@bitkyc08/opencodex 2.78.0 → 2.80.0

package/src/server/responses/passthrough-delivery.ts

@@ -18,7 +18,8 @@ import {
   relayWithAbort,
 } from "../relay";
 import { isUsageDebugEnabled } from "../../usage/debug";
-import { isReplayRefusalResponse } from "../../lib/upstream-retry";
+import { isNonReplayableResponse, isReplayRefusalResponse } from "../../lib/upstream-retry";
+import { sanitizeNonReplayableUpstreamError } from "./non-replayable-error";
 import { teeWithBoundedInspection } from "../inspection-tee";
 import {
   codexForwardTerminalOutcomeRecorder,
@@ -543,6 +544,9 @@ export async function deliverPassthroughResponse(
     // through sanitizePassthroughHeaders) so a redirect to a dead host can never
     // masquerade as a pre-connection failure after the credential was seen.
     // The numeric outcome above already classified it neutral — no streak.
+    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse)) {
+      return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
+    }
     if (upstreamResponse.status >= 300 && upstreamResponse.status < 400) {
       return new Response(upstreamResponse.body, {
         status: upstreamResponse.status,

package/src/server/responses/passthrough-dispatch.ts

@@ -37,7 +37,7 @@ import {
   codexProbeLeaseId,
   codexProbeQuotaScope,
   codexTransientProbeGrant,
-  createCodexReserveDispatchGuard,
+  createCodexAuthDispatchGuard,
 } from "../../codex/auth-context";
 import {
   NamespaceToolCollisionError,
@@ -87,7 +87,6 @@ import {
   fetchWithHeaderTimeout,
   providerFetch,
   safeHostLabel,
-  storedPoolReplayDispatchNotifier,
 } from "./fetch-helpers";
 import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
 import { clientCancelledResponse } from "./core-errors";
@@ -816,7 +815,7 @@ export async function preparePassthroughExchange(
             throw new Error("Credential selection changed before pre-output stream recovery");
           }
           if (isCanonicalOpenAiForwardProvider(route.provider)) {
-            createCodexReserveDispatchGuard(
+            createCodexAuthDispatchGuard(
               admissionState.authCtx,
               options.codexAuthPolicy ?? config,
               route.modelId,
@@ -984,7 +983,7 @@ export async function preparePassthroughExchange(
               modelId: route.modelId,
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
             }),
             route.provider.authMode === "forward")
             // Every real attempt response — including an intermediate 5xx the
@@ -1089,7 +1088,7 @@ export async function preparePassthroughExchange(
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                  ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                  ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
               }),
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
@@ -1180,13 +1179,13 @@ export async function preparePassthroughExchange(
         // The replay-dispatched signal is what bounds the rest of this logical request, so it
         // has to describe a send that actually happened. fetchWithHeaderTimeout awaits pacing
         // admission BEFORE calling the executor, so signalling at the call site would spend the
-        // budget even when a rejected pacing wait means nothing reaches the network. Wrapping
-        // the executor moves the signal to the last moment before the send, where a throw from
-        // here on is a genuine transport attempt. The notifier is built once for the whole leg:
-        // it fires on the first dispatch, and a replacement is another send of the same replay
-        // rather than a second one to announce.
-        const oauthReplayExecutor = storedPoolReplayDispatchNotifier(
-          providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+        // budget even when a rejected pacing wait means nothing reaches the network. Signal
+        // only after the physical-dispatch policy check succeeds; a local refusal is no send.
+        // A replacement is another send of the same replay, rather than a second announcement.
+        const replayGuard = isCanonicalOpenAiForwardProvider(route.provider)
+          ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined;
+        let replayNotified = false;
+        const oauthReplayExecutor = providerFetch(route.provider, options.codexWsRuntimeIdentity, {
             httpOnly: canonicalBufferedJson,
             nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
               && responseEffects.plaintextV2AgentMessageToolNames.size === 0
@@ -1195,11 +1194,14 @@ export async function preparePassthroughExchange(
             providerName: route.providerName,
             modelId: route.modelId,
             onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
-            beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-              ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
-          }),
-          codex401ReplayKind === "stored" ? options.onStoredPool401ReplayDispatched : undefined,
-        );
+            beforeDispatch: headers => {
+              replayGuard?.(headers);
+              if (codex401ReplayKind === "stored" && !replayNotified) {
+                replayNotified = true;
+                options.onStoredPool401ReplayDispatched?.();
+              }
+            },
+          });
         // Routed through the shared helper so an ambiguous reset on THIS leg answers with the
         // same refusal every other leg gives. A bare fetch here rejected instead, and the
         // caller's transport-failure path turns a rejection into a client-retryable 502 --
@@ -1346,7 +1348,7 @@ export async function preparePassthroughExchange(
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                  ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                  ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
               }),
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
@@ -1481,7 +1483,7 @@ export async function preparePassthroughExchange(
                 modelId: route.modelId,
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
-                  ? createCodexReserveDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+                  ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
               }),
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);

package/src/server/responses/request-prepare.ts

@@ -46,6 +46,7 @@ import {
   codexPoolAffinityKey,
   previewCodexPoolLineage,
   applyCodexAuthContextToProvider,
+  releaseCodexAuthContextProbeLease,
   hasCallerCodexBearer,
   requestOwnedMainPinState,
   requestOwnedMainCredentialIsLive,
@@ -58,6 +59,7 @@ import {
   previousResponseProviderState,
 } from "../../responses/state";
 import { formatErrorResponse } from "../../bridge";
+import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import type { OcxParsedRequest } from "../../types";
 import { buildToolBridgeMaps } from "./collaboration";
 import { parseRequest } from "../../responses/parser";
@@ -1352,7 +1354,15 @@ export async function prepareResponsesRequest(
     substituteMainCredential = finalAuth.substituteMainCredential;
   }
 
-  route.provider = applyCodexAuthContextToProvider(route.provider, admissionState.authCtx, route.codexAccountMode);
+  try {
+    route.provider = applyCodexAuthContextToProvider(route.provider, admissionState.authCtx, route.codexAccountMode);
+  } catch (error) {
+    releaseCodexAuthContextProbeLease(admissionState.authCtx);
+    if (options.abortSignal?.aborted || req.signal.aborted) return clientCancelledResponse();
+    const mapped = mapCodexAuthContextErrorToResponse(error, { now: Date.now(), accountSelector: route.codexAccountNamespace });
+    if (mapped) return mapped;
+    throw error;
+  }
   applyCodexAccountGatedWireNormalization(parsed, route, logCtx);
   try {
     recordPolicyPreparedDestination(policyScope, route.providerName, parsed._wireModelOverride ?? parsed.modelId);

package/src/server/responses/sidecar-execution.ts

@@ -510,6 +510,7 @@ export async function executeResponsesSidecars(
         transportState.bindKeyUsageFromBridge(usage);
       },
       recordSidecarOutcome: wsPlan.forwardSidecar?.recordOutcome,
+      beforeSidecarDispatch: wsPlan.forwardSidecar?.beforeDispatch,
       connectTimeoutMs: config.connectTimeoutMs ?? 200_000,
       routedModelStallTimeoutMs: wsPlan.routedModelStallTimeoutMs,
       stallTimeoutSec: wsPlan.stallTimeoutSec,

package/src/server/search.ts

@@ -11,6 +11,7 @@
  * paid backend than the one the operator named.
  */
 import { formatErrorResponse } from "../bridge";
+import { openAiSidecarCreditRefusal } from "../providers/openai-sidecar-credit";
 import {
   CodexAccountCooldownError,
   codexMainProfileDrainingResponse,
@@ -202,6 +203,7 @@ export async function handleSearch(
   const sidecarExit = sidecarEnter("search");
   let upstreamResponse: Response | undefined;
   try {
+    upstream.beforeDispatch?.();
     upstreamResponse = await fetch(url, {
       method: "POST",
       headers,
@@ -233,6 +235,8 @@ export async function handleSearch(
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_closed_request", "search request canceled by client");
     }
+    const policyRefusal = openAiSidecarCreditRefusal(err);
+    if (policyRefusal) return cooldownErrorResponse(policyRefusal, Date.now(), accountNamespace);
     if (linkedSignal.signal.aborted || (err instanceof Error && err.name === "TimeoutError")) {
       upstream.recordOutcome?.("timeout");
       return formatErrorResponse(504, "upstream_error", "search upstream timed out");

package/src/server/startup-health-cache.ts

@@ -1,7 +1,7 @@
 import { execFile } from "node:child_process";
 import { join } from "node:path";
 import { codexAutoStartEnabled } from "../config";
-import { deriveStartupHealth, type StartupHealth } from "../codex/autostart-health";
+import { deriveStartupHealth, startupHealthProbeBudgetMs, type StartupHealth } from "../codex/autostart-health";
 import { getCodexRoutingKind } from "../codex/inject";
 import { diagnoseCodexShim } from "../codex/shim";
 import { durableBunPath } from "../lib/bun-runtime";
@@ -11,7 +11,7 @@ import type { OcxConfig } from "../types";
 import { truncateRetainedUtf8 } from "../lib/admission";
 
 const CACHE_TTL_MS = 30_000;
-const PROBE_TIMEOUT_MS = probeTimeoutMs();
+const PROBE_TIMEOUT_MS = startupHealthProbeBudgetMs();
 const INITIAL_PROBE_WAIT_MS = PROBE_TIMEOUT_MS + 500;
 const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 
@@ -31,10 +31,6 @@ const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
  * bound in both cases: a wedged probe is still abandoned, and the caller still
  * receives the previous reading rather than waiting on it.
  */
-function probeTimeoutMs(): number {
-  return process.platform === "win32" ? 15_000 : 5_000;
-}
-
 /** The probe bound, so a test's own budget cannot fall below what it must wait for. */
 export function startupHealthProbeTimeoutMs(): number {
   return PROBE_TIMEOUT_MS;

package/src/service/desktop-startup.ts

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
-import { accessSync, constants, readFileSync, realpathSync } from "node:fs";
+import { accessSync, constants, readFileSync, readlinkSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { readPid } from "../config/process-state";
 import { resolveServiceOwnership, sameServiceOwnershipSubject, type ServiceOwnershipResolution } from "./state";
 
@@ -29,11 +29,28 @@ interface DesktopStartupDeps {
   ownership?: () => ServiceOwnershipResolution;
   readPid?: () => number | null;
   run?: typeof run;
+  env?: NodeJS.ProcessEnv;
+  proc?: ProcReader;
 }
 
+/** Linux process identity from procfs: executable target and parent pid. */
+interface ProcReader {
+  exe(pid: number): string;
+  parent(pid: number): number;
+}
+const procfs: ProcReader = {
+  exe: pid => readlinkSync(`/proc/${pid}/exe`),
+  // comm may contain spaces or parentheses, so fields are counted after the last ')'.
+  parent: pid => {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    return Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+  },
+};
+
 /** Cheap ownership-only snapshot: no launchd/process probes on the server request path. */
 export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
-  if ((deps.platform ?? process.platform) !== "darwin") return undefined;
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "darwin" && platform !== "linux") return undefined;
   const owner = (deps.ownership ?? resolveServiceOwnership)();
   return owner.kind === "owned" && owner.ownership.owner === "desktop"
     ? deriveDesktopStartup({ owned: true, loginEnabled: false, running: false }) : undefined;
@@ -91,3 +108,83 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
     return deriveDesktopStartup({ ...facts, running: false });
   }
 }
+
+/** HOME-based autostart entry written by the desktop app's login item (`tauri-plugin-autostart`). */
+function linuxLoginApp(entry: string): string | null {
+  const fields = new Map<string, string>();
+  let section = "";
+  for (const raw of entry.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    if (line.startsWith("[")) { section = line; continue; }
+    const at = line.indexOf("=");
+    if (section === "[Desktop Entry]" && at > 0 && !fields.has(line.slice(0, at).trim())) {
+      fields.set(line.slice(0, at).trim(), line.slice(at + 1).trim());
+    }
+  }
+  if (fields.get("Type") !== "Application" || fields.get("Hidden") === "true"
+    || fields.get("X-GNOME-Autostart-enabled") === "false"
+    || ["OnlyShowIn", "NotShowIn", "TryExec"].some(key => fields.has(key))) return null;
+  // Credit only the backend's simple Exec form; desktop quoting/escaping/field codes are unsupported.
+  const app = /^([^\s"'\\%`><~|&;$*?#()]+) --autostart$/.exec(fields.get("Exec") ?? "")?.[1];
+  return app && isAbsolute(app) && basename(app) === "opencodex-desktop" ? app : null;
+}
+
+/** Read-only Linux desktop ownership, HOME login entry and live parent/child checks via procfs. */
+export function diagnoseLinuxDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  if ((deps.platform ?? process.platform) !== "linux") return undefined;
+  const ownership = deps.ownership ?? resolveServiceOwnership;
+  const owner = ownership();
+  if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
+  const facts = { owned: true, loginEnabled: false, running: false };
+  const proc = deps.proc ?? procfs;
+  const pidReader = deps.readPid ?? readPid;
+  try {
+    const env = deps.env ?? process.env;
+    const home = deps.home ?? homedir();
+    const configured = env.XDG_CONFIG_HOME;
+    const config = configured && isAbsolute(configured) ? configured : join(home, ".config");
+    // auto-launch 0.5.0 writes autostart under HOME; Tauri app_config_dir uses XDG for install-id.
+    // A relocated XDG_CONFIG_HOME puts that entry outside the session's autostart search path.
+    if (resolve(config) !== resolve(home, ".config")) return deriveDesktopStartup(facts);
+    const capture = () => {
+      const id = readFileSync(join(config, "com.opencodex.desktop", "install-id"), "utf8");
+      if (id.trim() !== owner.ownership.installId) return null;
+      const entry = readFileSync(join(home, ".config", "autostart", "OpenCodex.desktop"), "utf8");
+      const login = linuxLoginApp(entry);
+      if (!login) return null;
+      const app = realpathSync(login);
+      if (basename(app) !== "opencodex-desktop") return null;
+      const proxy = realpathSync(join(dirname(app), "ocx"));
+      if (dirname(proxy) !== dirname(app) || basename(proxy) !== "ocx") return null;
+      accessSync(app, constants.X_OK);
+      accessSync(proxy, constants.X_OK);
+      const pid = pidReader();
+      const parent = pid !== null ? proc.parent(pid) : null;
+      const child = pid !== null ? realpathSync(proc.exe(pid)) : null;
+      const parentApp = parent !== null && parent > 1 ? realpathSync(proc.exe(parent)) : null;
+      const running = pid !== null && child === proxy && parentApp === app && pidReader() === pid;
+      const currentOwner = ownership();
+      if (currentOwner.kind === "unknown" || !sameServiceOwnershipSubject(owner, currentOwner)) return null;
+      return { id, entry, login, app, proxy, pid, parent, child, parentApp, running };
+    };
+    const first = capture();
+    if (!first) return deriveDesktopStartup(facts);
+    const final = capture();
+    // Re-read the entire evidence chain, including files, targets and the exact parent PID.
+    // A changed or unreadable snapshot cannot retain protection from the first read.
+    if (final && JSON.stringify(first) === JSON.stringify(final)) {
+      facts.loginEnabled = true;
+      facts.running = final.running;
+    }
+    return deriveDesktopStartup(facts);
+  } catch {
+    // Unreadable login or procfs evidence never grants protection or releases the claim.
+    return deriveDesktopStartup({ ...facts, running: false });
+  }
+}
+
+/** Platform dispatch for the full (probing) desktop startup diagnostic. */
+export function diagnoseDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  return (deps.platform ?? process.platform) === "linux" ? diagnoseLinuxDesktopStartup(deps) : diagnoseMacDesktopStartup(deps);
+}

package/src/vision/describe.ts

@@ -8,6 +8,7 @@ import { applyUpstreamRecoveryInit, fetchWithResetRetry } from "../lib/upstream-
 import { parseSidecarSSE } from "../web-search/parse";
 import type { SidecarOutcomeRecorder } from "../web-search/executor";
 import { NATIVE_RESERVE_MODEL } from "../codex/catalog/native-models";
+import { openAiSidecarCreditRefusal } from "../providers/openai-sidecar-credit";
 
 export interface VisionSettings {
   model: string;
@@ -60,6 +61,7 @@ export async function describeImage(
   settings: VisionSettings,
   abortSignal?: AbortSignal,
   recordOutcome?: SidecarOutcomeRecorder,
+  beforeDispatch?: () => void,
 ): Promise<DescribeOutcome> {
   if (settings.reserveCompatibility && settings.model === NATIVE_RESERVE_MODEL) {
     return { text: "", error: "Luna Reserve compatibility is only available as a conversation model, not a vision helper. Choose another vision helper model." };
@@ -98,16 +100,19 @@ export async function describeImage(
     const res = await fetchWithResetRetry(
       // The replay needs `keepalive: false` to abandon the half-closed pooled socket; Bun has
       // ignored a bare `Connection: close` (oven-sh/bun#20492).
-      recovery => fetch(`${forwardProvider.baseUrl}/responses`, applyUpstreamRecoveryInit({
-        method: "POST",
-        headers,
-        body: JSON.stringify(body),
-        signal: linkedSignal.signal,
-        // Credential-bearing: do not follow a cross-origin 3xx. Bun strips `Authorization`
-        // across origins but forwards nonstandard headers such as `chatgpt-account-id`,
-        // `session_id`, and `x-codex-turn-metadata` to the redirect target.
-        redirect: "manual",
-      }, recovery)),
+      recovery => {
+        beforeDispatch?.();
+        return fetch(`${forwardProvider.baseUrl}/responses`, applyUpstreamRecoveryInit({
+          method: "POST",
+          headers,
+          body: JSON.stringify(body),
+          signal: linkedSignal.signal,
+          // Credential-bearing: do not follow a cross-origin 3xx. Bun strips `Authorization`
+          // across origins but forwards nonstandard headers such as `chatgpt-account-id`,
+          // `session_id`, and `x-codex-turn-metadata` to the redirect target.
+          redirect: "manual",
+        }, recovery));
+      },
       { replaySafe: true, abortSignal: linkedSignal.signal, label: "vision-sidecar" },
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
@@ -129,6 +134,8 @@ export async function describeImage(
       detachBodyGuard();
     }
   } catch (e) {
+    const policyRefusal = openAiSidecarCreditRefusal(e);
+    if (policyRefusal) return { text: "", error: policyRefusal.message };
     const kind = e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error";
     const callerAborted = abortSignal?.aborted === true
       && linkedSignal.signal.aborted

package/src/vision/index.ts

@@ -269,6 +269,7 @@ async function executeDescription(
     plan.settings,
     abortSignal,
     recordSidecarOutcome,
+    plan.forwardSidecar.beforeDispatch,
   );
 }
 

package/src/web-search/executor.ts

@@ -15,6 +15,7 @@ import { withUpstreamHttpVersion } from "../lib/upstream-http-version";
 import { parseSidecarSSE, type WebSearchResult } from "./parse";
 import type { CodexUpstreamOutcome } from "../codex/routing";
 import { NATIVE_RESERVE_MODEL } from "../codex/catalog/native-models";
+import { openAiSidecarCreditRefusal } from "../providers/openai-sidecar-credit";
 
 export interface SidecarSettings {
   model: string;
@@ -78,6 +79,7 @@ export async function runWebSearch(
   settings: SidecarSettings,
   abortSignal?: AbortSignal,
   recordOutcome?: SidecarOutcomeRecorder,
+  beforeDispatch?: () => void,
 ): Promise<SidecarOutcome> {
   if (settings.reserveCompatibility && settings.model === NATIVE_RESERVE_MODEL) {
     return { text: "", sources: [], error: "Luna Reserve compatibility is only available as a conversation model, not a search helper. Choose another search helper model." };
@@ -115,16 +117,19 @@ export async function runWebSearch(
       // defined init, and withUpstreamHttpVersion spreads the result, so `protocol` and the
       // recovery fields (`connection: close` + Bun's transport-level `keepalive: false`) survive
       // together. The reverse order needs a `?? init` fallback to type-check at all.
-      recovery => fetch(url, withUpstreamHttpVersion(url, applyUpstreamRecoveryInit({
-        method: "POST",
-        headers,
-        body: JSON.stringify(body),
-        signal: linkedSignal.signal,
-        // Credential-bearing: do not follow a cross-origin 3xx. Bun strips `Authorization`
-        // across origins but forwards nonstandard headers such as `chatgpt-account-id`,
-        // `session_id`, and `x-codex-turn-metadata` to the redirect target.
-        redirect: "manual",
-      }, recovery), forwardProvider)),
+      recovery => {
+        beforeDispatch?.();
+        return fetch(url, withUpstreamHttpVersion(url, applyUpstreamRecoveryInit({
+          method: "POST",
+          headers,
+          body: JSON.stringify(body),
+          signal: linkedSignal.signal,
+          // Credential-bearing: do not follow a cross-origin 3xx. Bun strips `Authorization`
+          // across origins but forwards nonstandard headers such as `chatgpt-account-id`,
+          // `session_id`, and `x-codex-turn-metadata` to the redirect target.
+          redirect: "manual",
+        }, recovery), forwardProvider));
+      },
       {
         replaySafe: true,
         abortSignal: linkedSignal.signal,
@@ -180,6 +185,8 @@ export async function runWebSearch(
       detachBodyGuard();
     }
   } catch (e) {
+    const policyRefusal = openAiSidecarCreditRefusal(e);
+    if (policyRefusal) return { text: "", sources: [], error: policyRefusal.message };
     const kind = e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error";
     const callerAborted = abortSignal?.aborted === true
       && linkedSignal.signal.aborted