@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/server/messages-native.ts

@@ -1,3 +1,5 @@
+import { createPhysicalSendReporter } from "../lib/request-execution-budget";
+import { createInferenceSendBudget } from "./inference/context";
 /**
  * Managed native Messages lane (PF-08, behind `protocols.rollout.managedMessagesNative`).
  *
@@ -17,32 +19,36 @@
  *
  * Loaded lazily by `claude-messages.ts` only when the switch is on and a route is eligible.
  */
-import { resolveAnthropicModelRoute } from "../oauth/anthropic-model-routes";
-import { bindAnthropicRefusalCredential, rotateAnthropicAccountOnResponse } from "../oauth/anthropic-account-refusal";
-import { claimAnthropicFamilyRevalidation } from "../oauth/anthropic-model-quota";
+import { resolveAnthropicModelRouteForInstance } from "../oauth/anthropic-model-routes";
+import { bindAnthropicRefusalCredentialForSend, rotateAnthropicAccountOnResponseForInstance } from "../oauth/anthropic-account-refusal";
+import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIsCurrent,
+  type AnthropicPhysicalSendOwnership } from "../oauth/anthropic-send-ownership";
+import { anthropicModelQuotaFor } from "../oauth/anthropic-model-quota";
 import { captureConfigGeneration } from "../lib/state-store-sweeper";
-import { recordAnthropicAccountQuotaFromHeaders } from "../providers/quota";
+import { recordAnthropicAccountQuotaFromHeadersForInstance } from "../providers/quota";
 import { credentialGeneration, getAccountCredentialWithStatus } from "../oauth/store";
 import { ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST } from "../oauth/anthropic-routing";
 import { enforceAnthropicImageLimits } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
-import { formatAnthropicErrorBody } from "../adapters/anthropic";
+import { formatAnthropicErrorBody, resolveAnthropicMessagesUrl } from "../adapters/anthropic";
 import {
   anthropicMessagesNativeWireBody,
   buildAnthropicMessagesPassthroughRequest,
   type AnthropicMessagesPassthroughRequest,
 } from "../adapters/anthropic/passthrough";
-import { resolveInboundModel } from "../claude/inbound";
-import { anthropicErrorBody, anthropicErrorResponse, collectAnthropicMessage } from "../claude/outbound";
+import { effortFromOutputConfig, resolveInboundModel } from "../claude/inbound";
+import { anthropicErrorBody, anthropicErrorResponse, claudeOverflowSsePayload, claudePromptTooLongMessage, collectAnthropicMessage, isContextOverflowText, isThroughputLimitText } from "../claude/outbound";
 import type { AdmissionLease } from "../lib/admission";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { classifyError } from "../lib/errors";
+import { relaySseWithPayloadRewrite } from "./sse-payload-rewrite";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { isTranslatorBudgetExceededError, type TranslatorBudget } from "../lib/translator-budget";
 import {
   applyReplayRefusalClientHeaders,
   applyUpstreamRecoveryInit,
+  SendBudgetExhaustedError,
   fetchWithResetRetry,
   fetchWithTransientRetry,
   isNonReplayableResponse,
@@ -67,12 +73,13 @@ import {
 } from "../providers/key-failover";
 import { stampApiKeyAccountLabel } from "../providers/label";
 import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../oauth";
-import { AnthropicAccountCooldownError, formatAnthropicProviderForLog, hasAnthropicFailoverQuorum } from "../oauth/anthropic-routing";
+import { AnthropicAccountCooldownError, formatAnthropicProviderForLog, anthropicRoutingFor } from "../oauth/anthropic-routing";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
 import { resolveProtocolSettings } from "../protocols/settings";
 import { addProtocolEntryReason, markProtocolBlocked } from "../protocols/trace";
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import { preservesPhysicalComboProvider, resolveComboId } from "../combos";
-import { captureRouteStaticPolicy, routeModel, type RouteResult } from "../router";
+import { captureRouteStaticPolicy, routedProviderConfig, routeModel, type RouteResult } from "../router";
 import { POLICY_NAMESPACE, resolvePolicyProfileId } from "../routing/profile";
 import type { AnthropicClientIdentity } from "../adapters/anthropic/client-identity";
 import type { OcxConfig, OcxProviderConfig, OcxUsage } from "../types";
@@ -88,11 +95,12 @@ import { beginInferenceAttempt } from "./inference/attempt";
 import { createFinalRequestLog, type FinalRequestLogMeta } from "./inference/final-log";
 import { registerTurn, unregisterTurn } from "./lifecycle";
 import { nativeMessagesDeclineReason, type NativeMessagesSelector } from "./messages-native-eligibility";
+import { messagesSecondaryInstanceUnavailable } from "./messages-native-selector";
 import {
   nativeOAuthBindingIsCurrent,
   NativeOAuthSelectionChangedError,
   NativeOAuthModelRouteError,
-  resolveNativeOAuthBinding,
+  resolveNativeOAuthBindingForInstance,
   restoreOAuthToolNamesInMessage,
   restoreOAuthToolNamesInSse,
   type NativeOAuthBinding,
@@ -100,6 +108,7 @@ import {
 import {
   noteProviderAttemptSend,
   recordAttemptCredentialSource,
+  recordAttemptRequestedEffort,
   recordFirstOutput,
   recordKeyAttemptFailure,
   recordKeyWireAttemptUsage,
@@ -112,6 +121,7 @@ import { workflowRefusalResponse } from "./workflow-refusal";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { admissionModelDeniedResponse, type AdmissionModelScope } from "./admission-model-scope";
 import { nativeMessagesToolScopeDenial } from "./messages-native-scope";
+import { retainUpstreamMessagesRequestId } from "./messages-response-headers";
 
 export {
   isNativeMessagesRouteEligible,
@@ -300,14 +310,25 @@ async function prepareNativeBody(body: Rec, signal: AbortSignal): Promise<void>
  */
 export async function handleNativeMessages(options: HandleNativeMessagesOptions): Promise<Response> {
   const { req, config, logCtx, logIds, route, body, requestedModel, translatorBudget } = options;
+  const nativeInstance = configuredAnthropicInstance(config, route.providerName);
   const requestedStream = body.stream === true;
   logCtx.inboundProtocol = "messages";
   logCtx.model = route.modelId;
   logCtx.provider = route.providerName;
+  logCtx.spendPoolId = route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
   logCtx.requestedModel = requestedModel;
   if (route.routeReason === "model-alias" || route.modelId !== requestedModel) logCtx.requestedAlias = requestedModel;
   logCtx.requestedServiceTier = typeof body.service_tier === "string" ? body.service_tier : undefined;
+  if (logCtx.requestedEffort === undefined) {
+    const effort = effortFromOutputConfig(body.output_config);
+    const thinking = isRec(body.thinking) ? body.thinking : undefined;
+    const budget = thinking?.budget_tokens;
+    if (effort !== undefined) logCtx.requestedEffort = effort;
+    else if (thinking?.type === "disabled") logCtx.requestedEffort = "none";
+    else if (thinking?.type === "enabled" && typeof budget === "number"
+      && Number.isSafeInteger(budget) && budget > 0) logCtx.requestedEffort = `budget:${budget}`;
+  }
   // Reserve spend the way native Chat does: an input estimate that never enters usage, and the
   // caller's own output ceiling.
   if (logCtx.usageLogInputTokens === undefined) {
@@ -323,6 +344,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     adapter: "anthropic",
   });
   attemptHandle.seal(logCtx.accountLogLabel);
+  recordAttemptRequestedEffort(logCtx);
   const { attempt } = attemptHandle;
   const finalLog = createFinalRequestLog(logIds, logCtx);
   const finishLog: FinishLog = (status, message, meta = { closeReason: "non_stream" }) => {
@@ -353,11 +375,18 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     return null;
   };
 
+  if (route.provider.authMode === "oauth" && !nativeInstance) {
+    return fail(401, "Configured Anthropic OAuth instance is unavailable", "authentication_error");
+  }
+
   const toolScopeDenial = nativeMessagesToolScopeDenial(options.modelScope, route.providerName, requestedModel, body);
   if (toolScopeDenial) {
     finishLog(403, toolScopeDenial.message);
     return admissionModelDeniedResponse(toolScopeDenial);
   }
+  let routeTarget: string;
+  try { routeTarget = resolveAnthropicMessagesUrl(route.provider); }
+  catch { return fail(400, "Invalid Anthropic Messages destination", "invalid_request_error"); }
 
   try {
     await prepareNativeBody(body, req.signal);
@@ -391,7 +420,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   const oauthProvider = (binding: NativeOAuthBinding): OcxProviderConfig => ({ ...route.provider, apiKey: binding.snapshot.accessToken });
   if (route.provider.authMode === "oauth") {
     try {
-      oauthBinding = await resolveNativeOAuthBinding(config, { sessionKey: options.sessionKey, model: route.modelId });
+      oauthBinding = await resolveNativeOAuthBindingForInstance(nativeInstance!, config, { routeTarget, sessionKey: options.sessionKey, model: route.modelId });
     } catch (error) {
       cleanupAbort();
       upstream.abort();
@@ -411,6 +440,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
   if (oauthBinding) logCtx.provider = formatAnthropicProviderForLog(route.providerName, oauthBinding.snapshot.accountId, config);
   const spendTracker = attachRequestSpendTracker(req, logCtx);
+  const physicalBudget = createInferenceSendBudget(req, logCtx);
   let activeRequest: AnthropicMessagesPassthroughRequest;
   let retainedRequestBytes = 0;
   const releaseRetainedRequest = () => {
@@ -473,8 +503,17 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     : Number.POSITIVE_INFINITY;
   const transientSendAvailable = (): boolean => remainingTransientSends() > 0;
   const selector: NativeMessagesSelector = options.selector ?? {};
+  const nativeOAuthRouteIsCurrent = (binding: NativeOAuthBinding): boolean => {
+    const provider = config.providers[binding.instance];
+    if (configuredAnthropicInstance(config, binding.instance) !== binding.instance || !provider) return false;
+    // Same normalization as the bound target (nativeOAuthRouteTarget): compare routed destinations.
+    let routed: OcxProviderConfig;
+    try { routed = routedProviderConfig(binding.instance, provider); } catch { return false; }
+    return resolveAnthropicMessagesUrl(routed) === routeTarget
+      && nativeMessagesDeclineReason({ ...route, provider: routed }, body, config, selector) === undefined;
+  };
 
-  const send = async (recovery?: "rate-limit-429" | "oauth-account-403" | "key-429" | "key-401"): Promise<Response> => {
+  const send = async (recovery?: "rate-limit-429" | "oauth-401" | "oauth-account-403" | "key-429" | "key-401"): Promise<Response> => {
     const remaining = remainingTransientSends();
     if (requestTransientPolicy && remaining <= 0) {
       throw new Error("native Messages transient send budget exhausted before recovery dispatch");
@@ -493,12 +532,13 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
           modelId: route.modelId,
           dispatchOverride: async (_input, init, execute) => {
             if (oauthBinding) {
+              if (!nativeOAuthRouteIsCurrent(oauthBinding)) throw new NativeOAuthSelectionChangedError();
               // The OAuth twin of the key check below: re-resolve through the same selection
               // owner when the committed account or its credential moved since the build.
               for (let attempt = 0; !nativeOAuthBindingIsCurrent(oauthBinding); attempt++) {
                 if (attempt >= 3) throw new NativeOAuthSelectionChangedError();
                 try {
-                  oauthBinding = await resolveNativeOAuthBinding(config, { sessionKey: options.sessionKey, model: route.modelId });
+                  oauthBinding = await resolveNativeOAuthBindingForInstance(nativeInstance!, config, { routeTarget, sessionKey: options.sessionKey, model: route.modelId });
                 } catch (error) {
                   if (error instanceof OAuthAccountPausedError || error instanceof OAuthLoginRequiredError
                     || error instanceof AnthropicAccountCooldownError || error instanceof NativeOAuthModelRouteError) throw error;
@@ -519,31 +559,58 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
             const headers = new Headers(wire.headers);
             const encoding = new Headers(init.headers).get("accept-encoding");
             if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
-            const snapshot = oauthBinding?.snapshot;
-            const providerAccountUuid = oauthBinding?.providerAccountUuid;
+            const sendingBinding = oauthBinding;
+            const snapshot = sendingBinding?.snapshot;
+            const providerAccountUuid = sendingBinding?.providerAccountUuid;
             const writerGeneration = snapshot ? captureConfigGeneration() : 0;
-            const ownsBearer = snapshot && headers.get("authorization") === `Bearer ${snapshot.accessToken}` && !headers.has("x-api-key");
-            const releaseFamily = snapshot ? claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
+            const ownsBearer = snapshot && snapshot.provider === nativeInstance
+              && headers.get("authorization") === `Bearer ${snapshot.accessToken}` && !headers.has("x-api-key");
+            if (oauthBinding && (!ownsBearer || wire.url !== oauthBinding.routeTarget
+              || !nativeOAuthRouteIsCurrent(oauthBinding) || !nativeOAuthBindingIsCurrent(oauthBinding))) {
+              throw new NativeOAuthSelectionChangedError();
+            }
+            const releaseFamily = snapshot && oauthBinding ? anthropicModelQuotaFor(oauthBinding.instance).claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
             if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
             let dispatched: Response;
+            const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
+              poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
+            }));
+            let sendOwner: AnthropicPhysicalSendOwnership | null = null;
             try {
               if (init.signal?.aborted) throw init.signal.reason;
-              if (!spendTracker.charge()) throw new NativeMessagesSpendRefusal();
+              // Capture before either accounting path so this request retains its start policy.
+              if (spendReport.beforeSend && !spendReport.beforeSend()) {
+                if (spendTracker.refusals) throw new NativeMessagesSpendRefusal();
+                throw new SendBudgetExhaustedError();
+              }
+              if (!physicalBudget.spendEnforced && !spendTracker.charge()) throw new NativeMessagesSpendRefusal();
               noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+              // Last synchronous ownership reservation before the physical fetch. Retain this
+              // exact incarnation across its await; a returned response can never reserve one.
+              sendOwner = snapshot ? captureAnthropicPhysicalSendOwnership(snapshot) : null;
+              if (snapshot && !sendOwner) throw new NativeOAuthSelectionChangedError();
               dispatched = await sendWithConnectionPolicy(
                 (activeProvider as OcxProviderTransport).fetch ?? execute,
                 wire.url,
                 applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
                 { providerName: route.providerName, provider: activeProvider },
               );
-            } finally { releaseFamily(); }
-            if (ownsBearer && snapshot) {
+            } finally {
+              try { if (physicalBudget.spendEnforced) spendReport(1); }
+              finally {
+                try { spendReport.close?.(); }
+                finally { releaseFamily(); }
+              }
+            }
+            if (ownsBearer && snapshot && sendOwner && sendingBinding) {
               try {
-                const current = getAccountCredentialWithStatus("anthropic", snapshot.accountId);
-                if (current && !current.needsReauth && credentialGeneration(current.credential) === snapshot.generation
+                const current = getAccountCredentialWithStatus(snapshot.provider, snapshot.accountId);
+                if (anthropicPhysicalSendOwnershipIsCurrent(sendOwner) && nativeOAuthRouteIsCurrent(sendingBinding)
+                  && current && !current.needsReauth && current.credential.access === snapshot.accessToken
+                  && credentialGeneration(current.credential) === snapshot.generation
                   && current.credential.accountId === providerAccountUuid) {
-                  bindAnthropicRefusalCredential(dispatched, snapshot, providerAccountUuid);
-                  recordAnthropicAccountQuotaFromHeaders(snapshot.accountId, dispatched.headers, writerGeneration, dispatched.status, route.modelId);
+                  bindAnthropicRefusalCredentialForSend(dispatched, sendOwner, providerAccountUuid);
+                  recordAnthropicAccountQuotaFromHeadersForInstance(nativeInstance!, snapshot.accountId, dispatched.headers, writerGeneration, dispatched.status, route.modelId);
                 }
               } catch { /* Passive observation must not fail the response. */ }
             }
@@ -618,16 +685,17 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     const oauthRetryKey = {};
     const triedAccountIds = new Set<string>();
     let oauthFailovers = 0;
-    while (oauthBinding && (response.status === 429 || response.status === 403)) {
+    while (oauthBinding && (response.status === 429 || response.status === 403 || response.status === 401)) {
       const sendingBinding = oauthBinding;
       const expectedRecoverySelection = sendingBinding.selection;
       triedAccountIds.add(sendingBinding.snapshot.accountId);
-      const nextAccountId = await rotateAnthropicAccountOnResponse(response, {
+      const nextAccountId = await rotateAnthropicAccountOnResponseForInstance(sendingBinding.instance, response, {
         config, accountId: sendingBinding.snapshot.accountId, model: route.modelId,
         sessionKey: sendingBinding.sessionKey, decision: sendingBinding.routeDecision,
         excludedAccountIds: triedAccountIds,
         currentDecision: () => {
-          const resolved = resolveAnthropicModelRoute(config, route.modelId);
+          if (!nativeOAuthRouteIsCurrent(sendingBinding)) throw new NativeOAuthSelectionChangedError();
+          const resolved = resolveAnthropicModelRouteForInstance(sendingBinding.instance, config, route.modelId);
           if (resolved.error) throw new NativeOAuthModelRouteError(`Invalid Anthropic model routes: ${resolved.error}`);
           return resolved.decision;
         },
@@ -635,9 +703,9 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
         canRetry: transientSendAvailable() && oauthFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
       });
       if (!nextAccountId) break;
-      const recovery = response.status === 403 ? "oauth-account-403" : "rate-limit-429";
+      const recovery = response.status === 401 ? "oauth-401" : response.status === 403 ? "oauth-account-403" : "rate-limit-429";
       discard(response);
-      oauthBinding = await resolveNativeOAuthBinding(config, {
+      oauthBinding = await resolveNativeOAuthBindingForInstance(nativeInstance!, config, { routeTarget,
         sessionKey: options.sessionKey, model: route.modelId, candidateAccountId: nextAccountId,
         expectedRecoverySelection, expectedRecoveryRouteDecision: sendingBinding.routeDecision,
       });
@@ -652,6 +720,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     upstream.abort();
     if (req.signal.aborted) return fail(499, "Client cancelled request", "api_error");
     const sendError = error instanceof UpstreamRetryEvidenceError ? error.cause : error;
+    if (sendError instanceof SendBudgetExhaustedError) return fail(429, sendError.message, "send_budget_exhausted", "send_budget_exhausted");
     if (sendError instanceof NativeMessagesSpendRefusal) {
       const refusal = workflowRefusalResponse("workflow-spend-exhausted", logCtx);
       finishLog(429);
@@ -683,7 +752,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       upstream.abort();
       return fail(499, "Client cancelled request", "api_error");
     }
-    return nativeMessagesErrorResponse(response, bodyText, finishLog);
+    return retainUpstreamMessagesRequestId(nativeMessagesErrorResponse(response, bodyText, finishLog), response.headers);
   }
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
@@ -708,10 +777,15 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
           releaseStreamTurn();
         }
       }, bodyGuard);
-      return new Response(relayed, {
+      // A configured Messages provider words an oversized-input refusal its own way; Claude Code
+      // compacts only on Anthropic's wording (devlog/_plan/261009_claude_1m_default/010). The
+      // rewrite buffers whole frames, so it sits after the tap: stall detection keeps timing raw
+      // upstream bytes. Real Anthropic pools refuse pre-stream in that wording and keep one relay.
+      const clientStream = nativeInstance ? relayed : relaySseWithPayloadRewrite(relayed, claudeOverflowSsePayload, translatorBudget);
+      return retainUpstreamMessagesRequestId(new Response(clientStream, {
         status: 200,
         headers: { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache", Connection: "keep-alive" },
-      });
+      }), response.headers);
     }
     // A non-streaming caller whose upstream streamed anyway: fold the stream into one message.
     const tapState: { closeReason?: FinalRequestLogMeta["closeReason"]; meta?: FinalRequestLogMeta } = {};
@@ -733,10 +807,11 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
         // as the streaming lane's row; a plain upstream error event keeps the non_stream row.
         const tapMeta = tapState.meta;
         if (tapMeta && (tapMeta.terminalStatus || tapMeta.closeReason !== "terminal")) finishLog(502, text, tapMeta);
+        if (isNativeOverflowError(error, text)) return fail(400, claudePromptTooLongMessage(text), "invalid_request_error");
         return fail(502, text, "api_error");
       }
       finishLog(200);
-      return Response.json(message);
+      return retainUpstreamMessagesRequestId(Response.json(message), response.headers);
     } catch (error) {
       cleanupAbort();
       upstream.abort();
@@ -794,12 +869,19 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   const serialized = JSON.stringify(message);
   finishLog(200);
   if (requestedStream) {
-    return new Response(messageAsSse(message), {
+    return retainUpstreamMessagesRequestId(new Response(messageAsSse(message), {
       status: 200,
       headers: { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache" },
-    });
+    }), response.headers);
   }
-  return new Response(serialized, { status: 200, headers: { "Content-Type": "application/json" } });
+  return retainUpstreamMessagesRequestId(new Response(serialized, { status: 200, headers: { "Content-Type": "application/json" } }), response.headers);
+}
+
+/** A folded stream error that refuses an oversized input (same gate as the SSE rewrite). */
+function isNativeOverflowError(error: Rec, message: string): boolean {
+  const sized = error.type === "invalid_request_error" || error.type === "request_too_large";
+  return sized && !isThroughputLimitText(message)
+    && (error.code === "context_length_exceeded" || isContextOverflowText(message));
 }
 
 /**
@@ -809,11 +891,13 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
  */
 function nativeMessagesErrorResponse(response: Response, bodyText: string, finishLog: FinishLog): Response {
   let upstreamType: string | undefined;
+  let upstreamCode: string | undefined;
   let upstreamMessage: string | undefined;
   try {
     const parsed = JSON.parse(bodyText) as Rec;
     const details = isRec(parsed.error) ? parsed.error : parsed;
     if (typeof details.type === "string") upstreamType = details.type;
+    if (typeof details.code === "string") upstreamCode = details.code;
     if (typeof details.message === "string" && details.message.trim()) {
       upstreamMessage = redactSecretString(details.message.trim());
     }
@@ -842,9 +926,17 @@ function nativeMessagesErrorResponse(response: Response, bodyText: string, finis
   if (retryAfter) headers.set("Retry-After", retryAfter);
   else if (transient) headers.set("Retry-After", "2");
   if (replayRefusal) applyReplayRefusalClientHeaders(headers);
+  // The native envelope keeps its shape (no added code); only an overflow's wording changes, so
+  // Claude Code recognizes it and compacts (010).
+  // Only a 400/413 refusal: the shared classifier also files a 429 "too many tokens per minute"
+  // under context_length_exceeded, and that one must stay a rate limit.
+  const overflow = !replayRefusal && (response.status === 400 || response.status === 413)
+    && !isThroughputLimitText(safeMessage)
+    && (classified.code === "context_length_exceeded" || upstreamCode === "context_length_exceeded"
+      || isContextOverflowText(safeMessage));
   const out = new Response(JSON.stringify(anthropicErrorBody(
     status,
-    safeMessage,
+    overflow ? claudePromptTooLongMessage(safeMessage) : safeMessage,
     transient ? "overloaded_error" : upstreamType,
     replayRefusal ? UPSTREAM_RESET_REPLAY_REFUSED_CODE : undefined,
   )), { status, headers });
@@ -865,6 +957,7 @@ export function nativeMessagesCountBody(
 ): Rec | undefined {
   if (typeof body.model !== "string") return undefined;
   try {
+    if (messagesSecondaryInstanceUnavailable(config, body.model, cc)) return undefined;
     const selectorId = resolveInboundModel(body.model, cc);
     // Combo and policy selectors are never eligible, and routing them would advance round-robin
     // state or run the policy evaluator for a request that sends nothing.
@@ -875,11 +968,13 @@ export function nativeMessagesCountBody(
       route.providerName, route.modelId, route.provider, route.staticPolicy.effectiveAlias, "anthropic",
     );
     route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic", route.staticPolicy);
+    const instance = configuredAnthropicInstance(config, route.providerName);
     const selector: NativeMessagesSelector = {
       ...rows,
       routeSelector: selectorId,
       claudeCode: cc,
-      ...(route.provider.authMode === "oauth" ? { oauthFailoverQuorum: hasAnthropicFailoverQuorum() } : {}),
+      ...(route.provider.authMode === "oauth" && instance
+        ? { oauthFailoverQuorum: anthropicRoutingFor(instance).hasAnthropicFailoverQuorum() } : {}),
     };
     if (nativeMessagesDeclineReason(route, body, config, selector) !== undefined) return undefined;
     // The body without a credential: counting never resolves or refreshes an OAuth account.

package/src/server/messages-response-headers.ts

@@ -0,0 +1,14 @@
+/** Only an opaque Anthropic request id is carried; arbitrary upstream headers stay private. */
+export function upstreamMessagesRequestIdHeaders(upstream: Headers): Record<string, string> {
+  const requestId = upstream.get("request-id");
+  return requestId && /^req_[A-Za-z0-9_-]{1,128}$/.test(requestId)
+    ? { "request-id": requestId }
+    : {};
+}
+
+/** The response is newly constructed by the Messages handler; preserve its body and markers. */
+export function retainUpstreamMessagesRequestId(response: Response, upstream: Headers): Response {
+  const requestId = upstreamMessagesRequestIdHeaders(upstream)["request-id"];
+  if (requestId) response.headers.set("request-id", requestId);
+  return response;
+}

package/src/server/request-log-conversation.ts

@@ -37,6 +37,47 @@ export function normalizeLogConversationId(raw: string | undefined | null): stri
   return createHash("sha256").update(trimmed).digest("hex").slice(0, LOG_CONVERSATION_ID_LEN);
 }
 
+const CODEX_THREAD_LINK_PREFIX = "codex://threads/";
+/** Real thread links stay well under this bound; larger pastes skip unwrapping so per-row matching stays cheap. */
+const LOG_CONVERSATION_LINK_MAX = 512;
+
+/**
+ * Unwrap a pasted `codex://threads/<id>` deep link to the bare thread id. Codex's
+ * "copy session link" clipboard carries that URI form while clients send the bare id
+ * on the wire, so Logs search accepts either paste without changing what is persisted.
+ * Query/fragment metadata (e.g. `?hostId=…`) belongs to the link, not the id, and is
+ * dropped. The scan is a bounded linear walk — no ambiguous regex — because this runs
+ * per log row on every filter evaluation.
+ */
+export function unwrapLogConversationQuery(query: string): string {
+  const trimmed = query.trim();
+  if (
+    trimmed.length > LOG_CONVERSATION_LINK_MAX ||
+    trimmed.length <= CODEX_THREAD_LINK_PREFIX.length ||
+    !trimmed.toLowerCase().startsWith(CODEX_THREAD_LINK_PREFIX)
+  ) {
+    return trimmed;
+  }
+  const rest = trimmed.slice(CODEX_THREAD_LINK_PREFIX.length);
+  const metaIndex = rest.search(/[?#]/);
+  const segment = (metaIndex === -1 ? rest : rest.slice(0, metaIndex)).replace(/\/+$/, "");
+  // A thread id is a single path segment; deeper paths or embedded whitespace keep the
+  // whole paste as the query, so foreign `codex://` URIs still fail to match.
+  return segment !== "" && !/[/\s]/.test(segment) ? segment : trimmed;
+}
+
+/**
+ * The candidate ids a conversation query may legitimately match. Unwrapping a pasted
+ * `codex://threads/<id>` link must add a match path, not replace one: a client can
+ * literally send a `codex://threads/…` session id, which is hashed whole for storage,
+ * so the untouched paste stays a candidate too.
+ */
+export function logConversationQueryCandidates(query: string): string[] {
+  const trimmed = query.trim();
+  const unwrapped = unwrapLogConversationQuery(trimmed);
+  return unwrapped === trimmed ? [unwrapped] : [unwrapped, trimmed];
+}
+
 /**
  * Filter match: accept either the persisted digest or the original preimage
  * (so pasting from Logs detail or the client-facing session id both work).
@@ -46,11 +87,13 @@ export function matchesLogConversationId(
   query: string | undefined | null,
 ): boolean {
   if (!stored) return false;
-  const trimmed = typeof query === "string" ? query.trim() : "";
-  if (!trimmed) return false;
-  if (stored === trimmed) return true;
-  const hashed = normalizeLogConversationId(trimmed);
-  return hashed !== undefined && stored === hashed;
+  for (const candidate of logConversationQueryCandidates(typeof query === "string" ? query : "")) {
+    if (!candidate) continue;
+    if (stored === candidate) return true;
+    const hashed = normalizeLogConversationId(candidate);
+    if (hashed !== undefined && stored === hashed) return true;
+  }
+  return false;
 }
 
 /**

package/src/server/request-log.ts

@@ -63,6 +63,7 @@ import {
   type UsageStatus,
 } from "../usage/log";
 import type { RequestExecutionBudget } from "../lib/request-execution-budget";
+import type { WorkflowSpendDenialDetail } from "../lib/workflow-budget";
 import { attributeFinalRequest, attributeSealedAttempt } from "./request-log-failure-attribution";
 import { debugAttemptDeliverySummary } from "../lib/debug";
 import {
@@ -203,6 +204,10 @@ export interface RequestLogContext {
   spendOutputCeilingTokens?: number;
   /** Pre-send input estimate reserved for spend only; unlike usageLogInputTokens it never enters usage. */
   spendInputEstimateTokens?: number;
+  /** Canonical provider-pool spend identity; independent of mutable, account-specific log labels. */
+  spendPoolId?: string;
+  /** Internal safe refusal detail for a request whose ceiling includes unidentified old pool spend. */
+  spendRefusalDetail?: WorkflowSpendDenialDetail;
   /** Settles this request's durable spend entries from `addFinalRequestLog`. */
   spendTracker?: RequestSpendSettlement;
   attempts?: PersistedUsageAttempt[];
@@ -227,6 +232,8 @@ export interface RequestLogContext {
    * message) extracted from a `response.failed` SSE payload or non-streaming error body, so the
    * request log / GUI shows the actual upstream failure rather than only the HTTP-mapped code. */
   upstreamError?: string;
+  upstreamErrorCode?: string;
+  upstreamRequestId?: string;
   /** HTTP status derived from a terminal `response.failed` SSE payload (429/401/503/etc.). */
   terminalHttpStatus?: number;
   /** Recognized structured terminal code whose exact identity must survive status mapping. */
@@ -337,6 +344,8 @@ export interface RequestLogEntry {
   closeReason?: "terminal" | "client_cancel" | "non_stream" | "body_stall" | "body_overflow";
   /** Secret-redacted upstream error reason, surfaced in /api/logs and the GUI detail modal. */
   upstreamError?: string;
+  upstreamErrorCode?: string;
+  upstreamRequestId?: string;
   usageStatus: UsageStatus;
   usage?: OcxUsage;
   totalTokens?: number;
@@ -1090,6 +1099,24 @@ export function inspectResponseLogSsePayloadParsed(
  * a non-streaming JSON error body. We keep the FIRST non-empty reason (the original failure) and
  * run it through redactSecretString so secrets never reach /api/logs. Pure; safe on any text.
  */
+const UPSTREAM_DIAGNOSTIC_TOKEN = /^[A-Za-z0-9_.:-]{1,128}$/;
+
+function noteBoundedDiagnostic(
+  logCtx: RequestLogContext,
+  field: "upstreamErrorCode" | "upstreamRequestId",
+  value: unknown,
+): void {
+  if (logCtx[field] !== undefined) return;
+  if (typeof value !== "string" || !UPSTREAM_DIAGNOSTIC_TOKEN.test(value)) return;
+  logCtx[field] = value;
+  const status = logCtx.terminalHttpStatus;
+  if (status === undefined || status >= 500) console.warn(`[opencodex] upstream failure${status ? ` status=${status}` : ""}${logCtx.upstreamErrorCode ? ` code=${logCtx.upstreamErrorCode}` : ""}${logCtx.upstreamRequestId ? ` request_id=${logCtx.upstreamRequestId}` : ""}`);
+}
+
+export function noteUpstreamRequestId(logCtx: RequestLogContext, headers: Headers): void {
+  noteBoundedDiagnostic(logCtx, "upstreamRequestId", headers.get("openai-request-id") ?? headers.get("x-request-id"));
+}
+
 function captureUpstreamError(logCtx: RequestLogContext, text: string | null): void {
   if (!text) return;
   let parsed: unknown | undefined;
@@ -1109,14 +1136,19 @@ function captureUpstreamErrorParsed(
   if (parsed !== undefined && parsed !== null) {
     const json = parsed as {
       type?: unknown;
-      error?: { message?: unknown };
-      last_error?: { message?: unknown };
+      error?: { message?: unknown; code?: unknown };
+      last_error?: { message?: unknown; code?: unknown };
       response?: {
         error?: { type?: unknown; code?: unknown; message?: unknown };
         incomplete_details?: { reason?: unknown; message?: unknown };
       };
     };
     captureTerminalHttpStatus(logCtx, json);
+    noteBoundedDiagnostic(
+      logCtx,
+      "upstreamErrorCode",
+      json.error?.code ?? json.response?.error?.code ?? json.last_error?.code,
+    );
     const reason = json?.response?.incomplete_details?.reason;
     if (json.type === "response.incomplete"
       && logCtx.terminalIncompleteReason === undefined
@@ -1588,6 +1620,8 @@ export function addFinalRequestLog(
     ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
     ...(closeReason ? { closeReason } : {}),
     ...(logCtx.upstreamError ? { upstreamError: logCtx.upstreamError } : {}),
+    ...(logCtx.upstreamErrorCode ? { upstreamErrorCode: logCtx.upstreamErrorCode } : {}),
+    ...(logCtx.upstreamRequestId ? { upstreamRequestId: logCtx.upstreamRequestId } : {}),
     usageStatus,
     ...(loggedUsage ? { usage: loggedUsage } : {}),
     ...(totalTokens !== undefined ? { totalTokens } : {}),