@bitkyc08/opencodex 2.7.39 → 2.7.40-preview.20260725

package/src/providers/openai-sidecar.ts

@@ -95,7 +95,14 @@ export async function resolveFirstUsableOpenAiSidecar(
       authContext,
       headers: headersForCodexAuthContext(incomingHeaders, authContext),
       ...(authContext.kind === "pool" || authContext.kind === "main-pool"
-        ? { recordOutcome: (outcome: CodexUpstreamOutcome) => recordCodexUpstreamOutcome(config, authContext.accountId, outcome) }
+        ? {
+          recordOutcome: (outcome: CodexUpstreamOutcome) => recordCodexUpstreamOutcome(
+            config,
+            authContext.accountId,
+            outcome,
+            { probeLeaseId: authContext.probeLeaseId },
+          ),
+        }
         : {}),
     };
   }

package/src/providers/openai-tiers.ts

@@ -35,6 +35,24 @@ export function isCanonicalOpenAiForwardProvider(provider: OcxProviderConfig): b
     && normalizedBaseUrl(provider.baseUrl) === CODEX_FORWARD_BASE_URL;
 }
 
+const OPENAI_API_BASE_URL = "https://api.openai.com/v1";
+
+/**
+ * Whether this provider can serve `POST /responses/compact`. The canonical ChatGPT
+ * backend can, and so can the official OpenAI API — but an arbitrary gateway that
+ * merely speaks the Responses wire cannot, and calling it there fails compaction
+ * with an unhelpful error instead of falling back to a routed summary (#422).
+ */
+export function supportsNativeResponsesCompactEndpoint(
+  providerName: string,
+  provider: OcxProviderConfig,
+): boolean {
+  if (isCanonicalOpenAiForwardProvider(provider)) return true;
+  return providerName === OPENAI_API_PROVIDER_ID
+    && provider.adapter === "openai-responses"
+    && normalizedBaseUrl(provider.baseUrl) === OPENAI_API_BASE_URL;
+}
+
 export interface OpenAiTierMigrationProjection {
   config: OcxConfig;
   changed: boolean;

package/src/server/adapter-resolve.ts

@@ -7,18 +7,32 @@ import { createMimoFreeAdapter } from "../adapters/mimo-free";
 import { createOpenAIChatAdapter } from "../adapters/openai-chat";
 import { createResponsesPassthroughAdapter } from "../adapters/openai-responses";
 import type { OcxProviderConfig } from "../types";
+import { isWirePinnedModel, MODEL_ADAPTER_OVERRIDE_ALLOWED, pinnedWireAdapter } from "../types";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 
-/** Providers whose listed model ids must be driven over the Anthropic wire even if the provider's
- *  configured adapter is something else (the upstream only speaks Anthropic for these models). */
-const ANTHROPIC_WIRE_MODELS: Record<string, Set<string>> = {
-  "opencode-go": new Set(["minimax-m2.5", "minimax-m2.7", "minimax-m3"]),
-};
-
-/** Return a provider config whose adapter is forced to "anthropic" when the model id is wire-pinned. */
+/**
+ * Resolve the wire a single model should use: a hard pin first, then a configured
+ * per-model override, then the provider's own adapter.
+ *
+ * Safe to call more than once on its own output — the pin check does not look at the
+ * current adapter, so a second pass cannot let an override displace a pin.
+ */
 export function resolveWireProtocolOverride(providerName: string, modelId: string, providerConfig: OcxProviderConfig): OcxProviderConfig {
-  const overrideSet = ANTHROPIC_WIRE_MODELS[providerName];
-  if (overrideSet?.has(modelId) && providerConfig.adapter !== "anthropic") {
-    return { ...providerConfig, adapter: "anthropic" };
+  const pinned = pinnedWireAdapter(providerName, modelId);
+  if (pinned && providerConfig.adapter !== pinned) {
+    return { ...providerConfig, adapter: pinned };
+  }
+  // Re-check the allow-list here, not just in the config validator: the file may have
+  // been hand-edited, or written by a build that allowed more values.
+  const requested = providerConfig.modelAdapters?.[modelId];
+  if (requested
+    && MODEL_ADAPTER_OVERRIDE_ALLOWED.has(requested)
+    && requested !== providerConfig.adapter
+    && !isWirePinnedModel(providerName, modelId)
+    // A forward provider hands the caller's own credential upstream; the chat adapter
+    // only ever sends provider.apiKey, so switching wires here would drop the auth.
+    && !isCanonicalOpenAiForwardProvider(providerConfig)) {
+    return { ...providerConfig, adapter: requested };
   }
   return providerConfig;
 }

package/src/server/auth-cors.ts

@@ -2,6 +2,7 @@ import { timingSafeEqual } from "node:crypto";
 import { formatErrorResponse } from "../bridge";
 import {
   booleanRecordConfigError,
+  modelAdapterRecordConfigError,
   codexAutoStartEnabled,
   positiveIntegerConfigError,
   positiveIntegerRecordConfigError,
@@ -234,6 +235,8 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (maxInputError) return `provider ${name} ${maxInputError}`;
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
+  const modelAdaptersError = modelAdapterRecordConfigError(raw.modelAdapters, "modelAdapters", name, typed);
+  if (modelAdaptersError) return `provider ${name} ${modelAdaptersError}`;
   const defaultMaxOutputError = positiveIntegerConfigError(raw.defaultMaxOutputTokens, "defaultMaxOutputTokens");
   if (defaultMaxOutputError) return `provider ${name} ${defaultMaxOutputError}`;
   const maxOutputError = positiveIntegerRecordConfigError(raw.modelMaxOutputTokens, "modelMaxOutputTokens");

package/src/server/chat-completions.ts

@@ -16,6 +16,7 @@ import {
 } from "../chat/outbound";
 import { estimateTokens } from "../lib/token-estimate";
 import { routeModel } from "../router";
+import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
 import {
@@ -68,6 +69,9 @@ export async function handleChatCompletions(
   let directRoute = false;
   try {
     const route = routeModel(config, internalBody.model as string);
+    // Settle the wire once so every branch below reads the adapter this model will
+    // actually use, not the provider-wide default (#404).
+    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider);
     logCtx.model = route.modelId;
     logCtx.providerAdapter = route.provider.adapter;
     logCtx.requestedModel = requestedModel;

package/src/server/claude-messages.ts

@@ -23,6 +23,7 @@ import {
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
 import { routeModel } from "../router";
+import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
 import { addFinalRequestLog, httpStatusForTerminalStatus, recordFirstOutput, type RequestLogContext, type RequestLogEntry } from "./request-log";
@@ -570,6 +571,9 @@ export async function handleClaudeMessages(
   let nativeRoute = false;
   try {
     const route = routeModel(config, internalBody.model as string);
+    // Settle the wire once so the sampling decision below reads the effective
+    // adapter rather than the provider-wide default (#404).
+    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider);
     if (route.provider.adapter === "openai-responses") {
       nativeRoute = true;
       delete internalBody.max_output_tokens;

package/src/server/index.ts

@@ -122,7 +122,7 @@ import { handleChatCompletions } from "./chat-completions";
 import { anthropicErrorResponse } from "../claude/outbound";
 import { buildDesktop3pRegistry } from "../claude/desktop-3p";
 import { handleImages } from "./images";
-import { handleLive, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "./live";
+import { handleLive, logLiveSidebandFrame, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "./live";
 import { handleSearch } from "./search";
 import { fetchAllModels, handleManagementAPI, VERSION } from "./management-api";
 
@@ -185,6 +185,7 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
   });
   upstream.addEventListener("message", (event) => {
     try {
+      logLiveSidebandFrame("u2c", event.data);
       if (typeof event.data === "string") ws.send(event.data);
       else if (event.data instanceof ArrayBuffer) ws.send(event.data);
       else if (ArrayBuffer.isView(event.data)) {
@@ -679,6 +680,7 @@ export function startServer(port?: number) {
       },
       message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
         if (ws.data.kind === "live-sideband") {
+          logLiveSidebandFrame("c2u", raw);
           const upstream = ws.data.liveUpstream;
           if (!upstream || upstream.readyState === WebSocket.CONNECTING || !ws.data.liveOpened) {
             const pending = ws.data.livePending ?? (ws.data.livePending = []);

package/src/server/live.ts

@@ -20,6 +20,7 @@
  * - `GET /v1/realtime/calls/{callId}` — path-form join
  * - `GET /v1/realtime?call_id=` — Realtime v1/v2 join
  */
+import { appendFileSync } from "node:fs";
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
@@ -69,6 +70,61 @@ export const LIVE_CLIENT_PROTOCOL_HEADERS = [
   "x-oai-attestation",
 ] as const;
 
+/**
+ * Env-gated sideband frame forensics (diagnostic for multibyte transcript corruption).
+ *
+ * When `OCX_LIVE_FRAME_LOG` is set to a file path, every relayed sideband frame appends one
+ * JSONL record: direction, frame kind, byte length, and whether the payload contains U+FFFD.
+ * Privacy: full frame payloads are never written — only when U+FFFD is present, a short
+ * excerpt around the first replacement character is included so the corruption point can be
+ * attributed (upstream vs relay vs client). Disabled entirely when the env var is unset.
+ */
+export const LIVE_FRAME_LOG_ENV = "OCX_LIVE_FRAME_LOG";
+const LIVE_FRAME_LOG_CONTEXT_CHARS = 24;
+
+function fffdContext(text: string): string | undefined {
+  const idx = text.indexOf("\uFFFD");
+  if (idx < 0) return undefined;
+  const start = Math.max(0, idx - LIVE_FRAME_LOG_CONTEXT_CHARS);
+  const end = Math.min(text.length, idx + LIVE_FRAME_LOG_CONTEXT_CHARS);
+  return text.slice(start, end);
+}
+
+export function logLiveSidebandFrame(dir: "c2u" | "u2c", data: unknown): void {
+  const logPath = process.env[LIVE_FRAME_LOG_ENV];
+  if (!logPath) return;
+  try {
+    let kind: "text" | "binary" = "binary";
+    let bytes = 0;
+    let context: string | undefined;
+    if (typeof data === "string") {
+      kind = "text";
+      bytes = Buffer.byteLength(data);
+      context = fffdContext(data);
+    } else if (data instanceof ArrayBuffer) {
+      bytes = data.byteLength;
+      context = fffdContext(new TextDecoder().decode(new Uint8Array(data)));
+    } else if (ArrayBuffer.isView(data)) {
+      const view = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+      bytes = data.byteLength;
+      context = fffdContext(new TextDecoder().decode(view));
+    } else {
+      return;
+    }
+    const record = {
+      ts: new Date().toISOString(),
+      dir,
+      kind,
+      bytes,
+      fffd: context !== undefined,
+      ...(context !== undefined ? { context } : {}),
+    };
+    appendFileSync(logPath, `${JSON.stringify(record)}\n`);
+  } catch {
+    // Frame forensics must never break the relay.
+  }
+}
+
 function clientProtocolHeaders(reqHeaders: Headers): Record<string, string> {
   const out: Record<string, string> = {};
   for (const name of LIVE_CLIENT_PROTOCOL_HEADERS) {

package/src/server/memory-watchdog.ts

@@ -39,7 +39,7 @@ const DEFAULT_INTERVAL_MS = 60_000;
 const DEFAULT_WARN_THRESHOLD_BYTES = 4 * 1024 ** 3; // 4 GiB
 const DEFAULT_RING_SIZE = 360; // ≈6h at 60s
 const WARN_INTERVAL_MS = 30 * 60_000;
-const DOCS_URL = "https://lidge-jun.github.io/opencodex/troubleshooting/windows-memory/";
+const DOCS_URL = "https://opencodex.me/troubleshooting/windows-memory/";
 
 let active: MemoryWatchdog | null = null;
 

package/src/server/responses/compact.ts

@@ -49,6 +49,7 @@ import {
   headersForCodexAuthContext,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
+  codexProbeLeaseId,
   type CodexAuthContext,
 } from "../../codex/auth-context";
 import {
@@ -59,7 +60,7 @@ import {
 import { fetchWithResetRetry, fetchWithTransientRetry, applyUpstreamRecoveryInit } from "../../lib/upstream-retry";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
 import { slugsEquivalent } from "../../providers/slug-codec";
 import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
 import { isUsageDebugEnabled } from "../../usage/debug";
@@ -202,7 +203,10 @@ export async function handleResponsesCompact(
     }
   }
 
-  if (route.provider.adapter === "openai-responses") {
+  // Native /responses/compact exists on the canonical ChatGPT backend and on the
+  // official OpenAI API. Any other Responses-shaped gateway must take the routed
+  // summarizer path below, or compaction fails against an endpoint it never had (#422).
+  if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider)) {
     // Native ChatGPT/OpenAI model: forward the compact request verbatim to the real backend.
     // Resolve the SAME pool/thread auth context as /v1/responses — forwarding the caller's raw
     // headers would run compaction on the wrong account (or 401) whenever a pool account is
@@ -255,6 +259,7 @@ export async function handleResponsesCompact(
       recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
         ...meta,
         threadId: compactThreadId,
+        probeLeaseId: codexProbeLeaseId(authCtx),
       });
     };
     let upstream: Response;
@@ -322,21 +327,46 @@ export async function handleResponsesCompact(
   });
   const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal });
   if (!response.ok) return response;
-  let json: { output?: unknown[] };
+  let json: { output?: unknown[]; status?: unknown; error?: unknown };
   try {
-    json = await response.json() as { output?: unknown[] };
+    json = await response.json() as { output?: unknown[]; status?: unknown; error?: unknown };
   } catch {
     return formatErrorResponse(502, "server_error", "compaction turn returned a non-JSON response");
   }
-  const compactionItem = (json.output ?? []).find(
+  // The internal turn answers 200 even when it failed or was truncated, so the body
+  // has to be inspected. Reporting a failure beats installing "(no summary
+  // available)" as replacement history and silently losing the conversation (#422).
+  if (json.error) {
+    const message = typeof json.error === "string"
+      ? json.error
+      : (json.error as { message?: unknown })?.message;
+    return formatErrorResponse(502, "upstream_error", typeof message === "string" ? message : "compaction turn failed");
+  }
+  if (json.status !== "completed") {
+    return formatErrorResponse(
+      502,
+      "upstream_error",
+      `compaction turn did not complete (status: ${String(json.status ?? "unknown")})`,
+    );
+  }
+  const compactionItems = (json.output ?? []).filter(
     (item): item is { type: string; encrypted_content?: string } =>
       !!item && typeof item === "object" && (item as { type?: string }).type === "compaction",
   );
-  const summary = compactionItem?.encrypted_content
-    ? decodeCompactionSummary(compactionItem.encrypted_content) ?? ""
-    : "";
+  if (compactionItems.length !== 1) {
+    return formatErrorResponse(
+      502,
+      "invalid_response_error",
+      `compaction turn produced ${compactionItems.length} compaction items, expected exactly 1`,
+    );
+  }
+  const encrypted = compactionItems[0]!.encrypted_content;
+  const decoded = typeof encrypted === "string" ? decodeCompactionSummary(encrypted) : null;
+  // An empty `ocx1:` envelope decodes to "" rather than null, so length is what matters.
+  if (decoded === null || decoded.trim().length === 0) {
+    return formatErrorResponse(502, "invalid_response_error", "compaction turn produced an empty summary");
+  }
+  const summary = decoded;
   const output = buildCompactV1Output(extractCompactUserMessages(inputItems), summary);
   return new Response(JSON.stringify({ output }), { headers: { "Content-Type": "application/json" } });
 }
-
-

package/src/server/responses/core.ts

@@ -49,6 +49,8 @@ import {
   headersForCodexAuthContext,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
+  codexProbeLeaseId,
+  releaseCodexAuthContextProbeLease,
   stripCodexRuntimeProviderFields,
   type CodexAuthContext,
 } from "../../codex/auth-context";
@@ -105,6 +107,7 @@ import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/cat
 import { buildToolBridgeMaps, collabSurface, injectDeveloperMessage, multiAgentGuidanceText } from "./collaboration";
 import { hasUnreadableEncryptedAgentTask, looksLikeBackendCiphertext, sanitizeEncryptedContentInPlace } from "./encrypted-payload";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel } from "./fetch-helpers";
+import { guardTerminalEventStream } from "./terminal-guard";
 
 /**
  * Adapters whose continuation state must survive Codex's store:false requests.
@@ -119,7 +122,10 @@ export function sidecarOutcomeRecorder(
   threadId?: string | null,
 ): ((outcome: CodexUpstreamOutcome) => void) | undefined {
   return authCtx.kind === "pool" || authCtx.kind === "main-pool"
-    ? outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, { threadId })
+    ? outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+      threadId,
+      probeLeaseId: authCtx.probeLeaseId,
+    })
     : undefined;
 }
 
@@ -206,7 +212,10 @@ export function codexForwardTerminalOutcomeRecorder(
       // Normal limit/content-filter/stall terminal — the account served the
       // request. Don't penalize account health; record success to clear any
       // prior soft-avoid so a healthy account isn't stuck avoided.
-      recordCodexUpstreamOutcome(config, authCtx.accountId, 200, { threadId });
+      recordCodexUpstreamOutcome(config, authCtx.accountId, 200, {
+        threadId,
+        probeLeaseId: codexProbeLeaseId(authCtx),
+      });
       return;
     }
     // status === "completed" or "failed": use the semantic HTTP status derived
@@ -221,7 +230,10 @@ export function codexForwardTerminalOutcomeRecorder(
     const outcome = status === "completed"
       ? 200
       : (httpStatusOverride ?? logCtx?.terminalHttpStatus ?? 502);
-    recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, { threadId });
+    recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+      threadId,
+      probeLeaseId: codexProbeLeaseId(authCtx),
+    });
   };
 }
 
@@ -720,6 +732,10 @@ export async function handleResponses(
     }
     parsed.modelId = route.modelId;
   }
+  // Settle the wire once, right after the native model id is known, so logging,
+  // fast-mode injection, auth, and sidecar decisions all read the adapter this
+  // request will actually use rather than the provider-wide default (#404).
+  route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider);
   logCtx.model = route.modelId;
   logCtx.provider = route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
@@ -851,6 +867,8 @@ export async function handleResponses(
     throw err;
   }
   if (!isCodexAuthContextUsable(authCtx, config)) {
+    // Nothing reaches upstream on this path, so give the probe back.
+    releaseCodexAuthContextProbeLease(authCtx);
     return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
   }
   route.provider = applyCodexAuthContextToProvider(route.provider, authCtx, route.codexAccountMode);
@@ -973,7 +991,12 @@ export async function handleResponses(
   // one `{type:"compaction"}` output item (codex-rs compact_remote_v2.rs). Passthrough handles it
   // natively upstream; here we run the routed model as a plain summarizer — no tools, no web-search
   // sidecar — and the bridge appends the synthetic compaction item (src/responses/compaction.ts).
-  const routedCompaction = parsed._compactionRequest === true && !("passthrough" in adapter && adapter.passthrough);
+  // A Responses-shaped wire does not imply support for Codex's private
+  // `compaction_trigger` item — only the canonical ChatGPT backend speaks that
+  // contract. An API-key gateway would receive the trigger, answer with an ordinary
+  // message, and leave Codex fataling on a missing compaction item (#422).
+  const routedCompaction = parsed._compactionRequest === true
+    && !isCanonicalOpenAiForwardProvider(route.provider);
   if (routedCompaction) {
     delete parsed.context.tools;
     delete parsed._webSearch;
@@ -982,7 +1005,7 @@ export async function handleResponses(
     parsed.context.messages.push({ role: "user", content: COMPACT_PROMPT, timestamp: Date.now() });
   }
 
-  if ("passthrough" in adapter && adapter.passthrough) {
+  if ("passthrough" in adapter && adapter.passthrough && !routedCompaction) {
     // Local continuation cache for the ChatGPT passthrough. Codex WS turns chain with
     // previous_response_id, ocx converts them to internal HTTP requests, and the ChatGPT Codex
     // REST backend rejects the parameter — the adapter strips it in forward mode, so the ONLY
@@ -1025,6 +1048,7 @@ export async function handleResponses(
       if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
         recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
           threadId: req.headers.get("x-codex-parent-thread-id"),
+          probeLeaseId: codexProbeLeaseId(authCtx),
         });
       }
       const msg = outcome === "timeout"
@@ -1079,6 +1103,7 @@ export async function handleResponses(
       if (retryAuthCtx?.kind === "pool" || retryAuthCtx?.kind === "main-pool") {
         recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, 400, {
           threadId: req.headers.get("x-codex-parent-thread-id"),
+          probeLeaseId: codexProbeLeaseId(firstAuthCtx),
         });
 
         const retryHeaders = headersForCodexAuthContext(req.headers, retryAuthCtx);
@@ -1147,25 +1172,9 @@ export async function handleResponses(
    if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
       // primary was the 5h window; it now carries weekly data for GPT plans.
       // Prefer primary when present, fall back to secondary for compatibility.
-      const primaryRaw = upstreamResponse.headers.get("x-codex-primary-used-percent");
-      const secondaryRaw = upstreamResponse.headers.get("x-codex-secondary-used-percent");
-      const weeklyRaw = primaryRaw ?? secondaryRaw;
-      const monthlyRaw = upstreamResponse.headers.get("x-codex-tertiary-used-percent");
-      const primaryResetRaw = upstreamResponse.headers.get("x-codex-primary-reset-at");
-      const secondaryResetRaw = upstreamResponse.headers.get("x-codex-secondary-reset-at");
-      const weeklyResetRaw = primaryRaw ? primaryResetRaw : secondaryResetRaw;
-      const monthlyResetRaw = upstreamResponse.headers.get("x-codex-tertiary-reset-at");
       const retryAfterRaw = upstreamResponse.headers.get("retry-after");
-      if (weeklyRaw || monthlyRaw) {
-        const { updateAccountQuota } = await import("../../codex/auth-api");
-        updateAccountQuota(
-          authCtx.accountId,
-          weeklyRaw,
-          weeklyResetRaw,
-          monthlyRaw,
-          monthlyResetRaw,
-        );
-      }
+      const { applyAccountQuotaFromUpstreamHeaders } = await import("../../codex/auth-api");
+      applyAccountQuotaFromUpstreamHeaders(authCtx.accountId, upstreamResponse.headers);
       if (terminalBodyWillRecord) {
         options.setTerminalOutcomeRecorder?.((status, httpStatusOverride) => {
           terminalRecorder(status, httpStatusOverride);
@@ -1174,8 +1183,13 @@ export async function handleResponses(
       } else {
         recordCodexUpstreamOutcome(config, authCtx.accountId, upstreamResponse.status, {
         retryAfter: retryAfterRaw,
-         resetAt: [primaryResetRaw, secondaryResetRaw, monthlyResetRaw].filter(Boolean),
+         resetAt: [
+           upstreamResponse.headers.get("x-codex-primary-reset-at"),
+           upstreamResponse.headers.get("x-codex-secondary-reset-at"),
+           upstreamResponse.headers.get("x-codex-tertiary-reset-at"),
+         ].filter(Boolean),
          threadId: req.headers.get("x-codex-parent-thread-id"),
+         probeLeaseId: codexProbeLeaseId(authCtx),
         });
       }
     }
@@ -1634,8 +1648,136 @@ export async function handleResponses(
 
   cancelBodyOnAbort(upstreamResponse.body, upstream.signal);
 
+  // Claude can return a clean end_turn after announcing an edit without emitting any tool call.
+  // Keep the normal request/recovery path above intact, and use this bounded callback only for the
+  // one internal continuation pass. A continuation failure becomes an in-stream adapter error so
+  // the client never sees a second hidden HTTP response or an unbounded retry loop.
+  const terminalGuardEnabled = activeAdapter.name === "anthropic" && !options.comboAttempt && !routedCompaction;
+  const fetchTerminalGuardContinuation = async function* (nextParsed: OcxParsedRequest): AsyncGenerator<AdapterEvent> {
+    let imageTierBias = 0;
+    let response: Response | undefined;
+    while (true) {
+      try {
+        const continuationRequest = await activeAdapter.buildRequest(nextParsed, {
+          headers: selectedForwardHeaders,
+          ...(imageTierBias > 0 ? { imageTierBias } : {}),
+        });
+        const continuationEstimate = typeof continuationRequest.usageLog?.inputTokens === "number"
+          ? continuationRequest.usageLog.inputTokens
+          : undefined;
+        if (continuationEstimate !== undefined) logCtx.usageLogInputTokens = continuationEstimate;
+        if (activeAdapter.fetchResponse) {
+          noteAttemptSend(logCtx.activeAttempt, continuationEstimate);
+          response = await activeAdapter.fetchResponse(continuationRequest, {
+              abortSignal: upstream.signal,
+              timeoutMs: connectMs,
+              stream: nextParsed.stream,
+            });
+        } else {
+          response = await fetchWithResetRetry(
+              recovery => {
+                noteAttemptSend(logCtx.activeAttempt, continuationEstimate, recovery);
+                return fetchWithHeaderTimeout(
+                  continuationRequest.url,
+                  applyUpstreamRecoveryInit({
+                    method: continuationRequest.method,
+                    headers: continuationRequest.headers,
+                    body: continuationRequest.body,
+                  }, recovery),
+                  upstream.signal,
+                  connectMs,
+                  nextParsed.stream,
+                  providerFetch(route.provider),
+                );
+              },
+              { abortSignal: upstream.signal, label: safeHostLabel(continuationRequest.url) },
+            );
+        }
+      } catch (error) {
+        if (options.abortSignal?.aborted) {
+          yield { type: "error", message: "client closed request during terminal continuation", status: 499 };
+        } else {
+          yield { type: "error", message: `Provider continuation failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+        return;
+      }
+
+      if (response.status === 429 && hasKeyPoolFailover(route.provider)) {
+        const rotated = rotateProviderTransportOn429(config, route.providerName, {
+          retryAfter: response.headers.get("retry-after"),
+          now: Date.now(),
+          attemptedKey: route.provider.apiKey,
+          promptCacheKey: nextParsed.options.promptCacheKey,
+        });
+        if (rotated) {
+          try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+          route.provider = rotated;
+          activeAdapter = resolveAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider),
+            config.cacheRetention,
+          );
+          continue;
+        }
+      }
+      if (shouldAttemptImageTierRetry({
+        status: response.status,
+        adapterName: activeAdapter.name,
+        parsed: nextParsed,
+        alreadyAttempted: imageTierBias > 0,
+      })) {
+        imageTierBias = 1;
+        try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+        continue;
+      }
+      break;
+    }
+
+    if (!response.ok) {
+      const errorText = await response.text().catch(() => "unknown error");
+      yield {
+        type: "error",
+        status: response.status,
+        message: `Provider continuation error ${response.status}: ${redactSecretString(errorText.slice(0, 500))}`,
+      };
+      return;
+    }
+
+    try {
+      // Protect the continuation body against a client abort landing between fetch resolution and
+      // reader attach, exactly as the initial response is guarded above (#390/366e3053). Without
+      // this, a client cancel during the continuation reopens the Bun fetch-to-reader abort race.
+      const detachContinuationBodyGuard = cancelBodyOnAbort(response.body, upstream.signal);
+      try {
+        if (nextParsed.stream) {
+          yield* activeAdapter.parseStream(response);
+        } else if (activeAdapter.parseResponse) {
+          yield* await activeAdapter.parseResponse(response);
+        } else {
+          yield { type: "error", message: "Provider continuation does not support response parsing" };
+        }
+      } finally {
+        detachContinuationBodyGuard();
+      }
+    } catch (error) {
+      if (options.abortSignal?.aborted) {
+        yield { type: "error", message: "client closed request during terminal continuation", status: 499 };
+      } else {
+        yield { type: "error", message: `Provider continuation parse failed: ${redactSecretString(error instanceof Error ? error.message : String(error))}` };
+      }
+    }
+  };
+
   if (parsed.stream) {
-    const eventStream = activeAdapter.parseStream(upstreamResponse);
+    const initialEventStream = activeAdapter.parseStream(upstreamResponse);
+    const eventStream = terminalGuardEnabled
+      ? guardTerminalEventStream({
+          parsed,
+          firstEvents: initialEventStream,
+          adapterName: activeAdapter.name,
+          maxAutoContinuations: 1,
+          continuation: fetchTerminalGuardContinuation,
+        })
+      : initialEventStream;
     const { toolNsMap, freeformToolNames, toolSearchToolNames } = buildToolBridgeMaps(parsed);
     const sseStream = bridgeToResponsesSSE(
       eventStream, parsed.modelId, toolNsMap, freeformToolNames, toolSearchToolNames,
@@ -1670,7 +1812,19 @@ export async function handleResponses(
   if (activeAdapter.parseResponse) {
     let events: AdapterEvent[];
     try {
-      events = await activeAdapter.parseResponse(upstreamResponse);
+      const initialEvents = await activeAdapter.parseResponse(upstreamResponse);
+      if (terminalGuardEnabled) {
+        events = [];
+        for await (const event of guardTerminalEventStream({
+          parsed,
+          firstEvents: (async function* () { yield* initialEvents; })(),
+          adapterName: activeAdapter.name,
+          maxAutoContinuations: 1,
+          continuation: fetchTerminalGuardContinuation,
+        })) events.push(event);
+      } else {
+        events = initialEvents;
+      }
     } finally {
       cleanupUpstreamAbort();
     }