@bitkyc08/opencodex 2.78.0 → 2.80.0

package/src/server/live.ts

@@ -44,9 +44,14 @@ import { cancelBodyOnAbort, signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import { hardenSecretPath } from "../lib/windows-secret-acl";
 import type { OcxConfig } from "../types";
-import { resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
+import {
+  resolveCallerOwnedOpenAiSidecar,
+  resolveFirstUsableOpenAiSidecar,
+  selectOpenAiImagesProvider,
+} from "../providers/openai-sidecar";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "./auth-cors";
 import { admissionScopeDenial } from "./admission-model-scope";
+import { nativeLiveCalls } from "./live-native-calls";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
@@ -613,6 +618,12 @@ async function readRequestBodyCapped(req: Request, maxBytes: number): Promise<Ar
 export interface LiveScopeDestination {
   admission?: DataPlaneAdmission;
   model: string | undefined;
+  /**
+   * The call a sideband join attaches to. When this process did not create it (no entry in
+   * `nativeLiveCalls`), the client created it with its own ChatGPT login — a V3 `existingCall` —
+   * and the join is authenticated as that caller instead of a Pool-selected account.
+   */
+  callerOwnedCallId?: string;
 }
 
 /**
@@ -691,9 +702,14 @@ export async function resolveLiveRelay(
   let forwardAuthError: Response | undefined;
   if (candidates.forwardCandidates.length > 0) {
     try {
-      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
-        beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
-      });
+      const joinsForeignCall = destination?.callerOwnedCallId !== undefined
+        && !nativeLiveCalls.has(destination.callerOwnedCallId);
+      forward = (joinsForeignCall
+        ? resolveCallerOwnedOpenAiSidecar(candidates.forwardCandidates, req.headers, config)
+        : undefined)
+        ?? await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
+          beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+        });
       if (forward) {
         logCtx.provider = formatCodexProviderForLog(
           forward.providerName,
@@ -756,7 +772,8 @@ export async function resolveLiveRelay(
       providerBaseUrl: provider.baseUrl,
       usesBackendShape: isChatGptBackendBaseUrl(provider.baseUrl),
       keyed: false,
-      recordOutcome: status => forward.recordOutcome?.(status),
+      // A caller-owned or Direct credential selected no Pool account, so there is nothing to record.
+      ...(forward.recordOutcome ? { recordOutcome: (status: number | "timeout" | "connect_error") => forward.recordOutcome?.(status) } : {}),
     };
   }
   if (forwardAuthError) return forwardAuthError;
@@ -864,6 +881,11 @@ export async function handleLive(
       detachBodyGuard();
     }
     if (payload instanceof Response) return payload;
+    // Remember the calls this proxy created, so their joins keep the Pool account that created
+    // them while a join for any other call is authenticated as its caller (`resolveLiveRelay`).
+    if (upstreamResponse.status >= 200 && upstreamResponse.status < 300) {
+      nativeLiveCalls.record(upstreamResponse.headers.get("location"));
+    }
     const relayHeaders: Record<string, string> = {};
     for (const name of LIVE_RELAY_HEADERS) {
       const value = upstreamResponse.headers.get(name);
@@ -902,6 +924,7 @@ export async function resolveLiveSidebandUpgrade(
   const relay = await resolveLiveRelay(req, config, logCtx, turnAdmissionLease, {
     admission,
     model: liveSidebandModel(target),
+    ...("callId" in target ? { callerOwnedCallId: target.callId } : {}),
   });
   if (relay instanceof Response) return relay;
   return {

package/src/server/local-management-read-client.ts

@@ -25,6 +25,8 @@ export type LocalManagementReadResult =
 
 export interface LocalManagementReadDeps {
   fetchImpl?: typeof fetch;
+  /** Default transport seam; receives the caller deadline. */
+  directFetch?: typeof directLocalHttpFetch;
   readRuntime?: (pid: number) => RuntimePortState | null;
   createNonce?: () => string;
   now?: () => number;
@@ -84,18 +86,20 @@ export async function fetchBoundLocalManagementRead(
   if (!capability) return { kind: "unavailable", reason: "capability-unavailable" };
 
   try {
-    const response = await (deps.fetchImpl ?? directLocalHttpFetch)(
-      `http://${probeHostname(target.hostname)}:${target.port}${path}`,
-      {
-        headers: {
-          [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
-          [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,
-          [LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER]: String(expiresAt),
-          [LOCAL_MANAGEMENT_CAPABILITY_HEADER]: capability,
-        },
-        signal: AbortSignal.timeout(deps.timeoutMs ?? 4_000),
+    const timeoutMs = deps.timeoutMs ?? 4_000;
+    const url = `http://${probeHostname(target.hostname)}:${target.port}${path}`;
+    const init: RequestInit = {
+      headers: {
+        [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
+        [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,
+        [LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER]: String(expiresAt),
+        [LOCAL_MANAGEMENT_CAPABILITY_HEADER]: capability,
       },
-    );
+      signal: AbortSignal.timeout(timeoutMs),
+    };
+    const response = deps.fetchImpl
+      ? await deps.fetchImpl(url, init)
+      : await (deps.directFetch ?? directLocalHttpFetch)(url, init, { timeoutMs });
     if (deps.requireResponseProof && !verifyLocalAttestationProof(
       runtime.attestationSecret, nonce, target.pid, target.port, response.headers.get(LOCAL_ATTESTATION_PROOF_HEADER),
     )) {

package/src/server/management/oauth-account-routes.ts

@@ -1164,6 +1164,21 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     }, 200, req, config);
   }
 
+  if (url.pathname === "/api/keys/reveal" && req.method === "POST") {
+    if (principal !== "gui-session") {
+      return jsonResponse({ error: "dashboard session required" }, 403, req, config);
+    }
+    const body = await readJsonBody(req);
+    if (!body || Object.keys(body).length !== 1 || typeof body.id !== "string" || !body.id) {
+      return jsonResponse({ error: "invalid body" }, 400, req, config);
+    }
+    const entry = config.apiKeys?.find(key => key.id === body.id);
+    if (!entry) return jsonResponse({ error: "key not found" }, 404, req, config);
+    const response = jsonResponse({ key: entry.key }, 200, req, config);
+    response.headers.set("Cache-Control", "no-store");
+    return response;
+  }
+
   if (url.pathname === "/api/keys/rotate" && req.method === "POST") {
     const body = await readJsonBody(req);
     if (!body || Object.keys(body).length !== 1 || typeof body.id !== "string" || !body.id) {

package/src/server/management/route-registry.ts

@@ -324,6 +324,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PATCH", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/keys/reveal", module: "server/management/oauth-account-routes", mutates: false, exempt: { reason: "session-only", why: "Revealing a data key requires the gui-session principal; the admin token is refused." } },
   { method: "POST", path: "/api/keys/rotate", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys/rotate/commit", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/oauth/accounts/clear-cooldown", module: "server/management/oauth-account-routes", mutates: true },

package/src/server/management/shared.ts

@@ -89,6 +89,11 @@ export type TokPerSecondResult =
   | { kind: "value"; value: number; estimated: boolean }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
+export type DecodeTimingBasis = "generation-window" | "legacy-post-visible-output";
+export type DecodeTokPerSecondResult =
+  | (Extract<TokPerSecondResult, { kind: "value" }> & { timingBasis: DecodeTimingBasis })
+  | Extract<TokPerSecondResult, { kind: "unavailable" }>;
+
 export type CostEstimateReason =
   | "usage_estimated"
   | "cache_detail_missing"
@@ -149,7 +154,7 @@ export const MIN_DECODE_WINDOW_MS = 1_000;
  */
 export function decodeTokPerSecondResult(
   entry: Pick<MetricSource, "durationMs" | "firstOutputMs" | "genStartMs" | "lastOutputMs" | "usageStatus" | "usage">,
-): TokPerSecondResult {
+): DecodeTokPerSecondResult {
   if (!entry.usage) return { kind: "unavailable", reason: "usage_missing" };
   if (entry.usageStatus === "unsupported") return { kind: "unavailable", reason: "usage_unsupported" };
   if (entry.usage.outputTokens <= 0) return { kind: "unavailable", reason: "output_missing" };
@@ -159,7 +164,8 @@ export function decodeTokPerSecondResult(
     if (generationMs <= 0) return { kind: "unavailable", reason: "invalid_duration" };
     if (generationMs < MIN_DECODE_WINDOW_MS) return { kind: "unavailable", reason: "decode_window_too_short" };
     const value = tokensPerSecond(entry.usage.outputTokens, generationMs);
-    return value === null ? { kind: "unavailable", reason: "invalid_duration" } : { kind: "value", value, estimated: true };
+    return value === null ? { kind: "unavailable", reason: "invalid_duration" }
+      : { kind: "value", value, estimated: true, timingBasis: "generation-window" };
   }
   // A row that predates TTFT capture, or a non-streaming turn that never recorded one, has no
   // window to measure. That is a different fact from a bad duration, so it gets its own reason.
@@ -173,7 +179,7 @@ export function decodeTokPerSecondResult(
   if (windowMs < MIN_DECODE_WINDOW_MS) return { kind: "unavailable", reason: "decode_window_too_short" };
   const value = tokensPerSecond(entry.usage.outputTokens, windowMs);
   if (value === null) return { kind: "unavailable", reason: "invalid_duration" };
-  return { kind: "value", value, estimated: true };
+  return { kind: "value", value, estimated: true, timingBasis: "legacy-post-visible-output" };
 }
 
 export function unavailableCostReason(entry: MetricSource): MetricUnavailableReason {

package/src/server/messages-native-scope.ts

@@ -0,0 +1,60 @@
+import {
+  AdmissionModelDeniedError, routeAllowedByScope, UNNAMED_DESTINATION_MODEL, type AdmissionModelScope,
+} from "./admission-model-scope";
+
+type Rec = Record<string, unknown>;
+const isRec = (value: unknown): value is Rec => value !== null && typeof value === "object" && !Array.isArray(value);
+const isAdvisor = (tool: Rec): boolean => typeof tool.type === "string" && /^advisor_\d{8}$/.test(tool.type);
+
+/** Only executable declarations are policy inputs; schemas, arguments and results stay opaque. */
+export function nativeMessagesToolScopeDenial(
+  scope: AdmissionModelScope | undefined,
+  providerName: string,
+  requestedModel: string,
+  body: Readonly<Rec>,
+): AdmissionModelDeniedError | undefined {
+  if (!scope || scope.models.length === 0) return undefined;
+  const definitions = new Map<string, Rec[]>();
+  const withdrawn = new Set<string>();
+  const anonymous: Rec[] = [];
+  if (Array.isArray(body.tools)) for (const tool of body.tools) {
+    if (!isRec(tool)) continue;
+    if (typeof tool.name !== "string") { anonymous.push(tool); continue; }
+    const declarations = definitions.get(tool.name) ?? [];
+    declarations.push(tool);
+    definitions.set(tool.name, declarations);
+  }
+  if (Array.isArray(body.messages)) for (const message of body.messages) {
+    if (!isRec(message) || message.role !== "system" || !Array.isArray(message.content)) continue;
+    // Upstream rejects tool changes in turn-scoped messages; do not depend on that. An addition
+    // always counts, and only a permanent removal withdraws a declaration (fail closed).
+    const permanent = message.clear_at === undefined || message.clear_at === "never";
+    for (const block of message.content) {
+      if (!isRec(block) || !isRec(block.tool)) continue;
+      const tool = block.tool;
+      if (block.type === "tool_addition" && tool.type === "tool_definition" && isRec(tool.definition)) {
+        const definition = tool.definition;
+        if (typeof definition.name !== "string") { anonymous.push(definition); continue; }
+        // A temporary replacement keeps the declaration it shadows in scope as well.
+        // These arrays belong to this check, not to the caller's declarations.
+        const declarations = permanent ? [] : definitions.get(definition.name) ?? [];
+        declarations.push(definition);
+        definitions.set(definition.name, declarations);
+        withdrawn.delete(definition.name);
+      } else if (tool.type === "tool_reference" && typeof tool.name === "string") {
+        if (block.type === "tool_removal" && permanent) withdrawn.add(tool.name);
+        if (block.type === "tool_addition") withdrawn.delete(tool.name);
+      }
+    }
+  }
+  // Deferred definitions can still be loaded by tool search in the current turn.
+  const active = [...anonymous, ...[...definitions].flatMap(([name, tools]) => withdrawn.has(name) ? [] : tools)];
+  for (const tool of active) {
+    if (!isAdvisor(tool)) continue;
+    const modelId = typeof tool.model === "string" && tool.model.trim() ? tool.model : undefined;
+    if (modelId === undefined || !routeAllowedByScope(scope, { providerName, modelId })) {
+      return new AdmissionModelDeniedError(requestedModel, { providerName, modelId: modelId ?? UNNAMED_DESTINATION_MODEL });
+    }
+  }
+  return undefined;
+}

package/src/server/messages-native.ts

@@ -110,6 +110,8 @@ import { linkAbortSignal } from "./responses/core-lifetime";
 import { attachRequestSpendTracker } from "./responses/request-spend";
 import { workflowRefusalResponse } from "./workflow-refusal";
 import { sseFieldValue } from "../lib/sse-decoder";
+import { admissionModelDeniedResponse, type AdmissionModelScope } from "./admission-model-scope";
+import { nativeMessagesToolScopeDenial } from "./messages-native-scope";
 
 export {
   isNativeMessagesRouteEligible,
@@ -159,6 +161,7 @@ export interface HandleNativeMessagesOptions {
   callerAnthropicBeta?: string | null;
   clientIdentity?: AnthropicClientIdentity;
   sessionKey?: string | null;
+  modelScope?: AdmissionModelScope;
 }
 
 type FinishLog = (status: number, message?: string, meta?: FinalRequestLogMeta) => void;
@@ -350,6 +353,12 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     return null;
   };
 
+  const toolScopeDenial = nativeMessagesToolScopeDenial(options.modelScope, route.providerName, requestedModel, body);
+  if (toolScopeDenial) {
+    finishLog(403, toolScopeDenial.message);
+    return admissionModelDeniedResponse(toolScopeDenial);
+  }
+
   try {
     await prepareNativeBody(body, req.signal);
   } catch (error) {

package/src/server/responses/adapter-dispatch.ts

@@ -4,6 +4,7 @@ import { authorizeResendForRecovery } from "../../lib/request-resend-gate";
 import { ambiguousResendAllowanceFor, selfContainedResponsesBody } from "./reset-replay";
 import { transientSendCapFor } from "./request-send-budget";
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { sanitizeNonReplayableUpstreamError } from "./non-replayable-error";
 import { isLocalUpstream } from "../../lib/local-upstream";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
@@ -100,6 +101,9 @@ import {
 } from "../../lib/errors";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { cancelBodyOnAbort } from "../../lib/abort";
+import { createCodexAuthDispatchGuard, releaseCodexAuthContextProbeLease, unwrapUpstreamRetryEvidenceError } from "../../codex/auth-context";
+import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import { chargeWorkflowSends } from "../../lib/workflow-budget";
 import { isAntigravityValidationRefusal } from "./antigravity-validation-refusal";
 
@@ -344,6 +348,8 @@ export async function prepareAdapterExchange(
             dispatchOverride: oauthDispatch(builtInitialRequest),
             providerName: route.providerName,
             modelId: route.modelId,
+            beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+              ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
           }),
         }));
     } else {
@@ -384,6 +390,8 @@ export async function prepareAdapterExchange(
               dispatchOverride: oauthDispatch(builtInitialRequest),
               providerName: route.providerName,
               modelId: route.modelId,
+              beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+                ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
             }));
         },
         {
@@ -406,6 +414,13 @@ export async function prepareAdapterExchange(
     upstream.abort();
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const refusal = err instanceof UpstreamRetryEvidenceError ? err.cause : err;
+    const codexRefusal = mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
+      now: Date.now(), accountSelector: route.codexAccountNamespace,
+    });
+    if (codexRefusal) {
+      releaseCodexAuthContextProbeLease(admissionState.authCtx);
+      return codexRefusal;
+    }
     // A pause committed during pacing is local admission policy, not a failed upstream.
     if (refusal instanceof OAuthAccountPausedError) {
       return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(refusal));
@@ -550,6 +565,8 @@ export async function prepareAdapterExchange(
                   dispatchOverride: oauthDispatch(retryRequest),
                   providerName: route.providerName,
                   modelId: route.modelId,
+                  beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+                    ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
                 }),
               });
             });
@@ -601,6 +618,8 @@ export async function prepareAdapterExchange(
                     dispatchOverride: oauthDispatch(retryRequest),
                     providerName: route.providerName,
                     modelId: route.modelId,
+                    beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
+                      ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
                   }));
               },
               {
@@ -624,6 +643,15 @@ export async function prepareAdapterExchange(
           retryRequest.releaseBodyObservation?.();
         }
       } catch (err) {
+        const codexRefusal = !options.abortSignal?.aborted && mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
+          now: Date.now(), accountSelector: route.codexAccountNamespace,
+        });
+        if (codexRefusal) {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          releaseCodexAuthContextProbeLease(admissionState.authCtx);
+          return { failed: codexRefusal };
+        }
         if (preserveFailureResponse && !replacementAdmitted && !options.abortSignal?.aborted)
           return { failed: preserveFailureResponse };
         cleanupUpstreamAbort();
@@ -704,8 +732,9 @@ export async function prepareAdapterExchange(
       // Preserve the terminal verdict through adapter and combo error formatting.
       // This also covers a reset reached by a 401/429/413 recovery refetch.
       if (isNonReplayableResponse(upstreamResponse)) {
-        cleanupUpstreamAbort();
-        return upstreamResponse;
+        try {
+          return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
+        } finally { cleanupUpstreamAbort(); }
       }
      if (
        upstreamResponse.status === 401

package/src/server/responses/combo-requested-effort.ts

@@ -0,0 +1,14 @@
+/** Restore the caller label while retaining JEV's forced effort and later child transitions. */
+export function comboRequestedEffortLabel(
+  originalRequestedEffort: string | undefined,
+  childRequestedEffort: string | undefined,
+  forcedEffort?: string | null,
+): string | undefined {
+  if (originalRequestedEffort === undefined) return childRequestedEffort;
+  const transitionIndex = childRequestedEffort?.indexOf("->") ?? -1;
+  const laterTransitions = transitionIndex >= 0 ? childRequestedEffort!.slice(transitionIndex) : "";
+  const forcedTransition = forcedEffort != null && forcedEffort !== originalRequestedEffort
+    ? `->${forcedEffort}`
+    : "";
+  return `${originalRequestedEffort}${forcedTransition}${laterTransitions}`;
+}

package/src/server/responses/compact.ts

@@ -53,7 +53,7 @@ import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/
 import {
   applyCodexAuthContextToProvider,
   callerCodexWorkspaceAccountId,
-  createCodexReserveDispatchGuard,
+  createCodexAuthDispatchGuard,
   unwrapUpstreamRetryEvidenceError,
   CodexMainProfileDrainingError,
   headersForCodexAuthContext,
@@ -182,6 +182,8 @@ import {
 import { hasResponsesItemIdRepair, relaySseWithResponsesItemIdRepair } from "../responses-item-id-repair";
 import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/catalog";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
+import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
+import { clientCancelledResponse } from "./core-errors";
 
 import {
   codexAccountGatedCanonicalWireModel,
@@ -435,6 +437,9 @@ async function refreshPoolCompactContext(args: {
       generation: refreshed.generation,
       poolQuotaWriter: capturePoolQuotaWriter(authCtx.accountId, refreshed),
     };
+    // See the core counterpart: the spread dropped the WeakMap-bound credit policy, so a hold
+    // or opt-out landing during the refresh await would go unchecked on the copy.
+    rebindPoolCreditPolicy(authCtx, refreshedAuthCtx);
     const refreshedProvider = applyCodexAuthContextToProvider(
       stripCodexRuntimeProviderFields(provider),
       refreshedAuthCtx,
@@ -463,6 +468,16 @@ async function refreshPoolCompactContext(args: {
     if (isTerminalCompactPoolRefreshFailure(error)) {
       return { ok: false, quarantine: true, response: reauthResponse() };
     }
+    if (req.signal.aborted) {
+      return { ok: false, quarantine: false, response: clientCancelledResponse() };
+    }
+    // See the core counterpart: a policy refusal raised after a successful refresh maps like
+    // the admission path — a reset-bound 429, never a 503 mislabeled as a refresh failure.
+    const policyResponse = mapCodexAuthContextErrorToResponse(error, {
+      now: Date.now(),
+      accountSelector: args.codexAccountNamespace,
+    });
+    if (policyResponse) return { ok: false, quarantine: false, response: policyResponse };
     return {
       ok: false,
       quarantine: false,
@@ -1042,7 +1057,7 @@ export async function handleResponsesCompact(
           providerName: route.providerName,
           modelId: route.modelId,
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
-            ? createCodexReserveDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
+            ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
         }),
         // Every credential-bearing forward send gets manual redirects, not only
         // pool sends: direct mode carries the caller's credential too (#914).

package/src/server/responses/core-auth.ts

@@ -41,6 +41,7 @@ import { markLocalRequestLogRefusal } from "../request-log";
 import { CODEX_POOL_REFRESH_INCOMPLETE_LOG_REASON } from "../../codex/pool-refresh-backoff";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import { forceRefreshMainAccountToken } from "../../codex/main-account";
+import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
 import { safeCallerSessionId } from "../caller-session-identity";
 
 /** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
@@ -200,6 +201,7 @@ export async function resolveResponsesCodexAuth(
   credentialDomainWasRewritten = false,
   retainAccountForUploadedFiles = false,
 ): Promise<ResponsesAuthResolution> {
+  let authCtx: CodexAuthContext | undefined;
   try {
     let authInputHeaders = codexRouteCredentialDomainHeaders(
       req,
@@ -260,7 +262,6 @@ export async function resolveResponsesCodexAuth(
     if (route.codexAccountMode === "direct" && !substituteMainCredential) {
       validateForwardAdmissionCredential(authInputHeaders, config);
     }
-    let authCtx: CodexAuthContext;
     if (route.codexAccountMode) {
       authCtx = await resolveCodexAuthContext(authInputHeaders, config, route.codexAccountMode, {
         admission: options.admission,
@@ -342,6 +343,7 @@ export async function resolveResponsesCodexAuth(
       substituteMainCredential,
     };
   } catch (err) {
+    releaseCodexAuthContextProbeLease(authCtx);
     if (options.abortSignal?.aborted || req.signal.aborted) {
       return { ok: false, response: clientCancelledResponse() };
     }
@@ -480,6 +482,9 @@ export async function refreshPoolForwardAuth(args: {
       generation: refreshed.generation,
       poolQuotaWriter: capturePoolQuotaWriter(authCtx.accountId, refreshed),
     };
+    // The spread dropped the WeakMap-bound credit policy: without the live binding a hold or
+    // opt-out landing during the refresh await would go unchecked on every no-override path.
+    rebindPoolCreditPolicy(authCtx, refreshedAuthCtx);
     const provider = applyCodexAuthContextToProvider(
       stripCodexRuntimeProviderFields(route.provider),
       refreshedAuthCtx,
@@ -502,6 +507,18 @@ export async function refreshPoolForwardAuth(args: {
         response: formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication"),
       };
     }
+    if (options.abortSignal?.aborted || req.signal.aborted) {
+      return { ok: false, quarantine: false, response: clientCancelledResponse() };
+    }
+    // The credential itself refreshed; a policy refusal raised afterwards (a credit hold or an
+    // opt-out that landed during the await) is not a refresh failure. Map it the same way the
+    // admission path does — a reset-bound 429, never a 503 telling the caller to sign in — and
+    // never quarantine a valid account for a policy refusal.
+    const policyResponse = mapCodexAuthContextErrorToResponse(error, {
+      accountSelector: route.codexAccountNamespace,
+      now: Date.now(),
+    });
+    if (policyResponse) return { ok: false, quarantine: false, response: policyResponse };
     return {
       ok: false,
       quarantine: false,

package/src/server/responses/core-codex-account.ts

@@ -54,7 +54,8 @@ import {
   headersForCodexAuthContext,
   applyCodexAuthContextToProvider,
   stripCodexRuntimeProviderFields,
-  createCodexReserveDispatchGuard,
+  createCodexAuthDispatchGuard,
+  CodexPoolAccountCreditsOffError,
 } from "../../codex/auth-context";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import { isRequestExecutionBudget } from "../../lib/request-execution-budget";
@@ -745,12 +746,21 @@ export async function retryCodexPoolOnAlternateAccount(
   // Only a combo reset-derived outcome is deferred. Retry-After, defaults, and
   // ordinary requests must block the first account before the alternate send.
   if (!deferFirstOutcome) recordFirstOutcome();
-  const retryHeaders = headersForCodexAuthContext(callerAuthHeaders, retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission);
-  const retryProvider = applyCodexAuthContextToProvider(
-    stripCodexRuntimeProviderFields(route.provider),
-    retryAuthCtx,
-    "pool",
-  );
+  let retryHeaders: Headers;
+  let retryProvider: ReturnType<typeof applyCodexAuthContextToProvider>;
+  try {
+    retryHeaders = headersForCodexAuthContext(callerAuthHeaders, retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission);
+    retryProvider = applyCodexAuthContextToProvider(stripCodexRuntimeProviderFields(route.provider), retryAuthCtx, "pool");
+  } catch (error) {
+    if (!(error instanceof CodexPoolAccountCreditsOffError)) throw error;
+    // Body/entitlement reads above can outlive credit consent. No alternate will send:
+    // release its reservation and probes, then let the owner map the policy refusal.
+    accountMovePermit?.release();
+    releaseCodexAuthContextProbeLease(firstAuthCtx);
+    releaseCodexAuthContextProbeLease(retryAuthCtx);
+    await firstResponse.body?.cancel().catch(() => undefined);
+    return { kind: "transport", error, authCtx: retryAuthCtx };
+  }
   const retryAdapter = resolveAdapter(
     resolveWireProtocolOverride(route.providerName, route.modelId, retryProvider, inboundWire, route.staticPolicy),
     config.cacheRetention,
@@ -889,7 +899,7 @@ export async function retryCodexPoolOnAlternateAccount(
             modelId: route.modelId,
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-              ? createCodexReserveDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+              ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
           }),
           // Credential-bearing forward send: never follow a redirect into a
           // dead-host rejection after the credential was seen (#914).

package/src/server/responses/core-combo.ts

@@ -106,6 +106,7 @@ import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
 import { settleOperatorReplacement } from "../../lib/upstream-retry";
 import { createComboProtocolLanes, dispatchNativeComboChild } from "./core-combo-native";
 import { createJevModelInvoker } from "./jev-model-invoke";
+import { comboRequestedEffortLabel } from "./combo-requested-effort";
 import { clientWireOf } from "../inference/client-wire";
 
 /**
@@ -656,13 +657,9 @@ export async function executeComboResponses(
     && isDeclaredReasoningEffort(originalRequestedEffortValue)
     ? originalRequestedEffortValue
     : undefined;
-  const restoreOriginalRequestedEffort = (childLog: RequestLogContext): void => {
+  const restoreOriginalRequestedEffort = (childLog: RequestLogContext, forcedEffort?: string | null): void => {
     if (originalRequestedEffort === undefined) return;
-    const normalizedRequestedEffort = childLog.requestedEffort;
-    const transitionIndex = normalizedRequestedEffort?.indexOf("->") ?? -1;
-    childLog.requestedEffort = transitionIndex >= 0
-      ? `${originalRequestedEffort}${normalizedRequestedEffort!.slice(transitionIndex)}`
-      : originalRequestedEffort;
+    childLog.requestedEffort = comboRequestedEffortLabel(originalRequestedEffort, childLog.requestedEffort, forcedEffort);
     recordAttemptRequestedEffort(childLog);
   };
 
@@ -907,7 +904,8 @@ export async function executeComboResponses(
         onNativePassthroughCancel: callbackGate.onCancel,
         onResponseComplete: callbackGate.onResponseComplete,
       });
-      restoreOriginalRequestedEffort(childLog);
+      // Native Chat rebuilds its own body and does not apply the initial JEV effort.
+      restoreOriginalRequestedEffort(childLog, nativeChild ? undefined : initialJevDecision?.effort);
     } catch (error) {
       callbackGate.discard();
       if (options.abortSignal?.aborted) {

package/src/server/responses/non-replayable-error.ts

@@ -0,0 +1,48 @@
+import { isNonReplayableResponse, isReplayRefusalResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
+import { clientCancelledResponse, readDisplaySafeErrorText } from "./core-errors";
+
+const UPSTREAM_ERROR_TYPES = new Set([
+  "invalid_request_error", "authentication_error", "permission_error", "not_found_error",
+  "rate_limit_error", "request_too_large", "overloaded_error", "api_error", "server_error", "insufficient_quota",
+]);
+const UPSTREAM_ERROR_CODES = new Set([
+  "context_length_exceeded", "rate_limit_exceeded", "insufficient_quota", "invalid_api_key",
+  "model_not_found", "invalid_prompt", "content_policy_violation", "server_error",
+  "unsupported_parameter", "invalid_value", "string_above_max_length",
+]);
+
+/** Client projection never grants another send or turns a real upstream error into our refusal. */
+export async function sanitizeNonReplayableUpstreamError(
+  response: Response,
+  signal: AbortSignal,
+): Promise<Response> {
+  if (response.ok || !isNonReplayableResponse(response) || isReplayRefusalResponse(response)) return response;
+  const text = await readDisplaySafeErrorText(response, signal, "");
+  if (signal.aborted) {
+    const cancelled = clientCancelledResponse();
+    markResponseNonReplayable(cancelled);
+    return cancelled;
+  }
+  let type = "upstream_error";
+  let code: string | undefined;
+  try {
+    const parsed = JSON.parse(text);
+    const upstreamType = parsed?.error?.type;
+    const upstreamCode = parsed?.error?.code;
+    if (typeof upstreamType === "string" && UPSTREAM_ERROR_TYPES.has(upstreamType)) type = upstreamType;
+    if (typeof upstreamCode === "string" && UPSTREAM_ERROR_CODES.has(upstreamCode)) code = upstreamCode;
+  } catch {
+    // Incomplete or non-JSON bodies retain the generic error type.
+  }
+  // Upstream text is not forwarded here: no bounded redaction can be proven complete against a client's decoders.
+  const body = JSON.stringify({ error: { type, ...(code === undefined ? {} : { code }),
+    message: `Provider error ${response.status}: upstream diagnostic withheld for a non-replayable failure`,
+  } });
+  const headers = new Headers({ "content-type": "application/json" });
+  if (response.headers.get("x-should-retry") === "false") headers.set("x-should-retry", "false");
+  const safe = new Response(response.status === 304 ? null : body, {
+    status: response.status, headers,
+  });
+  markResponseNonReplayable(safe);
+  return safe;
+}