@bitkyc08/opencodex 2.72.0 → 2.73.0

package/src/server/responses/passthrough-delivery.ts

@@ -1,4 +1,5 @@
 import { isNativeControlResponse } from "./native-response-control";
+import { createOutboundCredentialMask, createTerminalErrorRedactionBlockRewrite } from "./terminal-error-redaction";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
@@ -10,6 +11,7 @@ import {
   createSseInspector,
   markEagerRelaySseResponse,
   markNativePassthroughSseResponse,
+  markPreinspectedJsonResponse,
   consumeForInspection,
   consumeForResponseLogMetadata,
   relaySseWithFailedTail,
@@ -32,7 +34,7 @@ import { recordSubagentQuotaFailureForThreadSpawn } from "../../codex/subagent-m
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { codexProbeLeaseId, codexProbeQuotaScope, codexTransientProbeGrant, releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
 import { consumeComboFailure } from "./core-combo-failure";
-import { readDisplaySafeErrorText } from "./core-errors";
+import { clientCancelledResponse, readDisplaySafeErrorText } from "./core-errors";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
 import { formatPassthroughUpstreamError } from "./passthrough-error";
 import { rewriteUpstreamPolicyRefusal } from "./policy-refusal";
@@ -131,13 +133,94 @@ import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { idleDeadline } from "../../lib/abort";
 import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { formatErrorResponse } from "../../bridge";
-import { inspectResponseLogJson } from "../request-log";
+import {
+  httpStatusFromTerminalError,
+  inspectResponseLogJson,
+  inspectResponseLogSsePayloadParsed,
+} from "../request-log";
 import { restoreRoutedCustomCallsInJson } from "../../responses/custom-tool-compat";
 import { restoreRoutedToolSearchCallsInJson } from "../../responses/tool-search-compat";
 import { responsesJsonToSseStream } from "../responses-json-events";
+import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import {
+  bufferedResponsesReadOptions,
+  collectBufferedResponsesSse,
+  type BufferedResponsesSseFailure,
+  type BufferedResponsesSseResult,
+} from "./buffered-sse-json";
 
 const PLAINTEXT_V2_SSE_PREFIX_LIMIT = 4096;
 
+/** Replay retained SSE in small views so the rewrite decoder never receives one 32 MiB chunk. */
+function replayBufferedSse(bytes: Uint8Array): ReadableStream<Uint8Array> {
+  let offset = 0;
+  return new ReadableStream({
+    pull(controller) {
+      if (offset >= bytes.byteLength) {
+        controller.close();
+        return;
+      }
+      const end = Math.min(bytes.byteLength, offset + 64 * 1024);
+      controller.enqueue(bytes.subarray(offset, end));
+      offset = end;
+    },
+  });
+}
+
+const BUFFERED_CONTEXT_ERROR_CODES = new Set([
+  "context_length_exceeded", "context_window_exceeded", "input_too_long",
+]);
+const BUFFERED_QUOTA_ERROR_CODES = new Set([
+  "usage_limit_exceeded", "usage_limit_reached", "rate_limit_exceeded", "insufficient_quota",
+]);
+const BUFFERED_OVERLOAD_ERROR_CODES = new Set(["server_is_overloaded"]);
+
+function bufferedErrorDefaults(status: number): { type: string; code: string } {
+  switch (status) {
+    case 400: return { type: "invalid_request_error", code: "invalid_request_error" };
+    case 401: return { type: "authentication_error", code: "invalid_api_key" };
+    case 403: return { type: "permission_error", code: "permission_denied" };
+    case 429: return { type: "rate_limit_error", code: "rate_limit_exceeded" };
+    case 499: return { type: "client_closed_request", code: "client_closed_request" };
+    case 503: return { type: "server_error", code: "server_is_overloaded" };
+    default: return { type: "upstream_error", code: "upstream_server_error" };
+  }
+}
+
+/** Preserve only explicit, recognized bare-error classes; diagnostic wording never sets status. */
+function bufferedBareErrorPresentation(
+  failure: BufferedResponsesSseFailure,
+  message: string,
+): { status: number; error: { type: string; code: string; message: string } } {
+  if (failure.upstreamRefusalCode !== undefined) {
+    return {
+      status: 400,
+      error: { type: "invalid_request_error", code: failure.upstreamRefusalCode, message },
+    };
+  }
+  const explicitCode = failure.upstreamErrorCode;
+  const status = explicitCode !== undefined
+    ? BUFFERED_CONTEXT_ERROR_CODES.has(explicitCode) ? 400
+      : BUFFERED_QUOTA_ERROR_CODES.has(explicitCode) ? 429
+        : BUFFERED_OVERLOAD_ERROR_CODES.has(explicitCode) ? 503
+        : httpStatusFromTerminalError({ code: explicitCode })
+    : httpStatusFromTerminalError({ type: failure.upstreamErrorType });
+  const defaults = bufferedErrorDefaults(status);
+  if (status === 502) return { status, error: { ...defaults, message } };
+  const explicitType = failure.upstreamErrorType;
+  const typeMatchesStatus = explicitType !== undefined
+    && (httpStatusFromTerminalError({ type: explicitType }) === status
+      || (explicitType === "server_error" && status === 503));
+  return {
+    status,
+    error: {
+      type: typeMatchesStatus ? explicitType! : defaults.type,
+      code: explicitCode ?? defaults.code,
+      message,
+    },
+  };
+}
+
 /** Prefix-probe budget: bounds one silent gap and the whole probe alike. */
 interface PlaintextV2SseProbeOptions {
   timeoutMs: number;
@@ -348,10 +431,12 @@ export async function deliverPassthroughResponse(
   const { requestBindings } = transportState;
 
   let upstreamResponse = nativeExchange.upstreamResponse;
+  const canonicalBufferedJson = clientRequestedStream !== true
+    && isCanonicalOpenAiForwardProvider(route.provider);
   const originalContentType = upstreamResponse.headers.get("content-type");
   if (isUsageDebugEnabled() && originalContentType) logCtx.usageDebugContentType = originalContentType;
   if (responseEffects.plaintextV2AgentMessageToolNames.size > 0
-    && upstreamResponse.ok && upstreamResponse.body && parsed.stream
+    && upstreamResponse.ok && upstreamResponse.body && (parsed.stream || canonicalBufferedJson)
     && !originalContentType?.toLowerCase().includes("text/event-stream")
     && !originalContentType?.toLowerCase().includes("application/json")
     && !isCodexWsUpstreamResponse(upstreamResponse)
@@ -372,7 +457,11 @@ export async function deliverPassthroughResponse(
     // reach this fallback only after their first Responses event is confirmed.
     const passthroughCt = headers.get("content-type")?.toLowerCase();
     const isEventStream = passthroughCt?.includes("text/event-stream")
-      || (responseEffects.plaintextV2AgentMessageToolNames.size === 0 && upstreamResponse.ok && !!upstreamResponse.body && !passthroughCt && parsed.stream);
+      || (responseEffects.plaintextV2AgentMessageToolNames.size === 0
+        && upstreamResponse.ok
+        && !!upstreamResponse.body
+        && !passthroughCt
+        && (parsed.stream || canonicalBufferedJson));
     const recordTerminalOutcome = codexForwardTerminalOutcomeRecorder(
       config,
       admissionState.authCtx,
@@ -522,10 +611,13 @@ export async function deliverPassthroughResponse(
     const grokUpstreamEchoEnabled = isXaiResponsesDestination(route.provider)
       && responsesRequestMayReplayToolOutput(parsed._rawBody);
     if (isEventStream && upstreamResponse.body) {
-      // For streamed passthrough, a successful terminal response means non-error upstream status
-      // before relay starts. Waiting for SSE completion would retain request state across the whole
-      // stream; a later body failure does not undo that this destination accepted and served the turn.
-      commitReasoningReplayServingRoute(nativeExchange.request.headers);
+      // Streaming clients commit the serving route once the upstream accepted the turn; retaining
+      // request state until their body ends would change the existing relay contract. The canonical
+      // non-streaming fold below is different: nothing is published yet, so it defers this mutation
+      // until both the raw and rewritten terminal snapshots validate.
+      if (!canonicalBufferedJson) {
+        commitReasoningReplayServingRoute(nativeExchange.request.headers);
+      }
       const terminalRepairPolicy = route.staticPolicy.model.responsesTerminalRepair;
       // #3761: opt-in hosted-web-search bridge. Codex always declares the hosted web_search tool,
       // and this branch relays that declaration on the assumption the destination executes it.
@@ -665,7 +757,9 @@ export async function deliverPassthroughResponse(
       // are not the Responses wire shapes the snapshot must mirror.
       // Only validated client blocks may publish plaintext continuation state.
       // Raw inspection precedes rewriting on eager relays, so it cannot own this write.
-      const plaintextInspector = !grokUpstreamEchoEnabled && responseEffects.plaintextV2AgentMessageToolNames.size > 0
+      const plaintextInspector = !canonicalBufferedJson
+        && !grokUpstreamEchoEnabled
+        && responseEffects.plaintextV2AgentMessageToolNames.size > 0
         ? createSseInspector({ onCompletedResponse: rememberPassthroughResponseChecked })
         : undefined;
       const plaintextEncoder = plaintextInspector ? new TextEncoder() : undefined;
@@ -675,6 +769,7 @@ export async function deliverPassthroughResponse(
           return [block];
         }, { dispose: () => plaintextInspector.dispose() })
         : undefined;
+      const maskCredential = createOutboundCredentialMask(nativeExchange.request.headers);
       const blockRewrites = [
         payloadRewrites.length > 0
           ? payloadRewriteAsBlockRewrite(composeSsePayloadRewrites(...payloadRewrites))
@@ -742,12 +837,211 @@ export async function deliverPassthroughResponse(
             rememberPassthroughResponse ? rememberPassthroughResponseChecked : undefined,
           )
           : undefined,
+        createTerminalErrorRedactionBlockRewrite(nativeExchange.request.headers, maskCredential),
         rememberPlaintextBlock,
       ].filter((rewrite): rewrite is NonNullable<typeof rewrite> => rewrite !== undefined);
       const clientBlockRewrite = blockRewrites.length > 0
         ? composeSseBlockRewrites(...blockRewrites)
         : undefined;
       const needsClientRewrite = clientBlockRewrite !== undefined;
+
+      if (canonicalBufferedJson) {
+        const signal = options.abortSignal ?? req.signal;
+        const bufferedRead = bufferedResponsesReadOptions(resolveStallTimeoutMs(
+          config.stallTimeoutSec,
+          { localUpstream: nativeExchange.localUpstream },
+        ));
+        const failBufferedTurn = (
+          message: string,
+          failure?: BufferedResponsesSseFailure,
+        ): Response => {
+          upstream.abort(new Error(message));
+          const upstreamError = failure?.upstreamError;
+          const upstreamRefusalCode = failure?.upstreamRefusalCode;
+          const rawPresentation = upstreamError === undefined || failure === undefined
+            ? undefined
+            : bufferedBareErrorPresentation(failure, upstreamError);
+          const presentation = rawPresentation === undefined ? undefined : {
+            status: rawPresentation.status,
+            error: {
+              type: maskCredential(rawPresentation.error.type),
+              code: maskCredential(rawPresentation.error.code),
+              message: maskCredential(rawPresentation.error.message),
+            },
+          };
+          if (upstreamError !== undefined) {
+            // The streaming relay turns a bare `error` event into a terminal failure. Mirror that
+            // verdict for JSON callers before recording/formatting it, or a provider refusal is
+            // misreported as a retryable generic 502 and clients can replay a rejected turn.
+            const error = presentation!.error;
+            const terminalPayload = {
+              type: "response.failed",
+              response: { status: "failed", error, last_error: error },
+            };
+            // Classification comes only from the bounded structured type/code above. A bare
+            // transport reset can contain misleading copy such as "invalid api key"; letting the
+            // log's message fallback reinterpret it would retire a healthy credential.
+            logCtx.terminalHttpStatus = presentation!.status;
+            noteInspectedPayload(terminalPayload);
+            inspectResponseLogSsePayloadParsed(
+              logCtx,
+              JSON.stringify(terminalPayload),
+              terminalPayload,
+            );
+          }
+          const failureStatus = logCtx.terminalHttpStatus ?? 502;
+          if (recordTerminalOutcomes) {
+            logCtx.transportPhase = "mid_stream";
+            logCtx.terminalSource = "synthetic";
+            if (logCtx.activeAttempt) logCtx.activeAttempt.streamAborted = true;
+            terminalRecorder?.("failed", failureStatus);
+            options.onNativePassthroughTerminal?.("failed");
+          }
+          if (upstreamError !== undefined) {
+            const failureHeaders = new Headers(headers);
+            failureHeaders.set("content-type", "application/json");
+            failureHeaders.delete("content-length");
+            failureHeaders.delete("content-encoding");
+            if (upstreamRefusalCode !== undefined) failureHeaders.delete("retry-after");
+            const error = presentation!.error;
+            return formatPassthroughUpstreamError(
+              failureStatus,
+              JSON.stringify({ error, ...(upstreamRefusalCode === undefined ? {} : { retryable: false }) }),
+              {
+                headers: failureHeaders,
+                suppressRetryAfter: upstreamRefusalCode !== undefined,
+              },
+            );
+          }
+          return formatErrorResponse(502, "upstream_error", message);
+        };
+        let raw: BufferedResponsesSseResult | undefined = await collectBufferedResponsesSse(
+          passthroughSseBody,
+          upstream,
+          { signal, terminalBoundary: codexSafetyBufferingOptions, read: bufferedRead, retainTranscript: true },
+        );
+        if (!raw.ok) {
+          if (raw.kind === "aborted" || signal.aborted) {
+            responseEffects.responseCompletionCancelled = true;
+            options.onNativePassthroughCancel?.();
+            return clientCancelledResponse();
+          }
+          const message = raw.kind === "oversized"
+            ? "upstream SSE response exceeded the safe body limit"
+            : raw.kind === "timeout"
+              ? "upstream SSE response stalled before completing"
+              : raw.kind === "malformed" || raw.kind === "missing_terminal"
+                ? "upstream SSE response ended without one valid terminal response"
+                : "upstream SSE response failed before a valid terminal response";
+          return failBufferedTurn(message, raw);
+        }
+        if (!raw.bytes) return failBufferedTurn("upstream SSE transcript was not retained for rewriting");
+        let rawBytes: Uint8Array | undefined = raw.bytes;
+        raw = undefined; // Release the raw reconstruction graph before building the client copy.
+
+        // Reuse the ordinary client rewrite chain against the bounded transcript. The raw pass
+        // above validates before any continuation or outcome side effect; this second validation
+        // means a rewrite failure cannot publish a turn the non-streaming caller never received.
+        let bufferedClientBody: ReadableStream<Uint8Array> | undefined = clientBlockRewrite
+          ? relaySseWithBlockRewrite(
+            replayBufferedSse(rawBytes),
+            clientBlockRewrite,
+            translatorBudget,
+          )
+          : replayBufferedSse(rawBytes);
+        const client = await collectBufferedResponsesSse(bufferedClientBody, upstream, {
+          signal,
+          read: bufferedRead,
+          retainTranscript: false,
+        });
+        bufferedClientBody = undefined;
+        if (!client.ok) {
+          if (client.kind === "aborted" || signal.aborted) {
+            responseEffects.responseCompletionCancelled = true;
+            options.onNativePassthroughCancel?.();
+            return clientCancelledResponse();
+          }
+          const message = client.kind === "oversized"
+            ? "rewritten SSE response exceeded the safe body limit"
+            : client.kind === "timeout"
+              ? "rewritten SSE response stalled before completing"
+              : "rewritten SSE response did not contain one valid terminal response";
+          return failBufferedTurn(message, client);
+        }
+        if (Date.now() >= bufferedRead.deadlineAt) {
+          return failBufferedTurn("buffered Responses turn exceeded the safe total deadline");
+        }
+
+        const cancelAfterValidation = (): Response => {
+          responseEffects.responseCompletionCancelled = true;
+          options.onNativePassthroughCancel?.();
+          return clientCancelledResponse();
+        };
+        if (signal.aborted) return cancelAfterValidation();
+
+        // Effects intentionally run only after both bounded validations. They inspect the same
+        // upstream-facing transcript as the streaming relay and fire once; continuation storage
+        // receives the final client-visible response once after all restorations succeeded.
+        const reportNativeTerminal = recordTerminalOutcomes
+          ? (status: ResponsesTerminalStatus, httpStatusOverride?: number) => {
+            if (signal.aborted) return;
+            terminalRecorder?.(status, httpStatusOverride);
+            if (status === "failed" || status === "incomplete") {
+              const quotaFailureMessage = [httpStatusOverride, logCtx.terminalHttpStatus]
+                .find(value => value === 429 || value === 402);
+              if (!isFixedCodexAccount(admissionState.authCtx) && quotaFailureMessage !== undefined) {
+                recordSubagentQuotaFailureForThreadSpawn(
+                  req.headers,
+                  subagentQuotaFailureModel,
+                  quotaFailureMessage,
+                  config,
+                  requestState.subagentFallbackAccountId,
+                );
+              }
+            }
+            options.onNativePassthroughTerminal?.(status);
+          }
+          : undefined;
+        const effectInspector = createSseInspector({
+          onTerminal: reportNativeTerminal,
+          logCtx,
+          onParsedPayload: noteInspectedPayload,
+          onFirstOutput: options.onFirstOutput,
+          pinCompletedResponseIdToFirstSeen: githubCopilotRepairEnabled,
+        });
+        try {
+          // The deferred effects pass must not turn a bounded 32 MiB transcript into one long
+          // event-loop monopoly. Keep decoder input small and yield between MiB groups; the
+          // aggregate frame cap was already enforced by both validation passes.
+          for (let offset = 0; offset < rawBytes.byteLength; offset += 64 * 1024) {
+            if (signal.aborted) return cancelAfterValidation();
+            effectInspector.feed(rawBytes.subarray(offset, Math.min(rawBytes.byteLength, offset + 64 * 1024)));
+            if (offset > 0 && offset % (1024 * 1024) === 0) {
+              await new Promise<void>(resolve => setTimeout(resolve, 0));
+              if (signal.aborted) return cancelAfterValidation();
+            }
+          }
+          if (signal.aborted) return cancelAfterValidation();
+          effectInspector.finish();
+        } finally {
+          effectInspector.dispose();
+        }
+        if (signal.aborted) return cancelAfterValidation();
+        commitReasoningReplayServingRoute(nativeExchange.request.headers);
+        rawBytes = undefined;
+        if (client.terminal.status === "completed") {
+          rememberPassthroughResponseChecked(client.terminal.response);
+        }
+
+        const jsonHeaders = sanitizePassthroughHeaders(headers, codexSafetyBufferingOptions);
+        jsonHeaders.set("content-type", "application/json");
+        return markPreinspectedJsonResponse(new Response(JSON.stringify(client.terminal.response), {
+          status: upstreamResponse.status,
+          statusText: upstreamResponse.statusText,
+          headers: jsonHeaders,
+        }));
+      }
+
       const relayPlatform = relayPlatformForTests ?? process.platform;
       // #864: win32 rewrite traffic must never enter the tee()+JS-pull chain
       // (Bun#32111 JS-sink segfault — text frames pass, the terminal block is
@@ -829,6 +1123,7 @@ export async function deliverPassthroughResponse(
         }, {
           clientGoneSignal: options.abortSignal,
           terminalBoundary: codexSafetyBufferingOptions,
+          maskCredential,
           ...(inlineEagerRewrite ? { rewriteBudget: translatorBudget } : {}),
           ...(logCtx.upstreamError === undefined ? {} : { upstreamError: logCtx.upstreamError }),
         });
@@ -922,7 +1217,7 @@ export async function deliverPassthroughResponse(
           responseEffects.responseCompletionCancelled = true;
           clientGone.abort(reason);
         },
-        { upstreamError: logCtx.upstreamError, terminalBoundary: codexSafetyBufferingOptions },
+        { upstreamError: logCtx.upstreamError, terminalBoundary: codexSafetyBufferingOptions, maskCredential },
       );
       return markNativePassthroughSseResponse(new Response(clientBody, {
         status: upstreamResponse.status,

package/src/server/responses/passthrough-dispatch.ts

@@ -137,7 +137,8 @@ import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { refreshPoolForwardAuth, refreshNativeMainForwardAuth, withClaudeNativeSession } from "./core-auth";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import type { OAuthAccessSnapshot } from "../../oauth";
-import { publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { AnthropicAccountCooldownError } from "../../oauth/anthropic-routing";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
   hasEligibleGenericOAuthFailoverTarget,
@@ -260,6 +261,18 @@ export async function preparePassthroughExchange(
     const codexSafetyBufferingOptions = isCanonicalOpenAiForwardProvider(route.provider)
       ? codexSafetyBufferingFilterOptions(config)
       : undefined;
+    // The canonical ChatGPT adapter coerces only its final outbound copy to `stream:true` so the
+    // separately captured client preference can still select JSON delivery. Recovery runs before
+    // delivery, though, and must classify the bytes the upstream was actually asked to send:
+    // ChatGPT may omit Content-Type, so consulting `parsed.stream` here would mistake its SSE body
+    // for non-streaming JSON and skip both opaque-state and safe-reset recovery.
+    const upstreamRequestsStream = parsed.stream === true
+      || isCanonicalOpenAiForwardProvider(route.provider);
+    // A JSON client still needs the canonical destination's HTTP/SSE response so delivery can
+    // validate and fold it. Letting the forced `stream:true` body select the WebSocket transport
+    // bypasses manual HTTP redirects and can turn a real 3xx into a connect timeout.
+    const canonicalBufferedJson = clientRequestedStream !== true
+      && isCanonicalOpenAiForwardProvider(route.provider);
     const imageGenCallAliases = route.provider.authMode === "forward"
       ? new Map<string, { namespace: string; name: string }>()
       : imageGenToolCallAliases(toolBridgeMaps.toolNsMap, parsed._rawBody, translatorBudget);
@@ -881,7 +894,23 @@ export async function preparePassthroughExchange(
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
         return formatErrorResponse(429, "request_send_budget_exhausted", err.message);
       }
-      const localRefusal = mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
+      const refusal = unwrapUpstreamRetryEvidenceError(err);
+      // Pacing may outlive the selected account's admission. No fetch occurred, so do
+      // not turn an operator pause into a 502 or charge it to host/account health.
+      if (refusal instanceof OAuthAccountPausedError || refusal instanceof OAuthLoginRequiredError || refusal instanceof AnthropicAccountCooldownError) {
+        releaseUpstreamHostAdmission(nativeHostState.lease);
+        nativeHostState.lease = null;
+        releaseCodexAuthContextProbeLease(admissionState.authCtx);
+        if (refusal instanceof OAuthLoginRequiredError) {
+          return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(refusal));
+        }
+        if (refusal instanceof AnthropicAccountCooldownError) {
+          return formatErrorResponse(429, "rate_limit_error", refusal.message,
+            refusal.retryAfterSeconds === null ? undefined : { retryAfter: String(refusal.retryAfterSeconds) });
+        }
+        return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(refusal));
+      }
+      const localRefusal = mapCodexAuthContextErrorToResponse(refusal, {
         now: Date.now(), accountSelector: route.codexAccountNamespace,
       });
       if (localRefusal) {
@@ -944,8 +973,9 @@ export async function preparePassthroughExchange(
             method: request.method,
             headers: request.headers,
             body: request.body,
-          }, recovery), upstream.signal, connectMs, parsed.stream,
+          }, recovery), upstream.signal, connectMs, upstreamRequestsStream,
             providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              httpOnly: canonicalBufferedJson,
               nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
                 && responseEffects.plaintextV2AgentMessageToolNames.size === 0
                 ? options.nativeControl : undefined,
@@ -1048,12 +1078,13 @@ export async function preparePassthroughExchange(
               method: request.method,
               headers: request.headers,
               body: request.body,
-            }, innerRecovery), upstream.signal, connectMs, parsed.stream,
+            }, innerRecovery), upstream.signal, connectMs, upstreamRequestsStream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
-                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
-                ? options.nativeControl : undefined,
-              dispatchOverride: oauthDispatch(request),
+                httpOnly: canonicalBufferedJson,
+                nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                  && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                  ? options.nativeControl : undefined,
+                dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
@@ -1156,6 +1187,7 @@ export async function preparePassthroughExchange(
         // rather than a second one to announce.
         const oauthReplayExecutor = storedPoolReplayDispatchNotifier(
           providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+            httpOnly: canonicalBufferedJson,
             nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
               && responseEffects.plaintextV2AgentMessageToolNames.size === 0
               ? options.nativeControl : undefined,
@@ -1185,7 +1217,7 @@ export async function preparePassthroughExchange(
               }, recovery),
               upstream.signal,
               connectMs,
-              parsed.stream,
+              upstreamRequestsStream,
               oauthReplayExecutor,
               route.provider.authMode === "forward",
             ).then(adoptObservedResponse);
@@ -1303,12 +1335,13 @@ export async function preparePassthroughExchange(
               method: request.method,
               headers: request.headers,
               body: request.body,
-            }, recovery), upstream.signal, connectMs, parsed.stream,
+            }, recovery), upstream.signal, connectMs, upstreamRequestsStream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
-                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
-                ? options.nativeControl : undefined,
-              dispatchOverride: oauthDispatch(request),
+                httpOnly: canonicalBufferedJson,
+                nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                  && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                  ? options.nativeControl : undefined,
+                dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
@@ -1437,12 +1470,13 @@ export async function preparePassthroughExchange(
               method: request.method,
               headers: request.headers,
               body: request.body,
-            }, recovery), upstream.signal, connectMs, parsed.stream,
+            }, recovery), upstream.signal, connectMs, upstreamRequestsStream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
-                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
-                ? options.nativeControl : undefined,
-              dispatchOverride: oauthDispatch(request),
+                httpOnly: canonicalBufferedJson,
+                nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                  && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                  ? options.nativeControl : undefined,
+                dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
@@ -1554,7 +1588,8 @@ export async function preparePassthroughExchange(
           upstream,
           connectMs,
           passthroughEstimate,
-          stream: parsed.stream,
+          stream: upstreamRequestsStream,
+          httpOnly: canonicalBufferedJson,
           onResponse: (response, retryAuthCtx, retryRequest) => {
             adoptCodexWsStage(response);
             captureAffinityResponse(
@@ -1604,7 +1639,7 @@ export async function preparePassthroughExchange(
     const recoveryContentType = upstreamResponse.headers.get("content-type")?.toLowerCase() ?? "";
     const streamedFunctionOutputCandidate = upstreamResponse.ok
       && !!upstreamResponse.body
-      && (recoveryContentType.includes("text/event-stream") || (!recoveryContentType && parsed.stream))
+      && (recoveryContentType.includes("text/event-stream") || (!recoveryContentType && upstreamRequestsStream))
       && !opaqueBlobRecoveryGuard.attempted
       && !configuredTransientSendBudgetExhausted()
       && outboundResponsesBodyCarriesEncryptedFunctionOutput(request.body);
@@ -1622,7 +1657,7 @@ export async function preparePassthroughExchange(
           if (decryptRejection) preflightLog.upstreamError = ENCRYPTED_FUNCTION_OUTPUT_REJECTION;
           return decryptRejection;
         }, {
-          allowMissingContentType: !recoveryContentType && parsed.stream,
+          allowMissingContentType: !recoveryContentType && upstreamRequestsStream,
           replayReadErrors: true,
         });
       if (options.abortSignal?.aborted) return transportFailureResponse(options.abortSignal.reason);
@@ -1772,7 +1807,7 @@ export async function preparePassthroughExchange(
       && !(options.nativeControl && options.inboundTransport === "websocket")
       && ambiguousResend() !== undefined
       && remainingTransientSendBudget(transientSendAttempts()) > 0
-      && (streamRecoveryContentType.includes("text/event-stream") || (!streamRecoveryContentType && parsed.stream));
+      && (streamRecoveryContentType.includes("text/event-stream") || (!streamRecoveryContentType && upstreamRequestsStream));
     if (protocolRecoveryCandidate) {
       upstreamResponse = deferProtocolSafeResetRecovery(
         upstreamResponse,
@@ -1791,11 +1826,11 @@ export async function preparePassthroughExchange(
             authorize: () => authorizeResendForRecovery(stage, "connection-reset", ambiguousResend()).allowed,
             acceptResponse: candidate => {
               const type = candidate.headers.get("content-type")?.toLowerCase() ?? "";
-              return type.includes("text/event-stream") || (!type && parsed.stream);
+              return type.includes("text/event-stream") || (!type && upstreamRequestsStream);
             },
           },
         ),
-        { allowMissingContentType: !streamRecoveryContentType && parsed.stream },
+        { allowMissingContentType: !streamRecoveryContentType && upstreamRequestsStream },
       );
     }
     break;

package/src/server/responses/passthrough-error.ts

@@ -79,6 +79,8 @@ export function formatPassthroughUpstreamError(
     statusText?: string;
     headers?: Headers;
     now?: number;
+    /** Caller holds an authoritative fatal verdict; neither inherited nor inferred waits apply. */
+    suppressRetryAfter?: boolean;
     /**
      * Provenance from the caller that still holds the response: this body is a refusal this
      * proxy synthesized. The body check below is the fallback for a re-wrapped body, and it
@@ -96,7 +98,7 @@ export function formatPassthroughUpstreamError(
   const replayRefusal = options?.replayRefusal === true || isReplayRefusalBody(trimmed);
   // Two different reasons to answer with no wait at all, handled the same way: a hard policy
   // block will not become servable, and a refusal we made was never a rate limit.
-  const suppressRetryAfter = cyberPolicyFailure || replayRefusal;
+  const suppressRetryAfter = options?.suppressRetryAfter === true || cyberPolicyFailure || replayRefusal;
   const resolved = suppressRetryAfter
     ? undefined
     : resolveClientRetryAfter({