@bitkyc08/opencodex 2.7.30 → 2.7.33-preview.20260722

package/src/server/management-api.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../codex/catalog";
 import { invalidateCodexModelsCache, nativeModelRows } from "../codex/catalog";
@@ -46,7 +47,7 @@ import {
   setDebugSettings,
   type DebugFlag,
 } from "../lib/debug-settings";
-import type { OcxClaudeCodeConfig, OcxConfig, OcxProviderConfig } from "../types";
+import type { OcxClaudeCodeConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../types";
 import { drainAndShutdown } from "./lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "./request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../usage/cost";
@@ -798,9 +799,26 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
       native: true,
       ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
     }));
-    return jsonResponse([...native, ...models.map(m => {
+    const customModels = (config.customModels ?? []).map(cm => {
+      const namespaced = routedSlug(cm.provider, cm.modelId);
+      return {
+        provider: cm.provider,
+        id: cm.modelId,
+        namespaced,
+        disabled: [...disabled].some(stored => slugEquals(stored, cm.provider, cm.modelId)),
+        custom: true,
+        customId: cm.id,
+        displayName: cm.displayName,
+        ...(cm.contextWindow ? { contextWindow: cm.contextWindow } : {}),
+        ...(cm.inputModalities ? { inputModalities: cm.inputModalities } : {}),
+      };
+    });
+    // Custom metadata wins when a live/static routed row resolves to the same Codex-facing slug.
+    const customNamespaced = new Set(customModels.map(c => c.namespaced));
+    const dedupedRouted = models.map(m => {
       // Codex-facing slug (one "/", slug-codec); disabledModels compares tolerate both forms.
       const namespaced = routedSlug(m.provider, m.id);
+      if (customNamespaced.has(namespaced)) return null;
       const contextCap = providerContextCap(config, m.provider);
       return {
         ...m,
@@ -808,7 +826,8 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
         disabled: [...disabled].some(stored => slugEquals(stored, m.provider, m.id)),
         ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
       };
-    })]);
+    }).filter(Boolean);
+    return jsonResponse([...native, ...dedupedRouted, ...customModels]);
   }
 
   if (url.pathname === "/api/provider-context-caps" && req.method === "GET") {
@@ -880,6 +899,96 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     return jsonResponse({ ok: true, disabled });
   }
 
+  if (url.pathname === "/api/custom-models" && req.method === "GET") {
+    return jsonResponse(config.customModels ?? []);
+  }
+
+  if (url.pathname === "/api/custom-models" && req.method === "POST") {
+    let body: { provider?: unknown; modelId?: unknown; displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const provider = typeof body.provider === "string" ? body.provider.trim() : "";
+    const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
+    if (!provider || !modelId) return jsonResponse({ error: "provider and modelId are required" }, 400);
+    if (modelId.includes("/")) return jsonResponse({ error: "modelId must not contain /" }, 400);
+    if (!isValidProviderName(provider)) return jsonResponse({ error: "invalid provider name" }, 400);
+    if (!hasOwnProvider(config.providers, provider)) return jsonResponse({ error: "provider not configured" }, 404);
+    const displayName = typeof body.displayName === "string" && body.displayName.trim() ? body.displayName.trim() : undefined;
+    if (displayName?.includes("/")) return jsonResponse({ error: "displayName must not contain /" }, 400);
+    const contextWindow = typeof body.contextWindow === "number" && body.contextWindow > 0 ? Math.floor(body.contextWindow) : undefined;
+    const inputModalities = Array.isArray(body.inputModalities) ? body.inputModalities.filter((m): m is string => typeof m === "string") : undefined;
+    const existing = config.customModels ?? [];
+    const newSlug = routedSlug(provider, modelId);
+    if (existing.some(cm => routedSlug(cm.provider, cm.modelId) === newSlug)) {
+      return jsonResponse({ error: "duplicate model" }, 409);
+    }
+    const entry: OcxCustomModel = {
+      id: randomUUID(),
+      provider,
+      modelId,
+      ...(displayName ? { displayName } : {}),
+      ...(contextWindow ? { contextWindow } : {}),
+      ...(inputModalities && inputModalities.length > 0 ? { inputModalities } : {}),
+      addedAt: new Date().toISOString(),
+    };
+    config.customModels = [...existing, entry];
+    const { saveConfig: save } = await import("../config");
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse(entry, 201);
+  }
+
+  const customPutMatch = url.pathname.match(/^\/api\/custom-models\/([^/]+)$/);
+  if (customPutMatch && req.method === "PUT") {
+    let id: string;
+    try { id = decodeURIComponent(customPutMatch[1]); } catch { return jsonResponse({ error: "invalid id encoding" }, 400); }
+    let body: { displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown; modelId?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const list = config.customModels ?? [];
+    const idx = list.findIndex(cm => cm.id === id);
+    if (idx === -1) return jsonResponse({ error: "not found" }, 404);
+    const cm = { ...list[idx] };
+    if (typeof body.modelId === "string" && body.modelId.trim()) {
+      if (body.modelId.includes("/")) return jsonResponse({ error: "modelId must not contain /" }, 400);
+      cm.modelId = body.modelId.trim();
+    }
+    if (body.displayName !== undefined) {
+      const dn = typeof body.displayName === "string" ? body.displayName.trim() : "";
+      if (dn.includes("/")) return jsonResponse({ error: "displayName must not contain /" }, 400);
+      cm.displayName = dn || undefined;
+    }
+    if (body.contextWindow !== undefined) {
+      cm.contextWindow = typeof body.contextWindow === "number" && body.contextWindow > 0 ? Math.floor(body.contextWindow) : undefined;
+    }
+    if (body.inputModalities !== undefined) {
+      cm.inputModalities = Array.isArray(body.inputModalities) ? body.inputModalities.filter((m): m is string => typeof m === "string") : undefined;
+    }
+    const updatedSlug = routedSlug(cm.provider, cm.modelId);
+    if (list.some((other, i) => i !== idx && routedSlug(other.provider, other.modelId) === updatedSlug)) {
+      return jsonResponse({ error: "duplicate model" }, 409);
+    }
+    list[idx] = cm;
+    config.customModels = list;
+    const { saveConfig: save } = await import("../config");
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse(cm);
+  }
+
+  const customDelMatch = url.pathname.match(/^\/api\/custom-models\/([^/]+)$/);
+  if (customDelMatch && req.method === "DELETE") {
+    let id: string;
+    try { id = decodeURIComponent(customDelMatch[1]); } catch { return jsonResponse({ error: "invalid id encoding" }, 400); }
+    const list = config.customModels ?? [];
+    const idx = list.findIndex(cm => cm.id === id);
+    if (idx === -1) return jsonResponse({ error: "not found" }, 404);
+    list.splice(idx, 1);
+    config.customModels = list.length > 0 ? list : undefined;
+    const { saveConfig: save } = await import("../config");
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ ok: true });
+  }
+
   // multi_agent_v2 surface toggle. GET reports the flag + the agents.max_threads
   // boot conflict; PUT flips it via the official `codex features` CLI and RESYNCS
   // the catalog so multi-agent surface metadata stays fresh. The catalog build
@@ -1375,18 +1484,18 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
         }
       }
       // addAccount / reauth forces a fresh browser identity (skips local-CLI token import).
-      const { url: authUrl, instructions } = await startLoginFlow(provider, {
+      const { url: authUrl, instructions, deviceCode } = await startLoginFlow(provider, {
         forceLogin: body.addAccount === true || reauth,
         ...(accountId ? { reauthAccountId: accountId } : {}),
       });
       upsertOAuthProvider(config, provider); // mutate LIVE config — routing sees it without restart
-      if (authUrl) {
+      if (authUrl && !deviceCode) {
         // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
         // window.open is popup-blocked because it runs after an await, not a direct click.
         const { openUrl } = await import("../lib/open-url");
         openUrl(authUrl);
       }
-      return jsonResponse({ url: authUrl, instructions });
+      return jsonResponse({ url: authUrl, instructions, deviceCode });
     } catch (err) {
       return jsonResponse({ error: err instanceof Error ? err.message : String(err) }, 409);
     }
@@ -1454,6 +1563,20 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     clearProviderQuotaCache();
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
   }
+  if (url.pathname === "/api/oauth/accounts/alias" && req.method === "PUT") {
+    const body = await req.json().catch(() => ({})) as { provider?: unknown; accountId?: unknown; alias?: unknown };
+    const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
+    const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
+    const alias = typeof body.alias === "string" ? body.alias.trim() : "";
+    if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    if (!accountId) return jsonResponse({ error: "missing accountId" }, 400);
+    if (typeof body.alias !== "string" || alias.length > 80 || /[\x00-\x1f\x7f]/.test(alias)) {
+      return jsonResponse({ error: "alias must be at most 80 printable characters" }, 400);
+    }
+    const { setAccountAlias } = await import("../oauth/store");
+    if (!(await setAccountAlias(provider, accountId, alias || undefined))) return jsonResponse({ error: "account not found" }, 404);
+    return jsonResponse({ ok: true, provider, accountId, alias: alias || null });
+  }
   if (url.pathname === "/api/oauth/accounts" && req.method === "DELETE") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     const id = url.searchParams.get("id") ?? "";
@@ -1507,6 +1630,20 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     clearKeyCooldowns(name); // manual key management resets 429 cooldown state
     return jsonResponse({ ok: true, name, activeId: body.id });
   }
+  if (url.pathname === "/api/providers/keys/alias" && req.method === "PUT") {
+    const body = await req.json().catch(() => ({})) as { name?: unknown; id?: unknown; alias?: unknown };
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    const alias = typeof body.alias === "string" ? body.alias.trim() : "";
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    if (!id) return jsonResponse({ error: "missing id" }, 400);
+    if (typeof body.alias !== "string" || alias.length > 80 || /[\x00-\x1f\x7f]/.test(alias)) {
+      return jsonResponse({ error: "alias must be at most 80 printable characters" }, 400);
+    }
+    const { setProviderApiKeyLabel } = await import("../providers/api-keys");
+    if (!setProviderApiKeyLabel(config, name, id, alias || undefined)) return jsonResponse({ error: "key not found" }, 404);
+    return jsonResponse({ ok: true, name, id, alias: alias || null });
+  }
   if (url.pathname === "/api/providers/keys" && req.method === "DELETE") {
     const name = (url.searchParams.get("name") ?? "").trim();
     const id = url.searchParams.get("id") ?? "";

package/src/server/relay.ts

@@ -406,7 +406,7 @@ export function relaySseWithHeartbeat(
  */
 export function consumeForInspection(
   body: ReadableStream<Uint8Array>,
-  onTerminal: (status: ResponsesTerminalStatus) => void,
+  onTerminal: (status: ResponsesTerminalStatus, httpStatusOverride?: number) => void,
   signal?: AbortSignal,
   onDone?: () => void,
   logCtx?: RequestLogContext,
@@ -451,14 +451,24 @@ export function consumeForInspection(
             reportFirstOutput(payload);
             if (payload) {
               const status = terminalStatusFromSsePayload(payload);
-              if (status) { reported = true; onTerminal(status); }
+              if (status) {
+                reported = true;
+                if (logCtx) {
+                  logCtx.transportPhase = "terminal_sse";
+                  logCtx.terminalSource = "upstream";
+                }
+                onTerminal(status);
+              }
               if (onCompletedResponse) {
                 const response = completedResponseFromSsePayload(payload);
                 if (response) onCompletedResponse(response);
               }
             }
           }
-          if (!reported && !cancelled) onTerminal("incomplete");
+          if (!reported && !cancelled) {
+            if (logCtx) logCtx.terminalSource = "synthetic";
+            onTerminal("incomplete");
+          }
           return;
         }
         buffer += decoder.decode(value, { stream: true });
@@ -472,7 +482,14 @@ export function consumeForInspection(
           if (!payload) continue;
           if (!reported) {
             const status = terminalStatusFromSsePayload(payload);
-            if (status) { reported = true; onTerminal(status); }
+            if (status) {
+              reported = true;
+              if (logCtx) {
+                logCtx.transportPhase = "terminal_sse";
+                logCtx.terminalSource = "upstream";
+              }
+              onTerminal(status);
+            }
           }
           if (onCompletedResponse) {
             const response = completedResponseFromSsePayload(payload);
@@ -481,7 +498,16 @@ export function consumeForInspection(
         }
       }
     } catch {
-      if (!reported && !cancelled) onTerminal("incomplete");
+      // Upstream read failure after HTTP 200 (mid-stream socket reset) is not a
+      // protocol `response.incomplete` terminal. Report a synthetic 502 so account
+      // health treats it as transient; abort-driven client cancellation still wins.
+      if (!reported && !cancelled) {
+        if (logCtx) {
+          logCtx.transportPhase = "mid_stream";
+          logCtx.terminalSource = "synthetic";
+        }
+        onTerminal("failed", 502);
+      }
     } finally {
       onDone?.();
     }

package/src/server/request-log.ts

@@ -62,6 +62,9 @@ export interface RequestLogContext {
   upstreamError?: string;
   /** HTTP status derived from a terminal `response.failed` SSE payload (429/401/503/etc.). */
   terminalHttpStatus?: number;
+  affinity?: "reused" | "new_bind" | "rebound" | "cleared";
+  transportPhase?: "pre_headers" | "mid_stream" | "terminal_sse";
+  terminalSource?: "upstream" | "synthetic";
 }
 
 export interface RequestLogEntry {
@@ -92,6 +95,12 @@ export interface RequestLogEntry {
   usage?: OcxUsage;
   totalTokens?: number;
   attempts?: PersistedUsageAttempt[];
+  /** Codex pool affinity decision for this request (diagnostics for #186). */
+  affinity?: "reused" | "new_bind" | "rebound" | "cleared";
+  /** Where the upstream terminal/failure was observed. */
+  transportPhase?: "pre_headers" | "mid_stream" | "terminal_sse";
+  /** Whether the terminal came from a real upstream SSE event or a proxy synthetic tail. */
+  terminalSource?: "upstream" | "synthetic";
 }
 
 const requestLog: RequestLogEntry[] = [];
@@ -587,6 +596,9 @@ export function addFinalRequestLog(
     ...(loggedUsage ? { usage: loggedUsage } : {}),
     ...(totalTokens !== undefined ? { totalTokens } : {}),
     ...(attempts?.length ? { attempts } : {}),
+    ...(logCtx.affinity ? { affinity: logCtx.affinity } : {}),
+    ...(logCtx.transportPhase ? { transportPhase: logCtx.transportPhase } : {}),
+    ...(logCtx.terminalSource ? { terminalSource: logCtx.terminalSource } : {}),
   });
   if (isUsageDebugEnabled()) {
     appendUsageDebug({

package/src/server/responses.ts

@@ -6,7 +6,7 @@ import {
 } from "../config";
 import { parseRequest } from "../responses/parser";
 import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractCompactUserMessages } from "../responses/compaction";
-import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../adapters/openai-responses";
 import { expandPreviousResponseInput, previousResponseConversationId, rememberResponseState } from "../responses/state";
 import { routeModel } from "../router";
 import {
@@ -55,7 +55,7 @@ import {
   recordCodexUpstreamOutcome,
   type CodexUpstreamOutcome,
 } from "../codex/routing";
-import { fetchWithResetRetry, fetchWithTransientRetry } from "../lib/upstream-retry";
+import { fetchWithResetRetry, fetchWithTransientRetry, applyUpstreamRecoveryInit } from "../lib/upstream-retry";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../providers/openai-sidecar";
 import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../providers/openai-virtual-models";
@@ -69,6 +69,7 @@ import type { WsData } from "./ws-bridge";
 import { registerTurn, trackStreamLifetime, unregisterTurn } from "./lifecycle";
 import { redactSecretString } from "../lib/redact";
 import { readBoundedResponseBody } from "../lib/bounded-body";
+import { supportedLadderFor } from "./effort-policy";
 import {
   beginRequestAttempt,
   catalogModelSupportsServiceTier,
@@ -395,9 +396,13 @@ export function sanitizeEncryptedContentInPlace(input: unknown): number {
   return rewritten;
 }
 
-export function sidecarOutcomeRecorder(config: OcxConfig, authCtx: CodexAuthContext): ((outcome: CodexUpstreamOutcome) => void) | undefined {
+export function sidecarOutcomeRecorder(
+  config: OcxConfig,
+  authCtx: CodexAuthContext,
+  threadId?: string | null,
+): ((outcome: CodexUpstreamOutcome) => void) | undefined {
   return authCtx.kind === "pool" || authCtx.kind === "main-pool"
-    ? outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome)
+    ? outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, { threadId })
     : undefined;
 }
 
@@ -418,9 +423,32 @@ export function codexForwardTerminalOutcomeRecorder(
   config: OcxConfig,
   authCtx: CodexAuthContext,
   provider: OcxProviderConfig,
-): ((status: ResponsesTerminalStatus) => void) | undefined {
+  logCtx?: RequestLogContext,
+  threadId?: string | null,
+): ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined {
   if (!usesCodexForwardPoolAuth(authCtx, provider)) return undefined;
-  return status => recordCodexUpstreamOutcome(config, authCtx.accountId, status === "completed" ? 200 : 502);
+  return (status, httpStatusOverride) => {
+    if (status === "incomplete") {
+      // Normal limit/content-filter/stall terminal — the account served the
+      // request. Don't penalize account health; record success to clear any
+      // prior soft-avoid so a healthy account isn't stuck avoided.
+      recordCodexUpstreamOutcome(config, authCtx.accountId, 200, { threadId });
+      return;
+    }
+    // status === "completed" or "failed": use the semantic HTTP status derived
+    // from the terminal SSE error payload (httpStatusFromTerminalError in
+    // request-log inspection) instead of collapsing every non-completed terminal
+    // to 502. A 400 invalid_request_error must not soft-avoid the account or
+    // rebind threads — only genuine transport/5xx failures should trigger
+    // transient health recording.
+    // httpStatusOverride: the combo WS path inspects SSE payloads into the parent
+    // logCtx, but this recorder closes over the child logCtx. The caller passes
+    // the parent's terminalHttpStatus so the semantic status is not lost.
+    const outcome = status === "completed"
+      ? 200
+      : (httpStatusOverride ?? logCtx?.terminalHttpStatus ?? 502);
+    recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, { threadId });
+  };
 }
 
 /**
@@ -466,7 +494,7 @@ interface HandleResponsesOptions {
   onFirstOutput?: () => void;
   onCodexAuthContextResolved?: (context: CodexAuthContext | undefined) => void;
   recordTerminalOutcomes?: boolean;
-  setTerminalOutcomeRecorder?: (recorder: ((status: ResponsesTerminalStatus) => void) | undefined) => void;
+  setTerminalOutcomeRecorder?: (recorder: ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined) => void;
   onNativePassthroughTerminal?: (status: ResponsesTerminalStatus) => void;
   onNativePassthroughCancel?: () => void;
   /** Internal recursion guard; callers outside this module must not set it. */
@@ -562,6 +590,15 @@ function createChildPassthroughCallbackGate(options: HandleResponsesOptions) {
   };
 }
 
+export function buildComboChildHeaders(parentHeaders: HeadersInit): Headers {
+  const childHeaders = new Headers(parentHeaders);
+  // Combo children re-serialize already-decoded JSON. Keeping transport metadata from
+  // the parent would make the child decoder treat plain JSON as compressed bytes.
+  childHeaders.delete("content-length");
+  childHeaders.delete("content-encoding");
+  return childHeaders;
+}
+
 async function handleComboResponses(
   req: Request,
   rawBody: unknown,
@@ -595,20 +632,21 @@ async function handleComboResponses(
       model: pick.target.model,
       provider: pick.target.provider,
     };
+    const targetRoute = routeModel(config, `${pick.target.provider}/${pick.target.model}`);
     const childBody = concreteComboRequestBody(
       rawBody,
       pick.target,
       comboDefaultEffort(config, comboId),
+      supportedLadderFor({ provider: targetRoute.provider, modelId: targetRoute.modelId }),
     );
-    const childHeaders = new Headers(req.headers);
-    childHeaders.delete("content-length");
+    const childHeaders = buildComboChildHeaders(req.headers);
     const childRequest = new Request(req.url, {
       method: req.method,
       headers: childHeaders,
       body: JSON.stringify(childBody),
     });
     let resolvedAuth: CodexAuthContext | undefined;
-    let terminalRecorder: ((status: ResponsesTerminalStatus) => void) | undefined;
+    let terminalRecorder: ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined;
     const started = Date.now();
     const attempt = beginRequestAttempt(
       (logCtx.attempts?.length ?? 0) + 1,
@@ -1092,11 +1130,11 @@ export async function handleResponses(
       upstreamResponse = await fetchWithTransientRetry(
         recovery => {
           noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recovery);
-          return fetchWithHeaderTimeout(request.url, {
+          return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
             method: request.method,
             headers: request.headers,
             body: request.body,
-          }, upstream.signal, connectMs, parsed.stream, providerFetch(route.provider));
+          }, recovery), upstream.signal, connectMs, parsed.stream, providerFetch(route.provider));
         },
         { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
       );
@@ -1104,7 +1142,11 @@ export async function handleResponses(
       upstream.abort();
       if (options.abortSignal?.aborted) return clientCancelledResponse();
       const outcome = err instanceof Error && err.name === "TimeoutError" ? "timeout" : "connect_error";
-      if (usesCodexForwardPoolAuth(authCtx, route.provider)) recordCodexUpstreamOutcome(config, authCtx.accountId, outcome);
+      if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
+        recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+          threadId: req.headers.get("x-codex-parent-thread-id"),
+        });
+      }
       const msg = outcome === "timeout"
         ? `Provider connect timeout after ${connectMs}ms`
         : `Provider unreachable: ${err instanceof Error ? err.message : String(err)}`;
@@ -1122,7 +1164,13 @@ export async function handleResponses(
     const passthroughCt = headers.get("content-type")?.toLowerCase();
     const isEventStream = passthroughCt?.includes("text/event-stream")
       || (upstreamResponse.ok && !!upstreamResponse.body && !passthroughCt && parsed.stream);
-    const terminalRecorder = codexForwardTerminalOutcomeRecorder(config, authCtx, route.provider);
+    const terminalRecorder = codexForwardTerminalOutcomeRecorder(
+      config,
+      authCtx,
+      route.provider,
+      logCtx,
+      req.headers.get("x-codex-parent-thread-id"),
+    );
     const terminalBodyWillRecord = !!terminalRecorder && upstreamResponse.ok && isEventStream;
     // Capture quota from upstream response for multi-account tracking
    if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
@@ -1148,14 +1196,15 @@ export async function handleResponses(
         );
       }
       if (terminalBodyWillRecord) {
-        options.setTerminalOutcomeRecorder?.(status => {
-          terminalRecorder(status);
+        options.setTerminalOutcomeRecorder?.((status, httpStatusOverride) => {
+          terminalRecorder(status, httpStatusOverride);
           options.onNativePassthroughTerminal?.(status);
         });
       } else {
         recordCodexUpstreamOutcome(config, authCtx.accountId, upstreamResponse.status, {
         retryAfter: retryAfterRaw,
          resetAt: [primaryResetRaw, secondaryResetRaw, monthlyResetRaw].filter(Boolean),
+         threadId: req.headers.get("x-codex-parent-thread-id"),
         });
       }
     }
@@ -1174,8 +1223,8 @@ export async function handleResponses(
         // even if the client has already disconnected: the turn genuinely reached that terminal, so
         // it must log as completed/failed, not be dropped or downgraded to a cancel (#44). A pure
         // client-cancel (no terminal seen) is finalized separately via consumeForInspection's onCancel.
-        const reportNativeTerminal = (status: ResponsesTerminalStatus) => {
-          terminalRecorder?.(status);
+        const reportNativeTerminal = (status: ResponsesTerminalStatus, httpStatusOverride?: number) => {
+          terminalRecorder?.(status, httpStatusOverride);
           options.onNativePassthroughTerminal?.(status);
         };
         consumeForInspection(
@@ -1390,9 +1439,11 @@ export async function handleResponses(
       upstreamResponse = await fetchWithResetRetry(
         recovery => {
           noteAttemptSend(logCtx.activeAttempt, inputTokenEstimate, recovery);
-          return fetchWithHeaderTimeout(request.url, {
-            method: request.method, headers: request.headers, body: request.body,
-          }, upstream.signal, connectMs, parsed.stream, providerFetch(route.provider));
+          return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
+            method: request.method,
+            headers: request.headers,
+            body: request.body,
+          }, recovery), upstream.signal, connectMs, parsed.stream, providerFetch(route.provider));
         },
         { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
       );
@@ -1710,10 +1761,11 @@ export async function handleResponsesCompact(
     // headers would run compaction on the wrong account (or 401) whenever a pool account is
     // active for this thread while normal turns succeed.
     let compactProvider = route.provider;
+    let authCtx: CodexAuthContext = { kind: "main", accountId: null };
     const headers = new Headers({ "content-type": "application/json" });
     try {
       if (route.codexAccountMode) {
-        const authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode);
+        authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode);
         const selected = headersForCodexAuthContext(req.headers, authCtx);
         compactProvider = applyCodexAuthContextToProvider(route.provider, authCtx, route.codexAccountMode);
         for (const name of FORWARD_HEADERS) {
@@ -1743,20 +1795,64 @@ export async function handleResponsesCompact(
     }
     const base = (compactProvider.baseUrl ?? "").replace(/\/$/, "");
     if (compactProvider.apiKey) headers.set("authorization", `Bearer ${resolveEnvValue(compactProvider.apiKey)}`);
-    const { reasoning: _reasoning, ...compactBody } = raw as typeof raw & { reasoning?: unknown };
+    const { reasoning: _reasoning, ...compactBodyRaw } = raw as typeof raw & { reasoning?: unknown };
+    // The regular /v1/responses path applies sanitizeReasoningInputContent via the adapter's
+    // buildRequest, but the compact endpoint forwards directly. Apply the same sanitizer here
+    // so routed-model reasoning items (reasoning_text content) don't 400 the ChatGPT backend.
+    const compactBody = sanitizeReasoningInputContent(compactBodyRaw) as typeof compactBodyRaw;
+    const compactUrl = `${base}/responses/compact`;
+    const compactThreadId = req.headers.get("x-codex-parent-thread-id");
+    const connectMs = config.connectTimeoutMs ?? 200_000;
+    const recordCompactPoolOutcome = (outcome: CodexUpstreamOutcome, meta: { retryAfter?: string | null } = {}) => {
+      if (!usesCodexForwardPoolAuth(authCtx, route.provider)) return;
+      recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+        ...meta,
+        threadId: compactThreadId,
+      });
+    };
     let upstream: Response;
     try {
-      upstream = await fetch(`${base}/responses/compact`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({ ...compactBody, model: route.modelId }),
-        signal: req.signal,
-      });
-    } catch {
+      // Same connect timeout + keep-alive reset + transient-5xx recovery as /v1/responses —
+      // compact hits the same ChatGPT host and must soft-avoid / clear affinity (#186).
+      upstream = await fetchWithTransientRetry(
+        recovery => fetchWithHeaderTimeout(
+          compactUrl,
+          applyUpstreamRecoveryInit({
+            method: "POST",
+            headers,
+            body: JSON.stringify({ ...compactBody, model: route.modelId }),
+          }, recovery),
+          req.signal,
+          connectMs,
+          false,
+          providerFetch(compactProvider),
+        ),
+        { abortSignal: req.signal, label: safeHostLabel(compactUrl) },
+      );
+    } catch (err) {
       if (req.signal.aborted) return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+      const outcome = err instanceof Error && err.name === "TimeoutError" ? "timeout" : "connect_error";
+      recordCompactPoolOutcome(outcome);
       return formatErrorResponse(502, "upstream_error", "Failed to connect to compact upstream");
     }
-    return bufferCompactResponse(upstream, req.signal);
+    const retryAfter = upstream.headers.get("retry-after");
+    const buffered = await bufferCompactResponse(upstream, req.signal);
+    // Record pool health only after the body is fully delivered (or definitively failed).
+    // A premature 200 would clear soft-avoid while the client still sees a buffer 502.
+    if (buffered.status === 499) {
+      return buffered;
+    }
+    if (upstream.ok && buffered.status >= 500) {
+      // The upstream account returned 200 — it is healthy. The buffering failure
+      // (oversized body exceeding COMPACT_RESPONSE_MAX_BYTES, or a rare mid-read
+      // reset on a small JSON payload) is a local proxy issue, not account flakiness.
+      // Record the upstream status so a deterministic payload-size limit does not
+      // soft-avoid a healthy account and rotate a thread for 30s.
+      recordCompactPoolOutcome(upstream.status, { retryAfter });
+    } else {
+      recordCompactPoolOutcome(upstream.status, { retryAfter });
+    }
+    return buffered;
   }
 
   // ROUTED model: run the v2 synthetic-compaction turn internally (appends COMPACT_PROMPT, no

package/src/service.ts

@@ -503,7 +503,7 @@ function installWindows(): void {
       throw new Error(`Cannot remove the native service before switching to Task Scheduler: ${err instanceof Error ? err.message : String(err)}. Remove it manually with 'sc delete ${WINSW_SERVICE_ID}' or retry.`);
     }
     if (statusWinswRaw() !== "nonexistent") {
-      throw new Error("Native service still present after removal attempt — aborting switch. Remove it manually with 'sc delete opencodex-proxy-native'.");
+      throw new Error(`Native service registration could not be re-verified after the removal attempt — aborting switch. Check 'sc.exe query ${WINSW_SERVICE_ID}' and remove it manually if present.`);
     }
   }
   // End a running task BEFORE rewriting the assets it is executing — cmd.exe reading the
@@ -761,7 +761,9 @@ export function stopServiceIfInstalled(): boolean {
       const q = schtasks(["/query", "/tn", TASK]);
       if (q.includes(TASK)) { stopWindows(); stopped = true; }
     } catch { /* task not found */ }
-    if (statusWinswRaw() !== "nonexistent") { stopWinswService(); stopped = true; }
+    if (statusWinswRaw() !== "nonexistent") {
+      try { stopWinswService(); stopped = true; } catch { /* best-effort */ }
+    }
     if (stopped) return true;
   } else if (process.platform === "linux" && isSystemd() && existsSync(unitPath())) {
     try { stopSystemd(); return true; } catch { return false; }
@@ -793,7 +795,14 @@ export function uninstallServiceIfInstalled(): boolean {
       const q = schtasks(["/query", "/tn", TASK]);
       if (q.includes(TASK)) { uninstallWindows(); removed = true; }
     } catch { /* task not found */ }
-    if (statusWinswRaw() !== "nonexistent") { uninstallWinswService(); removed = true; }
+    if (statusWinswRaw() !== "nonexistent") {
+      try {
+        uninstallWinswService();
+        removed = true;
+      } catch (err) {
+        console.warn(`⚠️  Failed to remove native service: ${err instanceof Error ? err.message : String(err)}. Check 'sc.exe query ${WINSW_SERVICE_ID}'.`);
+      }
+    }
     if (removed) { removeServiceInstallState(); return true; }
   } else if (process.platform === "linux" && existsSync(unitPath())) {
     try { uninstallSystemd(); removeServiceInstallState(); return true; } catch {