@bitkyc08/opencodex 2.35.0 → 2.36.0-preview.20260830

package/src/grok/models.ts

@@ -0,0 +1,56 @@
+import {
+  filterCatalogVisibleModels,
+  nativeContextLimits,
+  nativeDefaultReasoningEffort,
+  nativeOpenAiContextWindow,
+  nativeReasoningEfforts,
+  visibleNativeSlugs,
+  type CatalogModel,
+} from "../codex/catalog";
+import type { OcxConfig } from "../types";
+import type { GrokInjectModel } from "./inject";
+
+/**
+ * Catalog → inject payload used by both `syncGrokConfig` and the dashboard enable
+ * path. Native rows carry the pinned ladder; routed rows carry
+ * `reasoningEfforts` / `defaultReasoningEffort`. The writer sanitizes Grok-invalid
+ * rungs — this function forwards the same lists `/v1/models` already advertises.
+ */
+export function buildGrokInjectModels(
+  config: Pick<OcxConfig, "disabledModels" | "combos" | "providers" | "providerContextCaps">,
+  routed: CatalogModel[],
+): GrokInjectModel[] {
+  const contextLimits = nativeContextLimits(config);
+  return [
+    ...visibleNativeSlugs(config).map(id => {
+      const contextWindow = nativeOpenAiContextWindow(id, contextLimits);
+      const reasoningEfforts = nativeReasoningEfforts(id);
+      const defaultReasoningEffort = nativeDefaultReasoningEffort(id);
+      return {
+        id,
+        ...(contextWindow !== undefined ? { contextWindow } : {}),
+        ...(reasoningEfforts.length > 0 ? { reasoningEfforts } : {}),
+        ...(defaultReasoningEffort !== undefined ? { defaultReasoningEffort } : {}),
+      };
+    }),
+    ...routed.map(model => {
+      const efforts = model.reasoningEfforts ?? [];
+      return {
+        id: model.alias ?? `${model.provider}/${model.id}`,
+        ...(model.contextWindow !== undefined ? { contextWindow: model.contextWindow } : {}),
+        ...(efforts.length > 0 ? { reasoningEfforts: efforts } : {}),
+        ...(model.defaultReasoningEffort !== undefined
+          ? { defaultReasoningEffort: model.defaultReasoningEffort }
+          : {}),
+      };
+    }),
+  ];
+}
+
+/** Visible routed catalog, then the shared inject list. */
+export function grokInjectModelsFromCatalog(
+  config: OcxConfig,
+  catalog: CatalogModel[],
+): GrokInjectModel[] {
+  return buildGrokInjectModels(config, filterCatalogVisibleModels(catalog, config));
+}

package/src/grok/status.ts

@@ -65,22 +65,35 @@ export function readGrokStatus(opts: { grokHome?: string } = {}): GrokStatus {
   let baseUrl: string | null = null;
   let current: GrokStatusModel | null = null;
 
+  // The provider block carries base_url in the current shape; per-model base_url is the
+  // legacy fallback for fences written before the model_providers migration.
+  let inProviderBlock = false;
+
   for (const rawLine of region.split("\n")) {
     const line = rawLine.trim();
+    const providerHeader = /^\[model_providers\.([^\]]+)\]$/.exec(line);
+    if (providerHeader) {
+      inProviderBlock = true;
+      continue;
+    }
     const header = /^\[model\.([^\]]+)\]$/.exec(line);
     if (header) {
+      inProviderBlock = false;
       current = { alias: header[1]!, id: "" };
       models.push(current);
       continue;
     }
-    if (!current) continue;
-    if (line.startsWith("model =")) {
-      current.id = tomlStringValue(line) ?? "";
-    } else if (line.startsWith("base_url =")) {
-      baseUrl ??= tomlStringValue(line) ?? null;
-    } else if (line.startsWith("context_window =")) {
-      const value = Number(line.slice(line.indexOf("=") + 1).trim());
-      if (Number.isFinite(value) && value > 0) current.contextWindow = value;
+    if (line.startsWith("base_url =")) {
+      // Prefer the provider block's base_url; fall back to per-model (legacy shape).
+      if (inProviderBlock) baseUrl ??= tomlStringValue(line) ?? null;
+      else if (current && baseUrl === null) baseUrl = tomlStringValue(line) ?? null;
+    } else if (!inProviderBlock && current) {
+      if (line.startsWith("model =")) {
+        current.id = tomlStringValue(line) ?? "";
+      } else if (line.startsWith("context_window =")) {
+        const value = Number(line.slice(line.indexOf("=") + 1).trim());
+        if (Number.isFinite(value) && value > 0) current.contextWindow = value;
+      }
     }
   }
 

package/src/grok/sync.ts

@@ -6,9 +6,10 @@
  *
  * Deps are injectable (mirrors src/codex/sync.ts) so tests can run without a live proxy.
  */
-import { visibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
+import type { CatalogModel } from "../codex/catalog";
 import type { OcxConfig } from "../types";
-import { injectGrokConfig, type GrokInjectModel, type GrokInjectResult } from "./inject";
+import { projectGrokCatalog } from "./catalog";
+import { injectGrokConfig, type GrokInjectResult } from "./inject";
 
 export interface GrokSyncDeps {
   fetchAllModels: (config: OcxConfig) => Promise<CatalogModel[]>;
@@ -32,22 +33,10 @@ export async function syncGrokConfig(
   opts: { hostname?: string; grokHome?: string } = {},
   deps: GrokSyncDeps = { fetchAllModels: defaultFetchAllModels, injectGrokConfig },
 ): Promise<GrokInjectResult> {
-  let models: GrokInjectModel[];
+  let projection: ReturnType<typeof projectGrokCatalog>;
   try {
-    const routed = filterCatalogVisibleModels(await deps.fetchAllModels(config), config);
-    models = [
-      // Native slugs carry their context window too. Without it Grok falls back to its own
-      // default (200k) and understates models like gpt-5.6-sol, which is 372k. This is the same
-      // accessor the dashboard's native rows use, so the two cannot disagree.
-      ...visibleNativeSlugs(config).map(id => {
-        const contextWindow = nativeOpenAiContextWindow(id, nativeContextLimits(config));
-        return { id, ...(contextWindow !== undefined ? { contextWindow } : {}) };
-      }),
-      ...routed.map(m => ({
-        id: m.alias ?? `${m.provider}/${m.id}`,
-        ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
-      })),
-    ];
+    const allRouted = await deps.fetchAllModels(config);
+    projection = projectGrokCatalog(allRouted, config);
   } catch (err) {
     return {
       ok: false,
@@ -58,9 +47,12 @@ export async function syncGrokConfig(
   // Pass the FULL list plus the exclusion set: the writer allocates aliases over
   // everything and emits only what is switched on, so a model's alias never depends on
   // its neighbours' switches. Absent/empty selection keeps today's behaviour exactly.
-  return deps.injectGrokConfig(port, models, {
+  return deps.injectGrokConfig(port, projection.models, {
     ...(opts.hostname !== undefined ? { hostname: opts.hostname } : {}),
     ...(opts.grokHome !== undefined ? { grokHome: opts.grokHome } : {}),
     excluded: new Set(config.grokExcludedModels ?? []),
+    catalogModelIds: projection.catalogModelIds,
+    disabledProviderNamespaces: projection.disabledProviderNamespaces,
+    comboPublicModelIds: projection.comboPublicModelIds,
   });
 }

package/src/images/loop.ts

@@ -21,7 +21,7 @@ import type { AttemptRecoveryKind } from "../usage/log";
 import { bridgeToResponsesSSE } from "../bridge";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { readBoundedResponseBody } from "../lib/bounded-body";
-import { fetchWithResetRetry, prepareSameTarget429Wait } from "../lib/upstream-retry";
+import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait } from "../lib/upstream-retry";
 import { rateLimitRetryDelayMs } from "../providers/key-failover";
 import {
   isTranslatorBudgetExceededError,
@@ -521,12 +521,15 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
                 deps.onAttemptSend?.(retryRecovery ?? recovery);
                 const h = new Headers(request.headers);
                 if (!h.has("accept-encoding")) h.set("accept-encoding", "identity");
-                return fetchImpl(request.url, {
+                // Same reset-recovery parity as the web-search loop: the replay needs
+                // `keepalive: false` to abandon the pooled socket, because Bun has ignored the
+                // hop-by-hop header alone (oven-sh/bun#20492).
+                return fetchImpl(request.url, applyUpstreamRecoveryInit({
                   method: request.method,
                   headers: h,
                   body: request.body,
                   signal: headerDeadline.signal,
-                });
+                }, retryRecovery));
               },
               { abortSignal: headerDeadline.signal, label: "image-bridge-loop" },
             );

package/src/integrations/native/ownership-preflight.ts

@@ -22,11 +22,14 @@ import {
   type ServiceStateEvidence,
 } from "../../service";
 import {
+  createWindowsTaskListingCache,
   inspectServiceManagerInstallation,
   type ProbeDeps,
   type ServiceManagerClaim,
 } from "../../service-manager-probe";
 
+export { createWindowsTaskListingCache };
+
 export type NativeTeardownOwnership = { ok: true } | { ok: false; message: string };
 
 export function assertNativeTeardownOwned(): NativeTeardownOwnership {
@@ -199,4 +202,4 @@ export function inspectNativeCodexOwnership(deps: OwnershipDeps = {}): Ownership
   return valid.length === 0
     ? { ownership: "owned", reason: "no service state and no service manager claim" }
     : { ownership: "owned", reason: "the recorded service state names these homes" };
-}
+}

package/src/lab/fabric/producer-isolate.ts

@@ -1,6 +1,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { ensureRestrictedDir } from "../paths";
 import { FABRIC_LIMITS } from "./constants";
 import {
   FABRIC_PRODUCER_PROTOCOL_MAX_BYTES,
@@ -31,12 +32,44 @@ interface IsolateRequest {
   now?: () => number;
 }
 
-function minimalChildEnv(scratchRoot: string): Record<string, string> {
-  return {
+/**
+ * The environment an isolated producer child runs with.
+ *
+ * Exported so a test that spawns `producer-child.ts` directly cannot drift from
+ * the environment production actually uses. The Windows loader state and the
+ * scratch-owned temp paths below are load-bearing, and a test carrying its own
+ * literal copy of this object silently loses them.
+ */
+export function minimalFabricChildEnv(scratchRoot: string): Record<string, string> {
+  const childTempDir = join(scratchRoot, ".tmp");
+  ensureRestrictedDir(childTempDir, scratchRoot);
+  const env: Record<string, string> = {
     TZ: "UTC",
     NO_COLOR: "1",
     OCX_FABRIC_SCRATCH_ROOT: scratchRoot,
+    // Executors commonly use os.tmpdir() through libraries they import. Keep
+    // those writes inside the same scratch boundary instead of forwarding the
+    // user's ambient temp directory (Windows) or falling back to /tmp (POSIX).
+    TEMP: childTempDir,
+    TMP: childTempDir,
+    TMPDIR: childTempDir,
   };
+  if (process.platform !== "win32") return env;
+  // Windows has no equivalent of "run with an (almost) empty environment". A
+  // CreateProcess child inherits nothing here, and the loader itself reads the
+  // environment: without SystemRoot it cannot resolve the system DLLs the Bun
+  // executable links against, so the child dies before its entry module runs.
+  // The parent then sees an immediate non-zero close with no protocol line and
+  // reports harness_failure -- which is what turned every CL-07 producer case
+  // into "inconclusive" on the Windows leg while POSIX stayed green.
+  //
+  // These are OS-owned loader state, not caller-supplied configuration. Temp
+  // state is deliberately not forwarded; it is rooted in scratch above.
+  for (const name of ["SystemRoot", "windir"] as const) {
+    const value = process.env[name];
+    if (value) env[name] = value;
+  }
+  return env;
 }
 
 function killChild(child: ChildProcess): void {
@@ -56,7 +89,7 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
     let child: ChildProcess;
     try {
       child = spawn(process.execPath, ["run", CHILD_ENTRY], {
-        env: minimalChildEnv(request.scratchRoot),
+        env: minimalFabricChildEnv(request.scratchRoot),
         stdio: ["pipe", "pipe", "pipe"],
       });
     } catch (error) {

package/src/lib/destination-policy.ts

@@ -68,6 +68,83 @@ function classifyIpv4(hostname: string): DestinationAssessment {
   return { kind: "public", detail: "public IP" };
 }
 
+/**
+ * Expand an IPv6 literal into its eight hextets, or null when it is not one this can parse.
+ * `firstIpv6Hextet` below only needs the leading group; prefix matching needs the whole address,
+ * and `::` compression plus the RFC 4291 trailing dotted-quad form both have to be handled.
+ */
+function ipv6Hextets(hostname: string): number[] | null {
+  let text = hostname;
+  const dotted = text.match(/(\d{1,3}(?:\.\d{1,3}){3})$/);
+  if (dotted?.index !== undefined) {
+    const octets = dotted[1].split(".").map(Number);
+    if (octets.some(octet => !Number.isInteger(octet) || octet < 0 || octet > 255)) return null;
+    text = text.slice(0, dotted.index)
+      + ((octets[0]! << 8) | octets[1]!).toString(16)
+      + ":"
+      + ((octets[2]! << 8) | octets[3]!).toString(16);
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const parseGroups = (part: string): number[] | null => {
+    if (!part) return [];
+    const out: number[] = [];
+    for (const piece of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/i.test(piece)) return null;
+      out.push(Number.parseInt(piece, 16));
+    }
+    return out;
+  };
+  const head = parseGroups(halves[0] ?? "");
+  const tail = halves.length === 2 ? parseGroups(halves[1] ?? "") : [];
+  if (!head || !tail) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const fill = 8 - head.length - tail.length;
+  if (fill < 1) return null;
+  return [...head, ...Array<number>(fill).fill(0), ...tail];
+}
+
+/** RFC 6052 §2.1 well-known NAT64 prefix, 64:ff9b::/96, as its six leading hextets. */
+const NAT64_WELL_KNOWN_PREFIX = [0x64, 0xff9b, 0, 0, 0, 0] as const;
+
+/**
+ * `0:0:0:0:ffff:0::/96` — the explicit-zero spelling of a mapped IPv4 that some DNS resolvers
+ * return, e.g. `::ffff:0:c612:1b` for `198.18.0.27`.
+ *
+ * This is deliberately NOT taught to `classifyIpv6`. Under RFC 4291 the mapped prefix is
+ * `::ffff:0:0/96`, so `::ffff:0:c612:1b` is a reserved address whose tail merely LOOKS like an
+ * IPv4 — it is not equivalent to `198.18.0.27`. Treating the two as equal in the general
+ * classifier would admit `::ffff:0:5db8:d822` (tail `93.184.216.34`) as a public destination,
+ * which is the merge blocker a maintainer raised on #2812.
+ *
+ * The reported symptom is narrower than that equivalence: on a fake-IP resolver the answer
+ * assesses as `non-global address`, so the `allowBenchmarkAddresses` exception — which exists
+ * precisely for Clash/Surge/Mihomo fake-IP — could never be reached for this spelling. The fix
+ * therefore lives inside that opt-in, and only for a tail that is itself in `198.18.0.0/15`.
+ */
+const EXPLICIT_ZERO_MAPPED_PREFIX = [0, 0, 0, 0, 0xffff, 0] as const;
+
+/**
+ * True when this DNS answer may pass the `allowBenchmarkAddresses` opt-in.
+ *
+ * Ordinary benchmark answers (IPv4 `198.18/19`, canonical `::ffff:198.18.0.27`, and the NAT64
+ * form) already carry `detail: "benchmark address"` and pass through the first branch. The
+ * second branch adds ONLY the explicit-zero spelling, and only when its embedded quad is itself
+ * a benchmark address — so a public, loopback, private, or metadata-looking tail is refused.
+ */
+function isBenchmarkDnsAnswer(address: string, assessment: DestinationAssessment | null): boolean {
+  if (assessment?.kind === "private" && assessment.detail === "benchmark address") return true;
+  if (isIP(address) !== 6) return false;
+  if (assessment?.kind !== "private" || assessment.detail !== "non-global address") return false;
+  const hextets = ipv6Hextets(normalizeHostname(address));
+  if (!hextets) return false;
+  if (!EXPLICIT_ZERO_MAPPED_PREFIX.every((group, index) => hextets[index] === group)) return false;
+  const hi = hextets[6]!;
+  const lo = hextets[7]!;
+  const embedded = classifyIpv4(`${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`);
+  return embedded.kind === "private" && embedded.detail === "benchmark address";
+}
+
 function firstIpv6Hextet(hostname: string): number | null {
   const head = hostname.split(":")[0];
   if (!head) return 0;
@@ -89,6 +166,20 @@ function classifyIpv6(hostname: string): DestinationAssessment {
     const ipv4 = `${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`;
     return classifyIpv4(ipv4);
   }
+  // NAT64 (RFC 6052): on an IPv6-only/DNS64 network every IPv4-only peer is synthesized into
+  // 64:ff9b::<ipv4>, whose leading hextet (0x64) is below the 2000::/3 global-unicast window and
+  // so fell through to "non-global address". That rejected ordinary public destinations for any
+  // user behind NAT64 — two tests already worked around it with `allowPrivateNetwork: true`.
+  // Classify the EMBEDDED IPv4 instead, exactly as the ::ffff: forms above do, so a wrapped
+  // 127.0.0.1 or 10/8 stays blocked rather than becoming an SSRF bypass. Only the well-known
+  // prefix is decoded; RFC 8215's 64:ff9b:1::/48 is reserved for local-use translation and keeps
+  // its non-global treatment.
+  const hextets = ipv6Hextets(hostname);
+  if (hextets && NAT64_WELL_KNOWN_PREFIX.every((group, index) => hextets[index] === group)) {
+    const hi = hextets[6]!;
+    const lo = hextets[7]!;
+    return classifyIpv4(`${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`);
+  }
   if (hostname === "::1") return { kind: "loopback", detail: "loopback address" };
   if (hostname === "::") return { kind: "unspecified", detail: "unspecified address" };
   const hextet = firstIpv6Hextet(hostname);
@@ -250,11 +341,7 @@ export async function providerDestinationResolvedError(
     const assessment = ipKind === 4 ? classifyIpv4(address) : ipKind === 6 ? classifyIpv6(normalizeHostname(address)) : null;
     if (!assessment || assessment.kind === "public") continue;
     // Clash fake-IP only: 198.18/19 benchmark detail. Mixed dangerous sets still reject.
-    if (
-      options?.allowBenchmarkAddresses
-      && assessment.kind === "private"
-      && assessment.detail === "benchmark address"
-    ) {
+    if (options?.allowBenchmarkAddresses && isBenchmarkDnsAnswer(address, assessment)) {
       continue;
     }
     if (assessment.kind === "metadata") return `baseUrl hostname ${hostname} resolves to a blocked metadata endpoint (${address})`;
@@ -353,7 +440,7 @@ export async function resolvePublicAddresses(
       // fake-IP DNS, not a LAN provider. Accept it without allowPrivateNetwork and
       // do not mark the destination private, so the caller's HTTP(S)_PROXY path
       // still applies (credit #1748).
-      if (benchmarkAllowed && assessment?.kind === "private" && assessment.detail === "benchmark address") {
+      if (benchmarkAllowed && isBenchmarkDnsAnswer(address, assessment)) {
         validatedAddresses.push({ address, family: ipKind === 4 || ipKind === 6 ? ipKind : (family || 4) });
         continue;
       }
@@ -377,4 +464,3 @@ export async function resolvePublicAddresses(
 export async function assertUrlResolvesPublic(url: string): Promise<void> {
   await resolvePublicAddresses(url);
 }
-

package/src/lib/redact.ts

@@ -1,6 +1,11 @@
 export const REDACTED_SECRET = "[REDACTED]";
 
-const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
+/**
+ * Credential-bearing header/field names. Exported for transports that must refuse to send
+ * credentials over an unsafe channel (e.g. plaintext non-loopback HTTP) rather than
+ * re-deriving a narrower local list.
+ */
+export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
 
 /**
  * Colon-labelled credential headers echoed back inside an error body

package/src/lib/shadow-call.ts

@@ -9,6 +9,23 @@
  */
 export const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-5.6-luna"] as const;
 
+/**
+ * Optional blocked model redirects at the shared routing layer.
+ * When `blockedModelRedirects` is configured (e.g. `{ "gpt-5.6-terra": "gpt-5.6-luna" }`),
+ * requests targeting those models are rewritten to the substitute model with
+ * routeReason "blocked-model-redirect".
+ * Returns undefined when not configured or the model is not in the redirect map.
+ */
+export function resolveBlockedModelRedirect(
+  config: { blockedModelRedirects?: Record<string, string> } | undefined,
+  modelId: string,
+): string | undefined {
+  if (!config?.blockedModelRedirects || typeof config.blockedModelRedirects !== "object") {
+    return undefined;
+  }
+  return config.blockedModelRedirects[modelId];
+}
+
 /** Normalize a persisted `sourceModels` override; falls back to the defaults. */
 export function shadowSourceModels(configured?: unknown): string[] {
   const configuredStrings = Array.isArray(configured)
@@ -44,18 +61,36 @@ export function shadowSourceModelPrefix(modelId: string, configured?: unknown):
   return shadowSourceModels(configured).find(prefix => modelId.startsWith(prefix));
 }
 
+export interface ShadowCallModelIdentity {
+  providerName: string;
+  modelId: string;
+}
+
+/** Match a source prefix and replacement as a provider+model pair, never by slug alone. */
+export function shadowCallTargetsIntersect(
+  source: ShadowCallModelIdentity,
+  target: ShadowCallModelIdentity,
+): boolean {
+  return source.providerName === target.providerName
+    && target.modelId.startsWith(source.modelId);
+}
+
 /**
  * Decide whether a matching source model should use the opt-in intercept.
  *
  * Before Codex 0.147.0 this checked x-codex-turn-metadata and exempted
  * request_kind "turn". Codex 0.147.0 can label background helper calls as
  * "turn", causing them to bypass the intercept (#1684). The fix is to
- * intercept every configured shadow source model unconditionally — the model
- * slug alone is a sufficient signal.
+ * intercept every configured shadow source model regardless of request kind.
+ * A replacement intersecting the same provider+model source set remains a
+ * no-op because rewriting it would only create self-interception (#2706).
  */
 export function shouldInterceptShadowCall(
   modelId: string,
   configured: unknown,
+  source: ShadowCallModelIdentity,
+  target: ShadowCallModelIdentity,
 ): boolean {
-  return isShadowSourceModel(modelId, configured);
+  return isShadowSourceModel(modelId, configured)
+    && !shadowCallTargetsIntersect(source, target);
 }

package/src/lib/test-home-guard.ts

@@ -58,15 +58,20 @@ function canonicalize(path: string): string {
  * `homedir()` later would return the sandbox and leave the real home unprotected — the
  * guard would be perfectly inverted while its tests still looked green.
  */
-const PROTECTED_HOME = canonicalize(
-  join(process.env[REAL_HOME_ENV]?.trim() || homedir(), ".opencodex"),
-);
+const REAL_HOME = process.env[REAL_HOME_ENV]?.trim() || homedir();
+const PROTECTED_HOME = canonicalize(join(REAL_HOME, ".opencodex"));
+const PROTECTED_CODEX_HOME = canonicalize(join(REAL_HOME, ".codex"));
 
 /** The production home this process protects. Exported for the guard's own tests. */
 export function protectedHomeForTests(): string {
   return PROTECTED_HOME;
 }
 
+/** The production Codex home this process protects when tests write native credentials. */
+export function protectedCodexHomeForTests(): string {
+  return PROTECTED_CODEX_HOME;
+}
+
 export function isTestHomeGuardArmed(): boolean {
   return process.env[GUARD_ENV] === "1";
 }
@@ -88,3 +93,13 @@ export function assertNotRealHomeUnderTest(dir: string): void {
     + "instead of calling the global writer (see devlog 260730_codex_rs_upstream_v2_live_handoff/070).",
   );
 }
+
+/** Throw when an armed test process is about to write the real native Codex home. */
+export function assertNotRealCodexHomeUnderTest(dir: string): void {
+  if (!isTestHomeGuardArmed()) return;
+  if (canonicalize(dir) !== PROTECTED_CODEX_HOME) return;
+  throw new Error(
+    `refusing to write the real Codex home (${PROTECTED_CODEX_HOME}) from a test process. `
+    + "Point CODEX_HOME at a temp directory for this test before writing native auth.json.",
+  );
+}

package/src/lib/upstream-retry.ts

@@ -239,12 +239,19 @@ export interface ResetRetryOptions {
   abortSignal?: AbortSignal;
   /** Short host/path label for the retry warn log (no secrets/query strings). */
   label?: string;
+  /** Total upstream sends allowed, including the first one. Not a per-layer retry count. */
   attempts?: number;
 }
 
 export interface TransientRetryOptions extends ResetRetryOptions {
   /** Test seam: per-attempt slow budget override (defaults to TRANSIENT_RETRY_SLOW_ATTEMPT_MS). */
   slowAttemptMs?: number;
+  /**
+   * Reports how many upstream sends this call actually consumed, so a caller that spans
+   * several legs of one request (initial send, then a 429/account-recovery refetch) can
+   * keep them on ONE budget instead of handing each leg a fresh one.
+   */
+  onSendsConsumed?: (sends: number) => void;
 }
 
 export type UpstreamSendRecovery = "connection-reset" | "transient-5xx";
@@ -353,23 +360,47 @@ export async function fetchWithResetRetry(
  * its body intact. Honors Retry-After via retryBackoffDelayMs.
  *
  * A failed attempt slower than the slow budget is returned as-is (slow-502 shape);
- * note `opts.attempts` is shared with the inner reset layer (no caller passes it today).
+ * `opts.attempts` is ONE total-send budget covering this layer and the inner reset layer
+ * together, so it bounds the real number of upstream requests rather than multiplying.
  */
 export async function fetchWithTransientRetry(
   doFetch: ReplayableFetch,
   opts: TransientRetryOptions = {},
 ): Promise<Response> {
-  const attempts = Math.max(1, opts.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS);
+  const budget = Math.max(1, opts.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS);
   const slowAttemptMs = opts.slowAttemptMs ?? TRANSIENT_RETRY_SLOW_ATTEMPT_MS;
   const transientStatuses: number[] = [];
+  // `attempts` is ONE total-send budget shared with the inner reset layer, not a per-layer
+  // count. Forwarding it into every `fetchWithResetRetry` made the two multiply: with
+  // `attempts: 3` the outer loop ran 3 transient rounds and each round independently retried
+  // 3 connection resets, so a single call could emit 9 upstream sends — and 10 could emit 100.
+  // That was harmless only because no caller passed `attempts`; the provider-level
+  // `transientRetryOn5xx` policy is the first one that does, and multiplying load against an
+  // already-failing provider is worse than not retrying at all.
+  let sent = 0;
+  const countedFetch: ReplayableFetch = (recovery) => {
+    // Incremented BEFORE the await so a rejected send still consumes budget; counting only
+    // successes would let a reset storm loop without bound.
+    sent += 1;
+    return doFetch(recovery);
+  };
+  // Floor of 1 keeps the inner call legal once the budget is spent; the loop condition, not a
+  // zero-attempt inner call, is what actually stops the retries.
+  const remaining = () => Math.max(1, budget - sent);
+  // Reported in `finally` rather than at each exit: this function returns from five places
+  // and throws from one, and a caller sharing the budget across request legs must be told the
+  // real count on every one of them.
+  try {
   let attemptStart = Date.now();
-  let res = await fetchWithResetRetry(doFetch, opts);
-  for (let attempt = 0; attempt < attempts - 1; attempt++) {
+  let res = await fetchWithResetRetry(countedFetch, { ...opts, attempts: remaining() });
+  for (let attempt = 0; sent < budget; attempt++) {
     if (res.ok || !isTransientUpstreamStatus(res.status)) return res;
+    // Checked before cancelResponseBodyBestEffort so an already-aborted caller never receives
+    // a response whose body we just cancelled.
     if (opts.abortSignal?.aborted) return res;
     if (Date.now() - attemptStart > slowAttemptMs) return res;
     console.warn(
-      `[upstream-retry] transient ${res.status}${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`,
+      `[upstream-retry] transient ${res.status}${opts.label ? ` (${opts.label})` : ""} — retrying (${sent + 1}/${budget})`,
     );
     const delay = retryBackoffDelayMs(attempt, {
       baseDelayMs: TRANSIENT_RETRY_BASE_DELAY_MS,
@@ -377,16 +408,22 @@ export async function fetchWithTransientRetry(
       headers: res.headers,
     });
     cancelResponseBodyBestEffort(res);
+    // Throws on abort (see sleepWithAbort): the rejection propagates, and the body we just
+    // cancelled belonged to a response we were discarding anyway.
     await sleepWithAbort(delay, opts.abortSignal);
     attemptStart = Date.now();
     transientStatuses.push(res.status);
     try {
-      res = await fetchWithResetRetry(doFetch, opts, "transient-5xx");
+      res = await fetchWithResetRetry(countedFetch, { ...opts, attempts: remaining() }, "transient-5xx");
     } catch (err) {
       // Keep the prior 5xx evidence attached: the origin already responded, so
       // this rejection is not pre-connection and must not classify as neutral.
       throw new UpstreamRetryEvidenceError(transientStatuses, err);
     }
   }
+  // Budget exhausted: the last response is returned with its body intact.
   return res;
+  } finally {
+    opts.onSendsConsumed?.(sent);
+  }
 }