@bitkyc08/opencodex 2.83.0 → 2.84.0

package/src/server/responses/core-codex-account.ts

@@ -22,7 +22,15 @@ import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
 import { formatErrorResponse } from "../../bridge";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { upstreamErrorMessageFromPayload, isRateLimitOrQuotaFailureMessage } from "../../lib/errors";
-import { isNonReplayableResponse, isTransientUpstreamStatus } from "../../lib/upstream-retry";
+import { isNonReplayableResponse, isTransientUpstreamStatus, SendBudgetExhaustedError } from "../../lib/upstream-retry";
+import {
+  codexWsPreOutputRefusalHold,
+  codexWsPreOutputRefusalOutcomeRecorded,
+  isCodexWsPreOutputRefusal,
+  noteCodexWsPreOutputRefusalOutcome,
+  restoreCodexWsPreOutputRefusal,
+  type CodexWsPreOutputRefusalHold,
+} from "./codex-ws-wire";
 import type { RequestLogContext } from "../request-log";
 import type { DataPlaneAdmission } from "../auth-cors";
 import type { InboundWire } from "../../providers/registry";
@@ -121,6 +129,90 @@ export function usesCodexForwardPoolAuth(
     && provider.authMode === "forward" && provider.adapter === "openai-responses";
 }
 
+/**
+ * Write a pre-output refusal projection's account outcome once (#6969), for an exit that no other
+ * owner records: a caller abort or a local send-budget refusal during the same-account backoff,
+ * where the transport-failure path writes no account health and the restored stream never reaches
+ * delivery. A projection already recorded by the alternate-account helper is left alone.
+ */
+export function recordCodexPreOutputRefusalOutcome(
+  config: OcxConfig,
+  authCtx: CodexAuthContext,
+  provider: OcxProviderConfig,
+  response: Response,
+  modelId: string,
+): void {
+  if (!isCodexWsPreOutputRefusal(response) || codexWsPreOutputRefusalOutcomeRecorded(response)) return;
+  if (!usesCodexForwardPoolAuth(authCtx, provider)) return;
+  noteCodexWsPreOutputRefusalOutcome(response);
+  recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
+    threadId: authCtx.affinityKey,
+    fixedAccount: authCtx.fixedAccount,
+    modelId,
+    probeLeaseId: codexProbeLeaseId(authCtx),
+    probeQuotaScope: codexProbeQuotaScope(authCtx),
+    transientProbe: codexTransientProbeGrant(authCtx),
+    writerGeneration: authCtx.writerGeneration,
+  });
+}
+
+/**
+ * The pre-output refusal hold for one Pool send starting now (#6969), or undefined. Pool forward
+ * sends only, and never a combo child, whose own stream preflight already advances on a zero-output
+ * terminal. Every projection a send produces must later pass through
+ * {@link PoolPreOutputRefusals.restore}.
+ */
+export function poolPreOutputRefusalHold(
+  authCtx: CodexAuthContext,
+  provider: OcxProviderConfig,
+  connectMs: number,
+  comboAttempt: boolean | undefined,
+): CodexWsPreOutputRefusalHold | undefined {
+  return !comboAttempt && usesCodexForwardPoolAuth(authCtx, provider) ? codexWsPreOutputRefusalHold(connectMs) : undefined;
+}
+
+/**
+ * One dispatch's view of its pre-output refusal projections (#6969): the last one the initial
+ * transient ladder observed, the single exit where the dispatch itself must record it, and the
+ * restore that hands the client the original stream.
+ */
+export class PoolPreOutputRefusals {
+  private last: Response | undefined;
+  /** True when the response handed to delivery is a restored projection already recorded. */
+  outcomeRecorded = false;
+
+  readonly observe = (response: Response): Response => {
+    if (isCodexWsPreOutputRefusal(response)) this.last = response;
+    return response;
+  };
+
+  /**
+   * One owner per exceptional exit of the initial ladder. A caller abort or a local budget refusal
+   * during the backoff leaves the transport-failure path writing no account health, so the refusal
+   * already observed is recorded here; any other exception keeps that path as its single writer.
+   */
+  recordOnLocalExit(
+    error: unknown,
+    aborted: boolean,
+    config: OcxConfig,
+    authCtx: CodexAuthContext,
+    provider: OcxProviderConfig,
+    modelId: string,
+  ): void {
+    if (!this.last || !(aborted || error instanceof SendBudgetExhaustedError)) return;
+    recordCodexPreOutputRefusalOutcome(config, authCtx, provider, this.last, modelId);
+  }
+
+  /**
+   * Called right after the Pool block on every recovery pass: a projection that survived the ladder
+   * and the account move becomes the original event stream before any later reader sees it.
+   */
+  restore(response: Response): Response {
+    this.outcomeRecorded = isCodexWsPreOutputRefusal(response) && codexWsPreOutputRefusalOutcomeRecorded(response);
+    return restoreCodexWsPreOutputRefusal(response);
+  }
+}
+
 
 /** Live proof that this plain-main response used the observed main credential. */
 export function liveMainQuotaDispatch(
@@ -368,6 +460,10 @@ export async function shouldRetryCodexScopedQuotaOnAlternate(
  * could duplicate a turn the origin may still be running. A 5xx whose body confirms quota is not
  * routed here either — {@link shouldRetryCodexPoolAccountQuota} classifies that one first and
  * carries the cooldown with it.
+ *
+ * A WebSocket refusal reaches this predicate only as the opt-in pre-output projection (#6969): the
+ * upstream itself ended the turn with a structured 5xx while nothing but empty lifecycle frames had
+ * been relayed. It carries no non-replayable marker because nothing could have been observed.
  */
 export function shouldRetryCodexPoolAccountTransient(response: Response): boolean {
   return !isNonReplayableResponse(response) && isTransientUpstreamStatus(response.status);
@@ -420,6 +516,8 @@ export interface CodexPoolAccountRetryArgs {
   stream: boolean;
   /** Keep a buffered canonical client on HTTP/SSE after moving to another Pool account. */
   httpOnly?: boolean;
+  /** Pre-output refusal hold for the alternate's WebSocket send (#6969); the caller restores. */
+  preOutputRefusalHold?: CodexWsPreOutputRefusalHold;
   onResponse?: (
     response: Response,
     authCtx: CodexAuthContext,
@@ -571,6 +669,10 @@ export async function retryCodexPoolOnAlternateAccount(
   // keep handing it the next request.
   const recordUnmovedTransientOutcome = (): void => {
     if (!isTransientUpstreamStatus(outcomeStatus)) return;
+    // #6969: one write per projection. After recordFirstOutcome, a late window or permit denial
+    // must not record the same refusal again, and a recorded projection tells delivery to skip it.
+    if (codexWsPreOutputRefusalOutcomeRecorded(firstResponse)) return;
+    noteCodexWsPreOutputRefusalOutcome(firstResponse);
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       threadId: firstAuthCtx.affinityKey,
       fixedAccount: firstAuthCtx.fixedAccount,
@@ -763,6 +865,7 @@ export async function retryCodexPoolOnAlternateAccount(
       // Retry already advanced the RR ring via excludeAccountId — reuse for promotion.
       ...(retryAuthCtx.accountId ? { promoteAccountId: retryAuthCtx.accountId } : {}),
     });
+    noteCodexWsPreOutputRefusalOutcome(firstResponse);
   };
   // Only a combo reset-derived outcome is deferred. Retry-After, defaults, and
   // ordinary requests must block the first account before the alternate send.
@@ -918,6 +1021,7 @@ export async function retryCodexPoolOnAlternateAccount(
             httpOnly,
             providerName: route.providerName,
             modelId: route.modelId,
+            preOutputRefusalHold: args.preOutputRefusalHold,
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,

package/src/server/responses/core-combo-failure.ts

@@ -14,6 +14,7 @@ import {
 import { normalizeUpstreamErrorText } from "./core-errors";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { formatErrorResponse } from "../../bridge";
+import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
 import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
 import { usageFromResponsesPayload } from "../request-log";
 import type { ResponsesTerminalStatus } from "../../bridge";
@@ -121,6 +122,7 @@ export async function consumeComboFailure(
     classificationText,
     ...(codexModelRefusal !== undefined ? { codexModelRefusal } : {}),
     ...(normalizedUpstreamCode !== undefined ? { upstreamCode: normalizedUpstreamCode } : {}),
+    ...(upstreamMessage !== undefined ? { upstreamMessage } : {}),
     ...(upstreamType !== undefined ? { upstreamType } : {}),
     ...(!cyberFailure && cooldownRetryAfter !== undefined ? { retryAfter: cooldownRetryAfter } : {}),
     // The EFFECTIVE classification decides, not the raw status. An upstream that wraps a quota
@@ -221,3 +223,15 @@ export function buildComboChildHeaders(parentHeaders: HeadersInit): Headers {
   childHeaders.delete("content-encoding");
   return childHeaders;
 }
+
+/**
+ * A member's local Ollama late-attribution refusal: the exact proxy-owned constant on the exact
+ * local wire shape, from a replayable attempt. The caller replaces only the client response with
+ * the literal constant envelope; classification inputs are never rewritten.
+ */
+export function isLateAttributionRefusal(failure: ConsumedComboFailure): boolean {
+  return !failure.nonReplayable
+    && failure.response.status === 413
+    && failure.upstreamCode === "request_too_large"
+    && failure.upstreamMessage === OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE;
+}

package/src/server/responses/core-combo.ts

@@ -80,6 +80,7 @@ import {
   buildComboChildHeaders,
   createChildPassthroughCallbackGate,
   consumeComboFailure,
+  isLateAttributionRefusal,
 } from "./core-combo-failure";
 import {
   linkRequestSessionLane,
@@ -100,7 +101,7 @@ import {
   markEagerRelaySseResponse,
 } from "../relay";
 import { preflightComboStreamResponse } from "./combo-stream-preflight";
-import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
+import { streamingContextOverflowResponse, jsonContextOverflowResponse, lateAttributionLimitResponse } from "./context-overflow";
 import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
 import { settleOperatorReplacement } from "../../lib/upstream-retry";
 import { createComboProtocolLanes, dispatchNativeComboChild } from "./core-combo-native";
@@ -1007,6 +1008,10 @@ export async function executeComboResponses(
       retainCancelledAttempt();
       return clientCancelledResponse();
     }
+    // A member's local late-attribution refusal reaches the client only as the literal constant
+    // envelope: swap the response, keep every classification input, and skip the overflow rewrite.
+    const lateAttributionRefusal = isLateAttributionRefusal(failure);
+    if (lateAttributionRefusal) failure = { ...failure, response: lateAttributionLimitResponse() };
     sealRequestAttemptIdentity(
       attempt,
       childLog.provider,
@@ -1047,7 +1052,7 @@ export async function executeComboResponses(
       });
     const wantsStream = (rawBody as { stream?: unknown } | null)?.stream === true;
     // Local byte admission has its own diagnostic; do not relabel it as an upstream refusal.
-    const classifyOverflow = failure.response.status === 413
+    const classifyOverflow = failure.response.status === 413 && !lateAttributionRefusal
       && (wantsStream || (failure.upstreamCode !== "outbound_body_too_large"
         && failure.upstreamCode !== "translation_buffer_limit"));
     lastFailureClassifiesOverflow = classifyOverflow;

package/src/server/responses/core-errors.ts

@@ -2,7 +2,7 @@ import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { redactSecretString } from "../../lib/redact";
 import { isCyberPolicyMessage, isCyberPolicyCode } from "../../lib/errors";
 import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
-import { formatErrorResponse } from "../../bridge";
+import { formatErrorResponse, formatUsageLimitReachedResponse } from "../../bridge";
 import {
   UnsupportedContentEncodingError,
   DecompressedBodyTooLargeError,
@@ -132,6 +132,34 @@ export function clientCancelledResponse(): Response {
   return formatErrorResponse(499, "client_cancelled", "Client cancelled request");
 }
 
+/**
+ * The Responses answer to a local Anthropic pool refusal (`AnthropicAccountCooldownError`).
+ *
+ * When every held account is out on spent quota the refusal is a usage limit (#6991), which the
+ * Codex client stops on and renders with its reset time; anything else stays the retryable
+ * `rate_limit_error` it always was. A combo child keeps the retryable form and wording: the combo
+ * hops on any 429 and rebuilds the body anyway, and `isAnthropicPoolLocalRefusal` in
+ * `core-combo.ts` deliberately cools the target for the short local fallback, which a usage-limit
+ * code or usage-limit prose would stretch to the ten-minute exhaustion fallback in
+ * `combos/failover.ts`.
+ */
+export function anthropicPoolCooldownResponse(
+  refusal: {
+    message: string;
+    retryableMessage: string;
+    retryAfterSeconds: number | null;
+    usageLimit: { readonly resetsAt: number | null } | null;
+  },
+  options: { comboAttempt?: boolean; logCtx?: { errorCode?: string } } = {},
+): Response {
+  if (refusal.usageLimit !== null && !options.comboAttempt) {
+    if (options.logCtx) options.logCtx.errorCode = "usage_limit_reached";
+    return formatUsageLimitReachedResponse(refusal.message, refusal.usageLimit.resetsAt, refusal.retryAfterSeconds);
+  }
+  return formatErrorResponse(429, "rate_limit_error", refusal.retryableMessage,
+    refusal.retryAfterSeconds === null ? undefined : { retryAfter: String(refusal.retryAfterSeconds) });
+}
+
 
 export const UNREADABLE_ENCRYPTED_AGENT_TASK_MESSAGE =
   "Routed V2 worker task is encrypted for the native ChatGPT backend and cannot be read by the selected provider. Use plaintext V2 agent-message delivery or select a native ChatGPT model.";

package/src/server/responses/core-options.ts

@@ -30,6 +30,8 @@ export interface ConsumedComboFailure {
   codexModelRefusal?: CodexAccountModelRefusal;
   /** Structured upstream `error.code` when present in the failure body. */
   upstreamCode?: string;
+  /** Sanitized structured `error.message`; compared only against proxy-owned constants, never emitted. */
+  upstreamMessage?: string;
   /** Complete structured provider type, retained for conservative recovery classification. */
   upstreamType?: string;
   /** Valid numeric/date value used only for cooldown calculation. */

package/src/server/responses/deferred-collab-surface.ts

@@ -0,0 +1,158 @@
+/**
+ * Deferred V1 collaboration evidence from Codex's `<tools>` world-state fragment (#6844).
+ *
+ * When the model supports tool search (every OpenCodex catalog row), codex-rs registers the V1
+ * collaboration tools as DEFERRED (core/src/tools/spec_plan.rs, add_collaboration_tools) under the
+ * fixed namespace `multi_agent_v1` (core/src/tools/handlers/multi_agents_spec.rs). Neither the wire
+ * tools nor the code-mode exec description then mention them. With the deferred_tool_world_state
+ * feature on (default off upstream; Codex Desktop sessions were observed receiving it), codex-rs
+ * instead tells the model which namespaces it can load, in a developer fragment
+ * (core/src/context/world_state/tools.rs):
+ *
+ *   <tools>
+ *   Deferred tool namespaces:
+ *   - multi_agent_v1: Tools for spawning and managing sub-agents.
+ *   </tools>
+ *
+ * Later turns carry only diffs ("Added deferred tool namespaces:", "Removed deferred tool
+ * namespaces:", "No deferred tool namespaces remain."), so membership is replayed in input order.
+ * The fragment is capped at 4 KiB: rows may be name-only, and whole rows may be replaced by
+ * "... <n> additional namespaces omitted." (tools_budget.rs).
+ *
+ * The evidence is positive-only and conservative:
+ * - only developer messages are read, each text part on its own, and only a part that is exactly
+ *   one fragment after trimming; text that merely mentions the tag is ignored;
+ * - a fragment that starts like one but breaks the line grammar clears what was carried, because a
+ *   lost removal could have been multi_agent_v1; omitted removals clear for the same reason, and
+ *   omitted rows never establish a namespace;
+ * - it counts only beside a host that can load deferred tools: a genuine code-mode exec or a
+ *   structured tool_search tool. A caller's own exec or a function merely named tool_search is not
+ *   one.
+ *
+ * Capability boundary: the row proves that some deferred multi_agent_v1 tool is registered, not
+ * that spawn_agent is. Upstream can split them only through an embedder-supplied ToolPolicy
+ * allowlist; its one production allowlist (the guardian reviewer) admits no V1 tool at all, and
+ * the V1 depth limit disables the surface as a unit, so Codex CLI and Desktop never send a
+ * management-only V1 namespace. A developer item can also be impersonated by whoever writes the
+ * conversation. Both cases receive advisory guidance they cannot act on; nothing is enforced here.
+ */
+import type { OcxMessage, OcxParsedRequest, OcxTool } from "../../types";
+import type { CodeModeExecAnalysis } from "./code-mode-collab-surface";
+
+const MULTI_AGENT_V1_NAMESPACE = "multi_agent_v1";
+const OPEN_TAG = "<tools>";
+const CLOSE_TAG = "</tools>";
+const SNAPSHOT_HEADER = "Deferred tool namespaces:";
+const ADDED_HEADER = "Added deferred tool namespaces:";
+const REMOVED_HEADER = "Removed deferred tool namespaces:";
+const EMPTY_STATE = "No deferred tool namespaces remain.";
+// A description is opaque: upstream copies its first line verbatim, which may hold any character
+// except \n, including U+2028/U+2029 that `.` would refuse.
+const ROW = /^- ([^:\s]+)(?:: [\s\S]*)?$/;
+const OMISSION = /^\.\.\. \d+ additional namespaces omitted\.$/;
+
+type Fragment =
+  | { kind: "malformed" }
+  | { kind: "snapshot"; rows: Set<string>; empty: boolean }
+  | { kind: "diff"; added: Set<string>; removed: Set<string>; removedOmitted: boolean; empty: boolean };
+
+/** One standalone fragment, a malformed one, or nothing (text that is not a fragment). */
+function parseFragment(text: string): Fragment | null {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith(OPEN_TAG)) return null;
+  if (!trimmed.endsWith(CLOSE_TAG) || trimmed.length < OPEN_TAG.length + CLOSE_TAG.length) return { kind: "malformed" };
+  const body = trimmed.slice(OPEN_TAG.length, trimmed.length - CLOSE_TAG.length);
+  let group: "snapshot" | "added" | "removed" | undefined;
+  // Upstream renders each group at most once, Added before Removed, and skips empty groups.
+  const seen = new Set<"snapshot" | "added" | "removed">();
+  let groupHasEntries = true;
+  let empty = false;
+  const rows = { snapshot: new Set<string>(), added: new Set<string>(), removed: new Set<string>() };
+  let removedOmitted = false;
+  const open = (next: "snapshot" | "added" | "removed"): boolean => {
+    if (seen.has(next) || !groupHasEntries) return false;
+    if (next === "added" && seen.has("removed")) return false;
+    seen.add(next);
+    group = next;
+    groupHasEntries = false;
+    return true;
+  };
+  for (const raw of body.split("\n")) {
+    const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+    if (line === "") continue;
+    // The empty-state notice closes the fragment; nothing may follow it.
+    if (empty) return { kind: "malformed" };
+    if (line === SNAPSHOT_HEADER) { if (!open("snapshot")) return { kind: "malformed" }; continue; }
+    if (line === ADDED_HEADER) { if (!open("added")) return { kind: "malformed" }; continue; }
+    if (line === REMOVED_HEADER) { if (!open("removed")) return { kind: "malformed" }; continue; }
+    if (line === EMPTY_STATE) {
+      if (!groupHasEntries) return { kind: "malformed" };
+      empty = true;
+      continue;
+    }
+    if (group === undefined) return { kind: "malformed" };
+    groupHasEntries = true;
+    if (OMISSION.test(line)) {
+      if (group === "removed") removedOmitted = true;
+      continue;
+    }
+    const row = ROW.exec(line);
+    if (!row) return { kind: "malformed" };
+    rows[group].add(row[1]!);
+  }
+  if (!groupHasEntries) return { kind: "malformed" };
+  const sawSnapshot = seen.has("snapshot");
+  const sawDiff = seen.has("added") || seen.has("removed");
+  if (sawSnapshot && sawDiff) return { kind: "malformed" };
+  if (sawSnapshot) return { kind: "snapshot", rows: rows.snapshot, empty };
+  if (!sawDiff && !empty) return { kind: "malformed" };
+  for (const name of rows.added) if (rows.removed.has(name)) return { kind: "malformed" };
+  return { kind: "diff", added: rows.added, removed: rows.removed, removedOmitted, empty };
+}
+
+function developerTexts(message: OcxMessage): string[] {
+  if (message.role !== "developer") return [];
+  if (typeof message.content === "string") return [message.content];
+  return message.content.flatMap(part => (part.type === "text" ? [part.text] : []));
+}
+
+/** Replays every fragment in input order; true when multi_agent_v1 is currently known deferred. */
+function deferredNamespacesIncludeV1(messages: readonly OcxMessage[]): boolean {
+  const current = new Set<string>();
+  for (const message of messages) {
+    for (const text of developerTexts(message)) {
+      const fragment = parseFragment(text);
+      if (fragment === null) continue;
+      switch (fragment.kind) {
+        case "malformed":
+          current.clear();
+          break;
+        case "snapshot":
+          current.clear();
+          for (const name of fragment.rows) current.add(name);
+          break;
+        case "diff":
+          if (fragment.removedOmitted) current.clear();
+          for (const name of fragment.added) current.add(name);
+          for (const name of fragment.removed) current.delete(name);
+          break;
+      }
+      if (fragment.kind !== "malformed" && fragment.empty) current.clear();
+    }
+  }
+  return current.has(MULTI_AGENT_V1_NAMESPACE);
+}
+
+function declaresStructuredToolSearch(tools: readonly OcxTool[] | undefined): boolean {
+  return (tools ?? []).some(tool => !tool.namespace && tool.toolSearch === true);
+}
+
+/**
+ * True when the request's own developer history says V1 collaboration tools are deferred and the
+ * request comes from a host that can load deferred tools.
+ */
+export function deferredV1Evidence(parsed: OcxParsedRequest, codeMode: CodeModeExecAnalysis): boolean {
+  if (!codeMode.genuineExec && !declaresStructuredToolSearch(parsed.context.tools)) return false;
+  return deferredNamespacesIncludeV1(parsed.context.messages);
+}
+

package/src/server/responses/deferred-send-reporter.ts

@@ -0,0 +1,25 @@
+import type { PhysicalSendReporter } from "../../lib/request-execution-budget";
+
+/** Retry thunks can fail in pacing; settle only starts admitted at the physical executor. */
+export function deferPhysicalSendReporter(physical: PhysicalSendReporter) {
+  let dispatched = 0;
+  let reported = 0;
+  const report: PhysicalSendReporter = () => {
+    const count = dispatched - reported;
+    if (count <= 0) return;
+    physical(count);
+    reported += count;
+  };
+  // The retry helper owns attempts, while the physical callback owns spend admission.
+  report.beforeSend = () => true;
+  report.execute = physical.execute;
+  report.close = () => { report(0); physical.close?.(); };
+  return {
+    report,
+    beforeDispatch(): boolean {
+      if (physical.beforeSend && !physical.beforeSend()) return false;
+      dispatched++;
+      return true;
+    },
+  };
+}

package/src/server/responses/fetch-helpers.ts

@@ -1,4 +1,5 @@
 import type { NativeResponseControl } from "./native-response-control";
+import type { CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import type { Server } from "bun";
 import {
   codexWsUpstreamFetch,
@@ -28,6 +29,7 @@ import {
   type ProviderEgressBinding,
 } from "../../lib/provider-egress";
 import { redactSecretString } from "../../lib/redact";
+import { outboundCredentials } from "../../lib/outbound-credential-registry";
 
 export { withUpstreamHttpVersion };
 
@@ -205,6 +207,9 @@ export function sendWithConnectionPolicy(
     && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
+  // Final headers, after plugin rewrites: an upstream can only echo what it received here, so the
+  // request log refuses any diagnostic that repeats one of these values (see request-log-terminal-status).
+  outboundCredentials().remember(headers);
   return physicalFetch(input, {
     ...init,
     ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
@@ -240,6 +245,12 @@ export interface ProviderFetchOptions {
   beforeDispatch?: (headers: Headers) => void;
   /** One-shot receipt after final local HTTP admission, immediately before executor entry. */
   onPhysicalDispatch?: () => void;
+  /**
+   * Opt-in (#6969): let a Codex WebSocket send hold empty lifecycle frames so an authoritative
+   * upstream refusal before any output settles as a replayable gateway status. Only a caller that
+   * restores the projection afterwards (restoreCodexWsPreOutputRefusal) may set it.
+   */
+  preOutputRefusalHold?: CodexWsPreOutputRefusalHold;
   /** Revalidate/rebuild a queued request at its physical send boundary, after pacing. */
   dispatchOverride?: (input: Parameters<typeof globalThis.fetch>[0], init: RequestInit, execute: typeof globalThis.fetch) => Promise<Response>;
 }
@@ -356,7 +367,7 @@ export function providerFetch(
       const fallback = ((url: Parameters<typeof globalThis.fetch>[0], fallbackInit?: RequestInit) =>
         httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit)) as typeof globalThis.fetch;
       return codexWsUpstreamFetch(input, init, fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
-        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce);
+        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold);
     }
     return httpFetch(input, init);
   };

package/src/server/responses/passthrough-delivery.ts

@@ -408,6 +408,7 @@ export async function deliverPassthroughResponse(
     | "noteInspectedPayload"
     | "normalizeFunctionCompletionJson"
     | "localUpstream"
+    | "terminalOutcomeRecorded"
   >,
 ): Promise<Response> {
   const { route } = requestState;
@@ -486,7 +487,9 @@ export async function deliverPassthroughResponse(
       ? (status: ResponsesTerminalStatus, httpStatusOverride?: number): void => {
         if (terminalOutcomeRecorded) return;
         terminalOutcomeRecorded = true;
-        recordTerminalOutcome(status, httpStatusOverride);
+        // A restored pre-output refusal whose account outcome dispatch already wrote (#6969) keeps
+        // every other terminal callback but must not write the same refusal a second time.
+        if (!nativeExchange.terminalOutcomeRecorded) recordTerminalOutcome(status, httpStatusOverride);
       }
       : undefined;
     const terminalBodyWillRecord = !!terminalRecorder && upstreamResponse.ok && isEventStream;

package/src/server/responses/passthrough-dispatch.ts

@@ -91,7 +91,7 @@ import {
   safeHostLabel,
 } from "./fetch-helpers";
 import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
-import { clientCancelledResponse } from "./core-errors";
+import { anthropicPoolCooldownResponse, clientCancelledResponse } from "./core-errors";
 import {
   upstreamHostCircuitOpenResponse,
   usesCodexForwardPoolAuth,
@@ -101,6 +101,8 @@ import {
   shouldRetryCodexPoolAccountQuota,
   shouldRetryCodexPoolAccountTransient,
   retryCodexPoolOnAlternateAccount,
+  PoolPreOutputRefusals,
+  poolPreOutputRefusalHold,
 } from "./core-codex-account";
 import {
   clearCodexModelDenialEvidence,
@@ -949,8 +951,7 @@ export async function preparePassthroughExchange(
           return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(refusal));
         }
         if (refusal instanceof AnthropicAccountCooldownError) {
-          return formatErrorResponse(429, "rate_limit_error", refusal.message,
-            refusal.retryAfterSeconds === null ? undefined : { retryAfter: String(refusal.retryAfterSeconds) });
+          return anthropicPoolCooldownResponse(refusal, { comboAttempt: options.comboAttempt, logCtx });
         }
         return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(refusal));
       }
@@ -1005,6 +1006,9 @@ export async function preparePassthroughExchange(
     // Stable per request: the Combo booking (`reserveDispatch`) already started and froze the spend
     // policy, so `spendEnforced` cannot change before dispatch even though no reporter starts it here.
     const receiptMode = !sendBudgetState.adapterSendBudget?.spendEnforced && Boolean(options.comboInitialSend);
+    // #6969: Pool sends hold empty lifecycle frames so a pre-output refusal reaches the ladder below.
+    const preOutputRefusals = new PoolPreOutputRefusals();
+    const preOutputRefusalHold = () => poolPreOutputRefusalHold(admissionState.authCtx, route.provider, connectMs, options.comboAttempt);
     try {
       // Transient-5xx pre-stream retry (devlog/_plan/260716_claudecode_hardening/010):
       // the ChatGPT backend emits transient 502/520s that an immediate retry absorbs.
@@ -1035,11 +1039,12 @@ export async function preparePassthroughExchange(
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                 ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+              preOutputRefusalHold: preOutputRefusalHold(),
             }),
             route.provider.authMode === "forward")
             // Every real attempt response — including an intermediate 5xx the
             // retry wrapper replaces — proves the host was reached (#914 review).
-            .then(adoptObservedResponse);
+            .then(adoptObservedResponse).then(preOutputRefusals.observe);
         },
         { abortSignal: upstream.signal, label: safeHostLabel(request.url),
           attempts: sendBudgetState.initialSendAllowance(transientSendAttempts()),
@@ -1050,6 +1055,8 @@ export async function preparePassthroughExchange(
         },
       );
     } catch (err) {
+      preOutputRefusals.recordOnLocalExit(err, options.abortSignal?.aborted === true || req.signal.aborted,
+        config, admissionState.authCtx, route.provider, route.modelId);
       return transportFailureResponse(err);
     } finally {
       request.releaseBodyObservation?.();
@@ -1676,6 +1683,7 @@ export async function preparePassthroughExchange(
           passthroughEstimate,
           stream: upstreamRequestsStream,
           httpOnly: canonicalBufferedJson,
+          preOutputRefusalHold: preOutputRefusalHold(),
           onResponse: (response, retryAuthCtx, retryRequest) => {
             adoptCodexWsStage(response);
             captureAffinityResponse(
@@ -1702,6 +1710,8 @@ export async function preparePassthroughExchange(
         }
       }
     }
+    // #6969: a projection nothing above recovered goes on as the original stream, before any reader.
+    upstreamResponse = preOutputRefusals.restore(upstreamResponse);
     // The deterministic route record cannot classify history it never observed (restart, expiry,
     // eviction, or an older transcript). Inspect only a bounded clone of a 4xx whose exact outbound
     // Responses body still carries opaque state, then rebuild once through the ordinary adapter
@@ -1969,6 +1979,7 @@ export async function preparePassthroughExchange(
     connectMs,
     localUpstream,
     upstreamResponse,
+    terminalOutcomeRecorded: preOutputRefusals.outcomeRecorded,
   };
 }
 

package/src/server/responses/request-prepare.ts

@@ -33,6 +33,7 @@ import { resolveContextPrincipal } from "../auth-cors";
 import { resolveSkillsSnapshotScopeKey, snapshotSkillsCatalogInBody } from "./skills-snapshot";
 import {
   isShadowSourceModel,
+  shadowCallPreservesSelectedModel,
   shadowSourceModelPrefix,
   shouldInterceptShadowCall,
 } from "../../lib/shadow-call";
@@ -275,10 +276,11 @@ export async function prepareResponsesRequest(
     }
   }
   let shadowCallIntercepted = false;
-  // A spawned sub-agent turn names its model on purpose; gpt-6-luna is both the helper
-  // slug and a default sub-agent model, so neither intercept site may rewrite that turn.
+  // Luna is also selectable by users/children. Both intercept sites use the same
+  // per-turn provenance; WS frames must not inherit the handshake's classification.
   const threadSpawn = isThreadSpawnRequest(req.headers);
-  if (!concreteSelection && !options.compactionRoutingOverride && !options.internalDecisionCall && !threadSpawn && !memoryModelApplies && body && typeof body === "object" && !Array.isArray(body)) {
+  const preserveShadowModel = shadowCallPreservesSelectedModel(body, req.headers, options.inboundTransport);
+  if (!concreteSelection && !options.compactionRoutingOverride && !options.internalDecisionCall && !preserveShadowModel && !memoryModelApplies && body && typeof body === "object" && !Array.isArray(body)) {
     const shadowIntercept = config.shadowCallIntercept;
     const rawShadowModel = (body as { model?: unknown }).model;
     if (shadowIntercept?.enabled && shadowIntercept.model && typeof rawShadowModel === "string"
@@ -613,7 +615,7 @@ export async function prepareResponsesRequest(
     }
     const _sci = config.shadowCallIntercept;
     let shadowRoute: RouteResult | undefined;
-    if (!concreteSelection && !memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !options.internalDecisionCall && !threadSpawn && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
+    if (!concreteSelection && !memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !options.internalDecisionCall && !preserveShadowModel && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
       const sourcePrefix = shadowSourceModelPrefix(parsed.modelId, _sci.sourceModels)!;
       let sourceIdentity = { providerName: OPENAI_CODEX_PROVIDER_ID, modelId: sourcePrefix };
       try {