@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/codex/reserve-availability.ts

@@ -0,0 +1,177 @@
+import { createHmac, randomBytes } from "node:crypto";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import {
+  getMainQuotaCredentialGeneration, isMainQuotaWriterLive, matchesMainQuotaCredential, type MainQuotaWriter,
+} from "./main-account-cache";
+import { NATIVE_RESERVE_MODEL } from "./catalog/native-models";
+import { WHAM_REQUEST_TIMEOUT_MS } from "./quota-recovery-timing";
+import type { WhamUsageResponse } from "./quota-types";
+
+const USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+const AUTHORIZATION_TTL_MS = 60_000;
+const credentialSalt = randomBytes(32);
+type Token = { accessToken: string; chatgptAccountId: string };
+export interface MainReserveAuthorization {
+  readonly writer: MainQuotaWriter;
+  readonly observedAt: number;
+  readonly expiresAt: number;
+}
+type Input = {
+  token: Token;
+  writer: MainQuotaWriter | undefined;
+  signal?: AbortSignal;
+  observeOrdinaryQuota: (data: WhamUsageResponse, writer: MainQuotaWriter) => void;
+};
+type Slot = {
+  key: string;
+  writer: MainQuotaWriter;
+  credentialGeneration: number;
+  revision: number;
+  authorization?: MainReserveAuthorization;
+  flight?: Promise<MainReserveAuthorization | undefined>;
+  controller?: AbortController;
+};
+let current: Slot | undefined;
+const authorizationKeys = new WeakMap<MainReserveAuthorization, string>();
+
+function credentialKey(token: Token, writer: MainQuotaWriter): string {
+  return createHmac("sha256", credentialSalt).update(writer.identityKey)
+    .update(`:${writer.identityGeneration}:${getMainQuotaCredentialGeneration()}:`).update(token.accessToken).digest("hex");
+}
+function owned(token: Token, writer: MainQuotaWriter): boolean {
+  return isMainQuotaWriterLive(writer) && matchesMainQuotaCredential(token.accessToken, token.chatgptAccountId);
+}
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function userId(token: string): string | undefined {
+  try {
+    const payload: unknown = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    const auth = record(payload) ? payload["https://api.openai.com/auth"] : undefined;
+    if (!record(auth)) return;
+    const value = auth.chatgpt_user_id ?? auth.user_id;
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+  } catch { return; }
+}
+function identityMatches(data: WhamUsageResponse, token: Token): boolean {
+  if (data.account_id != null && data.account_id !== token.chatgptAccountId) return false;
+  const expectedUser = userId(token.accessToken);
+  return expectedUser === undefined || data.user_id == null || data.user_id === expectedUser;
+}
+function reserveLimits(data: WhamUsageResponse) {
+  return Array.isArray(data.additional_rate_limits)
+    ? data.additional_rate_limits.filter(entry => record(entry) && entry.limit_name === NATIVE_RESERVE_MODEL)
+    : [];
+}
+function grantsReserve(data: WhamUsageResponse): boolean {
+  const limits = reserveLimits(data);
+  return data.rate_limit?.allowed === false && data.rate_limit_upsell?.banner_type === "luna_reserve"
+    && limits.length === 1 && limits[0]?.rate_limit?.allowed === true;
+}
+
+/** An object copied/spread onto a refreshed credential is not an authorization for that credential. */
+export function isMainReserveAuthorizationLive(
+  value: MainReserveAuthorization | undefined, token: Token, now = Date.now(),
+): boolean {
+  if (!value || !owned(token, value.writer) || value.expiresAt <= now || value.observedAt > now) return false;
+  const key = credentialKey(token, value.writer);
+  return current?.authorization === value && authorizationKeys.get(value) === key && current.key === key;
+}
+
+/** Passive usage may revoke, but never grant. Missing Reserve on a passive read is not revocation. */
+export function observeMainReserveRevocation(data: WhamUsageResponse, writer: MainQuotaWriter | undefined): void {
+  const slot = current;
+  if (!slot || !writer || !isMainQuotaWriterLive(writer)
+    || writer.identityKey !== slot.writer.identityKey || writer.identityGeneration !== slot.writer.identityGeneration) return;
+  if (data.rate_limit?.allowed !== true && !reserveLimits(data).some(limit => limit.rate_limit?.allowed === false)) return;
+  slot.revision += 1;
+  slot.authorization = undefined;
+  slot.controller?.abort();
+}
+
+async function waitForCaller<T>(flight: Promise<T>, signal?: AbortSignal): Promise<T | undefined> {
+  if (!signal) return flight;
+  if (signal.aborted) return;
+  let abort!: () => void;
+  const aborted = new Promise<undefined>(resolve => { abort = () => resolve(undefined); signal.addEventListener("abort", abort, { once: true }); });
+  try { return await Promise.race([flight, aborted]); }
+  finally { signal.removeEventListener("abort", abort); }
+}
+
+async function readAuthorization(slot: Slot, input: Input & { writer: MainQuotaWriter }): Promise<MainReserveAuthorization | undefined> {
+  const controller = new AbortController();
+  slot.controller = controller;
+  const revision = slot.revision;
+  const deadline = Date.now() + WHAM_REQUEST_TIMEOUT_MS;
+  const live = () => current === slot && revision === slot.revision && !controller.signal.aborted
+    && Date.now() < deadline && slot.credentialGeneration === getMainQuotaCredentialGeneration()
+    && owned(input.token, input.writer);
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let onAbort!: () => void;
+  const stopped = new Promise<undefined>(resolve => {
+    onAbort = () => resolve(undefined);
+    controller.signal.addEventListener("abort", onAbort, { once: true });
+    timer = setTimeout(() => controller.abort(), WHAM_REQUEST_TIMEOUT_MS);
+  });
+  const operation = (async () => {
+    const response = await fetch(USAGE_URL, {
+      method: "GET", redirect: "error", signal: controller.signal,
+      headers: {
+        authorization: `Bearer ${input.token.accessToken}`,
+        "chatgpt-account-id": input.token.chatgptAccountId,
+        "x-openai-codex-luna-reserve": "1", accept: "application/json",
+      },
+    });
+    if (!response.ok || !live()) {
+      void response.body?.cancel().catch(() => undefined);
+      return;
+    }
+    const body = await readBoundedResponseBody(response, {
+      signal: controller.signal, fatalUtf8: true,
+      totalTimeoutMs: Math.max(1, deadline - Date.now()), inactivityTimeoutMs: WHAM_REQUEST_TIMEOUT_MS,
+    });
+    if (!body.displaySafe || body.truncated || !live()) return;
+    const raw: unknown = JSON.parse(body.text);
+    if (!record(raw)) return;
+    const data = raw as WhamUsageResponse;
+    if (!identityMatches(data, input.token)) return;
+    // Keep malformed additional containers away from legacy ordinary parsers.
+    if (data.additional_rate_limits != null && !Array.isArray(data.additional_rate_limits)) return;
+    input.observeOrdinaryQuota(data, input.writer);
+    if (!live() || !grantsReserve(data)) { slot.authorization = undefined; return; }
+    const observedAt = Date.now();
+    const authorization = Object.freeze({
+      writer: Object.freeze({ ...input.writer }), observedAt, expiresAt: observedAt + AUTHORIZATION_TTL_MS,
+    });
+    authorizationKeys.set(authorization, slot.key);
+    slot.authorization = authorization;
+    return authorization;
+  })().catch(() => undefined);
+  try { return await Promise.race([operation, stopped]); }
+  finally {
+    clearTimeout(timer);
+    controller.signal.removeEventListener("abort", onAbort);
+    if (slot.controller === controller) slot.controller = undefined;
+  }
+}
+
+/** Capability-aware read with an already-owned token; no auth-file access or inference. */
+export async function getMainReserveAuthorization(input: Input): Promise<MainReserveAuthorization | undefined> {
+  const writer = input.writer && { ...input.writer };
+  const token = { ...input.token };
+  if (input.signal?.aborted || !writer || !owned(token, writer)) return;
+  const key = credentialKey(token, writer);
+  if (!current || current.key !== key) {
+    current?.controller?.abort();
+    current = { key, writer: { ...writer }, credentialGeneration: getMainQuotaCredentialGeneration(), revision: 0 };
+  }
+  const slot = current;
+  if (isMainReserveAuthorizationLive(slot.authorization, token)) return slot.authorization;
+  if (!slot.flight) {
+    const flight = readAuthorization(slot, { ...input, token, writer });
+    slot.flight = flight;
+    void flight.finally(() => { if (slot.flight === flight) slot.flight = undefined; });
+  }
+  const result = await waitForCaller(slot.flight, input.signal);
+  return !input.signal?.aborted && isMainReserveAuthorizationLive(result, token) ? result : undefined;
+}

package/src/codex/routing.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { saveConfigPreservingClaudeCode } from "../config";
 import { isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store";
 import { codexAccountLogLabel } from "./account-label";
+import { NATIVE_RESERVE_MODEL } from "./catalog/native-models";
 import { isCodexAccountPaused } from "./account-pause";
 import { clearCodexAccountPin, codexAccountPriorityLookup, pinnedCodexAccountId } from "./account-priority";
 import { isCodexAccountUsable, type CodexAccountUsabilityOptions } from "./account-usability";
@@ -114,6 +115,14 @@ const CODEX_MAX_RESET_DERIVED_COOLDOWN_MS = 15 * 60_000;
 /** Minimum gap between probe leases for one cooled-down account. */
 export const CODEX_QUOTA_PROBE_INTERVAL_MS = 5 * 60_000;
 export const CODEX_FAILURE_WINDOW_MS = 5 * 60_000;
+/**
+ * How recently a 100% burst reading must have been OBSERVED to exclude an account when it
+ * carries no reset timestamp (#3425). Deliberately far tighter than the 6h disk-hydration
+ * horizon in `quota.ts`: shorter than any plausible five-hour burst window, so a persisted
+ * reading can never strand a recovered account, and long enough that a snapshot taken at
+ * admission is still fresh when selection reads it.
+ */
+export const TERMINAL_SHORT_WINDOW_FRESHNESS_MS = 5 * 60_000;
 /** How long a transient failure keeps the account out of pool selection. */
 export const CODEX_TRANSIENT_SOFT_AVOID_MS = 30_000;
 const CODEX_TRANSIENT_SOFT_AVOID_ESCALATION_MS = [
@@ -165,7 +174,7 @@ export type CodexCooldownSource = "retry-after" | "reset-derived" | "default";
  * Add a new explicit group here only when its independent upstream quota is
  * confirmed, so shared limits never receive cross-model bypasses.
  */
-export type CodexQuotaScope = "shared" | "spark";
+export type CodexQuotaScope = "shared" | "spark" | "reserve";
 
 export type CodexQuotaRecoveryProbeClaim = {
   accountId: string;
@@ -200,6 +209,7 @@ function isModelDetourAffinityScope(scope: ThreadAffinityScope): scope is ModelD
 
 const NATIVE_MODEL_QUOTA_SCOPES: Readonly<Record<string, CodexQuotaScope>> = {
   "gpt-5.3-codex-spark": "spark",
+  [NATIVE_RESERVE_MODEL]: "reserve",
 };
 
 export function codexQuotaScopeForModel(modelId: string | undefined): CodexQuotaScope | undefined {
@@ -365,6 +375,7 @@ export function computeCodexUsageScore(quota: {
   monthlyPercent?: number;
   shortPercent?: number;
   shortResetAt?: number;
+  shortObservedAt?: number;
 } | null, plan?: unknown, now: number = Date.now()): number {
   if (!quota) return CODEX_UNKNOWN_USAGE_SCORE;
   const finite = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value);
@@ -404,15 +415,24 @@ export function computeCodexUsageScore(quota: {
  * direction here is the one that keeps an account selectable: a wrongly-selected account
  * fails one request, while a wrongly-excluded one is invisible until someone reads the pool
  * by hand.
+ *
+ * A missing reset can instead be aged by shortObservedAt (#3425). General updatedAt is not
+ * sufficient: credit-only updates preserve the old short tuple but advance that timestamp.
+ * Old disk snapshots without short-window provenance remain unknown.
  */
 function isTerminalShortWindow(
-  quota: { shortPercent?: number; shortResetAt?: number },
+  quota: { shortPercent?: number; shortResetAt?: number; shortObservedAt?: number },
   now: number,
 ): boolean {
   if (typeof quota.shortPercent !== "number" || !Number.isFinite(quota.shortPercent)) return false;
   if (quota.shortPercent < CODEX_EXHAUSTED_USAGE_PERCENT) return false;
   const resetAt = quota.shortResetAt;
-  if (typeof resetAt !== "number" || !Number.isFinite(resetAt) || resetAt <= 0) return false;
+  if (typeof resetAt !== "number" || !Number.isFinite(resetAt) || resetAt <= 0) {
+    const observedAt = quota.shortObservedAt;
+    if (typeof observedAt !== "number" || !Number.isFinite(observedAt)) return false;
+    const age = now - observedAt;
+    return age >= 0 && age <= TERMINAL_SHORT_WINDOW_FRESHNESS_MS;
+  }
   // Both units reach storage: `normalizeResetAt` does not scale, and the GUI disambiguates
   // by magnitude at read time. A comparison written against one assumption is off by 1000x
   // against the other, and in the seconds-read-as-milliseconds direction every terminal
@@ -548,7 +568,7 @@ function canAcquireQuotaProbeLease(health: CodexUpstreamHealth | undefined, now:
 
 /**
  * Claim due reset-derived cooldown probes without consulting account selection.
- * Pool credentials only: the main account has no quota-refresh single-flight.
+ * Added Pool credentials only; owned main usage recovery is handled separately.
  */
 export function claimDueCodexQuotaRecoveryProbes(
   config: OcxConfig,
@@ -575,11 +595,10 @@ export function claimDueCodexQuotaRecoveryProbes(
       { scope: undefined, health: upstreamHealth.get(account.id) },
       ...[...(quotaScopedHealth.get(account.id) ?? [])].map(([scope, health]) => ({ scope, health })),
     ].filter((entry): entry is { scope?: CodexQuotaScope; health: CodexUpstreamHealth } =>
-      // `spark` is deliberately never claimed. `GET /backend-api/wham/usage` takes no scope
-      // parameter and returns generic weekly/monthly windows, so its result can never prove a
-      // spark recovery — a claim here would spend an upstream call to settle `false` every
-      // time, and (with one claim per account per pass) delay the shared scope that CAN recover.
-      entry.scope !== "spark"
+      // Generic WHAM evidence can recover only ordinary quota, never Spark or Reserve.
+      // Do not spend this account's one claim per pass on an independent scope and
+      // delay the shared scope that the response can actually recover.
+      (entry.scope === undefined || entry.scope === "shared")
       && entry.health?.cooldownSource === "reset-derived"
       && canAcquireQuotaProbeLease(entry.health, now))
       .sort((a, b) =>

package/src/codex/shim.ts

@@ -766,7 +766,42 @@ exec ${shQuote(realCodexPath)} "$@"
 `;
 }
 
-type UnixShimProbeResult = "cleanup" | "descendants" | "failed" | "recursive" | "timeout" | null;
+type UnixShimProbeCleanupPhase = "marker" | "reentry" | "group" | "stderr" | "group-id" | "termination" | "spawn" | "exception";
+interface UnixShimProbeCleanup {
+  kind: "cleanup";
+  phase: UnixShimProbeCleanupPhase;
+  code: string;
+  status: number | null;
+  signal: string;
+}
+type UnixShimProbeResult = UnixShimProbeCleanup | "descendants" | "failed" | "recursive" | "timeout" | null;
+
+const SHIM_PROBE_ERROR_CODES = new Set([
+  "EACCES", "EAGAIN", "EBADF", "ECANCELED", "EINTR", "EIO", "EMFILE", "ENFILE",
+  "ENOENT", "ENOEXEC", "ENOMEM", "ENOSPC", "EPERM", "EPIPE", "ESRCH", "ETIMEDOUT", "ETXTBSY",
+]);
+const SHIM_PROBE_SIGNALS = new Set([
+  "SIGABRT", "SIGBUS", "SIGHUP", "SIGILL", "SIGINT", "SIGKILL", "SIGPIPE", "SIGQUIT",
+  "SIGSEGV", "SIGTERM", "SIGTRAP", "SIGXCPU", "SIGXFSZ",
+]);
+
+/** Diagnostics cross a CLI boundary: never stringify arbitrary errors or metadata. */
+function shimProbeCleanup(
+  phase: UnixShimProbeCleanupPhase, error?: unknown, status?: unknown, signal?: unknown,
+): UnixShimProbeCleanup {
+  let code = error === undefined ? "none" : "unknown";
+  if (error !== null && typeof error === "object") {
+    try {
+      const value = Object.getOwnPropertyDescriptor(error, "code")?.value;
+      if (typeof value === "string" && SHIM_PROBE_ERROR_CODES.has(value)) code = value;
+    } catch { /* hostile accessors/proxies cannot turn diagnostics into an exception */ }
+  }
+  return {
+    kind: "cleanup", phase, code,
+    status: typeof status === "number" && Number.isInteger(status) && status >= 0 && status <= 255 ? status : null,
+    signal: typeof signal === "string" && SHIM_PROBE_SIGNALS.has(signal) ? signal : "none",
+  };
+}
 
 let codexShimProbeHookForTests: (() => void) | null = null;
 let codexShimProbeShellForTests: string | null = null;
@@ -842,6 +877,8 @@ function probeUnixShimInstall(wrapperPath: string): UnixShimProbeResult {
   delete env.OCX_SHIM_ACTIVE_DEPTH;
   delete env.OCX_SHIM_PROBE_ACTIVE;
   let groupId = 0;
+  let probeStatus: unknown;
+  let probeSignal: unknown;
   try {
     chmodSync(probeDir, 0o700);
     const result = spawnSync(process.execPath, [
@@ -863,26 +900,31 @@ function probeUnixShimInstall(wrapperPath: string): UnixShimProbeResult {
       timeout: CODEX_SHIM_INSTALL_PROBE_TIMEOUT_MS + CODEX_SHIM_INSTALL_PROBE_EXIT_TIMEOUT_MS,
       killSignal: "SIGKILL",
     });
+    probeStatus = result.status;
+    probeSignal = result.signal;
     const timedOut = (result.error as NodeJS.ErrnoException | undefined)?.code === "ETIMEDOUT";
     const marker = readProbeMetadata(markerPath, 64);
     const reentryMarker = readProbeMetadata(reentryPath, 64);
     const groupText = readProbeMetadata(groupPath, 64);
     const launcherStderr = readProbeMetadata(stderrPath, MAX_DIAGNOSTIC_VALUE_BYTES);
     groupId = groupText === null ? 0 : Number.parseInt(groupText, 10);
-    if (marker === null || reentryMarker === null || groupText === null || launcherStderr === null
-      || !Number.isInteger(groupId) || groupId <= 0) return "cleanup";
+    if (marker === null) return shimProbeCleanup("marker", result.error, probeStatus, probeSignal);
+    if (reentryMarker === null) return shimProbeCleanup("reentry", result.error, probeStatus, probeSignal);
+    if (groupText === null) return shimProbeCleanup("group", result.error, probeStatus, probeSignal);
+    if (launcherStderr === null) return shimProbeCleanup("stderr", result.error, probeStatus, probeSignal);
+    if (!Number.isInteger(groupId) || groupId <= 0) return shimProbeCleanup("group-id", result.error, probeStatus, probeSignal);
     const groupSurvived = unixProcessGroupAlive(groupId);
     if (timedOut || marker || reentryMarker || groupSurvived) {
       try {
         terminateUnixProcessGroup(groupId);
-      } catch {
-        return "cleanup";
+      } catch (error) {
+        return shimProbeCleanup("termination", error, probeStatus, probeSignal);
       }
     }
-    if (result.error && !timedOut) return "cleanup";
+    if (result.error && !timedOut) return shimProbeCleanup("spawn", result.error, probeStatus, probeSignal);
     if (timedOut || marker === "timeout") return "timeout";
     if (marker === "recursive" || reentryMarker === "recursive") return "recursive";
-    if (reentryMarker !== "") return "cleanup";
+    if (reentryMarker !== "") return shimProbeCleanup("reentry", undefined, probeStatus, probeSignal);
     if (marker === "descendants") return "descendants";
     if (groupSurvived) return "descendants";
     if (result.status === CODEX_SHIM_REENTRY_EXIT_CODE && launcherStderr.includes(CODEX_SHIM_REENTRY_DIAGNOSTIC)) {
@@ -890,11 +932,11 @@ function probeUnixShimInstall(wrapperPath: string): UnixShimProbeResult {
     }
     if (result.status !== 0) return "failed";
     return null;
-  } catch {
+  } catch (error) {
     if (Number.isInteger(groupId) && groupId > 0) {
       try { terminateUnixProcessGroup(groupId); } catch { /* cleanup classification below */ }
     }
-    return "cleanup";
+    return shimProbeCleanup("exception", error, probeStatus, probeSignal);
   } finally {
     try { rmSync(probeDir, { recursive: true, force: true }); } catch { /* best-effort cleanup */ }
   }
@@ -2215,8 +2257,8 @@ function installCodexShimInternal(options: InstallCodexShimInternalOptions): { i
           ? `the saved launcher did not finish --version within ${CODEX_SHIM_INSTALL_PROBE_TIMEOUT_MS}ms`
           : unsafe === "descendants"
             ? "the saved launcher left background descendants running after --version"
-            : unsafe === "cleanup"
-              ? "the saved launcher's probe process group could not be terminated cleanly"
+            : unsafe !== null && typeof unsafe === "object"
+              ? `the saved launcher's probe process group could not be terminated cleanly [phase=${unsafe.phase}; code=${unsafe.code}; status=${unsafe.status ?? "none"}; signal=${unsafe.signal}]`
               : "the saved launcher failed its --version probe";
       return {
         installed: false,

package/src/codex/subagent-model-fallback.ts

@@ -38,7 +38,7 @@ import {
 import { routeModel, type RouteResult } from "../router";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { codexAccountNamespaceForModel } from "./account-namespace-match";
-import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "./catalog/native-models";
+import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS, NATIVE_MAIN_DRAIN_SENTINEL_MODELS } from "./catalog/native-models";
 import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
 import {
   getUpstreamHostHealth,
@@ -59,6 +59,8 @@ export type SubagentPoolAccountPreview = (
 export type SubagentModelEligibleAccountIds = (
   modelId: string | undefined,
 ) => ReadonlySet<string> | undefined;
+/** Additional resolved routes that a restricted fallback caller has independently approved. */
+export type SubagentFallbackRouteEligibility = (route: RouteResult) => boolean;
 let subagentQuotaPrimeForTests: SubagentQuotaPrimeFn | null = null;
 let quotaPrimeInFlight: Promise<void> | null = null;
 
@@ -328,9 +330,17 @@ export function isSubagentModelUnavailable(
   // preserve the credential fence. If no non-main candidate can serve an unqualified
   // gated model, retain main only as a read-free sentinel: final auth owns the atomic
   // claim and returns maintenance instead of letting a routed fallback bypass it.
+  //
+  // The predicate is its OWN set, not the account-gated one. The sentinel protects the atomic
+  // main claim during a drain, which has nothing to do with entitlement; it read the gated set
+  // only because the two happened to hold the same slugs. Ungating the flagships (2026-09-04)
+  // would have flipped this false and let a drain silently rewrite the operator's configured
+  // subagent model instead of reporting maintenance -- a different model answering than was
+  // chosen. The set is explicit rather than every supported native, so gpt-5.5 and friends keep
+  // their existing fall-back-and-answer behaviour.
   const preserveDrainingMainCandidate = route.codexAccountId === undefined
     && candidateAccountUsabilityOptions?.nativeMainSelectionOnly === true
-    && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId);
+    && NATIVE_MAIN_DRAIN_SENTINEL_MODELS.has(route.modelId);
   if (!preserveDrainingMainCandidate) return true;
   const drainingMainUsabilityOptions: CodexAccountUsabilityOptions = {
     ...candidateAccountUsabilityOptions,
@@ -356,13 +366,21 @@ export function selectAvailableSubagentModel(
   poolAccountPreview?: SubagentPoolAccountPreview,
   modelEligibleAccountIdsForModel?: SubagentModelEligibleAccountIds,
   resolvedChain?: readonly string[],
+  restrictedRouteEligible?: SubagentFallbackRouteEligibility,
 ): { model: string; rewritten: boolean; skipped: string[] } {
   const chain = resolvedChain ?? normalizedChain(primary, config, extraFallback, trailingFallback);
   const skipped: string[] = [];
   for (const candidate of chain) {
     if (nativeFallbackOnly) {
       const route = tryRouteFallbackModel(config, candidate);
-      if (!route || !isCanonicalOpenAiForwardProvider(route.provider)) {
+      if (
+        !route
+        || route.combo !== undefined
+        || (
+          !isCanonicalOpenAiForwardProvider(route.provider)
+          && restrictedRouteEligible?.(route) !== true
+        )
+      ) {
         skipped.push(candidate);
         continue;
       }
@@ -607,6 +625,7 @@ export function applySubagentModelFallback(
   poolAccountPreview?: SubagentPoolAccountPreview,
   modelEligibleAccountIdsForModel?: SubagentModelEligibleAccountIds,
   resolvedFallbackChain?: readonly string[] | null,
+  restrictedRouteEligible?: SubagentFallbackRouteEligibility,
 ): { from?: string; to?: string; skipped?: string[] } | null {
   if (!isThreadSpawnRequest(headers)) return null;
   const fallbackChain = resolvedFallbackChain === undefined
@@ -625,6 +644,7 @@ export function applySubagentModelFallback(
     poolAccountPreview,
     modelEligibleAccountIdsForModel,
     fallbackChain,
+    restrictedRouteEligible,
   );
   if (!selection.rewritten) return selection.skipped.length > 0
     ? { from: parsed.modelId, to: parsed.modelId, skipped: selection.skipped }