@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/server/responses/request-prepare.ts

@@ -1,4 +1,5 @@
 import type { ResponsesRequestContext, ResponsesAdmissionState, ResponsesDispatchers } from "./core-options";
+import { capturePolicyRequestRoute, assertPolicyNormalizedRoute, recordPolicyPreparedDestination, policyCandidateRefusalResponse } from "./policy-request-scope";
 import {
   agentTaskRecoveryConfig,
   restoreCachedEncryptedAgentTasks,
@@ -96,6 +97,7 @@ import {
   resolveSubagentFallbackModelEligibility,
   canPassThroughEncryptedV2AgentTask,
   applyFinalRouteRequestNormalization,
+  previewXaiOauthWireModel,
 } from "./core-normalize";
 import {
   cachedDeniedCodexAccountIdsForModel,
@@ -146,6 +148,8 @@ import {
   conversationCarriesUploadedFiles,
 } from "./account-change-state";
 
+import { redactHostedImageDisplayPaths } from "../responses-hosted-image-display";
+
 /** Parses, selects, and admits one request without changing the dispatch policy. */
 export async function prepareResponsesRequest(
   requestContext: Pick<ResponsesRequestContext, "options" | "config" | "req" | "logCtx">,
@@ -153,6 +157,8 @@ export async function prepareResponsesRequest(
   requestDispatchers: ResponsesDispatchers,
 ) {
   const { options, config, req, logCtx } = requestContext;
+  const policyScope = options.policyRequestScope ?? { triedDestinations: new Set<string>() };
+  const concreteSelection = options.comboAttempt || options.policyFallbackCandidate !== undefined;
 
   // The Chat and Anthropic surfaces replay through here with a Responses-shaped body,
   // so an omitted value means a genuine Responses inbound.
@@ -168,6 +174,8 @@ export async function prepareResponsesRequest(
     }
     return decodeRequestErrorResponse(err, "responses");
   }
+  // Remove display-only artifact paths before helpers, combo dispatch and upstream replay.
+  redactHostedImageDisplayPaths(body);
   observeCacheDiagnosticInbound(
     logCtx,
     body,
@@ -176,7 +184,7 @@ export async function prepareResponsesRequest(
       ? "system-derived"
       : options.promptCacheKeyIsSharedCohort === false ? "metadata-derived" : "caller",
   );
-  if (!options.comboAttempt && !options.compactionRoutingOverride && inboundWire === "responses") {
+  if (!concreteSelection && !options.compactionRoutingOverride && inboundWire === "responses") {
     options.compactionRoutingOverride = applyCompactionRoutingOverride(body, req.headers, config, {
       endpoint: "responses",
       transport: options.inboundTransport,
@@ -186,20 +194,21 @@ export async function prepareResponsesRequest(
   // metadata, never from the model id: Phase 1 shares `gpt-5.6-luna` with the app's title/commit
   // helper calls. Read here, ahead of the shadow intercept below, because the phase decision is the
   // more specific of the two settings and must be the one that survives when both match one request.
-  const memoryModelPhase = options.memoryModelPhase
+  // A JEV decision-model call is the router's own auxiliary turn, never a Codex memory phase.
+  const memoryModelPhase = options.internalDecisionCall ? undefined : options.memoryModelPhase
     ?? ((config.memoryModels?.extract || config.memoryModels?.consolidation)
-      && !options.comboAttempt && !options.compactionRoutingOverride && inboundWire === "responses"
+      && !concreteSelection && !options.compactionRoutingOverride && inboundWire === "responses"
       ? detectMemoryModelPhase(body, req.headers, { transport: options.inboundTransport }) ?? undefined
       : undefined);
   const memoryModelTarget = memoryModelPhase ? configuredMemoryModel(config, memoryModelPhase) : undefined;
   // A combo child is a synthetic replay of the parent's decision: its model is already the target's
   // concrete provider/model, so neither site below may rewrite or re-resolve it. It keeps the phase
   // through `options.memoryModelPhase` instead, which is what applies the phase effort.
-  const memoryModelApplies = memoryModelTarget !== undefined && options.comboAttempt !== true;
+  const memoryModelApplies = memoryModelTarget !== undefined && !concreteSelection;
   options.onRequestBodyParsed?.(body);
   // An effort row naming a table-less combo (`combo/x--high`) must reach the combo dispatcher
   // as its base id, so the selector is normalized here, before comboIdFromRawBody reads model.
-  const comboRows = !options.comboAttempt && body && typeof body === "object" && !Array.isArray(body)
+  const comboRows = !concreteSelection && body && typeof body === "object" && !Array.isArray(body)
     && typeof (body as { model?: unknown }).model === "string"
     // One parse for both grammars, from the selector as the client sent it. Parsing them
     // separately made the outcome depend on which ran first.
@@ -228,7 +237,7 @@ export async function prepareResponsesRequest(
   }
   // Compaction may send the last client-visible bare model after a combo switch.
   // Configured selectors take precedence; otherwise recall before combo dispatch (#3891).
-  if (!options.comboAttempt && !options.compactionRoutingOverride && body && typeof body === "object" && !Array.isArray(body)) {
+  if (!concreteSelection && !options.compactionRoutingOverride && body && typeof body === "object" && !Array.isArray(body)) {
     const rawModel = (body as { model?: unknown }).model;
     const rawInput = (body as { input?: unknown }).input;
     const isCompactionTrigger = Array.isArray(rawInput)
@@ -265,7 +274,7 @@ export async function prepareResponsesRequest(
   // A spawned sub-agent turn names its model on purpose; gpt-6-luna is both the helper
   // slug and a default sub-agent model, so neither intercept site may rewrite that turn.
   const threadSpawn = isThreadSpawnRequest(req.headers);
-  if (!options.comboAttempt && !options.compactionRoutingOverride && !threadSpawn && !memoryModelApplies && body && typeof body === "object" && !Array.isArray(body)) {
+  if (!concreteSelection && !options.compactionRoutingOverride && !options.internalDecisionCall && !threadSpawn && !memoryModelApplies && body && typeof body === "object" && !Array.isArray(body)) {
     const shadowIntercept = config.shadowCallIntercept;
     const rawShadowModel = (body as { model?: unknown }).model;
     if (shadowIntercept?.enabled && shadowIntercept.model && typeof rawShadowModel === "string"
@@ -283,7 +292,12 @@ export async function prepareResponsesRequest(
       }
     }
   }
-  const comboId = !options.comboAttempt ? comboIdFromRawBody(body, config) : null;
+  const comboId = !concreteSelection ? comboIdFromRawBody(body, config) : null;
+  // A decision model may be a plain model or a non-JEV combo. A JEV combo here would recurse
+  // into another decision, so the call is refused and the parent decision fails open.
+  if (options.internalDecisionCall && comboId && config.combos?.[comboId]?.strategy === "jev") {
+    return formatErrorResponse(400, "invalid_request_error", "A JEV decision model cannot be a JEV combo");
+  }
   if (comboId && Object.hasOwn(config.combos ?? {}, comboId)) {
     options.onRequestBodyRead?.();
     return requestDispatchers.handleComboResponses(req, body, comboId, config, logCtx, {
@@ -507,13 +521,17 @@ export async function prepareResponsesRequest(
   // request rather than a destination it never asked for.
   const inboundSelector = parsed.modelId;
   const admissionScope = resolveAdmissionModelScope(config, options.admission);
-  const captureInboundRoutePolicy = (candidate: RouteResult): RouteResult => {
+  const captureInboundRoutePolicy = (candidate: RouteResult, captureRequestPolicy = true): RouteResult => {
     // Every route this request path produces passes through here: the direct
     // name, an alias, a policy or combo selection, a compaction override, a
     // shadow-intercept target and both subagent-fallback re-routes. Checking
     // the key's scope at this one point is what stops a rewrite from reaching
     // a destination the front door would have refused.
-    assertRouteAllowedByScope(admissionScope, inboundSelector, candidate);
+    // A shadow-intercept target is probed before interception is decided, so it
+    // skips the request-owned policy capture here; the accepted target is
+    // captured where it becomes the request's route. A declined policy target
+    // must not lend its eligibility or "policy" route kind to the request.
+    if (captureRequestPolicy) capturePolicyRequestRoute(policyScope, candidate);
     candidate.staticPolicy = captureRouteStaticPolicy(
       candidate.providerName,
       candidate.modelId,
@@ -521,6 +539,11 @@ export async function prepareResponsesRequest(
       candidate.staticPolicy.effectiveAlias,
       inboundWire,
     );
+    // Fast-only keys authorize the same billed lane that final normalization serializes.
+    assertRouteAllowedByScope(admissionScope, inboundSelector, {
+      providerName: candidate.providerName,
+      modelId: previewXaiOauthWireModel(parsed, candidate, config, inboundWire),
+    });
     return candidate;
   };
   try {
@@ -528,11 +551,12 @@ export async function prepareResponsesRequest(
     // no canonical OpenAI route for (#2901). Only the initial compaction route
     // may fall back to the configured default provider; combo attempts and the
     // later fallback/recovery re-routes keep the ordinary reservation.
-    const resolveRoute = (modelId: string) => captureInboundRoutePolicy(options.comboAttempt
+    const routeInbound = (modelId: string) => concreteSelection
       ? routeConcreteModel(config, modelId)
       : parsed._compactionRequest === true
         ? routeCompactionModel(config, modelId, evidenceFromBody(parsed._rawBody))
-        : routeModel(config, modelId, evidenceFromBody(parsed._rawBody)));
+        : routeModel(config, modelId, evidenceFromBody(parsed._rawBody));
+    const resolveRoute = (modelId: string) => captureInboundRoutePolicy(routeInbound(modelId));
     // The phase's destination. Resolved through the admission-scoped resolver every other route
     // uses, and it fails closed exactly like the shadow target: falling back to the native model
     // would spend the quota the operator routed away from, without their choosing it.
@@ -554,7 +578,7 @@ export async function prepareResponsesRequest(
     }
     const _sci = config.shadowCallIntercept;
     let shadowRoute: RouteResult | undefined;
-    if (!memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !threadSpawn && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
+    if (!concreteSelection && !memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !options.internalDecisionCall && !threadSpawn && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
       const sourcePrefix = shadowSourceModelPrefix(parsed.modelId, _sci.sourceModels)!;
       let sourceIdentity = { providerName: OPENAI_CODEX_PROVIDER_ID, modelId: sourcePrefix };
       try {
@@ -563,7 +587,7 @@ export async function prepareResponsesRequest(
       } catch { /* Native Codex helper calls remain OpenAI-owned without an enabled OpenAI route. */ }
       // A dead target fails this helper call once, before any send; it never falls through to
       // the native source model or to the default provider (#5618).
-      const target = resolveShadowCallTarget(_sci.model, resolveRoute);
+      const target = resolveShadowCallTarget(_sci.model, modelId => captureInboundRoutePolicy(routeInbound(modelId), false));
       if ("unavailable" in target) {
         logCtx.shadowCallRewrittenFrom = sanitizeLogMetadataString(sourcePrefix);
         logCtx.errorCode = INTERCEPT_TARGET_UNAVAILABLE_CODE;
@@ -587,11 +611,12 @@ export async function prepareResponsesRequest(
         );
         // Helpers must not resume/append into the parent thread's Cursor conversation.
         parsed._cursorIsolateConversation = true;
-        shadowRoute = targetRoute;
+        shadowRoute = capturePolicyRequestRoute(policyScope, targetRoute);
       }
     }
     if (parsed._compactionRequest === true || options.compactionRoutingOverride) parsed._cursorIsolateConversation = true;
-    route = memoryRoute ?? shadowRoute ?? resolveRoute(parsed.modelId);
+    route = memoryRoute ?? shadowRoute ?? resolveRoute(options.policyFallbackCandidate
+      ? `${options.policyFallbackCandidate.provider}/${options.policyFallbackCandidate.model}` : parsed.modelId);
     // Name the phase in the persisted route decision, so the request log says why this turn went to
     // the memory destination instead of leaving it looking like a plain user selection. Set here, on
     // the resolved route, so a combo child's own route carries it too.
@@ -615,7 +640,10 @@ export async function prepareResponsesRequest(
       if (parsed._compactionRequest === true) parsed._portableCompaction = true;
     }
     logCtx.routeDecision = route.routeDecision;
+    logCtx.policyEligibility = route.policyEligibility;
   } catch (err) {
+    const policyRefusal = policyCandidateRefusalResponse(err);
+    if (policyRefusal) return policyRefusal;
     if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
     if (err instanceof NoAvailableComboTargetsError) {
       return comboUnavailable(err.comboId);
@@ -827,7 +855,10 @@ export async function prepareResponsesRequest(
         );
         credentialDomainWasRewritten = true;
         logCtx.routeDecision = route.routeDecision;
+        logCtx.policyEligibility = route.policyEligibility;
       } catch (err) {
+        const policyRefusal = policyCandidateRefusalResponse(err);
+        if (policyRefusal) return policyRefusal;
         if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
         if (err instanceof NoAvailableComboTargetsError) {
           return comboUnavailable(err.comboId);
@@ -1038,7 +1069,10 @@ export async function prepareResponsesRequest(
               );
               credentialDomainWasRewritten = true;
               logCtx.routeDecision = route.routeDecision;
+              logCtx.policyEligibility = route.policyEligibility;
             } catch (err) {
+              const policyRefusal = policyCandidateRefusalResponse(err);
+              if (policyRefusal) return policyRefusal;
               if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
               if (err instanceof NoAvailableComboTargetsError) {
                 return comboUnavailable(err.comboId);
@@ -1178,6 +1212,7 @@ export async function prepareResponsesRequest(
   // upstream for reliability (#875); the answer must then be reframed to SSE
   // for streaming clients.
   const clientRequestedStream = parsed.stream;
+  const admittedPolicyRoute = { providerName: route.providerName, modelId: route.modelId };
   await applyFinalRouteRequestNormalization({
     parsed,
     route,
@@ -1188,13 +1223,23 @@ export async function prepareResponsesRequest(
     inboundTransport: options.inboundTransport,
     claudeGoAffinity: options.claudeGoAffinity,
   });
+  try {
+    assertPolicyNormalizedRoute(policyScope, admittedPolicyRoute, route);
+  } catch (error) {
+    const policyRefusal = policyCandidateRefusalResponse(error);
+    if (policyRefusal) return policyRefusal;
+    throw error;
+  }
   // Normalization is the last thing that can move the destination: resolving an
   // OpenAI virtual model rewrites route.modelId to the wire id that will
   // actually be billed. A scope checked only before this would authorize the
   // public selector and send the wire model, so the settled route is checked
   // once more here.
-  if (!routeAllowedByScope(admissionScope, route)) {
-    return admissionModelDeniedResponse(new AdmissionModelDeniedError(inboundSelector, route));
+  const scopedDestination = parsed._wireModelOverride === undefined
+    ? route
+    : { providerName: route.providerName, modelId: parsed._wireModelOverride };
+  if (!routeAllowedByScope(admissionScope, scopedDestination)) {
+    return admissionModelDeniedResponse(new AdmissionModelDeniedError(inboundSelector, scopedDestination));
   }
   // Attribute local auth/cooldown failures to the public selector too; exact auth may fail before
   // the normal post-resolution provider label is assigned.
@@ -1304,6 +1349,13 @@ export async function prepareResponsesRequest(
 
   route.provider = applyCodexAuthContextToProvider(route.provider, admissionState.authCtx, route.codexAccountMode);
   applyCodexAccountGatedWireNormalization(parsed, route, logCtx);
+  try {
+    recordPolicyPreparedDestination(policyScope, route.providerName, parsed._wireModelOverride ?? parsed.modelId);
+  } catch (error) {
+    const policyRefusal = policyCandidateRefusalResponse(error);
+    if (policyRefusal) return policyRefusal;
+    throw error;
+  }
   logCtx.provider = route.codexAccountNamespace
     ? `${route.providerName}-${route.codexAccountNamespace}`
     : formatCodexProviderForLog(route.providerName, codexLogAccountId(admissionState.authCtx), config);

package/src/server/responses/request-transport.ts

@@ -1,3 +1,5 @@
+import { anthropicFamilyRejected, claimAnthropicFamilyRevalidation } from "../../oauth/anthropic-model-quota";
+import { anthropicRatePauseUntil } from "../../oauth/anthropic-rate-limit-policy";
 import { bindAnthropicRefusalCredential } from "../../oauth/anthropic-account-refusal";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
@@ -20,6 +22,7 @@ import {
   isAnthropicAccountPoolEnabled,
   getAnthropicPoolAccessSnapshot,
   getAnthropicAccountHealthSnapshot,
+  AnthropicAccountCooldownError,
   getEligibleAnthropicAccounts,
   commitAnthropicSelectionRouting,
   formatAnthropicProviderForLog,
@@ -174,7 +177,7 @@ export async function prepareResponsesTransport(
           ? await getAnthropicPoolAccessSnapshot(oauthSelection.accountId)
           : await getValidAccessSnapshotForAccount(route.providerName, oauthSelection.accountId, { requireUsableAccount: true });
       }
-      if (anthropicRouteDecision && !routeCandidates(getEligibleAnthropicAccounts(), anthropicRouteDecision).includes(candidate.accountId)) return null;
+      if (anthropicRouteDecision && !routeCandidates(getEligibleAnthropicAccounts(Date.now(), route.modelId), anthropicRouteDecision).includes(candidate.accountId)) return null;
       const committed = await commitOAuthAccountSelection(route.providerName, candidate.accountId, {
         expectedSelection: oauthSelection,
         expectedCredentialGeneration: candidate.generation,
@@ -183,7 +186,7 @@ export async function prepareResponsesTransport(
       if (committed) {
         if (route.providerName === "anthropic" && !commitAnthropicSelectionRouting(
           candidate.accountId, oauthSelection, committed,
-          { config, sessionKey: anthropicSessionKey, reason: anthropicReason, expectedCredentialGeneration: candidate.generation, routeDecision: anthropicRouteDecision },
+          { config, sessionKey: anthropicSessionKey, reason: anthropicReason, expectedCredentialGeneration: candidate.generation, routeDecision: anthropicRouteDecision, model: route.modelId },
         )) return null;
         oauthSelection = committed;
         servingOAuthSnapshot = candidate;
@@ -197,7 +200,7 @@ export async function prepareResponsesTransport(
       // A revision also changes on per-account policy edits. Re-evaluate the selector
       // after credential waits even without a model route, rather than reusing stale active.
       const revisedAnthropic = route.providerName === "anthropic"
-        ? resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision) : null;
+        ? resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision, route.modelId) : null;
       const revisedAnthropicId = revisedAnthropic?.accountId;
       if (route.providerName === "anthropic" && !revisedAnthropicId) return null;
       if (revisedAnthropic) anthropicReason = revisedAnthropic.reason;
@@ -217,8 +220,11 @@ export async function prepareResponsesTransport(
     const admitted = await commitResolvedOAuthSelection(candidate);
     if (!admitted) throw new Error("OAuth selection changed during credential recovery");
     if (kiroLoadEnabled && options.accountLoad?.lease?.accountId !== admitted.accountId) {
-      const replayLease = await acquireAccountLease("kiro", admitted.accountId, { maxConcurrentPerAccount: kiroCap });
-      if (!replayLease || !options.accountLoad) {
+      const signal = options.abortSignal ?? req.signal;
+      const replayLease = await acquireAccountLease("kiro", admitted.accountId, {
+        maxConcurrentPerAccount: kiroCap, signal,
+      });
+      if (!replayLease || !options.accountLoad || options.accountLoad.cancelled || signal.aborted) {
         replayLease?.release();
         throw new Error("Kiro replay account capacity is full");
       }
@@ -263,16 +269,20 @@ export async function prepareResponsesTransport(
     retryParsed: OcxParsedRequest = parsed,
   ): Promise<OAuthAccessSnapshot | null> => {
     if (route.provider.googleMode === "cloud-code-assist" && !snapshot.projectId) return null;
+    const signal = options.abortSignal ?? req.signal;
     let speculative = kiroLoadEnabled && options.accountLoad?.lease?.accountId !== snapshot.accountId
-      ? await acquireAccountLease("kiro", snapshot.accountId, { maxConcurrentPerAccount: kiroCap }) : null;
+      ? await acquireAccountLease("kiro", snapshot.accountId, { maxConcurrentPerAccount: kiroCap, signal }) : null;
+    if (speculative && (options.accountLoad?.cancelled || signal.aborted)) { speculative.release(); return null; }
     if (kiroLoadEnabled && options.accountLoad?.lease?.accountId !== snapshot.accountId && !speculative) return null;
     let committed: OAuthAccessSnapshot | null;
     try { committed = await commitResolvedOAuthSelection(snapshot); }
     catch (error) { speculative?.release(); throw error; }
     if (!committed) { speculative?.release(); return null; }
+    if (speculative && (options.accountLoad?.cancelled || signal.aborted)) { speculative.release(); return null; }
     if (kiroLoadEnabled && committed.accountId !== (speculative?.accountId ?? options.accountLoad?.lease?.accountId)) {
       speculative?.release();
-      speculative = await acquireAccountLease("kiro", committed.accountId, { maxConcurrentPerAccount: kiroCap });
+      speculative = await acquireAccountLease("kiro", committed.accountId, { maxConcurrentPerAccount: kiroCap, signal });
+      if (speculative && (options.accountLoad?.cancelled || signal.aborted)) { speculative.release(); return null; }
       if (!speculative) return null;
     }
     if (speculative && options.accountLoad) {
@@ -299,6 +309,12 @@ export async function prepareResponsesTransport(
       parsed._kiroAuthContext = kiroContext;
       if (retryParsed !== parsed) retryParsed._kiroAuthContext = { ...kiroContext };
     }
+    if (route.providerName === "zed") {
+      // Zed signs with its own user id; `snapshot.accountId` is the local slot hash.
+      const zedContext = { userId: snapshot.providerUserId ?? "" };
+      parsed._zedAuthContext = zedContext;
+      if (retryParsed !== parsed) retryParsed._zedAuthContext = { ...zedContext };
+    }
     // Re-stamp: a request that rotated accounts must be attributed to the account that actually
     // served it. All three rotation sites funnel through here, so this is the only re-stamp
     // needed -- and putting it anywhere else would let one of the three drift.
@@ -345,7 +361,7 @@ export async function prepareResponsesTransport(
     const row = getAccountCredentialWithStatus(route.providerName, binding.snapshot.accountId);
     return selected?.accountId === binding.selection.accountId && selected?.revision === binding.selection.revision
       && !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
-      && (route.providerName !== "anthropic" || !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId))
+      && (route.providerName !== "anthropic" || !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId) && !anthropicRatePauseUntil(binding.snapshot.accountId) && !anthropicFamilyRejected(binding.snapshot.accountId, route.modelId))
       && credentialGeneration(row.credential) === binding.snapshot.generation;
   };
   const resolveSelectionAdapter = (provider: OcxProviderConfig, retention = config.cacheRetention): ProviderAdapter => {
@@ -412,11 +428,11 @@ export async function prepareResponsesTransport(
       let candidate = servingOAuthSnapshot;
       if (route.providerName === "anthropic") {
         oauthSelection = captureOAuthAccountSelection(route.providerName);
-        const accountId = await resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision);
+        const accountId = await resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
         candidate = await getAnthropicPoolAccessSnapshot(accountId);
       }
       if (!candidate || !await applyFailoverSnapshot(candidate, requestParsed)) {
-        if (route.providerName === "anthropic") await resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision);
+        if (route.providerName === "anthropic") await resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
         throw new Error("OAuth account selection changed before dispatch");
       }
     } else {
@@ -503,18 +519,22 @@ export async function prepareResponsesTransport(
           // Reselection can choose a provider override instead of the supplied executor.
           // Either way the send crosses the physical boundary, so the connection policy is
           // applied around whichever implementation was just selected (#4992).
-          commitKeyAttemptSend();
           // The binding travels with the send, so a rebuilt request resolves its provider route
           // against the destination it is actually going to rather than the one this dispatch
           // started with. Account reselection can move the upstream host, which would otherwise
           // apply a host-scoped decision to a different host.
-          const response = await sendWithConnectionPolicy(
-            fetchImpl,
-            destination,
-            { ...dispatchInit, redirect: "manual" },
-            { providerName: route.providerName, provider: route.provider },
-          );
-          if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
+          const releaseFamily = snapshot ? claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
+          if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+          let response: Response;
+          try {
+            commitKeyAttemptSend();
+            response = await sendWithConnectionPolicy(
+              fetchImpl,
+              destination,
+              { ...dispatchInit, redirect: "manual" },
+              { providerName: route.providerName, provider: route.provider },
+            );
+          } finally { releaseFamily(); }
           // Observe each physical response before retries replace it. The binding belongs to
           // this dispatch, so a manual switch cannot file A's headers against B. Header
           // overrides and credential replacement make ownership unprovable: skip those writes.
@@ -523,10 +543,11 @@ export async function prepareResponsesTransport(
               const current = getAccountCredentialWithStatus("anthropic", snapshot.accountId);
               if (current && !current.needsReauth && credentialGeneration(current.credential) === snapshot.generation) {
                 bindAnthropicRefusalCredential(response, snapshot);
-                recordAnthropicAccountQuotaFromHeaders(snapshot.accountId, response.headers, writerGeneration);
+                recordAnthropicAccountQuotaFromHeaders(snapshot.accountId, response.headers, writerGeneration, response.status, route.modelId);
               }
             } catch { /* best-effort observation cannot fail the response */ }
           }
+          if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
           return response;
         }
         const nextAdapter = await refreshDispatchAdapter(requestParsed);
@@ -577,13 +598,13 @@ export async function prepareResponsesTransport(
         const routeResult = resolveAnthropicModelRoute(config, route.modelId);
         if (routeResult.error) return formatErrorResponse(400, "invalid_request_error", `Invalid Anthropic model routes: ${routeResult.error}`);
         anthropicRouteDecision = routeResult.decision;
-        const selection = resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision);
+        const selection = resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision, route.modelId);
         if (!selection.accountId) {
           if (selection.reason === "paused") return formatErrorResponse(403, "permission_error", "Anthropic OAuth accounts are paused. Resume an account in account settings and retry.");
           // Route names may resemble account IDs; log only the matched rule position.
           if (anthropicRouteDecision) console.warn(`[anthropic-pool] route:#${anthropicRouteDecision.position} ${selection.reason}; answering locally`);
           if (selection.reason === "all-cooled") {
-            const retryAfterSec = getAnthropicPoolRetryAfterSeconds(Date.now(), anthropicRouteDecision);
+            const retryAfterSec = getAnthropicPoolRetryAfterSeconds(Date.now(), anthropicRouteDecision, route.modelId);
             return formatErrorResponse(
               429,
               "rate_limit_error",
@@ -667,11 +688,18 @@ export async function prepareResponsesTransport(
         if (safetyAlternateId && admitted.accountId !== safetyAlternateId)
           return formatErrorResponse(409, "conflict_error", "OAuth account selection changed; retry the request");
         if (kiroLoadEnabled) {
+          const transportSignal = options.abortSignal ?? req.signal;
           const lease = await acquireAccountLease("kiro", admitted.accountId, {
-            maxConcurrentPerAccount: kiroCap, waitMs: KIRO_ACCOUNT_WAIT_MS, signal: options.abortSignal ?? req.signal,
+            maxConcurrentPerAccount: kiroCap, waitMs: KIRO_ACCOUNT_WAIT_MS, signal: transportSignal,
           });
-          if (!lease) return (options.abortSignal ?? req.signal).aborted
+          if (!lease) return transportSignal.aborted
             ? clientCancelledResponse() : capacityResponse();
+          // The lease may be granted between the holder's cleanup and this install;
+          // re-check cancellation before the holder can no longer reach it.
+          if (options.accountLoad?.cancelled || transportSignal.aborted) {
+            lease.release();
+            return clientCancelledResponse();
+          }
           if (options.accountLoad) options.accountLoad.lease = lease;
           else lease.release();
         }
@@ -717,6 +745,9 @@ export async function prepareResponsesTransport(
           // Only genuinely accountless adapter calls leave the context undefined and use local/env fallback.
           parsed._kiroAuthContext = { ...(resolved.kiro ?? {}) };
         }
+        if (route.providerName === "zed") {
+          parsed._zedAuthContext = { userId: resolved.providerUserId ?? "" };
+        }
         // Project identity belongs to the admitted account on EVERY request, including
         // the request after a pool transition made that account the persisted active one.
         if (route.provider.googleMode === "cloud-code-assist") {

package/src/server/responses/run-turn-execution.ts

@@ -62,6 +62,7 @@ const RUNTURN_WS_ROUTE_STATE_KEYS = [
   "_cursorConversationId",
   "_cursorClientThreadId",
   "_kiroAuthContext",
+  "_zedAuthContext",
   "_providerContinuation",
   "_providerContinuationOwner",
   "_providerContinuationCandidate",

package/src/server/responses/sidecar-execution.ts

@@ -177,6 +177,11 @@ export async function executeResponsesSidecars(
   const imgPlan = !routedCompaction ? await planImageBridge(config, parsed, route.provider) : undefined;
   const vidPlan = !routedCompaction ? await planVideoBridge(config, parsed, route.provider) : undefined;
   const canRunWebSearch = !!wsPlan && !transportState.adapter.runTurn;
+  let sidecarOutputStarted = false;
+  const sidecarHasCommittedOutput = () => sidecarOutputStarted
+    || (logCtx.activeAttempt?.deliverySummary?.semanticBytes ?? 0) > 0
+    || (logCtx.activeAttempt?.deliverySummary?.sideEffectEvents ?? 0) > 0;
+  const noteSidecarOutput = () => { sidecarOutputStarted = true; options.onFirstOutput?.(); };
   const rotateSidecarProviderOn429 = async (
     retryAfter: string | null,
     responseHeaders?: Headers,
@@ -270,7 +275,8 @@ export async function executeResponsesSidecars(
       const nextAccountId = await rotateAnthropicAccountOnResponse(
         originalResponse ?? new Response(null, { status: 429, headers: responseHeaders ?? (retryAfter ? { "retry-after": retryAfter } : undefined) }), {
           config, accountId: transportState.anthropicPoolAccountId, sessionKey: anthropicSessionKey,
-          decision: transportState.anthropicRouteDecision, signal: options.abortSignal,
+          model: route.modelId, requestKey: transportState, decision: transportState.anthropicRouteDecision, signal: options.abortSignal,
+          allow429Recovery: !sidecarHasCommittedOutput(), allowAccountRefusal: !sidecarHasCommittedOutput(),
           canRetry: hop.allowed && transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
         });
       if (!nextAccountId) {
@@ -422,7 +428,7 @@ export async function executeResponsesSidecars(
       on429: rotateSidecarProviderOn429,
       retryOn429Policy: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro")
         ? null : rateLimitRetryPolicyFor(route.provider),
-      ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
+      onFirstOutput: noteSidecarOutput,
       ...(options.forceEmptyResponseId ? { forceEmptyResponseId: true } : {}),
       onCompletedResponse: (response, providerState) => {
         const served = transportState.replayOAuthCredentialSnapshot;
@@ -493,7 +499,7 @@ export async function executeResponsesSidecars(
       maxSearches: wsPlan.maxSearches,
       forceEmptyResponseId: true,
       abortSignal: options.abortSignal,
-      ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
+      onFirstOutput: noteSidecarOutput,
       onRequestBuilt: request => {
         recordAdapterReasoning(logCtx, request);
         recordAdapterTier(logCtx, request);