@bitkyc08/opencodex 2.7.39 → 2.7.40-preview.20260725

package/src/adapters/openai-responses.ts

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
 import type { IncomingMeta, ProviderAdapter } from "./base";
-import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../types";
+import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../types";
 import { catalogModelSupportsReasoningSummaries } from "../codex/catalog";
-import { decodeCompactionSummary, SUMMARY_PREFIX } from "../responses/compaction";
+import { COMPACT_PROMPT, decodeCompactionSummary, SUMMARY_PREFIX } from "../responses/compaction";
+import { decodeServerSentEvents } from "../lib/sse-decoder";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 import { OCX_REASONING_PREFIX } from "../responses/reasoning-envelope";
 import { modelRecordValue } from "../reasoning-effort";
 
@@ -518,6 +520,81 @@ function stripUnsupportedHostedTools(body: unknown): unknown {
   return tools.length === body.tools.length ? body : { ...body, tools };
 }
 
+/** Replace every `input_image` part under a routed-compaction body with a short marker. */
+function stripInputImagesDeep(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(stripInputImagesDeep);
+  if (!isPlainObject(value)) return value;
+  if (value.type === "input_image") {
+    return { type: "input_text", text: "[image omitted for compaction]" };
+  }
+  const out: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(value)) out[key] = stripInputImagesDeep(entry);
+  return out;
+}
+
+/**
+ * Rewrite a compaction turn for an upstream that does not speak Codex's private
+ * `compaction_trigger` item: drop the trigger and the whole tool surface, and ask
+ * for the handoff summary in plain terms instead (#422).
+ *
+ * The adapter builds from `parsed._rawBody`, so the summarizer prompt that
+ * handleResponses() pushed onto `parsed.context` never reaches the wire — it has to
+ * be applied here. Images go too: a summary needs no pixels, and a text-only
+ * gateway would reject them.
+ */
+function buildRoutedCompactionBody(body: unknown): unknown {
+  if (!isPlainObject(body)) return body;
+  const { tools: _tools, tool_choice: _toolChoice, parallel_tool_calls: _parallel, ...rest } = body;
+  const input = Array.isArray(body.input) ? body.input : [];
+  const kept = input.filter(item => !isPlainObject(item)
+    // `additional_tools` is how Codex Desktop's responses-lite shape carries tools;
+    // leaving it in would break the no-tools invariant even with `tools` removed.
+    || (item.type !== "compaction_trigger" && item.type !== "additional_tools"));
+  return {
+    ...rest,
+    input: [
+      ...(stripInputImagesDeep(kept) as unknown[]),
+      { type: "message", role: "user", content: [{ type: "input_text", text: COMPACT_PROMPT }] },
+    ],
+  };
+}
+
+/** Read the Responses `usage` block, if the gateway sent one. */
+function usageFromResponsesPayload(payload: unknown): OcxUsage | undefined {
+  if (!isPlainObject(payload) || !isPlainObject(payload.usage)) return undefined;
+  const usage = payload.usage;
+  const inputTokens = typeof usage.input_tokens === "number" ? usage.input_tokens : 0;
+  const outputTokens = typeof usage.output_tokens === "number" ? usage.output_tokens : 0;
+  if (inputTokens === 0 && outputTokens === 0) return undefined;
+  return {
+    inputTokens,
+    outputTokens,
+    ...(typeof usage.total_tokens === "number" ? { totalTokens: usage.total_tokens } : {}),
+  };
+}
+
+function responsesPayloadText(response: unknown): string {
+  if (!isPlainObject(response) || !Array.isArray(response.output)) return "";
+  return response.output
+    .filter(item => isPlainObject(item) && item.type === "message")
+    .flatMap(item => (Array.isArray((item as Record<string, unknown>).content)
+      ? (item as { content: unknown[] }).content
+      : []))
+    .filter(part => isPlainObject(part) && part.type === "output_text")
+    .map(part => String((part as { text?: unknown }).text ?? ""))
+    .join("");
+}
+
+function responsesErrorMessage(payload: unknown): string {
+  if (!isPlainObject(payload)) return "upstream compaction failed";
+  const err = payload.error;
+  if (typeof err === "string") return err;
+  if (isPlainObject(err) && typeof err.message === "string") return err.message;
+  const incomplete = payload.incomplete_details;
+  if (isPlainObject(incomplete) && typeof incomplete.reason === "string") return incomplete.reason;
+  return "upstream compaction failed";
+}
+
 export function createResponsesPassthroughAdapter(provider: OcxProviderConfig): ProviderAdapter & { passthrough: true } {
   return {
     name: "openai-responses",
@@ -573,6 +650,12 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         outBody = repairOversizedReplayCallIds(outBody);
       }
       outBody = stripUnsupportedReasoningSummaryDelivery(outBody, parsed.modelId);
+      // Same predicate as the routedCompaction gate in handleResponses(): an
+      // authMode check would let a noncanonical custom forward provider skip this
+      // rewrite while the server still routes it as a summarizer turn (#422).
+      if (parsed._compactionRequest === true && !isCanonicalOpenAiForwardProvider(provider)) {
+        outBody = buildRoutedCompactionBody(outBody);
+      }
       return {
         url,
         method: "POST",
@@ -585,8 +668,71 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       };
     },
 
-    async *parseStream(): AsyncGenerator<AdapterEvent> {
-      yield { type: "error", message: "passthrough adapter should not parse stream" };
+    // The passthrough normally relays the upstream stream verbatim and never parses.
+    // The exception is a routed compaction turn: the server drives this adapter like
+    // an ordinary one so the bridge can build the single compaction item (#422).
+    async *parseStream(response: Response): AsyncGenerator<AdapterEvent> {
+      if (!response.body) {
+        yield { type: "error", message: "passthrough adapter received no response body" };
+        return;
+      }
+      let deltas = "";
+      let doneText = "";
+      let snapshot = "";
+      let usage: OcxUsage | undefined;
+      for await (const event of decodeServerSentEvents(response.body)) {
+        let payload: unknown;
+        try { payload = JSON.parse(event.data); } catch { continue; }
+        if (!isPlainObject(payload)) continue;
+        switch (payload.type) {
+          case "response.output_text.delta":
+            if (typeof payload.delta === "string") deltas += payload.delta;
+            break;
+          case "response.output_text.done":
+            if (typeof payload.text === "string") doneText += payload.text;
+            break;
+          case "response.failed":
+          case "error":
+            yield { type: "error", message: responsesErrorMessage(payload.response ?? payload) };
+            return;
+          case "response.incomplete":
+            yield { type: "incomplete", reason: responsesErrorMessage(payload.response ?? payload) };
+            return;
+          case "response.completed":
+            snapshot = responsesPayloadText(payload.response);
+            usage = usageFromResponsesPayload(payload.response);
+            break;
+        }
+      }
+      // Gateways differ in which of these they emit; prefer the authoritative
+      // completed snapshot so text is never double-counted.
+      const text = snapshot || doneText || deltas;
+      if (text) yield { type: "text_delta", text };
+      yield { type: "done", ...(usage ? { usage } : {}) };
+    },
+
+    async parseResponse(response: Response): Promise<AdapterEvent[]> {
+      let payload: unknown;
+      try { payload = await response.json(); } catch {
+        return [{ type: "error", message: "malformed upstream compaction response" }];
+      }
+      if (!isPlainObject(payload)) {
+        return [{ type: "error", message: "malformed upstream compaction response" }];
+      }
+      if (payload.error || payload.status === "failed") {
+        return [{ type: "error", message: responsesErrorMessage(payload) }];
+      }
+      if (payload.status === "incomplete") {
+        return [{ type: "incomplete", reason: responsesErrorMessage(payload) }];
+      }
+      const text = responsesPayloadText(payload);
+      if (!text) {
+        // A completed turn with no usable text cannot become a summary; saying so is
+        // better than installing an empty compaction as replacement history.
+        return [{ type: "error", message: "upstream compaction returned no summary text" }];
+      }
+      const usage = usageFromResponsesPayload(payload);
+      return [{ type: "text_delta", text }, { type: "done", ...(usage ? { usage } : {}) }];
     },
   };
 }

package/src/bridge.ts

@@ -456,6 +456,17 @@ export function bridgeToResponsesSSE(
             if (event.type !== "done" && event.type !== "incomplete" && event.type !== "error") continue;
           }
           switch (event.type) {
+            case "assistant_boundary": {
+              // A guarded continuation starts a fresh assistant output item while keeping the
+              // intermediate, suspicious text in the same Responses turn.
+              if (currentMsg) closeCurrentMessage();
+              if (currentReasoning) closeCurrentReasoning();
+              if (currentRawReasoning) closeCurrentRawReasoning();
+              flushHiddenRawReasoning();
+              if (currentToolCall) closeCurrentToolCall();
+              flushHiddenReasoningEnvelope();
+              break;
+            }
             case "text_delta": {
               if (currentReasoning) closeCurrentReasoning();
               if (currentRawReasoning) closeCurrentRawReasoning();
@@ -971,6 +982,12 @@ export function buildResponseJSON(
 
   for (const e of events) {
     switch (e.type) {
+      case "assistant_boundary":
+        flushText();
+        flushSummaryReasoning();
+        flushRawReasoning();
+        flushToolCall();
+        break;
       case "text_delta":
         if (currentText && currentTextPhase !== e.phase) flushText();
         if (currentSummaryReasoning) flushSummaryReasoning();
@@ -1062,7 +1079,9 @@ export function buildResponseJSON(
   flushSummaryReasoning();
   flushRawReasoning();
   flushToolCall();
-  if (options?.compaction && !errorEvent) {
+  // A truncated turn must never be installed as replacement history: emit the
+  // compaction item only when the turn actually completed (#422).
+  if (options?.compaction && !errorEvent && !incompleteEvent && stopReason !== "max_tokens") {
     output.push({ type: "compaction", id: `cmp_${uuid()}`, encrypted_content: encodeCompactionSummary(compactionText) });
   }
 

package/src/claude/outbound.ts

@@ -76,6 +76,43 @@ function sseFrame(name: string, data: Rec): string {
   return `event: ${name}\ndata: ${JSON.stringify(data)}\n\n`;
 }
 
+/**
+ * Claude Code / Anthropic WebSearch domain filters are optional and mutually exclusive.
+ * Empty arrays are rejected ("ambiguous"); both fields together are rejected. Routed models
+ * often emit both shapes — sanitize before Claude Code sees the tool_use / server_tool_use
+ * input (issue #381).
+ */
+export function isClaudeWebSearchToolName(name: string): boolean {
+  const trimmed = name.trim();
+  return trimmed === "WebSearch" || /^web_search/i.test(trimmed);
+}
+
+function normalizeWebSearchDomainList(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const domains = value
+    .filter((entry): entry is string => typeof entry === "string" && entry.trim().length > 0)
+    .map(entry => entry.trim());
+  return domains.length > 0 ? domains : undefined;
+}
+
+/** Strip empty domain filters; if both remain, keep `allowed_domains` and drop `blocked_domains`. */
+export function sanitizeWebSearchInput(input: unknown): Rec {
+  const src: Rec = isRec(input) ? { ...input } : {};
+  const allowed = normalizeWebSearchDomainList(src.allowed_domains);
+  const blocked = normalizeWebSearchDomainList(src.blocked_domains);
+  delete src.allowed_domains;
+  delete src.blocked_domains;
+  if (allowed && blocked) {
+    // Prefer allow-list (restrict-to) when a routed model sets both non-empty fields.
+    src.allowed_domains = allowed;
+  } else if (allowed) {
+    src.allowed_domains = allowed;
+  } else if (blocked) {
+    src.blocked_domains = blocked;
+  }
+  return src;
+}
+
 /**
  * Map a Responses `web_search_call` item to its Anthropic pair: the server_tool_use
  * input (query/queries) and the web_search_tool_result content (hits, or the error
@@ -87,7 +124,9 @@ function webSearchPairFromItem(item: Rec): { id: string; input: Rec; resultConte
     ? action.queries.filter((q): q is string => typeof q === "string" && q.length > 0)
     : [];
   const query = typeof action.query === "string" ? action.query : "";
-  const input: Rec = queries.length > 1 ? { queries } : { query: queries[0] ?? query };
+  const input = sanitizeWebSearchInput(
+    queries.length > 1 ? { queries } : { query: queries[0] ?? query },
+  );
   const completed = item.status !== "failed";
   let resultContent: unknown;
   if (completed) {
@@ -125,6 +164,10 @@ interface OpenBlock {
   index: number;
   /** Responses item_id (tool calls) so output_item.done can match. */
   itemId?: string;
+  /** Buffer WebSearch args and emit one sanitized input_json_delta on close (#381). */
+  bufferWebSearchArgs?: boolean;
+  argsBuf?: string;
+  webSearchArgsEmitted?: boolean;
 }
 
 /** Streaming: Responses SSE bytes -> Anthropic Messages SSE bytes. */
@@ -170,6 +213,19 @@ export function responsesSseToAnthropicSse(
       }
       const closeOpenBlock = () => {
         if (!open) return;
+        if (open.kind === "tool_use" && open.bufferWebSearchArgs && !open.webSearchArgsEmitted) {
+          // Emit sanitized args even if output_item.done never supplied a full arguments field
+          // (finish/fail paths, or deltas-only streams).
+          let parsed: unknown = {};
+          const rawArgs = open.argsBuf ?? "";
+          try { parsed = rawArgs.length > 0 ? JSON.parse(rawArgs) : {}; } catch { parsed = {}; }
+          emit("content_block_delta", {
+            type: "content_block_delta",
+            index: open.index,
+            delta: { type: "input_json_delta", partial_json: JSON.stringify(sanitizeWebSearchInput(parsed)) },
+          });
+          open.webSearchArgsEmitted = true;
+        }
         if (open.kind === "thinking") {
           // Synthetic signature: Claude Code accepts it (003 E6); inbound drops replays anyway.
           emit("content_block_delta", {
@@ -253,21 +309,34 @@ export function responsesSseToAnthropicSse(
             closeOpenBlock();
             sawToolUse = true;
             const index = blockIndex++;
+            const name = typeof item.name === "string" ? item.name : "";
+            const bufferWebSearchArgs = isClaudeWebSearchToolName(name);
             emit("content_block_start", {
               type: "content_block_start", index,
               content_block: {
                 type: "tool_use",
                 id: typeof item.call_id === "string" ? item.call_id : `toolu_${uuid()}`,
-                name: typeof item.name === "string" ? item.name : "",
+                name,
                 input: {},
               },
             });
-            open = { kind: "tool_use", index, itemId: typeof item.id === "string" ? item.id : undefined };
+            open = {
+              kind: "tool_use",
+              index,
+              itemId: typeof item.id === "string" ? item.id : undefined,
+              bufferWebSearchArgs,
+              argsBuf: "",
+              webSearchArgsEmitted: false,
+            };
             break;
           }
           case "response.function_call_arguments.delta": {
             if (typeof data.delta !== "string" || data.delta.length === 0) break;
             if (!open || open.kind !== "tool_use") break;
+            if (open.bufferWebSearchArgs) {
+              open.argsBuf = `${open.argsBuf ?? ""}${data.delta}`;
+              break;
+            }
             emit("content_block_delta", {
               type: "content_block_delta", index: open.index,
               delta: { type: "input_json_delta", partial_json: data.delta },
@@ -307,7 +376,22 @@ export function responsesSseToAnthropicSse(
             if (!open) break;
             // Close the matching open block (message/reasoning items close implicitly on
             // the next block; function_call items must close here so tool input parses).
-            if (open.kind === "tool_use" && item.type === "function_call") closeOpenBlock();
+            if (open.kind === "tool_use" && item.type === "function_call") {
+              if (open.bufferWebSearchArgs && !open.webSearchArgsEmitted) {
+                const rawArgs = typeof item.arguments === "string" && item.arguments.length > 0
+                  ? item.arguments
+                  : (open.argsBuf ?? "");
+                let parsed: unknown = {};
+                try { parsed = rawArgs.length > 0 ? JSON.parse(rawArgs) : {}; } catch { parsed = {}; }
+                emit("content_block_delta", {
+                  type: "content_block_delta",
+                  index: open.index,
+                  delta: { type: "input_json_delta", partial_json: JSON.stringify(sanitizeWebSearchInput(parsed)) },
+                });
+                open.webSearchArgsEmitted = true;
+              }
+              closeOpenBlock();
+            }
             else if (open.kind === "text" && item.type === "message") closeOpenBlock();
             else if (open.kind === "thinking" && item.type === "reasoning") closeOpenBlock();
             break;
@@ -442,11 +526,12 @@ export function responsesJsonToAnthropicMessage(json: unknown, model: string): R
         if (typeof raw.arguments === "string" && raw.arguments.length > 0) {
           try { input = JSON.parse(raw.arguments); } catch { input = {}; }
         }
+        const name = typeof raw.name === "string" ? raw.name : "";
         content.push({
           type: "tool_use",
           id: typeof raw.call_id === "string" ? raw.call_id : `toolu_${uuid()}`,
-          name: typeof raw.name === "string" ? raw.name : "",
-          input,
+          name,
+          input: isClaudeWebSearchToolName(name) ? sanitizeWebSearchInput(input) : input,
         });
         break;
       }

package/src/codex/auth-api.ts

@@ -19,11 +19,19 @@ import {
   getAccountQuota,
   listAccountQuotas,
   parseUsageQuota,
+  setAccountQuotaFromParsed,
   updateAccountQuota,
   type StoredAccountQuota,
   type WhamUsageResponse,
 } from "./quota";
-export { clearAccountQuota, getAccountQuota, parseUsageQuota, updateAccountQuota } from "./quota";
+export {
+  applyAccountQuotaFromUpstreamHeaders,
+  clearAccountQuota,
+  getAccountQuota,
+  parseUsageQuota,
+  setAccountQuotaFromParsed,
+  updateAccountQuota,
+} from "./quota";
 import { extractAccountId, decodeJwtPayload } from "../oauth/chatgpt";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { maskEmail } from "../lib/privacy";
@@ -280,14 +288,7 @@ export async function fetchMainAccountInfo(forceRefresh = false): Promise<{ emai
     // score and auto-switch the main account exactly like a pool account (Option A).
     setMainAccountPlan(result.plan);
     if (result.quota) {
-      updateAccountQuota(
-        MAIN_CODEX_ACCOUNT_ID,
-        result.quota.weeklyPercent,
-        result.quota.weeklyResetAt,
-        result.quota.monthlyPercent,
-        result.quota.monthlyResetAt,
-        result.quota.resetCredits,
-      );
+      setAccountQuotaFromParsed(MAIN_CODEX_ACCOUNT_ID, result.quota);
     }
     return result;
   } catch {
@@ -327,14 +328,7 @@ async function fetchPoolAccountQuota(accountId: string, forceRefresh = false, co
     const data = (await resp.json()) as WhamUsageResponse;
     const quota = parseUsageQuota({ ...data, plan_type: data.plan_type ?? configuredPlan });
     if (!quota) return { quota: existing ?? null, needsReauth: false };
-    updateAccountQuota(
-      accountId,
-      quota.weeklyPercent,
-      quota.weeklyResetAt,
-      quota.monthlyPercent,
-      quota.monthlyResetAt,
-      quota.resetCredits,
-    );
+    setAccountQuotaFromParsed(accountId, quota);
     return { quota: getAccountQuota(accountId), needsReauth: false };
   } catch (e) {
     if (e instanceof CodexCredentialGenerationConflictError || e instanceof CodexCredentialRefreshLockTimeoutError) return { quota: existing ?? null, needsReauth: false };
@@ -767,14 +761,7 @@ export async function handleCodexAuthAPI(
               markCodexAccountValidated(accountId, warmup.validatedAt);
               clearAccountNeedsReauth(accountId);
               if (quota) {
-                updateAccountQuota(
-                  accountId,
-                  quota.weeklyPercent,
-                  quota.weeklyResetAt,
-                  quota.monthlyPercent,
-                  quota.monthlyResetAt,
-                  quota.resetCredits,
-                );
+                setAccountQuotaFromParsed(accountId, quota);
               }
 
               const latestConfig = getRuntimeConfig(config);

package/src/codex/auth-context.ts

@@ -9,6 +9,8 @@ import { isCodexAccountUsable } from "./account-usability";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken } from "./main-account";
 import {
   getCodexAccountCooldownUntil,
+  releaseCodexQuotaProbeLease,
+  tryAcquireCodexQuotaProbeLease,
   pickLowestUsageCodexAccount,
   resolveCodexAccountForThreadDetailed,
 } from "./routing";
@@ -24,6 +26,12 @@ export type CodexAuthContext =
       generation: number;
       accessToken: string;
       chatgptAccountId: string;
+      /**
+       * Set when this request was admitted through an active quota cooldown as
+       * the account's single probe. Must be echoed into the upstream outcome so
+       * only this request can clear the cooldown (#433).
+       */
+      probeLeaseId?: string;
     }
   | {
       // Main Codex account participating in rotation: token injected from ~/.codex/auth.json
@@ -32,8 +40,24 @@ export type CodexAuthContext =
       accountId: string;
       accessToken: string;
       chatgptAccountId: string;
+      /** See `pool.probeLeaseId`. */
+      probeLeaseId?: string;
     };
 
+/** Probe lease carried by this context, when it holds one. */
+export function codexProbeLeaseId(ctx: CodexAuthContext | undefined): string | undefined {
+  return ctx?.kind === "pool" || ctx?.kind === "main-pool" ? ctx.probeLeaseId : undefined;
+}
+
+/**
+ * Hand back a probe lease for a request that will not reach upstream. Safe to
+ * call with a context that holds no lease.
+ */
+export function releaseCodexAuthContextProbeLease(ctx: CodexAuthContext | undefined): void {
+  const leaseId = codexProbeLeaseId(ctx);
+  if (ctx && leaseId) releaseCodexQuotaProbeLease(ctx.accountId!, leaseId);
+}
+
 export type OcxRuntimeProviderConfig = OcxProviderConfig & {
   _codexAccountOverride?: { accessToken: string; chatgptAccountId: string };
   _codexAccountRequired?: boolean;
@@ -130,13 +154,30 @@ export async function resolveCodexAuthContext(
       .catch(() => {});
   }
   const cooldownUntil = getCodexAccountCooldownUntil(accountId);
-  if (cooldownUntil) throw new CodexAccountCooldownError(accountId, cooldownUntil);
+  // A cooled-down account never sends traffic, so upstream recovery can never be
+  // observed and the cooldown outlives the real limit. Admit one probe per
+  // interval; its outcome decides whether the cooldown ends (#433).
+  let probeLeaseId: string | undefined;
+  if (cooldownUntil) {
+    probeLeaseId = tryAcquireCodexQuotaProbeLease(accountId) ?? undefined;
+    if (!probeLeaseId) throw new CodexAccountCooldownError(accountId, cooldownUntil);
+  }
 
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     // Main account in rotation: inject the read-only auth.json token and fail closed if it vanished.
     const token = getMainAccountToken();
-    if (!token) throw new CodexPoolAuthenticationError();
-    return { kind: "main-pool", accountId, accessToken: token.accessToken, chatgptAccountId: token.chatgptAccountId };
+    if (!token) {
+      // Nothing will reach upstream, so give the probe back instead of burning it.
+      if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
+      throw new CodexPoolAuthenticationError();
+    }
+    return {
+      kind: "main-pool",
+      accountId,
+      accessToken: token.accessToken,
+      chatgptAccountId: token.chatgptAccountId,
+      ...(probeLeaseId ? { probeLeaseId } : {}),
+    };
   }
 
   try {
@@ -147,8 +188,10 @@ export async function resolveCodexAuthContext(
       generation: token.generation,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
+      ...(probeLeaseId ? { probeLeaseId } : {}),
     };
   } catch (cause) {
+    if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
     if (shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {
       markAccountNeedsReauth(accountId);
     }
@@ -158,6 +201,8 @@ export async function resolveCodexAuthContext(
 
 export function assertCodexAuthContextNotCooled(ctx: CodexAuthContext | undefined): void {
   if (ctx?.kind !== "pool" && ctx?.kind !== "main-pool") return;
+  // A context holding the probe lease was deliberately admitted through the cooldown.
+  if (ctx.probeLeaseId) return;
   const cooldownUntil = getCodexAccountCooldownUntil(ctx.accountId);
   if (cooldownUntil) throw new CodexAccountCooldownError(ctx.accountId, cooldownUntil);
 }