codex-copilot-dx 0.6.4 → 0.6.6

package/README.md

@@ -111,7 +111,7 @@ active account or profile. GPT requests continue to use the bearer supplied by
 the current PM profile; exact enabled Anthropic model IDs use the isolated
 CCDX Claude profile. Neither credential is copied into the other application.
 
-The first recipe supports only an exact, unmodified PM Studio 2.9.7 bundle on
+The current patch recipe supports only an exact, unmodified PM Studio 2.9.7 bundle on
 macOS. Authorize the isolated Claude profile first, quit PM Studio and its
 updater, then run the one-time setup command:
 
@@ -120,14 +120,14 @@ ccdx auth login claude --reauth --github-login <personal-github-login>
 ccdx pms setup
 ```
 
-Inspect the installed version, exact patch integrity, isolated Claude profile,
-and relay without changing files:
+Inspect the installed version, exact patch manifest plus executable/signing
+integrity, isolated Claude profile, and live relay routing without changing files:
 
 ```bash
 ccdx pms status
 ```
 
-`pm-studio status` and `pm-studio setup` are equivalent long-form aliases.
+`ccdx pm-studio status` and `ccdx pm-studio setup` are equivalent long-form aliases.
 
 `ccdx pms setup` performs only local preflight, backup, staging, integrity,
 signing, and replacement work. It never starts Device Flow, the adapter,
@@ -187,13 +187,13 @@ To change the model used by Codex Auto-review, run:
 ccdx auto-review-model
 ```
 
-The selector reads the current adapter model list, falling back to the fresh local
-model cache, and offers only enabled models that advertise a Responses endpoint.
+The selector first queries the running adapter, including its last-known-good
+model list when live refresh is unavailable, then falls back to the non-expired
+local model cache. It offers only enabled models that advertise a Responses endpoint.
 It saves the selection in `~/.config/codex-copilot-dx/config.json` (or under
 `XDG_CONFIG_HOME` when set); choosing `gpt-5.5` clears the override and restores
-the package default. A running 0.5.1+
-adapter reads the setting on the next Auto-review request, so it does not need to
-be restarted.
+the package default. A running adapter reads the setting on the next Auto-review
+request, so it does not need to be restarted.
 
 To update the globally installed package, choose a source interactively:
 
@@ -213,26 +213,26 @@ ccdx update github
 The npm source installs `codex-copilot-dx@latest` through the registry already
 configured for npm, including a company mirror. The GitHub source installs the
 latest commit from `DaleXiao/codex-copilot-dx` `main` and opts in to Git fetching
-for that command, as required by npm 12. It does not change npm's persistent
-`allow-git` setting. Both paths use npm's global installer without shell
+for that command. It does not change npm's persistent `allow-git` setting. Both
+paths use npm's global installer without shell
 interpolation. A currently running adapter keeps its loaded version until it is
 stopped and started again.
 If a configured npm mirror has not synchronized the current release yet, use
 the GitHub source to install the current `main` revision.
 
-On first run, it will:
-1. Authenticate with GitHub via device flow (if needed), after first trying compatible local Copilot token sources
-2. Print the local package version and check for a newer npm release in the background
-3. Start the adapter on loopback (`127.0.0.1:2026`)
+On a normal launch, it will:
+1. Print the local package version and check for a newer npm release in the background
+2. Reuse a compatible running adapter when available; otherwise authenticate with GitHub if needed, after first trying compatible local Copilot token sources
+3. When starting a new adapter, refresh Copilot model metadata and listen on loopback (`127.0.0.1:2026`)
 4. Configure Codex (`~/.codex/config.toml`) to use the adapter, including stale shell env base URLs if present
 5. Configure Claude Code (`~/.claude/settings.json`) to use the adapter; it creates the file when missing, otherwise backs up `settings.json.bak` before updating the local API env keys
-6. Launch Codex Desktop
+6. On macOS, attempt to launch Codex or ChatGPT unless `CCDX_AUTO_LAUNCH` disables it
 
 Claude Code picks up the new `ANTHROPIC_BASE_URL` on its next launch.
 
-If an existing `codex-copilot-dx` adapter is already running on the configured host and port, a second launch reuses it instead of starting another proxy. The second launch still refreshes Codex and Claude Code config, then exits.
+If a compatible CCDX adapter is already running on the configured host and port, a second launch reuses it instead of starting another proxy. The second launch still refreshes Codex and Claude Code config, then exits.
 
-The running adapter reports its package and protocol versions. After upgrading `codex-copilot-dx`, stop the old process before starting the new version; the new CLI refuses to silently reuse an incompatible adapter.
+The running adapter reports its package and protocol versions. After upgrading the package, stop the old process before starting the new version; the new CLI refuses to silently reuse an incompatible adapter.
 
 Do not set Claude Code by manually exporting `ANTHROPIC_BASE_URL` or `ANTHROPIC_AUTH_TOKEN` in your shell. Let `ccdx` write the local config files instead. If you previously exported those variables, remove them from shell startup files and restart the terminal before launching Claude Code.
 
@@ -337,7 +337,7 @@ Environment variables:
 | `CCDX_REQUEST_BODY_TIMEOUT_MS` | `120000` | Maximum time to receive and decode one request body before returning `408` |
 | `CCDX_MAX_UPSTREAM_BODY_BYTES` | `31457280` | Strict maximum forwarded Responses body size; larger payloads are adapted locally or rejected with `413` |
 | `CCDX_MAX_SSE_BUFFER_BYTES` | `8388608` | Maximum buffered bytes for one unterminated upstream SSE line/event |
-| `CCDX_UPSTREAM_TIMEOUT_MS` | `120000` | Timeout for non-streaming upstream Copilot requests |
+| `CCDX_UPSTREAM_TIMEOUT_MS` | `120000` | Per-phase timeout for Responses preparation and non-streaming upstream Copilot requests |
 | `CCDX_STREAM_HANDSHAKE_TIMEOUT_MS` | `120000` | Timeout while waiting for upstream streaming response headers |
 | `CCDX_STREAM_IDLE_TIMEOUT_MS` | `120000` | Maximum idle time between upstream streaming body chunks |
 | `CCDX_UPSTREAM_RETRIES` | `2` | Retries for safe requests and clearly pre-connect POST failures; capped at `5` |
@@ -398,7 +398,7 @@ The final serialized UTF-8 request body is measured before forwarding. Above the
 
 Completed image transforms are reused from a byte-bounded process-local LRU cache, and concurrent requests for the same transform share one encode. The cache key includes source content, MIME type, model-aware dimensions, WebP quality, and encoder settings; failures are not cached and request cancellation remains isolated.
 
-Before image encoding, CCDX leaves ordinary visual history byte-for-byte unchanged while it has at most 24 historical images and the expanded body is at most 18 MiB. Above either threshold, the temporary upstream view keeps every current-turn image and at most 16 recent historical images, targeting 16 MiB. If that history tree then times out during local preparation or upstream handshake, the next retry automatically uses an 8-image, 10 MiB recovery window for ten minutes. Two successful requests or a successful compaction clear recovery mode. CCDX never transparently repeats the ambiguous timed-out POST, and no local history is deleted; retrying does not require restarting the service.
+Before image encoding, CCDX leaves ordinary visual history byte-for-byte unchanged while it has at most 24 historical images and the expanded body is at most 18 MiB. Above either threshold, the temporary upstream view keeps every current-turn image and at most 16 recent historical images, targeting 16 MiB. If that history tree then times out during local preparation, a streaming handshake, or a non-streaming upstream request, or if the upstream returns HTTP 408, the next retry automatically uses an 8-image, 10 MiB recovery window for ten minutes. Two successful requests or a successful compaction clear recovery mode. CCDX never transparently repeats the ambiguous timed-out POST, and no local history is deleted; retrying does not require restarting the service.
 
 When expanded Responses history exceeds Copilot's 50-image request limit, the adapter removes older duplicate image occurrences first, then keeps the 50 most recent images. This applies only to the forwarded request: local history remains complete, current images are preferred over older history, and requests at or below the limit are unchanged.
 

package/bin/cli.mjs

@@ -316,6 +316,7 @@ try {
     codexModelRegistry: profileModels.codexRegistry,
     claudeModelRegistry: profileModels.claudeRegistry,
     claudeMode: profileRuntime.claudeMode,
+    isClaudeProfileCurrent: profileRuntime.isClaudeProfileCurrent,
     showRequestId: CLI.showRequestId,
     upstreamTimeoutMs: RUNTIME.upstreamTimeoutMs,
     streamHandshakeTimeoutMs: RUNTIME.streamHandshakeTimeoutMs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "Use Codex Desktop, Claude Code, and Claude App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/scripts/benchmark.mjs

@@ -23,6 +23,14 @@ function runProbe(source) {
   return JSON.parse(result.stdout.trim());
 }
 
+function median(values) {
+  const ordered = [...values].sort((left, right) => left - right);
+  const middle = Math.floor(ordered.length / 2);
+  return ordered.length % 2 === 0
+    ? (ordered[middle - 1] + ordered[middle]) / 2
+    : ordered[middle];
+}
+
 function deterministicPixels(byteLength, initialSeed) {
   const pixels = Buffer.alloc(byteLength);
   let seed = initialSeed;
@@ -154,7 +162,7 @@ function largePayloadProbe(targetMiB, concurrency) {
 }
 
 function largeTokenCountProbe(mode) {
-  return runProbe(`
+  const samples = Array.from({ length: 3 }, () => runProbe(`
     const text = "a ".repeat(2 * 1024 * 1024);
     const started = performance.now();
     let tokens;
@@ -174,6 +182,51 @@ function largeTokenCountProbe(mode) {
       rss_mib: +(memory.rss / 1048576).toFixed(1),
       heap_used_mib: +(memory.heapUsed / 1048576).toFixed(1),
     }));
+  `));
+  return {
+    input_mib: samples[0].input_mib,
+    tokens: samples[0].tokens,
+    elapsed_ms: +median(samples.map((sample) => sample.elapsed_ms)).toFixed(1),
+    rss_mib: +median(samples.map((sample) => sample.rss_mib)).toFixed(1),
+    heap_used_mib: +median(samples.map((sample) => sample.heap_used_mib)).toFixed(1),
+    samples: samples.length,
+  };
+}
+
+function toolOutputParseCacheProbe() {
+  return runProbe(`
+    import { enforceResponsesImageLimit } from "./src/responses-image-limit.mjs";
+    import { responsesHistoricalImageStats } from "./src/responses-byte-budget.mjs";
+    import { prepareResponsesChatPayload } from "./src/responses-chat-payload.mjs";
+
+    const item = {
+      type: "function_call_output",
+      call_id: "call_benchmark",
+      output: JSON.stringify([{ type: "input_text", text: "x".repeat(8 * 1024 * 1024) }]),
+    };
+    const source = item.output;
+    const originalParse = JSON.parse;
+    let parseCalls = 0;
+    JSON.parse = function countedParse(value, ...args) {
+      if (value === source) parseCalls += 1;
+      return originalParse.call(this, value, ...args);
+    };
+    const started = performance.now();
+    try {
+      enforceResponsesImageLimit([item]);
+      responsesHistoricalImageStats([item], 1);
+      await prepareResponsesChatPayload({
+        body: { model: "gpt-4o", input: [item] },
+        currentInputStart: 1,
+      }, { payloadOptions: { maxBytes: 30 * 1024 * 1024 } });
+    } finally {
+      JSON.parse = originalParse;
+    }
+    process.stdout.write(JSON.stringify({
+      output_mib: +(Buffer.byteLength(source) / 1048576).toFixed(1),
+      parse_calls: parseCalls,
+      elapsed_ms: +(performance.now() - started).toFixed(1),
+    }));
   `);
 }
 
@@ -373,6 +426,7 @@ if (checkMode) {
     proxy: largeTokenCountProbe("proxy"),
     materialized_array: largeTokenCountProbe("array"),
   };
+  report.tool_output_parse_cache = toolOutputParseCacheProbe();
   report.large_payload_peak = [
     largePayloadProbe(5, 4),
     largePayloadProbe(30, 1),
@@ -409,6 +463,9 @@ if (checkMode) {
   if (proxy.heap_used_mib > array.heap_used_mib * 0.75) {
     failures.push(`token counter heap regression: proxy=${proxy.heap_used_mib}MiB array=${array.heap_used_mib}MiB`);
   }
+  if (report.tool_output_parse_cache.parse_calls !== 1) {
+    failures.push(`stringified tool output parsed ${report.tool_output_parse_cache.parse_calls} times instead of once`);
+  }
   for (const payload of report.large_payload_peak) {
     if (payload.admission_max_active_mib > payload.admission_budget_mib) {
       failures.push(`request admission exceeded its budget at ${payload.target_request_mib}MiB x${payload.concurrency}`);

package/src/adapter.mjs

@@ -215,6 +215,7 @@ export function createAdapterHandler(options = {}) {
         codexModelRegistry,
         claudeModelRegistry,
         claudeMode,
+        isClaudeProfileCurrent: options.isClaudeProfileCurrent,
       })));
       return;
     }
@@ -366,11 +367,9 @@ export function startAdapter(port = 2026, host = "127.0.0.1", options = {}) {
   server.once("close", cleanupTerminalActivity);
 
   server.on("upgrade", (req, socket) => {
-    // Codex Desktop 0.130+ negotiates a "responses_websockets" server-push
-    // protocol on WS upgrade. We don't implement that protocol; accepting the
-    // upgrade and waiting for a client request just hangs and triggers a
-    // 5-attempt reconnect storm. Refuse the upgrade so Codex falls back to
-    // plain HTTP SSE, which this adapter handles correctly.
+    // The responses_websockets upgrade expects a server-push protocol that this
+    // adapter does not implement. Refuse it so the client can fall back to the
+    // supported HTTP SSE transport instead of waiting on an unusable socket.
     socket.write("HTTP/1.1 426 Upgrade Required\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
     socket.destroy();
   });

package/src/auto-review-model.mjs

@@ -135,7 +135,7 @@ export async function runAutoReviewModelCommand({
   if (String(env.CCDX_AUTO_REVIEW_MODEL || "").trim()) {
     output.write(`CCDX_AUTO_REVIEW_MODEL=${current.model} remains the effective override until it is unset.\n`);
   } else {
-    output.write("The running 0.5.1+ adapter will use this model on the next Auto Review request.\n");
+    output.write("The running adapter will use this model on the next Auto Review request.\n");
   }
   return { ...result, cancelled: false, model: selectedModel };
 }

package/src/cli-auth.mjs

@@ -21,6 +21,7 @@ import {
   normalizeGithubIdentity,
 } from "./github-identity.mjs";
 import { saveModelCache } from "./model-cache.mjs";
+import { isClaudeCopilotModel } from "./models.mjs";
 import { profileRouting } from "./profile-routing.mjs";
 import { status } from "./status.mjs";
 
@@ -145,17 +146,7 @@ async function codexIdentity({ home, fetchImpl, signal }) {
 function claudeModels(payload) {
   const models = Array.isArray(payload) ? payload : payload?.data;
   if (!Array.isArray(models)) throw new Error("Claude account model catalog contained no model list");
-  return models.filter((model) => {
-    const id = String(model?.id || "").trim();
-    const vendor = String(model?.vendor || model?.owned_by || "").trim().toLowerCase();
-    const policy = String(model?.policy?.state || "").trim().toLowerCase();
-    const endpoints = Array.isArray(model?.supported_endpoints) ? model.supported_endpoints : [];
-    return Boolean(id)
-      && (id.toLowerCase().startsWith("claude-") || vendor === "anthropic")
-      && model?.model_picker_enabled === true
-      && (!policy || policy === "enabled")
-      && (endpoints.includes("/chat/completions") || endpoints.includes("/v1/messages"));
-  });
+  return models.filter(isClaudeCopilotModel);
 }
 
 function catalogModels(payload) {

package/src/cli-models.mjs

@@ -6,6 +6,10 @@ import {
   readAuthProfileCredentials,
 } from "./auth-profile.mjs";
 import { buildHeaders, DEFAULT_API_BASE, FALLBACK_VSCODE_VERSION } from "./copilot.mjs";
+import {
+  isClaudeCopilotCatalogEntry,
+  isClaudeCopilotModel,
+} from "./models.mjs";
 import { status } from "./status.mjs";
 
 const DEFAULT_MODELS_TIMEOUT_MS = 10000;
@@ -37,11 +41,15 @@ export function selectableCopilotModels(payload) {
   const models = [];
   const seen = new Set();
   for (const model of data) {
-    if (model?.model_picker_enabled !== true) continue;
-    const policyState = safeText(model?.policy?.state).toLowerCase();
-    if (policyState && policyState !== "enabled") continue;
-    const capabilityType = safeText(model?.capabilities?.type).toLowerCase();
-    if (capabilityType && capabilityType !== "chat") continue;
+    if (isClaudeCopilotCatalogEntry(model)) {
+      if (!isClaudeCopilotModel(model)) continue;
+    } else {
+      if (model?.model_picker_enabled !== true) continue;
+      const policyState = safeText(model?.policy?.state).toLowerCase();
+      if (policyState && policyState !== "enabled") continue;
+      const capabilityType = safeText(model?.capabilities?.type).toLowerCase();
+      if (capabilityType && capabilityType !== "chat") continue;
+    }
 
     const id = safeText(model?.id);
     const endpoints = endpointLabels(model);
@@ -163,8 +171,7 @@ export function formatLiveCopilotModels(catalog, { commandName = "ccdx" } = {})
   const profile = catalog?.profile === AUTH_PROFILE_CLAUDE ? AUTH_PROFILE_CLAUDE : AUTH_PROFILE_CODEX;
   const responses = models.filter((model) => model.endpoints.includes("responses")).length;
   const chat = models.filter((model) => model.endpoints.includes("chat")).length;
-  const claude = models.filter((model) => model.id.toLowerCase().startsWith("claude-")
-    || model.vendor.toLowerCase() === "anthropic").length;
+  const claude = models.filter(isClaudeCopilotCatalogEntry).length;
   const lines = [
     `${commandName} models${profile === AUTH_PROFILE_CLAUDE ? " --profile claude" : ""}`,
     status("ok", `Live catalog from ${safeText(catalog?.upstreamHost, "GitHub Copilot")}: ${models.length} selectable of ${Number(catalog?.advertised) || 0} advertised`),

package/src/cli-options.mjs

@@ -258,7 +258,7 @@ export function cliCommandName() {
 
 function topicHelp(name, topic) {
   const sections = {
-    start: `Usage:\n  ${name} [start] [--configure-claude-app] [--show-request-id]\n\nStarts or reuses the local adapter, updates Codex and Claude Code configuration, and opens Codex.\n--configure-claude-app also creates or updates the managed Claude App gateway profile.`,
+    start: `Usage:\n  ${name} [start] [--configure-claude-app] [--show-request-id]\n\nStarts or reuses the local adapter, updates Codex and Claude Code configuration, and attempts to open Codex or ChatGPT when auto-launch is enabled and supported.\n--configure-claude-app also creates or updates the managed Claude App gateway profile.`,
     auth: `Usage:\n  ${name} auth status [--online]\n  ${name} auth login claude [--github-login <login>] [--reauth]\n\nShows the two account profiles or configures the isolated Claude account. Device login starts only when no reusable local Copilot credential is available or --reauth is used.`,
     "auth status": `Usage:\n  ${name} auth status [--online]\n\nShows account routing without exposing credentials. --online also verifies both configured Copilot entitlements and model catalogs.`,
     "auth login": `Usage:\n  ${name} auth login claude [--github-login <login>] [--reauth]\n\nReuses a compatible local Copilot credential when possible. --reauth forces GitHub Device Flow.`,

package/src/copilot-client.mjs

@@ -150,6 +150,7 @@ export function createCopilotClientRuntime({
   }
 
   async function responses(reqBody, {
+    assertActive,
     signal,
     fetchImpl,
     retryOptions,
@@ -160,13 +161,14 @@ export function createCopilotClientRuntime({
   } = {}) {
     const token = await tokenSession.getToken({ signal });
     const preparedPayload = await prepareResponsesPayload(reqBody, {
+      assertActive,
       ...payloadOptions,
       currentInputStart,
       profiles: payloadPrepared ? [] : payloadOptions.profiles,
       skipInitialOptimization: payloadPrepared || payloadOptions.skipInitialOptimization,
       signal,
     });
-    const finalizedPayload = enforceResponsesPayloadByteBudget(reqBody, preparedPayload);
+    const finalizedPayload = enforceResponsesPayloadByteBudget(reqBody, preparedPayload, { assertActive });
     const { bodyText, bodyBytes, stage, adapted } = finalizedPayload;
     const summary = finalizedPayload.stage === preparedPayload.stage
       ? preparedPayload.summary

package/src/doctor.mjs

@@ -12,7 +12,7 @@ import { claudeDesktopPaths } from "./claude-desktop-config.mjs";
 import { status } from "./status.mjs";
 import { buildHeaders, DEFAULT_API_BASE, FALLBACK_VSCODE_VERSION } from "./copilot.mjs";
 import { adapterBaseUrl, checkRunningAdapter } from "./running-adapter.mjs";
-import { CODEX_AUTO_REVIEW_MODEL } from "./models.mjs";
+import { CODEX_AUTO_REVIEW_MODEL, isClaudeCopilotModel } from "./models.mjs";
 import { loadModelCache } from "./model-cache.mjs";
 
 function localGatewayBaseUrl(host, port) {
@@ -66,7 +66,7 @@ function modelEndpoints(model) {
 
 export function selectCompatibilityModels(models, { claudeModels = models } = {}) {
   const data = copilotModelData(models).filter((model) => model?.model_picker_enabled !== false);
-  const claudeData = copilotModelData(claudeModels).filter((model) => model?.model_picker_enabled !== false);
+  const claudeData = copilotModelData(claudeModels);
   const responsesCandidates = data.filter((model) => {
     const id = String(model?.id || "");
     const endpoints = modelEndpoints(model);
@@ -74,12 +74,7 @@ export function selectCompatibilityModels(models, { claudeModels = models } = {}
   });
   const responsesOnly = [...responsesCandidates].reverse()
     .find((model) => !modelEndpoints(model).includes("/chat/completions"));
-  const claude = claudeData.find((model) => {
-    const id = String(model?.id || "");
-    const vendor = String(model?.vendor || "").toLowerCase();
-    return (id.startsWith("claude-") || vendor === "anthropic")
-      && modelEndpoints(model).includes("/chat/completions");
-  });
+  const claude = claudeData.find(isClaudeCopilotModel);
   return {
     responsesModel: String((responsesOnly || responsesCandidates[0])?.id || ""),
     claudeModel: String(claude?.id || ""),
@@ -588,6 +583,12 @@ export async function collectDoctorChecks({
       }
       if (!pm.adapter?.ok) {
         checks.push({ kind: "warn", message: "PM Studio relay is not currently available", fix: "ccdx start" });
+      } else if (!pm.runtime?.ok) {
+        checks.push({
+          kind: "warn",
+          message: "PM Studio relay is running, but its isolated routing is not ready",
+          fix: "stop the running adapter, then run ccdx start",
+        });
       }
     } else if (pm.app.state === "clean") {
       checks.push({

package/src/http-transport.mjs

@@ -47,29 +47,56 @@ function admissionAbortError(signal) {
   return error;
 }
 
-function createSupplementalAdmission({ maxWeight, maxQueued, waitTimeoutMs, label }) {
+function createSupplementalAdmission({ maxWeight, maxQueued, waitTimeoutMs, label, blockBehindExclusive = false }) {
   const queue = [];
   let activeWeight = 0;
+  let activeRequestedWeight = 0;
   let activeRequests = 0;
 
   const activate = (entry) => {
     entry.cleanup();
     activeWeight += entry.weight;
+    activeRequestedWeight += entry.requestedWeight;
     activeRequests += 1;
     let released = false;
-    entry.resolve(() => {
+    const release = () => {
       if (released) return;
       released = true;
       activeWeight = Math.max(0, activeWeight - entry.weight);
+      activeRequestedWeight = Math.max(0, activeRequestedWeight - entry.requestedWeight);
       activeRequests = Math.max(0, activeRequests - 1);
       drain();
+    };
+    release.resize = (requestedWeight) => {
+      if (released) return 0;
+      const parsedWeight = Number.isFinite(requestedWeight) && requestedWeight > 0
+        ? Math.ceil(requestedWeight)
+        : maxWeight;
+      const requested = Math.max(1, parsedWeight);
+      const weight = Math.min(requested, maxWeight);
+      if (weight > entry.weight) {
+        throw new RangeError(`${label} admission weight cannot grow`);
+      }
+      activeWeight = Math.max(0, activeWeight - (entry.weight - weight));
+      activeRequestedWeight = Math.max(0, activeRequestedWeight + requested - entry.requestedWeight);
+      entry.weight = weight;
+      entry.requestedWeight = requested;
+      drain();
+      return weight;
+    };
+    Object.defineProperties(release, {
+      weight: { get: () => released ? 0 : entry.weight },
+      requestedWeight: { get: () => released ? 0 : entry.requestedWeight },
+      maxWeight: { value: maxWeight },
     });
+    entry.resolve(release);
   };
 
   const drain = () => {
     for (let index = 0; index < queue.length;) {
       const entry = queue[index];
       if (activeWeight + entry.weight > maxWeight) {
+        if (blockBehindExclusive && entry.weight === maxWeight) break;
         index += 1;
         continue;
       }
@@ -83,8 +110,12 @@ function createSupplementalAdmission({ maxWeight, maxQueued, waitTimeoutMs, labe
     const parsedWeight = Number.isFinite(requestedWeight) && requestedWeight > 0
       ? Math.ceil(requestedWeight)
       : maxWeight;
-    const weight = Math.max(1, Math.min(parsedWeight, maxWeight));
-    if (queue.length >= maxQueued && activeWeight + weight > maxWeight) {
+    const requested = Math.max(1, parsedWeight);
+    const weight = Math.min(requested, maxWeight);
+    const blockedByExclusive = blockBehindExclusive
+      && queue.some((entry) => entry.weight === maxWeight);
+    const mustWait = blockedByExclusive || activeWeight + weight > maxWeight;
+    if (queue.length >= maxQueued && mustWait) {
       return Promise.reject(httpError(`${label} queue is full (${maxQueued} waiting)`, 503));
     }
 
@@ -92,6 +123,7 @@ function createSupplementalAdmission({ maxWeight, maxQueued, waitTimeoutMs, labe
       let timer;
       const entry = {
         weight,
+        requestedWeight: requested,
         resolve,
         cleanup: () => {
           if (timer) clearTimeout(timer);
@@ -120,7 +152,13 @@ function createSupplementalAdmission({ maxWeight, maxQueued, waitTimeoutMs, labe
     });
   };
 
-  acquire.stats = () => ({ activeWeight, activeRequests, queued: queue.length, maxWeight });
+  acquire.stats = () => ({
+    activeWeight,
+    activeRequestedWeight,
+    activeRequests,
+    queued: queue.length,
+    maxWeight,
+  });
   return acquire;
 }
 
@@ -143,6 +181,7 @@ export function createRequestAdmission({
     maxQueued: queueLimit,
     waitTimeoutMs: timeoutMs,
     label: "Decoded request body",
+    blockBehindExclusive: true,
   });
   const acquireResponseHistory = createSupplementalAdmission({
     maxWeight: byteLimit,
@@ -194,10 +233,30 @@ export function createRequestAdmission({
         releaseSupplemental();
         throw admissionAbortError(options?.signal);
       }
-      supplementalReleases.add(releaseSupplemental);
+      let supplementalReleased = false;
+      const releaseReservation = () => {
+        if (supplementalReleased) return;
+        supplementalReleased = true;
+        supplementalReleases.delete(releaseReservation);
+        releaseSupplemental();
+      };
+      releaseReservation.resize = (nextWeight) => {
+        if (supplementalReleased) return 0;
+        return releaseSupplemental.resize(nextWeight);
+      };
+      Object.defineProperties(releaseReservation, {
+        weight: { get: () => supplementalReleased ? 0 : releaseSupplemental.weight },
+        requestedWeight: {
+          get: () => supplementalReleased ? 0 : releaseSupplemental.requestedWeight,
+        },
+        maxWeight: { value: releaseSupplemental.maxWeight },
+      });
+      supplementalReleases.add(releaseReservation);
+      return releaseReservation;
     };
     release.acquireDecompression = (options) => acquireDecompression(1, options);
     release.reserveDecodedBody = (bytes, options) => reserve(acquireDecodedBody, bytes, options);
+    release.reserveDecodedBody.supportsResize = true;
     release.reserveResponseHistory = (bytes, options) => reserve(acquireResponseHistory, bytes, options);
     entry.resolve(release);
   };
@@ -285,7 +344,8 @@ export function createRequestAdmission({
     waitMsMax: counters.waitMsMax,
     decompressionsActive: acquireDecompression.stats().activeRequests,
     decompressionsQueued: acquireDecompression.stats().queued,
-    decodedBodyBytes: acquireDecodedBody.stats().activeWeight,
+    decodedBodyBytes: acquireDecodedBody.stats().activeRequestedWeight,
+    decodedBodyAdmissionBytes: acquireDecodedBody.stats().activeWeight,
     decodedBodiesActive: acquireDecodedBody.stats().activeRequests,
     decodedBodiesQueued: acquireDecodedBody.stats().queued,
     responseHistoryBytes: acquireResponseHistory.stats().activeWeight,
@@ -445,21 +505,62 @@ export async function readJsonBody(req, {
     return parseRequestJson(await readIdentityText(req, maxBodyBytes, maxDecodedBodyBytes, signal));
   }
   const buffer = await readRequestBuffer(req, maxBodyBytes, signal);
-  const releaseDecompression = await admission?.acquireDecompression?.({ signal }) || (() => {});
+  let releaseDecompression = () => {};
+  let decodedReservation;
+  let retainDecodedReservation = false;
   try {
     let decoded;
+    const supportsResizableReservation = admission?.reserveDecodedBody?.supportsResize === true;
+    // Most compressed bodies fit the existing 4x admission estimate. High-ratio bodies retry
+    // only after obtaining the pool's exclusive reservation, so a full decoded body never waits
+    // outside the decoded-body budget.
+    const estimatedDecodedBytes = Math.max(
+      1,
+      Math.min(buffer.length * COMPRESSED_BODY_WEIGHT_MULTIPLIER, maxDecodedBodyBytes),
+    );
+    if (supportsResizableReservation) {
+      decodedReservation = await admission.reserveDecodedBody(estimatedDecodedBytes, { signal });
+    }
+    releaseDecompression = await admission?.acquireDecompression?.({ signal }) || (() => {});
+    const reservedBytes = decodedReservation?.requestedWeight;
+    const reservedAdmissionBytes = decodedReservation?.weight;
+    const decodedPoolBytes = decodedReservation?.maxWeight;
+    const tentativeDecodeLimit = Number.isFinite(reservedBytes)
+      && Number.isFinite(reservedAdmissionBytes)
+      && Number.isFinite(decodedPoolBytes)
+      && reservedAdmissionBytes < decodedPoolBytes
+      ? Math.min(reservedBytes, maxDecodedBodyBytes)
+      : maxDecodedBodyBytes;
     try {
-      decoded = await decodeRequestBuffer(buffer, req.headers?.["content-encoding"], maxDecodedBodyBytes);
+      decoded = await decodeRequestBuffer(buffer, req.headers?.["content-encoding"], tentativeDecodeLimit);
     } catch (e) {
-      if (e?.statusCode) throw e;
-      throw httpError(`Invalid compressed request body: ${e.message}`, 400);
+      if (e?.statusCode === 413 && tentativeDecodeLimit < maxDecodedBodyBytes && supportsResizableReservation) {
+        releaseDecompression();
+        releaseDecompression = () => {};
+        decodedReservation();
+        decodedReservation = await admission.reserveDecodedBody(maxDecodedBodyBytes, { signal });
+        releaseDecompression = await admission.acquireDecompression?.({ signal }) || (() => {});
+        try {
+          decoded = await decodeRequestBuffer(buffer, req.headers?.["content-encoding"], maxDecodedBodyBytes);
+        } catch (retryError) {
+          if (retryError?.statusCode) throw retryError;
+          throw httpError(`Invalid compressed request body: ${retryError.message}`, 400);
+        }
+      } else {
+        if (e?.statusCode) throw e;
+        throw httpError(`Invalid compressed request body: ${e.message}`, 400);
+      }
     }
     if (signal?.aborted) throw admissionAbortError(signal);
     if (decoded.length > 0) {
-      await admission?.reserveDecodedBody?.(decoded.length, { signal });
+      if (supportsResizableReservation) decodedReservation.resize(decoded.length);
+      else decodedReservation = await admission?.reserveDecodedBody?.(decoded.length, { signal });
     }
-    return parseRequestJson(decoded.toString("utf8"));
+    const parsed = parseRequestJson(decoded.toString("utf8"));
+    retainDecodedReservation = true;
+    return parsed;
   } finally {
+    if (!retainDecodedReservation) decodedReservation?.();
     releaseDecompression();
   }
 }