@bitkyc08/opencodex 2.62.0-preview.20260923 → 2.63.0-preview.20260923

package/src/server/management/agent-settings-routes.ts

@@ -7,6 +7,7 @@ import { mergeModelPinnedEfforts, modelPinnedEffortsConfigError } from "../../co
 import { MULTI_AGENT_SURFACE_ADVISORY_VERSION, multiAgentSurfaceAdvisory, resolveMultiAgentMode } from "../../config/multi-agent-surface";
 import { captureConfigTopLevelRollback, parsedConfigRebaseDeletionKeys, projectConfigRebaseProvenance } from "../../config/rebase-provenance";
 import {
+  adoptPersistedClaudeCode,
   DEFAULT_SUBAGENT_MODELS,
   codexAutoStartEnabled,
   deleteConfigTopLevelKey,
@@ -123,12 +124,12 @@ function persistDesktopProfileField(
 ): { ok: true } | { ok: false; reason: "missing" | "invalid" | "conflict" } {
   const outcome = mutatePersistedConfig(persisted => {
     persisted.claudeCode = { ...(persisted.claudeCode ?? {}), desktopProfile };
-    return { changed: true, value: true };
+    return { changed: true, value: structuredClone(persisted.claudeCode) };
   });
   // Only mirror into memory once the durable write actually landed; an
   // `unavailable` outcome must not leave the snapshot claiming a saved profile.
   if (outcome.status === "unavailable") return { ok: false, reason: outcome.reason };
-  config.claudeCode = { ...(config.claudeCode ?? {}), desktopProfile };
+  adoptPersistedClaudeCode(config, outcome.value);
   return { ok: true };
 }
 
@@ -137,9 +138,15 @@ async function persistDesktopModeField(
   desktopMode: "first-party" | "gateway",
 ): Promise<{ ok: true } | { ok: false; reason: "missing" | "invalid" | "conflict" }> {
   const { recordClaudeDesktopMode } = await import("../../claude/desktop-first-party");
-  const outcome = mutatePersistedConfig(persisted => recordClaudeDesktopMode(persisted, desktopMode));
+  const outcome = mutatePersistedConfig(persisted => {
+    const mutation = recordClaudeDesktopMode(persisted, desktopMode);
+    return { changed: mutation.changed, value: structuredClone(persisted.claudeCode) };
+  });
   if (outcome.status === "unavailable") return { ok: false, reason: outcome.reason };
-  recordClaudeDesktopMode(config, desktopMode);
+  // First-party apply ends here — no profile-marker write follows — so without
+  // adopting, live diverges from the armed baseline and a later whole-config
+  // save reads that divergence as a pending mutation and stomps hand edits.
+  adoptPersistedClaudeCode(config, outcome.value);
   return { ok: true };
 }
 
@@ -1168,8 +1175,10 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
           ...(modeWarning ? { warning: modeWarning } : {}),
         }, 500);
       }
-      const { claudeDesktopPolicyWarning, probeClaudeDesktopPolicy } = await import("../../claude/desktop-policy");
-      const policyState = (deps.probeClaudeDesktopPolicy ?? probeClaudeDesktopPolicy)({ platform: deps.platform ?? process.platform });
+      const { claudeDesktopPolicyWarning, getCachedClaudeDesktopPolicy } = await import("../../claude/desktop-policy");
+      const policyState = deps.probeClaudeDesktopPolicy
+        ? await deps.probeClaudeDesktopPolicy({ platform: deps.platform ?? process.platform })
+        : await getCachedClaudeDesktopPolicy({ platform: deps.platform ?? process.platform });
       const policyWarning = claudeDesktopPolicyWarning(policyState);
       const warning = [modeWarning, policyWarning].filter(Boolean).join(" ");
       return jsonResponse({
@@ -1219,10 +1228,10 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       // a stale apply the operator should refresh.
       const stale = desiredEnabled && (mode === "first-party" ? firstPartySeen.stale : observed.kind === "gateway_drifted");
       const { getDesktopHealth } = await import("../../claude/desktop-health");
-      const { claudeDesktopPolicyHealth, probeClaudeDesktopPolicy } = await import("../../claude/desktop-policy");
-      const policyState = (deps.probeClaudeDesktopPolicy ?? probeClaudeDesktopPolicy)({
-        platform: deps.platform ?? process.platform,
-      });
+      const { claudeDesktopPolicyHealth, getCachedClaudeDesktopPolicy } = await import("../../claude/desktop-policy");
+      const policyState = deps.probeClaudeDesktopPolicy
+        ? await deps.probeClaudeDesktopPolicy({ platform: deps.platform ?? process.platform })
+        : await getCachedClaudeDesktopPolicy({ platform: deps.platform ?? process.platform });
       // Managed-policy conflicts only matter for the gateway profile; first-party mode never
       // touches Desktop's own configuration.
       const policy = claudeDesktopPolicyHealth(mode === "first-party" ? "absent" : policyState);

package/src/server/management/context.ts

@@ -10,7 +10,7 @@ import type { refreshOwnedCatalogIntegrations } from "../../integrations/catalog
 import type { Paths as CodexPromptPaths } from "../../codex/prompt-layers";
 import type { injectGrokConfig } from "../../grok/inject";
 import type { removeDesktop3pStandardPivot, writeDesktop3pConfig } from "../../claude/desktop-3p";
-import type { probeClaudeDesktopPolicy } from "../../claude/desktop-policy";
+import type { ClaudeDesktopPolicyProbeOptions, ClaudeDesktopPolicyState } from "../../claude/desktop-policy";
 import type { RuntimePortState } from "../../config/process-state";
 import type { CursorInstall } from "../../integrations/cursor-detect";
 import type { CursorEffortTable } from "../../integrations/cursor-effort-table";
@@ -74,7 +74,9 @@ export interface ManagementApiDeps {
   removeDesktop3pStandardPivot?: typeof removeDesktop3pStandardPivot;
   writeDesktop3pConfig?: typeof writeDesktop3pConfig;
   /** Read-only Windows MDM policy seam for status/apply tests. */
-  probeClaudeDesktopPolicy?: typeof probeClaudeDesktopPolicy;
+  probeClaudeDesktopPolicy?: (
+    options?: ClaudeDesktopPolicyProbeOptions,
+  ) => ClaudeDesktopPolicyState | Promise<ClaudeDesktopPolicyState>;
   /**
    * Runtime-state seam: the fence must name the host/port the RUNNING process
    * bound (agent-settings-routes.ts:99-103 pattern), and a test must not depend

package/src/server/responses/codex-ws-exchange.ts

@@ -1,3 +1,4 @@
+import { NativeSteeringError } from "./native-steering";
 import { mergeSteeringContinuation } from "./native-steering-settings";
 import { markNativeControlResponse } from "./native-response-control";
 import type { NativeResponseControl } from "./native-response-control";
@@ -345,11 +346,11 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
           // the first create frame.
           let base: Record<string, unknown> | undefined;
           detachSteering = nativeControl.attach(frame => {
-            const sendControl = () => {
-              if (terminal || signal?.aborted || session.closed || ws.readyState !== WebSocket.OPEN) {
-                throw new Error("Native steering connection is no longer available");
-              }
-              beforeDispatch?.(new Headers(headers));
+            // Build, serialize and bound-check the reconstructed frame synchronously in the
+            // channel callback: a typed refusal must reach the channel's synchronous rollback
+            // (continuation slot released, journal unwritten) rather than the asynchronous
+            // failStream path, so a corrected continuation can still retry on this channel.
+            const prepare = () => {
               let outgoing = frame;
               if (frame.type === "response.create") {
                 // Generation overrides have passed route policy; identity/tools remain pinned.
@@ -361,11 +362,20 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
                   : { ...continuationBase, input: frame.input, previous_response_id: frame.previous_response_id };
               }
               const text = JSON.stringify(outgoing);
+              nativeControl.assertOutboundFrame?.(text);
               if (codexWsCreateFrameExceedsLimit(text)) {
                 throw new Error("Native steering frame exceeds the transport byte limit");
               }
-              if (frame.type === "response.create") continuationBase = outgoing;
-              try { ws.send(text); } catch {
+              return { outgoing, text };
+            };
+            const prepared = prepare();
+            const sendControl = () => {
+              if (terminal || signal?.aborted || session.closed || ws.readyState !== WebSocket.OPEN) {
+                throw new Error("Native steering connection is no longer available");
+              }
+              beforeDispatch?.(new Headers(headers));
+              if (frame.type === "response.create") continuationBase = prepared.outgoing;
+              try { ws.send(prepared.text); } catch {
                 // A send failure has unknown delivery. Never replay or fall back.
                 failStream("Native steering send failed; delivery is unknown");
                 throw new Error("Native steering send failed; delivery is unknown");
@@ -374,7 +384,13 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
             if (frame.type === "response.create" && beforeContinuation) {
               // Explicit tool-result continuations are physical request starts;
               // they keep provider pacing and revalidate auth AFTER the wait.
-              void beforeContinuation().then(sendControl).catch(() => failStream("Native steering continuation could not be dispatched; do not automatically replay queued input"));
+              // A typed pre-send refusal (e.g. the configured upstream body limit) is a
+              // known non-delivery and keeps its own message; every other failure keeps
+              // the unknown-delivery wording.
+              void beforeContinuation().then(sendControl).catch(error => failStream(
+                error instanceof NativeSteeringError ? error
+                  : new Error("Native steering continuation could not be dispatched; do not automatically replay queued input"),
+              ));
             } else sendControl();
           }, error => failStream(error));
         }

package/src/server/responses/core-codex-account.ts

@@ -212,6 +212,10 @@ export async function codexPoolAccountModel400Denial(
   wireModelId?: string,
 ): Promise<string | undefined> {
   if (response.status !== 400) return undefined;
+  // A response that must not be sent again cannot open an alternate-account retry either. The
+  // reset helper marks the answer to a spent operator replacement this way, and that turn may
+  // already have run on the first send. Same rule as the quota and transient ladders below.
+  if (isNonReplayableResponse(response)) return undefined;
   try {
     const body = await readBoundedResponseBody(response.clone(), { signal });
     if (!body.displaySafe || body.truncated) return undefined;

package/src/server/responses/core-combo-failure.ts

@@ -13,6 +13,7 @@ import {
 import { normalizeUpstreamErrorText } from "./core-errors";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { formatErrorResponse } from "../../bridge";
+import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
 import { usageFromResponsesPayload } from "../request-log";
 import type { ResponsesTerminalStatus } from "../../bridge";
 
@@ -30,6 +31,9 @@ export async function consumeComboFailure(
   signal?: AbortSignal,
   now = Date.now(),
 ): Promise<ConsumedComboFailure> {
+  // Read before the body: the marker lives on this Response object, and the failure below is
+  // rebuilt as a new one that would otherwise lose it.
+  const nonReplayable = isNonReplayableResponse(response);
   const fallback = `Provider error ${response.status}`;
   let classificationText = fallback;
   let usage: OcxUsage | undefined;
@@ -97,16 +101,19 @@ export async function consumeComboFailure(
     now,
     includeDefault: false,
   });
+  const failureResponse = formatErrorResponse(
+    response.status,
+    cyberFailure ? (upstreamType ?? CYBER_POLICY_ERROR_CODE) : "upstream_error",
+    message,
+    {
+      ...(normalizedUpstreamCode !== undefined ? { code: normalizedUpstreamCode } : {}),
+      ...(clientRetryAfter !== undefined ? { retryAfter: clientRetryAfter } : {}),
+    },
+  );
+  if (nonReplayable) markResponseNonReplayable(failureResponse);
   return {
-    response: formatErrorResponse(
-      response.status,
-      cyberFailure ? (upstreamType ?? CYBER_POLICY_ERROR_CODE) : "upstream_error",
-      message,
-      {
-        ...(normalizedUpstreamCode !== undefined ? { code: normalizedUpstreamCode } : {}),
-        ...(clientRetryAfter !== undefined ? { retryAfter: clientRetryAfter } : {}),
-      },
-    ),
+    response: failureResponse,
+    ...(nonReplayable ? { nonReplayable: true } : {}),
     classificationText,
     ...(normalizedUpstreamCode !== undefined ? { upstreamCode: normalizedUpstreamCode } : {}),
     ...(!cyberFailure && cooldownRetryAfter !== undefined ? { retryAfter: cooldownRetryAfter } : {}),

package/src/server/responses/core-combo.ts

@@ -678,9 +678,13 @@ export async function executeComboResponses(
     attemptRetained = true;
     lastFailure = failure.response;
     lastFailedChildLog = childLog;
-    const failureDecision = comboFailureDecision(failure.response.status, failure.classificationText, {
-      code: failure.upstreamCode,
-    });
+    // A non-replayable failure (the answer to a spent ambiguous-reset replacement) may follow a
+    // send that already ran the turn, so no later target may receive it, whatever its status says.
+    const failureDecision = failure.nonReplayable
+      ? "stop"
+      : comboFailureDecision(failure.response.status, failure.classificationText, {
+        code: failure.upstreamCode,
+      });
     const wantsStream = (rawBody as { stream?: unknown } | null)?.stream === true;
     // Local byte admission has its own diagnostic; do not relabel it as an upstream refusal.
     const classifyOverflow = failure.response.status === 413

package/src/server/responses/core-options.ts

@@ -28,6 +28,12 @@ export interface ConsumedComboFailure {
   resetAt?: string[];
   /** Reserved for 040 usage attribution without adding another body read. */
   usage?: OcxUsage;
+  /**
+   * The failed attempt's response was marked non-replayable, such as the answer to a spent
+   * ambiguous-reset replacement. The re-wrapped {@link response} cannot carry that in-memory
+   * marker, so the combo loop reads it here and stops instead of sending the turn to a later target.
+   */
+  nonReplayable?: boolean;
 }
 
 

package/src/server/responses/native-injection-replay.ts

@@ -1,4 +1,4 @@
-import { MAX_NATIVE_STEERING_REPLAY_BYTES, type NativeSteeringReplayObserver } from "./native-steering-replay";
+import { MAX_NATIVE_STEERING_REPLAY_BYTES, admitNativeControlReplayJournal, registerNativeControlReplayJournal, type NativeSteeringReplayObserver } from "./native-steering-replay";
 import { injectionRecord as record, type InjectionFrame as Frame, type FunctionResult } from "./native-injection-protocol";
 
 import { nativeResultFingerprint } from "./native-tool-results";
@@ -16,6 +16,9 @@ export class NativeInjectionReplay implements NativeSteeringReplayObserver {
   private acceptedBatchBytes: number[] = [];
   private explicit: unknown[] = [];
   private previous: unknown[] = [];
+  private unregisterAccounting?: () => void;
+
+  get retainedBytes(): number { return this.bytes; }
 
   /** Capture a private initial prefix; existing persistence eligibility is checked by the caller. */
   constructor(input: unknown, private readonly remember: (input: unknown[], response: Frame) => void) {
@@ -23,12 +26,19 @@ export class NativeInjectionReplay implements NativeSteeringReplayObserver {
       ? [{ type: "message", role: "user", content: [{ type: "input_text", text: input }] }]
       : Array.isArray(input) ? [...input] : [];
     this.reserve(this.prefix);
+    this.unregisterAccounting = registerNativeControlReplayJournal(this);
   }
   /** Charge serialized bytes, refusing rather than truncating an over-budget transcript. */
   private reserve(value: unknown): number {
     const bytes = Buffer.byteLength(JSON.stringify(value));
     if (this.bytes + bytes > MAX_NATIVE_STEERING_REPLAY_BYTES) throw new Error("Native injection replay exceeded its history budget.");
     this.bytes += bytes;
+    try {
+      admitNativeControlReplayJournal(this);
+    } catch (error) {
+      this.bytes -= bytes;
+      throw error;
+    }
     return bytes;
   }
   /** Journal before physical send, with rollback usable only for a known unsent frame. */
@@ -99,6 +109,8 @@ export class NativeInjectionReplay implements NativeSteeringReplayObserver {
   }
   /** Drop all retained bodies at cancellation, connection teardown or unknown delivery. */
   dispose(): void {
+    this.unregisterAccounting?.();
+    this.unregisterAccounting = undefined;
     this.prefix = []; this.output.clear(); this.accepted.clear(); this.pending = undefined; this.pendingBytes = 0; this.acceptedBatchBytes = [];
     this.explicit = []; this.previous = []; this.bytes = 0;
   }

package/src/server/responses/native-injection.ts

@@ -1,6 +1,14 @@
 import { CodexWsCorrelation } from "./codex-ws-correlation";
+import { NativeSteeringError } from "./native-steering";
+import { checkOutboundBodySize } from "./outbound-body-guard";
 import type { NativeResponseControl } from "./native-response-control";
 import type { NativeSteeringReplayObserver } from "./native-steering-replay";
+import {
+  UNDECLARED_TOOL_CALL_ERROR_CODE,
+  undeclaredToolCallMessage,
+  undeclaredToolCallNameInResponse,
+} from "../responses-undeclared-tool-guard";
+import type { ProviderExecutedCallType } from "../responses-undeclared-tool-guard";
 import {
   injectionError, injectionFingerprint, injectionId, injectionRecord as record, injectionResults,
   isInjectionRequest, MAX_NATIVE_INJECTIONS, MAX_NATIVE_INJECTION_BYTES, MAX_NATIVE_INJECTION_CALLS,
@@ -44,20 +52,39 @@ export class NativeInjectionChannel implements NativeResponseControl {
   private ackTimer?: ReturnType<typeof setTimeout>;
   private idleTimer?: ReturnType<typeof setTimeout>;
   private readonly settings = new Map<string, string>();
+  private declaredToolNames?: ReadonlySet<string>;
+  private declaredBareToolNames: ReadonlySet<string> = new Set();
+  private declaredNamelessCallTypes: ReadonlySet<string> = new Set();
+  private providerExecutedCallTypes: ReadonlySet<ProviderExecutedCallType> = new Set();
   private readonly lane: unknown;
 
   /** Pin the original settings and lane; construction never opens a connection. */
   constructor(initial: Frame, private readonly idleMs = 300_000,
+    private readonly maxUpstreamBodyBytes?: number,
     private readonly deadlines = { ackMs: NATIVE_INJECTION_ACK_MS, toolMs: NATIVE_INJECTION_TOOL_MS }) {
     if (!isInjectionRequest(initial)) injectionError("injection_not_supported", "Native injection requires explicit multi_agent.enabled.");
     this.lane = initial.stream_id ?? undefined;
     for (const [key, value] of Object.entries(initial)) if (!ENVELOPE.has(key)) this.settings.set(key, injectionFingerprint(value));
   }
+  /** Refuse the exact rebuilt control body before it reaches the retained socket. */
+  assertOutboundFrame(text: string): void {
+    if (!checkOutboundBodySize(text, this.maxUpstreamBodyBytes).admitted) {
+      injectionError("outbound_body_too_large", "Native injection frame exceeds the configured upstream body limit.");
+    }
+  }
   /** Report that the real dispatch boundary has selected this owner. */
   get attached(): boolean { return this.everAttached; }
   /** A terminal is not final until submitted results have acknowledgements. */
   get ended(): boolean { return this.finished; }
 
+  /** Mirror the ordinary response guard for native events that bypass its SSE rewrite. */
+  configureToolAuthorization(active: boolean, names: ReadonlySet<string>, bareNames: ReadonlySet<string>, namelessCallTypes: ReadonlySet<string>, providerExecuted: ReadonlySet<ProviderExecutedCallType>): void {
+    this.declaredToolNames = active ? new Set(names) : undefined;
+    this.declaredBareToolNames = active ? new Set(bareNames) : new Set();
+    this.declaredNamelessCallTypes = active ? new Set(namelessCallTypes) : new Set();
+    this.providerExecutedCallTypes = active ? new Set(providerExecuted) : new Set();
+  }
+
   /** Attach once, after routing/auth/admission, retaining no global response-ID lookup. */
   attach(send: (frame: Frame) => void, fail: (error: Error) => void): () => void {
     if (this.everAttached) throw new Error("Native injection transport is already owned.");
@@ -77,17 +104,28 @@ export class NativeInjectionChannel implements NativeResponseControl {
     return injectionError("native_control_mode_mismatch", "This multi-agent turn owns an injection-only channel; start a separate turn for steering.");
   }
   /** Abort unknown-delivery state without HTTP fallback, resends or invented acceptance. */
-  private fail(): void {
+  private fail(error?: Error): void {
     this.finished = true;
     clearTimeout(this.ackTimer); clearTimeout(this.idleTimer);
-    this.onFailure?.(new Error("Native injection transport failed or timed out; delivery is unknown. Do not automatically resend or rerun tools."));
+    this.onFailure?.(error ?? new Error("Native injection transport failed or timed out; delivery is unknown. Do not automatically resend or rerun tools."));
   }
   /** Require the same live owner; an unbound or detached channel cannot authorize a send. */
   private live(): void {
     if (!this.send || this.finished) injectionError("injection_not_supported", "No live native injection transport is available on this route.");
   }
+  private authorize(item: unknown): void {
+    if (!this.declaredToolNames) return;
+    const undeclared = undeclaredToolCallNameInResponse(
+      { output: [item] }, this.declaredToolNames, this.declaredNamelessCallTypes,
+      this.providerExecutedCallTypes, this.declaredBareToolNames,
+    );
+    if (undeclared !== undefined) {
+      injectionError(UNDECLARED_TOOL_CALL_ERROR_CODE, undeclaredToolCallMessage(undeclared));
+    }
+  }
   /** Advertise client-owned function/custom calls and approvals, never hosted execution. */
   private advertise(item: unknown): void {
+    this.authorize(item);
     const requirement = nativeToolRequirement(item);
     if (!requirement) return;
     const old = this.calls.get(requirement.key);
@@ -116,6 +154,7 @@ export class NativeInjectionChannel implements NativeResponseControl {
       if (call.state !== "available") injectionError("duplicate_injection", "This function result was already submitted; do not replay it.");
     }
     const text = JSON.stringify(frame);
+    this.assertOutboundFrame(text);
     const bytes = Buffer.byteLength(text);
     if (this.queue.length >= MAX_NATIVE_INJECTIONS || bytes + this.queueBytes > MAX_NATIVE_INJECTION_BYTES) {
       injectionError("injection_queue_full", "Native injection queue count or byte limit reached; no result was sent.");
@@ -135,10 +174,23 @@ export class NativeInjectionChannel implements NativeResponseControl {
     this.inFlight = submission;
     this.ackTimer = setTimeout(() => this.fail(), this.deadlines.ackMs);
     this.ackTimer.unref?.();
+    let rollback: (() => void) | undefined;
     try {
-      this.replay?.submitted(submission.frame);
+      rollback = this.replay?.submitted(submission.frame);
       this.send!(submission.frame);
-    } catch {
+    } catch (error) {
+      if (error instanceof NativeSteeringError) {
+        // A typed refusal is a known non-delivery: unjournal and free the reservation
+        // so a corrected result can be queued again on the same channel.
+        rollback?.();
+        clearTimeout(this.ackTimer); this.ackTimer = undefined;
+        this.inFlight = undefined; this.queue.shift(); this.queueBytes -= submission.bytes;
+        for (const item of submission.results) {
+          const call = this.calls.get(nativeResultKey(item));
+          if (call?.state === "queued") call.state = "available";
+        }
+        throw error;
+      }
       this.fail();
       injectionError("injection_delivery_unknown", "Injection dispatch failed; do not automatically resend or rerun tools.");
     }
@@ -163,7 +215,7 @@ export class NativeInjectionChannel implements NativeResponseControl {
     clearTimeout(this.ackTimer); this.ackTimer = undefined;
     this.inFlight = undefined; this.queue.shift(); this.queueBytes -= pending.bytes;
     // Do not let a synchronous fake peer publish the next ack before this event is relayed.
-    if (this.queue.length) queueMicrotask(() => { try { this.pump(); } catch { this.fail(); } });
+    if (this.queue.length) queueMicrotask(() => { try { this.pump(); } catch (error) { this.fail(error instanceof NativeSteeringError ? error : undefined); } });
   }
   /** Commit terminal replay only when no submitted injection can change its accepted inputs. */
   private recordTerminal(): void {
@@ -197,8 +249,14 @@ export class NativeInjectionChannel implements NativeResponseControl {
     }
     if (Buffer.byteLength(JSON.stringify(frame)) > MAX_NATIVE_INJECTION_BYTES) injectionError("invalid_injection", "Native injection continuation exceeds its byte limit.");
     this.continuationSent = true;
-    try { this.recordTerminal(); const copy = JSON.parse(JSON.stringify(frame)) as Frame; this.replay?.submitted(copy); this.send(copy); }
-    catch { this.fail(); injectionError("injection_delivery_unknown", "Continuation delivery is unknown; do not automatically resend results."); }
+    let undo: (() => void) | undefined;
+    try { this.recordTerminal(); const copy = JSON.parse(JSON.stringify(frame)) as Frame; undo = this.replay?.submitted(copy); this.send(copy); }
+    catch (error) {
+      // A typed refusal is a known non-delivery: unjournal, release the continuation
+      // slot so a corrected frame can be sent, and keep the code.
+      if (error instanceof NativeSteeringError) { undo?.(); this.continuationSent = false; throw error; }
+      this.fail(); injectionError("injection_delivery_unknown", "Continuation delivery is unknown; do not automatically resend results.");
+    }
     if (!this.finished) this.armIdle(this.deadlines.ackMs);
     return true;
   }
@@ -225,6 +283,7 @@ export class NativeInjectionChannel implements NativeResponseControl {
         this.correlation?.finish(); this.correlation = new CodexWsCorrelation(true, () => false);
       } else if (!this.currentId || this.terminal) throw new Error("Unexpected native injection event outside an active response.");
       this.correlation?.accept({ ...event, stream_id: undefined });
+      if (type === "response.output_item.added") this.authorize(event.item);
       if (type === "response.output_item.done") this.advertise(event.item);
       if (["response.completed", "response.failed", "response.incomplete"].includes(String(type))) {
         if (!this.currentId || response?.id !== this.currentId) throw new Error("Native injection terminal identity mismatch.");

package/src/server/responses/native-response-control.ts

@@ -1,6 +1,7 @@
 import type { OcxProviderConfig } from "../../types";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import type { NativeSteeringReplayObserver } from "./native-steering-replay";
+import type { ProviderExecutedCallType } from "../responses-undeclared-tool-guard";
 
 import { isInjectionRequest } from "./native-injection-protocol";
 
@@ -10,6 +11,7 @@ export interface NativeResponseControl {
   relayActive: boolean;
   normalizeContinuation?: (frame: Record<string, unknown>) => Record<string, unknown>;
   replayFactory?: () => NativeSteeringReplayObserver;
+  configureToolAuthorization?: (active: boolean, names: ReadonlySet<string>, bareNames: ReadonlySet<string>, namelessCallTypes: ReadonlySet<string>, providerExecuted: ReadonlySet<ProviderExecutedCallType>) => void;
   readonly attached: boolean;
   readonly ended: boolean;
   attach(send: (frame: Record<string, unknown>) => void, fail: (error: Error) => void): () => void;
@@ -17,6 +19,8 @@ export interface NativeResponseControl {
   steer(frame: Record<string, unknown>): void;
   inject?(frame: Record<string, unknown>): void;
   continue(frame: Record<string, unknown>): boolean;
+  /** Apply operator-configured limits to the exact reconstructed upstream frame. */
+  assertOutboundFrame?(text: string): void;
 }
 
 export const OPENAI_API_RESPONSES_URL = "https://api.openai.com/v1/responses";
@@ -27,10 +31,10 @@ export function markNativeControlResponse(response: Response): Response { native
 /** Recognize a marked native response by identity, not by caller-controlled content. */
 export function isNativeControlResponse(response: Response): boolean { return nativeControlResponses.has(response); }
 
-/** Preserve canonical ChatGPT eligibility; public API controls require an explicit provider WebSocket opt-in. */
+/** Preserve canonical ChatGPT eligibility; only injection may use the separately billed public API. */
 export function nativeResponseControlEligible(provider: OcxProviderConfig, control?: NativeResponseControl): boolean {
   if (isCanonicalOpenAiForwardProvider(provider)) return true;
-  return (control?.kind === "injection" || control?.kind === "steering") && provider.adapter === "openai-responses"
+  return control?.kind === "injection" && provider.adapter === "openai-responses"
     && provider.upstreamWebsocket === true && provider.authMode !== "forward"
     && provider.baseUrl?.replace(/\/+$/, "") === "https://api.openai.com/v1";
 }

package/src/server/responses/native-steering-replay.ts

@@ -1,4 +1,9 @@
 import { nativeResponseOutput } from "./native-response-output";
+import {
+  admitAppOwnedPinnedBytes,
+  appOwnedBytesSnapshot,
+  type RetainedStoreSnapshot,
+} from "../../lib/app-owned-memory";
 
 /**
  * Connection-local replay journal. Only input committed by response.created enters
@@ -6,6 +11,46 @@ import { nativeResponseOutput } from "./native-response-output";
  * continuation cache. Bodies are bounded and discarded at connection teardown.
  */
 export const MAX_NATIVE_STEERING_REPLAY_BYTES = 32 * 1024 * 1024;
+/**
+ * Aggregate ceiling across every live steering and injection journal. The operator
+ * budget is an eviction target that can be raised to 4 GiB; pinned control journals
+ * keep their own finite admission cap so the documented pin-capable aggregate stays
+ * below the process-owned 512 MiB worst case.
+ */
+export const MAX_NATIVE_CONTROL_REPLAY_TOTAL_BYTES = 128 * 1024 * 1024;
+let aggregateCapBytes = MAX_NATIVE_CONTROL_REPLAY_TOTAL_BYTES;
+const activeReplays = new Set<{ readonly retainedBytes: number }>();
+
+/** Account active journals as pinned state: protocol safety forbids evicting pending input. */
+export function nativeControlReplayRetainedStoreSnapshot(): RetainedStoreSnapshot {
+  let bytes = 0;
+  for (const replay of activeReplays) bytes += replay.retainedBytes;
+  return { count: activeReplays.size, bytes, evictableBytes: 0, pinnedBytes: bytes, oldestAt: null };
+}
+
+/** Track one live control journal (steering or injection) and return its detach hook. */
+export function registerNativeControlReplayJournal(journal: { readonly retainedBytes: number }): () => void {
+  activeReplays.add(journal);
+  return () => { activeReplays.delete(journal); };
+}
+
+/**
+ * Shared pinned-memory admission for one journal's current retained bytes. Bytes the
+ * retained-store registry already sees are measured in place; a journal still in its
+ * constructor is priced as a new proposal. Reclaimable owners are demoted before
+ * refusal, so cache occupancy alone never fails a journal.
+ */
+export function admitNativeControlReplayJournal(journal: { readonly retainedBytes: number }): void {
+  const replayBytes = nativeControlReplayRetainedStoreSnapshot().bytes
+    + (activeReplays.has(journal) ? 0 : journal.retainedBytes);
+  if (replayBytes > aggregateCapBytes) {
+    throw new Error("Native control replay exceeded the pinned journal ceiling.");
+  }
+  const registeredBytes = appOwnedBytesSnapshot().stores.native_control_replay?.bytes ?? 0;
+  if (!admitAppOwnedPinnedBytes(replayBytes - registeredBytes)) {
+    throw new Error("Native control replay exceeded the application-owned memory budget.");
+  }
+}
 type Frame = Record<string, unknown>;
 /** Accept JSON object envelopes without treating arrays as records. */
 function record(value: unknown): value is Frame {
@@ -32,16 +77,22 @@ export class NativeSteeringReplay implements NativeSteeringReplayObserver {
   private submissions: Array<{ parent: string; input: unknown[]; id?: string; bytes: number }> = [];
   private explicitInput: unknown[] = [];
   private explicitBytes = 0;
+  private disposed = false;
+  private unregisterAccounting?: () => void;
+
+  get retainedBytes(): number { return this.bytes; }
 
   /** Capture the initial prefix and reject over-budget history before dispatch. */
   constructor(input: unknown, private readonly remember: (input: unknown[], response: Frame) => void) {
     this.prefix = [...inputItems(input)];
     this.bytes = Buffer.byteLength(JSON.stringify(this.prefix));
     this.check();
+    this.unregisterAccounting = registerNativeControlReplayJournal(this);
   }
   /** Reject overflow rather than silently truncating retained conversation input. */
   private check(): void {
     if (this.bytes > MAX_NATIVE_STEERING_REPLAY_BYTES) throw new Error("Native steering replay exceeded its bounded history budget; input was not silently truncated.");
+    admitNativeControlReplayJournal(this);
   }
   /** Reserve replay bytes before send and return a rollback for synchronous failure. */
   submitted(frame: Frame): () => void {
@@ -116,6 +167,10 @@ export class NativeSteeringReplay implements NativeSteeringReplayObserver {
   }
   /** Release retained input, output and queued submissions when the owner detaches. */
   dispose(): void {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.unregisterAccounting?.();
+    this.unregisterAccounting = undefined;
     this.prefix = [];
     this.previousOutput = [];
     this.submissions = [];
@@ -124,3 +179,8 @@ export class NativeSteeringReplay implements NativeSteeringReplayObserver {
     this.bytes = 0;
   }
 }
+
+/** Test-only: shrink the aggregate pinned-journal ceiling (null restores the documented cap). */
+export function setNativeControlReplayTotalCapForTests(capBytes: number | null): void {
+  aggregateCapBytes = capBytes ?? MAX_NATIVE_CONTROL_REPLAY_TOTAL_BYTES;
+}

package/src/server/responses/native-steering.ts

@@ -3,6 +3,7 @@ import type { NativeSteeringReplayObserver } from "./native-steering-replay";
 import { createHash } from "node:crypto";
 import { CODEX_WS_ID_MAX_BYTES, CodexWsCorrelation } from "./codex-ws-correlation";
 import { codexWsCreateFrameExceedsLimit } from "./codex-ws-wire";
+import { checkOutboundBodySize } from "./outbound-body-guard";
 
 export const MAX_NATIVE_STEERS = 32;
 export const MAX_NATIVE_STEERING_RESPONSES = 128;
@@ -123,7 +124,7 @@ export class NativeSteeringChannel {
   private advertisedBytes = 0;
 
   /** Pin the initial lane and setting digests without opening a transport. */
-  constructor(initial: Frame, private readonly idleMs = 300_000) {
+  constructor(initial: Frame, private readonly idleMs = 300_000, private readonly maxUpstreamBodyBytes?: number) {
     if (record(initial.multi_agent) && initial.multi_agent.enabled === true) {
       throw new NativeSteeringError("native_control_mode_mismatch", "Multi-agent responses cannot use the single-agent steering channel.");
     }
@@ -132,6 +133,13 @@ export class NativeSteeringChannel {
       if (!["type", "input", "previous_response_id", "stream", "stream_id"].includes(key)) this.settings.set(key, fingerprint(value));
     }
   }
+
+  /** Refuse the exact rebuilt control body before it reaches the retained socket. */
+  assertOutboundFrame(text: string): void {
+    if (!checkOutboundBodySize(text, this.maxUpstreamBodyBytes).admitted) {
+      throw new NativeSteeringError("outbound_body_too_large", "Native steering frame exceeds the configured upstream body limit.");
+    }
+  }
   /** Report whether native dispatch ever bound a physical connection to this owner. */
   get attached(): boolean { return this.everAttached; }
   /** Report whether ordered terminal handling has finished the native chain. */

package/src/server/responses/passthrough-delivery.ts

@@ -417,10 +417,9 @@ export async function deliverPassthroughResponse(
             describeImages: requiresVisionPreprocessing(config, route.provider, route.modelId, route.providerName),
             sidecar: config.webSearchSidecar,
           }),
-          // Scope the executed-search memo to this exact upstream (#4587). The Responses adapter
-          // derives the same scope from the same base URL before the NEXT turn is dispatched, so
-          // a replayed hosted cell can be turned back into the destination's own call and result.
-          destinationScope: bridgeSearchReplayScope(route.provider.baseUrl),
+          // Snapshot the bound conversation, provider, model, destination, and credential. The
+          // next turn must match every dimension before its hosted cell can recover this result.
+          destinationScope: bridgeSearchReplayScope(parsed._reasoningReplayScope),
           // Appending a search result can push the continuation past the ceiling the first leg
           // was admitted under, so the same limit is re-applied before every later send.
           checkOutboundBody: (continuationBody: string) => {

package/src/server/responses/passthrough-dispatch.ts

@@ -480,6 +480,13 @@ export async function preparePassthroughExchange(
         || clientDeclaredNamelessCallTypes.size > 0
         || clientExplicitWireToolCatalog
       ) && route.provider.authMode !== "forward";
+      options.nativeControl?.configureToolAuthorization?.(
+        undeclaredToolGuardActive,
+        declaredWireToolNames,
+        declaredBareWireToolNames,
+        declaredNamelessClientCallTypes,
+        providerExecutedCallTypes,
+      );
     };
     refreshUndeclaredToolGuard(request);
     // A refused turn must not seed `previous_response_id` replay. The inspection branch reads the