@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/server/responses/adapter-dispatch.ts

@@ -1,5 +1,8 @@
 import { classifyAnthropic429 } from "../../oauth/anthropic-rate-limit-policy";
 import { rotateAnthropicAccountOnResponse } from "../../oauth/anthropic-account-refusal";
+import { authorizeResendForRecovery } from "../../lib/request-resend-gate";
+import { ambiguousResendAllowanceFor, selfContainedResponsesBody } from "./reset-replay";
+import { transientSendCapFor } from "./request-send-budget";
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import { isLocalUpstream } from "../../lib/local-upstream";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
@@ -25,6 +28,7 @@ import { withProviderRequestSlot } from "../../providers/request-pacing";
 import { providerFetch, fetchWithHeaderTimeout, safeHostLabel } from "./fetch-helpers";
 import {
   transientRetryPolicyFor,
+  resetReplayPolicyFor,
   rateLimitRetryPolicyFor,
   hasKeyPoolFailover,
   rotateProviderTransportOn401,
@@ -46,9 +50,10 @@ import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import type { OAuthAccessSnapshot } from "../../oauth";
 import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
-import { getAccountSet } from "../../oauth/store";
+import { getAccountSet, markAccountNeedsReauthIfGeneration } from "../../oauth/store";
 import { tryKiroAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
 import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
+import { classifyAntigravityRefusal } from "../../adapters/antigravity-refusal";
 import { normalizeFinalKiroHttpError } from "../../adapters/kiro-retry";
 import { noteKiroMonthlyRefusal } from "../../providers/kiro-usage";
 import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
@@ -155,6 +160,8 @@ export async function prepareAdapterExchange(
     | "reserveCredentialHop"
     | "pendingHopPermit"
     | "workflowRootId"
+    | "claimAmbiguousResend"
+    | "sendsUsed"
   >,
 ) {
   const { options, config, logCtx, req } = requestContext;
@@ -188,9 +195,18 @@ export async function prepareAdapterExchange(
     recoveryClassFor,
     sendBudgetExhausted,
     reserveCredentialHop,
+    claimAmbiguousResend,
   } = sendBudgetState;
 
 
+  let selfContainedJudgment: boolean | undefined;
+  const requestIsSelfContained = (): boolean =>
+    selfContainedJudgment ??= selfContainedResponsesBody(parsed._rawBody);
+  const claimPreHeaderResend = (): boolean => authorizeResendForRecovery(
+    "pre-header", "connection-reset",
+    ambiguousResendAllowanceFor(route.provider, requestIsSelfContained, claimAmbiguousResend),
+  ).allowed;
+
   const upstream = new AbortController();
   const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal);
   const connectMs = config.connectTimeoutMs ?? 200_000;
@@ -342,6 +358,13 @@ export async function prepareAdapterExchange(
       const compactPrepaid = options.compactionRecoveryAttempted ? sendBudgetState.pendingHopPermit : undefined;
       if (compactPrepaid) sendBudgetState.pendingHopPermit = undefined;
       let compactPrepaidUsed = false;
+      // Combo and emergency compaction admission already book this target's first send.
+      // Its configured initial ceiling is target-local; the shared remainder below still
+      // accounts for earlier targets without deducting their sends from this target twice.
+      const initialSendCap = transientPolicy || resetReplayPolicyFor(route.provider)
+        ? transientSendCapFor(transientPolicy?.attempts,
+          (options.comboAttempt || compactPrepaid) ? 0 : sendBudgetState.sendsUsed)
+        : 1;
       const fetchWithRetryPolicy = (route.provider.adapter === "google" || transientPolicy)
         ? fetchWithTransientRetry
         : fetchWithResetRetry;
@@ -366,15 +389,12 @@ export async function prepareAdapterExchange(
         {
           abortSignal: upstream.signal,
           label: safeHostLabel(builtInitialRequest.url),
-          ...(transientPolicy || compactPrepaid
-            // Draws the remainder, not the raw policy. A combo child inherits the parent's
-            // holder but used to take a fresh full allowance on its own first send, so the
-            // shared counter was inherited without ever being read as a limit.
+          claimAmbiguousResend: claimPreHeaderResend,
+          ...(transientPolicy || resetReplayPolicyFor(route.provider) || compactPrepaid
             ? {
-              // The first emergency send is already paid for. Only retries consume the
-              // remaining allowance; treating the booking as unavailable blocks a cap of two.
-              attempts: Math.min(transientPolicy?.attempts ?? 1,
-                remainingTransientSendBudget(transientPolicy?.attempts ?? 1) + (compactPrepaid ? 1 : 0)),
+              // A pending compaction permit already booked this leg's first physical send.
+              attempts: Math.min(initialSendCap,
+                remainingTransientSendBudget(initialSendCap) + (compactPrepaid ? 1 : 0)),
               onSendsConsumed: noteTransientSends,
             }
             : {}),
@@ -544,14 +564,21 @@ export async function prepareAdapterExchange(
           const refetchWithPolicy = (route.provider.adapter === "google" || refetchTransientPolicy)
             ? fetchWithTransientRetry
             : fetchWithResetRetry;
-          // Same rule as the passthrough rebuild: spend the base allowance first, then the one
-          // shared final-recovery reserve, so a recovery that follows a spent streak still gets
-          // its single send instead of dying at three.
-          const refetchAllowance = refetchTransientPolicy
-            ? recoverySendAllowance(
-              refetchTransientPolicy.attempts,
-              recoveryClassFor(recovery),
+          const helperCountsSends = refetchTransientPolicy !== null || resetReplayPolicyFor(route.provider) !== null;
+          const prepaid = sendBudgetState.pendingHopPermit;
+          const configuredTotal = refetchTransientPolicy?.attempts;
+          const refetchCap = transientSendCapFor(configuredTotal,
+            sendBudgetState.sendsUsed - (prepaid ? 1 : 0));
+          // An exact total includes a booked hop, even when it consumed the last base slot.
+          // Keep that funded send while forbidding the final reserve from widening the total.
+          const prepaidLastSlot = helperCountsSends && configuredTotal !== undefined && prepaid
+            && refetchCap > 0 && remainingTransientSendBudget(refetchCap) === 0;
+          if (prepaidLastSlot) sendBudgetState.pendingHopPermit = undefined;
+          const refetchAllowance = helperCountsSends
+            ? prepaidLastSlot ? { attempts: 1, permit: prepaid } : recoverySendAllowance(
+              refetchCap, recoveryClassFor(recovery),
               `${route.providerName}|${route.modelId}|${recovery}`,
+              { allowFinalRecoveryReserve: configuredTotal === undefined },
             )
             : undefined;
           try {
@@ -565,7 +592,7 @@ export async function prepareAdapterExchange(
                 // can be refused above before it does. use() past the first attempt is a no-op.
                 onDispatch?.();
                 if (preserveFailureResponse) replacementAdmitted = true;
-                if (!refetchTransientPolicy) chargeFastDowngradeWorkflowSend();
+                if (!refetchAllowance) chargeFastDowngradeWorkflowSend();
                 return fetchWithHeaderTimeout(retryRequest.url,
                   applyUpstreamRecoveryInit({
                     method: retryRequest.method, headers: retryRequest.headers, body: retryRequest.body,
@@ -579,6 +606,7 @@ export async function prepareAdapterExchange(
               {
                 abortSignal: upstream.signal,
                 label: safeHostLabel(retryRequest.url),
+                claimAmbiguousResend: claimPreHeaderResend,
                 ...(refetchAllowance
                   ? {
                     attempts: refetchAllowance.attempts,
@@ -637,7 +665,7 @@ export async function prepareAdapterExchange(
       const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
       const hop = reserveCredentialHop("auth-recovery",
         `${route.providerName}|${route.modelId}|antigravity-auth`,
-        !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null);
+        !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null));
       if (!hop.allowed) return null;
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextId);
@@ -707,7 +735,7 @@ export async function prepareAdapterExchange(
               const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
               const hop = reserveCredentialHop("auth-recovery",
                 `${route.providerName}|${route.modelId}|terminal-refresh-account`,
-                !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null);
+                !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null));
               if (hop.allowed) {
                 try {
                   const admitted = await applyFailoverSnapshot(alternate);
@@ -860,7 +888,7 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "repair",
           `${route.providerName}|${route.modelId}|anthropic-fast-downgrade`,
-          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
         );
         if (hop.allowed) {
           anthropicFastDowngradeGuard.attempted = true;
@@ -1058,10 +1086,9 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "auth-recovery",
           `${route.providerName}|${route.modelId}|adapter-recovery-oauth-429`,
-          // Only a helper-routed replay reports this send back. A reset-only refetch reports
-          // nothing and an adapter ladder settles the booking itself, so promising an external
-          // report on either would leave a booking pending until it swallowed a later charge.
-          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+          // Transient and opted-in reset helpers report physical sends; an adapter-owned
+          // ladder settles its own booking.
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
         );
         if (!hop.allowed) break;
         const nextAccountId = rotateGenericOAuthAccountOnRefusal(
@@ -1163,10 +1190,9 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "auth-recovery",
           `${route.providerName}|${route.modelId}|adapter-recovery-oauth-429`,
-          // Only a helper-routed replay reports this send back. A reset-only refetch reports
-          // nothing and an adapter ladder settles the booking itself, so promising an external
-          // report on either would leave a booking pending until it swallowed a later charge.
-          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+          // Transient and opted-in reset helpers report physical sends; an adapter-owned
+          // ladder settles its own booking.
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
         );
         if (!hop.allowed) break;
         const nextAccountId = rotateGenericOAuthAccountOn429(
@@ -1243,6 +1269,104 @@ export async function prepareAdapterExchange(
           break;
         }
       }
+      // Antigravity verify-account quarantine: a 403 demanding account verification
+      // is terminal for THAT account — its grant still refreshes, so only a manual
+      // verification followed by a re-login clears it. Mark it needsReauth (durable,
+      // shown as `needs-reauth(verify)` in `ocx account list` with a `verify_account`
+      // health reason in the management API, excluded from the pool until re-login)
+      // and replay the same request on the next eligible account so the pool keeps
+      // serving.
+      while (
+        upstreamResponse.status === 403
+        && route.providerName === "google-antigravity"
+        && transportState.genericFailoverAccountId
+      ) {
+        const refusal = classifyAntigravityRefusal(upstreamResponse.status,
+          await readDisplaySafeErrorText(upstreamResponse.clone(), upstream.signal, ""));
+        if (refusal.kind === "other") break;
+        const sent = transportState.sentOAuthSnapshot;
+        const failedAccountId = transportState.genericFailoverAccountId;
+        // Fenced write: a 403 arriving after the credential rotated (refresh or
+        // re-login) must not quarantine the new login. Without the matching sent
+        // snapshot there is no owner for this write, so skip marking.
+        if (!sent || sent.accountId !== failedAccountId) break;
+        try {
+          await markAccountNeedsReauthIfGeneration(route.providerName, failedAccountId, sent.generation, undefined, "verify_account");
+        } catch {
+          // A failed quarantine write must preserve the refusal, not authorize another send.
+          break recovery;
+        }
+        if (!antigravityPoolActivated || transportState.genericFailovers >= transportState.genericFailoverLimit) break;
+        const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
+        const hop = reserveCredentialHop(
+          "auth-recovery",
+          `${route.providerName}|${route.modelId}|adapter-recovery-oauth-verify`,
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
+        );
+        if (!hop.allowed) break;
+        // Auth-refusal rotation, not the rate-limit one: a verification refusal
+        // must not record rate-limit cooldown semantics against the account.
+        const nextAccountId = rotateAntigravityAccountOnAuthRefusal(
+          antigravityPoolActivated,
+          failedAccountId,
+          sent.generation,
+          route.modelId,
+        );
+        if (!nextAccountId) {
+          hop.permit?.release();
+          break;
+        }
+        // The refusal body stays alive until the replacement owns the outcome: it
+        // is also the preserveFailureResponse below, so cancelling it early would
+        // hand back a 403 with a destroyed body when the rebuild is refused.
+        const failedResponse = upstreamResponse;
+        try {
+          // The FULL snapshot, not just the bearer: Antigravity pairs an
+          // account-matched projectId with its token, so a token-only swap would mix
+          // one account's credential with another's routing data.
+          const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
+          if (!await applyFailoverSnapshot(snapshot)) {
+            hop.permit?.release();
+            break;
+          }
+          invalidateSameTargetRequest();
+          transportState.activeAdapter = resolveSelectionAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+            config.cacheRetention,
+          );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: transportState.activeAdapter.name,
+            oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+          });
+          sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
+          recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
+          sendBudgetState.pendingHopPermit = hop.permit;
+          let result: Response | { failed: Response };
+          try {
+            result = await rebuildAndRefetch("oauth-account-403", () => {
+              if (!adapterOwnsDispatch) hop.permit?.use();
+            }, failedResponse);
+          } finally {
+            sendBudgetState.pendingHopPermit = undefined;
+          }
+          if ("failed" in result) {
+            hop.permit?.release();
+            if (result.failed !== failedResponse) return result.failed;
+            // Preserve common redaction and combo consumption without another recovery send.
+            break recovery;
+          }
+          transportState.genericFailovers += 1;
+          try { void failedResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+          upstreamResponse = result;
+          if (isNonReplayableResponse(upstreamResponse)) continue recovery;
+        } catch {
+          hop.permit?.release();
+          break;
+        }
+      }
       }
       // Unknown provenance is deliberately fail-soft in pre-flight: after a restart, TTL expiry,
       // or LRU eviction, a valid same-backend blob must survive. A decoder's own 4xx identity is

package/src/server/responses/codex-auth-error.ts

@@ -30,9 +30,15 @@ export function codexModelAvailabilityErrorResponse(error: CodexModelAvailabilit
   return formatErrorResponse(400, "invalid_request_error", error.message);
 }
 
+/** Actionable sign-in guidance without guessing which upstream revocation cause occurred. */
+export const CODEX_MAIN_SIGN_IN_REQUIRED_MESSAGE =
+  "Codex main account needs sign-in. Run `codex login` to sign in again.";
+
 export function nativeMainRefreshFailureResponse(error: unknown): Response {
   if (error instanceof MainAccountTokenRefreshError && error.reason === "reauth") {
-    return formatErrorResponse(401, "authentication_error", "Codex main account needs reauthentication");
+    // Same sentence the quarantine produces on every later request, so the first refusal and the
+    // ones after it do not describe one dead credential two different ways.
+    return formatErrorResponse(401, "authentication_error", CODEX_MAIN_SIGN_IN_REQUIRED_MESSAGE);
   }
   if (error instanceof MainAccountTokenRefreshError
     || error instanceof MainAuthJsonChangedDuringRefreshError
@@ -98,7 +104,9 @@ export function mapCodexAuthContextErrorToResponse(
     return codexModelAvailabilityErrorResponse(error);
   }
   if (error instanceof CodexPoolAuthenticationError || error instanceof CodexDirectAuthenticationError) {
-    return formatErrorResponse(401, "authentication_error", error.message);
+    return formatErrorResponse(401, "authentication_error",
+      error instanceof CodexPoolAuthenticationError && error.quarantinedMain
+        ? CODEX_MAIN_SIGN_IN_REQUIRED_MESSAGE : error.message);
   }
   if (error instanceof CodexMainSubstitutionUnavailableError) {
     return formatErrorResponse(

package/src/server/responses/combo-stream-preflight.ts

@@ -1,3 +1,4 @@
+import { codexAccountModelRefusal, codexAccountModelRefusalPayload, hasConflictingCodexModelRefusalEnvelopes, type CodexAccountModelRefusal } from "../../combos/failover";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import { comboFailureDecision } from "../../combos";
 import { httpStatusFromTerminalError } from "../../lib/errors";
@@ -68,6 +69,26 @@ function bareErrorStatus(payload: unknown): number | undefined {
   });
 }
 
+/** Match the selected SSE error envelope before projection drops competing fields. */
+function terminalModelRefusal(status: number, event: Record<string, unknown>): CodexAccountModelRefusal {
+  if (hasConflictingCodexModelRefusalEnvelopes(status, event)) return "ambiguous";
+  const outer = codexAccountModelRefusalPayload(status, event);
+  if (outer === "ambiguous") return outer;
+  const nested = event.response;
+  if (event.type !== "error" && nested && typeof nested === "object" && !Array.isArray(nested)) {
+    const nestedKind = codexAccountModelRefusalPayload(status, nested);
+    if (nestedKind === "ambiguous") return nestedKind;
+    const nestedError = (nested as Record<string, unknown>).error;
+    if (nestedError && typeof nestedError === "object" && !Array.isArray(nestedError)) {
+      return nestedKind;
+    }
+  }
+  if (event.type === "error" && !Object.hasOwn(event, "error") && typeof event.message === "string") {
+    return codexAccountModelRefusal(status, event.message, { allowNestedResponse: false });
+  }
+  return outer;
+}
+
 function bareErrorIsRetryable(payload: unknown): boolean {
   const status = bareErrorStatus(payload);
   if (status === undefined || !payload || typeof payload !== "object" || Array.isArray(payload)) {
@@ -84,7 +105,9 @@ function bareErrorIsRetryable(payload: unknown): boolean {
   const message = typeof error.message === "string"
     ? error.message
     : typeof event.message === "string" ? event.message : "";
-  return comboFailureDecision(status, message, { code }) === "hop";
+  return comboFailureDecision(status, message, {
+    code, codexModelRefusal: terminalModelRefusal(status, event),
+  }) === "hop";
 }
 
 function retryableZeroOutputTerminal(payload: unknown): boolean {
@@ -226,7 +249,7 @@ function failedTerminalResponse(
 
 export type ComboStreamPreflightResult =
   | { kind: "accepted"; response: Response }
-  | { kind: "failed"; response: Response }
+  | { kind: "failed"; response: Response; codexModelRefusal?: CodexAccountModelRefusal }
   /**
    * The body errored mid-stream and `replayReadErrors` asked for the prefix back rather than
    * a rethrow. `stage` is how far the inspection actually got; whether that permits a
@@ -322,7 +345,10 @@ export async function preflightComboStreamResponse(
         || retryableTerminalPayload?.type === "error")
         && !outputCommitted && retryableTerminalPayload) {
         await reader.cancel("retrying zero-output combo stream terminal").catch(() => undefined);
-        return { kind: "failed", response: failedTerminalResponse(response, retryableTerminalPayload, logCtx) };
+        const failed = failedTerminalResponse(response, retryableTerminalPayload, logCtx);
+        return { kind: "failed", response: failed,
+          ...(failed.status === 400
+            ? { codexModelRefusal: terminalModelRefusal(failed.status, retryableTerminalPayload) } : {}) };
       }
       if (next.done || terminalStatus !== undefined || outputCommitted
         || bufferedBytes >= COMBO_STREAM_PREFLIGHT_MAX_BYTES

package/src/server/responses/compaction-routing.ts

@@ -1,6 +1,6 @@
 import type { OcxConfig } from "../../types";
 import { isDeclaredReasoningEffort } from "../../reasoning-effort";
-import { COMPACTION_TRIGGERS } from "../../config/schema/compaction-triggers";
+import { COMPACTION_TRIGGERS, validCompactionSourceModels } from "../../config/schema/compaction-triggers";
 import { routeConcreteModel, type RouteResult } from "../../router";
 import { resolveComboId } from "../../combos/identifiers";
 import { resolvePolicyProfileId } from "../../routing/profile";
@@ -57,6 +57,15 @@ export function applyCompactionRoutingOverride(
     && (typeof override.reasoningEffort !== "string" || !isDeclaredReasoningEffort(override.reasoningEffort))) return null;
   const triggers = configuredTriggers(override.triggers);
   if (!triggers) return null;
+  if (override.sourceModels !== undefined) {
+    if (!validCompactionSourceModels(override.sourceModels)) return null;
+    // Match the selector the conversation actually routed on: a synthetic `--fast` or
+    // effort suffix is ingress decoration, so `cheap--fast` is still the allowlisted `cheap`.
+    const source = sourceSelectorOf(config, raw.model);
+    if (!override.sourceModels.some(selector => selector.endsWith("/*")
+      ? source.startsWith(selector.slice(0, -1)) && source.length > selector.length - 1
+      : source === selector)) return null;
+  }
   if (options.endpoint !== "compact"
     && !(Array.isArray(raw.input) && raw.input.some(item => record(item)?.type === "compaction_trigger"))) return null;
 

package/src/server/responses/core-auth.ts

@@ -41,13 +41,19 @@ import { markLocalRequestLogRefusal } from "../request-log";
 import { CODEX_POOL_REFRESH_INCOMPLETE_LOG_REASON } from "../../codex/pool-refresh-backoff";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import { forceRefreshMainAccountToken } from "../../codex/main-account";
+import { safeCallerSessionId } from "../caller-session-identity";
 
-/** Keep synthesized Claude identity out of request headers reused by policy/combo fallback. */
+/** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
 export function withClaudeNativeSession(headers: Headers, provider: OcxProviderConfig, sessionId?: string): Headers {
-  if (!sessionId || !isCanonicalOpenAiForwardProvider(provider)
-    || headers.has("session_id") || headers.has("session-id") || headers.has("thread-id")) return headers;
+  // Empty values count as absent, matching materializeCodexUpstreamAuth, so first attempts and
+  // retries rebuilt from caller headers pick the same identity.
+  if (!isCanonicalOpenAiForwardProvider(provider) || headers.get("session_id")) return headers;
+  const alias = ["session-id", "thread-id"].find(name => headers.get(name));
+  const nativeSession = alias ? safeCallerSessionId(headers.get(alias)) : sessionId;
+  // A non-empty invalid alias suppresses weaker metadata identity.
+  if (!nativeSession) return headers;
   const forwarded = new Headers(headers);
-  forwarded.set("session_id", sessionId);
+  forwarded.set("session_id", nativeSession);
   return forwarded;
 }
 
@@ -57,6 +63,9 @@ export type ResponsesAuthResolution =
   | { ok: false; response: Response };
 
 
+export type CodexCredentialOwnershipOptions = Pick<HandleResponsesOptions,
+  "admission" | "callerDirectAuth" | "stripClaudeMainAuthForNoncanonicalForward" | "trustedClaudeMainAuth">;
+
 /**
  * The caller credential the final Codex auth resolution will be given, as far as the ROUTE
  * decides it: a route change that may cross a credential domain drops the raw caller credential,
@@ -67,15 +76,53 @@ export type ResponsesAuthResolution =
  * an HMAC of exactly this Authorization header. Two copies of this rule would put preview and
  * final auth in different scopes the first time one of them changed.
  */
+/**
+ * The stored native-main credential this process injected itself, when it is the bearer the
+ * resolution will see.
+ *
+ * `handleClaudeMessages` reads `~/.codex/auth.json` and attaches it so OpenAI-backed sidecars stay
+ * reachable on a translated turn. It is OUR credential, not the caller's -- the ingress says so
+ * where it sets `nativeCallerAuth` and `callerDirectAuth` to null for exactly this reason -- and
+ * every reader of the resolution's input headers has to agree about that, or one of them conclud
+ * the request owns a credential that in fact belongs to the Pool.
+ */
+export function injectedClaudeMainBearer(
+  route: Pick<RouteResult, "provider">,
+  options: CodexCredentialOwnershipOptions,
+): { authorization: string; chatgptAccountId?: string } | undefined {
+  return options.stripClaudeMainAuthForNoncanonicalForward === true
+    && isCanonicalOpenAiForwardProvider(route.provider)
+    ? options.trustedClaudeMainAuth : undefined;
+}
+
+function validatedCallerDirectHeaders(
+  config: OcxConfig,
+  route: Pick<RouteResult, "provider">,
+  options: CodexCredentialOwnershipOptions,
+): Headers | undefined {
+  if (!options.callerDirectAuth || !isCanonicalOpenAiForwardProvider(route.provider)) return undefined;
+  const headers = new Headers({ authorization: options.callerDirectAuth.authorization });
+  if (options.callerDirectAuth.chatgptAccountId) headers.set("chatgpt-account-id", options.callerDirectAuth.chatgptAccountId);
+  return captureCallerDirectAuth(headers, config) ? headers : undefined;
+}
+
 export function codexRouteCredentialDomainHeaders(
   req: Request,
   route: RouteResult,
   options: HandleResponsesOptions,
   credentialDomainWasRewritten: boolean,
+  config: OcxConfig,
 ): Headers {
-  const trustedClaudeMainForFinalRoute = options.stripClaudeMainAuthForNoncanonicalForward === true
-    && isCanonicalOpenAiForwardProvider(route.provider)
-    ? options.trustedClaudeMainAuth : undefined;
+  const callerDirect = validatedCallerDirectHeaders(config, route, options);
+  if (callerDirect) {
+    const headers = new Headers(req.headers);
+    headers.set("authorization", callerDirect.get("authorization")!);
+    const accountId = callerDirect.get("chatgpt-account-id");
+    if (accountId) headers.set("chatgpt-account-id", accountId);
+    else headers.delete("chatgpt-account-id");
+    return headers;
+  }
+  const trustedClaudeMainForFinalRoute = injectedClaudeMainBearer(route, options);
   if (trustedClaudeMainForFinalRoute) {
     const claudeMainHeaders = new Headers(req.headers);
     claudeMainHeaders.set("authorization", trustedClaudeMainForFinalRoute.authorization);
@@ -117,15 +164,25 @@ export function codexRouteCredentialDomainHeaders(
 export function codexRouteCredentialOwnership(
   authInputHeaders: Headers,
   config: OcxConfig,
-  route: RouteResult,
-  options: HandleResponsesOptions,
+  route: Pick<RouteResult, "provider" | "codexAccountMode">,
+  options: CodexCredentialOwnershipOptions,
 ): { substituteMainCredential: boolean; requestScopedMainCredential: boolean } {
   const substituteMainCredential = options.admission?.source === "bearer"
     && (route.codexAccountMode !== undefined || isCanonicalOpenAiForwardProvider(route.provider));
   return {
     substituteMainCredential,
+    // A request-scoped main credential is one the CALLER owns: it exists for this request only,
+    // owns no Pool state, and must never be quarantined or refreshed on the Pool's behalf. The
+    // stored credential this process injected is the opposite of that in every respect, and
+    // `hasForwardableCodexBearer` cannot tell them apart -- it sees a Codex JWT with an account
+    // id either way. Counting ours as the caller's made the native main slot caller-owned on
+    // every translated Claude turn: `main` instead of `main-pool`, so an upstream 401 on a
+    // revoked session recorded no outcome, refreshed nothing, and retired nothing, and the next
+    // request sent the same dead token again.
     requestScopedMainCredential: route.codexAccountMode !== undefined
       && !substituteMainCredential
+      && (validatedCallerDirectHeaders(config, route, options) !== undefined
+        || injectedClaudeMainBearer(route, options) === undefined)
       && hasForwardableCodexBearer(authInputHeaders, config),
   };
 }
@@ -149,6 +206,7 @@ export async function resolveResponsesCodexAuth(
       route,
       options,
       credentialDomainWasRewritten,
+      config,
     );
     // A caller-auth transport that is not canonical OpenAI (keyless Cursor) consumes the
     // caller's Authorization as its own upstream token. Keep that contract only for a clean
@@ -171,27 +229,6 @@ export async function resolveResponsesCodexAuth(
         authInputHeaders = scoped;
       }
     }
-    // The caller's own Direct credential may cross an internal route change only to the
-    // canonical OpenAI transport, under a predicate deliberately STRICTER than plain
-    // unchanged-route Direct forwarding: a clean non-proxy bearer whose ChatGPT-domain
-    // marker is valid, with any explicit account header matching that marker. Unchanged
-    // routes keep their legacy rules; sidecar enrichment grants no primary authority.
-    if (options.callerDirectAuth && isCanonicalOpenAiForwardProvider(route.provider)) {
-      const directHeaders = new Headers({
-        authorization: options.callerDirectAuth.authorization,
-        ...(options.callerDirectAuth.chatgptAccountId
-          ? { "chatgpt-account-id": options.callerDirectAuth.chatgptAccountId } : {}),
-      });
-      if (captureCallerDirectAuth(directHeaders, config)) {
-        authInputHeaders = new Headers(authInputHeaders);
-        authInputHeaders.set("authorization", options.callerDirectAuth.authorization);
-        if (options.callerDirectAuth.chatgptAccountId) {
-          authInputHeaders.set("chatgpt-account-id", options.callerDirectAuth.chatgptAccountId);
-        } else {
-          authInputHeaders.delete("chatgpt-account-id");
-        }
-      }
-    }
     // #1686: a caller that proved admission with a BEARER presented one of our own secrets.
     // Refusing it here is what made the codex-cli `env_key` contract unusable against Direct.
     // Admitting it is only safe because the stored main credential is substituted below, so

package/src/server/responses/core-codex-account.ts

@@ -59,7 +59,7 @@ import {
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import { isRequestExecutionBudget } from "../../lib/request-execution-budget";
 import type { SingleUseDispatchPermit } from "../../lib/request-execution-budget";
-import { hasForwardableCodexBearer } from "../auth-cors";
+import { codexRouteCredentialOwnership, type CodexCredentialOwnershipOptions } from "./core-auth";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import {
   conversationStateBindingFromAuth,
@@ -360,7 +360,7 @@ export interface CodexPoolAccountRetryArgs {
   route: Pick<RouteResult, "providerName" | "modelId" | "provider" | "staticPolicy">;
   parsed: OcxParsedRequest;
   logCtx: RequestLogContext;
-  options: {
+  options: CodexCredentialOwnershipOptions & {
     admission?: DataPlaneAdmission;
     codexAuthPolicy?: CodexAuthPolicyConfig;
     visionDescribeTerminal?: boolean;
@@ -641,10 +641,13 @@ export async function retryCodexPoolOnAlternateAccount(
         "pool",
         {
           excludeAccountId: firstAuthCtx.accountId,
+          signal: options.abortSignal,
           admission: options.admission,
           codexAuthPolicy: options.codexAuthPolicy,
           modelId: route.modelId,
-          requestScopedMainCredential: hasForwardableCodexBearer(callerAuthHeaders, config),
+          requestScopedMainCredential: codexRouteCredentialOwnership(callerAuthHeaders, config, {
+            provider: route.provider, codexAccountMode: "pool",
+          }, options).requestScopedMainCredential,
           beginCodexAccountSelection: codexAccountSelectionForTurn(options.turnAdmissionLease),
           resolveCodexModelEntitlements: entitlementResolver,
         },

package/src/server/responses/core-combo-failure.ts

@@ -1,3 +1,4 @@
+import { codexAccountModelRefusal, codexAccountModelRefusalHardStopCode, type CodexAccountModelRefusal } from "../../combos/failover";
 import { parseRetryAfterMs } from "../../combos";
 import type { ConsumedComboFailure, HandleResponsesOptions } from "./core-options";
 import type { OcxUsage } from "../../types";
@@ -36,6 +37,7 @@ export async function consumeComboFailure(
   const nonReplayable = isNonReplayableResponse(response);
   const fallback = `Provider error ${response.status}`;
   let classificationText = fallback;
+  let codexModelRefusal: CodexAccountModelRefusal | undefined;
   let usage: OcxUsage | undefined;
   let upstreamCode: string | undefined;
   let upstreamMessage: string | undefined;
@@ -60,10 +62,11 @@ export async function consumeComboFailure(
         && isRateLimitOrQuotaFailureMessage(quotaMessage);
     }
     if (body.displaySafe && !body.truncated) {
+      if (response.status === 400) codexModelRefusal = codexAccountModelRefusal(response.status, body.text);
       const normalized = normalizeUpstreamErrorText(body.text, fallback);
       if (utf8Trusted || isCyberPolicyCode(normalized.code) || isCyberPolicyMessage(normalized.safeText)) {
         classificationText = normalized.safeText;
-        upstreamCode = normalized.code;
+        upstreamCode = codexAccountModelRefusalHardStopCode(response.status, body.text) ?? normalized.code;
         upstreamMessage = normalized.message;
         upstreamType = normalized.type;
       }
@@ -116,6 +119,7 @@ export async function consumeComboFailure(
     response: failureResponse,
     ...(nonReplayable ? { nonReplayable: true } : {}),
     classificationText,
+    ...(codexModelRefusal !== undefined ? { codexModelRefusal } : {}),
     ...(normalizedUpstreamCode !== undefined ? { upstreamCode: normalizedUpstreamCode } : {}),
     ...(upstreamType !== undefined ? { upstreamType } : {}),
     ...(!cyberFailure && cooldownRetryAfter !== undefined ? { retryAfter: cooldownRetryAfter } : {}),