@yansigit/opencodex 2.33.1 → 2.35.0

package/src/server/request-log-conversation.ts

@@ -73,6 +73,27 @@ export function inboundClientThreadIdFromRequest(headers: Headers): string | und
   );
 }
 
+/**
+ * Fixed-size logical turn lane (#820).
+ *
+ * A lane must be as SPECIFIC as the identity available, which is the opposite of what
+ * `codexPoolAffinityKey` wants. Affinity deliberately prefers the parent thread so a whole
+ * subagent fan-out pins to one account; a lane keyed that way would put every parallel
+ * subagent of one parent into a single lane and reject all but the first with 503 — the
+ * fan-out is the normal case, not an abuse.
+ *
+ * So the parent is a QUALIFIER, never the lane on its own when a child thread exists: the
+ * pair separates siblings while still keeping one conversation's overlapping turns together.
+ */
+export function sessionLaneIdFromRequest(headers: Headers): string | undefined {
+  const parent = normalizeLogConversationId(headers.get("x-codex-parent-thread-id"));
+  const thread = normalizeLogConversationId(headers.get("thread-id"));
+  const session = normalizeLogConversationId(sessionIdHeaderFromRequest(headers));
+  const specific = thread ?? session;
+  if (parent && specific) return `${parent}\u0000${specific}`;
+  return specific ?? parent;
+}
+
 function firstSanitizedConversationId(
   ...values: Array<string | null | undefined>
 ): string | undefined {

package/src/server/request-log.ts

@@ -6,6 +6,7 @@ import {
   httpStatusFromTerminalError as httpStatusFromClassifiedTerminalError,
   isClientClosedMessage,
   isCyberPolicyCode,
+  isCyberPolicyMessage,
 } from "../lib/errors";
 import { CODEX_CONFIG_PATH, readRootTomlString } from "../codex/paths";
 import { readCodexCatalogPath } from "../codex/catalog";
@@ -19,7 +20,7 @@ import {
   isKnownAdmissionKind,
   isKnownInboundProtocol,
   isKnownUsageSurface,
-  isCodexUsageAccountLogLabel,
+  isPersistableAccountLogLabel,
   isValidReasoningWireValue,
   readRecentUsageEntries,
   usageForFinalLog,
@@ -65,6 +66,8 @@ export interface RequestLogContext {
   /** Stable non-PII Codex Pool account identity for durable usage attribution. */
   accountLogLabel?: string;
   requestedModel?: string;
+  /** User-facing alias selector when routing resolved one; native model remains `model`. */
+  requestedAlias?: string;
   /** Original bare helper model when the opt-in shadow-call route rewrote this request. */
   shadowCallRewrittenFrom?: string;
   /** Internal structural combo identity; omitted from RequestLogEntry/JSONL. */
@@ -144,6 +147,7 @@ export interface RequestLogEntry {
   /** Best-effort chat/session correlation for Logs grouping (#330). */
   conversationId?: string;
   requestedModel?: string;
+  requestedAlias?: string;
   /** Original bare helper model when the opt-in shadow-call route rewrote this request. */
   shadowCallRewrittenFrom?: string;
   requestedEffort?: string;
@@ -255,10 +259,11 @@ export function requestLogEntryFromPersistedUsage(entry: PersistedUsageEntry): R
     ...(entry.firstOutputMs !== undefined ? { firstOutputMs: entry.firstOutputMs } : {}),
     ...(isKnownUsageSurface(entry.surface) ? { surface: entry.surface } : {}),
     ...(entry.conversationId ? { conversationId: entry.conversationId } : {}),
-    ...(isCodexUsageAccountLogLabel(entry.accountLogLabel)
+    ...(isPersistableAccountLogLabel(entry.accountLogLabel)
       ? { accountLogLabel: entry.accountLogLabel }
       : {}),
     ...(entry.requestedModel ? { requestedModel: entry.requestedModel } : {}),
+    ...(entry.requestedAlias ? { requestedAlias: entry.requestedAlias } : {}),
     ...(entry.shadowCallRewrittenFrom
       ? { shadowCallRewrittenFrom: entry.shadowCallRewrittenFrom }
       : {}),
@@ -373,12 +378,13 @@ export function addRequestLog(entry: RequestLogEntry) {
       ...(entry.apiKeyId ? { apiKeyId: entry.apiKeyId } : {}),
       ...(isKnownAdmissionKind(entry.admissionKind) ? { admissionKind: entry.admissionKind } : {}),
       ...(isKnownInboundProtocol(entry.inboundProtocol) ? { inboundProtocol: entry.inboundProtocol } : {}),
-      ...(isCodexUsageAccountLogLabel(entry.accountLogLabel)
+      ...(isPersistableAccountLogLabel(entry.accountLogLabel)
         ? { accountLogLabel: entry.accountLogLabel }
         : {}),
       ...(entry.conversationId ? { conversationId: entry.conversationId } : {}),
       ...(entry.resolvedModel ? { resolvedModel: entry.resolvedModel } : {}),
       ...(entry.requestedModel ? { requestedModel: entry.requestedModel } : {}),
+      ...(entry.requestedAlias ? { requestedAlias: entry.requestedAlias } : {}),
       ...(entry.shadowCallRewrittenFrom
         ? { shadowCallRewrittenFrom: entry.shadowCallRewrittenFrom }
         : {}),
@@ -765,7 +771,7 @@ function captureUpstreamErrorParsed(
       last_error?: { message?: unknown };
       response?: {
         error?: { type?: unknown; code?: unknown; message?: unknown };
-        incomplete_details?: { reason?: unknown };
+        incomplete_details?: { reason?: unknown; message?: unknown };
       };
     };
     captureTerminalHttpStatus(logCtx, json);
@@ -779,7 +785,8 @@ function captureUpstreamErrorParsed(
     if (logCtx.upstreamError) return;
     const message = json?.error?.message
       ?? json?.last_error?.message
-      ?? json?.response?.error?.message;
+      ?? json?.response?.error?.message
+      ?? json?.response?.incomplete_details?.message;
     if (typeof message === "string" && message.trim()) {
       logCtx.upstreamError = redactSecretString(message).slice(0, 500);
       return;
@@ -818,25 +825,43 @@ function captureTerminalHttpStatus(
   logCtx: RequestLogContext,
   json: {
     type?: unknown;
-    response?: { error?: { type?: unknown; code?: unknown; message?: unknown } };
+    code?: unknown;
+    message?: unknown;
+    error?: { type?: unknown; code?: unknown; message?: unknown };
+    last_error?: { type?: unknown; code?: unknown; message?: unknown };
+    response?: {
+      error?: { type?: unknown; code?: unknown; message?: unknown };
+      incomplete_details?: { code?: unknown; message?: unknown };
+    };
   },
 ): void {
   if (logCtx.terminalHttpStatus !== undefined) return;
-  if (json.type !== "response.failed") return;
-  const error = json.response?.error;
-  if (!error || typeof error !== "object") return;
-  const terminalCode = error.code === null || typeof error.code === "string"
-    ? error.code
-    : undefined;
-  if (isCyberPolicyCode(terminalCode)) {
+  const type = json.type;
+  if (type !== "response.failed" && type !== "response.incomplete" && type !== "error") return;
+  const responseError = json.response?.error;
+  const responseDetails = json.response?.incomplete_details;
+  const candidates = [json.error, json.last_error, responseError, responseDetails, json];
+  const policy = candidates.some(candidate => (
+    candidate?.code === null || typeof candidate?.code === "string"
+  ) && isCyberPolicyCode(candidate.code as string | null | undefined))
+    || candidates.some(candidate => (
+      typeof candidate?.message === "string"
+      && candidate.message.trim().length > 0
+      && isCyberPolicyMessage(candidate.message)
+    ));
+  if (policy) {
     logCtx.terminalErrorCode = CYBER_POLICY_ERROR_CODE;
-  } else {
-    delete logCtx.terminalErrorCode;
+    logCtx.terminalHttpStatus = 400;
+    return;
   }
+  if (type !== "response.failed" || !responseError || typeof responseError !== "object") return;
+  const responseCode = responseError.code === null || typeof responseError.code === "string"
+    ? responseError.code
+    : undefined;
   logCtx.terminalHttpStatus = httpStatusFromTerminalError({
-    type: typeof error.type === "string" ? error.type : undefined,
-    code: terminalCode,
-    message: typeof error.message === "string" ? error.message : undefined,
+    type: typeof responseError.type === "string" ? responseError.type : undefined,
+    code: responseCode,
+    message: typeof responseError.message === "string" ? responseError.message : undefined,
   });
 }
 
@@ -945,11 +970,12 @@ export function addFinalRequestLog(
     ...(logCtx.apiKeyId ? { apiKeyId: logCtx.apiKeyId } : {}),
     ...(logCtx.admissionKind ? { admissionKind: logCtx.admissionKind } : {}),
     ...(logCtx.inboundProtocol ? { inboundProtocol: logCtx.inboundProtocol } : {}),
-    ...(isCodexUsageAccountLogLabel(logCtx.accountLogLabel)
+    ...(isPersistableAccountLogLabel(logCtx.accountLogLabel)
       ? { accountLogLabel: logCtx.accountLogLabel }
       : {}),
     ...(logCtx.conversationId ? { conversationId: logCtx.conversationId } : {}),
     ...(logCtx.requestedModel ? { requestedModel: logCtx.requestedModel } : {}),
+    ...(logCtx.requestedAlias ? { requestedAlias: logCtx.requestedAlias } : {}),
     ...(shadowCallRewrittenFrom ? { shadowCallRewrittenFrom } : {}),
     ...(logCtx.requestedEffort ? { requestedEffort: logCtx.requestedEffort } : {}),
     ...(logCtx.effectiveEffort ? { effectiveEffort: logCtx.effectiveEffort } : {}),
@@ -1170,7 +1196,7 @@ export function sealRequestAttemptIdentity(
   if (!attempt) return;
   attempt.provider = provider;
   attempt.adapter = adapter;
-  if (isCodexUsageAccountLogLabel(accountLogLabel)) attempt.accountLogLabel = accountLogLabel;
+  if (isPersistableAccountLogLabel(accountLogLabel)) attempt.accountLogLabel = accountLogLabel;
 }
 
 export function noteAttemptSend(

package/src/server/responses/collaboration.ts

@@ -2,6 +2,7 @@ import type { Server } from "bun";
 import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type ResponsesTerminalStatus } from "../../bridge";
 import {
   getConfigPath,
+  loadConfig,
   multiAgentGuidanceEnabled,
   resolveEnvValue,
 } from "../../config";
@@ -10,6 +11,7 @@ import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractC
 import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../../adapters/openai-responses";
 import { expandPreviousResponseInput, previousResponseProviderState, rememberResponseState } from "../../responses/state";
 import { routeModel } from "../../router";
+import type { RawEntry } from "../../codex/catalog/parsing";
 import {
   advanceComboAfterFailure,
   comboDefaultEffort,
@@ -245,15 +247,47 @@ export async function resolveEffectiveSubagentRoster(
   surface: SpawnAgentSurface,
 ): Promise<EffectiveSubagentRoster> {
   const { effectiveSubagentRoster } = await import("../../codex/catalog");
-  return effectiveSubagentRoster(configuredModels, surface);
+  return effectiveSubagentRoster(configuredModels, surface, await freshSubagentCatalogEntries());
+}
+
+/**
+ * The persisted Codex catalog, with native context metadata re-derived from the CURRENT config.
+ *
+ * The subagent roster reads the catalog FILE, which is only as fresh as the last sync. A row
+ * written before the operator widened the native window keeps its old `context_window`, so a
+ * child was planning and compacting against a narrower budget than its parent — measured at
+ * 272,000 x 95% = 258,400 while the request path resolved 922,000 (#2574).
+ *
+ * Re-applying the override is cheap and idempotent: it is the same function the writer uses,
+ * so a fresh catalog is unchanged and a stale one is repaired in memory rather than silently
+ * believed. It does not rewrite the file — the row on disk stays whatever the last sync wrote,
+ * and `ocx sync` remains what refreshes it.
+ */
+async function freshSubagentCatalogEntries(): Promise<RawEntry[]> {
+  const { readCatalog, readCodexCatalogPath, nativeContextLimits } = await import("../../codex/catalog");
+  const { applyNativeOpenAiContextOverride } = await import("../../codex/catalog/parsing");
+  const entries = readCatalog(readCodexCatalogPath())?.models ?? [];
+  if (entries.length === 0) return [];
+  let limits: ReturnType<typeof nativeContextLimits>;
+  try {
+    limits = nativeContextLimits(loadConfig());
+  } catch {
+    // An unreadable config must not cost the caller its roster; serve the file as written.
+    return entries;
+  }
+  return entries.map(entry => {
+    const clone = { ...entry };
+    applyNativeOpenAiContextOverride(clone, limits);
+    return clone;
+  });
 }
 
 /** Reuse one parsed catalog snapshot across every roster projection for this request. */
 async function createRequestScopedSubagentRosterResolver(): Promise<NonNullable<
   MultiAgentGuidanceDeps["resolveEffectiveSubagentRoster"]
 >> {
-  const { effectiveSubagentRoster, readCatalog, readCodexCatalogPath } = await import("../../codex/catalog");
-  const catalogEntries = readCatalog(readCodexCatalogPath())?.models ?? [];
+  const { effectiveSubagentRoster } = await import("../../codex/catalog");
+  const catalogEntries = await freshSubagentCatalogEntries();
   return (configuredModels, surface) =>
     effectiveSubagentRoster(configuredModels, surface, catalogEntries);
 }
@@ -390,7 +424,10 @@ export async function multiAgentGuidanceText(
       + "use only models listed for this collaboration surface. "
       + "When setting either override, set fork_turns to \"none\" "
       + "(or a positive turn count such as \"3\"; full-history forks reject overrides) "
-      + "and make the task message self-contained.";
+      + "and make the task message self-contained. "
+      + "When specifying model overrides, omit agent_type or use \"worker\" to prevent enforcing locked default models. "
+      + "Subagent exec runs in a pure V8 isolate without require('fs'); "
+      + "escape nested template literals in tools.apply_patch to prevent JavaScript syntax errors (e.g., write \\` and \\\${var}).";
     let preferredText = "";
     if (preferred) {
       preferredText = ` Preferred sub-agent: model "${preferred.model}"`
@@ -426,7 +463,7 @@ export async function multiAgentGuidanceText(
 
 
 
-export const V2_GUIDANCE_CHAR_BUDGET = 700;
+export const V2_GUIDANCE_CHAR_BUDGET = 1200;
 
 export function applyInjectionPlaceholders(prompt: string, model?: string, effort?: string, roster?: string, fallback?: string, roles?: string): string {
   return prompt

package/src/server/responses/combo-stream-preflight.ts

@@ -4,6 +4,12 @@ import { createSseInspector } from "../relay";
 import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 
 const COMBO_STREAM_PREFLIGHT_MAX_BYTES = MAX_CLIENT_SSE_FRAME_BYTES;
+// Keep retained object count proportional to the same byte budget used by the
+// shared SSE framer. Tiny or empty upstream reads must not bypass the byte cap.
+const COMBO_STREAM_PREFLIGHT_MAX_CHUNKS = Math.max(
+  1,
+  Math.ceil(COMBO_STREAM_PREFLIGHT_MAX_BYTES / 1024),
+);
 
 const PRE_OUTPUT_CONTROL_EVENTS = new Set([
   "response.created",
@@ -105,8 +111,8 @@ export type ComboStreamPreflightResult =
 /**
  * Buffer a combo child's downstream SSE only until the request becomes unsafe to
  * replay or reaches a terminal. This owns exactly one body reader. The aggregate
- * buffer is capped; hitting the cap commits the current target instead of growing
- * memory or guessing that replay is safe.
+ * buffer is capped by bytes and retained chunks; hitting either cap commits the
+ * current target instead of growing memory or guessing that replay is safe.
  */
 export async function preflightComboStreamResponse(
   response: Response,
@@ -161,7 +167,8 @@ export async function preflightComboStreamResponse(
         return { kind: "failed", response: failedTerminalResponse(response, failedPayload, logCtx) };
       }
       if (next.done || terminalStatus !== undefined || outputCommitted
-        || bufferedBytes >= COMBO_STREAM_PREFLIGHT_MAX_BYTES) {
+        || bufferedBytes >= COMBO_STREAM_PREFLIGHT_MAX_BYTES
+        || buffered.length >= COMBO_STREAM_PREFLIGHT_MAX_CHUNKS) {
         return { kind: "accepted", response: replayBufferedResponse(response, reader, buffered) };
       }
     }