@bitkyc08/opencodex 2.65.0 → 2.66.0

package/src/server/chat-native.ts

@@ -1,6 +1,6 @@
 import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
-import { chatBodyCarriesImage, chatBodyCarriesToolResultImage } from "../chat/image-parts";
 import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
+import { isNativeChatRouteEligible } from "./chat-native-eligibility";
 import {
   chatCompletionsErrorBody,
   chatCompletionsErrorResponse,
@@ -15,12 +15,13 @@ import {
   CYBER_POLICY_ERROR_CODE,
   isCyberPolicyCode,
   isCyberPolicyMessage,
+  SEND_BUDGET_EXHAUSTED_CODE,
 } from "../lib/errors";
+import type { RequestExecutionBudget } from "../lib/request-execution-budget";
 import type { AdmissionLease } from "../lib/admission";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
-import { isModelTextOnly, requiresVisionPreprocessing } from "../vision";
 import {
   applyUpstreamRecoveryInit,
   fetchWithResetRetry,
@@ -32,6 +33,8 @@ import {
   REPLAY_REFUSAL_CLIENT_HEADERS,
   REPLAY_REFUSED_STATUS,
   retainReplayRefusal,
+  SendBudgetExhaustedError,
+  TRANSIENT_RETRY_MAX_ATTEMPTS,
   UpstreamRetryEvidenceError,
   type UpstreamSendRecovery,
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
@@ -58,20 +61,23 @@ import type { OcxConfig, OcxProviderConfig } from "../types";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { linkAbortSignal } from "./responses";
 import {
-  addFinalRequestLog,
-  beginRequestAttempt,
   noteProviderAttemptSend,
   recordKeyAttemptFailure,
   recordKeyWireAttemptUsage,
   recordFirstOutput,
   recordAttemptCredentialSource,
-  sealRequestAttemptIdentity,
   type RequestLogContext,
 } from "./request-log";
 import { jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
+import { beginInferenceAttempt, type InferenceAttempt } from "./inference/attempt";
+import { createFinalRequestLog } from "./inference/final-log";
 import { registerTurn, unregisterTurn } from "./lifecycle";
 import { attachRequestSpendTracker } from "./responses/request-spend";
 import { workflowRefusalResponse } from "./workflow-refusal";
+import type { ComboProtocolSource } from "./responses/core-combo-native";
+import type { ProtocolEnvelope } from "../protocols/envelope";
+
+export { isNativeChatRouteEligible, nativeChatDeclineReason } from "./chat-native-eligibility";
 
 type Rec = Record<string, unknown>;
 
@@ -154,50 +160,12 @@ function isRec(value: unknown): value is Rec {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
-export function isNativeChatRouteEligible(route: RouteResult, rawBody: Rec, config?: OcxConfig): boolean {
-  const provider = route.provider;
-  if (provider.adapter !== "openai-chat") return false;
-  if (provider.authMode !== undefined && provider.authMode !== "key" && provider.authMode !== "local") return false;
-  // Combo and policy execution own multi-candidate retries in the Responses pipeline.
-  if (route.combo || route.routeKind === "combo" || route.routeKind === "policy") return false;
-  if (rawBody.store === true || rawBody.background === true) return false;
-  if (typeof rawBody.previous_response_id === "string" && rawBody.previous_response_id.length > 0) return false;
-  if (rawBody.compaction_trigger !== undefined) return false;
-  // A standard Chat tool message accepts a string or text parts, not image_url, so
-  // normalizing a Pi/Anthropic tool image into image_url is not enough on its own —
-  // the part is still inside a tool message. The translated adapter already places
-  // tool-result images in a following user carrier after the complete paired batch
-  // (flushToolResultImages), so divert these requests there. Ordinary user images and
-  // text-only tool results keep the native fast path.
-  if (chatBodyCarriesToolResultImage(rawBody)) return false;
-  // Vision sidecar coverage (roadmap 180): a text-only routed model with an
-  // image-bearing body must go through the Responses pipeline, whose plan
-  // site describes or strips the image. The native fast path has no vision
-  // handling, so letting it keep such a request forwards raw pixels to a
-  // model the operator declared blind.
-  if (chatBodyCarriesImage(rawBody)) {
-    const needsVision = config
-      ? requiresVisionPreprocessing(config, provider, route.modelId, route.providerName)
-      : isModelTextOnly(provider, route.modelId);
-    if (needsVision) return false;
-  }
-  if (Array.isArray(rawBody.tools)) {
-    for (const tool of rawBody.tools) {
-      if (!isRec(tool)) continue;
-      if (tool.type === "web_search" || tool.type === "web_search_preview" || tool.type === "image_generation") {
-        return false;
-      }
-    }
-  }
-  return true;
-}
-
 function chatCompletionJson(value: unknown): Rec | null {
   if (!isRec(value) || !Array.isArray(value.choices) || value.choices.length === 0) return null;
   return value;
 }
 
-interface HandleNativeChatOptions {
+export interface HandleNativeChatOptions {
   req: Request;
   config: OcxConfig;
   logCtx: RequestLogContext;
@@ -209,36 +177,108 @@ interface HandleNativeChatOptions {
   translatorBudget: TranslatorBudget;
 }
 
+/** Records the outcome on whichever final row owns this attempt; the first call wins. */
+export type NativeChatFinishLog = (
+  status: number,
+  message?: string,
+  closeReason?: "non_stream" | "terminal" | "client_cancel",
+) => void;
+
+export interface NativeChatExecution extends HandleNativeChatOptions {
+  finishLog: NativeChatFinishLog;
+  /**
+   * A combo child's per-target budget (PF-07). With it the attempt opens no spend tracker of its
+   * own: the combo's hop reservation already booked the first send on the request's shared
+   * counter, and every later physical send is reported to that counter, whose observer is the
+   * request's one spend tracker. A second tracker would book each send twice and, merged into
+   * the parent row, replace the one the final log settles.
+   */
+  sendBudget?: RequestExecutionBudget;
+  /** Replaces the request-relative first-output mark; a combo child records its own. */
+  onFirstOutput?: () => void;
+  /** The lease a streamed body holds; defaults to `logIds.turnAdmissionLease`. */
+  turnAdmissionLease?: AdmissionLease;
+}
+
+/**
+ * The native Chat ingress: opens the attempt on the request's log context and owns the
+ * request's final log row, then runs the attempt.
+ */
 export async function handleNativeChatCompletions(options: HandleNativeChatOptions): Promise<Response> {
-  const { req, config, logCtx, logIds, route, requestedModel, requestedStream, translatorBudget } = options;
+  const { logCtx, logIds, route } = options;
   logCtx.inboundProtocol = "chat";
-  const attempt = beginRequestAttempt(
-    (logCtx.attempts?.length ?? 0) + 1,
-    route.providerName,
-    route.modelId,
-    "openai-chat",
-  );
-  logCtx.activeAttempt = attempt;
-  logCtx.activeAttemptStartedAt = Date.now();
-  (logCtx.attempts ??= []).push(attempt);
-  sealRequestAttemptIdentity(attempt, route.providerName, "openai-chat", logCtx.accountLogLabel);
+  const attemptHandle = beginInferenceAttempt(logCtx, {
+    provider: route.providerName,
+    model: route.modelId,
+    adapter: "openai-chat",
+  });
+  attemptHandle.seal(logCtx.accountLogLabel);
 
-  let logged = false;
-  const finishLog = (status: number, message?: string, closeReason: "non_stream" | "terminal" | "client_cancel" = "non_stream") => {
-    if (logged) return;
-    logged = true;
+  const finalLog = createFinalRequestLog(logIds, logCtx);
+  const finishLog: NativeChatFinishLog = (status, message, closeReason = "non_stream") => {
+    if (finalLog.finished()) return;
+    // The failure text lands on the context before the row is written, and only once.
     if (message) logCtx.upstreamError = redactSecretString(message).slice(0, 500);
-    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason });
+    finalLog.finish(status, { closeReason });
   };
+  return runNativeChatAttempt({ ...options, finishLog }, attemptHandle);
+}
+
+/**
+ * The Chat source a combo hands its native children (PF-07). A child runs on the attempt the
+ * combo opened and reports through the combo's callbacks, so the final row stays the parent's.
+ */
+export function createNativeChatComboSource(input: {
+  req: Request;
+  config: OcxConfig;
+  envelope: ProtocolEnvelope;
+  requestedModel: string;
+  requestedStream: boolean;
+  translatorBudget: TranslatorBudget;
+}): ComboProtocolSource {
+  return {
+    inbound: "chat",
+    envelope: input.envelope,
+    dispatchNativeChild: child => runNativeChatAttempt({
+      req: input.req,
+      config: input.config,
+      logCtx: child.childLog,
+      route: child.route,
+      chatBody: child.body,
+      requestedModel: input.requestedModel,
+      requestedStream: input.requestedStream,
+      translatorBudget: input.translatorBudget,
+      finishLog: child.finishLog,
+      sendBudget: child.sendBudget,
+      onFirstOutput: child.onFirstOutput,
+      ...(child.turnAdmissionLease ? { turnAdmissionLease: child.turnAdmissionLease } : {}),
+    }, child.attemptHandle),
+  };
+}
+
+/**
+ * One native Chat attempt on an already-open attempt row: effort normalization, the send
+ * loop with key failover and 429 replay, relay and usage. Every outcome is reported through
+ * `execution.finishLog`, so the caller decides which final row it lands on.
+ */
+export async function runNativeChatAttempt(
+  execution: NativeChatExecution,
+  attemptHandle: InferenceAttempt,
+): Promise<Response> {
+  const { req, config, logCtx, logIds, route, requestedModel, requestedStream, translatorBudget, finishLog } = execution;
+  const { sendBudget } = execution;
+  const { attempt } = attemptHandle;
+  const onFirstOutput = execution.onFirstOutput
+    ?? (logIds ? () => recordFirstOutput(logCtx, logIds.start) : undefined);
   const fail = (status: number, message: string, type?: string, code?: string | null): Response => {
     const safeMessage = redactSecretString(message);
     finishLog(status, safeMessage);
     return chatCompletionsErrorResponse(status, safeMessage, type, code);
   };
 
-  normalizePinnedChatEffort(options);
-  logCtx.requestedServiceTier = typeof options.chatBody.service_tier === "string"
-    ? options.chatBody.service_tier
+  normalizePinnedChatEffort(execution);
+  logCtx.requestedServiceTier = typeof execution.chatBody.service_tier === "string"
+    ? execution.chatBody.service_tier
     : undefined;
 
   const upstream = new AbortController();
@@ -248,7 +288,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
   // of adding another trackStreamLifetime wrapper (unsafe on bundled Bun#32111).
   let streamTurnRegistered = false;
   const transferTurnToStream = () => {
-    const lease = logIds?.turnAdmissionLease;
+    const lease = execution.turnAdmissionLease ?? logIds?.turnAdmissionLease;
     if (!lease || typeof (lease as { bindAbortController?: unknown }).bindAbortController !== "function") return;
     registerTurn(upstream, lease);
     streamTurnRegistered = true;
@@ -269,7 +309,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
   if (proactiveKeyProvider) route.provider = proactiveKeyProvider;
   let activeProvider: OcxProviderConfig = route.provider;
   stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
-  const spendTracker = attachRequestSpendTracker(req, logCtx);
+  const spendTracker = sendBudget ? undefined : attachRequestSpendTracker(req, logCtx);
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
   let activeRequest: AdapterRequest;
   let retainedRequestBytes = 0;
@@ -287,7 +327,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     recordAttemptCredentialSource(attempt, route.providerName, activeProvider, activeAdapter.name);
     return buildOpenAIChatPassthroughRequest(
       activeProvider,
-      options.chatBody,
+      execution.chatBody,
       route.modelId,
       requestedStream,
       fastPolicyForModel(activeProvider, route.modelId, route.providerName, "chat"),
@@ -311,9 +351,21 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
   // key rotation so recovery cannot replace the ceiling along with the active credential.
   const requestTransientPolicy = transientRetryPolicyFor(activeProvider);
   let transientSendsUsed = 0;
-  const remainingTransientSends = (): number => requestTransientPolicy
-    ? Math.max(0, requestTransientPolicy.attempts - transientSendsUsed)
-    : Number.POSITIVE_INFINITY;
+  // A combo child also answers to the request's shared base allowance, at the cap its own ladder
+  // uses. Its first send is exempt: the combo reserved it before dispatching this target.
+  const sharedSendCap = requestTransientPolicy?.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS;
+  let physicalSends = 0;
+  const remainingSharedSends = (): number => {
+    if (!sendBudget) return Number.POSITIVE_INFINITY;
+    const remaining = sendBudget.remainingBaseSends(sharedSendCap);
+    return physicalSends === 0 ? Math.max(1, remaining) : remaining;
+  };
+  const remainingTransientSends = (): number => Math.min(
+    requestTransientPolicy
+      ? Math.max(0, requestTransientPolicy.attempts - transientSendsUsed)
+      : Number.POSITIVE_INFINITY,
+    remainingSharedSends(),
+  );
   const transientSendAvailable = (): boolean => remainingTransientSends() > 0;
 
   const send = async (request: AdapterRequest, recovery?: "rate-limit-429" | "key-429"): Promise<Response> => {
@@ -321,6 +373,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       // #2643: opted-in key-auth openai-chat providers retry pre-stream transient statuses on
       // the native chat lane too; everyone else keeps reset-only semantics.
       const remaining = remainingTransientSends();
+      if (sendBudget && remaining <= 0) throw new SendBudgetExhaustedError(safeHostLabel(request.url));
       if (requestTransientPolicy && remaining <= 0) {
         throw new Error("native Chat transient send budget exhausted before recovery dispatch");
       }
@@ -343,7 +396,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
               dispatchOverride: async (_input, init, execute) => {
                 if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
                   const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
-                  if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, options.chatBody, config)) {
+                  if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, execution.chatBody, config)) {
                     throw new Error("Provider key selection is no longer available for native Chat");
                   }
                   activeProvider = current;
@@ -362,7 +415,15 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                 const encoding = new Headers(init.headers).get("accept-encoding");
                 if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
                 if (init.signal?.aborted) throw init.signal.reason;
-                if (!spendTracker.charge()) throw new NativeChatSpendRefusal();
+                if (sendBudget) {
+                  // Backstop for sends the helper cannot see coming (a reset replay). The first
+                  // report settles the combo's booking; each later one is charged and booked.
+                  if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
+                    throw new SendBudgetExhaustedError(safeHostLabel(request.url));
+                  }
+                  physicalSends += 1;
+                  sendBudget.used += 1;
+                } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
                 noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
                 // A reselected provider transport is still a physical send: the connection policy
                 // and manual-redirect ownership wrap the selected implementation (#4992).
@@ -433,7 +494,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
         now: Date.now(),
         attemptedKey: activeProvider.apiKey,
         attemptedSelection: activeProvider._apiKeyAttempt,
-        promptCacheKey: typeof options.chatBody.prompt_cache_key === "string" ? options.chatBody.prompt_cache_key : undefined,
+        promptCacheKey: typeof execution.chatBody.prompt_cache_key === "string" ? execution.chatBody.prompt_cache_key : undefined,
       });
       if (!rotated) break;
       // Rotation also records the failed key's cooldown and persists the next healthy key.
@@ -455,6 +516,10 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     upstream.abort();
     if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
     const sendError = error instanceof UpstreamRetryEvidenceError ? error.cause : error;
+    if (sendBudget && sendError instanceof SendBudgetExhaustedError) {
+      // A decision this process made, answered as the Responses path answers it: 429, not 502.
+      return fail(429, sendError.message, SEND_BUDGET_EXHAUSTED_CODE, SEND_BUDGET_EXHAUSTED_CODE);
+    }
     if (sendError instanceof NativeChatSpendRefusal) {
       const refusal = workflowRefusalResponse("workflow-spend-exhausted", logCtx);
       finishLog(429);
@@ -569,7 +634,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       translatorBudget,
       signal: upstream.signal,
       stallTimeoutSec: config.stallTimeoutSec,
-      onFirstOutput: logIds ? () => recordFirstOutput(logCtx, logIds.start) : undefined,
+      onFirstOutput,
       onUsage: usage => {
         if (!recordKeyWireAttemptUsage(logCtx, usage)) {
           logCtx.usage = usage;
@@ -669,7 +734,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       attempt.usage = usage;
     }
   }
-  if (logIds) recordFirstOutput(logCtx, logIds.start);
+  onFirstOutput?.();
   try {
     const serialized = requestedStream
       ? jsonCompletionSse(completion, requestedModel, translatorBudget)

package/src/server/claude-messages.ts

@@ -18,7 +18,8 @@ import { sseFieldValue } from "../lib/sse-decoder";
 import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
 import { createToolCallIdAllocator } from "../adapters/tool-call-id";
-import { AnthropicRequestError, DesktopModelMappingUnavailableError, anthropicToResponsesTranslation, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
+import { messagesToResponsesTranslation } from "../protocols/codecs/messages";
+import { AnthropicRequestError, DesktopModelMappingUnavailableError, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
 import { isKnownDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
 import { resolveAlias, claudeCodeNativeAlias, legacyAliasForNative } from "../claude/alias";
 import { recordDesktopRequest } from "../claude/desktop-health";
@@ -49,7 +50,8 @@ import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "./request-decompress";
-import { addFinalRequestLog, httpStatusForRequestLogTerminal, recordFirstOutput, type RequestLogContext, type RequestLogEntry } from "./request-log";
+import { addFinalRequestLog, httpStatusForRequestLogTerminal, recordFirstOutput, type RequestLogContext } from "./request-log";
+import { createFinalRequestLog } from "./inference/final-log";
 import {
   conversationIdFromClaudeMetadata,
   getOrAllocateRequestSessionLane,
@@ -58,7 +60,21 @@ import {
   sessionLaneIdFromRequest,
 } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
+import { clientWireOf } from "./inference/client-wire";
+import { directEncodersApply } from "./inference/client-encoder-delivery";
+import type { ClientEncoderOption } from "./responses/core-options";
 import { handleResponses } from "./responses";
+import { upstreamWireForAdapter } from "../protocols/contract";
+import { createProtocolEnvelope, type ProtocolEnvelope } from "../protocols/envelope";
+import { featuresFromMessagesBody, type ProtocolFeature } from "../protocols/features";
+import { credentialDomainFor, messagesBodyHasOpaqueState } from "../protocols/opaque-state";
+import { hasAnthropicFailoverQuorum } from "../oauth/anthropic-routing";
+import { checkRepresentable, unrepresentableMessage } from "../protocols/guard";
+import { requestPathForLane } from "../protocols/path";
+import { resolveApiSurfaceSettings, resolveProtocolSettings } from "../protocols/settings";
+import { markProtocolBlocked, markProtocolEntry } from "../protocols/trace";
+import { recordProtocolShadowPlan } from "../protocols/shadow-plan";
+import { nativeMessagesDeclineReason, type NativeMessagesSelector } from "./messages-native-eligibility";
 import {
   isApiAuthRequired,
   isDataPlaneAdmissionSecret,
@@ -148,11 +164,19 @@ export function buildClaudeReplayConfig(config: OcxConfig): OcxConfig {
   };
 }
 
+/**
+ * Messages exposure, shared by /v1/messages and /v1/messages/count_tokens so the two can never
+ * disagree. `resolveApiSurfaceSettings` is the only reader: an explicit
+ * `apiSurfaces.messages.enabled` wins, a malformed one closes the surface, and absence inherits
+ * `claudeCode.enabled`.
+ */
 function claudeInboundDisabled(config: OcxConfig): Response | null {
-  if (config.claudeCode?.enabled === false) {
-    return anthropicErrorResponse(403, "Claude inbound is disabled (GUI: Claude ON toggle / config.claudeCode.enabled)", "permission_error");
-  }
-  return null;
+  const messages = resolveApiSurfaceSettings(config).messages;
+  if (messages.enabled) return null;
+  const detail = messages.source === "invalid"
+    ? "config.apiSurfaces.messages is not a valid setting, so the surface stays closed"
+    : "GUI: API page Messages toggle / config.apiSurfaces.messages.enabled / config.claudeCode.enabled";
+  return anthropicErrorResponse(403, `Messages API is disabled (${detail})`, "permission_error");
 }
 
 async function readAnthropicBody(req: Request, budget: TranslatorBudget, maxBytes: number): Promise<unknown> {
@@ -234,7 +258,7 @@ function uuidFromHex(hex32: string): string {
   return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;
 }
 
-function anthropicUsageToOcx(usage: Rec | undefined): { inputTokens: number; outputTokens: number; cachedInputTokens?: number; cacheReadInputTokens?: number; cacheCreationInputTokens?: number } | undefined {
+export function anthropicUsageToOcx(usage: Rec | undefined): { inputTokens: number; outputTokens: number; cachedInputTokens?: number; cacheReadInputTokens?: number; cacheCreationInputTokens?: number } | undefined {
   if (!usage) return undefined;
   const num = (v: unknown) => typeof v === "number" ? v : 0;
   const hasCache = usage.cache_read_input_tokens !== undefined || usage.cache_creation_input_tokens !== undefined;
@@ -428,7 +452,7 @@ export function tapAnthropicSseForLog(
  * An empty id has no representable wire form, and forwarding `""` is what Anthropic
  * rejects (#1767), so the request fails locally with a 400 before any upstream fetch.
  */
-function sanitizePassthroughToolCallIds(messages: unknown[]): void {
+export function sanitizePassthroughToolCallIds(messages: unknown[]): void {
   const blocks: Rec[] = [];
   for (const message of messages) {
     if (!isRec(message) || !Array.isArray(message.content)) continue;
@@ -466,12 +490,7 @@ async function anthropicNativePassthrough(
   logCtx.model = model;
   logCtx.provider = "anthropic-native";
   logCtx.requestedModel = model;
-  let logged = false;
-  const finalize = (status: number, meta: { closeReason: PassthroughCloseReason | "non_stream" }) => {
-    if (!logIds || logged) return;
-    logged = true;
-    addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
-  };
+  const finalize = createFinalRequestLog(logIds, logCtx).finish;
 
   const base = (config.claudeCode?.anthropicBaseUrl ?? "https://api.anthropic.com").replace(/\/$/, "");
   const search = new URL(req.url).search;
@@ -718,6 +737,7 @@ async function handleClaudeMessagesWithBudget(
   logCtx.surface = "claude";
   const disabled = claudeInboundDisabled(config);
   if (disabled) {
+    markProtocolBlocked(logCtx, { inbound: "messages", reasonCodes: ["surface-disabled"] });
     if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 403, { closeReason: "non_stream" });
     return disabled;
   }
@@ -731,6 +751,9 @@ async function handleClaudeMessagesWithBudget(
   let effortRow: ParsedEffortRowId | null = null;
   let fastRow: ParsedFastRowId | null = null;
   let requestedModel = "";
+  // Built only under the reject policy; the legacy default leaves this request untouched.
+  let envelope: ProtocolEnvelope | undefined;
+  let messagesFeatures: () => Iterable<ProtocolFeature> = () => [];
   try {
     anthropicBody = await readAnthropicBody(req, translatorBudget, resolveInboundBodyLimitBytes(config.maxInboundBodyBytes));
     // Defensive [1m] strip (devlog 138): clients normally remove the context-variant
@@ -797,7 +820,21 @@ async function handleClaudeMessagesWithBudget(
     // caller's body with the caller's credential and never runs the Anthropic adapter, so the
     // proxy-owned `speed` + beta (anthropic-speed wire) and its usage.speed observation would be
     // silently skipped. Translation reaches the adapter, which owns both.
+    const messagesBody = anthropicBody;
+    if (isRec(messagesBody) && resolveProtocolSettings(config).unrepresentable === "reject") {
+      envelope = createProtocolEnvelope({ inbound: "messages", body: messagesBody, translatorBudget });
+    }
+    const sourceEnvelope = envelope;
+    // The bridge entry mark below reads these before an effort override rewrites `thinking`,
+    // which also fixes the envelope's cached features on the caller's own settings.
+    // Scanned once, like the envelope's cache, so a later mark reports the same features.
+    let scannedFeatures: ReadonlySet<ProtocolFeature> | undefined;
+    messagesFeatures = sourceEnvelope
+      ? () => sourceEnvelope.features()
+      : () => (scannedFeatures ??= featuresFromMessagesBody(messagesBody));
     if (!effortRow && !fastRow && isRec(anthropicBody) && wantsNativePassthrough(req, config, requestPolicy, anthropicBody.model, cc)) {
+      markProtocolEntry(logCtx, { inbound: "messages", lane: "native", features: messagesFeatures });
+      recordProtocolShadowPlan(logCtx, config, { inbound: "messages", model: requestedModel });
       return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
     }
     // Capture source semantics before effort rewriting or translation drops fields.
@@ -814,6 +851,7 @@ async function handleClaudeMessagesWithBudget(
         anthropicBeta: req.headers.get("anthropic-beta") ?? undefined,
       });
       if (compatibility.decision === "reject") {
+        markProtocolBlocked(logCtx, { inbound: "messages", reasonCodes: ["compatibility-reject"], features: messagesFeatures });
         logCtx.errorCode = "claude_compatibility_unsupported";
         if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
         return anthropicErrorResponse(400, compatibility.reason!, "invalid_request_error");
@@ -826,6 +864,14 @@ async function handleClaudeMessagesWithBudget(
         };
       }
     }
+    // Features are read here, before an effort override rewrites the thinking settings.
+    markProtocolEntry(logCtx, {
+      inbound: "messages",
+      lane: "bridge",
+      reasonCodes: effortRow ? ["effort-row"] : fastRow ? ["fast-row"] : [],
+      features: messagesFeatures,
+    });
+    recordProtocolShadowPlan(logCtx, config, { inbound: "messages", model: requestedModel });
     if (isRec(anthropicBody) && effortOverride) {
       anthropicBody.output_config = {
         ...(isRec(anthropicBody.output_config) ? anthropicBody.output_config : {}),
@@ -833,7 +879,7 @@ async function handleClaudeMessagesWithBudget(
       };
       delete anthropicBody.thinking;
     }
-    const translation = anthropicToResponsesTranslation(anthropicBody, cc, translatorBudget);
+    const translation = messagesToResponsesTranslation(anthropicBody, cc, translatorBudget);
     internalBody = translation.body;
     // The Anthropic translator builds its body from model/input/store/stream plus sampling
     // fields only, so the caller intent is applied to the TRANSLATED body rather than the
@@ -877,9 +923,11 @@ async function handleClaudeMessagesWithBudget(
   // the translated Anthropic SSE into a message JSON for non-streaming clients.
   internalBody.stream = true;
 
+  let clientEncoder: ClientEncoderOption | undefined;
   // Native ChatGPT passthrough (openai-responses forward) accepts only Codex-shaped
   // bodies: it 400s on sampling params ("Unsupported parameter: max_output_tokens",
   // verified live 2026-07-11). Strip them for that route; routed providers keep them.
+  let settledRoute: ReturnType<typeof routeModel> | undefined;
   try {
     const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
     // Same reason as the native Chat lane: this route can be sent from here, so
@@ -896,6 +944,10 @@ async function handleClaudeMessagesWithBudget(
     );
     route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic", route.staticPolicy);
     logCtx.routeDecision = route.routeDecision;
+    settledRoute = route;
+    if (directEncodersApply(config, route)) {
+      clientEncoder = { protocol: "messages", stream, model: requestedModel, inputTokenFloor: claudeRequestTokenFloor() };
+    }
     if (route.provider.adapter === "openai-responses") {
       delete internalBody.max_output_tokens;
       delete internalBody.temperature;
@@ -939,6 +991,70 @@ async function handleClaudeMessagesWithBudget(
     /* unknown model: let handleResponses shape the 404 */
   }
 
+  // PF-08: a managed-key Anthropic route sends its Messages body natively. The caller-forward
+  // passthrough above was decided on the caller's own credential and never reaches this point.
+  const nativeSelector: NativeMessagesSelector = {
+    effortRow: !!effortRow, fastRow: !!fastRow, routeSelector: String(internalBody.model ?? ""), claudeCode: cc,
+    // PF-10: a stored second OAuth account turns on the bridge's rotation, so it stays there.
+    ...(settledRoute?.provider.authMode === "oauth" ? { oauthFailoverQuorum: hasAnthropicFailoverQuorum() } : {}),
+  };
+  const nativeDecline = settledRoute && isRec(anthropicBody)
+    ? nativeMessagesDeclineReason(settledRoute, anthropicBody, config, nativeSelector)
+    : "rollout-disabled";
+  const nativeMessagesRoute = settledRoute && nativeDecline === undefined ? settledRoute : undefined;
+  // With the switch on, a declined route says why on its bridge mark, as native Chat does.
+  if (nativeDecline && nativeDecline !== "rollout-disabled") {
+    markProtocolEntry(logCtx, {
+      inbound: "messages",
+      lane: "bridge",
+      reasonCodes: [...(effortRow ? ["effort-row" as const] : fastRow ? ["fast-row" as const] : []), nativeDecline],
+      features: messagesFeatures,
+    });
+  }
+  // Combo and policy children are judged per candidate (PF-07); an unknown model has no route.
+  if (envelope && settledRoute && !settledRoute.combo && settledRoute.routeKind !== "policy") {
+    const verdict = checkRepresentable({
+      inbound: "messages",
+      requestPath: requestPathForLane("messages", nativeMessagesRoute ? "native" : "bridge", upstreamWireForAdapter(settledRoute.provider.adapter)),
+      features: envelope.features(),
+      policy: "reject",
+    });
+    if (!verdict.ok) {
+      markProtocolBlocked(logCtx, { inbound: "messages", reasonCodes: verdict.reasonCodes, features: verdict.features });
+      logCtx.errorCode = "unsupported_feature";
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
+      return anthropicErrorResponse(400, unrepresentableMessage(verdict.features), "invalid_request_error");
+    }
+  }
+  // PF-10: opaque thinking state reaches only first-party Anthropic; under `reject` a native
+  // route to anyone else refuses the request instead of sending it without that state.
+  if (envelope && nativeMessagesRoute && !credentialDomainFor(nativeMessagesRoute.provider)?.firstPartyAnthropic
+    && messagesBodyHasOpaqueState(anthropicBody as Rec)) {
+    markProtocolBlocked(logCtx, { inbound: "messages", reasonCodes: ["feature-unrepresentable", "opaque-state-stripped"], features: messagesFeatures });
+    logCtx.errorCode = "unsupported_feature";
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
+    return anthropicErrorResponse(400, "The selected route cannot carry thinking signatures or redacted_thinking blocks", "invalid_request_error");
+  }
+  if (nativeMessagesRoute) {
+    markProtocolEntry(logCtx, { inbound: "messages", lane: "native", features: messagesFeatures });
+    let nativeBody: Rec;
+    try {
+      // Built from the source envelope when there is one, after the managed-client steps above.
+      nativeBody = envelope ? envelope.freshBody() : anthropicBody as Rec;
+    } catch (err) {
+      if (!isTranslatorBudgetExceededError(err)) throw err;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 413, { closeReason: "non_stream" });
+      return anthropicErrorResponse(413, "request translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");
+    }
+    const { handleNativeMessages } = await import("./messages-native");
+    return await handleNativeMessages({
+      req, config, logCtx, ...(logIds ? { logIds } : {}),
+      route: nativeMessagesRoute, body: nativeBody, requestedModel, translatorBudget, selector: nativeSelector,
+      // The one caller header the native lane is given; the builder allowlists it.
+      callerAnthropicBeta: req.headers.get("anthropic-beta"),
+    });
+  }
+
   const headers = new Headers({ "content-type": "application/json" });
   let trustedClaudeMainAuth: { authorization: string; chatgptAccountId?: string } | undefined;
   for (const name of FORWARD_HEADERS) {
@@ -1008,12 +1124,7 @@ async function handleClaudeMessagesWithBudget(
   // via the terminal callbacks; routed streams get the Responses-vocabulary log tap
   // BEFORE translation (the translated Anthropic stream has no response.completed
   // frame, so tapping it records a bogus 502 with no usage/cache detail).
-  let nativeLogged = false;
-  const finalizeNativeLog = (status: number, meta: { terminalStatus?: RequestLogEntry["terminalStatus"]; closeReason: "terminal" | "client_cancel" }) => {
-    if (!logIds || nativeLogged) return;
-    nativeLogged = true;
-    addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
-  };
+  const finalizeNativeLog = createFinalRequestLog(logIds, logCtx).finish;
   const upstream = await handleResponses(internalReq, buildClaudeReplayConfig(config), logCtx, {
     // Routing keeps Claude-only sidecar overrides; admission policy must follow the live owner.
     codexAuthPolicy: config,
@@ -1036,8 +1147,11 @@ async function handleClaudeMessagesWithBudget(
     ...(logIds ? { onFirstOutput: () => recordFirstOutput(logCtx, logIds.start) } : {}),
     onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForRequestLogTerminal(status, logCtx), { terminalStatus: status, closeReason: "terminal" }),
     onNativePassthroughCancel: () => finalizeNativeLog(499, { closeReason: "client_cancel" }),
+    ...(clientEncoder ? { clientEncoder } : {}),
   });
   const response = logIds ? responseWithDeferredRequestLog(upstream, logIds.requestId, logIds.start, logCtx) : upstream;
+  // Already in the Messages wire (direct encoder): no conversion.
+  if (clientWireOf(upstream) === "messages") return response;
 
   if (!response.ok) {
     // Read the shared provenance verdict before consuming and re-wrapping the body. A refusal
@@ -1317,7 +1431,11 @@ export async function handleClaudeCountTokens(
     if (wantsNativePassthrough(req, config, requestPolicy, model, cc)) {
       return await anthropicNativePassthrough(req, config, { model, provider: "anthropic-native", surface: "claude" }, undefined, raw, "/v1/messages/count_tokens");
     }
-    const inputTokens = estimateClaudeRequestTokens(raw, model);
+    // PF-08: an eligible managed-key route counts the body the native lane would send.
+    const nativeCountBody = resolveProtocolSettings(config).rollout.managedMessagesNative
+      ? (await import("./messages-native")).nativeMessagesCountBody(config, cc, raw, { fastRow: countFastRow !== null })
+      : undefined;
+    const inputTokens = estimateClaudeRequestTokens(nativeCountBody ?? raw, model);
     return new Response(JSON.stringify({ input_tokens: inputTokens }), {
       status: 200,
       headers: { "Content-Type": "application/json" },