@bitkyc08/opencodex 2.60.0 → 2.61.0-preview.20260922

package/src/server/admission-model-scope.ts

@@ -0,0 +1,219 @@
+import type { DataPlaneAdmission } from "./auth-cors";
+import type { OcxApiKeyEntry, OcxConfig } from "../types";
+
+/**
+ * Per-admission-key model and provider scope.
+ *
+ * A hub that serves several clients with their own `ocx_data_…` keys needs a
+ * mail or cron key to be unable to spend a coding key's Grok or Claude quota.
+ * Hub-level model selection cannot express that: it hides a model from
+ * everyone or from no one (#5049).
+ *
+ * Two rules decide what this is and is not:
+ *
+ * A scope names DESTINATIONS, not selectors. It is evaluated against the
+ * resolved route — the provider and model a turn will actually bill — never
+ * against the string the client sent. A client-supplied label is not a
+ * permission subject: alias resolution, a combo pick, a policy fallback and a
+ * compaction override all rewrite that string, so a scope checked before them
+ * would authorize one destination and reach another.
+ *
+ * A scope is never management authority. It narrows which models an inference
+ * key may call and grants nothing else; reading or editing a scope stays on
+ * the management credential.
+ */
+export interface AdmissionModelScope {
+  /** Resolved provider names this key may reach. Empty means every provider. */
+  readonly providers: readonly string[];
+  /** Resolved destinations this key may reach. Empty means every model. */
+  readonly models: readonly string[];
+}
+
+/** The resolved destination a scope decision is made about. */
+export interface ScopedRoute {
+  readonly providerName: string;
+  readonly modelId: string;
+}
+
+const normalize = (value: string): string => value.trim().toLowerCase();
+
+/** Does this scope admit this provider on its own terms? */
+function providerAllowedByScope(scope: AdmissionModelScope, providerName: string): boolean {
+  return scope.providers.length === 0 || scope.providers.includes(normalize(providerName));
+}
+
+function normalizedList(values: readonly string[] | undefined): readonly string[] {
+  if (!Array.isArray(values)) return [];
+  const seen = new Set<string>();
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const normalized = normalize(value);
+    if (normalized) seen.add(normalized);
+  }
+  return [...seen];
+}
+
+/** Read the scope a stored key declares. An entry with neither list is unrestricted. */
+export function admissionModelScopeOf(entry: Pick<OcxApiKeyEntry, "allowedProviders" | "allowedModels">): AdmissionModelScope | undefined {
+  const providers = normalizedList(entry.allowedProviders);
+  const models = normalizedList(entry.allowedModels);
+  return providers.length === 0 && models.length === 0 ? undefined : { providers, models };
+}
+
+/**
+ * The scope that applies to one request, or undefined when nothing is scoped.
+ *
+ * Only a configured key carries a scope. The environment token and loopback
+ * admission have no stored record to attach one to, so they stay unrestricted;
+ * an operator who wants them narrowed issues a configured key instead.
+ */
+export function resolveAdmissionModelScope(
+  config: Pick<OcxConfig, "apiKeys">,
+  admission: DataPlaneAdmission | undefined,
+): AdmissionModelScope | undefined {
+  if (!admission || admission.kind !== "configured") return undefined;
+  const entry = (config.apiKeys ?? []).find(key => key.id === admission.keyId);
+  return entry ? admissionModelScopeOf(entry) : undefined;
+}
+
+/**
+ * Does this scope admit this resolved destination?
+ *
+ * The two lists are independent conditions and both must hold when both are
+ * declared: a key allowed one provider and one model may not reach that
+ * model on a different provider, which is what a combo child or a policy
+ * fallback would otherwise do while the requested selector stayed the same.
+ *
+ * A model entry matches the bare resolved model id or the fully qualified
+ * `provider/model` form, so an operator can scope one model everywhere or
+ * pin it to a single provider without a second field.
+ */
+export function routeAllowedByScope(
+  scope: AdmissionModelScope | undefined,
+  route: ScopedRoute,
+): boolean {
+  if (!scope) return true;
+  const model = normalize(route.modelId);
+  if (!providerAllowedByScope(scope, route.providerName)) return false;
+  if (scope.models.length === 0) return true;
+  return scope.models.includes(model) || scope.models.includes(normalize(route.providerName) + "/" + model);
+}
+
+/**
+ * A request that asked for a destination its key may not reach.
+ *
+ * Carries the selector the client sent rather than the destination it resolved
+ * to: the caller needs to know which of its own requests was refused, and a
+ * key that may not reach a provider has no business learning that an alias it
+ * named points there. The resolved destination goes to the server log.
+ */
+export class AdmissionModelDeniedError extends Error {
+  readonly requestedModel: string;
+  readonly deniedProvider: string;
+  readonly deniedModel: string;
+  constructor(requestedModel: string, route: ScopedRoute) {
+    super("model " + requestedModel + " is not allowed for this API key");
+    this.name = "AdmissionModelDeniedError";
+    this.requestedModel = requestedModel;
+    this.deniedProvider = route.providerName;
+    this.deniedModel = route.modelId;
+  }
+}
+
+/** Stable wire type for a scope refusal. */
+export const MODEL_NOT_ALLOWED_FOR_KEY = "model_not_allowed_for_key";
+
+/**
+ * How a refusal names a destination whose model nobody stated.
+ *
+ * This is message vocabulary, never a model id. It is not compared against
+ * `allowedModels`, so an operator who copies it out of a refusal into a list
+ * cannot grant "whatever the upstream picks" — the one destination a model list
+ * is unable to describe.
+ */
+export const UNNAMED_DESTINATION_MODEL = "(unnamed)";
+
+/** The HTTP body a scope refusal returns. 403: authenticated, not permitted. */
+export function admissionModelDeniedBody(error: AdmissionModelDeniedError): {
+  error: { type: string; message: string; model: string };
+} {
+  return {
+    error: {
+      type: MODEL_NOT_ALLOWED_FOR_KEY,
+      message: error.message,
+      model: error.requestedModel,
+    },
+  };
+}
+
+/**
+ * The refusal a scoped request gets: 403, not 404.
+ *
+ * The key authenticated; it simply may not reach this destination. Reporting
+ * "not found" instead would tell a client its credential is wrong and invite
+ * it to retry with another, and would make an operator's own denial
+ * indistinguishable from a typo in the model name.
+ */
+export function admissionModelDeniedResponse(error: AdmissionModelDeniedError): Response {
+  return new Response(JSON.stringify(admissionModelDeniedBody(error)), {
+    status: 403,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+/**
+ * Refuse a resolved destination this key may not reach.
+ *
+ * Every request-path site that produces or re-produces a route calls this, so
+ * the direct name, an alias, a combo child, a policy or subagent fallback and
+ * a compaction override are all checked at the point they become concrete
+ * rather than once at the front door.
+ */
+export function assertRouteAllowedByScope(
+  scope: AdmissionModelScope | undefined,
+  requestedModel: string,
+  route: ScopedRoute,
+): void {
+  if (!routeAllowedByScope(scope, route)) {
+    throw new AdmissionModelDeniedError(requestedModel, route);
+  }
+}
+
+/**
+ * The refusal a non-routed data-plane surface returns, or undefined when the
+ * destination is permitted.
+ *
+ * The Responses path resolves a route inside a try/catch and throws from the
+ * point the destination becomes concrete. The endpoints beside it -- images,
+ * audio, voice and the search relay -- have no router and no such boundary:
+ * each picks its own upstream inline and returns a Response. This is the same
+ * predicate against the same kind of resolved destination, shaped for that
+ * control flow, so a key that may not reach a provider is refused identically
+ * whichever surface it asked through.
+ *
+ * `destination.modelId` is undefined when nobody named the model this request
+ * will run: the relay copies the body and the upstream picks, or a voice join
+ * attaches to a call this process never recorded. A key with a model list is
+ * then refused, because no entry in that list can describe the destination; a
+ * key scoped only by provider is judged on the provider alone.
+ */
+export function admissionScopeDenial(
+  config: Pick<OcxConfig, "apiKeys">,
+  admission: DataPlaneAdmission | undefined,
+  requestedModel: string | undefined,
+  destination: { readonly providerName: string; readonly modelId: string | undefined },
+): Response | undefined {
+  const scope = resolveAdmissionModelScope(config, admission);
+  if (!scope) return undefined;
+  const allowed = destination.modelId === undefined
+    ? providerAllowedByScope(scope, destination.providerName) && scope.models.length === 0
+    : routeAllowedByScope(scope, { providerName: destination.providerName, modelId: destination.modelId });
+  if (allowed) return undefined;
+  return admissionModelDeniedResponse(new AdmissionModelDeniedError(
+    requestedModel ?? UNNAMED_DESTINATION_MODEL,
+    {
+      providerName: destination.providerName,
+      modelId: destination.modelId ?? UNNAMED_DESTINATION_MODEL,
+    },
+  ));
+}

package/src/server/audio-live.ts

@@ -11,7 +11,8 @@ import { LIVE_AUDIO_MODEL, resolveAudioUpstream, type AudioUpstream } from "./au
 import { registerTurn, unregisterTurn } from "./lifecycle";
 import {
   backendJsonBodyFromApiMultipart, buildLiveSidebandUpstreamWsUrl, forwardLiveUrl, keyedLiveUrl,
-  LIVE_CLIENT_PROTOCOL_HEADERS, LIVE_REQUEST_MAX_BYTES, LIVE_RESPONSE_MAX_BYTES, readBodyCapped,
+  LIVE_CLIENT_PROTOCOL_HEADERS, LIVE_REQUEST_MAX_BYTES, LIVE_RESPONSE_MAX_BYTES, liveSidebandModel,
+  readBodyCapped,
   type LiveSidebandTarget,
 } from "./live";
 import { LIVE_CALL_TTL_MS, LiveCallBindings, upstreamLiveCallId } from "./live-call-bindings";
@@ -115,6 +116,8 @@ export async function handleExternalLive(
       owner: options.client.owner, upstreamCallId: callId,
       joinStyle: frameless ? "frameless-path" : "realtime-query",
       providerName: relay.providerName,
+      // A join carries no model of its own; this is the one the call settled on.
+      model,
       accountId: context ? context.kind === "main" ? callerOwned ? undefined : MAIN_CODEX_ACCOUNT_ID : context.accountId : undefined,
       chatgptAccountId: new Headers(relay.headers).get("chatgpt-account-id") ?? undefined,
       keyedCredentialDigest: relay.keyed ? createHash("sha256").update(new Headers(relay.headers).get("authorization") ?? "").digest("hex") : undefined,
@@ -150,13 +153,16 @@ export async function resolveExternalLiveSocket(
   }
   let upstreamTarget = binding ? { style: binding.joinStyle, callId: binding.upstreamCallId } as LiveSidebandTarget : target;
   const frameless = upstreamTarget.style === "frameless-path" || upstreamTarget.style === "frameless-standalone";
-  let model = LIVE_AUDIO_MODEL;
   if (upstreamTarget.style === "frameless-standalone") {
     const query = new URLSearchParams(upstreamTarget.query);
     if (!query.has("model") || query.get("model") === "gpt-live-1") query.set("model", LIVE_AUDIO_MODEL);
-    model = query.get("model") ?? LIVE_AUDIO_MODEL;
     upstreamTarget = { ...upstreamTarget, query: query.toString() };
   }
+  // What this socket will actually run: the model a bound call settled on when
+  // this same key created it, or the one a standalone session forwards in its
+  // own query. Reading only the Frameless query left a Realtime standalone
+  // socket judged as the default while its query carried another model.
+  const model = binding?.model ?? liveSidebandModel(upstreamTarget) ?? LIVE_AUDIO_MODEL;
   const relay = await resolveAudioUpstream(client.headers, config, log, {
     admission: client.admission, model, lease: options.lease,
     signal: options.signal,

package/src/server/audio-upstream.ts

@@ -14,6 +14,7 @@ import { formatCodexProviderForLog } from "../codex/routing";
 import type { AdmissionLease } from "../lib/admission";
 import { captureExplicitOpenAiCallerAuth, resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
 import type { OcxConfig } from "../types";
+import { admissionScopeDenial } from "./admission-model-scope";
 import {
   isProxyAdmissionSecret,
   resolveDataPlaneAdmissionSecret,
@@ -119,6 +120,18 @@ export async function resolveAudioUpstream(
         return formatErrorResponse(401, "authentication_error", "Selected audio account is unavailable");
       }
       validateForwardAdmissionCredential(selected, config);
+      // Every audio surface — file transcription, the dictation socket, voice
+      // call-create and the sideband join — resolves its upstream here, and
+      // `options.model` is the model that upstream will run, not a selector the
+      // caller can rewrite afterwards. One check therefore covers all of them.
+      const forwardDenial = admissionScopeDenial(config, options.admission, options.model, {
+        providerName: candidate.providerName,
+        modelId: options.model,
+      });
+      if (forwardDenial) {
+        releaseCodexAuthContextProbeLease(context);
+        return forwardDenial;
+      }
       log.provider = formatCodexProviderForLog(candidate.providerName, context.accountId, config);
       log.model = options.model;
       return {
@@ -136,6 +149,11 @@ export async function resolveAudioUpstream(
       const selected = new Headers(provider.headers);
       selected.set("authorization", `Bearer ${apiKey}`);
       validateForwardAdmissionCredential(selected, config);
+      const keyedDenial = admissionScopeDenial(config, options.admission, options.model, {
+        providerName,
+        modelId: options.model,
+      });
+      if (keyedDenial) return keyedDenial;
       log.provider = providerName;
       log.model = options.model;
       return {

package/src/server/auth-cors.ts

@@ -11,6 +11,7 @@ import {
   providerWebSearchBridgeConfigError,
   requestPacingConfigError,
   retryOn429PolicyConfigError,
+  retryOnResetPolicyConfigError,
   sanitizeModelCostsForDisplay,
 } from "../config";
 import {
@@ -29,6 +30,7 @@ import {
   upstreamHttpVersionConfigError,
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
+import { providerEgressConfigError } from "../lib/provider-egress";
 import { redactSecretString } from "../lib/redact";
 import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
@@ -722,6 +724,10 @@ export function providerManagementConfigError(
     delete canonicalCandidate.modelCosts;
     // requestPacing is a user-owned transport overlay, not part of the canonical seed.
     delete canonicalCandidate.requestPacing;
+    // retryOnReset is the same kind of overlay: it tunes how this provider's own Responses
+    // sends recover, not what the canonical forward seed is. Validated below
+    // (retryOnResetPolicyConfigError).
+    delete canonicalCandidate.retryOnReset;
     // Context windows are the same kind of user-owned overlay as requestPacing: the operator
     // narrowing what their own native rows advertise. They can only ever LOWER the measured
     // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
@@ -768,6 +774,10 @@ export function providerManagementConfigError(
     // it before it reaches the management API response.
     return `provider ${JSON.stringify(redactSecretString(name))} ${retryOn429Error}`;
   }
+  const retryOnResetError = retryOnResetPolicyConfigError(raw.retryOnReset);
+  if (retryOnResetError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${retryOnResetError}`;
+  }
   const requestPacingError = requestPacingConfigError(raw.requestPacing);
   if (requestPacingError) {
     return `provider ${JSON.stringify(redactSecretString(name))} ${requestPacingError}`;
@@ -780,6 +790,13 @@ export function providerManagementConfigError(
   if (upstreamHttpVersionError) {
     return `provider ${JSON.stringify(redactSecretString(name))} ${upstreamHttpVersionError}`;
   }
+  // Per-provider egress shares one definition with the transports and the config loader, so a
+  // value the dashboard accepts is one a request can actually leave by. The message never
+  // echoes the value: a proxy URL routinely embeds `user:password@`.
+  const egressError = providerEgressConfigError(typed);
+  if (egressError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${egressError}`;
+  }
   const modelCostsError = providerModelCostsConfigError(raw.modelCosts);
   if (modelCostsError) {
     // The provider name is caller-controlled and can be token-shaped; redact and JSON-escape
@@ -947,6 +964,13 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   decodesNativeCompactionBlobs: "editor",
   allowEncryptedV2AgentTasks: "editor",
   allowPrivateNetwork: "editor",
+  // A proxy URL routinely embeds `user:password@`, so it never reaches the dashboard DTO and
+  // the editor may not write it. `ocx config set` and the config file remain the way to set
+  // it, which is the same boundary `apiKey` sits behind and for the same reason.
+  proxy: "redacted",
+  // A bypass list names destinations, carries no credential, and is only meaningful next to a
+  // route the operator can already see.
+  noProxy: "editor",
   upstreamHttpVersion: "editor",
   upstreamWebsocket: "editor",
   directGeminiWireRenames: "editor",
@@ -1024,6 +1048,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   pinParallelToolCallsFalse: "editor",
   terminalContinuationGuard: "editor",
   openaiChatEofTolerance: "editor",
+  foldDeveloperRoleToSystem: "editor",
   promptCacheKey: "editor",
   chatServiceTier: "editor",
   responsesItemIdRepair: "editor",
@@ -1033,6 +1058,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   showThinkingSummary: "editor",
   retryOn429: "editor",
   transientRetryOn5xx: "editor",
+  retryOnReset: "editor",
   reasoningSplitModels: "editor",
   reasoningDetailsModels: "editor",
   thinkingToggleModels: "editor",

package/src/server/chat-completions.ts

@@ -22,6 +22,15 @@ import {
 import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
+import {
+  applyReplayRefusalClientHeaders,
+  isReplayRefusalCode,
+  isReplayRefusalResponse,
+  REPLAY_REFUSAL_CLIENT_HEADERS,
+  REPLAY_REFUSED_STATUS,
+  retainReplayRefusal,
+  UPSTREAM_RESET_REPLAY_REFUSED_CODE,
+} from "../lib/upstream-retry";
 import { estimateTokens } from "../lib/token-estimate";
 import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
@@ -46,6 +55,12 @@ import { providerConsumesCallerAuthorization } from "../providers/caller-authori
 import { captureExplicitOpenAiCallerAuth } from "../providers/openai-sidecar";
 import { captureCallerDirectAuth } from "../providers/caller-authorization";
 import type { AdmissionLease } from "../lib/admission";
+import {
+  admissionModelDeniedResponse,
+  AdmissionModelDeniedError,
+  assertRouteAllowedByScope,
+  resolveAdmissionModelScope,
+} from "./admission-model-scope";
 import type { DataPlaneAdmission } from "./auth-cors";
 import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
@@ -150,6 +165,10 @@ async function handleChatCompletionsWithBudget(
   let chatNativeRoute: ReturnType<typeof routeModel> | null = null;
   try {
     const route = routeModel(config, chatBody.model as string, evidenceFromBody(chatBody));
+    // The native Chat lane sends without re-entering the Responses path, so it
+    // has to apply the key's scope itself. Translated traffic is checked where
+    // every rewrite converges instead.
+    assertRouteAllowedByScope(resolveAdmissionModelScope(config, logIds?.admission), requestedModel, route);
     // Preserve the routed destination for Go recognition, then settle the wire before
     // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
     const routedProvider = route.provider;
@@ -182,6 +201,11 @@ async function handleChatCompletionsWithBudget(
     // effort, failover, and per-attempt telemetry run before any native Chat send.
     if (!route.combo && !effortRow && isNativeChatRouteEligible(route, chatBody, config)) chatNativeRoute = route;
   } catch (err) {
+    if (err instanceof AdmissionModelDeniedError) {
+      logCtx.requestedModel = requestedModel;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 403, { closeReason: "non_stream" });
+      return admissionModelDeniedResponse(err);
+    }
     if (err instanceof UnknownRoutingPolicyError) {
       logCtx.requestedModel = requestedModel;
       if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 404, { closeReason: "non_stream" });
@@ -404,9 +428,19 @@ async function handleChatCompletionsWithBudget(
           : "invalid_request_error"),
       message,
     );
+    // The same verdict the native Chat surface reads, from the same two places: the response
+    // this wrapper still holds, and the code a body kept through an intermediate formatter.
+    // Not the status -- a refusal and a real rate limit are both 429, which is the whole
+    // reason this surface used to report one as the other.
+    const replayRefusal = isReplayRefusalResponse(upstream) || isReplayRefusalCode(upstreamCode);
     if (isCyberPolicyCode(upstreamCode) || classified.code === CYBER_POLICY_ERROR_CODE) {
       classified.code = CYBER_POLICY_ERROR_CODE;
       classified.type = cyberPolicyErrorType(upstreamType);
+    } else if (replayRefusal) {
+      // 429 classifies as a rate limit, which already carries a code, so the empty-code branch
+      // below could never restore this one -- the translated client was told the provider
+      // throttled the turn, and handed a two-second wait to send it again.
+      classified.code = UPSTREAM_RESET_REPLAY_REFUSED_CODE;
     } else if (upstreamCode === "model_not_found") {
       // Structured model_not_found must win over classifyError's generic remaps.
       classified.code = "model_not_found";
@@ -414,8 +448,10 @@ async function handleChatCompletionsWithBudget(
     } else if (upstreamCode !== undefined && upstreamCode !== null && classified.code == null) {
       classified.code = upstreamCode;
     }
-    const status = isCyberPolicyCode(classified.code) ? 400 : upstream.status;
-    const retryAfter = isCyberPolicyCode(classified.code)
+    const status = isCyberPolicyCode(classified.code) ? 400
+      : replayRefusal ? REPLAY_REFUSED_STATUS
+      : upstream.status;
+    const retryAfter = isCyberPolicyCode(classified.code) || replayRefusal
       ? undefined
       : resolveClientRetryAfter({
         status: upstream.status,
@@ -434,9 +470,12 @@ async function handleChatCompletionsWithBudget(
       headers: {
         "Content-Type": "application/json",
         ...(retryAfter ? { "Retry-After": retryAfter } : {}),
+        ...(replayRefusal ? REPLAY_REFUSAL_CLIENT_HEADERS : {}),
       },
     });
+    if (replayRefusal) retainReplayRefusal(rewritten);
     return logIds
+      // Deferred logging re-wraps this response and carries the verdict with it.
       ? responseWithDeferredRequestLog(rewritten, logIds.requestId, logIds.start, logCtx)
       : rewritten;
   }
@@ -503,11 +542,25 @@ async function handleChatCompletionsWithBudget(
     } else if (isCyberPolicyCode(error?.code) || classified.code === CYBER_POLICY_ERROR_CODE) {
       classified.code = CYBER_POLICY_ERROR_CODE;
       classified.type = cyberPolicyErrorType(error?.type);
+    } else if (isReplayRefusalCode(error?.code)) {
+      // The refusal can also arrive as a failed Responses envelope rather than a non-2xx.
+      // Reporting that as the 502 below would invite the four resends the refusal prevents.
+      classified.code = UPSTREAM_RESET_REPLAY_REFUSED_CODE;
     } else if (error?.code === "model_not_found") {
       // Same deliberate preserve as the non-OK path: structured code beats generic classify.
       classified.code = "model_not_found";
       classified.type = "invalid_request_error";
     }
+    if (isReplayRefusalCode(classified.code)) {
+      const refusal = chatCompletionsErrorResponse(
+        REPLAY_REFUSED_STATUS, message, classified.type, classified.code,
+      );
+      const headers = new Headers(refusal.headers);
+      applyReplayRefusalClientHeaders(headers);
+      return finishJson(retainReplayRefusal(
+        new Response(refusal.body, { status: refusal.status, headers }),
+      ));
+    }
     return finishJson(chatCompletionsErrorResponse(
       classified.code === "translation_buffer_limit"
         ? 502

package/src/server/chat-native.ts

@@ -29,6 +29,9 @@ import {
   isReplayRefusalCode,
   isReplayRefusalResponse,
   prepareSameTarget429Wait,
+  REPLAY_REFUSAL_CLIENT_HEADERS,
+  REPLAY_REFUSED_STATUS,
+  retainReplayRefusal,
   type UpstreamSendRecovery,
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
 } from "../lib/upstream-retry";
@@ -359,6 +362,11 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                   applyUpstreamRecoveryInit({
                     ...init, method: request.method, headers, body: request.body,
                   }, transportRecovery),
+                  // Reselection can replace the provider transport and the wire shape, so the
+                  // egress route is bound to the provider this send actually uses. Omitting it
+                  // here would let a provider transport bypass its configured route entirely,
+                  // because that transport wins over the executor that carries the binding.
+                  { providerName: route.providerName, provider: activeProvider },
                 );
                 if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
                 return dispatched;
@@ -492,10 +500,13 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
           : response.status >= 500 ? "server_error" : "invalid_request_error"),
       clientMessage,
     );
+    // The verdict is read once, from the response that carries it and from the code a
+    // re-wrapped body kept -- never from the status, which a real rate limit shares.
+    const replayRefusal = isReplayRefusalResponse(response) || isReplayRefusalCode(upstreamCode);
     if (isCyberPolicyCode(upstreamCode) || classified.code === CYBER_POLICY_ERROR_CODE) {
       classified.code = CYBER_POLICY_ERROR_CODE;
       classified.type = cyberPolicyErrorType(upstreamType);
-    } else if (isReplayRefusalResponse(response) || isReplayRefusalCode(upstreamCode)) {
+    } else if (replayRefusal) {
       // 429 classifies as a rate limit and a rate limit already carries a code, so the branch
       // below -- which only fills an EMPTY code -- could never restore this one. Without it the
       // client is told the provider throttled the turn, when what happened is that this proxy
@@ -507,11 +518,13 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     } else if (upstreamCode !== undefined && upstreamCode !== null && classified.code == null) {
       classified.code = upstreamCode;
     }
-    const status = isCyberPolicyCode(classified.code) ? 400 : response.status;
+    const status = isCyberPolicyCode(classified.code) ? 400
+      : replayRefusal ? REPLAY_REFUSED_STATUS
+      : response.status;
     // A refusal this proxy made has no wait to report. Synthesizing one here would hand the
     // client the default two-second retry for a rate limit that never happened, which is the
     // duplicate send the refusal exists to prevent.
-    const retryAfter = isCyberPolicyCode(classified.code) || isReplayRefusalCode(classified.code)
+    const retryAfter = isCyberPolicyCode(classified.code) || replayRefusal
       ? undefined
       : resolveClientRetryAfter({
         status: response.status,
@@ -519,13 +532,15 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
         upstreamRetryAfter: response.headers.get("retry-after"),
       });
     finishLog(status, classified.message);
-    return new Response(JSON.stringify(chatCompletionsErrorBody(status, classified.message, classified.type, classified.code)), {
+    const rewritten = new Response(JSON.stringify(chatCompletionsErrorBody(status, classified.message, classified.type, classified.code)), {
       status,
       headers: {
         "Content-Type": "application/json",
         ...(retryAfter ? { "Retry-After": retryAfter } : {}),
+        ...(replayRefusal ? REPLAY_REFUSAL_CLIENT_HEADERS : {}),
       },
     });
+    return replayRefusal ? retainReplayRefusal(rewritten) : rewritten;
   }
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";