lidge-jun · Sep 13, 2026 · Sep 12, 2026 · Sep 12, 2026 · Sep 12, 2026 · Sep 12, 2026
@@ -24,6 +24,14 @@ should select among several targets.
 
 Credential-bearing model, image, video, and search requests do not automatically follow HTTP redirects, including same-origin redirects. Configure the final upstream API URL instead of a redirecting alias. A redirect does not cause the server to resend credentials or the request body to its destination. The response owner retains its existing error or relay behavior; native Responses and compact routes can return the original 3xx and `Location` to the client. Client redirect behavior is separate from this server transport policy.
 
+## Console upload rejections
+
+An exact Console or Console Go `Invalid upload request.` HTTP 400 from a canonical
+OpenCode Zen/Go generation endpoint receives one retry after 800 ms. The proxy reuses
+the same serialized request and records the recovery in Logs. Other 400 errors,
+custom destinations, cancellations and repeated upload rejections remain failures.
+This does not retry filtered model responses or interrupted streams.
+
 ## Endpoint overview
 
 | Client surface | Endpoint | Successful non-stream result | Successful stream or socket result |

@@ -796,6 +796,7 @@ export const de: Record<TKey, string> = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth ratenbegrenzt (429)",
   "logs.detail.attempt.recovery.image413": "Bildnutzlast zu groß (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "Wiederholung nach leerer Antwort",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Console-Upload erneut versucht",
   "logs.detail.attempt.recovery.unknown": "Unbekannter Wiederherstellungsgrund",
   "logs.detail.reason.usage_missing": "Nutzung wurde nicht gemeldet.",
   "logs.detail.reason.usage_unsupported": "Dieser Anbieter meldet keine Nutzung.",

@@ -845,6 +845,7 @@ export const en = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth rate-limited (429)",
   "logs.detail.attempt.recovery.image413": "Image payload too large (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "Empty completion retry",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Console upload retry",
   "logs.detail.attempt.recovery.unknown": "Unknown recovery reason",
   "logs.detail.reason.usage_missing": "Usage was not reported.",
   "logs.detail.reason.usage_unsupported": "This provider does not report usage.",

@@ -821,6 +821,7 @@ export const fr: Record<TKey, string> = {
   "logs.detail.attempt.recovery.transient5xx": "Erreur 5xx temporaire",
   "logs.detail.attempt.recovery.connectionReset": "Réinitialisation de la connexion",
   "logs.detail.attempt.recovery.emptyCompletion": "Nouvelle tentative après une réponse vide",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Nouvelle tentative d’envoi Console",
   "logs.detail.attempt.recovery.oauth401": "Réauthentification OAuth",
   "logs.detail.attempt.recovery.key429": "Clé soumise à une limitation de débit (429)",
   "logs.detail.attempt.recovery.rateLimit429": "Limitation de débit (429)",

@@ -758,6 +758,7 @@ export const ja: Record<TKey, string> = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth レート制限 (429)",
   "logs.detail.attempt.recovery.image413": "画像ペイロードが大きすぎます (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "空の完了を再試行",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Console アップロード再試行",
   "logs.detail.attempt.recovery.unknown": "不明なリカバリ理由",
   "logs.detail.reason.usage_missing": "使用量が報告されませんでした。",
   "logs.detail.reason.usage_unsupported": "このプロバイダーは使用量を報告しません。",

@@ -827,6 +827,7 @@ export const ko: Record<TKey, string> = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth 요청 한도 초과 (429)",
   "logs.detail.attempt.recovery.image413": "이미지 페이로드가 너무 큼 (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "빈 응답 재시도",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Console 업로드 재시도",
   "logs.detail.attempt.recovery.unknown": "알 수 없는 복구 사유",
   "logs.detail.reason.usage_missing": "usage가 보고되지 않았습니다.",
   "logs.detail.reason.usage_unsupported": "이 프로바이더는 usage 보고를 지원하지 않습니다.",

@@ -813,6 +813,7 @@ export const ru: Record<TKey, string> = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth ограничен (429)",
   "logs.detail.attempt.recovery.image413": "Слишком большой размер изображения (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "Повтор пустого завершения",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Повтор загрузки Console",
   "logs.detail.attempt.recovery.unknown": "Неизвестная причина восстановления",
   "logs.detail.reason.usage_missing": "Данные об использовании не были сообщены.",
   "logs.detail.reason.usage_unsupported": "Этот провайдер не сообщает данные об использовании.",

@@ -832,6 +832,7 @@ export const tr: Record<TKey, string> = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth kısıtlandı (429)",
   "logs.detail.attempt.recovery.image413": "Görsel boyutu çok büyük (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "Boş tamamlama yeniden denemesi",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Console yüklemesi yeniden denendi",
   "logs.detail.attempt.recovery.unknown": "Bilinmeyen kurtarma nedeni",
   "logs.detail.reason.usage_missing": "Kullanım bildirilmedi.",
   "logs.detail.reason.usage_unsupported": "Bu sağlayıcı kullanım bildirmeyebilir.",

@@ -2210,6 +2210,7 @@ export const zhTW: Record<TKey, string> = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth 被限流 (429)",
   "logs.detail.attempt.recovery.image413": "圖片承載過大 (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "空白完成重試",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Console 上傳重試",
   "logs.detail.attempt.recovery.unknown": "未知的復原原因",
   "logs.detail.estimate.provider_cost_overlay": "已使用供應商設定的價格覆蓋。",
   "logs.detail.estimate.priority_lower_bound": "無法取得已確認的 Priority 價格；目前顯示的估算是已知下限。",

@@ -808,6 +808,7 @@ export const zh: Record<TKey, string> = {
   "logs.detail.attempt.recovery.anthropicOauth429": "Anthropic OAuth 被限流 (429)",
   "logs.detail.attempt.recovery.image413": "图片载荷过大 (413)",
   "logs.detail.attempt.recovery.emptyCompletion": "空完成重试",
+  "logs.detail.attempt.recovery.consoleGoUpload": "Console 上传重试",
   "logs.detail.attempt.recovery.unknown": "未知的恢复原因",
   "logs.detail.reason.usage_missing": "未上报 usage。",
   "logs.detail.reason.usage_unsupported": "该提供方不支持上报 usage。",

@@ -113,7 +113,8 @@ type AttemptRecoveryKind =
   | "rate-limit-429"
   | "anthropic-oauth-429"
   | "image-413"
-  | "empty-completion";
+  | "empty-completion"
+  | "console-go-upload-retry";
 
 interface LogAttempt {
   ordinal: number;
@@ -307,6 +308,7 @@ const RECOVERY_KIND_KEYS = {
   "anthropic-oauth-429": "logs.detail.attempt.recovery.anthropicOauth429",
   "image-413": "logs.detail.attempt.recovery.image413",
   "empty-completion": "logs.detail.attempt.recovery.emptyCompletion",
+  "console-go-upload-retry": "logs.detail.attempt.recovery.consoleGoUpload",
 } as const satisfies Record<AttemptRecoveryKind, string>;
 
 /** Map a metric-unavailable reason to its i18n key. */

@@ -1075,6 +1075,7 @@
     "responses-account-label.test.ts": "responses",
     "responses-compaction-routing.test.ts": "responses",
     "responses-compaction.test.ts": "responses",
+    "responses-console-go-upload-retry.test.ts": "responses",
     "responses-context-overflow.test.ts": "responses",
     "responses-custom-tool-guidance.test.ts": "responses",
     "responses-custom-tool-repair.test.ts": "responses",

@@ -175,3 +175,60 @@ export function enrichOpenCodeZenUpstreamMessage(
 ): string {
   return enrichOpenCodeZenFreeTierMessage(enrichOpenCodeZenRateLimitMessage(message, opts), opts);
 }
+
+/** The effective HTTP endpoint, never the configured row name, identifies Console. */
+export function isConsoleGoDestination(outboundUrl: string | undefined): boolean {
+  if (!outboundUrl) return false;
+  try {
+    const url = new URL(outboundUrl);
+    return url.protocol === "https:" && url.hostname === "opencode.ai"
+      && url.port === "" && url.username === "" && url.password === ""
+      && /^\/zen\/(?:go\/)?v1\/(?:responses|chat\/completions|messages)$/.test(url.pathname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The canonical refusal envelope, as served on both Console routes:
+ *   {"error":{"param":null,"type":"invalid_request_error","message":"Error from provider
+ *   (Console Go): Upstream request failed: [invalid_request_error] Invalid upload request."}}
+ *
+ * The gateway names itself Console on the Zen key route and Console Go on the Go route, so the
+ * anchor is the shared product name plus the refusal sentence. The message is matched whole: a
+ * bare string, a suffix, or any other envelope is a different refusal and must not be replayed.
+ * Being stricter than necessary is the safe direction: a missed match leaves the turn failing
+ * exactly as it does today, while a loose match spends an extra request on unrelated 400s.
+ */
+const CONSOLE_UPLOAD_REFUSALS = new Set([
+  "Error from provider (Console Go): Upstream request failed: [invalid_request_error] Invalid upload request.",
+  "Error from provider (Console): Upstream request failed: [invalid_request_error] Invalid upload request.",
+]);
+
+/**
+ * True only for the canonical Console upload refusal on a canonical Console destination.
+ * Route-gated on purpose: the message alone would let any other upstream that happens to answer
+ * with this English sentence trigger a second send from an unrelated provider.
+ */
+export function isTransientConsoleGoUploadRejection(opts: {
+  status: number;
+  errorBody: string | undefined;
+  outboundUrl?: string;
+}): boolean {
+  if (opts.status !== 400 || !opts.errorBody) return false;
+  if (!isConsoleGoDestination(opts.outboundUrl)) return false;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(opts.errorBody);
+  } catch {
+    return false;
+  }
+  const error = (payload as { error?: unknown } | null)?.error;
+  if (!error || typeof error !== "object" || Array.isArray(error)) return false;
+  // The whole envelope, not just the sentence: Console always answers this refusal as
+  // invalid_request_error with a null param, so a partial envelope is a different error.
+  const envelope = error as { param?: unknown; type?: unknown; message?: unknown };
+  if (envelope.type !== "invalid_request_error" || envelope.param !== null) return false;
+  // Matched without trimming: padding means the gateway wrapped or appended something.
+  return typeof envelope.message === "string" && CONSOLE_UPLOAD_REFUSALS.has(envelope.message);
+}
@@ -102,7 +102,10 @@ import {
 } from "../../lib/errors";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
-import { enrichOpenCodeZenUpstreamMessage } from "../../providers/opencode-zen-rate-limit";
+import {
+  enrichOpenCodeZenUpstreamMessage,
+  isTransientConsoleGoUploadRejection,
+} from "../../providers/opencode-zen-rate-limit";
 import { CODE_MODE_EXEC_TOOL_NAME, modelInList, namespacedToolName } from "../../types";
 import type {
   AdapterEvent,
@@ -213,6 +216,7 @@ import {
   fetchWithTransientRetry,
   isNonReplayableResponse,
   prepareSameTarget429Wait,
+  sleepWithAbort,
 } from "../../lib/upstream-retry";
 import {
   ForwardAdmissionCredentialError,
@@ -848,6 +852,31 @@ async function opaqueBlobRejectionBodyForRecovery(
   }
 }
 
+/**
+ * Backoff for the single exact-request replay after a canonical Console upload rejection.
+ */
+const CONSOLE_GO_UPLOAD_RETRY_DELAY_MS = 800;
+
+/**
+ * Peek the upstream error body for the Console Go transient-400 recovery. Only a complete,
+ * display-safe body may drive a retry decision (same contract as
+ * opaqueBlobRejectionBodyForRecovery), and reading a clone leaves the original response intact
+ * for the caller's own error surface when no retry is taken.
+ */
+async function consoleGoUploadRejectionBody(
+  response: Response,
+  alreadyAttempted: boolean,
+  signal: AbortSignal,
+): Promise<string | undefined> {
+  if (isNonReplayableResponse(response) || response.status !== 400 || alreadyAttempted) return undefined;
+  try {
+    const body = await readBoundedResponseBody(response.clone(), { signal });
+    return body.displaySafe && !body.truncated ? body.text : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Materialize an upstream error body only when the bounded reader observed a complete,
  * display-safe payload. Partial timeout and over-limit prefixes are attacker-controlled,
@@ -5231,6 +5260,9 @@ async function handleResponsesInner(
     const opaqueBlobRecoveryGuard: OpaqueBlobRecoveryGuard = { attempted: false };
     let oauth401ReplayAttempted = false;
     let codex401ReplayKind: "main" | "stored" | null = null;
+    // Console Go answers a transient 400 "Invalid upload request." for bodies it accepts
+    // moments later; at most one byte-identical replay is allowed per request.
+    const consoleGoUploadRetryGuard: { attempted: boolean } = { attempted: false };
     const rateLimitPolicy = rateLimitRetryPolicyFor(route.provider);
     let rateLimitRetries = 0;
     const rebuildAndRefetch = async (
@@ -5245,10 +5277,12 @@ async function handleResponsesInner(
         return { failed: formatErrorResponse(502, "upstream_error", "Recovery changed the provider wire unexpectedly") };
       }
       try {
-        request = await retryAdapter.buildRequest(parsed, {
-          headers: selectedForwardHeaders,
-          translatorBudget,
-        });
+        if (recovery !== "console-go-upload-retry") {
+          request = await retryAdapter.buildRequest(parsed, {
+            headers: selectedForwardHeaders,
+            translatorBudget,
+          });
+        }
         refreshRoutedNamespaceToolAliases(request);
         recordAdapterReasoning(logCtx, request);
         recordAdapterTier(logCtx, request);
@@ -5778,6 +5812,36 @@ async function handleResponsesInner(
         logCtx.terminalIncompleteReason = preflightLog.terminalIncompleteReason;
       }
     }
+    // Console Go (opencode-zen / opencode-go) intermittently rejects a body it accepts seconds
+    // later with 400 invalid_request_error / "Invalid upload request." Replay the byte-identical
+    // request once after the exact gateway rejection. Single-shot guard.
+    // This recovery reuses the captured request; other recovery kinds still rebuild.
+    if (!consoleGoUploadRetryGuard.attempted) {
+      const uploadRejectionBody = await consoleGoUploadRejectionBody(
+        upstreamResponse,
+        consoleGoUploadRetryGuard.attempted,
+        upstream.signal,
+      );
+      if (uploadRejectionBody !== undefined
+        && isTransientConsoleGoUploadRejection({
+          status: upstreamResponse.status,
+          errorBody: uploadRejectionBody,
+          outboundUrl: request.url,
+        })) {
+        consoleGoUploadRetryGuard.attempted = true;
+        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+        if (!upstream.signal.aborted) {
+          try {
+            await sleepWithAbort(CONSOLE_GO_UPLOAD_RETRY_DELAY_MS, upstream.signal);
+          } catch { return clientCancelledResponse(); }
+        }
+        if (upstream.signal.aborted) return clientCancelledResponse();
+        const result = await rebuildAndRefetch("console-go-upload-retry");
+        if ("failed" in result) return result.failed;
+        upstreamResponse = result;
+        continue passthroughRecovery;
+      }
+    }
     break;
     }
     const headers = sanitizePassthroughHeaders(upstreamResponse.headers);
@@ -7267,6 +7331,9 @@ async function handleResponsesInner(
     // 413→429 rotation cannot silently undo the tightening.
     let imageRetryAttempted = false;
     const opaqueBlobRecoveryGuard: OpaqueBlobRecoveryGuard = { attempted: false };
+    // Console Go answers a transient 400 "Invalid upload request." for bodies it accepts
+    // moments later; at most one byte-identical replay is allowed per request.
+    const consoleGoUploadRetryGuard: { attempted: boolean } = { attempted: false };
     let oauth401ReplayAttempted = false;
     /**
      * Rebuild the request from the current parsed input (and any image-tier bias) and refetch
@@ -7651,6 +7718,35 @@ async function handleResponsesInner(
         upstreamResponse = result;
         continue recovery;
       }
+      // Console Go (opencode-zen / opencode-go) intermittently rejects a body it accepts seconds
+      // later with 400 invalid_request_error / "Invalid upload request." Replay the
+      // byte-identical request once after the exact gateway rejection.
+      if (!consoleGoUploadRetryGuard.attempted) {
+        const uploadRejectionBody = await consoleGoUploadRejectionBody(
+          upstreamResponse,
+          consoleGoUploadRetryGuard.attempted,
+          upstream.signal,
+        );
+        if (uploadRejectionBody !== undefined
+          && isTransientConsoleGoUploadRejection({
+            status: upstreamResponse.status,
+            errorBody: uploadRejectionBody,
+            outboundUrl: sameTargetRequest?.url,
+          })) {
+          consoleGoUploadRetryGuard.attempted = true;
+          try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+          if (!upstream.signal.aborted) {
+            try {
+              await sleepWithAbort(CONSOLE_GO_UPLOAD_RETRY_DELAY_MS, upstream.signal);
+            } catch { cleanupUpstreamAbort(); return clientCancelledResponse(); }
+          }
+          if (upstream.signal.aborted) { cleanupUpstreamAbort(); return clientCancelledResponse(); }
+          const result = await rebuildAndRefetch("console-go-upload-retry");
+          if ("failed" in result) return result.failed;
+          upstreamResponse = result;
+          continue recovery;
+        }
+      }
       break;
     }
     if (!upstreamResponse.ok) {

@@ -70,6 +70,7 @@ export type AttemptRecoveryKind =
   | "anthropic-oauth-429"
   | "oauth-account-429"
   | "image-413"
+  | "console-go-upload-retry"
   | "opaque-blob-rejection"
   | "empty-completion";
 
@@ -309,6 +310,7 @@ const ATTEMPT_RECOVERY_KINDS = new Set<AttemptRecoveryKind>([
   "anthropic-oauth-429",
   "oauth-account-429",
   "image-413",
+  "console-go-upload-retry",
   "opaque-blob-rejection",
   "empty-completion",
 ]);

@@ -471,6 +471,10 @@ retried. Guarded paths: the ChatGPT passthrough and generic adapter fetch in
 fallback. Adapters with their own `fetchResponse` (kiro, cursor, google) keep their own retry
 policies; kiro imports the shared abort/sleep helpers from this module.
 
+## Console upload rejection recovery
+
+`src/providers/opencode-zen-rate-limit.ts` recognizes the complete Console upload-rejection envelope only at the effective HTTPS opencode.ai Zen/Go generation endpoint. A provider row name cannot authorize another destination. The two recovery loops in `src/server/responses/core.ts` wait 800 ms and replay the captured serialized request once; cancellation, nonreplayable responses, other errors and a second upload rejection keep their failure semantics. The recovery kind is persisted as `console-go-upload-retry` and has a localized Logs label.
+
 ## Same-provider combo quota fallback
 
 For a failover combo with multiple models on the same Codex-login OpenAI provider, a pre-stream