@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/server/chat-native.ts

@@ -1,3 +1,5 @@
+import { createPhysicalSendReporter } from "../lib/request-execution-budget";
+import { createInferenceSendBudget } from "./inference/context";
 import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
 import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
 import { isNativeChatRouteEligible } from "./chat-native-eligibility";
@@ -17,7 +19,7 @@ import {
   isCyberPolicyMessage,
   SEND_BUDGET_EXHAUSTED_CODE,
 } from "../lib/errors";
-import type { RequestExecutionBudget } from "../lib/request-execution-budget";
+import { reportDispatchSends, type RequestExecutionBudget, type SingleUseDispatchPermit } from "../lib/request-execution-budget";
 import type { AdmissionLease } from "../lib/admission";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
@@ -198,6 +200,7 @@ export interface NativeChatExecution extends HandleNativeChatOptions {
    * the parent row, replace the one the final log settles.
    */
   sendBudget?: RequestExecutionBudget;
+  comboDispatchPermit?: SingleUseDispatchPermit;
   /** Replaces the request-relative first-output mark; a combo child records its own. */
   onFirstOutput?: () => void;
   /** The lease a streamed body holds; defaults to `logIds.turnAdmissionLease`. */
@@ -254,6 +257,7 @@ export function createNativeChatComboSource(input: {
       translatorBudget: input.translatorBudget,
       finishLog: child.finishLog,
       sendBudget: child.sendBudget,
+      comboDispatchPermit: child.comboDispatchPermit,
       onFirstOutput: child.onFirstOutput,
       ...(child.turnAdmissionLease ? { turnAdmissionLease: child.turnAdmissionLease } : {}),
     }, child.attemptHandle),
@@ -314,6 +318,7 @@ export async function runNativeChatAttempt(
   let activeProvider: OcxProviderConfig = route.provider;
   stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
   const spendTracker = sendBudget ? undefined : attachRequestSpendTracker(req, logCtx);
+  const physicalBudget = sendBudget ?? createInferenceSendBudget(req, logCtx);
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
   let activeRequest: AdapterRequest;
   let retainedRequestBytes = 0;
@@ -356,14 +361,16 @@ export async function runNativeChatAttempt(
   // key rotation so recovery cannot replace the ceiling along with the active credential.
   const requestTransientPolicy = transientRetryPolicyFor(activeProvider);
   let transientSendsUsed = 0;
-  // A combo child also answers to the request's shared base allowance, at the cap its own ladder
-  // uses. Its first send is exempt: the combo reserved it before dispatching this target.
+  // A Combo child's initial send is prepaid, not exempt from the shared ceiling. Only its
+  // owning permit exposes that one booking in addition to the still-unspent allowance, and only
+  // until this child's first physical send has started and settled the booking.
   const sharedSendCap = requestTransientPolicy?.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS;
   let physicalSends = 0;
+  let initialSendStarted = false;
   const remainingSharedSends = (): number => {
     if (!sendBudget) return Number.POSITIVE_INFINITY;
     const remaining = sendBudget.remainingBaseSends(sharedSendCap);
-    return physicalSends === 0 ? Math.max(1, remaining) : remaining;
+    return Math.min(sharedSendCap, remaining + (!initialSendStarted && execution.comboDispatchPermit ? 1 : 0));
   };
   const remainingTransientSends = (): number => Math.min(
     requestTransientPolicy
@@ -399,6 +406,21 @@ export async function runNativeChatAttempt(
     claimAmbiguousResend,
   );
 
+  // Non-enforced accounting for one physical send. Enforced spend is owned by the reporter.
+  const comboReceipt = Boolean(sendBudget && execution.comboDispatchPermit);
+  const settleNonEnforcedSend = (url: string): void => {
+    if (sendBudget) {
+      // Backstop for sends the helper cannot see coming (a reset replay). The first
+      // report settles the combo's booking; each later one is charged and booked.
+      if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
+        throw new SendBudgetExhaustedError(safeHostLabel(url));
+      }
+      physicalSends += 1;
+      reportDispatchSends(sendBudget, 1, execution.comboDispatchPermit);
+      initialSendStarted = true;
+    } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
+  };
+
   const send = async (
     request: AdapterRequest,
     recovery?: "rate-limit-429" | "key-429" | UpstreamSendRecovery,
@@ -428,6 +450,9 @@ export async function runNativeChatAttempt(
           providerFetch(activeProvider, undefined, {
             providerName: route.providerName,
             modelId: route.modelId,
+            onPhysicalDispatch: comboReceipt
+              ? () => { if (!physicalBudget.spendEnforced) settleNonEnforcedSend(request.url); }
+              : undefined,
             dispatchOverride: async (_input, init, execute) => {
               if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
                 const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
@@ -450,30 +475,41 @@ export async function runNativeChatAttempt(
               const encoding = new Headers(init.headers).get("accept-encoding");
               if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
               if (init.signal?.aborted) throw init.signal.reason;
-              if (sendBudget) {
-                // Backstop for sends the helper cannot see coming (a reset replay). The first
-                // report settles the combo's booking; each later one is charged and booked.
-                if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
-                  throw new SendBudgetExhaustedError(safeHostLabel(request.url));
+              const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
+                poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
+              }), execution.comboDispatchPermit);
+              let dispatched: Response;
+              try {
+                // Capture this request's spend policy at its first physical boundary, including
+                // observe-only starts; later configuration changes belong to later requests.
+                if (spendReport.beforeSend && !spendReport.beforeSend()) {
+                  if ((logCtx.spendTracker as { refusals?: number } | undefined)?.refusals) throw new NativeChatSpendRefusal();
+                  throw new SendBudgetExhaustedError();
                 }
-                physicalSends += 1;
-                sendBudget.used += 1;
-              } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
-              noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-              // A reselected provider transport is still a physical send: the connection policy
-              // and manual-redirect ownership wrap the selected implementation (#4992).
-              const dispatched = await sendWithConnectionPolicy(
-                (activeProvider as OcxProviderTransport).fetch ?? execute,
-                request.url,
-                applyUpstreamRecoveryInit({
-                  ...init, method: request.method, headers, body: request.body,
-                }, transportRecovery),
-                // Reselection can replace the provider transport and the wire shape, so the
-                // egress route is bound to the provider this send actually uses. Omitting it
-                // here would let a provider transport bypass its configured route entirely,
-                // because that transport wins over the executor that carries the binding.
-                { providerName: route.providerName, provider: activeProvider },
-              );
+                // Enforced spend started this send at `beforeSend`. A Combo child's non-enforced
+                // send is booked by the physical-dispatch receipt instead, so a local refusal
+                // before the wire refunds the booking rather than charging it.
+                if (physicalBudget.spendEnforced) initialSendStarted = true;
+                else if (!comboReceipt) settleNonEnforcedSend(request.url);
+                noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+                // A reselected provider transport is still a physical send: the connection policy
+                // and manual-redirect ownership wrap the selected implementation (#4992).
+                dispatched = await sendWithConnectionPolicy(
+                  (activeProvider as OcxProviderTransport).fetch ?? execute,
+                  request.url,
+                  applyUpstreamRecoveryInit({
+                    ...init, method: request.method, headers, body: request.body,
+                  }, transportRecovery),
+                  // Reselection can replace the provider transport and the wire shape, so the
+                  // egress route is bound to the provider this send actually uses. Omitting it
+                  // here would let a provider transport bypass its configured route entirely,
+                  // because that transport wins over the executor that carries the binding.
+                  { providerName: route.providerName, provider: activeProvider },
+                );
+              } finally {
+                try { if (physicalBudget.spendEnforced) spendReport(1); }
+                finally { spendReport.close?.(); }
+              }
               if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
               return dispatched;
             },
@@ -558,7 +594,7 @@ export async function runNativeChatAttempt(
     upstream.abort();
     if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
     const sendError = error instanceof UpstreamRetryEvidenceError ? error.cause : error;
-    if (sendBudget && sendError instanceof SendBudgetExhaustedError) {
+    if (sendError instanceof SendBudgetExhaustedError) {
       // A decision this process made, answered as the Responses path answers it: 429, not 502.
       return fail(429, sendError.message, SEND_BUDGET_EXHAUSTED_CODE, SEND_BUDGET_EXHAUSTED_CODE);
     }

package/src/server/claude-messages.ts

@@ -21,7 +21,8 @@ import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize"
 import { createToolCallIdAllocator } from "../adapters/tool-call-id";
 import { openAIChatSerializesThinking } from "../adapters/openai-chat/messages";
 import { messagesToResponsesTranslation } from "../protocols/codecs/messages";
-import { AnthropicRequestError, DesktopModelMappingUnavailableError, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
+import { AnthropicRequestError, DesktopModelMappingUnavailableError, extractOcxEffortDirective, extractOcxRouteDirective, nativeAnthropicProjection, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
+import { nativeReasoningTag, type NativeReasoningOwner } from "../responses/reasoning-replay-cache";
 import { isKnownDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
 import { resolveAlias, claudeCodeNativeAlias, legacyAliasForNative } from "../claude/alias";
 import { recordDesktopRequest } from "../claude/desktop-health";
@@ -41,6 +42,7 @@ import {
 } from "../lib/upstream-retry";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { anthropicRateLimitHeaders } from "./anthropic-rate-limit-headers";
+import { upstreamMessagesRequestIdHeaders } from "./messages-response-headers";
 import {
   anthropicErrorBody,
   anthropicErrorResponse,
@@ -80,7 +82,9 @@ import { upstreamWireForAdapter } from "../protocols/contract";
 import { createProtocolEnvelope, type ProtocolEnvelope } from "../protocols/envelope";
 import { featuresFromMessagesBody, type ProtocolFeature } from "../protocols/features";
 import { credentialDomainFor, messagesBodyHasOpaqueState } from "../protocols/opaque-state";
-import { hasAnthropicFailoverQuorum, anthropicSessionKeyFromParts } from "../oauth/anthropic-routing";
+import { anthropicRoutingFor, anthropicSessionKeyFromParts } from "../oauth/anthropic-routing";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
+import { messagesSelectorTargetsSecondaryInstance, messagesSecondaryInstanceUnavailable } from "./messages-native-selector";
 import { checkRepresentable, unrepresentableMessage } from "../protocols/guard";
 import { requestPathForLane } from "../protocols/path";
 import { resolveApiSurfaceSettings, resolveProtocolSettings } from "../protocols/settings";
@@ -244,6 +248,7 @@ function wantsNativePassthrough(
 ): model is string {
   if (cc?.nativePassthrough === false) return false;
   if (typeof model !== "string" || !/^(claude|anthropic)/i.test(model)) return false;
+  if (messagesSelectorTargetsSecondaryInstance(config, model, cc)) return false;
   // Authorization and x-api-key both belong to the upstream on this branch. An exposed listener
   // therefore requires the dedicated admission header even though the routed Messages surface
   // keeps accepting all three legacy admission forms.
@@ -631,7 +636,10 @@ async function anthropicNativePassthrough(
   const upstream = result.upstream;
 
   const contentType = upstream.headers.get("content-type") ?? "application/json";
-  const rateLimitHeaders = anthropicRateLimitHeaders(upstream.headers);
+  const rateLimitHeaders = {
+    ...anthropicRateLimitHeaders(upstream.headers),
+    ...(pathname === "/v1/messages" ? upstreamMessagesRequestIdHeaders(upstream.headers) : {}),
+  };
   const bodyGuard = resolvePassthroughBodyGuard(config, req.signal);
   if (upstream.ok && contentType.includes("text/event-stream") && upstream.body) {
     return new Response(tapAnthropicSseForLog(upstream.body, logCtx, finalize, bodyGuard), {
@@ -834,6 +842,7 @@ export async function handleClaudeMessages(
     return finalizeTranslatorBudgetResponse(
       await handleClaudeMessagesWithBudget(req, config, logCtx, translatorBudget, logIds, requestPolicy, ingress),
       translatorBudget,
+      req.signal,
     );
   } catch (error) {
     translatorBudget.dispose();
@@ -869,6 +878,9 @@ async function handleClaudeMessagesWithBudget(
   let anthropicBody: unknown;
   let internalBody: Rec;
   let cacheKeySource: ClaudeCacheKeySource = null;
+  let nativeReasoningReplay: ReadonlyMap<string, string> | undefined;
+  const nativeReasoningMint: { owner?: NativeReasoningOwner } = {};
+  let nativeProjectionOnlyError: AnthropicRequestError | undefined;
   let effortOverride: string | null = null;
   let effortRow: ParsedEffortRowId | null = null;
   let fastRow: ParsedFastRowId | null = null;
@@ -959,7 +971,20 @@ async function handleClaudeMessagesWithBudget(
     if (!effortRow && !fastRow && isRec(anthropicBody) && wantsNativePassthrough(req, config, requestPolicy, anthropicBody.model, cc)) {
       markProtocolEntry(logCtx, { inbound: "messages", lane: "native", features: messagesFeatures });
       recordProtocolShadowPlan(logCtx, config, { inbound: "messages", model: requestedModel });
-      return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
+      let projectedBody: Rec;
+      try {
+        projectedBody = nativeAnthropicProjection(anthropicBody, translatorBudget);
+      } catch (err) {
+        if (!isTranslatorBudgetExceededError(err)) throw err;
+        if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 413, { closeReason: "non_stream" });
+        return anthropicErrorResponse(413, "request translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");
+      }
+      return await anthropicNativePassthrough(req, config, logCtx, logIds, projectedBody, "/v1/messages");
+    }
+    if (isRec(anthropicBody) && typeof anthropicBody.model === "string"
+      && messagesSecondaryInstanceUnavailable(config, anthropicBody.model, cc)) {
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 401, { closeReason: "non_stream" });
+      return anthropicErrorResponse(401, "Configured Anthropic OAuth instance is unavailable", "authentication_error");
     }
     // Only Anthropic holds message-thread state; the error makes Claude Code resend the full turn.
     if (carriesMessageThread(anthropicBody)) {
@@ -1009,7 +1034,19 @@ async function handleClaudeMessagesWithBudget(
       };
       delete anthropicBody.thinking;
     }
-    const translation = messagesToResponsesTranslation(anthropicBody, cc, translatorBudget);
+    let translation;
+    try {
+      translation = messagesToResponsesTranslation(anthropicBody, cc, translatorBudget);
+    } catch (err) {
+      // A native Messages route can discard an undecodable proxy envelope. Keep the
+      // original error for any route that ultimately translates to Responses.
+      if (!(err instanceof AnthropicRequestError) || err.message !== "malformed ocxr1 reasoning signature"
+        || !isRec(anthropicBody)) throw err;
+      const projected = nativeAnthropicProjection(anthropicBody, translatorBudget);
+      if (projected === anthropicBody) throw err;
+      translation = messagesToResponsesTranslation(projected, cc, translatorBudget);
+      nativeProjectionOnlyError = err;
+    }
     internalBody = translation.body;
     // The Anthropic translator builds its body from model/input/store/stream plus sampling
     // fields only, so the caller intent is applied to the TRANSLATED body rather than the
@@ -1017,6 +1054,7 @@ async function handleClaudeMessagesWithBudget(
     if (fastRow) internalBody.service_tier = "priority";
     translatorBudget.chargeRetained(jsonUtf8Bytes(internalBody), { kind: "request_copies" });
     cacheKeySource = translation.cacheKeySource;
+    nativeReasoningReplay = translation.nativeReasoningReplay;
   } catch (err) {
     const overflow = isTranslatorBudgetExceededError(err);
     const unavailable = err instanceof DesktopModelMappingUnavailableError;
@@ -1148,15 +1186,25 @@ async function handleClaudeMessagesWithBudget(
 
   // PF-08: a managed-key Anthropic route sends its Messages body natively. The caller-forward
   // passthrough above was decided on the caller's own credential and never reaches this point.
+  const settledInstance = configuredAnthropicInstance(config, settledRoute?.providerName);
+  if (settledRoute?.providerName === "anthropic2" && settledRoute.provider.authMode === "oauth" && !settledInstance) {
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 401, { closeReason: "non_stream" });
+    return anthropicErrorResponse(401, "Configured Anthropic OAuth instance is unavailable", "authentication_error");
+  }
   const nativeSelector: NativeMessagesSelector = {
     effortRow: !!effortRow, fastRow: !!fastRow, routeSelector: String(internalBody.model ?? ""), claudeCode: cc,
     // PF-10: a stored second OAuth account turns on the bridge's rotation, so it stays there.
-    ...(settledRoute?.provider.authMode === "oauth" ? { oauthFailoverQuorum: hasAnthropicFailoverQuorum() } : {}),
+    ...(settledRoute?.provider.authMode === "oauth" && settledInstance
+      ? { oauthFailoverQuorum: anthropicRoutingFor(settledInstance).hasAnthropicFailoverQuorum() } : {}),
   };
   const nativeDecline = settledRoute && isRec(anthropicBody)
     ? nativeMessagesDeclineReason(settledRoute, anthropicBody, config, nativeSelector)
     : "rollout-disabled";
   const nativeMessagesRoute = settledRoute && nativeDecline === undefined ? settledRoute : undefined;
+  if (nativeProjectionOnlyError && !nativeMessagesRoute) {
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
+    return anthropicErrorResponse(400, nativeProjectionOnlyError.message, "invalid_request_error");
+  }
   // With the switch on, a declined route says why on its bridge mark, as native Chat does.
   if (nativeDecline && nativeDecline !== "rollout-disabled") {
     markProtocolEntry(logCtx, {
@@ -1195,7 +1243,7 @@ async function handleClaudeMessagesWithBudget(
     let nativeBody: Rec;
     try {
       // Built from the source envelope when there is one, after the managed-client steps above.
-      nativeBody = envelope ? envelope.freshBody() : anthropicBody as Rec;
+      nativeBody = nativeAnthropicProjection(envelope ? envelope.freshBody() : anthropicBody as Rec, translatorBudget);
     } catch (err) {
       if (!isTranslatorBudgetExceededError(err)) throw err;
       if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 413, { closeReason: "non_stream" });
@@ -1300,6 +1348,8 @@ async function handleClaudeMessagesWithBudget(
     // Without this the replay would look native and a Responses-scoped wire default
     // would fire, disagreeing with the pre-flight decision above.
     inboundWire: "anthropic",
+    nativeReasoningReplay,
+    nativeReasoningMint,
     claudeGoAffinity: { sessionLane: claudeGoSessionLane },
     claudeNativeSessionId,
     stripClaudeMainAuthForNoncanonicalForward: true,
@@ -1381,6 +1431,7 @@ async function handleClaudeMessagesWithBudget(
   if (contentType.includes("text/event-stream") && response.body) {
     const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, {
       translatorBudget,
+      nativeReasoningTagFor: blob => nativeReasoningTag(nativeReasoningMint.owner, blob),
       // Only a floor, and only for the first frame: an upstream that reports usage early wins
       // over it inside the translator, and the terminal `message_delta` carries the
       // authoritative count either way (#4857).
@@ -1450,7 +1501,7 @@ async function handleClaudeMessagesWithBudget(
   }
   let message: Rec;
   try {
-    message = responsesJsonToAnthropicMessage(json, requestedModel, translatorBudget);
+    message = responsesJsonToAnthropicMessage(json, requestedModel, translatorBudget, blob => nativeReasoningTag(nativeReasoningMint.owner, blob));
   } catch (err) {
     if (!isTranslatorBudgetExceededError(err)) throw err;
     return anthropicErrorResponse(413, "upstream translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");

package/src/server/gui-static.ts

@@ -20,12 +20,46 @@ const MIME_TYPES: Record<string, string> = {
  */
 const HASHED_ASSET_PATTERN = /-[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9]+$/;
 
-export function findGuiDist(): string | null {
+/** `productName` in desktop/src-tauri/tauri.conf.json; Linux packages install resources under `lib/<productName>`. */
+export const DESKTOP_PRODUCT_NAME = "OpenCodex";
+
+/**
+ * Where a compiled `ocx` looks for `gui/dist`, given the directory holding the executable.
+ *
+ * Beside the binary covers a release archive and the Windows desktop install. The desktop shell
+ * ships `ocx` as a sidecar and its resources where Tauri's `resource_dir` puts them: `../Resources`
+ * inside a macOS app bundle, `../lib/<productName>` for a Linux package (`/usr/bin`, `/usr/local/bin`,
+ * an AppImage's `usr/bin`). The shell passes that directory as OPENCODEX_GUI_DIST only to the sidecar
+ * it starts itself; `ocx ensure` from the Codex shim and the login service start the same binary
+ * without the variable, so they find the dashboard here.
+ */
+export function standaloneGuiDistCandidates(executableDir: string, platform: NodeJS.Platform = process.platform): string[] {
+  const candidates = [join(executableDir, "gui", "dist")];
+  if (platform === "darwin") candidates.push(join(executableDir, "..", "Resources", "gui", "dist"));
+  if (platform === "linux") candidates.push(join(executableDir, "..", "lib", DESKTOP_PRODUCT_NAME, "gui", "dist"));
+  return candidates;
+}
+
+/** Overrides for tests; production callers pass nothing and get this process's own layout. */
+export interface GuiDistLookup {
+  /** Directory holding a compiled `ocx`, or null when running from source. */
+  standaloneDir?: string | null;
+  platform?: NodeJS.Platform;
+  /** Directory of this module; a source checkout's `gui/dist` is resolved from it. */
+  moduleDir?: string;
+}
+
+/** Lookup only: checks for `index.html` and never creates, copies or builds anything. */
+export function findGuiDist(lookup: GuiDistLookup = {}): string | null {
+  const standaloneDir = lookup.standaloneDir === undefined
+    ? (isStandaloneBinary() ? standaloneRoot() : null)
+    : lookup.standaloneDir;
+  const moduleDir = lookup.moduleDir ?? import.meta.dir;
   const candidates = [
     process.env.OPENCODEX_GUI_DIST,
-    ...(isStandaloneBinary() ? [join(standaloneRoot(), "gui", "dist")] : []),
-    join(import.meta.dir, "..", "..", "gui", "dist"),
-    join(import.meta.dir, "..", "..", "..", "gui", "dist"),
+    ...(standaloneDir === null ? [] : standaloneGuiDistCandidates(standaloneDir, lookup.platform)),
+    join(moduleDir, "..", "..", "gui", "dist"),
+    join(moduleDir, "..", "..", "..", "gui", "dist"),
   ].filter((candidate): candidate is string => Boolean(candidate));
   for (const c of candidates) {
     if (existsSync(join(c, "index.html"))) return c;

package/src/server/inbound-body-admission.ts

@@ -181,6 +181,7 @@ export function runAdmittedBodyWork(
       addFinalRequestLog(refusalLog.requestId, refusalLog.start, refusalLog.logCtx, refused.status, {
         closeReason: "terminal",
       });
+      refusalLog.onLogged?.();
     }
     return withCors(refused, req, policy);
   });

package/src/server/index/claude-intercept-lifecycle.ts

@@ -41,10 +41,11 @@ export function buildInterceptDesiredClients(config: OcxConfig, observed: Claude
  * imports keep the catalog and discovery off the synchronous startup path.
  */
 export async function loadPickerRoutesFromCatalog(): Promise<PickerRouteInput> {
-  const [{ loadConfig }, { fetchAllModels }, catalog] = await Promise.all([
+  const [{ loadConfig }, { fetchAllModels }, catalog, { resolveAutoContext }] = await Promise.all([
     import("../../config"),
     import("../management-api"),
     import("../../codex/catalog"),
+    import("../../claude/context-windows"),
   ]);
   const config = loadConfig();
   const models = await fetchAllModels(config);
@@ -54,6 +55,7 @@ export async function loadPickerRoutesFromCatalog(): Promise<PickerRouteInput> {
       .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow })),
     ...(config.claudeCode?.desktopProfile ? { profile: config.claudeCode.desktopProfile } : {}),
     nativeContextCap: catalog.nativeContextLimits(config),
+    auto: resolveAutoContext(config.claudeCode),
   };
 }
 

package/src/server/index/serve-options.ts

@@ -21,6 +21,7 @@ import {
 } from "./live-sideband";
 import {
   withRequestLogId,
+  withMessagesRequestLogId,
 } from "./startup-warnings";
 
 import { remoteWorkspaceEnabled } from "../../remote-control/workspace-activation";
@@ -118,6 +119,7 @@ import { handleChatCompletions } from "../chat-completions";
 import { anthropicErrorResponse } from "../../claude/outbound";
 import {
   buildDesktop3pRegistry,
+  desktop3pModelOptions,
   generateDesktop3pModels,
 } from "../../claude/desktop-3p";
 import { buildDesktopDiscoveryInputs } from "../../claude/desktop-discovery-inputs";
@@ -1024,6 +1026,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             const models = config.claudeCode?.enabled === false ? [] : generateDesktop3pModels(
               desktopInputs.nativeSlugs, desktopInputs.routedModels,
               config.claudeCode?.desktopProfile, desktopInputs.nativeContextCap,
+              desktop3pModelOptions(config.claudeCode),
             );
             const response = jsonResponse({ version: 1, models }, 200, req, policy);
             response.headers.set("Cache-Control", "no-store");
@@ -1556,11 +1559,16 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // pre-translation stream + native passthrough callbacks) — do not re-wrap the
         // translated Anthropic stream here.
         const sessionReq = withCallerSessionIdentity(req, admission);
-        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
+        // Entering the handler, or a logged refusal, means the final request log owns requestId.
+        let ownsRequestLog = false;
+        const claimRequestLog = (work: (lease: ActiveTurnLease) => Promise<Response>) =>
+          (lease: ActiveTurnLease) => { ownsRequestLog = true; return work(lease); };
+        const response = await runAdmittedHttpTurn(sessionReq, policy, claimRequestLog(async turnAdmissionLease => withCors(
           await handleClaudeMessages(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy, { claudeIntercept: ingress === "claude-intercept" }),
           req,
           policy,
-        ), { requestId, start, logCtx });
+        )), { requestId, start, logCtx, onLogged: () => { ownsRequestLog = true; } });
+        return ownsRequestLog ? withMessagesRequestLogId(response, requestId) : response;
       }
 
       // OpenAI Chat Completions inbound (GitHub Copilot App / OpenAI-compatible clients).

package/src/server/index/spend-ledger-lifecycle.ts

@@ -6,6 +6,7 @@ import {
 import {
   configureSharedSpendLedger,
   spendPolicyFromConfig,
+  waitForSharedSpendReporterDrain,
 } from "../../lib/spend-reservation-ledger";
 import { warnIfSyncedStateDirectory } from "../../lib/synced-state-location";
 
@@ -26,7 +27,7 @@ export function waitForFailedStartRollback(error: unknown): Promise<void> {
 }
 
 export interface SpendLedgerServerLifecycle {
-  configure(spend: OcxSpendConfig | undefined): void;
+  configure(spend: OcxSpendConfig | undefined, poolAliases?: unknown, providerIds?: readonly string[]): void;
   track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T;
   release(): void;
   releaseAfterFailedStart(): Promise<void>;
@@ -36,7 +37,8 @@ export interface SpendLedgerServerLifecycle {
 export function acquireSpendLedgerServerLifecycle(configDir: string): SpendLedgerServerLifecycle {
   const owner: SpendLedgerOwnerLease = acquireSpendLedgerOwner(configDir);
   // Advisory: a synced state directory makes the journal's hard-link guard refuse intermittently
-  // (#6314). Said once at startup instead of being discovered from a 502.
+  // (#6314), including Google Drive syncing the native Desktop or Documents folder. Said once
+  // at startup instead of being discovered from a 502. The nlink guard itself is unchanged.
   warnIfSyncedStateDirectory(configDir);
   // Each entry returns whatever the listener's own stop returned. Typed as void-or-promise
   // because the rollback below has to WAIT on it: declaring it `() => void` let the call site
@@ -49,13 +51,18 @@ export function acquireSpendLedgerServerLifecycle(configDir: string): SpendLedge
     owner.release();
   };
   return {
-    configure(spend): void {
-      configureSharedSpendLedger(spendPolicyFromConfig(spend));
+    configure(spend, poolAliases, providerIds): void {
+      configureSharedSpendLedger(spendPolicyFromConfig(spend, poolAliases, providerIds));
     },
     track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T {
       // Capture the raw stop before startServer replaces the public method with full teardown.
       const stop = server.stop.bind(server);
-      failedStartStops.push(() => stop(true));
+      const drainedStop = async (closeActiveConnections?: boolean): Promise<void> => {
+        await stop(closeActiveConnections);
+        await waitForSharedSpendReporterDrain();
+      };
+      Object.defineProperty(server, "stop", { configurable: true, value: drainedStop });
+      failedStartStops.push(() => drainedStop(true));
       return server;
     },
     release,

package/src/server/index/startup-warnings.ts

@@ -100,6 +100,25 @@ import {
 
 const REQUEST_LOG_ID_RESPONSE_HEADER = "x-opencodex-request-id";
 
+/** Messages clients persist request-id; the upstream diagnostic id has a separate namespace. */
+export function withMessagesRequestLogId(response: Response, requestId: string): Response {
+  const upstreamId = response.headers.get("request-id");
+  const correlated = withRequestLogId(response, requestId);
+  correlated.headers.delete("x-opencodex-upstream-request-id");
+  if (upstreamId && /^req_[A-Za-z0-9_-]{1,128}$/.test(upstreamId)) {
+    correlated.headers.set("x-opencodex-upstream-request-id", upstreamId);
+  }
+  correlated.headers.set("request-id", requestId);
+  const exposed = correlated.headers.get("Access-Control-Expose-Headers") ?? "";
+  const names = exposed.split(",").map(name => name.trim().toLowerCase());
+  const additions = ["request-id", ...(correlated.headers.has("x-opencodex-upstream-request-id")
+    ? ["x-opencodex-upstream-request-id"] : [])].filter(name => !names.includes(name));
+  if (additions.length) {
+    correlated.headers.set("Access-Control-Expose-Headers", [exposed, ...additions].filter(Boolean).join(", "));
+  }
+  return correlated;
+}
+
 export function withRequestLogId(response: Response, requestId: string): Response {
   const headers = new Headers(response.headers);
   headers.set(REQUEST_LOG_ID_RESPONSE_HEADER, requestId);

package/src/server/index.ts

@@ -302,7 +302,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(config.appOwnedMemoryBudgetMb));
   enforceAppOwnedMemoryBudget();
   // Observe-only mode still journals physical sends, so every server owns before configuring.
-  spendLedgerLifecycle.configure(config.spend);
+  spendLedgerLifecycle.configure(config.spend, config.spendPoolAliases, Object.keys(config.providers));
   // After ownership: a second server on the same home is refused above, so the process running
   // this line is the only one appending to usage.jsonl and the only one that may compact it.
   setUsageLedgerRetention(config.usageLedgerMaxBytes);
@@ -505,7 +505,9 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
     if (!lease) return serverBusyResponse(req, "active turns", policy);
     // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
-    const workflow = admitHttpWorkflowTurn(req.headers);
+    let workflow: ReturnType<typeof admitHttpWorkflowTurn>;
+    try { workflow = admitHttpWorkflowTurn(req.headers); }
+    catch (error) { lease.release(); throw error; }
     if (workflow && !workflow.admitted) {
       lease.release();
       // withCors, because without Access-Control-Allow-Origin the exposed refusal header is
@@ -748,6 +750,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   Object.defineProperty(server, "stop", {
     configurable: true,
     value: async (closeActiveConnections?: boolean): Promise<void> => {
+      backgroundLifecycle?.revokeClientFanout();
       remoteWorkspaceStopping = true;
       liveCallBindings.clear();
       // Disarm the package-tree restart timer before teardown can schedule another restart.

package/src/server/inference/context.ts

@@ -34,7 +34,7 @@ export function createInferenceSendBudget(
 export function expandInferenceOAuthSendBudget(budget: TransientSendBudget | undefined, accounts: number): void {
   if (!budget) return;
   const policy = ingressPolicies.get(budget);
-  if (!policy || budget.used !== 0) return;
+  if (!policy || budget.used !== 0 || ("physicalStarted" in budget && Number(budget.physicalStarted) > 0)) return;
   ingressPolicies.delete(budget);
   if (accounts < 2 || !Number.isSafeInteger(accounts)) return;
   const sends = Math.min(accounts, GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST) * TRANSIENT_RETRY_MAX_ATTEMPTS;

package/src/server/lifecycle.ts

@@ -479,7 +479,7 @@ export async function drainAndShutdown(
   beginBackgroundShellShutdown();
   try {
     while (admittedTurns.size > 0 && Date.now() < deadline) {
-      await Bun.sleep(100);
+      await Bun.sleep(Math.min(100, Math.max(0, deadline - Date.now())));
     }
     if (admittedTurns.size > 0) {
       console.warn(`⚠️  Aborting ${admittedTurns.size} in-flight turn(s) after ${timeoutMs}ms deadline`);