@bitkyc08/opencodex 2.78.0 → 2.79.0

package/src/server/messages-native.ts

@@ -110,6 +110,8 @@ import { linkAbortSignal } from "./responses/core-lifetime";
 import { attachRequestSpendTracker } from "./responses/request-spend";
 import { workflowRefusalResponse } from "./workflow-refusal";
 import { sseFieldValue } from "../lib/sse-decoder";
+import { admissionModelDeniedResponse, type AdmissionModelScope } from "./admission-model-scope";
+import { nativeMessagesToolScopeDenial } from "./messages-native-scope";
 
 export {
   isNativeMessagesRouteEligible,
@@ -159,6 +161,7 @@ export interface HandleNativeMessagesOptions {
   callerAnthropicBeta?: string | null;
   clientIdentity?: AnthropicClientIdentity;
   sessionKey?: string | null;
+  modelScope?: AdmissionModelScope;
 }
 
 type FinishLog = (status: number, message?: string, meta?: FinalRequestLogMeta) => void;
@@ -350,6 +353,12 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     return null;
   };
 
+  const toolScopeDenial = nativeMessagesToolScopeDenial(options.modelScope, route.providerName, requestedModel, body);
+  if (toolScopeDenial) {
+    finishLog(403, toolScopeDenial.message);
+    return admissionModelDeniedResponse(toolScopeDenial);
+  }
+
   try {
     await prepareNativeBody(body, req.signal);
   } catch (error) {

package/src/server/responses/adapter-dispatch.ts

@@ -4,6 +4,7 @@ import { authorizeResendForRecovery } from "../../lib/request-resend-gate";
 import { ambiguousResendAllowanceFor, selfContainedResponsesBody } from "./reset-replay";
 import { transientSendCapFor } from "./request-send-budget";
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { sanitizeNonReplayableUpstreamError } from "./non-replayable-error";
 import { isLocalUpstream } from "../../lib/local-upstream";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
@@ -100,6 +101,9 @@ import {
 } from "../../lib/errors";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { cancelBodyOnAbort } from "../../lib/abort";
+import { createCodexAuthDispatchGuard, releaseCodexAuthContextProbeLease, unwrapUpstreamRetryEvidenceError } from "../../codex/auth-context";
+import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import { chargeWorkflowSends } from "../../lib/workflow-budget";
 import { isAntigravityValidationRefusal } from "./antigravity-validation-refusal";
 
@@ -344,6 +348,8 @@ export async function prepareAdapterExchange(
             dispatchOverride: oauthDispatch(builtInitialRequest),
             providerName: route.providerName,
             modelId: route.modelId,
+            beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+              ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
           }),
         }));
     } else {
@@ -384,6 +390,8 @@ export async function prepareAdapterExchange(
               dispatchOverride: oauthDispatch(builtInitialRequest),
               providerName: route.providerName,
               modelId: route.modelId,
+              beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+                ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
             }));
         },
         {
@@ -406,6 +414,13 @@ export async function prepareAdapterExchange(
     upstream.abort();
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const refusal = err instanceof UpstreamRetryEvidenceError ? err.cause : err;
+    const codexRefusal = mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
+      now: Date.now(), accountSelector: route.codexAccountNamespace,
+    });
+    if (codexRefusal) {
+      releaseCodexAuthContextProbeLease(admissionState.authCtx);
+      return codexRefusal;
+    }
     // A pause committed during pacing is local admission policy, not a failed upstream.
     if (refusal instanceof OAuthAccountPausedError) {
       return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(refusal));
@@ -550,6 +565,8 @@ export async function prepareAdapterExchange(
                   dispatchOverride: oauthDispatch(retryRequest),
                   providerName: route.providerName,
                   modelId: route.modelId,
+                  beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+                    ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
                 }),
               });
             });
@@ -601,6 +618,8 @@ export async function prepareAdapterExchange(
                     dispatchOverride: oauthDispatch(retryRequest),
                     providerName: route.providerName,
                     modelId: route.modelId,
+                    beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+                      ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
                   }));
               },
               {
@@ -624,6 +643,15 @@ export async function prepareAdapterExchange(
           retryRequest.releaseBodyObservation?.();
         }
       } catch (err) {
+        const codexRefusal = !options.abortSignal?.aborted && mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
+          now: Date.now(), accountSelector: route.codexAccountNamespace,
+        });
+        if (codexRefusal) {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          releaseCodexAuthContextProbeLease(admissionState.authCtx);
+          return { failed: codexRefusal };
+        }
         if (preserveFailureResponse && !replacementAdmitted && !options.abortSignal?.aborted)
           return { failed: preserveFailureResponse };
         cleanupUpstreamAbort();
@@ -704,8 +732,9 @@ export async function prepareAdapterExchange(
       // Preserve the terminal verdict through adapter and combo error formatting.
       // This also covers a reset reached by a 401/429/413 recovery refetch.
       if (isNonReplayableResponse(upstreamResponse)) {
-        cleanupUpstreamAbort();
-        return upstreamResponse;
+        try {
+          return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
+        } finally { cleanupUpstreamAbort(); }
       }
      if (
        upstreamResponse.status === 401

package/src/server/responses/compact.ts

@@ -53,7 +53,7 @@ import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/
 import {
   applyCodexAuthContextToProvider,
   callerCodexWorkspaceAccountId,
-  createCodexReserveDispatchGuard,
+  createCodexAuthDispatchGuard,
   unwrapUpstreamRetryEvidenceError,
   CodexMainProfileDrainingError,
   headersForCodexAuthContext,
@@ -182,6 +182,8 @@ import {
 import { hasResponsesItemIdRepair, relaySseWithResponsesItemIdRepair } from "../responses-item-id-repair";
 import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/catalog";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
+import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
+import { clientCancelledResponse } from "./core-errors";
 
 import {
   codexAccountGatedCanonicalWireModel,
@@ -435,6 +437,9 @@ async function refreshPoolCompactContext(args: {
       generation: refreshed.generation,
       poolQuotaWriter: capturePoolQuotaWriter(authCtx.accountId, refreshed),
     };
+    // See the core counterpart: the spread dropped the WeakMap-bound credit policy, so a hold
+    // or opt-out landing during the refresh await would go unchecked on the copy.
+    rebindPoolCreditPolicy(authCtx, refreshedAuthCtx);
     const refreshedProvider = applyCodexAuthContextToProvider(
       stripCodexRuntimeProviderFields(provider),
       refreshedAuthCtx,
@@ -463,6 +468,16 @@ async function refreshPoolCompactContext(args: {
     if (isTerminalCompactPoolRefreshFailure(error)) {
       return { ok: false, quarantine: true, response: reauthResponse() };
     }
+    if (req.signal.aborted) {
+      return { ok: false, quarantine: false, response: clientCancelledResponse() };
+    }
+    // See the core counterpart: a policy refusal raised after a successful refresh maps like
+    // the admission path — a reset-bound 429, never a 503 mislabeled as a refresh failure.
+    const policyResponse = mapCodexAuthContextErrorToResponse(error, {
+      now: Date.now(),
+      accountSelector: args.codexAccountNamespace,
+    });
+    if (policyResponse) return { ok: false, quarantine: false, response: policyResponse };
     return {
       ok: false,
       quarantine: false,
@@ -1042,7 +1057,7 @@ export async function handleResponsesCompact(
           providerName: route.providerName,
           modelId: route.modelId,
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
-            ? createCodexReserveDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
+            ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
         }),
         // Every credential-bearing forward send gets manual redirects, not only
         // pool sends: direct mode carries the caller's credential too (#914).

package/src/server/responses/core-auth.ts

@@ -41,6 +41,7 @@ import { markLocalRequestLogRefusal } from "../request-log";
 import { CODEX_POOL_REFRESH_INCOMPLETE_LOG_REASON } from "../../codex/pool-refresh-backoff";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import { forceRefreshMainAccountToken } from "../../codex/main-account";
+import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
 import { safeCallerSessionId } from "../caller-session-identity";
 
 /** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
@@ -200,6 +201,7 @@ export async function resolveResponsesCodexAuth(
   credentialDomainWasRewritten = false,
   retainAccountForUploadedFiles = false,
 ): Promise<ResponsesAuthResolution> {
+  let authCtx: CodexAuthContext | undefined;
   try {
     let authInputHeaders = codexRouteCredentialDomainHeaders(
       req,
@@ -260,7 +262,6 @@ export async function resolveResponsesCodexAuth(
     if (route.codexAccountMode === "direct" && !substituteMainCredential) {
       validateForwardAdmissionCredential(authInputHeaders, config);
     }
-    let authCtx: CodexAuthContext;
     if (route.codexAccountMode) {
       authCtx = await resolveCodexAuthContext(authInputHeaders, config, route.codexAccountMode, {
         admission: options.admission,
@@ -342,6 +343,7 @@ export async function resolveResponsesCodexAuth(
       substituteMainCredential,
     };
   } catch (err) {
+    releaseCodexAuthContextProbeLease(authCtx);
     if (options.abortSignal?.aborted || req.signal.aborted) {
       return { ok: false, response: clientCancelledResponse() };
     }
@@ -480,6 +482,9 @@ export async function refreshPoolForwardAuth(args: {
       generation: refreshed.generation,
       poolQuotaWriter: capturePoolQuotaWriter(authCtx.accountId, refreshed),
     };
+    // The spread dropped the WeakMap-bound credit policy: without the live binding a hold or
+    // opt-out landing during the refresh await would go unchecked on every no-override path.
+    rebindPoolCreditPolicy(authCtx, refreshedAuthCtx);
     const provider = applyCodexAuthContextToProvider(
       stripCodexRuntimeProviderFields(route.provider),
       refreshedAuthCtx,
@@ -502,6 +507,18 @@ export async function refreshPoolForwardAuth(args: {
         response: formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication"),
       };
     }
+    if (options.abortSignal?.aborted || req.signal.aborted) {
+      return { ok: false, quarantine: false, response: clientCancelledResponse() };
+    }
+    // The credential itself refreshed; a policy refusal raised afterwards (a credit hold or an
+    // opt-out that landed during the await) is not a refresh failure. Map it the same way the
+    // admission path does — a reset-bound 429, never a 503 telling the caller to sign in — and
+    // never quarantine a valid account for a policy refusal.
+    const policyResponse = mapCodexAuthContextErrorToResponse(error, {
+      accountSelector: route.codexAccountNamespace,
+      now: Date.now(),
+    });
+    if (policyResponse) return { ok: false, quarantine: false, response: policyResponse };
     return {
       ok: false,
       quarantine: false,

package/src/server/responses/core-codex-account.ts

@@ -54,7 +54,8 @@ import {
   headersForCodexAuthContext,
   applyCodexAuthContextToProvider,
   stripCodexRuntimeProviderFields,
-  createCodexReserveDispatchGuard,
+  createCodexAuthDispatchGuard,
+  CodexPoolAccountCreditsOffError,
 } from "../../codex/auth-context";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import { isRequestExecutionBudget } from "../../lib/request-execution-budget";
@@ -745,12 +746,21 @@ export async function retryCodexPoolOnAlternateAccount(
   // Only a combo reset-derived outcome is deferred. Retry-After, defaults, and
   // ordinary requests must block the first account before the alternate send.
   if (!deferFirstOutcome) recordFirstOutcome();
-  const retryHeaders = headersForCodexAuthContext(callerAuthHeaders, retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission);
-  const retryProvider = applyCodexAuthContextToProvider(
-    stripCodexRuntimeProviderFields(route.provider),
-    retryAuthCtx,
-    "pool",
-  );
+  let retryHeaders: Headers;
+  let retryProvider: ReturnType<typeof applyCodexAuthContextToProvider>;
+  try {
+    retryHeaders = headersForCodexAuthContext(callerAuthHeaders, retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission);
+    retryProvider = applyCodexAuthContextToProvider(stripCodexRuntimeProviderFields(route.provider), retryAuthCtx, "pool");
+  } catch (error) {
+    if (!(error instanceof CodexPoolAccountCreditsOffError)) throw error;
+    // Body/entitlement reads above can outlive credit consent. No alternate will send:
+    // release its reservation and probes, then let the owner map the policy refusal.
+    accountMovePermit?.release();
+    releaseCodexAuthContextProbeLease(firstAuthCtx);
+    releaseCodexAuthContextProbeLease(retryAuthCtx);
+    await firstResponse.body?.cancel().catch(() => undefined);
+    return { kind: "transport", error, authCtx: retryAuthCtx };
+  }
   const retryAdapter = resolveAdapter(
     resolveWireProtocolOverride(route.providerName, route.modelId, retryProvider, inboundWire, route.staticPolicy),
     config.cacheRetention,
@@ -889,7 +899,7 @@ export async function retryCodexPoolOnAlternateAccount(
             modelId: route.modelId,
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-              ? createCodexReserveDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+              ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
           }),
           // Credential-bearing forward send: never follow a redirect into a
           // dead-host rejection after the credential was seen (#914).

package/src/server/responses/non-replayable-error.ts

@@ -0,0 +1,48 @@
+import { isNonReplayableResponse, isReplayRefusalResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
+import { clientCancelledResponse, readDisplaySafeErrorText } from "./core-errors";
+
+const UPSTREAM_ERROR_TYPES = new Set([
+  "invalid_request_error", "authentication_error", "permission_error", "not_found_error",
+  "rate_limit_error", "request_too_large", "overloaded_error", "api_error", "server_error", "insufficient_quota",
+]);
+const UPSTREAM_ERROR_CODES = new Set([
+  "context_length_exceeded", "rate_limit_exceeded", "insufficient_quota", "invalid_api_key",
+  "model_not_found", "invalid_prompt", "content_policy_violation", "server_error",
+  "unsupported_parameter", "invalid_value", "string_above_max_length",
+]);
+
+/** Client projection never grants another send or turns a real upstream error into our refusal. */
+export async function sanitizeNonReplayableUpstreamError(
+  response: Response,
+  signal: AbortSignal,
+): Promise<Response> {
+  if (response.ok || !isNonReplayableResponse(response) || isReplayRefusalResponse(response)) return response;
+  const text = await readDisplaySafeErrorText(response, signal, "");
+  if (signal.aborted) {
+    const cancelled = clientCancelledResponse();
+    markResponseNonReplayable(cancelled);
+    return cancelled;
+  }
+  let type = "upstream_error";
+  let code: string | undefined;
+  try {
+    const parsed = JSON.parse(text);
+    const upstreamType = parsed?.error?.type;
+    const upstreamCode = parsed?.error?.code;
+    if (typeof upstreamType === "string" && UPSTREAM_ERROR_TYPES.has(upstreamType)) type = upstreamType;
+    if (typeof upstreamCode === "string" && UPSTREAM_ERROR_CODES.has(upstreamCode)) code = upstreamCode;
+  } catch {
+    // Incomplete or non-JSON bodies retain the generic error type.
+  }
+  // Upstream text is not forwarded here: no bounded redaction can be proven complete against a client's decoders.
+  const body = JSON.stringify({ error: { type, ...(code === undefined ? {} : { code }),
+    message: `Provider error ${response.status}: upstream diagnostic withheld for a non-replayable failure`,
+  } });
+  const headers = new Headers({ "content-type": "application/json" });
+  if (response.headers.get("x-should-retry") === "false") headers.set("x-should-retry", "false");
+  const safe = new Response(response.status === 304 ? null : body, {
+    status: response.status, headers,
+  });
+  markResponseNonReplayable(safe);
+  return safe;
+}

package/src/server/responses/passthrough-delivery.ts

@@ -18,7 +18,8 @@ import {
   relayWithAbort,
 } from "../relay";
 import { isUsageDebugEnabled } from "../../usage/debug";
-import { isReplayRefusalResponse } from "../../lib/upstream-retry";
+import { isNonReplayableResponse, isReplayRefusalResponse } from "../../lib/upstream-retry";
+import { sanitizeNonReplayableUpstreamError } from "./non-replayable-error";
 import { teeWithBoundedInspection } from "../inspection-tee";
 import {
   codexForwardTerminalOutcomeRecorder,
@@ -543,6 +544,9 @@ export async function deliverPassthroughResponse(
     // through sanitizePassthroughHeaders) so a redirect to a dead host can never
     // masquerade as a pre-connection failure after the credential was seen.
     // The numeric outcome above already classified it neutral — no streak.
+    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse)) {
+      return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
+    }
     if (upstreamResponse.status >= 300 && upstreamResponse.status < 400) {
       return new Response(upstreamResponse.body, {
         status: upstreamResponse.status,

package/src/server/responses/passthrough-dispatch.ts

@@ -37,7 +37,7 @@ import {
   codexProbeLeaseId,
   codexProbeQuotaScope,
   codexTransientProbeGrant,
-  createCodexReserveDispatchGuard,
+  createCodexAuthDispatchGuard,
 } from "../../codex/auth-context";
 import {
   NamespaceToolCollisionError,
@@ -87,7 +87,6 @@ import {
   fetchWithHeaderTimeout,
   providerFetch,
   safeHostLabel,
-  storedPoolReplayDispatchNotifier,
 } from "./fetch-helpers";
 import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
 import { clientCancelledResponse } from "./core-errors";
@@ -816,7 +815,7 @@ export async function preparePassthroughExchange(
             throw new Error("Credential selection changed before pre-output stream recovery");
           }
           if (isCanonicalOpenAiForwardProvider(route.provider)) {
-            createCodexReserveDispatchGuard(
+            createCodexAuthDispatchGuard(
               admissionState.authCtx,
               options.codexAuthPolicy ?? config,
               route.modelId,
@@ -984,7 +983,7 @@ export async function preparePassthroughExchange(
               modelId: route.modelId,
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
             }),
             route.provider.authMode === "forward")
             // Every real attempt response — including an intermediate 5xx the
@@ -1089,7 +1088,7 @@ export async function preparePassthroughExchange(
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                  ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                  ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
               }),
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
@@ -1180,13 +1179,13 @@ export async function preparePassthroughExchange(
         // The replay-dispatched signal is what bounds the rest of this logical request, so it
         // has to describe a send that actually happened. fetchWithHeaderTimeout awaits pacing
         // admission BEFORE calling the executor, so signalling at the call site would spend the
-        // budget even when a rejected pacing wait means nothing reaches the network. Wrapping
-        // the executor moves the signal to the last moment before the send, where a throw from
-        // here on is a genuine transport attempt. The notifier is built once for the whole leg:
-        // it fires on the first dispatch, and a replacement is another send of the same replay
-        // rather than a second one to announce.
-        const oauthReplayExecutor = storedPoolReplayDispatchNotifier(
-          providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+        // budget even when a rejected pacing wait means nothing reaches the network. Signal
+        // only after the physical-dispatch policy check succeeds; a local refusal is no send.
+        // A replacement is another send of the same replay, rather than a second announcement.
+        const replayGuard = isCanonicalOpenAiForwardProvider(route.provider)
+          ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined;
+        let replayNotified = false;
+        const oauthReplayExecutor = providerFetch(route.provider, options.codexWsRuntimeIdentity, {
             httpOnly: canonicalBufferedJson,
             nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
               && responseEffects.plaintextV2AgentMessageToolNames.size === 0
@@ -1195,11 +1194,14 @@ export async function preparePassthroughExchange(
             providerName: route.providerName,
             modelId: route.modelId,
             onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
-            beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-              ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
-          }),
-          codex401ReplayKind === "stored" ? options.onStoredPool401ReplayDispatched : undefined,
-        );
+            beforeDispatch: headers => {
+              replayGuard?.(headers);
+              if (codex401ReplayKind === "stored" && !replayNotified) {
+                replayNotified = true;
+                options.onStoredPool401ReplayDispatched?.();
+              }
+            },
+          });
         // Routed through the shared helper so an ambiguous reset on THIS leg answers with the
         // same refusal every other leg gives. A bare fetch here rejected instead, and the
         // caller's transport-failure path turns a rejection into a client-retryable 502 --
@@ -1346,7 +1348,7 @@ export async function preparePassthroughExchange(
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                  ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                  ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
               }),
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
@@ -1481,7 +1483,7 @@ export async function preparePassthroughExchange(
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                  ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                  ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
               }),
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);

package/src/server/responses/request-prepare.ts

@@ -46,6 +46,7 @@ import {
   codexPoolAffinityKey,
   previewCodexPoolLineage,
   applyCodexAuthContextToProvider,
+  releaseCodexAuthContextProbeLease,
   hasCallerCodexBearer,
   requestOwnedMainPinState,
   requestOwnedMainCredentialIsLive,
@@ -58,6 +59,7 @@ import {
   previousResponseProviderState,
 } from "../../responses/state";
 import { formatErrorResponse } from "../../bridge";
+import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import type { OcxParsedRequest } from "../../types";
 import { buildToolBridgeMaps } from "./collaboration";
 import { parseRequest } from "../../responses/parser";
@@ -1352,7 +1354,15 @@ export async function prepareResponsesRequest(
     substituteMainCredential = finalAuth.substituteMainCredential;
   }
 
-  route.provider = applyCodexAuthContextToProvider(route.provider, admissionState.authCtx, route.codexAccountMode);
+  try {
+    route.provider = applyCodexAuthContextToProvider(route.provider, admissionState.authCtx, route.codexAccountMode);
+  } catch (error) {
+    releaseCodexAuthContextProbeLease(admissionState.authCtx);
+    if (options.abortSignal?.aborted || req.signal.aborted) return clientCancelledResponse();
+    const mapped = mapCodexAuthContextErrorToResponse(error, { now: Date.now(), accountSelector: route.codexAccountNamespace });
+    if (mapped) return mapped;
+    throw error;
+  }
   applyCodexAccountGatedWireNormalization(parsed, route, logCtx);
   try {
     recordPolicyPreparedDestination(policyScope, route.providerName, parsed._wireModelOverride ?? parsed.modelId);

package/src/server/responses/sidecar-execution.ts

@@ -510,6 +510,7 @@ export async function executeResponsesSidecars(
         transportState.bindKeyUsageFromBridge(usage);
       },
       recordSidecarOutcome: wsPlan.forwardSidecar?.recordOutcome,
+      beforeSidecarDispatch: wsPlan.forwardSidecar?.beforeDispatch,
       connectTimeoutMs: config.connectTimeoutMs ?? 200_000,
       routedModelStallTimeoutMs: wsPlan.routedModelStallTimeoutMs,
       stallTimeoutSec: wsPlan.stallTimeoutSec,

package/src/server/search.ts

@@ -11,6 +11,7 @@
  * paid backend than the one the operator named.
  */
 import { formatErrorResponse } from "../bridge";
+import { openAiSidecarCreditRefusal } from "../providers/openai-sidecar-credit";
 import {
   CodexAccountCooldownError,
   codexMainProfileDrainingResponse,
@@ -202,6 +203,7 @@ export async function handleSearch(
   const sidecarExit = sidecarEnter("search");
   let upstreamResponse: Response | undefined;
   try {
+    upstream.beforeDispatch?.();
     upstreamResponse = await fetch(url, {
       method: "POST",
       headers,
@@ -233,6 +235,8 @@ export async function handleSearch(
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_closed_request", "search request canceled by client");
     }
+    const policyRefusal = openAiSidecarCreditRefusal(err);
+    if (policyRefusal) return cooldownErrorResponse(policyRefusal, Date.now(), accountNamespace);
     if (linkedSignal.signal.aborted || (err instanceof Error && err.name === "TimeoutError")) {
       upstream.recordOutcome?.("timeout");
       return formatErrorResponse(504, "upstream_error", "search upstream timed out");

package/src/server/startup-health-cache.ts

@@ -1,7 +1,7 @@
 import { execFile } from "node:child_process";
 import { join } from "node:path";
 import { codexAutoStartEnabled } from "../config";
-import { deriveStartupHealth, type StartupHealth } from "../codex/autostart-health";
+import { deriveStartupHealth, startupHealthProbeBudgetMs, type StartupHealth } from "../codex/autostart-health";
 import { getCodexRoutingKind } from "../codex/inject";
 import { diagnoseCodexShim } from "../codex/shim";
 import { durableBunPath } from "../lib/bun-runtime";
@@ -11,7 +11,7 @@ import type { OcxConfig } from "../types";
 import { truncateRetainedUtf8 } from "../lib/admission";
 
 const CACHE_TTL_MS = 30_000;
-const PROBE_TIMEOUT_MS = probeTimeoutMs();
+const PROBE_TIMEOUT_MS = startupHealthProbeBudgetMs();
 const INITIAL_PROBE_WAIT_MS = PROBE_TIMEOUT_MS + 500;
 const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 
@@ -31,10 +31,6 @@ const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
  * bound in both cases: a wedged probe is still abandoned, and the caller still
  * receives the previous reading rather than waiting on it.
  */
-function probeTimeoutMs(): number {
-  return process.platform === "win32" ? 15_000 : 5_000;
-}
-
 /** The probe bound, so a test's own budget cannot fall below what it must wait for. */
 export function startupHealthProbeTimeoutMs(): number {
   return PROBE_TIMEOUT_MS;

package/src/vision/describe.ts

@@ -8,6 +8,7 @@ import { applyUpstreamRecoveryInit, fetchWithResetRetry } from "../lib/upstream-
 import { parseSidecarSSE } from "../web-search/parse";
 import type { SidecarOutcomeRecorder } from "../web-search/executor";
 import { NATIVE_RESERVE_MODEL } from "../codex/catalog/native-models";
+import { openAiSidecarCreditRefusal } from "../providers/openai-sidecar-credit";
 
 export interface VisionSettings {
   model: string;
@@ -60,6 +61,7 @@ export async function describeImage(
   settings: VisionSettings,
   abortSignal?: AbortSignal,
   recordOutcome?: SidecarOutcomeRecorder,
+  beforeDispatch?: () => void,
 ): Promise<DescribeOutcome> {
   if (settings.reserveCompatibility && settings.model === NATIVE_RESERVE_MODEL) {
     return { text: "", error: "Luna Reserve compatibility is only available as a conversation model, not a vision helper. Choose another vision helper model." };
@@ -98,16 +100,19 @@ export async function describeImage(
     const res = await fetchWithResetRetry(
       // The replay needs `keepalive: false` to abandon the half-closed pooled socket; Bun has
       // ignored a bare `Connection: close` (oven-sh/bun#20492).
-      recovery => fetch(`${forwardProvider.baseUrl}/responses`, applyUpstreamRecoveryInit({
-        method: "POST",
-        headers,
-        body: JSON.stringify(body),
-        signal: linkedSignal.signal,
-        // Credential-bearing: do not follow a cross-origin 3xx. Bun strips `Authorization`
-        // across origins but forwards nonstandard headers such as `chatgpt-account-id`,
-        // `session_id`, and `x-codex-turn-metadata` to the redirect target.
-        redirect: "manual",
-      }, recovery)),
+      recovery => {
+        beforeDispatch?.();
+        return fetch(`${forwardProvider.baseUrl}/responses`, applyUpstreamRecoveryInit({
+          method: "POST",
+          headers,
+          body: JSON.stringify(body),
+          signal: linkedSignal.signal,
+          // Credential-bearing: do not follow a cross-origin 3xx. Bun strips `Authorization`
+          // across origins but forwards nonstandard headers such as `chatgpt-account-id`,
+          // `session_id`, and `x-codex-turn-metadata` to the redirect target.
+          redirect: "manual",
+        }, recovery));
+      },
       { replaySafe: true, abortSignal: linkedSignal.signal, label: "vision-sidecar" },
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
@@ -129,6 +134,8 @@ export async function describeImage(
       detachBodyGuard();
     }
   } catch (e) {
+    const policyRefusal = openAiSidecarCreditRefusal(e);
+    if (policyRefusal) return { text: "", error: policyRefusal.message };
     const kind = e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error";
     const callerAborted = abortSignal?.aborted === true
       && linkedSignal.signal.aborted

package/src/vision/index.ts

@@ -269,6 +269,7 @@ async function executeDescription(
     plan.settings,
     abortSignal,
     recordSidecarOutcome,
+    plan.forwardSidecar.beforeDispatch,
   );
 }