@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/server/responses/request-send-budget.ts

@@ -1,9 +1,13 @@
 import type { ResponsesRequestContext } from "./core-options";
 import { createRequestExecutionBudget, isRequestExecutionBudget } from "../../lib/request-execution-budget";
-import { chargeWorkflowSends, workflowSendCeilingReached } from "../../lib/workflow-budget";
+import {
+  chargeWorkflowSends,
+  workflowSendCeilingReached,
+  workflowSpendCeilingReached,
+} from "../../lib/workflow-budget";
 import { workflowRefusalResponse } from "../workflow-refusal";
-import type { AttemptRecoveryKind } from "../../usage/log";
-import { noteAttemptSend } from "../request-log";
+import type { AttemptRecoveryKind, AttemptRecoveryWithheld } from "../../usage/log";
+import { noteAttemptRecoveryWithheld, noteAttemptSend } from "../request-log";
 import { TRANSIENT_RETRY_MAX_ATTEMPTS } from "../../lib/upstream-retry";
 import type {
   DispatchDecision,
@@ -13,6 +17,28 @@ import type {
   SingleUseDispatchPermit,
 } from "../../lib/request-execution-budget";
 
+/**
+ * The transient-5xx ladder cap for ONE leg, given the provider's configured request total.
+ *
+ * `remainingTransientSendBudget(cap)` treats `cap` as a ceiling on what REMAINS, which is the
+ * right shape for the fixed constant: every leg may ask for up to three, and the request-wide
+ * base allowance is what actually bounds the total. A configured `transientRetryOn5xx.attempts`
+ * is documented as the total for one request including the first send, so it has to be reduced
+ * by what the request already sent before it is intersected with that allowance. Passing it
+ * straight through would make it a per-leg ceiling instead, and a request configured at one send
+ * could still reach upstream again on a recovery leg (#4893).
+ *
+ * An absent policy returns the constant unchanged, so a provider that configures nothing behaves
+ * exactly as it does today at every call site.
+ */
+export function transientSendCapFor(
+  configuredAttempts: number | undefined,
+  sendsUsed: number,
+): number {
+  if (configuredAttempts === undefined) return TRANSIENT_RETRY_MAX_ATTEMPTS;
+  return Math.max(0, configuredAttempts - Math.max(0, sendsUsed));
+}
+
 /** Owns the shared request send counter and recovery permits. */
 export function createResponsesSendBudget(
   requestContext: Pick<ResponsesRequestContext, "options" | "req" | "logCtx">,
@@ -45,6 +71,22 @@ export function createResponsesSendBudget(
     // marked synthetic rather than reading as a request that vanished with zero sends.
     return workflowRefusalResponse("workflow-sends-exhausted", logCtx, undefined, workflowRootId);
   }
+  // The token ceiling asked at the same seam, for the same reason the count one is asked here.
+  // Without it a spent root reaches the dispatch ladder, is refused by the ledger at the first
+  // physical send, and answers with the generic send-budget error every exhausted request
+  // returns -- a refusal an operator cannot tell from an ordinary budget exhaustion, on a
+  // ceiling they configured themselves. Asked before dispatch, it names the scope and the
+  // number instead. Returns undefined and touches no ledger when no ceiling is configured.
+  const spentCeiling = workflowSpendCeilingReached(workflowRootId);
+  if (spentCeiling) {
+    return workflowRefusalResponse(
+      "workflow-spend-exhausted",
+      logCtx,
+      undefined,
+      workflowRootId,
+      spentCeiling,
+    );
+  }
   // No floor. Math.max(1, ...) meant an exhausted request still funded one send on every
   // recovery leg, so a bounded per-leg allowance never became a bounded per-request one.
   const remainingTransientSendBudget = (budget: number): number =>
@@ -71,8 +113,28 @@ export function createResponsesSendBudget(
     if (send.ordinal <= 1) return;
     noteAttemptSend(logCtx.activeAttempt, inputTokens, send.recovery);
   };
-  const sendBudgetExhausted = (): boolean =>
-    remainingTransientSendBudget(TRANSIENT_RETRY_MAX_ATTEMPTS) === 0;
+  /**
+   * Records a recovery an adapter was ready to make and the budget refused.
+   *
+   * No send happened, so this deliberately does not touch `sendCount`. It is the other half of
+   * the pair that makes a one-send log readable: no recovery kind AND no withheld reason means
+   * nothing was eligible; a withheld reason means something was (#5044).
+   */
+  const noteAdapterRecoveryWithheld = (withheld: { reason: AttemptRecoveryWithheld }): void => {
+    noteAttemptRecoveryWithheld(logCtx.activeAttempt, withheld.reason);
+  };
+  /**
+   * Whether this request has any base send left under `cap`.
+   *
+   * The cap is a parameter because a lane that reads a provider's configured
+   * `transientRetryOn5xx` ladder has to ask this question at the SAME cap its sends use.
+   * Asking at the constant while dispatching at a configured value lets a provider with
+   * headroom be told it is exhausted, and lets one configured below the constant pass this
+   * check and then be refused at the send (#4893). Defaulted, so every existing caller keeps
+   * the constant it already used.
+   */
+  const sendBudgetExhausted = (cap: number = TRANSIENT_RETRY_MAX_ATTEMPTS): boolean =>
+    remainingTransientSendBudget(cap) === 0;
   /**
    * A credential hop reserves the send its own replay will make, and that replay is a recovery
    * leg. The leg must SPEND the hop's reservation instead of taking a second one: the
@@ -113,16 +175,22 @@ export function createResponsesSendBudget(
    * The base allowance is spent first. Once it is gone a recovery class may still draw the
    * single shared final-recovery reserve -- which is what keeps the validated sanitized rebuild
    * after a 5xx streak alive at four total sends -- but an account move and a rebuild cannot
-   * each take one. `countedExternally` is set because these legs run through the retry helper,
-   * which reports the same send again through `onSendsConsumed`.
+   * each take one. A caller with an exact provider total can suppress that reserve. The
+   * `countedExternally` flag exists because these legs run through the retry helper, which reports
+   * the same send again through `onSendsConsumed`.
    */
   const recoverySendAllowance = (
     cap: number,
     sendClass: SendClass,
     targetKey: string,
+    options: { allowFinalRecoveryReserve?: boolean } = {},
   ): { attempts: number; permit?: SingleUseDispatchPermit } => {
     const base = remainingTransientSendBudget(cap);
     if (base > 0) return { attempts: base };
+    // A provider-configured transient total is an exact physical-send ceiling. Once it is
+    // exhausted, the request-wide recovery reserve must not silently widen it. The default stays
+    // permissive so unconfigured providers retain the guarded profile's fourth recovery send.
+    if (options.allowFinalRecoveryReserve === false) return { attempts: 0 };
     if (pendingHopPermit) {
       const hopPermit = pendingHopPermit;
       pendingHopPermit = undefined;
@@ -178,9 +246,18 @@ export function createResponsesSendBudget(
     workflowRootId,
     noteTransientSends,
     remainingTransientSendBudget,
+    /**
+     * Physical sends this logical request has already made.
+     *
+     * A live getter, not a snapshot: it is read once per dispatch leg to resolve a configured
+     * ladder, and a value frozen at construction would answer for a request that had sent
+     * nothing.
+     */
+    get sendsUsed(): number { return sendBudget.used; },
     adapterSendBudget,
     adapterDispatchBudget,
     noteAdapterPhysicalSend,
+    noteAdapterRecoveryWithheld,
     sendBudgetExhausted,
     get pendingHopPermit(): SingleUseDispatchPermit | undefined {
       return pendingHopPermit;

package/src/server/responses/request-sidecar-auth.ts

@@ -126,18 +126,26 @@ export async function prepareResponsesSidecarAuth(
     });
   const recordSidecarOutcome = openAiSidecar?.recordOutcome;
   if (visionPlan) {
-    await describeImagesInPlace(
-      parsed,
-      visionPlan,
-      openAiSidecar?.headers ?? requestState.selectedForwardHeaders,
-      options.abortSignal,
-      recordSidecarOutcome,
-      translatorBudget,
-    );
+    try {
+      await describeImagesInPlace(
+        parsed,
+        visionPlan,
+        openAiSidecar?.headers ?? requestState.selectedForwardHeaders,
+        options.abortSignal,
+        recordSidecarOutcome,
+        translatorBudget,
+      );
+    } finally {
+      // Local validation can reject every image before the sidecar fetch records an outcome.
+      // Vision-only turns must hand that unused cooldown probe back; when a fetch did run the
+      // outcome already consumed it, so this generation-bound release is a safe no-op.
+      if (!needsOpenAiSearch) openAiSidecar?.releaseProbeLease?.();
+    }
   } else if (requiresVisionPreprocessing(config, route.provider, route.modelId, route.providerName)) {
     // Image capability is not positively proven but no sidecar plan is dispatchable: fail closed.
     // Never forward raw image bytes to an unverified upstream.
     stripImagesInPlace(parsed, translatorBudget);
+    if (!needsOpenAiSearch) openAiSidecar?.releaseProbeLease?.();
   }
 
   return {

package/src/server/responses/request-spend.ts

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import type { RequestSendObserver } from "../../lib/request-execution-budget";
 import { sharedSpendLedger, type SpendReservationLedger } from "../../lib/spend-reservation-ledger";
-import type { RequestLogContext } from "../request-log";
+import { markLocalRequestLogRefusal, type RequestLogContext } from "../request-log";
+import { recordWorkflowRefusalEvent, workflowDenialSummary } from "../../lib/workflow-budget";
 
 /** The terminal usage a request reported, in the only two fields the ledger books. */
 export interface TerminalSpendUsage {
@@ -42,7 +43,7 @@ export function createRequestSpendTracker(
   logCtx: Pick<
     RequestLogContext,
     "provider" | "accountLogLabel" | "usageLogInputTokens" | "spendOutputCeilingTokens"
-  >,
+  > & Partial<Pick<RequestLogContext, "localTerminalReason" | "terminalSource" | "errorCode">>,
   rootId: string | undefined,
   injected?: SpendReservationLedger,
 ): RequestSpendTracker {
@@ -70,7 +71,13 @@ export function createRequestSpendTracker(
     for (let index = 0; index < live.length - 1; index += 1) ledger().markDispatched(live[index] as string);
   };
   return {
-    charge(): boolean {
+    charge(options?: { alreadySent?: boolean }): boolean {
+      // A send that has already left is RECORDED, never refused: the tokens are spent, and a
+      // booking the ledger drops is a booking the ceiling can never see. This is the reporting
+      // transports' path -- the passthrough ladder reports through `onSendsConsumed` after the
+      // fetch -- so without it a root ceiling on the canonical Codex path would sit one send
+      // short of its limit forever and refuse nothing.
+      const alreadySent = options?.alreadySent === true;
       const sendId = randomUUID();
       const decision = ledger().reserve({
         sendId,
@@ -83,18 +90,40 @@ export function createRequestSpendTracker(
         },
         inputTokens: logCtx.usageLogInputTokens ?? 0,
         outputCeilingTokens: logCtx.spendOutputCeilingTokens ?? 0,
+        ...(alreadySent ? { alreadySent: true } : {}),
       });
       if (!decision.reserved) {
         refusals += 1;
-        // Only an operator's configured ceiling refuses a dispatch. Every other denial --
-        // capacity, durability, a journal this process could not prove complete -- means the
-        // ledger cannot ACCOUNT for this send, which is not a reason to refuse one. An
-        // unconfigured install keeps the count caps it already had and is not newly refused,
-        // and a degraded ledger must not become an outage.
-        return decision.denial.reason !== "spend-limit-exceeded";
+        const denial = decision.denial;
+        // A ceiling refuses, and so does a ledger that cannot make the reservation durable
+        // under one. That second case is the whole reason this store is on disk: admitting a
+        // send whose record a restart would forget is how an exhausted budget comes back with
+        // a fresh allowance, and the ledger raises those two denials ONLY when a limit is
+        // configured -- so an install that configured nothing is still never refused here.
+        // Capacity and a duplicate send id stay permissive: they say the ledger cannot account
+        // for this send, which is a degradation to report, not an outage to cause.
+        if (denial.reason === "reserve-not-durable" || denial.reason === "journal-corrupt") {
+          return alreadySent;
+        }
+        if (denial.reason !== "spend-limit-exceeded") return true;
+        // This send is refused, and the dispatch path that asked will report an exhausted send
+        // budget -- from there, that is all it can see. The row is where an operator actually
+        // looks, so the ceiling is named on it here: a locally assigned code wins in
+        // addFinalRequestLog, so the request that CROSSED the ceiling reads as a spend refusal
+        // rather than as the ordinary budget exhaustion it would otherwise be indistinguishable
+        // from. The event ring gets the same pair so /api/workflow-budget agrees with the row.
+        const detail = { scope: denial.scope, limit: denial.limit, projected: denial.projected };
+        const summary = workflowDenialSummary("workflow-spend-exhausted", detail);
+        markLocalRequestLogRefusal(logCtx, summary.code);
+        logCtx.errorCode = summary.code;
+        recordWorkflowRefusalEvent(rootId, "workflow-spend-exhausted", Date.now(), detail);
+        return false;
       }
       live.push(sendId);
       confirmOlderSends();
+      // It has already left, so the reservation cannot be handed back for free: from here only
+      // a settlement or unresolved spend is honest about it.
+      if (alreadySent) ledger().markDispatched(sendId);
       return true;
     },
     refund(): void {

package/src/server/responses/request-transport.ts

@@ -41,7 +41,7 @@ import {
   resolveCurrentProviderApiKeyTransport,
 } from "../../providers/api-key-selection";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
-import { providerFetch } from "./fetch-helpers";
+import { providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
 import type { ProviderFetchOptions } from "./fetch-helpers";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
 import { recordAnthropicAccountQuotaFromHeaders, hasPassiveAccountQuota } from "../../providers/quota";
@@ -190,8 +190,9 @@ export async function prepareResponsesTransport(
    * lines, and the divergence that produced was the bug: `apiKey` was swapped while the routing
    * metadata paired with it stayed behind.
    *
-   * Returns false when the snapshot cannot be used safely, and the caller must then abandon the
-   * rotation rather than send a half-applied identity:
+   * Returns the admitted snapshot, which can differ when a newer manual selection wins the
+   * proposal race. Returns null when the snapshot cannot be used safely, and the caller must then
+   * abandon the rotation rather than send a half-applied identity:
    *
    * - Copilot pins its bearer to an account-scoped regional origin, so transport is re-resolved
    *   with the new account's `apiBaseUrl` instead of inheriting the previous account's host. The
@@ -207,10 +208,10 @@ export async function prepareResponsesTransport(
   const applyFailoverSnapshot = async (
     snapshot: OAuthAccessSnapshot,
     retryParsed: OcxParsedRequest = parsed,
-  ): Promise<boolean> => {
-    if (route.provider.googleMode === "cloud-code-assist" && !snapshot.projectId) return false;
+  ): Promise<OAuthAccessSnapshot | null> => {
+    if (route.provider.googleMode === "cloud-code-assist" && !snapshot.projectId) return null;
     const committed = await commitResolvedOAuthSelection(snapshot);
-    if (!committed) return false;
+    if (!committed) return null;
     snapshot = committed;
     let rotatedProvider: OcxProviderConfig = { ...route.provider, apiKey: snapshot.accessToken };
     if (route.providerName === "github-copilot") {
@@ -243,7 +244,7 @@ export async function prepareResponsesTransport(
     }
     sentOAuthSnapshot = snapshot;
     replayOAuthCredentialSnapshot = { accountId: snapshot.accountId, generation: snapshot.generation };
-    return true;
+    return snapshot;
   };
   // Key sends may be rebuilt while queued. Keep metadata pending until the guarded
   // physical dispatch binds it to the selection that actually reaches the upstream.
@@ -405,8 +406,10 @@ export async function prepareResponsesTransport(
             && sentHeaders?.get("authorization") === `Bearer ${snapshot.accessToken}`
             && !sentHeaders?.has("x-api-key");
           // Reselection can choose a provider override instead of the supplied executor.
+          // Either way the send crosses the physical boundary, so the connection policy is
+          // applied around whichever implementation was just selected (#4992).
           commitKeyAttemptSend();
-          const response = await fetchImpl(destination, { ...dispatchInit, redirect: "manual" });
+          const response = await sendWithConnectionPolicy(fetchImpl, destination, { ...dispatchInit, redirect: "manual" });
           if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
           // Observe each physical response before retries replace it. The binding belongs to
           // this dispatch, so a manual switch cannot file A's headers against B. Header
@@ -487,7 +490,7 @@ export async function prepareResponsesTransport(
         // measured as spent. A null answer means "use the active account", so every provider
         // without quota evidence keeps the resolution it has today.
         const preferredAccountId = isGenericFailoverProvider(route.providerName, route.provider)
-          ? preferredInitialAccount(config, route.providerName)
+          ? preferredInitialAccount(config, route.providerName, Date.now(), route.modelId)
           : null;
         // Resolved account-scoped, NOT through failoverAccountSnapshot: that helper marks a
         // rotation site, and rotation sites must apply their credential through
@@ -550,7 +553,7 @@ export async function prepareResponsesTransport(
           // Advance the pool cursor only now that this account is actually admitted. The
           // helper returns immediately unless the kernel is on AND the strategy is
           // round-robin, so quota and fill-first pools reach it without being touched.
-          noteGenericPoolSelection(config, route.providerName, resolved.accountId);
+          noteGenericPoolSelection(config, route.providerName, resolved.accountId, route.modelId);
         }
         // Anthropic is excluded from isGenericFailoverProvider -- its own pool owns affinity and
         // a fail-closed local-cli credential rule -- so without this stamp its identity is

package/src/server/responses/run-turn-execution.ts

@@ -12,7 +12,7 @@ import {
   adapterNeedsForcedContinuation,
   adapterResponseReachedServingTerminal,
 } from "./core-replay";
-import { sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
+import { noteAttemptRecoveryWithheld, sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
 import { waitForProviderRequestSlot, RequestPacingQueueOverloadError } from "../../providers/request-pacing";
 import type { AdapterEventQueue } from "../../adapters/run-turn-queue";
 import type { AttemptRecoveryKind } from "../../usage/log";
@@ -231,12 +231,21 @@ export async function executeResponsesRunTurn(
         "auth-recovery",
         `${route.providerName}|${route.modelId}|runturn-oauth-429`,
       );
-      if (!hop.allowed) return false;
+      if (!hop.allowed) {
+        // The roster bound above already said this credential set may rotate again; the shared
+        // request budget is what refused. Returning false lets the preflight 429 reach the
+        // client unchanged, which is right, but it used to leave a log indistinguishable from
+        // a request where no rotation was ever available (#5044).
+        noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
+        return false;
+      }
       const nextAccountId = rotateGenericOAuthAccountOn429(
         config,
         route.providerName,
         transportState.genericFailoverAccountId,
         null,
+        Date.now(),
+        route.modelId,
       );
       if (!nextAccountId) {
         hop.permit?.release();
@@ -245,7 +254,8 @@ export async function executeResponsesRunTurn(
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
         transportState.genericFailovers += 1;
-        if (!await applyFailoverSnapshot(snapshot)) {
+        const admittedSnapshot = await applyFailoverSnapshot(snapshot);
+        if (!admittedSnapshot) {
           hop.permit?.release();
           return false;
         }
@@ -275,7 +285,10 @@ export async function executeResponsesRunTurn(
           providerName: route.providerName,
           provider: rotatedProvider,
           adapterName: rotatedAdapter.name,
-          oauthCredentialSnapshot: { accountId: snapshot.accountId, generation: snapshot.generation },
+          oauthCredentialSnapshot: {
+            accountId: admittedSnapshot.accountId,
+            generation: admittedSnapshot.generation,
+          },
           codexAuthContext: admissionState.authCtx,
           forwardHeaders: requestState.selectedForwardHeaders,
         });
@@ -299,7 +312,9 @@ export async function executeResponsesRunTurn(
       try {
         while (true) {
           const preflight = await preflightAdapterEvents(source);
-          if (!preflight.error || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
+          if (preflight.replayUnsafe
+            || !preflight.error
+            || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
             return preflight.stream;
           }
           const retryQueue = createAdapterEventQueue({

package/src/server/responses/sidecar-execution.ts

@@ -186,6 +186,8 @@ export async function executeResponsesSidecars(
         route.providerName,
         transportState.genericFailoverAccountId,
         retryAfter,
+        Date.now(),
+        route.modelId,
       );
       if (!nextAccountId) {
         hop.permit?.release();

package/src/server/responses/ws-upstream.ts

@@ -1,3 +1,6 @@
+import { OPENAI_API_RESPONSES_URL } from "./native-response-control";
+import { isInjectionRequest } from "./native-injection-protocol";
+import type { NativeResponseControl } from "./native-response-control";
 // Upstream WebSocket transport for the ChatGPT Codex backend.
 //
 // Why this exists: the Codex backend serves the responses_websockets path from
@@ -13,7 +16,7 @@
 // (passthrough relay, adapter parsers, usage sniffing) is unchanged.
 
 import { compareBunVersions } from "../../lib/bun-stream-caps";
-import { resolveProxyRoute } from "../../lib/proxy-env";
+import { resolveProxyRoute, socks5ProxyFromEnv } from "../../lib/proxy-env";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { CODEX_RESPONSES_HTTP_URL, CODEX_RESPONSES_WS_URL, prepareCodexHttpInit, prepareCodexWsRequest } from "./codex-ws-request";
 import { codexWsExchange } from "./codex-ws-exchange";
@@ -104,6 +107,7 @@ export function shouldUseCodexWsUpstream(
   upstreamWebsocketConfigured = false,
 ): boolean {
   if (!bunSupportsBoundedCodexWsRelay(runtime)) return false;
+  if (socks5ProxyFromEnv()) return false;
   if (url !== CODEX_RESPONSES_HTTP_URL && !upstreamWebsocketConfigured) return false;
   if (upstreamWebsocketConfigured && !isResponsesWebsocketEligibleUrl(url)) return false;
   if ((init?.method ?? "GET").toUpperCase() !== "POST") return false;
@@ -129,6 +133,8 @@ export function codexWsUpstreamFetch(
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
   onQuota?: CodexWsQuotaObserver,
   beforeDispatch?: (headers: Headers) => void,
+  nativeControl?: NativeResponseControl,
+  beforeContinuation?: () => Promise<void>,
 ): Promise<Response> {
   const prepared = prepareCodexWsRequest(url, init);
   if (!prepared) return sseFallback(url, prepareCodexHttpInit(url, init));
@@ -142,6 +148,17 @@ export function codexWsUpstreamFetch(
   }
 
   const { frameText, headers } = prepared;
+  // Never infer backend support from a model name or enable controls on a gateway.
+  const control = nativeControl?.kind === "injection"
+    ? ((prepared.canonical || url === OPENAI_API_RESPONSES_URL) && isInjectionRequest(JSON.parse(frameText)) ? nativeControl : undefined)
+    : (prepared.canonical || url === OPENAI_API_RESPONSES_URL) ? nativeControl : undefined;
+  if (control?.kind === "injection" && url === OPENAI_API_RESPONSES_URL) {
+    const beta = headers["openai-beta"];
+    if (!beta?.split(",").some(value => value.trim() === "responses_multi_agent=v1")) {
+      headers["openai-beta"] = beta ? `${beta}, responses_multi_agent=v1` : "responses_multi_agent=v1";
+    }
+  }
+
 
   // Decide before dialing. Once the socket is open the caller already holds a
   // streaming Response, so the oversized close can only be surfaced as a stream
@@ -169,7 +186,9 @@ export function codexWsUpstreamFetch(
   }
   let session: CodexWsSession;
   try {
-    const identity = codexWsReuseIdentity(url, headers, frameText, proxy);
+    // Steering keeps a private physical connection across successor responses; it
+    // must never enter the idle-socket pool or move to a different credential.
+    const identity = control ? null : codexWsReuseIdentity(url, headers, frameText, proxy);
     session = (identity ? codexWsPool.acquire(identity, wsUrl, headers, proxy) : null)
       ?? new CodexWsSession(wsUrl, headers, false, undefined, proxy);
     if (!session.busy && !session.reserve()) {
@@ -181,6 +200,8 @@ export function codexWsUpstreamFetch(
   }
   return codexWsExchange({
     session, url, init, prepared, sseFallback, onQuota, beforeDispatch,
+    nativeControl: control,
+    beforeContinuation,
     bunVersion: typeof runtime === "string" ? runtime : runtime.version,
   });
 }

package/src/server/responses-custom-tool-repair.ts

@@ -298,7 +298,7 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       releaseCall(upstreamItemId);
       return [replaceSseDataPayload(block, JSON.stringify({
         ...parsed,
-        input: helper ? compileCodeModeHelperInput(source, helper) : source,
+        input: helper ? compileCodeModeHelperInput(source, helper, name) : source,
       }))];
     }
     if (
@@ -381,7 +381,7 @@ export function createRoutedCustomToolRestoreBlockRewrite(
         type: nextType,
         item_id: customToolItemId(upstreamItemId),
         input: helper
-          ? compileCodeModeHelperInput(source, helper)
+          ? compileCodeModeHelperInput(source, helper, itemName?.name ?? "")
           : unwrapRoutedCustomToolArguments(source, itemName?.name ?? "", itemName?.namespace),
       };
       return [replaceSseDataPayload(replaceSseEventName(block, nextType), JSON.stringify(next))];

package/src/server/sse-frame-buffer.ts

@@ -2,6 +2,8 @@ import { isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
 
 export const MAX_CLIENT_SSE_FRAME_BYTES = 4 * 1024 * 1024;
 
+export const EMPTY_BYTES = new Uint8Array(0);
+
 const LF_LF = Uint8Array.of(10, 10);
 const LF_CR_LF = Uint8Array.of(10, 13, 10);
 const CR_LF_LF = Uint8Array.of(13, 10, 10);
@@ -155,8 +157,8 @@ function isResponsesTerminalFrame(block: Uint8Array): boolean {
 export class BoundedSseFrameBuffer {
   private readonly maxFrameBytes: number;
   private readonly maxFramesPerFeed: number;
-  private delimiterTail: Uint8Array = new Uint8Array(0);
-  private candidate: Uint8Array = new Uint8Array(0);
+  private delimiterTail: Uint8Array = EMPTY_BYTES;
+  private candidate: Uint8Array = EMPTY_BYTES;
   private candidateBytes = 0;
   private disposed = false;
 
@@ -172,8 +174,8 @@ export class BoundedSseFrameBuffer {
   }
 
   private clear(): void {
-    this.delimiterTail = new Uint8Array(0);
-    this.candidate = new Uint8Array(0);
+    this.delimiterTail = EMPTY_BYTES;
+    this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
   }
 
@@ -209,12 +211,12 @@ export class BoundedSseFrameBuffer {
   }
 
   private takeCandidate(): Uint8Array {
-    if (this.candidateBytes === 0) return new Uint8Array(0);
+    if (this.candidateBytes === 0) return EMPTY_BYTES;
     const block = this.candidate.slice(0, this.candidateBytes);
     // Release the working allocation after each complete frame. This avoids
     // retaining a rare multi-MiB frame allocation for the rest of a long-lived
     // stream; normal small-frame allocation remains bounded by feed's frame cap.
-    this.candidate = new Uint8Array(0);
+    this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
     return block;
   }
@@ -225,7 +227,7 @@ export class BoundedSseFrameBuffer {
 
     const frames: BoundedSseFrame[] = [];
     const previousTail = this.delimiterTail;
-    this.delimiterTail = new Uint8Array(0);
+    this.delimiterTail = EMPTY_BYTES;
     const tailLength = previousTail.byteLength;
     const totalLength = tailLength + chunk.byteLength;
     const byteAt = (index: number): number => index < tailLength
@@ -286,10 +288,10 @@ export class BoundedSseFrameBuffer {
 
   /** Return the final unterminated block bytes and release all retained state. */
   finish(): Uint8Array {
-    if (this.disposed) return new Uint8Array(0);
+    if (this.disposed) return EMPTY_BYTES;
     try {
       this.retain(this.delimiterTail);
-      this.delimiterTail = new Uint8Array(0);
+      this.delimiterTail = EMPTY_BYTES;
       return this.takeCandidate();
     } finally {
       this.clear();
@@ -307,7 +309,7 @@ export class BoundedSseFrameBuffer {
 export function joinSseFrameBytes(parts: readonly Uint8Array[]): Uint8Array {
   let byteLength = 0;
   for (const part of parts) byteLength += part.byteLength;
-  if (byteLength === 0) return new Uint8Array(0);
+  if (byteLength === 0) return EMPTY_BYTES;
   if (parts.length === 1 && parts[0]!.byteLength === byteLength) return parts[0]!;
   const joined = new Uint8Array(byteLength);
   let offset = 0;

package/src/server/sse-payload-rewrite.ts

@@ -178,17 +178,44 @@ export function createSseBlockBuffer(
 
 /** Join all data lines from one SSE event according to the event-stream field rules. */
 export function sseDataPayload(block: string): string | null {
-  const data: string[] = [];
-  for (const line of block.split(/\r?\n/)) {
-    if (line === "data") {
-      data.push("");
-      continue;
+  let result = "";
+  let found = false;
+  let lineStart = 0;
+  const len = block.length;
+
+  while (lineStart < len) {
+    const nextNewline = block.indexOf("\n", lineStart);
+    let lineEnd = nextNewline === -1 ? len : nextNewline;
+    const nextStart = nextNewline === -1 ? len : nextNewline + 1;
+    if (lineEnd > lineStart && block.charCodeAt(lineEnd - 1) === 13) {
+      lineEnd -= 1;
     }
-    if (!line.startsWith("data:")) continue;
-    const value = line.slice(5);
-    data.push(value.startsWith(" ") ? value.slice(1) : value);
+
+    const lineLen = lineEnd - lineStart;
+    if (lineLen === 4 && block.startsWith("data", lineStart)) {
+      if (found) {
+        result += "\n";
+      } else {
+        found = true;
+      }
+    } else if (lineLen >= 5 && block.startsWith("data:", lineStart)) {
+      let valueStart = lineStart + 5;
+      if (valueStart < lineEnd && block.charCodeAt(valueStart) === 32) {
+        valueStart += 1;
+      }
+      const value = block.slice(valueStart, lineEnd);
+      if (found) {
+        result += "\n" + value;
+      } else {
+        result = value;
+        found = true;
+      }
+    }
+
+    lineStart = nextStart;
   }
-  return data.length > 0 ? data.join("\n") : null;
+
+  return found ? result : null;
 }
 
 /** Replace an SSE event's data field while preserving non-data fields and newline style. */

package/src/server/stop-teardown.ts

@@ -67,7 +67,14 @@ export async function performStopTeardown(url: URL, io: StopTeardownIo = {}): Pr
   // undone (#3008).
   const grokNote = grok.ok ? "" : ` Grok config cleanup failed: ${grok.message}`;
   if (restore.success && grok.ok) {
-    return { success: true, message: "Proxy stopping, native Codex restored.", sharedTeardown: "performed" };
+    // A degraded restore is a success — routing is out and the client is no longer aimed at
+    // a port that is about to disappear — but it left a provider table behind on purpose.
+    // Reporting a bare "restored" would put the caller in exactly the position #4812
+    // describes: a config they did not expect and no idea why it is there.
+    const retained = restore.retainedCodexProviderTable
+      ? ` ${(await import("../codex/inject/restore")).describeRetainedCodexProviderTable(restore.retainedCodexProviderTable)}`
+      : "";
+    return { success: true, message: `Proxy stopping, native Codex restored.${retained}`, sharedTeardown: "performed" };
   }
   if (restore.success) {
     return {