@bitkyc08/opencodex 2.60.0 → 2.61.0-preview.20260922

package/src/server/responses/fetch-helpers.ts

@@ -12,9 +12,57 @@ import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 import { withUpstreamHttpVersion } from "../../lib/upstream-http-version";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { configuredOutboundFetch } from "../../lib/proxy-env";
+import {
+  describeProviderEgressForLog,
+  markEgressTransparentExecutor,
+  providerEgressSendInit,
+  providerEgressIsExplicit,
+  resolveProviderEgress,
+  type ProviderEgressBinding,
+} from "../../lib/provider-egress";
+import { redactSecretString } from "../../lib/redact";
 
 export { withUpstreamHttpVersion };
 
+const egressWebsocketDowngradeWarned = new Set<string>();
+/** A provider name is configuration-controlled, so the notice set is bounded like any cache. */
+const EGRESS_DOWNGRADE_NOTICE_LIMIT = 64;
+/**
+ * Marks an init whose provider egress route an outer physical-send boundary already decided.
+ *
+ * Own symbol keys survive object spread, so the mark travels through the rebuild a
+ * `dispatchOverride` performs, and an unknown symbol on a `RequestInit` is inert at the wire.
+ */
+const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
+
+/**
+ * Announce once, per provider, that an explicit egress route moved this provider off the
+ * WebSocket fast lane.
+ *
+ * The WebSocket upstream selects its proxy from the process environment when it dials, so it
+ * cannot carry a per-provider route. Serving the turn over HTTP/SSE honours the operator's
+ * egress choice, which is the one that has to win — but a transport change the operator did
+ * not ask for is exactly the kind of substitution this batch refuses to make silently, so it
+ * is stated rather than merely done.
+ */
+function warnEgressWebsocketDowngradeOnce(providerName: string, egress: string): void {
+  if (egressWebsocketDowngradeWarned.has(providerName)) return;
+  if (egressWebsocketDowngradeWarned.size >= EGRESS_DOWNGRADE_NOTICE_LIMIT) return;
+  egressWebsocketDowngradeWarned.add(providerName);
+  console.warn(
+    // The name is caller-controlled and can be token-shaped, so it is redacted and JSON-escaped
+    // before it reaches a log, exactly as at the management error boundary.
+    `[opencodex] provider ${JSON.stringify(redactSecretString(providerName))} declares egress ${egress}; the WebSocket upstream `
+    + "selects its proxy from the process environment and cannot carry a per-provider route, "
+    + "so these turns are served over HTTP/SSE.",
+  );
+}
+
+/** Test seam: the downgrade notice is once per provider per process, not once per request. */
+export function __resetEgressWebsocketDowngradeNotices(): void {
+  egressWebsocketDowngradeWarned.clear();
+}
+
 export function disableResponsesRequestTimeout(req: Request, server: Pick<Server<WsData>, "timeout"> | undefined): boolean {
   if (!server) return false;
   try {
@@ -97,21 +145,43 @@ export function sendWithConnectionPolicy(
   physicalFetch: typeof globalThis.fetch,
   input: Parameters<typeof globalThis.fetch>[0],
   init?: RequestInit,
+  egress?: ProviderEgressBinding,
 ): Promise<Response> {
   const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
   const fresh = wantsFreshConnection(input);
   if (fresh) {
     headers.set("Connection", "close");
   }
+  // Decided here, against the destination this send is actually going to, and around whichever
+  // executor was just selected. A `dispatchOverride` that rebuilds a queued request can change
+  // both the upstream host and the provider transport after the wrapper was constructed, so a
+  // route resolved at construction could be applied to a different host than it was decided for.
+  // These calls nest: an override decides with its own binding and then hands the send to the
+  // executor `providerFetch` supplied, which is another one of these. The outermost caller holds
+  // the reselected provider and the rebuilt destination, so it decides and marks the init; the
+  // inner pass honours that mark rather than recomputing from a stale closure.
+  const alreadyDecided = (init as Record<symbol, unknown> | undefined)?.[EGRESS_DECIDED] === true;
+  const decide = egress !== undefined && !alreadyDecided;
+  const egressInit = decide ? providerEgressSendInit(egress, physicalFetch, input) : {};
   return physicalFetch(input, {
     ...init,
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),
+    ...egressInit,
+    ...(decide ? { [EGRESS_DECIDED]: true } : {}),
   });
 }
 
 export interface ProviderFetchOptions {
+  /**
+   * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
+   *
+   * Set by a caller replacing an HTTP stream that already failed: a WS create frame is a
+   * different send on a different transport, and the replacement has to be the same kind of
+   * exchange the client is already reading.
+   */
+  httpOnly?: boolean;
   nativeControl?: NativeResponseControl;
   providerName?: string;
   modelId?: string;
@@ -130,28 +200,63 @@ export function providerFetch(
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
   options: ProviderFetchOptions = {},
 ): ProviderFetch {
-  const configuredFetch = Object.assign(
+  const providerName = options.providerName ?? "<unnamed provider>";
+  const customExecutor = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch;
+  // The route is applied at the physical send (see `sendWithConnectionPolicy`). This binding is
+  // only what that boundary needs to decide it.
+  const egressBinding: ProviderEgressBinding = { providerName, provider };
+  // Resolved per request, not once per wrapper: `providers.<name>.noProxy` is evaluated against
+  // the destination, so two requests through the same executor can legitimately take different
+  // routes. A malformed value throws and rejects the request rather than degrading to the
+  // global proxy or to direct, either of which would read as success at the call site.
+  const egressFor = (input: Parameters<typeof globalThis.fetch>[0]) => resolveProviderEgress({
+    providerName,
+    provider,
+    url: typeof input === "string" ? input : input instanceof URL ? input : input.url,
+  });
+  // The built-in executor forwards its init to a transport that honours the proxy option.
+  const configuredFetch = markEgressTransparentExecutor(Object.assign(
     (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => configuredOutboundFetch(input, init),
     { preconnect: globalThis.fetch.preconnect?.bind(globalThis.fetch) },
-  ) as typeof globalThis.fetch;
-  const base = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? configuredFetch;
+  ) as typeof globalThis.fetch);
+  const base = customExecutor ?? configuredFetch;
   const preconnect = (...args: Parameters<typeof globalThis.fetch.preconnect>): void => {
     base.preconnect?.(...args);
   };
   // Rebuilt dispatches must use the same physical-send boundary as ordinary HTTP sends.
   // Return the original 3xx so the response owner retains its retry/health/relay contract.
-  const dispatch = Object.assign(
+  //
+  // Marked transparent because it forwards its init to a transport that honours the proxy
+  // option. Leaving it unmarked would make an ordinary configured provider refuse its own route
+  // on every overridden path, after the attempt had already been recorded — an override selects
+  // `provider.fetch ?? execute`, and `execute` is this wrapper. It still carries the binding, so
+  // an override that simply calls it gets the route decided rather than dropped; an override
+  // that decided for itself has already marked the init and this pass defers to that decision.
+  const dispatch = markEgressTransparentExecutor(Object.assign(
     (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) =>
-      sendWithConnectionPolicy(base, input, init),
+      sendWithConnectionPolicy(base, input, init, egressBinding),
     { preconnect },
-  ) as typeof globalThis.fetch;
+  ) as typeof globalThis.fetch);
   const httpFetch = Object.assign(
     async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+      // Refuse before any dispatch side effect where that is sound. `beforeDispatch` commits
+      // attempt accounting and consumes admission state, so a refusal firing after it would
+      // charge an attempt for a send that never happens, and a throwing hook would mask the
+      // egress error with an unrelated one.
+      //
+      // With no override, this input and `base` ARE the final destination and executor, so the
+      // full decision can be made now. With an override, only the configured value is checked:
+      // the override may rebuild against a different host and select a different transport, and
+      // refusing on this destination would reject a request whose real route is fine.
+      if (options.dispatchOverride) egressFor(input);
+      else providerEgressSendInit(egressBinding, base, input);
       // The hook inspects the outgoing headers and refuses the send by throwing; it is not a
       // mutator, and the copy it receives is deliberately not threaded onward. `Connection`
       // is decided inside `dispatch`, which runs after this, so the fresh-connection policy
       // wins regardless of what any caller or hook put in the header.
       options.beforeDispatch?.(new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+      // No proxy option is attached here: a `dispatchOverride` may rebuild this request against
+      // a different destination, so the route is decided at the physical send instead.
       const dispatchInit = { ...withUpstreamHttpVersion(input, init, provider), timeout: 0 };
       return options.dispatchOverride
         ? options.dispatchOverride(input, dispatchInit, dispatch)
@@ -164,7 +269,13 @@ export function providerFetch(
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
   const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
     const upstreamWebsocket = provider.upstreamWebsocket === true;
-    if (typeof input === "string" && init && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
+    if (!options.httpOnly && typeof input === "string" && init
+      && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
+      const egress = egressFor(input);
+      if (providerEgressIsExplicit(egress)) {
+        warnEgressWebsocketDowngradeOnce(providerName, describeProviderEgressForLog(egress));
+        return httpFetch(input, init);
+      }
       // The fallback has to be the same HTTP fetch the non-WS branch would have
       // used, protocol pin included: a WS turn that falls back is serving the
       // request over HTTP, and dropping the provider's `upstreamHttpVersion`
@@ -188,11 +299,16 @@ export function providerFetch(
     await waitForPacing(init?.signal ?? undefined);
     return unpaced(input, init);
   };
-  return Object.assign(wrapped, {
+  // The returned wrapper forwards its init down to `dispatch`, which applies the route at the
+  // physical send. Adapters that hand this executor back as `provider.fetch` (Cursor does)
+  // therefore still carry a per-provider route instead of being refused as opaque.
+  const paceAware = Object.assign(wrapped, {
     preconnect,
     waitForPacing,
     unpacedFetch: Object.assign(unpaced, { preconnect }),
   });
+  markEgressTransparentExecutor(paceAware as unknown as typeof globalThis.fetch);
+  return paceAware;
 }
 
 

package/src/server/responses/input-admission.ts

@@ -85,9 +85,19 @@ function imageTokens(imageUrl: string): number {
 function contentPartTokens(part: OcxContentPart, modelId: string): number {
   if (part.type === "image") return imageTokens(part.imageUrl);
   if (part.type === "video") return imageTokens(part.videoUrl);
+  // An inline document is a base64 payload, not a sentence: estimating it from its marker would
+  // admit a request whose real input is orders of magnitude larger. Counted arithmetically —
+  // rebuilding the data URL here would materialize a second request-sized string just to measure it.
+  if (part.type === "document") return base64PayloadTokens(part.data);
   return estimateTokens(part.text, modelId);
 }
 
+function base64PayloadTokens(base64: string): number {
+  if (base64.length === 0) return 0;
+  const decoded = Math.floor((base64.length * 3) / 4);
+  return Math.max(1, Math.ceil(decoded / IMAGE_BYTES_PER_TOKEN));
+}
+
 function contentTokens(content: string | readonly OcxContentPart[], modelId: string): number {
   if (typeof content === "string") return estimateTokens(content, modelId);
   let total = 0;

package/src/server/responses/passthrough-delivery.ts

@@ -93,6 +93,7 @@ import { createResponsesFieldBackfillBlockRewrite } from "./responses-field-back
 import { createResponsesFunctionToolRepairBlockRewrite } from "../responses-function-tool-repair";
 import {
   createUndeclaredToolCallGuardBlockRewrite,
+  currentTurnWireToolCatalogBody,
   undeclaredToolCallNameInResponse,
   undeclaredToolCallMessage,
   normalizeDefaultNamespaceInJson,
@@ -515,7 +516,19 @@ export async function deliverPassthroughResponse(
           ? createGrokResponsesTimestampBlockRewrite()
           : undefined,
         grokClientCompatibilityEnabled
-          ? createGrokResponsesSparseTerminalBlockRewrite(translatorBudget)
+          ? createGrokResponsesSparseTerminalBlockRewrite(
+            translatorBudget,
+            nativeExchange.outboundRequestBody,
+            {
+              clientToolAuthorizationBody: currentTurnWireToolCatalogBody(
+                parsed._rawBody,
+                parsed._replayPrefixLen ?? 0,
+              ),
+              routedNamespaceToolAliases: responseEffects.routedNamespaceToolAliases,
+              routedMuseToolNameAliases: responseEffects.routedMuseToolNameAliases,
+              convertedRoutedCustomToolNames: routedCustomToolNames,
+            },
+          )
           : undefined,
         snapshotRepairEnabled
           ? createResponsesSnapshotBlockRewrite(nativeExchange.outboundRequestBody, translatorBudget)

package/src/server/responses/passthrough-dispatch.ts

@@ -102,7 +102,7 @@ import {
   clearCodexModelDenialEvidence,
   recordCodexModelDenialEvidence,
 } from "../../codex/model-entitlements";
-import { readCodexWsStage } from "./codex-ws-wire";
+import { isCodexWsUpstreamResponse, readCodexWsStage } from "./codex-ws-wire";
 import { linkAbortSignal } from "./core-lifetime";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import { checkOutboundBodySize, describeOutboundBodyRefusal } from "./outbound-body-guard";
@@ -112,7 +112,8 @@ import {
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
   isNonReplayableResponse,
- prepareSameTarget429Wait,
+  refetchAfterProtocolSafeReset,
+  prepareSameTarget429Wait,
   sleepWithAbort,
 } from "../../lib/upstream-retry";
 import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
@@ -151,7 +152,9 @@ import {
   reasoningEffortRejectionText,
 } from "./core-opaque-recovery";
 import type { RequestLogContext } from "../request-log";
-import { preflightComboStreamResponse } from "./combo-stream-preflight";
+import { deferProtocolSafeResetRecovery, preflightComboStreamResponse } from "./combo-stream-preflight";
+import { authorizeResendForRecovery } from "../../lib/request-resend-gate";
+import { ambiguousResendAllowanceFor, selfContainedResponsesBody } from "./reset-replay";
 import { upstreamErrorMessageFromPayload, ENCRYPTED_FUNCTION_OUTPUT_REJECTION } from "../../lib/errors";
 import { isTransientConsoleGoUploadRejection } from "../../providers/opencode-zen-rate-limit";
 import { planReasoningEffortDowngrade } from "../../providers/reasoning-metadata";
@@ -189,6 +192,8 @@ export async function preparePassthroughExchange(
     | "genericFailovers"
     | "applyFailoverSnapshot"
     | "noteRoutedAttemptSend"
+    | "selectionIsCurrent"
+    | "requestBindings"
   >,
   responseEffects: Pick<
     ResponsesEffects,
@@ -206,6 +211,7 @@ export async function preparePassthroughExchange(
     | "recoverySendAllowance"
     | "recoveryClassFor"
     | "sendBudgetExhausted"
+    | "claimAmbiguousResend"
     | "reserveCredentialHop"
     | "pendingHopPermit"
     | "workflowRootId"
@@ -239,6 +245,7 @@ export async function preparePassthroughExchange(
     recoverySendAllowance,
     recoveryClassFor,
     sendBudgetExhausted,
+    claimAmbiguousResend,
     reserveCredentialHop,
     workflowRootId,
   } = sendBudgetState;
@@ -704,6 +711,35 @@ export async function preparePassthroughExchange(
     );
     const configuredTransientSendBudgetExhausted = (): boolean =>
       transientSendPolicy() !== null && transientSendAttempts() === 0;
+    /**
+     * Judged once. The inbound body does not change between legs, and every rebuild this lane
+     * performs only ever REMOVES a hazard -- `previous_response_id` is expanded, hosted tools
+     * are lowered into client execution -- so a body that was replaceable stays replaceable.
+     * Memoized rather than recomputed because it walks the input array, and a provider that
+     * never opted in must not pay for it at all.
+     */
+    let selfContainedJudgment: boolean | undefined;
+    const requestIsSelfContained = (): boolean =>
+      selfContainedJudgment ??= selfContainedResponsesBody(parsed._rawBody);
+    /**
+     * The operator's replacement grant for THIS logical request.
+     *
+     * Read per leg because `route.provider` is reassigned by credential rotation and transport
+     * resolution inside the recovery loop, exactly like `transientSendPolicy`. The counter it
+     * claims from is not per leg: it lives on the request's execution budget, which a combo
+     * child shares, so every ambiguous stage of this request draws on the same grant.
+     */
+    const ambiguousResend = () =>
+      ambiguousResendAllowanceFor(route.provider, requestIsSelfContained, claimAmbiguousResend);
+    /**
+     * The pre-header row of the stage table, asked through the one gate.
+     *
+     * `fetchWithResetRetry` takes a plain callback because it is a leaf that must not import
+     * the server tree; routing the answer through `authorizeResendForRecovery` here is what
+     * keeps the decision derived from the table rather than restated as a boolean.
+     */
+    const claimPreHeaderResend = (): boolean =>
+      authorizeResendForRecovery("pre-header", "connection-reset", ambiguousResend()).allowed;
     /**
      * Refuse a built body that exceeds the operator's configured ceiling, before it is sent.
      *
@@ -845,6 +881,7 @@ export async function preparePassthroughExchange(
         },
         { abortSignal: upstream.signal, label: safeHostLabel(request.url),
           attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends,
+          claimAmbiguousResend: claimPreHeaderResend,
           // The OpenCode Go destination stalls-then-drops inference sends (ambiguous
           // pre-header resets surfacing as refused 429s); its subscription traffic is
           // inference-only, so a bounded reset replay here absorbs the blip instead of
@@ -949,7 +986,8 @@ export async function preparePassthroughExchange(
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: allowance.attempts, onSendsConsumed: noteTransientSends },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: allowance.attempts,
+            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
         );
       } catch (err) {
         return { failed: transportFailureResponse(err) };
@@ -1030,35 +1068,54 @@ export async function preparePassthroughExchange(
         // every other build site; a replay is exactly when a grown payload reappears.
         const replayBodyRefusal = refuseOversizedOutboundBody(request);
         if (replayBodyRefusal) return replayBodyRefusal;
-        transportState.noteRoutedAttemptSend(passthroughEstimate, "oauth-401");
-        upstreamResponse = await fetchWithHeaderTimeout(
-          request.url,
-          { method: request.method, headers: request.headers, body: request.body },
-          upstream.signal,
-          connectMs,
-          parsed.stream,
-          // The replay-dispatched signal is what bounds the rest of this logical request, so it
-          // has to describe a send that actually happened. fetchWithHeaderTimeout awaits pacing
-          // admission BEFORE calling the executor, so signalling at the call site would spend the
-          // budget even when a rejected pacing wait means nothing reaches the network. Wrapping
-          // the executor moves the signal to the last moment before the send, where a throw from
-          // here on is a genuine transport attempt.
-          storedPoolReplayDispatchNotifier(
-            providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
-                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
-                ? options.nativeControl : undefined,
-              dispatchOverride: oauthDispatch(request),
-              providerName: route.providerName,
-              modelId: route.modelId,
-              onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
-              beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
-            }),
-            codex401ReplayKind === "stored" ? options.onStoredPool401ReplayDispatched : undefined,
-          ),
-          route.provider.authMode === "forward",
-        ).then(adoptObservedResponse);
+        // The replay-dispatched signal is what bounds the rest of this logical request, so it
+        // has to describe a send that actually happened. fetchWithHeaderTimeout awaits pacing
+        // admission BEFORE calling the executor, so signalling at the call site would spend the
+        // budget even when a rejected pacing wait means nothing reaches the network. Wrapping
+        // the executor moves the signal to the last moment before the send, where a throw from
+        // here on is a genuine transport attempt. The notifier is built once for the whole leg:
+        // it fires on the first dispatch, and a replacement is another send of the same replay
+        // rather than a second one to announce.
+        const oauthReplayExecutor = storedPoolReplayDispatchNotifier(
+          providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+            nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+              && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+              ? options.nativeControl : undefined,
+            dispatchOverride: oauthDispatch(request),
+            providerName: route.providerName,
+            modelId: route.modelId,
+            onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
+            beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+              ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+          }),
+          codex401ReplayKind === "stored" ? options.onStoredPool401ReplayDispatched : undefined,
+        );
+        // Routed through the shared helper so an ambiguous reset on THIS leg answers with the
+        // same refusal every other leg gives. A bare fetch here rejected instead, and the
+        // caller's transport-failure path turns a rejection into a client-retryable 502 --
+        // which invites the whole turn to be sent again, on a leg whose first send may already
+        // have run it.
+        upstreamResponse = await fetchWithTransientRetry(
+          recovery => {
+            transportState.noteRoutedAttemptSend(passthroughEstimate, recovery ?? "oauth-401");
+            return fetchWithHeaderTimeout(
+              request.url,
+              applyUpstreamRecoveryInit({
+                method: request.method,
+                headers: request.headers,
+                body: request.body,
+              }, recovery),
+              upstream.signal,
+              connectMs,
+              parsed.stream,
+              oauthReplayExecutor,
+              route.provider.authMode === "forward",
+            ).then(adoptObservedResponse);
+          },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url),
+            attempts: remainingTransientSendBudget(transientSendAttempts()),
+            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
+        );
       } catch (err) {
         return transportFailureResponse(err);
       } finally {
@@ -1182,7 +1239,8 @@ export async function preparePassthroughExchange(
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()),
+            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -1314,7 +1372,8 @@ export async function preparePassthroughExchange(
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()),
+            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -1571,6 +1630,91 @@ export async function preparePassthroughExchange(
         continue passthroughRecovery;
       }
     }
+
+    // The post-header row of the same table. A native SSE body can die after the head with the
+    // caller having observed nothing, which is the identical question the pre-header helper
+    // answers -- and the identical grant, because both claim from this request's one allowance.
+    const streamRecoveryContentType = upstreamResponse.headers.get("content-type")?.toLowerCase() ?? "";
+    const protocolRecoveryCandidate = upstreamResponse.ok
+      && !!upstreamResponse.body
+      && !isNonReplayableResponse(upstreamResponse)
+      // The WebSocket transport settles its own ambiguous failures and marks them
+      // non-replayable; re-reading its body here would be a second owner of one exchange.
+      && !isCodexWsUpstreamResponse(upstreamResponse)
+      // A downstream WebSocket turn that fell back to HTTP must relay response.created
+      // immediately so the client can address the turn and receive explicit control refusal.
+      // This preflight retains that event until output commits, so the two contracts cannot
+      // share one body owner.
+      && !(options.nativeControl && options.inboundTransport === "websocket")
+      && ambiguousResend() !== undefined
+      && remainingTransientSendBudget(transientSendAttempts()) > 0
+      && (streamRecoveryContentType.includes("text/event-stream") || (!streamRecoveryContentType && parsed.stream));
+    if (protocolRecoveryCandidate) {
+      upstreamResponse = deferProtocolSafeResetRecovery(
+        upstreamResponse,
+        { model: logCtx.model, provider: logCtx.provider },
+        (error, stage) => refetchAfterProtocolSafeReset(
+          (signal = upstream.signal) => fetchWithHeaderTimeout(
+            request.url,
+            applyUpstreamRecoveryInit({
+              method: request.method,
+              headers: request.headers,
+              body: request.body,
+            }, "connection-reset"),
+            signal,
+            connectMs,
+            true,
+            providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              // A replacement HTTP body must not open a fresh WebSocket exchange: the turn it
+              // replaces was an HTTP stream, and a WS create frame is a different send.
+              httpOnly: true,
+              providerName: route.providerName,
+              modelId: route.modelId,
+              dispatchOverride: oauthDispatch(request),
+              beforeDispatch: headers => {
+                if (signal.aborted) throw signal.reason;
+                if (!transportState.selectionIsCurrent(transportState.requestBindings.get(request))) {
+                  throw new Error("Credential selection changed before pre-output stream recovery");
+                }
+                if (isCanonicalOpenAiForwardProvider(route.provider)) {
+                  createCodexReserveDispatchGuard(
+                    admissionState.authCtx,
+                    options.codexAuthPolicy ?? config,
+                    route.modelId,
+                    options.admission,
+                    options.visionDescribeTerminal === true,
+                  )?.(headers);
+                }
+                // Recorded with the kind the gate derived its cause from, at the moment the
+                // send actually leaves. One authorisation, one recorded reason, one send.
+                transportState.noteRoutedAttemptSend(passthroughEstimate, "connection-reset");
+                // Charged to the SAME request counter every other send goes through. The
+                // replacement is bought here rather than by a nested retry helper, so there is
+                // one charge for one send and no per-layer counter to reconcile.
+                noteTransientSends(1);
+              },
+            }),
+            route.provider.authMode === "forward",
+          ).then(adoptObservedResponse),
+          error,
+          {
+            abortSignal: upstream.signal,
+            label: safeHostLabel(request.url),
+            attempts: remainingTransientSendBudget(transientSendAttempts()),
+            // The whole decision, including the stage the preflight observed and the grant the
+            // pre-header helper shares. A committed stage refuses here without touching the
+            // allowance, which is what keeps a turn that already emitted output from draining
+            // the replacement a later ambiguous reset would have been entitled to.
+            authorize: () => authorizeResendForRecovery(stage, "connection-reset", ambiguousResend()).allowed,
+            acceptResponse: candidate => {
+              const type = candidate.headers.get("content-type")?.toLowerCase() ?? "";
+              return type.includes("text/event-stream") || (!type && parsed.stream);
+            },
+          },
+        ),
+        { allowMissingContentType: !streamRecoveryContentType && parsed.stream },
+      );
+    }
     break;
     }
 

package/src/server/responses/passthrough-error.ts

@@ -1,6 +1,11 @@
 import { formatErrorResponse } from "../../bridge";
 import { isCyberPolicyCode, isCyberPolicyMessage } from "../../lib/errors";
-import { isReplayRefusalCode, UPSTREAM_RESET_REPLAY_REFUSED_CODE } from "../../lib/upstream-retry";
+import {
+  applyReplayRefusalClientHeaders,
+  isReplayRefusalCode,
+  retainReplayRefusal,
+  UPSTREAM_RESET_REPLAY_REFUSED_CODE,
+} from "../../lib/upstream-retry";
 import {
   resolveClientRetryAfter,
   validateClientRetryAfterHeader,
@@ -62,6 +67,10 @@ function isReplayRefusalBody(body: string): boolean {
  * - a replay refusal this proxy wrote gets none and keeps none: the whole point of the
  *   refusal is that the turn may already be running, and the synthetic default for a
  *   retryable 429 is a direct instruction to the client to send it a second time
+ *
+ * A refusal also leaves with the shared no-retry header and the in-process marker, so the
+ * verdict survives this re-wrap as a property of the response rather than as a status a later
+ * reader would have to guess from.
  */
 export function formatPassthroughUpstreamError(
   status: number,
@@ -84,11 +93,10 @@ export function formatPassthroughUpstreamError(
   const upstreamRetryAfter = options?.headers?.get("retry-after")?.trim() || undefined;
   const originalValid = validateClientRetryAfterHeader(upstreamRetryAfter, now);
   const cyberPolicyFailure = isCyberPolicyBody(trimmed);
+  const replayRefusal = options?.replayRefusal === true || isReplayRefusalBody(trimmed);
   // Two different reasons to answer with no wait at all, handled the same way: a hard policy
   // block will not become servable, and a refusal we made was never a rate limit.
-  const suppressRetryAfter = cyberPolicyFailure
-    || options?.replayRefusal === true
-    || isReplayRefusalBody(trimmed);
+  const suppressRetryAfter = cyberPolicyFailure || replayRefusal;
   const resolved = suppressRetryAfter
     ? undefined
     : resolveClientRetryAfter({
@@ -105,7 +113,9 @@ export function formatPassthroughUpstreamError(
         && upstreamRetryAfter !== undefined
         && originalValid === undefined);
 
-    if (!needsSet && !needsDelete) {
+    // A refusal always takes the rewriting path: it has a header to add even when the
+    // upstream named no wait for it to remove.
+    if (!needsSet && !needsDelete && !replayRefusal) {
       return new Response(bodyText, {
         status,
         ...(options?.statusText ? { statusText: options.statusText } : {}),
@@ -118,21 +128,30 @@ export function formatPassthroughUpstreamError(
       : new Headers({ "Content-Type": "application/json" });
     if (needsSet) headers.set("Retry-After", resolved!);
     else headers.delete("Retry-After");
-    return new Response(bodyText, {
+    if (replayRefusal) applyReplayRefusalClientHeaders(headers);
+    const rewritten = new Response(bodyText, {
       status,
       ...(options?.statusText ? { statusText: options.statusText } : {}),
       headers,
     });
+    return replayRefusal ? retainReplayRefusal(rewritten) : rewritten;
   }
 
   const response = formatErrorResponse(
     status,
     "upstream_error",
     `Provider error ${status}: (empty body)`,
-    resolved !== undefined ? { retryAfter: resolved } : undefined,
+    // Provenance is all that is left when the bounded read returned nothing display-safe, and
+    // it is enough: the formatter allowlists this code, restates the refusal status and marks
+    // the response, so an unreadable refusal reaches the client as the same refusal.
+    replayRefusal
+      ? { code: UPSTREAM_RESET_REPLAY_REFUSED_CODE }
+      : resolved !== undefined ? { retryAfter: resolved } : undefined,
   );
   const headers = new Headers(response.headers);
   headers.set("Content-Type", "application/json");
   if (resolved !== undefined) headers.set("Retry-After", resolved);
-  return new Response(response.body, { status: response.status, headers });
+  if (replayRefusal) applyReplayRefusalClientHeaders(headers);
+  const wrapped = new Response(response.body, { status: response.status, headers });
+  return replayRefusal ? retainReplayRefusal(wrapped) : wrapped;
 }