router-for-me/CLIProxyAPI · error

realtime_client_secret_capacity_exhausted

realtime_client_secret_capacity_exhausted

Error message

Realtime client secret capacity exhausted

What it means

Thrown when the JSON payload a plugin sent for host.model.stream_read fails to unmarshal into pluginapi.HostModelStreamReadRequest. The only meaningful field is StreamID (string); type mismatches or malformed JSON trigger this, wrapping the encoding/json cause with %w.

Source

Thrown at internal/client/codex/live/client_secret.go:32

	"github.com/gin-gonic/gin"
)

const (
	ClientSecretSessionContextKey   = "codexLiveClientSecretSession"
	ClientSecretPrincipalContextKey = "codexLiveClientSecretPrincipal"
	clientSecretPrefix              = "ek_"
	clientSecretDefaultLifetime     = 10 * time.Minute
	clientSecretMinimumLifetime     = 10 * time.Second
	clientSecretMaximumLifetime     = 2 * time.Hour
	clientSecretMaxBodySize         = 64 << 10
	clientSecretMaxEntries          = 1024
	clientSecretMaxEntriesPerIssuer = 64
)

var (
	errInvalidClientSecret    = errors.New("Realtime client secret is invalid or expired")
	errClientSecretCapacity   = errors.New("Realtime client secret capacity exhausted")
	errUnsupportedSessionType = errors.New("Realtime session type is not supported")
)

// ClientSecretAuthorization contains the local session configuration associated with an ephemeral key.
type ClientSecretAuthorization struct {
	Principal       string
	IssuerPrincipal string
	IssuerProvider  string
	Session         json.RawMessage
}

type clientSecretEntry struct {
	authorization ClientSecretAuthorization
	expiresAt     time.Time
}

type clientSecretStore struct {
	mu      sync.Mutex

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Marshal pluginapi.HostModelStreamReadRequest{StreamID: id} with encoding/json and send those bytes verbatim.
2. Rebuild plugin against the host's SDK version to eliminate schema drift.
3. Log the failing payload to pinpoint the malformed field.

Example fix

// after
raw, _ := json.Marshal(pluginapi.HostModelStreamReadRequest{StreamID: streamID})
respRaw, err := host.Call(ctx, "host.model.stream_read", raw)

raw, err := json.Marshal(pluginapi.HostModelStreamReadRequest{StreamID: id})
if err != nil {
    return err
}

if err != nil {
    var typeErr *json.UnmarshalTypeError
    if errors.As(err, &typeErr) {
        return fmt.Errorf("plugin read-request schema bug (field %s): %w", typeErr.Field, err)
    }
    return err
}

When it happens

Trigger: Plugin calls host.model.stream_read with bytes that are not valid JSON for the schema: non-string StreamID, truncated payload, or empty body.

Common situations: Plugin-side serialization bug; schema drift between plugin SDK and host; corrupted buffer at the C ABI boundary.

Related errors

• auth file not found
• invalid_session
• decode host log request: %w
• decode host auth list request: %w
• decode host auth get request: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/4c303f3ef68779df. Report an issue: GitHub.