@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/server/responses/request-send-budget.ts

@@ -9,7 +9,7 @@ import {
 import { poolContinuityRefusalReason, workflowRefusalResponse } from "../workflow-refusal";
 import type { AttemptRecoveryKind, AttemptRecoveryWithheld } from "../../usage/log";
 import { noteAttemptRecoveryWithheld, noteAttemptSend } from "../request-log";
-import { TRANSIENT_RETRY_MAX_ATTEMPTS } from "../../lib/upstream-retry";
+import { TRANSIENT_RETRY_MAX_ATTEMPTS, SendBudgetExhaustedError } from "../../lib/upstream-retry";
 import type {
   DispatchDecision,
   DispatchIntent,
@@ -58,10 +58,24 @@ export function createResponsesSendBudget(
   // sends once per child seven hundred times, so every send charged to the request is charged
   // to the root as well (#4546).
   const workflowRootId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
-  const inheritedPermit = options.compactionRecoveryPermit ?? options.comboDispatchPermit;
+  // A child that owns its Combo booking settles that exact permit through the reporter, even
+  // when its caller handed ownership over only as `comboInitialSend`.
+  const inheritedPermit = options.compactionRecoveryPermit ?? options.comboDispatchPermit
+    ?? options.comboInitialSend?.permit;
   let pendingHopPermit: SingleUseDispatchPermit | undefined = options.compactionRecoveryPermit;
+  let initialPermit = options.comboInitialSend?.permit;
+  // Count this owner's physical sends, not later bookings made by other shared-ledger owners.
+  // Direct callers retain sends reported before this owner was constructed.
+  let targetSendsUsed = initialPermit ? 0 : Math.max(0,
+    sendBudget.used - (options.compactionRecoveryPermit ? 1 : 0));
+  /** Attribute reported physical sends to this owner; the prepaid booking is spent once reported. */
+  const noteTargetSends = (charged: number): void => {
+    targetSendsUsed += charged;
+    if (charged > 0) initialPermit = undefined;
+  };
   const recordTransientSends = (used: number, permit?: SingleUseDispatchPermit): void => {
     const charged = Math.max(0, used);
+    noteTargetSends(charged);
     reportDispatchSends(sendBudget, charged, permit);
     options.onCompactionRecoverySendsReported?.(charged);
     chargeWorkflowSends(workflowRootId, charged);
@@ -71,6 +85,7 @@ export function createResponsesSendBudget(
   const transientSendReporter = (permit = pendingHopPermit ?? inheritedPermit) =>
     createPhysicalSendReporter(sendBudget, () => ({ poolId: logCtx.spendPoolId ?? logCtx.provider,
       identityId: logCtx.accountLogLabel }), permit, charged => {
+      noteTargetSends(Math.max(0, charged));
       options.onCompactionRecoverySendsReported?.(charged);
       chargeWorkflowSends(workflowRootId, charged);
     });
@@ -136,6 +151,7 @@ export function createResponsesSendBudget(
     // Ordinal 1 is skipped because the caller normally records it before dispatch. An adapter
     // that reports every send asks for it to be counted here instead, so that the first send is
     // logged where it actually happens rather than before admission could still refuse it.
+    targetSendsUsed += 1;
     if (send.ordinal <= 1 && options.includeFirst !== true) return;
     noteAttemptSend(logCtx.activeAttempt, inputTokens, send.recovery);
   };
@@ -191,21 +207,29 @@ export function createResponsesSendBudget(
    * The hop hands its reservation down through `pendingHopPermit`, the same seam the
    * passthrough ladder already uses, and this view spends it on the adapter's FIRST
    * reservation. Every later send in that ladder is a new physical send and is charged
-   * normally. The refundable view below keeps an unused hop open until executor invocation;
-   * its adapter release hands back an abandoned replay. The ordinary view retains early
-   * settlement for existing callers.
+   * normally. Claiming preserves the refundable single-use booking until physical dispatch;
+   * an abandoned replay releases only that exact booking.
    */
-  const claimHopPermit = (): SingleUseDispatchPermit | undefined => {
-    const permit = pendingHopPermit;
-    pendingHopPermit = undefined;
-    return permit;
+  const permits = {
+    /** Transfer the initial booking once to the adapter dispatch owner. */
+    claimInitialPermit: () => {
+      const permit = initialPermit;
+      initialPermit = undefined;
+      return permit;
+    },
+    /** Transfer a pending recovery booking once, without creating a new allowance. */
+    claimHopPermit: () => {
+      const permit = pendingHopPermit;
+      pendingHopPermit = undefined;
+      return permit;
+    },
   };
-  const adapterDispatchBudget: RequestExecutionBudget | undefined = adapterSendBudget === undefined
-    ? undefined : adapterDispatchBudgetView(adapterSendBudget, { claimHopPermit });
-  // Opt in only where the adapter's executor is the confirmation boundary. Ordinary callers
-  // keep the existing early settlement contract, including already-settled permit fallback.
-  const refundableAdapterDispatchBudget: RequestExecutionBudget | undefined = adapterSendBudget === undefined
-    ? undefined : adapterDispatchBudgetView(adapterSendBudget, { claimHopPermit }, true);
+  const adapterDispatchBudget = adapterSendBudget === undefined
+    ? undefined : adapterDispatchBudgetView(adapterSendBudget, permits);
+  // Preserve the existing opted-in view for direct callers, including its admitted replacement
+  // of an already-settled hop. Exact-owned Combo and sidecar handoffs use the ordinary view.
+  const refundableAdapterDispatchBudget = adapterSendBudget === undefined
+    ? undefined : adapterDispatchBudgetView(adapterSendBudget, permits, true);
   /**
    * How many sends a recovery leg may make, and the permit that authorises the last one.
    *
@@ -292,12 +316,34 @@ export function createResponsesSendBudget(
     noteTransientSends,
     transientSendReporter,
     remainingTransientSendBudget,
+    /** Only this child's prepaid send, not every pending external booking, is spendable here. */
+    initialSendAllowance: (cap: number): number => Math.min(cap,
+      remainingTransientSendBudget(cap) + (initialPermit ? 1 : 0)),
+    /** At final executor admission, settle only the owning booking or reserve this send. */
+    noteInitialDispatch: (prepaid = initialPermit): void => {
+      if (prepaid) {
+        if (!prepaid.assumeCharge()) throw new SendBudgetExhaustedError();
+        if (prepaid === initialPermit) initialPermit = undefined;
+      } else if (adapterSendBudget && (options.comboInitialSend || options.compactionRecoveryPermit)) {
+        const decision = adapterSendBudget.reserveDispatch({ sendClass: "transient",
+          targetKey: adapterSendBudget.lastTargetKey ?? `${logCtx.provider}/${logCtx.model}` });
+        if (!decision.allowed || !decision.permit.use()) throw new SendBudgetExhaustedError();
+      } else {
+        // Legacy direct callers can prebook without handing over a permit; keep their reporter.
+        noteTransientSends(1);
+        return;
+      }
+      targetSendsUsed += 1;
+      options.onCompactionRecoverySendsReported?.(1);
+      chargeWorkflowSends(workflowRootId, 1);
+    },
+    /** Physical sends reported by this owner; unrelated shared reservations cannot consume it. */
+    get targetSendsUsed(): number { return targetSendsUsed; },
     /**
-     * Physical sends this logical request has already made.
+     * Charged sends, including open prepaid reservations, across this logical request.
      *
-     * A live getter, not a snapshot: it is read once per dispatch leg to resolve a configured
-     * ladder, and a value frozen at construction would answer for a request that had sent
-     * nothing.
+     * A live getter, not a completed-send snapshot. Initial ladders use the child's own
+     * prepaid allowance and target-local count; shared admission keeps every booking spent.
      */
     get sendsUsed(): number { return sendBudget.used; },
     adapterSendBudget,
@@ -335,8 +381,11 @@ export type ResponsesSendBudget = Exclude<ReturnType<typeof createResponsesSendB
  */
 function adapterDispatchBudgetView(
   budget: RequestExecutionBudget,
-  hop: { claimHopPermit: () => SingleUseDispatchPermit | undefined },
-  refundableHop = false,
+  hop: {
+    claimInitialPermit: () => SingleUseDispatchPermit | undefined;
+    claimHopPermit: () => SingleUseDispatchPermit | undefined;
+  },
+  legacyHopReplacement = false,
 ): RequestExecutionBudget {
   return {
     get physicalStarted() { return budget.physicalStarted; },
@@ -360,10 +409,22 @@ function adapterDispatchBudgetView(
     claimAmbiguousResend: (limit: number): boolean => budget.claimAmbiguousResend?.(limit) === true,
     get ambiguousResendSpent(): boolean { return budget.ambiguousResendSpent === true; },
     reserveDispatch(intent: DispatchIntent): DispatchDecision {
-      const refundable = refundableHop || budget.spendEnforced === true;
       // A dispatch whose upstream state is unknown is refused on its own merits. A hop that
       // already paid does not make an unsafe replay safe, so that check stays with the budget.
       if (intent.replaySafe !== false) {
+        // The Combo reserves a logical provider/model identity. The child's first actual
+        // endpoint is not a recovery transition; retain the original refundable permit.
+        const initialPermit = hop.claimInitialPermit();
+        if (initialPermit) {
+          budget.bindPrepaidTarget?.(intent.targetKey);
+          return { allowed: true, permit: {
+            sendClass: initialPermit.sendClass,
+            execute: run => initialPermit.execute ? initialPermit.execute(run) : run(),
+            use: () => initialPermit.assumeCharge(),
+            assumeCharge: () => initialPermit.assumeCharge(),
+            release: () => initialPermit.release(),
+          } };
+        }
         const hopPermit = hop.claimHopPermit();
         if (hopPermit && intent.targetKey !== budget.lastTargetKey) {
           // The rotated credential can select a different regional endpoint. Replace the
@@ -372,35 +433,37 @@ function adapterDispatchBudgetView(
           hopPermit.release();
           return budget.reserveDispatch({ ...intent, sendClass: hopPermit.sendClass });
         }
-        if (hopPermit !== undefined && (refundable || hopPermit.assumeCharge())) {
-          let settled = false;
-          let executionPermit = hopPermit;
-          const confirm = (): boolean => {
-            if (settled) return false;
-            settled = true;
-            // Admission can still reject this replay. Close its external booking only when
-            // the adapter invokes its executor, leaving release() able to refund it until then.
-            if (!refundable || hopPermit.assumeCharge()) return true;
-            // Preserve the old fallback for a permit another leg already settled.
-            const fresh = budget.reserveDispatch(intent);
-            if (!fresh.allowed) return false;
-            executionPermit = fresh.permit;
-            return fresh.permit.assumeCharge();
-          };
-          return {
-            allowed: true,
-            permit: {
+        // Reservation precedes pacing and beforeDispatch. Transfer the exact open booking;
+        // only physical consumption closes external reporting and makes it non-refundable.
+        // The underlying permit enforces single use, including settlement by another owner.
+        if (hopPermit !== undefined) {
+          if (legacyHopReplacement) {
+            let settled = false;
+            let executionPermit = hopPermit;
+            const confirm = (): boolean => {
+              if (settled) return false;
+              settled = true;
+              if (hopPermit.assumeCharge()) return true;
+              // Preserve the old fallback for a permit another leg already settled.
+              const fresh = budget.reserveDispatch(intent);
+              if (!fresh.allowed) return false;
+              executionPermit = fresh.permit;
+              return fresh.permit.assumeCharge();
+            };
+            return { allowed: true, permit: {
               sendClass: hopPermit.sendClass,
               execute: run => executionPermit.execute ? executionPermit.execute(run) : run(),
-              use: confirm,
-              assumeCharge: confirm,
-              release: (): void => {
-                if (!refundable || settled) return;
-                settled = true;
-                hopPermit.release();
-              },
-            },
-          };
+              use: confirm, assumeCharge: confirm,
+              release: () => { if (!settled) { settled = true; hopPermit.release(); } },
+            } };
+          }
+          return { allowed: true, permit: {
+            sendClass: hopPermit.sendClass,
+            execute: run => hopPermit.execute ? hopPermit.execute(run) : run(),
+            use: () => hopPermit.assumeCharge(),
+            assumeCharge: () => hopPermit.assumeCharge(),
+            release: () => hopPermit.release(),
+          } };
         }
       }
       return budget.reserveDispatch(intent);

package/src/server/responses/request-transport.ts

@@ -53,6 +53,9 @@ import { classifyModelFamilyForQuota } from "../../oauth/account-quota-rank";
 import { expandInferenceOAuthSendBudget } from "../inference/context";
 import { stampOAuthAccountLabel, usesApiKeyAccount } from "../../providers/label";
 import { resolveProviderTransport } from "../../providers/xai-transport";
+import { captureRouteStaticPolicy } from "../../router";
+import { CopilotAutoHttpError, resolveCopilotAuto } from "../../providers/github-copilot-auto";
+import { renameRoutedIdentityInContext } from "../../adapters/identity";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
   providerApiKeySelectionIsCurrent,
@@ -87,6 +90,13 @@ import { resolvePassiveRouteSubjectId } from "../passive-route-linker";
 import { clientCancelledResponse } from "./core-errors";
 import { acquireAccountLease, KIRO_ACCOUNT_WAIT_MS } from "../../oauth/kiro-account-load";
 
+/** Return a renewed Chat wire to the native owner before sending inference. */
+export class CopilotAutoAdapterHandoff extends Error {
+  constructor(readonly adapter: ProviderAdapter) {
+    super("Copilot Auto dispatch requires the Chat adapter");
+  }
+}
+
 /** Owns live credential selection and adapter bindings for one request. */
 export async function prepareResponsesTransport(
   requestContext: Pick<ResponsesRequestContext, "config" | "logCtx" | "options" | "req">,
@@ -160,6 +170,8 @@ export async function prepareResponsesTransport(
     || route.providerName === "devin"
   ) && route.provider.authMode === "oauth";
   let sentOAuthSnapshot: OAuthAccessSnapshot | undefined;
+  // One inference-401 replay belongs to this request, even when Auto changes exchange wire.
+  let oauth401ReplayAttempted = false;
   let replayOAuthCredentialSnapshot: Pick<OAuthAccessSnapshot, "accountId" | "generation"> | undefined;
   let anthropicPoolAccountId: string | null = null;
   let anthropicPoolFailovers = 0;
@@ -281,6 +293,84 @@ export async function prepareResponsesTransport(
    * the case the fence exists for. Stays 0 for every provider without a passive quota.
    */
   let passiveQuotaWriterGeneration = 0;
+  const copilotRequestedModel = route.modelId;
+  /** Project only bounded Copilot refusal metadata; upstream bodies and session tokens never reach the client. */
+  const copilotRefusalResponse = (error: unknown): Response | undefined => {
+    if (!(error instanceof CopilotAutoHttpError) || ![401, 403, 429].includes(error.status)) return;
+    const response = formatErrorResponse(error.status, error.status === 429 ? "rate_limit_error" : "authentication_error",
+      error.message);
+    if (error.retryAfter) response.headers.set("retry-after", error.retryAfter);
+    return response;
+  };
+  let copilotSessionExpiresAt = Infinity;
+  let copilotNegotiationRefreshed = false;
+  let copilotAutoAdapter: OcxProviderConfig["adapter"] | undefined;
+  /** The operator-configured wire, captured before the first Auto negotiation can rewrite route.provider. */
+  let copilotConfiguredWire: { adapter: OcxProviderConfig["adapter"]; responsesPath?: string;
+    chatCompletionsPath?: string; apiVersion?: string } | undefined;
+  /** Start every negotiation from the configured wire, so a previous credential's Auto adapter,
+   *  endpoint and session headers never carry over to a credential that keeps the named model. */
+  const copilotNegotiationBase = (provider: OcxProviderConfig): OcxProviderConfig => {
+    if (!copilotConfiguredWire) return provider;
+    const headers = new Headers(provider.headers);
+    headers.delete("Copilot-Session-Token");
+    if (copilotConfiguredWire.apiVersion === undefined) headers.delete("X-GitHub-Api-Version");
+    else headers.set("X-GitHub-Api-Version", copilotConfiguredWire.apiVersion);
+    const base: OcxProviderConfig = { ...provider, adapter: copilotConfiguredWire.adapter,
+      headers: Object.fromEntries(headers) };
+    if (copilotConfiguredWire.responsesPath === undefined) delete base.responsesPath;
+    else base.responsesPath = copilotConfiguredWire.responsesPath;
+    if (copilotConfiguredWire.chatCompletionsPath === undefined) delete base.chatCompletionsPath;
+    else base.chatCompletionsPath = copilotConfiguredWire.chatCompletionsPath;
+    return base;
+  };
+  /** Resolve the request's ephemeral wire selection and recover at most one OAuth negotiation 401. */
+  const resolveCopilotSelection = async (requestParsed: OcxParsedRequest, insideDispatch = false): Promise<void> => {
+    if (route.providerName !== "github-copilot" || route.provider.authMode === "forward") return;
+    copilotConfiguredWire ??= {
+      adapter: route.provider.adapter,
+      responsesPath: route.provider.responsesPath,
+      chatCompletionsPath: route.provider.chatCompletionsPath,
+      apiVersion: new Headers(route.provider.headers).get("X-GitHub-Api-Version") ?? undefined,
+    };
+    /** Fence control-plane sends to the captured credential; reuse an already-held dispatch concurrency lease. */
+    const negotiate = () => {
+      const binding: DispatchBinding | undefined = oauthSelection && servingOAuthSnapshot
+        ? { kind: "oauth", selection: { ...oauthSelection }, snapshot: servingOAuthSnapshot }
+        : { kind: "api-key", provider: { ...route.provider } };
+      return resolveCopilotAuto(copilotNegotiationBase(route.provider), copilotRequestedModel, requestParsed,
+        options.abortSignal ?? req.signal, /** Fence each negotiation send against the captured credential binding before touching the network. */
+          () => selectionIsCurrent(binding), !insideDispatch);
+    };
+    let selected: Awaited<ReturnType<typeof resolveCopilotAuto>>;
+    try { selected = await negotiate(); }
+    catch (error) {
+      if (!(error instanceof CopilotAutoHttpError) || error.status !== 401 || copilotNegotiationRefreshed
+        || oauth401ReplayAttempted || route.provider.authMode !== "oauth" || !servingOAuthSnapshot) throw error;
+      copilotNegotiationRefreshed = true;
+      const refreshed = await refreshResolvedOAuthSelection(servingOAuthSnapshot);
+      route.provider = resolveProviderTransport(route.providerName,
+        { ...route.provider, apiKey: refreshed.accessToken }, parsed.options.promptCacheKey,
+        resolveCopilotApiBaseUrl(refreshed.apiBaseUrl));
+      sentOAuthSnapshot = refreshed;
+      replayOAuthCredentialSnapshot = { accountId: refreshed.accountId, generation: refreshed.generation };
+      selected = await negotiate();
+    }
+    copilotSessionExpiresAt = selected.expiresAt ?? Infinity;
+    route.provider = selected.provider;
+    route.modelId = selected.modelId;
+    route.staticPolicy = captureRouteStaticPolicy(route.providerName, route.modelId, route.provider,
+      route.staticPolicy.effectiveAlias, inboundWire);
+    copilotAutoAdapter = selected.auto ? selected.provider.adapter : undefined;
+    for (const target of new Set([parsed, requestParsed])) {
+      target.modelId = selected.modelId;
+      if (target._rawBody && typeof target._rawBody === "object")
+        (target._rawBody as { model?: string }).model = selected.modelId;
+      target.context = renameRoutedIdentityInContext(target.context, selected.modelId);
+    }
+    logCtx.model = selected.modelId;
+    if (logCtx.activeAttempt) logCtx.activeAttempt.model = selected.modelId;
+  };
   /**
    * Apply a rotated account's FULL credential snapshot to the live route (#2568d).
    *
@@ -306,6 +396,7 @@ export async function prepareResponsesTransport(
   const applyFailoverSnapshot = async (
     snapshot: OAuthAccessSnapshot,
     retryParsed: OcxParsedRequest = parsed,
+    insideDispatch = false,
   ): Promise<OAuthAccessSnapshot | null> => {
     requireAnthropicAdmission();
     if (snapshot.provider !== route.providerName) return null;
@@ -342,6 +433,9 @@ export async function prepareResponsesTransport(
     }
     if (snapshot.projectId) rotatedProvider = { ...rotatedProvider, project: snapshot.projectId };
     route.provider = rotatedProvider;
+    await resolveCopilotSelection(retryParsed, insideDispatch);
+    // Negotiation itself may have recovered a 401 with a newer committed credential.
+    if (route.providerName === "github-copilot" && servingOAuthSnapshot) snapshot = servingOAuthSnapshot;
     if (route.providerName === "kiro") {
       const kiroContext = { ...(snapshot.kiro ?? {}) };
       // Terminal-guard continuations are rebuilt from a shallow clone. Updating only the
@@ -411,7 +505,9 @@ export async function prepareResponsesTransport(
       && (anthropicInstance === undefined || !anthropicRouting!.getAnthropicAccountHealthSnapshot(binding.snapshot.accountId) && !anthropicRatePolicy!.anthropicRatePauseUntil(binding.snapshot.accountId) && !anthropicQuota!.anthropicFamilyRejected(binding.snapshot.accountId, route.modelId))
       && credentialGeneration(row.credential) === binding.snapshot.generation;
   };
+  /** Bind the negotiated wire adapter and its built requests to the serving credential's authority. */
   const resolveSelectionAdapter = (provider: OcxProviderConfig, retention = config.cacheRetention): ProviderAdapter => {
+    if (copilotAutoAdapter) provider = { ...provider, adapter: copilotAutoAdapter };
     const resolved = resolveAdapter(provider, retention, route.providerName);
     if (route.provider.authMode === "forward") return resolved;
     const binding: DispatchBinding | undefined = route.provider.authMode === "oauth"
@@ -468,6 +564,7 @@ export async function prepareResponsesTransport(
     }
     return resolved;
   };
+  /** Rebuild a stale queued selection while retaining the caller's dispatch lease and renewing Auto metadata. */
   const refreshDispatchAdapter = async (requestParsed: OcxParsedRequest): Promise<ProviderAdapter> => {
     requireAnthropicAdmission();
     if (route.provider.authMode === "oauth") {
@@ -479,7 +576,7 @@ export async function prepareResponsesTransport(
         const accountId = await anthropicRouting!.resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
         candidate = await anthropicRouting!.getAnthropicPoolAccessSnapshot(accountId);
       }
-      if (!candidate || !await applyFailoverSnapshot(candidate, requestParsed)) {
+      if (!candidate || !await applyFailoverSnapshot(candidate, requestParsed, true)) {
         if (anthropicInstance !== undefined) await anthropicRouting!.resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
         throw new Error("OAuth account selection changed before dispatch");
       }
@@ -487,6 +584,7 @@ export async function prepareResponsesTransport(
       const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, route.provider);
       if (!current) throw new Error("API key selection is unavailable before dispatch");
       route.provider = current;
+      await resolveCopilotSelection(requestParsed, true);
     }
     adapter = activeAdapter = runTurnAdapter = resolveSelectionAdapter(
       resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
@@ -552,13 +650,14 @@ export async function prepareResponsesTransport(
     throw new Error("Account selection changed repeatedly before turn dispatch");
     } finally { producer?.close(); }
   };
-  const oauthDispatch = (wireRequest: AdapterRequest, requestParsed = parsed): ProviderFetchOptions["dispatchOverride"] => {
+  /** Fence the physical send, with bounded credential/session rebuilds and safe negotiated refusals. */
+  const oauthDispatch = (wireRequest: AdapterRequest, requestParsed = parsed, owner: "adapter" | "passthrough" = "adapter"): ProviderFetchOptions["dispatchOverride"] => {
     if (route.provider.authMode === "forward") return undefined;
-    return async (input, init, execute) => {
+    return /** Dispatch with the current binding and session, rebuilding at most three times before returning a safe refusal. */ async (input, init, execute) => {
       let destination = input;
       let dispatchInit = init;
       for (let attempt = 0; attempt < 3; attempt++) {
-        if (selectionIsCurrent(requestBindings.get(wireRequest))) {
+        if (selectionIsCurrent(requestBindings.get(wireRequest)) && copilotSessionExpiresAt > Date.now() + 1000) {
           const fetchImpl = (route.provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? execute;
           const binding = requestBindings.get(wireRequest);
           const snapshot = anthropicInstance !== undefined && binding?.kind === "oauth"
@@ -622,7 +721,16 @@ export async function prepareResponsesTransport(
           if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
           return response;
         }
-        const nextAdapter = await refreshDispatchAdapter(requestParsed);
+        let nextAdapter: ProviderAdapter;
+        try { nextAdapter = await refreshDispatchAdapter(requestParsed); }
+        catch (error) {
+          const refusal = copilotRefusalResponse(error);
+          if (refusal) return refusal;
+          throw error;
+        }
+        if (owner === "passthrough" && route.providerName === "github-copilot" && nextAdapter.name === "openai-chat") {
+          throw new CopilotAutoAdapterHandoff(nextAdapter);
+        }
         // Rebind before rebuilding: the rebuild's bridged-search restore and continuation
         // restore key on the serving identity, which must be the refreshed route's, not the
         // credential whose selection just lapsed.
@@ -876,7 +984,15 @@ export async function prepareResponsesTransport(
       ? resolveCopilotApiBaseUrl(sentOAuthSnapshot?.apiBaseUrl)
       : undefined,
   );
+  try { await resolveCopilotSelection(parsed); }
+  catch (error) {
+    if ((options.abortSignal ?? req.signal).aborted) return clientCancelledResponse();
+    const refusal = copilotRefusalResponse(error);
+    if (refusal) return refusal;
+    return formatErrorResponse(502, "provider_error", "GitHub Copilot Auto negotiation failed; retry or check your Copilot account permissions.");
+  }
   let adapterProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy);
+  if (copilotAutoAdapter) adapterProvider = { ...adapterProvider, adapter: copilotAutoAdapter };
   const stripClaudeMainAuth = options.stripClaudeMainAuthForNoncanonicalForward === true
     && !isCanonicalOpenAiForwardProvider(adapterProvider)
     && ((adapterProvider.adapter === "openai-responses" && adapterProvider.authMode === "forward")
@@ -1008,6 +1124,8 @@ export async function prepareResponsesTransport(
     set genericFailovers(value: typeof genericFailovers) {
       genericFailovers = value;
     },
+    get oauth401ReplayAttempted(): boolean { return oauth401ReplayAttempted; },
+    set oauth401ReplayAttempted(value: boolean) { oauth401ReplayAttempted = value; },
     get adapter(): ProviderAdapter {
       return adapter;
     },
@@ -1065,6 +1183,8 @@ export async function prepareResponsesTransport(
     applyFailoverSnapshot,
     selectionIsCurrent,
     resolveSelectionAdapter,
+    resolveCopilotSelection,
+    copilotRefusalResponse,
     refreshRunTurnAdapter,
     oauthDispatch,
     noteRoutedAttemptSend,

package/src/server/responses/response-effects.ts

@@ -75,6 +75,7 @@ export function createResponsesEffects(
   // message, and leave Codex fataling on a missing compaction item (#422).
   const commitReasoningReplayServingRoute = (outboundHeaders?: HeadersInit): void => {
     commitReasoningReplayServingIdentity(parsed._reasoningReplayScope);
+    if (parsed._nativeReasoningMint) parsed._nativeReasoningMint.owner = parsed._nativeReasoningBoundOwner;
     rememberServingConversationStateIssuer(admissionState.authCtx, poolAffinityKey);
     // History has no model namespace. Record the account that actually accepted this
     // final attempt, after refresh/failover, rather than guessing from mutable affinity.

package/src/server/responses/run-turn-execution.ts

@@ -1,3 +1,4 @@
+import { mapSpendLedgerStorageError } from "./spend-storage-error";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
@@ -20,7 +21,7 @@ import type { AttemptRecoveryKind } from "../../usage/log";
 import { providerFetch } from "./fetch-helpers";
 import { normalizeLogConversationId } from "../request-log-conversation";
 import { normalizeDeclaredToolName, type AdapterEvent, type OcxProviderContinuationState } from "../../types";
-import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
+import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE, SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE, type OcxErrorPayload } from "../../lib/errors";
 import { SendBudgetExhaustedError, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
   hasEligibleGenericOAuthFailoverTarget,
@@ -235,6 +236,7 @@ export async function executeResponsesRunTurn(
       preacquiredSlot?: ProviderRequestSlot,
     ): Promise<void> => {
       const attemptSeq = ++runTurnAttemptSeq;
+      if (attemptSeq === 1 && options.comboInitialSend) options.comboInitialSend.producerOwned = true;
       let pacingSlot = preacquiredSlot;
       const emit = (event: AdapterEvent) => {
         options.onCompactionRecoveryAdapterEvent?.(event);
@@ -314,7 +316,8 @@ export async function executeResponsesRunTurn(
           Object.assign(parsed, routeState);
         }
       } catch (err) {
-        emit(err instanceof RequestPacingQueueOverloadError
+        const storageRefusal = mapSpendLedgerStorageError(err, logCtx);
+        emit(storageRefusal ? { type: "error", ...storageRefusal } : err instanceof RequestPacingQueueOverloadError
           ? {
               type: "error",
               status: 429,
@@ -339,6 +342,7 @@ export async function executeResponsesRunTurn(
                 message: err instanceof Error ? err.message : String(err),
               });
       } finally {
+        if (attemptSeq === 1) options.comboInitialSend?.permit.release();
         devinProducers.delete(producerAbort);
         cleanupProducerAbort?.();
         releaseProviderRequestSlot(pacingSlot);
@@ -711,7 +715,8 @@ export async function executeResponsesRunTurn(
           runTurnAbort.abort();
           queue.close();
           const message = preflight.error?.message ?? "Adapter ended before producing a response";
-          const failure = formatErrorResponse(502, "upstream_error", redactSecretString(message));
+          const failure = formatErrorResponse(preflight.error?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? 503 : 502,
+            preflight.error?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : "upstream_error", redactSecretString(message));
           // A replay-unsafe heartbeat means the adapter already ran a local side effect, so the
           // combo must not send this turn to another target: the failure stays with this child.
           if (preflight.replayUnsafe) markResponseNonReplayable(failure);
@@ -910,7 +915,9 @@ export async function executeResponsesRunTurn(
           const message = classifiedError?.message ?? (firstMeaningful?.type === "error"
             ? firstMeaningful.message
             : "Adapter ended before producing a response");
-          const failure = formatErrorResponse(502, "upstream_error", redactSecretString(message));
+          const storageRefusal = firstMeaningful?.type === "error" && firstMeaningful.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE;
+          const failure = formatErrorResponse(storageRefusal ? 503 : 502,
+            storageRefusal ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : "upstream_error", redactSecretString(message));
           if (replayUnsafe) markResponseNonReplayable(failure);
           return failure;
         }
@@ -954,7 +961,10 @@ export async function executeResponsesRunTurn(
         commitReasoningReplayServingRoute();
       }
       notifyResponseComplete(json);
-      return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } });
+      return new Response(JSON.stringify(json), {
+        status: (json.error as OcxErrorPayload | undefined)?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? 503 : 200,
+        headers: { "Content-Type": "application/json" },
+      });
     } catch (error) {
       if (!isTranslatorBudgetExceededError(error)) throw error;
       runTurnAbort.abort();