@bitkyc08/opencodex 2.67.0 → 2.68.0-preview.20260927

package/src/server/responses/reset-replay.ts

@@ -78,6 +78,38 @@ export function selfContainedResponsesBody(body: unknown): boolean {
   });
 }
 
+/**
+ * Chat Completions tools are executed by the client by spec -- the origin only emits the call.
+ * Anything else (`web_search`, `code_interpreter`, a vendor hosted tool) runs on the origin during
+ * the turn, so an unknown or hosted entry fails the whole catalog rather than being skipped.
+ */
+function clientExecutedChatTools(tools: unknown, budget: { remaining: number }): boolean {
+  if (!Array.isArray(tools) || tools.length > budget.remaining) return false;
+  budget.remaining -= tools.length;
+  return tools.every(tool => record(tool) && tool.type === "function");
+}
+
+/**
+ * A Chat Completions body whose second send can only repeat the inference.
+ *
+ * The lane is stateless by construction -- the proxy rebuilds the whole `messages` array on every
+ * turn, and `previous_response_id` is not part of the Chat wire -- so the only hazards left are
+ * server-side storage, which would record a second completion, and a hosted tool the origin would
+ * run a second time.
+ */
+export function selfContainedChatBody(body: unknown): boolean {
+  if (!record(body)) return false;
+  if (body.store === true) return false;
+  if (body.previous_response_id != null) return false;
+  // Hosted execution requested outside the `tools` catalog. Judged on the inbound body like every
+  // other hazard here, which is conservative for the outbound request by design: a body that asks
+  // for a hosted search is refused rather than assumed harmless because a later stage might drop
+  // the field.
+  if (body.web_search_options !== undefined) return false;
+  if (!Array.isArray(body.messages)) return false;
+  return body.tools === undefined || clientExecutedChatTools(body.tools, { remaining: MAX_TOOL_ENTRIES });
+}
+
 /**
  * The allowance for ONE logical request, or nothing when the provider did not opt in.
  *

package/src/server/responses/run-turn-execution.ts

@@ -6,14 +6,14 @@ import type { ResponsesEffects } from "./response-effects";
 import type { ResponsesSendBudget } from "./request-send-budget";
 import type { ResponsesCompletionPolicy } from "./completion-policy";
 import { linkAbortSignal, runTurnAdapterSseResponses } from "./core-lifetime";
-import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/run-turn-queue";
+import { createAdapterEventQueue, preflightAdapterEvents, type AdapterEventPreflight } from "../../adapters/run-turn-queue";
 import {
   bindRouteReasoningReplayScope,
   adapterNeedsForcedContinuation,
   adapterResponseReachedServingTerminal,
 } from "./core-replay";
 import { noteAttemptRecoveryWithheld, sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
-import { waitForProviderRequestSlot, RequestPacingQueueOverloadError } from "../../providers/request-pacing";
+import { releaseProviderRequestSlot, waitForProviderRequestSlot, RequestPacingQueueOverloadError, type ProviderRequestSlot } from "../../providers/request-pacing";
 import type { AdapterEventQueue } from "../../adapters/run-turn-queue";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { providerFetch } from "./fetch-helpers";
@@ -22,7 +22,6 @@ import { normalizeDeclaredToolName, type AdapterEvent, type OcxProviderContinuat
 import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
 import { SendBudgetExhaustedError, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
-  GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
   hasEligibleGenericOAuthFailoverTarget,
   isGenericOAuthFailoverEnabled,
   rotateGenericOAuthAccountOn429,
@@ -31,6 +30,9 @@ import {
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { formatErrorResponse, bridgeToResponsesSSE, buildResponseJSON } from "../../bridge";
 import { redactSecretString } from "../../lib/redact";
+import { adapterFailureFromEvent } from "../../bridge/internal";
+import { resolveClientRetryAfter } from "../../lib/retry-after";
+import { DEFAULT_STALL_TIMEOUT_SEC, resolveStallTimeoutSec } from "../../stall-timeout";
 import { jsonUtf8Bytes } from "../../lib/json-byte-size";
 import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
 import {
@@ -89,6 +91,7 @@ export async function executeResponsesRunTurn(
     | "replayOAuthCredentialSnapshot"
     | "genericFailoverAccountId"
     | "genericFailovers"
+    | "genericFailoverLimit"
     | "applyFailoverSnapshot"
     | "resolveSelectionAdapter"
     | "adapter"
@@ -184,8 +187,9 @@ export async function executeResponsesRunTurn(
     };
     // Initial admission must settle before the streaming Response commits HTTP 200.
     // Let the outer Responses facade preserve the local retryable-429 contract.
+    let initialPacingSlot: ProviderRequestSlot;
     try {
-      await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
+      initialPacingSlot = await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
     } catch (error) {
       cleanupRunTurnAbort();
       queue.close();
@@ -211,11 +215,17 @@ export async function executeResponsesRunTurn(
       // rounds carry the grown message history and adjusted tool list while
       // selection/replay binding stays on the request's own parsed object.
       turnParsed: PreparedResponsesRequest["parsed"] = parsed,
+      preacquiredSlot?: ProviderRequestSlot,
     ): Promise<void> => {
       const attemptSeq = ++runTurnAttemptSeq;
+      let pacingSlot = preacquiredSlot;
+      const emit = (event: AdapterEvent) => {
+        options.onCompactionRecoveryAdapterEvent?.(event);
+        targetQueue.push(event);
+      };
       try {
         if (!pacingSlotAcquired) {
-          await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
+          pacingSlot = await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
         }
         await refreshRunTurnSelection();
         // LOCAL PATCH (runturn-websearch): refreshRunTurnSelection binds route
@@ -241,6 +251,8 @@ export async function executeResponsesRunTurn(
             // Cursor HTTP/1.1 consumes it for RunSSE; every BidiAppend and redial then waits on
             // the same provider queue through this stateful wrapper.
             pacingSlotAcquired: true,
+            pacingSlot,
+            turnScopedPacing: true,
           },
         );
         await transportState.runTurnAdapter.runTurn?.(
@@ -248,8 +260,10 @@ export async function executeResponsesRunTurn(
           {
             headers: requestState.selectedForwardHeaders,
             abortSignal: runTurnAbort.signal,
+            comboAttempt: options.comboAttempt === true,
             translatorBudget,
             providerFetch: runTurnProviderFetch,
+            pacingSlot,
             // The only way the request budget reaches a transport the adapter owns. Without it
             // a Cursor turn's inner ladder was three physical sends the cap read as one.
             ...(adapterDispatchBudget ? { sendBudget: adapterDispatchBudget } : {}),
@@ -262,7 +276,7 @@ export async function executeResponsesRunTurn(
             ),
             onRecoveryWithheld: noteAdapterRecoveryWithheld,
           },
-          targetQueue.push,
+          emit,
         );
         // LOCAL PATCH (runturn-websearch): adapters may write conversation/
         // continuation state onto the object they received; merge it back so
@@ -276,7 +290,7 @@ export async function executeResponsesRunTurn(
           Object.assign(parsed, routeState);
         }
       } catch (err) {
-        targetQueue.push(err instanceof RequestPacingQueueOverloadError
+        emit(err instanceof RequestPacingQueueOverloadError
           ? {
               type: "error",
               status: 429,
@@ -301,6 +315,7 @@ export async function executeResponsesRunTurn(
                 message: err instanceof Error ? err.message : String(err),
               });
       } finally {
+        releaseProviderRequestSlot(pacingSlot);
         // Cursor assigns a stable conversation id inside runTurn on the first headerless
         // turn; backfill so Logs can filter/total that opening request (#330 / #522).
         if (!logCtx.conversationId && parsed._cursorConversationId) {
@@ -313,7 +328,7 @@ export async function executeResponsesRunTurn(
     // synthetic web_search tool; later iterations get their own queue so the
     // search loop can buffer each turn's events before deciding to intercept.
     const wsFirstParsed = wsPlan ? runTurnWebSearchInitialParsed(parsed) : parsed;
-    const runTurn = async (): Promise<void> => runTurnAttempt(queue, undefined, true, wsFirstParsed);
+    const runTurn = async (): Promise<void> => runTurnAttempt(queue, undefined, true, wsFirstParsed, initialPacingSlot);
     const runTurnFailoverArmed = () =>
       route.provider.authMode === "oauth"
       || !!(transportState.genericFailoverAccountId
@@ -345,7 +360,7 @@ export async function executeResponsesRunTurn(
       if (
         status !== 429
         || !transportState.genericFailoverAccountId
-        || transportState.genericFailovers >= GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
+        || transportState.genericFailovers >= transportState.genericFailoverLimit
         || !isGenericOAuthFailoverEnabled(config, route.providerName)
       ) return false;
       // Intersection with the request's shared budget: the roster bound above answers "may this
@@ -432,17 +447,81 @@ export async function executeResponsesRunTurn(
         return false;
       }
     };
+    const streamAfterPreflight = (
+      initialSource: AsyncIterable<AdapterEvent>,
+      replayParsed: PreparedResponsesRequest["parsed"],
+      initiallyReplayUnsafe: boolean,
+    ): AsyncIterable<AdapterEvent> => (async function* () {
+      let source = initialSource;
+      let replayUnsafe = initiallyReplayUnsafe;
+      let firstMeaningfulSeen = false;
+      while (true) {
+        let rotated = false;
+        for await (const event of source) {
+          if (!firstMeaningfulSeen && event.type === "heartbeat") {
+            replayUnsafe ||= event.replayUnsafe === true;
+            yield event;
+            continue;
+          }
+          if (!firstMeaningfulSeen && !replayUnsafe && event.type === "error"
+            && await rotateRunTurnAdapterOnPreflight429(event)) {
+            const retryQueue = createAdapterEventQueue({
+              onBacklogExceeded: () => runTurnAbort.abort(),
+            });
+            const pendingPermit = sendBudgetState.pendingHopPermit;
+            const retryAttempt = runTurnAttempt(retryQueue, "oauth-account-429", false, replayParsed);
+            if (pendingPermit) {
+              const releaseIfUnclaimed = () => {
+                if (sendBudgetState.pendingHopPermit !== pendingPermit) return;
+                sendBudgetState.pendingHopPermit = undefined;
+                pendingPermit.release();
+              };
+              void retryAttempt.then(releaseIfUnclaimed, releaseIfUnclaimed);
+            }
+            source = retryQueue.stream();
+            rotated = true;
+            break;
+          }
+          firstMeaningfulSeen = true;
+          yield event;
+        }
+        if (!rotated) return;
+      }
+    })();
     const preflightRunTurnFailover = async (
       firstSource: AsyncIterable<AdapterEvent>,
       // LOCAL PATCH (runturn-websearch): replayed attempts re-dispatch this
       // request — the grown-history iteration for post-search legs, the
       // tool-injected first request elsewhere.
       replayParsed: PreparedResponsesRequest["parsed"] = wsFirstParsed,
+      deadlineAt?: number,
     ): Promise<AsyncIterable<AdapterEvent>> => {
       let source = firstSource;
+      let latestRetryAttempt: Promise<void> | undefined;
+      let deferPendingPermitCleanup = false;
       try {
         while (true) {
-          const preflight = await preflightAdapterEvents(source);
+          const preflight = await preflightAdapterEvents(source, undefined, {
+            ...(deadlineAt === undefined ? {} : { maxWaitMs: deadlineAt - Date.now() }),
+            honorReady: replayParsed.stream,
+          });
+          if (preflight.timedOut) {
+            const pendingPermit = sendBudgetState.pendingHopPermit;
+            if (pendingPermit && latestRetryAttempt) {
+              // The timed-out replay may still be waiting for its first physical dispatch.
+              // Keep its reservation available until the adapter claims it; if the attempt ends
+              // before claiming, refund it then rather than charging a later send twice.
+              deferPendingPermitCleanup = true;
+              const releaseIfUnclaimed = () => {
+                if (sendBudgetState.pendingHopPermit !== pendingPermit) return;
+                sendBudgetState.pendingHopPermit = undefined;
+                pendingPermit.release();
+              };
+              void latestRetryAttempt.then(releaseIfUnclaimed, releaseIfUnclaimed);
+            }
+            return streamAfterPreflight(preflight.stream, replayParsed, preflight.replayUnsafe);
+          }
+          if (preflight.ready) return streamAfterPreflight(preflight.stream, replayParsed, preflight.replayUnsafe);
           if (preflight.replayUnsafe
             || !preflight.error
             || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
@@ -451,15 +530,14 @@ export async function executeResponsesRunTurn(
           const retryQueue = createAdapterEventQueue({
             onBacklogExceeded: () => runTurnAbort.abort(),
           });
-          void runTurnAttempt(retryQueue, "oauth-account-429", false, replayParsed);
+          latestRetryAttempt = runTurnAttempt(retryQueue, "oauth-account-429", false, replayParsed);
+          void latestRetryAttempt;
           source = retryQueue.stream();
         }
       } finally {
-        // A handed-down hop reservation belongs to the replay this loop dispatched, and the
-        // loop only leaves after that replay's first event has arrived -- so the adapter has
-        // already reserved if it was ever going to. Dropping the reference here keeps an
-        // adapter that reserves nothing from leaving a free send for an unrelated later leg.
-        sendBudgetState.pendingHopPermit = undefined;
+        // On ordinary exit the replay's first event proves its first-send reservation was reached.
+        // A timed-out replay may not have dispatched yet, so that path defers cleanup above.
+        if (!deferPendingPermitCleanup) sendBudgetState.pendingHopPermit = undefined;
       }
     };
     // The empty-completion retry re-runs the turn against a fresh queue: the
@@ -490,17 +568,49 @@ export async function executeResponsesRunTurn(
         message: undeclaredToolCallMessage(effectiveName),
       };
     };
+    const grokDevinPreflight = !options.comboAttempt && logCtx.surface === "grok" && inboundWire === "responses"
+      && transportState.runTurnAdapter.name === "devin";
+    const grokRateLimitResponse = (preflight: AdapterEventPreflight): Response | undefined => {
+      if (preflight.replayUnsafe || preflight.error?.status !== 429
+        || preflight.error.code === SEND_BUDGET_EXHAUSTED_CODE) return;
+      const { httpStatus, error } = adapterFailureFromEvent(preflight.error);
+      cancelResponseCompletion();
+      runTurnAbort.abort();
+      queue.close();
+      cleanupRunTurnAbort();
+      releaseSearchProbeLease();
+      return formatErrorResponse(httpStatus, error.type, error.message, {
+        code: error.code,
+        retryAfter: resolveClientRetryAfter({ status: httpStatus, message: error.message }),
+      });
+    };
     if (parsed.stream) {
       try {
       void runTurn();
       let eventSource: AsyncIterable<AdapterEvent> = queue.stream();
+      const stallTimeoutSec = wsPlan?.stallTimeoutSec ?? config.stallTimeoutSec;
+      // A disabled watchdog (0) is not a zero preflight: it would commit SSE before Devin's first
+      // event and deliver a pre-output 429 in-stream. Fall back to the default finite bound.
+      const preflightDeadlineAt = grokDevinPreflight
+        ? Date.now() + (resolveStallTimeoutSec(stallTimeoutSec) || DEFAULT_STALL_TIMEOUT_SEC) * 1_000
+        : undefined;
       if (runTurnFailoverArmed()) {
         // Preflight holds only heartbeats and the first meaningful event. A first-event 429 can be
         // replayed transparently; after any output reaches the bridge, a later error stays terminal.
-        eventSource = await preflightRunTurnFailover(eventSource);
+        eventSource = await preflightRunTurnFailover(eventSource, wsFirstParsed, preflightDeadlineAt);
+      }
+      if (grokDevinPreflight) {
+        const preflight = await preflightAdapterEvents(eventSource, undefined, {
+          maxWaitMs: (preflightDeadlineAt ?? Date.now()) - Date.now(),
+        });
+        eventSource = preflight.stream;
+        const refusal = grokRateLimitResponse(preflight);
+        if (refusal) return refusal;
       }
       if (options.comboAttempt) {
-        const preflight = await preflightAdapterEvents(eventSource, classifyUndeclaredFirstTool);
+        const preflight = await preflightAdapterEvents(
+          eventSource, classifyUndeclaredFirstTool, { honorReady: false },
+        );
         if (preflight.error || preflight.empty) {
           runTurnAbort.abort();
           queue.close();
@@ -559,7 +669,7 @@ export async function executeResponsesRunTurn(
           translatorBudget,
           replayCacheScope: parsed._reasoningReplayScope,
           ...(options.forceEmptyResponseId ? { responseId: "" } : {}),
-          stallTimeoutSec: wsPlan?.stallTimeoutSec ?? config.stallTimeoutSec,
+          stallTimeoutSec,
           hideThinkingSummary: parsed.options.hideThinkingSummary,
           declaredToolNames,
           enforceDeclaredToolNames,
@@ -618,6 +728,13 @@ export async function executeResponsesRunTurn(
         (async function* () { yield* firstAttemptEvents; })(),
       )) runTurnEvents.push(event);
     }
+    if (grokDevinPreflight) {
+      const preflight = await preflightAdapterEvents(
+        (async function* () { yield* runTurnEvents; })(), undefined, { honorReady: false },
+      );
+      const refusal = grokRateLimitResponse(preflight);
+      if (refusal) return refusal;
+    }
     let events: AdapterEvent[];
     // LOCAL PATCH (runturn-websearch): same exclusion as the streaming branch —
     // a search-aware retry runs inside runTurnWebSearchLoop, not the raw guard.

package/src/server/responses/sidecar-execution.ts

@@ -20,11 +20,16 @@ import type { ProviderAdapter } from "../../adapters/base";
 import type { OcxParsedRequest } from "../../types";
 import { rotateProviderTransportOn429, rateLimitRetryPolicyFor } from "../../providers/key-failover";
 import {
-  GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
   isGenericOAuthFailoverEnabled,
   rotateGenericOAuthAccountOn429,
+  rotateGenericOAuthAccountOnRefusal,
+  quarantineKiroSuspendedAccount,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
+import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
+import { noteKiroMonthlyRefusal, noteKiroServedSuccess } from "../../providers/kiro-usage";
+import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
+import { readDisplaySafeErrorText } from "./core-errors";
 import {
   ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
   rotateAnthropicAccountOn429,
@@ -59,6 +64,8 @@ export async function executeResponsesSidecars(
     | "adapter"
     | "genericFailoverAccountId"
     | "genericFailovers"
+    | "genericFailoverLimit"
+    | "replayOAuthCredentialSnapshot"
     | "applyFailoverSnapshot"
     | "anthropicPoolAccountId"
     | "anthropicPoolFailovers"
@@ -160,18 +167,32 @@ export async function executeResponsesSidecars(
     retryAfter: string | null,
     responseHeaders?: Headers,
     retryParsed?: OcxParsedRequest,
+    originalResponse?: Response,
   ): Promise<{ adapter: ProviderAdapter; recoveryKind: AttemptRecoveryKind } | null> => {
+    if (route.providerName !== "kiro" && originalResponse && originalResponse.status !== 429) return null;
+    const refusal = route.providerName === "kiro" && originalResponse
+      ? classifyKiroRefusal(originalResponse.status,
+        await readDisplaySafeErrorText(originalResponse.clone(), options.abortSignal ?? new AbortController().signal, "")).kind
+      : "rate";
+    if (refusal === "other") return null;
+    const sent = transportState.replayOAuthCredentialSnapshot;
+    const monthlyCooldownMs = route.providerName === "kiro" && refusal === "monthly_quota" && sent
+      ? noteKiroMonthlyRefusal(sent.accountId, sent.generation, Date.now()) : undefined;
+    if (monthlyCooldownMs !== undefined) persistKiroAccountState();
+    if (route.providerName === "kiro" && refusal === "suspended" && transportState.genericFailoverAccountId)
+      quarantineKiroSuspendedAccount(transportState.genericFailoverAccountId, sent?.generation);
     // Which credential axis actually moved. The main routed path already reports these three
     // separately (`adapter-dispatch`: key-429 / anthropic-oauth-429 / oauth-account-429); the
     // sidecar loops used to flatten all three to `key-429`, so an account rotation read as a key
     // rotation in the attempt row and in the Logs UI.
     let recoveryKind: AttemptRecoveryKind = "key-429";
-    const rotated = rotateProviderTransportOn429(config, route.providerName, route.provider, {
+    const rotated = route.providerName !== "kiro" || originalResponse?.status === 429
+      ? rotateProviderTransportOn429(config, route.providerName, route.provider, {
       retryAfter,
       now: Date.now(),
       attemptedKey: route.provider.apiKey,
       promptCacheKey: parsed.options.promptCacheKey,
-    });
+      }) : null;
     if (rotated) {
       route.provider = rotated;
     } else if (
@@ -180,7 +201,7 @@ export async function executeResponsesSidecars(
       // excludes it), so its sidecar 429s died on this guard before the Anthropic arm below
       // could ever be considered.
       transportState.genericFailoverAccountId
-      && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
+      && transportState.genericFailovers < transportState.genericFailoverLimit
       && isGenericOAuthFailoverEnabled(config, route.providerName)
     ) {
       // Intersection with the request's shared budget. The sidecar replay is dispatched by the
@@ -191,7 +212,10 @@ export async function executeResponsesSidecars(
         `${route.providerName}|${route.modelId}|sidecar-oauth-429`,
       );
       if (!hop.allowed) return null;
-      const nextAccountId = rotateGenericOAuthAccountOn429(
+      const nextAccountId = route.providerName === "kiro" ? rotateGenericOAuthAccountOnRefusal(
+        config, route.providerName, transportState.genericFailoverAccountId,
+        refusal, retryAfter, Date.now(), route.modelId, monthlyCooldownMs,
+      ) : rotateGenericOAuthAccountOn429(
         config,
         route.providerName,
         transportState.genericFailoverAccountId,
@@ -205,11 +229,12 @@ export async function executeResponsesSidecars(
       }
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
-        transportState.genericFailovers += 1;
+        if (route.providerName !== "kiro") transportState.genericFailovers += 1;
         if (!await applyFailoverSnapshot(snapshot, retryParsed)) {
           hop.permit?.release();
           return null;
         }
+        if (route.providerName === "kiro") transportState.genericFailovers += 1;
       } catch {
         hop.permit?.release();
         return null;
@@ -384,10 +409,14 @@ export async function executeResponsesSidecars(
         transportState.bindKeyUsageFromBridge(usage);
       },
       on429: rotateSidecarProviderOn429,
-      retryOn429Policy: rateLimitRetryPolicyFor(route.provider),
+      retryOn429Policy: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro")
+        ? null : rateLimitRetryPolicyFor(route.provider),
       ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
       ...(options.forceEmptyResponseId ? { forceEmptyResponseId: true } : {}),
       onCompletedResponse: (response, providerState) => {
+        const served = transportState.replayOAuthCredentialSnapshot;
+        if (route.providerName === "kiro" && response.status === "completed" && served
+          && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
         commitReasoningReplayServingRoute();
         rememberKiroDeliveredFinalAnswer(transportState.adapter.name, response);
         rememberResponseState(
@@ -467,8 +496,12 @@ export async function executeResponsesSidecars(
       stallTimeoutSec: wsPlan.stallTimeoutSec,
       streamRoutedModelOutput: wsPlan.streamRoutedModelOutput,
       on429: rotateSidecarProviderOn429,
-      retryOn429Policy: rateLimitRetryPolicyFor(route.provider),
+      retryOn429Policy: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro")
+        ? null : rateLimitRetryPolicyFor(route.provider),
       onCompletedResponse: response => {
+        const served = transportState.replayOAuthCredentialSnapshot;
+        if (route.providerName === "kiro" && response.status === "completed" && served
+          && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
         commitReasoningReplayServingRoute();
         notifyResponseComplete(response);
       },

package/src/server/responses/terminal-guard.ts

@@ -184,6 +184,7 @@ function mergeUsage(first: OcxUsage | undefined, second: OcxUsage | undefined):
   const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
   const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
   const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
+  const providerCredits = sumOptional("providerCredits");
   const inputTokens = first.inputTokens + second.inputTokens;
   const outputTokens = first.outputTokens + second.outputTokens;
   return {
@@ -194,6 +195,7 @@ function mergeUsage(first: OcxUsage | undefined, second: OcxUsage | undefined):
     ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
     ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
     ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
+    ...(providerCredits !== undefined ? { providerCredits } : {}),
     ...(first.estimated || second.estimated ? { estimated: true } : {}),
   };
 }

package/src/server/responses/ws-upstream.ts

@@ -18,11 +18,12 @@ import type { NativeResponseControl } from "./native-response-control";
 import { compareBunVersions } from "../../lib/bun-stream-caps";
 import { resolveProxyRoute, socks5ProxyFromEnv } from "../../lib/proxy-env";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
-import { CODEX_RESPONSES_HTTP_URL, CODEX_RESPONSES_WS_URL, prepareCodexHttpInit, prepareCodexWsRequest } from "./codex-ws-request";
+import { CODEX_RESPONSES_HTTP_URL, CODEX_RESPONSES_WS_URL, CODEX_WS_FRAME_HEADERS, prepareCodexHttpInit, prepareCodexWsRequest } from "./codex-ws-request";
 import { codexWsExchange } from "./codex-ws-exchange";
 import { CodexWsSession } from "./codex-ws-session";
 import { codexWsPool, codexWsReuseIdentity } from "./codex-ws-pool";
 import { codexWsCreateFrameExceedsLimit } from "./codex-ws-wire";
+import { isLoopbackUrl, rewriteWebSocketDial } from "../../plugins/upstream-hooks";
 export { CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES, MAX_CODEX_WS_QUEUE_BYTES,
   MAX_CODEX_WS_CREATE_FRAME_BYTES, CODEX_WS_CREATE_FRAME_LIMIT_BYTES, codexWsCreateFrameExceedsLimit,
   isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse } from "./codex-ws-wire";
@@ -81,6 +82,40 @@ export function bunSupportsBoundedCodexWsRelay(
   return comparison !== null && comparison >= 0;
 }
 
+/**
+ * Apply plugin rewrites to one Codex WebSocket dial and settle its proxy. `proxy` was resolved
+ * for the canonical `wsUrl`. A loopback rewrite dials directly; any other rewrite gets its own
+ * route (scheme and `NO_PROXY` may differ). Null means the rewritten destination needs the SSE
+ * fallback, exactly as an unusable route for the canonical URL does.
+ */
+export function planCodexWsDial(
+  wsUrl: string,
+  headers: Record<string, string>,
+  proxy: string | undefined,
+  env: Parameters<typeof resolveProxyRoute>[1] = process.env,
+): { url: string; headers: Record<string, string>; proxy: string | undefined } | null {
+  const rewritten = rewriteWebSocketDial(wsUrl, headers, proxy);
+  // Per-turn headers ride in each frame's client_metadata, which was prepared before the rewrite
+  // and is authoritative; a pooled socket's upgrade copy is intentionally ignored. A rewriter
+  // therefore cannot change them here, and the upgrade keeps the values the frame carries.
+  const dialHeaders = { ...rewritten.headers };
+  for (const name of CODEX_WS_FRAME_HEADERS) {
+    if (Object.hasOwn(headers, name)) dialHeaders[name] = headers[name]!;
+    else delete dialHeaders[name];
+  }
+  const dial = { ...rewritten, headers: dialHeaders };
+  if (dial.url === wsUrl || isLoopbackUrl(dial.url)) return dial;
+  let destination: URL;
+  try {
+    destination = new URL(dial.url);
+  } catch {
+    return null;
+  }
+  const route = resolveProxyRoute(destination, env);
+  if (route.kind === "fallback") return null;
+  return { ...dial, proxy: route.kind === "proxy" ? route.proxy : undefined };
+}
+
 export function shouldUseCodexWsUpstream(
   url: string,
   init?: RequestInit,
@@ -176,9 +211,14 @@ export function codexWsUpstreamFetch(
   try {
     // Steering keeps a private physical connection across successor responses; it
     // must never enter the idle-socket pool or move to a different credential.
-    const identity = control ? null : codexWsReuseIdentity(url, headers, frameText, proxy);
-    session = (identity ? codexWsPool.acquire(identity, wsUrl, headers, proxy) : null)
-      ?? new CodexWsSession(wsUrl, headers, false, undefined, proxy);
+    // Plugin rewrite runs per exchange, before the pool lookup. The dialled destination, its
+    // headers and its proxy are all part of the reuse identity, so a pooled socket is never
+    // reused for a different destination or with stale plugin headers.
+    const dial = planCodexWsDial(wsUrl, headers, proxy);
+    if (!dial) return sseFallback(url, init);
+    const identity = control ? null : codexWsReuseIdentity(url, dial.headers, frameText, dial.proxy, dial.url);
+    session = (identity ? codexWsPool.acquire(identity, dial.url, dial.headers, dial.proxy) : null)
+      ?? new CodexWsSession(dial.url, dial.headers, false, undefined, dial.proxy);
     if (!session.busy && !session.reserve()) {
       session.dispose();
       return sseFallback(url, init);