fix(combos): hop on a definite zero-output context overflow

docs-site/src/content/docs/guides/combos.md

@@ -83,7 +83,10 @@ The request then follows normal combo selection and failover.
 
 Explicit provider/combo selectors and configured combo aliases take precedence over this recall.
 Failed, incomplete, or cancelled responses do not replace the last successful selection. Recall is
-process-local and bounded to 256 lanes for 30 minutes; it does not store account credentials.
+process-local and bounded to 256 conversations for 30 minutes, and to 1 KiB per remembered model
+name and 64 KiB in total; expired entries are also cleaned up in the background. A response whose
+model name is too large to retain leaves the previous selection untouched rather than clearing it.
+Recall does not store account credentials.
 Without usable conversation identity or valid remembered state, normal compaction routing applies.
 A restart clears the remembered state.
 

docs-site/src/content/docs/ko/guides/combos.md

@@ -66,7 +66,7 @@ alias는 클라이언트가 요청하는 공개 이름만 바꿉니다. 콤보
 
 클라이언트가 콤보를 바꾼 뒤 공급자 접두사 없는 모델 이름으로 압축을 요청하면, opencodex는 같은 대화에서 가장 최근에 응답을 성공적으로 마친 콤보를 기억해 사용할 수 있습니다. 모델 이름이 완료된 응답과 일치하고, 현재 설정에 해당 콤보와 대상이 남아 있어야 합니다. 압축 요청도 일반 콤보 선택과 페일오버를 따릅니다.
 
-명시한 공급자·콤보 선택자와 설정된 콤보 별칭이 기억한 값보다 우선합니다. 실패·미완료·취소된 응답은 마지막 성공 기록을 덮어쓰지 않습니다. 기록은 프로세스 안에서 최대 256개 대화, 30분 동안 유지하며 계정 자격증명을 저장하지 않습니다. 유효한 대화 식별자나 기록이 없으면 일반 압축 라우팅을 사용합니다. 재시작하면 기록은 사라집니다.
+명시한 공급자·콤보 선택자와 설정된 콤보 별칭이 기억한 값보다 우선합니다. 실패·미완료·취소된 응답은 마지막 성공 기록을 덮어쓰지 않습니다. 기록은 프로세스 안에서 최대 256개 대화, 30분 동안 유지하고, 모델 이름 하나당 1 KiB·전체 64 KiB로 제한하며, 만료된 기록은 배경에서도 정리합니다. 모델 이름이 너무 커서 보관할 수 없는 응답은 이전 선택을 지우지 않고 그대로 둡니다. 기록은 계정 자격증명을 저장하지 않습니다. 유효한 대화 식별자나 기록이 없으면 일반 압축 라우팅을 사용합니다. 재시작하면 기록은 사라집니다.
 
 ## 전략 선택
 

src/combos/failover.ts

@@ -401,11 +401,15 @@ export function comboFailureCooldownScope(
 ): ComboFailureCooldownScope {
   const code = normalizedFailureCode(options?.code);
   // Request-shape refusals first: an oversized request must not cool a healthy target.
+  // A native transport can surface a zero-output model overflow as a generic
+  // upstream_server_error carrying precise context-window prose, so consult the bounded
+  // message classifier too: that target is healthy, the turn was simply too large for it.
   if (
     status === 413
     || REQUEST_SHAPE_FAILURE_CODES.has(code)
     || isRequestLocalFreePromptCap(status, message, options?.code)
     || isProviderTargetContextOverflow(status, message, options?.code)
+    || isDefiniteContextOverflow(status, message)
     || isRequestLocalTargetIncompatibility(status, message, options?.code)
   ) return "none";
   if (isProviderScopedQuotaCap(status, message, options?.code)) return "provider";
@@ -451,13 +455,85 @@ function isProviderTargetContextOverflow(
     && /\bprompt\s+\d+\s*>\s*\d+\s+maximum context length\b/i.test(message);
 }
 
+/** A status can carry a verdict about the REQUEST; 401/403/429 speak about the credential. */
+const CONTEXT_VERDICT_STATUSES: ReadonlySet<number> = new Set([400, 413, 422]);
+
+/**
+ * Phrases a provider emits when the INPUT does not fit this model's context window. Matched
+ * against the innermost provider message only, so an unrelated refusal that merely quotes one
+ * of these tokens in a code field cannot authorize a replay.
+ */
+const DEFINITE_CONTEXT_OVERFLOW_PHRASES = [
+  "exceeds the context window",
+  "exceed the context window",
+  "context window exceeded",
+  "context length exceeded",
+  "maximum context length",
+  "maximum context window",
+  "too many tokens",
+];
+
+/** Wrapper envelopes unwrapped before the leaf message is read. */
+const MAX_CONTEXT_OVERFLOW_ENVELOPES = 4;
+
+function isDefiniteContextOverflowMessage(text: string): boolean {
+  const normalized = text.toLowerCase();
+  return normalized === "context_length_exceeded"
+    || DEFINITE_CONTEXT_OVERFLOW_PHRASES.some(phrase => normalized.includes(phrase));
+}
+
+/**
+ * Confirm a context overflow from the provider MESSAGE rather than from a code token that
+ * merely appears somewhere in the envelope. An upstream controls both fields and can emit a
+ * contradictory pair -- `context_length_exceeded` beside `Unsupported parameter: user` -- and
+ * that is not evidence the turn is too large for this model. `classifyError` reads the whole
+ * blob, which is exactly the looseness this must not inherit.
+ *
+ * A JSON-shaped body that fails to parse is truncated or corrupt, not prose: `classificationText`
+ * is capped at 500 characters by `normalizeUpstreamErrorText` before it reaches this function, so
+ * a long envelope arrives here as a JSON prefix. Reading that prefix as plain text would let an
+ * arbitrary field that happens to sit in the first 500 bytes authorize a hop, so it fails closed.
+ *
+ * Only the exact proxy wrapper is unwrapped, within a fixed envelope budget and 16,384 characters.
+ */
+function isDefiniteContextOverflow(status: number, message: string): boolean {
+  if (!CONTEXT_VERDICT_STATUSES.has(status) && status < 500) return false;
+  if (message.length > 16_384) return false;
+  let text = message.trim();
+  // One pass per unwrapped envelope, plus one for the leaf the last envelope yields.
+  for (let unwrapped = 0; unwrapped <= MAX_CONTEXT_OVERFLOW_ENVELOPES; unwrapped += 1) {
+    const providerPrefix = /^Provider error \d{3}:\s*/.exec(text);
+    if (providerPrefix) text = text.slice(providerPrefix[0].length).trim();
+    if (!text.startsWith("{")) return isDefiniteContextOverflowMessage(text);
+    if (unwrapped === MAX_CONTEXT_OVERFLOW_ENVELOPES) return false;
+    let payload: unknown;
+    try { payload = JSON.parse(text); } catch { return false; }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    const record = payload as Record<string, unknown>;
+    const response = record.response && typeof record.response === "object" && !Array.isArray(record.response)
+      ? record.response as Record<string, unknown>
+      : undefined;
+    const source = [record.error, response?.error, response?.last_error, record.last_error, record]
+      .find((candidate): candidate is Record<string, unknown> =>
+        !!candidate && typeof candidate === "object" && !Array.isArray(candidate)
+        && typeof (candidate as Record<string, unknown>).message === "string");
+    if (!source) return false;
+    text = (source.message as string).trim();
+  }
+  return false;
+}
+
 export function comboFailureDecision(
   status: number,
   message: string,
   options?: { code?: string | null },
 ): ComboFailureDecision {
   if (status === 499) return "stop";
   if (message.toLowerCase().includes("origin_rejected")) return "stop";
+  // Structured form of the same hard refusal. The prose test above misses it when the origin
+  // reports the code out of band, and every hop rule below -- including the context-overflow
+  // one -- must stay subordinate to it.
+  if (normalizedFailureCode(options?.code) === "origin_rejected") return "stop";
   // The origin may already be executing this turn (the Codex WebSocket relay sent the create
   // frame and never saw a response event). Hopping would send the same request to a second
   // target while the first may still be generating; the honest status goes to the client.
@@ -476,6 +552,15 @@ export function comboFailureDecision(
   // (for example 5059 + invalid_request_prompt_too_long). That is evidence that this
   // target is too small, not that every later combo target is incapable of serving it.
   if (isProviderTargetContextOverflow(status, message, options?.code)) return "hop";
+  // A definite context-window refusal is target-local inside a heterogeneous combo: this model
+  // cannot hold the turn, but a later target may have a larger window. Two boundaries keep this
+  // safe. It is reached only after cancellation, structured origin/cyber refusals and
+  // non-replayable post-send codes have already stopped. And it only ever classifies a failure
+  // the combo stream preflight already proved emitted no output: `comboStreamPayloadCommitsOutput`
+  // commits the child on any text, tool call or unknown event, and only a zero-output terminal
+  // becomes a failure response at all, so a turn whose text the client already saw is never
+  // reclassified here.
+  if (isDefiniteContextOverflow(status, message)) return "hop";
   // A local input-admission refusal (#1524) says "this candidate cannot fit the request",
   // not "the request is impossible": the next candidate may have a larger context window.
   //

src/lib/state-store-registrations.ts

@@ -21,7 +21,7 @@ import {
 } from "../combos/failover";
 import { reconcileComboWarningMemos } from "../combos/request";
 import { reconcileComboRotationState } from "../combos/resolve";
-import { reconcileComboRecall } from "../server/responses/combo-session-recall";
+import { reconcileComboRecall, sweepExpiredComboRecall } from "../server/responses/combo-session-recall";
 import { listLiveComboTargetKeys } from "../combos/types";
 import {
   listLiveConfigOwnershipRoots,
@@ -112,7 +112,11 @@ export const STATE_STORE_REGISTRATIONS = [
   { name: "model-cache-history", reconcileGeneration: reconcileModelCacheGeneration },
   { name: "pool-rotation", reconcileGeneration: reconcilePoolRotationState },
   { name: "combo-rotation", reconcileGeneration: reconcileComboRotationState },
-  { name: "combo-session-recall", reconcileGeneration: reconcileComboRecall },
+  {
+    name: "combo-session-recall",
+    sweepExpired: sweepExpiredComboRecall,
+    reconcileGeneration: reconcileComboRecall,
+  },
   { name: "guardian-backoff", reconcileGeneration: reconcileGuardianBackoff },
   { name: "codex-reauth", reconcileGeneration: reconcileCodexReauthState },
   { name: "oauth-reauth", reconcileGeneration: reconcileOAuthReauthState },

src/server/responses/combo-session-recall.ts

@@ -8,14 +8,46 @@ interface ComboRecallEntry {
   target: Pick<OcxComboTarget, "provider" | "model">;
   responseModel: string;
   at: number;
+  /** UTF-8 size of `responseModel`, the only client-influenced field of unbounded length. */
+  bytes: number;
 }
 
 const RECALL_CAPACITY = 256;
 const RECALL_TTL_MS = 30 * 60 * 1000;
+/**
+ * A model id is provider-reported and arrives on the response, so nothing upstream of here
+ * bounds its length. Lane keys are already SHA-256 digests, so the model string is the only
+ * field that can grow, and 256 lanes alone do not bound the bytes they hold.
+ */
+const RECALL_MODEL_BYTES_MAX = 1024;
+const RECALL_TOTAL_BYTES_MAX = 64 * 1024;
 const recall = new Map<string, ComboRecallEntry>();
+let recallBytes = 0;
 let lastReconciledGeneration = 0;
 let liveOwners: Pick<GenerationContext, "comboIds" | "comboTargets" | "providerNames"> | undefined;
 
+/** Every removal path goes through here so the byte counter can never drift from the map. */
+function deleteEntry(lane: string): boolean {
+  const entry = recall.get(lane);
+  if (!entry) return false;
+  recall.delete(lane);
+  recallBytes -= entry.bytes;
+  return true;
+}
+
+/**
+ * UTF-8 size of a remembered model id, or null when it is too large to retain.
+ *
+ * The code-unit test runs first and is the part that matters: a UTF-8 encoding is never smaller
+ * than the code-unit count, so an oversized string is rejected without encoding it, and the
+ * bound cannot be defeated by paying the allocation it exists to prevent.
+ */
+function boundedModelBytes(responseModel: string): number | null {
+  if (responseModel.length > RECALL_MODEL_BYTES_MAX) return null;
+  const bytes = Buffer.byteLength(responseModel, "utf8");
+  return bytes > RECALL_MODEL_BYTES_MAX ? null : bytes;
+}
+
 function ownsEntry(context: Pick<GenerationContext, "comboIds" | "comboTargets" | "providerNames">, entry: ComboRecallEntry): boolean {
   return context.comboIds.has(entry.comboId)
     && context.providerNames.has(entry.target.provider)
@@ -32,14 +64,29 @@ export function rememberComboForLane(
   if (!lane || !comboId || !responseModel.trim()) return;
   // Reject even a same-named recreated owner: its previous in-flight turn is obsolete.
   if (writerGeneration < Math.max(lastReconciledGeneration, captureConfigGeneration())) return;
-  const entry = { comboId, target: { provider: target.provider, model: target.model }, responseModel, at: Date.now() };
+  // An unretainable model id DECLINES the write; it must not clear the lane. Every other
+  // rejection above returns the same way, and clearing here would let a late completion erase
+  // a newer selection that this function has no ordering information to compare against.
+  const bytes = boundedModelBytes(responseModel);
+  if (bytes === null) return;
+  const entry = {
+    comboId,
+    target: { provider: target.provider, model: target.model },
+    responseModel,
+    at: Date.now(),
+    bytes,
+  };
   if (liveOwners && !ownsEntry(liveOwners, entry)) return;
-  recall.delete(lane);
+  deleteEntry(lane);
   recall.set(lane, entry);
-  while (recall.size > RECALL_CAPACITY) {
+  recallBytes += bytes;
+  // Insertion order is recency order, because every write re-inserts its lane at the back.
+  // Evicting from the front therefore drops the least recently written lane, never this one:
+  // a single entry is capped well below the aggregate budget, so it always fits.
+  while (recall.size > RECALL_CAPACITY || recallBytes > RECALL_TOTAL_BYTES_MAX) {
     const oldest = recall.keys().next().value;
-    if (oldest === undefined) break;
-    recall.delete(oldest);
+    if (oldest === undefined || oldest === lane) break;
+    deleteEntry(oldest);
   }
 }
 
@@ -57,12 +104,25 @@ export function recallComboForLane(
     || !Object.hasOwn(config.providers, entry.target.provider)
     || !provider || provider.disabled === true
     || !combo?.targets.some(target => targetKey(target) === targetKey(entry.target))) {
-    recall.delete(lane);
+    deleteEntry(lane);
     return undefined;
   }
   return entry.responseModel === model ? entry.comboId : undefined;
 }
 
+/**
+ * Periodic expiry. Without it a lane that is never read again and never touched by a config
+ * reconciliation holds its entry for the life of the process: the existing TTL is only
+ * evaluated on read or on generation change.
+ */
+export function sweepExpiredComboRecall(now: number): number {
+  let removed = 0;
+  for (const [lane, entry] of recall) {
+    if (now - entry.at >= RECALL_TTL_MS && deleteEntry(lane)) removed += 1;
+  }
+  return removed;
+}
+
 export function reconcileComboRecall(context: GenerationContext): number {
   if (context.generation <= lastReconciledGeneration) return 0;
   lastReconciledGeneration = context.generation;
@@ -74,8 +134,7 @@ export function reconcileComboRecall(context: GenerationContext): number {
   let removed = 0;
   for (const [lane, entry] of recall) {
     if (!ownsEntry(context, entry) || Date.now() - entry.at >= RECALL_TTL_MS) {
-      recall.delete(lane);
-      removed += 1;
+      if (deleteEntry(lane)) removed += 1;
     }
   }
   return removed;
@@ -84,6 +143,7 @@ export function reconcileComboRecall(context: GenerationContext): number {
 /** Test-only reset, alongside the combo rotation/cooldown resets. */
 export function clearComboRecallForTests(): void {
   recall.clear();
+  recallBytes = 0;
   lastReconciledGeneration = 0;
   liveOwners = undefined;
 }