@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/server/responses/request-spend.ts

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import type { RequestSendObserver } from "../../lib/request-execution-budget";
 import { sharedSpendLedger, type SpendReservationLedger } from "../../lib/spend-reservation-ledger";
-import type { RequestLogContext } from "../request-log";
+import { markLocalRequestLogRefusal, type RequestLogContext } from "../request-log";
+import { recordWorkflowRefusalEvent, workflowDenialSummary } from "../../lib/workflow-budget";
 
 /** The terminal usage a request reported, in the only two fields the ledger books. */
 export interface TerminalSpendUsage {
@@ -42,7 +43,7 @@ export function createRequestSpendTracker(
   logCtx: Pick<
     RequestLogContext,
     "provider" | "accountLogLabel" | "usageLogInputTokens" | "spendOutputCeilingTokens"
-  >,
+  > & Partial<Pick<RequestLogContext, "localTerminalReason" | "terminalSource" | "errorCode">>,
   rootId: string | undefined,
   injected?: SpendReservationLedger,
 ): RequestSpendTracker {
@@ -70,7 +71,13 @@ export function createRequestSpendTracker(
     for (let index = 0; index < live.length - 1; index += 1) ledger().markDispatched(live[index] as string);
   };
   return {
-    charge(): boolean {
+    charge(options?: { alreadySent?: boolean }): boolean {
+      // A send that has already left is RECORDED, never refused: the tokens are spent, and a
+      // booking the ledger drops is a booking the ceiling can never see. This is the reporting
+      // transports' path -- the passthrough ladder reports through `onSendsConsumed` after the
+      // fetch -- so without it a root ceiling on the canonical Codex path would sit one send
+      // short of its limit forever and refuse nothing.
+      const alreadySent = options?.alreadySent === true;
       const sendId = randomUUID();
       const decision = ledger().reserve({
         sendId,
@@ -83,18 +90,40 @@ export function createRequestSpendTracker(
         },
         inputTokens: logCtx.usageLogInputTokens ?? 0,
         outputCeilingTokens: logCtx.spendOutputCeilingTokens ?? 0,
+        ...(alreadySent ? { alreadySent: true } : {}),
       });
       if (!decision.reserved) {
         refusals += 1;
-        // Only an operator's configured ceiling refuses a dispatch. Every other denial --
-        // capacity, durability, a journal this process could not prove complete -- means the
-        // ledger cannot ACCOUNT for this send, which is not a reason to refuse one. An
-        // unconfigured install keeps the count caps it already had and is not newly refused,
-        // and a degraded ledger must not become an outage.
-        return decision.denial.reason !== "spend-limit-exceeded";
+        const denial = decision.denial;
+        // A ceiling refuses, and so does a ledger that cannot make the reservation durable
+        // under one. That second case is the whole reason this store is on disk: admitting a
+        // send whose record a restart would forget is how an exhausted budget comes back with
+        // a fresh allowance, and the ledger raises those two denials ONLY when a limit is
+        // configured -- so an install that configured nothing is still never refused here.
+        // Capacity and a duplicate send id stay permissive: they say the ledger cannot account
+        // for this send, which is a degradation to report, not an outage to cause.
+        if (denial.reason === "reserve-not-durable" || denial.reason === "journal-corrupt") {
+          return alreadySent;
+        }
+        if (denial.reason !== "spend-limit-exceeded") return true;
+        // This send is refused, and the dispatch path that asked will report an exhausted send
+        // budget -- from there, that is all it can see. The row is where an operator actually
+        // looks, so the ceiling is named on it here: a locally assigned code wins in
+        // addFinalRequestLog, so the request that CROSSED the ceiling reads as a spend refusal
+        // rather than as the ordinary budget exhaustion it would otherwise be indistinguishable
+        // from. The event ring gets the same pair so /api/workflow-budget agrees with the row.
+        const detail = { scope: denial.scope, limit: denial.limit, projected: denial.projected };
+        const summary = workflowDenialSummary("workflow-spend-exhausted", detail);
+        markLocalRequestLogRefusal(logCtx, summary.code);
+        logCtx.errorCode = summary.code;
+        recordWorkflowRefusalEvent(rootId, "workflow-spend-exhausted", Date.now(), detail);
+        return false;
       }
       live.push(sendId);
       confirmOlderSends();
+      // It has already left, so the reservation cannot be handed back for free: from here only
+      // a settlement or unresolved spend is honest about it.
+      if (alreadySent) ledger().markDispatched(sendId);
       return true;
     },
     refund(): void {

package/src/server/responses/request-transport.ts

@@ -41,7 +41,7 @@ import {
   resolveCurrentProviderApiKeyTransport,
 } from "../../providers/api-key-selection";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
-import { providerFetch } from "./fetch-helpers";
+import { providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
 import type { ProviderFetchOptions } from "./fetch-helpers";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
 import { recordAnthropicAccountQuotaFromHeaders, hasPassiveAccountQuota } from "../../providers/quota";
@@ -190,8 +190,9 @@ export async function prepareResponsesTransport(
    * lines, and the divergence that produced was the bug: `apiKey` was swapped while the routing
    * metadata paired with it stayed behind.
    *
-   * Returns false when the snapshot cannot be used safely, and the caller must then abandon the
-   * rotation rather than send a half-applied identity:
+   * Returns the admitted snapshot, which can differ when a newer manual selection wins the
+   * proposal race. Returns null when the snapshot cannot be used safely, and the caller must then
+   * abandon the rotation rather than send a half-applied identity:
    *
    * - Copilot pins its bearer to an account-scoped regional origin, so transport is re-resolved
    *   with the new account's `apiBaseUrl` instead of inheriting the previous account's host. The
@@ -207,10 +208,10 @@ export async function prepareResponsesTransport(
   const applyFailoverSnapshot = async (
     snapshot: OAuthAccessSnapshot,
     retryParsed: OcxParsedRequest = parsed,
-  ): Promise<boolean> => {
-    if (route.provider.googleMode === "cloud-code-assist" && !snapshot.projectId) return false;
+  ): Promise<OAuthAccessSnapshot | null> => {
+    if (route.provider.googleMode === "cloud-code-assist" && !snapshot.projectId) return null;
     const committed = await commitResolvedOAuthSelection(snapshot);
-    if (!committed) return false;
+    if (!committed) return null;
     snapshot = committed;
     let rotatedProvider: OcxProviderConfig = { ...route.provider, apiKey: snapshot.accessToken };
     if (route.providerName === "github-copilot") {
@@ -243,7 +244,7 @@ export async function prepareResponsesTransport(
     }
     sentOAuthSnapshot = snapshot;
     replayOAuthCredentialSnapshot = { accountId: snapshot.accountId, generation: snapshot.generation };
-    return true;
+    return snapshot;
   };
   // Key sends may be rebuilt while queued. Keep metadata pending until the guarded
   // physical dispatch binds it to the selection that actually reaches the upstream.
@@ -405,8 +406,10 @@ export async function prepareResponsesTransport(
             && sentHeaders?.get("authorization") === `Bearer ${snapshot.accessToken}`
             && !sentHeaders?.has("x-api-key");
           // Reselection can choose a provider override instead of the supplied executor.
+          // Either way the send crosses the physical boundary, so the connection policy is
+          // applied around whichever implementation was just selected (#4992).
           commitKeyAttemptSend();
-          const response = await fetchImpl(destination, { ...dispatchInit, redirect: "manual" });
+          const response = await sendWithConnectionPolicy(fetchImpl, destination, { ...dispatchInit, redirect: "manual" });
           if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
           // Observe each physical response before retries replace it. The binding belongs to
           // this dispatch, so a manual switch cannot file A's headers against B. Header
@@ -487,7 +490,7 @@ export async function prepareResponsesTransport(
         // measured as spent. A null answer means "use the active account", so every provider
         // without quota evidence keeps the resolution it has today.
         const preferredAccountId = isGenericFailoverProvider(route.providerName, route.provider)
-          ? preferredInitialAccount(config, route.providerName)
+          ? preferredInitialAccount(config, route.providerName, Date.now(), route.modelId)
           : null;
         // Resolved account-scoped, NOT through failoverAccountSnapshot: that helper marks a
         // rotation site, and rotation sites must apply their credential through
@@ -550,7 +553,7 @@ export async function prepareResponsesTransport(
           // Advance the pool cursor only now that this account is actually admitted. The
           // helper returns immediately unless the kernel is on AND the strategy is
           // round-robin, so quota and fill-first pools reach it without being touched.
-          noteGenericPoolSelection(config, route.providerName, resolved.accountId);
+          noteGenericPoolSelection(config, route.providerName, resolved.accountId, route.modelId);
         }
         // Anthropic is excluded from isGenericFailoverProvider -- its own pool owns affinity and
         // a fail-closed local-cli credential rule -- so without this stamp its identity is

package/src/server/responses/run-turn-execution.ts

@@ -12,7 +12,7 @@ import {
   adapterNeedsForcedContinuation,
   adapterResponseReachedServingTerminal,
 } from "./core-replay";
-import { sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
+import { noteAttemptRecoveryWithheld, sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
 import { waitForProviderRequestSlot, RequestPacingQueueOverloadError } from "../../providers/request-pacing";
 import type { AdapterEventQueue } from "../../adapters/run-turn-queue";
 import type { AttemptRecoveryKind } from "../../usage/log";
@@ -231,12 +231,21 @@ export async function executeResponsesRunTurn(
         "auth-recovery",
         `${route.providerName}|${route.modelId}|runturn-oauth-429`,
       );
-      if (!hop.allowed) return false;
+      if (!hop.allowed) {
+        // The roster bound above already said this credential set may rotate again; the shared
+        // request budget is what refused. Returning false lets the preflight 429 reach the
+        // client unchanged, which is right, but it used to leave a log indistinguishable from
+        // a request where no rotation was ever available (#5044).
+        noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
+        return false;
+      }
       const nextAccountId = rotateGenericOAuthAccountOn429(
         config,
         route.providerName,
         transportState.genericFailoverAccountId,
         null,
+        Date.now(),
+        route.modelId,
       );
       if (!nextAccountId) {
         hop.permit?.release();
@@ -245,7 +254,8 @@ export async function executeResponsesRunTurn(
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
         transportState.genericFailovers += 1;
-        if (!await applyFailoverSnapshot(snapshot)) {
+        const admittedSnapshot = await applyFailoverSnapshot(snapshot);
+        if (!admittedSnapshot) {
           hop.permit?.release();
           return false;
         }
@@ -275,7 +285,10 @@ export async function executeResponsesRunTurn(
           providerName: route.providerName,
           provider: rotatedProvider,
           adapterName: rotatedAdapter.name,
-          oauthCredentialSnapshot: { accountId: snapshot.accountId, generation: snapshot.generation },
+          oauthCredentialSnapshot: {
+            accountId: admittedSnapshot.accountId,
+            generation: admittedSnapshot.generation,
+          },
           codexAuthContext: admissionState.authCtx,
           forwardHeaders: requestState.selectedForwardHeaders,
         });
@@ -299,7 +312,9 @@ export async function executeResponsesRunTurn(
       try {
         while (true) {
           const preflight = await preflightAdapterEvents(source);
-          if (!preflight.error || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
+          if (preflight.replayUnsafe
+            || !preflight.error
+            || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
             return preflight.stream;
           }
           const retryQueue = createAdapterEventQueue({

package/src/server/responses/sidecar-execution.ts

@@ -186,6 +186,8 @@ export async function executeResponsesSidecars(
         route.providerName,
         transportState.genericFailoverAccountId,
         retryAfter,
+        Date.now(),
+        route.modelId,
       );
       if (!nextAccountId) {
         hop.permit?.release();

package/src/server/responses/ws-upstream.ts

@@ -16,7 +16,7 @@ import type { NativeResponseControl } from "./native-response-control";
 // (passthrough relay, adapter parsers, usage sniffing) is unchanged.
 
 import { compareBunVersions } from "../../lib/bun-stream-caps";
-import { resolveProxyRoute } from "../../lib/proxy-env";
+import { resolveProxyRoute, socks5ProxyFromEnv } from "../../lib/proxy-env";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { CODEX_RESPONSES_HTTP_URL, CODEX_RESPONSES_WS_URL, prepareCodexHttpInit, prepareCodexWsRequest } from "./codex-ws-request";
 import { codexWsExchange } from "./codex-ws-exchange";
@@ -107,6 +107,7 @@ export function shouldUseCodexWsUpstream(
   upstreamWebsocketConfigured = false,
 ): boolean {
   if (!bunSupportsBoundedCodexWsRelay(runtime)) return false;
+  if (socks5ProxyFromEnv()) return false;
   if (url !== CODEX_RESPONSES_HTTP_URL && !upstreamWebsocketConfigured) return false;
   if (upstreamWebsocketConfigured && !isResponsesWebsocketEligibleUrl(url)) return false;
   if ((init?.method ?? "GET").toUpperCase() !== "POST") return false;

package/src/server/responses-custom-tool-repair.ts

@@ -298,7 +298,7 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       releaseCall(upstreamItemId);
       return [replaceSseDataPayload(block, JSON.stringify({
         ...parsed,
-        input: helper ? compileCodeModeHelperInput(source, helper) : source,
+        input: helper ? compileCodeModeHelperInput(source, helper, name) : source,
       }))];
     }
     if (
@@ -381,7 +381,7 @@ export function createRoutedCustomToolRestoreBlockRewrite(
         type: nextType,
         item_id: customToolItemId(upstreamItemId),
         input: helper
-          ? compileCodeModeHelperInput(source, helper)
+          ? compileCodeModeHelperInput(source, helper, itemName?.name ?? "")
           : unwrapRoutedCustomToolArguments(source, itemName?.name ?? "", itemName?.namespace),
       };
       return [replaceSseDataPayload(replaceSseEventName(block, nextType), JSON.stringify(next))];

package/src/server/sse-frame-buffer.ts

@@ -2,6 +2,8 @@ import { isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
 
 export const MAX_CLIENT_SSE_FRAME_BYTES = 4 * 1024 * 1024;
 
+export const EMPTY_BYTES = new Uint8Array(0);
+
 const LF_LF = Uint8Array.of(10, 10);
 const LF_CR_LF = Uint8Array.of(10, 13, 10);
 const CR_LF_LF = Uint8Array.of(13, 10, 10);
@@ -155,8 +157,8 @@ function isResponsesTerminalFrame(block: Uint8Array): boolean {
 export class BoundedSseFrameBuffer {
   private readonly maxFrameBytes: number;
   private readonly maxFramesPerFeed: number;
-  private delimiterTail: Uint8Array = new Uint8Array(0);
-  private candidate: Uint8Array = new Uint8Array(0);
+  private delimiterTail: Uint8Array = EMPTY_BYTES;
+  private candidate: Uint8Array = EMPTY_BYTES;
   private candidateBytes = 0;
   private disposed = false;
 
@@ -172,8 +174,8 @@ export class BoundedSseFrameBuffer {
   }
 
   private clear(): void {
-    this.delimiterTail = new Uint8Array(0);
-    this.candidate = new Uint8Array(0);
+    this.delimiterTail = EMPTY_BYTES;
+    this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
   }
 
@@ -209,12 +211,12 @@ export class BoundedSseFrameBuffer {
   }
 
   private takeCandidate(): Uint8Array {
-    if (this.candidateBytes === 0) return new Uint8Array(0);
+    if (this.candidateBytes === 0) return EMPTY_BYTES;
     const block = this.candidate.slice(0, this.candidateBytes);
     // Release the working allocation after each complete frame. This avoids
     // retaining a rare multi-MiB frame allocation for the rest of a long-lived
     // stream; normal small-frame allocation remains bounded by feed's frame cap.
-    this.candidate = new Uint8Array(0);
+    this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
     return block;
   }
@@ -225,7 +227,7 @@ export class BoundedSseFrameBuffer {
 
     const frames: BoundedSseFrame[] = [];
     const previousTail = this.delimiterTail;
-    this.delimiterTail = new Uint8Array(0);
+    this.delimiterTail = EMPTY_BYTES;
     const tailLength = previousTail.byteLength;
     const totalLength = tailLength + chunk.byteLength;
     const byteAt = (index: number): number => index < tailLength
@@ -286,10 +288,10 @@ export class BoundedSseFrameBuffer {
 
   /** Return the final unterminated block bytes and release all retained state. */
   finish(): Uint8Array {
-    if (this.disposed) return new Uint8Array(0);
+    if (this.disposed) return EMPTY_BYTES;
     try {
       this.retain(this.delimiterTail);
-      this.delimiterTail = new Uint8Array(0);
+      this.delimiterTail = EMPTY_BYTES;
       return this.takeCandidate();
     } finally {
       this.clear();
@@ -307,7 +309,7 @@ export class BoundedSseFrameBuffer {
 export function joinSseFrameBytes(parts: readonly Uint8Array[]): Uint8Array {
   let byteLength = 0;
   for (const part of parts) byteLength += part.byteLength;
-  if (byteLength === 0) return new Uint8Array(0);
+  if (byteLength === 0) return EMPTY_BYTES;
   if (parts.length === 1 && parts[0]!.byteLength === byteLength) return parts[0]!;
   const joined = new Uint8Array(byteLength);
   let offset = 0;

package/src/server/sse-payload-rewrite.ts

@@ -178,17 +178,44 @@ export function createSseBlockBuffer(
 
 /** Join all data lines from one SSE event according to the event-stream field rules. */
 export function sseDataPayload(block: string): string | null {
-  const data: string[] = [];
-  for (const line of block.split(/\r?\n/)) {
-    if (line === "data") {
-      data.push("");
-      continue;
+  let result = "";
+  let found = false;
+  let lineStart = 0;
+  const len = block.length;
+
+  while (lineStart < len) {
+    const nextNewline = block.indexOf("\n", lineStart);
+    let lineEnd = nextNewline === -1 ? len : nextNewline;
+    const nextStart = nextNewline === -1 ? len : nextNewline + 1;
+    if (lineEnd > lineStart && block.charCodeAt(lineEnd - 1) === 13) {
+      lineEnd -= 1;
     }
-    if (!line.startsWith("data:")) continue;
-    const value = line.slice(5);
-    data.push(value.startsWith(" ") ? value.slice(1) : value);
+
+    const lineLen = lineEnd - lineStart;
+    if (lineLen === 4 && block.startsWith("data", lineStart)) {
+      if (found) {
+        result += "\n";
+      } else {
+        found = true;
+      }
+    } else if (lineLen >= 5 && block.startsWith("data:", lineStart)) {
+      let valueStart = lineStart + 5;
+      if (valueStart < lineEnd && block.charCodeAt(valueStart) === 32) {
+        valueStart += 1;
+      }
+      const value = block.slice(valueStart, lineEnd);
+      if (found) {
+        result += "\n" + value;
+      } else {
+        result = value;
+        found = true;
+      }
+    }
+
+    lineStart = nextStart;
   }
-  return data.length > 0 ? data.join("\n") : null;
+
+  return found ? result : null;
 }
 
 /** Replace an SSE event's data field while preserving non-data fields and newline style. */

package/src/server/system-env-shell.ts

@@ -1,7 +1,7 @@
 import { accessSync, constants, readFileSync, writeFileSync, unlinkSync, mkdirSync, statSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { getConfigDir } from "../config";
-import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionTokens, type AuthDetectDeps } from "../claude/auth-detect";
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
 import { ANTHROPIC_PARENT_ENV_SLOTS, trustedNodeLauncherContext, type AnthropicParentEnvSlot } from "../cli/launcher-context";
@@ -128,6 +128,10 @@ export function writeShellEnvFile(
   if (config.claudeCode?.alwaysEnableEffort === true) {
     lines.push(conditional("CLAUDE_CODE_ALWAYS_ENABLE_EFFORT", "1"));
   }
+  // Tool-search deferral (#4838): opt-in, conditional like every other lever so a
+  // value already exported in the user's shell wins.
+  const toolSearch = claudeToolSearchEnv(config.claudeCode?.toolSearch);
+  if (toolSearch !== undefined) lines.push(conditional("ENABLE_TOOL_SEARCH", toolSearch));
   const shellEnvPath = getShellEnvFilePath();
   recordOwnedConfigPath(getConfigDir(), shellEnvPath);
   mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });

package/src/server/system-env.ts

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
-import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER } from "../claude/auth-detect";
 import { isProxyAdmissionSecret } from "./auth-cors";
 import type { OcxConfig } from "../types";
@@ -33,6 +33,7 @@ const MANAGED_SYSTEM_ENV_NAMES = new Set<string>([
   "DISABLE_COMPACT",
   "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
   "CLAUDE_CODE_ALWAYS_ENABLE_EFFORT",
+  "ENABLE_TOOL_SEARCH",
 ]);
 
 interface SystemEnvTracking {
@@ -309,6 +310,11 @@ export async function injectSystemEnv(
     if (config.claudeCode?.alwaysEnableEffort === true) {
       injectLever("CLAUDE_CODE_ALWAYS_ENABLE_EFFORT", "1");
     }
+    // Tool-search deferral (#4838): same opt-in contract as `ocx claude`, so a machine
+    // whose Claude Code is launched from Dock/launchd gets the setting it configured
+    // instead of only terminal sessions. injectLever keeps a user-owned launchd value.
+    const toolSearch = claudeToolSearchEnv(config.claudeCode?.toolSearch);
+    if (toolSearch !== undefined) injectLever("ENABLE_TOOL_SEARCH", toolSearch);
 
     // Shell-hook env file: works for new shells in already-running Terminal.app.
     writeShellEnvFile(port, config, modelEnv, auto, deps);

package/src/server/workflow-refusal.ts

@@ -5,6 +5,10 @@
  * check in `src/server/index.ts` and the pre-dispatch ceiling check in
  * `src/server/responses/core.ts` -- had drifted into saying different things about the same
  * refusal, and because the non-obvious part below has to be stated once and not twice.
+ *
+ * The HTTP admission DECISION lives here too, for the same reason: the lane derivation and the
+ * refusal it produces are two halves of one answer, and keeping them in one file is what stops
+ * a denial from losing the detail that makes it legible on the way out.
  */
 import { formatErrorResponse } from "../bridge";
 import {
@@ -14,9 +18,13 @@ import {
 } from "./request-log";
 import {
   WORKFLOW_LOCAL_REFUSAL_HEADER,
+  admitWorkflowTurn,
   workflowDenialSummary,
   recordWorkflowRefusalEvent,
   type WorkflowDenial,
+  type WorkflowDecision,
+  type WorkflowLane,
+  type WorkflowSpendDenialDetail,
 } from "../lib/workflow-budget";
 
 /**
@@ -54,11 +62,16 @@ export function workflowRefusalResponse(
   logCtx?: RequestLogContext,
   refusalLog?: WorkflowRefusalLog,
   rootId?: string,
+  spend?: WorkflowSpendDenialDetail,
 ): Response {
-  const summary = workflowDenialSummary(reason);
+  // The denial detail, when the caller has it, is what turns "a token ceiling refused this"
+  // into "the account ceiling of 100,000 is spent". It reaches the message, the event ring and
+  // the log row through this one function, so the three cannot drift into saying different
+  // things about the same refusal -- which is what put this module here in the first place.
+  const summary = workflowDenialSummary(reason, spend);
   // Only a caller that decided the refusal ITSELF passes a root id. admitWorkflowTurn already
   // records its own denials, so passing one there would double-count them.
-  if (rootId) recordWorkflowRefusalEvent(rootId, reason);
+  if (rootId) recordWorkflowRefusalEvent(rootId, reason, Date.now(), spend);
   const recordOn = logCtx ?? refusalLog?.logCtx;
   if (recordOn) {
     markLocalRequestLogRefusal(recordOn, summary.code);
@@ -82,3 +95,44 @@ export function workflowRefusalResponse(
   refusal.headers.set("Access-Control-Expose-Headers", WORKFLOW_LOCAL_REFUSAL_HEADER);
   return refusal;
 }
+
+/**
+ * Admit one HTTP turn against its root workflow budget.
+ *
+ * A fan-out shares the conversation it serves. Without a reserve, a worker burst takes every
+ * slot under its own root and the interactive turn that started it waits behind its own
+ * children. A request that names a parent is treated as that fan-out; a top-level request is
+ * the conversation and may use the reserved slots.
+ */
+export function admitHttpWorkflowTurn(headers: Headers): WorkflowDecision | undefined {
+  const rootId = headers.get("x-codex-parent-thread-id")?.trim() || undefined;
+  const threadId = headers.get("thread-id")?.trim() || undefined;
+  const lane: WorkflowLane = rootId !== undefined && threadId !== undefined && threadId !== rootId
+    ? "worker"
+    : "interactive";
+  return admitWorkflowTurn(rootId, lane, undefined, threadId);
+}
+
+/**
+ * The refusal for a decision {@link admitHttpWorkflowTurn} declined.
+ *
+ * It exists so the denial's own detail survives the trip to the wire. A token-ceiling denial
+ * arrives carrying the scope that refused and the number it refused against, and a caller that
+ * forwarded only `reason` would answer with a 429 that names no ceiling -- which is the
+ * illegible refusal this whole path is built to avoid. No root id is passed on: the admission
+ * check already recorded its own event, and passing one would count the refusal twice.
+ */
+export function workflowDecisionRefusalResponse(
+  decision: Extract<WorkflowDecision, { admitted: false }>,
+  logCtx?: RequestLogContext,
+  refusalLog?: WorkflowRefusalLog,
+): Response {
+  const spend = decision.spendScope !== undefined && decision.spendLimit !== undefined
+    ? {
+      scope: decision.spendScope,
+      limit: decision.spendLimit,
+      ...(decision.spendProjected !== undefined ? { projected: decision.spendProjected } : {}),
+    }
+    : undefined;
+  return workflowRefusalResponse(decision.reason, logCtx, refusalLog, undefined, spend);
+}

package/src/service/cli.ts

@@ -197,23 +197,28 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
     assertServiceAuthEnvironment();
     // A throw used to escape straight to the top level, so the one command that can
     // leave a macOS hub evicted never reached its own serving check (#4236, defect 1f).
-    // Report the failure, then still ask whether anything is listening: on darwin the
-    // rollback inside installLaunchd may have brought the previous job back, and on
-    // Windows the preserve/restart protocol may have done the same. The operator needs
-    // both halves of that answer, and the exit code stays non-zero either way.
+    // Still ask whether anything is listening: on darwin the rollback inside installLaunchd
+    // may have brought the previous job back, and on Windows the preserve/restart protocol
+    // may have done the same. The operator needs both halves of that answer, and the exit
+    // code stays non-zero either way.
+    //
+    // The failure text travels INTO that report rather than being printed here. Printing it
+    // here and then letting the report reach its success line stated both outcomes for one
+    // run — "❌ Service repair failed: ... exit code 199" beside "✅ opencodex service
+    // repaired and serving on port 10100" — and the checkmark was the false half: the
+    // existing registration had been restarted, not repaired (#4914).
     let repairError: unknown;
     try {
       await repairService({ verb });
     } catch (error) {
       repairError = error;
-      console.error(`❌ Service ${verb} failed: ${error instanceof Error ? error.message : String(error)}`);
       process.exitCode = 1;
     }
     // All three platforms: a repair that reports success while nothing serves is the
     // defect class this unit exists to close. Windows bakes its port into the
     // scheduler wrapper or the WinSW XML, both of which installedServiceListenPort()
     // now reads.
-    await reportServiceServing(verb === "restart" ? "restarted" : "repaired");
+    await reportServiceServing(verb === "restart" ? "restarted" : "repaired", {}, repairError);
     if (repairError !== undefined) process.exitCode = 1;
     return;
   }
@@ -265,6 +270,11 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       await maybeShowStarPrompt();
       break;
     case "start":
+      // The installed launcher preserves the recorded CODEX_SQLITE_HOME: a
+      // changed sqlite_home/CODEX_SQLITE_HOME/CODEX_HOME would start the service
+      // on the recorded database while this shell resolves another, splitting
+      // native Codex history between databases. Same guard `stop` already runs.
+      assertServiceEnvironmentMatchesInstall();
       ops.start();
       await reportServiceServing("started");
       break;

package/src/service/guards.ts

@@ -10,6 +10,7 @@ import { isTestHomeGuardArmed } from "../lib/test-home-guard";
 import { diagnoseService } from "./diagnostics";
 import type { ServiceDiagnostic } from "./diagnostics";
 import { currentCodexHome, currentOpenCodexHome, normalizePathForCompare, readServiceInstallState } from "./state";
+import { resolveCodexSqliteHome } from "../codex/paths";
 import { win32 } from "node:path";
 
 /**
@@ -61,6 +62,15 @@ export function assertServiceEnvironmentMatchesInstall(): void {
         "Run the service command from the same OpenCodex home so service state and secrets match.",
     );
   }
+  if (state.codexSqliteHome !== undefined) {
+    const actualCodexSqliteHome = resolveCodexSqliteHome({ codexHome: actualCodexHome });
+    if (normalizePathForCompare(state.codexSqliteHome) !== normalizePathForCompare(actualCodexSqliteHome)) {
+      throw new ServiceOwnershipError(
+        `Service was installed with Codex SQLite home=${state.codexSqliteHome}, but the current Codex SQLite home=${actualCodexSqliteHome}. ` +
+          "Run the service command with the same sqlite_home configuration and CODEX_SQLITE_HOME so native Codex history restore updates the correct database.",
+      );
+    }
+  }
 }
 
 function isLoopbackHostname(hostname: string | undefined): boolean {