@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/server/responses/adapter-dispatch.ts

@@ -25,6 +25,7 @@ import {
   hasKeyPoolFailover,
   rotateProviderTransportOn401,
   rateLimitRetryDelayMs,
+  readQuotaResetAt,
   rotateProviderTransportOn429,
 } from "../../providers/key-failover";
 import {
@@ -127,6 +128,7 @@ export async function prepareAdapterExchange(
     ResponsesSendBudget,
     | "adapterDispatchBudget"
     | "noteAdapterPhysicalSend"
+    | "noteAdapterRecoveryWithheld"
     | "remainingTransientSendBudget"
     | "noteTransientSends"
     | "recoverySendAllowance"
@@ -160,6 +162,7 @@ export async function prepareAdapterExchange(
   const {
     adapterDispatchBudget,
     noteAdapterPhysicalSend,
+    noteAdapterRecoveryWithheld,
     remainingTransientSendBudget,
     noteTransientSends,
     recoverySendAllowance,
@@ -243,7 +246,11 @@ export async function prepareAdapterExchange(
     return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } });
   }
   try {
-    initialRequest = await transportState.activeAdapter.buildRequest(parsed, { headers: requestState.selectedForwardHeaders, translatorBudget });
+    initialRequest = await transportState.activeAdapter.buildRequest(parsed, {
+      headers: requestState.selectedForwardHeaders,
+      translatorBudget,
+      abortSignal: upstream.signal,
+    });
     refreshRequestToolAliases(initialRequest);
     recordAdapterReasoning(logCtx, initialRequest);
     recordAdapterTier(logCtx, initialRequest);
@@ -286,6 +293,7 @@ export async function prepareAdapterExchange(
         timeoutMs: connectMs,
         sendBudget: adapterDispatchBudget,
         onPhysicalSend: send => noteAdapterPhysicalSend(inputTokenEstimate, send),
+        onRecoveryWithheld: noteAdapterRecoveryWithheld,
         stream: parsed.stream,
         executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
               pacingSlotAcquired: true,
@@ -401,6 +409,7 @@ export async function prepareAdapterExchange(
           retryRequest = await transportState.activeAdapter.buildRequest(parsed, {
             headers: requestState.selectedForwardHeaders,
             translatorBudget,
+            abortSignal: upstream.signal,
             ...(transportState.imageTierBias > 0 ? { imageTierBias: transportState.imageTierBias } : {}),
           });
           recordAdapterReasoning(logCtx, retryRequest);
@@ -442,6 +451,7 @@ export async function prepareAdapterExchange(
               timeoutMs: connectMs,
             sendBudget: adapterDispatchBudget,
               onPhysicalSend: send => noteAdapterPhysicalSend(retryEstimate, send),
+              onRecoveryWithheld: noteAdapterRecoveryWithheld,
               stream: parsed.stream,
               executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
                 pacingSlotAcquired: true,
@@ -525,17 +535,17 @@ export async function prepareAdapterExchange(
         return { failed: formatErrorResponse(502, "upstream_error", msg) };
       }
     };
-    // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
-    recovery: for (;;) {
+   // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
+   recovery: for (;;) {
       // Preserve the terminal verdict through adapter and combo error formatting.
       // This also covers a reset reached by a 401/429/413 recovery refetch.
       if (isNonReplayableResponse(upstreamResponse)) {
         cleanupUpstreamAbort();
         return upstreamResponse;
       }
-      if (
-        upstreamResponse.status === 401
-        && isOAuth401ReplayProvider
+     if (
+       upstreamResponse.status === 401
+       && isOAuth401ReplayProvider
         && transportState.sentOAuthSnapshot
         && !oauth401ReplayAttempted
         && !sendBudgetExhausted()
@@ -576,7 +586,7 @@ export async function prepareAdapterExchange(
         route.provider = refreshedProvider;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider, inboundWire),
+          resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider, inboundWire, route.staticPolicy),
           config.cacheRetention,
         );
         bindRouteReasoningReplayScope({
@@ -609,7 +619,7 @@ export async function prepareAdapterExchange(
         route.provider = rotated;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
           config.cacheRetention,
         );
         bindRouteReasoningReplayScope({
@@ -618,15 +628,15 @@ export async function prepareAdapterExchange(
           provider: route.provider,
           adapterName: transportState.activeAdapter.name,
         });
-        const result = await rebuildAndRefetch("key-401");
-        if ("failed" in result) return result.failed;
-        upstreamResponse = result;
+       const result = await rebuildAndRefetch("key-401");
+       if ("failed" in result) return result.failed;
+       upstreamResponse = result;
         // A recovery refetch can itself die on an ambiguous pre-header reset, and the refusal
         // that answers it is a 429. Every arm below keys on 429, so letting it fall through
         // hands the marked refusal to the next waiting arm and replays the send it exists to
         // stop. Re-enter the loop guard instead, which returns it unchanged.
         if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-      }
+     }
 
       // Same-target 429 wait-and-retry (opt-in `retryOn429`, issue #487). Codex never retries
       // 429 itself (it retries 5xx only), and single-key pools cannot use the failover below,
@@ -663,23 +673,44 @@ export async function prepareAdapterExchange(
           upstream.abort();
           return clientCancelledResponse();
         }
-        const result = await rebuildAndRefetch("rate-limit-429");
-        if ("failed" in result) return result.failed;
-        upstreamResponse = result;
+       const result = await rebuildAndRefetch("rate-limit-429");
+       if ("failed" in result) return result.failed;
+       upstreamResponse = result;
         // The refusal is a 429 too: without this the while condition is still true and the
         // next configured attempt replays it on the same target.
         if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-      }
+     }
 
       // Multi-key 429 failover: rotate to the next pool key (cooldown-aware) and retry the
       // SAME request once per remaining key. OAuth/forward providers and single-key pools
       // return null immediately, so this stays a no-op for them (src/providers/key-failover.ts).
       while (upstreamResponse.status === 429 && hasKeyPoolFailover(route.provider)) {
+        // A quota exhaustion is dated in the BODY, not in `Retry-After` — OpenRouter
+        // sends no header for it (#4024). Read a bounded prefix before the socket is
+        // released below; a failed or slow read just leaves the header path in charge.
+        // Peeks a bounded prefix and hands back a Response still carrying the whole
+        // body, so the cancel below still releases the socket.
+        let peeked: Awaited<ReturnType<typeof readQuotaResetAt>>;
+        try {
+          peeked = await readQuotaResetAt(upstreamResponse, { signal: options.abortSignal });
+        } catch {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          return clientCancelledResponse();
+        }
+        if (options.abortSignal?.aborted) {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          return clientCancelledResponse();
+        }
+        upstreamResponse = peeked.response;
+        const quotaResetAt = peeked.at;
         const rotated = rotateProviderTransportOn429(config, route.providerName, route.provider, {
           retryAfter: upstreamResponse.headers.get("retry-after"),
           now: Date.now(),
           attemptedKey: route.provider.apiKey,
           promptCacheKey: parsed.options.promptCacheKey,
+          quotaResetAt,
         });
         if (!rotated) break;
         // Release the failed response's socket before retrying; unread bodies otherwise linger
@@ -688,7 +719,7 @@ export async function prepareAdapterExchange(
         route.provider = rotated;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
           config.cacheRetention,
         );
         bindRouteReasoningReplayScope({
@@ -697,13 +728,13 @@ export async function prepareAdapterExchange(
           provider: route.provider,
           adapterName: transportState.activeAdapter.name,
         });
-        const result = await rebuildAndRefetch("key-429");
-        if ("failed" in result) return result.failed;
-        upstreamResponse = result;
+       const result = await rebuildAndRefetch("key-429");
+       if ("failed" in result) return result.failed;
+       upstreamResponse = result;
         // Rotating on the refusal would also write a cooldown against a key that rate-limited
         // nothing, which outlives the request.
         if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-      }
+     }
 
       // Opt-in Anthropic OAuth account pool (#294): cool the failed account and retry
       // with another eligible OAuth account (bounded per request). Disabled by default.
@@ -731,16 +762,16 @@ export async function prepareAdapterExchange(
           invalidateSameTargetRequest();
           logCtx.provider = formatAnthropicProviderForLog("anthropic", admitted.accountId, config);
           transportState.activeAdapter = resolveSelectionAdapter(
-            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
           recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
-          const result = await rebuildAndRefetch("anthropic-oauth-429");
-          if ("failed" in result) return result.failed;
-          upstreamResponse = result;
+         const result = await rebuildAndRefetch("anthropic-oauth-429");
+         if ("failed" in result) return result.failed;
+         upstreamResponse = result;
           if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-        } catch {
+       } catch {
           break;
         }
       }
@@ -786,6 +817,8 @@ export async function prepareAdapterExchange(
           route.providerName,
           transportState.genericFailoverAccountId,
           upstreamResponse.headers.get("retry-after"),
+          Date.now(),
+          route.modelId,
         );
         if (!nextAccountId) {
           hop.permit?.release();
@@ -804,7 +837,7 @@ export async function prepareAdapterExchange(
           }
           invalidateSameTargetRequest();
           transportState.activeAdapter = resolveSelectionAdapter(
-            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
@@ -832,12 +865,12 @@ export async function prepareAdapterExchange(
             hop.permit?.release();
             return result.failed;
           }
-          upstreamResponse = result;
+         upstreamResponse = result;
           // The hop's permit is already settled by the dispatch boundary above; continuing
           // only skips the remaining arms, it does not abandon a reservation.
           if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-        } catch {
-          // A throw before the send — snapshot fetch, credential application, adapter
+       } catch {
+         // A throw before the send — snapshot fetch, credential application, adapter
           // resolution — must hand the reservation back. Without this the ladder charges the
           // request for a send it never made, and a later recovery in the same request is
           // refused on an allowance nothing spent. release() is idempotent and a no-op once

package/src/server/responses/compact.ts

@@ -10,6 +10,7 @@ import { parseRequest } from "../../responses/parser";
 import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractCompactUserMessages } from "../../responses/compaction";
 import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../../adapters/openai-responses";
 import { expandPreviousResponseInput, previousResponseProviderState, rememberResponseState } from "../../responses/state";
+import { repairLegacyDottedToolCallNames } from "../../responses/legacy-dotted-tool-name-repair";
 import { NoEligiblePolicyCandidateError, routeCompactionModel } from "../../router";
 import { evidenceFromBody } from "../../routing/request-evidence";
 import {
@@ -107,6 +108,7 @@ import {
 } from "../../codex/upstream-host-health";
 import {
   ForwardAdmissionCredentialError,
+  contextPrincipalIdOf,
   hasForwardableCodexBearer,
   validateForwardAdmissionCredential,
 } from "../auth-cors";
@@ -114,12 +116,21 @@ import type { DataPlaneAdmission } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
-import { isCodexReserveRequestEligible } from "../../codex/loopback-target";
+import {
+  isCodexReserveOptInMissing,
+  isCodexReserveRequestEligible,
+  CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE,
+} from "../../codex/loopback-target";
 import { slugsEquivalent } from "../../providers/slug-codec";
 import { decideTier, tierValueAfterDecision } from "../../providers/fastwire";
 import { fastPolicyForModel } from "../../providers/service-tier";
 import { parseFastOnlyRowId } from "../fast-row";
-import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
+import { captureOpenAiVirtualWirePolicy, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
+import {
+  applyCompactionRoutingOverride,
+  compactionRoutingKeepsProviderIdentity,
+  type CompactionRoutingOverride,
+} from "./compaction-routing";
 import { isUsageDebugEnabled } from "../../usage/debug";
 import {
   readJsonRequestBody,
@@ -210,8 +221,33 @@ function pruneCompactHandoffRoutes(now: number): void {
   }
 }
 
-function rememberCompactHandoffRoute(req: Request, model: string, now = Date.now()): void {
-  const key = sessionLaneIdFromRequest(req.headers);
+/**
+ * The handoff map is process-global, so a caller-controlled lane header alone
+ * cannot be the key: two authenticated clients sending the same lane header
+ * would share one fallback route. Namespace the lane by the admitted principal.
+ * A loopback or missing admission has no authenticated identity to bind this
+ * cross-request state to, so it is ineligible rather than trusted.
+ */
+function compactHandoffRouteKey(req: Request, admission: DataPlaneAdmission | undefined): string | null {
+  const lane = sessionLaneIdFromRequest(req.headers);
+  if (!lane || !admission || admission.kind === "loopback") return null;
+  // Fail closed rather than substituting a weaker identity. `keyId` survives a
+  // rotation and every identity-less environment admission would collapse into
+  // one bucket, which is the collision this key exists to prevent. Production
+  // admission always mints `contextPrincipalId` for configured and environment
+  // holders, so no real authenticated caller loses the route.
+  const principal = contextPrincipalIdOf(admission);
+  if (!principal) return null;
+  return `${principal}\u0000${lane}`;
+}
+
+function rememberCompactHandoffRoute(
+  req: Request,
+  admission: DataPlaneAdmission | undefined,
+  model: string,
+  now = Date.now(),
+): void {
+  const key = compactHandoffRouteKey(req, admission);
   if (!key || model.length > COMPACT_HANDOFF_MODEL_MAX_LENGTH) return;
   pruneCompactHandoffRoutes(now);
   compactHandoffRoutes.delete(key);
@@ -219,13 +255,18 @@ function rememberCompactHandoffRoute(req: Request, model: string, now = Date.now
   pruneCompactHandoffRoutes(now);
 }
 
-function forgetCompactHandoffRoute(req: Request): void {
-  const key = sessionLaneIdFromRequest(req.headers);
+function forgetCompactHandoffRoute(req: Request, admission?: DataPlaneAdmission): void {
+  const key = compactHandoffRouteKey(req, admission);
   if (key) compactHandoffRoutes.delete(key);
 }
 
-function compactHandoffRoute(req: Request, previousModel: string, now = Date.now()): string | null {
-  const key = sessionLaneIdFromRequest(req.headers);
+function compactHandoffRoute(
+  req: Request,
+  admission: DataPlaneAdmission | undefined,
+  previousModel: string,
+  now = Date.now(),
+): string | null {
+  const key = compactHandoffRouteKey(req, admission);
   if (!key) return null;
   pruneCompactHandoffRoutes(now);
   const entry = compactHandoffRoutes.get(key);
@@ -236,6 +277,7 @@ function compactHandoffRoute(req: Request, previousModel: string, now = Date.now
 }
 
 export interface HandleResponsesCompactOptions {
+  compactionRoutingOverride?: CompactionRoutingOverride | null;
   nativeMainRefreshDependencies?: NativeMainRefreshDependencies;
   /** Release the listener's idle guard only after the complete request body is accepted. */
   onRequestBodyRead?: () => void;
@@ -568,6 +610,9 @@ export async function handleResponsesCompact(
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     return formatErrorResponse(400, "invalid_request_error", "Invalid compaction request body");
   }
+  if (!options.compactionRoutingOverride) {
+    options = { ...options, compactionRoutingOverride: applyCompactionRoutingOverride(body, req.headers, config, { endpoint: "compact" }) };
+  }
   const raw = body as { model?: unknown; input?: unknown };
   if (typeof raw.model !== "string" || raw.model.length === 0) {
     return formatErrorResponse(400, "invalid_request_error", "compaction request requires a model");
@@ -582,11 +627,12 @@ export async function handleResponsesCompact(
   // The client's own selector, kept for the request log: `raw.model` is rewritten to the
   // base id above, and logCtx.requestedModel is assigned from it further down, so without
   // this the log would lose which id the client actually asked for.
-  const compactRequestedModel = compactFastRow ? compactFastRow.baseId + "--fast" : raw.model;
+  const compactRequestedModel = options.compactionRoutingOverride?.sourceModel
+    ?? (compactFastRow ? compactFastRow.baseId + "--fast" : raw.model);
 
   // Recall the last completed client-visible bare model after a combo switch (#3891).
   // Configured selectors take precedence over this implicit session hint.
-  if (typeof compactModel === "string" && !compactModel.includes("/") && !compactFastRow
+  if (!options.compactionRoutingOverride && typeof compactModel === "string" && !compactModel.includes("/") && !compactFastRow
     && !resolveComboId(config, compactModel)) {
     const recalledComboId = recallComboForLane(config, sessionLaneIdFromRequest(req.headers), compactModel);
     if (recalledComboId) {
@@ -632,9 +678,24 @@ export async function handleResponsesCompact(
     ? `${route.providerName}-${route.codexAccountNamespace}`
     : route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
+  // #4940, and the same refusal the ordinary Responses path makes in request-prepare.ts. Compact has
+  // to repeat it rather than inherit it: the native branch below dispatches straight to
+  // `/responses/compact` and only the routed fallback replays through handleResponses, so relying on
+  // that one seam would leave the native compact turn forwarding a Reserve model the opt-in has made
+  // unservable. Composed from the same three facts, in the same order, as `customReserveForward`
+  // further down, and placed before the virtual-model rewrite so it reads the model the caller
+  // actually selected -- and before auth, host-circuit admission, or any upstream byte.
+  //
+  // No terminal-helper or inbound-wire qualifier is needed here the way it is on the ordinary path:
+  // this endpoint is the native Codex compaction wire, and a vision/search helper never reaches it.
+  if (isCodexReserveOptInMissing(config, selectedModelId, admission)
+    && isCanonicalOpenAiForwardProvider(route.provider)) {
+    return formatErrorResponse(400, "invalid_request_error", CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE);
+  }
   const virtual = resolveOpenAiCompactModel(route.providerName, selectedModelId);
   if (virtual) {
     route.modelId = virtual.wireModelId;
+    captureOpenAiVirtualWirePolicy(route, virtual);
     logCtx.model = virtual.selectedModelId;
     logCtx.resolvedModel = virtual.wireModelId;
   } else {
@@ -698,7 +759,12 @@ export async function handleResponsesCompact(
   // no budget at all, so `handleResponsesInner` minted a fresh four after the native attempt
   // had already spent some of the first one.
   const sendBudget: RequestExecutionBudget = options.sendBudget ?? createRequestExecutionBudget();
-  if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider) && !accountGatedCompactWireModel && !route.combo) {
+  // A manual override onto another backend must not mint ciphertext the conversation model cannot replay.
+  const manualOverrideCrossesProvider = options.compactionRoutingOverride
+    ? !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route)
+    : false;
+  if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider) && !accountGatedCompactWireModel && !route.combo
+    && !manualOverrideCrossesProvider) {
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
     }
@@ -796,7 +862,12 @@ export async function handleResponsesCompact(
     // The regular /v1/responses path applies sanitizeReasoningInputContent via the adapter's
     // buildRequest, but the compact endpoint forwards directly. Apply the same sanitizer here
     // so routed-model reasoning items (reasoning_text content) don't 400 the ChatGPT backend.
-    const compactBody = sanitizeReasoningInputContent(compactBodyRaw) as typeof compactBodyRaw;
+    // #5095: the compact endpoint forwards `raw` directly, so it needs the same legacy dotted
+    // call-name repair the adapter applies. A damaged item here refuses the compaction itself,
+    // which is the request a long task depends on to keep going.
+    const compactBody = repairLegacyDottedToolCallNames(
+      sanitizeReasoningInputContent(compactBodyRaw),
+    ) as typeof compactBodyRaw;
     {
       const binding = conversationStateBindingFromAuth(authCtx, codexPoolAffinityKey(req.headers));
       if (binding) {
@@ -1254,10 +1325,10 @@ export async function handleResponsesCompact(
     // synthetic buffer errors are not upstream bodies and stay uninspected.
     if (buffered.ok) {
       inspectResponseLogJson(logCtx, await buffered.clone().text());
-      forgetCompactHandoffRoute(req);
+      if (!options.compactionRoutingOverride) forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
-    } else if (quotaFailure && !storedPool401ReplayAttempted) {
-      const fallbackModel = compactHandoffRoute(req, raw.model);
+    } else if (!options.compactionRoutingOverride && quotaFailure && !storedPool401ReplayAttempted) {
+      const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {
           method: "POST",
@@ -1319,7 +1390,7 @@ export async function handleResponsesCompact(
   // The routed compaction turn is a handoff inside the same logical request, so it draws the
   // REMAINDER. Minting here is what let a native attempt spend three sends and the routed
   // fallback spend four more.
-  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, ...(admission ? { admission } : {}) });
+  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRoutingOverride: options.compactionRoutingOverride, ...(admission ? { admission } : {}) });
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };
   if (response.headers.get("content-type")?.includes("text/event-stream")) {
@@ -1389,7 +1460,7 @@ export async function handleResponsesCompact(
     const result = new Response(JSON.stringify({ output: compactionItems }), {
       headers: { "Content-Type": "application/json" },
     });
-    rememberCompactHandoffRoute(req, raw.model);
+    if (!options.compactionRoutingOverride) rememberCompactHandoffRoute(req, admission, raw.model);
     return result;
   }
   const encrypted = compactionItems[0]!.encrypted_content;
@@ -1400,6 +1471,6 @@ export async function handleResponsesCompact(
   }
   const summary = decoded;
   const output = buildCompactV1Output(extractCompactUserMessages(inputItems), summary);
-  rememberCompactHandoffRoute(req, raw.model);
+  if (!options.compactionRoutingOverride) rememberCompactHandoffRoute(req, admission, raw.model);
   return new Response(JSON.stringify({ output }), { headers: { "Content-Type": "application/json" } });
 }

package/src/server/responses/compaction-routing.ts

@@ -0,0 +1,111 @@
+import type { OcxConfig } from "../../types";
+import { isDeclaredReasoningEffort } from "../../reasoning-effort";
+import { COMPACTION_TRIGGERS } from "../../config/schema/compaction-triggers";
+import { routeConcreteModel, type RouteResult } from "../../router";
+import { resolveComboId } from "../../combos/identifiers";
+import { recallComboForLane } from "./combo-session-recall";
+import { sessionLaneIdFromRequest } from "../request-log-conversation";
+
+/** `sourceModel` is the conversation's own selector before the rewrite. */
+export interface CompactionRoutingOverride {
+  sourceModel: string;
+  /** Combo the lane remembers for a bare `sourceModel` (#3891); the conversation resumes there, not on the bare route. */
+  sourceCombo?: string;
+  /** Combo the configured override resolves to; its children route concretely but stay portable. */
+  targetCombo?: string;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+}
+
+/**
+ * Triggers this override covers. Absent means manual only, which is the narrowest
+ * reading of the setting and leaves automatic compaction exactly as it routes today.
+ * A hand-edited value the schema would have rejected disables the override rather
+ * than widening it, so a malformed edit can never route more than it names.
+ */
+function configuredTriggers(value: unknown): readonly string[] | null {
+  if (value === undefined) return ["manual"];
+  if (!Array.isArray(value) || value.length === 0) return null;
+  if (!value.every(entry => typeof entry === "string" && (COMPACTION_TRIGGERS as readonly string[]).includes(entry))) return null;
+  if (new Set(value).size !== value.length) return null;
+  return value as readonly string[];
+}
+
+export interface CompactionRoutingOverrideOptions {
+  /** `responses` requires a `compaction_trigger` input item; the native compact endpoint carries none. */
+  endpoint?: "responses" | "compact";
+  transport?: "websocket";
+}
+
+export function applyCompactionRoutingOverride(
+  body: unknown,
+  headers: Headers,
+  config: OcxConfig,
+  options: CompactionRoutingOverrideOptions = {},
+): CompactionRoutingOverride | null {
+  const override = config.compactionRouting;
+  const raw = record(body);
+  if (!raw || typeof raw.model !== "string" || !raw.model.trim()
+    || typeof override?.model !== "string" || !override.model.trim()) return null;
+  if (override.reasoningEffort !== undefined
+    && (typeof override.reasoningEffort !== "string" || !isDeclaredReasoningEffort(override.reasoningEffort))) return null;
+  const triggers = configuredTriggers(override.triggers);
+  if (!triggers) return null;
+  if (options.endpoint !== "compact"
+    && !(Array.isArray(raw.input) && raw.input.some(item => record(item)?.type === "compaction_trigger"))) return null;
+
+  const metadata: unknown[] = [];
+  const header = headers.get("x-codex-turn-metadata");
+  if (options.transport !== "websocket" && header !== null) metadata.push(header);
+  const client = record(raw.client_metadata);
+  if (client && Object.hasOwn(client, "x-codex-turn-metadata")) metadata.push(client["x-codex-turn-metadata"]);
+  if (metadata.length === 0) return null;
+  let trigger: string | undefined;
+  for (const value of metadata) {
+    if (typeof value !== "string") return null;
+    try {
+      const parsed = record(JSON.parse(value));
+      if (parsed?.request_kind !== "compaction") return null;
+      const carried = record(parsed.compaction)?.trigger;
+      if (typeof carried !== "string" || !triggers.includes(carried)) return null;
+      // Copies that name different triggers are not agreement, and picking either one would
+      // let a caller widen an override by disagreeing with itself.
+      if (trigger !== undefined && trigger !== carried) return null;
+      trigger = carried;
+    } catch {
+      return null;
+    }
+  }
+  if (trigger === undefined) return null;
+
+  const sourceModel = raw.model;
+  const sourceCombo = recallComboForLane(config, sessionLaneIdFromRequest(headers), sourceModel);
+  const targetCombo = resolveComboId(config, override.model.trim()) ?? undefined;
+  raw.model = override.model.trim();
+  if (override.reasoningEffort !== undefined) {
+    raw.reasoning = { ...record(raw.reasoning), effort: override.reasoningEffort };
+  }
+  return { sourceModel, ...(sourceCombo ? { sourceCombo } : {}), ...(targetCombo ? { targetCombo } : {}) };
+}
+
+/** Same provider identity keeps caller auth and may use native compact; its ciphertext replays only there. */
+export function compactionRoutingKeepsProviderIdentity(
+  config: OcxConfig,
+  override: CompactionRoutingOverride,
+  route: RouteResult,
+): boolean {
+  if (route.combo || override.sourceCombo || override.targetCombo || resolveComboId(config, override.sourceModel)) return false;
+  let source: RouteResult;
+  try {
+    source = routeConcreteModel(config, override.sourceModel);
+  } catch {
+    return false;
+  }
+  return source.providerName === route.providerName
+    && source.codexAccountMode === route.codexAccountMode
+    && source.codexAccountNamespace === route.codexAccountNamespace;
+}