@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/server/management-api.ts

@@ -66,9 +66,11 @@ import { handleRoutingAnalyticsRoutes } from "./management/routing-analytics-rou
 import { handleMetricsRoutes } from "./management/metrics-routes";
 import { handleProviderRoutes } from "./management/provider-routes";
 import { handleModelRoutes } from "./management/model-routes";
+import { handleClaudeInterceptRoutes } from "./management/claude-intercept-routes";
 import { handleAgentSettingsRoutes } from "./management/agent-settings-routes";
 import { handleOauthAccountRoutes } from "./management/oauth-account-routes";
 import { handleComboRoutes } from "./management/combo-routes";
+import { handleDecisionRoutes } from "./management/decision-routes";
 import { handleSystemRoutes } from "./management/system-routes";
 import { handleSidebarRoutes } from "./management/sidebar-routes";
 import { handleUsageTimelineRoutes } from "./management/usage-timeline-routes";
@@ -166,6 +168,12 @@ async function handleWorkflowBudgetRoutesOnDemand(ctx: ManagementContext): Promi
   return handleWorkflowBudgetRoutes(ctx);
 }
 
+async function handleCodexAgentRoleRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/codex-agent-roles")) return null;
+  const { handleCodexAgentRoleRoutes } = await import("./management/codex-agent-role-routes");
+  return handleCodexAgentRoleRoutes(ctx);
+}
+
 /**
  * Lazy like the Lab and routing-profile handlers: the protocol planner reaches the router and
  * the ingress eligibility rules, which no other dashboard request needs.
@@ -326,7 +334,8 @@ export async function handleManagementAPI(
   }
   let routed: Response | null | undefined;
   try {
-    routed = handleSessionRoutes(ctx)
+    routed = await handleClaudeInterceptRoutes(ctx)
+    ??     handleSessionRoutes(ctx)
     ??     (await handleLinkRoutesOnDemand(ctx))
     ??     (await handleRemoteWorkspaceRoutesOnDemand(ctx))
     ??     (await handleConfigRoutes(ctx))
@@ -336,6 +345,7 @@ export async function handleManagementAPI(
     ??     (await handleQuotaResetRoutesOnDemand(ctx))
     ??     (await handleLowQuotaRoutesOnDemand(ctx))
     ??     (await handleWorkflowBudgetRoutesOnDemand(ctx))
+    ??     (await handleCodexAgentRoleRoutesOnDemand(ctx))
     ??     (await handleProtocolRoutesOnDemand(ctx))
     ??     (await handleGrokCouponRoutesOnDemand(ctx))
     ??     (await handleAnthropicResetGrantRoutesOnDemand(ctx))
@@ -351,6 +361,7 @@ export async function handleManagementAPI(
     ??     (await handleAgentSettingsRoutes(ctx))
     ??     (await handleCodexPromptRoutes(ctx))
     ??     (await handleOauthAccountRoutes(ctx))
+    ??     (await handleDecisionRoutes(ctx))
     ??     (await handleComboRoutes(ctx))
     ??     (await handleSystemRoutes(ctx))
     ??     (await handleLabRoutesOnDemand(ctx))

package/src/server/messages-native-oauth.ts

@@ -55,6 +55,8 @@ function isRec(value: unknown): value is Rec {
 export interface NativeOAuthBinding {
   readonly selection: Selection;
   readonly snapshot: OAuthAccessSnapshot;
+  /** Anthropic account UUID from the same stored generation, distinct from snapshot.accountId. */
+  readonly providerAccountUuid?: string;
 }
 
 /** The selection moved or became pooled while it was being resolved. Maps to a 409 retry. */
@@ -95,7 +97,9 @@ export async function resolveNativeOAuthBinding(config: OcxConfig): Promise<Nati
         expectedCredentialGeneration: candidate.generation,
       })) continue;
       if (pooled(config)) break;
-      const binding = { selection: committed, snapshot: candidate };
+      const row = getAccountCredentialWithStatus(PROVIDER, candidate.accountId);
+      if (!row || credentialGeneration(row.credential) !== candidate.generation) continue;
+      const binding = { selection: committed, snapshot: candidate, providerAccountUuid: row.credential.accountId };
       if (nativeOAuthBindingIsCurrent(binding)) return binding;
     }
     // Re-read after a lost commit or a health change during credential resolution.
@@ -114,7 +118,8 @@ export function nativeOAuthBindingIsCurrent(binding: NativeOAuthBinding): boolea
     && selected?.revision === binding.selection.revision
     && !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
     && !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId)
-    && credentialGeneration(row.credential) === binding.snapshot.generation;
+    && credentialGeneration(row.credential) === binding.snapshot.generation
+    && row.credential.accountId === binding.providerAccountUuid;
 }
 
 /** Map a `tool_use` block's wire name back to the caller's name; other blocks are untouched. */

package/src/server/messages-native.ts

@@ -10,8 +10,8 @@
  * key selection, key failover and 429 replay, connection policy — so nothing the Responses
  * pipeline enforces is bypassed.
  *
- * Authority. This lane reads no caller header. The ingress hands over one value, the caller's
- * `anthropic-beta`, which the builder reduces to an allowlist. The caller-forward passthrough in
+ * Authority. The ingress hands over caller `anthropic-beta` for allowlisting and an opaque
+ * observed CLI identity handle for first-party compatibility. Neither grants credential authority. The caller-forward passthrough in
  * `claude-messages.ts` (the caller's own Anthropic credential) is a different branch decided
  * before this one, and nothing here can reach it or be reached from it.
  *
@@ -67,6 +67,7 @@ import type { OcxProviderTransport } from "../providers/xai-transport";
 import { preservesPhysicalComboProvider, resolveComboId } from "../combos";
 import { captureRouteStaticPolicy, routeModel, type RouteResult } from "../router";
 import { POLICY_NAMESPACE, resolvePolicyProfileId } from "../routing/profile";
+import type { AnthropicClientIdentity } from "../adapters/anthropic/client-identity";
 import type { OcxConfig, OcxProviderConfig, OcxUsage } from "../types";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import {
@@ -145,9 +146,10 @@ export interface HandleNativeMessagesOptions {
   selector?: NativeMessagesSelector;
   /**
    * The caller's `anthropic-beta` header, handed over by the ingress. The builder keeps only
-   * allowlisted values; no other caller header reaches this lane.
+   * allowlisted values. Client identity is a separate bounded opaque handle.
    */
   callerAnthropicBeta?: string | null;
+  clientIdentity?: AnthropicClientIdentity;
 }
 
 type FinishLog = (status: number, message?: string, meta?: FinalRequestLogMeta) => void;
@@ -410,6 +412,8 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     recordAttemptCredentialSource(attempt, route.providerName, activeProvider, "anthropic");
     const built = buildAnthropicMessagesPassthroughRequest(activeProvider, route.modelId, body, config, {
       callerAnthropicBeta: options.callerAnthropicBeta,
+      providerAccountUuid: oauthBinding?.providerAccountUuid,
+      clientIdentity: options.clientIdentity,
     });
     if (built.strippedOpaqueState && rejectUnrepresentable) throw new NativeOpaqueStateRefusal();
     if (built.droppedBetas) addProtocolEntryReason(logCtx, "anthropic-beta-dropped");

package/src/server/relay.ts

@@ -779,7 +779,9 @@ export function firstOutputFromParsed(parsed: unknown): boolean {
   const event = parsed as { type?: unknown; delta?: unknown };
   return (event.type === "response.output_text.delta"
     || event.type === "response.reasoning_summary_text.delta"
-    || event.type === "response.reasoning_text.delta")
+    || event.type === "response.reasoning_text.delta"
+    || event.type === "response.function_call_arguments.delta"
+    || event.type === "response.custom_tool_call_input.delta")
     && typeof event.delta === "string"
     && event.delta.length > 0;
 }

package/src/server/request-log.ts

@@ -247,6 +247,8 @@ export interface RequestLogContext {
   terminalSource?: "upstream" | "synthetic";
   /** Bounded route-decision trace (RI-01); never contains secrets. */
   routeDecision?: RouteDecisionTraceV1;
+  /** Full eligible provider/model membership from a policy route; never logged. */
+  policyEligibility?: ReadonlySet<string>;
   /** Privacy-bounded JEV selection metadata; downstream usage is recorded on attempts[]. */
   jevDecision?: PersistedJevDecisionV1;
   /** Opt-in shadow evidence, normalized again at the logging boundary. */

package/src/server/responses/adapter-continuation.ts

@@ -396,9 +396,9 @@ export function createAdapterContinuations(
       ) {
         const nextAccountId = await rotateAnthropicAccountOnResponse(response, {
           config, accountId: transportState.anthropicPoolAccountId, sessionKey: anthropicSessionKey,
-          decision: transportState.anthropicRouteDecision, signal: upstream.signal,
-          canRetry: transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
-          allowAccountRefusal,
+          model: route.modelId, requestKey: transportState, decision: transportState.anthropicRouteDecision, signal: upstream.signal,
+          canRetry: !sendBudgetExhausted() && transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
+          allowAccountRefusal, allow429Recovery: allowAccountRefusal,
         });
         if (nextAccountId) {
           try {

package/src/server/responses/adapter-dispatch.ts

@@ -1,3 +1,4 @@
+import { classifyAnthropic429 } from "../../oauth/anthropic-rate-limit-policy";
 import { rotateAnthropicAccountOnResponse } from "../../oauth/anthropic-account-refusal";
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import { isLocalUpstream } from "../../lib/local-upstream";
@@ -691,7 +692,8 @@ export async function prepareAdapterExchange(
           refreshed = await refreshResolvedOAuthSelection(transportState.sentOAuthSnapshot);
         } catch (err) {
           const failed = transportState.sentOAuthSnapshot;
-          if (route.providerName === "google-antigravity" && err instanceof OAuthLoginRequiredError && failed
+          if (route.providerName === "google-antigravity" && !antigravityAuthRotationAttempted
+            && err instanceof OAuthLoginRequiredError && failed
             && getAccountSet(route.providerName)?.accounts.some(row =>
               row.id === failed.accountId && row.needsReauth === true)) {
             antigravityAuthRotationAttempted = true;
@@ -993,8 +995,8 @@ export async function prepareAdapterExchange(
       ) {
         const nextAccountId = await rotateAnthropicAccountOnResponse(upstreamResponse, {
           config, accountId: transportState.anthropicPoolAccountId, sessionKey: anthropicSessionKey,
-          decision: transportState.anthropicRouteDecision, signal: upstream.signal,
-          canRetry: transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
+          model: route.modelId, requestKey: transportState, decision: transportState.anthropicRouteDecision, signal: upstream.signal,
+          canRetry: !sendBudgetExhausted() && transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
         });
         if (!nextAccountId) break;
         try {
@@ -1091,6 +1093,11 @@ export async function prepareAdapterExchange(
             resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
+          bindRouteReasoningReplayScope({
+            parsed, providerName: route.providerName, provider: route.provider,
+            adapterName: transportState.activeAdapter.name,
+            oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+          });
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
           recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
           // The replay IS this hop's send, so hand the reservation down and let the layer that
@@ -1190,6 +1197,13 @@ export async function prepareAdapterExchange(
             resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
+          // Same contract as the Kiro refusal arm: the replay must carry the replacement
+          // account's continuation owner and reasoning scope, never the account that just 429'd.
+          bindRouteReasoningReplayScope({
+            parsed, providerName: route.providerName, provider: route.provider,
+            adapterName: transportState.activeAdapter.name,
+            oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+          });
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
           recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
           // The replay IS this hop's send, so hand the reservation down and let the layer that
@@ -1414,6 +1428,7 @@ export async function prepareAdapterExchange(
           status: upstreamResponse.status,
           message,
           upstreamRetryAfter,
+          includeDefault: !(transportState.anthropicPoolAccountId && classifyAnthropic429(upstreamResponse.headers) === "request-scoped-unknown"),
         });
       return formatErrorResponse(
         upstreamResponse.status,

package/src/server/responses/compact.ts

@@ -1,4 +1,5 @@
 import { capturePoolQuotaWriter } from "../../codex/account-store";
+import { previewXaiOauthWireModel } from "./core-normalize";
 import {
   admissionModelDeniedResponse,
   AdmissionModelDeniedError,
@@ -196,6 +197,7 @@ import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, safeOriginLabel }
 import { mapCodexAuthContextErrorToResponse, nativeMainRefreshFailureResponse } from "./codex-auth-error";
 import { linkRequestSessionLane, sessionLaneIdFromRequest } from "../request-log-conversation";
 import { recallComboForLane } from "./combo-session-recall";
+import { redactHostedImageDisplayPaths } from "../responses-hosted-image-display";
 
 export const COMPACT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 
@@ -622,6 +624,8 @@ export async function handleResponsesCompact(
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     return formatErrorResponse(400, "invalid_request_error", "Invalid compaction request body");
   }
+  // Compaction forwards client history upstream too; keep local artifact paths out of it.
+  redactHostedImageDisplayPaths(body);
   if (!options.compactionRoutingOverride) {
     options = { ...options, compactionRoutingOverride: applyCompactionRoutingOverride(body, req.headers, config, { endpoint: "compact" }) };
   }
@@ -670,7 +674,15 @@ export async function handleResponsesCompact(
     // A compaction override picks the model, not the caller, so the key's scope
     // is applied to what the override resolved to rather than to the selector
     // the client sent.
-    assertRouteAllowedByScope(resolveAdmissionModelScope(config, admission), compactRequestedModel, route);
+    // Routed xAI OAuth compaction must preview its Fast wire model here;
+    // native compact keeps checking the destination it dispatches directly.
+    const callerTier = (raw as Record<string, unknown>).service_tier;
+    assertRouteAllowedByScope(resolveAdmissionModelScope(config, admission), compactRequestedModel, {
+      providerName: route.providerName,
+      modelId: previewXaiOauthWireModel({ options: {
+        serviceTier: compactFastRow ? "priority" : typeof callerTier === "string" ? callerTier : undefined,
+      } }, route, config, "responses"),
+    });
   } catch (err) {
     if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
     if (err instanceof NoEligiblePolicyCandidateError) {
@@ -691,6 +703,7 @@ export async function handleResponsesCompact(
   logCtx.requestedModel = compactRequestedModel;
   logCtx.model = selectedModelId;
   logCtx.routeDecision = route.routeDecision;
+  logCtx.policyEligibility = route.policyEligibility;
   logCtx.provider = route.codexAccountNamespace
     ? `${route.providerName}-${route.codexAccountNamespace}`
     : route.providerName;

package/src/server/responses/core-auth.ts

@@ -89,6 +89,8 @@ export function codexRouteCredentialDomainHeaders(
   // Route-changing recursion retains typed admission, never an unscoped raw
   // caller credential. Bearer admission is substituted or stripped below.
   const routeMayChangeCredentialDomain = options.comboAttempt === true
+    // A JEV decision-model turn is a new credential domain even though it starts headerless.
+    || options.internalDecisionCall === true
     || route.routeKind === "policy"
     || route.credentialDomainRewrite === true
     || credentialDomainWasRewritten;

package/src/server/responses/core-combo.ts

@@ -31,7 +31,8 @@ import {
   advanceComboAfterFailure,
   comboFailureCooldownScope,
   JEV_PROVIDER_ID,
-  resolveJevDecision,
+  jevDecisionBackendFor,
+  resolveJevComboDecision,
   type ComboPick,
   type JevCandidate,
   type JevDecision,
@@ -48,7 +49,12 @@ import { routeConcreteModel, comboRouteDecisionTrace } from "../../router";
 import { memoryModelRouteReason } from "./memory-models";
 import { poolAccountProviderLabel } from "../../providers/label";
 import { getAccountSet } from "../../oauth/store";
-import { formatAnthropicProviderForLog, getAnthropicAccountHealthSnapshot } from "../../oauth/anthropic-routing";
+import {
+  formatAnthropicProviderForLog,
+  getAnthropicAccountHealthSnapshot,
+  getAnthropicPoolRetryAfterSeconds,
+  getEligibleAnthropicAccounts,
+} from "../../oauth/anthropic-routing";
 import { codexAccountLogLabel } from "../../codex/account-label";
 import { codexQuotaScopeForModel, getCodexQuotaHealthSnapshot } from "../../codex/routing";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
@@ -93,6 +99,7 @@ import { streamingContextOverflowResponse, jsonContextOverflowResponse } from ".
 import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
 import { settleOperatorReplacement } from "../../lib/upstream-retry";
 import { createComboProtocolLanes, dispatchNativeComboChild } from "./core-combo-native";
+import { createJevModelInvoker } from "./jev-model-invoke";
 import { clientWireOf } from "../inference/client-wire";
 
 /**
@@ -119,6 +126,33 @@ function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId
 }
 
 
+/**
+ * True only for the Anthropic OAuth pool's OWN "all accounts cooled" 429. Its Retry-After is the
+ * earliest per-account cooldown restated (`getAnthropicPoolRetryAfterSeconds`), which the pool
+ * keeps enforcing locally, so it must not also park the combo target: an account added, resumed or
+ * cleared a minute later would otherwise sit ignored until the target expired, up to the 24h
+ * server-delay ceiling.
+ *
+ * Provenance, not just current state: the target must be the OAuth pool, no account may have been
+ * identified for the failure, and the pool must be holding the wait right now. An upstream 429 on
+ * a pool account always cools and names that account, and an API-key provider never qualifies, so
+ * a genuine upstream Retry-After still parks the target in full.
+ */
+export function isAnthropicPoolLocalRefusal(
+  config: OcxConfig,
+  providerName: string,
+  status: number,
+  failedAccount: string | undefined,
+  now = Date.now(),
+): boolean {
+  return providerName === "anthropic"
+    && config.providers[providerName]?.authMode === "oauth"
+    && status === 429
+    && failedAccount === undefined
+    && getEligibleAnthropicAccounts(now).length === 0
+    && getAnthropicPoolRetryAfterSeconds(now) !== null;
+}
+
 /**
  * A combo's execution policy is DECLARED by the combo, not inherited from the single-target
  * profile.
@@ -533,16 +567,30 @@ export async function executeComboResponses(
     const decisionStartedAt = Date.now();
     let decision: JevDecision;
     try {
-      decision = await resolveJevDecision({
+      decision = await resolveJevComboDecision({
         body,
         candidates: choices.map(choice => choice.candidate),
         fallback,
         config,
+        ...(combo.decisionProvider ? { decisionProvider: combo.decisionProvider } : {}),
+        ...(combo.decisionModel
+          ? {
+            decisionModel: combo.decisionModel,
+            invokeModel: createJevModelInvoker({
+              req,
+              config,
+              options,
+              handleResponses: requestDispatchers.handleResponses,
+            }),
+          }
+          : {}),
+        ...(combo.decisionTimeoutMs !== undefined ? { timeoutMs: combo.decisionTimeoutMs } : {}),
         signal: options.abortSignal,
       });
     } catch (error) {
       if (options.abortSignal?.aborted) return clientCancelledResponse();
       decision = {
+        backend: jevDecisionBackendFor(combo),
         ...fallback,
         gate: "network",
         latencyMs: Math.max(0, Date.now() - decisionStartedAt),
@@ -561,6 +609,7 @@ export async function executeComboResponses(
       },
       gate: decision.gate,
       latencyMs: decision.latencyMs,
+      backend: decision.backend,
       ...(decision.confidence !== undefined ? { confidence: decision.confidence } : {}),
       ...(decision.chosenProbability !== undefined
         ? { chosenProbability: decision.chosenProbability }
@@ -568,6 +617,7 @@ export async function executeComboResponses(
       ...(decision.usage ? { usage: decision.usage } : {}),
     });
     console.debug("[combo] JEV decision", {
+      backend: decision.backend,
       targetKey: decision.targetKey,
       effort: decision.effort,
       gate: decision.gate,
@@ -988,8 +1038,20 @@ export async function executeComboResponses(
     });
     const failedTargetKey = targetKey(pick.target);
     let failedTargetCooldownRecorded = false;
+    // The dispatch rewrote this to name the pool account that actually served the turn.
+    const failedAccount = cooledPoolAccountLabel(
+      config,
+      pick.target.provider,
+      pick.target.model,
+      poolAccountProviderLabel(childLog.provider, pick.target.provider),
+    );
+    // The target still cools on the pool's own refusal (the anti-hammer guard), but for the local
+    // fallback rather than the pool's restated per-account Retry-After.
+    const poolLocalRefusal = isAnthropicPoolLocalRefusal(
+      config, pick.target.provider, failure.response.status, failedAccount, failureNow,
+    );
     const nextPick = advanceComboAfterFailure(config, pick, {
-      retryAfter: failure.retryAfter,
+      retryAfter: poolLocalRefusal ? undefined : failure.retryAfter,
       resetAt: failure.resetAt,
       cooldownMs: combo.cooldownMs,
       now: failureNow,
@@ -998,13 +1060,7 @@ export async function executeComboResponses(
       status: failure.response.status,
       code: failure.upstreamCode,
       message: failure.classificationText,
-      // The dispatch rewrote this to name the pool account that actually served the turn.
-      failedAccount: cooledPoolAccountLabel(
-        config,
-        pick.target.provider,
-        pick.target.model,
-        poolAccountProviderLabel(childLog.provider, pick.target.provider),
-      ),
+      failedAccount,
       onCooldownRecorded: target => {
         failedTargetCooldownRecorded ||= targetKey(target) === failedTargetKey;
       },

package/src/server/responses/core-normalize.ts

@@ -38,7 +38,26 @@ import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
 import { recordAttemptRequestedEffort } from "../request-log";
 import type { ResolvedFastPolicy } from "../../providers/fastwire";
-import { applyXaiOauthFastModel } from "../../providers/xai-fast-model";
+import { applyXaiOauthFastModel, xaiOauthFastModelForDecision } from "../../providers/xai-fast-model";
+
+/** Preview the billed xAI lane without mutating request state or resolving credentials. */
+export function previewXaiOauthWireModel(
+  parsed: { options: Pick<OcxParsedRequest["options"], "serviceTier"> },
+  route: RouteResult,
+  config: OcxConfig,
+  inboundWire: InboundWire,
+): string {
+  if (route.providerName !== "xai" || route.provider.authMode !== "oauth") return route.modelId;
+  const provider = resolveWireProtocolOverride(
+    route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy,
+  );
+  const policy = fastPolicyForModel(
+    provider, route.modelId, route.providerName, inboundWire, config.providers[route.providerName],
+  );
+  return xaiOauthFastModelForDecision(
+    { ...route, provider }, decideTier(policy, config.fastMode, parsed.options.serviceTier),
+  ) ?? route.modelId;
+}
 
 export const MAX_FAST_WIRE_CAPABILITY_WARNINGS = 256;
 
@@ -186,6 +205,7 @@ export async function applyFinalRouteRequestNormalization(args: {
   logCtx.provider = route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
   logCtx.routeDecision = route.routeDecision;
+  logCtx.policyEligibility = route.policyEligibility;
   if (route.routeReason === "model-alias" || route.modelId !== responseModelId && responseModelId.includes("/")) logCtx.requestedAlias = responseModelId;
 
   if (responsesUpstreamStreaming === false && route.provider.adapter === "openai-responses") {

package/src/server/responses/core-options.ts

@@ -19,6 +19,7 @@ import type { TransientSendBudget } from "../../lib/upstream-retry";
 import type { RequestLogContext } from "../request-log";
 import type { UpstreamHostAdmissionLease } from "../../codex/upstream-host-health";
 import type { AccountLease } from "../../oauth/kiro-account-load";
+import type { PolicyRequestScope } from "./policy-request-scope";
 
 export interface ConsumedComboFailure {
   response: Response;
@@ -57,6 +58,10 @@ export interface ClientEncoderOption {
 }
 
 export interface HandleResponsesOptions {
+  /** Internal request-owned policy authorization; never read from client headers or body. */
+  policyRequestScope?: PolicyRequestScope;
+  /** Internal concrete selector chosen from the original policy evaluation. */
+  policyFallbackCandidate?: { provider: string; model: string };
   /** Internal routed-compaction recovery: one logical request, one emergency target. */
   compactionRecoveryAttempted?: boolean;
   compactionRecoveryPermit?: SingleUseDispatchPermit;
@@ -66,7 +71,7 @@ export interface HandleResponsesOptions {
   /** Physical-send reports already delivered to the shared used setter, including booking settlement. */
   onCompactionRecoverySendsReported?: (count: number) => void;
   /** Private holder for the Kiro serving-account lease. */
-  accountLoad?: { lease: AccountLease | null };
+  accountLoad?: { lease: AccountLease | null; cancelled: boolean };
   /** Internal Claude replay identity; consumed only by the final canonical Go transport. */
   claudeGoAffinity?: { sessionLane?: string };
   /** Validated Claude metadata identity; projected only into final canonical attempt headers. */
@@ -74,6 +79,11 @@ export interface HandleResponsesOptions {
   /** Original live policy owner; separate from caller-specific routing/sidecar snapshots. */
   codexAuthPolicy?: CodexAuthPolicyConfig;
   turnAdmissionLease?: AdmissionLease;
+  /**
+   * A JEV decision-model call issued by a combo. It never carries caller credentials, is never
+   * rewritten by memory or shadow-call routing, and may not dispatch into a JEV combo.
+   */
+  internalDecisionCall?: boolean;
   /**
    * How the caller proved data-plane admission (#1686).
    *

package/src/server/responses/core.ts

@@ -43,10 +43,12 @@ export async function handleResponses(
 ): Promise<Response> {
   const ownsBudget = options.translatorBudget === undefined;
   const translatorBudget = options.translatorBudget ?? createTranslatorBudget();
-  const accountLoad = { lease: null as import("../../oauth/kiro-account-load").AccountLease | null };
   const abortSignal = options.abortSignal ?? req.signal;
-  const release = () => { accountLoad.lease?.release(); accountLoad.lease = null; abortSignal.removeEventListener("abort", release); };
-  abortSignal.addEventListener("abort", release, { once: true });
+  const accountLoad = { lease: null as import("../../oauth/kiro-account-load").AccountLease | null,
+    cancelled: abortSignal.aborted };
+  function release() { accountLoad.lease?.release(); accountLoad.lease = null; abortSignal.removeEventListener("abort", cancel); }
+  function cancel() { accountLoad.cancelled = true; release(); }
+  abortSignal.addEventListener("abort", cancel, { once: true });
   try {
     const response = await runWithCompactionRecovery(req, config, logCtx, {
       ...options,

package/src/server/responses/fetch-helpers.ts

@@ -15,6 +15,7 @@ import {
   type ProviderRequestSlot,
 } from "../../providers/request-pacing";
 import { withUpstreamHttpVersion } from "../../lib/upstream-http-version";
+import { providerTlsFetch } from "../../lib/provider-tls-profile";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { configuredOutboundFetch } from "../../lib/proxy-env";
 import { isLoopbackUrl, rewriteUpstream } from "../../plugins/upstream-hooks";
@@ -252,8 +253,10 @@ export function providerFetch(
     { preconnect: globalThis.fetch.preconnect?.bind(globalThis.fetch) },
   ) as typeof globalThis.fetch);
   const base = customExecutor ?? configuredFetch;
+  const transport = options.providerName ? providerTlsFetch(options.providerName, provider, base) : base;
   const preconnect = (...args: Parameters<typeof globalThis.fetch.preconnect>): void => {
-    base.preconnect?.(...args);
+    // A TLS profile owns the handshake; a Bun preconnect would open a differently fingerprinted one.
+    if (transport === base) base.preconnect?.(...args);
   };
   // Rebuilt dispatches must use the same physical-send boundary as ordinary HTTP sends.
   // Return the original 3xx so the response owner retains its retry/health/relay contract.
@@ -266,7 +269,7 @@ export function providerFetch(
   // that decided for itself has already marked the init and this pass defers to that decision.
   const dispatch = markEgressTransparentExecutor(Object.assign(
     (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) =>
-      sendWithConnectionPolicy(base, input, init, egressBinding),
+      sendWithConnectionPolicy(transport, input, init, egressBinding),
     { preconnect },
   ) as typeof globalThis.fetch);
   const httpFetch = Object.assign(
@@ -281,7 +284,7 @@ export function providerFetch(
       // the override may rebuild against a different host and select a different transport, and
       // refusing on this destination would reject a request whose real route is fine.
       if (options.dispatchOverride) egressFor(input);
-      else providerEgressSendInit(egressBinding, base, input);
+      else providerEgressSendInit(egressBinding, transport, input);
       // The hook inspects the outgoing headers and refuses the send by throwing; it is not a
       // mutator, and the copy it receives is deliberately not threaded onward. `Connection`
       // is decided inside `dispatch`, which runs after this, so the fresh-connection policy