@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/server/responses/codex-auth-error.ts

@@ -30,9 +30,15 @@ export function codexModelAvailabilityErrorResponse(error: CodexModelAvailabilit
   return formatErrorResponse(400, "invalid_request_error", error.message);
 }
 
+/** Actionable sign-in guidance without guessing which upstream revocation cause occurred. */
+export const CODEX_MAIN_SIGN_IN_REQUIRED_MESSAGE =
+  "Codex main account needs sign-in. Run `codex login` to sign in again.";
+
 export function nativeMainRefreshFailureResponse(error: unknown): Response {
   if (error instanceof MainAccountTokenRefreshError && error.reason === "reauth") {
-    return formatErrorResponse(401, "authentication_error", "Codex main account needs reauthentication");
+    // Same sentence the quarantine produces on every later request, so the first refusal and the
+    // ones after it do not describe one dead credential two different ways.
+    return formatErrorResponse(401, "authentication_error", CODEX_MAIN_SIGN_IN_REQUIRED_MESSAGE);
   }
   if (error instanceof MainAccountTokenRefreshError
     || error instanceof MainAuthJsonChangedDuringRefreshError
@@ -98,7 +104,9 @@ export function mapCodexAuthContextErrorToResponse(
     return codexModelAvailabilityErrorResponse(error);
   }
   if (error instanceof CodexPoolAuthenticationError || error instanceof CodexDirectAuthenticationError) {
-    return formatErrorResponse(401, "authentication_error", error.message);
+    return formatErrorResponse(401, "authentication_error",
+      error instanceof CodexPoolAuthenticationError && error.quarantinedMain
+        ? CODEX_MAIN_SIGN_IN_REQUIRED_MESSAGE : error.message);
   }
   if (error instanceof CodexMainSubstitutionUnavailableError) {
     return formatErrorResponse(

package/src/server/responses/combo-stream-preflight.ts

@@ -1,3 +1,4 @@
+import { codexAccountModelRefusal, codexAccountModelRefusalPayload, hasConflictingCodexModelRefusalEnvelopes, type CodexAccountModelRefusal } from "../../combos/failover";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import { comboFailureDecision } from "../../combos";
 import { httpStatusFromTerminalError } from "../../lib/errors";
@@ -68,6 +69,26 @@ function bareErrorStatus(payload: unknown): number | undefined {
   });
 }
 
+/** Match the selected SSE error envelope before projection drops competing fields. */
+function terminalModelRefusal(status: number, event: Record<string, unknown>): CodexAccountModelRefusal {
+  if (hasConflictingCodexModelRefusalEnvelopes(status, event)) return "ambiguous";
+  const outer = codexAccountModelRefusalPayload(status, event);
+  if (outer === "ambiguous") return outer;
+  const nested = event.response;
+  if (event.type !== "error" && nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const nestedKind = codexAccountModelRefusalPayload(status, nested);
+    if (nestedKind === "ambiguous") return nestedKind;
+    const nestedError = (nested as Record<string, unknown>).error;
+    if (nestedError && typeof nestedError === "object" && !Array.isArray(nestedError)) {
+      return nestedKind;
+    }
+  }
+  if (event.type === "error" && !Object.hasOwn(event, "error") && typeof event.message === "string") {
+    return codexAccountModelRefusal(status, event.message, { allowNestedResponse: false });
+  }
+  return outer;
+}
+
 function bareErrorIsRetryable(payload: unknown): boolean {
   const status = bareErrorStatus(payload);
   if (status === undefined || !payload || typeof payload !== "object" || Array.isArray(payload)) {
@@ -84,7 +105,9 @@ function bareErrorIsRetryable(payload: unknown): boolean {
   const message = typeof error.message === "string"
     ? error.message
     : typeof event.message === "string" ? event.message : "";
-  return comboFailureDecision(status, message, { code }) === "hop";
+  return comboFailureDecision(status, message, {
+    code, codexModelRefusal: terminalModelRefusal(status, event),
+  }) === "hop";
 }
 
 function retryableZeroOutputTerminal(payload: unknown): boolean {
@@ -226,7 +249,7 @@ function failedTerminalResponse(
 
 export type ComboStreamPreflightResult =
   | { kind: "accepted"; response: Response }
-  | { kind: "failed"; response: Response }
+  | { kind: "failed"; response: Response; codexModelRefusal?: CodexAccountModelRefusal }
   /**
    * The body errored mid-stream and `replayReadErrors` asked for the prefix back rather than
    * a rethrow. `stage` is how far the inspection actually got; whether that permits a
@@ -322,7 +345,10 @@ export async function preflightComboStreamResponse(
         || retryableTerminalPayload?.type === "error")
         && !outputCommitted && retryableTerminalPayload) {
         await reader.cancel("retrying zero-output combo stream terminal").catch(() => undefined);
-        return { kind: "failed", response: failedTerminalResponse(response, retryableTerminalPayload, logCtx) };
+        const failed = failedTerminalResponse(response, retryableTerminalPayload, logCtx);
+        return { kind: "failed", response: failed,
+          ...(failed.status === 400
+            ? { codexModelRefusal: terminalModelRefusal(failed.status, retryableTerminalPayload) } : {}) };
       }
       if (next.done || terminalStatus !== undefined || outputCommitted
         || bufferedBytes >= COMBO_STREAM_PREFLIGHT_MAX_BYTES

package/src/server/responses/compaction-routing.ts

@@ -1,6 +1,6 @@
 import type { OcxConfig } from "../../types";
 import { isDeclaredReasoningEffort } from "../../reasoning-effort";
-import { COMPACTION_TRIGGERS } from "../../config/schema/compaction-triggers";
+import { COMPACTION_TRIGGERS, validCompactionSourceModels } from "../../config/schema/compaction-triggers";
 import { routeConcreteModel, type RouteResult } from "../../router";
 import { resolveComboId } from "../../combos/identifiers";
 import { resolvePolicyProfileId } from "../../routing/profile";
@@ -57,6 +57,15 @@ export function applyCompactionRoutingOverride(
     && (typeof override.reasoningEffort !== "string" || !isDeclaredReasoningEffort(override.reasoningEffort))) return null;
   const triggers = configuredTriggers(override.triggers);
   if (!triggers) return null;
+  if (override.sourceModels !== undefined) {
+    if (!validCompactionSourceModels(override.sourceModels)) return null;
+    // Match the selector the conversation actually routed on: a synthetic `--fast` or
+    // effort suffix is ingress decoration, so `cheap--fast` is still the allowlisted `cheap`.
+    const source = sourceSelectorOf(config, raw.model);
+    if (!override.sourceModels.some(selector => selector.endsWith("/*")
+      ? source.startsWith(selector.slice(0, -1)) && source.length > selector.length - 1
+      : source === selector)) return null;
+  }
   if (options.endpoint !== "compact"
     && !(Array.isArray(raw.input) && raw.input.some(item => record(item)?.type === "compaction_trigger"))) return null;
 

package/src/server/responses/core-auth.ts

@@ -57,6 +57,9 @@ export type ResponsesAuthResolution =
   | { ok: false; response: Response };
 
 
+export type CodexCredentialOwnershipOptions = Pick<HandleResponsesOptions,
+  "admission" | "callerDirectAuth" | "stripClaudeMainAuthForNoncanonicalForward" | "trustedClaudeMainAuth">;
+
 /**
  * The caller credential the final Codex auth resolution will be given, as far as the ROUTE
  * decides it: a route change that may cross a credential domain drops the raw caller credential,
@@ -67,15 +70,53 @@ export type ResponsesAuthResolution =
  * an HMAC of exactly this Authorization header. Two copies of this rule would put preview and
  * final auth in different scopes the first time one of them changed.
  */
+/**
+ * The stored native-main credential this process injected itself, when it is the bearer the
+ * resolution will see.
+ *
+ * `handleClaudeMessages` reads `~/.codex/auth.json` and attaches it so OpenAI-backed sidecars stay
+ * reachable on a translated turn. It is OUR credential, not the caller's -- the ingress says so
+ * where it sets `nativeCallerAuth` and `callerDirectAuth` to null for exactly this reason -- and
+ * every reader of the resolution's input headers has to agree about that, or one of them conclud
+ * the request owns a credential that in fact belongs to the Pool.
+ */
+export function injectedClaudeMainBearer(
+  route: Pick<RouteResult, "provider">,
+  options: CodexCredentialOwnershipOptions,
+): { authorization: string; chatgptAccountId?: string } | undefined {
+  return options.stripClaudeMainAuthForNoncanonicalForward === true
+    && isCanonicalOpenAiForwardProvider(route.provider)
+    ? options.trustedClaudeMainAuth : undefined;
+}
+
+function validatedCallerDirectHeaders(
+  config: OcxConfig,
+  route: Pick<RouteResult, "provider">,
+  options: CodexCredentialOwnershipOptions,
+): Headers | undefined {
+  if (!options.callerDirectAuth || !isCanonicalOpenAiForwardProvider(route.provider)) return undefined;
+  const headers = new Headers({ authorization: options.callerDirectAuth.authorization });
+  if (options.callerDirectAuth.chatgptAccountId) headers.set("chatgpt-account-id", options.callerDirectAuth.chatgptAccountId);
+  return captureCallerDirectAuth(headers, config) ? headers : undefined;
+}
+
 export function codexRouteCredentialDomainHeaders(
   req: Request,
   route: RouteResult,
   options: HandleResponsesOptions,
   credentialDomainWasRewritten: boolean,
+  config: OcxConfig,
 ): Headers {
-  const trustedClaudeMainForFinalRoute = options.stripClaudeMainAuthForNoncanonicalForward === true
-    && isCanonicalOpenAiForwardProvider(route.provider)
-    ? options.trustedClaudeMainAuth : undefined;
+  const callerDirect = validatedCallerDirectHeaders(config, route, options);
+  if (callerDirect) {
+    const headers = new Headers(req.headers);
+    headers.set("authorization", callerDirect.get("authorization")!);
+    const accountId = callerDirect.get("chatgpt-account-id");
+    if (accountId) headers.set("chatgpt-account-id", accountId);
+    else headers.delete("chatgpt-account-id");
+    return headers;
+  }
+  const trustedClaudeMainForFinalRoute = injectedClaudeMainBearer(route, options);
   if (trustedClaudeMainForFinalRoute) {
     const claudeMainHeaders = new Headers(req.headers);
     claudeMainHeaders.set("authorization", trustedClaudeMainForFinalRoute.authorization);
@@ -117,15 +158,25 @@ export function codexRouteCredentialDomainHeaders(
 export function codexRouteCredentialOwnership(
   authInputHeaders: Headers,
   config: OcxConfig,
-  route: RouteResult,
-  options: HandleResponsesOptions,
+  route: Pick<RouteResult, "provider" | "codexAccountMode">,
+  options: CodexCredentialOwnershipOptions,
 ): { substituteMainCredential: boolean; requestScopedMainCredential: boolean } {
   const substituteMainCredential = options.admission?.source === "bearer"
     && (route.codexAccountMode !== undefined || isCanonicalOpenAiForwardProvider(route.provider));
   return {
     substituteMainCredential,
+    // A request-scoped main credential is one the CALLER owns: it exists for this request only,
+    // owns no Pool state, and must never be quarantined or refreshed on the Pool's behalf. The
+    // stored credential this process injected is the opposite of that in every respect, and
+    // `hasForwardableCodexBearer` cannot tell them apart -- it sees a Codex JWT with an account
+    // id either way. Counting ours as the caller's made the native main slot caller-owned on
+    // every translated Claude turn: `main` instead of `main-pool`, so an upstream 401 on a
+    // revoked session recorded no outcome, refreshed nothing, and retired nothing, and the next
+    // request sent the same dead token again.
     requestScopedMainCredential: route.codexAccountMode !== undefined
       && !substituteMainCredential
+      && (validatedCallerDirectHeaders(config, route, options) !== undefined
+        || injectedClaudeMainBearer(route, options) === undefined)
       && hasForwardableCodexBearer(authInputHeaders, config),
   };
 }
@@ -149,6 +200,7 @@ export async function resolveResponsesCodexAuth(
       route,
       options,
       credentialDomainWasRewritten,
+      config,
     );
     // A caller-auth transport that is not canonical OpenAI (keyless Cursor) consumes the
     // caller's Authorization as its own upstream token. Keep that contract only for a clean
@@ -171,27 +223,6 @@ export async function resolveResponsesCodexAuth(
         authInputHeaders = scoped;
       }
     }
-    // The caller's own Direct credential may cross an internal route change only to the
-    // canonical OpenAI transport, under a predicate deliberately STRICTER than plain
-    // unchanged-route Direct forwarding: a clean non-proxy bearer whose ChatGPT-domain
-    // marker is valid, with any explicit account header matching that marker. Unchanged
-    // routes keep their legacy rules; sidecar enrichment grants no primary authority.
-    if (options.callerDirectAuth && isCanonicalOpenAiForwardProvider(route.provider)) {
-      const directHeaders = new Headers({
-        authorization: options.callerDirectAuth.authorization,
-        ...(options.callerDirectAuth.chatgptAccountId
-          ? { "chatgpt-account-id": options.callerDirectAuth.chatgptAccountId } : {}),
-      });
-      if (captureCallerDirectAuth(directHeaders, config)) {
-        authInputHeaders = new Headers(authInputHeaders);
-        authInputHeaders.set("authorization", options.callerDirectAuth.authorization);
-        if (options.callerDirectAuth.chatgptAccountId) {
-          authInputHeaders.set("chatgpt-account-id", options.callerDirectAuth.chatgptAccountId);
-        } else {
-          authInputHeaders.delete("chatgpt-account-id");
-        }
-      }
-    }
     // #1686: a caller that proved admission with a BEARER presented one of our own secrets.
     // Refusing it here is what made the codex-cli `env_key` contract unusable against Direct.
     // Admitting it is only safe because the stored main credential is substituted below, so

package/src/server/responses/core-codex-account.ts

@@ -59,7 +59,7 @@ import {
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import { isRequestExecutionBudget } from "../../lib/request-execution-budget";
 import type { SingleUseDispatchPermit } from "../../lib/request-execution-budget";
-import { hasForwardableCodexBearer } from "../auth-cors";
+import { codexRouteCredentialOwnership, type CodexCredentialOwnershipOptions } from "./core-auth";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import {
   conversationStateBindingFromAuth,
@@ -360,7 +360,7 @@ export interface CodexPoolAccountRetryArgs {
   route: Pick<RouteResult, "providerName" | "modelId" | "provider" | "staticPolicy">;
   parsed: OcxParsedRequest;
   logCtx: RequestLogContext;
-  options: {
+  options: CodexCredentialOwnershipOptions & {
     admission?: DataPlaneAdmission;
     codexAuthPolicy?: CodexAuthPolicyConfig;
     visionDescribeTerminal?: boolean;
@@ -641,10 +641,13 @@ export async function retryCodexPoolOnAlternateAccount(
         "pool",
         {
           excludeAccountId: firstAuthCtx.accountId,
+          signal: options.abortSignal,
           admission: options.admission,
           codexAuthPolicy: options.codexAuthPolicy,
           modelId: route.modelId,
-          requestScopedMainCredential: hasForwardableCodexBearer(callerAuthHeaders, config),
+          requestScopedMainCredential: codexRouteCredentialOwnership(callerAuthHeaders, config, {
+            provider: route.provider, codexAccountMode: "pool",
+          }, options).requestScopedMainCredential,
           beginCodexAccountSelection: codexAccountSelectionForTurn(options.turnAdmissionLease),
           resolveCodexModelEntitlements: entitlementResolver,
         },

package/src/server/responses/core-combo-failure.ts

@@ -1,3 +1,4 @@
+import { codexAccountModelRefusal, codexAccountModelRefusalHardStopCode, type CodexAccountModelRefusal } from "../../combos/failover";
 import { parseRetryAfterMs } from "../../combos";
 import type { ConsumedComboFailure, HandleResponsesOptions } from "./core-options";
 import type { OcxUsage } from "../../types";
@@ -36,6 +37,7 @@ export async function consumeComboFailure(
   const nonReplayable = isNonReplayableResponse(response);
   const fallback = `Provider error ${response.status}`;
   let classificationText = fallback;
+  let codexModelRefusal: CodexAccountModelRefusal | undefined;
   let usage: OcxUsage | undefined;
   let upstreamCode: string | undefined;
   let upstreamMessage: string | undefined;
@@ -60,10 +62,11 @@ export async function consumeComboFailure(
         && isRateLimitOrQuotaFailureMessage(quotaMessage);
     }
     if (body.displaySafe && !body.truncated) {
+      if (response.status === 400) codexModelRefusal = codexAccountModelRefusal(response.status, body.text);
       const normalized = normalizeUpstreamErrorText(body.text, fallback);
       if (utf8Trusted || isCyberPolicyCode(normalized.code) || isCyberPolicyMessage(normalized.safeText)) {
         classificationText = normalized.safeText;
-        upstreamCode = normalized.code;
+        upstreamCode = codexAccountModelRefusalHardStopCode(response.status, body.text) ?? normalized.code;
         upstreamMessage = normalized.message;
         upstreamType = normalized.type;
       }
@@ -116,6 +119,7 @@ export async function consumeComboFailure(
     response: failureResponse,
     ...(nonReplayable ? { nonReplayable: true } : {}),
     classificationText,
+    ...(codexModelRefusal !== undefined ? { codexModelRefusal } : {}),
     ...(normalizedUpstreamCode !== undefined ? { upstreamCode: normalizedUpstreamCode } : {}),
     ...(upstreamType !== undefined ? { upstreamType } : {}),
     ...(!cyberFailure && cooldownRetryAfter !== undefined ? { retryAfter: cooldownRetryAfter } : {}),

package/src/server/responses/core-combo-native.ts

@@ -34,6 +34,7 @@ import {
 import { captureRouteStaticPolicy, routeConcreteModel } from "../../router";
 import { comboDefaultEffort, concreteComboRequestBody, getCombo } from "../../combos";
 import { supportedLadderFor } from "../effort-policy";
+import { applyDroidReasoningDefault } from "../droid-reasoning-default";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../../providers/opencode-go-transport";
 import { getOrAllocateRequestSessionLane } from "../request-log-conversation";
@@ -105,10 +106,11 @@ export function createComboProtocolLanes(input: {
   config: OcxConfig;
   logCtx: RequestLogContext;
   admission: DataPlaneAdmission | undefined;
+  droidDefaultEffort?: string;
   comboId: string;
   targets: readonly ComboTarget[];
 }): ComboProtocolLanes | undefined {
-  const { source, req, config, logCtx, admission, comboId, targets } = input;
+  const { source, req, config, logCtx, admission, droidDefaultEffort, comboId, targets } = input;
   if (!source) return undefined;
   const envelope = source.envelope;
   const reject = resolveProtocolSettings(config).unrepresentable === "reject";
@@ -207,6 +209,10 @@ export function createComboProtocolLanes(input: {
       const route = settle(target, targetRoute);
       const body = nativeBody(target, route);
       if (!route || !body) return undefined;
+      applyDroidReasoningDefault(body, droidDefaultEffort, {
+        provider: targetRoute.provider,
+        modelId: targetRoute.modelId,
+      });
       applyComboEffort(body, config, comboId, target, targetRoute);
       return { route, body, sendBudget: targetSendBudget };
     },

package/src/server/responses/core-combo.ts

@@ -1,8 +1,10 @@
+import type { CodexAccountModelRefusal } from "../../combos/failover";
 import {
   isCodexReasoningEffort,
   isDeclaredReasoningEffort,
   resolveEffortAtOrBelow,
 } from "../../reasoning-effort";
+import { resolveAdmissionModelScope, routeAllowedByScope } from "../admission-model-scope";
 import { recordAttemptRequestedEffort } from "../request-log";
 import {
   CODEX_TEXT_GUARDED_BUDGET_POLICY,
@@ -65,6 +67,8 @@ import {
   recoverEncryptedAgentTaskWithResult,
 } from "./agent-task-recovery";
 import { isThreadSpawnRequest, supportedLadderFor } from "../effort-policy";
+import { applyDroidResponsesReasoningDefault } from "../droid-reasoning-default";
+import { isPlainObject } from "../../lib/plain-data";
 import {
   clientCancelledResponse,
   comboUnavailable,
@@ -327,6 +331,7 @@ export async function executeComboResponses(
     config,
     logCtx,
     admission: options.admission,
+    droidDefaultEffort: options.droidDefaultEffort,
     comboId,
     targets: combo.targets,
   });
@@ -572,6 +577,9 @@ export async function executeComboResponses(
         candidates: choices.map(choice => choice.candidate),
         fallback,
         config,
+        isDestinationAllowed: (providerName, modelId) => routeAllowedByScope(
+          resolveAdmissionModelScope(config, options.admission), { providerName, modelId },
+        ),
         ...(combo.decisionProvider ? { decisionProvider: combo.decisionProvider } : {}),
         ...(combo.decisionModel
           ? {
@@ -709,8 +717,13 @@ export async function executeComboResponses(
       modelId: targetRoute.modelId,
     });
     const initialJevDecision = firstComboTarget ? jevDecision : undefined;
+    const childInput = options.droidDefaultEffort && isPlainObject(body) ? { ...body } : body;
+    applyDroidResponsesReasoningDefault(childInput, options.droidDefaultEffort, {
+      provider: targetRoute.provider,
+      modelId: targetRoute.modelId,
+    });
     const childBody = concreteComboRequestBody(
-      body,
+      childInput,
       pick.target,
       initialJevDecision ? initialJevDecision.effort : comboDefaultEffort(config, comboId),
       initialJevDecision?.effort === null ? [] : targetReasoningEfforts,
@@ -773,6 +786,7 @@ export async function executeComboResponses(
     const completedTarget = { provider: pick.target.provider, model: pick.target.model };
     const writerGeneration = pick.writerGeneration;
     let consumedChildFailure: ConsumedComboFailure | undefined;
+    let preflightModelRefusal: CodexAccountModelRefusal | undefined;
     const callbackGate = createChildPassthroughCallbackGate({
       ...options,
       onResponseComplete: model => {
@@ -895,6 +909,7 @@ export async function executeComboResponses(
         callbackGate.discard();
         terminalRecorder?.("failed", preflight.response.status);
         response = preflight.response;
+        preflightModelRefusal = preflight.codexModelRefusal;
       } else {
         response = preflight.response;
         if (nativePassthrough) markNativePassthroughSseResponse(response);
@@ -937,6 +952,7 @@ export async function executeComboResponses(
     try {
       failure = consumedChildFailure
         ?? await consumeComboFailure(response, options.abortSignal);
+      if (preflightModelRefusal !== undefined) failure = { ...failure, codexModelRefusal: preflightModelRefusal };
     } catch (error) {
       if (options.abortSignal?.aborted) {
         retainCancelledAttempt();
@@ -981,6 +997,7 @@ export async function executeComboResponses(
       ? "stop"
       : comboFailureDecision(failure.response.status, failure.classificationText, {
         code: failure.upstreamCode,
+        codexModelRefusal: failure.codexModelRefusal,
       });
     const wantsStream = (rawBody as { stream?: unknown } | null)?.stream === true;
     // Local byte admission has its own diagnostic; do not relabel it as an upstream refusal.

package/src/server/responses/core-normalize.ts

@@ -38,6 +38,7 @@ import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
 import { recordAttemptRequestedEffort } from "../request-log";
 import type { ResolvedFastPolicy } from "../../providers/fastwire";
+import { applyDroidResponsesReasoningDefault } from "../droid-reasoning-default";
 import { applyXaiOauthFastModel, xaiOauthFastModelForDecision } from "../../providers/xai-fast-model";
 
 /** Preview the billed xAI lane without mutating request state or resolving credentials. */
@@ -140,9 +141,15 @@ export async function applyFinalRouteRequestNormalization(args: {
   inboundWire: InboundWire;
   inboundTransport?: "websocket";
   claudeGoAffinity?: HandleResponsesOptions["claudeGoAffinity"];
+  droidDefaultEffort?: HandleResponsesOptions["droidDefaultEffort"];
 }): Promise<void> {
   const { parsed, route, config, req, logCtx, inboundWire, inboundTransport } = args;
   const effortSelector = prepareEffortNormalization(parsed, route);
+  if (applyDroidResponsesReasoningDefault(
+    parsed._rawBody,
+    args.droidDefaultEffort,
+    { provider: route.provider, modelId: route.modelId },
+  )) parsed.options.reasoning = args.droidDefaultEffort;
 
   // Only Anthropic message routes retain the Codex-facing selector. Other providers must keep
   // their existing response.model contract even when their public and wire model ids differ.

package/src/server/responses/core-options.ts

@@ -1,3 +1,4 @@
+import type { CodexAccountModelRefusal } from "../../combos/failover";
 import type { NativeResponseControl } from "./native-response-control";
 import type { AdapterEvent, OcxUsage, OcxProviderContinuationState, OcxConfig } from "../../types";
 import type { RouteResult } from "../../router";
@@ -24,6 +25,8 @@ import type { PolicyRequestScope } from "./policy-request-scope";
 export interface ConsumedComboFailure {
   response: Response;
   classificationText: string;
+  /** Complete bounded-envelope evidence captured before display truncation; never serialized. */
+  codexModelRefusal?: CodexAccountModelRefusal;
   /** Structured upstream `error.code` when present in the failure body. */
   upstreamCode?: string;
   /** Complete structured provider type, retained for conservative recovery classification. */
@@ -131,6 +134,8 @@ export interface HandleResponsesOptions {
    * it. Omitted means a genuine Responses inbound.
    */
   inboundWire?: InboundWire;
+  /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
+  droidDefaultEffort?: string;
   /** PF-07: the Chat source a combo child may send natively; set only by the Chat ingress. */
   protocolSource?: import("./core-combo-native").ComboProtocolSource;
   /** Internal transport identity for route-scoped upstream compatibility policy. */

package/src/server/responses/fetch-helpers.ts

@@ -192,8 +192,17 @@ export function sendWithConnectionPolicy(
   const egressInit = redirectedToLoopback
     ? { proxy: false as const }
     : decide ? providerEgressSendInit(egress, physicalFetch, input) : {};
+  // Bun can reset large native Codex string uploads before receiving headers while
+  // the identical UTF-8 buffer succeeds. Convert only at the final HTTP send so
+  // WebSocket selection still sees the serialized string and no retry is added.
+  const target = input instanceof Request ? input.url : String(input);
+  const body = init?.body;
+  const largeCodexBody = typeof body === "string"
+    && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
+    && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   return physicalFetch(input, {
     ...init,
+    ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),

package/src/server/responses/passthrough-delivery.ts

@@ -1329,7 +1329,7 @@ export async function deliverPassthroughResponse(
           clientJson = imageDisplay.json(clientJson);
         } catch (error) {
           if (error instanceof RangeError) {
-            return formatErrorResponse(502, "upstream_error", "hosted image result count exceeds local display limit");
+            return formatErrorResponse(502, "upstream_error", "hosted image result exceeds local display limits");
           }
           throw error;
         } finally { imageDisplay.dispose?.(); }

package/src/server/responses/policy-fallback.ts

@@ -111,7 +111,7 @@ async function shouldHopPolicyCandidate(response: Response, signal?: AbortSignal
   if (isPolicyCandidateRefusal(response)) return true;
   try {
     const inspected = await readBoundedResponseBody(response.clone(), { signal });
-    const text = inspected.displaySafe ? inspected.text : "";
+    const text = inspected.displaySafe && !inspected.truncated ? inspected.text : "";
     return comboFailureDecision(response.status, text, { code: errorCodeFromText(text) }) === "hop";
   } catch {
     return false;

package/src/server/responses/request-prepare.ts

@@ -676,6 +676,7 @@ export async function prepareResponsesRequest(
     route,
     options,
     credentialDomainWasRewritten,
+    config,
   );
   // Does the CALLER own the credential this request will authenticate with? Validated exactly
   // the way final auth validates it: the route ownership predicate AND the caller-bearer check
@@ -736,6 +737,7 @@ export async function prepareResponsesRequest(
     // recovery or a profile drain fences the physical identity, final auth drops main and preview
     // has to drop it too. A hardcoded `true` would be wrong in the second case and `false` in
     // the first.
+    requestOwnedMainCredential: previewRequestScopedMainCredential,
     isMainAccountTokenLive: previewRequestScopedMainCredential
       ? () => previewRequestOwnedMainCredentialLive
       : undefined,
@@ -962,6 +964,7 @@ export async function prepareResponsesRequest(
                 route,
                 options,
                 credentialDomainWasRewritten,
+                config,
               );
               const recoveryRequestScopedMainCredential = codexRouteCredentialOwnership(
                 recoveryAuthHeaders,
@@ -993,6 +996,7 @@ export async function prepareResponsesRequest(
               const recoverySelectionOptions = {
                 nativeMainSelectionOnly: !recoveryNativeMainBlocked
                   && recoverySelectionAdmission?.mainProfileDraining === true,
+                requestOwnedMainCredential: recoveryRequestScopedMainCredential,
                 isMainAccountTokenLive: recoveryRequestScopedMainCredential
                   ? () => recoveryRequestOwnedMainCredentialLive
                   : undefined,
@@ -1222,6 +1226,7 @@ export async function prepareResponsesRequest(
     inboundWire,
     inboundTransport: options.inboundTransport,
     claudeGoAffinity: options.claudeGoAffinity,
+    droidDefaultEffort: options.droidDefaultEffort,
   });
   try {
     assertPolicyNormalizedRoute(policyScope, admittedPolicyRoute, route);

package/src/server/responses/request-spend.ts

@@ -1,9 +1,9 @@
 import { randomUUID } from "node:crypto";
 import type { RequestSendObserver } from "../../lib/request-execution-budget";
-import { sharedSpendLedger, type SpendReservationLedger } from "../../lib/spend-reservation-ledger";
+import { sharedSpendLedger, type SpendReservationLedger, type SpendScopes } from "../../lib/spend-reservation-ledger";
 import { SpendLedgerOwnerError } from "../../lib/spend-ledger-owner";
 import { markLocalRequestLogRefusal, type RequestLogContext } from "../request-log";
-import { recordWorkflowRefusalEvent, workflowDenialSummary } from "../../lib/workflow-budget";
+import { recordWorkflowRefusalEvent, workflowDenialSummary, type WorkflowDenial } from "../../lib/workflow-budget";
 
 /** The terminal usage a request reported, in the only two fields the ledger books. */
 export interface TerminalSpendUsage {
@@ -81,44 +81,44 @@ export function createRequestSpendTracker(
       // short of its limit forever and refuse nothing.
       const alreadySent = options?.alreadySent === true;
       const sendId = randomUUID();
-      const decision = ledger().reserve({
+      const bookedLedger = ledger();
+      const scopes: SpendScopes = {
+        ...(rootId !== undefined ? { rootId } : {}),
+        // The existing privacy-safe log label is aliased again by the ledger.
+        ...(logCtx.accountLogLabel !== undefined ? { identityId: logCtx.accountLogLabel } : {}),
+        ...(logCtx.provider !== undefined ? { poolId: logCtx.provider } : {}),
+      };
+      const policy = bookedLedger.policy;
+      const enforced = (scopes.rootId !== undefined && policy.root.maxTokens !== undefined)
+        || (scopes.identityId !== undefined && policy.identity.maxTokens !== undefined)
+        || (scopes.poolId !== undefined && policy.pool.maxTokens !== undefined);
+      const decision = bookedLedger.reserve({
         sendId,
-        scopes: {
-          ...(rootId !== undefined ? { rootId } : {}),
-          // Already the privacy-safe label the request log uses, and the ledger aliases it
-          // again on the way to disk. A raw credential never reaches either.
-          ...(logCtx.accountLogLabel !== undefined ? { identityId: logCtx.accountLogLabel } : {}),
-          ...(logCtx.provider !== undefined ? { poolId: logCtx.provider } : {}),
-        },
+        scopes,
         inputTokens: logCtx.spendInputEstimateTokens ?? logCtx.usageLogInputTokens ?? 0,
         outputCeilingTokens: logCtx.spendOutputCeilingTokens ?? 0,
         ...(alreadySent ? { alreadySent: true } : {}),
       });
       if (!decision.reserved) {
+        // An applicable ceiling cannot authorize an unbooked send, including when tracking
+        // capacity is full. Unconfigured/nonapplicable requests remain observe-only, and a
+        // physical send reported after dispatch cannot be refused retroactively.
+        if (alreadySent || !enforced) return true;
         refusals += 1;
         const denial = decision.denial;
-        // A ceiling refuses, and so does a ledger that cannot make the reservation durable
-        // under one. That second case is the whole reason this store is on disk: admitting a
-        // send whose record a restart would forget is how an exhausted budget comes back with
-        // a fresh allowance, and the ledger raises those two denials ONLY when a limit is
-        // configured -- so an install that configured nothing is still never refused here.
-        // Capacity and a duplicate send id stay permissive: they say the ledger cannot account
-        // for this send, which is a degradation to report, not an outage to cause.
-        if (denial.reason === "reserve-not-durable" || denial.reason === "journal-corrupt") {
-          return alreadySent;
-        }
-        if (denial.reason !== "spend-limit-exceeded") return true;
-        // This send is refused, and the dispatch path that asked will report an exhausted send
-        // budget -- from there, that is all it can see. The row is where an operator actually
-        // looks, so the ceiling is named on it here: a locally assigned code wins in
-        // addFinalRequestLog, so the request that CROSSED the ceiling reads as a spend refusal
-        // rather than as the ordinary budget exhaustion it would otherwise be indistinguishable
-        // from. The event ring gets the same pair so /api/workflow-budget agrees with the row.
-        const detail = { scope: denial.scope, limit: denial.limit, projected: denial.projected };
-        const summary = workflowDenialSummary("workflow-spend-exhausted", detail);
+        const reason: WorkflowDenial = denial.reason === "duplicate-send-id"
+          ? "workflow-send-replayed"
+          : denial.reason === "reserve-not-durable" || denial.reason === "journal-corrupt"
+            ? "workflow-spend-undurable"
+            : denial.reason === "tracking-capacity-exhausted"
+              ? "workflow-tracking-exhausted"
+              : "workflow-spend-exhausted";
+        const detail = denial.reason === "spend-limit-exceeded"
+          ? { scope: denial.scope, limit: denial.limit, projected: denial.projected } : undefined;
+        const summary = workflowDenialSummary(reason, detail);
         markLocalRequestLogRefusal(logCtx, summary.code);
         logCtx.errorCode = summary.code;
-        recordWorkflowRefusalEvent(rootId, "workflow-spend-exhausted", Date.now(), detail);
+        recordWorkflowRefusalEvent(rootId, reason, Date.now(), detail);
         return false;
       }
       live.push(sendId);