@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/server/management/provider-overwrite-carry.ts

@@ -1,6 +1,26 @@
 import { nonBlankStringArrayConfigError, normalizeNonBlankStringArray } from "../../config/provider-validation";
+import {
+  retryOn429PolicyConfigError,
+  retryOnResetPolicyConfigError,
+  transientRetryOn5xxPolicyConfigError,
+} from "../../config/load-degrade";
 import type { OcxProviderConfig } from "../../types";
 
+/**
+ * The retry policies. They are the one carried group the PATCH field mask did not know, and they
+ * are `"editor"` fields, so before this a save that dropped one left no API path to put it back.
+ * Each validator is the same strict check the loader's schema applies, so the mask cannot store a
+ * block that a later load would reject.
+ */
+const RETRY_POLICY_FIELDS = ["retryOn429", "transientRetryOn5xx", "retryOnReset"] as const satisfies
+  readonly (keyof OcxProviderConfig)[];
+
+const RETRY_POLICY_VALIDATORS = {
+  retryOn429: retryOn429PolicyConfigError,
+  transientRetryOn5xx: transientRetryOn5xxPolicyConfigError,
+  retryOnReset: retryOnResetPolicyConfigError,
+} as const satisfies Record<typeof RETRY_POLICY_FIELDS[number], (policy: unknown) => string | null>;
+
 /**
  * What a provider save keeps (#5563).
  *
@@ -11,13 +31,22 @@ import type { OcxProviderConfig } from "../../types";
  * them afterwards: the disk row equals its baseline, so the three-way merge keeps the value the
  * save wrote.
  *
- * These five settings record how one upstream behaves. An overwrite that keeps the destination
+ * `hideRawReasoning` is an operator display policy, so every overwrite of the same provider name
+ * carries it when omitted, even when the destination changes. The compatibility settings below
+ * record how one upstream behaves. An overwrite that keeps the destination
  * carries each one the request omits, including an explicit `[]` or `false`. An overwrite that
  * moves the provider to another destination carries none of them: they describe the previous
  * upstream, and registry enrichment already fills what is known about the new one. The same
  * destination rule gates the stored `apiKeyPool`, whose keys were issued for the previous
  * destination. A value the request sends always wins, and the rest of the old row is never merged
  * into the candidate.
+ *
+ * The three retry policies join them on the same terms, and for a sharper reason: they are
+ * `"editor"` fields that had no branch in the PATCH field mask, so a save that dropped one left no
+ * API path to put it back. The mask branch below restores that path, and validates each policy
+ * against the loader's own schema — PATCH never runs the schema, and a malformed block would not
+ * degrade to "absent": the load would fail and the default config would take the whole provider
+ * table.
  */
 export const PROVIDER_COMPAT_CARRY_FIELDS = [
   "preserveReasoningContentModels",
@@ -25,9 +54,13 @@ export const PROVIDER_COMPAT_CARRY_FIELDS = [
   "foldDeveloperRoleToSystem",
   "reasoningWireFormat",
   "omitReasoningEffortWithToolsModels",
+  ...RETRY_POLICY_FIELDS,
 ] as const satisfies readonly (keyof OcxProviderConfig)[];
 
+export const PROVIDER_DISPLAY_CARRY_FIELDS = ["hideRawReasoning"] as const satisfies readonly (keyof OcxProviderConfig)[];
+
 export type ProviderCompatCarryField = typeof PROVIDER_COMPAT_CARRY_FIELDS[number];
+type ProviderDisplayCarryField = typeof PROVIDER_DISPLAY_CARRY_FIELDS[number];
 
 /** The only `reasoningWireFormat` value the adapters understand. */
 export const PROVIDER_REASONING_WIRE_FORMATS: readonly NonNullable<OcxProviderConfig["reasoningWireFormat"]>[] = [
@@ -39,13 +72,13 @@ export const PROVIDER_REASONING_WIRE_FORMATS: readonly NonNullable<OcxProviderCo
  * omitted this" and "the registry supplied it" look the same.
  */
 export interface ProviderOverwriteSample {
-  readonly submitted: ReadonlySet<ProviderCompatCarryField>;
+  readonly submitted: ReadonlySet<ProviderCompatCarryField | ProviderDisplayCarryField>;
   readonly namesAuthMode: boolean;
 }
 
 export function sampleProviderOverwrite(provider: object): ProviderOverwriteSample {
   return {
-    submitted: new Set(PROVIDER_COMPAT_CARRY_FIELDS.filter(field => Object.hasOwn(provider, field))),
+    submitted: new Set([...PROVIDER_COMPAT_CARRY_FIELDS, ...PROVIDER_DISPLAY_CARRY_FIELDS].filter(field => Object.hasOwn(provider, field))),
     namesAuthMode: Object.hasOwn(provider, "authMode"),
   };
 }
@@ -81,7 +114,8 @@ export function providerOverwriteKeepsDestination(
 }
 
 /**
- * Carry the stored compatibility settings the request omitted. `live` must be the row read after
+ * Carry the stored display policy on every overwrite, then the omitted compatibility settings
+ * only when the destination is unchanged. `live` must be the row read after
  * the route's DNS await, so a PATCH that saved one of them during the wait is kept.
  */
 export function carryProviderCompatFields(
@@ -89,13 +123,25 @@ export function carryProviderCompatFields(
   live: OcxProviderConfig | undefined,
   sample: ProviderOverwriteSample,
 ): void {
-  if (!live || !providerOverwriteKeepsDestination(candidate, live, sample)) return;
+  if (!live) return;
   const target = candidate as unknown as Record<string, unknown>;
+  for (const field of PROVIDER_DISPLAY_CARRY_FIELDS) {
+    if (sample.submitted.has(field)) continue;
+    const stored = live[field];
+    if (stored !== undefined) target[field] = stored;
+  }
+  if (!providerOverwriteKeepsDestination(candidate, live, sample)) return;
   for (const field of PROVIDER_COMPAT_CARRY_FIELDS) {
     if (sample.submitted.has(field)) continue;
     const stored = live[field];
     if (stored === undefined) continue;
-    target[field] = Array.isArray(stored) ? [...stored] : stored;
+    // Arrays and the retry-policy objects are copied rather than aliased, like `requestPacing`
+    // in the route: a later edit of one row must not reach the other through a shared value.
+    target[field] = Array.isArray(stored)
+      ? [...stored]
+      : stored !== null && typeof stored === "object"
+        ? structuredClone(stored)
+        : stored;
   }
 }
 
@@ -112,6 +158,8 @@ export function providerCompatFieldConfigError(provider: Record<string, unknown>
   }
   const fold = provider.foldDeveloperRoleToSystem;
   if (fold !== undefined && typeof fold !== "boolean") return "foldDeveloperRoleToSystem must be a boolean";
+  const hideRawReasoning = provider.hideRawReasoning;
+  if (hideRawReasoning !== undefined && typeof hideRawReasoning !== "boolean") return "hideRawReasoning must be a boolean";
   const wire = provider.reasoningWireFormat;
   if (wire !== undefined && !PROVIDER_REASONING_WIRE_FORMATS.includes(wire as never)) {
     return `reasoningWireFormat must be one of: ${PROVIDER_REASONING_WIRE_FORMATS.join(", ")}`;
@@ -149,6 +197,13 @@ export function applyProviderCompatPatchFields(
     else return { error: "foldDeveloperRoleToSystem must be a boolean" };
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "hideRawReasoning")) {
+    const value = rawBody.hideRawReasoning;
+    if (value === null) delete next.hideRawReasoning;
+    else if (typeof value === "boolean") next.hideRawReasoning = value;
+    else return { error: "hideRawReasoning must be a boolean" };
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "reasoningWireFormat")) {
     const value = rawBody.reasoningWireFormat;
     if (value === null) {
@@ -160,5 +215,23 @@ export function applyProviderCompatPatchFields(
     }
     touched = true;
   }
+  // The retry policies. They are validated here, like `requestPacing` and `upstreamHttpVersion`,
+  // because PATCH does not run the config schema: only POST does, through
+  // `validateConfigCandidate`. A malformed block that reached disk would fail the load and take
+  // the whole provider table to the default config with it, so the mask refuses it rather than
+  // storing something the loader will reject. `null` leaves the row entirely: the schema reads an
+  // absent block as "off", so deleting the key is what disables one, not storing `{enabled:false}`.
+  for (const field of RETRY_POLICY_FIELDS) {
+    if (!Object.hasOwn(rawBody, field)) continue;
+    const value = rawBody[field];
+    if (value === null) {
+      delete next[field];
+    } else {
+      const error = RETRY_POLICY_VALIDATORS[field](value);
+      if (error) return { error };
+      next[field] = structuredClone(value) as OcxProviderConfig[typeof field];
+    }
+    touched = true;
+  }
   return { touched };
 }

package/src/server/management/provider-routes.ts

@@ -1,4 +1,4 @@
-import { modelCapabilitiesConfigError, mergeModelCapabilities } from "../../config/provider-validation";
+import { contextTierRecordConfigError, modelCapabilitiesConfigError, mergeModelCapabilities } from "../../config/provider-validation";
 import { DECLARABLE_HOSTED_TOOL_TYPES } from "../../responses/hosted-tool-policy";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -530,6 +530,13 @@ function applyProviderPatchFields(
     else next.modelCapabilities = capabilities;
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "modelContextTiers")) {
+    const error = contextTierRecordConfigError(rawBody.modelContextTiers, true);
+    if (error) return { error };
+    if (rawBody.modelContextTiers === null) delete next.modelContextTiers;
+    else next.modelContextTiers = Object.assign(Object.create(null), next.modelContextTiers ?? {}, rawBody.modelContextTiers);
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "modelContextWindows")) {
     const value = rawBody.modelContextWindows;
     if (value === null) {
@@ -933,6 +940,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       models: p.models ?? [],
       contextWindow: p.contextWindow,
       modelContextWindows: p.modelContextWindows,
+      modelContextTiers: p.modelContextTiers,
       modelCapabilities: p.modelCapabilities,
       pinnedReasoningEffort: p.pinnedReasoningEffort,
       modelPinnedReasoningEfforts: p.modelPinnedReasoningEfforts,
@@ -1213,6 +1221,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // call can never fire.
     const submittedContextWindow = Object.hasOwn(prov, "contextWindow");
     const submittedModelContextWindows = Object.hasOwn(prov, "modelContextWindows");
+    const submittedModelContextTiers = Object.hasOwn(prov, "modelContextTiers");
     const submittedModelAutoCompactTokenLimits = Object.hasOwn(prov, "modelAutoCompactTokenLimits");
     const submittedModelDisplayNames = Object.hasOwn(prov, "modelDisplayNames");
     const submittedRequestPacing = Object.hasOwn(prov, "requestPacing");
@@ -1298,7 +1307,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!submittedFastEnabled && liveFastEnabled !== undefined) prov.fastEnabled = liveFastEnabled;
     // The form sends none of the compatibility settings either (#5563). Read the live row rather
     // than `existing`, like the alias overlays below: a PATCH that saved one of them while DNS
-    // validation awaited must not be undone. Nothing is carried to a new destination.
+    // validation awaited must not be undone. Only the hideRawReasoning display policy follows the
+    // provider to a new destination; the upstream compatibility settings do not.
     carryProviderCompatFields(prov, config.providers[name], overwriteSample);
     if (existing?.modelContextWindows) {
       // When the client did send a map, its keys win and the user's other keys survive. When
@@ -1342,48 +1352,51 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         prov.zaiResponsesDefaultVersion = latest.zaiResponsesDefaultVersion;
       }
     }
-    // Reapply pins to the latest live row after DNS/import awaits, then validate the
-    // complete draft before adopting any provider/default state.
+    // Reapply pins after DNS/import awaits; validate the complete draft before adoption.
     const latest = config.providers[name];
     const latestPinError = applyProviderPinFields(prov, body.provider, latest);
     if (latestPinError) return jsonResponse({ error: latestPinError }, 400);
     const pinsOwned = Object.hasOwn(body.provider, "pinnedReasoningEffort")
       || Object.hasOwn(body.provider, "modelPinnedReasoningEfforts")
       || latest?.pinnedReasoningEffort !== undefined || latest?.modelPinnedReasoningEfforts !== undefined;
-    // New registration also edits discovery/disabled-model state; stage those
-    // side effects with the registration draft instead of mutating live state
-    // before validation.
+    // Stage new-registration discovery state in a draft until validation passes.
     const registrationDraft = !latest ? {
       ...config,
       ...(config.modelDiscovery === undefined ? {} : { modelDiscovery: structuredClone(config.modelDiscovery) }),
     } : undefined;
     initializeProviderModelSelection(name, prov, latest, registrationDraft ?? config);
     const candidate = stripRegistryOnlyStaticHeaders(name, prov);
-    const draft = { ...(registrationDraft ?? config), providers: { ...config.providers, [name]: candidate },
-      ...(body.setDefault === true ? { defaultProvider: name } : {}) };
-    const validation = validateConfigCandidate(draft);
-    if (!validation.ok) return jsonResponse({ error: validation.error }, 400);
     const previous = Object.getOwnPropertyDescriptor(config.providers, name);
     const rollback = pinsOwned ? captureConfigTopLevelRollback(config, ["defaultProvider", "modelDiscovery", "disabledModels"]) : undefined;
-    try {
-      if (registrationDraft) {
-        for (const key of ["modelDiscovery", "disabledModels"] as const) {
-          if (Object.hasOwn(registrationDraft, key)) Object.defineProperty(config, key, {
-            value: registrationDraft[key], writable: true, enumerable: true, configurable: true,
-          });
+    let validationError: string | undefined;
+    withConfigMutationLockSync(() => {
+      const liveTiers = config.providers[name]?.modelContextTiers;
+      if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
+      else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
+      else if (!submittedModelContextTiers) delete candidate.modelContextTiers;
+      const draft = { ...(registrationDraft ?? config), providers: { ...config.providers, [name]: candidate }, ...(body.setDefault === true ? { defaultProvider: name } : {}) };
+      const validation = validateConfigCandidate(draft); if (!validation.ok) { validationError = validation.error; return; }
+      try {
+        if (registrationDraft) {
+          for (const key of ["modelDiscovery", "disabledModels"] as const) {
+            if (Object.hasOwn(registrationDraft, key)) Object.defineProperty(config, key, {
+              value: registrationDraft[key], writable: true, enumerable: true, configurable: true,
+            });
+          }
         }
+        config.providers[name] = candidate;
+        if (body.setDefault === true) config.defaultProvider = name;
+        (deps.saveConfigPreservingClaudeCode ?? save)(config);
+      } catch (error) {
+        if (rollback) {
+          if (previous) Object.defineProperty(config.providers, name, previous);
+          else delete config.providers[name];
+          rollback();
+        }
+        throw error;
       }
-      config.providers[name] = candidate;
-      if (body.setDefault === true) config.defaultProvider = name;
-      (deps.saveConfigPreservingClaudeCode ?? save)(config);
-    } catch (error) {
-      if (rollback) {
-        if (previous) Object.defineProperty(config.providers, name, previous);
-        else delete config.providers[name];
-        rollback();
-      }
-      throw error;
-    }
+    });
+    if (validationError !== undefined) return jsonResponse({ error: validationError }, 400);
     reconcileLiveStateStores();
     if (prov.apiKey && prov.apiKeyPool) {
       const { addProviderApiKey } = await import("../../providers/api-keys");

package/src/server/management/route-registry.ts

@@ -103,6 +103,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/codex-auth/login-status", module: "codex/auth-api/routes", mutates: false },
   { method: "GET", path: "/api/codex-auth/quota", module: "codex/auth-api/routes", mutates: false },
   { method: "GET", path: "/api/codex-auth/quota/history", module: "codex/auth-api/routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/low-quota-events", module: "server/management/low-quota-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The authenticated event history is an operator diagnostic with no CLI verb yet.", owner: "rt5 low-quota", ownerDoc: "structure/gui-and-management-api.md" } },
   { method: "GET", path: "/api/codex-auth/reset-credits", module: "codex/auth-api/routes", mutates: false },
   { method: "PATCH", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api/routes", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts", module: "codex/auth-api/routes", mutates: true },

package/src/server/management-api.ts

@@ -149,6 +149,12 @@ async function handleQuotaResetRoutesOnDemand(ctx: ManagementContext): Promise<R
   return handleQuotaResetRoutes(ctx);
 }
 
+async function handleLowQuotaRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/codex-auth/low-quota-events", false)) return null;
+  const { handleLowQuotaRoutes } = await import("./management/low-quota-routes");
+  return handleLowQuotaRoutes(ctx);
+}
+
 /**
  * Lazy like the Lab and routing-profile handlers, and for the same recorded reason: this file is
  * mounted for every dashboard request, so a static import would put the workflow-budget ledger
@@ -328,6 +334,7 @@ export async function handleManagementAPI(
     ??     (await handleLogsUsageRoutes(ctx))
     ??     (await handleRequestHistoryRoutes(ctx))
     ??     (await handleQuotaResetRoutesOnDemand(ctx))
+    ??     (await handleLowQuotaRoutesOnDemand(ctx))
     ??     (await handleWorkflowBudgetRoutesOnDemand(ctx))
     ??     (await handleProtocolRoutesOnDemand(ctx))
     ??     (await handleGrokCouponRoutesOnDemand(ctx))

package/src/server/responses/adapter-continuation.ts

@@ -83,6 +83,7 @@ export function createAdapterContinuations(
     | "oauthDispatch"
     | "invalidateSameTargetRequest"
     | "resolveSelectionAdapter"
+    | "anthropicRouteDecision"
     | "anthropicPoolAccountId"
     | "anthropicPoolFailovers"
     | "anthropicSessionKey"
@@ -178,6 +179,7 @@ export function createAdapterContinuations(
         try {
           continuationRequest = await transportState.activeAdapter.buildRequest(nextParsed, {
             headers: requestState.selectedForwardHeaders,
+            providerName: route.providerName,
             translatorBudget,
             ...(transportState.imageTierBias > 0 ? { imageTierBias: transportState.imageTierBias } : {}),
           });
@@ -398,6 +400,7 @@ export function createAdapterContinuations(
           anthropicSessionKey,
           Date.now(),
           response.headers,
+          transportState.anthropicRouteDecision,
         );
         if (nextAccountId) {
           try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }

package/src/server/responses/adapter-delivery.ts

@@ -153,6 +153,7 @@ export async function deliverAdapterResponse(
         fold: {
           replayCacheScope: parsed._reasoningReplayScope,
           hideThinkingSummary: parsed.options.hideThinkingSummary,
+          hideRawReasoning: parsed.options.hideRawReasoning,
           toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames,
         },
         stallTimeoutSec: config.stallTimeoutSec,
@@ -175,6 +176,7 @@ export async function deliverAdapterResponse(
         stallTimeoutSec: config.stallTimeoutSec,
         localUpstream,
         hideThinkingSummary: parsed.options.hideThinkingSummary,
+        hideRawReasoning: parsed.options.hideRawReasoning,
         declaredToolNames,
         bareCustomToolNames,
         enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
@@ -243,6 +245,7 @@ export async function deliverAdapterResponse(
       translatorBudget,
       replayCacheScope: parsed._reasoningReplayScope,
       hideThinkingSummary: parsed.options.hideThinkingSummary,
+      hideRawReasoning: parsed.options.hideRawReasoning,
       toolNsMap,
       declaredToolNames,
       bareCustomToolNames,

package/src/server/responses/adapter-dispatch.ts

@@ -93,6 +93,7 @@ import {
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { cancelBodyOnAbort } from "../../lib/abort";
 import { chargeWorkflowSends } from "../../lib/workflow-budget";
+import { isAntigravityValidationRefusal } from "./antigravity-validation-refusal";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function prepareAdapterExchange(
@@ -126,6 +127,7 @@ export async function prepareAdapterExchange(
     | "replayOAuthCredentialSnapshot"
     | "invalidateSameTargetRequest"
     | "resolveSelectionAdapter"
+    | "anthropicRouteDecision"
     | "anthropicPoolAccountId"
     | "anthropicPoolFailovers"
     | "anthropicSessionKey"
@@ -268,6 +270,7 @@ export async function prepareAdapterExchange(
   try {
     initialRequest = await transportState.activeAdapter.buildRequest(parsed, {
       headers: requestState.selectedForwardHeaders,
+            providerName: route.providerName,
       translatorBudget,
       abortSignal: upstream.signal,
     });
@@ -413,7 +416,7 @@ export async function prepareAdapterExchange(
     // moments later; at most one byte-identical replay is allowed per request.
     const consoleGoUploadRetryGuard: { attempted: boolean } = { attempted: false };
     let oauth401ReplayAttempted = false;
-    let antigravity401RotationAttempted = false;
+    let antigravityAuthRotationAttempted = false;
     // At most one reasoning-effort downgrade per request. This sits outside the recovery loop
     // below for the same reason the two guards above do: a guard declared inside it is reset by
     // every `continue recovery`, which would let one turn walk the whole ladder down.
@@ -454,6 +457,7 @@ export async function prepareAdapterExchange(
         try {
           retryRequest = await transportState.activeAdapter.buildRequest(parsed, {
             headers: requestState.selectedForwardHeaders,
+            providerName: route.providerName,
             translatorBudget,
             abortSignal: upstream.signal,
             ...(transportState.imageTierBias > 0 ? { imageTierBias: transportState.imageTierBias } : {}),
@@ -665,7 +669,7 @@ export async function prepareAdapterExchange(
           if (route.providerName === "google-antigravity" && err instanceof OAuthLoginRequiredError && failed
             && getAccountSet(route.providerName)?.accounts.some(row =>
               row.id === failed.accountId && row.needsReauth === true)) {
-            antigravity401RotationAttempted = true;
+            antigravityAuthRotationAttempted = true;
             const rotated = await rotateAntigravityAuth(upstreamResponse, "oauth-401");
             if (rotated) { upstreamResponse = rotated; continue recovery; }
           }
@@ -758,13 +762,24 @@ export async function prepareAdapterExchange(
       }
 
       if (route.providerName === "google-antigravity" && upstreamResponse.status === 401
-        && oauth401ReplayAttempted && !antigravity401RotationAttempted
+        && oauth401ReplayAttempted && !antigravityAuthRotationAttempted
         && !isNonReplayableResponse(upstreamResponse)) {
-        antigravity401RotationAttempted = true;
+        antigravityAuthRotationAttempted = true;
         const rotated = await rotateAntigravityAuth(upstreamResponse, "oauth-401");
         if (rotated) { upstreamResponse = rotated; continue recovery; }
       }
 
+      if (route.providerName === "google-antigravity" && upstreamResponse.status === 403
+        && transportState.activeAdapter.name === "google"
+        && antigravityPoolActivated && !antigravityAuthRotationAttempted
+        && !isNonReplayableResponse(upstreamResponse)
+        && transportState.genericFailovers < transportState.genericFailoverLimit
+        && await isAntigravityValidationRefusal(upstreamResponse, options.abortSignal)) {
+        antigravityAuthRotationAttempted = true;
+        const rotated = await rotateAntigravityAuth(upstreamResponse, "oauth-account-403");
+        if (rotated) { upstreamResponse = rotated; continue recovery; }
+      }
+
       // Static API-key pools can recover a credential-scoped 401 without abandoning the
       // provider: one revoked or mistyped key says nothing about its siblings. OAuth providers
       // refresh above and never enter here — `hasKeyPoolFailover` rejects oauth/forward modes.
@@ -959,6 +974,7 @@ export async function prepareAdapterExchange(
           anthropicSessionKey,
           Date.now(),
           upstreamResponse.headers,
+          transportState.anthropicRouteDecision,
         );
         if (!nextAccountId) break;
         try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }

package/src/server/responses/antigravity-validation-refusal.ts

@@ -0,0 +1,20 @@
+import { ANTIGRAVITY_VALIDATION_REQUIRED_PREFIX } from "../../adapters/google-errors";
+import { readBoundedResponseBody } from "../../lib/bounded-body";
+
+/** Inspect only the Google adapter's normalized, already bounded 403 response. */
+export async function isAntigravityValidationRefusal(response: Response, signal?: AbortSignal): Promise<boolean> {
+  if (response.status !== 403 || signal?.aborted) return false;
+  try {
+    const body = await readBoundedResponseBody(response.clone(), {
+      maxBytes: 1024,
+      totalTimeoutMs: 1000,
+      firstByteTimeoutMs: 1000,
+      inactivityTimeoutMs: 1000,
+      signal,
+    });
+    return !signal?.aborted && body.displaySafe && !body.truncated && !body.timedOut && !body.oversized
+      && body.text.startsWith(`${ANTIGRAVITY_VALIDATION_REQUIRED_PREFIX}: `);
+  } catch {
+    return false;
+  }
+}

package/src/server/responses/core-auth.ts

@@ -90,6 +90,7 @@ export function codexRouteCredentialDomainHeaders(
   // caller credential. Bearer admission is substituted or stripped below.
   const routeMayChangeCredentialDomain = options.comboAttempt === true
     || route.routeKind === "policy"
+    || route.credentialDomainRewrite === true
     || credentialDomainWasRewritten;
   if (routeMayChangeCredentialDomain && options.admission?.source !== "bearer") {
     const scoped = new Headers(req.headers);

package/src/server/responses/core-codex-account.ts

@@ -777,6 +777,7 @@ export async function retryCodexPoolOnAlternateAccount(
   }
   const request = await retryAdapter.buildRequest(parsed, {
     headers: retryHeaders,
+    providerName: route.providerName,
     translatorBudget: options.translatorBudget,
   });
   recordAdapterReasoning(logCtx, request);

package/src/server/responses/core-normalize.ts

@@ -176,6 +176,10 @@ export async function applyFinalRouteRequestNormalization(args: {
       || (!summary && !hasValidatedActiveReasoningEffort(parsed.options)
         && route.provider.showThinkingSummary !== true);
   }
+  // Provider policy, recomputed per final route like the summary default above so a fallback
+  // cannot inherit the previous target's choice. Raw content-channel reasoning is suppressed;
+  // provider-authored summaries stay on the summary channel and remain visible.
+  parsed.options.hideRawReasoning = route.provider.hideRawReasoning === true;
   if (preserveAnthropicResponseModel) parsed._responseModelId = responseModelId;
   logCtx.model = virtualModel?.selectedModelId ?? route.modelId;
   logCtx.provider = route.providerName;

package/src/server/responses/passthrough-dispatch.ts

@@ -327,7 +327,11 @@ export async function preparePassthroughExchange(
     const providerExecutedCallTypes = new Set<ProviderExecutedCallType>();
     let request: Awaited<ReturnType<typeof transportState.adapter.buildRequest>>;
     try {
-      request = await transportState.adapter.buildRequest(parsed, { headers: requestState.selectedForwardHeaders, translatorBudget });
+      request = await transportState.adapter.buildRequest(parsed, {
+        headers: requestState.selectedForwardHeaders,
+        providerName: route.providerName,
+        translatorBudget,
+      });
     } catch (error) {
       releaseCodexAuthContextProbeLease(admissionState.authCtx);
       // A tool catalog this proxy cannot lower onto one wire namespace is a client input error, and
@@ -993,6 +997,7 @@ export async function preparePassthroughExchange(
         if (recovery !== "console-go-upload-retry") {
           request = await retryAdapter.buildRequest(parsed, {
             headers: requestState.selectedForwardHeaders,
+          providerName: route.providerName,
             translatorBudget,
           });
         }
@@ -1130,6 +1135,7 @@ export async function preparePassthroughExchange(
       try {
         request = await replayAdapter.buildRequest(parsed, {
           headers: requestState.selectedForwardHeaders,
+          providerName: route.providerName,
           translatorBudget,
         });
         refreshRequestToolAliases(request);
@@ -1274,6 +1280,7 @@ export async function preparePassthroughExchange(
       try {
         request = await refreshedAdapter.buildRequest(parsed, {
           headers: requestState.selectedForwardHeaders,
+          providerName: route.providerName,
           translatorBudget,
         });
         refreshRequestToolAliases(request);

package/src/server/responses/request-sidecar-auth.ts

@@ -3,6 +3,7 @@ import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
 import type { ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { omitEarlierCompactionImages } from "../../responses/compaction-images";
 import {
   shouldResolveOpenAiVisionSidecar,
   resolveOpenAiVisionModel,
@@ -51,6 +52,7 @@ export async function prepareResponsesSidecarAuth(
   const visionDescribeTerminal = options.visionDescribeTerminal === true;
   const routedCompaction = parsed._compactionRequest === true
     && (!isCanonicalOpenAiForwardProvider(route.provider) || parsed._portableCompaction === true);
+  if (routedCompaction) parsed.context.messages = omitEarlierCompactionImages(parsed.context.messages);
   const needsOpenAiVision = !visionDescribeTerminal
     && shouldResolveOpenAiVisionSidecar(config, route.provider, route.modelId, parsed, route.providerName);
   // LOCAL PATCH (runturn-websearch): runTurn adapters can run the web-search