@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/types/provider.ts

@@ -68,15 +68,15 @@ export interface TransientRetryPolicy {
 }
 
 /**
- * Opt-in replacement of a native Responses send whose upstream connection closed while the
+ * Opt-in replacement of a Responses send whose upstream connection closed while the
  * caller had observed nothing (`providers.<name>.retryOnReset`).
  *
- * Covers both ambiguous stages the proxy can be in: no response head at all, and a head whose
- * SSE body carried only control events. Disabled unless the object is present; a bare `{}`
- * opts in with defaults. Only a request the proxy can judge self-contained is ever replaced;
- * see `src/server/responses/reset-replay.ts`. The replacement inference may still be billed if
- * the origin had already started the first one, which is what makes this opt-in rather than
- * default.
+ * Native Responses covers pre-header resets and post-header SSE carrying only control events.
+ * Generic translated dispatch covers initial and rebuilt pre-header sends, sharing the same
+ * grant and send budget; adapter-owned transports and translated post-header failures are excluded.
+ * Disabled unless present; `{}` opts in. Only self-contained requests qualify (see
+ * `src/server/responses/reset-replay.ts`). Replacement inference may still be billed if the
+ * origin had already started the first one, so this is opt-in rather than default.
  */
 export interface ResetReplayPolicy {
   /** Master switch. Presence of the object also enables the policy (default true). */
@@ -411,6 +411,22 @@ export interface OcxProviderConfig {
    * `ocxr1` envelopes are still stripped because no upstream can decrypt them.
    */
   preserveResponsesReasoningContent?: boolean;
+  /**
+   * Whether to preserve Codex-private `input[].id` on `store: false` requests.
+   * Disabled by default: ordinary Responses upstreams interpret input IDs as references
+   * to nonexistent stored items and return 404. Upstream launcher relays such as
+   * Codex Web GPT (`chatgpt-web/*`) require the current-turn user message ID for
+   * browser-session replay (#6220).
+   */
+  preserveResponsesInputItemIds?: boolean;
+  /**
+   * Whether to preserve ChatGPT-internal `internal_chat_message_metadata_passthrough`
+   * on outgoing input messages for noncanonical destinations. Disabled by default:
+   * public Responses gateways reject the private field as an unknown parameter.
+   * Upstream launcher relays such as Codex Web GPT require this metadata (or the item ID)
+   * to extract turn provenance (#6220).
+   */
+  preserveResponsesMessageMetadata?: boolean;
   /**
    * Treat this provider's `modelReasoningEfforts` as authoritative at the wire, not only in the
    * catalog. Adapters that ship their own per-model effort table (currently `command-code`)
@@ -652,6 +668,8 @@ export interface OcxProviderConfig {
    */
   autoReviewModelOverrides?: Record<string, string>;
   headers?: Record<string, string>;
+  /** Inbound client metadata headers to copy to this provider when the outbound field is otherwise unset. */
+  forwardClientHeaders?: string[];
   /** Default provider-routing preferences for models sent through the canonical OpenRouter API. */
   openRouterRouting?: OpenRouterProviderRouting;
   /** Exact model-id overrides for `openRouterRouting`. Each matching entry replaces the default. */
@@ -992,9 +1010,9 @@ export interface OcxProviderConfig {
    */
   transientRetryOn5xx?: TransientRetryPolicy;
   /**
-   * Opt-in replacement of a native Responses send that died while the caller had observed
-   * nothing (`providers.<name>.retryOnReset`). Disabled unless present; a bare `{}` opts in
-   * with defaults. Native Responses sends only, and only for self-contained requests.
+   * Opt-in replacement of self-contained Responses sends (`providers.<name>.retryOnReset`).
+   * Disabled unless present; `{}` opts in. Native sends and generic translated initial/rebuilt
+   * pre-header sends share the grant/budget; adapter-owned and translated post-header failures are excluded.
    */
   retryOnReset?: ResetReplayPolicy;
   /**

package/src/update/index.ts

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { manualUpdateFailureGuidance } from "./update-failure-guidance.mjs";
 import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
 import { proxyIdentityAt } from "../server/proxy-liveness";
 import { probeProxyLiveness } from "./proxy-liveness-probe.mjs";
@@ -922,7 +923,7 @@ export async function runUpdate(): Promise<void> {
       spawnSync(process.execPath, [postUpdateLauncher, "tray", "start"], { stdio: "ignore", windowsHide: true, env: mutation.unprivilegedEnvironment() });
     }
     await recoverStoppedRuntime("package update failed");
-    console.error(`\n⚠️  Update failed (${bin} exit ${r.status ?? "?"}). Try manually:  ${bin} ${cmdArgs.join(" ")}`);
+    console.error(`\n⚠️  Update failed (${bin} exit ${r.status ?? "?"}). ${manualUpdateFailureGuidance({ bin, args: cmdArgs, owner }).join("\n")}`);
     return 1;
   }
   } catch (error) {

package/src/update/npm-invocation.mjs

@@ -1,4 +1,4 @@
-import { existsSync } from "node:fs";
+import { existsSync, realpathSync } from "node:fs";
 import { win32 } from "node:path";
 
 const CMD_META = /([()%!^"`<>&|;, *?])/g;
@@ -38,11 +38,41 @@ export function resolveNpmCommand(
 ) {
   if (platform !== "win32") return "npm";
   const exists = deps.exists ?? existsSync;
+  const realpath = deps.realpath ?? realpathSync.native;
   const cwd = deps.cwd ?? process.cwd();
   const trustedRoots = [env.APPDATA, env.LOCALAPPDATA, env.ProgramFiles, env["ProgramFiles(x86)"],
     env.USERPROFILE && win32.join(env.USERPROFILE, "scoop", "shims")]
     .filter(root => typeof root === "string" && win32.isAbsolute(root));
   const trustedEntry = entry => trustedRoots.some(root => isInside(root, entry) && !isInside(root, cwd));
+  // Scoop installs Node's npm in the app tree, not in scoop/shims. Admit only
+  // the two Node apps' current npm directories, never arbitrary Scoop apps or
+  // a launch directory inside the installation itself.
+  const scoopNodeRoots = typeof env.USERPROFILE === "string" && win32.isAbsolute(env.USERPROFILE)
+    ? ["nodejs", "nodejs-lts"].map(app => win32.join(env.USERPROFILE, "scoop", "apps", app))
+    : [];
+  const trustedScoopNodeEntry = (entry, candidate) => {
+    const app = scoopNodeRoots.find(root => {
+      const current = win32.join(root, "current");
+      return isSamePath(current, entry) || isSamePath(win32.join(current, "bin"), entry);
+    });
+    if (!app) return null;
+    try {
+      const appPath = realpath(app);
+      const currentPath = realpath(win32.join(app, "current"));
+      const entryPath = realpath(entry);
+      const candidatePath = realpath(candidate);
+      const cwdPath = realpath(cwd);
+      const persistBin = win32.join(realpath(env.USERPROFILE), "scoop", "persist", win32.basename(app), "bin");
+      const insideInstall = isInside(currentPath, entryPath);
+      const persistedBin = isSamePath(entry, win32.join(app, "current", "bin"))
+        && isSamePath(entryPath, persistBin);
+      return !isSamePath(appPath, currentPath) && isInside(appPath, currentPath)
+        && (insideInstall || persistedBin) && isInside(entryPath, candidatePath)
+        && !isInside(currentPath, cwdPath) && !isInside(entryPath, cwdPath);
+    } catch {
+      return false;
+    }
+  };
   const extensions = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD")
     .split(";")
     .filter(Boolean);
@@ -54,10 +84,12 @@ export function resolveNpmCommand(
   for (const entry of pathEntries) {
     if (!win32.isAbsolute(entry)) continue;
     if (isSamePath(entry, cwd)) continue;
-    if (isInside(cwd, entry) && !trustedEntry(entry)) continue;
     for (const extension of extensions) {
       const candidate = win32.join(entry, `npm${extension.toLowerCase()}`);
-      if (exists(candidate)) return win32.resolve(candidate);
+      if (!exists(candidate)) continue;
+      const scoopTrust = trustedScoopNodeEntry(entry, candidate);
+      if (scoopTrust === false || (scoopTrust === null && isInside(cwd, entry) && !trustedEntry(entry))) continue;
+      return win32.resolve(candidate);
     }
   }
   return null;

package/src/update/proxy-liveness-probe.mjs

@@ -16,7 +16,16 @@ import { spawnSync } from "node:child_process";
  * stop. Fail-open was wrong here: a listener that accepts connections but withholds
  * `/healthz`, or a probe that times out, is exactly the state where replacing package
  * files is most dangerous, and "we could not tell" is not evidence the proxy is gone.
- * Only a refused connection or a definitive non-OpenCodex answer earns `"dead"`.
+ * A refused connection or a definitive non-OpenCodex answer earns `"dead"`. So does one
+ * more observation when the dial is neither answered nor refused (a timeout, or a dropped
+ * SYN as with a listener bound to a tailnet address): the child tries one transient
+ * exclusive bind of the same host and port, and a successful bind means nothing holds the
+ * port at that instant. The fallback runs only for a literal IP address, because a name can
+ * resolve to different addresses for the dial and the bind. A failed bind (`EADDRINUSE`,
+ * `EADDRNOTAVAIL`, any error) stays
+ * `"unknown"`, a held-but-silent port included. The whole probe is bounded by the child's
+ * own `timeoutMs` plus a 1500 ms spawn ceiling, after which it is `"unknown"`. A successful
+ * bind is a statement about that moment, not a promise that the endpoint cannot restart.
  */
 export function probeProxyLiveness(port, hostname = "127.0.0.1", timeoutMs = 1500) {
   // An unusable port is not an ambiguous probe: there is nothing to ask.
@@ -38,6 +47,8 @@ export function probeProxyLiveness(port, hostname = "127.0.0.1", timeoutMs = 150
   const script = [
     "const http = require('node:http');",
     "const [host, port, timeout] = process.argv.slice(1);",
+    "let settled = false;",
+    "const settle = word => { if (!settled) { settled = true; process.stdout.write(word); } };",
     "const req = http.get({ host, port: Number(port), path: '/healthz', timeout: Number(timeout) }, res => {",
     "  let body = '';",
     "  res.setEncoding('utf8');",
@@ -56,15 +67,34 @@ export function probeProxyLiveness(port, hostname = "127.0.0.1", timeoutMs = 150
     "            && typeof parsed.uptime === 'number'));",
     "      // Only a clean 200 decides anything. Any other status means the endpoint is",
     "      // answering but not telling us what it is, which is not evidence of absence.",
-    "      if (res.statusCode !== 200) process.stdout.write('UNKNOWN');",
-    "      else process.stdout.write(isOpencodex ? 'LIVE' : 'DEAD');",
-    "    } catch { process.stdout.write('UNKNOWN'); }",
+    "      if (res.statusCode !== 200) settle('UNKNOWN');",
+    "      else settle(isOpencodex ? 'LIVE' : 'DEAD');",
+    "    } catch { settle('UNKNOWN'); }",
     "  });",
     "});",
-    "req.on('timeout', () => { process.stdout.write('UNKNOWN'); req.destroy(); });",
-    "// ECONNREFUSED is the one error that proves nothing is listening. Everything else -",
-    "// reset, unreachable host, TLS confusion - leaves the question open.",
-    "req.on('error', err => process.stdout.write(err && err.code === 'ECONNREFUSED' ? 'DEAD' : 'UNKNOWN'));",
+    // A refused connection is the clean proof that nothing is listening. Everything else -
+    // reset, unreachable host, a silent drop - leaves the question open, with one more way
+    // to close it: a port nobody listens on can be bound, a held one cannot (EADDRINUSE).
+    // A proxy bound to a Tailscale address is the case that needs this: the stack drops
+    // the SYN instead of refusing it, so the dial only ever times out.
+    "let bindStarted = false;",
+    "const bindCheck = () => {",
+    "  if (bindStarted || settled) return;",
+    "  bindStarted = true;",
+    // A name can resolve to several addresses, and the dial and the bind resolve it on
+    // their own: a live proxy on one address would not stop a bind on another. Only a
+    // literal address names the same endpoint on both sides.
+    "  if (require('node:net').isIP(host) === 0) { settle('UNKNOWN'); return; }",
+    "  const server = require('node:net').createServer();",
+    "  server.on('connection', socket => socket.destroy());",
+    "  server.once('error', () => settle('UNKNOWN'));",
+    "  server.listen({ host, port: Number(port), exclusive: true }, () => server.close(() => settle('DEAD')));",
+    "};",
+    "req.on('timeout', () => { req.destroy(); bindCheck(); });",
+    "req.on('error', err => {",
+    "  if (err && err.code === 'ECONNREFUSED') settle('DEAD');",
+    "  else bindCheck();",
+    "});",
   ].join("\n");
   try {
     const probe = spawnSync(

package/src/update/update-failure-guidance.d.mts

@@ -1,3 +1,9 @@
+export function manualUpdateFailureGuidance(command: {
+  bin: string;
+  args: string[];
+  owner?: import("./pnpm-global-install.mjs").PnpmGlobalOwner;
+  platform?: NodeJS.Platform;
+}): string[];
 export function npmUpdateFailureGuidance(failure: {
   phase?: string;
   rolledBack?: boolean;

package/src/update/update-failure-guidance.mjs

@@ -1,5 +1,5 @@
 /**
- * What to tell the operator after a failed npm self-update (#5624).
+ * What to tell the operator after a failed self-update (#5624).
  *
  * The transactional updater (`transactional-install.mjs`) either leaves the live package
  * untouched, rolls it back, or — only on a double fault — leaves it moved aside with a recovery
@@ -10,6 +10,28 @@
  * Plain ESM with no Bun APIs: the Node launcher (`bin/ocx.mjs`) imports it.
  */
 
+import { pnpmGlobalCommandArgs } from "./pnpm-global-install.mjs";
+
+/**
+ * Manual replacement must wait for recovery and stop the runtime through its owner first.
+ * @param {{ bin: string; args: string[]; owner?: import("./pnpm-global-install.mjs").PnpmGlobalOwner; platform?: NodeJS.Platform }} command
+ * @returns {string[]}
+ */
+export function manualUpdateFailureGuidance({ bin, args, owner, platform = process.platform }) {
+  const windows = platform === "win32";
+  const quote = value => /^[a-zA-Z0-9_@./:=-]+$/.test(value) ? value
+    : "'" + value.replaceAll("'", windows ? "''" : "'\\''") + "'";
+  const commandBin = owner ? owner.commandPath : bin;
+  const commandArgs = owner ? pnpmGlobalCommandArgs(args, owner) : args;
+  const install = (windows ? "& " : "") + [commandBin, ...commandArgs].map(quote).join(" ");
+  return [
+    "Next: run 'ocx status' and let any in-progress recovery finish.",
+    "If a proxy is running, stop it through its owner ('ocx stop', the owning service, or the desktop app) and confirm it has stopped before installing.",
+    (windows ? "Then run in PowerShell: " : "Then run: ") + install,
+    "After installation completes, restart through the owning service ('ocx service restart') or desktop app; run 'ocx start' if unmanaged.",
+  ];
+}
+
 /** Phases in which the live package was never touched. */
 const UNTOUCHED_PHASES = new Set(["stage", "verify", "swap-backup"]);
 
@@ -18,14 +40,17 @@ const UNTOUCHED_PHASES = new Set(["stage", "verify", "swap-backup"]);
  * @returns {{ previousVersionKept: boolean; lines: string[] }}
  */
 export function npmUpdateFailureGuidance({ phase, rolledBack, pkgName, version, tag }) {
-  const reinstall = "npm install -g --allow-scripts=bun " + pkgName + "@" + (version || tag || "latest");
+  const manual = manualUpdateFailureGuidance({
+    bin: "npm", args: ["install", "-g", "--allow-scripts=bun", pkgName + "@" + (version || tag || "latest")],
+  });
   const kept = UNTOUCHED_PHASES.has(phase ?? "") || rolledBack === true;
   if (!kept) {
     return {
       previousVersionKept: false,
       lines: [
         "The previous version was moved aside and could not be put back automatically.",
-        "Next: run the \"restore\" command recorded in .ocx-recovery.json next to the package, or reinstall with '" + reinstall + "'.",
+        "Next: run the \"restore\" command recorded in .ocx-recovery.json next to the package, or follow the manual reinstall steps below.",
+        ...manual,
       ],
     };
   }
@@ -33,8 +58,8 @@ export function npmUpdateFailureGuidance({ phase, rolledBack, pkgName, version,
     previousVersionKept: true,
     lines: [
       "The previous version is still installed.",
-      "Next: run 'ocx update' again. If it fails the same way, run 'ocx stop', then '" + reinstall
-        + "', then 'ocx service restart' ('ocx start' when no background service is installed).",
+      "Next: run 'ocx update' again. If it fails the same way, reinstall manually:",
+      ...manual,
     ],
   };
 }

package/src/usage/expected-prices.ts

@@ -370,6 +370,15 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   { provider: "google-antigravity", modelId: "claude-opus-4-6-thinking", cost4: CLAUDE_OPUS_46, source: `anthropic official Claude Opus 4.6 ${ANTHROPIC_PRICING}`, verifiedAt: "2026-07-23", status: "verified" },
   // Alias without the Antigravity "-thinking" suffix (if logs/UI ever surface it).
   { provider: "google-antigravity", modelId: "claude-opus-4-6", cost4: CLAUDE_OPUS_46, source: `anthropic official Claude Opus 4.6 ${ANTHROPIC_PRICING}`, verifiedAt: "2026-07-23", status: "verified" },
+  // Antigravity uses subscription quota; these are derived Anthropic reference estimates.
+  { provider: "google-antigravity", modelId: "claude-sonnet-5-5", cost4: CLAUDE_SONNET_55, source: `derived: Anthropic Claude Sonnet 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "claude-sonnet-5-5-low", cost4: CLAUDE_SONNET_55, source: `derived: Anthropic Claude Sonnet 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "claude-sonnet-5-5-medium", cost4: CLAUDE_SONNET_55, source: `derived: Anthropic Claude Sonnet 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "claude-sonnet-5-5-high", cost4: CLAUDE_SONNET_55, source: `derived: Anthropic Claude Sonnet 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "claude-opus-5-5", cost4: CLAUDE_OPUS_55, source: `derived: Anthropic Claude Opus 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "claude-opus-5-5-low", cost4: CLAUDE_OPUS_55, source: `derived: Anthropic Claude Opus 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "claude-opus-5-5-medium", cost4: CLAUDE_OPUS_55, source: `derived: Anthropic Claude Opus 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "claude-opus-5-5-high", cost4: CLAUDE_OPUS_55, source: `derived: Anthropic Claude Opus 5.5 reference price; ${ANTHROPIC_PRICING}`, verifiedAt: "2026-10-03", status: "verified-derived" },
   { provider: "google-antigravity", modelId: "gpt-oss-120b-medium", cost4: { input: 0.03, output: 0.15, cacheRead: 0, cacheWrite: 0 }, source: "derived: gpt-oss-120b open-weights — OpenRouter advertised lowest https://openrouter.ai/openai/gpt-oss-120b/providers", verifiedAt: "2026-07-20", status: "verified-derived" },
   // Kimi / Moonshot — official price tables are now published (2026-07-20 re-check;
   // previously empty). kimi = Kimi Code OAuth surface, moonshot = CN key surface,

package/src/usage/log.ts

@@ -347,6 +347,9 @@ export interface PersistedUsageEntry {
   durationMs: number;
   /** TTFT relative to the request start (WP4); unset for non-streaming/tool-only. */
   firstOutputMs?: number;
+  /** Request-relative generation window (#6309): first output item, last output delta. Written as a pair. */
+  genStartMs?: number;
+  lastOutputMs?: number;
   usageStatus: UsageStatus;
   usage?: OcxUsage;
   totalTokens?: number;
@@ -1035,6 +1038,10 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
     ...(isNonNegativeFiniteNumber(entry.firstOutputMs)
       ? { firstOutputMs: entry.firstOutputMs }
       : {}),
+    ...(isNonNegativeFiniteNumber(entry.genStartMs) && isNonNegativeFiniteNumber(entry.lastOutputMs)
+      && entry.lastOutputMs >= entry.genStartMs
+      ? { genStartMs: entry.genStartMs, lastOutputMs: entry.lastOutputMs }
+      : {}),
     usageStatus: entry.usageStatus,
     ...(entry.usage ? { usage: normalizeUsageValue(entry.usage) } : {}),
     ...(typeof entry.totalTokens === "number" ? { totalTokens: entry.totalTokens } : {}),

package/src/usage/summary.ts

@@ -10,7 +10,7 @@ import {
   type PersistedUsageEntry,
   type UsageStatus,
 } from "./log";
-import { type AttemptCostEstimate, type CostEstimate, estimateAttemptCost, estimateRequestCost, serviceTierContext, type ServiceTierContext } from "./cost";
+import { type AttemptCostEstimate, type CostEstimate, estimateAttemptCost, estimateRequestCost, serviceTierContext, type ServiceTierContext, tokensPerSecond } from "./cost";
 
 /**
  * Canonical range members. The warm-up loop in the management usage route
@@ -73,6 +73,18 @@ export interface UsageSummaryTotals {
   cacheSynthesizedRequests?: number;
   /** Rows with no cache detail at all. Not a miss, and not a zero. */
   cacheUnknownRequests?: number;
+  /**
+   * Aggregated output throughput (#6309): output tokens and wall-clock milliseconds summed over
+   * the attempts whose usage was measured, plus how many attempts qualified. The rate is the
+   * token sum over the duration sum — a time-weighted average, not a mean of per-request rates —
+   * so one fast tiny request cannot outweigh many slow large ones. Attempts without both a
+   * positive token count and a positive duration contribute nothing.
+   */
+  throughputOutputTokens?: number;
+  throughputDurationMs?: number;
+  throughputSamples?: number;
+  /** Derived at finalize time: throughputOutputTokens / throughputDurationMs * 1000. */
+  throughputTokensPerSec?: number;
 }
 
 export interface UsageDay {
@@ -118,6 +130,10 @@ export interface UsageModel {
   totalTokens: number;
   inputTokens: number;
   outputTokens: number;
+  /** Aggregate output throughput for this row (#6309): summed measured tokens over summed duration. */
+  throughputTokensPerSec?: number;
+  /** Attempts behind the throughput aggregate; absent when nothing was measured. */
+  throughputSamples?: number;
   cachedInputTokens?: number;
   cacheReadInputTokens?: number;
   cacheCreationInputTokens?: number;
@@ -141,6 +157,12 @@ export interface UsageProvider {
   totalTokens: number;
   inputTokens?: number;
   outputTokens?: number;
+  /**
+   * Aggregate output throughput for this row (#6309): summed measured output tokens over summed
+   * wall-clock duration. Undefined when no attempt in the row reported both.
+   */
+  throughputTokensPerSec?: number;
+  throughputSamples?: number;
   cachedInputTokens?: number;
   cacheReadInputTokens?: number;
   cacheCreationInputTokens?: number;
@@ -420,6 +442,8 @@ export interface UsageAttribution {
   usageStatus: UsageStatus;
   usage?: PersistedUsageEntry["usage"];
   totalTokens?: number;
+  /** Wall-clock duration of the attempt, or of the row when it has no attempts. */
+  durationMs?: number;
   /** Attempt provenance when the row has one, else the entry's; never assumed observed. */
   cacheProvenance?: CacheTelemetryProvenance;
 }
@@ -465,6 +489,7 @@ export function usageAttributions(entry: PersistedUsageEntry): UsageAttribution[
       usageStatus: entry.usageStatus,
       ...(entry.usage ? { usage: entry.usage } : {}),
       ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
+      durationMs: entry.durationMs,
       ...(entry.cacheProvenance ? { cacheProvenance: entry.cacheProvenance } : {}),
     }];
   }
@@ -482,6 +507,7 @@ export function usageAttributions(entry: PersistedUsageEntry): UsageAttribution[
       usageStatus: attempt.usageStatus,
       ...(attempt.usage ? { usage: attempt.usage } : {}),
       ...(attempt.totalTokens !== undefined ? { totalTokens: attempt.totalTokens } : {}),
+      durationMs: attempt.durationMs,
       ...(cacheProvenance ? { cacheProvenance } : {}),
     };
   });
@@ -611,6 +637,30 @@ function finalizeCoverage(totals: UsageSummaryTotals): void {
   totals.coverageRatio = totals.requests === 0 ? 0 : totals.measuredRequests / totals.requests;
 }
 
+/**
+ * Aggregate output throughput inputs (#6309) into the window totals. A measured attempt
+ * contributes its output tokens and duration only when both are positive, so a zero-token
+ * or zero-duration row cannot deflate or inflate the rate. Without attempts, the row-level
+ * usage and duration describe the request directly.
+ */
+function addThroughputTotals(totals: UsageSummaryTotals, entry: PersistedUsageEntry): void {
+  const samples = entry.attempts?.length
+    ? entry.attempts
+    : [{ usage: entry.usage, durationMs: entry.durationMs }];
+  for (const sample of samples) {
+    if (!sample.usage || tokensPerSecond(sample.usage.outputTokens, sample.durationMs) === null) continue;
+    totals.throughputOutputTokens = (totals.throughputOutputTokens ?? 0) + sample.usage.outputTokens;
+    totals.throughputDurationMs = (totals.throughputDurationMs ?? 0) + sample.durationMs;
+    totals.throughputSamples = (totals.throughputSamples ?? 0) + 1;
+  }
+}
+
+/** Fold the raw throughput sums into the rate the dashboard and API expose. */
+function finalizeThroughput(totals: UsageSummaryTotals): void {
+  if ((totals.throughputDurationMs ?? 0) <= 0) return;
+  totals.throughputTokensPerSec = tokensPerSecond(totals.throughputOutputTokens ?? 0, totals.throughputDurationMs!) ?? undefined;
+}
+
 function addEstimatedCost(
   totals: UsageSummaryTotals,
   entry: Pick<PersistedUsageEntry, "usageStatus" | "usage" | "attempts">,
@@ -670,6 +720,9 @@ interface UsageModelAccumulator {
   cacheObserved: boolean;
   /** Input tokens from attributions with OBSERVED cache detail; the hit-rate denominator. */
   cacheObservedInputTokens: number;
+  throughputOutputTokens: number;
+  throughputDurationMs: number;
+  throughputSamples: number;
   estimatedCostUsd?: number;
   requestCounts: UsageRequestCounts;
   requestFacts?: Map<number, number>;
@@ -820,6 +873,9 @@ function mergeTotals(target: UsageSummaryTotals, source: UsageSummaryTotals): vo
   target.cacheObservedRequests = mergeOptionalTotal(target.cacheObservedRequests, source.cacheObservedRequests);
   target.cacheSynthesizedRequests = mergeOptionalTotal(target.cacheSynthesizedRequests, source.cacheSynthesizedRequests);
   target.cacheUnknownRequests = mergeOptionalTotal(target.cacheUnknownRequests, source.cacheUnknownRequests);
+  target.throughputOutputTokens = mergeOptionalTotal(target.throughputOutputTokens, source.throughputOutputTokens);
+  target.throughputDurationMs = mergeOptionalTotal(target.throughputDurationMs, source.throughputDurationMs);
+  target.throughputSamples = mergeOptionalTotal(target.throughputSamples, source.throughputSamples);
 }
 
 /** Sum an optional total. Absent on one side means "not computed there", so it contributes nothing. */
@@ -849,6 +905,9 @@ function blankModelAccumulator(
     cacheCreationInputTokens: 0,
     cacheObserved: false,
     cacheObservedInputTokens: 0,
+    throughputOutputTokens: 0,
+    throughputDurationMs: 0,
+    throughputSamples: 0,
     requestCounts: blankRequestCounts(),
     ...(mode === "exact" ? { requestFacts: new Map() } : {}),
   };
@@ -877,6 +936,9 @@ function mergeModelAccumulator(target: UsageModelAccumulator, source: UsageModel
   target.cacheCreationInputTokens += source.cacheCreationInputTokens;
   target.cacheObserved ||= source.cacheObserved;
   target.cacheObservedInputTokens += source.cacheObservedInputTokens;
+  target.throughputOutputTokens += source.throughputOutputTokens;
+  target.throughputDurationMs += source.throughputDurationMs;
+  target.throughputSamples += source.throughputSamples;
   if (source.estimatedCostUsd !== undefined) {
     target.estimatedCostUsd = (target.estimatedCostUsd ?? 0) + source.estimatedCostUsd;
   }
@@ -1081,6 +1143,12 @@ function buildUsageModels(
       totalTokens: model.summaryTotalTokens,
       inputTokens: model.inputTokens,
       outputTokens: model.outputTokens,
+      ...(model.throughputDurationMs > 0
+        ? {
+            throughputTokensPerSec: tokensPerSecond(model.throughputOutputTokens, model.throughputDurationMs) ?? undefined,
+            throughputSamples: model.throughputSamples,
+          }
+        : {}),
       cachedInputTokens: model.cacheReadInputTokens,
       cacheReadInputTokens: model.cacheReadInputTokens,
       cacheCreationInputTokens: model.cacheCreationInputTokens,
@@ -1120,6 +1188,12 @@ function buildUsageProviders(
         totalTokens: provider.summaryTotalTokens,
         inputTokens: provider.inputTokens,
         outputTokens: provider.outputTokens,
+        ...(provider.throughputDurationMs > 0
+          ? {
+              throughputTokensPerSec: tokensPerSecond(provider.throughputOutputTokens, provider.throughputDurationMs) ?? undefined,
+              throughputSamples: provider.throughputSamples,
+            }
+          : {}),
         cachedInputTokens: provider.cacheReadInputTokens,
         cacheReadInputTokens: provider.cacheReadInputTokens,
         cacheCreationInputTokens: provider.cacheCreationInputTokens,
@@ -1298,6 +1372,11 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
     if (attribution.usage) {
       breakdown.inputTokens += attribution.usage.inputTokens;
       breakdown.outputTokens += attribution.usage.outputTokens;
+      if (tokensPerSecond(attribution.usage.outputTokens, attribution.durationMs ?? 0) !== null) {
+        breakdown.throughputOutputTokens += attribution.usage.outputTokens;
+        breakdown.throughputDurationMs += attribution.durationMs!;
+        breakdown.throughputSamples += 1;
+      }
       const { read, creation, provenance } = cacheObservationFromUsage(
         attribution.usage,
         attribution.cacheProvenance,
@@ -1463,6 +1542,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
     addTokens(partition.totals, entry);
     addSpendTotals(partition.totals, entry);
     addCacheProvenanceTotals(partition.totals, entry);
+    addThroughputTotals(partition.totals, entry);
     addEstimatedCost(partition.totals, entry, costInfo);
 
     const requestKey = this.mode === "exact" ? this.requestKey(entry.requestId) : null;
@@ -1556,6 +1636,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
       day.modelOverlaps.push(...partition.modelOverlaps.values());
     }
     finalizeCoverage(totals);
+    finalizeThroughput(totals);
 
     const customDates = this.window ? new Set(customWindowDates(this.window)) : null;
     const dayCount = customDates?.size ?? (range === "all" ? dayCountForAllRange(oldestTimestamp, now) : fixedDays);

package/src/web-search/loop.ts

@@ -382,9 +382,6 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
   const messages: OcxMessage[] = [...parsed.context.messages];
   const loopT0 = Date.now();
   const allTools = parsed.context.tools ?? [];
-  // For the forced-answer pass we drop the synthetic web_search tool so the model MUST answer from the
-  // results already in `messages` (can't search again) — this guarantees a non-empty final answer.
-  const toolsNoWebSearch = allTools.filter(t => !t.webSearch);
   let searchesExecuted = 0;
   let executedSearchCount = 0;
   // Queries whose search already failed this turn — repeats are short-circuited so a model that keeps
@@ -438,8 +435,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
    * restart) before the `on429` key rotation.
    */
   const prepareIterationEvents = async function* (forceAnswer: boolean): AsyncGenerator<AdapterEvent, IterationResponse> {
-    // On the forced-answer pass the synthetic web_search tool is gone, so the model MUST answer
-    // from the results already in `messages`. A weak model can still produce a thin answer that
+    // On the forced-answer pass the model is asked to answer from the results already in
+    // `messages`. A weak model can still produce a thin answer that
     // ignores what the search found, which reads to the user as "the search did nothing". Nudge it
     // (iteration-locally — never mutate the shared `messages`) to actually use the gathered results.
     // Only when a REAL search ran (executedSearchCount, not empty-query/limit/repeat placeholders).
@@ -455,7 +452,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
     const iterParsed: OcxParsedRequest = {
       ...parsed, stream: true,
       ...(recoveringEmptyAnswer ? { options: { ...parsed.options, toolChoice: "none" as const } } : {}),
-      context: { ...parsed.context, messages: iterMessages, tools: recoveringEmptyAnswer ? [] : forceAnswer ? toolsNoWebSearch : allTools },
+      context: { ...parsed.context, messages: iterMessages, tools: recoveringEmptyAnswer ? [] : allTools },
     };
     // One cumulative header deadline spans every pool-key 429 rotation in this model iteration.
     // clear() stops only its timer after final headers; the direct turn signal remains attached to
@@ -885,8 +882,13 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
 
           // Loop (search + re-ask) ONLY when the model's actionable output is purely web_search. A real
           // tool call (e.g. shell/apply_patch) means this turn is terminal for Codex — finalize so those
-          // calls reach Codex. forceAnswer also finalizes.
-          const shouldLoop = split.calls.length > 0 && !split.hasRealToolCall && !forceAnswer;
+          // calls reach Codex.
+          // The budget check happens per query inside runSearchCall, so a
+          // forced pass that emits one more web_search call is served the
+          // limit-reached result instead of failing the turn (#6464: stripping
+          // the declaration makes some models emit the raw call as visible
+          // text).
+          const shouldLoop = split.calls.length > 0 && !split.hasRealToolCall;
           if (!shouldLoop) {
             // #1001: a forced-answer pass that ends `done` must have produced
             // usable output — never a malformed tool call, and never silence.
@@ -959,6 +961,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           return;
         }
       }
+      yield { type: "error", message: "web-search loop exceeded its iteration cap" };
     } finally {
       if (abortSignal) abortSignal.removeEventListener("abort", linkAbort);
     }