@bitkyc08/opencodex 2.64.0 → 2.65.0-preview.20260925

package/src/server/proxy-liveness.ts

@@ -84,12 +84,47 @@ export interface LivenessIo {
   createChallengeFn?: () => string;
 }
 
+/**
+ * Operator override for the per-probe fetch ceilings below (`OCX_PROBE_TIMEOUT_MS`),
+ * integer milliseconds in [1, MAX_PROBE_TIMEOUT_MS].
+ *
+ * Some hosts put a security layer (content filter, EDR network extension) in front of
+ * loopback TCP that adds a fixed per-connect cost, measured at about one second on an
+ * affected macOS machine. The shipped 750 ms probe then aborts before a healthy proxy can
+ * answer, and every CLI liveness consumer reports the proxy as down while a direct
+ * `curl /healthz` succeeds.
+ *
+ * The override only raises: each ceiling keeps its shipped floor (750 ms for the shared
+ * default, 1500 ms for the stop/start ownership budgets that guard against a duplicate
+ * proxy, #764, #5004), so a small value can never shorten them. Values above the 30 s
+ * ceiling are ignored rather than clamped: a stop multiplies its budget by the attempt
+ * count, and a typo must not turn a stop into a wait of minutes or days. Parsed once at
+ * module load; anything malformed falls back to the defaults and never breaks startup.
+ */
+export const MAX_PROBE_TIMEOUT_MS = 30_000;
+const SHARED_PROBE_FLOOR_MS = 750;
+const OWNERSHIP_PROBE_FLOOR_MS = 1500;
+
+export function parseProbeTimeoutOverrideMs(raw: string | undefined): number | undefined {
+  const trimmed = raw?.trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) return undefined;
+  const n = Number(trimmed);
+  return n > 0 && n <= MAX_PROBE_TIMEOUT_MS ? n : undefined;
+}
+
+/** The ceiling for a probe whose shipped value is `floorMs`, raised by a valid override only. */
+export function probeCeilingMs(floorMs: number, override: number | undefined): number {
+  return Math.max(floorMs, override ?? 0);
+}
+
+const probeTimeoutOverrideMs = parseProbeTimeoutOverrideMs(process.env.OCX_PROBE_TIMEOUT_MS);
+
 /** Default per-probe fetch ceiling shared by liveness and readiness probes. */
-export const DEFAULT_PROBE_TIMEOUT_MS = 750;
+export const DEFAULT_PROBE_TIMEOUT_MS = probeCeilingMs(SHARED_PROBE_FLOOR_MS, probeTimeoutOverrideMs);
 
 /** Default probe options for service stop / orphan cleanup — a just-bound proxy can miss a single 750ms probe. */
 export const SERVICE_STOP_LIVENESS: Pick<LivenessIo, "timeoutMs" | "attempts"> = {
-  timeoutMs: 1500,
+  timeoutMs: probeCeilingMs(OWNERSHIP_PROBE_FLOOR_MS, probeTimeoutOverrideMs),
   attempts: 3,
 };
 
@@ -105,7 +140,7 @@ export const SERVICE_STOP_LIVENESS: Pick<LivenessIo, "timeoutMs" | "attempts"> =
  * the stop path already uses for the mirror-image decision.
  */
 export const START_OWNERSHIP_LIVENESS: Pick<LivenessIo, "timeoutMs" | "attempts"> = {
-  timeoutMs: 1500,
+  timeoutMs: probeCeilingMs(OWNERSHIP_PROBE_FLOOR_MS, probeTimeoutOverrideMs),
   attempts: 3,
 };
 

package/src/server/request-log-account-rotation.ts

@@ -0,0 +1,53 @@
+import { ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+import { isCodexUsageAccountLogLabel, type PersistedUsageAttempt } from "../usage/log";
+
+/**
+ * Did the account behind a sent attempt change between two sends of the same request?
+ *
+ * Any ACCOUNT change ends the attempt, not just an API-key one. Codex pool and generic OAuth
+ * labels are `p`/`o` + 6 hex, which the key-only pattern never matched, so a rotation folded the
+ * second account's sends, usage and label into the first attempt row: the request then reported
+ * one attempt on the wrong account, and per-account usage attribution was silently wrong.
+ * `isCodexUsageAccountLogLabel` (src/usage/log.ts) already persists those labels onto the
+ * attempt through the broad pattern; this is the same pattern, read back at the split.
+ *
+ * The other axis a rotation can move: Anthropic's pool carries no label at all --
+ * `stampOAuthAccountLabel` skips that base provider -- and keeps its account inside the
+ * account-qualified log provider string (`anthropic-p<hex6>`), so the label test can never see an
+ * Anthropic rotation. Comparing providers is safe because a sent attempt's provider is frozen by
+ * `sealRequestAttemptIdentity`: the only way the two diverge after a send is the account moving
+ * underneath the row.
+ */
+export function attemptAccountChanged(
+  previousLabel: string | undefined,
+  nextLabel: string | undefined,
+  attemptProvider: string | undefined,
+  currentProvider: string,
+): boolean {
+  const labelChanged = previousLabel !== nextLabel
+    && (ACCOUNT_LOG_LABEL_RE.test(previousLabel ?? "") || ACCOUNT_LOG_LABEL_RE.test(nextLabel ?? ""));
+  return labelChanged || (attemptProvider !== undefined && attemptProvider !== currentProvider && currentProvider.length > 0);
+}
+
+/** Stamp an attempt's identity; after its first send the account is frozen (see attemptAccountChanged). */
+export function sealRequestAttemptIdentity(
+  attempt: PersistedUsageAttempt | undefined,
+  provider: string,
+  adapter: string,
+  accountLogLabel?: string,
+): void {
+  if (!attempt) return;
+  if (attempt.provider !== provider || attempt.adapter !== adapter) delete attempt.credentialSource;
+  // The adapter keeps re-stamping: a mid-turn wire rotation is still this same physical send.
+  attempt.adapter = adapter;
+  if (attempt.sendCount === 0) {
+    attempt.provider = provider;
+    if (isCodexUsageAccountLogLabel(accountLogLabel)) attempt.accountLogLabel = accountLogLabel;
+    else delete attempt.accountLogLabel;
+    return;
+  }
+  // After a send the account is settled; only a label that arrives late for the same account lands.
+  if (attempt.accountLogLabel === undefined && isCodexUsageAccountLogLabel(accountLogLabel)) {
+    attempt.accountLogLabel = accountLogLabel;
+  }
+}

package/src/server/request-log.ts

@@ -2,6 +2,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { stampApiKeyAccountLabel, usesApiKeyAccount } from "../providers/label";
 import { KEY_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+import { attemptAccountChanged, sealRequestAttemptIdentity } from "./request-log-account-rotation";
+export { sealRequestAttemptIdentity };
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import type { ResponsesTerminalStatus } from "../bridge";
 import {
@@ -1748,20 +1750,6 @@ export function beginRequestAttempt(
   };
 }
 
-export function sealRequestAttemptIdentity(
-  attempt: PersistedUsageAttempt | undefined,
-  provider: string,
-  adapter: string,
-  accountLogLabel?: string,
-): void {
-  if (!attempt) return;
-  if (attempt.provider !== provider || attempt.adapter !== adapter) delete attempt.credentialSource;
-  attempt.provider = provider;
-  attempt.adapter = adapter;
-  if (isCodexUsageAccountLogLabel(accountLogLabel)) attempt.accountLogLabel = accountLogLabel;
-  else delete attempt.accountLogLabel;
-}
-
 /** Preserve metered JSON failures before key recovery consumes/cancels their body. */
 export async function recordKeyAttemptFailure(logCtx: RequestLogContext, response: Response, signal?: AbortSignal): Promise<void> {
   const attempt = logCtx.activeAttempt;
@@ -1805,8 +1793,7 @@ export function noteProviderAttemptSend(
   stampApiKeyAccountLabel(logCtx, providerName, provider);
   const next = logCtx.accountLogLabel;
   if (attempt && usesApiKeyAccount(provider)) keyUsageOwners.add(attempt);
-  if (attempt && attempt.sendCount > 0 && previous !== next
-    && (KEY_ACCOUNT_LOG_LABEL_RE.test(previous ?? "") || KEY_ACCOUNT_LOG_LABEL_RE.test(next ?? ""))) {
+  if (attempt && attempt.sendCount > 0 && attemptAccountChanged(previous, next, attempt.provider, logCtx.provider)) {
     // An input estimate is not evidence that a failed send used that many tokens.
     delete attempt.inputTokenEstimate;
     finishRequestAttempt(attempt, attempt.status >= 100 ? attempt.status

package/src/server/responses/adapter-dispatch.ts

@@ -17,6 +17,7 @@ import {
 } from "../request-log";
 import { clientCancelledResponse, readDisplaySafeErrorText, normalizeUpstreamErrorText } from "./core-errors";
 import { redactSecretString } from "../../lib/redact";
+import { rewriteUpstreamPolicyRefusal } from "./policy-refusal";
 import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 import { providerFetch, fetchWithHeaderTimeout, safeHostLabel } from "./fetch-helpers";
 import {
@@ -41,7 +42,7 @@ import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import type { OAuthAccessSnapshot } from "../../oauth";
 import { publicOAuthAuthenticationErrorMessage } from "../../oauth";
-import { resolveProviderTransport } from "../../providers/xai-transport";
+import { isXaiResponsesDestination, resolveProviderTransport } from "../../providers/xai-transport";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { bindRouteReasoningReplayScope } from "./core-replay";
@@ -1066,6 +1067,21 @@ export async function prepareAdapterExchange(
           ? streamingContextOverflowResponse(parsed._responseModelId ?? parsed.modelId, translatorBudget)
           : jsonContextOverflowResponse();
       }
+      const policyRefusal = rewriteUpstreamPolicyRefusal({
+        status: upstreamResponse.status,
+        errorText,
+        stream: clientRequestedStream,
+        modelId: parsed._responseModelId ?? parsed.modelId,
+        // The same host check covers the openai-chat wire: both xAI hosts serve Chat too.
+        destinationIsXai: isXaiResponsesDestination(route.provider),
+        translatorBudget,
+        turnAdmissionLease: options.turnAdmissionLease,
+      });
+      if (policyRefusal) {
+        // Codex-facing incomplete/content_filter. openai-responses passthrough
+        // uses the same helper after its 413 block.
+        return policyRefusal;
+      }
       if (!isFixedCodexAccount(admissionState.authCtx)) {
         recordSubagentQuotaFailureForThreadSpawn(
           req.headers,

package/src/server/responses/agent-task-recovery.ts

@@ -75,15 +75,17 @@ interface AgentEnvelope {
   encryptedStartIndex: number;
   inputSnapshot: string;
   headerText: string;
-  messageType: "NEW_TASK" | "MESSAGE";
-  taskName: string;
+  messageType: "NEW_TASK" | "MESSAGE" | "FOLLOWUP_TASK" | "FINAL_ANSWER";
+  taskName: string | null;
   sender: string;
   ciphertexts: readonly string[];
   author: string;
   recipient: string;
 }
 
-const ROUTING_HEADER = /(?:^|\n)Message Type\s*:\s*(NEW_TASK|MESSAGE)\s*\nTask name\s*:\s*(\S+)\s*\nSender\s*:\s*(\S+)\s*\nPayload\s*:\s*(?:\n|$)/;
+const ROUTING_HEADER = /(?:^|\n)Message Type\s*:\s*(NEW_TASK|MESSAGE|FOLLOWUP_TASK)\s*\nTask name\s*:\s*(\S+)\s*\nSender\s*:\s*(\S+)\s*\nPayload\s*:\s*(?:\n|$)/;
+// FINAL_ANSWER omits the Task name line when the sender declares no recipient.
+const FINAL_ANSWER_HEADER = /(?:^|\n)Message Type\s*:\s*FINAL_ANSWER\s*\n(?:Task name\s*:\s*(\S+)\s*\n)?Sender\s*:\s*(\S+)\s*\nPayload\s*:\s*(?:\n|$)/;
 
 function findEnvelope(input: unknown): AgentEnvelope | null {
   if (!Array.isArray(input)) return null;
@@ -104,7 +106,7 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
   if (!Array.isArray(content)) return null;
 
   let headerText: string | null = null;
-  let messageType: "NEW_TASK" | "MESSAGE" | null = null;
+  let messageType: "NEW_TASK" | "MESSAGE" | "FOLLOWUP_TASK" | "FINAL_ANSWER" | null = null;
   let taskName: string | null = null;
   let sender: string | null = null;
   let encryptedStartIndex = -1;
@@ -119,16 +121,24 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
       && typeof part.text === "string"
     ) {
       const match = ROUTING_HEADER.exec(part.text);
-      if (match) {
+      const finalMatch = match ? null : FINAL_ANSWER_HEADER.exec(part.text);
+      if (match || finalMatch) {
         if (headerText !== null) return null;
+        const m = match ?? finalMatch!;
         if (
-          part.text.slice(0, match.index).trim().length > 0
-          || part.text.slice(match.index + match[0].length).trim().length > 0
+          part.text.slice(0, m.index).trim().length > 0
+          || part.text.slice(m.index + m[0].length).trim().length > 0
         ) return null;
-        headerText = match[0].startsWith("\n") ? match[0].slice(1) : match[0];
-        messageType = match[1] as "NEW_TASK" | "MESSAGE";
-        taskName = match[2]!;
-        sender = match[3]!;
+        headerText = m[0].startsWith("\n") ? m[0].slice(1) : m[0];
+        if (match) {
+          messageType = match[1] as "NEW_TASK" | "MESSAGE" | "FOLLOWUP_TASK";
+          taskName = match[2]!;
+          sender = match[3]!;
+        } else {
+          messageType = "FINAL_ANSWER";
+          taskName = finalMatch![1] ?? null;
+          sender = finalMatch![2]!;
+        }
       }
     }
     if (part.type !== "encrypted_content") continue;
@@ -145,7 +155,6 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
   if (
     !headerText
     || !messageType
-    || !taskName
     || !sender
     || encryptedStartIndex < 0
     || ciphertexts.length === 0
@@ -153,7 +162,13 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
 
   const itemRecord = item as { author?: unknown; recipient?: unknown };
   if (typeof itemRecord.author !== "string" || typeof itemRecord.recipient !== "string") return null;
-  if (itemRecord.author !== sender || itemRecord.recipient !== taskName) return null;
+  // A FINAL_ANSWER without a Task name line declares no recipient, so the structured
+  // recipient is only cross-checked when a task name is present; admission is the
+  // trust boundary either way.
+  if (
+    itemRecord.author !== sender
+    || (taskName !== null && itemRecord.recipient !== taskName)
+  ) return null;
 
   return {
     itemIndex,
@@ -170,10 +185,15 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
 }
 
 function stripMatchingEnvelope(assignment: string, envelope: AgentEnvelope): string | null {
-  const match = ROUTING_HEADER.exec(assignment);
+  const header = envelope.messageType === "FINAL_ANSWER" ? FINAL_ANSWER_HEADER : ROUTING_HEADER;
+  const foreign = header === FINAL_ANSWER_HEADER ? ROUTING_HEADER : FINAL_ANSWER_HEADER;
+  if (foreign.test(assignment)) return null;
+  const match = header.exec(assignment);
   if (!match) return assignment;
   if (match.index !== 0) return null;
-  if (
+  if (envelope.messageType === "FINAL_ANSWER") {
+    if ((match[1] ?? null) !== envelope.taskName || match[2] !== envelope.sender) return null;
+  } else if (
     match[1] !== envelope.messageType
     || match[2] !== envelope.taskName
     || match[3] !== envelope.sender
@@ -295,18 +315,21 @@ function admittedRecovery(
   if (!envelope) return { admitted: false, reason: "unsupported_envelope" };
   const admission = recoveryAdmission(req, config);
   if (!admission) return { admitted: false, reason: "admission_denied" };
+  // A JSON-encoded fixed-order tuple, not a delimiter-joined string: a field that carries the
+  // delimiter shifts every boundary after it, so two envelopes could hash to one entry and one
+  // recovery would replay for the other. A FINAL_ANSWER that omits its Task name line carries no
+  // addressing in the header, which leaves the structured recipient as the only field separating
+  // two such envelopes and makes the boundary the whole difference.
   const cacheKey = createHash("sha256")
-    .update(admission.cacheScope)
-    .update("\0")
-    .update(parentThreadId ?? "")
-    .update("\0")
-    .update(envelope.messageType)
-    .update("\0")
-    .update(envelope.taskName)
-    .update("\0")
-    .update(envelope.sender)
-    .update("\0")
-    .update(JSON.stringify(envelope.ciphertexts))
+    .update(JSON.stringify([
+      admission.cacheScope,
+      parentThreadId ?? "",
+      envelope.messageType,
+      envelope.taskName ?? "",
+      envelope.recipient,
+      envelope.sender,
+      envelope.ciphertexts,
+    ]))
     .digest("hex");
   return { admitted: true, recovery: { envelope, admission, cacheKey } };
 }

package/src/server/responses/codex-ws-exchange.ts

@@ -11,7 +11,7 @@ import type { CodexWsSession } from "./codex-ws-session";
 import { UPGRADE_DEADLINE_MS, CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES,
   MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage,
   codexWsCreateFrameExceedsLimit, codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
-  type CodexWsFailureStage, type CodexWsStageRecord } from "./codex-ws-wire";
+  markCodexWsSocketDeath, type CodexWsFailureStage, type CodexWsStageRecord } from "./codex-ws-wire";
 
 interface ExchangeOptions {
   nativeControl?: NativeResponseControl;
@@ -213,14 +213,14 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       resolve(response);
     };
 
-    const failStream = (error: unknown, status: 502 | 504 = 502) => {
+    const failStream = (error: unknown, status: 502 | 504 = 502, { socketDied = false } = {}) => {
       if (terminal) return;
       terminal = true;
       if (sent && !responseCommitted && metadata) {
         // Nothing has been promised to the client yet, so the honest answer is a gateway
         // status, not a 200 whose body then fails. The frame may already be executing
-        // upstream: the response is marked non-replayable so no layer of this process sends
-        // it again, and the client applies its own retry policy as it would on the direct
+        // upstream: the response is marked non-replayable so no retry layer of this process
+        // sends it again, and the client applies its own retry policy as it would on the direct
         // path. Same settle order as a refused create: snapshot, detach, close, dispose.
         const prelude = metadata.snapshot();
         // Claim the commit slot so no later path can resolve a second, 200 Response.
@@ -230,7 +230,13 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         session.dispose();
         const message = error instanceof Error ? error.message : String(error);
         const failureResponse = codexWsPreResponseFailure(status, message, prelude);
-        markCodexWsStage(failureResponse, stageRecord(Buffer.byteLength(frameText, "utf8")));
+        const stage = failureStage();
+        markCodexWsStage(failureResponse, stageRecord(stage.requestBytes));
+        // #4191: a socket that died under the send is the one settle the dispatch may replace,
+        // once, and only under the operator's `retryOnReset` grant. Native steering and injection
+        // are left out: their channel may already have sent continuation frames on this socket, so
+        // the create frame alone no longer describes the turn.
+        if (socketDied && !nativeControl) markCodexWsSocketDeath(failureResponse, stage);
         resolve(failureResponse);
         return;
       }
@@ -549,7 +555,9 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         resolve(sseFallback(url, init));
         return;
       }
-      if (sent && !terminal) failStream(closedBeforeTerminalMessage(event, failureStage()));
+      if (sent && !terminal) {
+        failStream(closedBeforeTerminalMessage(event, failureStage()), 502, { socketDied: true });
+      }
     };
 
     const onError = () => {
@@ -560,7 +568,10 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         cleanup();
         session.dispose();
         resolve(sseFallback(url, init));
-      } else failStream(`codex websocket transport error${codexWsFailureDetail(failureStage())}`);
+      } else {
+        const message = `codex websocket transport error${codexWsFailureDetail(failureStage())}`;
+        failStream(message, 502, { socketDied: true });
+      }
     };
     detachOwner = session.bindOwner(reason => cancelExchange(reason));
     ws.addEventListener("open", onOpen);

package/src/server/responses/codex-ws-wire.ts

@@ -214,10 +214,10 @@ export function classifyCodexWsFailure(stage: CodexWsFailureStage): CodexWsFailu
  * whose failures cannot be compared with anything else, which is the reported symptom -- every
  * such failure reached the user as one of two bare sentences.
  *
- * It does not relax the transport's own rule. The no-replay-after-send contract in
- * `codex-ws-exchange.ts` holds regardless of what this returns, and the stage below is
- * deliberately not consulted as a fallback-eligibility signal; it reports where the exchange got
- * to, and `resendPermission` happens to agree that everything past `before-send` is refused.
+ * It does not relax the transport's own rule. The stage below reports where the exchange got to,
+ * and `resendPermission` agrees that everything past `before-send` is refused. When a socket dies
+ * under the send, this stage is what the resend gate is asked with (#4191), so the operator's
+ * `retryOnReset` grant is the only way past that refusal, as it is for an HTTP reset.
  */
 export const CODEX_WS_FAILURE_PROJECTION = {
   /** The create frame never left, so the origin provably never saw this turn. */
@@ -236,6 +236,29 @@ export function projectCodexWsFailure(
   return CODEX_WS_FAILURE_PROJECTION[classifyCodexWsFailure(stage)];
 }
 
+const socketDeathStages = new WeakMap<Response, RequestFailureStage>();
+
+/**
+ * Record that a pre-response settle came from the socket closing or failing under the send (#4191),
+ * rather than from silence, a refused frame or a local limit.
+ *
+ * A fact about how the exchange ended, not a grant. The settle is the same non-replayable 502
+ * either way; whether the turn may go out once more is the resend gate's question, and only the
+ * operator's `retryOnReset` grant can answer it yes.
+ */
+export function markCodexWsSocketDeath(response: Response, stage: CodexWsFailureStage): void {
+  socketDeathStages.set(response, projectCodexWsFailure(stage).stage);
+}
+
+/**
+ * Where the send stood when its socket died: `pre-header` when nothing came back and
+ * `protocol-prelude` when frames arrived but none was a Responses event. Undefined for every other
+ * response.
+ */
+export function codexWsSocketDeathStage(response: Response): RequestFailureStage | undefined {
+  return socketDeathStages.get(response);
+}
+
 /**
  * Render the stage as a suffix appended to an existing failure message.
  *

package/src/server/responses/core-combo.ts

@@ -27,6 +27,7 @@ import {
   comboFailureCooldownScope,
 } from "../../combos";
 import { formatErrorResponse } from "../../bridge";
+import { SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
 import {
   expandPreviousResponseInput,
   previousResponseReplayFailure,
@@ -73,6 +74,7 @@ import {
 import { preflightComboStreamResponse } from "./combo-stream-preflight";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
 import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
+import { settleOperatorReplacement } from "../../lib/upstream-retry";
 
 /**
  * Sends one combo target may run on its own before the ladder moves on. A target is a whole
@@ -165,6 +167,7 @@ export function comboTargetSendBudget(
 }
 
 
+/** Dispatch a Responses combo within its shared send budget and preserve terminal child failures. */
 export async function executeComboResponses(
   req: Request,
   rawBody: unknown,
@@ -449,13 +452,17 @@ export async function executeComboResponses(
       countedExternally: true,
     });
     if (hopDecision && hopDecision.allowed) hopDecision.permit.use();
-    else if (hopDecision && !firstComboTarget) {
+    else if (hopDecision && firstComboTarget) {
+      // A refused initial reservation authorizes no child send and has no upstream failure to return.
+      return formatErrorResponse(429, SEND_BUDGET_EXHAUSTED_CODE, "request send budget exhausted before combo dispatch");
+    }
+    else if (hopDecision) {
       // Out of budget is not this target's failure. The established exhaustion contract is to
       // return the last real upstream answer with its status, headers and any quota body
       // intact rather than to mint a synthetic error, and a later target only exists because
       // an earlier one already recorded one.
       if (lastFailedChildLog) adoptFailedChildLog(lastFailedChildLog);
-      break;
+      return lastFailure!;
     }
     const targetSendBudget = comboSendScope
       ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
@@ -678,9 +685,20 @@ export async function executeComboResponses(
     attemptRetained = true;
     lastFailure = failure.response;
     lastFailedChildLog = childLog;
+    // A replacement that answers 200 is unmarked, and its zero-output failure only exists once
+    // preflight has rebuilt the stream as a fresh Response. A spent grant never hops: a status the
+    // client would resend becomes the refusal, and anything else reaches the client as it is.
+    const spentReplacement = !failure.nonReplayable && comboSendScope?.ambiguousResendSpent === true;
+    if (spentReplacement) {
+      const settled = settleOperatorReplacement(failure.response);
+      if (settled !== failure.response) {
+        adoptFailedChildLog(childLog);
+        return settled;
+      }
+    }
     // A non-replayable failure (the answer to a spent ambiguous-reset replacement) may follow a
     // send that already ran the turn, so no later target may receive it, whatever its status says.
-    const failureDecision = failure.nonReplayable
+    const failureDecision = failure.nonReplayable || spentReplacement
       ? "stop"
       : comboFailureDecision(failure.response.status, failure.classificationText, {
         code: failure.upstreamCode,

package/src/server/responses/core-normalize.ts

@@ -19,6 +19,7 @@ import { shouldPreparePlaintextV2AgentMessages } from "../../responses/plaintext
 import { hasValidatedActiveReasoningEffort } from "../../responses/parser";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { applyOpenAiVirtualModel } from "../../providers/openai-virtual-models";
+import { renameRoutedIdentityInContext } from "../../adapters/identity";
 import {
   fastPolicyForModel,
   serviceTierSupportFromPolicy,
@@ -137,6 +138,12 @@ export async function applyFinalRouteRequestNormalization(args: {
     }
     parsed.modelId = route.modelId;
   }
+  // #5221: the parser named the identity sentence from the CLIENT selector, because routing had
+  // not run when it read the body, and only the adapters that build their own system text rename
+  // it afterwards. Settle it on the id this request really sends, here where that id is final —
+  // every dispatch path (passthrough, runTurn, adapter request build) reads the context after
+  // this, and a combo child runs this for its own target.
+  parsed.context = renameRoutedIdentityInContext(parsed.context, route.modelId);
   // Transport-neutral reliability policy (#875): applies to any Responses
   // upstream whose final adapter is openai-responses, not only WS turns.
   const responsesUpstreamStreaming = route.staticPolicy.model.responsesUpstreamStreaming;

package/src/server/responses/core-opaque-recovery.ts

@@ -311,14 +311,15 @@ export function shouldAttemptOpaqueBlobRecovery(args: {
  * Peek the upstream error body for the reasoning-effort downgrade. Only 400/403 are considered
  * and the body must be complete and display-safe, the same contract the other rejection peeks
  * use. The match is deliberately narrow: the upstream has to name reasoning effort, so an
- * unrelated 400 never triggers a replay.
+ * unrelated 400 never triggers a replay. A non-replayable answer, such as one to a spent operator
+ * replacement, is never read: the first send may already have run the turn.
  */
 export async function reasoningEffortRejectionText(
   response: Response,
   alreadyAttempted: boolean,
   signal: AbortSignal,
 ): Promise<string | undefined> {
-  if (alreadyAttempted) return undefined;
+  if (alreadyAttempted || isNonReplayableResponse(response)) return undefined;
   if (response.status !== 400 && response.status !== 403) return undefined;
   try {
     const body = await readBoundedResponseBody(response.clone(), { signal });

package/src/server/responses/encrypted-payload.ts

@@ -198,21 +198,21 @@ function textWithoutFernetRuns(payload: string, runs: readonly FernetTokenRun[])
 /**
  * The routing header codex-rs writes above a delegated agent payload.
  *
- * `MESSAGE` is matched as well as `NEW_TASK`, and only for the unreadability CHECK --
- * recovery stays NEW_TASK-only. #3021 reported a subagent `MESSAGE` arriving in the
- * parent conversation as raw `gAAAA...` ciphertext after an `adapter_eof`. The detector
- * decides "unreadable" by stripping the envelope and asking whether any plaintext
- * survives, so an envelope shape it does not recognise counts as surviving text: a
- * `MESSAGE` whose entire body is one Fernet token measured as READABLE and was forwarded
- * verbatim.
+ * All four codex-rs message types are recognised: NEW_TASK, MESSAGE, FOLLOWUP_TASK,
+ * and FINAL_ANSWER, whose Task name line is optional. #3021 reported a subagent
+ * `MESSAGE` arriving in the parent conversation as raw `gAAAA...` ciphertext after an
+ * `adapter_eof`. The detector decides "unreadable" by stripping the envelope and asking
+ * whether any plaintext survives, so an envelope shape it does not recognise counts as
+ * surviving text: an unrecognised type whose entire body is one Fernet token measured as
+ * READABLE and would be forwarded verbatim.
  *
- * Widening the strip is not the same as widening recovery. Recovery decrypts, and
- * decrypting a `MESSAGE` on the parent's behalf would build a plaintext oracle out of a
- * payload the parent's session may have no right to read. This only lets the proxy
- * NOTICE that what it is about to forward is unreadable ciphertext, which is what the
- * report asks for: fail closed with a structured error rather than paste the token.
+ * This strip must therefore stay in step with the message types the opt-in recovery
+ * recognises (see agent-task-recovery.ts). The strip itself is still only detection: it
+ * lets the proxy notice that what it is about to forward is unreadable ciphertext and
+ * fail closed with a structured error rather than paste the token. Recovery admission,
+ * not the strip, is the trust boundary for decryption.
  */
-export const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*(?:NEW_TASK|MESSAGE)[^\n]*\nTask name\s*:[^\n]*\nSender\s*:[^\n]*\nPayload\s*:\s*(?:\n|$)/gi;
+export const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*(?:NEW_TASK|MESSAGE|FOLLOWUP_TASK)[^\n]*\n\s*Task name\s*:[^\n]*\n\s*Sender\s*:[^\n]*\n\s*Payload\s*:\s*(?:\n|$)|(?:^|\n)Message Type\s*:\s*FINAL_ANSWER[^\n]*\n\s*(?:Task name\s*:[^\n]*\n\s*)?Sender\s*:[^\n]*\n\s*Payload\s*:\s*(?:\n|$)/gi;
 
 // CXC is the compatibility-hook control namespace. Strip only the tagged paragraph:
 // later untagged paragraphs may be genuine task text. Repeated CXC paragraphs are
@@ -262,7 +262,8 @@ function splitFernetParts(content: unknown[]): Set<object> {
 export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
   if (!Array.isArray(input)) return false;
 
-  // codex-rs appends one NEW_TASK agent_message at the current input tail. Historical
+  // codex-rs appends one agent_message (any of the four codex-rs message types) at the
+  // current input tail. Historical
   // agent messages may be adjacent in full-history bodies; they must not poison the
   // later task. compaction_trigger/additional_tools are trailing metadata rather than
   // a newer user turn.

package/src/server/responses/fetch-helpers.ts

@@ -268,7 +268,7 @@ export function providerFetch(
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
   const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
-    const upstreamWebsocket = provider.upstreamWebsocket === true;
+    const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
       && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
       const egress = egressFor(input);