@bitkyc08/opencodex 2.81.0 → 2.82.0

package/src/oauth/index.ts

@@ -38,7 +38,7 @@ import { anthropicOAuthDefinition, assertAnthropicInstanceLoginConfig, Anthropic
   resumeAnthropicRefreshIntentCleanup, clearObservedAnthropicRefreshIntent } from "./anthropic-oauth-definitions";
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, RefreshIntentIOError } from "./nous";
-import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
+import { ChatGptTokenRequestError, ChatGptTokenError, loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginZed, refreshZedToken } from "./zed";
@@ -350,7 +350,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
   },
   chatgpt: {
     login: (ctrl, opts) => loginChatGPT(ctrl, { forceLogin: opts?.forceLogin, flow: opts?.flow }),
-    refresh: (rt) => refreshChatGPTToken(rt),
+    refresh: (rt, signal) => refreshChatGPTToken(rt, { signal }),
     providerConfig: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" as const },
     defaultModel: "gpt-5.6-luna",
   },
@@ -712,10 +712,14 @@ function isTerminalRefreshError(err: unknown): boolean {
     || msg.includes("expired_token");
 }
 function terminal(error:unknown):boolean{
+  if (error instanceof ChatGptTokenRequestError) return false;
   if(error instanceof XaiTokenRequestError)return ["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??"");
   if(error instanceof AnthropicTokenError)return (error.httpStatus===400||error.httpStatus===401)&&["invalid_grant","refresh_token_reused","revoked","revoked_token","refresh_token_revoked"].includes(error.oauthError??"");
   if(error instanceof KiroTokenRefreshError)return (error.httpStatus===400||error.httpStatus===401)&&error.oauthError!==undefined;
   if(error instanceof NousTokenError)return error.terminal===true||["invalid_grant","refresh_token_reused","revoked","revoked_token","expired_token"].includes(error.oauthError??"");
+  // ChatGPT carries the pool classifier's verdict on the error itself: revoked and
+  // expired grants are terminal; unknown/transient failures stay retryable.
+  if(error instanceof ChatGptTokenError)return error.terminal;
   // Local durable-write/read/cleanup failures are operational, not credential
   // death: the provider credential was never rejected or consumed. Never mark
   // the account needsReauth for broken local persistence infrastructure.

package/src/oauth/store.ts

@@ -1508,7 +1508,7 @@ export async function markAccountNeedsReauth(
 export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");if(isAnthropicInstanceId(provider))assertAnthropicCredentialSource(provider,safe);return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;delete account.refreshAttentionGeneration;if(account.needsReauthReason!=="verify_account"){delete account.needsReauth;delete account.needsReauthReason;}return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
 // A late refresh failure must not change an operator-paused account's health. Check under
 // the mutation lock, not before awaiting it, so a concurrent pause cannot be overwritten.
-export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account"):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account",isCurrent?:(store:AuthStore)=>boolean):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;if(isCurrent&&!isCurrent(store))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}
 
 /** Attention is projected only; refresh selection continues to use the stored terminal flag. */
 export function accountNeedsReauthForStatus(provider: string, account: ProviderAccount, now = Date.now()): boolean {

package/src/providers/azure-model-metadata.ts

@@ -0,0 +1,115 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteFile } from "../config/atomic-write";
+import { getConfigDir } from "../config/paths";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
+
+const SOURCE_URL = "https://models.dev/api.json";
+const FILENAME = "azure-model-metadata-cache.json";
+const TTL_MS = 24 * 60 * 60 * 1000;
+
+export type AzureModelMetadata = { input?: string[]; contextWindow?: number; maxTokens?: number };
+type Snapshot = { version: 1; fetchedAt: number; models: Record<string, AzureModelMetadata> };
+type CacheState = { snapshot?: Snapshot | null; inFlight?: Promise<void>; retryAfter: number };
+const cacheByConfigDir = new Map<string, CacheState>();
+
+function cacheState(configDir: string): CacheState {
+  let state = cacheByConfigDir.get(configDir);
+  if (!state) {
+    state = { retryAfter: 0 };
+    cacheByConfigDir.set(configDir, state);
+  }
+  return state;
+}
+
+export function isAzureModelMetadataDestination(baseUrl: string | undefined): boolean {
+  try {
+    return !!baseUrl && new URL(baseUrl).hostname.endsWith(".openai.azure.com");
+  } catch {
+    return false;
+  }
+}
+
+function positiveInteger(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+function parseModels(models: unknown, published: boolean): Record<string, AzureModelMetadata> {
+  const out: Record<string, AzureModelMetadata> = Object.create(null);
+  for (const [id, value] of Object.entries(record(models) ?? {}).slice(0, 2000)) {
+    const row = record(value);
+    if (!row || id.length > 256) continue;
+    const limit = published ? record(row.limit) : row;
+    const input = published ? record(row.modalities)?.input : row.input;
+    const modalities = Array.isArray(input)
+      ? [...new Set(input.filter((item): item is string => item === "text" || item === "image" || item === "audio"))]
+      : [];
+    const contextWindow = positiveInteger(published ? limit?.context : limit?.contextWindow);
+    const maxTokens = positiveInteger(published ? limit?.output : limit?.maxTokens);
+    if (!modalities.length && contextWindow === undefined && maxTokens === undefined) continue;
+    out[id.toLowerCase()] = {
+      ...(modalities.length ? { input: modalities } : {}),
+      ...(contextWindow !== undefined ? { contextWindow } : {}),
+      ...(maxTokens !== undefined ? { maxTokens } : {}),
+    };
+  }
+  return out;
+}
+
+function loadSnapshot(configDir: string, state: CacheState): Snapshot | null {
+  if (state.snapshot !== undefined) return state.snapshot;
+  state.snapshot = null;
+  try {
+    const raw = record(JSON.parse(readFileSync(join(configDir, FILENAME), "utf8")));
+    if (raw?.version === 1 && positiveInteger(raw.fetchedAt) !== undefined && record(raw.models)) {
+      state.snapshot = { version: 1, fetchedAt: raw.fetchedAt as number, models: parseModels(raw.models, false) };
+    }
+  } catch { /* Missing or corrupt optional metadata leaves bundled hints available. */ }
+  return state.snapshot;
+}
+
+/** Synchronous catalog fallback. Generation requests never fetch this snapshot. */
+export function publishedAzureModelMetadata(modelId: string, configDir = getConfigDir()): AzureModelMetadata | undefined {
+  return loadSnapshot(configDir, cacheState(configDir))?.models[modelId.toLowerCase()];
+}
+
+/** Refresh once per day during discovery, coalesced and bounded; retain stale data offline. */
+export async function refreshAzureModelMetadata(baseUrl: string | undefined, configDir = getConfigDir()): Promise<void> {
+  if (!isAzureModelMetadataDestination(baseUrl)) return;
+  // Capture state and destination together: tests and embedders can change config roots.
+  const state = cacheState(configDir);
+  const current = loadSnapshot(configDir, state);
+  if ((current && Date.now() - current.fetchedAt < TTL_MS) || Date.now() < state.retryAfter) return;
+  if (state.inFlight) return state.inFlight;
+  const path = join(configDir, FILENAME);
+  state.inFlight = (async () => {
+    try {
+      const signal = AbortSignal.timeout(2000);
+      const response = await fetch(SOURCE_URL, {
+        headers: { accept: "application/json" },
+        redirect: "error",
+        signal,
+      });
+      if (!response.ok) return;
+      const body = await readBoundedResponseBytes(response, { maxBytes: 16 * 1024 * 1024, signal });
+      if (body.oversized) return;
+      const raw = record(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body.bytes)));
+      // Provider-specific rows matter: Azure may expose text only where the direct vendor has vision.
+      const models = parseModels(record(raw?.azure)?.models, true);
+      if (!Object.keys(models).length) return;
+      state.snapshot = { version: 1, fetchedAt: Date.now(), models };
+      try { atomicWriteFile(path, JSON.stringify(state.snapshot) + "\n"); } catch { /* Memory still serves discovery. */ }
+    } catch { /* A public metadata outage must not fail provider discovery. */ }
+    finally { state.retryAfter = Date.now() + 60_000; }
+  })().finally(() => { state.inFlight = undefined; });
+  return state.inFlight;
+}
+
+export function resetAzureModelMetadataForTests(): void {
+  cacheByConfigDir.clear();
+}

package/src/providers/derive.ts

@@ -1,5 +1,7 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
+import { COST_VENDOR_PRIORITY, getModelMetadata, getModelMetadataCaseInsensitive } from "../generated/model-metadata";
 import { cloneFastWire } from "./fastwire";
+import { isAzureModelMetadataDestination, publishedAzureModelMetadata, type AzureModelMetadata } from "./azure-model-metadata";
 import { resolveModelPolicy } from "./resolved-model-policy";
 import {
   PROVIDER_REGISTRY,
@@ -651,6 +653,25 @@ export function shouldCaseFoldMetadataModelId(providerId: string): boolean {
   return entry?.metadataModelIdNormalize === "case-insensitive";
 }
 
+const AZURE_VENDOR_METADATA_PRIORITY = [
+  "azure-openai",
+  ...COST_VENDOR_PRIORITY.filter(provider => provider !== "azure-openai"),
+];
+
+/**
+ * Fill missing Azure model metadata by destination and known model id. Custom provider
+ * names miss PROVIDER_ALIASES; arbitrary deployment aliases still need explicit metadata.
+ */
+export function azureVendorModelMetadata(baseUrl: string | undefined, modelId: string, metadataConfigDir?: string): AzureModelMetadata | undefined {
+  if (!isAzureModelMetadataDestination(baseUrl)) return undefined;
+  const published = publishedAzureModelMetadata(modelId, metadataConfigDir);
+  for (const provider of AZURE_VENDOR_METADATA_PRIORITY) {
+    const meta = getModelMetadata(provider, modelId) ?? getModelMetadataCaseInsensitive(provider, modelId);
+    if (meta) return { ...meta, ...published };
+  }
+  return published;
+}
+
 function entryToPreset(entry: ProviderRegistryEntry): DerivedProviderPreset {
   return {
     id: entry.id,

package/src/providers/quota/vendor-probes-key.ts

@@ -38,6 +38,7 @@ const DEEPSEEK_BASE_URL = "https://api.deepseek.com";
 const CLINE_BASE_URL = "https://api.cline.bot";
 const OLLAMA_CLOUD_BASE_URL = "https://ollama.com";
 const OLLAMA_CLOUD_USAGE_URL = `${OLLAMA_CLOUD_BASE_URL}/api/usage`;
+const OLLAMA_CLOUD_BALANCE_URL = `${OLLAMA_CLOUD_BASE_URL}/api/balance`;
 const ZAI_BASE_URL = "https://api.z.ai";
 const ZAI_CN_BASE_URL = "https://open.bigmodel.cn";
 const MINIMAX_REMAINS_PATH = "/v1/api/openplatform/coding_plan/remains";
@@ -439,11 +440,80 @@ async function fetchClineQuota(provider: string, config: OcxProviderConfig): Pro
 }
 
 /**
- * Ollama Cloud `GET https://ollama.com/api/usage` — returns account usage.
- * Legacy plans report rolling 5-hour `limits.session.usage` and 7-day
- * `limits.weekly.usage`. Migrated monthly-credit plans report
- * `limits.monthly.usage`. `usage` values are normalized fractions (0..1).
+ * Ollama Cloud quota. `GET https://ollama.com/api/balance` is the live source: it
+ * returns the included (plan) balance plus purchased credits. Legacy plans report
+ * rolling 5-hour `included.session.remaining_percent` and 7-day
+ * `included.weekly.remaining_percent` (remaining shares, so used = 100 - remaining);
+ * credit plans report `included.balance_usd`/`included.allowance_usd` over a
+ * `period`.
+ *
+ * `GET https://ollama.com/api/usage` used to carry `limits.{session,weekly,monthly}.usage`
+ * as normalized fractions but now returns only a request-count timeseries, so it is
+ * kept as a fallback for older deployments.
  */
+function parseOllamaUsedPercent(row: Record<string, unknown>): number | undefined {
+  if (row.remaining_percent !== undefined) {
+    const remaining = toFiniteNumber(row.remaining_percent);
+    if (remaining === undefined) return undefined;
+    return normalizePercent(Math.round((100 - remaining) * 100) / 100);
+  }
+  return parseOllamaPercent(row.usage);
+}
+
+export function parseOllamaCloudBalance(body: Record<string, unknown> | null): ProviderQuota | null {
+  if (!body) return null;
+  const included = asRecord(body.included);
+  if (!included) return null;
+
+  const quota: ProviderQuota = { updatedAt: Date.now() };
+  let windows = 0;
+
+  const rows: Array<[string, "fiveHour" | "weekly" | "monthly"]> = [
+    ["session", "fiveHour"],
+    ["weekly", "weekly"],
+    ["monthly", "monthly"],
+  ];
+  for (const [key, window] of rows) {
+    const row = asRecord(included[key]);
+    if (!row) continue;
+    const percent = parseOllamaUsedPercent(row);
+    if (percent === undefined) continue;
+    const resetAt = normalizeResetAt(row.resets_at);
+    if (window === "fiveHour") {
+      quota.fiveHourPercent = percent;
+      if (resetAt !== undefined) quota.fiveHourResetAt = resetAt;
+    } else if (window === "weekly") {
+      quota.weeklyPercent = percent;
+      if (resetAt !== undefined) quota.weeklyResetAt = resetAt;
+    } else {
+      quota.monthlyPercent = percent;
+      if (resetAt !== undefined) quota.monthlyResetAt = resetAt;
+    }
+    windows += 1;
+  }
+
+  const allowance = toFiniteNumber(included.allowance_usd);
+  const balance = toFiniteNumber(included.balance_usd);
+  if (allowance !== undefined && allowance > 0 && balance !== undefined) {
+    const used = Math.max(0, allowance - balance);
+    const percent = normalizePercent(Math.round((used / allowance) * 10000) / 100);
+    if (percent !== undefined) {
+      const expiresAt = normalizeResetAt(asRecord(included.period)?.until);
+      // creditsUsd is the included allowance only; purchased credits are ignored.
+      quota.creditsUsd = {
+        used,
+        limit: allowance,
+        remaining: balance,
+        percent,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+      };
+      windows += 1;
+    }
+  }
+
+  return windows > 0 ? quota : null;
+}
+
 function parseOllamaPercent(usageValue: unknown): number | undefined {
   const usage = toFiniteNumber(usageValue);
   if (usage === undefined || usage < 0) return undefined;
@@ -489,25 +559,65 @@ export function parseOllamaCloudQuota(body: Record<string, unknown> | null): Pro
   return windows > 0 ? quota : null;
 }
 
+/**
+ * Routing projection for an `/api/balance` report. `creditsUsd` covers the included
+ * allowance only, so it may veto routing only when purchased credit is known to be empty;
+ * otherwise an exhausted allowance would block an account that still has paid balance.
+ */
+function ollamaBalanceInferenceQuota(quota: ProviderQuota, body: Record<string, unknown> | null): ProviderQuota {
+  if (!quota.creditsUsd) return quota;
+  const purchased = toFiniteNumber(asRecord(body?.purchased)?.balance_usd);
+  if (purchased !== undefined && purchased <= 0) return quota;
+  const { creditsUsd: _includedOnly, ...inference } = quota;
+  return inference;
+}
+
 async function fetchOllamaCloudQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaProbeResult> {
   const effectiveBaseUrl = config.baseUrl ?? getProviderRegistryEntry(provider)?.baseUrl ?? "";
   if (!isCanonicalOllamaCloudBaseUrl(effectiveBaseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await quotaFetch(provider, config, OLLAMA_CLOUD_USAGE_URL, {
-    headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
-    redirect: "error",
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  });
-  if (!response.ok) {
-    if (response.status === 404) return null;
-    return response.status >= 400 && response.status < 500 && response.status !== 408 && response.status !== 429
-      ? TERMINAL_QUOTA_FAILURE
-      : null;
+  const attempts: Array<{
+    url: string;
+    source: string;
+    parse: (body: Record<string, unknown> | null) => ProviderQuota | null;
+  }> = [
+    { url: OLLAMA_CLOUD_BALANCE_URL, source: "ollama-cloud:balance", parse: parseOllamaCloudBalance },
+    { url: OLLAMA_CLOUD_USAGE_URL, source: "ollama-cloud:usage", parse: parseOllamaCloudQuota },
+  ];
+  let terminalFailure = false;
+  for (const attempt of attempts) {
+    let response: Response;
+    try {
+      response = await quotaFetch(provider, config, attempt.url, {
+        headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
+        redirect: "error",
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      });
+    } catch {
+      continue;
+    }
+    if (!response.ok) {
+      if (response.status !== 404 && response.status >= 400 && response.status < 500 && response.status !== 408 && response.status !== 429) {
+        terminalFailure = true;
+      }
+      try {
+        void response.body?.cancel().catch(() => undefined);
+      } catch {
+        // Best-effort cancellation only.
+      }
+      continue;
+    }
+    const raw = await readQuotaJson(response);
+    if (raw === QUOTA_JSON_READ_FAILURE) return terminalFailure ? TERMINAL_QUOTA_FAILURE : null;
+    const body = asRecord(raw);
+    const quota = attempt.parse(body);
+    if (quota) {
+      const inference = attempt.url === OLLAMA_CLOUD_BALANCE_URL ? ollamaBalanceInferenceQuota(quota, body) : quota;
+      return keyReport(provider, attempt.source, quota, config, apiKey, inference);
+    }
   }
-  const body = asRecord(await readQuotaJson(response));
-  const quota = parseOllamaCloudQuota(body);
-  return quota ? keyReport(provider, "ollama-cloud:usage", quota, config, apiKey, quota) : null;
+  return terminalFailure ? TERMINAL_QUOTA_FAILURE : null;
 }
 
 /**

package/src/providers/quota.ts

@@ -97,7 +97,7 @@ export {
   type ProviderAccountQuota,
 } from "./quota/account-cache";
 export { fetchAntigravityUsageQuota, isCanonicalAntigravityQuotaUrl, setAntigravityAccountQuotaTransportForTests } from "./quota/antigravity";
-export { parseOllamaCloudQuota, parseZaiQuotaLimits, providerApiKeyQuotaMode } from "./quota/vendor-probes-key";
+export { parseOllamaCloudBalance, parseOllamaCloudQuota, parseZaiQuotaLimits, providerApiKeyQuotaMode } from "./quota/vendor-probes-key";
 export { parseXaiCreditsResponse } from "./quota/vendor-probes-oauth";
 export async function fetchProviderApiKeyQuotas(config: OcxConfig, name: string, forceRefresh = false): Promise<ProviderApiKeyQuota[]> {
   const provider = config.providers[name];

package/src/responses/reasoning-envelope.ts

@@ -36,6 +36,32 @@ export interface ReasoningEnvelope {
    * same way a signature does.
    */
   krc?: string;
+  /**
+   * A Responses provider's own `encrypted_content` for one reasoning item, minted while serving
+   * `model` (the client-facing model the Claude route was asked for). The Claude route has no
+   * other channel to hand a provider its reasoning back: the body is `store: false` and Claude
+   * Code replays only the thinking block. `src/claude/inbound.ts` restores it only for a request
+   * naming the same model, so a model switch cannot carry it to a provider that cannot decrypt it.
+   */
+  nat?: NativeReasoning;
+}
+
+export interface NativeReasoning {
+  /** The provider's opaque `encrypted_content`, verbatim. */
+  enc: string;
+  /** Client-facing model the item was produced for. */
+  model: string;
+  /** Route-bound HMAC for this exact ciphertext. */
+  tag: string;
+  /** The provider's reasoning item id, when it sent one. */
+  id?: string;
+}
+
+function decodeNativeReasoning(value: unknown): NativeReasoning | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const { enc, model, id, tag } = value as { enc?: unknown; model?: unknown; id?: unknown; tag?: unknown };
+  if (typeof enc !== "string" || enc.length === 0 || typeof model !== "string" || model.length === 0 || typeof tag !== "string" || tag.length === 0) return undefined;
+  return typeof id === "string" && id.length > 0 ? { enc, model, tag, id } : { enc, model, tag };
 }
 
 export function encodeReasoningEnvelope(envelope: ReasoningEnvelope, budget?: TranslatorBudget): string {
@@ -116,7 +142,9 @@ export function decodeReasoningEnvelope(encryptedContent: string, budget?: Trans
       if (hasTxt) envelope.txt = txt;
       const krc = (parsed as { krc?: unknown }).krc;
       if (typeof krc === "string" && krc.length > 0) envelope.krc = krc;
-      return envelope.sig || envelope.red || hasTxt || envelope.krc ? envelope : null;
+      const nat = decodeNativeReasoning((parsed as { nat?: unknown }).nat);
+      if (nat) envelope.nat = nat;
+      return envelope.sig || envelope.red || hasTxt || envelope.krc || envelope.nat ? envelope : null;
     } catch {
       return null;
     } finally {

package/src/responses/reasoning-replay-cache.ts

@@ -19,7 +19,8 @@
  * long-lived proxy cannot grow without limit.
  */
 
-import { createHash, createHmac, randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { thoughtSignatureReplaySalt } from "./thought-signature-replay";
 import type {
   OcxProviderConfig,
   OcxReasoningReplayIdentity,
@@ -27,6 +28,21 @@ import type {
 } from "../types";
 
 const MAX_ENTRIES = 64;
+export interface NativeReasoningOwner { destination: string; credential: string }
+
+/** Bind exact ciphertext to the durable route that accepted it. */
+export function nativeReasoningTag(owner: NativeReasoningOwner | undefined, blob: string): string | undefined {
+  const salt = thoughtSignatureReplaySalt();
+  if (!owner || !salt || salt.length < 16 || blob.length === 0) return undefined;
+  return createHmac("sha256", salt).update("native-reasoning\0")
+    .update(JSON.stringify([owner.destination, owner.credential, createHash("sha256").update(blob).digest("hex")]))
+    .digest("hex");
+}
+
+export function nativeReasoningTagMatches(expected: string | undefined, presented: string | undefined): boolean {
+  if (!expected || !presented || !/^[a-f0-9]{64}$/.test(expected) || !/^[a-f0-9]{64}$/.test(presented)) return false;
+  return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(presented, "hex"));
+}
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
 const OPAQUE_BLOB_REJECTION_TTL_MS = 5 * 60 * 1000;

package/src/responses/spill-store.ts

@@ -765,10 +765,23 @@ export function readResponseSpill(responseId: string, ref: ResponseSpillRef): Re
 export function deleteResponseSpill(ref: ResponseSpillRef): void {
   if (!validSpillRef(ref)) return;
   const dir = responseSpillDirectory();
+  const path = join(dir, ref.fileName);
   try {
-    unlink(join(dir, ref.fileName));
+    unlink(path);
     fsyncDirectoryBestEffort(dir);
-  } catch { /* best effort */ }
+  } catch (error) {
+    // Still best effort, but no longer invisible: a file a failed unlink left behind occupies
+    // the volume, so the accounting owner keeps pricing it until the path is gone (#6747).
+    if (!isErrno(error, "ENOENT")) spillUnlinkFailureObserver?.(path, ref.payloadBytes);
+  }
+}
+
+type SpillUnlinkFailureObserver = (path: string, bytes: number) => void;
+let spillUnlinkFailureObserver: SpillUnlinkFailureObserver | null = null;
+
+/** The owner of spill accounting registers here so a failed unlink cannot under-report disk use. */
+export function setResponseSpillUnlinkFailureObserver(next: SpillUnlinkFailureObserver | null): void {
+  spillUnlinkFailureObserver = next;
 }
 
 type SpillDirNameKind = "spill" | "temp";

package/src/responses/state/metrics.ts

@@ -18,6 +18,10 @@ export interface ResponseStateMetrics {
   spillLastWriteFailureOrigin: ResponseSpillWriteFailureOrigin | null;
   spillAclRetryReturnedTimeouts: number;
   spillAclTimeoutMemoRefusals: number;
+  /** Publications refused because the durable spill cap could not make room (cumulative). */
+  spillCapacityRefusals: number;
+  /** Spills evicted by admission to make room for a newer publication (cumulative). */
+  spillHeadroomEvictions: number;
   spillLastWriteFailureAt: number | null;
   spillLastWriteSuccessAt: number | null;
   spillReadFailures: number;
@@ -37,6 +41,8 @@ export function computeResponseStateMetrics(params: {
   spillLastSuccessAt: number | null;
   spillAclRetryReturnedTimeouts: number;
   spillAclTimeoutMemoRefusals: number;
+  spillCapacityRefusals: number;
+  spillHeadroomEvictions: number;
   spillLastFailureAt: number | null;
   spillReadFailures: number;
   replayScopeMismatchDrops: number;
@@ -79,6 +85,8 @@ export function computeResponseStateMetrics(params: {
     spillLastWriteFailureOrigin: params.spillLastFailureOrigin,
     spillAclRetryReturnedTimeouts: params.spillAclRetryReturnedTimeouts,
     spillAclTimeoutMemoRefusals: params.spillAclTimeoutMemoRefusals,
+    spillCapacityRefusals: params.spillCapacityRefusals,
+    spillHeadroomEvictions: params.spillHeadroomEvictions,
     spillLastWriteFailureAt: params.spillLastFailureAt,
     spillLastWriteSuccessAt: params.spillLastSuccessAt,
     spillReadFailures: params.spillReadFailures,

package/src/responses/state/spill-failure.ts

@@ -1,8 +1,14 @@
 export const spillCounters = {
   writes: 0, writeFailures: 0, readFailures: 0,
   aclRetryReturnedTimeouts: 0, aclTimeoutMemoRefusals: 0,
+  capacityRefusals: 0, headroomEvictions: 0,
 };
 
+/** Test-only: zero every spill counter, including ones added later. */
+export function resetSpillCountersForTests(): void {
+  for (const key of Object.keys(spillCounters) as Array<keyof typeof spillCounters>) spillCounters[key] = 0;
+}
+
 export type ResponseSpillWriteFailureCode =
   | "EACLRETRYEXHAUSTED"
   | "ETIMEDOUT"
@@ -102,6 +108,12 @@ export function noteSpillWriteFailure(
   if (origin === "retry_returned_timeout") spillCounters.aclRetryReturnedTimeouts += 1;
   else if (origin === "timeout_memo_refusal") spillCounters.aclTimeoutMemoRefusals += 1;
 }
+
+/** A publication refused because the durable spill cap could not make room for it (#6747). */
+export function noteSpillCapacityRefusal(): void {
+  spillCounters.capacityRefusals += 1;
+  noteSpillWriteFailure(null, "ECAPACITY");
+}
 /**
  * Admission-boundary observability (test-visible). directSpills: oversized
  * candidates routed straight to durable spill without a resident stay or

package/src/responses/state/spill-queue.ts

@@ -11,12 +11,14 @@ import {
   responseSpillNow,
   type ResponseSpillPublicationControl,
   type ResponseSpillRef,
+  setResponseSpillUnlinkFailureObserver,
   writeResponseSpillDurably,
   writeResponseSpillDurablyAsync,
 } from "../spill-store";
 import { enforceAppOwnedMemoryBudget } from "../../lib/app-owned-memory";
 import {
   admissionCounters,
+  noteSpillCapacityRefusal,
   noteSpillWriteFailure,
   noteSpillWriteSuccess,
   spillAclMemoRefusalOrigin,
@@ -42,7 +44,8 @@ export interface SpillQueueStore {
   pruneResponses(): void;
   accountedResponseSpillBytes(): number;
   spillByteCap(): number;
-  enforceSpilledResponseBudget(): number;
+  /** No argument: plain cap pruning. A number (0 included): admission reclaim of that headroom. */
+  enforceSpilledResponseBudget(requiredHeadroomBytes?: number): number;
   terminalizationMaxPasses(): number;
 }
 
@@ -122,6 +125,8 @@ function chargeUnreclaimableSpillPath(path: string | null | undefined, bytes: nu
   if (!path || bytes <= 0) return;
   unreclaimableSpillPaths.set(path, bytes);
 }
+// A failed unlink of an installed or deferred spill leaves a real file too; price it the same way.
+setResponseSpillUnlinkFailureObserver(chargeUnreclaimableSpillPath);
 
 /** Drop charges for paths that have since disappeared; returns the surviving total. */
 function reconcileUnreclaimableSpillPaths(): number {
@@ -286,9 +291,10 @@ export function queuePendingResponseSpill(
   // against a total that is short by a whole envelope.
   const inheritedBytes = inheritedSpill?.payloadBytes ?? 0;
   if (requireStore().accountedResponseSpillBytes() + footprint + inheritedBytes > requireStore().spillByteCap()) {
-    requireStore().enforceSpilledResponseBudget();
+    // An envelope over the replay ceiling ends in EFBIG anyway; never evict a continuation for it.
+    if (footprint / 2 <= responseSpillPayloadCap()) requireStore().enforceSpilledResponseBudget(footprint + inheritedBytes);
     if (requireStore().accountedResponseSpillBytes() + footprint + inheritedBytes > requireStore().spillByteCap()) {
-      noteSpillWriteFailure(null, "ECAPACITY");
+      noteSpillCapacityRefusal();
       requireStore().replaceWithSpillFailure(id, candidate);
       requireStore().deferSupersededSpill(inheritedSpill);
       return;
@@ -421,10 +427,11 @@ function installShutdownFallbackSpill(
     // over budget. `replaceWithSpillFailure` is the same fail-closed ending the budget
     // exhaustion path uses, so replay reports `spill_failed` and the client resends.
     if (requireStore().accountedResponseSpillBytes() + supersededBytes > requireStore().spillByteCap()) {
-      requireStore().enforceSpilledResponseBudget();
+      // The footprint is already reserved above, so only the superseded generation is extra room.
+      if (footprint / 2 <= responseSpillPayloadCap()) requireStore().enforceSpilledResponseBudget(supersededBytes);
       if (requireStore().accountedResponseSpillBytes() + supersededBytes > requireStore().spillByteCap()) {
         if (requireStore().currentEntry(job.id) === candidate) {
-          noteSpillWriteFailure(null, "ECAPACITY");
+          noteSpillCapacityRefusal();
           requireStore().replaceWithSpillFailure(job.id, candidate);
           requireStore().deferSupersededSpill(job.supersededSpill);
         }