@askalf/dario 6.3.0 → 6.5.0

package/README.md

@@ -269,6 +269,8 @@ The tool doesn't know. The backend doesn't know. dario is the seam.
 
 A ChatGPT Plus or Pro plan is served on **all three** of dario's endpoints: any client that speaks `/v1/chat/completions` or `/v1/responses` can use it (Codex CLI, the OpenAI SDKs, the Agents SDK, your scripts), and so can any client that speaks `/v1/messages` (Claude Code, the Anthropic SDKs, agent runtimes). The harness never needs to know which subscription is behind it — and the symmetry holds: Codex CLI runs on a Claude plan the same way.
 
+An Anthropic-shape client that declares Anthropic's hosted `web_search_20260209` tool gets **real web search on the ChatGPT plan** (since 6.4): the plan's own search runs, and the client sees Anthropic's own blocks — `server_tool_use` with the query, `web_search_tool_result` listing the pages searched, the answer with `web_search_result_location` citations. `allowed_domains` and `user_location` carry over, and so does forcing the search with `tool_choice`; `blocked_domains` and `max_uses` do not.
+
 ```bash
 dario add altman            # prints an authorize URL; paste the redirect URL back
 dario codex list

package/dist/anthropic-responses-translate.d.ts

@@ -216,9 +216,33 @@ export interface ResponsesFunctionTool {
     parameters: Record<string, unknown>;
     strict?: boolean | null;
 }
+/**
+ * The Responses hosted web-search tool (v6.4). `filters.allowed_domains` and
+ * `user_location` are the two Anthropic web-search options it can carry;
+ * `blocked_domains` and `max_uses` have no equivalent and are dropped.
+ */
+export interface ResponsesWebSearchTool {
+    type: 'web_search';
+    filters?: {
+        allowed_domains?: string[];
+    };
+    user_location?: {
+        type: 'approximate';
+        city?: string;
+        region?: string;
+        country?: string;
+        timezone?: string;
+    };
+    search_context_size?: 'low' | 'medium' | 'high';
+}
+export type ResponsesTool = ResponsesFunctionTool | ResponsesWebSearchTool;
 export type ResponsesToolChoice = 'auto' | 'none' | 'required' | {
     type: 'function';
     name: string;
+}
+/** Force the hosted web search (the backend accepts `web_search` here, not a function name). */
+ | {
+    type: 'web_search';
 };
 export interface ResponsesReasoningConfig {
     /**
@@ -235,7 +259,9 @@ export interface ResponsesRequest {
     model: string;
     input: ResponsesInputItem[];
     instructions?: string;
-    tools?: ResponsesFunctionTool[];
+    tools?: ResponsesTool[];
+    /** `web_search_call.action.sources` — the searched URLs, which the Anthropic result block needs. */
+    include?: string[];
     tool_choice?: ResponsesToolChoice;
     parallel_tool_calls?: boolean;
     reasoning?: ResponsesReasoningConfig;
@@ -292,7 +318,29 @@ export interface ResponsesReasoningItem {
     encrypted_content?: string | null;
     status?: string;
 }
-export type ResponsesOutputItem = ResponsesMessageItem | ResponsesResponseFunctionCall | ResponsesReasoningItem | {
+/**
+ * A hosted web-search step as the backend reports it. `action.type` is
+ * `search` (with `query` and, when `include: web_search_call.action.sources`
+ * was asked for, `sources`), `open_page` (`url`) or `find_in_page`
+ * (`url`, `pattern`) — probed 2026-09-12 on the ChatGPT backend.
+ */
+export interface ResponsesWebSearchCallItem {
+    type: 'web_search_call';
+    id?: string;
+    status?: string;
+    action?: {
+        type?: string;
+        query?: string;
+        queries?: string[];
+        url?: string;
+        pattern?: string;
+        sources?: Array<{
+            type?: string;
+            url?: string;
+        }>;
+    };
+}
+export type ResponsesOutputItem = ResponsesMessageItem | ResponsesResponseFunctionCall | ResponsesReasoningItem | ResponsesWebSearchCallItem | {
     type: string;
     [key: string]: unknown;
 };
@@ -429,6 +477,15 @@ export type ResponsesAnthropicStreamEvent = {
         id: string;
         name: string;
         input: Record<string, unknown>;
+    } | {
+        type: 'server_tool_use';
+        id: string;
+        name: 'web_search';
+        input: Record<string, unknown>;
+    } | {
+        type: 'web_search_tool_result';
+        tool_use_id: string;
+        content: AnthropicWebSearchResult[];
     };
 } | {
     type: 'content_block_delta';
@@ -442,6 +499,9 @@ export type ResponsesAnthropicStreamEvent = {
     } | {
         type: 'input_json_delta';
         partial_json: string;
+    } | {
+        type: 'citations_delta';
+        citation: AnthropicWebSearchCitation;
     };
 } | {
     type: 'content_block_stop';
@@ -461,6 +521,22 @@ export type ResponsesAnthropicStreamEvent = {
 } | {
     type: 'message_stop';
 };
+/** One searched page, as Anthropic's `web_search_tool_result` lists them. */
+export interface AnthropicWebSearchResult {
+    type: 'web_search_result';
+    url: string;
+    title: string;
+    encrypted_content: string;
+    page_age: string | null;
+}
+/** A citation on a text block, as Anthropic's `citations_delta` carries it. */
+export interface AnthropicWebSearchCitation {
+    type: 'web_search_result_location';
+    url: string;
+    title: string;
+    cited_text: string;
+    encrypted_index: string;
+}
 /**
  * One parsed Responses SSE event — a typed superset of the fields this
  * translator consumes. Every event carries a `type`; the rest are present
@@ -480,6 +556,14 @@ export interface ResponsesStreamEvent {
     summary_index?: number;
     /** Text / argument / reasoning fragment on `*.delta` events. */
     delta?: string;
+    /** `output_text.annotation.added`: a url_citation over the item's text. */
+    annotation?: {
+        type?: string;
+        url?: string;
+        title?: string;
+        start_index?: number;
+        end_index?: number;
+    };
     /** error event fields. */
     code?: string | null;
     message?: string;

package/dist/anthropic-responses-translate.js

@@ -288,7 +288,7 @@ function translateAssistantBlocks(blocks) {
         out.push(call);
     return out;
 }
-function translateToolChoice(choice) {
+function translateToolChoice(choice, webSearchName) {
     if (!choice || typeof choice !== 'object')
         return undefined;
     switch (choice.type) {
@@ -299,7 +299,12 @@ function translateToolChoice(choice) {
         case 'any':
             return 'required';
         case 'tool':
-            // Responses forced form is FLATTENED: {type:'function', name}.
+            // Responses forced form is FLATTENED: {type:'function', name}. Forcing
+            // the hosted web search is its own shape — `{type:'function', name:
+            // 'web_search'}` names a function the request never declared and the
+            // backend 400s ("Tool choice 'function' not found in 'tools'").
+            if (typeof choice.name === 'string' && choice.name === webSearchName)
+                return { type: 'web_search' };
             return typeof choice.name === 'string'
                 ? { type: 'function', name: choice.name }
                 : 'required';
@@ -361,11 +366,37 @@ export function anthropicToResponsesRequest(body, targetModel, options = {}) {
     const instructions = flattenSystem(body.system);
     if (instructions.length > 0)
         out.instructions = instructions;
+    // The client's name for the hosted web search, once one is declared, so a
+    // forced tool_choice on it translates to the hosted-tool choice.
+    let webSearchName;
     if (Array.isArray(body.tools)) {
         const tools = [];
+        let webSearch = false;
         for (const tool of body.tools) {
             if (!tool || typeof tool.name !== 'string')
                 continue;
+            // Anthropic's hosted web search → the backend's hosted web search. The
+            // two options both sides speak travel; the rest is dropped. Asking for
+            // `action.sources` is what lets the result block name the pages it
+            // searched rather than come back empty.
+            const t = tool;
+            if (typeof t.type === 'string' && t.type.startsWith('web_search') && !webSearch) {
+                webSearch = true;
+                webSearchName = tool.name;
+                const ws = { type: 'web_search' };
+                if (Array.isArray(t.allowed_domains) && t.allowed_domains.length > 0)
+                    ws.filters = { allowed_domains: t.allowed_domains.filter((d) => typeof d === 'string') };
+                const loc = t.user_location;
+                if (loc && typeof loc === 'object') {
+                    const l = { type: 'approximate' };
+                    for (const k of ['city', 'region', 'country', 'timezone'])
+                        if (typeof loc[k] === 'string')
+                            l[k] = loc[k];
+                    ws.user_location = l;
+                }
+                tools.push(ws);
+                continue;
+            }
             if (!tool.input_schema || typeof tool.input_schema !== 'object')
                 continue;
             const fn = {
@@ -379,8 +410,10 @@ export function anthropicToResponsesRequest(body, targetModel, options = {}) {
         }
         if (tools.length > 0)
             out.tools = tools;
+        if (webSearch)
+            out.include = ['web_search_call.action.sources'];
     }
-    const toolChoice = translateToolChoice(body.tool_choice);
+    const toolChoice = translateToolChoice(body.tool_choice, webSearchName);
     if (toolChoice !== undefined && out.tools)
         out.tool_choice = toolChoice;
     if (body.tool_choice?.disable_parallel_tool_use === true && out.tools) {
@@ -579,6 +612,10 @@ export function responsesStreamToAnthropicSSE(options = {}) {
     const blockByOutputIndex = new Map();
     let sawToolCall = false;
     let syntheticToolSeq = 0;
+    /** Text streamed per message item, so a url_citation's indices can be turned into cited_text. */
+    const textByOutputIndex = new Map();
+    /** server_tool_use ids per web_search_call output index, for the result block. */
+    const searchIdByOutputIndex = new Map();
     function ensureStarted(event, events) {
         if (started)
             return;
@@ -620,6 +657,46 @@ export function responsesStreamToAnthropicSSE(options = {}) {
         });
         return index;
     }
+    /**
+     * A hosted web-search step: a `server_tool_use` block opened at
+     * output_item.added, its input (query or url) written at output_item.done
+     * when the backend reveals the action, then a `web_search_tool_result`
+     * block listing the pages the step touched — the searched sources when the
+     * request asked for them, the opened page otherwise.
+     */
+    function openSearchBlock(item, outputIndex, events) {
+        const index = nextIndex++;
+        open = { kind: 'search', index, outputIndex };
+        blockByOutputIndex.set(outputIndex, { kind: 'search', index });
+        const id = strOr(item?.id) || `srvtoolu_responses_${syntheticToolSeq++}`;
+        searchIdByOutputIndex.set(outputIndex, id);
+        events.push({ type: 'content_block_start', index, content_block: { type: 'server_tool_use', id, name: 'web_search', input: {} } });
+        return index;
+    }
+    function finishSearchBlock(item, outputIndex, events) {
+        const ws = (item ?? {});
+        const action = ws.action ?? {};
+        const input = action.type === 'search' || action.query
+            ? { query: strOr(action.query) || (Array.isArray(action.queries) ? strOr(action.queries[0]) : '') }
+            : action.url ? { url: strOr(action.url), ...(action.pattern ? { pattern: strOr(action.pattern) } : {}) } : {};
+        const blk = blockByOutputIndex.get(outputIndex);
+        if (blk && blk.kind === 'search') {
+            events.push({ type: 'content_block_delta', index: blk.index, delta: { type: 'input_json_delta', partial_json: JSON.stringify(input) } });
+        }
+        closeOpenBlock(events);
+        const results = [];
+        const seen = new Set();
+        const urls = Array.isArray(action.sources) ? action.sources.map((s) => strOr(s?.url)).filter(Boolean) : action.url ? [strOr(action.url)] : [];
+        for (const url of urls) {
+            if (seen.has(url))
+                continue;
+            seen.add(url);
+            results.push({ type: 'web_search_result', url, title: '', encrypted_content: '', page_age: null });
+        }
+        const index = nextIndex++;
+        events.push({ type: 'content_block_start', index, content_block: { type: 'web_search_tool_result', tool_use_id: searchIdByOutputIndex.get(outputIndex) ?? '', content: results } });
+        events.push({ type: 'content_block_stop', index });
+    }
     function openThinkingBlock(outputIndex, events) {
         const index = nextIndex++;
         open = { kind: 'thinking', index, outputIndex };
@@ -719,12 +796,16 @@ export function responsesStreamToAnthropicSSE(options = {}) {
                         openToolBlock(event.item, outputIndex, events);
                     else if (itemType === 'reasoning')
                         openThinkingBlock(outputIndex, events);
+                    else if (itemType === 'web_search_call')
+                        openSearchBlock(event.item, outputIndex, events);
                     // message → nothing; the text block opens on the first delta.
                     break;
                 }
                 case 'response.output_text.delta': {
                     if (typeof event.delta === 'string' && event.delta.length > 0) {
-                        const index = ensureTextBlock(numOr(event.output_index, 0), events);
+                        const oi = numOr(event.output_index, 0);
+                        const index = ensureTextBlock(oi, events);
+                        textByOutputIndex.set(oi, (textByOutputIndex.get(oi) ?? '') + event.delta);
                         events.push({
                             type: 'content_block_delta',
                             index,
@@ -733,6 +814,24 @@ export function responsesStreamToAnthropicSSE(options = {}) {
                     }
                     break;
                 }
+                case 'response.output_text.annotation.added': {
+                    // A url_citation over the message text → a citation on the text
+                    // block, with the cited span cut from what has streamed so far.
+                    const a = event.annotation;
+                    if (a && a.type === 'url_citation' && typeof a.url === 'string') {
+                        const oi = numOr(event.output_index, 0);
+                        const index = ensureTextBlock(oi, events);
+                        const text = textByOutputIndex.get(oi) ?? '';
+                        const from = numOr(a.start_index, 0);
+                        const to = numOr(a.end_index, from);
+                        events.push({
+                            type: 'content_block_delta',
+                            index,
+                            delta: { type: 'citations_delta', citation: { type: 'web_search_result_location', url: a.url, title: strOr(a.title), cited_text: text.slice(Math.max(0, from), Math.max(from, to)), encrypted_index: '' } },
+                        });
+                    }
+                    break;
+                }
                 case 'response.function_call_arguments.delta': {
                     if (typeof event.delta === 'string' && event.delta.length > 0) {
                         const index = resolveBlock(numOr(event.output_index, 0), 'tool', events);
@@ -758,6 +857,11 @@ export function responsesStreamToAnthropicSSE(options = {}) {
                 }
                 case 'response.output_item.done': {
                     const outputIndex = numOr(event.output_index, 0);
+                    const itemType = event.item && typeof event.item === 'object' ? event.item.type : undefined;
+                    if (itemType === 'web_search_call') {
+                        finishSearchBlock(event.item, outputIndex, events);
+                        break;
+                    }
                     if (open && open.outputIndex === outputIndex)
                         closeOpenBlock(events);
                     break;
@@ -861,7 +965,7 @@ export function createAnthropicMessageAssembler() {
                 }
                 else if (e.type === 'content_block_start') {
                     blocks[e.index] = { ...e.content_block };
-                    if (e.content_block.type === 'tool_use')
+                    if (e.content_block.type === 'tool_use' || e.content_block.type === 'server_tool_use')
                         partialJson.set(e.index, '');
                 }
                 else if (e.type === 'content_block_delta') {
@@ -873,6 +977,8 @@ export function createAnthropicMessageAssembler() {
                         b.thinking = String(b.thinking ?? '') + d.thinking;
                     else if (d.type === 'input_json_delta')
                         partialJson.set(e.index, (partialJson.get(e.index) ?? '') + d.partial_json);
+                    else if (d.type === 'citations_delta')
+                        (b.citations = (Array.isArray(b.citations) ? b.citations : [])).push(d.citation);
                 }
                 else if (e.type === 'message_delta') {
                     if (msg) {
@@ -894,7 +1000,7 @@ export function createAnthropicMessageAssembler() {
         message(fallbackModel) {
             for (const [i, raw] of partialJson) {
                 const b = blocks[i];
-                if (!b || b.type !== 'tool_use')
+                if (!b || (b.type !== 'tool_use' && b.type !== 'server_tool_use'))
                     continue;
                 b.input = safeParseArguments(raw);
             }

package/dist/codex-accounts.d.ts

@@ -61,14 +61,88 @@ export declare function _resetCodexRefreshFailuresForTest(): void;
  * a misleading "run `dario login`" answer to the client.
  */
 export declare function getFreshCodexAccount(creds: CodexAccountCredentials): Promise<CodexAccountCredentials>;
+/** Record that `alias` declined, for as long as the upstream asked. */
+export declare function noteCodexDecline(alias: string, retryAfterMs?: number | null): number;
+/** A seat that just served is not rate-limited — clear it. */
+export declare function clearCodexDecline(alias: string): void;
+/** Ms until `alias` is askable again; 0 when it is askable now. */
+export declare function codexCooldownRemainingMs(alias: string): number;
+/** Test seam — forget every cool-down and binding. */
+export declare function _resetCodexPoolForTest(): void;
+/** The alias currently bound to a conversation, or null. */
+export declare function codexStickyAliasFor(key: string | null | undefined): string | null;
 /**
- * Pick the account to serve a request. Single account is the expected case (one
- * ChatGPT subscription); with several, `DARIO_CODEX_ACCOUNT` names one and
- * otherwise the first alphabetically wins. No rotation/least-recently-used
- * balancing — a subscription is per-seat, so spreading load across seats is the
- * user's decision to make explicitly, not something to do implicitly.
+ * Move a conversation onto `alias`, the codex mirror of pool.rebindSticky.
+ *
+ * Selection binds a conversation to the seat it picked; mid-request failover
+ * then moves it, and without this the binding still names the seat that just
+ * declined — the next turn would read a stale binding, find it cooling, and
+ * re-pick from scratch. A null key is accepted so the caller does not have to
+ * guard: a request with no hashable first user message has no conversation to
+ * bind.
+ */
+export declare function rebindCodexSticky(key: string | null | undefined, alias: string): void;
+/**
+ * Choose a ChatGPT seat for this request.
+ *
+ * Order, most specific first:
+ *   1. an explicitly named alias (`x-dario-account`, DARIO_CODEX_ACCOUNT) — a
+ *      pin is an instruction, so it is honoured even while cooling; the caller
+ *      asked for that seat and gets its answer, 429 included.
+ *   2. the seat this conversation is already bound to, unless it is cooling.
+ *   3. the first seat alphabetically that is not cooling — deterministic, so a
+ *      given conversation lands on the same seat across a restart and keeps its
+ *      prompt cache.
+ *   4. null when every seat is cooling. The caller answers from that rather
+ *      than spending a request that can only 429 again.
+ */
+export declare function selectCodexAccount(preferredAlias?: string, opts?: {
+    stickyKey?: string | null;
+}): Promise<CodexAccountCredentials | null>;
+/**
+ * The next askable seat that this request has NOT already tried.
+ *
+ * Mid-flight failover: a seat that 429s during a request hands the SAME
+ * request to a peer rather than failing it. Without this the pool only helps
+ * the request AFTER the one that discovered the limit — the discovering
+ * request still failed, every time a window rolled over.
+ *
+ * `tried` is per-request, so a seat already attempted here is never revisited
+ * inside the same request even if its cool-down has not landed yet. That is
+ * the codex mirror of the Claude pool's selectExcluding, and it is what makes
+ * the loop terminate: every pass adds a seat, so it is bounded by pool size.
+ *
+ * Stickiness is deliberately NOT consulted. The bound seat is the one that
+ * just declined; re-offering it would loop, and a conversation whose seat has
+ * gone away is better served elsewhere than not at all.
+ */
+export declare function selectCodexAccountExcluding(tried: ReadonlySet<string>): Promise<CodexAccountCredentials | null>;
+/** Every seat is cooling — the fail-fast condition, for the caller's message. */
+/**
+ * Are ALL of these aliases cooling, right now?
+ *
+ * Synchronous on purpose. The provider-wide cool-down is written from this
+ * answer, and an `await` between deciding and writing is a window another
+ * in-flight request can use: the last-limited-seat request observes every seat
+ * cooling, a peer then succeeds on a just-recovered seat and calls
+ * clearCodexDecline, and the delayed continuation re-cools the whole provider
+ * against a pool that is healthy again. canAttempt('codex') then short-circuits
+ * and the healthy seat is skipped until the stale window expires — the exact
+ * single-seat outage this pool exists to prevent, reintroduced by the
+ * bookkeeping meant to prevent it.
+ *
+ * Re-checking inside the continuation narrows that window; it does not close
+ * it, because the re-check is itself another await. Taking the alias list first
+ * and then deciding-and-writing with no suspension point between them closes it
+ * outright: JS runs that callback as one unit, so nothing can interleave.
+ *
+ * The alias list may be a tick stale, which is harmless — a seat added in that
+ * window is not cooling, so "all cooled" is false on the next decline anyway.
  */
-export declare function selectCodexAccount(preferredAlias?: string): Promise<CodexAccountCredentials | null>;
+export declare function allAliasesCooled(aliases: readonly string[]): boolean;
+export declare function allCodexAccountsCooled(): Promise<boolean>;
+/** Longest remaining cool-down across every seat, for a `retry-after`. */
+export declare function codexPoolRetryAfterMs(): Promise<number>;
 /**
  * Parse whatever the user pastes back after authorizing.
  *

package/dist/codex-accounts.js

@@ -15,6 +15,7 @@ import { homedir } from 'node:os';
 import { randomBytes } from 'node:crypto';
 import { generateCodexPKCE, buildCodexAuthorizeUrl, exchangeCodexAuthorizationCode, refreshCodexAccessToken, CodexRefreshError, } from './codex-oauth.js';
 import { durableWriteFile } from './durable-write.js';
+import { ProviderCooldowns } from './provider-cooldown.js';
 const DARIO_DIR = join(homedir(), '.dario');
 const CODEX_ACCOUNTS_DIR = join(DARIO_DIR, 'codex-accounts');
 /** Same alias charset/traversal guard as accounts.ts's safeAliasPath. */
@@ -298,7 +299,105 @@ export async function getFreshCodexAccount(creds) {
  * balancing — a subscription is per-seat, so spreading load across seats is the
  * user's decision to make explicitly, not something to do implicitly.
  */
-export async function selectCodexAccount(preferredAlias) {
+/**
+ * Per-seat cool-downs and conversation stickiness for the ChatGPT pool
+ * (dario#1244 follow-up).
+ *
+ * Until now selectCodexAccount returned `sort()[0]` — the alphabetically FIRST
+ * account, every time. `dario add altman` will happily store a dozen seats and
+ * dario would use exactly one of them. That is why the account-wide 429 on
+ * 2026-09-07 took the whole GPT lane down: a second seat sat there, healthy and
+ * unreachable, while every request failed over to Claude.
+ *
+ * Reuses ProviderCooldowns keyed by ALIAS rather than by provider name. It is
+ * already the right shape — arbitrary string key, injectable clock, entries
+ * dropped on read — so the pool needs no second cool-down implementation.
+ *
+ * ROTATION IS PER-CONVERSATION, NOT PER-REQUEST, and that is the whole design.
+ * The Codex prompt cache is scoped to the serving account: a conversation that
+ * builds a prefix on seat A reads nothing from it on seat B, and measured cache
+ * share on this lane is 59% in production against a 73% controlled ceiling.
+ * Rotating per request would trade a rate-limit problem for a cache problem and
+ * come out behind. So a conversation binds to a seat and stays there until that
+ * seat actually declines.
+ *
+ * Deliberately NOT headroom routing like the Claude pool. Claude responds with
+ * `anthropic-ratelimit-*` headers on every response, so that pool can read
+ * utilisation before it picks. The Codex backend states nothing until it 429s —
+ * the only signal is the decline itself plus its `retry-after` — so this is
+ * fill-first with cool-down eviction, which is what the available signal
+ * supports. If the backend ever starts reporting utilisation, this is where
+ * headroom would go.
+ */
+let codexCooldowns = new ProviderCooldowns();
+/** conversation sticky key -> alias. Bounded; swept when it exceeds the cap. */
+const codexSticky = new Map();
+const CODEX_STICKY_MAX = 500;
+/** Record that `alias` declined, for as long as the upstream asked. */
+export function noteCodexDecline(alias, retryAfterMs) {
+    return codexCooldowns.note(alias, retryAfterMs);
+}
+/** A seat that just served is not rate-limited — clear it. */
+export function clearCodexDecline(alias) {
+    codexCooldowns.clear(alias);
+}
+/** Ms until `alias` is askable again; 0 when it is askable now. */
+export function codexCooldownRemainingMs(alias) {
+    return codexCooldowns.remainingMs(alias);
+}
+/** Test seam — forget every cool-down and binding. */
+export function _resetCodexPoolForTest() {
+    codexSticky.clear();
+    // A fresh instance rather than clearing per alias: the previous version
+    // emptied the sticky map first and then iterated it, so it cleared nothing
+    // and cool-downs leaked between test cases.
+    codexCooldowns = new ProviderCooldowns();
+}
+/** The alias currently bound to a conversation, or null. */
+export function codexStickyAliasFor(key) {
+    return key ? codexSticky.get(key) ?? null : null;
+}
+function bindCodexSticky(key, alias) {
+    if (codexSticky.size >= CODEX_STICKY_MAX && !codexSticky.has(key)) {
+        // Oldest-first eviction: Map preserves insertion order, so the first key is
+        // the least recently bound. Losing a binding costs one cache miss, never
+        // correctness, so a cheap sweep beats an LRU.
+        const oldest = codexSticky.keys().next().value;
+        if (oldest !== undefined)
+            codexSticky.delete(oldest);
+    }
+    codexSticky.set(key, alias);
+}
+/**
+ * Move a conversation onto `alias`, the codex mirror of pool.rebindSticky.
+ *
+ * Selection binds a conversation to the seat it picked; mid-request failover
+ * then moves it, and without this the binding still names the seat that just
+ * declined — the next turn would read a stale binding, find it cooling, and
+ * re-pick from scratch. A null key is accepted so the caller does not have to
+ * guard: a request with no hashable first user message has no conversation to
+ * bind.
+ */
+export function rebindCodexSticky(key, alias) {
+    if (!key)
+        return;
+    bindCodexSticky(key, alias);
+}
+/**
+ * Choose a ChatGPT seat for this request.
+ *
+ * Order, most specific first:
+ *   1. an explicitly named alias (`x-dario-account`, DARIO_CODEX_ACCOUNT) — a
+ *      pin is an instruction, so it is honoured even while cooling; the caller
+ *      asked for that seat and gets its answer, 429 included.
+ *   2. the seat this conversation is already bound to, unless it is cooling.
+ *   3. the first seat alphabetically that is not cooling — deterministic, so a
+ *      given conversation lands on the same seat across a restart and keeps its
+ *      prompt cache.
+ *   4. null when every seat is cooling. The caller answers from that rather
+ *      than spending a request that can only 429 again.
+ */
+export async function selectCodexAccount(preferredAlias, opts) {
     const alias = preferredAlias || process.env.DARIO_CODEX_ACCOUNT;
     if (alias) {
         const one = await loadCodexAccount(alias);
@@ -308,7 +407,83 @@ export async function selectCodexAccount(preferredAlias) {
     const all = await loadAllCodexAccounts();
     if (all.length === 0)
         return null;
-    return [...all].sort((a, b) => a.alias.localeCompare(b.alias))[0];
+    const byAlias = [...all].sort((a, b) => a.alias.localeCompare(b.alias));
+    const key = opts?.stickyKey ?? null;
+    if (key) {
+        const bound = codexSticky.get(key);
+        if (bound && !codexCooldowns.isCooled(bound)) {
+            const hit = byAlias.find((c) => c.alias === bound);
+            // A binding to a seat that has since been removed falls through to a
+            // fresh pick rather than failing the request.
+            if (hit)
+                return hit;
+            codexSticky.delete(key);
+        }
+    }
+    const free = byAlias.find((c) => !codexCooldowns.isCooled(c.alias));
+    if (!free)
+        return null;
+    if (key)
+        bindCodexSticky(key, free.alias);
+    return free;
+}
+/**
+ * The next askable seat that this request has NOT already tried.
+ *
+ * Mid-flight failover: a seat that 429s during a request hands the SAME
+ * request to a peer rather than failing it. Without this the pool only helps
+ * the request AFTER the one that discovered the limit — the discovering
+ * request still failed, every time a window rolled over.
+ *
+ * `tried` is per-request, so a seat already attempted here is never revisited
+ * inside the same request even if its cool-down has not landed yet. That is
+ * the codex mirror of the Claude pool's selectExcluding, and it is what makes
+ * the loop terminate: every pass adds a seat, so it is bounded by pool size.
+ *
+ * Stickiness is deliberately NOT consulted. The bound seat is the one that
+ * just declined; re-offering it would loop, and a conversation whose seat has
+ * gone away is better served elsewhere than not at all.
+ */
+export async function selectCodexAccountExcluding(tried) {
+    const all = await loadAllCodexAccounts();
+    if (all.length === 0)
+        return null;
+    return [...all]
+        .sort((a, b) => a.alias.localeCompare(b.alias))
+        .find((c) => !tried.has(c.alias) && !codexCooldowns.isCooled(c.alias)) ?? null;
+}
+/** Every seat is cooling — the fail-fast condition, for the caller's message. */
+/**
+ * Are ALL of these aliases cooling, right now?
+ *
+ * Synchronous on purpose. The provider-wide cool-down is written from this
+ * answer, and an `await` between deciding and writing is a window another
+ * in-flight request can use: the last-limited-seat request observes every seat
+ * cooling, a peer then succeeds on a just-recovered seat and calls
+ * clearCodexDecline, and the delayed continuation re-cools the whole provider
+ * against a pool that is healthy again. canAttempt('codex') then short-circuits
+ * and the healthy seat is skipped until the stale window expires — the exact
+ * single-seat outage this pool exists to prevent, reintroduced by the
+ * bookkeeping meant to prevent it.
+ *
+ * Re-checking inside the continuation narrows that window; it does not close
+ * it, because the re-check is itself another await. Taking the alias list first
+ * and then deciding-and-writing with no suspension point between them closes it
+ * outright: JS runs that callback as one unit, so nothing can interleave.
+ *
+ * The alias list may be a tick stale, which is harmless — a seat added in that
+ * window is not cooling, so "all cooled" is false on the next decline anyway.
+ */
+export function allAliasesCooled(aliases) {
+    return aliases.length > 0 && aliases.every((a) => codexCooldowns.isCooled(a));
+}
+export async function allCodexAccountsCooled() {
+    return allAliasesCooled(await listCodexAccountAliases());
+}
+/** Longest remaining cool-down across every seat, for a `retry-after`. */
+export async function codexPoolRetryAfterMs() {
+    const aliases = await listCodexAccountAliases();
+    return aliases.reduce((max, a) => Math.max(max, codexCooldowns.remainingMs(a)), 0);
 }
 /**
  * Parse whatever the user pastes back after authorizing.

package/dist/codex-backend.d.ts

@@ -48,6 +48,9 @@ export interface CodexForwardOutcome {
 export interface CodexDecline {
     status: number;
     retryAfterMs: number | null;
+    /** The seat that declined. Without it a caller can cool the provider but
+     *  not the account, which is the whole point of a pool. */
+    alias: string;
 }
 /** The cached slug list for an alias WITHOUT fetching. For the admin surface:
  *  a status read must never cost an upstream call or a token refresh. */
@@ -275,7 +278,16 @@ export declare function buildCodexHeaders(creds: CodexAccountCredentials): Recor
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
-export declare function forwardResponsesToCodex(res: ServerResponse, body: Record<string, unknown>, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, fetchImpl?: typeof fetch, onDone?: (outcome: CodexForwardOutcome) => void): Promise<boolean>;
+export declare function forwardResponsesToCodex(res: ServerResponse, body: Record<string, unknown>, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, fetchImpl?: typeof fetch, onDone?: (outcome: CodexForwardOutcome) => void, 
+/** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
+ *  caller needs to know which seat and for how long — without it the pool
+ *  cannot cool a limited seat on this path, so selection hands the same
+ *  rate-limited account back on every following request. */
+onDecline?: (info: CodexDecline) => void, 
+/** When true a decline returns false WITHOUT writing, so the caller can
+ *  retry the request on a healthy peer. False keeps the old behaviour: the
+ *  upstream error is written through as the backend sent it. */
+deferOnUnavailable?: boolean): Promise<boolean>;
 /**
  * Serve a request from a stored Codex account, in either client wire shape.
  *

package/dist/codex-backend.js

@@ -717,6 +717,9 @@ export function createResponsesTranslator(model) {
 export const CODEX_SUPPORTED_FIELDS = [
     'model', 'input', 'stream', 'store', 'instructions',
     'tools', 'tool_choice', 'parallel_tool_calls', 'reasoning',
+    // `web_search_call.action.sources` (v6.4): accepted by the backend, probed
+    // 2026-09-12 — the searched URLs the Anthropic result block lists.
+    'include',
     // Sent by the Codex CLI on every request (codex-rs ResponsesApiRequest), so
     // accepted by construction; see codexPromptCacheKey.
     'prompt_cache_key',
@@ -756,7 +759,16 @@ export function buildCodexHeaders(creds) {
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
-export async function forwardResponsesToCodex(res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, fetchImpl = fetch, onDone) {
+export async function forwardResponsesToCodex(res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, fetchImpl = fetch, onDone, 
+/** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
+ *  caller needs to know which seat and for how long — without it the pool
+ *  cannot cool a limited seat on this path, so selection hands the same
+ *  rate-limited account back on every following request. */
+onDecline, 
+/** When true a decline returns false WITHOUT writing, so the caller can
+ *  retry the request on a healthy peer. False keeps the old behaviour: the
+ *  upstream error is written through as the backend sent it. */
+deferOnUnavailable = false) {
     const startedAt = Date.now();
     const model = String(body.model ?? '');
     let reported = false;
@@ -801,6 +813,23 @@ export async function forwardResponsesToCodex(res, body, creds, corsOrigin, secu
             const detail = await upstream.text().catch(() => '');
             if (verbose)
                 console.error(`[dario] codex backend ${upstream.status}: ${detail.slice(0, 300)}`);
+            // Same rule as the Messages path: a 429 or a 5xx is the seat declining,
+            // and that is true whether or not anything is waiting to take over.
+            const unavailable = upstream.status === 429 || upstream.status >= 500;
+            if (unavailable) {
+                try {
+                    onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')), alias: creds.alias });
+                }
+                catch { /* a reporting failure must never break a request */ }
+            }
+            if (deferOnUnavailable && unavailable) {
+                if (verbose)
+                    console.log(`[dario] codex account ${creds.alias} unavailable (${upstream.status}) — deferring`);
+                // Nothing written, so the caller is free to retry this same request
+                // on a peer. Reporting nothing here matches forwardToCodex: a
+                // declined attempt is not a served request.
+                return false;
+            }
             if (!clientGone) {
                 res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
                 // The backend's own error body, already in the client's shape.
@@ -1045,16 +1074,25 @@ midstream) {
             // own fault (a bad body, an unsupported parameter) is NOT: failing over
             // would just reproduce it somewhere else and hide the real error.
             const unavailable = upstream.status === 429 || upstream.status >= 500;
+            // The seat said no, and that is true whether or not a fallback exists
+            // to defer to. Recording it outside the defer branch is what lets the
+            // POOL rotate on a deployment with no --pool-fallback configured: with
+            // the notice inside the branch, a 429 went straight to the client and
+            // the seat was never cooled, so selection returned the same limited
+            // account forever (found writing the proxy-level test for #1288).
+            if (unavailable) {
+                try {
+                    onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')), alias: creds.alias });
+                }
+                catch { /* a reporting failure must never break a request */ }
+            }
             if (deferOnUnavailable && unavailable) {
                 console.log(`[dario] codex account ${creds.alias} unavailable (${upstream.status}) — deferring to the next provider`);
                 // A decline is the only exit that tells the caller nothing was served,
                 // and until now it carried no WHY: a 429 and a 503 were the same false.
                 // The chain needs the status (to cool a rate limit but not an outage)
                 // and the upstream's own `retry-after` (to cool it for the right long).
-                try {
-                    onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')) });
-                }
-                catch { /* a reporting failure must never break a declined request */ }
+                // (the decline was already recorded above, for both exits)
                 return false;
             }
             res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
@@ -1248,7 +1286,7 @@ midstream) {
             // status 0: no HTTP status ever arrived. Reported so the caller can tell
             // an outage from a rate limit — an unreachable backend is not quota.
             try {
-                onDecline?.({ status: 0, retryAfterMs: null });
+                onDecline?.({ status: 0, retryAfterMs: null, alias: creds.alias });
             }
             catch { /* as above */ }
             return false;

package/dist/proxy.js

@@ -31,7 +31,7 @@ import { responsesRequestToAnthropic, unsupportedOnClaudeError, ResponsesRequest
 import { isClaudeServableModel } from './claude-model.js';
 import { MODEL_UNROUTABLE } from './upstream-rejection.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
-import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount, getCodexRefreshFailure, CodexCredentialsUnavailableError } from './codex-accounts.js';
+import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, selectCodexAccountExcluding, rebindCodexSticky, getFreshCodexAccount, noteCodexDecline, clearCodexDecline, allAliasesCooled, getCodexRefreshFailure, CodexCredentialsUnavailableError } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
@@ -163,6 +163,30 @@ function extractFirstUserMessage(body) {
     }
     return '';
 }
+/**
+ * The conversation key for Codex seat stickiness, from raw request bytes.
+ *
+ * The same hash the Claude pool binds on (computeStickyKey over the first user
+ * message), so a conversation stays on one ChatGPT seat across turns and keeps
+ * the prompt-cache prefix it built there — rotating per request would trade a
+ * rate-limit problem for a cache problem.
+ *
+ * Null for a body that is not a JSON object or carries no user message; those
+ * requests bypass stickiness rather than sharing one bucket. Used by the two
+ * codex entries that hold no parsed body of their own (the pool-exhausted
+ * fallback and the mid-stream continuation target).
+ */
+function codexStickyKeyForBody(body) {
+    try {
+        const parsed = JSON.parse(body.toString('utf-8'));
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return computeStickyKey(extractFirstUserMessage(parsed));
+    }
+    catch {
+        return null;
+    }
+}
 // Session ID behavior:
 //   v3.18 rotated per request — which was itself a fingerprint. Real CC
 //   rotates roughly once per conversation, not per call. A user who has
@@ -1999,6 +2023,47 @@ export async function startProxy(opts = {}) {
     function checkAuth(req) {
         return authenticateRequest(req.headers, apiKeyBuf);
     }
+    /**
+     * A ChatGPT seat declined. Cool the SEAT, and the provider only once every
+     * seat is cooling.
+     *
+     * One handler for every codex forward — both wire shapes and the
+     * Claude-to-Codex fallback. It was two hand-copied copies, and that is
+     * precisely how the native Responses path ended up cooling nothing while
+     * the translated path cooled correctly: a third call site inherits this by
+     * construction rather than by someone remembering to copy it.
+     *
+     * Closes over nothing per-request, which is what makes one copy possible.
+     */
+    const codexOnDecline = (d) => {
+        // Cool the PROVIDER (is the codex lane usable at all) and the SEAT
+        // that actually declined (which ChatGPT account said no, and for how
+        // long). Before the seat half existed, selectCodexAccount returned the
+        // alphabetically-first account every time, so one 429'd seat took the
+        // whole lane down while its healthy peers sat unreachable.
+        if (d.status !== 429)
+            return;
+        // A 429 is a SEAT-level condition, so cool the seat unconditionally.
+        // The provider is only cooled once EVERY seat is cooling.
+        //
+        // Cooling the provider on any single 429 defeats the pool: the routing
+        // gate short-circuits on canAttempt('codex'), so the next request never
+        // reaches selectCodexAccount to find the healthy peer — the exact
+        // single-seat outage this change exists to remove (caught in review of
+        // #1288). Dropping provider cooling altogether is equally wrong the other
+        // way: on a single-seat deployment nothing would fail fast, and every
+        // request would re-hammer a seat already known to be limited instead of
+        // falling through to Claude. All-seats-cooled is the condition that means
+        // what the provider cool-down was always trying to say.
+        noteCodexDecline(d.alias, d.retryAfterMs);
+        void listCodexAccountAliases().then((aliases) => {
+            // Decide and write in the SAME tick — see allAliasesCooled. An await
+            // between the two lets a concurrent success clear a seat in the gap,
+            // and the late write then cools a pool that has recovered.
+            if (allAliasesCooled(aliases))
+                providerCooldowns.note('codex', d.retryAfterMs);
+        }).catch(() => { });
+    };
     /**
      * Serve a pool-exhausted request from the ChatGPT subscription (v6.0.0).
      *
@@ -2025,50 +2090,101 @@ export async function startProxy(opts = {}) {
             return false;
         if (!(await hasAnyCodexAccount().catch(() => false)))
             return false;
-        const stored = await selectCodexAccount().catch(() => null);
+        // Sticky on the CONVERSATION, not on this fallback hop: a conversation
+        // that reaches the subscription twice lands on the same seat both times,
+        // so the second turn reads the prefix the first one paid to create.
+        const stickyKey = codexStickyKeyForBody(body);
+        const stored = await selectCodexAccount(undefined, { stickyKey }).catch(() => null);
         if (!stored)
             return false;
-        let creds;
+        let seat;
         try {
-            creds = await getFreshCodexAccount(stored);
+            seat = await getFreshCodexAccount(stored);
         }
         catch {
             return false;
         }
-        const slugs = await getCodexModelSlugs(creds).catch(() => []);
-        const fallbackPick = pickCodexFallback(fallbackModels, slugs);
-        if (!fallbackPick)
-            return false;
-        const fallbackModel = fallbackPick.model;
-        const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
-        if (!fallbackBody)
-            return false;
-        console.log(`[dario] #${requestCount} ${why} → codex account ${creds.alias} as ${fallbackModel}`);
-        requestCount++;
-        attempted.add('codex');
         // If an api-key backend could ALSO serve this request, let the subscription
         // decline a 429/5xx rather than answer with it, and report not-served so the
-        // caller falls through to that backend. This helper's contract has always
-        // said it declines so the caller can continue; it just never exercised the
-        // mechanism it was built on, so a rate-limited subscription ended the chain
-        // with a healthy backend sitting unused beside it.
+        // caller falls through to that backend.
         //
-        // With NO next option, do not defer: the real upstream error is more useful
-        // to the client than replacing it with a generic 503.
+        // With NO next option and no peer, do not defer: the real upstream error is
+        // more useful to the client than replacing it with a generic 503.
         const hasNextOption = openaiBackend !== null && shape === 'openai';
-        const served = await forwardToCodex(req, res, fallbackBody, creds, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose, shape, fetch, hasNextOption, undefined, 
-        // Only a rate limit cools the provider. A 5xx or a transport failure is
-        // an outage, not quota — cooling it would park a provider that may be
-        // back on the next request, which is the opposite of the fix.
-        (d) => { if (d.status === 429)
-            providerCooldowns.note('codex', d.retryAfterMs); }, 
-        // The mirror of the Claude side (dario#1161): an operator who writes
-        // `--pool-fallback=gpt-5.6-terra:high` is choosing the effort the
-        // failover runs at, so the entry's own suffix reaches the request rather
-        // than the failover quietly running at the backend default.
-        effortForCodex(fallbackPick.effort));
-        if (served)
+        // The next seat that could serve one of these fallback models, excluding
+        // everything already tried. `peek` is the cached read, so the scan costs no
+        // upstream call; a seat whose model list is unknown is still worth a try.
+        //
+        // Scans rather than testing one candidate: with mixed model availability
+        // across seats, the alphabetically-next peer may be the one that lists none
+        // of the fallback models while a later one lists one.
+        const nextFallbackPeer = async (tried) => {
+            const skipped = new Set(tried);
+            for (;;) {
+                const candidate = await selectCodexAccountExcluding(skipped).catch(() => null);
+                if (!candidate)
+                    return null;
+                const peerSlugs = peekCodexModelSlugs(candidate.alias);
+                if (!peerSlugs || pickCodexFallback(fallbackModels, peerSlugs))
+                    return candidate;
+                skipped.add(candidate.alias);
+            }
+        };
+        // Mid-flight seat failover on the CLAUDE-TO-CODEX route, the same as the
+        // primary Codex route has. Without it this route selected one seat and
+        // stopped: a 429 from that seat was written to the client while a healthy
+        // peer sat unused, so the pool helped every route except this one (caught
+        // in review of #1288). The fallback model is re-picked per seat because
+        // pickCodexFallback reads that SEAT's slugs — peers need not list the same
+        // model, and the one that answers may answer as a different one.
+        //
+        // Terminates by construction: every pass adds a seat to `tried`, and
+        // nextFallbackPeer never returns one already in it.
+        const tried = new Set();
+        let served = false;
+        while (seat) {
+            tried.add(seat.alias);
+            const slugs = await getCodexModelSlugs(seat).catch(() => []);
+            const fallbackPick = pickCodexFallback(fallbackModels, slugs);
+            // Resolved BEFORE the attempt: it decides whether this attempt may defer,
+            // and becomes the seat to retry on if it declines.
+            const peer = await nextFallbackPeer(tried);
+            if (!fallbackPick) {
+                // This seat lists none of the fallback models. That used to end the
+                // attempt outright; a peer may still list one.
+                if (!peer)
+                    return false;
+                seat = await getFreshCodexAccount(peer).catch(() => peer);
+                continue;
+            }
+            const fallbackModel = fallbackPick.model;
+            const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
+            if (!fallbackBody)
+                return false;
+            console.log(`[dario] #${requestCount} ${why} → codex account ${seat.alias} as ${fallbackModel}`);
+            requestCount++;
+            // Marked only once an attempt is actually being made. Marking it before
+            // the guards above would tell the rest of the request that codex had been
+            // tried when it had not, suppressing a later legitimate attempt.
+            attempted.add('codex');
+            served = await forwardToCodex(req, res, fallbackBody, seat, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose, shape, fetch, hasNextOption || peer !== null, undefined, codexOnDecline, 
+            // The mirror of the Claude side (dario#1161): an operator who writes
+            // `--pool-fallback=gpt-5.6-terra:high` is choosing the effort the
+            // failover runs at, so the entry's own suffix reaches the request rather
+            // than the failover quietly running at the backend default.
+            effortForCodex(fallbackPick.effort));
+            if (served || !peer)
+                break;
+            console.log(`[dario] codex seat ${seat.alias} declined — retrying this fallback on ${peer.alias}`);
+            // The conversation follows the request. Its binding still names the seat
+            // that just declined; leaving it there would send the next turn back to a
+            // cooling seat and re-pick from scratch.
+            rebindCodexSticky(stickyKey, peer.alias);
+            seat = await getFreshCodexAccount(peer).catch(() => peer);
+        }
+        if (served) {
             providerCooldowns.clear('codex');
+        }
         return served;
     };
     /**
@@ -3027,7 +3143,10 @@ export async function startProxy(opts = {}) {
                     return null;
                 if (!(await hasAnyCodexAccount().catch(() => false)))
                     return null;
-                const stored = await selectCodexAccount().catch(() => null);
+                // The CLIENT's bytes rather than the rewritten `body`: a resume is the
+                // same conversation as the request that died mid-stream, so it must
+                // hash to the same key and land on the seat that conversation holds.
+                const stored = await selectCodexAccount(undefined, { stickyKey: codexStickyKeyForBody(clientBodyBytes) }).catch(() => null);
                 if (!stored)
                     return null;
                 let creds;
@@ -3328,8 +3447,17 @@ export async function startProxy(opts = {}) {
                     // account, rather than letting the throw escape into the JSON-peek
                     // catch below and disappear (DEV-179a412f).
                     let codexUnavailable = null;
+                    // Conversation -> seat binding for the codex lane, the mirror of the
+                    // Claude pool's stickyKey below. It belongs HERE because this is
+                    // where the seat is CHOSEN: without a key every turn independently
+                    // re-picks "the first seat not cooling", so a lower-alias seat that
+                    // frees up mid-conversation silently moves the conversation off the
+                    // seat holding its prompt-cache prefix (caught in review of #1288).
+                    // `parsedBody` is the object the invalid-body guard already parsed,
+                    // so this costs no second JSON.parse.
+                    const codexStickyKey = parsedBody ? computeStickyKey(extractFirstUserMessage(parsedBody)) : null;
                     if (await hasAnyCodexAccount()) {
-                        const stored = await selectCodexAccount();
+                        const stored = await selectCodexAccount(undefined, { stickyKey: codexStickyKey });
                         if (stored) {
                             try {
                                 codexCreds = await getFreshCodexAccount(stored);
@@ -3466,14 +3594,22 @@ export async function startProxy(opts = {}) {
                                 },
                             })
                             : null;
-                        // Before this hook a codex request left no trace: nothing in
-                        // /analytics, nothing in the request log, no per-account count.
-                        // The dock (and anyone reading /analytics) saw a proxy that
-                        // served GPT all day and reported zero of it. A decline (the
-                        // request handed to the Claude pool) reports nothing here; the
-                        // Claude path records what it then serves.
+                        // Reporting is one function for BOTH codex shapes below: the Responses
+                        // passthrough and the translated Messages path record the same row, so a
+                        // GPT request looks the same in /analytics whichever shape asked for it.
+                        //
+                        // Before this hook a codex request left no trace: nothing in /analytics,
+                        // nothing in the request log, no per-account count. The dock (and anyone
+                        // reading /analytics) saw a proxy that served GPT all day and reported
+                        // zero of it. A decline (the request handed to the Claude pool) reports
+                        // nothing here; the Claude path records what it then serves.
                         const codexOnDone = (o) => {
                             codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
+                            // A seat that actually SERVED is not rate-limited. Keyed on a 2xx,
+                            // never on forwardToCodex returning true — that means "I wrote a
+                            // response", which is equally true when it wrote the upstream 429.
+                            if (o.status >= 200 && o.status < 300)
+                                clearCodexDecline(o.alias);
                             analytics.record({
                                 timestamp: Date.now(),
                                 consumer,
@@ -3502,24 +3638,83 @@ export async function startProxy(opts = {}) {
                                     cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens,
                                 }, consumer));
                         };
-                        // A Responses client on a ChatGPT-subscription model: the backend
-                        // speaks that shape natively, so the body goes through as written
-                        // (model resolved) and the SSE comes back untouched — no round
-                        // trip through the Messages shape, which cannot carry the newest
-                        // Codex CLI request features. Answers on the raw response: these
-                        // bytes are already in the client's shape.
-                        const served = codexAvailable && (isResponses && responsesBodyRaw
-                            ? await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone)
-                            : await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', codexFetch, canDefer, codexOnDone, 
-                            // Cool codex on a rate limit only — a 5xx or an unreachable backend
-                            // is an outage, and parking a provider for that would keep it out
-                            // of the chain while it was already coming back.
-                            (d) => { if (d.status === 429)
-                                providerCooldowns.note('codex', d.retryAfterMs); }, 
-                            // dario#1260 — the effort named by the model-name suffix stripped
-                            // above. Undefined for every request that did not name one, which
-                            // leaves the outbound body exactly as it was.
-                            effortForCodex(requestEffort), codexGuard));
+                        // Mid-flight seat failover. A 429 lands BEFORE any body is written —
+                        // forwardToCodex only returns false on the decline path — so the same
+                        // request can be handed to a healthy peer instead of failing. Without
+                        // this the pool only helps the request AFTER the one that discovered the
+                        // limit; the discovering request still failed, every window rollover.
+                        //
+                        // `deferOnUnavailable` is widened to `canDefer || a peer exists`: without
+                        // that, a decline with no Claude fallback configured writes the 429 to the
+                        // client and returns true, and there is nothing left to retry onto.
+                        //
+                        // Terminates by construction: every pass adds a seat to `codexTried`, and
+                        // selectCodexAccountExcluding never returns a seat already in it.
+                        let served = false;
+                        if (codexAvailable) {
+                            const codexTried = new Set();
+                            let codexSeat = codexCreds;
+                            while (codexSeat) {
+                                codexTried.add(codexSeat.alias);
+                                // Resolved BEFORE the attempt: it decides whether this attempt may
+                                // defer, and becomes the seat to retry on if it declines.
+                                // A peer that demonstrably does not list this model cannot serve it;
+                                // trying it would trade a 429 for a 400. peek is the cached read, so
+                                // this never costs an upstream call — an unknown list still gets a try.
+                                //
+                                // Scanning rather than testing one candidate: with mixed model
+                                // availability across seats, the alphabetically-next peer may be the
+                                // one that cannot serve this model while a later one can. Stopping at
+                                // the first incompatible candidate left `codexPeer` null and abandoned
+                                // a usable seat — with no Claude fallback the declining seat's 429 went
+                                // straight to the client (caught in review of #1288). `peerTried` is
+                                // seeded from `codexTried` and grows every pass, so this terminates.
+                                let codexPeer = null;
+                                const peerTried = new Set(codexTried);
+                                for (;;) {
+                                    const candidate = await selectCodexAccountExcluding(peerTried).catch(() => null);
+                                    if (!candidate)
+                                        break;
+                                    const peerSlugs = rawModel ? peekCodexModelSlugs(candidate.alias) : null;
+                                    if (!peerSlugs || isCodexModel(rawModel, peerSlugs)) {
+                                        codexPeer = candidate;
+                                        break;
+                                    }
+                                    peerTried.add(candidate.alias);
+                                }
+                                // A Responses client on a ChatGPT-subscription model: the backend speaks
+                                // that shape natively, so the body goes through as written (model
+                                // resolved) and the SSE comes back untouched — no round trip through the
+                                // Messages shape, which cannot carry the newest Codex CLI request
+                                // features. Answers on the raw response: these bytes are already in the
+                                // client's shape.
+                                //
+                                // It sits INSIDE the retry loop, on the same seat sequence and the same
+                                // defer condition as the translated path. Outside it, a 429 on this shape
+                                // cooled nothing: selection handed the same limited seat back on every
+                                // following request and a healthy peer was never reached — the single-seat
+                                // outage this change exists to remove, surviving on the one shape Codex
+                                // CLI actually speaks (caught in review of #1288).
+                                if (isResponses && responsesBodyRaw) {
+                                    served = await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone, codexOnDecline, canDefer || codexPeer !== null);
+                                }
+                                else {
+                                    served = await forwardToCodex(req, res, body, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', codexFetch, canDefer || codexPeer !== null, codexOnDone, codexOnDecline, 
+                                    // dario#1260 — the effort named by the model-name suffix stripped
+                                    // above. Undefined for every request that did not name one, which
+                                    // leaves the outbound body exactly as it was.
+                                    effortForCodex(requestEffort), codexGuard);
+                                }
+                                if (served || !codexPeer)
+                                    break;
+                                console.log(`[dario] codex seat ${codexSeat.alias} declined — retrying this request on ${codexPeer.alias}`);
+                                // The conversation follows the request. Its binding still names
+                                // the seat that just declined; leaving it there would send the
+                                // next turn back to a cooling seat and re-pick from scratch.
+                                rebindCodexSticky(codexStickyKey, codexPeer.alias);
+                                codexSeat = await getFreshCodexAccount(codexPeer).catch(() => codexPeer);
+                            }
+                        }
                         if (served) {
                             // A provider that just served is not rate-limited.
                             providerCooldowns.clear('codex');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.3.0",
+  "version": "6.5.0",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {