@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/server/responses/compact.ts

@@ -1,4 +1,10 @@
 import { capturePoolQuotaWriter } from "../../codex/account-store";
+import {
+  admissionModelDeniedResponse,
+  AdmissionModelDeniedError,
+  assertRouteAllowedByScope,
+  resolveAdmissionModelScope,
+} from "../admission-model-scope";
 import type { Server } from "bun";
 import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type ResponsesTerminalStatus } from "../../bridge";
 import {
@@ -10,6 +16,7 @@ import { parseRequest } from "../../responses/parser";
 import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractCompactUserMessages } from "../../responses/compaction";
 import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../../adapters/openai-responses";
 import { expandPreviousResponseInput, previousResponseProviderState, rememberResponseState } from "../../responses/state";
+import { repairLegacyDottedToolCallNames } from "../../responses/legacy-dotted-tool-name-repair";
 import { NoEligiblePolicyCandidateError, routeCompactionModel } from "../../router";
 import { evidenceFromBody } from "../../routing/request-evidence";
 import {
@@ -124,7 +131,12 @@ import { slugsEquivalent } from "../../providers/slug-codec";
 import { decideTier, tierValueAfterDecision } from "../../providers/fastwire";
 import { fastPolicyForModel } from "../../providers/service-tier";
 import { parseFastOnlyRowId } from "../fast-row";
-import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
+import { captureOpenAiVirtualWirePolicy, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
+import {
+  applyCompactionRoutingOverride,
+  compactionRoutingKeepsProviderIdentity,
+  type CompactionRoutingOverride,
+} from "./compaction-routing";
 import { isUsageDebugEnabled } from "../../usage/debug";
 import {
   readJsonRequestBody,
@@ -271,6 +283,7 @@ function compactHandoffRoute(
 }
 
 export interface HandleResponsesCompactOptions {
+  compactionRoutingOverride?: CompactionRoutingOverride | null;
   nativeMainRefreshDependencies?: NativeMainRefreshDependencies;
   /** Release the listener's idle guard only after the complete request body is accepted. */
   onRequestBodyRead?: () => void;
@@ -603,6 +616,9 @@ export async function handleResponsesCompact(
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     return formatErrorResponse(400, "invalid_request_error", "Invalid compaction request body");
   }
+  if (!options.compactionRoutingOverride) {
+    options = { ...options, compactionRoutingOverride: applyCompactionRoutingOverride(body, req.headers, config, { endpoint: "compact" }) };
+  }
   const raw = body as { model?: unknown; input?: unknown };
   if (typeof raw.model !== "string" || raw.model.length === 0) {
     return formatErrorResponse(400, "invalid_request_error", "compaction request requires a model");
@@ -617,11 +633,12 @@ export async function handleResponsesCompact(
   // The client's own selector, kept for the request log: `raw.model` is rewritten to the
   // base id above, and logCtx.requestedModel is assigned from it further down, so without
   // this the log would lose which id the client actually asked for.
-  const compactRequestedModel = compactFastRow ? compactFastRow.baseId + "--fast" : raw.model;
+  const compactRequestedModel = options.compactionRoutingOverride?.sourceModel
+    ?? (compactFastRow ? compactFastRow.baseId + "--fast" : raw.model);
 
   // Recall the last completed client-visible bare model after a combo switch (#3891).
   // Configured selectors take precedence over this implicit session hint.
-  if (typeof compactModel === "string" && !compactModel.includes("/") && !compactFastRow
+  if (!options.compactionRoutingOverride && typeof compactModel === "string" && !compactModel.includes("/") && !compactFastRow
     && !resolveComboId(config, compactModel)) {
     const recalledComboId = recallComboForLane(config, sessionLaneIdFromRequest(req.headers), compactModel);
     if (recalledComboId) {
@@ -644,7 +661,12 @@ export async function handleResponsesCompact(
     // routes ordinary turns elsewhere (#2901); the compaction-scoped router
     // may land that on the configured default provider instead of 404.
     route = routeCompactionModel(config, compactModel, evidenceFromBody(raw));
+    // A compaction override picks the model, not the caller, so the key's scope
+    // is applied to what the override resolved to rather than to the selector
+    // the client sent.
+    assertRouteAllowedByScope(resolveAdmissionModelScope(config, admission), compactRequestedModel, route);
   } catch (err) {
+    if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
     if (err instanceof NoEligiblePolicyCandidateError) {
       // Persist the evaluation trace (per-candidate exclusions + the
       // no-eligible reason) so a failed compact policy request stays
@@ -684,6 +706,7 @@ export async function handleResponsesCompact(
   const virtual = resolveOpenAiCompactModel(route.providerName, selectedModelId);
   if (virtual) {
     route.modelId = virtual.wireModelId;
+    captureOpenAiVirtualWirePolicy(route, virtual);
     logCtx.model = virtual.selectedModelId;
     logCtx.resolvedModel = virtual.wireModelId;
   } else {
@@ -747,7 +770,12 @@ export async function handleResponsesCompact(
   // no budget at all, so `handleResponsesInner` minted a fresh four after the native attempt
   // had already spent some of the first one.
   const sendBudget: RequestExecutionBudget = options.sendBudget ?? createRequestExecutionBudget();
-  if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider) && !accountGatedCompactWireModel && !route.combo) {
+  // A manual override onto another backend must not mint ciphertext the conversation model cannot replay.
+  const manualOverrideCrossesProvider = options.compactionRoutingOverride
+    ? !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route)
+    : false;
+  if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider) && !accountGatedCompactWireModel && !route.combo
+    && !manualOverrideCrossesProvider) {
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
     }
@@ -845,7 +873,12 @@ export async function handleResponsesCompact(
     // The regular /v1/responses path applies sanitizeReasoningInputContent via the adapter's
     // buildRequest, but the compact endpoint forwards directly. Apply the same sanitizer here
     // so routed-model reasoning items (reasoning_text content) don't 400 the ChatGPT backend.
-    const compactBody = sanitizeReasoningInputContent(compactBodyRaw) as typeof compactBodyRaw;
+    // #5095: the compact endpoint forwards `raw` directly, so it needs the same legacy dotted
+    // call-name repair the adapter applies. A damaged item here refuses the compaction itself,
+    // which is the request a long task depends on to keep going.
+    const compactBody = repairLegacyDottedToolCallNames(
+      sanitizeReasoningInputContent(compactBodyRaw),
+    ) as typeof compactBodyRaw;
     {
       const binding = conversationStateBindingFromAuth(authCtx, codexPoolAffinityKey(req.headers));
       if (binding) {
@@ -1303,9 +1336,9 @@ export async function handleResponsesCompact(
     // synthetic buffer errors are not upstream bodies and stay uninspected.
     if (buffered.ok) {
       inspectResponseLogJson(logCtx, await buffered.clone().text());
-      forgetCompactHandoffRoute(req, admission);
+      if (!options.compactionRoutingOverride) forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
-    } else if (quotaFailure && !storedPool401ReplayAttempted) {
+    } else if (!options.compactionRoutingOverride && quotaFailure && !storedPool401ReplayAttempted) {
       const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {
@@ -1368,7 +1401,7 @@ export async function handleResponsesCompact(
   // The routed compaction turn is a handoff inside the same logical request, so it draws the
   // REMAINDER. Minting here is what let a native attempt spend three sends and the routed
   // fallback spend four more.
-  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, ...(admission ? { admission } : {}) });
+  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRoutingOverride: options.compactionRoutingOverride, ...(admission ? { admission } : {}) });
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };
   if (response.headers.get("content-type")?.includes("text/event-stream")) {
@@ -1438,7 +1471,7 @@ export async function handleResponsesCompact(
     const result = new Response(JSON.stringify({ output: compactionItems }), {
       headers: { "Content-Type": "application/json" },
     });
-    rememberCompactHandoffRoute(req, admission, raw.model);
+    if (!options.compactionRoutingOverride) rememberCompactHandoffRoute(req, admission, raw.model);
     return result;
   }
   const encrypted = compactionItems[0]!.encrypted_content;
@@ -1449,6 +1482,6 @@ export async function handleResponsesCompact(
   }
   const summary = decoded;
   const output = buildCompactV1Output(extractCompactUserMessages(inputItems), summary);
-  rememberCompactHandoffRoute(req, admission, raw.model);
+  if (!options.compactionRoutingOverride) rememberCompactHandoffRoute(req, admission, raw.model);
   return new Response(JSON.stringify({ output }), { headers: { "Content-Type": "application/json" } });
 }

package/src/server/responses/compaction-routing.ts

@@ -0,0 +1,111 @@
+import type { OcxConfig } from "../../types";
+import { isDeclaredReasoningEffort } from "../../reasoning-effort";
+import { COMPACTION_TRIGGERS } from "../../config/schema/compaction-triggers";
+import { routeConcreteModel, type RouteResult } from "../../router";
+import { resolveComboId } from "../../combos/identifiers";
+import { recallComboForLane } from "./combo-session-recall";
+import { sessionLaneIdFromRequest } from "../request-log-conversation";
+
+/** `sourceModel` is the conversation's own selector before the rewrite. */
+export interface CompactionRoutingOverride {
+  sourceModel: string;
+  /** Combo the lane remembers for a bare `sourceModel` (#3891); the conversation resumes there, not on the bare route. */
+  sourceCombo?: string;
+  /** Combo the configured override resolves to; its children route concretely but stay portable. */
+  targetCombo?: string;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+}
+
+/**
+ * Triggers this override covers. Absent means manual only, which is the narrowest
+ * reading of the setting and leaves automatic compaction exactly as it routes today.
+ * A hand-edited value the schema would have rejected disables the override rather
+ * than widening it, so a malformed edit can never route more than it names.
+ */
+function configuredTriggers(value: unknown): readonly string[] | null {
+  if (value === undefined) return ["manual"];
+  if (!Array.isArray(value) || value.length === 0) return null;
+  if (!value.every(entry => typeof entry === "string" && (COMPACTION_TRIGGERS as readonly string[]).includes(entry))) return null;
+  if (new Set(value).size !== value.length) return null;
+  return value as readonly string[];
+}
+
+export interface CompactionRoutingOverrideOptions {
+  /** `responses` requires a `compaction_trigger` input item; the native compact endpoint carries none. */
+  endpoint?: "responses" | "compact";
+  transport?: "websocket";
+}
+
+export function applyCompactionRoutingOverride(
+  body: unknown,
+  headers: Headers,
+  config: OcxConfig,
+  options: CompactionRoutingOverrideOptions = {},
+): CompactionRoutingOverride | null {
+  const override = config.compactionRouting;
+  const raw = record(body);
+  if (!raw || typeof raw.model !== "string" || !raw.model.trim()
+    || typeof override?.model !== "string" || !override.model.trim()) return null;
+  if (override.reasoningEffort !== undefined
+    && (typeof override.reasoningEffort !== "string" || !isDeclaredReasoningEffort(override.reasoningEffort))) return null;
+  const triggers = configuredTriggers(override.triggers);
+  if (!triggers) return null;
+  if (options.endpoint !== "compact"
+    && !(Array.isArray(raw.input) && raw.input.some(item => record(item)?.type === "compaction_trigger"))) return null;
+
+  const metadata: unknown[] = [];
+  const header = headers.get("x-codex-turn-metadata");
+  if (options.transport !== "websocket" && header !== null) metadata.push(header);
+  const client = record(raw.client_metadata);
+  if (client && Object.hasOwn(client, "x-codex-turn-metadata")) metadata.push(client["x-codex-turn-metadata"]);
+  if (metadata.length === 0) return null;
+  let trigger: string | undefined;
+  for (const value of metadata) {
+    if (typeof value !== "string") return null;
+    try {
+      const parsed = record(JSON.parse(value));
+      if (parsed?.request_kind !== "compaction") return null;
+      const carried = record(parsed.compaction)?.trigger;
+      if (typeof carried !== "string" || !triggers.includes(carried)) return null;
+      // Copies that name different triggers are not agreement, and picking either one would
+      // let a caller widen an override by disagreeing with itself.
+      if (trigger !== undefined && trigger !== carried) return null;
+      trigger = carried;
+    } catch {
+      return null;
+    }
+  }
+  if (trigger === undefined) return null;
+
+  const sourceModel = raw.model;
+  const sourceCombo = recallComboForLane(config, sessionLaneIdFromRequest(headers), sourceModel);
+  const targetCombo = resolveComboId(config, override.model.trim()) ?? undefined;
+  raw.model = override.model.trim();
+  if (override.reasoningEffort !== undefined) {
+    raw.reasoning = { ...record(raw.reasoning), effort: override.reasoningEffort };
+  }
+  return { sourceModel, ...(sourceCombo ? { sourceCombo } : {}), ...(targetCombo ? { targetCombo } : {}) };
+}
+
+/** Same provider identity keeps caller auth and may use native compact; its ciphertext replays only there. */
+export function compactionRoutingKeepsProviderIdentity(
+  config: OcxConfig,
+  override: CompactionRoutingOverride,
+  route: RouteResult,
+): boolean {
+  if (route.combo || override.sourceCombo || override.targetCombo || resolveComboId(config, override.sourceModel)) return false;
+  let source: RouteResult;
+  try {
+    source = routeConcreteModel(config, override.sourceModel);
+  } catch {
+    return false;
+  }
+  return source.providerName === route.providerName
+    && source.codexAccountMode === route.codexAccountMode
+    && source.codexAccountNamespace === route.codexAccountNamespace;
+}

package/src/server/responses/core-codex-account.ts

@@ -328,7 +328,8 @@ export interface CodexPoolAccountRetryArgs {
   /** Sanitized caller input, before any selected Pool credential was materialized. */
   callerAuthHeaders: Headers;
   config: OcxConfig;
-  route: { providerName: string; modelId: string; provider: OcxProviderConfig };
+  /** Actual routed result narrowed to the fields this retry consumes. */
+  route: Pick<RouteResult, "providerName" | "modelId" | "provider" | "staticPolicy">;
   parsed: OcxParsedRequest;
   logCtx: RequestLogContext;
   options: {
@@ -681,7 +682,7 @@ export async function retryCodexPoolOnAlternateAccount(
     "pool",
   );
   const retryAdapter = resolveAdapter(
-    resolveWireProtocolOverride(route.providerName, route.modelId, retryProvider, inboundWire),
+    resolveWireProtocolOverride(route.providerName, route.modelId, retryProvider, inboundWire, route.staticPolicy),
     config.cacheRetention,
     route.providerName,
   );
@@ -841,7 +842,11 @@ export async function retryCodexPoolOnAlternateAccount(
         parsed.modelId,
       );
       if (retryModelDenial !== undefined) {
-        recordCodexModelDenialEvidence(retryAuthCtx.accountId, retryModelDenial);
+        recordCodexModelDenialEvidence(
+          retryAuthCtx.accountId,
+          retryModelDenial,
+          retryAuthCtx.kind === "pool" ? retryAuthCtx.generation : undefined,
+        );
       }
       if (!retrySameConfirmedAccount || retrySendCount >= maxRetrySends) break;
       // Caller-owned main is an alternate-account replay and can never enter the bounded

package/src/server/responses/core-combo.ts

@@ -29,7 +29,6 @@ import {
 import { formatErrorResponse } from "../../bridge";
 import {
   expandPreviousResponseInput,
-  previousResponseScopeMismatch,
   previousResponseReplayFailure,
   previousResponseProviderState,
 } from "../../responses/state";
@@ -201,11 +200,12 @@ export async function executeComboResponses(
   // imageInput is disabled (and so targets see the full replayed input).
   const inboundClientThreadId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
   const body = expandPreviousResponseInput(rawBody, inboundClientThreadId);
-  const scopeMismatch = previousResponseScopeMismatch(body);
-  if (scopeMismatch) {
-    console.warn("[opencodex] dropped a previous_response_id with a mismatched client task scope; continuing fresh");
+  const replayFailure = previousResponseReplayFailure(body);
+  if (replayFailure?.reason === "scope_mismatch") {
+    console.warn("[opencodex] refusing continuation because the client task scope does not match replay state");
   }
-  if (previousResponseReplayFailure(body)) {
+  // Local replay failures require full client replay.
+  if (replayFailure) {
     return formatErrorResponse(
       400,
       "previous_response_not_found",
@@ -235,7 +235,7 @@ export async function executeComboResponses(
     sourceBody: body,
     previousResponseInputExpanded: body !== rawBody
       && typeof (body as { previous_response_id?: unknown }).previous_response_id === "string",
-    providerContinuation: !scopeMismatch && body !== rawBody && requestedPreviousId
+    providerContinuation: body !== rawBody && requestedPreviousId
       ? previousResponseProviderState(requestedPreviousId)
       : undefined,
     recoveredPlaintext: false,
@@ -521,7 +521,7 @@ export async function executeComboResponses(
         // The live config can change while the child is streaming. Never retain credentials.
         const currentCombo = getCombo(config, comboId);
         const provider = config.providers[completedTarget.provider];
-        if (Object.hasOwn(config.providers, completedTarget.provider)
+        if (!options.compactionRoutingOverride && Object.hasOwn(config.providers, completedTarget.provider)
           && provider && provider.disabled !== true
           && currentCombo?.targets.some(target => targetKey(target) === targetKey(completedTarget))) {
           rememberComboForLane(sessionLaneIdFromRequest(req.headers), comboId, completedTarget, model, writerGeneration);

package/src/server/responses/core-normalize.ts

@@ -13,7 +13,6 @@ import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import type { RequestLogContext } from "../request-log";
 import type { HandleResponsesOptions } from "./core-options";
 import { prepareEffortNormalization } from "../effort-policy";
-import { providerModelResponsesUpstreamStreaming } from "../../providers/registry";
 import { resolveOpenCodeGoTransport } from "../../providers/opencode-go-transport";
 import { getOrAllocateRequestSessionLane } from "../request-log-conversation";
 import { shouldPreparePlaintextV2AgentMessages } from "../../responses/plaintext-v2-agent-messages";
@@ -80,6 +79,7 @@ export function canPassThroughEncryptedV2AgentTask(
     route.modelId,
     provider,
     inboundWire,
+    route.staticPolicy,
   ).adapter === "openai-responses";
 }
 
@@ -126,6 +126,8 @@ export async function applyFinalRouteRequestNormalization(args: {
   const responseModelId = parsed.modelId;
   const preserveAnthropicResponseModel = route.providerName === "anthropic"
     || route.provider.adapter === "anthropic";
+  const finalSelectedModelId = route.modelId;
+  const virtualModel = applyOpenAiVirtualModel(parsed, route, logCtx, inboundWire);
 
   // Apply the routed model id upstream: routing may strip a "<provider>/" namespace.
   if (route.modelId !== parsed.modelId) {
@@ -136,11 +138,7 @@ export async function applyFinalRouteRequestNormalization(args: {
   }
   // Transport-neutral reliability policy (#875): applies to any Responses
   // upstream whose final adapter is openai-responses, not only WS turns.
-  const responsesUpstreamStreaming = providerModelResponsesUpstreamStreaming(
-    route.providerName,
-    route.provider,
-    route.modelId,
-  );
+  const responsesUpstreamStreaming = route.staticPolicy.model.responsesUpstreamStreaming;
 
   // Preserve the routed destination for Go recognition, then settle the wire before
   // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
@@ -150,6 +148,7 @@ export async function applyFinalRouteRequestNormalization(args: {
     route.modelId,
     routedProvider,
     inboundWire,
+    route.staticPolicy,
   );
   route.provider = resolveOpenCodeGoTransport(wireProvider,
     args.claudeGoAffinity ? args.claudeGoAffinity.sessionLane : getOrAllocateRequestSessionLane(req),
@@ -168,7 +167,7 @@ export async function applyFinalRouteRequestNormalization(args: {
       || (!summary && route.provider.showThinkingSummary !== true);
   }
   if (preserveAnthropicResponseModel) parsed._responseModelId = responseModelId;
-  logCtx.model = route.modelId;
+  logCtx.model = virtualModel?.selectedModelId ?? route.modelId;
   logCtx.provider = route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
   logCtx.routeDecision = route.routeDecision;
@@ -194,11 +193,6 @@ export async function applyFinalRouteRequestNormalization(args: {
     (parsed._rawBody as Record<string, unknown>).store = false;
   }
 
-  // Final selected model before virtual wire-model rewriting (Pro aliases).
-  const finalSelectedModelId = route.modelId;
-
-  // Virtual model rewriting: Pro aliases → base model + reasoning.mode="pro".
-  applyOpenAiVirtualModel(parsed, route, logCtx);
   if (parsed._responseModelId !== undefined && parsed._responseModelId !== parsed.modelId) {
     logCtx.resolvedModel = route.modelId;
     logCtx.preserveResolvedModelFromRoute = true;

package/src/server/responses/core-opaque-recovery.ts

@@ -88,6 +88,7 @@ export function isEncryptedFunctionOutputRejection(bodyText: string): boolean {
   try {
     const payload = JSON.parse(bodyText) as unknown;
     if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    if (upstreamErrorMessageFromPayload(payload) === ENCRYPTED_FUNCTION_OUTPUT_REJECTION) return true;
     const record = payload as { detail?: unknown; message?: unknown; error?: unknown };
     if (record.detail === ENCRYPTED_FUNCTION_OUTPUT_REJECTION) return true;
     if (record.message === ENCRYPTED_FUNCTION_OUTPUT_REJECTION) return true;
@@ -115,6 +116,88 @@ export function isReasoningBlobCallerMismatchMessage(message: string): boolean {
 }
 
 
+/**
+ * Longest embedded payload this will parse. The wrapper is a short error envelope; anything
+ * larger is not the shape being matched, and refusing to walk it keeps an upstream-controlled
+ * string from deciding how much work the classifier does.
+ */
+const LITELLM_EMBEDDED_PAYLOAD_LIMIT = 16_384;
+const LITELLM_WRAPPER_PREFIX = "litellm.BadRequestError:";
+const LITELLM_WRAPPER_MARKER = "OpenAIException - ";
+
+/**
+ * The JSON an OpenAI-compatible gateway embeds in its own error message, or undefined.
+ *
+ * Brace-aware rather than a regex because the embedded object legitimately contains braces and
+ * escaped quotes inside its message, and the gateway appends its own prose after the closing
+ * brace. Counting depth outside string literals is the only way to find the real end.
+ */
+function liteLlmEmbeddedErrorPayload(message: string): unknown {
+  if (!message.startsWith(LITELLM_WRAPPER_PREFIX)) return undefined;
+  const markerIndex = message.indexOf(LITELLM_WRAPPER_MARKER);
+  if (markerIndex < 0) return undefined;
+  const start = message.indexOf("{", markerIndex + LITELLM_WRAPPER_MARKER.length);
+  if (start < 0) return undefined;
+  const end = Math.min(message.length, start + LITELLM_EMBEDDED_PAYLOAD_LIMIT);
+
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let index = start; index < end; index += 1) {
+    const character = message[index]!;
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === '"') inString = false;
+      continue;
+    }
+    if (character === '"') { inString = true; continue; }
+    if (character === "{") depth += 1;
+    else if (character === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        try { return JSON.parse(message.slice(start, index + 1)) as unknown; } catch { return undefined; }
+      }
+    }
+  }
+  return undefined;
+}
+
+
+/** True for an error message that is a gateway envelope rather than an upstream's own wording. */
+function isLiteLlmEnvelopeMessage(message: string): boolean {
+  return message.startsWith(LITELLM_WRAPPER_PREFIX) && message.includes(LITELLM_WRAPPER_MARKER);
+}
+
+
+/**
+ * An OpenAI-compatible gateway relaying the one authoritative ciphertext rejection inside its
+ * own error string.
+ *
+ * Deliberately narrower than {@link isSelfIdentifiedOpaqueBlobRejection}. The embedded payload is
+ * matched against exactly one identity -- `invalid_request_error` carrying
+ * `invalid_encrypted_content` -- and the generic classifier is NOT re-run against it. Re-running
+ * it would let every other opaque identity arrive through the wrapper as well: the code-less
+ * unverifiable-ciphertext wording, the #4469 caller mismatch, and the two xAI decoder strings.
+ * Each of those was admitted on evidence from a specific upstream about how that upstream words
+ * its own rejection, and a gateway in between is not that evidence. Only the coded identity is
+ * unambiguous enough to survive relaying.
+ */
+export function isLiteLlmWrappedCiphertextRejection(payload: unknown): boolean {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const outer = (payload as { error?: unknown }).error;
+  if (!outer || typeof outer !== "object" || Array.isArray(outer)) return false;
+  const message = (outer as { message?: unknown }).message;
+  if (typeof message !== "string") return false;
+  const embedded = liteLlmEmbeddedErrorPayload(message);
+  if (!embedded || typeof embedded !== "object" || Array.isArray(embedded)) return false;
+  const inner = (embedded as { error?: unknown }).error;
+  if (!inner || typeof inner !== "object" || Array.isArray(inner)) return false;
+  const { type, code } = inner as { type?: unknown; code?: unknown };
+  return type === "invalid_request_error" && code === "invalid_encrypted_content";
+}
+
+
 export function isSelfIdentifiedOpaqueBlobRejection(bodyText: string): boolean {
   if (isEncryptedFunctionOutputRejection(bodyText)) return true;
   try {
@@ -131,6 +214,14 @@ export function isSelfIdentifiedOpaqueBlobRejection(bodyText: string): boolean {
 
     if (record.error && typeof record.error === "object" && !Array.isArray(record.error)) {
       const error = record.error as { type?: unknown; code?: unknown; message?: unknown };
+      // A gateway envelope is decided ONLY by its embedded payload, before any wording check
+      // below runs. Those checks match anchored phrases anywhere in the message, and a gateway
+      // quotes the upstream's message inside its own -- so without this the relayed text would
+      // satisfy the caller-mismatch identity and gain a resend the strict wrapper check exists to
+      // withhold. Returning here rather than falling through is the point.
+      if (typeof error.message === "string" && isLiteLlmEnvelopeMessage(error.message)) {
+        return isLiteLlmWrappedCiphertextRejection(payload);
+      }
       if (error.type === "invalid_request_error") {
         if (error.code === "invalid_encrypted_content") return true;
         if (

package/src/server/responses/core-options.ts

@@ -11,6 +11,7 @@ import type { NativeMainRefreshDependencies } from "../../codex/main-account";
 import type { InboundWire } from "../../providers/registry";
 import type { ExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import type { CallerDirectAuth } from "../../providers/caller-authorization";
+import type { CompactionRoutingOverride } from "./compaction-routing";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import type { RequestLogContext } from "../request-log";
@@ -51,6 +52,8 @@ export interface HandleResponsesOptions {
   admission?: DataPlaneAdmission;
   /** Called at most once after the complete client body is read and accepted for dispatch. */
   onRequestBodyRead?: () => void;
+  /** Internal handoff for retry wrappers that must reuse the already-accounted request body. */
+  onRequestBodyParsed?: (body: unknown) => void;
   forceEmptyResponseId?: boolean;
   /** Internal, connection-owned control channel; never reconstructed from headers. */
   nativeControl?: NativeResponseControl;
@@ -105,6 +108,7 @@ export interface HandleResponsesOptions {
   callerDirectAuth?: CallerDirectAuth | null;
   /** Internal recursion guard; callers outside this module must not set it. */
   comboAttempt?: boolean;
+  compactionRoutingOverride?: CompactionRoutingOverride | null;
   /** Internal combo handoff for one parent-validated continuation snapshot. */
   comboReplaySnapshot?: {
     sourceBody: unknown;

package/src/server/responses/encrypted-payload.ts

@@ -98,6 +98,19 @@ import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/cat
 
 
 export function looksLikeBackendCiphertext(payload: string): boolean {
+  // Unknown replay history has no authenticity proof. Require the key-independent Fernet wire
+  // structure instead of granting ciphertext authority to any long base64-like model output.
+  // Proven backend bytes still remain opaque and byte-identical; malformed/plaintext slots are
+  // lowered by the compatibility path below rather than poisoning every later native replay.
+  return isStructurallyValidFernetToken(payload);
+}
+
+/**
+ * Pre-route compatibility keeps an encoded-looking unknown slot opaque until the destination is
+ * known. A routed destination strips that slot instead of exposing possible truncated ciphertext;
+ * the canonical backend later applies the stricter structural classifier.
+ */
+function looksLikeUnknownOpaqueSlot(payload: string): boolean {
   return payload.length >= 64 && /^[A-Za-z0-9+/=_-]+$/.test(payload);
 }
 
@@ -480,7 +493,10 @@ function contentWithoutCiphertext(content: unknown[]): unknown[] {
 
 
 
-export function sanitizeEncryptedContentInPlace(input: unknown): number {
+export function sanitizeEncryptedContentInPlace(
+  input: unknown,
+  options: { preserveUnknownOpaqueSlots?: boolean } = {},
+): number {
   if (!Array.isArray(input)) return 0;
   let rewritten = 0;
   const protectedFragments = new WeakSet<object>();
@@ -512,7 +528,9 @@ export function sanitizeEncryptedContentInPlace(input: unknown): number {
         && typeof (child as { encrypted_content?: unknown }).encrypted_content === "string"
       ) {
         const payload = (child as { encrypted_content: string }).encrypted_content;
-        if (!protectedFragments.has(child) && !looksLikeBackendCiphertext(payload)) {
+        const preserveUnknown = options.preserveUnknownOpaqueSlots === true
+          && looksLikeUnknownOpaqueSlot(payload);
+        if (!protectedFragments.has(child) && !looksLikeBackendCiphertext(payload) && !preserveUnknown) {
           const parts = encryptedSlotParts(payload);
           frame.node.splice(frame.index, 1, ...parts);
           rewritten += 1;