{"record":{"id":"4c303f3ef68779df","repo":"router-for-me/CLIProxyAPI","slug":"realtime-client-secret-capacity-exhausted","errorCode":"realtime_client_secret_capacity_exhausted","errorMessage":"Realtime client secret capacity exhausted","messagePattern":"Realtime client secret capacity exhausted","errorType":"http","errorClass":null,"httpStatus":429,"severity":"error","filePath":"internal/client/codex/live/client_secret.go","lineNumber":32,"sourceCode":"\n\t\"github.com/gin-gonic/gin\"\n)\n\nconst (\n\tClientSecretSessionContextKey   = \"codexLiveClientSecretSession\"\n\tClientSecretPrincipalContextKey = \"codexLiveClientSecretPrincipal\"\n\tclientSecretPrefix              = \"ek_\"\n\tclientSecretDefaultLifetime     = 10 * time.Minute\n\tclientSecretMinimumLifetime     = 10 * time.Second\n\tclientSecretMaximumLifetime     = 2 * time.Hour\n\tclientSecretMaxBodySize         = 64 << 10\n\tclientSecretMaxEntries          = 1024\n\tclientSecretMaxEntriesPerIssuer = 64\n)\n\nvar (\n\terrInvalidClientSecret    = errors.New(\"Realtime client secret is invalid or expired\")\n\terrClientSecretCapacity   = errors.New(\"Realtime client secret capacity exhausted\")\n\terrUnsupportedSessionType = errors.New(\"Realtime session type is not supported\")\n)\n\n// ClientSecretAuthorization contains the local session configuration associated with an ephemeral key.\ntype ClientSecretAuthorization struct {\n\tPrincipal       string\n\tIssuerPrincipal string\n\tIssuerProvider  string\n\tSession         json.RawMessage\n}\n\ntype clientSecretEntry struct {\n\tauthorization ClientSecretAuthorization\n\texpiresAt     time.Time\n}\n\ntype clientSecretStore struct {\n\tmu      sync.Mutex","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/client/codex/live/client_secret.go#L14-L50","documentation":"Thrown when the JSON payload a plugin sent for host.model.stream_read fails to unmarshal into pluginapi.HostModelStreamReadRequest. The only meaningful field is StreamID (string); type mismatches or malformed JSON trigger this, wrapping the encoding/json cause with %w.","triggerScenarios":"Plugin calls host.model.stream_read with bytes that are not valid JSON for the schema: non-string StreamID, truncated payload, or empty body.","commonSituations":"Plugin-side serialization bug; schema drift between plugin SDK and host; corrupted buffer at the C ABI boundary.","solutions":["Marshal pluginapi.HostModelStreamReadRequest{StreamID: id} with encoding/json and send those bytes verbatim.","Rebuild plugin against the host's SDK version to eliminate schema drift.","Log the failing payload to pinpoint the malformed field."],"exampleFix":"// after\nraw, _ := json.Marshal(pluginapi.HostModelStreamReadRequest{StreamID: streamID})\nrespRaw, err := host.Call(ctx, \"host.model.stream_read\", raw)","handlingStrategy":"try-catch","validationCode":"raw, err := json.Marshal(pluginapi.HostModelStreamReadRequest{StreamID: id})\nif err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    var typeErr *json.UnmarshalTypeError\n    if errors.As(err, &typeErr) {\n        return fmt.Errorf(\"plugin read-request schema bug (field %s): %w\", typeErr.Field, err)\n    }\n    return err\n}","preventionTips":["Marshal the generated struct; never concatenate JSON by hand.","Keep stream read helpers centralized.","Pin plugin SDK to host version."],"tags":["pluginhost","json","rpc","deserialization"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}