@bitkyc08/opencodex 2.79.0 → 2.80.0

package/src/generated/compatibility-version.json

@@ -6,11 +6,11 @@
   "files": [
     {
       "path": "bun.lock",
-      "sha256": "c065612db20131683fd657dce98b6c51745ed9fadfeb56ea0c3edd823da39cc4"
+      "sha256": "7bceb5361a92a8401247dcf131a3e0a40fc2e2b1ededb3c6468e4d435c75fc8c"
     },
     {
       "path": "package.json",
-      "sha256": "90cabe2689a17d5376a3d50526cbe2a6b4f5a441dd829476770e14aacda15281"
+      "sha256": "a2b957b51f2de2693b6b6e6cfd57da30c2076dc7e8d9b4c17f467b4db79f2bcd"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -150,7 +150,7 @@
     },
     {
       "path": "src/adapters/cursor.ts",
-      "sha256": "a3f0a744b4760bbbe396dd603bf1cd1ee74e26c6eb50283e57fad244a610fe7c"
+      "sha256": "e34908e890bf1b6c34dcda0b0ef4665db1254904cd0213c76048816531af2faf"
     },
     {
       "path": "src/adapters/cursor/arg-codec.ts",
@@ -238,7 +238,7 @@
     },
     {
       "path": "src/adapters/cursor/live-transport.ts",
-      "sha256": "699f44189ff255403edcf770dff925f4711b40cfa3a198f2c220f503f55c5310"
+      "sha256": "7c58b4a37097012ebb840ac2dd3121b6964a61faf0c9dc6e92e18551f87f1326"
     },
     {
       "path": "src/adapters/cursor/mcp-config.ts",
@@ -262,7 +262,7 @@
     },
     {
       "path": "src/adapters/cursor/native-exec-fs.ts",
-      "sha256": "0982cbadbb8886f1c90f8ad9cd2fa1bb53ea09861f88d52a56da63d17efb54ea"
+      "sha256": "4a87ce4d504447de532cb55fbe997a2fb0f56fa7142548114ddafb6051d82533"
     },
     {
       "path": "src/adapters/cursor/native-exec-mcp.ts",
@@ -282,7 +282,7 @@
     },
     {
       "path": "src/adapters/cursor/native-exec.ts",
-      "sha256": "abbd8943857b348d1e4c0310fbebf99028db0ab08c042d13c6dca0cc429119ed"
+      "sha256": "f5c6e83e6e9554ab4a0de7817b8385bac716789f0d2372212b92a531f9026aeb"
     },
     {
       "path": "src/adapters/cursor/native-foreground-shell.ts",
@@ -298,11 +298,11 @@
     },
     {
       "path": "src/adapters/cursor/protobuf-request.ts",
-      "sha256": "f2d09cd8ac83d82e102fba1a8a82613bccd2cbc56b8c3b9dfc251f305ab8cf85"
+      "sha256": "f6796726488c0ccfc81a705c9d179945d02e54a52a111766935671b50631cab7"
     },
     {
       "path": "src/adapters/cursor/request-builder.ts",
-      "sha256": "5de11940153ba2ff83390d47b235e6aa009c363e344f58032893b1f5ddf73464"
+      "sha256": "f62c554ff41430331a639d6dbfde6df95cdae854635bbf4b0aa5557e7f2c3d5f"
     },
     {
       "path": "src/adapters/cursor/structured-output.ts",
@@ -318,15 +318,15 @@
     },
     {
       "path": "src/adapters/cursor/tool-definitions.ts",
-      "sha256": "3aa052f5b70fc54ae59f78ba23e87b8a7c8f1e83f6ed60a31e359a5bcd3baca0"
+      "sha256": "9a2aefcb82f7040f3581676fa6a8d63c9ca0352400dcf659cf3b664b63d489c0"
     },
     {
       "path": "src/adapters/cursor/tool-guidance.ts",
-      "sha256": "8fd5d06a5622cc049c227cff78a24f15d7b9f0152566804dd1346cace9b42b8d"
+      "sha256": "a4865e3854aadcd979229830c92dc15cc60ef355f574f727348a730d23ae97aa"
     },
     {
       "path": "src/adapters/cursor/tool-naming.ts",
-      "sha256": "47f7fb1de1e4fd06d2b29c0811f472cd3380dee0b633d646683dcaab5c959976"
+      "sha256": "be1d589e1b8f6e85f620d7f3e33651b5ca09b086a97a80add4f6878c1b69b47d"
     },
     {
       "path": "src/adapters/cursor/tool-result-normalize.ts",
@@ -336,6 +336,10 @@
       "path": "src/adapters/cursor/tool-schemas.ts",
       "sha256": "e30dea6deed9ce06d3ecdc51a911137800a36e5ada8687f8c653cc85bbcaf2f9"
     },
+    {
+      "path": "src/adapters/cursor/tool-wording.ts",
+      "sha256": "a1370fd4945aa378315fb698ce16cf361712e45d861ca52942cdce7008bee539"
+    },
     {
       "path": "src/adapters/cursor/transport-retry.ts",
       "sha256": "6e166875c6bfba66b115d39b155178935fb003b1c1861b5dd768cc8e15542d01"
@@ -354,7 +358,7 @@
     },
     {
       "path": "src/adapters/devin.ts",
-      "sha256": "13c4afa1f3789e63ef73563ab56503970e38dc40c697877e81be8d4cc1e7c734"
+      "sha256": "3638c1041cb3fed3822c1d719b0a30945818a1110fddab8f3a9033f35a638f49"
     },
     {
       "path": "src/adapters/devin/cloud-direct/auth.ts",
@@ -578,7 +582,7 @@
     },
     {
       "path": "src/adapters/openai-chat/messages.ts",
-      "sha256": "6840534bae4cd81f39963725e9107eb6c8157712b53fc227aee9eec7a11e8023"
+      "sha256": "830502eb0f9875a20fbaead85a592c6c8b2445e48ad0742aac0cc875d49c966f"
     },
     {
       "path": "src/adapters/openai-chat/parallel-tool-calls.ts",
@@ -950,7 +954,7 @@
     },
     {
       "path": "src/claude/inbound.ts",
-      "sha256": "be92d4d81f55b72f3ba6dbe06d9015aa6562c48a47f9c93d05f83f0517cf1fcd"
+      "sha256": "f4093f29fe4635fd797d7d6fb6bd41484b4320a4b89b9ac3f1eb04525cd07166"
     },
     {
       "path": "src/claude/intercept/cli-catalog.ts",
@@ -1990,7 +1994,7 @@
     },
     {
       "path": "src/codex/autostart-health.ts",
-      "sha256": "bbd30686f19e73d40e1b3fbdb7cd20d9439459d19b4697c8410dac58bcb1b239"
+      "sha256": "58e8a3abced23821864f9f1a81cc9f48f55e7e0053eb057f0f163ef45798e235"
     },
     {
       "path": "src/codex/catalog-admission.ts",
@@ -2386,7 +2390,7 @@
     },
     {
       "path": "src/codex/journal.ts",
-      "sha256": "a9bd5e04eef84c7c89a8f83bec07450d2a2fadf8809cdea9c17d5fea20cd4885"
+      "sha256": "cdd5c61028cc9d411b0faeed0a0246f133818ec77110116ccfe3e89a98b2bec8"
     },
     {
       "path": "src/codex/legacy-config-keys.ts",
@@ -2798,7 +2802,7 @@
     },
     {
       "path": "src/codex/shim-overlay.ts",
-      "sha256": "ad34f2af4f374d6867e44e839b2baeefb3af25e558a445422ed97339eb2eeefc"
+      "sha256": "1df24cd1b1751ebdc642ad7262bf217d3c31cc0db850ec9917e4f8776d44ca87"
     },
     {
       "path": "src/codex/shim-path-resolution.ts",
@@ -2906,7 +2910,7 @@
     },
     {
       "path": "src/combos/jev.ts",
-      "sha256": "35b32a363251ecb148c90b54ee2588cb5e880354de984b7243fd29dcf9582177"
+      "sha256": "1d824e402ef1598769dbf90e7d6366f381eea5dd1976c14ca50cd058523d4ff3"
     },
     {
       "path": "src/combos/request.ts",
@@ -5614,7 +5618,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "72b72c4997af595f0add789b75ec18135a5bac886f16113d6e62fd3e8d459cb0"
+      "sha256": "b2440e8a896fa0ffc6084e2a08e10d8e5f0b1d4e5b10131abaf274d3b7dc34db"
     },
     {
       "path": "src/server/index/bounded-request.ts",
@@ -5998,7 +6002,7 @@
     },
     {
       "path": "src/server/messages-native-scope.ts",
-      "sha256": "c529062519b72e9ee5763663b646138726c51380822864b87d6cfad88f7f0297"
+      "sha256": "5f7894d80c9380e537805bd7dbdb03fb7a1d88afd903e5ca28727594955ca566"
     },
     {
       "path": "src/server/messages-native.ts",
@@ -6204,6 +6208,10 @@
       "path": "src/server/responses/collaboration.ts",
       "sha256": "3f9b70ccfcac8d786382c7f205d00eb49fe0d9d2d6a73c86d15d0e92c5594f3c"
     },
+    {
+      "path": "src/server/responses/combo-requested-effort.ts",
+      "sha256": "dea38eb1d677c32b38656a52b3b69be576ca9b69be33849a683e3b519c6dfbd8"
+    },
     {
       "path": "src/server/responses/combo-session-recall.ts",
       "sha256": "f40d4c2fa23ee4203e7805e127b16bcc76d46370798fbd90343cba46ff7d4e49"
@@ -6254,7 +6262,7 @@
     },
     {
       "path": "src/server/responses/core-combo.ts",
-      "sha256": "4ede978a89dc8fc04e3797516443ae952981d04a3cd093d2d17c3a00f01793e6"
+      "sha256": "a33687650dabc3f18dda5cd6babfab2f14e4df3c5ad97aa31a1c1e79f964afae"
     },
     {
       "path": "src/server/responses/core-errors.ts",
@@ -6550,7 +6558,7 @@
     },
     {
       "path": "src/service/desktop-startup.ts",
-      "sha256": "b20f9d4c158906832c25f0ea2577215745d2d75e8d3cf03a93dac31ed14c4389"
+      "sha256": "367773dc614bc4c4273d5d92150274da758a1656a5fa43d9a4939619d6de32a0"
     },
     {
       "path": "src/service/diagnostics.ts",
@@ -7148,13 +7156,17 @@
       "path": "src/web-search/gemini-executor.ts",
       "sha256": "ad13a59824c0b3bf504e06a72558cedebf0e1c8d1ddab3a6cf2222800b68dfe8"
     },
+    {
+      "path": "src/web-search/header-deadline.ts",
+      "sha256": "ec30e9fb56c13966cfc2405879ede715f86c59c49ddd16f32155b64969749394"
+    },
     {
       "path": "src/web-search/index.ts",
       "sha256": "719c325b6843e300f6177113c3afeacc252349c95acbca70dd09c5247fe4b4a4"
     },
     {
       "path": "src/web-search/loop.ts",
-      "sha256": "88cb405912a912c2ccf4cea4261ab727aa4d01b1b49f57081f7cf5d926d6b94b"
+      "sha256": "bfe6ae27084edd5848a4ecf7b11f5ca69ddf5cb63df1e204e820d7fa3fef1eed"
     },
     {
       "path": "src/web-search/ollama-executor.ts",

package/src/server/index.ts

@@ -463,21 +463,19 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     return serveGuiFile(rawPath) !== null;
   }
 
-  // Codex treats empty / non-JSON 503 bodies as "Unknown error" (#452). Keep Retry-After and
-  // the server_is_overloaded code so clients can back off, but always return a JSON envelope.
-  // These two run BEFORE the auth/origin checks, so they need the receiving listener's policy
-  // explicitly (#1102). Reaching for the shared `config` here would attach public-policy CORS
-  // headers to a 503 on the loopback listener — no model runs and no credential is spent, but
-  // it is the one error path that would answer a rebinding origin with its own origin echoed
-  // back.
+  // Codex maps 503 + server_is_overloaded to ServerOverloaded ("model at capacity"), retried
+  // only with retry advice that older clients ignore (#6642); server_restarting is a
+  // retryable UnexpectedStatus in every version and never reads as model capacity.
+  // Keep JSON (empty / non-JSON 503 means "Unknown error", #452) and Retry-After.
+  // Drain and busy run BEFORE auth/origin checks: use the receiving listener's policy
+  // (#1102), because shared public `config` could echo a rebinding origin on loopback.
   function drainingResponse(req: Request, policy: RequestPolicyView): Response {
-    const response = formatErrorResponse(503, "server_error", "Service shutting down");
-    const headers = new Headers(response.headers);
-    for (const [name, value] of Object.entries(corsHeaders(req, policy))) {
-      headers.set(name, value);
-    }
-    headers.set("Retry-After", "5");
-    return new Response(response.body, { status: 503, headers });
+    return withCors(new Response(JSON.stringify({
+      error: { type: "server_error", code: "server_restarting", message: "OpenCodex is restarting; retry this request." },
+    }), {
+      status: 503,
+      headers: { "Content-Type": "application/json", "Retry-After": "5" },
+    }), req, policy);
   }
 
   function serverBusyResponse(req: Request, resource: string, policy: RequestPolicyView): Response {

package/src/server/messages-native-scope.ts

@@ -36,7 +36,10 @@ export function nativeMessagesToolScopeDenial(
         const definition = tool.definition;
         if (typeof definition.name !== "string") { anonymous.push(definition); continue; }
         // A temporary replacement keeps the declaration it shadows in scope as well.
-        definitions.set(definition.name, permanent ? [definition] : [...definitions.get(definition.name) ?? [], definition]);
+        // These arrays belong to this check, not to the caller's declarations.
+        const declarations = permanent ? [] : definitions.get(definition.name) ?? [];
+        declarations.push(definition);
+        definitions.set(definition.name, declarations);
         withdrawn.delete(definition.name);
       } else if (tool.type === "tool_reference" && typeof tool.name === "string") {
         if (block.type === "tool_removal" && permanent) withdrawn.add(tool.name);

package/src/server/responses/combo-requested-effort.ts

@@ -0,0 +1,14 @@
+/** Restore the caller label while retaining JEV's forced effort and later child transitions. */
+export function comboRequestedEffortLabel(
+  originalRequestedEffort: string | undefined,
+  childRequestedEffort: string | undefined,
+  forcedEffort?: string | null,
+): string | undefined {
+  if (originalRequestedEffort === undefined) return childRequestedEffort;
+  const transitionIndex = childRequestedEffort?.indexOf("->") ?? -1;
+  const laterTransitions = transitionIndex >= 0 ? childRequestedEffort!.slice(transitionIndex) : "";
+  const forcedTransition = forcedEffort != null && forcedEffort !== originalRequestedEffort
+    ? `->${forcedEffort}`
+    : "";
+  return `${originalRequestedEffort}${forcedTransition}${laterTransitions}`;
+}

package/src/server/responses/core-combo.ts

@@ -106,6 +106,7 @@ import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
 import { settleOperatorReplacement } from "../../lib/upstream-retry";
 import { createComboProtocolLanes, dispatchNativeComboChild } from "./core-combo-native";
 import { createJevModelInvoker } from "./jev-model-invoke";
+import { comboRequestedEffortLabel } from "./combo-requested-effort";
 import { clientWireOf } from "../inference/client-wire";
 
 /**
@@ -656,13 +657,9 @@ export async function executeComboResponses(
     && isDeclaredReasoningEffort(originalRequestedEffortValue)
     ? originalRequestedEffortValue
     : undefined;
-  const restoreOriginalRequestedEffort = (childLog: RequestLogContext): void => {
+  const restoreOriginalRequestedEffort = (childLog: RequestLogContext, forcedEffort?: string | null): void => {
     if (originalRequestedEffort === undefined) return;
-    const normalizedRequestedEffort = childLog.requestedEffort;
-    const transitionIndex = normalizedRequestedEffort?.indexOf("->") ?? -1;
-    childLog.requestedEffort = transitionIndex >= 0
-      ? `${originalRequestedEffort}${normalizedRequestedEffort!.slice(transitionIndex)}`
-      : originalRequestedEffort;
+    childLog.requestedEffort = comboRequestedEffortLabel(originalRequestedEffort, childLog.requestedEffort, forcedEffort);
     recordAttemptRequestedEffort(childLog);
   };
 
@@ -907,7 +904,8 @@ export async function executeComboResponses(
         onNativePassthroughCancel: callbackGate.onCancel,
         onResponseComplete: callbackGate.onResponseComplete,
       });
-      restoreOriginalRequestedEffort(childLog);
+      // Native Chat rebuilds its own body and does not apply the initial JEV effort.
+      restoreOriginalRequestedEffort(childLog, nativeChild ? undefined : initialJevDecision?.effort);
     } catch (error) {
       callbackGate.discard();
       if (options.abortSignal?.aborted) {

package/src/service/desktop-startup.ts

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
-import { accessSync, constants, readFileSync, realpathSync } from "node:fs";
+import { accessSync, constants, readFileSync, readlinkSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { readPid } from "../config/process-state";
 import { resolveServiceOwnership, sameServiceOwnershipSubject, type ServiceOwnershipResolution } from "./state";
 
@@ -29,11 +29,28 @@ interface DesktopStartupDeps {
   ownership?: () => ServiceOwnershipResolution;
   readPid?: () => number | null;
   run?: typeof run;
+  env?: NodeJS.ProcessEnv;
+  proc?: ProcReader;
 }
 
+/** Linux process identity from procfs: executable target and parent pid. */
+interface ProcReader {
+  exe(pid: number): string;
+  parent(pid: number): number;
+}
+const procfs: ProcReader = {
+  exe: pid => readlinkSync(`/proc/${pid}/exe`),
+  // comm may contain spaces or parentheses, so fields are counted after the last ')'.
+  parent: pid => {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    return Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+  },
+};
+
 /** Cheap ownership-only snapshot: no launchd/process probes on the server request path. */
 export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
-  if ((deps.platform ?? process.platform) !== "darwin") return undefined;
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "darwin" && platform !== "linux") return undefined;
   const owner = (deps.ownership ?? resolveServiceOwnership)();
   return owner.kind === "owned" && owner.ownership.owner === "desktop"
     ? deriveDesktopStartup({ owned: true, loginEnabled: false, running: false }) : undefined;
@@ -91,3 +108,83 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
     return deriveDesktopStartup({ ...facts, running: false });
   }
 }
+
+/** HOME-based autostart entry written by the desktop app's login item (`tauri-plugin-autostart`). */
+function linuxLoginApp(entry: string): string | null {
+  const fields = new Map<string, string>();
+  let section = "";
+  for (const raw of entry.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    if (line.startsWith("[")) { section = line; continue; }
+    const at = line.indexOf("=");
+    if (section === "[Desktop Entry]" && at > 0 && !fields.has(line.slice(0, at).trim())) {
+      fields.set(line.slice(0, at).trim(), line.slice(at + 1).trim());
+    }
+  }
+  if (fields.get("Type") !== "Application" || fields.get("Hidden") === "true"
+    || fields.get("X-GNOME-Autostart-enabled") === "false"
+    || ["OnlyShowIn", "NotShowIn", "TryExec"].some(key => fields.has(key))) return null;
+  // Credit only the backend's simple Exec form; desktop quoting/escaping/field codes are unsupported.
+  const app = /^([^\s"'\\%`><~|&;$*?#()]+) --autostart$/.exec(fields.get("Exec") ?? "")?.[1];
+  return app && isAbsolute(app) && basename(app) === "opencodex-desktop" ? app : null;
+}
+
+/** Read-only Linux desktop ownership, HOME login entry and live parent/child checks via procfs. */
+export function diagnoseLinuxDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  if ((deps.platform ?? process.platform) !== "linux") return undefined;
+  const ownership = deps.ownership ?? resolveServiceOwnership;
+  const owner = ownership();
+  if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
+  const facts = { owned: true, loginEnabled: false, running: false };
+  const proc = deps.proc ?? procfs;
+  const pidReader = deps.readPid ?? readPid;
+  try {
+    const env = deps.env ?? process.env;
+    const home = deps.home ?? homedir();
+    const configured = env.XDG_CONFIG_HOME;
+    const config = configured && isAbsolute(configured) ? configured : join(home, ".config");
+    // auto-launch 0.5.0 writes autostart under HOME; Tauri app_config_dir uses XDG for install-id.
+    // A relocated XDG_CONFIG_HOME puts that entry outside the session's autostart search path.
+    if (resolve(config) !== resolve(home, ".config")) return deriveDesktopStartup(facts);
+    const capture = () => {
+      const id = readFileSync(join(config, "com.opencodex.desktop", "install-id"), "utf8");
+      if (id.trim() !== owner.ownership.installId) return null;
+      const entry = readFileSync(join(home, ".config", "autostart", "OpenCodex.desktop"), "utf8");
+      const login = linuxLoginApp(entry);
+      if (!login) return null;
+      const app = realpathSync(login);
+      if (basename(app) !== "opencodex-desktop") return null;
+      const proxy = realpathSync(join(dirname(app), "ocx"));
+      if (dirname(proxy) !== dirname(app) || basename(proxy) !== "ocx") return null;
+      accessSync(app, constants.X_OK);
+      accessSync(proxy, constants.X_OK);
+      const pid = pidReader();
+      const parent = pid !== null ? proc.parent(pid) : null;
+      const child = pid !== null ? realpathSync(proc.exe(pid)) : null;
+      const parentApp = parent !== null && parent > 1 ? realpathSync(proc.exe(parent)) : null;
+      const running = pid !== null && child === proxy && parentApp === app && pidReader() === pid;
+      const currentOwner = ownership();
+      if (currentOwner.kind === "unknown" || !sameServiceOwnershipSubject(owner, currentOwner)) return null;
+      return { id, entry, login, app, proxy, pid, parent, child, parentApp, running };
+    };
+    const first = capture();
+    if (!first) return deriveDesktopStartup(facts);
+    const final = capture();
+    // Re-read the entire evidence chain, including files, targets and the exact parent PID.
+    // A changed or unreadable snapshot cannot retain protection from the first read.
+    if (final && JSON.stringify(first) === JSON.stringify(final)) {
+      facts.loginEnabled = true;
+      facts.running = final.running;
+    }
+    return deriveDesktopStartup(facts);
+  } catch {
+    // Unreadable login or procfs evidence never grants protection or releases the claim.
+    return deriveDesktopStartup({ ...facts, running: false });
+  }
+}
+
+/** Platform dispatch for the full (probing) desktop startup diagnostic. */
+export function diagnoseDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  return (deps.platform ?? process.platform) === "linux" ? diagnoseLinuxDesktopStartup(deps) : diagnoseMacDesktopStartup(deps);
+}

package/src/web-search/header-deadline.ts

@@ -0,0 +1,67 @@
+import { clearableDeadline } from "../lib/abort";
+import { sendTrackingRequestSlot } from "../providers/request-pacing";
+import type { ProviderFetch } from "../server/responses/fetch-helpers";
+
+/** One iteration's cumulative header budget; only local pacing admission pauses its clock. */
+export function pacingHeaderDeadline(timeoutMs: number, parent: AbortSignal) {
+  const controller = new AbortController();
+  const signal = AbortSignal.any([parent, controller.signal]);
+  let remainingMs = timeoutMs;
+  let armedAt = performance.now();
+  let current = clearableDeadline(remainingMs, parent);
+  const timeoutReason = current.timeoutReason;
+  let pacingWaits = 0;
+  let cleared = false;
+  const relayExpiry = () => {
+    if (current.didExpire()) controller.abort(timeoutReason);
+  };
+  current.signal.addEventListener("abort", relayExpiry, { once: true });
+
+  const pause = () => {
+    if (cleared || pacingWaits++ > 0) return;
+    remainingMs = Math.max(0, remainingMs - (performance.now() - armedAt));
+    current.clear();
+    current.signal.removeEventListener("abort", relayExpiry);
+    // A delayed timer task must not let an already-spent budget escape into the queue.
+    if (remainingMs === 0 && !signal.aborted) controller.abort(timeoutReason);
+  };
+  const resume = () => {
+    if (cleared || --pacingWaits > 0 || signal.aborted) return;
+    armedAt = performance.now();
+    current = clearableDeadline(remainingMs, parent);
+    current.signal.addEventListener("abort", relayExpiry, { once: true });
+  };
+
+  return {
+    signal,
+    didExpire: () => signal.aborted && signal.reason === timeoutReason,
+    clear: () => {
+      cleared = true;
+      current.clear();
+      current.signal.removeEventListener("abort", relayExpiry);
+    },
+    /** Preserve the pacing seams used by adapter physical-send helpers, without double admission. */
+    pacedFetch(executor: typeof globalThis.fetch): typeof globalThis.fetch {
+      const pacing = executor as ProviderFetch;
+      if (!pacing.waitForPacing) return executor;
+      const waitForPacing: NonNullable<ProviderFetch["waitForPacing"]> = async (sendSignal) => {
+        pause();
+        try {
+          return await pacing.waitForPacing!(sendSignal ? AbortSignal.any([signal, sendSignal]) : signal);
+        } finally {
+          resume();
+        }
+      };
+      const unpacedFetch = pacing.unpacedFetch ?? executor;
+      const wrapped = async (input: Parameters<typeof fetch>[0], init?: RequestInit) => {
+        const slot = await waitForPacing(init?.signal ?? undefined);
+        return sendTrackingRequestSlot(slot, () => {
+          signal.throwIfAborted();
+          init?.signal?.throwIfAborted();
+          return unpacedFetch(input, init);
+        });
+      };
+      return Object.assign(wrapped, { preconnect: executor.preconnect, waitForPacing, unpacedFetch }) as ProviderFetch;
+    },
+  };
+}

package/src/web-search/loop.ts

@@ -11,7 +11,7 @@ import { runXaiWebSearch, type XaiSearchOptions } from "./xai-executor";
 import { runGeminiWebSearch } from "./gemini-executor";
 import { runExaWebSearch } from "./exa-executor";
 import type { WebSearchBackendId } from "./index";
-import { clearableDeadline } from "../lib/abort";
+import { pacingHeaderDeadline } from "./header-deadline";
 import { redactSecretString } from "../lib/redact";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait } from "../lib/upstream-retry";
@@ -455,10 +455,10 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       ...(recoveringEmptyAnswer ? { options: { ...parsed.options, toolChoice: "none" as const } } : {}),
       context: { ...parsed.context, messages: iterMessages, tools: recoveringEmptyAnswer ? [] : allTools },
     };
-    // One cumulative header deadline spans every pool-key 429 rotation in this model iteration.
+    // One cumulative header deadline spans key rotations and reset sends, excluding local pacing.
     // clear() stops only its timer after final headers; the direct turn signal remains attached to
     // the returned response body through AbortSignal.any().
-    let headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+    let headerDeadline = pacingHeaderDeadline(connectTimeoutMs, signal);
     try {
       /**
        * Build and fetch one web-search iteration on the given adapter, under the iteration
@@ -491,7 +491,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           cachedRequest = request;
           cachedAdapter = requestAdapter;
         }
-        const requestFetch = deps.fetchForRequest?.(request, iterParsed) ?? routedProviderFetch;
+        const requestFetch = headerDeadline.pacedFetch(deps.fetchForRequest?.(request, iterParsed) ?? routedProviderFetch);
         let response: Response;
         try {
           if (requestAdapter.fetchResponse) {
@@ -563,7 +563,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         // The deliberate backoff must not consume the cumulative response-header deadline:
         // start a fresh one so the replay gets a new connect budget (504 stays reserved for real
         // upstream latency).
-        headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+        headerDeadline = pacingHeaderDeadline(connectTimeoutMs, signal);
         // Stall-watchdog seam between bounded retry fetches.
         yield { type: "heartbeat" };
         prepared = await fetchOnce(adapter, "rate-limit-429");