@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/server/responses/adapter-dispatch.ts

@@ -1,3 +1,4 @@
+import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { classifyAnthropic429 } from "../../oauth/anthropic-rate-limit-policy";
 import { rotateAnthropicAccountOnResponseForInstance } from "../../oauth/anthropic-account-refusal";
 import { authorizeResendForRecovery } from "../../lib/request-resend-gate";
@@ -134,12 +135,15 @@ export async function prepareAdapterExchange(
     | "transportToken"
     | "oauthDispatch"
     | "imageTierBias"
+    | "oauth401ReplayAttempted"
     | "isOAuth401ReplayProvider"
     | "sentOAuthSnapshot"
     | "refreshResolvedOAuthSelection"
     | "replayOAuthCredentialSnapshot"
     | "invalidateSameTargetRequest"
     | "resolveSelectionAdapter"
+    | "resolveCopilotSelection"
+    | "copilotRefusalResponse"
     | "anthropicInstance"
     | "currentAnthropicRouteDecision"
     | "anthropicRouteDecision"
@@ -156,6 +160,7 @@ export async function prepareAdapterExchange(
   responseEffects: Pick<ResponsesEffects, "cancelResponseCompletion" | "notifyResponseComplete" | "refreshRequestToolAliases">,
   sendBudgetState: Pick<
     ResponsesSendBudget,
+    | "adapterSendBudget"
     | "adapterDispatchBudget"
     | "noteAdapterPhysicalSend"
     | "noteAdapterRecoveryWithheld"
@@ -170,6 +175,9 @@ export async function prepareAdapterExchange(
     | "workflowRootId"
     | "claimAmbiguousResend"
     | "sendsUsed"
+    | "targetSendsUsed"
+    | "initialSendAllowance"
+    | "noteInitialDispatch"
   >,
 ) {
   const { options, config, logCtx, req } = requestContext;
@@ -179,6 +187,8 @@ export async function prepareAdapterExchange(
     refreshResolvedOAuthSelection,
     invalidateSameTargetRequest,
     resolveSelectionAdapter,
+    resolveCopilotSelection,
+    copilotRefusalResponse,
     anthropicInstance,
     currentAnthropicRouteDecision,
     anthropicSessionKey,
@@ -196,6 +206,7 @@ export async function prepareAdapterExchange(
   } = requestState;
   const { cancelResponseCompletion, notifyResponseComplete, refreshRequestToolAliases } = responseEffects;
   const {
+    adapterSendBudget,
     adapterDispatchBudget,
     noteAdapterPhysicalSend,
     noteAdapterRecoveryWithheld,
@@ -219,6 +230,17 @@ export async function prepareAdapterExchange(
 
   const upstream = new AbortController();
   const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal);
+  /** Contain replacement negotiation before adapter admission and release its upstream abort link. */
+  const resolveRotatedCopilotSelection = async (): Promise<Response | undefined> => {
+    try { await resolveCopilotSelection(parsed); }
+    catch (error) {
+      cleanupUpstreamAbort();
+      upstream.abort();
+      if ((options.abortSignal ?? req.signal).aborted) return clientCancelledResponse();
+      return copilotRefusalResponse(error)
+        ?? formatErrorResponse(502, "upstream_error", "GitHub Copilot Auto negotiation failed.");
+    }
+  };
   const connectMs = config.connectTimeoutMs ?? 200_000;
   // Bridge stall budget (seconds of silence before upstream_stall_timeout); the retry backoff
   // heartbeat interval is derived from it so the watchdog is always fed during deliberate waits.
@@ -335,10 +357,15 @@ export async function prepareAdapterExchange(
    * is invisible to it and a missed bump would replay a request built with a stale key.
    */
 
+  const initialRecovery = route.providerName === "github-copilot"
+    ? sendBudgetState.pendingHopPermit?.sendClass === "auth-recovery" ? "oauth-account-429"
+      : transportState.oauth401ReplayAttempted ? "oauth-401" : undefined
+    : undefined;
   let upstreamResponse: Response;
+  let handoffPermit: ResponsesSendBudget["pendingHopPermit"];
   try {
     if (transportState.activeAdapter.fetchResponse) {
-      transportState.noteRoutedAttemptSend(inputTokenEstimate);
+      transportState.noteRoutedAttemptSend(inputTokenEstimate, initialRecovery);
       const producer = adapterDispatchBudget?.beginSpendProducer?.();
       try {
       upstreamResponse = await withProviderRequestSlot(route.providerName, route.provider, route.modelId, upstream.signal, pacingSlot =>
@@ -371,31 +398,55 @@ export async function prepareAdapterExchange(
       // reset-only semantics so combo failover hops on the first 5xx.
       const transientPolicy = transientRetryPolicyFor(route.provider);
       const resetPolicy = resetReplayPolicyFor(route.provider);
-      const compactPrepaid = options.compactionRecoveryAttempted ? sendBudgetState.pendingHopPermit : undefined;
+      // Rebook a native Copilot hop against the negotiated destination before dispatch.
+      // Raw externally counted permits settle through the retry helper's send reporter.
+      if (route.providerName === "github-copilot" && adapterSendBudget && sendBudgetState.pendingHopPermit
+        && sendBudgetState.pendingHopPermit.sendClass === "auth-recovery") {
+        const original = sendBudgetState.pendingHopPermit;
+        sendBudgetState.pendingHopPermit = undefined;
+        original.release();
+        const decision = adapterSendBudget.reserveDispatch({
+          sendClass: original.sendClass,
+          targetKey: `${route.providerName}|${builtInitialRequest.url}|${route.modelId}`,
+          countedExternally: true,
+        });
+        if (!decision.allowed) throw new SendBudgetExhaustedError(safeHostLabel(builtInitialRequest.url));
+        handoffPermit = decision.permit;
+      }
+      const compactPrepaid = handoffPermit ?? (options.compactionRecoveryAttempted ? sendBudgetState.pendingHopPermit : undefined);
       if (compactPrepaid) sendBudgetState.pendingHopPermit = undefined;
       let compactPrepaidUsed = false;
+      // A combo-owned or compaction-prepaid send is settled by the physical-dispatch receipt
+      // when spend enforcement is off. Enforced spend and direct requests keep the shared
+      // physical-send reporter, which already owns the permit lifecycle there.
+      // Stable per request: a Combo or compaction permit comes from `reserveDispatch`, which starts
+      // (and freezes) the spend policy first, so `spendEnforced` cannot change before dispatch.
+      const receiptMode = !sendBudgetState.adapterSendBudget?.spendEnforced
+        && Boolean(options.comboInitialSend || compactPrepaid);
       // Combo and emergency compaction admission already book this target's first send.
       // Its configured initial ceiling is target-local; the shared remainder below still
       // accounts for earlier targets without deducting their sends from this target twice.
       const initialSendCap = transientPolicy || resetPolicy
+        || (options.comboAttempt && route.provider.adapter === "google")
         ? transientSendCapFor(transientPolicy?.attempts,
           (options.comboAttempt || compactPrepaid) ? 0 : sendBudgetState.sendsUsed)
         : 1;
       const fetchWithRetryPolicy = (route.provider.adapter === "google" || transientPolicy)
         ? fetchWithTransientRetry
         : fetchWithResetRetry;
-      upstreamResponse = await fetchWithRetryPolicy(
+      try { upstreamResponse = await fetchWithRetryPolicy(
         recovery => {
           // Unconfigured generic sends may omit the counting reporter. Capture policy
           // independently so a later recovery still belongs to this request's start.
           sendBudgetState.adapterSendBudget?.startRequest?.({
             poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
           });
-          if (compactPrepaid && !compactPrepaidUsed) {
+          // Receipt mode books the physical send at executor admission instead of here.
+          if (!receiptMode && compactPrepaid && !compactPrepaidUsed) {
             if (!compactPrepaid.use()) throw new SendBudgetExhaustedError(safeHostLabel(builtInitialRequest.url));
             compactPrepaidUsed = true;
           }
-          transportState.noteRoutedAttemptSend(inputTokenEstimate, recovery);
+          transportState.noteRoutedAttemptSend(inputTokenEstimate, recovery ?? initialRecovery);
           return fetchWithHeaderTimeout(builtInitialRequest.url, applyUpstreamRecoveryInit({
             method: builtInitialRequest.method,
             headers: builtInitialRequest.headers,
@@ -405,6 +456,14 @@ export async function prepareAdapterExchange(
               dispatchOverride: oauthDispatch(builtInitialRequest),
               providerName: route.providerName,
               modelId: route.modelId,
+              onPhysicalDispatch: () => {
+                // Preserve the unconfigured direct-adapter accounting contract; Combo admission
+                // and explicit retry/compaction budgets require a receipt for their booked send.
+                if (receiptMode) {
+                  sendBudgetState.noteInitialDispatch(compactPrepaid && !compactPrepaidUsed ? compactPrepaid : undefined);
+                  compactPrepaidUsed = true;
+                }
+              },
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                 ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
             }));
@@ -413,27 +472,34 @@ export async function prepareAdapterExchange(
           abortSignal: upstream.signal,
           label: safeHostLabel(builtInitialRequest.url),
           claimAmbiguousResend: claimPreHeaderResend,
-          ...(sendBudgetState.adapterSendBudget?.spendEnforced || options.comboDispatchPermit || transientPolicy || resetPolicy || compactPrepaid
+          ...(sendBudgetState.adapterSendBudget?.spendEnforced || options.comboDispatchPermit || transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
             ? {
               // A pending compaction permit already booked this leg's first physical send.
-              ...(transientPolicy || resetPolicy || compactPrepaid
+              ...(transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
                 ? {
                   attempts: Math.min(initialSendCap,
-                    remainingTransientSendBudget(initialSendCap) + (compactPrepaid ? 1 : 0)),
+                    sendBudgetState.initialSendAllowance(initialSendCap) + (compactPrepaid ? 1 : 0)),
                 }
                 : {}),
-              // Keep the exact combo or compaction receipt on the helper callback. The reporter
-              // also settles the request and workflow counters for reset-only retries.
-              onSendsConsumed: transientSendReporter(compactPrepaid ?? options.comboDispatchPermit),
+              // Reporter path: direct requests and enforced spend. Receipt-mode sends are
+              // settled by `onPhysicalDispatch`, so a reporter here would count them twice.
+              ...(receiptMode
+                ? {}
+                : { onSendsConsumed: transientSendReporter(compactPrepaid ?? options.comboDispatchPermit) }),
             }
             : {}),
         },
-      );
+      ); } finally { compactPrepaid?.release(); }
     }
   } catch (err) {
     cleanupUpstreamAbort();
     upstream.abort();
     if (options.abortSignal?.aborted) return clientCancelledResponse();
+    const storageRefusal = spendLedgerStorageErrorResponse(err, logCtx);
+    if (storageRefusal) {
+      releaseCodexAuthContextProbeLease(admissionState.authCtx);
+      return storageRefusal;
+    }
     const refusal = err instanceof UpstreamRetryEvidenceError ? err.cause : err;
     const codexRefusal = mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
       now: Date.now(), accountSelector: route.codexAccountNamespace,
@@ -464,6 +530,7 @@ export async function prepareAdapterExchange(
     const msg = describeUpstreamConnectFailure(err, connectMs);
     return formatErrorResponse(502, "upstream_error", msg);
   } finally {
+    handoffPermit?.release();
     builtInitialRequest.releaseBodyObservation?.();
   }
 
@@ -487,7 +554,7 @@ export async function prepareAdapterExchange(
     // Console Go answers a transient 400 "Invalid upload request." for bodies it accepts
     // moments later; at most one byte-identical replay is allowed per request.
     const consoleGoUploadRetryGuard: { attempted: boolean } = { attempted: false };
-    let oauth401ReplayAttempted = false;
+    let oauth401ReplayAttempted = transportState.oauth401ReplayAttempted;
     let antigravityAuthRotationAttempted = false;
     // At most one reasoning-effort downgrade per request. This sits outside the recovery loop
     // below for the same reason the two guards above do: a guard declared inside it is reset by
@@ -609,8 +676,7 @@ export async function prepareAdapterExchange(
           const helperCountsSends = sendBudgetState.adapterSendBudget?.spendEnforced === true || refetchTransientPolicy !== null || resetReplayPolicyFor(route.provider) !== null;
           const prepaid = sendBudgetState.pendingHopPermit;
           const configuredTotal = refetchTransientPolicy?.attempts;
-          const refetchCap = transientSendCapFor(configuredTotal,
-            sendBudgetState.sendsUsed - (prepaid ? 1 : 0));
+          const refetchCap = transientSendCapFor(configuredTotal, sendBudgetState.targetSendsUsed);
           // An exact total includes a booked hop, even when it consumed the last base slot.
           // Keep that funded send while forbidding the final reserve from widening the total.
           const prepaidLastSlot = helperCountsSends && configuredTotal !== undefined && prepaid
@@ -671,6 +737,13 @@ export async function prepareAdapterExchange(
           retryRequest.releaseBodyObservation?.();
         }
       } catch (err) {
+        const storageRefusal = !options.abortSignal?.aborted && spendLedgerStorageErrorResponse(err, logCtx);
+        if (storageRefusal) {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          releaseCodexAuthContextProbeLease(admissionState.authCtx);
+          return { failed: storageRefusal };
+        }
         const codexRefusal = !options.abortSignal?.aborted && mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
           now: Date.now(), accountSelector: route.codexAccountNamespace,
         });
@@ -772,7 +845,7 @@ export async function prepareAdapterExchange(
         && !oauth401ReplayAttempted
         && !sendBudgetExhausted()
       ) {
-        oauth401ReplayAttempted = true;
+        oauth401ReplayAttempted = transportState.oauth401ReplayAttempted = true;
         let refreshed: OAuthAccessSnapshot;
         try {
           refreshed = await refreshResolvedOAuthSelection(transportState.sentOAuthSnapshot);
@@ -843,7 +916,7 @@ export async function prepareAdapterExchange(
         if (route.providerName === "kiro") {
           parsed._kiroAuthContext = { ...(refreshed.kiro ?? {}) };
         }
-        const refreshedProvider = resolveProviderTransport(
+        let refreshedProvider = resolveProviderTransport(
           route.providerName,
           {
             ...route.provider,
@@ -856,6 +929,9 @@ export async function prepareAdapterExchange(
             : undefined,
         );
         route.provider = refreshedProvider;
+        const copilotRefusal = await resolveRotatedCopilotSelection();
+        if (copilotRefusal) return copilotRefusal;
+        refreshedProvider = route.provider;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
           resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider, inboundWire, route.staticPolicy),
@@ -908,6 +984,8 @@ export async function prepareAdapterExchange(
         // until runtime cleanup (one per rotated key).
         try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
         route.provider = rotated;
+        const selectionFailure = await resolveRotatedCopilotSelection();
+        if (selectionFailure) return selectionFailure;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
           resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
@@ -1054,6 +1132,8 @@ export async function prepareAdapterExchange(
         // until runtime cleanup (one per rotated key under a rate-limit storm).
         try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
         route.provider = rotated;
+        const selectionFailure = await resolveRotatedCopilotSelection();
+        if (selectionFailure) return selectionFailure;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
           resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
@@ -1076,7 +1156,7 @@ export async function prepareAdapterExchange(
       // Anthropic OAuth: recover a rate limit or proven account entitlement refusal
       // before output, within the shared request and account rotation limits.
       while (
-        (upstreamResponse.status === 429 || upstreamResponse.status === 403)
+        (upstreamResponse.status === 429 || upstreamResponse.status === 403 || upstreamResponse.status === 401)
         && anthropicInstance
         && transportState.anthropicPoolAccountId
       ) {
@@ -1101,7 +1181,7 @@ export async function prepareAdapterExchange(
           );
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
           recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
-         const result = await rebuildAndRefetch("anthropic-oauth-429");
+         const result = await rebuildAndRefetch(upstreamResponse.status === 401 ? "oauth-401" : "anthropic-oauth-429");
          if ("failed" in result) return result.failed;
          upstreamResponse = result;
           if (isNonReplayableResponse(upstreamResponse)) continue recovery;

package/src/server/responses/codex-ws-exchange.ts

@@ -9,7 +9,7 @@ import { CODEX_RESPONSES_HTTP_URL, type PreparedCodexWsRequest } from "./codex-w
 import { CodexWsCorrelation } from "./codex-ws-correlation";
 import type { CodexWsSession } from "./codex-ws-session";
 import { UPGRADE_DEADLINE_MS, CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES,
-  MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage,
+  MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, markCodexWsPreludeProjection, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage,
   codexWsCreateFrameExceedsLimit, codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
   markCodexWsSocketDeath, type CodexWsFailureStage, type CodexWsStageRecord } from "./codex-ws-wire";
 
@@ -23,6 +23,7 @@ interface ExchangeOptions {
   sseFallback: typeof globalThis.fetch;
   onQuota?: CodexWsQuotaObserver;
   beforeDispatch?: (headers: Headers) => void;
+  onPhysicalDispatch?: () => void;
   /** Bun version string the caller gated on; stamped onto the stage record. */
   bunVersion?: string;
 }
@@ -44,7 +45,8 @@ function rejectionHeaders(source: Record<string, unknown>, prelude: Headers): He
     }
   }
   // Reuse the metadata owner's count/value/family budgets and window freshness
-  // rules, without publishing quota twice. The unmarked HTTP response owns it.
+  // rules, without publishing quota twice. Pool bookkeeping consumes the HTTP
+  // projection; plain-main publication belongs only to the WS observer.
   const projected = new CodexWsMetadata();
   try {
     for (const values of [Object.fromEntries(prelude), source]) {
@@ -240,6 +242,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         // are left out: their channel may already have sent continuation frames on this socket, so
         // the create frame alone no longer describes the turn.
         if (socketDied && !nativeControl) markCodexWsSocketDeath(failureResponse, stage);
+        markCodexWsPreludeProjection(failureResponse);
         resolve(failureResponse);
         return;
       }
@@ -411,6 +414,17 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         failStream(error);
         return;
       }
+      try { options.onPhysicalDispatch?.(); } catch (error) {
+        // Admission refused before the frame left. This is a pre-open rejection,
+        // not a transport failure and not an authorization to replay over SSE.
+        settledPreOpen = true;
+        sent = false;
+        terminal = true;
+        cleanup();
+        session.dispose();
+        reject(error);
+        return;
+      }
       try {
         ws.send(frameText);
         sentAt = Date.now();
@@ -501,6 +515,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
             cleanup();
             try { controller.close(); } catch { /* unused stream already closed */ }
             session.dispose();
+            markCodexWsPreludeProjection(rejection);
             resolve(rejection);
             return;
           }

package/src/server/responses/codex-ws-pool.ts

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes } from "node:crypto";
+import { codexWsReuseAcrossTurnsEnabled } from "../../config/codex-ws-reuse-setting";
 import { registerOptionalShutdownHook } from "../../lib/optional-shutdown-hooks";
 import { CODEX_RESPONSES_HTTP_URL, CODEX_WS_FRAME_HEADERS } from "./codex-ws-request";
 import { CODEX_WS_ID_MAX_BYTES } from "./codex-ws-correlation";
@@ -7,11 +8,15 @@ import { CodexWsSession } from "./codex-ws-session";
 export const CODEX_WS_POOL_MAX_SESSIONS = 32;
 export const CODEX_WS_POOL_IDLE_MS = 30_000;
 export const CODEX_WS_POOL_MAX_AGE_MS = 5 * 60_000;
+export const CODEX_WS_POOL_WAIT_MS = 750;
+/** Retained sockets per account+thread while cross-turn reuse is on. */
+export const CODEX_WS_POOL_SCOPE_LIMIT = 2;
+const CODEX_WS_POOL_WAIT_DEPTH = 2;
 const MUTABLE_HEADERS = new Set<string>(CODEX_WS_FRAME_HEADERS);
 let processKey: Buffer | undefined;
 let poolSequence = 0;
 
-export interface CodexWsReuseIdentity { key: string; scope: string }
+export interface CodexWsReuseIdentity { key: string; scope: string; routeTag: string }
 function value(value: unknown): value is string {
   return typeof value === "string" && value.trim().length > 0
     && !/[\u0000-\u001f\u007f]/.test(value) && Buffer.byteLength(value) <= CODEX_WS_ID_MAX_BYTES;
@@ -49,19 +54,23 @@ export function codexWsReuseIdentity(url: string, headers: Record<string, string
   const immutable = Object.entries(headers).filter(([name]) => !MUTABLE_HEADERS.has(name)).sort(([a], [b]) => a.localeCompare(b));
   if (immutable.length > 128 || immutable.some(([, field]) => !value(field))
     || immutable.reduce((bytes, [name, field]) => bytes + Buffer.byteLength(name) + Buffer.byteLength(field), 0) > 32 * 1024) return null;
-  const scope = digest([url, account, thread, turn]);
+  const reuseAcrossTurns = codexWsReuseAcrossTurnsEnabled();
+  const scope = digest(reuseAcrossTurns ? [url, account, thread] : [url, account, thread, turn]);
   const lite = metadata.ws_request_header_x_openai_internal_codex_responses_lite;
   if (lite !== undefined && lite !== "true" && lite !== "false") return null;
   // `dialUrl` is the socket destination after plugin rewrites; absent means the canonical one.
-  return { scope, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null, dialUrl ?? null]) };
+  const routeTag = digest(["route", authorization, proxy ?? null, dialUrl ?? null]);
+  return { scope, routeTag, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null, dialUrl ?? null]) };
 }
 
 interface Entry { identity: CodexWsReuseIdentity; session: CodexWsSession; createdAt: number; idleAt: number; retired: boolean }
-interface PoolOptions { now?: () => number; maxSessions?: number; idleMs?: number; maxAgeMs?: number }
+interface Waiter { key: string; resolve: (session: CodexWsSession | null) => void; timer: ReturnType<typeof setTimeout>; onAbort: () => void; signal?: AbortSignal }
+interface PoolOptions { now?: () => number; maxSessions?: number; idleMs?: number; maxAgeMs?: number; waitMs?: number }
 
 /** Bounded retained sockets only. Busy/capacity misses keep the existing one-shot path. */
 export class CodexWsPool {
   private readonly entries = new Map<string, Entry>();
+  private readonly waiters: Waiter[] = [];
   private timer?: ReturnType<typeof setTimeout>;
   private detachShutdown?: () => void;
   private readonly hookKey = `codex-upstream-ws-pool-${++poolSequence}`;
@@ -69,29 +78,74 @@ export class CodexWsPool {
   private readonly maxSessions: number;
   private readonly idleMs: number;
   private readonly maxAgeMs: number;
+  private readonly waitMs: number;
   constructor(options: PoolOptions = {}) {
     this.now = options.now ?? Date.now;
     this.maxSessions = options.maxSessions ?? CODEX_WS_POOL_MAX_SESSIONS;
     this.idleMs = options.idleMs ?? CODEX_WS_POOL_IDLE_MS;
     this.maxAgeMs = options.maxAgeMs ?? CODEX_WS_POOL_MAX_AGE_MS;
+    this.waitMs = options.waitMs ?? CODEX_WS_POOL_WAIT_MS;
   }
 
   acquire(identity: CodexWsReuseIdentity, url: string, headers: Record<string, string>, proxy?: string): CodexWsSession | null {
-    this.sweep();
-    for (const entry of this.entries.values()) {
-      if (entry.identity.scope !== identity.scope || entry.identity.key === identity.key) continue;
-      entry.retired = true;
-      if (!entry.session.busy) this.remove(entry);
+    return this.claim(identity, url, headers, proxy).session;
+  }
+
+  /**
+   * Before any frame is sent, wait for the matching busy socket instead of dialing a throwaway.
+   * The queue is FIFO and at most two deep. An abort or the deadline returns null.
+   */
+  acquireWaiting(
+    identity: CodexWsReuseIdentity,
+    url: string,
+    headers: Record<string, string>,
+    proxy: string | undefined,
+    signal?: AbortSignal,
+  ): Promise<CodexWsSession | null> {
+    const claimed = this.claim(identity, url, headers, proxy);
+    if (claimed.session || !claimed.busy) return Promise.resolve(claimed.session);
+    if (signal?.aborted) return Promise.resolve(null);
+    if (this.waiters.filter(waiter => waiter.key === identity.key).length >= CODEX_WS_POOL_WAIT_DEPTH) {
+      return Promise.resolve(null);
     }
+    return new Promise(resolve => {
+      const waiter: Waiter = {
+        key: identity.key,
+        resolve,
+        signal,
+        timer: setTimeout(() => this.finishWaiter(waiter, null), this.waitMs),
+        onAbort: () => this.finishWaiter(waiter, null),
+      };
+      waiter.timer.unref?.();
+      signal?.addEventListener("abort", waiter.onAbort, { once: true });
+      this.waiters.push(waiter);
+    });
+  }
+
+  private claim(
+    identity: CodexWsReuseIdentity,
+    url: string,
+    headers: Record<string, string>,
+    proxy?: string,
+  ): { session: CodexWsSession | null; busy: boolean } {
+    this.sweep();
+    this.retireSiblings(identity);
     const existing = this.entries.get(identity.key);
     if (existing) {
-      if (existing.retired || existing.session.busy) return null;
-      if (existing.session.reserve()) { this.arm(); return existing.session; }
+      if (existing.retired) return { session: null, busy: false };
+      if (existing.session.busy) return { session: null, busy: true };
+      if (existing.session.reserve()) { this.arm(); return { session: existing.session, busy: false }; }
       this.remove(existing);
+    } else if (codexWsReuseAcrossTurnsEnabled() && this.scopeCount(identity.scope) >= CODEX_WS_POOL_SCOPE_LIMIT) {
+      const oldest = [...this.entries.values()]
+        .filter(entry => entry.identity.scope === identity.scope && !entry.session.busy)
+        .sort((left, right) => left.idleAt - right.idleAt)[0];
+      if (!oldest) return { session: null, busy: false };
+      this.remove(oldest);
     }
     if (this.entries.size >= this.maxSessions) {
       const oldest = [...this.entries.values()].filter(entry => !entry.session.busy).sort((a, b) => a.idleAt - b.idleAt)[0];
-      if (!oldest) return null;
+      if (!oldest) return { session: null, busy: false };
       this.remove(oldest);
     }
     const createdAt = this.now();
@@ -100,13 +154,45 @@ export class CodexWsPool {
     session.reserve();
     this.entries.set(identity.key, entry);
     this.detachShutdown ??= registerOptionalShutdownHook(this.hookKey, () => this.dispose());
-    return session;
+    return { session, busy: false };
+  }
+
+  private retireSiblings(identity: CodexWsReuseIdentity): void {
+    const reuseAcrossTurns = codexWsReuseAcrossTurnsEnabled();
+    for (const entry of this.entries.values()) {
+      if (entry.identity.scope !== identity.scope || entry.identity.key === identity.key) continue;
+      const routeChanged = entry.identity.routeTag !== identity.routeTag;
+      if (reuseAcrossTurns && !routeChanged) continue;
+      entry.retired = true;
+      if (!entry.session.busy) this.remove(entry);
+    }
+  }
+
+  private scopeCount(scope: string): number {
+    let count = 0;
+    for (const entry of this.entries.values()) if (entry.identity.scope === scope && !entry.retired) count += 1;
+    return count;
+  }
+
+  private finishWaiter(waiter: Waiter, session: CodexWsSession | null): void {
+    const index = this.waiters.indexOf(waiter);
+    if (index < 0) return;
+    this.waiters.splice(index, 1);
+    clearTimeout(waiter.timer);
+    waiter.signal?.removeEventListener("abort", waiter.onAbort);
+    waiter.resolve(session);
   }
 
   private changed(entry: Entry): void {
     if (this.entries.get(entry.identity.key) !== entry) return;
     if (entry.session.closed) this.entries.delete(entry.identity.key);
     else if (!entry.session.busy) {
+      const waiter = this.waiters.find(candidate => candidate.key === entry.identity.key);
+      if (waiter && !entry.retired && entry.session.reserve()) {
+        this.finishWaiter(waiter, entry.session);
+        this.arm();
+        return;
+      }
       entry.idleAt = this.now();
       if (entry.retired || entry.idleAt - entry.createdAt >= this.maxAgeMs) this.remove(entry);
     }
@@ -152,6 +238,7 @@ export class CodexWsPool {
     this.detachShutdown = undefined;
     const entries = [...this.entries.values()];
     this.entries.clear();
+    for (const waiter of [...this.waiters]) this.finishWaiter(waiter, null);
     for (const entry of entries) entry.session.dispose(new DOMException("codex websocket pool shutdown", "AbortError"));
   }
 

package/src/server/responses/codex-ws-wire.ts

@@ -49,6 +49,7 @@ const WS_CLOSE_MESSAGE_TOO_BIG = 1009;
 
 const codexWsUpstreamResponses = new WeakSet<Response>();
 const quotaObservedResponses = new WeakSet<Response>();
+const codexWsPreludeProjections = new WeakSet<Response>();
 
 /** Quota arrived directly at its captured account; do not replay old HTTP prelude headers. */
 export function isCodexWsQuotaObservedResponse(response: Response): boolean {
@@ -60,6 +61,14 @@ export function isCodexWsUpstreamResponse(response: Response): boolean {
   return codexWsUpstreamResponses.has(response);
 }
 
+/** Pre-response projection; its headers retain the exchange's prelude snapshot. */
+export function markCodexWsPreludeProjection(response: Response): void {
+  codexWsPreludeProjections.add(response);
+}
+
+export function isCodexWsPreludeProjection(response: Response): boolean {
+  return codexWsPreludeProjections.has(response);
+}
 
 export function markCodexWsResponse(response: Response, observed: boolean): void {
   codexWsUpstreamResponses.add(response);

package/src/server/responses/combo-requested-effort.ts

@@ -10,5 +10,7 @@ export function comboRequestedEffortLabel(
   const forcedTransition = forcedEffort != null && forcedEffort !== originalRequestedEffort
     ? `->${forcedEffort}`
     : "";
-  return `${originalRequestedEffort}${forcedTransition}${laterTransitions}`;
+  const segments = `${originalRequestedEffort}${forcedTransition}${laterTransitions}`.split("->");
+  // A pin that kept the effort it was given is not a transition; drop the repeated segment.
+  return segments.filter((segment, index) => index === 0 || segment !== segments[index - 1]).join("->");
 }

package/src/server/responses/compact.ts

@@ -1,3 +1,4 @@
+import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { createPhysicalSendReporter } from "../../lib/request-execution-budget";
 import { createInferenceSendBudget } from "../inference/context";
 import { unboundPoolSpendRefusalResponse } from "../workflow-refusal";
@@ -1099,11 +1100,11 @@ export async function handleResponsesCompact(
     let outcomeCtx = authCtx;
     const localDispatchRefusal = (error: unknown): Response | undefined => {
       const cause = unwrapUpstreamRetryEvidenceError(error);
-      const response = cause instanceof SendBudgetExhaustedError
+      const response = spendLedgerStorageErrorResponse(error, logCtx) ?? (cause instanceof SendBudgetExhaustedError
         ? unboundPoolSpendRefusalResponse(logCtx) ?? formatErrorResponse(429, "request_send_budget_exhausted", cause.message)
         : mapCodexAuthContextErrorToResponse(cause, {
           now: Date.now(), accountSelector: route.codexAccountNamespace,
-        });
+        }));
       if (response) {
         releaseUpstreamHostAdmission(compactHostAdmissionLease);
         compactHostAdmissionLease = null;

package/src/server/responses/core-codex-account.ts

@@ -6,6 +6,7 @@ import {
   computeQuotaCooldown,
   formatCodexProviderForLog,
 } from "../../codex/routing";
+import { claimMainQuotaDispatchForWs, isMainQuotaDispatchLive, renewMainQuotaDispatchForAttempt, type MainQuotaDispatch } from "../../codex/main-account-cache";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { isCodexAccountGenerationLive } from "../../codex/account-store";
@@ -121,8 +122,28 @@ export function usesCodexForwardPoolAuth(
 }
 
 
+/** Live proof that this plain-main response used the observed main credential. */
+export function liveMainQuotaDispatch(
+  authCtx: CodexAuthContext, provider: OcxProviderConfig,
+): MainQuotaDispatch | undefined {
+  if (authCtx.kind !== "main" || !authCtx.mainQuotaDispatch) return undefined;
+  if (!isCanonicalOpenAiForwardProvider(provider)
+    || provider.authMode !== "forward" || provider.adapter !== "openai-responses") return undefined;
+  return isMainQuotaDispatchLive(authCtx.mainQuotaDispatch) ? authCtx.mainQuotaDispatch : undefined;
+}
+
 export function codexWsQuotaObserver(authCtx: CodexAuthContext, provider: OcxProviderConfig, modelId?: string): CodexWsQuotaObserver | undefined {
-  if (!isCanonicalOpenAiForwardProvider(provider) || !usesCodexForwardPoolAuth(authCtx, provider)) return undefined;
+  if (!isCanonicalOpenAiForwardProvider(provider)) return undefined;
+  if (!usesCodexForwardPoolAuth(authCtx, provider)) {
+    const captured = liveMainQuotaDispatch(authCtx, provider);
+    if (!captured || authCtx.kind !== "main") return undefined;
+    const dispatch = authCtx.mainQuotaDispatch = renewMainQuotaDispatchForAttempt(captured);
+    return headers => {
+      claimMainQuotaDispatchForWs(dispatch);
+      if (!isMainQuotaDispatchLive(dispatch)) return;
+      applyCapturedCodexQuota(MAIN_CODEX_ACCOUNT_ID, headers, dispatch.configGeneration, dispatch.writer, { modelId });
+    };
+  }
   const { accountId, writerGeneration } = authCtx;
   const credentialGeneration = authCtx.kind === "pool" ? authCtx.generation : undefined;
   const mainWriter = authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined;