@bitkyc08/opencodex 2.77.0 → 2.78.0

package/src/server/messages-native.ts

@@ -4,7 +4,7 @@
  * A Messages request whose settled route is a proxy-managed key on the `anthropic` adapter is
  * sent as Messages: the source body (after the ingress's managed-client steps) cut to a field
  * allowlist, the wire model, and the provider's own key. With `managedMessagesNativeOAuth` on
- * (PF-10), an unpooled Anthropic OAuth account is sent the same way with the access token the
+ * (PF-10), an Anthropic OAuth account is sent the same way with the access token the
  * existing OAuth selection resolves at dispatch (`messages-native-oauth.ts`). Modelled on the native Chat lane and
  * built on the same shared pieces — attempt row, finish-once final log, spend tracker, proactive
  * key selection, key failover and 429 replay, connection policy — so nothing the Responses
@@ -17,6 +17,13 @@
  *
  * Loaded lazily by `claude-messages.ts` only when the switch is on and a route is eligible.
  */
+import { resolveAnthropicModelRoute } from "../oauth/anthropic-model-routes";
+import { bindAnthropicRefusalCredential, rotateAnthropicAccountOnResponse } from "../oauth/anthropic-account-refusal";
+import { claimAnthropicFamilyRevalidation } from "../oauth/anthropic-model-quota";
+import { captureConfigGeneration } from "../lib/state-store-sweeper";
+import { recordAnthropicAccountQuotaFromHeaders } from "../providers/quota";
+import { credentialGeneration, getAccountCredentialWithStatus } from "../oauth/store";
+import { ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST } from "../oauth/anthropic-routing";
 import { enforceAnthropicImageLimits } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
 import { formatAnthropicErrorBody } from "../adapters/anthropic";
@@ -84,6 +91,7 @@ import { nativeMessagesDeclineReason, type NativeMessagesSelector } from "./mess
 import {
   nativeOAuthBindingIsCurrent,
   NativeOAuthSelectionChangedError,
+  NativeOAuthModelRouteError,
   resolveNativeOAuthBinding,
   restoreOAuthToolNamesInMessage,
   restoreOAuthToolNamesInSse,
@@ -150,6 +158,7 @@ export interface HandleNativeMessagesOptions {
    */
   callerAnthropicBeta?: string | null;
   clientIdentity?: AnthropicClientIdentity;
+  sessionKey?: string | null;
 }
 
 type FinishLog = (status: number, message?: string, meta?: FinalRequestLogMeta) => void;
@@ -373,7 +382,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   const oauthProvider = (binding: NativeOAuthBinding): OcxProviderConfig => ({ ...route.provider, apiKey: binding.snapshot.accessToken });
   if (route.provider.authMode === "oauth") {
     try {
-      oauthBinding = await resolveNativeOAuthBinding(config);
+      oauthBinding = await resolveNativeOAuthBinding(config, { sessionKey: options.sessionKey, model: route.modelId });
     } catch (error) {
       cleanupAbort();
       upstream.abort();
@@ -381,6 +390,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       const localRefusal = localOAuthFailure(error);
       if (localRefusal) return localRefusal;
       if (error instanceof NativeOAuthSelectionChangedError) return fail(409, error.message, "api_error");
+      if (error instanceof NativeOAuthModelRouteError) return fail(400, error.message, "invalid_request_error");
       return fail(401, publicOAuthAuthenticationErrorMessage(error), "authentication_error");
     }
   } else {
@@ -455,7 +465,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   const transientSendAvailable = (): boolean => remainingTransientSends() > 0;
   const selector: NativeMessagesSelector = options.selector ?? {};
 
-  const send = async (recovery?: "rate-limit-429" | "key-429" | "key-401"): Promise<Response> => {
+  const send = async (recovery?: "rate-limit-429" | "oauth-account-403" | "key-429" | "key-401"): Promise<Response> => {
     const remaining = remainingTransientSends();
     if (requestTransientPolicy && remaining <= 0) {
       throw new Error("native Messages transient send budget exhausted before recovery dispatch");
@@ -479,10 +489,10 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
               for (let attempt = 0; !nativeOAuthBindingIsCurrent(oauthBinding); attempt++) {
                 if (attempt >= 3) throw new NativeOAuthSelectionChangedError();
                 try {
-                  oauthBinding = await resolveNativeOAuthBinding(config);
+                  oauthBinding = await resolveNativeOAuthBinding(config, { sessionKey: options.sessionKey, model: route.modelId });
                 } catch (error) {
                   if (error instanceof OAuthAccountPausedError || error instanceof OAuthLoginRequiredError
-                    || error instanceof AnthropicAccountCooldownError) throw error;
+                    || error instanceof AnthropicAccountCooldownError || error instanceof NativeOAuthModelRouteError) throw error;
                   throw new NativeOAuthSelectionChangedError();
                 }
                 rebuildFor(oauthProvider(oauthBinding));
@@ -500,15 +510,34 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
             const headers = new Headers(wire.headers);
             const encoding = new Headers(init.headers).get("accept-encoding");
             if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
-            if (init.signal?.aborted) throw init.signal.reason;
-            if (!spendTracker.charge()) throw new NativeMessagesSpendRefusal();
-            noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-            const dispatched = await sendWithConnectionPolicy(
-              (activeProvider as OcxProviderTransport).fetch ?? execute,
-              wire.url,
-              applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
-              { providerName: route.providerName, provider: activeProvider },
-            );
+            const snapshot = oauthBinding?.snapshot;
+            const providerAccountUuid = oauthBinding?.providerAccountUuid;
+            const writerGeneration = snapshot ? captureConfigGeneration() : 0;
+            const ownsBearer = snapshot && headers.get("authorization") === `Bearer ${snapshot.accessToken}` && !headers.has("x-api-key");
+            const releaseFamily = snapshot ? claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
+            if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+            let dispatched: Response;
+            try {
+              if (init.signal?.aborted) throw init.signal.reason;
+              if (!spendTracker.charge()) throw new NativeMessagesSpendRefusal();
+              noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+              dispatched = await sendWithConnectionPolicy(
+                (activeProvider as OcxProviderTransport).fetch ?? execute,
+                wire.url,
+                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
+                { providerName: route.providerName, provider: activeProvider },
+              );
+            } finally { releaseFamily(); }
+            if (ownsBearer && snapshot) {
+              try {
+                const current = getAccountCredentialWithStatus("anthropic", snapshot.accountId);
+                if (current && !current.needsReauth && credentialGeneration(current.credential) === snapshot.generation
+                  && current.credential.accountId === providerAccountUuid) {
+                  bindAnthropicRefusalCredential(dispatched, snapshot, providerAccountUuid);
+                  recordAnthropicAccountQuotaFromHeaders(snapshot.accountId, dispatched.headers, writerGeneration, dispatched.status, route.modelId);
+                }
+              } catch { /* Passive observation must not fail the response. */ }
+            }
             if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
             return dispatched;
           },
@@ -544,7 +573,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       rebuildFor(rotated);
       response = await send("key-401");
     }
-    const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
+    const retryPolicy = oauthBinding ? undefined : rateLimitRetryPolicyFor(activeProvider);
     let retries = 0;
     // A refusal this proxy synthesized for a reset replay is not a provider rate limit.
     while (
@@ -577,6 +606,37 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       rebuildFor(rotated);
       response = await send("key-429");
     }
+    const oauthRetryKey = {};
+    const triedAccountIds = new Set<string>();
+    let oauthFailovers = 0;
+    while (oauthBinding && (response.status === 429 || response.status === 403)) {
+      const sendingBinding = oauthBinding;
+      const expectedRecoverySelection = sendingBinding.selection;
+      triedAccountIds.add(sendingBinding.snapshot.accountId);
+      const nextAccountId = await rotateAnthropicAccountOnResponse(response, {
+        config, accountId: sendingBinding.snapshot.accountId, model: route.modelId,
+        sessionKey: sendingBinding.sessionKey, decision: sendingBinding.routeDecision,
+        excludedAccountIds: triedAccountIds,
+        currentDecision: () => {
+          const resolved = resolveAnthropicModelRoute(config, route.modelId);
+          if (resolved.error) throw new NativeOAuthModelRouteError(`Invalid Anthropic model routes: ${resolved.error}`);
+          return resolved.decision;
+        },
+        signal: upstream.signal, requestKey: oauthRetryKey,
+        canRetry: transientSendAvailable() && oauthFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
+      });
+      if (!nextAccountId) break;
+      const recovery = response.status === 403 ? "oauth-account-403" : "rate-limit-429";
+      discard(response);
+      oauthBinding = await resolveNativeOAuthBinding(config, {
+        sessionKey: options.sessionKey, model: route.modelId, candidateAccountId: nextAccountId,
+        expectedRecoverySelection, expectedRecoveryRouteDecision: sendingBinding.routeDecision,
+      });
+      oauthFailovers++;
+      rebuildFor(oauthProvider(oauthBinding));
+      logCtx.provider = formatAnthropicProviderForLog(route.providerName, oauthBinding.snapshot.accountId, config);
+      response = await send(recovery);
+    }
   } catch (error) {
     releaseRetainedRequest();
     cleanupAbort();
@@ -591,6 +651,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     const localRefusal = localOAuthFailure(sendError);
     if (localRefusal) return localRefusal;
     if (sendError instanceof NativeOAuthSelectionChangedError) return fail(409, sendError.message, "api_error");
+    if (sendError instanceof NativeOAuthModelRouteError) return fail(400, sendError.message, "invalid_request_error");
     if (sendError instanceof NativeOpaqueStateRefusal) {
       logCtx.errorCode = "unsupported_feature";
       return fail(400, sendError.message, "invalid_request_error", "unsupported_feature");
@@ -791,6 +852,7 @@ export function nativeMessagesCountBody(
   cc: OcxConfig["claudeCode"],
   body: Rec,
   rows: Pick<NativeMessagesSelector, "effortRow" | "fastRow">,
+  clientIdentity?: AnthropicClientIdentity,
 ): Rec | undefined {
   if (typeof body.model !== "string") return undefined;
   try {
@@ -812,7 +874,7 @@ export function nativeMessagesCountBody(
     };
     if (nativeMessagesDeclineReason(route, body, config, selector) !== undefined) return undefined;
     // The body without a credential: counting never resolves or refreshes an OAuth account.
-    return anthropicMessagesNativeWireBody(route.provider, route.modelId, body).wireBody;
+    return anthropicMessagesNativeWireBody(route.provider, route.modelId, body, { clientIdentity }).wireBody;
   } catch {
     return undefined;
   }

package/src/server/responses/adapter-dispatch.ts

@@ -1,5 +1,8 @@
 import { classifyAnthropic429 } from "../../oauth/anthropic-rate-limit-policy";
 import { rotateAnthropicAccountOnResponse } from "../../oauth/anthropic-account-refusal";
+import { authorizeResendForRecovery } from "../../lib/request-resend-gate";
+import { ambiguousResendAllowanceFor, selfContainedResponsesBody } from "./reset-replay";
+import { transientSendCapFor } from "./request-send-budget";
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import { isLocalUpstream } from "../../lib/local-upstream";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
@@ -25,6 +28,7 @@ import { withProviderRequestSlot } from "../../providers/request-pacing";
 import { providerFetch, fetchWithHeaderTimeout, safeHostLabel } from "./fetch-helpers";
 import {
   transientRetryPolicyFor,
+  resetReplayPolicyFor,
   rateLimitRetryPolicyFor,
   hasKeyPoolFailover,
   rotateProviderTransportOn401,
@@ -156,6 +160,8 @@ export async function prepareAdapterExchange(
     | "reserveCredentialHop"
     | "pendingHopPermit"
     | "workflowRootId"
+    | "claimAmbiguousResend"
+    | "sendsUsed"
   >,
 ) {
   const { options, config, logCtx, req } = requestContext;
@@ -189,9 +195,18 @@ export async function prepareAdapterExchange(
     recoveryClassFor,
     sendBudgetExhausted,
     reserveCredentialHop,
+    claimAmbiguousResend,
   } = sendBudgetState;
 
 
+  let selfContainedJudgment: boolean | undefined;
+  const requestIsSelfContained = (): boolean =>
+    selfContainedJudgment ??= selfContainedResponsesBody(parsed._rawBody);
+  const claimPreHeaderResend = (): boolean => authorizeResendForRecovery(
+    "pre-header", "connection-reset",
+    ambiguousResendAllowanceFor(route.provider, requestIsSelfContained, claimAmbiguousResend),
+  ).allowed;
+
   const upstream = new AbortController();
   const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal);
   const connectMs = config.connectTimeoutMs ?? 200_000;
@@ -343,6 +358,13 @@ export async function prepareAdapterExchange(
       const compactPrepaid = options.compactionRecoveryAttempted ? sendBudgetState.pendingHopPermit : undefined;
       if (compactPrepaid) sendBudgetState.pendingHopPermit = undefined;
       let compactPrepaidUsed = false;
+      // Combo and emergency compaction admission already book this target's first send.
+      // Its configured initial ceiling is target-local; the shared remainder below still
+      // accounts for earlier targets without deducting their sends from this target twice.
+      const initialSendCap = transientPolicy || resetReplayPolicyFor(route.provider)
+        ? transientSendCapFor(transientPolicy?.attempts,
+          (options.comboAttempt || compactPrepaid) ? 0 : sendBudgetState.sendsUsed)
+        : 1;
       const fetchWithRetryPolicy = (route.provider.adapter === "google" || transientPolicy)
         ? fetchWithTransientRetry
         : fetchWithResetRetry;
@@ -367,15 +389,12 @@ export async function prepareAdapterExchange(
         {
           abortSignal: upstream.signal,
           label: safeHostLabel(builtInitialRequest.url),
-          ...(transientPolicy || compactPrepaid
-            // Draws the remainder, not the raw policy. A combo child inherits the parent's
-            // holder but used to take a fresh full allowance on its own first send, so the
-            // shared counter was inherited without ever being read as a limit.
+          claimAmbiguousResend: claimPreHeaderResend,
+          ...(transientPolicy || resetReplayPolicyFor(route.provider) || compactPrepaid
             ? {
-              // The first emergency send is already paid for. Only retries consume the
-              // remaining allowance; treating the booking as unavailable blocks a cap of two.
-              attempts: Math.min(transientPolicy?.attempts ?? 1,
-                remainingTransientSendBudget(transientPolicy?.attempts ?? 1) + (compactPrepaid ? 1 : 0)),
+              // A pending compaction permit already booked this leg's first physical send.
+              attempts: Math.min(initialSendCap,
+                remainingTransientSendBudget(initialSendCap) + (compactPrepaid ? 1 : 0)),
               onSendsConsumed: noteTransientSends,
             }
             : {}),
@@ -545,14 +564,21 @@ export async function prepareAdapterExchange(
           const refetchWithPolicy = (route.provider.adapter === "google" || refetchTransientPolicy)
             ? fetchWithTransientRetry
             : fetchWithResetRetry;
-          // Same rule as the passthrough rebuild: spend the base allowance first, then the one
-          // shared final-recovery reserve, so a recovery that follows a spent streak still gets
-          // its single send instead of dying at three.
-          const refetchAllowance = refetchTransientPolicy
-            ? recoverySendAllowance(
-              refetchTransientPolicy.attempts,
-              recoveryClassFor(recovery),
+          const helperCountsSends = refetchTransientPolicy !== null || resetReplayPolicyFor(route.provider) !== null;
+          const prepaid = sendBudgetState.pendingHopPermit;
+          const configuredTotal = refetchTransientPolicy?.attempts;
+          const refetchCap = transientSendCapFor(configuredTotal,
+            sendBudgetState.sendsUsed - (prepaid ? 1 : 0));
+          // An exact total includes a booked hop, even when it consumed the last base slot.
+          // Keep that funded send while forbidding the final reserve from widening the total.
+          const prepaidLastSlot = helperCountsSends && configuredTotal !== undefined && prepaid
+            && refetchCap > 0 && remainingTransientSendBudget(refetchCap) === 0;
+          if (prepaidLastSlot) sendBudgetState.pendingHopPermit = undefined;
+          const refetchAllowance = helperCountsSends
+            ? prepaidLastSlot ? { attempts: 1, permit: prepaid } : recoverySendAllowance(
+              refetchCap, recoveryClassFor(recovery),
               `${route.providerName}|${route.modelId}|${recovery}`,
+              { allowFinalRecoveryReserve: configuredTotal === undefined },
             )
             : undefined;
           try {
@@ -566,7 +592,7 @@ export async function prepareAdapterExchange(
                 // can be refused above before it does. use() past the first attempt is a no-op.
                 onDispatch?.();
                 if (preserveFailureResponse) replacementAdmitted = true;
-                if (!refetchTransientPolicy) chargeFastDowngradeWorkflowSend();
+                if (!refetchAllowance) chargeFastDowngradeWorkflowSend();
                 return fetchWithHeaderTimeout(retryRequest.url,
                   applyUpstreamRecoveryInit({
                     method: retryRequest.method, headers: retryRequest.headers, body: retryRequest.body,
@@ -580,6 +606,7 @@ export async function prepareAdapterExchange(
               {
                 abortSignal: upstream.signal,
                 label: safeHostLabel(retryRequest.url),
+                claimAmbiguousResend: claimPreHeaderResend,
                 ...(refetchAllowance
                   ? {
                     attempts: refetchAllowance.attempts,
@@ -638,7 +665,7 @@ export async function prepareAdapterExchange(
       const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
       const hop = reserveCredentialHop("auth-recovery",
         `${route.providerName}|${route.modelId}|antigravity-auth`,
-        !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null);
+        !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null));
       if (!hop.allowed) return null;
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextId);
@@ -708,7 +735,7 @@ export async function prepareAdapterExchange(
               const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
               const hop = reserveCredentialHop("auth-recovery",
                 `${route.providerName}|${route.modelId}|terminal-refresh-account`,
-                !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null);
+                !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null));
               if (hop.allowed) {
                 try {
                   const admitted = await applyFailoverSnapshot(alternate);
@@ -861,7 +888,7 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "repair",
           `${route.providerName}|${route.modelId}|anthropic-fast-downgrade`,
-          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
         );
         if (hop.allowed) {
           anthropicFastDowngradeGuard.attempted = true;
@@ -1059,10 +1086,9 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "auth-recovery",
           `${route.providerName}|${route.modelId}|adapter-recovery-oauth-429`,
-          // Only a helper-routed replay reports this send back. A reset-only refetch reports
-          // nothing and an adapter ladder settles the booking itself, so promising an external
-          // report on either would leave a booking pending until it swallowed a later charge.
-          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+          // Transient and opted-in reset helpers report physical sends; an adapter-owned
+          // ladder settles its own booking.
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
         );
         if (!hop.allowed) break;
         const nextAccountId = rotateGenericOAuthAccountOnRefusal(
@@ -1164,10 +1190,9 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "auth-recovery",
           `${route.providerName}|${route.modelId}|adapter-recovery-oauth-429`,
-          // Only a helper-routed replay reports this send back. A reset-only refetch reports
-          // nothing and an adapter ladder settles the booking itself, so promising an external
-          // report on either would leave a booking pending until it swallowed a later charge.
-          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+          // Transient and opted-in reset helpers report physical sends; an adapter-owned
+          // ladder settles its own booking.
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
         );
         if (!hop.allowed) break;
         const nextAccountId = rotateGenericOAuthAccountOn429(
@@ -1276,7 +1301,7 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "auth-recovery",
           `${route.providerName}|${route.modelId}|adapter-recovery-oauth-verify`,
-          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
         );
         if (!hop.allowed) break;
         // Auth-refusal rotation, not the rate-limit one: a verification refusal

package/src/server/responses/core-auth.ts

@@ -41,13 +41,19 @@ import { markLocalRequestLogRefusal } from "../request-log";
 import { CODEX_POOL_REFRESH_INCOMPLETE_LOG_REASON } from "../../codex/pool-refresh-backoff";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import { forceRefreshMainAccountToken } from "../../codex/main-account";
+import { safeCallerSessionId } from "../caller-session-identity";
 
-/** Keep synthesized Claude identity out of request headers reused by policy/combo fallback. */
+/** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
 export function withClaudeNativeSession(headers: Headers, provider: OcxProviderConfig, sessionId?: string): Headers {
-  if (!sessionId || !isCanonicalOpenAiForwardProvider(provider)
-    || headers.has("session_id") || headers.has("session-id") || headers.has("thread-id")) return headers;
+  // Empty values count as absent, matching materializeCodexUpstreamAuth, so first attempts and
+  // retries rebuilt from caller headers pick the same identity.
+  if (!isCanonicalOpenAiForwardProvider(provider) || headers.get("session_id")) return headers;
+  const alias = ["session-id", "thread-id"].find(name => headers.get(name));
+  const nativeSession = alias ? safeCallerSessionId(headers.get(alias)) : sessionId;
+  // A non-empty invalid alias suppresses weaker metadata identity.
+  if (!nativeSession) return headers;
   const forwarded = new Headers(headers);
-  forwarded.set("session_id", sessionId);
+  forwarded.set("session_id", nativeSession);
   return forwarded;
 }
 

package/src/server/responses/core-combo.ts

@@ -28,6 +28,7 @@ import {
   concreteComboRequestBody,
   comboDefaultEffort,
   isComboTargetInCooldown,
+  snapshotComboQuotaCooldowns,
   noteComboSuccess,
   comboFailureDecision,
   advanceComboAfterFailure,
@@ -72,6 +73,7 @@ import { isPlainObject } from "../../lib/plain-data";
 import {
   clientCancelledResponse,
   comboUnavailable,
+  comboUnavailableResponse,
   targetIncompatibleResponse,
   unreadableEncryptedAgentTaskResponse,
 } from "./core-errors";
@@ -412,8 +414,8 @@ export async function executeComboResponses(
     }
   };
   const adoptFailedChildLog = (childLog: RequestLogContext): void => {
-    // Attempts remain the complete physical history; the logical row mirrors the most recent
-    // failed target so an exhausted combo still has useful top-level reasoning diagnostics.
+    // Attempts remain the complete physical history; the logical row mirrors the failed
+    // target whose response is returned, including an earlier quota refusal on exhaustion.
     Object.assign(logCtx, childLog, {
       requestedModel,
       model: requestedModel,
@@ -676,6 +678,41 @@ export async function executeComboResponses(
   // is gone, so carry the loop's own classification decision instead of re-deriving a
   // weaker one from the status alone (#4149).
   let lastFailureClassifiesOverflow = false;
+  // The first quota/rate-limit refusal of the ladder. A fallback that then refuses its own
+  // credential or plan (401/403, or a 400 the ladder hopped past) says nothing about why the
+  // request failed: the primary target ran out. Returning that fallback refusal told clients
+  // "OpenAI account pool has no usable account credential" while every Claude account was spent.
+  let quotaFailure: Response | undefined;
+  let quotaFailedChildLog: RequestLogContext | undefined;
+  // Snapshotted before dispatch: a 401/403 inside this ladder cools its own provider, and that
+  // fresh cooldown is not a reason the request found no target.
+  const quotaCooldownSnapshot = snapshotComboQuotaCooldowns(config, comboId);
+  const exhaustedFailure = (): Response => {
+    const returnsQuota = lastFailure && [400, 401, 403].includes(lastFailure.status) && quotaFailure;
+    const failedChildLog = returnsQuota ? quotaFailedChildLog : lastFailedChildLog;
+    if (failedChildLog) adoptFailedChildLog(failedChildLog);
+    if (!lastFailure || ![400, 401, 403].includes(lastFailure.status)) return lastFailure!;
+    if (quotaFailure) return quotaFailure;
+    // The quota-refused target was cooled before this request picked, so the ladder never saw
+    // its refusal. The cooldown, with its Retry-After, is still the honest answer.
+    let quotaCooldownUntil: number | undefined;
+    const now = Date.now();
+    for (const { target, cooldownUntil } of quotaCooldownSnapshot) {
+      if (cooldownUntil <= now) continue;
+      try {
+        if (!targetEligible(target)) continue;
+      } catch {
+        // An eligibility check can exhaust the translator budget; it is not quota evidence.
+        continue;
+      }
+      quotaCooldownUntil = Math.min(quotaCooldownUntil ?? cooldownUntil, cooldownUntil);
+    }
+    const remainingQuotaCooldownMs = quotaCooldownUntil === undefined ? 0 : quotaCooldownUntil - Date.now();
+    return remainingQuotaCooldownMs > 0
+      ? comboUnavailableResponse(`No available targets for combo: ${comboId}`, {
+        retryAfter: String(Math.max(1, Math.ceil(remainingQuotaCooldownMs / 1000))),
+      }) : lastFailure;
+  };
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
@@ -698,8 +735,7 @@ export async function executeComboResponses(
       // return the last real upstream answer with its status, headers and any quota body
       // intact rather than to mint a synthetic error, and a later target only exists because
       // an earlier one already recorded one.
-      if (lastFailedChildLog) adoptFailedChildLog(lastFailedChildLog);
-      return lastFailure!;
+      return exhaustedFailure();
     }
     const targetSendBudget = comboSendScope
       ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
@@ -979,6 +1015,10 @@ export async function executeComboResponses(
     );
     attemptRetained = true;
     lastFailure = failure.response;
+    if (!quotaFailure && (lastFailure.status === 429 || lastFailure.status === 402)) {
+      quotaFailure = lastFailure;
+      quotaFailedChildLog = childLog;
+    }
     lastFailedChildLog = childLog;
     // A replacement that answers 200 is unmarked, and its zero-output failure only exists once
     // preflight has rebuilt the stream as a fresh Response. A spent grant never hops: a status the
@@ -1141,9 +1181,9 @@ export async function executeComboResponses(
       }
       // Waiting or recovery may have observed cancellation after the check above.
       if (options.abortSignal?.aborted) return clientCancelledResponse();
-      adoptFailedChildLog(childLog);
     }
   }
+  const failure = exhaustedFailure();
   if (
     lastFailure?.status === 413
     && lastFailureClassifiesOverflow
@@ -1152,5 +1192,5 @@ export async function executeComboResponses(
       ? streamingContextOverflowResponse(requestedModel, options.translatorBudget)
       : jsonContextOverflowResponse();
   }
-  return lastFailure!;
+  return failure;
 }

package/src/service/cli.ts

@@ -16,7 +16,8 @@ import { resolveServiceListenPort, reportServiceServing } from "./health";
 import { platformOps, proxyStillLiveAfterStop, stopTrackedProxyForServiceCommand, installServiceSafely, installFreshWindowsSchedulerSafely, removeServiceInstallState, isServiceInstalled } from "./orchestration";
 import { repairService } from "./repair";
 import type { ServiceRepairVerb } from "./repair";
-import { TASK, plistPath, readServiceBackend, releaseServiceOwner, resolveServiceOwnership } from "./state";
+import { TASK, plistPath, readServiceBackend, releaseServiceOwner, resolveServiceOwnership, serviceStatePaths } from "./state";
+import { ownershipMutationLeaseStatusLine } from "./ownership-mutation-lease.mjs";
 import { foreignServiceOwnerRefusal, unknownServiceOwnerRefusal } from "./repair";
 import type { ServiceBackend } from "./state";
 import { unitPath } from "./systemd";
@@ -419,6 +420,10 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
         // subsumes the not-installed case and adds the serving / stale-plist split.
         console.log(await serviceStatusReport());
       }
+      // A busy lease is why a supervised start can keep failing while the line above only
+      // says "not running"; report its recorded PID with unverified identity and lease age here.
+      const lease = ownershipMutationLeaseStatusLine(serviceStatePaths());
+      if (lease) console.log(lease);
       console.log(`Diagnostics: ${serviceDiagnosticsSummary()}`);
       break;
     }

package/src/service/ownership-mutation-lease.d.mts

@@ -5,6 +5,22 @@ export interface OwnershipMutationLeaseOptions {
   readonly processAlive?: (pid: number) => boolean;
   readonly beforeRelease?: (lockPath: string) => void;
   readonly joinToken?: string;
+  /** Names the current executable at the recorded PID, identity unverified; defaults to `tasklist` or `ps`. */
+  readonly processImage?: (pid: number) => string | null;
+}
+
+/** The recorded lease owner, identity unverified, read for diagnostics; never used to reclaim it. */
+export interface OwnershipMutationLeaseHolder {
+  readonly path: string;
+  /** The recorded PID; null when the directory holds no parseable owner. */
+  readonly pid: number | null;
+  /** Liveness of the current process at the recorded PID; identity is not verified. */
+  readonly alive: boolean | null;
+  /** The current executable at the recorded PID when alive and readable; identity is not verified. */
+  readonly image: string | null;
+  /** Milliseconds since the owner was written, on the clock stale recovery uses. */
+  readonly ageMs: number | null;
+  readonly record: "complete" | "incomplete" | "empty" | "unreadable";
 }
 
 export interface OwnershipMutationLease { readonly token: string; release(): void }
@@ -30,3 +46,13 @@ export declare function withOwnershipMutationLease<T>(
   run: () => T,
   options?: OwnershipMutationLeaseOptions,
 ): T;
+
+export declare function inspectOwnershipMutationLease(
+  statePaths: readonly string[],
+  options?: Pick<OwnershipMutationLeaseOptions, "now" | "processAlive" | "processImage">,
+): OwnershipMutationLeaseHolder | null;
+
+export declare function ownershipMutationLeaseStatusLine(
+  statePaths: readonly string[],
+  options?: Pick<OwnershipMutationLeaseOptions, "now" | "processAlive" | "processImage">,
+): string | null;