@bitkyc08/opencodex 2.81.0 → 2.82.0

package/src/responses/state.ts

@@ -31,7 +31,7 @@ import { recoverStaleResponseStateTemps } from "./state/temp-recovery";
 export type { ResponseSpillWriteFailureCode, ResponseSpillWriteStatus, ResponseSpillWriteFailureOrigin } from "./state/spill-failure";
 import type { ResponseSpillWriteFailureCode, ResponseSpillWriteStatus, ResponseSpillWriteFailureOrigin } from "./state/spill-failure";
 export { responseAdmissionCountersForTests } from "./state/spill-failure";
-import { admissionCounters, noteSpillWriteFailure, noteSpillWriteSuccess, spillCounters, spillWriteHealth } from "./state/spill-failure";
+import { admissionCounters, noteSpillWriteFailure, noteSpillWriteSuccess, resetSpillCountersForTests, spillCounters, spillWriteHealth } from "./state/spill-failure";
 import { loadSnapshotEntry } from "./state/snapshot-codec";
 import { isBodyNonPersistable } from "./state/body-policy";
 export { isBodyNonPersistable, markBodyNonPersistable } from "./state/body-policy";
@@ -876,20 +876,29 @@ export function replayOverlapSkipsForTests(): number {
  * This ceiling therefore bounds what the store owns, which is every file it can
  * account for, and not the directory as a whole.
  */
-function enforceSpilledResponseBudget(): number {
+function enforceSpilledResponseBudget(requiredHeadroomBytes?: number): number {
   // Price in-flight publications too: a file being created by
   // `writeResponseSpillDurablyAsync` occupies the volume before it reaches `states`.
   let spilledBytes = accountedResponseSpillBytes();
-  if (spilledBytes <= spillByteCap()) return 0;
+  // Admission (#6747) passes the room its publication needs, 0 included. Evict only while that
+  // room is still reachable: re-read accounting after each attempt, since a failed unlink stays
+  // charged, and stop the moment the publication cannot fit so no unrelated continuation pays.
+  const admission = requiredHeadroomBytes !== undefined;
+  const headroom = admission && requiredHeadroomBytes > 0 ? requiredHeadroomBytes : 0;
+  const feasible = (): boolean => !admission
+    || (spilledBytes = accountedResponseSpillBytes()) - spilledResponseBytes() + headroom <= spillByteCap();
+  if (!feasible() || spilledBytes <= spillByteCap() - headroom) return 0;
   const before = spilledBytes;
   // Deferred generations go first. They are already superseded, so releasing one
   // costs only the crash window the queue exists to cover — the same trade
   // PENDING_SPILL_UNLINKS_MAX already makes against unbounded disk. Evicting a
   // live continuation to make room for a dead file would be the wrong order.
-  while (spilledBytes > spillByteCap() && pendingSpillUnlinks.length > 0) {
+  while (spilledBytes > spillByteCap() - headroom && pendingSpillUnlinks.length > 0) {
     const ref = pendingSpillUnlinks.shift()!;
     spilledBytes -= ref.payloadBytes;
     deleteResponseSpill(ref);
+    if (admission) spillCounters.headroomEvictions += 1;
+    if (!feasible()) return before - spilledBytes;
   }
   // Ordered by createdAt, not by map order. `states` is not an age index:
   // demotion and spill replacement delete and reinsert entries, and
@@ -906,9 +915,11 @@ function enforceSpilledResponseBudget(): number {
     .sort((a, b) => a[1].createdAt - b[1].createdAt
       || (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
   for (const [id, entry] of spilled) {
-    if (spilledBytes <= spillByteCap()) break;
+    if (spilledBytes <= spillByteCap() - headroom) break;
     spilledBytes -= entry.spill.payloadBytes;
     deleteEntry(id);
+    if (admission) spillCounters.headroomEvictions += 1;
+    if (!feasible()) return before - spilledBytes;
   }
   return before - spilledBytes;
 }
@@ -1210,6 +1221,7 @@ export function responseStateMetrics(): ResponseStateMetrics {
     spillLastSuccessAt: spillWriteHealth.lastSuccessAt,
     spillAclRetryReturnedTimeouts: spillCounters.aclRetryReturnedTimeouts,
     spillAclTimeoutMemoRefusals: spillCounters.aclTimeoutMemoRefusals,
+    spillCapacityRefusals: spillCounters.capacityRefusals, spillHeadroomEvictions: spillCounters.headroomEvictions,
     spillLastFailureAt: spillWriteHealth.lastFailureAt,
     spillReadFailures: spillCounters.readFailures,
     replayScopeMismatchDrops,
@@ -1321,11 +1333,7 @@ export function clearResponseStateMemoryForTests(): void {
   oldestResidentAt = null;
   stateRevision = 0;
   pendingSpillUnlinks.length = 0;
-  spillCounters.writes = 0;
-  spillCounters.writeFailures = 0;
-  spillCounters.readFailures = 0;
-  spillCounters.aclRetryReturnedTimeouts = 0;
-  spillCounters.aclTimeoutMemoRefusals = 0;
+  resetSpillCountersForTests();
   spillWriteHealth.consecutiveFailures = 0;
   spillWriteHealth.lastFailureCode = null;
   spillWriteHealth.lastFailureOrigin = null;

package/src/responses/task-input.ts

@@ -54,3 +54,20 @@ export function externalTaskInputContent(item: unknown): string | OcxContentPart
     block.type === "output_text" ? { ...block, type: "input_text" } : block,
   ));
 }
+
+/**
+ * The same recognition, emitted as Responses-wire user content for the raw-body repairs (#6764).
+ *
+ * The passthrough and routed-compaction paths never read the parsed context, so they used to
+ * send this envelope through the generic orphan repair, which prefixes
+ * "[tool output for unknown call]". A summarizer then read an authorized handover as a stray tool
+ * result. Recognition is shared with the parser so both paths agree on what is task input.
+ */
+export function externalTaskInputResponsesContent(item: unknown): Record<string, unknown>[] | undefined {
+  if (externalTaskInputContent(item) === undefined) return undefined;
+  const output = (item as { output: string | TaskInputBlock[] }).output;
+  if (typeof output === "string") return [{ type: "input_text", text: output }];
+  return output.map(block => block.type === "input_image"
+    ? { type: "input_image", image_url: block.image_url, ...(block.detail ? { detail: block.detail === "original" ? "high" : block.detail } : {}) }
+    : { type: "input_text", text: block.text });
+}

package/src/server/background-lifecycle.ts

@@ -14,6 +14,7 @@ import {
 } from "../storage/policy-scheduler";
 import { startQuotaResetPoller, stopQuotaResetPoller } from "../quota/reset-poller";
 import {
+  setCatalogAutoRefreshClientFanout,
   startCatalogAutoRefresh,
   stopCatalogAutoRefresh,
   syncCatalogAutoRefreshCadence,
@@ -40,6 +41,7 @@ type ProcessLoops = {
 
 type LeaseOwner = {
   token: symbol;
+  fanoutRevoked: boolean;
   applyPolicy: PolicyApply;
   resources: ServerResourceOwnerLease;
   lowQuota: LowQuotaRegistration;
@@ -48,6 +50,7 @@ type LeaseOwner = {
 export type ServerBackgroundLifecycleLease = {
   scheduleStartupRun(): void;
   listLowQuotaEvents(limit?: number): LowQuotaEvent[];
+  revokeClientFanout(): void;
   release(): Promise<void>;
   releaseAfterFailedStart(): void;
 };
@@ -61,6 +64,25 @@ function setLivePolicyOwner(applyPolicy: PolicyApply | null): void {
   setStorageCleanupPolicyJobLiveApply(applyPolicy);
 }
 
+/** Resolve the current process owner at delivery time so lease hand-over cannot retain an old port. */
+async function refreshConnectedClientsAfterCatalogChange(isCurrent: () => boolean) {
+  const captured = owners.findLast(owner => !owner.fanoutRevoked);
+  if (!captured) return [];
+  const current = () => isCurrent() && !captured.fanoutRevoked && owners.includes(captured);
+  const [{ readRuntimePort }, { loadConfig }, { localClientSyncAllowed }, { syncEnabledClientIntegrations }] =
+    await Promise.all([
+      import("../config/process-state"),
+      import("../config"),
+      import("../codex/desired-state"),
+      import("./management/config-routes"),
+    ]);
+  const runtime = readRuntimePort(process.pid);
+  const config = loadConfig();
+  // An explicit catalog tick on a hub is not permission to enroll its local clients.
+  if (!runtime || !current() || !localClientSyncAllowed(config)) return [];
+  return syncEnabledClientIntegrations(runtime.port, config, {}, { unattended: { isCurrent: current } });
+}
+
 function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
   let memoryWatchdog: MemoryWatchdog | null = null;
   let stateStoreSweeper: ReturnType<typeof startStateStoreSweeper> | null = null;
@@ -83,6 +105,7 @@ function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
     // and interval timers are unref'd. The scheduler
     // module keeps every heavy import inside its tick, so naming it statically here
     // costs a module record and nothing else.
+    setCatalogAutoRefreshClientFanout(refreshConnectedClientsAfterCatalogChange);
     startCatalogAutoRefresh();
     // The scheduler starts at its default cadence because resolving the operator's value
     // reads the config barrel. Fire-and-forget: startup must not await an optional
@@ -106,6 +129,7 @@ function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
     stopStorageCleanupScheduler();
     stopQuotaResetPoller();
     stopCatalogAutoRefresh();
+    setCatalogAutoRefreshClientFanout(null);
     setLivePolicyOwner(null);
     throw error;
   }
@@ -119,6 +143,7 @@ function stopProcessLoops(): void {
   stopStorageCleanupScheduler();
   stopQuotaResetPoller();
   stopCatalogAutoRefresh();
+  setCatalogAutoRefreshClientFanout(null);
   setLivePolicyOwner(null);
 }
 
@@ -181,6 +206,7 @@ export function acquireServerBackgroundLifecycle(
 
   const owner: LeaseOwner = {
     token: Symbol("server-background-lifecycle"),
+    fanoutRevoked: false,
     applyPolicy,
     resources: acquireServerResourceOwner(),
     lowQuota: registerCodexLowQuotaProtection(config),
@@ -206,6 +232,7 @@ export function acquireServerBackgroundLifecycle(
     return stopStoragePolicyWorker().finally(() => { cleanupInProgress = false; });
   }
   return {
+    revokeClientFanout() { owner.fanoutRevoked = true; },
     listLowQuotaEvents(limit) { return owner.lowQuota.listEvents(limit); },
     scheduleStartupRun() {
       if (owners.some(candidate => candidate.token === owner.token)) {

package/src/server/chat-completions.ts

@@ -113,6 +113,7 @@ export async function handleChatCompletions(
     return finalizeTranslatorBudgetResponse(
       await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds),
       translatorBudget,
+      req.signal,
     );
   } catch (error) {
     translatorBudget.dispose();

package/src/server/chat-native.ts

@@ -361,14 +361,16 @@ export async function runNativeChatAttempt(
   // key rotation so recovery cannot replace the ceiling along with the active credential.
   const requestTransientPolicy = transientRetryPolicyFor(activeProvider);
   let transientSendsUsed = 0;
-  // A combo child also answers to the request's shared base allowance, at the cap its own ladder
-  // uses. Its first send is exempt: the combo reserved it before dispatching this target.
+  // A Combo child's initial send is prepaid, not exempt from the shared ceiling. Only its
+  // owning permit exposes that one booking in addition to the still-unspent allowance, and only
+  // until this child's first physical send has started and settled the booking.
   const sharedSendCap = requestTransientPolicy?.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS;
   let physicalSends = 0;
+  let initialSendStarted = false;
   const remainingSharedSends = (): number => {
     if (!sendBudget) return Number.POSITIVE_INFINITY;
     const remaining = sendBudget.remainingBaseSends(sharedSendCap);
-    return physicalSends === 0 ? Math.max(1, remaining) : remaining;
+    return Math.min(sharedSendCap, remaining + (!initialSendStarted && execution.comboDispatchPermit ? 1 : 0));
   };
   const remainingTransientSends = (): number => Math.min(
     requestTransientPolicy
@@ -404,6 +406,21 @@ export async function runNativeChatAttempt(
     claimAmbiguousResend,
   );
 
+  // Non-enforced accounting for one physical send. Enforced spend is owned by the reporter.
+  const comboReceipt = Boolean(sendBudget && execution.comboDispatchPermit);
+  const settleNonEnforcedSend = (url: string): void => {
+    if (sendBudget) {
+      // Backstop for sends the helper cannot see coming (a reset replay). The first
+      // report settles the combo's booking; each later one is charged and booked.
+      if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
+        throw new SendBudgetExhaustedError(safeHostLabel(url));
+      }
+      physicalSends += 1;
+      reportDispatchSends(sendBudget, 1, execution.comboDispatchPermit);
+      initialSendStarted = true;
+    } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
+  };
+
   const send = async (
     request: AdapterRequest,
     recovery?: "rate-limit-429" | "key-429" | UpstreamSendRecovery,
@@ -433,6 +450,9 @@ export async function runNativeChatAttempt(
           providerFetch(activeProvider, undefined, {
             providerName: route.providerName,
             modelId: route.modelId,
+            onPhysicalDispatch: comboReceipt
+              ? () => { if (!physicalBudget.spendEnforced) settleNonEnforcedSend(request.url); }
+              : undefined,
             dispatchOverride: async (_input, init, execute) => {
               if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
                 const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
@@ -466,15 +486,11 @@ export async function runNativeChatAttempt(
                   if ((logCtx.spendTracker as { refusals?: number } | undefined)?.refusals) throw new NativeChatSpendRefusal();
                   throw new SendBudgetExhaustedError();
                 }
-                if (!physicalBudget.spendEnforced && sendBudget) {
-                  // Backstop for sends the helper cannot see coming (a reset replay). The first
-                  // report settles the combo's booking; each later one is charged and booked.
-                  if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
-                    throw new SendBudgetExhaustedError(safeHostLabel(request.url));
-                  }
-                  physicalSends += 1;
-                  reportDispatchSends(sendBudget, 1, execution.comboDispatchPermit);
-                } else if (!physicalBudget.spendEnforced && !spendTracker?.charge()) throw new NativeChatSpendRefusal();
+                // Enforced spend started this send at `beforeSend`. A Combo child's non-enforced
+                // send is booked by the physical-dispatch receipt instead, so a local refusal
+                // before the wire refunds the booking rather than charging it.
+                if (physicalBudget.spendEnforced) initialSendStarted = true;
+                else if (!comboReceipt) settleNonEnforcedSend(request.url);
                 noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
                 // A reselected provider transport is still a physical send: the connection policy
                 // and manual-redirect ownership wrap the selected implementation (#4992).

package/src/server/claude-messages.ts

@@ -21,7 +21,8 @@ import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize"
 import { createToolCallIdAllocator } from "../adapters/tool-call-id";
 import { openAIChatSerializesThinking } from "../adapters/openai-chat/messages";
 import { messagesToResponsesTranslation } from "../protocols/codecs/messages";
-import { AnthropicRequestError, DesktopModelMappingUnavailableError, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
+import { AnthropicRequestError, DesktopModelMappingUnavailableError, extractOcxEffortDirective, extractOcxRouteDirective, nativeAnthropicProjection, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
+import { nativeReasoningTag, type NativeReasoningOwner } from "../responses/reasoning-replay-cache";
 import { isKnownDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
 import { resolveAlias, claudeCodeNativeAlias, legacyAliasForNative } from "../claude/alias";
 import { recordDesktopRequest } from "../claude/desktop-health";
@@ -41,6 +42,7 @@ import {
 } from "../lib/upstream-retry";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { anthropicRateLimitHeaders } from "./anthropic-rate-limit-headers";
+import { upstreamMessagesRequestIdHeaders } from "./messages-response-headers";
 import {
   anthropicErrorBody,
   anthropicErrorResponse,
@@ -634,7 +636,10 @@ async function anthropicNativePassthrough(
   const upstream = result.upstream;
 
   const contentType = upstream.headers.get("content-type") ?? "application/json";
-  const rateLimitHeaders = anthropicRateLimitHeaders(upstream.headers);
+  const rateLimitHeaders = {
+    ...anthropicRateLimitHeaders(upstream.headers),
+    ...(pathname === "/v1/messages" ? upstreamMessagesRequestIdHeaders(upstream.headers) : {}),
+  };
   const bodyGuard = resolvePassthroughBodyGuard(config, req.signal);
   if (upstream.ok && contentType.includes("text/event-stream") && upstream.body) {
     return new Response(tapAnthropicSseForLog(upstream.body, logCtx, finalize, bodyGuard), {
@@ -837,6 +842,7 @@ export async function handleClaudeMessages(
     return finalizeTranslatorBudgetResponse(
       await handleClaudeMessagesWithBudget(req, config, logCtx, translatorBudget, logIds, requestPolicy, ingress),
       translatorBudget,
+      req.signal,
     );
   } catch (error) {
     translatorBudget.dispose();
@@ -872,6 +878,9 @@ async function handleClaudeMessagesWithBudget(
   let anthropicBody: unknown;
   let internalBody: Rec;
   let cacheKeySource: ClaudeCacheKeySource = null;
+  let nativeReasoningReplay: ReadonlyMap<string, string> | undefined;
+  const nativeReasoningMint: { owner?: NativeReasoningOwner } = {};
+  let nativeProjectionOnlyError: AnthropicRequestError | undefined;
   let effortOverride: string | null = null;
   let effortRow: ParsedEffortRowId | null = null;
   let fastRow: ParsedFastRowId | null = null;
@@ -962,7 +971,15 @@ async function handleClaudeMessagesWithBudget(
     if (!effortRow && !fastRow && isRec(anthropicBody) && wantsNativePassthrough(req, config, requestPolicy, anthropicBody.model, cc)) {
       markProtocolEntry(logCtx, { inbound: "messages", lane: "native", features: messagesFeatures });
       recordProtocolShadowPlan(logCtx, config, { inbound: "messages", model: requestedModel });
-      return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
+      let projectedBody: Rec;
+      try {
+        projectedBody = nativeAnthropicProjection(anthropicBody, translatorBudget);
+      } catch (err) {
+        if (!isTranslatorBudgetExceededError(err)) throw err;
+        if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 413, { closeReason: "non_stream" });
+        return anthropicErrorResponse(413, "request translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");
+      }
+      return await anthropicNativePassthrough(req, config, logCtx, logIds, projectedBody, "/v1/messages");
     }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string"
       && messagesSecondaryInstanceUnavailable(config, anthropicBody.model, cc)) {
@@ -1017,7 +1034,19 @@ async function handleClaudeMessagesWithBudget(
       };
       delete anthropicBody.thinking;
     }
-    const translation = messagesToResponsesTranslation(anthropicBody, cc, translatorBudget);
+    let translation;
+    try {
+      translation = messagesToResponsesTranslation(anthropicBody, cc, translatorBudget);
+    } catch (err) {
+      // A native Messages route can discard an undecodable proxy envelope. Keep the
+      // original error for any route that ultimately translates to Responses.
+      if (!(err instanceof AnthropicRequestError) || err.message !== "malformed ocxr1 reasoning signature"
+        || !isRec(anthropicBody)) throw err;
+      const projected = nativeAnthropicProjection(anthropicBody, translatorBudget);
+      if (projected === anthropicBody) throw err;
+      translation = messagesToResponsesTranslation(projected, cc, translatorBudget);
+      nativeProjectionOnlyError = err;
+    }
     internalBody = translation.body;
     // The Anthropic translator builds its body from model/input/store/stream plus sampling
     // fields only, so the caller intent is applied to the TRANSLATED body rather than the
@@ -1025,6 +1054,7 @@ async function handleClaudeMessagesWithBudget(
     if (fastRow) internalBody.service_tier = "priority";
     translatorBudget.chargeRetained(jsonUtf8Bytes(internalBody), { kind: "request_copies" });
     cacheKeySource = translation.cacheKeySource;
+    nativeReasoningReplay = translation.nativeReasoningReplay;
   } catch (err) {
     const overflow = isTranslatorBudgetExceededError(err);
     const unavailable = err instanceof DesktopModelMappingUnavailableError;
@@ -1171,6 +1201,10 @@ async function handleClaudeMessagesWithBudget(
     ? nativeMessagesDeclineReason(settledRoute, anthropicBody, config, nativeSelector)
     : "rollout-disabled";
   const nativeMessagesRoute = settledRoute && nativeDecline === undefined ? settledRoute : undefined;
+  if (nativeProjectionOnlyError && !nativeMessagesRoute) {
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
+    return anthropicErrorResponse(400, nativeProjectionOnlyError.message, "invalid_request_error");
+  }
   // With the switch on, a declined route says why on its bridge mark, as native Chat does.
   if (nativeDecline && nativeDecline !== "rollout-disabled") {
     markProtocolEntry(logCtx, {
@@ -1209,7 +1243,7 @@ async function handleClaudeMessagesWithBudget(
     let nativeBody: Rec;
     try {
       // Built from the source envelope when there is one, after the managed-client steps above.
-      nativeBody = envelope ? envelope.freshBody() : anthropicBody as Rec;
+      nativeBody = nativeAnthropicProjection(envelope ? envelope.freshBody() : anthropicBody as Rec, translatorBudget);
     } catch (err) {
       if (!isTranslatorBudgetExceededError(err)) throw err;
       if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 413, { closeReason: "non_stream" });
@@ -1314,6 +1348,8 @@ async function handleClaudeMessagesWithBudget(
     // Without this the replay would look native and a Responses-scoped wire default
     // would fire, disagreeing with the pre-flight decision above.
     inboundWire: "anthropic",
+    nativeReasoningReplay,
+    nativeReasoningMint,
     claudeGoAffinity: { sessionLane: claudeGoSessionLane },
     claudeNativeSessionId,
     stripClaudeMainAuthForNoncanonicalForward: true,
@@ -1395,6 +1431,7 @@ async function handleClaudeMessagesWithBudget(
   if (contentType.includes("text/event-stream") && response.body) {
     const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, {
       translatorBudget,
+      nativeReasoningTagFor: blob => nativeReasoningTag(nativeReasoningMint.owner, blob),
       // Only a floor, and only for the first frame: an upstream that reports usage early wins
       // over it inside the translator, and the terminal `message_delta` carries the
       // authoritative count either way (#4857).
@@ -1464,7 +1501,7 @@ async function handleClaudeMessagesWithBudget(
   }
   let message: Rec;
   try {
-    message = responsesJsonToAnthropicMessage(json, requestedModel, translatorBudget);
+    message = responsesJsonToAnthropicMessage(json, requestedModel, translatorBudget, blob => nativeReasoningTag(nativeReasoningMint.owner, blob));
   } catch (err) {
     if (!isTranslatorBudgetExceededError(err)) throw err;
     return anthropicErrorResponse(413, "upstream translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");

package/src/server/inbound-body-admission.ts

@@ -181,6 +181,7 @@ export function runAdmittedBodyWork(
       addFinalRequestLog(refusalLog.requestId, refusalLog.start, refusalLog.logCtx, refused.status, {
         closeReason: "terminal",
       });
+      refusalLog.onLogged?.();
     }
     return withCors(refused, req, policy);
   });

package/src/server/index/claude-intercept-lifecycle.ts

@@ -41,10 +41,11 @@ export function buildInterceptDesiredClients(config: OcxConfig, observed: Claude
  * imports keep the catalog and discovery off the synchronous startup path.
  */
 export async function loadPickerRoutesFromCatalog(): Promise<PickerRouteInput> {
-  const [{ loadConfig }, { fetchAllModels }, catalog] = await Promise.all([
+  const [{ loadConfig }, { fetchAllModels }, catalog, { resolveAutoContext }] = await Promise.all([
     import("../../config"),
     import("../management-api"),
     import("../../codex/catalog"),
+    import("../../claude/context-windows"),
   ]);
   const config = loadConfig();
   const models = await fetchAllModels(config);
@@ -54,6 +55,7 @@ export async function loadPickerRoutesFromCatalog(): Promise<PickerRouteInput> {
       .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow })),
     ...(config.claudeCode?.desktopProfile ? { profile: config.claudeCode.desktopProfile } : {}),
     nativeContextCap: catalog.nativeContextLimits(config),
+    auto: resolveAutoContext(config.claudeCode),
   };
 }
 

package/src/server/index/serve-options.ts

@@ -21,6 +21,7 @@ import {
 } from "./live-sideband";
 import {
   withRequestLogId,
+  withMessagesRequestLogId,
 } from "./startup-warnings";
 
 import { remoteWorkspaceEnabled } from "../../remote-control/workspace-activation";
@@ -118,6 +119,7 @@ import { handleChatCompletions } from "../chat-completions";
 import { anthropicErrorResponse } from "../../claude/outbound";
 import {
   buildDesktop3pRegistry,
+  desktop3pModelOptions,
   generateDesktop3pModels,
 } from "../../claude/desktop-3p";
 import { buildDesktopDiscoveryInputs } from "../../claude/desktop-discovery-inputs";
@@ -1024,6 +1026,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             const models = config.claudeCode?.enabled === false ? [] : generateDesktop3pModels(
               desktopInputs.nativeSlugs, desktopInputs.routedModels,
               config.claudeCode?.desktopProfile, desktopInputs.nativeContextCap,
+              desktop3pModelOptions(config.claudeCode),
             );
             const response = jsonResponse({ version: 1, models }, 200, req, policy);
             response.headers.set("Cache-Control", "no-store");
@@ -1556,11 +1559,16 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // pre-translation stream + native passthrough callbacks) — do not re-wrap the
         // translated Anthropic stream here.
         const sessionReq = withCallerSessionIdentity(req, admission);
-        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
+        // Entering the handler, or a logged refusal, means the final request log owns requestId.
+        let ownsRequestLog = false;
+        const claimRequestLog = (work: (lease: ActiveTurnLease) => Promise<Response>) =>
+          (lease: ActiveTurnLease) => { ownsRequestLog = true; return work(lease); };
+        const response = await runAdmittedHttpTurn(sessionReq, policy, claimRequestLog(async turnAdmissionLease => withCors(
           await handleClaudeMessages(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy, { claudeIntercept: ingress === "claude-intercept" }),
           req,
           policy,
-        ), { requestId, start, logCtx });
+        )), { requestId, start, logCtx, onLogged: () => { ownsRequestLog = true; } });
+        return ownsRequestLog ? withMessagesRequestLogId(response, requestId) : response;
       }
 
       // OpenAI Chat Completions inbound (GitHub Copilot App / OpenAI-compatible clients).

package/src/server/index/spend-ledger-lifecycle.ts

@@ -37,7 +37,8 @@ export interface SpendLedgerServerLifecycle {
 export function acquireSpendLedgerServerLifecycle(configDir: string): SpendLedgerServerLifecycle {
   const owner: SpendLedgerOwnerLease = acquireSpendLedgerOwner(configDir);
   // Advisory: a synced state directory makes the journal's hard-link guard refuse intermittently
-  // (#6314). Said once at startup instead of being discovered from a 502.
+  // (#6314), including Google Drive syncing the native Desktop or Documents folder. Said once
+  // at startup instead of being discovered from a 502. The nlink guard itself is unchanged.
   warnIfSyncedStateDirectory(configDir);
   // Each entry returns whatever the listener's own stop returned. Typed as void-or-promise
   // because the rollback below has to WAIT on it: declaring it `() => void` let the call site

package/src/server/index/startup-warnings.ts

@@ -100,6 +100,25 @@ import {
 
 const REQUEST_LOG_ID_RESPONSE_HEADER = "x-opencodex-request-id";
 
+/** Messages clients persist request-id; the upstream diagnostic id has a separate namespace. */
+export function withMessagesRequestLogId(response: Response, requestId: string): Response {
+  const upstreamId = response.headers.get("request-id");
+  const correlated = withRequestLogId(response, requestId);
+  correlated.headers.delete("x-opencodex-upstream-request-id");
+  if (upstreamId && /^req_[A-Za-z0-9_-]{1,128}$/.test(upstreamId)) {
+    correlated.headers.set("x-opencodex-upstream-request-id", upstreamId);
+  }
+  correlated.headers.set("request-id", requestId);
+  const exposed = correlated.headers.get("Access-Control-Expose-Headers") ?? "";
+  const names = exposed.split(",").map(name => name.trim().toLowerCase());
+  const additions = ["request-id", ...(correlated.headers.has("x-opencodex-upstream-request-id")
+    ? ["x-opencodex-upstream-request-id"] : [])].filter(name => !names.includes(name));
+  if (additions.length) {
+    correlated.headers.set("Access-Control-Expose-Headers", [exposed, ...additions].filter(Boolean).join(", "));
+  }
+  return correlated;
+}
+
 export function withRequestLogId(response: Response, requestId: string): Response {
   const headers = new Headers(response.headers);
   headers.set(REQUEST_LOG_ID_RESPONSE_HEADER, requestId);

package/src/server/index.ts

@@ -750,6 +750,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   Object.defineProperty(server, "stop", {
     configurable: true,
     value: async (closeActiveConnections?: boolean): Promise<void> => {
+      backgroundLifecycle?.revokeClientFanout();
       remoteWorkspaceStopping = true;
       liveCallBindings.clear();
       // Disarm the package-tree restart timer before teardown can schedule another restart.