@bitkyc08/opencodex 2.55.0 → 2.57.0

package/src/server/responses/codex-ws-wire.ts

@@ -108,6 +108,11 @@ export type CodexWsStageRecord = Omit<CodexWsFailureStage, "requestBytes"> & {
 const codexWsStageByResponse = new WeakMap<Response, CodexWsStageRecord>();
 
 export function markCodexWsStage(response: Response, record: CodexWsStageRecord): void {
+  const current = codexWsStageByResponse.get(response);
+  if (current) {
+    Object.assign(current, record);
+    return;
+  }
   codexWsStageByResponse.set(response, record);
 }
 

package/src/server/responses/collaboration.ts

@@ -30,7 +30,7 @@ import {
 } from "../../combos";
 import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
-import { dottedToolName, modelInList, namespacedToolName, toolChoiceToolPredicate } from "../../types";
+import { dottedToolName, modelInList, namespacedToolName, NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES, toolChoiceToolPredicate } from "../../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../../types";
 import {
   forceRefreshOAuthAccessSnapshot,
@@ -83,7 +83,6 @@ import {
   catalogModelSupportsServiceTier,
   finishRequestAttempt,
   inspectResponseLogJson,
-  noteAttemptSend,
   readConfiguredCodexServiceTier,
   requestLogSpeedLabel,
   sealRequestAttemptIdentity,
@@ -152,6 +151,36 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
       dottedAliasOwners.set(t.name, null);
     }
   }
+  // Bare echo alias (`name` with no namespace spelling, #4679): some providers — observed
+  // on the muse family via Command Code — echo a namespaced tool by its bare name. The
+  // bare spelling is only a safe alias while it names ONE tool and cannot be read as
+  // another identity's canonical or dotted spelling.
+  // Code-mode helper spellings never gain a bare alias (#4679 review), whatever namespace
+  // declares them and whatever put the alias there. The list is owned by `src/types/tools.ts`,
+  // beside the names it protects, because the copy that used to live here drifted to a single
+  // namespace and had to be widened twice.
+  const bareAliasOwners = new Map<string, string | null>();
+  for (const t of authorizedTools) {
+    // Bare (no-namespace) declarations participate as owners too: a namespaced tool whose
+    // bare name equals a bare-declared function must not gain the bare alias, mirroring how
+    // the tool_choice bare path refuses ambiguous owners across the whole request catalog.
+    const identity = JSON.stringify([t.namespace ?? null, t.name]);
+    const owner = bareAliasOwners.get(t.name);
+    if (owner === undefined) bareAliasOwners.set(t.name, identity);
+    else if (owner !== identity) bareAliasOwners.set(t.name, null);
+  }
+  for (const t of authorizedTools) {
+    const canonical = namespacedToolName(t.namespace, t.name);
+    const owner = bareAliasOwners.get(canonical);
+    if (owner !== undefined && owner !== JSON.stringify([t.namespace, t.name])) {
+      bareAliasOwners.set(canonical, null);
+    }
+    const dotted = dottedToolName(t.namespace, t.name);
+    const dottedOwner = bareAliasOwners.get(dotted);
+    if (dottedOwner !== undefined && dottedOwner !== JSON.stringify([t.namespace, t.name])) {
+      bareAliasOwners.set(dotted, null);
+    }
+  }
   for (const t of authorizedTools) {
     // Upstream output is untrusted: only restore calls for tools the caller authorized.
     const wireName = namespacedToolName(t.namespace, t.name);
@@ -175,6 +204,30 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
         toolNsMap.set(dottedName, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
         if (t.parameters && typeof t.parameters === "object") toolParameterSchemas.set(dottedName, t.parameters);
       }
+      // Bare echo alias (`name` with no namespace spelling, #4679): same tool identity as
+      // the flattened wire name, so a provider that drops the namespace prefix still
+      // restores against this entry. Ambiguous bare names were resolved to null above;
+      // skipping them falls back to the spellings every provider can still echo.
+      // Code-mode helper spellings never gain a bare alias, from ANY namespace (#4792 review).
+      // Scoping this to `collaboration` was too narrow to be a boundary: a declaration such as
+      // `mcp__remote.exec` donated bare `exec` to the declared set, and normalizeDeclaredToolName
+      // then rewrote an undeclared `apply_patch`, `exec_command` or `write_stdin` onto it
+      // (src/types/tools.ts). No namespace may turn helper normalization on for a catalog that
+      // never declared the code-mode shell.
+      //
+      // The namespaced tool stays usable AS ITSELF: `ns__name` is added unconditionally above
+      // and `ns.name` whenever it is unambiguous, so only the namespace-dropping echo fallback
+      // is withdrawn, and only for these six spellings.
+      if (
+        bareAliasOwners.get(t.name) === JSON.stringify([t.namespace, t.name])
+        && !NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES.has(t.name)
+      ) {
+        budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
+        declaredToolNames.add(t.name);
+        budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([t.name, t.namespace, t.name])).byteLength, { kind: "retained_collectors" });
+        toolNsMap.set(t.name, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
+        if (t.parameters && typeof t.parameters === "object") toolParameterSchemas.set(t.name, t.parameters);
+      }
     }
     if (t.freeform) {
       budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
@@ -201,6 +254,20 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
   // Some routed providers echo a bare tool_choice selector instead of the flattened catalog
   // name. Accept only selectors the client actually sent and only when the full request catalog
   // contains one tool with that logical name.
+  //
+  // A helper spelling selected this way is split rather than refused (#4819). The two things a
+  // bare alias does are separable, and passthrough already relies on that: identity RESTORATION
+  // runs before authorization there, rewriting the echoed bare name to the namespaced identity
+  // the caller declared, and the guard then authorizes `ns__name`. DECLARATION is the part that
+  // is unsafe, because a declared-name set carrying bare `exec` is what makes
+  // `normalizeDeclaredToolName` rewrite an undeclared `apply_patch`, `exec_command` or
+  // `write_stdin` onto the selected tool (src/types/tools.ts).
+  //
+  // So a helper spelling gets the `toolNsMap` entry and not the `declaredToolNames` entry. The
+  // caller nominated exactly one tool by name, `bareNameCounts` proves nothing else answers to
+  // it, and restoring it authorizes nothing the request did not already declare. The echo path
+  // above withholds both, because a bare echo is a guess rather than a nomination and #4679
+  // pinned that shape (`tests/responses/bare-echo-alias.test.ts`).
   const choice = parsed.options.toolChoice;
   const bareChoiceNames = new Set(
     choice && typeof choice === "object"
@@ -213,8 +280,11 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
   }
   for (const t of authorizedTools) {
     if (!t.namespace || !bareChoiceNames.has(t.name) || bareNameCounts.get(t.name) !== 1 || declaredToolNames.has(t.name)) continue;
-    budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
-    declaredToolNames.add(t.name);
+    // Restore the identity; declare the name only when it is not a helper spelling.
+    if (!NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES.has(t.name)) {
+      budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
+      declaredToolNames.add(t.name);
+    }
     budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([t.name, t.namespace, t.name])).byteLength, { kind: "retained_collectors" });
     toolNsMap.set(t.name, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
     if (t.parameters && typeof t.parameters === "object") {

package/src/server/responses/combo-session-recall.ts

@@ -8,14 +8,46 @@ interface ComboRecallEntry {
   target: Pick<OcxComboTarget, "provider" | "model">;
   responseModel: string;
   at: number;
+  /** UTF-8 size of `responseModel`, the only client-influenced field of unbounded length. */
+  bytes: number;
 }
 
 const RECALL_CAPACITY = 256;
 const RECALL_TTL_MS = 30 * 60 * 1000;
+/**
+ * A model id is provider-reported and arrives on the response, so nothing upstream of here
+ * bounds its length. Lane keys are already SHA-256 digests, so the model string is the only
+ * field that can grow, and 256 lanes alone do not bound the bytes they hold.
+ */
+const RECALL_MODEL_BYTES_MAX = 1024;
+const RECALL_TOTAL_BYTES_MAX = 64 * 1024;
 const recall = new Map<string, ComboRecallEntry>();
+let recallBytes = 0;
 let lastReconciledGeneration = 0;
 let liveOwners: Pick<GenerationContext, "comboIds" | "comboTargets" | "providerNames"> | undefined;
 
+/** Every removal path goes through here so the byte counter can never drift from the map. */
+function deleteEntry(lane: string): boolean {
+  const entry = recall.get(lane);
+  if (!entry) return false;
+  recall.delete(lane);
+  recallBytes -= entry.bytes;
+  return true;
+}
+
+/**
+ * UTF-8 size of a remembered model id, or null when it is too large to retain.
+ *
+ * The code-unit test runs first and is the part that matters: a UTF-8 encoding is never smaller
+ * than the code-unit count, so an oversized string is rejected without encoding it, and the
+ * bound cannot be defeated by paying the allocation it exists to prevent.
+ */
+function boundedModelBytes(responseModel: string): number | null {
+  if (responseModel.length > RECALL_MODEL_BYTES_MAX) return null;
+  const bytes = Buffer.byteLength(responseModel, "utf8");
+  return bytes > RECALL_MODEL_BYTES_MAX ? null : bytes;
+}
+
 function ownsEntry(context: Pick<GenerationContext, "comboIds" | "comboTargets" | "providerNames">, entry: ComboRecallEntry): boolean {
   return context.comboIds.has(entry.comboId)
     && context.providerNames.has(entry.target.provider)
@@ -32,14 +64,29 @@ export function rememberComboForLane(
   if (!lane || !comboId || !responseModel.trim()) return;
   // Reject even a same-named recreated owner: its previous in-flight turn is obsolete.
   if (writerGeneration < Math.max(lastReconciledGeneration, captureConfigGeneration())) return;
-  const entry = { comboId, target: { provider: target.provider, model: target.model }, responseModel, at: Date.now() };
+  // An unretainable model id DECLINES the write; it must not clear the lane. Every other
+  // rejection above returns the same way, and clearing here would let a late completion erase
+  // a newer selection that this function has no ordering information to compare against.
+  const bytes = boundedModelBytes(responseModel);
+  if (bytes === null) return;
+  const entry = {
+    comboId,
+    target: { provider: target.provider, model: target.model },
+    responseModel,
+    at: Date.now(),
+    bytes,
+  };
   if (liveOwners && !ownsEntry(liveOwners, entry)) return;
-  recall.delete(lane);
+  deleteEntry(lane);
   recall.set(lane, entry);
-  while (recall.size > RECALL_CAPACITY) {
+  recallBytes += bytes;
+  // Insertion order is recency order, because every write re-inserts its lane at the back.
+  // Evicting from the front therefore drops the least recently written lane, never this one:
+  // a single entry is capped well below the aggregate budget, so it always fits.
+  while (recall.size > RECALL_CAPACITY || recallBytes > RECALL_TOTAL_BYTES_MAX) {
     const oldest = recall.keys().next().value;
-    if (oldest === undefined) break;
-    recall.delete(oldest);
+    if (oldest === undefined || oldest === lane) break;
+    deleteEntry(oldest);
   }
 }
 
@@ -57,12 +104,25 @@ export function recallComboForLane(
     || !Object.hasOwn(config.providers, entry.target.provider)
     || !provider || provider.disabled === true
     || !combo?.targets.some(target => targetKey(target) === targetKey(entry.target))) {
-    recall.delete(lane);
+    deleteEntry(lane);
     return undefined;
   }
   return entry.responseModel === model ? entry.comboId : undefined;
 }
 
+/**
+ * Periodic expiry. Without it a lane that is never read again and never touched by a config
+ * reconciliation holds its entry for the life of the process: the existing TTL is only
+ * evaluated on read or on generation change.
+ */
+export function sweepExpiredComboRecall(now: number): number {
+  let removed = 0;
+  for (const [lane, entry] of recall) {
+    if (now - entry.at >= RECALL_TTL_MS && deleteEntry(lane)) removed += 1;
+  }
+  return removed;
+}
+
 export function reconcileComboRecall(context: GenerationContext): number {
   if (context.generation <= lastReconciledGeneration) return 0;
   lastReconciledGeneration = context.generation;
@@ -74,8 +134,7 @@ export function reconcileComboRecall(context: GenerationContext): number {
   let removed = 0;
   for (const [lane, entry] of recall) {
     if (!ownsEntry(context, entry) || Date.now() - entry.at >= RECALL_TTL_MS) {
-      recall.delete(lane);
-      removed += 1;
+      if (deleteEntry(lane)) removed += 1;
     }
   }
   return removed;
@@ -84,6 +143,7 @@ export function reconcileComboRecall(context: GenerationContext): number {
 /** Test-only reset, alongside the combo rotation/cooldown resets. */
 export function clearComboRecallForTests(): void {
   recall.clear();
+  recallBytes = 0;
   lastReconciledGeneration = 0;
   liveOwners = undefined;
 }

package/src/server/responses/compact.ts

@@ -51,7 +51,9 @@ import {
   materializeCodexUpstreamAuthAsync,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
+  codexPoolAffinityKey,
   codexProbeLeaseId,
+  codexTransientProbeGrant,
   codexProbeQuotaScope,
   releaseCodexAuthContextProbeLease,
   stripCodexRuntimeProviderFields,
@@ -67,6 +69,13 @@ import {
   recordCodexUpstreamOutcome,
   type CodexUpstreamOutcome,
 } from "../../codex/routing";
+import {
+  applyAccountChangeConversationStateScrub,
+  conversationStateBindingFromAuth,
+  accountChangeFileReferenceRefusal,
+  rememberServingConversationStateIssuer,
+  conversationCarriesUploadedFiles,
+} from "./account-change-state";
 import {
   TokenRefreshError,
   forceRefreshCodexPoolToken,
@@ -76,6 +85,7 @@ import {
   fetchWithResetRetry,
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
+  isNonReplayableResponse,
   SendBudgetExhaustedError,
   TRANSIENT_RETRY_MAX_ATTEMPTS,
   type UpstreamSendRecovery,
@@ -134,7 +144,6 @@ import {
   catalogModelSupportsServiceTier,
   finishRequestAttempt,
   inspectResponseLogJson,
-  noteAttemptSend,
   readConfiguredCodexServiceTier,
   requestLogSpeedLabel,
   sealRequestAttemptIdentity,
@@ -682,6 +691,13 @@ export async function handleResponsesCompact(
   // Combo-resolved targets skip native compact so failover can advance through the
   // combo target list when the picked model returns 429/5xx — the routed path below
   // dispatches through handleResponses → handleComboResponses with full failover.
+  //
+  // One holder for the WHOLE logical compact, declared above the native branch because the
+  // routed fallback below is not a different request: a native attempt that 404s, or a quota
+  // failure that hands off, continues here. The routed turn used to call handleResponses with
+  // no budget at all, so `handleResponsesInner` minted a fresh four after the native attempt
+  // had already spent some of the first one.
+  const sendBudget: RequestExecutionBudget = options.sendBudget ?? createRequestExecutionBudget();
   if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider) && !accountGatedCompactWireModel && !route.combo) {
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
@@ -722,6 +738,14 @@ export async function handleResponsesCompact(
           beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
           signal: req.signal,
           nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
+          // #4778: the same retention the regular Responses path passes at its final auth. The
+          // post-429 guard below only declines to move AFTER this resolution has already bound
+          // an account, so without the bit here a quota-driven rebind could have carried the
+          // conversation off its issuing account before that guard is ever consulted -- and an
+          // uploaded file is readable only by the account that received it. Answered from `raw`,
+          // the same object and the same predicate the guard below uses, so the two can never
+          // disagree about which conversations are in scope.
+          retainAccountForUploadedFiles: conversationCarriesUploadedFiles(raw),
         });
         logCtx.accountLogLabel = codexAuthContextLogLabel(authCtx, config);
         const selected = await materializeCodexUpstreamAuthAsync(req.headers, authCtx, {
@@ -773,10 +797,32 @@ export async function handleResponsesCompact(
     // buildRequest, but the compact endpoint forwards directly. Apply the same sanitizer here
     // so routed-model reasoning items (reasoning_text content) don't 400 the ChatGPT backend.
     const compactBody = sanitizeReasoningInputContent(compactBodyRaw) as typeof compactBodyRaw;
+    {
+      const binding = conversationStateBindingFromAuth(authCtx, codexPoolAffinityKey(req.headers));
+      if (binding) {
+        // Refused rather than scrubbed: an uploaded file is content the caller attached, not
+        // continuation state the turn can do without.
+        const refusal = accountChangeFileReferenceRefusal({
+          body: raw,
+          bindingKey: binding.bindingKey,
+          servingAccountId: binding.accountId,
+        });
+        if (refusal) return refusal;
+        applyAccountChangeConversationStateScrub({
+          body: raw,
+          bindingKey: binding.bindingKey,
+          servingAccountId: binding.accountId,
+          logCtx,
+        });
+        applyAccountChangeConversationStateScrub({
+          body: compactBody,
+          bindingKey: binding.bindingKey,
+          servingAccountId: binding.accountId,
+          logCtx,
+        });
+      }
+    }
     const compactUrl = `${base}/responses/compact`;
-    // One holder for this logical compact, inherited by the handoff child so a second model
-    // does not start over with a fresh four.
-    const sendBudget: RequestExecutionBudget = options.sendBudget ?? createRequestExecutionBudget();
     const compactTargetKey = `${route.providerName}|${route.modelId}|compact`;
     const actualCompactHostKey = upstreamHostHealthKey(
       route.providerName,
@@ -842,6 +888,7 @@ export async function handleResponsesCompact(
         // replacement (#2887). Also covers the replay's own second 401.
         ...(ctx.kind === "pool" ? { credentialGeneration: ctx.generation } : {}),
         probeQuotaScope: codexProbeQuotaScope(ctx),
+        transientProbe: codexTransientProbeGrant(ctx),
         writerGeneration: ctx.kind === "pool" || ctx.kind === "main-pool"
           ? ctx.writerGeneration
           : undefined,
@@ -1041,6 +1088,10 @@ export async function handleResponsesCompact(
     // — reporting exhausted retries while another pool account sat idle (#913).
     if (
       (upstream.status === 429 || upstream.status === 402)
+      // A replay refusal this proxy synthesized carries 429 for the client's benefit only.
+      // It is not pool quota evidence, and the alternate account below is another send of a
+      // compact turn that may already have been processed.
+      && !isNonReplayableResponse(upstream)
       && !storedPool401ReplayAttempted
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
@@ -1055,15 +1106,22 @@ export async function handleResponsesCompact(
       ].filter(Boolean);
       // Build the alternate COMPLETELY before cancelling the first body: if construction
       // throws, the first rejection is still intact and can be returned to the client.
-      const alternate = await resolveAlternateCompactContext({
-        req,
-        admission,
-        config,
-        route,
-        selectedModelId,
-        excludeAccountId: authCtx.accountId,
-        turnAdmissionLease,
-      });
+      // The same reasoning refuses an uploaded-file move here: no alternate can read a file the
+      // issuing account received, so which one is chosen is irrelevant and asking before the
+      // resolution costs nothing. It also reuses the guarantee the comment above depends on --
+      // the first body is still uncancelled -- so the client gets the original rejection rather
+      // than an inaccessible-file error from account B (#4710).
+      const alternate = conversationCarriesUploadedFiles(raw)
+        ? undefined
+        : await resolveAlternateCompactContext({
+          req,
+          admission,
+          config,
+          route,
+          selectedModelId,
+          excludeAccountId: authCtx.accountId,
+          turnAdmissionLease,
+        });
       // Resolution can await a credential refresh, so the client may have gone away
       // while we were choosing B. Re-check before spending anything: recording A,
       // cancelling its body, and sending B are all observable side effects, and B's
@@ -1096,6 +1154,30 @@ export async function handleResponsesCompact(
         await upstream.body?.cancel().catch(() => undefined);
         outcomeCtx = alternate.authCtx;
         logCtx.accountLogLabel = codexAuthContextLogLabel(alternate.authCtx, config);
+        {
+          const binding = conversationStateBindingFromAuth(
+            alternate.authCtx,
+            (authCtx.kind === "pool" || authCtx.kind === "main-pool")
+              ? authCtx.affinityKey
+              : codexPoolAffinityKey(req.headers),
+          );
+          if (binding) {
+            applyAccountChangeConversationStateScrub({
+              body: raw,
+              bindingKey: binding.bindingKey,
+              servingAccountId: binding.accountId,
+              priorAccountId: authCtx.accountId,
+              logCtx,
+            });
+            applyAccountChangeConversationStateScrub({
+              body: compactBody,
+              bindingKey: binding.bindingKey,
+              servingAccountId: binding.accountId,
+              priorAccountId: authCtx.accountId,
+              logCtx,
+            });
+          }
+        }
         try {
           upstream = await sendCompactAttempt(alternate.provider, alternate.headers, "single", alternate.authCtx);
         } catch (err) {
@@ -1142,8 +1224,14 @@ export async function handleResponsesCompact(
     const bufferedErrorText = buffered.ok
       ? ""
       : await buffered.clone().text().catch(() => "");
-    const explicitQuotaStatus = buffered.status === 429 || buffered.status === 402;
-    const bodyInferredQuota = !buffered.ok
+    // The client-facing 429 of a synthesized replay refusal says nothing about this
+    // account's quota. Pool accounting keeps reading it as the transport failure it is,
+    // which is also what it recorded before the status was corrected for the client.
+    const replayRefused = isNonReplayableResponse(upstream);
+    const explicitQuotaStatus = !replayRefused
+      && (buffered.status === 429 || buffered.status === 402);
+    const bodyInferredQuota = !replayRefused
+      && !buffered.ok
       && !explicitQuotaStatus
       && isRateLimitOrQuotaFailureMessage(bufferedErrorText);
     const quotaFailure = explicitQuotaStatus || bodyInferredQuota;
@@ -1156,13 +1244,18 @@ export async function handleResponsesCompact(
     // A body-confirmed quota failure can arrive behind a generic 5xx. Record it as
     // quota evidence; otherwise preserve the real upstream status so a local buffering
     // failure after a 200 cannot soft-avoid a healthy account or rotate a thread.
-    recordCompactPoolOutcome(outcomeCtx, bodyInferredQuota ? 429 : upstream.status, { retryAfter, resetAt });
+    recordCompactPoolOutcome(
+      outcomeCtx,
+      bodyInferredQuota ? 429 : replayRefused ? 502 : upstream.status,
+      { retryAfter, resetAt },
+    );
     // Lift usage and response metadata from the buffered upstream JSON into the
     // request log; the routed branch gets the same through handleResponses. The
     // synthetic buffer errors are not upstream bodies and stay uninspected.
     if (buffered.ok) {
       inspectResponseLogJson(logCtx, await buffered.clone().text());
       forgetCompactHandoffRoute(req);
+      rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
     } else if (quotaFailure && !storedPool401ReplayAttempted) {
       const fallbackModel = compactHandoffRoute(req, raw.model);
       if (fallbackModel && !req.signal.aborted) {
@@ -1223,7 +1316,10 @@ export async function handleResponsesCompact(
     body: JSON.stringify(internalBody),
   });
   linkRequestSessionLane(req, internalReq);
-  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, ...(admission ? { admission } : {}) });
+  // The routed compaction turn is a handoff inside the same logical request, so it draws the
+  // REMAINDER. Minting here is what let a native attempt spend three sends and the routed
+  // fallback spend four more.
+  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, ...(admission ? { admission } : {}) });
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };
   if (response.headers.get("content-type")?.includes("text/event-stream")) {

package/src/server/responses/completion-policy.ts

@@ -0,0 +1,33 @@
+import type { ResponsesRequestContext } from "./core-options";
+import type { ResponsesSidecarAuth } from "./request-sidecar-auth";
+import { emptyCompletionRetryEnabled } from "./empty-completion-guard";
+
+/** One responsibility of the Responses request pipeline; state owners are explicit. */
+export function createResponsesCompletionPolicy(
+  requestContext: Pick<ResponsesRequestContext, "config" | "options">,
+  sidecarState: Pick<ResponsesSidecarAuth, "routedCompaction">,
+) {
+  const { config, options } = requestContext;
+  const { routedCompaction } = sidecarState;
+
+
+  // Empty-completion guard (codex-router PR #145 port): a 200 that completes with no output
+  // text and no tool call is a failure the client cannot see — it silently records the turn as
+  // done. The guard holds pre-content adapter events, suppresses the terminal of an empty
+  // turn, retries the IDENTICAL request once, and surfaces a stated error when the retry is
+  // empty or fails. This is a top-level config opt-in; OCX_EMPTY_COMPLETION_RETRY=0 is a
+  // disable-only emergency override. Compaction turns and combo attempts keep their own
+  // machinery (the combo preflight already handles empty streams). Native Chat-to-Chat
+  // requests return from handleChatCompletions before entering Responses core, so they are
+  // intentionally outside this guard and retain their existing one-send wire behavior.
+  const emptyCompletionGuardEnabled =
+    emptyCompletionRetryEnabled(config)
+    && !options.comboAttempt
+    && !routedCompaction;
+
+  return {
+    emptyCompletionGuardEnabled,
+  };
+}
+
+export type ResponsesCompletionPolicy = Exclude<ReturnType<typeof createResponsesCompletionPolicy>, Response>;