@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/server/responses/core-codex-account.ts

@@ -41,6 +41,7 @@ import { isNativeMainTrafficBlocked } from "../../codex/native-profile-startup";
 import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import { slugsEquivalent } from "../../providers/slug-codec";
 import {
+  callerCodexWorkspaceAccountId,
   codexProbeLeaseId,
   codexTransientProbeGrant,
   codexProbeQuotaScope,
@@ -173,8 +174,9 @@ export function normalizeCodexUnsupportedModelDetail(value: string): string {
  * that comparison fail for the one model that is still account-gated, which silently disabled
  * both the alternate-account retry and the same-account ladder built for exactly that case.
  *
- * The envelope is unchanged and stays exact: a top-level `detail` string, whitespace-collapsed
- * and case-folded, matching the whole sentence with nothing before or after it. No prose is
+ * Accept the HTTP `detail` envelope and the `error.message` envelope emitted by the
+ * WebSocket refused-create projection. Both must match the whole sentence, whitespace-collapsed
+ * and case-folded, with nothing before or after it. Competing envelopes are ambiguous. No prose is
  * inferred and no other 400 shape is admitted, because a 400 is also what a malformed request
  * earns and that must never read as an entitlement fact.
  */
@@ -186,7 +188,18 @@ export function codexUnsupportedModelFromDetail(
   try {
     const payload = JSON.parse(bodyText) as unknown;
     if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
-    const detail = (payload as { detail?: unknown }).detail;
+    const record = payload as Record<string, unknown>;
+    const hasDetail = Object.hasOwn(record, "detail");
+    const hasError = Object.hasOwn(record, "error");
+    if (hasDetail === hasError) return undefined;
+    let detail: unknown = record.detail;
+    if (hasError) {
+      const error = record.error;
+      if (!error || typeof error !== "object" || Array.isArray(error)) return undefined;
+      const fields = error as Record<string, unknown>;
+      if ([fields.type, fields.code].some(value => value != null && typeof value !== "string")) return undefined;
+      detail = fields.message;
+    }
     if (typeof detail !== "string") return undefined;
     const matched = /^the '([^']{1,256})' model is not supported when using codex with a chatgpt account\.$/u
       .exec(normalizeCodexUnsupportedModelDetail(detail));
@@ -280,15 +293,11 @@ export async function shouldRetryCodexPoolAccountQuota(
   // body carries no quota evidence either, but the marker is the contract, not the prose.
   if (isNonReplayableResponse(response)) return false;
   if (response.status === 402 || response.status === 429) {
-    // Status alone used to authorize the move, which is right for a limit the ACCOUNT owns and
-    // wrong for one it merely belongs to. An organization- or project-scoped exhaustion refuses
-    // every credential inside that organization, so the second account meets the same counter
-    // and the only thing the rotation buys is a second cold prompt prefix (#4546). Positive
-    // evidence is required to withhold it: the helper fails closed, so an unreadable or
-    // ambiguous body keeps the broad #584 behaviour unchanged, and `rate_limit_exceeded`,
-    // `slow_down` and plan-level exhaustion still rotate exactly as before.
-    const { codexScopedExhaustionCode } = await import("../../codex/quota-rejection");
-    return await codexScopedExhaustionCode(response, { signal }) === undefined;
+    // The response does not identify the organization or project whose quota was exhausted.
+    // Resolve the alternate before deciding whether its known workspace identity proves that an
+    // organization-scoped retry would be futile. Until then, preserve the broad #584 behaviour.
+    void signal;
+    return true;
   }
   if (response.status < 500 || response.status >= 600) return false;
   try {
@@ -305,6 +314,20 @@ export async function shouldRetryCodexPoolAccountQuota(
 }
 
 
+export async function shouldRetryCodexScopedQuotaOnAlternate(
+  response: Response,
+  firstWorkspaceAccountId: string,
+  alternateWorkspaceAccountId: string | undefined,
+  signal?: AbortSignal,
+): Promise<boolean> {
+  if (!firstWorkspaceAccountId || firstWorkspaceAccountId !== alternateWorkspaceAccountId) return true;
+  const { codexScopedExhaustionCode } = await import("../../codex/quota-rejection");
+  const code = await codexScopedExhaustionCode(response, { signal });
+  // Workspace identity binds organization-level limits, but the response supplies no project id.
+  return code === undefined || code === "project_spend_limit_exceeded";
+}
+
+
 /**
  * A pre-stream upstream 5xx another Codex account may still be able to serve.
  *
@@ -448,6 +471,7 @@ export function applyCodexAccountGatedWireNormalization(parsed: OcxParsedRequest
   if (logCtx) {
     logCtx.preserveResolvedModelFromRoute = true;
     delete logCtx.resolvedModel;
+    logCtx.wireModel = wireModel;
   }
   parsed.modelId = wireModel;
   if (!parsed._rawBody || typeof parsed._rawBody !== "object") return;
@@ -532,6 +556,22 @@ export async function retryCodexPoolOnAlternateAccount(
       writerGeneration: firstAuthCtx.writerGeneration,
     });
   };
+  // A body-confirmed quota response may arrive under HTTP 5xx. A path that returns the
+  // first response without a move must still record the NORMALIZED outcome: the ordinary
+  // terminal recorder sees only that wire status and would misclassify it as transient,
+  // leaving the exhausted account immediately selectable next turn.
+  const recordWrappedQuotaOutcome = (): void => {
+    if (outcomeStatus === firstResponse.status || (outcomeStatus !== 429 && outcomeStatus !== 402)) return;
+    recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
+      ...codexQuotaOutcomeMeta(firstResponse),
+      threadId: firstAuthCtx.affinityKey,
+      modelId: route.modelId,
+      probeLeaseId: codexProbeLeaseId(firstAuthCtx),
+      probeQuotaScope: codexProbeQuotaScope(firstAuthCtx),
+      transientProbe: codexTransientProbeGrant(firstAuthCtx),
+      writerGeneration: firstAuthCtx.writerGeneration,
+    });
+  };
   if (outcomeStatus === 400 && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId)) {
     invalidateCodexModelEntitlementsForAccount(firstAuthCtx.accountId);
     let refreshed;
@@ -628,26 +668,45 @@ export async function retryCodexPoolOnAlternateAccount(
     && retryAuthCtx?.kind !== "main-pool"
     && retryAuthCtx?.kind !== "main"
   ) {
-    // A body-confirmed quota response may arrive under HTTP 5xx. Without an alternate,
-    // the ordinary terminal recorder sees only that wire status and would misclassify it
-    // as transient, leaving the exhausted account immediately selectable next turn.
-    if (outcomeStatus !== firstResponse.status && (outcomeStatus === 429 || outcomeStatus === 402)) {
-      recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
-        ...codexQuotaOutcomeMeta(firstResponse),
-        threadId: firstAuthCtx.affinityKey,
-        modelId: route.modelId,
-        probeLeaseId: codexProbeLeaseId(firstAuthCtx),
-        probeQuotaScope: codexProbeQuotaScope(firstAuthCtx),
-        transientProbe: codexTransientProbeGrant(firstAuthCtx),
-        writerGeneration: firstAuthCtx.writerGeneration,
-      });
-    }
+    recordWrappedQuotaOutcome();
     // No usable alternate was resolved, so the reserved move never becomes a send.
     accountMovePermit?.release();
     recordUnmovedTransientOutcome();
     return { kind: "no-alternate" };
   }
 
+  if (
+    (outcomeStatus === 429 || outcomeStatus === 402)
+    && !await shouldRetryCodexScopedQuotaOnAlternate(
+      firstResponse,
+      firstAuthCtx.chatgptAccountId,
+      retryAuthCtx.kind === "pool" || retryAuthCtx.kind === "main-pool"
+        ? retryAuthCtx.chatgptAccountId
+        // A request-owned `main` alternate has no stored account id; its workspace
+        // identity is what the caller's own credential materializes upstream.
+        : callerCodexWorkspaceAccountId(callerAuthHeaders),
+      options.abortSignal,
+    )
+  ) {
+    // Suppressing the move is not suppressing the evidence: a same-workspace refusal
+    // still records its normalized quota outcome on the account that produced it.
+    recordWrappedQuotaOutcome();
+    accountMovePermit?.release();
+    releaseCodexAuthContextProbeLease(retryAuthCtx);
+    return { kind: "no-alternate" };
+  }
+
+  // The scope classification above reads the rejection body asynchronously, so the
+  // request may have been cancelled while it ran. Re-check before the send below
+  // mutates routing state or spends the alternate on a caller that is gone.
+  if (options.abortSignal?.aborted) {
+    recordWrappedQuotaOutcome();
+    recordUnmovedTransientOutcome();
+    accountMovePermit?.release();
+    releaseCodexAuthContextProbeLease(retryAuthCtx);
+    return { kind: "no-alternate" };
+  }
+
   const quotaMeta = { ...codexQuotaOutcomeMeta(firstResponse), ...(await codexDenialOutcomeMeta(firstResponse)) };
   if (outcomeStatus === 429 || outcomeStatus === 402) {
     const { applyAccountQuotaFromUpstreamHeaders } = await import("../../codex/auth-api");

package/src/server/responses/core-combo-failure.ts

@@ -45,27 +45,28 @@ export async function consumeComboFailure(
   // a second body read, so this mirrors its normalization: raw 402/429, or a 5xx whose intact,
   // display-safe body carries a recognized quota message.
   let quotaConfirmedByBody = false;
+  const serverError = response.status >= 500 && response.status < 600;
   try {
-    const body = await readBoundedResponseBody(response, {
-      signal,
-      // Match shouldRetryCodexPoolAccountQuota before treating a 5xx body as quota evidence.
-      fatalUtf8: response.status >= 500 && response.status < 600,
-    });
-    usage = usageFromComboFailureText(body.text);
-    if (
-      response.status >= 500 && response.status < 600
-      && body.displaySafe && !body.truncated
-    ) {
+    const body = await readBoundedResponseBody(response, { signal, reportUtf8Validity: serverError });
+    // A 5xx body counts as quota or classification evidence only when it decoded as valid
+    // UTF-8, matching shouldRetryCodexPoolAccountQuota. A malformed byte keeps the status-only
+    // fallback, with one exception: a cyber-policy refusal must still stop the combo, so the
+    // replacement-decoded text may carry that verdict and nothing else.
+    const utf8Trusted = !serverError || body.utf8Valid === true;
+    if (utf8Trusted) usage = usageFromComboFailureText(body.text);
+    if (serverError && utf8Trusted && body.displaySafe && !body.truncated) {
       const quotaMessage = codexQuotaFailureMessage(body.text);
       quotaConfirmedByBody = quotaMessage !== undefined
         && isRateLimitOrQuotaFailureMessage(quotaMessage);
     }
-    if (body.displaySafe) {
+    if (body.displaySafe && !body.truncated) {
       const normalized = normalizeUpstreamErrorText(body.text, fallback);
-      classificationText = normalized.safeText;
-      upstreamCode = normalized.code;
-      upstreamMessage = normalized.message;
-      upstreamType = normalized.type;
+      if (utf8Trusted || isCyberPolicyCode(normalized.code) || isCyberPolicyMessage(normalized.safeText)) {
+        classificationText = normalized.safeText;
+        upstreamCode = normalized.code;
+        upstreamMessage = normalized.message;
+        upstreamType = normalized.type;
+      }
     }
   } catch (error) {
     if (signal?.aborted) throw error;

package/src/server/responses/core-normalize.ts

@@ -16,6 +16,7 @@ import { prepareEffortNormalization } from "../effort-policy";
 import { resolveOpenCodeGoTransport } from "../../providers/opencode-go-transport";
 import { getOrAllocateRequestSessionLane } from "../request-log-conversation";
 import { shouldPreparePlaintextV2AgentMessages } from "../../responses/plaintext-v2-agent-messages";
+import { hasValidatedActiveReasoningEffort } from "../../responses/parser";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { applyOpenAiVirtualModel } from "../../providers/openai-virtual-models";
 import {
@@ -164,7 +165,8 @@ export async function applyFinalRouteRequestNormalization(args: {
   if (inboundWire === "responses" && parsed._rawBody) {
     const summary = (parsed._rawBody as { reasoning?: { summary?: unknown } }).reasoning?.summary;
     parsed.options.hideThinkingSummary = summary === "none"
-      || (!summary && route.provider.showThinkingSummary !== true);
+      || (!summary && !hasValidatedActiveReasoningEffort(parsed.options)
+        && route.provider.showThinkingSummary !== true);
   }
   if (preserveAnthropicResponseModel) parsed._responseModelId = responseModelId;
   logCtx.model = virtualModel?.selectedModelId ?? route.modelId;
@@ -195,6 +197,8 @@ export async function applyFinalRouteRequestNormalization(args: {
 
   if (parsed._responseModelId !== undefined && parsed._responseModelId !== parsed.modelId) {
     logCtx.resolvedModel = route.modelId;
+    logCtx.wireModel = route.modelId;
+    logCtx.responseModelEcho = parsed._responseModelId;
     logCtx.preserveResolvedModelFromRoute = true;
   }
 

package/src/server/responses/core-opaque-recovery.ts

@@ -1,11 +1,14 @@
 import { ENCRYPTED_FUNCTION_OUTPUT_REJECTION, upstreamErrorMessageFromPayload } from "../../lib/errors";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { isReasoningEffortRejection } from "../../providers/reasoning-metadata";
+import { isAnthropicFastRefusal } from "../../providers/anthropic-fast";
+import type { AdapterRequest } from "../../adapters/base";
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import type { OcxParsedRequest } from "../../types";
 import type { RequestLogContext } from "../request-log";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { rememberReasoningReplayOpaqueBlobRejection } from "../../responses/reasoning-replay-cache";
+import { resolvedAdapterWire } from "../../responses/continuation-ownership";
 
 export const OPAQUE_RESPONSES_INPUT_TYPES = new Set([
   "reasoning",
@@ -22,6 +25,21 @@ export const FUNCTION_OUTPUT_TYPES = new Set(["function_call_output", "custom_to
 export const AGENT_MESSAGE_TYPE = "agent_message";
 
 
+/**
+ * Whether the adapter serving this send speaks the Responses wire, as the adapter registry
+ * declares it.
+ *
+ * Recovery used to compare the adapter name with `"openai-responses"`. Azure OpenAI wraps the same
+ * passthrough under its own name, so an `invalid_encrypted_content` after moving a conversation
+ * onto Azure never recovered (#5583). The registry already records that relationship as
+ * `contractParent: "openai-responses"`, so reading the resolved wire covers Azure and any later
+ * wrapper of the same contract by construction, while every translated wire stays excluded.
+ */
+export function adapterSpeaksResponsesWire(adapterName: string): boolean {
+  return resolvedAdapterWire(adapterName) === "openai-responses";
+}
+
+
 export function encryptedFunctionOutputParts(output: unknown): boolean {
   return Array.isArray(output) && output.some(part => (
     part !== null
@@ -282,7 +300,7 @@ export function shouldAttemptOpaqueBlobRecovery(args: {
       && isEncryptedFunctionOutputRejection(args.errorBody)
     );
   return acceptedStatus
-    && args.adapterName === "openai-responses"
+    && adapterSpeaksResponsesWire(args.adapterName)
     && !args.alreadyAttempted
     && outboundResponsesBodyCarriesOpaqueBlob(args.outboundBody)
     && isSelfIdentifiedOpaqueBlobRejection(args.errorBody);
@@ -312,6 +330,33 @@ export async function reasoningEffortRejectionText(
 }
 
 
+/**
+ * Whether an Anthropic response refused the fast lane of a request that actually sent it.
+ *
+ * "Actually sent" is read from the adapter's own tier record for that exact request, never from
+ * the route: a request built without `speed` can be refused for other reasons and must not be
+ * downgraded. The body is read from a clone, so a refusal that is not recovered (or whose resend
+ * is not admitted) still reaches the caller intact.
+ */
+export async function anthropicFastRefused(
+  response: Response,
+  sentRequest: AdapterRequest | undefined,
+  adapterName: string,
+  alreadyAttempted: boolean,
+  signal: AbortSignal,
+): Promise<boolean> {
+  if (alreadyAttempted || adapterName !== "anthropic") return false;
+  if (response.status !== 400 && response.status !== 429) return false;
+  const outcome = sentRequest?.tierLog?.outcome;
+  if (outcome?.wireKind !== "anthropic-speed" || typeof outcome.wireValue !== "string") return false;
+  try {
+    const body = await readBoundedResponseBody(response.clone(), { signal });
+    return isAnthropicFastRefusal(response.status, response.headers, body.truncated ? undefined : body.text);
+  } catch {
+    return isAnthropicFastRefusal(response.status, response.headers, undefined);
+  }
+}
+
 export async function opaqueBlobRejectionBodyForRecovery(
   response: Response,
   outboundBody: string | undefined,
@@ -323,7 +368,7 @@ export async function opaqueBlobRejectionBodyForRecovery(
     isNonReplayableResponse(response)
     || response.status < 400
     || (response.status >= 500 && response.status !== 502)
-    || adapterName !== "openai-responses"
+    || !adapterSpeaksResponsesWire(adapterName)
     || alreadyAttempted
     || !outboundResponsesBodyCarriesOpaqueBlob(outboundBody)
   ) return undefined;
@@ -365,6 +410,9 @@ export async function consoleGoUploadRejectionBody(
 
 export function prepareOpaqueBlobRecovery(parsed: OcxParsedRequest): void {
   parsed._stripReasoningEncryptedContent = true;
+  // The destination rejected state another serving identity minted. A reasoning item's id names
+  // an item in that identity's store, so it goes with the blob.
+  parsed._dropForeignReasoningItemIds = true;
   const rawBody = parsed._rawBody;
   if (!rawBody || typeof rawBody !== "object" || Array.isArray(rawBody)) return;
   const input = (rawBody as { input?: unknown }).input;

package/src/server/responses/core-options.ts

@@ -114,6 +114,8 @@ export interface HandleResponsesOptions {
   callerDirectAuth?: CallerDirectAuth | null;
   /** Internal recursion guard; callers outside this module must not set it. */
   comboAttempt?: boolean;
+  /** Internal handoff: this combo was selected by shadow-call interception. */
+  shadowCallIntercepted?: boolean;
   compactionRoutingOverride?: CompactionRoutingOverride | null;
   /** Internal combo handoff for one parent-validated continuation snapshot. */
   comboReplaySnapshot?: {

package/src/server/responses/core-replay.ts

@@ -21,6 +21,7 @@ import {
   durableReplayDestinationIdentity,
   bindReasoningReplayScope,
   reasoningReplayServingIdentityChanged,
+  reasoningReplayItemStoreChanged,
   reasoningReplayOpaqueBlobRejectionMemoized,
 } from "../../responses/reasoning-replay-cache";
 import type { OAuthAccessSnapshot } from "../../oauth";
@@ -137,9 +138,15 @@ export function bindRouteReasoningReplayScope(args: {
   // after the first mismatch, but it cannot make history minted by the prior route decodable.
   if (reasoningReplayServingIdentityChanged(parsed._reasoningReplayScope)) {
     parsed._stripReasoningEncryptedContent = true;
+    // Only a different destination or credential makes the replayed item ids unresolvable; a
+    // model change on the same store keeps them.
+    if (reasoningReplayItemStoreChanged(parsed._reasoningReplayScope)) {
+      parsed._dropForeignReasoningItemIds = true;
+    }
   }
   if (reasoningReplayOpaqueBlobRejectionMemoized(parsed._reasoningReplayScope)) {
     parsed._stripReasoningEncryptedContent = true;
+    parsed._dropForeignReasoningItemIds = true;
   }
   bindProviderContinuationForRoute(parsed, continuationOwner);
 }

package/src/server/responses/core.ts

@@ -189,7 +189,7 @@ export { readDisplaySafeErrorText } from "./core-errors";
 export { usesCodexForwardPoolAuth } from "./core-codex-account";
 export { preAuthUpstreamHostCircuitKey } from "./core-codex-account";
 export { upstreamHostCircuitOpenResponse } from "./core-codex-account";
-export { shouldRetryCodexPoolAccountQuota } from "./core-codex-account";
+export { shouldRetryCodexPoolAccountQuota, shouldRetryCodexScopedQuotaOnAlternate } from "./core-codex-account";
 export { shouldRetryCodexPoolAccountTransient } from "./core-codex-account";
 export { codexAccountGatedCanonicalWireModel } from "./core-codex-account";
 export { codexForwardTerminalOutcomeRecorder } from "./core-codex-account";

package/src/server/responses/encrypted-payload.ts

@@ -123,11 +123,18 @@ function looksLikeUnknownOpaqueSlot(payload: string): boolean {
  */
 const FERNET_TOKEN_CANDIDATE = /g[A-Za-z0-9_-]{97,}={0,2}/g;
 const FERNET_TOKEN_BOUNDARY_CHAR = /[A-Za-z0-9_=-]/;
+// A normal mixed agent task contains one encrypted body. Keep pathological slots
+// from amplifying into an attacker-controlled number of request parts.
+const MAX_EMBEDDED_FERNET_RUNS_PER_SLOT = 64;
 
 interface FernetTokenRun {
   index: number;
   token: string;
 }
+interface FernetRunScan {
+  runs: FernetTokenRun[];
+  overflow: boolean;
+}
 
 /**
  * Validate only the key-independent Fernet wire structure. Authenticity cannot be
@@ -158,11 +165,11 @@ function isStructurallyValidFernetToken(token: string): boolean {
 }
 
 export function structurallyValidFernetTokens(payload: string): string[] {
-  return fernetTokenRuns(payload).map(run => run.token);
+  return fernetTokenRuns(payload).runs.map(run => run.token);
 }
 
 /** Maximal, boundary-delimited and structurally valid Fernet runs embedded in a slot. */
-function fernetTokenRuns(payload: string): FernetTokenRun[] {
+function fernetTokenRuns(payload: string): FernetRunScan {
   const runs: FernetTokenRun[] = [];
   for (const match of payload.matchAll(FERNET_TOKEN_CANDIDATE)) {
     const index = match.index ?? 0;
@@ -172,9 +179,10 @@ function fernetTokenRuns(payload: string): FernetTokenRun[] {
     if (before && FERNET_TOKEN_BOUNDARY_CHAR.test(before)) continue;
     if (after && FERNET_TOKEN_BOUNDARY_CHAR.test(after)) continue;
     if (!isStructurallyValidFernetToken(token)) continue;
+    if (runs.length === MAX_EMBEDDED_FERNET_RUNS_PER_SLOT) return { runs, overflow: true };
     runs.push({ index, token });
   }
-  return runs;
+  return { runs, overflow: false };
 }
 
 function textWithoutFernetRuns(payload: string, runs: readonly FernetTokenRun[]): string {
@@ -291,7 +299,9 @@ export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
     }
 
     if (fragmentParts.has(part)) continue;
-    const runs = fernetTokenRuns(record.encrypted_content);
+    const scan = fernetTokenRuns(record.encrypted_content);
+    if (scan.overflow) return true;
+    const { runs } = scan;
     if (runs.length > 0) hasFernetTask = true;
     readableParts.push(textWithoutFernetRuns(record.encrypted_content, runs));
   }
@@ -308,9 +318,11 @@ export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
 
 
 export function encryptedSlotParts(payload: string): Array<Record<string, string>> {
+  const scan = fernetTokenRuns(payload);
+  if (scan.overflow) return [{ type: "input_text", text: OMITTED_ENCRYPTED_CONTENT_TEXT }];
   const parts: Array<Record<string, string>> = [];
   let last = 0;
-  for (const run of fernetTokenRuns(payload)) {
+  for (const run of scan.runs) {
     const before = payload.slice(last, run.index);
     if (before.trim().length > 0) parts.push({ type: "input_text", text: before });
     parts.push({ type: "encrypted_content", encrypted_content: run.token });
@@ -420,7 +432,9 @@ export function stripAgentMessageCiphertextInPlace(input: unknown): number {
 
 /** Free text: drop embedded token runs, and replace a slot that is nothing but a token. */
 function textWithoutCiphertext(text: string): string {
-  const runs = fernetTokenRuns(text);
+  const scan = fernetTokenRuns(text);
+  if (scan.overflow) return OMITTED_ENCRYPTED_CONTENT_TEXT;
+  const { runs } = scan;
   if (runs.length > 0) return textWithRunsOmitted(text, runs);
   return looksLikeFernetToken(text.trim()) ? OMITTED_ENCRYPTED_CONTENT_TEXT : text;
 }
@@ -473,11 +487,11 @@ function contentWithoutCiphertext(content: unknown[]): unknown[] {
       changed = true;
       // Keep whatever plaintext a recognizable slot carries around its token; a slot this
       // cannot parse is replaced whole rather than forwarded on the chance that it is benign.
-      const runs = fernetTokenRuns(record.encrypted_content);
+      const scan = fernetTokenRuns(record.encrypted_content);
       return {
         type: "input_text",
-        text: runs.length > 0
-          ? textWithRunsOmitted(record.encrypted_content, runs)
+        text: scan.overflow ? OMITTED_ENCRYPTED_CONTENT_TEXT : scan.runs.length > 0
+          ? textWithRunsOmitted(record.encrypted_content, scan.runs)
           : OMITTED_ENCRYPTED_CONTENT_TEXT,
       };
     }

package/src/server/responses/passthrough-delivery.ts

@@ -207,7 +207,10 @@ export async function deliverPassthroughResponse(
 
     const headers = sanitizePassthroughHeaders(upstreamResponse.headers, codexSafetyBufferingOptions);
     const resolvedModel = headers.get("openai-model")?.trim();
-    if (resolvedModel && !logCtx.preserveResolvedModelFromRoute) logCtx.resolvedModel = resolvedModel;
+    if (resolvedModel) {
+      logCtx.servedModel = resolvedModel;
+      if (!logCtx.preserveResolvedModelFromRoute) logCtx.resolvedModel = resolvedModel;
+    }
     if (isUsageDebugEnabled()) {
       const upstreamContentType = upstreamResponse.headers.get("content-type");
       if (upstreamContentType) logCtx.usageDebugContentType = upstreamContentType;
@@ -380,36 +383,62 @@ export async function deliverPassthroughResponse(
       });
       // Capture the binding that actually served the first leg, after its permitted reselection.
       const webSearchBridgeBinding = requestBindings.get(nativeExchange.request);
-      // The bridge wraps the RAW upstream body, so terminal repair below still owns the single
-      // client-facing terminal — the bridge drops the terminal of every intercepted leg.
-      const upstreamSseBody = webSearchBridgePlan
+      // Repair must observe the raw first leg before the bridge suppresses an intercepted search
+      // lifecycle. Otherwise a provider that leaves that complete call open never arms repair's
+      // grace timer, so the bridge cannot execute the search or begin its continuation.
+      let passthroughSseBody = terminalRepairPolicy
+        ? relayResponsesSseWithTerminalRepair(
+          upstreamResponse.body,
+          upstream,
+          terminalRepairPolicy,
+          translatorBudget,
+          options.responsesTerminalRepairScheduler,
+        )
+        : upstreamResponse.body;
+      passthroughSseBody = webSearchBridgePlan
         ? createPassthroughWebSearchBridgeStream({
           plan: webSearchBridgePlan,
-          firstLeg: upstreamResponse.body,
+          firstLeg: passthroughSseBody,
           requestBody: nativeExchange.request.body,
           // Continuation legs replay the same built request with the executed search appended.
           // The first leg already passed the recovery ladder, the outbound size ceiling, and the
           // host circuit; a KEY-auth destination has no OAuth refresh to replay on a later leg.
-          send: (continuationBody: string) => fetchWithHeaderTimeout(
-            nativeExchange.request.url,
-            { method: nativeExchange.request.method, headers: nativeExchange.request.headers, body: continuationBody },
-            upstream.signal,
-            connectMs,
-            true,
-            providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              // Pacing can outlive a manual selection change. A continuation must retain the
-              // first leg's key and appended search result, never rebuild from the original turn.
-              beforeDispatch: () => {
-                if (webSearchBridgeBinding?.kind !== "api-key"
-                  || !providerApiKeySelectionIsCurrent(config, route.providerName, webSearchBridgeBinding.provider)) {
-                  throw new Error("API key selection changed during a web-search continuation");
-                }
-              },
-              providerName: route.providerName,
-              modelId: route.modelId,
-            }),
-            false,
-          ),
+          send: async (continuationBody: string) => {
+            const continuation = await fetchWithHeaderTimeout(
+              nativeExchange.request.url,
+              { method: nativeExchange.request.method, headers: nativeExchange.request.headers, body: continuationBody },
+              upstream.signal,
+              connectMs,
+              true,
+              providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+                // Pacing can outlive a manual selection change. A continuation must retain the
+                // first leg's key and appended search result, never rebuild from the original turn.
+                beforeDispatch: () => {
+                  if (webSearchBridgeBinding?.kind !== "api-key"
+                    || !providerApiKeySelectionIsCurrent(config, route.providerName, webSearchBridgeBinding.provider)) {
+                    throw new Error("API key selection changed during a web-search continuation");
+                  }
+                },
+                providerName: route.providerName,
+                modelId: route.modelId,
+              }),
+              false,
+            );
+            // The same provider can leave a complete continuation open without a terminal, which
+            // stalls the bridge's decide loop exactly like the first leg — so every leg gets the
+            // same repair, not only the intercepted first one.
+            if (!terminalRepairPolicy || !continuation.ok || !continuation.body) return continuation;
+            return new Response(
+              relayResponsesSseWithTerminalRepair(
+                continuation.body,
+                upstream,
+                terminalRepairPolicy,
+                translatorBudget,
+                options.responsesTerminalRepairScheduler,
+              ),
+              continuation,
+            );
+          },
           execute: createPassthroughWebSearchBridgeExecutor(webSearchBridgePlan, {
             providerApiKey: route.provider.apiKey ?? "",
             auth: webSearchBridgeAuth,
@@ -432,16 +461,7 @@ export async function deliverPassthroughResponse(
           onFinalize: () => releaseCodexAuthContextProbeLease(openAiSidecar?.authContext),
           signal: upstream.signal,
         })
-        : upstreamResponse.body;
-      const passthroughSseBody = terminalRepairPolicy
-        ? relayResponsesSseWithTerminalRepair(
-          upstreamSseBody,
-          upstream,
-          terminalRepairPolicy,
-          translatorBudget,
-          options.responsesTerminalRepairScheduler,
-        )
-        : upstreamSseBody;
+        : passthroughSseBody;
       const repairConfig = route.provider.responsesItemIdRepair;
       // Grok Build renders deltas live but reconstructs its durable assistant
       // turn from the completed response snapshot. Native Responses streams