@bitkyc08/opencodex 2.64.0 → 2.65.0-preview.20260925

package/src/server/responses/input-admission.ts

@@ -20,7 +20,7 @@ import { getModelMetadata } from "../../generated/model-metadata";
 import { estimateTokens } from "../../lib/token-estimate";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { modelRecordValue } from "../../reasoning-effort";
-import type { OcxContentPart, OcxParsedRequest, OcxProviderConfig } from "../../types";
+import { modelInList, type OcxContentPart, type OcxParsedRequest, type OcxProviderConfig } from "../../types";
 
 /**
  * Multiplier applied to the ceiling before refusing.
@@ -112,10 +112,12 @@ function contentTokens(content: string | readonly OcxContentPart[], modelId: str
  * their content as `OcxAssistantContentPart[]` — text, thinking blocks, and tool calls whose
  * JSON arguments are frequently the largest single item in an agent conversation. A walk
  * that counted only `{type:"text"}` would undercount exactly the turns that trigger this
- * gate.
+ * gate. The routed provider determines whether replayed thinking reaches the wire.
  */
-export function estimateInputTokens(parsed: OcxParsedRequest, modelId: string): number {
+export function estimateInputTokens(parsed: OcxParsedRequest, modelId: string, provider?: OcxProviderConfig): number {
   const { context } = parsed;
+  const countThinking = provider?.adapter !== "openai-chat"
+    || modelInList(provider.preserveReasoningContentModels, parsed.modelId);
   let total = 0;
 
   for (const prompt of context.systemPrompt ?? []) total += estimateTokens(prompt, modelId);
@@ -124,7 +126,9 @@ export function estimateInputTokens(parsed: OcxParsedRequest, modelId: string):
     if (message.role === "assistant") {
       for (const part of message.content) {
         if (part.type === "text") total += estimateTokens(part.text, modelId);
-        else if (part.type === "thinking") total += estimateTokens(part.thinking, modelId);
+        else if (part.type === "thinking") {
+          if (countThinking) total += estimateTokens(part.thinking, modelId);
+        }
         else total += estimateTokens(part.name, modelId) + estimateTokens(JSON.stringify(part.arguments), modelId);
       }
       // Opaque provider blob replayed verbatim upstream, so it costs real input tokens.
@@ -296,7 +300,7 @@ export function checkComboTargetInputAdmission(
   const requiredOutputHeadroom = targetOutput === null
     ? requestedOutput
     : Math.min(requestedOutput, targetOutput);
-  const estimatedTokens = estimateInputTokens(parsed, modelId);
+  const estimatedTokens = estimateInputTokens(parsed, modelId, provider);
   return {
     admitted: estimatedTokens <= ceiling && estimatedTokens + requiredOutputHeadroom <= window,
     estimatedTokens,
@@ -319,6 +323,6 @@ export function checkInputAdmission(
 ): InputAdmissionResult {
   const ceiling = resolveInputCeiling(provider, providerName, modelId, nativeContextCap);
   if (ceiling === null) return { admitted: true, estimatedTokens: 0, ceiling: null };
-  const estimatedTokens = estimateInputTokens(parsed, modelId);
+  const estimatedTokens = estimateInputTokens(parsed, modelId, provider);
   return { admitted: estimatedTokens <= ceiling * ADMISSION_TOLERANCE, estimatedTokens, ceiling };
 }

package/src/server/responses/native-response-control.ts

@@ -31,9 +31,9 @@ export function markNativeControlResponse(response: Response): Response { native
 /** Recognize a marked native response by identity, not by caller-controlled content. */
 export function isNativeControlResponse(response: Response): boolean { return nativeControlResponses.has(response); }
 
-/** Preserve canonical ChatGPT eligibility; only injection may use the separately billed public API. */
+/** Canonical ChatGPT needs its upstream WS enabled; only injection may use the separately billed public API. */
 export function nativeResponseControlEligible(provider: OcxProviderConfig, control?: NativeResponseControl): boolean {
-  if (isCanonicalOpenAiForwardProvider(provider)) return true;
+  if (isCanonicalOpenAiForwardProvider(provider)) return provider.upstreamWebsocket !== false;
   return control?.kind === "injection" && provider.adapter === "openai-responses"
     && provider.upstreamWebsocket === true && provider.authMode !== "forward"
     && provider.baseUrl?.replace(/\/+$/, "") === "https://api.openai.com/v1";

package/src/server/responses/passthrough-delivery.ts

@@ -35,6 +35,7 @@ import { consumeComboFailure } from "./core-combo-failure";
 import { readDisplaySafeErrorText } from "./core-errors";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
 import { formatPassthroughUpstreamError } from "./passthrough-error";
+import { rewriteUpstreamPolicyRefusal } from "./policy-refusal";
 import {
   resolvePassthroughWebSearchBridgeAuth,
   planPassthroughWebSearchBridge,
@@ -84,6 +85,12 @@ import {
   createGrokResponsesTimestampBlockRewrite,
 } from "../grok-responses-control-frame";
 import { createGrokResponsesSparseTerminalBlockRewrite } from "../grok-responses-snapshot-repair";
+import { isXaiResponsesDestination } from "../../providers/xai-transport";
+import {
+  createGrokUpstreamEnvelopeEchoBlockRewrite,
+  responsesRequestMayReplayToolOutput,
+  stripGrokUpstreamEnvelopeEchoFromResponsesJson,
+} from "../grok-upstream-envelope-echo";
 import {
   createPlaintextV2AgentMessageCallRestoreRewrite,
   restorePlaintextV2AgentMessageCallsInJsonResult,
@@ -121,12 +128,145 @@ import { linkAbortSignal, UPSTREAM_JSON_BODY_READ_OPTIONS } from "./core-lifetim
 import { registerTurn, unregisterTurn, trackStreamLifetime } from "../lifecycle";
 import { relaySseEagerBounded } from "../relay-eager";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
+import { idleDeadline } from "../../lib/abort";
+import { resolveStallTimeoutSec } from "../../stall-timeout";
 import { formatErrorResponse } from "../../bridge";
 import { inspectResponseLogJson } from "../request-log";
 import { restoreRoutedCustomCallsInJson } from "../../responses/custom-tool-compat";
 import { restoreRoutedToolSearchCallsInJson } from "../../responses/tool-search-compat";
 import { responsesJsonToSseStream } from "../responses-json-events";
 
+const PLAINTEXT_V2_SSE_PREFIX_LIMIT = 4096;
+
+/** Prefix-probe budget: bounds one silent gap and the whole probe alike. */
+interface PlaintextV2SseProbeOptions {
+  timeoutMs: number;
+  signal?: AbortSignal;
+}
+
+function classifyPlaintextV2SsePrefix(prefix: string): "sse" | "unknown" | "more" {
+  const lastLineEnd = prefix.lastIndexOf("\n");
+  if (lastLineEnd < 0) return "more";
+  for (const rawLine of prefix.slice(0, lastLineEnd + 1).split("\n")) {
+    const line = rawLine.replace(/\r$/, "").trim();
+    if (!line || line.startsWith(":")) continue;
+    if (/^(id|retry):/.test(line)) continue;
+    if (line.startsWith("event:")) {
+      return /^event:\s*(?:response\.[\w.-]+|error)$/.test(line) ? "sse" : "unknown";
+    }
+    if (line.startsWith("data:")) {
+      try {
+        const value = JSON.parse(line.slice(5).trim()) as { type?: unknown };
+        return typeof value.type === "string" && /^(?:response\.[\w.-]+|error)$/.test(value.type)
+          ? "sse" : "unknown";
+      } catch {
+        return "unknown";
+      }
+    }
+    return "unknown";
+  }
+  return "more";
+}
+
+/**
+ * Confirm an unlabeled successful body is Responses SSE before alias restoration.
+ *
+ * The probe waits at most `timeoutMs` for a first recognized event, then hands the body to the
+ * client with no deadline of its own: a stall in the prefix is a probe failure, and a stall after
+ * it belongs to the delivered stream.
+ */
+async function classifyPlaintextV2SseResponse(
+  response: Response,
+  probe: PlaintextV2SseProbeOptions,
+): Promise<Response> {
+  if (!response.body) return response;
+  const reader = response.body.getReader();
+  // A non-conforming stream can throw synchronously from cancel(); neither that nor a
+  // rejected cancel may escape past the probe's own deadline.
+  const cancelReader = (reason?: unknown): void => {
+    try {
+      void reader.cancel(reason).catch(() => undefined);
+    } catch {
+      // Some stream implementations throw synchronously from cancel().
+    }
+  };
+  const unrecognized = (): Response => new Response(null, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+  const { timeoutMs, signal } = probe;
+  const stalled = new DOMException("Plaintext V2 SSE prefix probe stalled", "TimeoutError");
+  let rejectProbe: ((reason: unknown) => void) | undefined;
+  const failed = new Promise<never>((_resolve, reject) => { rejectProbe = reject; });
+  // The race below always observes this rejection; this covers a deadline that fires after the
+  // race already settled with a chunk, which would otherwise be an unhandled rejection.
+  void failed.catch(() => undefined);
+  const inactivity = idleDeadline(timeoutMs, () => rejectProbe?.(stalled));
+  // A drip-fed body can restart the inactivity window forever, so the probe also carries one
+  // total budget that starts when the probe begins.
+  const totalTimer = timeoutMs > 0 ? setTimeout(() => rejectProbe?.(stalled), timeoutMs) : undefined;
+  const onAbort = (): void => rejectProbe?.(signal?.reason);
+  signal?.addEventListener("abort", onAbort, { once: true });
+  if (signal?.aborted) onAbort();
+  const decoder = new TextDecoder();
+  const buffered: Uint8Array[] = [];
+  let prefix = "";
+  let inspectedBytes = 0;
+  try {
+    while (inspectedBytes < PLAINTEXT_V2_SSE_PREFIX_LIMIT) {
+      if (signal?.aborted) throw signal.reason;
+      // Armed for every read, so a chunk that arrives restarts the window at the next iteration.
+      inactivity.reset();
+      const read = reader.read();
+      // Observe a late read rejection when the deadline or the client wins the race.
+      void read.catch(() => undefined);
+      const next = await Promise.race([read, failed]);
+      if (signal?.aborted) throw signal.reason;
+      if (next.done) break;
+      buffered.push(next.value);
+      const inspected = next.value.subarray(0, PLAINTEXT_V2_SSE_PREFIX_LIMIT - inspectedBytes);
+      inspectedBytes += inspected.byteLength;
+      prefix += decoder.decode(inspected, { stream: true });
+      const kind = classifyPlaintextV2SsePrefix(prefix);
+      if (kind === "sse") {
+        let bufferedIndex = 0;
+        const body = new ReadableStream<Uint8Array>({
+          async pull(controller) {
+            if (bufferedIndex < buffered.length) {
+              controller.enqueue(buffered[bufferedIndex++]!);
+              return;
+            }
+            try {
+              const result = await reader.read();
+              if (result.done) controller.close();
+              else controller.enqueue(result.value);
+            } catch (error) {
+              controller.error(error);
+            }
+          },
+          cancel(reason) { return reader.cancel(reason); },
+        });
+        const headers = new Headers(response.headers);
+        headers.set("content-type", "text/event-stream");
+        return new Response(body, { status: response.status, statusText: response.statusText, headers });
+      }
+      if (kind === "unknown") break;
+    }
+  } catch (error) {
+    // Timeout, client abort, or a failed read fails closed through the unrecognized-body exit,
+    // which the caller already answers as the unsupported-content-type 502.
+    cancelReader(error);
+    return unrecognized();
+  } finally {
+    inactivity.cancel();
+    if (totalTimer !== undefined) clearTimeout(totalTimer);
+    signal?.removeEventListener("abort", onAbort);
+  }
+  cancelReader();
+  return unrecognized();
+}
+
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function deliverPassthroughResponse(
   requestContext: Pick<ResponsesRequestContext, "logCtx" | "config" | "options" | "req">,
@@ -180,7 +320,6 @@ export async function deliverPassthroughResponse(
 ): Promise<Response> {
   const { logCtx, config, options, req } = requestContext;
   const {
-    upstreamResponse,
     codexSafetyBufferingOptions,
     upstream,
     connectMs,
@@ -205,18 +344,29 @@ export async function deliverPassthroughResponse(
   const { openAiSidecar } = sidecarState;
   const { requestBindings } = transportState;
 
+  let upstreamResponse = nativeExchange.upstreamResponse;
+  const originalContentType = upstreamResponse.headers.get("content-type");
+  if (isUsageDebugEnabled() && originalContentType) logCtx.usageDebugContentType = originalContentType;
+  if (responseEffects.plaintextV2AgentMessageToolNames.size > 0
+    && upstreamResponse.ok && upstreamResponse.body && parsed.stream
+    && !originalContentType?.toLowerCase().includes("text/event-stream")
+    && !originalContentType?.toLowerCase().includes("application/json")
+    && !isCodexWsUpstreamResponse(upstreamResponse)
+    && !(options.nativeControl && isNativeControlResponse(upstreamResponse))) {
+    upstreamResponse = await classifyPlaintextV2SseResponse(upstreamResponse, {
+      timeoutMs: resolveStallTimeoutSec(config.stallTimeoutSec) * 1000,
+      signal: options.abortSignal ?? req.signal,
+    });
+  }
+
     const headers = sanitizePassthroughHeaders(upstreamResponse.headers, codexSafetyBufferingOptions);
     const resolvedModel = headers.get("openai-model")?.trim();
     if (resolvedModel) {
       logCtx.servedModel = resolvedModel;
       if (!logCtx.preserveResolvedModelFromRoute) logCtx.resolvedModel = resolvedModel;
     }
-    if (isUsageDebugEnabled()) {
-      const upstreamContentType = upstreamResponse.headers.get("content-type");
-      if (upstreamContentType) logCtx.usageDebugContentType = upstreamContentType;
-    }
-    // The chatgpt backend may omit Content-Type on SSE responses. Fall back to
-    // treating a successful body as SSE when the caller requested streaming.
+    // ChatGPT may omit Content-Type on SSE responses. Plaintext V2 responses
+    // reach this fallback only after their first Responses event is confirmed.
     const passthroughCt = headers.get("content-type")?.toLowerCase();
     const isEventStream = passthroughCt?.includes("text/event-stream")
       || (responseEffects.plaintextV2AgentMessageToolNames.size === 0 && upstreamResponse.ok && !!upstreamResponse.body && !passthroughCt && parsed.stream);
@@ -326,6 +476,16 @@ export async function deliverPassthroughResponse(
           ? streamingContextOverflowResponse(parsed._responseModelId ?? parsed.modelId, translatorBudget)
           : jsonContextOverflowResponse();
       }
+      const policyRefusal = rewriteUpstreamPolicyRefusal({
+        status: upstreamResponse.status,
+        errorText,
+        stream: clientRequestedStream,
+        modelId: parsed._responseModelId ?? parsed.modelId,
+        destinationIsXai: isXaiResponsesDestination(route.provider),
+        translatorBudget,
+        turnAdmissionLease: options.turnAdmissionLease,
+      });
+      if (policyRefusal) return policyRefusal;
       return formatPassthroughUpstreamError(upstreamResponse.status, errorText, {
         statusText: upstreamResponse.statusText,
         headers,
@@ -356,6 +516,8 @@ export async function deliverPassthroughResponse(
     // (src/server/relay-eager.ts; policy:
     // devlog/_fin/260731_macos_rss_retention/100_darwin_eager_optin.md).
     // The bundled known-bad runtime remains on tee by default on both platforms.
+    const grokUpstreamEchoEnabled = isXaiResponsesDestination(route.provider)
+      && responsesRequestMayReplayToolOutput(parsed._rawBody);
     if (isEventStream && upstreamResponse.body) {
       // For streamed passthrough, a successful terminal response means non-error upstream status
       // before relay starts. Waiting for SSE completion would retain request state across the whole
@@ -500,7 +662,7 @@ export async function deliverPassthroughResponse(
       // are not the Responses wire shapes the snapshot must mirror.
       // Only validated client blocks may publish plaintext continuation state.
       // Raw inspection precedes rewriting on eager relays, so it cannot own this write.
-      const plaintextInspector = responseEffects.plaintextV2AgentMessageToolNames.size > 0
+      const plaintextInspector = !grokUpstreamEchoEnabled && responseEffects.plaintextV2AgentMessageToolNames.size > 0
         ? createSseInspector({ onCompletedResponse: rememberPassthroughResponseChecked })
         : undefined;
       const plaintextEncoder = plaintextInspector ? new TextEncoder() : undefined;
@@ -571,6 +733,11 @@ export async function deliverPassthroughResponse(
             declaredBareWireToolNames,
           )
           : undefined,
+        grokUpstreamEchoEnabled
+          ? createGrokUpstreamEnvelopeEchoBlockRewrite(
+            rememberPassthroughResponse ? rememberPassthroughResponseChecked : undefined,
+          )
+          : undefined,
         rememberPlaintextBlock,
       ].filter((rewrite): rewrite is NonNullable<typeof rewrite> => rewrite !== undefined);
       const clientBlockRewrite = blockRewrites.length > 0
@@ -620,7 +787,7 @@ export async function deliverPassthroughResponse(
         const inspector = createSseInspector({
           onTerminal: reportNativeTerminal,
           logCtx,
-          onCompletedResponse: rememberPassthroughResponse && responseEffects.plaintextV2AgentMessageToolNames.size === 0 ? rememberPassthroughResponseChecked : undefined,
+          onCompletedResponse: rememberPassthroughResponse && !grokUpstreamEchoEnabled && responseEffects.plaintextV2AgentMessageToolNames.size === 0 ? rememberPassthroughResponseChecked : undefined,
           onParsedPayload: noteInspectedPayload,
           onFirstOutput: options.onFirstOutput,
           pinCompletedResponseIdToFirstSeen: githubCopilotRepairEnabled,
@@ -722,7 +889,7 @@ export async function deliverPassthroughResponse(
             responseEffects.responseCompletionCancelled = true;
             options.onNativePassthroughCancel?.();
           },
-          rememberPassthroughResponse && responseEffects.plaintextV2AgentMessageToolNames.size === 0 ? rememberPassthroughResponseChecked : undefined,
+          rememberPassthroughResponse && !grokUpstreamEchoEnabled && responseEffects.plaintextV2AgentMessageToolNames.size === 0 ? rememberPassthroughResponseChecked : undefined,
           options.onFirstOutput,
           inspectionConsumerOptions,
         );
@@ -732,7 +899,7 @@ export async function deliverPassthroughResponse(
           logCtx,
           turnAc.signal,
           () => unregisterTurn(turnAc),
-          rememberPassthroughResponse && responseEffects.plaintextV2AgentMessageToolNames.size === 0 ? rememberPassthroughResponseChecked : undefined,
+          rememberPassthroughResponse && !grokUpstreamEchoEnabled && responseEffects.plaintextV2AgentMessageToolNames.size === 0 ? rememberPassthroughResponseChecked : undefined,
           options.onFirstOutput,
           inspectionConsumerOptions,
         );
@@ -814,6 +981,9 @@ export async function deliverPassthroughResponse(
       if (plaintextV2RestoreFailed) {
         return formatErrorResponse(502, "upstream_error", PLAINTEXT_V2_AGENT_MESSAGE_RESTORE_OVERFLOW_MESSAGE);
       }
+      if (grokUpstreamEchoEnabled) {
+        clientJson = stripGrokUpstreamEnvelopeEchoFromResponsesJson(clientJson);
+      }
       // #1700: same fail-closed policy as the SSE relay above. Both the plain JSON answer and
       // the reframed-SSE branch below are built from this body, so one check covers them. This
       // runs BEFORE the continuation cache write below: a refused turn must not become state a
@@ -844,7 +1014,7 @@ export async function deliverPassthroughResponse(
       commitReasoningReplayServingRoute(nativeExchange.request.headers);
       try {
         rememberPassthroughResponseChecked(
-          JSON.parse(text) as { id?: unknown; output?: unknown; status?: unknown; model?: unknown },
+          JSON.parse(grokUpstreamEchoEnabled ? clientJson : text) as { id?: unknown; output?: unknown; status?: unknown; model?: unknown },
         );
       } catch { /* non-JSON despite content-type; recording is best-effort */ }
       // #875: the transport-neutral reliability policy forced a bounded JSON

package/src/server/responses/passthrough-dispatch.ts

@@ -102,7 +102,7 @@ import {
   clearCodexModelDenialEvidence,
   recordCodexModelDenialEvidence,
 } from "../../codex/model-entitlements";
-import { isCodexWsUpstreamResponse, readCodexWsStage } from "./codex-ws-wire";
+import { codexWsSocketDeathStage, isCodexWsUpstreamResponse, readCodexWsStage } from "./codex-ws-wire";
 import { linkAbortSignal } from "./core-lifetime";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import { checkOutboundBodySize, describeOutboundBodyRefusal } from "./outbound-body-guard";
@@ -112,7 +112,10 @@ import {
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
   isNonReplayableResponse,
+  isConnectionResetError,
+  settleOperatorReplacement,
   refetchAfterProtocolSafeReset,
+  replayRefusalResponse,
   prepareSameTarget429Wait,
   sleepWithAbort,
 } from "../../lib/upstream-retry";
@@ -212,6 +215,7 @@ export async function preparePassthroughExchange(
     | "recoveryClassFor"
     | "sendBudgetExhausted"
     | "claimAmbiguousResend"
+    | "ambiguousResendSpent"
     | "reserveCredentialHop"
     | "pendingHopPermit"
     | "workflowRootId"
@@ -751,6 +755,57 @@ export async function preparePassthroughExchange(
      */
     const claimPreHeaderResend = (): boolean =>
       authorizeResendForRecovery("pre-header", "connection-reset", ambiguousResend()).allowed;
+    /**
+     * The one replacement send the ambiguous rows at the end of the recovery loop may buy: an SSE
+     * body that died before any output, and a Codex WebSocket that died under its create frame
+     * (#4191).
+     *
+     * HTTP-only for both. A replacement HTTP body must not open a fresh WebSocket exchange: the SSE
+     * row replaces an HTTP stream, which a WS create frame is not, and the WebSocket row replaces
+     * the transport that just failed.
+     */
+    const sendAmbiguousReplacement = (
+      signal: AbortSignal = upstream.signal,
+    ): Promise<Response> => fetchWithHeaderTimeout(
+      request.url,
+      applyUpstreamRecoveryInit({
+        method: request.method,
+        headers: request.headers,
+        body: request.body,
+      }, "connection-reset"),
+      signal,
+      connectMs,
+      true,
+      providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+        httpOnly: true,
+        providerName: route.providerName,
+        modelId: route.modelId,
+        dispatchOverride: oauthDispatch(request),
+        beforeDispatch: headers => {
+          if (signal.aborted) throw signal.reason;
+          if (!transportState.selectionIsCurrent(transportState.requestBindings.get(request))) {
+            throw new Error("Credential selection changed before pre-output stream recovery");
+          }
+          if (isCanonicalOpenAiForwardProvider(route.provider)) {
+            createCodexReserveDispatchGuard(
+              admissionState.authCtx,
+              options.codexAuthPolicy ?? config,
+              route.modelId,
+              options.admission,
+              options.visionDescribeTerminal === true,
+            )?.(headers);
+          }
+          // Recorded with the kind the gate derived its cause from, at the moment the
+          // send actually leaves. One authorisation, one recorded reason, one send.
+          transportState.noteRoutedAttemptSend(passthroughEstimate, "connection-reset");
+          // Charged to the SAME request counter every other send goes through. The
+          // replacement is bought here rather than by a nested retry helper, so there is
+          // one charge for one send and no per-layer counter to reconcile.
+          noteTransientSends(1);
+        },
+      }),
+      route.provider.authMode === "forward",
+    );
     /**
      * Refuse a built body that exceeds the operator's configured ceiling, before it is sent.
      *
@@ -1554,7 +1609,8 @@ export async function preparePassthroughExchange(
       if (options.abortSignal?.aborted) return transportFailureResponse(options.abortSignal.reason);
       upstreamResponse = preflight.response;
       if (preflight.kind === "failed") {
-        if (!configuredTransientSendBudgetExhausted()) {
+        // A zero-output failure does not undo an ambiguous replacement already sent.
+        if (!configuredTransientSendBudgetExhausted() && !sendBudgetState.ambiguousResendSpent) {
           const streamedOpaqueRecovery = await attemptOpaqueBlobRecovery({
             response: upstreamResponse,
             outboundBody: request.body,
@@ -1574,6 +1630,8 @@ export async function preparePassthroughExchange(
         logCtx.terminalHttpStatus = preflightLog.terminalHttpStatus;
         logCtx.terminalErrorCode = preflightLog.terminalErrorCode;
         logCtx.terminalIncompleteReason = preflightLog.terminalIncompleteReason;
+        // The projected failure must not invite another send after the replacement was spent.
+        if (sendBudgetState.ambiguousResendSpent) upstreamResponse = settleOperatorReplacement(upstreamResponse);
       }
     }
     // Console Go (opencode-zen / opencode-go) intermittently rejects a body it accepts seconds
@@ -1637,6 +1695,47 @@ export async function preparePassthroughExchange(
       }
     }
 
+    // The WebSocket row of the same table (#4191). A Codex socket that closed or failed under its
+    // create frame, before any Responses event, settled as a non-replayable 502 and every leg above
+    // let it through. Whether the turn ran upstream is as unknown as after a reset before the head,
+    // so the same grant decides, asked with the stage the exchange reached. The replacement's answer
+    // then goes round the loop like any other, and once the grant is spent nothing may send the
+    // turn a third time.
+    const socketDeathStage = codexWsSocketDeathStage(upstreamResponse);
+    if (
+      socketDeathStage
+      && !upstream.signal.aborted
+      // Asked before the gate, which claims last: a replacement the budget cannot fund must not
+      // spend the request's one grant.
+      && remainingTransientSendBudget(transientSendAttempts()) > 0
+      && authorizeResendForRecovery(socketDeathStage, "connection-reset", ambiguousResend()).allowed
+    ) {
+      try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+      console.warn(`[upstream-retry] codex websocket died before any Responses event (${safeHostLabel(request.url)}); `
+        + "using one replacement over HTTP");
+      let replacement: Response | undefined;
+      while (!replacement) {
+        try {
+          replacement = await sendAmbiguousReplacement().then(adoptObservedResponse);
+        } catch (err) {
+          if (upstream.signal.aborted) return transportFailureResponse(err);
+          // A replacement that reset before its head is the pre-header row again: a configured
+          // second grant (and a send the budget can still fund) may buy one more send. The gate
+          // claims from the request's finite allowance, so this loop is bounded by it.
+          if (
+            isConnectionResetError(err)
+            && remainingTransientSendBudget(transientSendAttempts()) > 0
+            && claimPreHeaderResend()
+          ) continue;
+          break;
+        }
+      }
+      // The first send may already have run the turn, so a replacement that failed settles as
+      // the refusal rather than as a transport error the client would retry.
+      upstreamResponse = replacement ? settleOperatorReplacement(replacement) : replayRefusalResponse();
+      continue passthroughRecovery;
+    }
+
     // The post-header row of the same table. A native SSE body can die after the head with the
     // caller having observed nothing, which is the identical question the pre-header helper
     // answers -- and the identical grant, because both claim from this request's one allowance.
@@ -1660,48 +1759,7 @@ export async function preparePassthroughExchange(
         upstreamResponse,
         { model: logCtx.model, provider: logCtx.provider },
         (error, stage) => refetchAfterProtocolSafeReset(
-          (signal = upstream.signal) => fetchWithHeaderTimeout(
-            request.url,
-            applyUpstreamRecoveryInit({
-              method: request.method,
-              headers: request.headers,
-              body: request.body,
-            }, "connection-reset"),
-            signal,
-            connectMs,
-            true,
-            providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              // A replacement HTTP body must not open a fresh WebSocket exchange: the turn it
-              // replaces was an HTTP stream, and a WS create frame is a different send.
-              httpOnly: true,
-              providerName: route.providerName,
-              modelId: route.modelId,
-              dispatchOverride: oauthDispatch(request),
-              beforeDispatch: headers => {
-                if (signal.aborted) throw signal.reason;
-                if (!transportState.selectionIsCurrent(transportState.requestBindings.get(request))) {
-                  throw new Error("Credential selection changed before pre-output stream recovery");
-                }
-                if (isCanonicalOpenAiForwardProvider(route.provider)) {
-                  createCodexReserveDispatchGuard(
-                    admissionState.authCtx,
-                    options.codexAuthPolicy ?? config,
-                    route.modelId,
-                    options.admission,
-                    options.visionDescribeTerminal === true,
-                  )?.(headers);
-                }
-                // Recorded with the kind the gate derived its cause from, at the moment the
-                // send actually leaves. One authorisation, one recorded reason, one send.
-                transportState.noteRoutedAttemptSend(passthroughEstimate, "connection-reset");
-                // Charged to the SAME request counter every other send goes through. The
-                // replacement is bought here rather than by a nested retry helper, so there is
-                // one charge for one send and no per-layer counter to reconcile.
-                noteTransientSends(1);
-              },
-            }),
-            route.provider.authMode === "forward",
-          ).then(adoptObservedResponse),
+          (signal = upstream.signal) => sendAmbiguousReplacement(signal).then(adoptObservedResponse),
           error,
           {
             abortSignal: upstream.signal,

package/src/server/responses/policy-fallback.ts

@@ -1,5 +1,6 @@
 import { comboFailureDecision } from "../../combos/failover";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
+import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import { finishRequestAttempt, type RequestLogContext } from "../request-log";
 import { linkRequestSessionLane } from "../request-log-conversation";
 import type { OcxConfig } from "../../types";
@@ -84,6 +85,8 @@ function errorCodeFromText(text: string): string | undefined {
 
 async function shouldHopPolicyCandidate(response: Response, signal?: AbortSignal): Promise<boolean> {
   if (response.status < 400 || signal?.aborted) return false;
+  // A response that must not be sent again cannot open a policy-candidate retry either.
+  if (isNonReplayableResponse(response)) return false;
   try {
     const inspected = await readBoundedResponseBody(response.clone(), { signal });
     const text = inspected.displaySafe ? inspected.text : "";

package/src/server/responses/policy-refusal.ts

@@ -0,0 +1,67 @@
+import { bridgeToResponsesSSE, buildResponseJSON } from "../../bridge";
+import type { AdmissionLease } from "../../lib/admission";
+import type { TranslatorBudget } from "../../lib/translator-budget";
+import type { AdapterEvent } from "../../types";
+import { extractPolicyRefusalText, isUpstreamPolicyRefusal } from "../../lib/errors";
+import { trackStreamLifetime } from "../lifecycle";
+
+async function* policyRefusalEvents(message: string): AsyncGenerator<AdapterEvent> {
+  yield { type: "text_delta", text: message };
+  yield { type: "done", stopReason: "content_filter" };
+}
+
+/**
+ * Turn an xAI-style HTTP 403 model refusal into a Codex-facing Responses
+ * incomplete/content_filter payload. Returned from `prepareAdapterExchange`
+ * and native openai-responses passthrough (the grok-4.6 OAuth wire), like
+ * the 413 overflow helpers. Combo hops still see the original 403.
+ *
+ * The streamed form is a delivered turn, so it carries the turn admission lease
+ * the way every other streaming return does: the lease is released when the body
+ * finishes or the client disconnects, not when the handler returns.
+ *
+ * Only an xAI destination is rewritten. Another provider's 403 may carry the same
+ * sentence for an unrelated reason, and turning it into a successful turn would hide it.
+ */
+export function rewriteUpstreamPolicyRefusal(args: {
+  status: number;
+  errorText: string;
+  stream: boolean;
+  modelId: string;
+  /** `isXaiResponsesDestination(route.provider)`: api.x.ai or the Grok CLI proxy. */
+  destinationIsXai: boolean;
+  translatorBudget: TranslatorBudget;
+  turnAdmissionLease?: AdmissionLease;
+}): Response | null {
+  if (!args.destinationIsXai || !isUpstreamPolicyRefusal(args.status, args.errorText)) return null;
+  const message = extractPolicyRefusalText(args.errorText);
+  if (!args.stream) {
+    const json = buildResponseJSON(
+      [
+        { type: "text_delta", text: message },
+        { type: "done", stopReason: "content_filter" },
+      ],
+      args.modelId,
+      { translatorBudget: args.translatorBudget },
+    );
+    return Response.json(json, { status: 200, headers: { "Cache-Control": "no-store" } });
+  }
+  const sse = bridgeToResponsesSSE(
+    policyRefusalEvents(message),
+    args.modelId,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    2_000,
+    { translatorBudget: args.translatorBudget },
+  );
+  return new Response(trackStreamLifetime(sse, new AbortController(), undefined, args.turnAdmissionLease), {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no",
+    },
+  });
+}