@bitkyc08/opencodex 2.60.0 → 2.61.0-preview.20260922

package/src/server/responses/request-prepare.ts

@@ -52,7 +52,7 @@ import { parseRequest } from "../../responses/parser";
 import { anthropicSessionKeyFromParts } from "../../oauth/anthropic-routing";
 import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
 import { bindTurnTerminationScope, rememberDeliveredFinalAnswer } from "../../responses/turn-termination";
-import { requestLogSpeedLabel, readConfiguredCodexServiceTier } from "../request-log";
+import { observeCacheDiagnosticInbound, rebindCacheDiagnosticBody, requestLogSpeedLabel, readConfiguredCodexServiceTier } from "../request-log";
 import type { RouteResult } from "../../router";
 import {
   captureRouteStaticPolicy,
@@ -110,6 +110,13 @@ import {
   CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE,
 } from "../../codex/loopback-target";
 import { checkComboTargetInputAdmission, checkInputAdmission } from "./input-admission";
+import {
+  admissionModelDeniedResponse,
+  AdmissionModelDeniedError,
+  assertRouteAllowedByScope,
+  resolveAdmissionModelScope,
+  routeAllowedByScope,
+} from "../admission-model-scope";
 import { nativeContextLimits } from "../../codex/catalog";
 import { streamingContextOverflowResponse } from "./context-overflow";
 import {
@@ -150,6 +157,14 @@ export async function prepareResponsesRequest(
     }
     return decodeRequestErrorResponse(err, "responses");
   }
+  observeCacheDiagnosticInbound(
+    logCtx,
+    body,
+    req.headers,
+    options.promptCacheKeyIsSharedCohort === true
+      ? "system-derived"
+      : options.promptCacheKeyIsSharedCohort === false ? "metadata-derived" : "caller",
+  );
   if (!options.comboAttempt && !options.compactionRoutingOverride && inboundWire === "responses") {
     options.compactionRoutingOverride = applyCompactionRoutingOverride(body, req.headers, config, {
       endpoint: "responses",
@@ -293,6 +308,10 @@ export async function prepareResponsesRequest(
   try {
     parsed = parseRequest(body);
     parsed._promptCacheKeyIsSharedCohort = options.promptCacheKeyIsSharedCohort;
+    // The body may have been rebuilt since the inbound observation (previous-response
+    // expansion); alias the parsed raw body to the same draft so the outbound
+    // observation at the adapter seam still finds it.
+    rebindCacheDiagnosticBody(parsed._rawBody, logCtx.cacheDiagnosticDraft);
     // Captured before any parser mutates it, so both grammars see the client's id.
     const { fastRow, effortRow } = parseSyntheticRowId(parsed.modelId, config);
     if (fastRow) {
@@ -411,7 +430,18 @@ export async function prepareResponsesRequest(
 
   let route: RouteResult;
   let credentialDomainWasRewritten = false;
+  // The selector the caller actually sent, captured before shadow interception
+  // or a subagent fallback rewrites it, so a refusal names the client's own
+  // request rather than a destination it never asked for.
+  const inboundSelector = parsed.modelId;
+  const admissionScope = resolveAdmissionModelScope(config, options.admission);
   const captureInboundRoutePolicy = (candidate: RouteResult): RouteResult => {
+    // Every route this request path produces passes through here: the direct
+    // name, an alias, a policy or combo selection, a compaction override, a
+    // shadow-intercept target and both subagent-fallback re-routes. Checking
+    // the key's scope at this one point is what stops a rewrite from reaching
+    // a destination the front door would have refused.
+    assertRouteAllowedByScope(admissionScope, inboundSelector, candidate);
     candidate.staticPolicy = captureRouteStaticPolicy(
       candidate.providerName,
       candidate.modelId,
@@ -474,6 +504,7 @@ export async function prepareResponsesRequest(
     }
     logCtx.routeDecision = route.routeDecision;
   } catch (err) {
+    if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
     if (err instanceof NoAvailableComboTargetsError) {
       return comboUnavailable(err.comboId);
     }
@@ -673,6 +704,7 @@ export async function prepareResponsesRequest(
         credentialDomainWasRewritten = true;
         logCtx.routeDecision = route.routeDecision;
       } catch (err) {
+        if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
         if (err instanceof NoAvailableComboTargetsError) {
           return comboUnavailable(err.comboId);
         }
@@ -873,6 +905,7 @@ export async function prepareResponsesRequest(
               credentialDomainWasRewritten = true;
               logCtx.routeDecision = route.routeDecision;
             } catch (err) {
+              if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
               if (err instanceof NoAvailableComboTargetsError) {
                 return comboUnavailable(err.comboId);
               }
@@ -1021,6 +1054,14 @@ export async function prepareResponsesRequest(
     inboundTransport: options.inboundTransport,
     claudeGoAffinity: options.claudeGoAffinity,
   });
+  // Normalization is the last thing that can move the destination: resolving an
+  // OpenAI virtual model rewrites route.modelId to the wire id that will
+  // actually be billed. A scope checked only before this would authorize the
+  // public selector and send the wire model, so the settled route is checked
+  // once more here.
+  if (!routeAllowedByScope(admissionScope, route)) {
+    return admissionModelDeniedResponse(new AdmissionModelDeniedError(inboundSelector, route));
+  }
   // Attribute local auth/cooldown failures to the public selector too; exact auth may fail before
   // the normal post-resolution provider label is assigned.
   if (route.codexAccountNamespace) {

package/src/server/responses/request-send-budget.ts

@@ -139,6 +139,16 @@ export function createResponsesSendBudget(
    */
   const sendBudgetExhausted = (cap: number = TRANSIENT_RETRY_MAX_ATTEMPTS): boolean =>
     remainingTransientSendBudget(cap) === 0;
+  /**
+   * Spend one operator-granted replacement for an ambiguous failure of THIS logical request.
+   *
+   * The counter is the execution budget's, so a combo child that derives its own scope draws on
+   * the same grant. A budget that predates it -- a stub, or a caller that passed the narrow
+   * holder -- cannot grant anything, and refusing is the fail-closed answer for a send whose
+   * upstream state is unknown.
+   */
+  const claimAmbiguousResend = (limit: number): boolean =>
+    isRequestExecutionBudget(sendBudget) && sendBudget.claimAmbiguousResend?.(limit) === true;
   /**
    * A credential hop reserves the send its own replay will make, and that replay is a recovery
    * leg. The leg must SPEND the hop's reservation instead of taking a second one: the
@@ -263,6 +273,7 @@ export function createResponsesSendBudget(
     noteAdapterPhysicalSend,
     noteAdapterRecoveryWithheld,
     sendBudgetExhausted,
+    claimAmbiguousResend,
     get pendingHopPermit(): SingleUseDispatchPermit | undefined {
       return pendingHopPermit;
     },
@@ -301,6 +312,7 @@ function adapterDispatchBudgetView(
     get targetTransitions(): number { return budget.targetTransitions; },
     get lastTargetKey(): string | undefined { return budget.lastTargetKey; },
     remainingBaseSends: (cap: number): number => budget.remainingBaseSends(cap),
+    claimAmbiguousResend: (limit: number): boolean => budget.claimAmbiguousResend?.(limit) === true,
     reserveDispatch(intent: DispatchIntent): DispatchDecision {
       // A dispatch whose upstream state is unknown is refused on its own merits. A hop that
       // already paid does not make an unsafe replay safe, so that check stays with the budget.

package/src/server/responses/request-transport.ts

@@ -64,6 +64,7 @@ import {
   recordKeyAttemptUsage,
 } from "../request-log";
 import type { AttemptRecoveryKind } from "../../usage/log";
+import { bindAttemptDeliveryRecorder } from "../../usage/attempt-delivery";
 import { resolvePassiveRouteSubjectId } from "../passive-route-linker";
 
 /** Owns live credential selection and adapter bindings for one request. */
@@ -298,15 +299,25 @@ export async function prepareResponsesTransport(
         recordKeyAttemptUsage(logCtx, event.usage);
       }
     };
+    // Counted at the one seam every adapter parse passes, and counted for EVERY event rather
+    // than only usage-bearing ones: the number this pairs with is the frame count the client
+    // transport relayed, and a difference between the two is the loss signal (#3983). Reading
+    // the current attempt through logCtx rather than capturing one keeps the count with the
+    // attempt that is live when the event arrives, across a mid-request attempt rotation.
+    const delivery = bindAttemptDeliveryRecorder(translatorBudget, () => logCtx.activeAttempt);
+    const observeEvent = (event: AdapterEvent, response: object): void => {
+      delivery.noteAdapterEvent();
+      observeUsage(event, response);
+    };
     const parseStream = resolved.parseStream.bind(resolved);
     resolved.parseStream = async function* (...args) {
-      for await (const event of parseStream(...args)) { observeUsage(event, args[0]); yield event; }
+      for await (const event of parseStream(...args)) { observeEvent(event, args[0]); yield event; }
     };
     if (resolved.parseResponse) {
       const parseResponse = resolved.parseResponse.bind(resolved);
       resolved.parseResponse = async (...args) => {
         const events = await parseResponse(...args);
-        events.forEach(event => observeUsage(event, args[0]));
+        events.forEach(event => observeEvent(event, args[0]));
         return events;
       };
     }
@@ -321,7 +332,7 @@ export async function prepareResponsesTransport(
       const runTurn = resolved.runTurn.bind(resolved);
       rawRunTurns.set(resolved, (requestParsed, incoming, emit) => {
         const response = {};
-        return runTurn(requestParsed, incoming, event => { observeUsage(event, response); emit(event); });
+        return runTurn(requestParsed, incoming, event => { observeEvent(event, response); emit(event); });
       });
       resolved.runTurn = (requestParsed, incoming, emit) => runSelectedTurn(resolved, requestParsed, incoming, emit);
     }
@@ -409,7 +420,16 @@ export async function prepareResponsesTransport(
           // Either way the send crosses the physical boundary, so the connection policy is
           // applied around whichever implementation was just selected (#4992).
           commitKeyAttemptSend();
-          const response = await sendWithConnectionPolicy(fetchImpl, destination, { ...dispatchInit, redirect: "manual" });
+          // The binding travels with the send, so a rebuilt request resolves its provider route
+          // against the destination it is actually going to rather than the one this dispatch
+          // started with. Account reselection can move the upstream host, which would otherwise
+          // apply a host-scoped decision to a different host.
+          const response = await sendWithConnectionPolicy(
+            fetchImpl,
+            destination,
+            { ...dispatchInit, redirect: "manual" },
+            { providerName: route.providerName, provider: route.provider },
+          );
           if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
           // Observe each physical response before retries replace it. The binding belongs to
           // this dispatch, so a manual switch cannot file A's headers against B. Header

package/src/server/responses/reset-replay.ts

@@ -0,0 +1,108 @@
+/**
+ * The operator opt-in that overrides the stage table's refusal, and the one request-wide
+ * allowance both ambiguous stages claim from.
+ *
+ * `resendPermission` answers `refused-ambiguous` for a native Responses send that died with
+ * the caller having observed nothing -- before the response head, or after it while the SSE
+ * body carried only control events. This module is the one place that answer is overridden,
+ * and it is narrow on three axes at once: the provider has to opt in, the request has to be
+ * one whose second send cannot do more than run the same inference again, and the whole
+ * logical request gets a fixed number of replacements no matter how many legs ask.
+ *
+ * The judgment is made on the inbound body the client sent, which is already parsed. It is
+ * conservative for the outbound request: the proxy expands `previous_response_id` and lowers
+ * hosted tools into client execution, so every hazard that reaches the wire was visible here,
+ * and a hazard visible here may already have been removed. A cheap fail-closed answer beats
+ * re-parsing a multi-megabyte outbound body on every send.
+ */
+import type { OcxProviderConfig } from "../../types";
+import { resetReplayPolicyFor } from "../../providers/key-failover";
+import type { AmbiguousResendAllowance } from "../../lib/request-resend-gate";
+
+/** Input items a client owns end to end: replaying them re-runs nothing but the model. */
+const CLIENT_INPUT_ITEM_TYPES: ReadonlySet<string> = new Set([
+  "message", "reasoning", "compaction",
+  "function_call", "function_call_output",
+  "custom_tool_call", "custom_tool_call_output",
+  "tool_search_call",
+]);
+const MESSAGE_ROLES: ReadonlySet<string> = new Set(["user", "assistant", "system", "developer"]);
+/** Bounded traversal: a catalog is operator data, not a reason to walk forever. */
+const MAX_TOOL_ENTRIES = 4096;
+const MAX_TOOL_DEPTH = 4;
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * True when every tool in the catalog is executed by the client. Hosted tools (`web_search`,
+ * `mcp`, `code_interpreter`, ...) run on the origin during the turn, so an unknown or hosted
+ * type fails the whole catalog rather than being skipped: a tool this proxy does not
+ * recognise is a tool it cannot vouch for.
+ */
+function clientExecutedTools(tools: unknown, budget: { remaining: number }, depth = 0): boolean {
+  if (!Array.isArray(tools) || depth > MAX_TOOL_DEPTH) return false;
+  return tools.every(tool => {
+    budget.remaining -= 1;
+    if (budget.remaining < 0 || !record(tool)) return false;
+    if (tool.type === "function" || tool.type === "custom") return true;
+    if (tool.type === "tool_search") return tool.execution === "client";
+    return tool.type === "namespace" && typeof tool.name === "string"
+      && clientExecutedTools(tool.tools, budget, depth + 1);
+  });
+}
+
+/**
+ * A Responses body whose second send can only repeat the inference: nothing stored, no
+ * server-side continuation state, complete input, and only client-executed tools. Deferred
+ * tool declarations inside `input` are checked by the same rule as the root catalog, so a
+ * hosted tool cannot ride in through `additional_tools` or a `tool_search_output`.
+ */
+export function selfContainedResponsesBody(body: unknown): boolean {
+  if (!record(body)) return false;
+  if (body.store !== false || body.background === true) return false;
+  if (body.previous_response_id != null || body.conversation != null || Object.hasOwn(body, "stream_id")) return false;
+  const input = body.input;
+  if (typeof input !== "string" && !Array.isArray(input)) return false;
+  const budget = { remaining: MAX_TOOL_ENTRIES };
+  if (body.tools !== undefined && !clientExecutedTools(body.tools, budget)) return false;
+  if (typeof input === "string") return true;
+  return input.every(item => {
+    if (!record(item)) return false;
+    if (item.type === "additional_tools" || item.type === "tool_search_output") {
+      return clientExecutedTools(item.tools, budget);
+    }
+    if (item.type === undefined) return typeof item.role === "string" && MESSAGE_ROLES.has(item.role);
+    return typeof item.type === "string" && CLIENT_INPUT_ITEM_TYPES.has(item.type);
+  });
+}
+
+/**
+ * The allowance for ONE logical request, or nothing when the provider did not opt in.
+ *
+ * Built once per request and handed to every leg. `claim` spends the request's counter, which
+ * lives on the execution budget and is therefore shared with a combo child's derived scope --
+ * that sharing is the reason the pre-header helper takes a callback instead of a number.
+ *
+ * The body judgment is carried rather than applied here, because the gate has to be able to
+ * say WHY it refused: "the operator granted nothing" and "this request cannot be replayed" are
+ * different operator problems, and folding them together is what made the old refusal a single
+ * undifferentiated no.
+ *
+ * `selfContained` is a predicate rather than a body, and the getter below is why: a provider
+ * that never opted in must not pay to walk the input array, and the caller memoizes one answer
+ * across every leg of the request.
+ */
+export function ambiguousResendAllowanceFor(
+  provider: Pick<OcxProviderConfig, "retryOnReset">,
+  requestIsSelfContained: () => boolean,
+  claim: (limit: number) => boolean,
+): AmbiguousResendAllowance | undefined {
+  const policy = resetReplayPolicyFor(provider);
+  if (policy === null) return undefined;
+  return {
+    get selfContained(): boolean { return requestIsSelfContained(); },
+    claim: () => claim(policy.replacements),
+  };
+}

package/src/server/responses-request-tool-scope.ts

@@ -0,0 +1,214 @@
+/**
+ * The tool selection a Responses request actually authorized, read from the final outbound body.
+ *
+ * The undeclared-tool guard answers whether a NAME was declared. This answers a different
+ * question: whether this request still permits a client tool call at all, and which names it
+ * permits. `tool_choice: "none"`, a forced selector and an `allowed_tools` allow-list each narrow
+ * the catalog without removing a declaration, so a name can be declared and forbidden at the same
+ * time — and a repair that rebuilds a terminal from collected items would otherwise hand the
+ * client a call the caller ruled out.
+ *
+ * The scope is read from the OUTBOUND body, after every removal, rename and translation, because
+ * that is the request the destination answered. A catalog that ends up empty there authorizes no
+ * client call whatever the selector still says.
+ */
+import type { MuseToolNameAliases } from "../responses/muse-tool-name-alias";
+import { museWireNameForOriginal } from "../responses/muse-tool-name-alias";
+import type {
+  RoutedNamespaceToolAliases,
+  RoutedNamespaceToolIdentity,
+} from "../responses/namespace-tool-compat";
+import {
+  CLIENT_EXECUTED_CALL_TYPES,
+  collectDeclaredWireToolNames,
+  hasExplicitWireToolCatalog,
+} from "./responses-undeclared-tool-guard";
+import { isPlainObject } from "./responses-snapshot-codec";
+
+type ToolKind = "function" | "custom";
+const BUILTIN_FUNCTIONS_NAMESPACE = "functions";
+
+type ToolIdentity = Readonly<{
+  kind: ToolKind;
+  name: string;
+  namespace?: string;
+}>;
+
+export type RequestToolScopeCorrespondence = Readonly<{
+  clientToolAuthorizationBody?: unknown;
+  routedNamespaceToolAliases?: RoutedNamespaceToolAliases;
+  routedMuseToolNameAliases?: MuseToolNameAliases;
+  convertedRoutedCustomToolNames?: ReadonlySet<string>;
+}>;
+
+function identityKey(identity: ToolIdentity): string {
+  return JSON.stringify([identity.kind, identity.namespace ?? null, identity.name]);
+}
+
+function clientNamespace(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 && value !== BUILTIN_FUNCTIONS_NAMESPACE
+    ? value
+    : undefined;
+}
+
+function selectorIdentity(selector: unknown): ToolIdentity | undefined {
+  if (!isPlainObject(selector)) return undefined;
+  if (selector.type !== "function" && selector.type !== "custom") return undefined;
+  if (typeof selector.name !== "string" || selector.name.length === 0) return undefined;
+  if ("namespace" in selector && typeof selector.namespace !== "string") return undefined;
+  const namespace = clientNamespace(selector.namespace);
+  return { kind: selector.type, name: selector.name, ...(namespace ? { namespace } : {}) };
+}
+
+function callIdentity(item: Record<string, unknown>): ToolIdentity | undefined {
+  const kind = item.type === "function_call"
+    ? "function"
+    : item.type === "custom_tool_call"
+      ? "custom"
+      : undefined;
+  if (!kind || typeof item.name !== "string" || item.name.length === 0) return undefined;
+  const namespace = clientNamespace(item.namespace);
+  return { kind, name: item.name, ...(namespace ? { namespace } : {}) };
+}
+
+function sameRestoredIdentity(left: ToolIdentity, right: RoutedNamespaceToolIdentity): boolean {
+  return left.namespace === right.namespace
+    && left.name === right.name
+    && left.kind === right.kind;
+}
+
+/**
+ * Exact identities this restored call could have used on the final outbound wire.
+ *
+ * Namespace spellings come only from namespace-tool-compat's request-scoped, ambiguity-checked
+ * aliases. Muse aliases then compose over those wire names. A kind change is admitted only when
+ * the request recorded that exact custom identity as converted to a function.
+ */
+function outboundCallIdentities(
+  item: Record<string, unknown>,
+  correspondence: RequestToolScopeCorrespondence,
+): ReadonlySet<string> {
+  const restored = callIdentity(item);
+  if (!restored) return new Set();
+  const keys = new Set<string>([identityKey(restored)]);
+  const museAliases = correspondence.routedMuseToolNameAliases ?? new Map();
+  const convertedCustom = correspondence.convertedRoutedCustomToolNames ?? new Set();
+  const originalSelection = isPlainObject(correspondence.clientToolAuthorizationBody)
+    ? toolSelection(correspondence.clientToolAuthorizationBody)
+    : UNRESTRICTED;
+  const originalSelectionAllowsRestored = originalSelection.kind === "allow"
+    && originalSelection.identities.has(identityKey(restored));
+
+  const addWireIdentity = (
+    preMuseName: string,
+    clientKind: ToolKind,
+    conversionIdentityVerified: boolean,
+  ): void => {
+    const name = museWireNameForOriginal(preMuseName, museAliases);
+    if (name === undefined) return;
+    const kind = clientKind === "custom"
+      && convertedCustom.has(preMuseName)
+      && conversionIdentityVerified
+      ? "function"
+      : clientKind;
+    keys.add(identityKey({ kind, name }));
+  };
+
+  if (restored.namespace === undefined) {
+    addWireIdentity(restored.name, restored.kind, originalSelectionAllowsRestored);
+  }
+  for (const [wireName, identity] of correspondence.routedNamespaceToolAliases ?? new Map()) {
+    // namespace-tool-compat emits only aliases authorized under the outbound selector's kind,
+    // then restores `custom` provenance from the request's conversion set. That exact alias edge is
+    // already the proof that this custom-to-function transition belongs to this identity.
+    if (sameRestoredIdentity(restored, identity)) addWireIdentity(wireName, identity.kind, true);
+  }
+  return keys;
+}
+
+type ToolSelection =
+  | { readonly kind: "unrestricted" }
+  | { readonly kind: "deny_all" }
+  | { readonly kind: "allow"; readonly identities: ReadonlySet<string> };
+
+const UNRESTRICTED: ToolSelection = { kind: "unrestricted" };
+
+/**
+ * Read the selector only where it states a client-call boundary.
+ *
+ * `auto`, `required` and an absent selector restrict nothing. A hosted selector
+ * (`{ type: "web_search" }`) forces a tool the PROVIDER runs and does not describe the client
+ * calls this turn may contain, so it is left alone rather than read as a deny-all: a false
+ * refusal would drop a call the caller could have executed.
+ */
+function toolSelection(body: Record<string, unknown>): ToolSelection {
+  const choice = body.tool_choice;
+  if (choice === "none") return { kind: "deny_all" };
+  if (!isPlainObject(choice)) return UNRESTRICTED;
+  if (choice.type === "allowed_tools") {
+    const identities = new Set<string>();
+    if (!Array.isArray(choice.tools)) return { kind: "allow", identities };
+    for (const entry of choice.tools) {
+      const identity = selectorIdentity(entry);
+      if (identity) identities.add(identityKey(identity));
+    }
+    // An allow-list carrying no client tool — emptied by normalization, or hosted entries only —
+    // still bounds this turn: it allows no client call.
+    return { kind: "allow", identities };
+  }
+  if (choice.type === "function" || choice.type === "custom") {
+    const identity = selectorIdentity(choice);
+    return {
+      kind: "allow",
+      identities: new Set(identity ? [identityKey(identity)] : []),
+    };
+  }
+  return UNRESTRICTED;
+}
+
+export type RequestToolScope = {
+  /**
+   * The name a client call is refused under, or undefined when this request permits it.
+   * A nameless call type is not answered here: only the declaration guard knows those.
+   */
+  forbiddenClientToolCallName(item: Record<string, unknown>): string | undefined;
+};
+
+/**
+ * The client-call boundary this request states, or undefined when it states none.
+ *
+ * Returning undefined for an unrestricted request keeps every ordinary turn on the path it
+ * already had: a caller that selected nothing gets no new refusal.
+ */
+export function requestToolScope(
+  body: unknown,
+  correspondence: RequestToolScopeCorrespondence = {},
+): RequestToolScope | undefined {
+  if (!isPlainObject(body)) return undefined;
+  const selection = toolSelection(body);
+  // A readable catalog that declares no client-executable name is authoritative, exactly as it is
+  // for the declaration guard: an explicit empty list denies every client call. An absent catalog
+  // says nothing — a passthrough request may omit `tools` and still receive a call the client
+  // understands.
+  const catalogDeniesClientCalls = hasExplicitWireToolCatalog(body)
+    && collectDeclaredWireToolNames(body).size === 0;
+  if (selection.kind === "unrestricted" && !catalogDeniesClientCalls) return undefined;
+  return {
+    forbiddenClientToolCallName(item: Record<string, unknown>): string | undefined {
+      if (typeof item.type !== "string" || !CLIENT_EXECUTED_CALL_TYPES.has(item.type)) {
+        return undefined;
+      }
+      const restored = callIdentity(item);
+      const reported = restored?.name;
+      if (reported === undefined) return undefined;
+      if (catalogDeniesClientCalls || selection.kind === "deny_all") return reported;
+      if (selection.kind === "allow") {
+        const candidates = outboundCallIdentities(item, correspondence);
+        return [...candidates].some(candidate => selection.identities.has(candidate))
+          ? undefined
+          : reported;
+      }
+      return undefined;
+    },
+  };
+}

package/src/server/responses-undeclared-tool-guard.ts

@@ -13,7 +13,10 @@ import {
 import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 
 /** Item types the client executes through a request-declared wire name. */
-const CLIENT_EXECUTED_CALL_TYPES = new Set(["function_call", "custom_tool_call"]);
+export const CLIENT_EXECUTED_CALL_TYPES: ReadonlySet<string> = new Set([
+  "function_call",
+  "custom_tool_call",
+]);
 /** Codex groups ordinary top-level tools here; unlike an MCP namespace, it has no wire prefix. */
 const BUILTIN_FUNCTIONS_NAMESPACE = "functions";
 

package/src/server/search.ts

@@ -25,6 +25,9 @@ import { codexAccountNamespaceForModel } from "../codex/account-namespace-match"
 import { NATIVE_RESERVE_MODEL } from "../codex/catalog/native-models";
 import { isCodexReserveRequestEligible } from "../codex/loopback-target";
 import type { DataPlaneAdmission } from "./auth-cors";
+import {
+  admissionScopeDenial,
+} from "./admission-model-scope";
 import { formatCodexProviderForLog } from "../codex/routing";
 import { signalWithTimeout } from "../lib/abort";
 import { readBoundedResponseBytes } from "../lib/bounded-body";
@@ -87,6 +90,11 @@ export async function handleSearch(
       if (!route.codexAccountId || route.codexAccountNamespace !== accountNamespace) {
         return formatErrorResponse(400, "invalid_request_error", "Invalid Codex account-qualified search model");
       }
+      // This branch resolves a model through the router and bills the account it
+      // names, so a scoped key is held to the same destination rule it is held
+      // to on the inference path.
+      const denial = admissionScopeDenial(config, admission, model, route);
+      if (denial) return denial;
       exactAccount = { accountId: route.codexAccountId, modelId: route.modelId };
       logCtx.provider = `${route.providerName}-${accountNamespace}`;
       logCtx.routeDecision = route.routeDecision;
@@ -108,7 +116,7 @@ export async function handleSearch(
   }
   const candidates = listOpenAiForwardSidecarCandidates(config);
   if (candidates.length === 0) {
-    return handleAlphaSearchSidecarFallback(body, config, req.signal, logCtx);
+    return handleAlphaSearchSidecarFallback(body, config, req.signal, logCtx, admission);
   }
 
   let upstream: Awaited<ReturnType<typeof resolveFirstUsableOpenAiSidecar>>;
@@ -148,6 +156,22 @@ export async function handleSearch(
     throw err;
   }
 
+  if (!accountNamespace) {
+    // An unqualified search model is never routed: the caller's own string is
+    // relayed to whichever ChatGPT account this upstream resolved to, and that
+    // account is billed for it. The qualified branch above was already judged
+    // against the route it resolved, so it is not judged twice here.
+    const searchModel = typeof model === "string" && model.trim() ? model : undefined;
+    const denial = admissionScopeDenial(config, admission, searchModel, {
+      providerName: upstream.providerName,
+      modelId: searchModel,
+    });
+    if (denial) {
+      upstream.releaseProbeLease?.();
+      return denial;
+    }
+  }
+
   const headers: Record<string, string> = { "content-type": "application/json" };
   if (upstream.provider.headers) Object.assign(headers, upstream.provider.headers);
   for (const [name, value] of upstream.headers) headers[name] = value;

package/src/server/usage-ledger-retention.ts

@@ -0,0 +1,73 @@
+/**
+ * Runtime owner for the opt-in usage-ledger size limit (#5063).
+ *
+ * The compactor in `src/usage/ledger-retention.ts` knows how to publish a smaller ledger safely.
+ * This is the part that decides when, and -- the half #5063 was missing -- what has to be
+ * discarded afterwards.
+ *
+ * Deleting rows from usage.jsonl invalidates three readers that do not watch the file: the
+ * 2,000-entry Logs ring, which otherwise keeps serving rows the ledger no longer has; the
+ * retained usage aggregate and failure projection, whose checkpoints now point past a boundary
+ * that moved; and the request-history index, whose source identity has changed. A compaction
+ * that skips any of them makes the dashboard disagree with the ledger, which is the disagreement
+ * this batch exists to remove.
+ */
+import { currentUsageLogRevision, setUsageLedgerAppendHook } from "../usage/log";
+import { enforceUsageLedgerSizeLimit } from "../usage/ledger-retention";
+import { discardRetainedFailureProjection } from "../usage/failure-projection-cache";
+import { rehydrateRequestLogsAfterLedgerReplacement } from "./request-log";
+import type { UsageLedgerRetentionStatus } from "../usage/retention-contract";
+
+let configuredMaxBytes: number | undefined;
+let enforcing = false;
+
+function invalidateLedgerReaders(): void {
+  // Ordered cheapest-first, and each guarded on its own: a projection that fails to discard
+  // must not stop the ring from being rebuilt, because the ring is the surface an operator is
+  // looking at while this happens.
+  try { discardRetainedFailureProjection(); } catch { /* rebuildable by construction */ }
+  void (async () => {
+    try {
+      const { discardRetainedUsageAggregate } = await import("./management/usage-aggregate-cache");
+      discardRetainedUsageAggregate();
+    } catch { /* rebuildable by construction */ }
+    try {
+      const { closeRequestHistoryIndex } = await import("../routing/history/indexer");
+      closeRequestHistoryIndex();
+    } catch { /* the index rebuilds from its own source-identity contract */ }
+  })();
+  try { rehydrateRequestLogsAfterLedgerReplacement(); } catch { /* the ring refills as rows arrive */ }
+}
+
+function enforceNow(): void {
+  // Re-entrancy guard, not a lock. The compaction itself runs inside the append call stack, and
+  // its own publication writes nothing through appendUsageEntry -- this exists so a future
+  // caller on that path cannot start a second pass over a file the first one is replacing.
+  if (enforcing) return;
+  enforcing = true;
+  try {
+    const result = enforceUsageLedgerSizeLimit(configuredMaxBytes);
+    if (result.kind === "replaced") invalidateLedgerReaders();
+  } catch (error) {
+    // Never fail a request because history could not be trimmed. The limit is not enforced and
+    // says so; the next append tries again from a fresh revision.
+    console.warn(
+      `[usage-retention] could not enforce the usage ledger size limit: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  } finally {
+    enforcing = false;
+  }
+}
+
+/** Install or update the policy. `undefined` removes the hook entirely. */
+export function setUsageLedgerRetention(maxBytes: number | undefined): void {
+  configuredMaxBytes = maxBytes;
+  setUsageLedgerAppendHook(maxBytes === undefined ? null : enforceNow);
+}
+
+export function usageLedgerRetentionStatus(): UsageLedgerRetentionStatus {
+  return {
+    ...(configuredMaxBytes !== undefined ? { maxBytes: configuredMaxBytes } : {}),
+    currentBytes: currentUsageLogRevision()?.size ?? 0,
+  };
+}