@askalf/dario 6.2.0 → 6.3.0

package/README.md

@@ -27,7 +27,7 @@
 
 <p><strong>One local endpoint. Every AI tool you own. The subscriptions you already pay for.</strong></p>
 
-<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~34k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~35k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
 
 <sub><a href="#start-in-60-seconds">Start</a> · <a href="#point-your-tools-at-it">Your tools</a> · <a href="#what-it-does-with-a-request">Routing</a> · <a href="#two-plans-one-endpoint">Two plans</a> · <a href="#many-seats-one-endpoint">Pool</a> · <a href="#it-tracks-a-moving-target">Drift</a> · <a href="#trust--transparency">Trust</a> · <a href="#will-my-account-get-suspended">Risk</a> · <a href="#commands">Commands</a> · <a href="#faq">FAQ</a> · <a href="docs/returning.md">Coming back after a while?</a></sub>
 
@@ -69,7 +69,25 @@ Prefer Docker? `ghcr.io/askalf/dario:latest` — multi-arch (`amd64` + `arm64`),
 
 ## Point your tools at it
 
-Two base URLs, one key. Anthropic-shaped clients talk to `http://localhost:3456`; OpenAI-shaped clients talk to `http://localhost:3456/v1`. The key is `dario` (any value works until you set `DARIO_API_KEY`, which then has to match).
+Two base URLs, one key. Anthropic-shaped clients talk to `http://localhost:3456`; OpenAI-shaped clients — chat/completions and, since 6.3, the Responses API — talk to `http://localhost:3456/v1`. The key is `dario` (any value works until you set `DARIO_API_KEY`, which then has to match).
+
+<details>
+<summary><strong>Codex CLI</strong> — OpenAI's agent, on your Claude plan</summary>
+
+```toml
+# ~/.codex/config.toml
+model = "claude-opus-5"
+model_provider = "dario"
+
+[model_providers.dario]
+name = "dario"
+base_url = "http://127.0.0.1:3456/v1"
+env_key = "DARIO_API_KEY"
+wire_api = "responses"
+```
+
+Codex CLI 0.154 dropped the chat wire for custom providers, so dario speaks the Responses API: the request is translated once at the front door and served like any Claude request — pool, failover, mid-stream continuation, the 17 KB Codex system prompt cached on the Claude side. The full agent loop runs: Claude calls `exec_command`, Codex executes it, the result goes back, Claude answers from it. Add a ChatGPT account too and `-m gpt-5.6-sol` on the same block goes to that plan through the same proxy. [Walkthrough and what is dropped](./docs/integrations/codex-cli.md).
+</details>
 
 <details>
 <summary><strong>Claude Code</strong> — forwarded verbatim</summary>
@@ -249,7 +267,7 @@ The tool doesn't know. The backend doesn't know. dario is the seam.
 
 ### Your ChatGPT plan, on both endpoints
 
-A ChatGPT Plus or Pro plan is served on **both** of dario's endpoints: any client that speaks `/v1/chat/completions` can use it (Codex CLI, the OpenAI SDKs, your scripts), and so can any client that speaks `/v1/messages` (Claude Code, the Anthropic SDKs, agent runtimes). The harness never needs to know which subscription is behind it.
+A ChatGPT Plus or Pro plan is served on **all three** of dario's endpoints: any client that speaks `/v1/chat/completions` or `/v1/responses` can use it (Codex CLI, the OpenAI SDKs, the Agents SDK, your scripts), and so can any client that speaks `/v1/messages` (Claude Code, the Anthropic SDKs, agent runtimes). The harness never needs to know which subscription is behind it — and the symmetry holds: Codex CLI runs on a Claude plan the same way.
 
 ```bash
 dario add altman            # prints an authorize URL; paste the redirect URL back
@@ -556,6 +574,8 @@ Full FAQ, including per-tool 401s and Team/Enterprise plans: [faq.md](./docs/faq
 
 ## Deep dives
 
+- [Claude Code wire drift](https://askalf.github.io/dario/drift-feed/) — every change to what Claude Code sends on the wire, as the template watcher observed it; [RSS](https://askalf.github.io/dario/drift-feed/feed.xml) · [JSON Feed](https://askalf.github.io/dario/drift-feed/feed.json)
+
 - [#183 — Modifying Claude Code's system prompt doesn't change billing; stripping its constraints recovers 1.2–2.8× output](https://github.com/askalf/dario/discussions/183)
 - [#68 — dario vs LiteLLM / OpenRouter / Kong AI Gateway (when each wins)](https://github.com/askalf/dario/discussions/68)
 - [#14 — Template replay: why we replay the shape instead of matching signals](https://github.com/askalf/dario/discussions/14)

package/dist/codex-backend.d.ts

@@ -262,6 +262,20 @@ export declare const CODEX_SUPPORTED_FIELDS: readonly string[];
 /** Drop every field this backend does not accept. Pure; exported for tests. */
 export declare function toCodexSupportedBody(body: Record<string, unknown>): Record<string, unknown>;
 export declare function buildCodexHeaders(creds: CodexAccountCredentials): Record<string, string>;
+/**
+ * Serve a Responses-shape request (`POST /v1/responses`) from a stored Codex
+ * account with NO translation: the ChatGPT backend speaks this shape natively,
+ * so the body goes through as the client wrote it (only `stream` forced) and
+ * the backend's SSE goes back byte for byte. This is what
+ * keeps the newest Codex CLI features working on a ChatGPT plan through dario
+ * — `additional_tools` input items, `custom` tools, `reasoning.context`,
+ * `include` — none of which survive a round trip through the Messages shape.
+ *
+ * Streaming only: the backend always streams, and folding a Responses stream
+ * into a buffered response object is not built yet. A non-streaming client
+ * gets a 400 saying so.
+ */
+export declare function forwardResponsesToCodex(res: ServerResponse, body: Record<string, unknown>, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, fetchImpl?: typeof fetch, onDone?: (outcome: CodexForwardOutcome) => void): Promise<boolean>;
 /**
  * Serve a request from a stored Codex account, in either client wire shape.
  *

package/dist/codex-backend.js

@@ -743,6 +743,148 @@ export function buildCodexHeaders(creds) {
         headers['ChatGPT-Account-ID'] = accountId;
     return headers;
 }
+/**
+ * Serve a Responses-shape request (`POST /v1/responses`) from a stored Codex
+ * account with NO translation: the ChatGPT backend speaks this shape natively,
+ * so the body goes through as the client wrote it (only `stream` forced) and
+ * the backend's SSE goes back byte for byte. This is what
+ * keeps the newest Codex CLI features working on a ChatGPT plan through dario
+ * — `additional_tools` input items, `custom` tools, `reasoning.context`,
+ * `include` — none of which survive a round trip through the Messages shape.
+ *
+ * Streaming only: the backend always streams, and folding a Responses stream
+ * into a buffered response object is not built yet. A non-streaming client
+ * gets a 400 saying so.
+ */
+export async function forwardResponsesToCodex(res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, fetchImpl = fetch, onDone) {
+    const startedAt = Date.now();
+    const model = String(body.model ?? '');
+    let reported = false;
+    const report = (status, usage) => {
+        if (reported || !onDone)
+            return;
+        reported = true;
+        try {
+            onDone({ status, latencyMs: Date.now() - startedAt, inputTokens: usage?.input ?? 0, outputTokens: usage?.output ?? 0,
+                cacheReadTokens: usage?.cacheRead ?? 0, cacheCreateTokens: usage?.cacheCreate ?? 0, stream: true, model, alias: creds.alias });
+        }
+        catch { /* never break a served request */ }
+    };
+    if (body.stream !== true) {
+        res.writeHead(400, { 'Content-Type': 'application/json', ...securityHeaders });
+        res.end(JSON.stringify({ error: { message: 'stream: true is required on /v1/responses for a ChatGPT-subscription model (the backend streams; buffering is not built)', type: 'invalid_request_error', param: 'stream', code: null } }));
+        report(400, null);
+        return true;
+    }
+    // Only `stream` is forced. `store` is the client's — sent, or omitted so
+    // the backend applies its own default: a stateful client relies on that
+    // default to make its next turn's previous_response_id resolvable, and
+    // Codex CLI sends false itself.
+    const upstreamBody = { ...body, stream: true };
+    const target = `${CODEX_BACKEND_BASE_URL.replace(/\/$/, '')}/responses`;
+    const abort = new AbortController();
+    let clientGone = false;
+    let finished = false;
+    const onClientClose = () => { if (!finished && !clientGone) {
+        clientGone = true;
+        if (!abort.signal.aborted)
+            abort.abort();
+    } };
+    res.on('close', onClientClose);
+    const timeout = setTimeout(() => abort.abort(), upstreamTimeoutMs);
+    let usage = null;
+    try {
+        if (verbose)
+            console.log(`[dario] → codex backend (responses passthrough): ${target} (model: ${model})`);
+        const upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(creds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+        if (!upstream.ok || !upstream.body) {
+            const detail = await upstream.text().catch(() => '');
+            if (verbose)
+                console.error(`[dario] codex backend ${upstream.status}: ${detail.slice(0, 300)}`);
+            if (!clientGone) {
+                res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
+                // The backend's own error body, already in the client's shape.
+                res.end(detail || JSON.stringify({ error: { message: 'Upstream Codex backend error', type: 'server_error', code: null, param: null } }));
+            }
+            report(clientGone ? 499 : upstream.status, null);
+            return true;
+        }
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': corsOrigin, ...securityHeaders });
+        const reader = upstream.body.getReader();
+        const decoder = new TextDecoder();
+        let tail = '';
+        let terminal = false;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (clientGone)
+                    break;
+                res.write(value);
+                // Usage rides the terminal event; read it off the wire as it passes.
+                // The terminal event also ENDS the response here: Codex CLI closes
+                // its side the moment it has `response.completed`, and waiting for the
+                // backend's EOF instead turned every finished turn into a "client
+                // disconnected" abort in the log.
+                tail += decoder.decode(value, { stream: true });
+                const frames = tail.split('\n\n');
+                tail = frames.pop() ?? '';
+                for (const f of frames) {
+                    const line = f.split('\n').find((l) => l.startsWith('data:'));
+                    if (!line)
+                        continue;
+                    let ev;
+                    try {
+                        ev = JSON.parse(line.slice(5));
+                    }
+                    catch {
+                        continue;
+                    }
+                    if (!isTerminalResponsesEvent(ev.type ?? ''))
+                        continue;
+                    terminal = true;
+                    usage = splitResponsesUsage(ev.response?.usage) ?? usage;
+                }
+                if (terminal)
+                    break;
+            }
+        }
+        finally {
+            reader.releaseLock();
+            if (terminal && !abort.signal.aborted)
+                abort.abort();
+        }
+        finished = true;
+        if (!clientGone)
+            res.end();
+        report(clientGone ? 499 : 200, usage);
+        return true;
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        if (verbose)
+            console.error(`[dario] codex backend (${creds.alias}) responses passthrough error: ${detail}`);
+        if (!clientGone) {
+            if (!res.headersSent) {
+                res.writeHead(502, { 'Content-Type': 'application/json', ...securityHeaders });
+                res.end(JSON.stringify({ error: { message: 'Upstream Codex backend error', type: 'server_error', code: null, param: null } }));
+            }
+            else {
+                try {
+                    res.end();
+                }
+                catch { /* already closed */ }
+            }
+        }
+        report(clientGone ? 499 : 502, usage);
+        return true;
+    }
+    finally {
+        clearTimeout(timeout);
+        res.removeListener('close', onClientClose);
+    }
+}
 /**
  * Serve a request from a stored Codex account, in either client wire shape.
  *

package/dist/doctor-core.d.ts

@@ -37,6 +37,21 @@ export interface Check {
  * live request, and this release was built on the lesson that a green config is
  * not a working path.
  */
+/**
+ * Mid-stream continuation readiness (v6.2.1). Configuration only, like
+ * failoverReadiness: it says which of the two hops a dying stream can take on
+ * this host, not that either works. The first hop (the same model again) needs
+ * nothing; the second (the other subscription) needs the failover chain AND
+ * somewhere for it to go — the exact INERT state the Failover row exists for.
+ */
+export declare function continuationReadiness(input: {
+    enabled: boolean;
+    chain: readonly string[];
+    codexAccounts: number;
+}): {
+    status: CheckStatus;
+    detail: string;
+};
 export declare function failoverReadiness(input: {
     chain: readonly string[];
     codexAccounts: number;

package/dist/doctor-core.js

@@ -41,6 +41,29 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
  * live request, and this release was built on the lesson that a green config is
  * not a working path.
  */
+/**
+ * Mid-stream continuation readiness (v6.2.1). Configuration only, like
+ * failoverReadiness: it says which of the two hops a dying stream can take on
+ * this host, not that either works. The first hop (the same model again) needs
+ * nothing; the second (the other subscription) needs the failover chain AND
+ * somewhere for it to go — the exact INERT state the Failover row exists for.
+ */
+export function continuationReadiness(input) {
+    if (!input.enabled) {
+        return { status: 'info', detail: 'off — a stream that dies mid-answer ends truncated (unset DARIO_MIDSTREAM_CONTINUE / drop --no-midstream-continue)' };
+    }
+    const secondHop = input.chain.length > 0 && input.codexAccounts > 0;
+    if (secondHop) {
+        return { status: 'ok', detail: `on: a dying stream resumes on the same model, then on ${input.chain.join(' → ')} (two hops)` };
+    }
+    return {
+        status: 'ok',
+        detail: 'on: a dying stream resumes on the same model only — '
+            + (input.chain.length === 0
+                ? 'add --pool-fallback for a second hop on the other subscription'
+                : 'the chain has nowhere to go for a second hop (see Failover)'),
+    };
+}
 export function failoverReadiness(input) {
     const { chain, codexAccounts, backends } = input;
     const hasCodex = codexAccounts > 0;
@@ -1170,6 +1193,9 @@ export async function runChecks(opts = {}) {
             backends: backends.map((b) => b.name),
         });
         checks.push({ status: verdict.status, label: 'Failover', detail: verdict.detail });
+        const midstreamEnabled = !['0', 'false', 'no', 'off'].includes((process.env.DARIO_MIDSTREAM_CONTINUE ?? '').toLowerCase());
+        const cont = continuationReadiness({ enabled: midstreamEnabled, chain, codexAccounts: codexAliases.length });
+        checks.push({ status: cont.status, label: 'Continuation', detail: cont.detail });
     }
     catch (err) {
         checks.push({ status: 'warn', label: 'Failover', detail: `check failed: ${err.message}` });

package/dist/midstream.d.ts

@@ -334,6 +334,34 @@ export declare class MidstreamGuard {
     private continueFrom;
     private log;
 }
+export interface ChaosCutOptions {
+    /** Characters of answer text an upstream stream is allowed before it is cut. */
+    afterChars: number;
+    /** How many streams to cut before the tap goes quiet (default 1). */
+    streams?: number;
+    log?: (line: string) => void;
+}
+/**
+ * The remaining-cuts counter, shared by every wrapper the proxy makes. The
+ * Claude leg and the codex leg wrap different fetch implementations, and a
+ * counter per wrapper would cut up to twice the promised number of streams
+ * (review finding on #1290): one budget for the proxy, not one per provider.
+ */
+export interface ChaosCutState {
+    left: number;
+}
+export declare function chaosCutState(o: ChaosCutOptions): ChaosCutState;
+/**
+ * Wraps an upstream fetch so that the first `streams` streamed answers die
+ * after `afterChars` characters of text — the failure this module exists for,
+ * on demand. A resume (its body carries the anchor quote) is never cut, so
+ * the tap produces a primary death and lets the continuation play out.
+ *
+ * Demo and test affordance, never a default: `DARIO_CHAOS_CUT_AFTER=300
+ * dario proxy` then stream any request and watch the seam. Both providers'
+ * text framing is recognised (`text_delta` / `response.output_text.delta`).
+ */
+export declare function chaosCutFetch(inner: typeof fetch, o: ChaosCutOptions, state?: ChaosCutState): typeof fetch;
 /** Convenience for sites that hold a ServerResponse: the guard writes through `write`, ends through `res.end()`. */
 export declare function guardFor(res: ServerResponse, o: Omit<MidstreamGuardOptions, 'end'>): MidstreamGuard;
 /**

package/dist/midstream.js

@@ -901,6 +901,62 @@ export class MidstreamGuard {
         (this.o.log ?? ((l) => console.log(`[dario] ${l}`)))(line);
     }
 }
+export function chaosCutState(o) {
+    return { left: o.streams ?? 1 };
+}
+/**
+ * Wraps an upstream fetch so that the first `streams` streamed answers die
+ * after `afterChars` characters of text — the failure this module exists for,
+ * on demand. A resume (its body carries the anchor quote) is never cut, so
+ * the tap produces a primary death and lets the continuation play out.
+ *
+ * Demo and test affordance, never a default: `DARIO_CHAOS_CUT_AFTER=300
+ * dario proxy` then stream any request and watch the seam. Both providers'
+ * text framing is recognised (`text_delta` / `response.output_text.delta`).
+ */
+export function chaosCutFetch(inner, o, state = chaosCutState(o)) {
+    const log = o.log ?? ((l) => console.warn(`[dario] ${l}`));
+    return async (input, init) => {
+        const res = await inner(input, init);
+        const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+        const isStream = /\/v1\/messages|\/responses/.test(url);
+        const bodyText = typeof init?.body === 'string' ? init.body : init?.body instanceof Uint8Array ? new TextDecoder().decode(init.body) : '';
+        const isResume = bodyText.includes(ANCHOR_OPEN);
+        if (!isStream || isResume || state.left <= 0 || res.status !== 200 || !res.body)
+            return res;
+        state.left--;
+        const reader = res.body.getReader();
+        const dec = new TextDecoder();
+        let text = '';
+        const body = new ReadableStream({
+            async pull(c) {
+                const { done, value } = await reader.read();
+                if (done) {
+                    c.close();
+                    return;
+                }
+                c.enqueue(value);
+                for (const m of dec.decode(value, { stream: true }).matchAll(/"(?:text|delta)":"((?:[^"\\]|\\.)*)"/g)) {
+                    try {
+                        text += JSON.parse(`"${m[1]}"`);
+                    }
+                    catch { /* not a text fragment */ }
+                }
+                if (text.length >= o.afterChars) {
+                    log(`CHAOS: cutting this stream after ${text.length} chars (${state.left} more to go)`);
+                    await new Promise((r) => setTimeout(r, 30)); // let what is queued reach the reader first
+                    try {
+                        await reader.cancel();
+                    }
+                    catch { /* already gone */ }
+                    c.error(new Error('chaos: read ECONNRESET'));
+                }
+            },
+            cancel() { reader.cancel().catch(() => { }); },
+        });
+        return new Response(body, { status: res.status, statusText: res.statusText, headers: res.headers });
+    };
+}
 /** Convenience for sites that hold a ServerResponse: the guard writes through `write`, ends through `res.end()`. */
 export function guardFor(res, o) {
     return new MidstreamGuard({ ...o, end: () => { if (!res.writableEnded)

package/dist/proxy.js

@@ -24,9 +24,10 @@ import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncL
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
-import { forwardToCodex, getCodexModelSlugs, peekCodexModelSlugs, isCodexModel, pickCodexFallback, pickClaudeTarget, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
+import { forwardToCodex, forwardResponsesToCodex, getCodexModelSlugs, peekCodexModelSlugs, isCodexModel, pickCodexFallback, pickClaudeTarget, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
 import { effortForCodex } from './effort.js';
-import { MidstreamGuard, guardFor, loopbackBaseFor, CONTINUATION_HEADER, MAX_CONTINUATION_DEPTH, continuationDepth } from './midstream.js';
+import { MidstreamGuard, guardFor, loopbackBaseFor, chaosCutFetch, chaosCutState, CONTINUATION_HEADER, MAX_CONTINUATION_DEPTH, continuationDepth } from './midstream.js';
+import { responsesRequestToAnthropic, unsupportedOnClaudeError, ResponsesRequestError, ResponsesOut, wrapResponsesClient } from './responses-inbound.js';
 import { isClaudeServableModel } from './claude-model.js';
 import { MODEL_UNROUTABLE } from './upstream-rejection.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
@@ -609,6 +610,9 @@ export function resolveProxyTarget(urlPath, isOpenAI) {
         return { target: `${ANTHROPIC_API}/v1/messages?beta=true`, thin: false };
     const allowed = {
         '/v1/messages': { target: `${ANTHROPIC_API}/v1/messages?beta=true`, thin: false },
+        // OpenAI Responses shape (v6.3, src/responses-inbound.ts): translated to
+        // a Messages body at the front door, served like any Anthropic request.
+        '/v1/responses': { target: `${ANTHROPIC_API}/v1/messages?beta=true`, thin: false },
         '/v1/messages/count_tokens': { target: `${ANTHROPIC_API}/v1/messages/count_tokens`, thin: true },
         '/v1/complete': { target: `${ANTHROPIC_API}/v1/complete`, thin: false },
     };
@@ -1093,7 +1097,22 @@ export async function startProxy(opts = {}) {
     // Upstream auth override: a per-token API key forwards to the standard API
     // pool via `x-api-key`, bypassing OAuth/Max + the account pool entirely.
     // Env-only so the key never lands in `ps`/argv. Default (empty) = OAuth/Max.
-    const upstreamFetch = opts.fetchImpl ?? fetch;
+    // DARIO_CHAOS_CUT_AFTER=<chars> [DARIO_CHAOS_CUT_STREAMS=<n>]: the first n
+    // streamed answers die on purpose after that many characters, so the
+    // mid-stream continuation can be watched on demand. Demo and test only —
+    // loud at startup, never a default. Applied to the codex leg as well.
+    const chaosCutAfter = Number.parseInt(process.env.DARIO_CHAOS_CUT_AFTER ?? '', 10);
+    const chaosCut = Number.isFinite(chaosCutAfter) && chaosCutAfter > 0
+        ? { afterChars: chaosCutAfter, streams: Math.max(1, Number.parseInt(process.env.DARIO_CHAOS_CUT_STREAMS ?? '1', 10) || 1) }
+        : null;
+    if (chaosCut)
+        console.warn(`[dario] ⚠  CHAOS: the first ${chaosCut.streams} streamed answer${chaosCut.streams === 1 ? '' : 's'} will be cut after ${chaosCut.afterChars} chars (DARIO_CHAOS_CUT_AFTER) — demo/test only`);
+    // One cut budget for the whole proxy. The two legs wrap different fetch
+    // implementations (the Claude leg honours opts.fetchImpl, the codex leg is
+    // the global fetch), so the counter lives outside both wrappers.
+    const chaosState = chaosCut ? chaosCutState(chaosCut) : null;
+    const upstreamFetch = chaosCut && chaosState ? chaosCutFetch(opts.fetchImpl ?? fetch, chaosCut, chaosState) : (opts.fetchImpl ?? fetch);
+    const codexFetch = chaosCut && chaosState ? chaosCutFetch(fetch, chaosCut, chaosState) : fetch;
     const upstreamApiKey = (opts.upstreamApiKey ?? process.env.ANTHROPIC_UPSTREAM_API_KEY ?? '').trim();
     if (upstreamApiKey)
         console.error('[dario] upstream auth: per-token API key (x-api-key) — OAuth/Max + account pool bypassed');
@@ -2587,6 +2606,17 @@ export async function startProxy(opts = {}) {
         }
         // Detect OpenAI-format requests
         const isOpenAI = urlPath === '/v1/chat/completions';
+        // A Responses-API client (Codex CLI, the OpenAI Agents SDK). Its request
+        // becomes an Anthropic Messages body below and everything written back to
+        // it is translated at the write boundary — from here on `res` IS that
+        // boundary, so even a pre-upstream error reaches the client in its shape.
+        const isResponses = urlPath === '/v1/responses';
+        const responsesOut = isResponses ? new ResponsesOut('') : null;
+        // The untranslated response, for the one path that answers a Responses
+        // client in its own shape without translation: the codex passthrough.
+        const rawRes = res;
+        if (responsesOut)
+            res = wrapResponsesClient(res, responsesOut);
         // Allowlisted API paths — only these are proxied (prevents SSRF).
         // count_tokens forwards thin (no template injection) — see resolveProxyTarget.
         const route = resolveProxyTarget(urlPath, isOpenAI);
@@ -2951,7 +2981,7 @@ export async function startProxy(opts = {}) {
             // (aliases, prefixes, the CC template); a mid-stream continuation
             // re-issues the CLIENT's request, not the rewritten one, so dario's own
             // rules apply to the resume the same way they applied to the original.
-            const clientBodyBytes = body;
+            let clientBodyBytes = body;
             // How deep in a continuation chain this request sits: 0 for a client
             // request, 1 for its resume, 2 for the resume of that resume — which is
             // never continued itself (MAX_CONTINUATION_DEPTH).
@@ -3069,6 +3099,45 @@ export async function startProxy(opts = {}) {
                     return;
                 }
             }
+            // Responses shape → Messages shape, once, before any routing peeks at
+            // the body. The translated body is what a continuation re-issues too:
+            // the loopback goes to /v1/messages, which is what this body now is.
+            // The client's Responses body as written — a ChatGPT-subscription model
+            // gets it verbatim (forwardResponsesToCodex), every other route gets the
+            // translation.
+            let responsesBodyRaw = null;
+            // NOTHING IS REFUSED HERE. Routing has not happened yet, so the
+            // translation only RECORDS what the Messages shape cannot carry
+            // (`t.unsupported`, e.g. previous_response_id). The route decides: the
+            // codex passthrough below forwards `responsesBodyRaw` untouched, so a
+            // stateful follow-up on a ChatGPT-subscription model reaches the backend
+            // that keeps state; only the Claude path, after the codex branch has
+            // passed on the request, answers a 400 naming the field. Both halves are
+            // asserted in test/responses-inbound-wiring.mjs ("previous_response_id
+            // on a ChatGPT-subscription model → forwarded untouched").
+            let responsesUnsupported = [];
+            if (isResponses && parsedBody !== null) {
+                try {
+                    responsesBodyRaw = parsedBody;
+                    const t = responsesRequestToAnthropic(parsedBody);
+                    if (verbose && t.warnings.length > 0)
+                        console.log(`[dario] #${requestCount} /v1/responses: ${t.warnings.join('; ')}`);
+                    responsesUnsupported = t.unsupported;
+                    parsedBody = t.body;
+                    body = Buffer.from(JSON.stringify(t.body));
+                    clientBodyBytes = body;
+                }
+                catch (err) {
+                    // Only the translator's own verdicts reach the client; anything else
+                    // is an internal failure and says so without its message.
+                    const known = err instanceof ResponsesRequestError;
+                    if (!known && verbose)
+                        console.error(`[dario] #${requestCount} /v1/responses translation failed: ${sanitizeError(err)}`);
+                    res.writeHead(400, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ error: { message: known ? err.message : 'request could not be translated', type: 'invalid_request_error', param: known ? err.param ?? null : null, code: null } }));
+                    return;
+                }
+            }
             // Provider prefix (v3.10.0). If the body's model field is `<provider>:<model>`
             // with a recognized prefix, strip the prefix and force routing regardless of
             // regex. CLI-level `--model=<provider>:<name>` applies the same override
@@ -3397,14 +3466,13 @@ export async function startProxy(opts = {}) {
                                 },
                             })
                             : null;
-                        const served = codexAvailable && await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', fetch, canDefer, 
                         // Before this hook a codex request left no trace: nothing in
                         // /analytics, nothing in the request log, no per-account count.
                         // The dock (and anyone reading /analytics) saw a proxy that
                         // served GPT all day and reported zero of it. A decline (the
                         // request handed to the Claude pool) reports nothing here; the
                         // Claude path records what it then serves.
-                        (o) => {
+                        const codexOnDone = (o) => {
                             codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
                             analytics.record({
                                 timestamp: Date.now(),
@@ -3433,16 +3501,25 @@ export async function startProxy(opts = {}) {
                                     inputTokens: o.inputTokens, outputTokens: o.outputTokens,
                                     cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens,
                                 }, consumer));
-                        }, 
-                        // Cool codex on a rate limit only — a 5xx or an unreachable backend
-                        // is an outage, and parking a provider for that would keep it out
-                        // of the chain while it was already coming back.
-                        (d) => { if (d.status === 429)
-                            providerCooldowns.note('codex', d.retryAfterMs); }, 
-                        // dario#1260 — the effort named by the model-name suffix stripped
-                        // above. Undefined for every request that did not name one, which
-                        // leaves the outbound body exactly as it was.
-                        effortForCodex(requestEffort), codexGuard);
+                        };
+                        // A Responses client on a ChatGPT-subscription model: the backend
+                        // speaks that shape natively, so the body goes through as written
+                        // (model resolved) and the SSE comes back untouched — no round
+                        // trip through the Messages shape, which cannot carry the newest
+                        // Codex CLI request features. Answers on the raw response: these
+                        // bytes are already in the client's shape.
+                        const served = codexAvailable && (isResponses && responsesBodyRaw
+                            ? await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone)
+                            : await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', codexFetch, canDefer, codexOnDone, 
+                            // Cool codex on a rate limit only — a 5xx or an unreachable backend
+                            // is an outage, and parking a provider for that would keep it out
+                            // of the chain while it was already coming back.
+                            (d) => { if (d.status === 429)
+                                providerCooldowns.note('codex', d.retryAfterMs); }, 
+                            // dario#1260 — the effort named by the model-name suffix stripped
+                            // above. Undefined for every request that did not name one, which
+                            // leaves the outbound body exactly as it was.
+                            effortForCodex(requestEffort), codexGuard));
                         if (served) {
                             // A provider that just served is not rate-limited.
                             providerCooldowns.clear('codex');
@@ -3532,6 +3609,16 @@ export async function startProxy(opts = {}) {
                 }
                 catch { /* not JSON — fall through to existing path */ }
             }
+            // A Responses feature only the codex passthrough can honour, on a
+            // request the Claude pool is about to serve: refuse it by name here,
+            // after routing, so the same field on a ChatGPT-subscription model was
+            // forwarded untouched above.
+            if (isResponses && responsesUnsupported.length > 0) {
+                requestCount++;
+                res.writeHead(400, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                res.end(JSON.stringify(unsupportedOnClaudeError(responsesUnsupported[0])));
+                return;
+            }
             // Claude's turn: the routing block above declined this request, so it
             // needs a pool account. Selecting HERE and not before the body read is
             // the fix for dario#1137 — a ChatGPT-subscription-only user has a