[lidge-jun]

Summary

Re-land of #8299 (reverted in #8402) with the fixes its post-merge review required.

Some OpenAI-compatible gateways end a stream with an SSE frame that is only {"error":{...}} (no root type), then [DONE] and EOF. Before this change both bare-error recognizers in src/server/relay.ts ignored it, so EOF synthesized response.incomplete / adapter_eof and the diagnostic was lost. After it, the untyped envelope is reported as response.failed across the tee, eager and WebSocket paths, and the request row and account inspector record the same verdict.

What changed relative to the reverted #8299:

• Selected-credential masking on the untyped policy terminal. An untyped cyber_policy envelope is rewritten into a terminal like the typed error event. The generated terminal now goes through the selected-credential mask on every path, including the WebSocket pump.

• One precedence rule for bare evidence (src/server/bare-upstream-error.ts): the newest typed error frame wins, an untyped envelope replaces only untyped evidence, and a genuine response.* terminal supersedes both. The client tail, the account inspector, the request row and the WS row all read the same reduced verdict, so a typed quota followed by an untyped unknown no longer reaches the client as a retryable 502 while the row records 429.

• Status attribution: an untyped rate limit records 429 instead of 502, and a read failure after a captured refusal keeps the refusal verdict for accounting.

• Explicit codes outrank copy: policy wording no longer overrides an explicit non-policy code.

• Provider-stated status kept separate from the synthetic 502. The verdict carries httpStatus only when the provider stated one (explicit refusal, recognized class, Codex WS wrapper 5xx), plus a terminalStatus for the wire. A typed error with no recognized class therefore leaves the row open as dev does, so combo preflight still reads explicit status/http_status/numeric code fields, and an ordinary error followed by a socket reset still reports upstream_reset.

• Policy frames decide only when they win. A per-stream terminal tracker applies the same reducer before the untyped-policy branch, and the client boundary, the inspector, passthrough inspection and the buffered JSON path all use it. An untyped `cyber_policy` envelope that loses to earlier typed evidence is no longer rewritten into a terminal. A winning policy terminal is final and carries the policy verdict, so a typed frame with a recognized code beside policy copy records 400/`cyber_policy` in the row as well as on the client, as dev's row did.

• Eager reset attribution matches tee and dev: the eager relay marks a read-failure tail as an upstream verdict only for a refusal or provider-stated class, so an unrecognized error followed by a reset keeps the `streamAborted` transport attribution.

• A bare frame after a genuine terminal leaves the row alone. Readers that keep inspecting past the terminal (the WebSocket EOF observer and the response-log metadata consumer) no longer let a later bare error restart the verdict. Before this, a `max_output_tokens` or completed turn could record 429 and reach account health as a quota failure. The frame's text keeps dev's guard: untyped text that echoes an outbound credential is recorded as `[REDACTED]`.

In buffered non-stream mode, a winning untyped policy frame after a genuine terminal yields `missing_terminal`. That is a deliberate choice: dev already gives `missing_terminal` for the same typed sequence.

Behavior note for reviewers: an untyped cyber_policy envelope ends the turn immediately and drops a later response.completed. That matches the typed error + cyber_policy behavior already on dev (checked with the same two-frame stream against aa30ea9d: typed → response.failed, no completion). It is parity with an existing rule, not a new one.

Combo preflight is unchanged: it treats the untyped frame as a non-control event and commits the target, so it never resends it; the relay reports the failure. A test pins that boundary next to dev's newer bare-error cases.

Closes #8216

Verification

The head merges current `dev` (`aa30ea9d`) into the re-land chain. Both sides were kept in all three conflicts: two docs/test hunks and the WS test import block. Bun 1.4.4 / macOS, with isolated `HOME`/`OPENCODEX_HOME`/`CODEX_HOME`/`CLAUDE_CONFIG_DIR`.

• `bun test --isolate` over 52 files: the 12 relay/WS/combo/refusal/reset suites, response-log inspection and request-log suites, the policy-fidelity, stream-aborted, attribution and diagnostics suites, every test that references `buffered-sse-json`, `passthrough-dispatch`, `terminalStatusFromParsed` or `cyber_policy`, and the layout, ratchet, lab-boundary, import-cycle and structure guards. Result: 3,617 pass / 0 fail across 60 files.
• New regressions in `tests/responses/sse-failed-tail.test.ts`: "a policy frame decides client, account and row together" (5 orderings × tee/eager) and "a reset after … keeps tee and eager attribution aligned" (3 cases). With the source changes reverted, 5 of the 8 fail; with them applied, all pass. Another case, "a bare frame after a genuine terminal leaves the row alone" (5 tests), fails 4 of 5 without its fix. Its redaction test fails if the post-terminal guard is removed.
• `bun run typecheck` (2,434 files), `bun run privacy:scan`, `bun run structure:check`, `bun scripts/file-size-ratchet.ts` and `git diff --check`: passed.
• Exact-head CI: see the checks on this head.
• NOT RUN: full `bun run test`; native Windows/macOS lanes (no per-PR `lane=all`, by policy).

Two test assertions from the precedence commit were corrected rather than loosened. The mixed-order matrix now asserts the status the failed row records (`httpStatusForRequestLogTerminal`), which still rejects a stale losing status. The "reset after an ordinary untyped error" case now asserts the `upstream_reset` that its own title and comment describe, matching dev's typed rule in `tests/server/relay-eager.test.ts`. The mixed-order harness now passes the status argument from `onTerminal` through, as the production recorder does.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Independent correctness and security reviews run on the final head before merge.

Co-authored-by: Ingwannu ingwannu@users.noreply.github.com

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

✅ Deterministic PR hygiene checks passed.