@bitkyc08/opencodex 2.52.0 → 2.53.0

package/src/server/relay.ts

@@ -183,7 +183,10 @@ export type SseTerminalOutputBoundary = {
  * terminal, and drops every later block/byte. A premature [DONE] is held until
  * a terminal arrives so clean EOF can synthesize one terminal and one sentinel.
  */
-export function createSseTerminalOutputBoundary(): SseTerminalOutputBoundary {
+export function createSseTerminalOutputBoundary(
+  options?: CodexSafetyBufferingFilterOptions,
+): SseTerminalOutputBoundary {
+  const dropSafetyBuffering = options?.dropCodexSafetyBuffering === true;
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
   const framer = new BoundedSseFrameBuffer(MAX_INSPECTION_SSE_FRAME_BYTES);
@@ -207,15 +210,22 @@ export function createSseTerminalOutputBoundary(): SseTerminalOutputBoundary {
       // behind EOF, so its log context cannot determine the outgoing terminal.
       const message = boundedBareUpstreamErrorMessage(parsed);
       if (message !== undefined) upstreamError = message;
+      const safetyBuffering = dropSafetyBuffering && parsed !== undefined
+        ? codexSafetyBufferingBlockAction(parsed) : "keep";
+      if (safetyBuffering === "drop") continue;
       const policyError = parsed !== undefined && isPolicyRewriteType(parsed)
         ? cyberPolicyTerminalError(parsed)
         : undefined;
-      const outboundBlock = policyError
-        ? encoder.encode(rewritePolicyTerminalBlock(
-          decoder.decode(frame.block),
-          policyFailurePayload(policyError, parsed),
-        ))
+      const policyPayload = policyError ? policyFailurePayload(policyError, parsed) : undefined;
+      let outboundBlock = policyPayload !== undefined
+        ? encoder.encode(rewritePolicyTerminalBlock(decoder.decode(frame.block), policyPayload))
         : frame.block;
+      if (safetyBuffering === "strip") {
+        outboundBlock = encoder.encode(stripCodexSafetyBufferingField(
+          decoder.decode(outboundBlock),
+          policyPayload !== undefined ? parseSsePayload(policyPayload) : parsed,
+        ));
+      }
       if (isDone) {
         done = true;
         if (responsesTerminal) {
@@ -287,11 +297,11 @@ export function relaySseWithFailedTail(
   body: ReadableStream<Uint8Array>,
   upstream: AbortController,
   onClientGone?: (reason?: unknown) => void,
-  opts?: { upstreamError?: string },
+  opts?: { upstreamError?: string; terminalBoundary?: CodexSafetyBufferingFilterOptions },
 ): ReadableStream<Uint8Array> {
   const reader = body.getReader();
   const encoder = new TextEncoder();
-  const terminalBoundary = createSseTerminalOutputBoundary();
+  const terminalBoundary = createSseTerminalOutputBoundary(opts?.terminalBoundary);
   let closed = false;
   const relayChunk = (
     controller: ReadableStreamDefaultController<Uint8Array>,
@@ -468,6 +478,29 @@ function isPolicyRewriteType(parsed: unknown): boolean {
   return type === "response.failed" || type === "response.incomplete" || type === "error";
 }
 
+/**
+ * Codex emits its safety-buffering hint in the SSE body as well as in headers:
+ * a `response.metadata` event whose `metadata.type` is `safety_buffering`, or a
+ * `safety_buffering` field on another event. The metadata event is dropped whole;
+ * the field is stripped so the carrying event is otherwise relayed unchanged.
+ */
+function codexSafetyBufferingBlockAction(parsed: unknown): "keep" | "drop" | "strip" {
+  const root = asJsonRecord(parsed);
+  if (!root) return "keep";
+  if (root.type === "response.metadata") {
+    const metadata = asJsonRecord(root.metadata);
+    if (metadata?.type === "safety_buffering") return "drop";
+  }
+  return Object.hasOwn(root, "safety_buffering") ? "strip" : "keep";
+}
+
+function stripCodexSafetyBufferingField(block: string, parsed: unknown): string {
+  const root = asJsonRecord(parsed);
+  if (!root) return block;
+  const { safety_buffering: _safetyBuffering, ...rest } = root;
+  return replaceSseDataPayload(block, JSON.stringify(rest));
+}
+
 function rewritePolicyTerminalBlock(block: string, payload: string): string {
   const newline = block.includes("\r\n") ? "\r\n" : "\n";
   const rewritten = replaceSseDataPayload(block, payload);
@@ -1461,7 +1494,31 @@ export function consumeForResponseLogMetadata(
  * body makes the caller (Codex) double-decode / truncate → "stream error" on every gpt passthrough.
  * Drop encoding + hop-by-hop headers; relay everything else (content-type, etc.) verbatim.
  */
-export function sanitizePassthroughHeaders(upstream: Headers): Headers {
+export const CODEX_SAFETY_BUFFERING_HEADERS = [
+  "x-codex-safety-buffering-enabled",
+  "x-codex-safety-buffering-faster-model",
+] as const;
+
+const CODEX_SAFETY_BUFFERING_HEADER_SET: ReadonlySet<string> = new Set(CODEX_SAFETY_BUFFERING_HEADERS);
+
+export interface CodexSafetyBufferingFilterOptions {
+  /**
+   * Drop Codex safety-buffering hints: the `x-codex-safety-buffering-*` response
+   * headers and the `safety_buffering` SSE metadata event / field. Absent and
+   * `false` relay everything unchanged.
+   */
+  dropCodexSafetyBuffering?: boolean;
+}
+
+/** Resolve the passthrough header policy from the loaded config (absent means "forward everything"). */
+export function codexSafetyBufferingFilterOptions(
+  config: { dropCodexSafetyBuffering?: boolean },
+): CodexSafetyBufferingFilterOptions {
+  return { dropCodexSafetyBuffering: config.dropCodexSafetyBuffering === true };
+}
+
+export function sanitizePassthroughHeaders(upstream: Headers, options?: CodexSafetyBufferingFilterOptions): Headers {
+  const dropSafetyBuffering = options?.dropCodexSafetyBuffering === true;
   const DROP = new Set([
     "content-encoding",
     "content-length",
@@ -1478,7 +1535,10 @@ export function sanitizePassthroughHeaders(upstream: Headers): Headers {
   ]);
   const out = new Headers();
   upstream.forEach((value, key) => {
-    if (!DROP.has(key.toLowerCase())) out.set(key, value);
+    const lower = key.toLowerCase();
+    if (DROP.has(lower)) return;
+    if (dropSafetyBuffering && CODEX_SAFETY_BUFFERING_HEADER_SET.has(lower)) return;
+    out.set(key, value);
   });
   return out;
 }

package/src/server/request-decompress.ts

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 import { gunzipSync, inflateRawSync, inflateSync, zstdDecompressSync } from "node:zlib";
 import type { TranslatorBudget } from "../lib/translator-budget";
 
@@ -29,7 +30,7 @@ export const MAX_DECOMPRESSED_BODY_BYTES = 256 * 1024 * 1024;
  * shrink and is stuck. An UNBOUNDED inbound cap is not an acceptable answer: this admission
  * limit is the only thing standing between one request and the process heap, and
  * `readBoundedJsonRequestBody` materializes the body several times over (retained wire bytes,
- * decoded bytes, the decoded string, the re-encoded measurement copies, and the parsed object
+ * decoded bytes, the decoded string, the serialized measurement string, and the parsed object
  * graph), so peak RSS is a MULTIPLE of whatever is admitted here. 512 MiB is the largest value
  * that keeps that multiple survivable on an ordinary machine, and it is what #3573 asked for.
  */
@@ -324,12 +325,14 @@ export async function readBoundedJsonRequestBody(
     const decoded = decodeRequestBody(raw, encoding, maxBytes);
     releaseDecoded = decoded === raw ? undefined : budget?.observeAcceptedRequestCopy(decoded.byteLength);
     const text = new TextDecoder().decode(decoded);
-    releaseText = budget?.observeAcceptedRequestCopy(new TextEncoder().encode(text).byteLength);
+    // Count UTF-8 without allocating another request-sized byte array for diagnostics.
+    releaseText = budget?.observeAcceptedRequestCopy(Buffer.byteLength(text, "utf8"));
     if (options && "emptyBodyFallback" in options && text.trim() === "") {
       return options.emptyBodyFallback;
     }
     const parsed = JSON.parse(text);
-    budget?.observeAcceptedRequestCopy(new TextEncoder().encode(JSON.stringify(parsed)).byteLength);
+    // Keep the serialized-size contract: normalization can expand numeric literals.
+    budget?.observeAcceptedRequestCopy(Buffer.byteLength(JSON.stringify(parsed), "utf8"));
     return parsed;
   } finally {
     releaseText?.();

package/src/server/responses/agent-task-recovery.ts

@@ -3,7 +3,7 @@ import { decodeJwtPayload, extractAccountId } from "../../oauth/chatgpt";
 import type { OcxConfig } from "../../types";
 import { boundedBodyDecodeFailure, readBoundedResponseBody } from "../../lib/bounded-body";
 import { isApiAuthRequired, isProxyAdmissionSecret } from "../auth-cors";
-import { structurallyValidFernetTokens } from "./encrypted-payload";
+import { MAX_AGENT_TASK_CIPHERTEXT_BYTES, MAX_AGENT_TASK_ENCRYPTED_PARTS, structurallyValidFernetTokens } from "./encrypted-payload";
 import {
   cachedAgentTaskRecovery,
   discardCachedAgentTaskRecovery,
@@ -31,7 +31,6 @@ const CODEX_ORIGINATORS = new Set([
 const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const OPENAI_TOKEN_ISSUERS = new Set(["https://auth.openai.com", "https://auth.openai.com/"]);
 const OPENAI_TOKEN_AUDIENCE = "https://api.openai.com/v1";
-const MAX_CIPHERTEXT_BYTES = 2 * 1024 * 1024;
 const MAX_ASSIGNMENT_BYTES = 2 * 1024 * 1024;
 const MAX_RECOVERY_RESPONSE_BYTES = 4 * 1024 * 1024;
 const CACHE_SCOPE_KEY = randomBytes(32);
@@ -73,12 +72,13 @@ export function agentTaskRecoveryConfig(config: OcxConfig): AgentTaskRecoveryOpt
 
 interface AgentEnvelope {
   itemIndex: number;
-  encryptedIndex: number;
+  encryptedStartIndex: number;
+  inputSnapshot: string;
   headerText: string;
   messageType: "NEW_TASK" | "MESSAGE";
   taskName: string;
   sender: string;
-  ciphertext: string;
+  ciphertexts: readonly string[];
   author: string;
   recipient: string;
 }
@@ -107,10 +107,9 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
   let messageType: "NEW_TASK" | "MESSAGE" | null = null;
   let taskName: string | null = null;
   let sender: string | null = null;
-  let encryptedIndex = -1;
-  let ciphertext = "";
-  let encryptedPartCount = 0;
-  let ciphertextCount = 0;
+  let encryptedStartIndex = -1;
+  const ciphertexts: string[] = [];
+  let ciphertextBytes = 0;
 
   for (let index = 0; index < content.length; index += 1) {
     const part = content[index] as { type?: unknown; text?: unknown; encrypted_content?: unknown } | null;
@@ -132,13 +131,15 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
         sender = match[3]!;
       }
     }
-    if (part.type !== "encrypted_content" || typeof part.encrypted_content !== "string") continue;
-    encryptedPartCount += 1;
-    for (const token of structurallyValidFernetTokens(part.encrypted_content)) {
-      ciphertextCount += 1;
-      encryptedIndex = index;
-      ciphertext = token;
-    }
+    if (part.type !== "encrypted_content") continue;
+    if (typeof part.encrypted_content !== "string") return null;
+    ciphertextBytes += Buffer.byteLength(part.encrypted_content);
+    if (ciphertexts.length >= MAX_AGENT_TASK_ENCRYPTED_PARTS || ciphertextBytes > MAX_AGENT_TASK_CIPHERTEXT_BYTES) return null;
+    const tokens = structurallyValidFernetTokens(part.encrypted_content);
+    if (tokens.length !== 1 || tokens[0] !== part.encrypted_content) return null;
+    if (encryptedStartIndex < 0) encryptedStartIndex = index;
+    if (index !== encryptedStartIndex + ciphertexts.length) return null;
+    ciphertexts.push(part.encrypted_content);
   }
 
   if (
@@ -146,11 +147,8 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
     || !messageType
     || !taskName
     || !sender
-    || encryptedIndex < 0
-    || encryptedPartCount !== 1
-    || ciphertextCount !== 1
-    || (content[encryptedIndex] as { encrypted_content?: unknown }).encrypted_content !== ciphertext
-    || Buffer.byteLength(ciphertext) > MAX_CIPHERTEXT_BYTES
+    || encryptedStartIndex < 0
+    || ciphertexts.length === 0
   ) return null;
 
   const itemRecord = item as { author?: unknown; recipient?: unknown };
@@ -159,12 +157,13 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
 
   return {
     itemIndex,
-    encryptedIndex,
+    encryptedStartIndex,
+    inputSnapshot: JSON.stringify(item),
     headerText,
     messageType,
     taskName,
     sender,
-    ciphertext,
+    ciphertexts,
     author: itemRecord.author,
     recipient: itemRecord.recipient,
   };
@@ -197,14 +196,8 @@ function injectAssignment(input: unknown, envelope: AgentEnvelope, assignment: s
   if (!item || typeof item !== "object") return false;
   const content = (item as { content?: unknown }).content;
   if (!Array.isArray(content)) return false;
-  const part = content[envelope.encryptedIndex] as { type?: unknown; encrypted_content?: unknown } | undefined;
-  if (
-    !part
-    || part.type !== "encrypted_content"
-    || part.encrypted_content !== envelope.ciphertext
-  ) return false;
-
-  content[envelope.encryptedIndex] = { type: "input_text", text: assignment };
+  if (JSON.stringify(item) !== envelope.inputSnapshot) return false;
+  content.splice(envelope.encryptedStartIndex, envelope.ciphertexts.length, { type: "input_text", text: assignment });
   const message = item as Record<string, unknown>;
   message.type = "message";
   message.role = "user";
@@ -313,7 +306,7 @@ function admittedRecovery(
     .update("\0")
     .update(envelope.sender)
     .update("\0")
-    .update(envelope.ciphertext)
+    .update(JSON.stringify(envelope.ciphertexts))
     .digest("hex");
   return { admitted: true, recovery: { envelope, admission, cacheKey } };
 }
@@ -343,7 +336,7 @@ function recoveryPayload(envelope: AgentEnvelope, model: string): string {
       recipient: envelope.recipient,
       content: [
         { type: "input_text", text: envelope.headerText },
-        { type: "encrypted_content", encrypted_content: envelope.ciphertext },
+        ...envelope.ciphertexts.map(encrypted_content => ({ type: "encrypted_content", encrypted_content })),
       ],
     }],
   });

package/src/server/responses/codex-auth-error.ts

@@ -7,6 +7,7 @@ import {
   CodexDirectAuthenticationError,
   CodexMainProfileDrainingError,
   CodexMainSubstitutionUnavailableError,
+  CodexModelAvailabilityError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../../codex/auth-context";
@@ -22,6 +23,13 @@ export interface CodexAuthContextErrorResponseOptions {
   now: number;
 }
 
+export function codexModelAvailabilityErrorResponse(error: CodexModelAvailabilityError): Response {
+  if (error.reason === "temporarily_unavailable") {
+    return formatErrorResponse(429, "rate_limit_error", error.message);
+  }
+  return formatErrorResponse(400, "invalid_request_error", error.message);
+}
+
 export function nativeMainRefreshFailureResponse(error: unknown): Response {
   if (error instanceof MainAccountTokenRefreshError && error.reason === "reauth") {
     return formatErrorResponse(401, "authentication_error", "Codex main account needs reauthentication");
@@ -86,6 +94,9 @@ export function mapCodexAuthContextErrorToResponse(
       "Selected Codex account needs reauthentication",
     );
   }
+  if (error instanceof CodexModelAvailabilityError) {
+    return codexModelAvailabilityErrorResponse(error);
+  }
   if (error instanceof CodexPoolAuthenticationError || error instanceof CodexDirectAuthenticationError) {
     return formatErrorResponse(401, "authentication_error", error.message);
   }

package/src/server/responses/codex-ws-exchange.ts

@@ -6,7 +6,8 @@ import { CodexWsCorrelation } from "./codex-ws-correlation";
 import type { CodexWsSession } from "./codex-ws-session";
 import { UPGRADE_DEADLINE_MS, CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES,
   MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage,
-  codexWsFailureDetail, codexWsPreResponseFailure, type CodexWsFailureStage } from "./codex-ws-wire";
+  codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
+  type CodexWsFailureStage, type CodexWsStageRecord } from "./codex-ws-wire";
 
 interface ExchangeOptions {
   session: CodexWsSession;
@@ -16,6 +17,8 @@ interface ExchangeOptions {
   sseFallback: typeof globalThis.fetch;
   onQuota?: CodexWsQuotaObserver;
   beforeDispatch?: (headers: Headers) => void;
+  /** Bun version string the caller gated on; stamped onto the stage record. */
+  bunVersion?: string;
 }
 
 const HTTP_HEADER_TOKEN = /^[!#$%&'*+.^_`|~0-9a-z-]+$/i;
@@ -83,7 +86,7 @@ function wrappedRejectionResponse(payload: Record<string, unknown>, prelude: Hea
 
 /** The sole SSE exchange state machine for both one-shot and retained sockets. */
 export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
-  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch } = options;
+  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch, bunVersion } = options;
   const { frameText, headers } = prepared;
   const signal = init.signal ?? undefined;
   return new Promise<Response>((resolve, reject) => {
@@ -105,6 +108,9 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
     let pongs = 0;
     let sentAt: number | null = null;
     let firstFrameAt: number | null = null;
+    // Numeric close code for the durable stage record; the reason string stays
+    // out of it on purpose (#4191 content-free contract).
+    let closeCode: number | null = null;
     let controller: ReadableStreamDefaultController<Uint8Array> | null = null;
     const encoder = new TextEncoder();
     const metadata = url === CODEX_RESPONSES_HTTP_URL ? new CodexWsMetadata(onQuota) : null;
@@ -115,6 +121,9 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
     // interval so a peer that answers pings can never trip the silence bound while alive.
     let silenceTimer: ReturnType<typeof setTimeout> | undefined;
     let pingTimer: ReturnType<typeof setTimeout> | undefined;
+    // The resolved 200, retained so a later body failure can replace its
+    // success-shaped stage record with the failure-shaped one (#4191).
+    let committedResponse: Response | null = null;
     const stream = new ReadableStream<Uint8Array>({
       start(c) { controller = c; },
       cancel() {
@@ -157,6 +166,28 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       pongs,
     });
 
+    /**
+     * The durable twin of failureStage (#4191). `requestBytes` is an explicit
+     * parameter so the committed-success path can pass null instead of paying
+     * the UTF-8 walk of a megabyte replay frame; failure callers pass
+     * `failureStage().requestBytes`, which measures exactly once.
+     */
+    const stageRecord = (requestBytes: number | null): CodexWsStageRecord => ({
+      requestBytes,
+      sent,
+      upstreamFrames,
+      controlFrames,
+      relayedEvents,
+      firstFrameMs: sentAt !== null && firstFrameAt !== null ? Math.max(0, firstFrameAt - sentAt) : null,
+      elapsedMs: sentAt !== null ? Math.max(0, Date.now() - sentAt) : null,
+      pings,
+      pongs,
+      closeCode,
+      reused: session.reused,
+      ocxVersion: codexWsOcxVersion(),
+      bunVersion: bunVersion ?? "unknown",
+    });
+
     const commitResponse = () => {
       if (responseCommitted) return;
       responseCommitted = true;
@@ -167,6 +198,8 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       const response = new Response(stream, { status: 200, headers: responseHeaders });
       metadata?.commit();
       markCodexWsResponse(response, Boolean(metadata && onQuota));
+      markCodexWsStage(response, stageRecord(null));
+      committedResponse = response;
       resolve(response);
     };
 
@@ -186,7 +219,9 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         try { controller?.close(); } catch { /* unused stream already closed */ }
         session.dispose();
         const message = error instanceof Error ? error.message : String(error);
-        resolve(codexWsPreResponseFailure(status, message, prelude));
+        const failureResponse = codexWsPreResponseFailure(status, message, prelude);
+        markCodexWsStage(failureResponse, stageRecord(Buffer.byteLength(frameText, "utf8")));
+        resolve(failureResponse);
         return;
       }
       // A response is already flowing (or this transport has no metadata channel and
@@ -196,6 +231,11 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       cleanup();
       try { controller?.error(typeof error === "string" ? new Error(error) : error); } catch { /* stream already done */ }
       session.dispose();
+      // A body failure replaces the success-shaped record commitResponse wrote:
+      // this settle is a failure, and the frame size is evidence again.
+      if (committedResponse) {
+        markCodexWsStage(committedResponse, stageRecord(Buffer.byteLength(frameText, "utf8")));
+      }
     };
 
     /** (Re)start the silence bound; every inbound frame or pong is proof of life. */
@@ -408,12 +448,21 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         terminal = true;
         cleanup();
         try { controller.close(); } catch { /* already closed */ }
+        // Refresh the success record with the final counters: the commit-time
+        // snapshot predates every relayed event, and the record is more useful
+        // when it says what the exchange actually delivered. Still no byte
+        // count — the happy path never pays it.
+        if (committedResponse) {
+          markCodexWsStage(committedResponse, stageRecord(null));
+        }
         session.release(completedId);
       }
     };
 
     const onClose = (event: unknown) => {
       cleanup();
+      const code = (event as { code?: unknown } | null)?.code;
+      if (typeof code === "number") closeCode = code;
       if (!opened) {
         if (settledPreOpen) return;
         settledPreOpen = true;

package/src/server/responses/codex-ws-wire.ts

@@ -4,6 +4,7 @@ import {
   UPSTREAM_CLOSED_BEFORE_RESPONSE_CODE,
   UPSTREAM_NO_RESPONSE_CODE,
 } from "../../lib/upstream-retry";
+import { readFileSync } from "node:fs";
 // If the 101 never arrives (network black hole), give SSE a chance well before
 // the caller's connect timeout (default 200s) would fire.
 export const UPGRADE_DEADLINE_MS = 10_000;
@@ -64,6 +65,60 @@ export function markCodexWsResponse(response: Response, observed: boolean): void
   if (observed) quotaObservedResponses.add(response);
 }
 
+/**
+ * The proxy's own version, stamped onto every stage record so a field report
+ * can be tied to the exact build that produced it (#4191). Computed locally
+ * with the same package.json IIFE management-api.ts / gui-static.ts use —
+ * importing management-api from the transport layer would invert the
+ * layering and pull the management surface into every WS exchange.
+ */
+const OCX_VERSION = (() => {
+  try {
+    return JSON.parse(readFileSync(new URL("../../../package.json", import.meta.url), "utf8")).version as string;
+  } catch {
+    return "0.0.0";
+  }
+})();
+
+/**
+ * The durable form of the stage counters, carried out of the exchange on the
+ * resolved Response so the logging layer can persist it without the exchange
+ * ever seeing a RequestLogContext (#4191).
+ *
+ * Everything here is a size, a count, a duration, a boolean, or a semver
+ * string: no request body, no header, no account identifier, no conversation
+ * text, and no close-reason text can reach a record built by the exchange.
+ * `requestBytes` is null on a committed success because the happy path never
+ * pays the UTF-8 walk of a megabyte replay frame; it is measured on failure,
+ * where its size is the evidence.
+ */
+export type CodexWsStageRecord = Omit<CodexWsFailureStage, "requestBytes"> & {
+  /** UTF-8 size of the create frame; null on the committed-success record. */
+  requestBytes: number | null;
+  /** Numeric upstream close code when the socket closed; null otherwise. */
+  closeCode: number | null;
+  /** True when the exchange ran on a pooled, previously used session. */
+  reused: boolean;
+  /** OpenCodex version that produced this record. */
+  ocxVersion: string;
+  /** Bun runtime version the exchange gated on. */
+  bunVersion: string;
+};
+
+const codexWsStageByResponse = new WeakMap<Response, CodexWsStageRecord>();
+
+export function markCodexWsStage(response: Response, record: CodexWsStageRecord): void {
+  codexWsStageByResponse.set(response, record);
+}
+
+export function readCodexWsStage(response: Response): CodexWsStageRecord | undefined {
+  return codexWsStageByResponse.get(response);
+}
+
+export function codexWsOcxVersion(): string {
+  return OCX_VERSION;
+}
+
 /**
  * The honest settlement for an exchange that sent its create frame and never saw a
  * response event.

package/src/server/responses/compact.ts

@@ -1,3 +1,4 @@
+import { capturePoolQuotaWriter } from "../../codex/account-store";
 import type { Server } from "bun";
 import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type ResponsesTerminalStatus } from "../../bridge";
 import {
@@ -356,6 +357,7 @@ async function refreshPoolCompactContext(args: {
       accessToken: refreshed.accessToken,
       chatgptAccountId: refreshed.chatgptAccountId,
       generation: refreshed.generation,
+      poolQuotaWriter: capturePoolQuotaWriter(authCtx.accountId, refreshed),
     };
     const refreshedProvider = applyCodexAuthContextToProvider(
       stripCodexRuntimeProviderFields(provider),
@@ -1037,7 +1039,7 @@ export async function handleResponsesCompact(
             upstream.headers,
             authCtx.writerGeneration,
             authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined,
-            { modelId: route.modelId },
+            { modelId: route.modelId, poolWriter: authCtx.kind === "pool" ? authCtx.poolQuotaWriter : undefined },
           );
         }
         recordCompactPoolOutcome(authCtx, upstream.status, {
@@ -1078,6 +1080,12 @@ export async function handleResponsesCompact(
         }
       }
     }
+    // Capture the final serving account as well as an earlier rejected account, once per response.
+    if (outcomeCtx.kind === "pool") {
+      const { applyAccountQuotaFromUpstreamHeaders } = await import("../../codex/quota");
+      applyAccountQuotaFromUpstreamHeaders(outcomeCtx.accountId, upstream.headers, outcomeCtx.writerGeneration,
+        undefined, { modelId: route.modelId, poolWriter: outcomeCtx.poolQuotaWriter });
+    }
     const retryAfter = upstream.headers.get("retry-after");
     const resetAt = [
       upstream.headers.get("x-codex-primary-reset-at"),