@bitkyc08/opencodex 2.67.0-preview.20260926 → 2.68.0-preview.20260927

package/src/server/chat-native.ts

@@ -38,11 +38,14 @@ import {
   UpstreamRetryEvidenceError,
   type UpstreamSendRecovery,
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
+  wrapWithZeroOutputRefetch,
 } from "../lib/upstream-retry";
 import {
   isTranslatorBudgetExceededError,
   type TranslatorBudget,
 } from "../lib/translator-budget";
+import { authorizeResendForRecovery } from "../lib/request-resend-gate";
+import { ambiguousResendAllowanceFor, selfContainedChatBody } from "./responses/reset-replay";
 import {
   hasKeyPoolFailover,
   selectProactiveApiKeyTransport,
@@ -59,6 +62,7 @@ import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { isLocalUpstream } from "../lib/local-upstream";
 import { linkAbortSignal } from "./responses";
 import {
   noteProviderAttemptSend,
@@ -368,7 +372,37 @@ export async function runNativeChatAttempt(
   );
   const transientSendAvailable = (): boolean => remainingTransientSends() > 0;
 
-  const send = async (request: AdapterRequest, recovery?: "rate-limit-429" | "key-429"): Promise<Response> => {
+  /**
+   * The operator's replacement grant for THIS logical request, read per leg because
+   * `activeProvider` is reassigned by credential rotation inside the send loop.
+   *
+   * A combo child already holds the request's send ledger, so the grant comes from it and every
+   * ambiguous stage of the request draws on the same counter. A direct Chat request opens no such
+   * ledger -- it accounts through a spend tracker instead -- so it keeps the single grant locally,
+   * which is the same ceiling for the same one attempt.
+   */
+  const requestIsSelfContained = (() => {
+    let memo: boolean | undefined;
+    return (): boolean => memo ??= selfContainedChatBody(execution.chatBody);
+  })();
+  let localAmbiguousResendSpent = false;
+  const claimAmbiguousResend = (limit: number): boolean => {
+    if (sendBudget?.claimAmbiguousResend) return sendBudget.claimAmbiguousResend(limit);
+    if (localAmbiguousResendSpent || limit <= 0) return false;
+    localAmbiguousResendSpent = true;
+    return true;
+  };
+  const ambiguousResend = () => ambiguousResendAllowanceFor(
+    activeProvider,
+    requestIsSelfContained,
+    claimAmbiguousResend,
+  );
+
+  const send = async (
+    request: AdapterRequest,
+    recovery?: "rate-limit-429" | "key-429" | UpstreamSendRecovery,
+    singleShot = false,
+  ): Promise<Response> => {
     try {
       // #2643: opted-in key-auth openai-chat providers retry pre-stream transient statuses on
       // the native chat lane too; everyone else keeps reset-only semantics.
@@ -377,74 +411,81 @@ export async function runNativeChatAttempt(
       if (requestTransientPolicy && remaining <= 0) {
         throw new Error("native Chat transient send budget exhausted before recovery dispatch");
       }
+      const dispatch = (transportRecovery?: UpstreamSendRecovery) => {
+        const effectiveRecovery = transportRecovery
+          ?? (recovery === "connection-reset" ? "connection-reset" : undefined);
+        return fetchWithHeaderTimeout(
+          request.url,
+          applyUpstreamRecoveryInit({
+            method: request.method,
+            headers: request.headers,
+            body: request.body,
+          }, effectiveRecovery),
+          upstream.signal,
+          connectMs,
+          requestedStream,
+          providerFetch(activeProvider, undefined, {
+            providerName: route.providerName,
+            modelId: route.modelId,
+            dispatchOverride: async (_input, init, execute) => {
+              if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
+                const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
+                if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, execution.chatBody, config)) {
+                  throw new Error("Provider key selection is no longer available for native Chat");
+                }
+                activeProvider = current;
+                stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
+                activeAdapter = createOpenAIChatAdapter(current);
+                activeRequest.releaseBodyObservation?.();
+                releaseRetainedRequest();
+                activeRequest = buildActiveRequest();
+                try { retainRequest(activeRequest); }
+                catch (error) { activeRequest.releaseBodyObservation?.(); throw error; }
+              }
+              // The retry closure may still hold a pre-pacing request. Replace its entire
+              // wire shape, not just Authorization, and retain transport recovery flags.
+              request = activeRequest;
+              const headers = new Headers(request.headers);
+              const encoding = new Headers(init.headers).get("accept-encoding");
+              if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
+              if (init.signal?.aborted) throw init.signal.reason;
+              if (sendBudget) {
+                // Backstop for sends the helper cannot see coming (a reset replay). The first
+                // report settles the combo's booking; each later one is charged and booked.
+                if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
+                  throw new SendBudgetExhaustedError(safeHostLabel(request.url));
+                }
+                physicalSends += 1;
+                sendBudget.used += 1;
+              } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
+              noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+              // A reselected provider transport is still a physical send: the connection policy
+              // and manual-redirect ownership wrap the selected implementation (#4992).
+              const dispatched = await sendWithConnectionPolicy(
+                (activeProvider as OcxProviderTransport).fetch ?? execute,
+                request.url,
+                applyUpstreamRecoveryInit({
+                  ...init, method: request.method, headers, body: request.body,
+                }, transportRecovery),
+                // Reselection can replace the provider transport and the wire shape, so the
+                // egress route is bound to the provider this send actually uses. Omitting it
+                // here would let a provider transport bypass its configured route entirely,
+                // because that transport wins over the executor that carries the binding.
+                { providerName: route.providerName, provider: activeProvider },
+              );
+              if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
+              return dispatched;
+            },
+          }),
+        );
+      };
+      // A replacement bought by an ambiguous reset is ONE send. Routing it back through a retry
+      // helper would let that helper spend sends the operator allowance never granted, which is
+      // the duplicated inference the allowance exists to bound.
+      if (singleShot) return await dispatch("connection-reset");
       const fetchWithPolicy = requestTransientPolicy ? fetchWithTransientRetry : fetchWithResetRetry;
       return await fetchWithPolicy(
-        (transportRecovery?: UpstreamSendRecovery) => {
-          return fetchWithHeaderTimeout(
-            request.url,
-            applyUpstreamRecoveryInit({
-              method: request.method,
-              headers: request.headers,
-              body: request.body,
-            }, transportRecovery),
-            upstream.signal,
-            connectMs,
-            requestedStream,
-            providerFetch(activeProvider, undefined, {
-              providerName: route.providerName,
-              modelId: route.modelId,
-              dispatchOverride: async (_input, init, execute) => {
-                if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
-                  const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
-                  if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, execution.chatBody, config)) {
-                    throw new Error("Provider key selection is no longer available for native Chat");
-                  }
-                  activeProvider = current;
-                  stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
-                  activeAdapter = createOpenAIChatAdapter(current);
-                  activeRequest.releaseBodyObservation?.();
-                  releaseRetainedRequest();
-                  activeRequest = buildActiveRequest();
-                  try { retainRequest(activeRequest); }
-                  catch (error) { activeRequest.releaseBodyObservation?.(); throw error; }
-                }
-                // The retry closure may still hold a pre-pacing request. Replace its entire
-                // wire shape, not just Authorization, and retain transport recovery flags.
-                request = activeRequest;
-                const headers = new Headers(request.headers);
-                const encoding = new Headers(init.headers).get("accept-encoding");
-                if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
-                if (init.signal?.aborted) throw init.signal.reason;
-                if (sendBudget) {
-                  // Backstop for sends the helper cannot see coming (a reset replay). The first
-                  // report settles the combo's booking; each later one is charged and booked.
-                  if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
-                    throw new SendBudgetExhaustedError(safeHostLabel(request.url));
-                  }
-                  physicalSends += 1;
-                  sendBudget.used += 1;
-                } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
-                noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-                // A reselected provider transport is still a physical send: the connection policy
-                // and manual-redirect ownership wrap the selected implementation (#4992).
-                const dispatched = await sendWithConnectionPolicy(
-                  (activeProvider as OcxProviderTransport).fetch ?? execute,
-                  request.url,
-                  applyUpstreamRecoveryInit({
-                    ...init, method: request.method, headers, body: request.body,
-                  }, transportRecovery),
-                  // Reselection can replace the provider transport and the wire shape, so the
-                  // egress route is bound to the provider this send actually uses. Omitting it
-                  // here would let a provider transport bypass its configured route entirely,
-                  // because that transport wins over the executor that carries the binding.
-                  { providerName: route.providerName, provider: activeProvider },
-                );
-                if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-                return dispatched;
-              },
-            }),
-          );
-        },
+        dispatch,
         {
           abortSignal: upstream.signal,
           label: safeHostLabel(request.url),
@@ -629,11 +670,39 @@ export async function runNativeChatAttempt(
   if (contentType.includes("text/event-stream") && response.body) {
     if (requestedStream) transferTurnToStream();
     let terminalStatus: number | undefined;
-    const stream = nativeChatSse(response.body, {
+    const resilientBody = wrapWithZeroOutputRefetch(
+      response.body,
+      // One physical send, not one more trip through a retry helper: the allowance below buys a
+      // single replacement, so the send must not be able to spend more than it granted.
+      async () => {
+        try {
+          return await send(activeRequest, "connection-reset", true);
+        } finally {
+          // Reselection can charge the rebuilt request after the initial send settled.
+          releaseRetainedRequest();
+        }
+      },
+      {
+        abortSignal: upstream.signal,
+        label: safeHostLabel(activeRequest.url),
+        attempts: remainingTransientSends(),
+        // The origin returned a head and may already be running the turn, so this is the
+        // ambiguous row of the stage table. Only the operator allowance the Responses stream
+        // also draws on can authorise it; without one the original failure stands.
+        authorize: () => authorizeResendForRecovery("headers-only", "connection-reset", ambiguousResend()).allowed,
+        // A replacement must satisfy the contract already promised to the client. A 200 that is
+        // not an event stream would reach the SSE translator as a non-SSE body and surface as a
+        // malformed-stream error instead of the reset that actually happened.
+        acceptResponse: replacement =>
+          (replacement.headers.get("content-type") ?? "").toLowerCase().includes("text/event-stream"),
+      },
+    );
+    const stream = nativeChatSse(resilientBody, {
       requestedModel,
       translatorBudget,
       signal: upstream.signal,
       stallTimeoutSec: config.stallTimeoutSec,
+      localUpstream: isLocalUpstream(activeProvider.baseUrl),
       onFirstOutput,
       onUsage: usage => {
         if (!recordKeyWireAttemptUsage(logCtx, usage)) {

package/src/server/claude-messages.ts

@@ -18,6 +18,7 @@ import { sseFieldValue } from "../lib/sse-decoder";
 import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
 import { createToolCallIdAllocator } from "../adapters/tool-call-id";
+import { openAIChatSerializesThinking } from "../adapters/openai-chat/messages";
 import { messagesToResponsesTranslation } from "../protocols/codecs/messages";
 import { AnthropicRequestError, DesktopModelMappingUnavailableError, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
 import { isKnownDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
@@ -27,6 +28,7 @@ import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
 import { claudeCodeForIngress } from "../claude/intercept/model-bindings";
 import { analyzeClaudeCompatibility, isClaudeCompatibilityMode } from "../claude/compatibility";
+import { carriesMessageThread, messageThreadUnsupportedResponse } from "../claude/message-threads";
 import {
   applyReplayRefusalClientHeaders,
   carryReplayRefusal,
@@ -45,7 +47,12 @@ import {
 } from "../claude/outbound";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
-import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import {
+  CLAUDE_NATIVE_THINKING,
+  projectClaudeRequest,
+  type ClaudeThinkingProjection,
+} from "../lib/claude-request-projection";
+import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, previewRouteModel, routedProviderConfig, UnknownRoutingPolicyError, routeModel, type RouteResult } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
@@ -837,6 +844,12 @@ async function handleClaudeMessagesWithBudget(
       recordProtocolShadowPlan(logCtx, config, { inbound: "messages", model: requestedModel });
       return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
     }
+    // Only Anthropic holds message-thread state; the error makes Claude Code resend the full turn.
+    if (carriesMessageThread(anthropicBody)) {
+      logCtx.errorCode = "claude_thread_unsupported";
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
+      return messageThreadUnsupportedResponse();
+    }
     // Capture source semantics before effort rewriting or translation drops fields.
     // This policy is uniform across translated targets, including later fallback attempts.
     const compatibilityMode: unknown = config.claudeCode?.compatibility;
@@ -904,7 +917,7 @@ async function handleClaudeMessagesWithBudget(
   if (!requestedModel) requestedModel = (anthropicBody as Rec).model as string;
   const stream = internalBody.stream === true;
   /**
-   * This proxy's count of the prompt it is about to forward, computed at most once.
+   * This proxy's count of the prompt it is about to forward, computed at most once per wire.
    *
    * Two readers want it and they want it under different rules. The usage log takes it as a
    * floor only for estimated-usage adapters, because its merge is `max(reported, estimate)` and
@@ -913,12 +926,17 @@ async function handleClaudeMessagesWithBudget(
    * `message_delta` still corrects it (#4857).
    */
   let requestTokenFloor: number | undefined;
-  const claudeRequestTokenFloor = (): number => {
-    if (requestTokenFloor === undefined) {
-      requestTokenFloor = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
-    }
-    return requestTokenFloor;
-  };
+  /**
+   * The `text|signature|redacted` triple `requestTokenFloor` was measured under.
+   *
+   * The count is not a constant for the request: a combo re-picks its child at dispatch and a
+   * retry can rotate the wire, so the pre-dispatch callers and the post-dispatch translator can
+   * legitimately want different projections. Keying the memo re-measures when they disagree
+   * instead of handing the translator the pre-dispatch measurement, and the estimator still runs
+   * at most twice for one request. At most, because a request has one settled wire per phase and
+   * the key collapses every repeat of the same answer.
+   */
+  let requestTokenFloorKey: string | undefined;
   // Routed adapters only support streamed turns; always stream internally and fold
   // the translated Anthropic SSE into a message JSON for non-streaming clients.
   internalBody.stream = true;
@@ -927,7 +945,25 @@ async function handleClaudeMessagesWithBudget(
   // Native ChatGPT passthrough (openai-responses forward) accepts only Codex-shaped
   // bodies: it 400s on sampling params ("Unsupported parameter: max_output_tokens",
   // verified live 2026-07-11). Strip them for that route; routed providers keep them.
-  let settledRoute: ReturnType<typeof routeModel> | undefined;
+  let settledRoute: RouteResult | undefined;
+  /**
+   * Which replayed thinking fields the send that actually happened will serialize.
+   *
+   * Read lazily: routing settles the ingress wire, core may then re-pick it (a combo child, a
+   * rotated retry), and this is called both before and after that happens. It therefore reads the
+   * physical attempt when one exists and the ingress route only until then.
+   */
+  const claudeThinkingProjection = (): ClaudeThinkingProjection =>
+    thinkingProjectionForDispatch(config, settledRoute, logCtx);
+  const claudeRequestTokenFloor = (): number => {
+    const thinking = claudeThinkingProjection();
+    const key = `${thinking.text}|${thinking.signature}|${thinking.redacted}`;
+    if (requestTokenFloor === undefined || requestTokenFloorKey !== key) {
+      requestTokenFloor = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel, thinking);
+      requestTokenFloorKey = key;
+    }
+    return requestTokenFloor;
+  };
   try {
     const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
     // Same reason as the native Chat lane: this route can be sent from here, so
@@ -1330,12 +1366,20 @@ function estimateBase64AttachmentTokens(data: string): number {
  * characters: one 2MB screenshot is ~2.7M base64 chars, which the plain chars/token
  * divide reports as hundreds of thousands of tokens versus a real cost around 1.6k.
  * That breaks the >2x drift bound the estimator is held to (devlog 260711_claude_inbound
- * 040 §3). Text and url sources are left in place and counted as characters, as is
+ * 040 §3); a live 260-message turn whose replayed thinking was 78.8% of the body breached
+ * it at 3.28x, which is why the estimate is projected onto the settled route. Text and url
+ * sources are left in place and counted as characters, as is
  * anything outside protocol content positions (tool_use.input, tool schemas).
+ *
+ * `thinking` selects which replayed thinking fields the SETTLED route serializes, so the measure
+ * describes the prompt this proxy forwards rather than the one the caller typed. Omitted, the
+ * whole body counts — correct for the Anthropic-native wire, where nothing is projected away.
+ * See `claude-request-projection.ts` for why a routed wire must project it out.
  */
 export function estimateClaudeRequestTokens(
   raw: { system?: unknown; messages?: unknown; tools?: unknown },
   modelId: string | undefined,
+  thinking: ClaudeThinkingProjection = CLAUDE_NATIVE_THINKING,
 ): number {
   let attachmentTokens = 0;
   // Blank base64 payloads ONLY in protocol content positions: message content blocks and
@@ -1370,11 +1414,93 @@ export function estimateClaudeRequestTokens(
       : messages;
   const parts: string[] = [];
   if (raw.system !== undefined) parts.push(typeof raw.system === "string" ? raw.system : JSON.stringify(raw.system));
-  if (raw.messages !== undefined) parts.push(JSON.stringify(sanitizedMessages(raw.messages)));
+  if (raw.messages !== undefined) {
+    const projected = projectClaudeRequest(raw, thinking);
+    parts.push(JSON.stringify(sanitizedMessages(projected.messages)));
+  }
   if (raw.tools !== undefined) parts.push(JSON.stringify(raw.tools));
   return Math.max(1, estimateTokens(parts.join("\n"), modelId) + attachmentTokens);
 }
 
+/**
+ * The projection for a route that has already settled.
+ *
+ * Only the OpenAI-shaped Chat adapter discards replayed thinking; every other settled wire
+ * forwards the body it was given. An unknown route keeps the full body.
+ */
+function thinkingProjectionForRoute(route: RouteResult | undefined): ClaudeThinkingProjection {
+  if (!route || route.provider.adapter !== "openai-chat") return CLAUDE_NATIVE_THINKING;
+  return openAIChatSerializesThinking(route.provider, route.modelId);
+}
+
+/**
+ * The projection for the wire that will physically carry the request.
+ *
+ * The ingress route is not the last word on that wire. A combo re-picks its child at dispatch,
+ * and a retry can rotate the adapter mid-turn, so the ingress pick can name a different provider
+ * — and therefore a different body — than the one that is sent. `logCtx.activeAttempt` is the
+ * send that actually happened (`sealRequestAttemptIdentity` keeps its adapter current), so it
+ * wins once it exists; before the first send the ingress route is the only authority there is.
+ *
+ * A Chat identity is re-derived through `routedProviderConfig`, not read off the raw config row:
+ * `preserveReasoningContentModels` is registry-merged, so a row that omits it would otherwise
+ * price a preserve-listed model as if the wire dropped its reasoning.
+ */
+function thinkingProjectionForDispatch(
+  config: OcxConfig,
+  route: RouteResult | undefined,
+  logCtx: Pick<RequestLogContext, "providerAdapter" | "activeAttempt">,
+): ClaudeThinkingProjection {
+  const attempt = logCtx.activeAttempt;
+  const adapter = attempt?.adapter ?? logCtx.providerAdapter;
+  // No send to describe yet: the ingress route is the best available answer, and for the
+  // Anthropic-native wire (which drops nothing) it is already the right one.
+  if (adapter === undefined) return thinkingProjectionForRoute(route);
+  if (adapter !== "openai-chat") return CLAUDE_NATIVE_THINKING;
+  const providerName = attempt?.provider;
+  const modelId = attempt?.model ?? route?.modelId;
+  const provider = providerName !== undefined && Object.hasOwn(config.providers, providerName)
+    ? config.providers[providerName]
+    : undefined;
+  // A Chat wire whose destination cannot be named keeps the route's own answer: over-counting on
+  // a path that publishes nothing is harmless, under-counting a real prompt is not.
+  if (providerName === undefined || modelId === undefined || provider === undefined) {
+    return thinkingProjectionForRoute(route);
+  }
+  try {
+    return openAIChatSerializesThinking(routedProviderConfig(providerName, provider), modelId);
+  } catch {
+    return thinkingProjectionForRoute(route);
+  }
+}
+
+/**
+ * The projection for a route resolved only to MEASURE a body this handler never sends.
+ *
+ * `previewRouteModel` is the read-only resolver: it advances no combo round-robin state, so a
+ * count request cannot steer where the next real turn goes. An unresolvable model keeps the
+ * full body, matching the old behavior for models routing cannot place.
+ *
+ * The wire is settled exactly as the turn path settles it. Routing fills in the provider's
+ * registry adapter, and a per-model `modelAdapters` override or a pinned wire is applied later by
+ * `resolveWireProtocolOverride` — so skipping it here would price the count against a body the
+ * routed adapter never sends.
+ */
+function thinkingProjectionForPreview(config: OcxConfig, modelId: string): ClaudeThinkingProjection {
+  try {
+    const route = previewRouteModel(config, modelId);
+    route.staticPolicy = captureRouteStaticPolicy(
+      route.providerName, route.modelId, route.provider, route.staticPolicy.effectiveAlias, "anthropic",
+    );
+    route.provider = resolveWireProtocolOverride(
+      route.providerName, route.modelId, route.provider, "anthropic", route.staticPolicy,
+    );
+    return thinkingProjectionForRoute(route);
+  } catch {
+    return CLAUDE_NATIVE_THINKING;
+  }
+}
+
 export async function handleClaudeCountTokens(
   req: Request,
   config: OcxConfig,
@@ -1431,11 +1557,20 @@ export async function handleClaudeCountTokens(
     if (wantsNativePassthrough(req, config, requestPolicy, model, cc)) {
       return await anthropicNativePassthrough(req, config, { model, provider: "anthropic-native", surface: "claude" }, undefined, raw, "/v1/messages/count_tokens");
     }
+    // A thread delta would undercount; refuse it exactly as the translated Messages path does.
+    if (carriesMessageThread(raw)) return messageThreadUnsupportedResponse();
     // PF-08: an eligible managed-key route counts the body the native lane would send.
     const nativeCountBody = resolveProtocolSettings(config).rollout.managedMessagesNative
       ? (await import("./messages-native")).nativeMessagesCountBody(config, cc, raw, { fastRow: countFastRow !== null })
       : undefined;
-    const inputTokens = estimateClaudeRequestTokens(nativeCountBody ?? raw, model);
+    // A count answers for the prompt a real turn from this model would forward, so it projects
+    // the same unserialized content that turn's `message_start` floor does. Counting the raw
+    // caller body instead reported replayed thinking this route never sends (#4857 family).
+    const inputTokens = estimateClaudeRequestTokens(
+      nativeCountBody ?? raw,
+      model,
+      thinkingProjectionForPreview(config, model),
+    );
     return new Response(JSON.stringify({ input_tokens: inputTokens }), {
       status: 200,
       headers: { "Content-Type": "application/json" },

package/src/server/index/link-listener.ts

@@ -29,6 +29,10 @@ export type LinkListenerStatus = {
   reason: string | null;
 };
 
+export function linkListenerOwnsTarget(status: LinkListenerStatus): boolean {
+  return status.state === "listening" && status.port !== null;
+}
+
 export interface LinkListenerLifecycle<T> {
   ownsListener(server: Server<T>): boolean;
   start(ctx: LinkListenerStartContext<T>): void;
@@ -93,6 +97,9 @@ export function createLinkListenerLifecycle<T>(deps: LinkListenerDeps = {}): Lin
       bound = serve({
         hostname: "127.0.0.1",
         port: requestedPort,
+        // The public listener's idle limit (serve-options.ts). Bun's 10 s default would cut a
+        // relayed turn that the Home holds or that streams with a long gap.
+        idleTimeout: 255,
         maxRequestBodySize: startContext.maxRequestBodySize,
         fetch: (req: Request, server: Server<unknown>) => startContext!.dispatch(req, server as Server<T>),
       } as Parameters<typeof Bun.serve>[0]);

package/src/server/index/optional-listeners.ts

@@ -6,6 +6,7 @@ import {
 } from "./claude-intercept-lifecycle";
 import {
   createLinkListenerLifecycle,
+  linkListenerOwnsTarget,
   linkRouteAllowed,
   type LinkListenerDeps,
   type LinkListenerLifecycle,
@@ -82,7 +83,9 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
       activeConfig = ctx.config;
       linkListener.start({ dispatch: ctx.dispatch, maxRequestBodySize: ctx.maxRequestBodySize });
       unregisterSupervisorAdmission ??= linkListener.onAuthenticatedCatalog(apiKeyId => supervisor.notifyAuthenticatedRequest?.(apiKeyId));
-      supervisor.start();
+      if (linkListenerOwnsTarget(linkListener.status())) {
+        supervisor.start();
+      }
       supervisorStop = () => supervisor.stop();
       claudeIntercept.start({
         config: ctx.config,

package/src/server/index/package-tree-guard.ts

@@ -2,9 +2,11 @@ import {
   createRuntimePackageTreeIntegrityGuard,
   type PackageTreeIntegrityGuard,
 } from "../../lib/package-tree-integrity";
+import { createPackageTreeRetargetWatch } from "../../lib/package-tree-retarget";
 import { acceptSystemRestart } from "../management/system-restart";
 import { inspectNativeCodexOwnership } from "../../integrations/native/ownership-preflight";
 import { detectInstall } from "../../update/index";
+import { planMiseLauncherTargetWatch } from "../../update/mise-launcher-target";
 import type { StartServerDeps } from "./startup-warnings";
 
 // Production guard wiring for the package-tree integrity fence. Tests inject
@@ -21,31 +23,48 @@ export function createPackageTreeIntegrityGuardForServer(
   }
   const acceptPackageTreeRestart = deps.acceptSystemRestart ?? acceptSystemRestart;
   let vetoAcceptedRestart: (() => void) | undefined;
+  // An out-of-band install replaced or retargeted the package this live process runs. Let the
+  // standard drain-and-restart path bring the new tree up instead of refusing traffic until a
+  // manual restart. acceptSystemRestart is idempotent and supervisor-aware. Throwing tells the
+  // caller to retry after its own debounce.
+  const restartOntoNewPackageTree = () => {
+    const beforeScheduledDrain = () => !isServiceChild() || serviceHomeOwned();
+    if (!beforeScheduledDrain()) throw new Error("service home ownership changed");
+    let admitted = false;
+    const result = acceptPackageTreeRestart(undefined, {
+      onAccepted: veto => { admitted = true; vetoAcceptedRestart = veto; },
+      beforeScheduledDrain,
+    });
+    // An automatic restart that could not take the drain lease (another drain owns the lifecycle
+    // gate) reports alreadyDraining without admitting it. Throw so the caller retries instead of
+    // treating the restart as done and leaving the service on the old package.
+    if (result.alreadyDraining && !admitted) throw new Error("restart admission is busy");
+  };
   const guard = createRuntimePackageTreeIntegrityGuard(
     deps.packageTreeInstaller ?? detectInstall(),
     deps.observePackageTree,
     undefined,
-    {
-      ...deps.packageTreeIntegrityOptions,
-      onReplaced: () => {
-        // An out-of-band install replaced the package under this live process. Serve
-        // the 503 for the triggering request, then let the standard drain-and-restart
-        // path bring the new tree up instead of refusing traffic until a manual
-        // restart. acceptSystemRestart is idempotent and supervisor-aware.
-        const beforeScheduledDrain = () => !isServiceChild() || serviceHomeOwned();
-        if (!beforeScheduledDrain()) throw new Error("service home ownership changed");
-        acceptPackageTreeRestart(undefined, {
-          onAccepted: veto => { vetoAcceptedRestart = veto; },
-          beforeScheduledDrain,
-        });
-      },
-    },
+    { ...deps.packageTreeIntegrityOptions, onReplaced: restartOntoNewPackageTree },
   );
+  // mise installs each version beside the last and repoints a floating link, so the manifest
+  // above never changes on `mise upgrade`. The managed service follows its launcher instead.
+  const plan = deps.packageTreeLauncherTarget === undefined
+    ? planMiseLauncherTargetWatch()
+    : deps.packageTreeLauncherTarget;
+  const retarget = plan
+    ? createPackageTreeRetargetWatch(
+      plan.runningRoot,
+      plan.resolveTarget,
+      restartOntoNewPackageTree,
+      deps.packageTreeRetargetOptions,
+    )
+    : null;
   return {
     status: () => guard.status(),
-    installedVersion: () => guard.installedVersion?.(),
+    installedVersion: () => guard.installedVersion?.() ?? retarget?.settledVersion(),
     dispose: () => {
       guard.dispose();
+      retarget?.dispose();
       vetoAcceptedRestart?.();
       vetoAcceptedRestart = undefined;
     },

package/src/server/index/serve-options.ts

@@ -87,6 +87,7 @@ import {
 import { sessionLaneIdFromRequest } from "../request-log-conversation";
 import { responseWithDeferredRequestLog } from "../relay";
 import { createRequestMetricsOwner } from "../request-metrics";
+import { cachedKiroQuotaMetricRows } from "../../providers/kiro-quota-metrics";
 import {
   corsHeaders,
   managementCorsHeaders,
@@ -292,7 +293,8 @@ export function createServeOptions(ctx: ServeOptionsContext) {
     port,
   } = ctx;
   void port;
-  const requestMetrics = metricsExportEnabled(config) ? createRequestMetricsOwner() : undefined;
+  const requestMetrics = metricsExportEnabled(config)
+    ? createRequestMetricsOwner(Date.now() / 1000, cachedKiroQuotaMetricRows) : undefined;
   const requestMetricsLogContext = requestMetrics ? { requestMetricsRecorder: requestMetrics } : {};
   const requestManagementApiDeps: ManagementApiDeps = requestMetrics
     ? { ...managementApiDeps, requestMetrics: { snapshot: () => requestMetrics.snapshot() } }
@@ -1398,7 +1400,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
           const response = await handleContextHistory(req, config, logCtx, contextEndpoint(url.pathname)!,
-            turnAdmissionLease, admission, () => resolveApiAuth(req, policy));
+            turnAdmissionLease, admission, () => resolveApiAuth(req, ingress === "hub-link" ? linkPolicy() : policy));
           addFinalRequestLog(requestId, start, logCtx, response.status,
             response.status === 499 ? { closeReason: "client_cancel" } : undefined);
           return withCors(response, req, policy);

package/src/server/index/startup-warnings.ts

@@ -11,6 +11,8 @@ import type {
   PackageTreeIntegrityOptions,
   PackageTreeRuntimeInstall,
 } from "../../lib/package-tree-integrity";
+import type { PackageTreeRetargetOptions } from "../../lib/package-tree-retarget";
+import type { MiseLauncherTargetWatchPlan } from "../../update/mise-launcher-target";
 import {
   consumeForInspection,
   relaySseWithHeartbeat,
@@ -158,6 +160,10 @@ export interface StartServerDeps {
   packageTreeServiceChild?: () => boolean;
   /** Test-only: whether this service child still owns its service home. */
   packageTreeServiceHomeOwned?: () => boolean;
+  /** Test-only launcher plan; production plans from the mise owner and service state. Null disables. */
+  packageTreeLauncherTarget?: MiseLauncherTargetWatchPlan | null;
+  /** Test-only retarget-watch timing and version seams. */
+  packageTreeRetargetOptions?: PackageTreeRetargetOptions;
   /** Test-only seam for observing quota-worker registration ownership. */
   registerCodexQuotaAutoRefreshWorker?: typeof registerCodexQuotaAutoRefreshWorker;
 }