@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/router.ts

@@ -152,6 +152,15 @@ function configuredOriginForLog(url: string): string {
 // `routedProviderConfig` runs per request, so warn once per (provider, discarded, effective) triple.
 // Keyed by the URLs too: editing config.json to a different wrong value warns again.
 const discardedBaseUrlWarnings = new Set<string>();
+let lastWarningReconciledGeneration = 0;
+
+export function reconcileRouterWarningMemos(generation: number): number {
+  if (generation <= lastWarningReconciledGeneration) return 0;
+  const removed = discardedBaseUrlWarnings.size;
+  discardedBaseUrlWarnings.clear();
+  lastWarningReconciledGeneration = generation;
+  return removed;
+}
 
 /**
  * A pinned registry entry — non-template `baseUrl`, no `allowBaseUrlOverride` — outranks a saved
@@ -247,6 +256,9 @@ function routedProviderConfig(providerName: string, provider: OcxProviderConfig)
     ...provider,
     adapter: registryEntry.adapter,
     baseUrl,
+    ...(provider.responsesPath === undefined && registryEntry.responsesPath !== undefined
+      ? { responsesPath: registryEntry.responsesPath }
+      : {}),
     authMode: canonicalAuthMode,
     apiKey: resolvedApiKey,
     // Backfill the Google wire mode + Vertex project/location from the registry when the user
@@ -303,8 +315,13 @@ export class NoEnabledOpenAiProviderError extends Error {
   }
 }
 
+// Codex uses a small number of control-plane model ids that are not part of the public GPT/o
+// naming families. Keep this exact: a broad `codex-*` rule could capture a third-party model.
+const CODEX_INTERNAL_OPENAI_MODELS = new Set(["codex-auto-review"]);
+
 function isBareOpenAiFamilyModel(modelId: string): boolean {
-  return !modelId.includes("/") && /^(?:gpt-|o1-|o3-|o4-)/.test(modelId);
+  return !modelId.includes("/")
+    && (/^(?:gpt-|o1-|o3-|o4-)/.test(modelId) || CODEX_INTERNAL_OPENAI_MODELS.has(modelId));
 }
 
 function routeResult(providerName: string, provider: OcxProviderConfig, modelId: string): RouteResult {

package/src/server/adapter-resolve.ts

@@ -9,22 +9,39 @@ import { createResponsesPassthroughAdapter } from "../adapters/openai-responses"
 import type { OcxProviderConfig } from "../types";
 import { isWirePinnedModel, MODEL_ADAPTER_OVERRIDE_ALLOWED, pinnedWireAdapter } from "../types";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { type InboundWire, providerModelWireDefault } from "../providers/registry";
 
 /**
  * Resolve the wire a single model should use: a hard pin first, then a configured
- * per-model override, then the provider's own adapter.
+ * per-model override, then a registry default for a mixed-wire provider, then the provider's
+ * own adapter.
  *
  * Safe to call more than once on its own output — the pin check does not look at the
  * current adapter, so a second pass cannot let an override displace a pin.
+ *
+ * `inbound` is the protocol the ORIGINAL client spoke. It defaults to `"responses"`
+ * because the Chat and Anthropic surfaces translate into a Responses-shaped body and
+ * replay through `handleResponses`; those two callers pass their real inbound so a
+ * scoped registry default cannot fire for a client that never asked for that wire.
  */
-export function resolveWireProtocolOverride(providerName: string, modelId: string, providerConfig: OcxProviderConfig): OcxProviderConfig {
+export function resolveWireProtocolOverride(
+  providerName: string,
+  modelId: string,
+  providerConfig: OcxProviderConfig,
+  inbound: InboundWire = "responses",
+): OcxProviderConfig {
   const pinned = pinnedWireAdapter(providerName, modelId);
   if (pinned && providerConfig.adapter !== pinned) {
     return { ...providerConfig, adapter: pinned };
   }
   // Re-check the allow-list here, not just in the config validator: the file may have
   // been hand-edited, or written by a build that allowed more values.
-  const requested = providerConfig.modelAdapters?.[modelId];
+  const configured = providerConfig.modelAdapters?.[modelId];
+  // An explicit allowed override wins, including one naming the provider-wide adapter (the
+  // opt-out from a registry default). Invalid hand-edited values fall through to the default.
+  const requested = configured && MODEL_ADAPTER_OVERRIDE_ALLOWED.has(configured)
+    ? configured
+    : providerModelWireDefault(providerName, providerConfig, modelId, MODEL_ADAPTER_OVERRIDE_ALLOWED, inbound);
   if (requested
     && MODEL_ADAPTER_OVERRIDE_ALLOWED.has(requested)
     && requested !== providerConfig.adapter

package/src/server/auth-cors.ts

@@ -12,7 +12,7 @@ import {
   reasoningSummaryDeliveryRecordConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
-import { getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport } from "../providers/registry";
+import { getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
@@ -70,16 +70,6 @@ export function isSameOriginAsRequest(req: Request, origin: string): boolean {
 }
 
 export function isAllowedRequestOrigin(req: Request, config: OcxConfig): boolean {
-  function isExtraAllowedOrigin(origin: string, cfg: OcxConfig): boolean {
-    if (!cfg.corsAllowOrigins?.length) return false;
-    return cfg.corsAllowOrigins.some(allowed => {
-      try {
-        return new URL(allowed).origin === new URL(origin).origin;
-      } catch {
-        return allowed === origin;
-      }
-    });
-  }
   const origin = req.headers.get("Origin");
   if (!isApiAuthRequired(config)) {
     if (!isLoopbackRequestHost(req.headers.get("Host"))) return false;
@@ -88,6 +78,17 @@ export function isAllowedRequestOrigin(req: Request, config: OcxConfig): boolean
   return !origin || isLoopbackOriginValue(origin) || isSameOriginAsRequest(req, origin) || isExtraAllowedOrigin(origin, config);
 }
 
+function isExtraAllowedOrigin(origin: string, cfg: OcxConfig): boolean {
+  if (!cfg.corsAllowOrigins?.length) return false;
+  return cfg.corsAllowOrigins.some(allowed => {
+    try {
+      return new URL(allowed).origin === new URL(origin).origin;
+    } catch {
+      return allowed === origin;
+    }
+  });
+}
+
 export function managementRequestOrigin(req: Request, config: OcxConfig): string | null {
   const host = req.headers.get("Host");
   const parsedHost = parseHttpHost(host);
@@ -106,7 +107,9 @@ export function isAllowedManagementOrigin(req: Request, config: OcxConfig): bool
   const requestOrigin = managementRequestOrigin(req, config);
   if (!requestOrigin) return false;
   const origin = req.headers.get("Origin");
-  return !origin || origin === requestOrigin;
+  // Exact match against the process-derived origin, or an operator-listed corsAllowOrigins
+  // entry (covers TLS-terminator https://… when the process observes http://…).
+  return !origin || origin === requestOrigin || isExtraAllowedOrigin(origin, config);
 }
 
 export function browserSecurityHeaders(): Record<string, string> {
@@ -210,17 +213,87 @@ function secretEquals(actual: string, expected: string | undefined): boolean {
   return expectedBytes.length === actualBytes.length && timingSafeEqual(actualBytes, expectedBytes);
 }
 
-/** Whether `token` is a data-plane admission secret. */
-export function isDataPlaneAdmissionSecret(token: string, config: OcxConfig): boolean {
+/**
+ * Which admission a data-plane request used.
+ *
+ * `configured` carries the matched key's id so a request can be attributed to
+ * the key that opened it. The other two exist so an unattributed request is a
+ * stated fact rather than a missing field: neither has a configured entry to
+ * point at, and a sentinel string in the id would collide with a hand-edited
+ * entry that happens to be named `loopback`.
+ */
+export type DataPlaneAdmission =
+  | { kind: "configured"; keyId: string }
+  | { kind: "environment" }
+  | { kind: "loopback" };
+
+/**
+ * Which admission secret `token` is, or null when it is none of them.
+ *
+ * Identical comparisons in an identical order to the boolean form this replaces —
+ * `secretEquals` still length-guards before `timingSafeEqual`. The only
+ * difference is that the matched entry's id survives the loop instead of being
+ * discarded, which is what makes per-key attribution possible without touching
+ * the admission decision itself.
+ */
+export function resolveDataPlaneAdmissionSecret(token: string, config: OcxConfig): DataPlaneAdmission | null {
   const actual = token.trim();
-  if (!actual) return false;
-  if (secretEquals(actual, configuredApiAuthToken(config))) return true;
+  if (!actual) return null;
+  if (secretEquals(actual, configuredApiAuthToken(config))) return { kind: "environment" };
   for (const k of config.apiKeys ?? []) {
-    if (secretEquals(actual, k.key)) return true;
+    if (secretEquals(actual, k.key)) return { kind: "configured", keyId: k.id };
   }
-  return false;
+  return null;
+}
+
+/** Whether `token` is a data-plane admission secret. */
+export function isDataPlaneAdmissionSecret(token: string, config: OcxConfig): boolean {
+  return resolveDataPlaneAdmissionSecret(token, config) !== null;
 }
 
+/**
+ * Split an admission into the fields a log row records.
+ *
+ * `apiKeyId` is set only for a configured key. The other two kinds have no
+ * configured entry to name, and folding them into the id as sentinel strings
+ * would collide with a hand-edited entry that happens to be called `loopback` —
+ * ids are only validated as non-empty strings.
+ */
+export function admissionFields(admission: DataPlaneAdmission): {
+  admissionKind: DataPlaneAdmission["kind"];
+  apiKeyId?: string;
+} {
+  return admission.kind === "configured"
+    ? { admissionKind: "configured", apiKeyId: admission.keyId }
+    : { admissionKind: admission.kind };
+}
+
+export type ApiAuthDisposition = "required" | "accepted" | "rejected";
+
+export interface ApiAuthMatrixRow {
+  endpoint: string;
+  bearer: ApiAuthDisposition;
+  dedicated: ApiAuthDisposition;
+  xApiKey: ApiAuthDisposition;
+}
+
+/**
+ * Which headers each data-plane endpoint actually accepts, shipped to the GUI so
+ * it stops describing the rule from memory. The dashboard has been telling users
+ * that Chat Completions takes `Authorization: Bearer`, which this file has never
+ * allowed — that route uses the dedicated-header-only wrapper because
+ * `Authorization` there may belong to Codex Direct passthrough.
+ *
+ * It lives next to the wrappers it describes, and a test drives real requests
+ * against every cell rather than reading the table back to itself.
+ */
+export const AUTH_MATRIX: readonly ApiAuthMatrixRow[] = [
+  { endpoint: "/v1/responses", bearer: "rejected", dedicated: "required", xApiKey: "rejected" },
+  { endpoint: "/v1/chat/completions", bearer: "rejected", dedicated: "required", xApiKey: "rejected" },
+  { endpoint: "/v1/messages", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
+  { endpoint: "/v1/models", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
+];
+
 /** Whether `token` is the environment-provided management secret. */
 export function isManagementAdmissionSecret(token: string): boolean {
   const actual = token.trim();
@@ -247,14 +320,23 @@ export function validateForwardAdmissionCredential(headers: Headers, config: Ocx
   if (bearer && isProxyAdmissionSecret(bearer, config)) throw new ForwardAdmissionCredentialError();
 }
 
-export function hasValidApiAuth(req: Request, config: OcxConfig): boolean {
-  if (!isApiAuthRequired(config)) return true;
+/**
+ * Resolving form of `hasValidApiAuth`: identical header precedence, identical
+ * decision, but it names the admission instead of collapsing it to a boolean.
+ */
+export function resolveApiAuth(req: Request, config: OcxConfig): DataPlaneAdmission | null {
+  // A loopback bind never reads a token at all, so there is no key to name.
+  if (!isApiAuthRequired(config)) return { kind: "loopback" };
   const actual = req.headers.get("x-opencodex-api-key")?.trim()
     || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
     // Anthropic-SDK clients (Claude Code with ANTHROPIC_API_KEY) authenticate via x-api-key.
     || req.headers.get("x-api-key")?.trim();
-  if (!actual) return false;
-  return isDataPlaneAdmissionSecret(actual, config);
+  if (!actual) return null;
+  return resolveDataPlaneAdmissionSecret(actual, config);
+}
+
+export function hasValidApiAuth(req: Request, config: OcxConfig): boolean {
+  return resolveApiAuth(req, config) !== null;
 }
 
 export function requireApiAuth(req: Request, config: OcxConfig, _kind: "data-plane"): Response | null {
@@ -267,10 +349,17 @@ export function requireApiAuth(req: Request, config: OcxConfig, _kind: "data-pla
  * Codex Direct. Remote binds must use the dedicated proxy header so the two bearer
  * domains can never be confused.
  */
-export function requireResponsesApiAuth(req: Request, config: OcxConfig): Response | null {
-  if (!isApiAuthRequired(config)) return null;
+export function resolveResponsesApiAuth(req: Request, config: OcxConfig): DataPlaneAdmission | null {
+  if (!isApiAuthRequired(config)) return { kind: "loopback" };
+  // Dedicated header ONLY. `Authorization` on these transports may belong to
+  // Codex Direct passthrough, and the two bearer domains must stay unconfusable.
   const actual = req.headers.get("x-opencodex-api-key")?.trim();
-  if (actual && isDataPlaneAdmissionSecret(actual, config)) return null;
+  if (!actual) return null;
+  return resolveDataPlaneAdmissionSecret(actual, config);
+}
+
+export function requireResponsesApiAuth(req: Request, config: OcxConfig): Response | null {
+  if (resolveResponsesApiAuth(req, config)) return null;
   return formatErrorResponse(401, "authentication_error", "opencodex API key required");
 }
 
@@ -418,9 +507,13 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
-    const registryNote = providerMatchesRegistryTransport(name, provider)
-      ? getProviderRegistryEntry(name)?.note
-      : undefined;
+    // Resolve the note by DESTINATION, not by name. A preset saved under a custom name is
+    // still pointed at the same vendor route, and a usage restriction the user needs to see
+    // must not disappear because the row was renamed. Prefer the same-name entry so an
+    // unrenamed provider keeps its exact registry note.
+    const registryNote = (providerMatchesRegistryTransport(name, provider)
+      ? getProviderRegistryEntry(name)
+      : registryEntryForProviderDestination(provider))?.note;
     if (typeof registryNote === "string" && registryNote.trim()) dto.note = registryNote;
     const codexAccountMode = providerCodexAccountMode(name, provider);
     if (codexAccountMode) dto.codexAccountMode = codexAccountMode;

package/src/server/chat-completions.ts

@@ -31,16 +31,24 @@ import {
 } from "./request-log";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
+import type { AdmissionLease } from "../lib/admission";
+import {
+  createTranslatorBudget,
+  finalizeTranslatorBudgetResponse,
+  isTranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "../lib/translator-budget";
 
 type Rec = Record<string, unknown>;
 
 function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-async function readChatBody(req: Request): Promise<unknown> {
+async function readChatBody(req: Request, budget: TranslatorBudget): Promise<unknown> {
   try {
-    return await readJsonRequestBody(req);
+    return await readJsonRequestBody(req, budget);
   } catch (err) {
+    if (isTranslatorBudgetExceededError(err)) throw err;
     throw new ChatCompletionsRequestError(err instanceof Error && err.message ? err.message : "Invalid JSON body");
   }
 }
@@ -49,17 +57,43 @@ export async function handleChatCompletions(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
-  logIds?: { requestId: string; start: number },
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+): Promise<Response> {
+  const translatorBudget = createTranslatorBudget();
+  try {
+    return finalizeTranslatorBudgetResponse(
+      await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds),
+      translatorBudget,
+    );
+  } catch (error) {
+    translatorBudget.dispose();
+    throw error;
+  }
+}
+
+async function handleChatCompletionsWithBudget(
+  req: Request,
+  config: OcxConfig,
+  logCtx: RequestLogContext,
+  translatorBudget: TranslatorBudget,
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
 ): Promise<Response> {
   let chatBody: unknown;
   let internalBody: Rec;
   try {
-    chatBody = await readChatBody(req);
+    chatBody = await readChatBody(req, translatorBudget);
     internalBody = chatCompletionsToResponsesBody(chatBody);
+    translatorBudget.chargeRetained(new TextEncoder().encode(JSON.stringify(internalBody)).byteLength, { kind: "request_copies" });
   } catch (err) {
-    const status = err instanceof ChatCompletionsRequestError ? 400 : 500;
+    const overflow = isTranslatorBudgetExceededError(err);
+    const status = overflow ? 413 : err instanceof ChatCompletionsRequestError ? 400 : 500;
     if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason: "non_stream" });
-    return chatCompletionsErrorResponse(status, err instanceof Error ? err.message : String(err));
+    return chatCompletionsErrorResponse(
+      status,
+      overflow ? "request translation buffer exceeded the safe limit" : err instanceof Error ? err.message : String(err),
+      overflow ? "request_too_large" : undefined,
+      overflow ? "translation_buffer_limit" : undefined,
+    );
   }
 
   const requestedModel = (chatBody as Rec).model as string;
@@ -78,7 +112,7 @@ export async function handleChatCompletions(
     const route = routeModel(config, internalBody.model as string);
     // Settle the wire once so every branch below reads the adapter this model will
     // actually use, not the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider);
+    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "chat");
     logCtx.model = route.modelId;
     logCtx.providerAdapter = route.provider.adapter;
     logCtx.requestedModel = requestedModel;
@@ -135,10 +169,12 @@ export async function handleChatCompletions(
     /* optional */
   }
 
+  const internalBodyJson = JSON.stringify(internalBody);
+  translatorBudget.chargeRetained(new TextEncoder().encode(internalBodyJson).byteLength, { kind: "request_copies" });
   const internalReq = new Request("http://localhost/v1/responses", {
     method: "POST",
     headers,
-    body: JSON.stringify(internalBody),
+    body: internalBodyJson,
   });
 
   let nativeLogged = false;
@@ -148,7 +184,11 @@ export async function handleChatCompletions(
     addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
   };
   const upstream = await handleResponses(internalReq, config, logCtx, {
+    ...(logIds?.turnAdmissionLease ? { turnAdmissionLease: logIds.turnAdmissionLease } : {}),
     abortSignal: req.signal,
+    // Body is Responses-shaped by now, but the client spoke Chat Completions.
+    inboundWire: "chat",
+    translatorBudget,
     ...(logIds ? { onFirstOutput: () => recordFirstOutput(logCtx, logIds.start) } : {}),
     onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForTerminalStatus(status), { terminalStatus: status, closeReason: "terminal" }),
     onNativePassthroughCancel: () => finalizeNativeLog(499, { closeReason: "client_cancel" }),
@@ -231,7 +271,7 @@ export async function handleChatCompletions(
 
   const contentType = response.headers.get("content-type") ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
-    const chatSse = responsesSseToChatCompletionsSse(response.body, requestedModel);
+    const chatSse = responsesSseToChatCompletionsSse(response.body, requestedModel, { translatorBudget });
     if (stream) {
       // Stream failures surface as an error SSE frame then abort the body — never a
       // success completion that embeds `[error] ...` + clean [DONE].
@@ -245,7 +285,7 @@ export async function handleChatCompletions(
       });
     }
     try {
-      const completion = await collectChatCompletion(chatSse, requestedModel);
+      const completion = await collectChatCompletion(chatSse, requestedModel, translatorBudget);
       return new Response(JSON.stringify(completion), {
         status: 200,
         headers: { "Content-Type": "application/json" },
@@ -274,7 +314,10 @@ export async function handleChatCompletions(
     const error = (json as { error?: { message?: string; type?: string; code?: string | null } }).error;
     const message = error?.message ?? "upstream request failed";
     const classified = classifyError(502, error?.type ?? "server_error", message);
-    if (isCyberPolicyCode(error?.code)) {
+    if (error?.code === "translation_buffer_limit") {
+      classified.code = "translation_buffer_limit";
+      classified.type = "invalid_request_error";
+    } else if (isCyberPolicyCode(error?.code)) {
       classified.code = CYBER_POLICY_ERROR_CODE;
       classified.type = "invalid_request_error";
     } else if (error?.code === "model_not_found") {
@@ -283,7 +326,9 @@ export async function handleChatCompletions(
       classified.type = "invalid_request_error";
     }
     return chatCompletionsErrorResponse(
-      isCyberPolicyCode(classified.code) ? 400 : 502,
+      classified.code === "translation_buffer_limit"
+        ? 413
+        : isCyberPolicyCode(classified.code) ? 400 : 502,
       message,
       classified.type,
       classified.code,

package/src/server/claude-messages.ts

@@ -33,6 +33,13 @@ import { addFinalRequestLog, httpStatusForTerminalStatus, recordFirstOutput, typ
 import { conversationIdFromClaudeMetadata } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
+import type { AdmissionLease } from "../lib/admission";
+import {
+  createTranslatorBudget,
+  finalizeTranslatorBudgetResponse,
+  isTranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "../lib/translator-budget";
 
 type Rec = Record<string, unknown>;
 
@@ -62,10 +69,11 @@ function claudeInboundDisabled(config: OcxConfig): Response | null {
   return null;
 }
 
-async function readAnthropicBody(req: Request): Promise<unknown> {
+async function readAnthropicBody(req: Request, budget: TranslatorBudget): Promise<unknown> {
   try {
-    return await readJsonRequestBody(req);
+    return await readJsonRequestBody(req, budget);
   } catch (err) {
+    if (isTranslatorBudgetExceededError(err)) throw err;
     throw new AnthropicRequestError(err instanceof Error && err.message ? err.message : "Invalid JSON body");
   }
 }
@@ -511,7 +519,26 @@ export async function handleClaudeMessages(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
-  logIds?: { requestId: string; start: number },
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+): Promise<Response> {
+  const translatorBudget = createTranslatorBudget();
+  try {
+    return finalizeTranslatorBudgetResponse(
+      await handleClaudeMessagesWithBudget(req, config, logCtx, translatorBudget, logIds),
+      translatorBudget,
+    );
+  } catch (error) {
+    translatorBudget.dispose();
+    throw error;
+  }
+}
+
+async function handleClaudeMessagesWithBudget(
+  req: Request,
+  config: OcxConfig,
+  logCtx: RequestLogContext,
+  translatorBudget: TranslatorBudget,
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
 ): Promise<Response> {
   logCtx.surface = "claude";
   const disabled = claudeInboundDisabled(config);
@@ -525,7 +552,7 @@ export async function handleClaudeMessages(
   let cacheKeySource: ClaudeCacheKeySource = null;
   let effortOverride: ReturnType<typeof extractOcxEffortDirective> = null;
   try {
-    anthropicBody = await readAnthropicBody(req);
+    anthropicBody = await readAnthropicBody(req, translatorBudget);
     // Defensive [1m] strip (devlog 138): clients normally remove the context-variant
     // marker themselves; the 1M signal we act on is the anthropic-beta header.
     // Case-insensitive — the CLI matches /\[1m\]/i (audit 021 #7).
@@ -575,11 +602,18 @@ export async function handleClaudeMessages(
     }
     const translation = anthropicToResponsesTranslation(anthropicBody, config.claudeCode);
     internalBody = translation.body;
+    translatorBudget.chargeRetained(new TextEncoder().encode(JSON.stringify(internalBody)).byteLength, { kind: "request_copies" });
     cacheKeySource = translation.cacheKeySource;
   } catch (err) {
-    const status = err instanceof AnthropicRequestError ? 400 : 500;
+    const overflow = isTranslatorBudgetExceededError(err);
+    const status = overflow ? 413 : err instanceof AnthropicRequestError ? 400 : 500;
     if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason: "non_stream" });
-    return anthropicErrorResponse(status, err instanceof Error ? err.message : String(err));
+    return anthropicErrorResponse(
+      status,
+      overflow ? "request translation buffer exceeded the safe limit" : err instanceof Error ? err.message : String(err),
+      overflow ? "request_too_large" : undefined,
+      overflow ? "translation_buffer_limit" : undefined,
+    );
   }
 
   const requestedModel = (anthropicBody as Rec).model as string;
@@ -596,7 +630,7 @@ export async function handleClaudeMessages(
     const route = routeModel(config, internalBody.model as string);
     // Settle the wire once so the sampling decision below reads the effective
     // adapter rather than the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider);
+    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic");
     if (route.provider.adapter === "openai-responses") {
       nativeRoute = true;
       delete internalBody.max_output_tokens;
@@ -666,10 +700,12 @@ export async function handleClaudeMessages(
       headers.set("session_id", uuidFromHex(internalBody.prompt_cache_key));
     }
   }
+  const internalBodyJson = JSON.stringify(internalBody);
+  translatorBudget.chargeRetained(new TextEncoder().encode(internalBodyJson).byteLength, { kind: "request_copies" });
   const internalReq = new Request("http://localhost/v1/responses", {
     method: "POST",
     headers,
-    body: JSON.stringify(internalBody),
+    body: internalBodyJson,
   });
 
   // Request-log wiring mirrors the /v1/responses route: native passthrough finalizes
@@ -683,8 +719,14 @@ export async function handleClaudeMessages(
     addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
   };
   const upstream = await handleResponses(internalReq, buildClaudeReplayConfig(config), logCtx, {
+    ...(logIds?.turnAdmissionLease ? { turnAdmissionLease: logIds.turnAdmissionLease } : {}),
     abortSignal: req.signal,
     promptCacheKeyIsSharedCohort: cacheKeySource === "system",
+    // The body is Responses-shaped by now, but the client spoke Anthropic Messages.
+    // Without this the replay would look native and a Responses-scoped wire default
+    // would fire, disagreeing with the pre-flight decision above.
+    inboundWire: "anthropic",
+    translatorBudget,
     ...(logIds ? { onFirstOutput: () => recordFirstOutput(logCtx, logIds.start) } : {}),
     onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForTerminalStatus(status), { terminalStatus: status, closeReason: "terminal" }),
     onNativePassthroughCancel: () => finalizeNativeLog(499, { closeReason: "client_cancel" }),
@@ -735,7 +777,7 @@ export async function handleClaudeMessages(
 
   const contentType = response.headers.get("content-type") ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
-    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel);
+    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, { translatorBudget });
     if (stream) {
       return new Response(anthropicSse, {
         status: 200,
@@ -746,8 +788,29 @@ export async function handleClaudeMessages(
         },
       });
     }
-    const message = await collectAnthropicMessage(anthropicSse, requestedModel);
+    let message: Rec;
+    try {
+      message = await collectAnthropicMessage(anthropicSse, requestedModel, translatorBudget);
+    } catch (error) {
+      if (isTranslatorBudgetExceededError(error)) {
+        return anthropicErrorResponse(413, error.message, "request_too_large", error.code);
+      }
+      return anthropicErrorResponse(502, error instanceof Error ? error.message : String(error), "api_error");
+    }
     const isError = (message as Rec).type === "error";
+    const translatedError = isError && typeof (message as Rec).error === "object"
+      ? (message as { error: { code?: unknown; message?: unknown } }).error
+      : undefined;
+    if (translatedError?.code === "translation_buffer_limit") {
+      return anthropicErrorResponse(
+        413,
+        typeof translatedError.message === "string"
+          ? translatedError.message
+          : "upstream translation buffer exceeded the safe limit",
+        "request_too_large",
+        "translation_buffer_limit",
+      );
+    }
     return new Response(JSON.stringify(message), {
       status: isError ? 502 : 200,
       headers: { "Content-Type": "application/json" },
@@ -763,7 +826,15 @@ export async function handleClaudeMessages(
   }
   const status = (json as Rec)?.status;
   if (status === "failed") {
-    const error = (json as { error?: { message?: string } }).error;
+    const error = (json as { error?: { message?: string; code?: string } }).error;
+    if (error?.code === "translation_buffer_limit") {
+      return anthropicErrorResponse(
+        413,
+        error.message ?? "upstream translation buffer exceeded the safe limit",
+        "request_too_large",
+        "translation_buffer_limit",
+      );
+    }
     return anthropicErrorResponse(502, error?.message ?? "upstream request failed", "api_error");
   }
   const message = responsesJsonToAnthropicMessage(json, requestedModel);
@@ -800,12 +871,13 @@ export async function handleClaudeCountTokens(req: Request, config: OcxConfig):
   if (disabled) return disabled;
 
   let body: unknown;
+  const translatorBudget = createTranslatorBudget();
   try {
-    body = await readAnthropicBody(req);
+    body = await readAnthropicBody(req, translatorBudget);
   } catch (err) {
     if (err instanceof AnthropicRequestError) return anthropicErrorResponse(400, err.message);
     return anthropicErrorResponse(500, err instanceof Error ? err.message : String(err));
-  }
+  } finally { translatorBudget.dispose(); }
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     return anthropicErrorResponse(400, "request body must be a JSON object");
   }