@bitkyc08/opencodex 2.81.0 → 2.82.0

package/src/server/responses/codex-ws-pool.ts

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes } from "node:crypto";
+import { codexWsReuseAcrossTurnsEnabled } from "../../config/codex-ws-reuse-setting";
 import { registerOptionalShutdownHook } from "../../lib/optional-shutdown-hooks";
 import { CODEX_RESPONSES_HTTP_URL, CODEX_WS_FRAME_HEADERS } from "./codex-ws-request";
 import { CODEX_WS_ID_MAX_BYTES } from "./codex-ws-correlation";
@@ -7,11 +8,15 @@ import { CodexWsSession } from "./codex-ws-session";
 export const CODEX_WS_POOL_MAX_SESSIONS = 32;
 export const CODEX_WS_POOL_IDLE_MS = 30_000;
 export const CODEX_WS_POOL_MAX_AGE_MS = 5 * 60_000;
+export const CODEX_WS_POOL_WAIT_MS = 750;
+/** Retained sockets per account+thread while cross-turn reuse is on. */
+export const CODEX_WS_POOL_SCOPE_LIMIT = 2;
+const CODEX_WS_POOL_WAIT_DEPTH = 2;
 const MUTABLE_HEADERS = new Set<string>(CODEX_WS_FRAME_HEADERS);
 let processKey: Buffer | undefined;
 let poolSequence = 0;
 
-export interface CodexWsReuseIdentity { key: string; scope: string }
+export interface CodexWsReuseIdentity { key: string; scope: string; routeTag: string }
 function value(value: unknown): value is string {
   return typeof value === "string" && value.trim().length > 0
     && !/[\u0000-\u001f\u007f]/.test(value) && Buffer.byteLength(value) <= CODEX_WS_ID_MAX_BYTES;
@@ -49,19 +54,23 @@ export function codexWsReuseIdentity(url: string, headers: Record<string, string
   const immutable = Object.entries(headers).filter(([name]) => !MUTABLE_HEADERS.has(name)).sort(([a], [b]) => a.localeCompare(b));
   if (immutable.length > 128 || immutable.some(([, field]) => !value(field))
     || immutable.reduce((bytes, [name, field]) => bytes + Buffer.byteLength(name) + Buffer.byteLength(field), 0) > 32 * 1024) return null;
-  const scope = digest([url, account, thread, turn]);
+  const reuseAcrossTurns = codexWsReuseAcrossTurnsEnabled();
+  const scope = digest(reuseAcrossTurns ? [url, account, thread] : [url, account, thread, turn]);
   const lite = metadata.ws_request_header_x_openai_internal_codex_responses_lite;
   if (lite !== undefined && lite !== "true" && lite !== "false") return null;
   // `dialUrl` is the socket destination after plugin rewrites; absent means the canonical one.
-  return { scope, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null, dialUrl ?? null]) };
+  const routeTag = digest(["route", authorization, proxy ?? null, dialUrl ?? null]);
+  return { scope, routeTag, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null, dialUrl ?? null]) };
 }
 
 interface Entry { identity: CodexWsReuseIdentity; session: CodexWsSession; createdAt: number; idleAt: number; retired: boolean }
-interface PoolOptions { now?: () => number; maxSessions?: number; idleMs?: number; maxAgeMs?: number }
+interface Waiter { key: string; resolve: (session: CodexWsSession | null) => void; timer: ReturnType<typeof setTimeout>; onAbort: () => void; signal?: AbortSignal }
+interface PoolOptions { now?: () => number; maxSessions?: number; idleMs?: number; maxAgeMs?: number; waitMs?: number }
 
 /** Bounded retained sockets only. Busy/capacity misses keep the existing one-shot path. */
 export class CodexWsPool {
   private readonly entries = new Map<string, Entry>();
+  private readonly waiters: Waiter[] = [];
   private timer?: ReturnType<typeof setTimeout>;
   private detachShutdown?: () => void;
   private readonly hookKey = `codex-upstream-ws-pool-${++poolSequence}`;
@@ -69,29 +78,74 @@ export class CodexWsPool {
   private readonly maxSessions: number;
   private readonly idleMs: number;
   private readonly maxAgeMs: number;
+  private readonly waitMs: number;
   constructor(options: PoolOptions = {}) {
     this.now = options.now ?? Date.now;
     this.maxSessions = options.maxSessions ?? CODEX_WS_POOL_MAX_SESSIONS;
     this.idleMs = options.idleMs ?? CODEX_WS_POOL_IDLE_MS;
     this.maxAgeMs = options.maxAgeMs ?? CODEX_WS_POOL_MAX_AGE_MS;
+    this.waitMs = options.waitMs ?? CODEX_WS_POOL_WAIT_MS;
   }
 
   acquire(identity: CodexWsReuseIdentity, url: string, headers: Record<string, string>, proxy?: string): CodexWsSession | null {
-    this.sweep();
-    for (const entry of this.entries.values()) {
-      if (entry.identity.scope !== identity.scope || entry.identity.key === identity.key) continue;
-      entry.retired = true;
-      if (!entry.session.busy) this.remove(entry);
+    return this.claim(identity, url, headers, proxy).session;
+  }
+
+  /**
+   * Before any frame is sent, wait for the matching busy socket instead of dialing a throwaway.
+   * The queue is FIFO and at most two deep. An abort or the deadline returns null.
+   */
+  acquireWaiting(
+    identity: CodexWsReuseIdentity,
+    url: string,
+    headers: Record<string, string>,
+    proxy: string | undefined,
+    signal?: AbortSignal,
+  ): Promise<CodexWsSession | null> {
+    const claimed = this.claim(identity, url, headers, proxy);
+    if (claimed.session || !claimed.busy) return Promise.resolve(claimed.session);
+    if (signal?.aborted) return Promise.resolve(null);
+    if (this.waiters.filter(waiter => waiter.key === identity.key).length >= CODEX_WS_POOL_WAIT_DEPTH) {
+      return Promise.resolve(null);
     }
+    return new Promise(resolve => {
+      const waiter: Waiter = {
+        key: identity.key,
+        resolve,
+        signal,
+        timer: setTimeout(() => this.finishWaiter(waiter, null), this.waitMs),
+        onAbort: () => this.finishWaiter(waiter, null),
+      };
+      waiter.timer.unref?.();
+      signal?.addEventListener("abort", waiter.onAbort, { once: true });
+      this.waiters.push(waiter);
+    });
+  }
+
+  private claim(
+    identity: CodexWsReuseIdentity,
+    url: string,
+    headers: Record<string, string>,
+    proxy?: string,
+  ): { session: CodexWsSession | null; busy: boolean } {
+    this.sweep();
+    this.retireSiblings(identity);
     const existing = this.entries.get(identity.key);
     if (existing) {
-      if (existing.retired || existing.session.busy) return null;
-      if (existing.session.reserve()) { this.arm(); return existing.session; }
+      if (existing.retired) return { session: null, busy: false };
+      if (existing.session.busy) return { session: null, busy: true };
+      if (existing.session.reserve()) { this.arm(); return { session: existing.session, busy: false }; }
       this.remove(existing);
+    } else if (codexWsReuseAcrossTurnsEnabled() && this.scopeCount(identity.scope) >= CODEX_WS_POOL_SCOPE_LIMIT) {
+      const oldest = [...this.entries.values()]
+        .filter(entry => entry.identity.scope === identity.scope && !entry.session.busy)
+        .sort((left, right) => left.idleAt - right.idleAt)[0];
+      if (!oldest) return { session: null, busy: false };
+      this.remove(oldest);
     }
     if (this.entries.size >= this.maxSessions) {
       const oldest = [...this.entries.values()].filter(entry => !entry.session.busy).sort((a, b) => a.idleAt - b.idleAt)[0];
-      if (!oldest) return null;
+      if (!oldest) return { session: null, busy: false };
       this.remove(oldest);
     }
     const createdAt = this.now();
@@ -100,13 +154,45 @@ export class CodexWsPool {
     session.reserve();
     this.entries.set(identity.key, entry);
     this.detachShutdown ??= registerOptionalShutdownHook(this.hookKey, () => this.dispose());
-    return session;
+    return { session, busy: false };
+  }
+
+  private retireSiblings(identity: CodexWsReuseIdentity): void {
+    const reuseAcrossTurns = codexWsReuseAcrossTurnsEnabled();
+    for (const entry of this.entries.values()) {
+      if (entry.identity.scope !== identity.scope || entry.identity.key === identity.key) continue;
+      const routeChanged = entry.identity.routeTag !== identity.routeTag;
+      if (reuseAcrossTurns && !routeChanged) continue;
+      entry.retired = true;
+      if (!entry.session.busy) this.remove(entry);
+    }
+  }
+
+  private scopeCount(scope: string): number {
+    let count = 0;
+    for (const entry of this.entries.values()) if (entry.identity.scope === scope && !entry.retired) count += 1;
+    return count;
+  }
+
+  private finishWaiter(waiter: Waiter, session: CodexWsSession | null): void {
+    const index = this.waiters.indexOf(waiter);
+    if (index < 0) return;
+    this.waiters.splice(index, 1);
+    clearTimeout(waiter.timer);
+    waiter.signal?.removeEventListener("abort", waiter.onAbort);
+    waiter.resolve(session);
   }
 
   private changed(entry: Entry): void {
     if (this.entries.get(entry.identity.key) !== entry) return;
     if (entry.session.closed) this.entries.delete(entry.identity.key);
     else if (!entry.session.busy) {
+      const waiter = this.waiters.find(candidate => candidate.key === entry.identity.key);
+      if (waiter && !entry.retired && entry.session.reserve()) {
+        this.finishWaiter(waiter, entry.session);
+        this.arm();
+        return;
+      }
       entry.idleAt = this.now();
       if (entry.retired || entry.idleAt - entry.createdAt >= this.maxAgeMs) this.remove(entry);
     }
@@ -152,6 +238,7 @@ export class CodexWsPool {
     this.detachShutdown = undefined;
     const entries = [...this.entries.values()];
     this.entries.clear();
+    for (const waiter of [...this.waiters]) this.finishWaiter(waiter, null);
     for (const entry of entries) entry.session.dispose(new DOMException("codex websocket pool shutdown", "AbortError"));
   }
 

package/src/server/responses/codex-ws-wire.ts

@@ -49,6 +49,7 @@ const WS_CLOSE_MESSAGE_TOO_BIG = 1009;
 
 const codexWsUpstreamResponses = new WeakSet<Response>();
 const quotaObservedResponses = new WeakSet<Response>();
+const codexWsPreludeProjections = new WeakSet<Response>();
 
 /** Quota arrived directly at its captured account; do not replay old HTTP prelude headers. */
 export function isCodexWsQuotaObservedResponse(response: Response): boolean {
@@ -60,6 +61,14 @@ export function isCodexWsUpstreamResponse(response: Response): boolean {
   return codexWsUpstreamResponses.has(response);
 }
 
+/** Pre-response projection; its headers retain the exchange's prelude snapshot. */
+export function markCodexWsPreludeProjection(response: Response): void {
+  codexWsPreludeProjections.add(response);
+}
+
+export function isCodexWsPreludeProjection(response: Response): boolean {
+  return codexWsPreludeProjections.has(response);
+}
 
 export function markCodexWsResponse(response: Response, observed: boolean): void {
   codexWsUpstreamResponses.add(response);

package/src/server/responses/combo-requested-effort.ts

@@ -10,5 +10,7 @@ export function comboRequestedEffortLabel(
   const forcedTransition = forcedEffort != null && forcedEffort !== originalRequestedEffort
     ? `->${forcedEffort}`
     : "";
-  return `${originalRequestedEffort}${forcedTransition}${laterTransitions}`;
+  const segments = `${originalRequestedEffort}${forcedTransition}${laterTransitions}`.split("->");
+  // A pin that kept the effort it was given is not a transition; drop the repeated segment.
+  return segments.filter((segment, index) => index === 0 || segment !== segments[index - 1]).join("->");
 }

package/src/server/responses/core-codex-account.ts

@@ -6,6 +6,7 @@ import {
   computeQuotaCooldown,
   formatCodexProviderForLog,
 } from "../../codex/routing";
+import { claimMainQuotaDispatchForWs, isMainQuotaDispatchLive, renewMainQuotaDispatchForAttempt, type MainQuotaDispatch } from "../../codex/main-account-cache";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { isCodexAccountGenerationLive } from "../../codex/account-store";
@@ -121,8 +122,28 @@ export function usesCodexForwardPoolAuth(
 }
 
 
+/** Live proof that this plain-main response used the observed main credential. */
+export function liveMainQuotaDispatch(
+  authCtx: CodexAuthContext, provider: OcxProviderConfig,
+): MainQuotaDispatch | undefined {
+  if (authCtx.kind !== "main" || !authCtx.mainQuotaDispatch) return undefined;
+  if (!isCanonicalOpenAiForwardProvider(provider)
+    || provider.authMode !== "forward" || provider.adapter !== "openai-responses") return undefined;
+  return isMainQuotaDispatchLive(authCtx.mainQuotaDispatch) ? authCtx.mainQuotaDispatch : undefined;
+}
+
 export function codexWsQuotaObserver(authCtx: CodexAuthContext, provider: OcxProviderConfig, modelId?: string): CodexWsQuotaObserver | undefined {
-  if (!isCanonicalOpenAiForwardProvider(provider) || !usesCodexForwardPoolAuth(authCtx, provider)) return undefined;
+  if (!isCanonicalOpenAiForwardProvider(provider)) return undefined;
+  if (!usesCodexForwardPoolAuth(authCtx, provider)) {
+    const captured = liveMainQuotaDispatch(authCtx, provider);
+    if (!captured || authCtx.kind !== "main") return undefined;
+    const dispatch = authCtx.mainQuotaDispatch = renewMainQuotaDispatchForAttempt(captured);
+    return headers => {
+      claimMainQuotaDispatchForWs(dispatch);
+      if (!isMainQuotaDispatchLive(dispatch)) return;
+      applyCapturedCodexQuota(MAIN_CODEX_ACCOUNT_ID, headers, dispatch.configGeneration, dispatch.writer, { modelId });
+    };
+  }
   const { accountId, writerGeneration } = authCtx;
   const credentialGeneration = authCtx.kind === "pool" ? authCtx.generation : undefined;
   const mainWriter = authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined;

package/src/server/responses/core-combo-native.ts

@@ -32,7 +32,7 @@ import {
   type RequestLogContext,
 } from "../request-log";
 import { captureRouteStaticPolicy, routeConcreteModel } from "../../router";
-import { comboDefaultEffort, concreteComboRequestBody, getCombo } from "../../combos";
+import { comboDefaultEffort, concreteComboRequestBody, getCombo, type JevDecision } from "../../combos";
 import { supportedLadderFor } from "../effort-policy";
 import { applyDroidReasoningDefault } from "../droid-reasoning-default";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
@@ -94,6 +94,7 @@ export interface ComboProtocolLanes {
     target: ComboTarget,
     targetRoute: RouteResult,
     targetSendBudget: TransientSendBudget | undefined,
+    initialDecision?: Pick<JevDecision, "effort">,
   ): NativeComboChildPlan | undefined;
 }
 
@@ -101,6 +102,7 @@ interface CandidateVerdict {
   skip?: ProtocolFeature[];
 }
 
+/** Build opt-in native eligibility and child plans; only the initial plan applies a JEV choice. */
 export function createComboProtocolLanes(input: {
   source: ComboProtocolSource | undefined;
   req: Request;
@@ -203,7 +205,7 @@ export function createComboProtocolLanes(input: {
         400, unrepresentableMessage(features), "invalid_request_error", "unsupported_feature",
       ), "chat");
     },
-    nativeChild: (target, targetRoute, targetSendBudget) => {
+    nativeChild: (target, targetRoute, targetSendBudget, initialDecision) => {
       // Without the request's execution budget a native child could not share its sends, so it
       // keeps the bridge rather than opening a tracker of its own.
       if (!isRequestExecutionBudget(targetSendBudget)) return undefined;
@@ -214,7 +216,22 @@ export function createComboProtocolLanes(input: {
         provider: targetRoute.provider,
         modelId: targetRoute.modelId,
       });
-      applyComboEffort(body, config, comboId, target, targetRoute);
+      if (initialDecision) {
+        // A validated JEV choice owns only this first dispatch, including explicit no-effort.
+        // Do not run ordinary force defaults for null: they require a non-null default.
+        delete body.service_tier;
+        delete body.thinking_budget;
+        delete body.thinking;
+        const reasoning = body.reasoning;
+        if (reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)) {
+          const preserved = { ...reasoning as Rec };
+          delete preserved.effort;
+          if (Object.keys(preserved).length > 0) body.reasoning = preserved;
+          else delete body.reasoning;
+        }
+        if (initialDecision.effort === null) delete body.reasoning_effort;
+        else body.reasoning_effort = initialDecision.effort;
+      } else applyComboEffort(body, config, comboId, target, targetRoute);
       return { route, body, sendBudget: targetSendBudget };
     },
   };

package/src/server/responses/core-combo.ts

@@ -717,30 +717,32 @@ export async function executeComboResponses(
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
     // The inherited spend tracker observes this parent log, before the child has its own label.
     logCtx.spendPoolId = targetRoute.providerName;
-    // The first target seeds the ledger's target identity and charges nothing; every later one
-    // is a real transition, refused once the declared hops, the alternate-target ledger or the
-    // request total are spent. `countedExternally` is required: the child charges its own
-    // physical sends, and charging here as well would halve the cap without saying so.
+    // Derive the target's allowance before booking its initial send; the booking occupies it.
+    const targetSendBudget = comboSendScope
+      ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
+      : options.sendBudget;
+    // Every target prepays one send. Only its child may consume that booking; later targets
+    // remain bounded by the shared total, transition ledger and per-target holdback.
+    // `countedExternally` is required: the child charges its own physical sends against this
+    // booking through the exact permit, and charging here as well would halve the cap.
     const hopDecision = comboSendScope?.reserveDispatch({
       sendClass: firstComboTarget ? "initial" : "combo-failover",
       targetKey: `${pick.target.provider}/${pick.target.model}`,
       countedExternally: true,
     });
-    if (hopDecision && hopDecision.allowed) hopDecision.permit.use();
-    else if (hopDecision && firstComboTarget) {
+    if (hopDecision && !hopDecision.allowed && firstComboTarget) {
       // A refused initial reservation authorizes no child send and has no upstream failure to return.
       return formatErrorResponse(429, SEND_BUDGET_EXHAUSTED_CODE, "request send budget exhausted before combo dispatch");
     }
-    else if (hopDecision) {
+    else if (hopDecision && !hopDecision.allowed) {
       // Out of budget is not this target's failure. The established exhaustion contract is to
       // return the last real upstream answer with its status, headers and any quota body
       // intact rather than to mint a synthetic error, and a later target only exists because
       // an earlier one already recorded one.
       return exhaustedFailure();
     }
-    const targetSendBudget = comboSendScope
-      ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
-      : options.sendBudget;
+    const initialSend = hopDecision?.allowed ? { permit: hopDecision.permit, producerOwned: false } : undefined;
+    try {
     comboTargetsDispatched += 1;
     const childLog: RequestLogContext = {
       model: pick.target.model,
@@ -764,7 +766,7 @@ export async function executeComboResponses(
       initialJevDecision ? initialJevDecision.effort : comboDefaultEffort(config, comboId),
       initialJevDecision?.effort === null ? [] : targetReasoningEfforts,
       combo.reasoningEffortMode,
-      initialJevDecision !== undefined && initialJevDecision.effort !== null ? "force" : combo.defaultEffortMode,
+      initialJevDecision ? (initialJevDecision.effort === null ? "fallback" : "force") : combo.defaultEffortMode,
     );
     if (initialJevDecision) {
       delete childBody.service_tier;
@@ -860,7 +862,7 @@ export async function executeComboResponses(
           && targetEligible(target)
           && !isComboTargetInCooldown(comboId, target),
         );
-      const nativeChild = protocolLanes?.nativeChild(pick.target, targetRoute, targetSendBudget);
+      const nativeChild = protocolLanes?.nativeChild(pick.target, targetRoute, targetSendBudget, initialJevDecision);
       response = nativeChild ? await dispatchNativeComboChild({
         source: options.protocolSource!,
         plan: nativeChild,
@@ -890,6 +892,7 @@ export async function executeComboResponses(
         // parent arrived with.
         sendBudget: targetSendBudget,
         comboAttempt: true,
+        comboInitialSend: initialSend,
         comboDispatchPermit: hopDecision?.allowed ? hopDecision.permit : undefined,
         comboReplaySnapshot,
         deferCodexResetDerivedCooldown,
@@ -909,8 +912,8 @@ export async function executeComboResponses(
         onNativePassthroughCancel: callbackGate.onCancel,
         onResponseComplete: callbackGate.onResponseComplete,
       });
-      // Native Chat rebuilds its own body and does not apply the initial JEV effort.
-      restoreOriginalRequestedEffort(childLog, nativeChild ? undefined : initialJevDecision?.effort);
+      // Both lanes applied the initial choice before provider pins/caps; retain those transitions.
+      restoreOriginalRequestedEffort(childLog, initialJevDecision?.effort);
     } catch (error) {
       callbackGate.discard();
       if (options.abortSignal?.aborted) {
@@ -1185,6 +1188,11 @@ export async function executeComboResponses(
       // Waiting or recovery may have observed cancellation after the check above.
       if (options.abortSignal?.aborted) return clientCancelledResponse();
     }
+    } finally {
+      // External receipts make release a no-op after real work. runTurn owns its asynchronous
+      // producer; core transfers cleanup there before returning a streaming response.
+      if (!initialSend?.producerOwned) initialSend?.permit.release();
+    }
   }
   const failure = exhaustedFailure();
   if (

package/src/server/responses/core-lifetime.ts

@@ -1,4 +1,5 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
+import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
 import {
   isNativePassthroughSseResponse,
   markNativePassthroughSseResponse,
@@ -37,42 +38,8 @@ export const UPSTREAM_JSON_BODY_READ_OPTIONS = {
 
 
 
-export function finalizeOwnedTranslatorBudget(response: Response, budget: TranslatorBudget): Response {
-  if (!response.body) {
-    budget.dispose();
-    return response;
-  }
-  const reader = response.body.getReader();
-  let finalized = false;
-  const finalize = () => {
-    if (finalized) return;
-    finalized = true;
-    budget.dispose();
-  };
-  const body = new ReadableStream<Uint8Array>({
-    async pull(controller) {
-      try {
-        const result = await reader.read();
-        if (result.done) {
-          finalize();
-          controller.close();
-        } else {
-          controller.enqueue(result.value);
-        }
-      } catch (error) {
-        finalize();
-        controller.error(error);
-      }
-    },
-    async cancel(reason) {
-      try { await reader.cancel(reason); } finally { finalize(); }
-    },
-  });
-  const finalizedResponse = new Response(body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: response.headers,
-  });
+export function finalizeOwnedTranslatorBudget(response: Response, budget: TranslatorBudget, signal?: AbortSignal): Response {
+  const finalizedResponse = finalizeTranslatorBudgetResponse(response, budget, signal);
   if (isNativePassthroughSseResponse(response)) {
     markNativePassthroughSseResponse(finalizedResponse);
   }

package/src/server/responses/core-options.ts

@@ -16,6 +16,7 @@ import type { ExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import type { CallerDirectAuth } from "../../providers/caller-authorization";
 import type { CompactionRoutingOverride } from "./compaction-routing";
 import type { TranslatorBudget } from "../../lib/translator-budget";
+import type { NativeReasoningOwner } from "../../responses/reasoning-replay-cache";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import type { RequestLogContext } from "../request-log";
 import type { UpstreamHostAdmissionLease } from "../../codex/upstream-host-health";
@@ -134,6 +135,8 @@ export interface HandleResponsesOptions {
    * it. Omitted means a genuine Responses inbound.
    */
   inboundWire?: InboundWire;
+  nativeReasoningReplay?: ReadonlyMap<string, string>;
+  nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
   droidDefaultEffort?: string;
   /** PF-07: the Chat source a combo child may send natively; set only by the Chat ingress. */
@@ -158,6 +161,8 @@ export interface HandleResponsesOptions {
   callerDirectAuth?: CallerDirectAuth | null;
   /** Internal recursion guard; callers outside this module must not set it. */
   comboAttempt?: boolean;
+  /** Child-owned prepaid initial send; capacity remains charged until dispatch or unsent release. */
+  comboInitialSend?: { permit: SingleUseDispatchPermit; producerOwned?: boolean };
   /** Exact externally booked combo hop, used for its child's spend preflight and send reports. */
   comboDispatchPermit?: SingleUseDispatchPermit;
   /** Internal handoff: this combo was selected by shadow-call interception. */

package/src/server/responses/core-replay.ts

@@ -19,6 +19,9 @@ import {
   reasoningReplayCodexCredentialIdentity,
   reasoningReplayKeyCredentialIdentity,
   durableReplayDestinationIdentity,
+  nativeReasoningTag,
+  nativeReasoningTagMatches,
+  type NativeReasoningOwner,
   bindReasoningReplayScope,
   reasoningReplayServingIdentityChanged,
   reasoningReplayItemStoreChanged,
@@ -118,6 +121,16 @@ export function bindRouteReasoningReplayScope(args: {
     ...args,
     modelId: parsed.modelId,
   });
+  const owner = nativeReasoningOwnerForRoute(args);
+  if (owner) parsed._nativeReasoningBoundOwner = owner;
+  else delete parsed._nativeReasoningBoundOwner;
+  if (parsed._nativeReasoningReplay?.size) {
+    for (const [blob, tag] of parsed._nativeReasoningReplay) {
+      if (!nativeReasoningTagMatches(nativeReasoningTag(owner, blob), tag)) {
+        stripNativeReasoningBlob(parsed, blob);
+      }
+    }
+  }
   const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
   const continuationOwner = providerContinuationOwnerFromReplayIdentity(
     replayIdentity && continuationDestinationIdentity
@@ -156,6 +169,66 @@ export function bindRouteReasoningReplayScope(args: {
   bindProviderContinuationForRoute(parsed, continuationOwner);
 }
 
+function stripNativeReasoningBlob(parsed: OcxParsedRequest, blob: string): void {
+  const input = (parsed._rawBody as { input?: unknown } | undefined)?.input;
+  if (Array.isArray(input)) {
+    for (const item of input) {
+      if (item && typeof item === "object" && item.type === "reasoning" && item.encrypted_content === blob) {
+        delete item.encrypted_content;
+        delete item.id;
+      }
+    }
+  }
+  for (const message of parsed.context.messages) {
+    if (message.role !== "assistant" || !Array.isArray(message.content)) continue;
+    for (const part of message.content) {
+      if (part.type !== "thinking" || typeof part.signature !== "string") continue;
+      try {
+        const item: unknown = JSON.parse(part.signature);
+        if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+        const reasoning = item as Record<string, unknown>;
+        if (reasoning.type !== "reasoning" || reasoning.encrypted_content !== blob) continue;
+        delete reasoning.encrypted_content;
+        delete reasoning.id;
+        part.signature = JSON.stringify(reasoning);
+        delete part.itemId;
+      } catch { /* A provider signature is not the parser's JSON carrier. */ }
+    }
+  }
+}
+
+export function nativeReasoningOwnerForRoute(args: {
+  provider: OcxProviderConfig;
+  oauthCredentialSnapshot?: Pick<OAuthAccessSnapshot, "accountId" | "generation">;
+  codexAuthContext?: CodexAuthContext;
+}): NativeReasoningOwner | undefined {
+  const { provider } = args;
+  const salt = thoughtSignatureReplaySalt();
+  if (!salt || salt.length < 16) return undefined;
+  const destination = durableReplayDestinationIdentity(JSON.stringify([
+    provider.baseUrl.trim().replace(/\/+$/, ""), provider.responsesPath ?? "",
+  ]));
+  let credential: string | undefined;
+  if (provider.authMode === "oauth") {
+    const snapshot = args.oauthCredentialSnapshot;
+    if (snapshot?.accountId && snapshot.generation !== undefined) credential = durableReplayCredentialIdentity(
+      "oauth", `${snapshot.accountId}\0${snapshot.generation}`, provider.headers, salt,
+    );
+  } else if (provider.authMode === "forward") {
+    const context = args.codexAuthContext;
+    if (context && (context.kind === "pool" || context.kind === "main-pool")
+      && context.accountId && context.writerGeneration !== undefined
+      && (context.kind !== "pool" || context.generation !== undefined)) {
+      credential = durableReplayCredentialIdentity("codex", JSON.stringify([
+        context.accountId, context.kind === "pool" ? context.generation : null, context.writerGeneration,
+      ]), provider.headers, salt);
+    }
+  } else if (provider.authMode !== "local") {
+    credential = durableReplayCredentialIdentity("key", nonEmptyProviderApiKey(provider), provider.headers, salt);
+  }
+  return destination && credential ? { destination, credential } : undefined;
+}
+
 
 function routeReasoningReplayIdentity(args: {
   providerName: string;

package/src/server/responses/core.ts

@@ -29,8 +29,6 @@ import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
 import { runWithCompactionRecovery } from "./compaction-recovery";
 
-/** Public Responses entry and compatibility exports. Implementations live with their owners. */
-
 /**
  * Route one `/v1/responses` request through the adapter pipeline: recovery loop, passthrough
  * wire, image/web-search bridges, and the terminal-guard continuation.
@@ -66,13 +64,15 @@ export async function handleResponses(
       // Once at ingress, spend observer included: a combo child inherits the parent's holder.
       sendBudget: options.sendBudget ?? createInferenceSendBudget(req, logCtx),
     }, handleResponsesInner);
-    const finalResponse = ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget) : response;
+    const finalResponse = ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget, abortSignal) : response;
     if (!accountLoad.lease) { release(); return finalResponse; }
     return finalizeAccountLease(finalResponse, release);
   } catch (error) {
     release();
     if (ownsBudget) translatorBudget.dispose();
     throw error;
+  } finally {
+    if (!options.comboInitialSend?.producerOwned) options.comboInitialSend?.permit.release();
   }
 }