@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/service/health.ts

@@ -148,6 +148,19 @@ export async function confirmServiceServing(
   return { ok: false, port };
 }
 
+/**
+ * The operation, as a noun, for a sentence that has to say it did not complete.
+ *
+ * The verb form reads as an accomplished fact ("service repaired"), which is exactly the
+ * claim that must not be made when the operation threw.
+ */
+const SERVICE_OPERATION_NOUN = {
+  installed: "install",
+  started: "start",
+  repaired: "repair",
+  restarted: "restart",
+} as const;
+
 /**
  * Print the outcome of `install` / `start` / `repair` in terms of what the user cares
  * about — is it serving? — instead of whether the manager accepted the registration.
@@ -156,10 +169,18 @@ export async function confirmServiceServing(
  * worker reads the child's exit status, so a registered-but-silent service now makes it
  * fall back to a direct proxy start rather than reporting a successful update over a
  * dead port.
+ *
+ * `precedingFailure` is the error the operation itself threw, when it threw. The serving
+ * probe still runs — a rollback or a preserve/restart protocol may well have left the
+ * previous job answering, and the operator needs that half of the answer (#4236). But the
+ * two halves have to be ONE sentence. Printing the failure separately and then reaching
+ * the success line here reported both outcomes for the same run and credited work that did
+ * not happen: the registration was kept, not repaired (#4914).
  */
 export async function reportServiceServing(
   verb: "installed" | "started" | "repaired" | "restarted",
   deps: Parameters<typeof confirmServiceServing>[0] = {},
+  precedingFailure?: unknown,
 ): Promise<void> {
   const healthBudgetMs = deps.timeoutMs ?? serviceInstallHealthMs();
   // Timed here rather than reported from the budget. confirmServiceServing knocks once
@@ -171,6 +192,28 @@ export async function reportServiceServing(
   const startedAt = now();
   const serving = await confirmServiceServing({ ...deps, timeoutMs: healthBudgetMs });
   const waitedMs = Math.max(0, now() - startedAt);
+  const failureDetail = precedingFailure === undefined
+    ? null
+    : precedingFailure instanceof Error ? precedingFailure.message : String(precedingFailure);
+  const operation = SERVICE_OPERATION_NOUN[verb];
+  if (failureDetail !== null) {
+    // Serving or not, the operation did not complete, so neither branch may print a
+    // checkmark. What differs is whether anything is answering, which is the fact the
+    // operator acts on next.
+    console.error(
+      serving.ok
+        ? `⚠️  Service ${operation} did not complete: ${failureDetail}\n`
+          + `   A proxy is answering on port ${serving.port}, so the existing registration was kept rather than replaced.\n`
+          + `   The ${operation} did not take effect; rerun it once the reported cause is resolved.\n`
+          + `   Log:       ${serviceLogPath()}`
+        : `❌ Service ${operation} failed: ${failureDetail}\n`
+          + `   No proxy answered on port ${serving.port} after ${Math.round(waitedMs / 1000)}s either.\n`
+          + `   Log:       ${serviceLogPath()}\n`
+          + `   Meanwhile: ocx start   (serves in the foreground)`,
+    );
+    process.exitCode = 1;
+    return;
+  }
   if (serving.ok) {
     console.log(`✅ opencodex service ${verb} and serving on port ${serving.port}.`);
     return;

package/src/service/state.ts

@@ -3,6 +3,7 @@ import { homedir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { expandUserPath, getConfigDir } from "../config";
 import { resolveCodexHomeDir, type CodexHomeDeps } from "../codex/home";
+import { resolveCodexSqliteHome } from "../codex/paths";
 import { durableBunRuntime, type BunRuntimeSource, type DurableBunRuntime } from "../lib/bun-runtime";
 import { WINSW_SHA256, WINSW_VERSION } from "../lib/winsw";
 import { hardenSecretPath } from "../lib/windows-secret-acl";
@@ -218,6 +219,8 @@ export interface ServiceInstallState {
   version: 1 | 2;
   codexHome: string;
   opencodexHome: string;
+  /** Effective Codex SQLite home used by this service's history integration. */
+  codexSqliteHome?: string;
   /** Baked at install; lets status flag paths gone stale after npm prefix/nvm moves. */
   bunPath?: string;
   cliPath?: string;
@@ -241,7 +244,7 @@ export function parseServiceInstallState(value: unknown): ServiceInstallState |
   if (state.version !== 1 && state.version !== 2) return null;
   if (typeof state.codexHome !== "string" || state.codexHome.length === 0) return null;
   if (typeof state.opencodexHome !== "string" || state.opencodexHome.length === 0) return null;
-  for (const key of ["bunPath", "cliPath", "launcherPath", "winswVersion", "winswSha256"] as const) {
+  for (const key of ["codexSqliteHome", "bunPath", "cliPath", "launcherPath", "winswVersion", "winswSha256"] as const) {
     if (state[key] !== undefined && (typeof state[key] !== "string" || state[key].length === 0)) return null;
   }
   if (state.version === 1) {
@@ -254,10 +257,12 @@ export function parseServiceInstallState(value: unknown): ServiceInstallState |
 
 export function writeServiceInstallState(backend: ServiceBackend = "scheduler", launcherPath?: string | null): void {
   const { bun, cli } = cliEntry();
+  const codexHome = currentCodexHome();
   const state: ServiceInstallState = {
     version: 2,
-    codexHome: currentCodexHome(),
+    codexHome,
     opencodexHome: currentOpenCodexHome(),
+    codexSqliteHome: resolveCodexSqliteHome({ codexHome }),
     bunPath: bun,
     cliPath: cli,
     ...(launcherPath ? { launcherPath } : {}),

package/src/types/accounts.ts

@@ -19,6 +19,10 @@ export interface CodexAccount {
 }
 
 export interface CodexAccountCredentials {
+  /** Read-only Orca auth.json link; Orca exclusively owns OAuth refresh. */
+  sourceAuthPath?: string;
+  /** Bind the link to the originally imported OAuth subject. */
+  sourceSubject?: string;
   accessToken: string;
   refreshToken: string;
   expiresAt: number;

package/src/types/config.ts

@@ -93,6 +93,31 @@ export interface OcxClaudeCodeConfig {
    * forcing effort on every request can leak reasoning params to non-reasoning routes.
    */
   alwaysEnableEffort?: boolean;
+  /**
+   * Opt-in ENABLE_TOOL_SEARCH injection for launched Claude Code sessions (#4838).
+   *
+   * Claude Code turns MCP tool deferral off whenever ANTHROPIC_BASE_URL names a
+   * non-first-party host, so an `ocx claude` session ships every tool schema in
+   * full on every request. Its own diagnostic states the precondition for turning
+   * that back on: "Set ENABLE_TOOL_SEARCH=true (or auto / auto:N) if your proxy
+   * forwards tool_reference blocks."
+   *
+   * Default OFF, because opencodex only forwards them on the NATIVE ANTHROPIC
+   * PASSTHROUGH route, where the body reaches Anthropic untouched. On a translated
+   * route the deferral shape is not representable: compatibility.ts marks
+   * tool_search/tool_reference/deferred_tools unsupported, and toolsToResponses
+   * drops the tool_search server tool while ignoring defer_loading — deferred tools
+   * still carry input_schema on the wire, so the routed provider receives every
+   * schema anyway while Claude Code stops accounting for them and therefore stops
+   * compacting. Under `claudeCode.compatibility: "enforce"` the same request is
+   * rejected with 400 instead.
+   *
+   * `true` injects "true"; a string is passed through verbatim so Claude Code's own
+   * vocabulary (`auto`, `auto:N`, `force`) stays reachable. `false` and absent
+   * inject nothing — they do not force the variable off, because a value the
+   * operator exported themselves always wins.
+   */
+  toolSearch?: boolean | string;
   /**
    * Subagent tier slots (devlog 260712 B2): injected as ANTHROPIC_DEFAULT_*_MODEL so
    * Claude Code's Agent-tool aliases (opus/sonnet/haiku/fable + parent-inherit) route
@@ -722,9 +747,11 @@ export interface OcxConfig {
     | { enabled: false }
     | { enabled: true; port?: number };
   /**
-   * Outbound HTTP(S) proxy URL for provider requests (e.g. "http://user:pass@proxy:8080", or
-   * "${HTTPS_PROXY}"-style env reference). Mirrored into HTTP_PROXY/HTTPS_PROXY at startup when
-   * those are unset — Bun's fetch honors them for all outbound calls; localhost is excluded.
+   * Outbound proxy URL for provider requests. HTTP(S) example: "http://user:pass@proxy:8080"
+   * or "${HTTPS_PROXY}". SOCKS5 example: "socks5://127.0.0.1:10808" (`ocx start --socks5`).
+   * HTTP URLs are mirrored into HTTP_PROXY/HTTPS_PROXY when unset. SOCKS5 URLs are mirrored
+   * into ALL_PROXY, clear inherited HTTP(S)_PROXY, and use OpenCodex's SOCKS5 transport.
+   * Loopback stays in NO_PROXY.
    * The literal `"auto"` reads the Windows WinINET static proxy (`ProxyEnable`/`ProxyServer`)
    * once at process start; on other platforms, or when the system proxy is off, SOCKS-only,
    * or unreadable, it degrades to direct egress with one log line (#1525). PAC/WPAD and live
@@ -778,6 +805,20 @@ export interface OcxConfig {
    * built-in `openai` provider, so Codex does not select native remote compaction. Default off.
    */
   codexClientCompaction?: boolean;
+  /**
+   * Label Codex shows for the injected `opencodex` provider. Defaults to `OpenCodex Proxy`.
+   *
+   * Presentation only. Routing is keyed on the provider id `opencodex` — the root
+   * `model_provider = "opencodex"` line and the `[model_providers.opencodex]` header — and this
+   * setting never touches either, so renaming the label cannot reroute or orphan a thread whose
+   * row already names that id.
+   *
+   * There is no way to emit an empty label: Codex rejects a provider with no name, so a blank,
+   * over-long, or control-character value falls back to the default rather than writing a config
+   * Codex would refuse to load. "Suppressing" the OpenCodex branding therefore means choosing a
+   * neutral label, not removing the field.
+   */
+  codexProviderDisplayName?: string;
   /**
    * Compatibility mode: temporarily rewrite Codex resume-history metadata while the proxy is active
    * so Codex App can show old OpenAI chats and opencodex-created exec chats under its default
@@ -811,6 +852,16 @@ export interface OcxConfig {
    * absence is the only default state this policy has.
    */
   codexPool?: OcxCodexPoolConfig;
+  /**
+   * Durable token ceilings for the spend-reservation ledger (#4546). Absent means the
+   * historical behaviour exactly: token spend is still accounted and journalled, and nothing
+   * is refused on it.
+   *
+   * Not in `getDefaultConfig()` on purpose, and deliberately shipped with no default figure.
+   * The ledger is on by default, so a default ceiling would start refusing real traffic on
+   * upgrade against a number nobody chose.
+   */
+  spend?: OcxSpendConfig;
   /** Opt-in per-account activation of newly reset Codex quota windows. */
   codexQuotaAutoRefresh?: Record<string, {
     fiveHour?: boolean;
@@ -1385,3 +1436,49 @@ export interface OcxCatalogAutoRefreshConfig {
    */
   intervalMinutes?: number;
 }
+
+/**
+ * One scope's token ceiling.
+ *
+ * An object rather than a bare number because the ledger's scope limit is already a record in
+ * `SpendReservationPolicy`, and a config shape that mirrors the runtime one cannot drift from
+ * it silently. Absent `maxTokens` is the same as an absent scope: observe only.
+ */
+export interface OcxSpendScopeConfig {
+  /**
+   * Tokens the scope may hold at once, counting settled spend, open reservations and
+   * unresolved spend. A reservation is the request's whole input plus its enforceable output
+   * ceiling, so this is compared against a number that assumes every cached prefix misses.
+   *
+   * There is no default. A ceiling is a number only the operator knows -- it depends on the
+   * plan, the account roster and what the install is for -- and the recorded lesson from the
+   * observational phase of #4546 is that guessing one is worse than shipping none.
+   */
+  maxTokens?: number;
+}
+
+/**
+ * Durable spend ceilings (#4546).
+ *
+ * The three scopes intersect: a request is admitted only when its own root workflow, the
+ * identity that would serve it, and the pool it would draw from all have room. That is what
+ * makes the ceiling hold against a caller that mints a fresh root id per request -- the root
+ * is new, the identity and pool are not.
+ *
+ * Every field is optional and an empty section is the same as no section at all.
+ */
+export interface OcxSpendConfig {
+  /** Ceiling for one root workflow -- the user-visible task, including its whole fan-out. */
+  root?: OcxSpendScopeConfig;
+  /** Ceiling for one authenticated identity, across every root it serves. */
+  identity?: OcxSpendScopeConfig;
+  /** Ceiling for one account pool, across every identity in it. */
+  pool?: OcxSpendScopeConfig;
+  /**
+   * Days a dormant scope's accounting is retained. Default 7.
+   *
+   * A scope is dropped only when it is both idle and under its ceiling, so shortening this
+   * cannot hand an exhausted scope a fresh allowance.
+   */
+  retentionDays?: number;
+}

package/src/types/provider.ts

@@ -618,6 +618,8 @@ export interface OcxProviderConfig {
   reasoningEfforts?: string[];
   /** Model-specific Codex-visible reasoning tiers. An empty array means “do not expose effort”. */
   modelReasoningEfforts?: Record<string, string[]>;
+  /** Catalog-only: do not synthesize a missing max rung for matching routed models. */
+  modelSuppressSyntheticMax?: Record<string, boolean>;
   /** Model-specific default Codex reasoning tier; must also be present in the visible tier list. */
   modelDefaultReasoningEfforts?: Record<string, string>;
   /** Operator-owned effort override; none omits effort and uses the provider default. */
@@ -677,6 +679,23 @@ export interface OcxProviderConfig {
    * apply_patch passthrough compatibility for OpenAI and unclassified gateways.
    */
   supportsResponsesCustomTools?: boolean;
+  /**
+   * Hosted tool declarations this Responses destination rejects, so they are stripped from
+   * the request instead of being forwarded and 400'd.
+   *
+   * This is how an OpenAI-compatible gateway with a narrower capability set than OpenAI
+   * describes itself. Before it existed, a destination that accepted plain Responses and
+   * `function` tools but rejected hosted `web_search` could only be handled by adding a
+   * hard-coded baseUrl rule to `src/responses/hosted-tool-policy.ts`, so every such gateway
+   * needed a proxy release; a text-only prompt like "Reply exactly with OK" failed before
+   * the model answered because the hosted declaration travelled with it (#5002).
+   *
+   * Values come from `DECLARABLE_HOSTED_TOOL_TYPES`. Spelling variants of one capability
+   * are aliased, so `["web_search"]` also denies `web_search_preview`. Pair this with
+   * `supportsResponsesCustomTools: false` for a gateway that also rejects native custom
+   * tools; the two capabilities are independent and denied independently.
+   */
+  unsupportedHostedTools?: string[];
   /**
    * Provider-local repair for Responses gateways whose lifecycle snapshots omit canonical
    * fields or closing events (#893). Disabled by default and applied only to client-facing

package/src/types/request.ts

@@ -68,6 +68,12 @@ export interface OcxParsedRequest {
   _cursorConversationId?: string;
   /** Stable upstream client thread identity, used only to derive provider-scoped continuation ids. */
   _clientThreadId?: string;
+  /**
+   * This request's OWN Codex thread id (`thread-id`), as opposed to `_clientThreadId`, which
+   * carries `x-codex-parent-thread-id` and is therefore shared by every parallel child of one
+   * parent. Only a surface that must distinguish siblings should read it.
+   */
+  _codexOwnThreadId?: string;
   /** True when promptCacheKey identifies a shared cache cohort rather than one conversation. */
   _promptCacheKeyIsSharedCohort?: boolean;
   /** Cursor-only thread owner; may be an opaque process-local Desktop session/thread identity. */
@@ -312,7 +318,7 @@ export interface OcxProviderContinuationState {
 }
 
 export type AdapterEvent =
-  | { type: "heartbeat" }
+  | { type: "heartbeat"; replayUnsafe?: true }
   | { type: "text_delta"; text: string; phase?: OcxMessagePhase }
   | { type: "thinking_delta"; thinking: string }
   // Anthropic extended-thinking round-trip: signature_delta for the current thinking block, and

package/src/types/wire.ts

@@ -46,7 +46,15 @@ export const MODEL_ADAPTER_OVERRIDE_ALLOWED: ReadonlySet<string> = new Set([
  * Anthropic for these models.
  */
 const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
-  "opencode-go": new Set(["minimax-m2.5", "minimax-m2.7", "minimax-m3"]),
+  "opencode-go": new Set([
+    "minimax-m2.5",
+    "minimax-m2.7",
+    "minimax-m3",
+    // OpenCode's catalog identifies Union Alpha as @ai-sdk/anthropic while the
+    // provider defaults to OpenAI-compatible; direct Chat returns 500 and direct
+    // Messages reaches the session check (#4847).
+    "union-alpha",
+  ]),
 };
 
 function anthropicWireModelsForProvider(providerName: string): ReadonlySet<string> | undefined {

package/src/usage/expected-prices.ts

@@ -124,6 +124,16 @@ const META_MUSE_SPARK_13_CONTRIBUTOR: Cost4 = { input: 0.1, output: 0.2, cacheRe
 const META_SPARK_SOURCE = `Meta Model API published price ${META_MODEL_PRICING}`;
 const META_SPARK_CONTRIBUTOR_SOURCE = `Meta Model API published Contributor-tier price ${META_MODEL_PRICING}; data-sharing discount tier`;
 const DEEPSEEK_PRICING = "https://api-docs.deepseek.com/quick_start/pricing-details-usd; V4 Flash alias transition scheduled 2026-07-24 — re-verify after";
+/*
+ * DeepSeek V4.1-Flash list prices (USD / 1M tokens), verified 2026-09-17 against
+ * https://api-docs.deepseek.com/quick_start/pricing. The page prices a peak window
+ * (09:30-24:00 Beijing) and an off-peak window; the tuple below is the peak-window
+ * list rate and the off-peak discount (0.15 / 0.60, cache-hit 0.003) is deliberately
+ * not baked in — the same rule as the Devin time-boxed promos. cacheWrite=0 follows
+ * the existing deepseek-chat / deepseek-reasoner rows: DeepSeek publishes no
+ * cache-write charge.
+ */
+const DEEPSEEK_V41_FLASH: Cost4 = { input: 0.3, output: 1.2, cacheRead: 0.006, cacheWrite: 0 };
 // Kimi official tables publish input/output/cache-hit only; cacheWrite is mapped to the
 // cache-miss input price (Kimi auto-caches with no separate write billing). 2026-07-20 re-verified.
 const KIMI_PRICING = "https://platform.kimi.ai/docs/pricing (official table; cacheWrite derived = input, Kimi auto-cache has no write billing)";
@@ -142,6 +152,14 @@ const BIGMODEL_NOTE = "z.ai international list price shown as estimate; domestic
 // anywhere. Cache stays 0 rather than inheriting the reseller's 0.15 — a reseller number
 // under a vendor-price label would be a wrong value wearing a verified badge.
 const QWEN38_MAX_PRICING = "https://qwen.ai/blog?id=qwen3.8 (Qwen release announcement; no Model Studio billing row yet; cache rates unpublished -> 0)";
+// Qwen-published qwen3.8-flash rate ($0.16 in / $0.47 out per 1M tokens) via the
+// Qwen3.8 release announcement, corroborated by API-vendor price tables. No cache
+// rate is published anywhere, so cache stays 0 rather than borrowing a reseller's
+// number — the same hold QWEN38_MAX takes. The announcement marks API availability
+// as coming soon, but the id is already served (and logged) on OpenCode Go, so the
+// estimate applies to real usage rows now.
+const QWEN38_FLASH: Cost4 = { input: 0.16, output: 0.47, cacheRead: 0, cacheWrite: 0 };
+const QWEN38_FLASH_PRICING = "https://qwen.ai/blog?id=qwen3.8-2026 (Qwen release announcement; API marked coming soon at announcement; cache rates unpublished -> 0; input/output corroborated by https://docs.b.ai/guides/models/qwen/qwen3.8-flash)";
 
 /*
  * Cognition/Devin list prices (USD / 1M tokens), verified 2026-09-13 against the
@@ -289,6 +307,16 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // for what that source does and does not cover.
   { provider: "alibaba-token-plan", modelId: "qwen3.8-max", cost4: QWEN38_MAX, source: QWEN38_MAX_PRICING, verifiedAt: "2026-08-04", status: "verified" },
   { provider: "alibaba-token-plan-intl", modelId: "qwen3.8-max", cost4: QWEN38_MAX, source: QWEN38_MAX_PRICING, verifiedAt: "2026-08-04", status: "verified" },
+  // OpenCode Go — five served ids with no jawcode bundle row and no vendor-level
+  // fallback (the fallback only searches jawcode metadata, never overlays), so the
+  // Usage estimated-cost column and the per-model breakdown rendered an em dash for
+  // every request through them. Each row reuses the vendor's own published list
+  // price as an estimate: Go itself is subscription-billed, hence verified-derived.
+  { provider: "opencode-go", modelId: "qwen3.8-max", cost4: QWEN38_MAX, source: `vendor list price applied to the OpenCode Go surface; ${QWEN38_MAX_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "qwen3.8-flash", cost4: QWEN38_FLASH, source: `vendor list price applied to the OpenCode Go surface; ${QWEN38_FLASH_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "deepseek-v4.1-flash", cost4: DEEPSEEK_V41_FLASH, source: `peak-window list rate applied to the OpenCode Go surface (off-peak 0.15/0.60 + cache-hit 0.003 not baked in); ${DEEPSEEK_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "glm-5.3-flash", cost4: GLM_53_FLASH, source: `z.ai list price applied to the OpenCode Go surface as an estimate; ${ZAI_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "muse-spark-1.3-contributor", cost4: META_MUSE_SPARK_13_CONTRIBUTOR, source: `Meta Model API Contributor-tier price applied to the OpenCode Go surface as an estimate; ${META_SPARK_CONTRIBUTOR_SOURCE}`, verifiedAt: "2026-09-17", status: "verified-derived" },
   // Cursor Auto router — Cursor's published fixed token price (verified).
   { provider: "cursor", modelId: "auto", cost4: { input: 1.25, output: 6, cacheRead: 0.25, cacheWrite: 1.25 }, source: "https://docs.cursor.com/account/pricing + https://cursor.com/blog/aug-2025-pricing", verifiedAt: "2026-07-20", status: "verified" },
   // Z.AI GLM family — the zai bundle's rows are all-zero upstream, and the four

package/src/usage/log.ts

@@ -77,6 +77,26 @@ export type AttemptRecoveryKind =
   | "empty-completion"
   | "reasoning-effort-downgrade";
 
+/**
+ * Why a recovery this request was otherwise willing to make did not happen.
+ *
+ * Recorded separately from `recoveryKinds` and from `sendCount`, because the question it
+ * answers is different from either. A log showing one physical send and no recovery kind used
+ * to be ambiguous: it could mean nothing was eligible, or that something was eligible and the
+ * send budget withheld it. Those need opposite follow-ups, and the second one was invisible
+ * (#5044).
+ *
+ * `sendCount` deliberately does not move for these. A refused attempt is not a physical send,
+ * and inflating the count to signal the refusal would corrupt the one number that means
+ * "requests this proxy actually made".
+ *
+ * Bounded vocabulary on purpose: it is a wire value a maintainer reads, never a credential, an
+ * account id, an upstream body, prompt content, or exception text.
+ */
+export type AttemptRecoveryWithheld =
+  | "retry-send-budget"
+  | "rotation-send-budget";
+
 /** Request-time upstream credential class, never a credential or account identifier. */
 export type UsageCredentialSource = "grok-oauth" | "xai-api-key";
 
@@ -139,6 +159,11 @@ export interface PersistedUsageAttempt {
   firstOutputMs?: number;
   sendCount: number;
   recoveryKinds: AttemptRecoveryKind[];
+  /**
+   * Recoveries this attempt was eligible for and did not make. Absent on ordinary attempts so
+   * old rows keep their exact shape.
+   */
+  recoveryWithheld?: AttemptRecoveryWithheld[];
   usageStatus: UsageStatus;
   /**
    * True when the proxy answered this turn locally and issued no upstream request. It travels on
@@ -487,6 +512,10 @@ const ATTEMPT_RECOVERY_KINDS = new Set<AttemptRecoveryKind>([
   "empty-completion",
   "reasoning-effort-downgrade",
 ]);
+const ATTEMPT_RECOVERY_WITHHELD = new Set<AttemptRecoveryWithheld>([
+  "retry-send-budget",
+  "rotation-send-budget",
+]);
 const USAGE_STATUSES = new Set<UsageStatus>([
   "reported",
   "unreported",
@@ -620,6 +649,14 @@ function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
         && ATTEMPT_RECOVERY_KINDS.has(value as AttemptRecoveryKind),
     ))]
     : [];
+  // Same shape as `recoveryKinds`: unknown values are dropped rather than failing the row, so a
+  // log written by a newer build stays readable by an older one.
+  const recoveryWithheld = Array.isArray(attempt.recoveryWithheld)
+    ? [...new Set(attempt.recoveryWithheld.filter(
+      (value): value is AttemptRecoveryWithheld => typeof value === "string"
+        && ATTEMPT_RECOVERY_WITHHELD.has(value as AttemptRecoveryWithheld),
+    ))]
+    : [];
   return {
     ordinal: attempt.ordinal as number,
     provider: attempt.provider,
@@ -639,6 +676,7 @@ function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
       : {}),
     sendCount: attempt.sendCount as number,
     recoveryKinds,
+    ...(recoveryWithheld.length ? { recoveryWithheld } : {}),
     usageStatus: attempt.usageStatus as UsageStatus,
     ...(isCodexUsageAccountLogLabel(attempt.accountLogLabel)
       ? { accountLogLabel: attempt.accountLogLabel }
@@ -852,18 +890,61 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
   };
 }
 
-function ensureUsageLogDir(): void {
+// Bound hot-path filesystem hardening to once per second while ensuring an external mode
+// widening cannot suppress write-triggered repair for the lifetime of the process.
+const USAGE_LOG_PERMISSION_RECHECK_MS = 1_000;
+
+type UsageLogPermissionCheck = {
+  path: string;
+  checkedAt: number;
+};
+
+let ensuredUsageLogDir: UsageLogPermissionCheck | null = null;
+let ensuredUsageLogFile: UsageLogPermissionCheck | null = null;
+
+function usageLogPermissionCheckIsCurrent(
+  check: UsageLogPermissionCheck | null,
+  path: string,
+  now: number,
+): boolean {
+  return check?.path === path
+    && now >= check.checkedAt
+    && now - check.checkedAt < USAGE_LOG_PERMISSION_RECHECK_MS;
+}
+
+function ensureUsageLogDir(now: number): void {
   const dir = getConfigDir();
+  if (usageLogPermissionCheckIsCurrent(ensuredUsageLogDir, dir, now)) return;
   recordOwnedConfigPath(dir, usageLogPath());
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   try { chmodSync(dir, 0o700); } catch { /* best-effort on platforms that ignore chmod */ }
+  ensuredUsageLogDir = { path: dir, checkedAt: now };
 }
 
 export function appendUsageEntry(entry: PersistedUsageEntry): void {
-  ensureUsageLogDir();
+  const line = `${JSON.stringify(normalizeUsageEntry(entry))}\n`;
   const path = usageLogPath();
-  appendFileSync(path, `${JSON.stringify(normalizeUsageEntry(entry))}\n`, { encoding: "utf-8", mode: 0o600 });
-  try { chmodSync(path, 0o600); } catch { /* best-effort on platforms that ignore chmod */ }
+  const now = Date.now();
+  const doAppend = (): void => {
+    ensureUsageLogDir(now);
+    const filePermissionsCurrent = usageLogPermissionCheckIsCurrent(ensuredUsageLogFile, path, now);
+    appendFileSync(path, line, { encoding: "utf-8", mode: 0o600 });
+    if (!filePermissionsCurrent) {
+      try { chmodSync(path, 0o600); } catch { /* best-effort on platforms that ignore chmod */ }
+      ensuredUsageLogFile = { path, checkedAt: now };
+    }
+  };
+  try {
+    doAppend();
+  } catch (error: any) {
+    if (error?.code === "ENOENT") {
+      ensuredUsageLogDir = null;
+      ensuredUsageLogFile = null;
+      doAppend();
+      return;
+    }
+    throw error;
+  }
 }
 
 export type UsageLogRevision = {
@@ -1057,6 +1138,8 @@ export function resetUsageReadCacheForTests(): void {
   managementUsageReadInflight?.abort.abort();
   managementUsageReadInflight = null;
   retainedUsageSnapshot = null;
+  ensuredUsageLogDir = null;
+  ensuredUsageLogFile = null;
 }
 
 function readExactly(fd: number, length: number, position: number): Buffer | null {

package/src/web-search/passthrough-bridge.ts

@@ -75,6 +75,7 @@ import {
 } from "./sidecar-providers";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
+import { rememberBridgeSearchReplay } from "../responses/bridge-search-replay-cache";
 
 /** Canonical Ollama Cloud origin. The only origin the "ollama" backend derives on its own. */
 export const OLLAMA_CLOUD_ORIGIN = "https://ollama.com";
@@ -377,11 +378,18 @@ export interface PassthroughWebSearchBridgeStreamOptions {
   /** Sends one continuation leg and resolves with its response. */
   send: (body: string) => Promise<Response>;
   execute: PassthroughWebSearchBridgeExecutor;
+  /**
+   * Destination identity for the executed-search memo (#4587). When absent nothing is recorded,
+   * and the next turn replays the hosted cell exactly as it does today.
+   */
+  destinationScope?: string;
   /**
    * Re-applies the caller's outbound body ceiling to a continuation body. Returns a refusal
    * message when the extended body may not be sent, or undefined when it is admitted.
    */
   checkOutboundBody?: (body: string) => string | undefined;
+  /** Releases request-scoped resources when the stream completes, fails, or is cancelled. */
+  onFinalize?: () => void;
   signal?: AbortSignal;
 }
 
@@ -1094,11 +1102,22 @@ async function* bridgeStreamBlocks(
         outcome = await options.execute(queries, options.signal);
       }
       yield* emit(state.searchEndFrames(call, queries, outcome));
-      turns.push({
-        call,
-        // The model needs a readable result either way; an executor error is reported as the
-        // tool result rather than as a turn failure, so it can still answer without the search.
-        output: outcome.error ? "Web search failed: " + outcome.error : outcome.text,
+      // The model needs a readable result either way; an executor error is reported as the
+      // tool result rather than as a turn failure, so it can still answer without the search.
+      const output = outcome.error ? "Web search failed: " + outcome.error : outcome.text;
+      turns.push({ call, output });
+      // Record what a continuation leg WOULD put on the wire, whether or not this leg sends one
+      // (#4587). The caller keeps the hosted cell and replays it next turn; the pre-dispatch
+      // rewrite in the Responses adapter uses this to hand the destination back its own call and
+      // result instead of an item type it never produced. Recording the same text that
+      // appendBridgeSearchTurn would append is what keeps a replayed turn and a continued turn
+      // showing the destination one consistent conversation.
+      rememberBridgeSearchReplay(options.destinationScope, call.cellItemId, {
+        callId: call.callId,
+        sourceItemId: call.sourceItemId,
+        name: WEB_SEARCH_TOOL_NAME,
+        argumentsText: call.argumentsText,
+        output,
       });
     }
 
@@ -1170,21 +1189,36 @@ export function createPassthroughWebSearchBridgeStream(
   const aborted = (): boolean => cancelled || options.signal?.aborted === true;
   const iterator = bridgeStreamBlocks(options, aborted)[Symbol.asyncIterator]();
   const encoder = new TextEncoder();
+  let finalized = false;
+  const finalize = (): void => {
+    if (finalized) return;
+    finalized = true;
+    options.onFinalize?.();
+  };
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
         const next = await iterator.next();
         if (next.done) {
+          finalize();
           controller.close();
           return;
         }
         controller.enqueue(encoder.encode(next.value));
       } catch (error) {
+        finalize();
         controller.error(error);
       }
     },
     cancel(reason) {
       cancelled = true;
+      // Release request-scoped authority immediately. An async generator cannot
+      // process a queued return() while its active next() is blocked on an
+      // upstream read, so deferring finalize until that settles would hold the
+      // sidecar probe lease for as long as the abandoned upstream leg does.
+      // Optional chaining would also skip finalize entirely for an iterator
+      // with no return method.
+      finalize();
       void iterator.return?.(reason);
     },
   });