@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/server/responses/passthrough-delivery.ts

@@ -364,6 +364,7 @@ export async function deliverPassthroughResponse(
     | "subagentFallbackAccountId"
     | "clientRequestedStream"
     | "translatorBudget"
+    | "inboundWire"
   >,
   transportState: Pick<ResponsesTransport, "requestBindings">,
   sidecarState: Pick<ResponsesSidecarAuth, "openAiSidecar">,
@@ -428,7 +429,8 @@ export async function deliverPassthroughResponse(
     normalizeFunctionCompletionJson,
   } = nativeExchange;
   const { commitReasoningReplayServingRoute, recordTerminalOutcomes } = responseEffects;
-  const { parsed, route, subagentQuotaFailureModel, clientRequestedStream, translatorBudget } = requestState;
+  const { parsed, route, subagentQuotaFailureModel, clientRequestedStream, translatorBudget, inboundWire } = requestState;
+  const enforceDeclaredToolNames = inboundWire !== "chat" && inboundWire !== "anthropic";
   const { openAiSidecar } = sidecarState;
   const { requestBindings } = transportState;
 
@@ -637,6 +639,7 @@ export async function deliverPassthroughResponse(
         route.provider.webSearchBridge?.backend,
         config,
         openAiSidecar,
+        route.providerName,
       );
       const webSearchBridgePlan = planPassthroughWebSearchBridge(parsed, route.provider, {
         providerName: route.providerName,
@@ -836,6 +839,7 @@ export async function deliverPassthroughResponse(
             providerExecutedCallTypes,
             declaredBareWireToolNames,
             recoverableBareCustomWireToolNames,
+            enforceDeclaredToolNames,
           )
           : undefined,
         grokUpstreamEchoEnabled
@@ -1293,7 +1297,7 @@ export async function deliverPassthroughResponse(
       if (grokUpstreamEchoEnabled) {
         clientJson = stripGrokUpstreamEnvelopeEchoFromResponsesJson(clientJson);
       }
-      // #1700: same fail-closed policy as the SSE relay above. Both the plain JSON answer and
+      // #1700: same inbound-wire refusal policy as the SSE relay above. Both the plain JSON answer and
       // the reframed-SSE branch below are built from this body, so one check covers them. This
       // runs BEFORE the continuation cache write below: a refused turn must not become state a
       // later `previous_response_id` replay can expand from.
@@ -1312,7 +1316,7 @@ export async function deliverPassthroughResponse(
             return undefined;
           }
         })();
-        if (undeclared !== undefined) {
+        if (enforceDeclaredToolNames && undeclared !== undefined) {
           return formatErrorResponse(502, "upstream_error", undeclaredToolCallMessage(undeclared));
         }
         clientJson = normalizeDefaultNamespaceInJson(

package/src/server/responses/passthrough-dispatch.ts

@@ -163,6 +163,7 @@ import { ambiguousResendAllowanceFor, selfContainedResponsesBody } from "./reset
 import { upstreamErrorMessageFromPayload, ENCRYPTED_FUNCTION_OUTPUT_REJECTION } from "../../lib/errors";
 import { isTransientConsoleGoUploadRejection } from "../../providers/opencode-zen-rate-limit";
 import { planReasoningEffortDowngrade } from "../../providers/reasoning-metadata";
+import { unboundPoolSpendRefusalResponse } from "../workflow-refusal";
 
 /** Prepares and recovers one native Responses exchange before client commitment. */
 export async function preparePassthroughExchange(
@@ -214,6 +215,7 @@ export async function preparePassthroughExchange(
     ResponsesSendBudget,
     | "remainingTransientSendBudget"
     | "noteTransientSends"
+    | "transientSendReporter"
     | "recoverySendAllowance"
     | "recoveryClassFor"
     | "sendBudgetExhausted"
@@ -249,6 +251,7 @@ export async function preparePassthroughExchange(
   const {
     remainingTransientSendBudget,
     noteTransientSends,
+    transientSendReporter,
     recoverySendAllowance,
     recoveryClassFor,
     sendBudgetExhausted,
@@ -794,7 +797,10 @@ export async function preparePassthroughExchange(
      */
     const sendAmbiguousReplacement = (
       signal: AbortSignal = upstream.signal,
-    ): Promise<Response> => fetchWithHeaderTimeout(
+    ): Promise<Response> => {
+      const report = transientSendReporter();
+      let started = false;
+      const run = () => fetchWithHeaderTimeout(
       request.url,
       applyUpstreamRecoveryInit({
         method: request.method,
@@ -829,11 +835,17 @@ export async function preparePassthroughExchange(
           // Charged to the SAME request counter every other send goes through. The
           // replacement is bought here rather than by a nested retry helper, so there is
           // one charge for one send and no per-layer counter to reconcile.
-          noteTransientSends(1);
+          if (report.beforeSend?.() === false) throw new SendBudgetExhaustedError(safeHostLabel(request.url));
+          started = true;
         },
       }),
       route.provider.authMode === "forward",
     );
+      return (report.execute ? report.execute(run) : run()).finally(() => {
+        try { if (started) report(1); }
+        finally { report.close?.(); }
+      });
+    };
     /**
      * Refuse a built body that exceeds the operator's configured ceiling, before it is sent.
      *
@@ -891,7 +903,8 @@ export async function preparePassthroughExchange(
         releaseUpstreamHostAdmission(nativeHostState.lease);
         nativeHostState.lease = null;
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
-        return formatErrorResponse(429, "request_send_budget_exhausted", err.message);
+        return unboundPoolSpendRefusalResponse(logCtx)
+          ?? formatErrorResponse(429, "request_send_budget_exhausted", err.message);
       }
       const refusal = unwrapUpstreamRetryEvidenceError(err);
       // Pacing may outlive the selected account's admission. No fetch occurred, so do
@@ -991,7 +1004,7 @@ export async function preparePassthroughExchange(
             .then(adoptObservedResponse);
         },
         { abortSignal: upstream.signal, label: safeHostLabel(request.url),
-          attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends,
+          attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: transientSendReporter(),
           claimAmbiguousResend: claimPreHeaderResend,
         },
       );
@@ -1094,7 +1107,7 @@ export async function preparePassthroughExchange(
               .then(adoptObservedResponse);
           },
           { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: allowance.attempts,
-            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
+            onSendsConsumed: transientSendReporter(allowance.permit), claimAmbiguousResend: claimPreHeaderResend },
         );
       } catch (err) {
         return { failed: transportFailureResponse(err) };
@@ -1226,7 +1239,7 @@ export async function preparePassthroughExchange(
           },
           { abortSignal: upstream.signal, label: safeHostLabel(request.url),
             attempts: remainingTransientSendBudget(transientSendAttempts()),
-            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
+            onSendsConsumed: transientSendReporter(), claimAmbiguousResend: claimPreHeaderResend },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -1354,7 +1367,7 @@ export async function preparePassthroughExchange(
               .then(adoptObservedResponse);
           },
           { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()),
-            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
+            onSendsConsumed: transientSendReporter(), claimAmbiguousResend: claimPreHeaderResend },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -1489,7 +1502,7 @@ export async function preparePassthroughExchange(
               .then(adoptObservedResponse);
           },
           { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()),
-            onSendsConsumed: noteTransientSends, claimAmbiguousResend: claimPreHeaderResend },
+            onSendsConsumed: transientSendReporter(), claimAmbiguousResend: claimPreHeaderResend },
         );
       } catch (err) {
         return transportFailureResponse(err);

package/src/server/responses/request-prepare.ts

@@ -64,6 +64,7 @@ import type { OcxParsedRequest } from "../../types";
 import { buildToolBridgeMaps } from "./collaboration";
 import { parseRequest } from "../../responses/parser";
 import { anthropicSessionKeyFromParts } from "../../oauth/anthropic-routing";
+import { configuredAnthropicInstance } from "../../providers/anthropic-instance";
 import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
 import { bindTurnTerminationScope, rememberDeliveredFinalAnswer } from "../../responses/turn-termination";
 import { observeCacheDiagnosticInbound, rebindCacheDiagnosticBody, requestLogSpeedLabel, readConfiguredCodexServiceTier } from "../request-log";
@@ -74,6 +75,7 @@ import {
   routeCompactionModel,
   routeModel,
   NoEligiblePolicyCandidateError,
+  AnthropicSecondaryInstanceUnavailableError,
 } from "../../router";
 import { evidenceFromBody } from "../../routing/request-evidence";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
@@ -522,6 +524,23 @@ export async function prepareResponsesRequest(
   // or a subagent fallback rewrites it, so a refusal names the client's own
   // request rather than a destination it never asked for.
   const inboundSelector = parsed.modelId;
+  const selectorTargetsSecondary = (selector: string): boolean => {
+    const slash = selector.indexOf("/");
+    if (slash <= 0) return false;
+    const qualifier = selector.slice(0, slash);
+    // Match router precedence: exact custom keys (including uppercase names) win over aliases.
+    if (Object.hasOwn(config.providers, qualifier)) return qualifier === "anthropic2";
+    return qualifier === "anthropic2"
+      || config.providers.anthropic2?.alias?.trim().toLowerCase() === qualifier.toLowerCase();
+  };
+  const explicitlyRequestsSecondary = selectorTargetsSecondary(inboundSelector);
+  const secondaryProvider = config.providers.anthropic2;
+  // Reserve an explicit B selector before an absent row can default-route it to A.
+  // Combo parents have already dispatched above; concrete children retain their own target.
+  if (explicitlyRequestsSecondary && (!secondaryProvider || secondaryProvider.disabled === true
+    || secondaryProvider.authMode === "oauth" && configuredAnthropicInstance(config, "anthropic2") !== "anthropic2")) {
+    return formatErrorResponse(401, "authentication_error", "Anthropic Pool 2 requires an enabled configured provider");
+  }
   const admissionScope = resolveAdmissionModelScope(config, options.admission);
   const captureInboundRoutePolicy = (candidate: RouteResult, captureRequestPolicy = true): RouteResult => {
     // Every route this request path produces passes through here: the direct
@@ -553,11 +572,21 @@ export async function prepareResponsesRequest(
     // no canonical OpenAI route for (#2901). Only the initial compaction route
     // may fall back to the configured default provider; combo attempts and the
     // later fallback/recovery re-routes keep the ordinary reservation.
-    const routeInbound = (modelId: string) => concreteSelection
-      ? routeConcreteModel(config, modelId)
-      : parsed._compactionRequest === true
-        ? routeCompactionModel(config, modelId, evidenceFromBody(parsed._rawBody))
-        : routeModel(config, modelId, evidenceFromBody(parsed._rawBody));
+    const routeInbound = (modelId: string) => {
+      const resolved = concreteSelection
+        ? routeConcreteModel(config, modelId)
+        : parsed._compactionRequest === true
+          ? routeCompactionModel(config, modelId, evidenceFromBody(parsed._rawBody))
+          : routeModel(config, modelId, evidenceFromBody(parsed._rawBody));
+      // A Pool 2 selector may leave Pool 2 only through an operator-configured cross-provider
+      // blocked-model redirect, which the router marks as a credential-domain rewrite. Any other
+      // destination means the selector fell through to default resolution, which stays refused.
+      const operatorRedirect = resolved.routeReason === "blocked-model-redirect" && resolved.credentialDomainRewrite === true;
+      if (selectorTargetsSecondary(modelId) && resolved.providerName !== "anthropic2" && !operatorRedirect) {
+        throw new Error("Anthropic Pool 2 selector cannot use the default provider");
+      }
+      return resolved;
+    };
     const resolveRoute = (modelId: string) => captureInboundRoutePolicy(routeInbound(modelId));
     // The phase's destination. Resolved through the admission-scoped resolver every other route
     // uses, and it fails closed exactly like the shadow target: falling back to the native model
@@ -644,6 +673,9 @@ export async function prepareResponsesRequest(
     logCtx.routeDecision = route.routeDecision;
     logCtx.policyEligibility = route.policyEligibility;
   } catch (err) {
+    if (err instanceof AnthropicSecondaryInstanceUnavailableError) {
+      return formatErrorResponse(401, "authentication_error", err.message);
+    }
     const policyRefusal = policyCandidateRefusalResponse(err);
     if (policyRefusal) return policyRefusal;
     if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);

package/src/server/responses/request-send-budget.ts

@@ -1,11 +1,12 @@
+import { createInferenceSendBudget } from "../inference/context";
 import type { ResponsesRequestContext } from "./core-options";
-import { createRequestExecutionBudget, isRequestExecutionBudget } from "../../lib/request-execution-budget";
+import { claimDispatchSpendProof, createPhysicalSendReporter, createRequestExecutionBudget, isRequestExecutionBudget, reportDispatchSends } from "../../lib/request-execution-budget";
 import {
   chargeWorkflowSends,
   workflowSendCeilingReached,
   workflowSpendCeilingReached,
 } from "../../lib/workflow-budget";
-import { workflowRefusalResponse } from "../workflow-refusal";
+import { poolContinuityRefusalReason, workflowRefusalResponse } from "../workflow-refusal";
 import type { AttemptRecoveryKind, AttemptRecoveryWithheld } from "../../usage/log";
 import { noteAttemptRecoveryWithheld, noteAttemptSend } from "../request-log";
 import { TRANSIENT_RETRY_MAX_ATTEMPTS } from "../../lib/upstream-retry";
@@ -52,17 +53,27 @@ export function createResponsesSendBudget(
   // fresh default of 3. It is now a holder carried on options, so a combo child inherits the
   // parent's spend instead of starting over per target -- both halves of the measured
   // amplification in #4546.
-  const sendBudget = options.sendBudget ?? createRequestExecutionBudget();
+  const sendBudget = options.sendBudget ?? createInferenceSendBudget(req, logCtx);
   // The root workflow is the user-visible task. A per-request cap cannot bound a fan-out that
   // sends once per child seven hundred times, so every send charged to the request is charged
   // to the root as well (#4546).
   const workflowRootId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
-  const noteTransientSends = (used: number): void => {
+  const inheritedPermit = options.compactionRecoveryPermit ?? options.comboDispatchPermit;
+  let pendingHopPermit: SingleUseDispatchPermit | undefined = options.compactionRecoveryPermit;
+  const recordTransientSends = (used: number, permit?: SingleUseDispatchPermit): void => {
     const charged = Math.max(0, used);
-    sendBudget.used += charged;
+    reportDispatchSends(sendBudget, charged, permit);
     options.onCompactionRecoverySendsReported?.(charged);
     chargeWorkflowSends(workflowRootId, charged);
   };
+  const noteTransientSends = (used: number): void => recordTransientSends(used, pendingHopPermit ?? inheritedPermit);
+  // Capture at helper creation, before another leg can replace the pending handoff.
+  const transientSendReporter = (permit = pendingHopPermit ?? inheritedPermit) =>
+    createPhysicalSendReporter(sendBudget, () => ({ poolId: logCtx.spendPoolId ?? logCtx.provider,
+      identityId: logCtx.accountLogLabel }), permit, charged => {
+      options.onCompactionRecoverySendsReported?.(charged);
+      chargeWorkflowSends(workflowRootId, charged);
+    });
   // Refused before any dispatch, and deliberately not by evicting the root's ledger entry:
   // dropping the record to make room would hand the fan-out a fresh allowance, which is the
   // laundering this ceiling exists to stop. The client is told the task needs a new grant
@@ -78,7 +89,17 @@ export function createResponsesSendBudget(
   // returns -- a refusal an operator cannot tell from an ordinary budget exhaustion, on a
   // ceiling they configured themselves. Asked before dispatch, it names the scope and the
   // number instead. Returns undefined and touches no ledger when no ceiling is configured.
-  const spentCeiling = workflowSpendCeilingReached(workflowRootId);
+  // Passthrough reports sends after they leave. Invalid or conflicting identity evidence
+  // still refuses here as well as in reserve(), including requests with no workflow root.
+  // Positive unbound balances alone are instead overlaid on each candidate pool below.
+  const continuityRefusal = poolContinuityRefusalReason();
+  if (continuityRefusal) {
+    return workflowRefusalResponse(continuityRefusal, logCtx, undefined, workflowRootId);
+  }
+  const prepaid = isRequestExecutionBudget(sendBudget)
+    ? claimDispatchSpendProof(sendBudget, options.compactionRecoveryPermit ?? options.comboDispatchPermit) : undefined;
+  const admissionPolicy = isRequestExecutionBudget(sendBudget) ? sendBudget.spendAdmissionPolicy : undefined;
+  const spentCeiling = workflowSpendCeilingReached(workflowRootId, undefined, logCtx.spendPoolId ?? logCtx.provider, prepaid, admissionPolicy);
   if (spentCeiling) {
     return workflowRefusalResponse(
       "workflow-spend-exhausted",
@@ -157,7 +178,6 @@ export function createResponsesSendBudget(
    * refused and the request would answer with a synthetic 502 in place of the real 429 the hop
    * was recovering from.
    */
-  let pendingHopPermit: SingleUseDispatchPermit | undefined = options.compactionRecoveryPermit;
   /**
    * The budget an adapter's OWN dispatch ladder reserves against.
    *
@@ -171,19 +191,21 @@ export function createResponsesSendBudget(
    * The hop hands its reservation down through `pendingHopPermit`, the same seam the
    * passthrough ladder already uses, and this view spends it on the adapter's FIRST
    * reservation. Every later send in that ladder is a new physical send and is charged
-   * normally. A permit the adapter takes but never sends under is released through the same
-   * call it would have used for a reservation of its own, so an abandoned replay is refunded
-   * rather than left charged.
+   * normally. The refundable view below keeps an unused hop open until executor invocation;
+   * its adapter release hands back an abandoned replay. The ordinary view retains early
+   * settlement for existing callers.
    */
+  const claimHopPermit = (): SingleUseDispatchPermit | undefined => {
+    const permit = pendingHopPermit;
+    pendingHopPermit = undefined;
+    return permit;
+  };
   const adapterDispatchBudget: RequestExecutionBudget | undefined = adapterSendBudget === undefined
-    ? undefined
-    : adapterDispatchBudgetView(adapterSendBudget, {
-      claimHopPermit: () => {
-        const permit = pendingHopPermit;
-        pendingHopPermit = undefined;
-        return permit;
-      },
-    });
+    ? undefined : adapterDispatchBudgetView(adapterSendBudget, { claimHopPermit });
+  // Opt in only where the adapter's executor is the confirmation boundary. Ordinary callers
+  // keep the existing early settlement contract, including already-settled permit fallback.
+  const refundableAdapterDispatchBudget: RequestExecutionBudget | undefined = adapterSendBudget === undefined
+    ? undefined : adapterDispatchBudgetView(adapterSendBudget, { claimHopPermit }, true);
   /**
    * How many sends a recovery leg may make, and the permit that authorises the last one.
    *
@@ -268,6 +290,7 @@ export function createResponsesSendBudget(
   return {
     workflowRootId,
     noteTransientSends,
+    transientSendReporter,
     remainingTransientSendBudget,
     /**
      * Physical sends this logical request has already made.
@@ -279,6 +302,7 @@ export function createResponsesSendBudget(
     get sendsUsed(): number { return sendBudget.used; },
     adapterSendBudget,
     adapterDispatchBudget,
+    refundableAdapterDispatchBudget,
     noteAdapterPhysicalSend,
     noteAdapterRecoveryWithheld,
     sendBudgetExhausted,
@@ -312,8 +336,17 @@ export type ResponsesSendBudget = Exclude<ReturnType<typeof createResponsesSendB
 function adapterDispatchBudgetView(
   budget: RequestExecutionBudget,
   hop: { claimHopPermit: () => SingleUseDispatchPermit | undefined },
+  refundableHop = false,
 ): RequestExecutionBudget {
   return {
+    get physicalStarted() { return budget.physicalStarted; },
+    get physicalLimit() { return budget.physicalLimit; },
+    get spendEnforced() { return budget.spendEnforced; },
+    get spendPolicyStarted() { return budget.spendPolicyStarted; },
+    get spendAdmissionPolicy() { return budget.spendAdmissionPolicy; },
+    startRequest: target => budget.startRequest?.(target),
+    claimPhysicalSend: () => budget.claimPhysicalSend?.(),
+    beginSpendProducer: () => budget.beginSpendProducer?.(),
     get used(): number { return budget.used; },
     set used(next: number) { budget.used = next; },
     logicalRequestId: budget.logicalRequestId,
@@ -327,6 +360,7 @@ function adapterDispatchBudgetView(
     claimAmbiguousResend: (limit: number): boolean => budget.claimAmbiguousResend?.(limit) === true,
     get ambiguousResendSpent(): boolean { return budget.ambiguousResendSpent === true; },
     reserveDispatch(intent: DispatchIntent): DispatchDecision {
+      const refundable = refundableHop || budget.spendEnforced === true;
       // A dispatch whose upstream state is unknown is refused on its own merits. A hop that
       // already paid does not make an unsafe replay safe, so that check stays with the budget.
       if (intent.replaySafe !== false) {
@@ -338,30 +372,33 @@ function adapterDispatchBudgetView(
           hopPermit.release();
           return budget.reserveDispatch({ ...intent, sendClass: hopPermit.sendClass });
         }
-        // Confirmed here rather than in `use()`: the adapter reserves immediately before it
-        // opens the transport, which is the same boundary the hop's own confirmation uses.
-        // A permit some other leg already settled returns false, and this falls through to a
-        // real reservation rather than handing the adapter a dead permit -- an adapter whose
-        // `use()` fails treats the request as exhausted and stops sending entirely.
-        if (hopPermit !== undefined && hopPermit.assumeCharge()) {
-          let spent = false;
+        if (hopPermit !== undefined && (refundable || hopPermit.assumeCharge())) {
+          let settled = false;
+          let executionPermit = hopPermit;
+          const confirm = (): boolean => {
+            if (settled) return false;
+            settled = true;
+            // Admission can still reject this replay. Close its external booking only when
+            // the adapter invokes its executor, leaving release() able to refund it until then.
+            if (!refundable || hopPermit.assumeCharge()) return true;
+            // Preserve the old fallback for a permit another leg already settled.
+            const fresh = budget.reserveDispatch(intent);
+            if (!fresh.allowed) return false;
+            executionPermit = fresh.permit;
+            return fresh.permit.assumeCharge();
+          };
           return {
             allowed: true,
             permit: {
               sendClass: hopPermit.sendClass,
-              use: (): boolean => {
-                if (spent) return false;
-                spent = true;
-                return true;
-              },
-              assumeCharge: (): boolean => {
-                if (spent) return false;
-                spent = true;
-                return true;
+              execute: run => executionPermit.execute ? executionPermit.execute(run) : run(),
+              use: confirm,
+              assumeCharge: confirm,
+              release: (): void => {
+                if (!refundable || settled) return;
+                settled = true;
+                hopPermit.release();
               },
-              // The hop's charge is already settled and belongs to the leg that asked for it,
-              // so there is nothing here to refund.
-              release: (): void => {},
             },
           };
         }