@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/server/responses/adapter-dispatch.ts

@@ -1,3 +1,4 @@
+import { deferPhysicalSendReporter } from "./deferred-send-reporter";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { classifyAnthropic429 } from "../../oauth/anthropic-rate-limit-policy";
 import { rotateAnthropicAccountOnResponseForInstance } from "../../oauth/anthropic-account-refusal";
@@ -23,11 +24,13 @@ import {
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
 } from "../request-log";
-import { clientCancelledResponse, readDisplaySafeErrorText, normalizeUpstreamErrorText } from "./core-errors";
+import { anthropicPoolCooldownResponse, clientCancelledResponse, readDisplaySafeErrorText, normalizeUpstreamErrorText } from "./core-errors";
+import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
 import { redactSecretString } from "../../lib/redact";
 import { rewriteUpstreamPolicyRefusal } from "./policy-refusal";
 import { withProviderRequestSlot } from "../../providers/request-pacing";
 import { providerFetch, fetchWithHeaderTimeout, safeHostLabel } from "./fetch-helpers";
+import { isAnthropicBillingKeyPool, rotateAnthropicBillingKeyOnResponse } from "../../providers/anthropic-billing-recovery";
 import {
   transientRetryPolicyFor,
   resetReplayPolicyFor,
@@ -91,7 +94,8 @@ import {
 } from "../../providers/opencode-zen-rate-limit";
 import { planReasoningEffortDowngrade } from "../../providers/reasoning-metadata";
 import { consumeComboFailure } from "./core-combo-failure";
-import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
+import { streamingContextOverflowResponse, jsonContextOverflowResponse, lateAttributionLimitResponse } from "./context-overflow";
+import { OllamaLateAttributionBudgetError } from "../../adapters/ollama-native";
 import { isFixedCodexAccount } from "./core-codex-account";
 import { recordSubagentQuotaFailureForThreadSpawn } from "../../codex/subagent-model-fallback";
 import {
@@ -108,6 +112,7 @@ import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import { chargeWorkflowSends } from "../../lib/workflow-budget";
 import { isAntigravityValidationRefusal } from "./antigravity-validation-refusal";
 import { unboundPoolSpendRefusalResponse } from "../workflow-refusal";
+import { AdmissionModelDeniedError, admissionModelDeniedResponse } from "../admission-model-scope";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function prepareAdapterExchange(
@@ -221,8 +226,13 @@ export async function prepareAdapterExchange(
 
 
   let selfContainedJudgment: boolean | undefined;
+  // On the Antigravity direct lane the raw body carries only settings; judge the body the bridge
+  // would have sent, built only if an ambiguous reset actually asks.
+  const directRequest = options.directRequest;
   const requestIsSelfContained = (): boolean =>
-    selfContainedJudgment ??= selfContainedResponsesBody(parsed._rawBody);
+    selfContainedJudgment ??= selfContainedResponsesBody(directRequest
+      ? { ...(parsed._rawBody as Record<string, unknown>), ...directRequest.bridgeConversation() }
+      : parsed._rawBody);
   const claimPreHeaderResend = (): boolean => authorizeResendForRecovery(
     "pre-header", "connection-reset",
     ambiguousResendAllowanceFor(route.provider, requestIsSelfContained, claimAmbiguousResend),
@@ -341,6 +351,14 @@ export async function prepareAdapterExchange(
     cleanupUpstreamAbort();
     upstream.abort();
     if (options.abortSignal?.aborted) return clientCancelledResponse();
+    if (err instanceof OllamaLateAttributionBudgetError) return lateAttributionLimitResponse();
+    // An adapter can also throw the shared translator budget while sizing generated
+    // request content (e.g. Ollama late-tool attribution); keep its established 413.
+    if (isTranslatorBudgetExceededError(err)) {
+      return formatErrorResponse(413, "request_too_large", "request translation buffer exceeded the safe limit", {
+        code: "translation_buffer_limit",
+      });
+    }
     const msg = err instanceof Error ? err.message : String(err);
     return formatErrorResponse(400, "invalid_request_error", redactSecretString(msg));
   }
@@ -362,6 +380,23 @@ export async function prepareAdapterExchange(
       : transportState.oauth401ReplayAttempted ? "oauth-401" : undefined
     : undefined;
   let upstreamResponse: Response;
+  // Preserve bounded terminal bytes without retaining the refused send's pacing lease.
+  // Reading the owned body to EOF (or cancelling on its bound) frees capacity BEFORE
+  // replacement admission; keeping that live body would wait on its own concurrency slot.
+  const retainFailureResponse = async (): Promise<Response> => {
+    const original = upstreamResponse;
+    const text = await readDisplaySafeErrorText(original, upstream.signal, "");
+    const headers = new Headers(original.headers);
+    headers.delete("content-length");
+    headers.delete("content-encoding");
+    upstreamResponse = new Response(text, { status: original.status, statusText: original.statusText, headers });
+    return upstreamResponse;
+  };
+  const billingPoolRequest = isAnthropicBillingKeyPool(route.provider);
+  let billingRecoveryActive = false;
+  const genericRefetchCountsSends = () => sendBudgetState.adapterSendBudget?.spendEnforced === true
+    || transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null
+    || billingPoolRequest || billingRecoveryActive;
   let handoffPermit: ResponsesSendBudget["pendingHopPermit"];
   try {
     if (transportState.activeAdapter.fetchResponse) {
@@ -434,6 +469,8 @@ export async function prepareAdapterExchange(
       const fetchWithRetryPolicy = (route.provider.adapter === "google" || transientPolicy)
         ? fetchWithTransientRetry
         : fetchWithResetRetry;
+      const initialReporter = transientSendReporter(compactPrepaid ?? options.comboDispatchPermit);
+      const deferredInitial = billingPoolRequest && !receiptMode ? deferPhysicalSendReporter(initialReporter) : undefined;
       try { upstreamResponse = await fetchWithRetryPolicy(
         recovery => {
           // Unconfigured generic sends may omit the counting reporter. Capture policy
@@ -442,10 +479,11 @@ export async function prepareAdapterExchange(
             poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
           });
           // Receipt mode books the physical send at executor admission instead of here.
-          if (!receiptMode && compactPrepaid && !compactPrepaidUsed) {
+          if (!deferredInitial && !receiptMode && compactPrepaid && !compactPrepaidUsed) {
             if (!compactPrepaid.use()) throw new SendBudgetExhaustedError(safeHostLabel(builtInitialRequest.url));
             compactPrepaidUsed = true;
           }
+          // Key transport keeps this metadata pending until it binds the actual selection.
           transportState.noteRoutedAttemptSend(inputTokenEstimate, recovery ?? initialRecovery);
           return fetchWithHeaderTimeout(builtInitialRequest.url, applyUpstreamRecoveryInit({
             method: builtInitialRequest.method,
@@ -457,6 +495,13 @@ export async function prepareAdapterExchange(
               providerName: route.providerName,
               modelId: route.modelId,
               onPhysicalDispatch: () => {
+                if (deferredInitial) {
+                  if (!deferredInitial.beforeDispatch()) throw new SendBudgetExhaustedError(safeHostLabel(builtInitialRequest.url));
+                  if (compactPrepaid && !compactPrepaidUsed) {
+                    if (!compactPrepaid.use()) throw new SendBudgetExhaustedError(safeHostLabel(builtInitialRequest.url));
+                    compactPrepaidUsed = true;
+                  }
+                }
                 // Preserve the unconfigured direct-adapter accounting contract; Combo admission
                 // and explicit retry/compaction budgets require a receipt for their booked send.
                 if (receiptMode) {
@@ -473,6 +518,7 @@ export async function prepareAdapterExchange(
           label: safeHostLabel(builtInitialRequest.url),
           claimAmbiguousResend: claimPreHeaderResend,
           ...(sendBudgetState.adapterSendBudget?.spendEnforced || options.comboDispatchPermit || transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
+            || billingPoolRequest
             ? {
               // A pending compaction permit already booked this leg's first physical send.
               ...(transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
@@ -485,7 +531,7 @@ export async function prepareAdapterExchange(
               // settled by `onPhysicalDispatch`, so a reporter here would count them twice.
               ...(receiptMode
                 ? {}
-                : { onSendsConsumed: transientSendReporter(compactPrepaid ?? options.comboDispatchPermit) }),
+                : { onSendsConsumed: deferredInitial?.report ?? initialReporter }),
             }
             : {}),
         },
@@ -501,6 +547,10 @@ export async function prepareAdapterExchange(
       return storageRefusal;
     }
     const refusal = err instanceof UpstreamRetryEvidenceError ? err.cause : err;
+    if (refusal instanceof AdmissionModelDeniedError) {
+      releaseCodexAuthContextProbeLease(admissionState.authCtx);
+      return admissionModelDeniedResponse(refusal);
+    }
     const codexRefusal = mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
       now: Date.now(), accountSelector: route.codexAccountNamespace,
     });
@@ -516,8 +566,7 @@ export async function prepareAdapterExchange(
       return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(refusal));
     }
     if (refusal instanceof AnthropicAccountCooldownError) {
-      return formatErrorResponse(429, "rate_limit_error", refusal.message,
-        refusal.retryAfterSeconds === null ? undefined : { retryAfter: String(refusal.retryAfterSeconds) });
+      return anthropicPoolCooldownResponse(refusal, { comboAttempt: options.comboAttempt, logCtx });
     }
     // A budget refusal is a decision this process made, not an upstream fault. Reporting it as
     // 502 does more than mislabel it: the Codex client retries 5xx and does not retry a 429, so
@@ -604,13 +653,26 @@ export async function prepareAdapterExchange(
           recordAdapterReasoning(logCtx, retryRequest);
           recordAdapterTier(logCtx, retryRequest);
         } catch (err) {
-          if (preserveFailureResponse && !options.abortSignal?.aborted) return { failed: preserveFailureResponse };
+          // A rotated credential that cannot be shaped keeps the refusal it was meant to
+          // replace. The image-tier rebuild is different: the request itself failed to shape,
+          // and its established 413/400 build-error contract stays authoritative.
+          if (preserveFailureResponse && recovery !== "image-413" && !options.abortSignal?.aborted) {
+            return { failed: preserveFailureResponse };
+          }
           // A rotated/rebuilt adapter build failure is a request-shaping error, not an
-          // upstream connect failure: tear the abort link down and map it as 400 (no 413
-          // translator-budget mapping here — that stays with parseRequest/buildToolBridgeMaps).
+          // upstream connect failure: tear the abort link down and map it as 400. A
+          // translator-budget refusal keeps its established 413 here as well — adapters
+          // can throw it while sizing generated content (e.g. Ollama late-tool
+          // attribution), not only parseRequest/buildToolBridgeMaps.
           cleanupUpstreamAbort();
           upstream.abort();
           if (options.abortSignal?.aborted) return { failed: clientCancelledResponse() };
+          if (err instanceof OllamaLateAttributionBudgetError) return { failed: lateAttributionLimitResponse() };
+          if (isTranslatorBudgetExceededError(err)) {
+            return { failed: formatErrorResponse(413, "request_too_large", "request translation buffer exceeded the safe limit", {
+              code: "translation_buffer_limit",
+            }) };
+          }
           const msg = err instanceof Error ? err.message : String(err);
           return { failed: formatErrorResponse(400, "invalid_request_error", redactSecretString(msg)) };
         }
@@ -673,7 +735,7 @@ export async function prepareAdapterExchange(
           const refetchWithPolicy = (route.provider.adapter === "google" || refetchTransientPolicy)
             ? fetchWithTransientRetry
             : fetchWithResetRetry;
-          const helperCountsSends = sendBudgetState.adapterSendBudget?.spendEnforced === true || refetchTransientPolicy !== null || resetReplayPolicyFor(route.provider) !== null;
+          const helperCountsSends = genericRefetchCountsSends();
           const prepaid = sendBudgetState.pendingHopPermit;
           const configuredTotal = refetchTransientPolicy?.attempts;
           const refetchCap = transientSendCapFor(configuredTotal, sendBudgetState.targetSendsUsed);
@@ -689,27 +751,41 @@ export async function prepareAdapterExchange(
               { allowFinalRecoveryReserve: configuredTotal === undefined },
             )
             : undefined;
+          let refetchPermitUsed = false;
+          const refetchReporter = refetchAllowance ? transientSendReporter(refetchAllowance.permit) : undefined;
+          const deferredRefetch = billingPoolRequest && refetchReporter ? deferPhysicalSendReporter(refetchReporter) : undefined;
           try {
             return await refetchWithPolicy(
               recoveryKind => {
                 sendBudgetState.adapterSendBudget?.startRequest?.({
                   poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
                 });
-                if (refetchAllowance?.permit && !refetchAllowance.permit.use()) {
-                  throw new SendBudgetExhaustedError(safeHostLabel(retryRequest.url));
-                }
-                transportState.noteRoutedAttemptSend(retryEstimate, recoveryKind ?? recovery);
-                // Same boundary on the helper path: the thunk is what reaches the wire, and it
-                // can be refused above before it does. use() past the first attempt is a no-op.
-                onDispatch?.();
-                if (preserveFailureResponse) replacementAdmitted = true;
-                if (!refetchAllowance) chargeFastDowngradeWorkflowSend();
+                // Prepare key metadata before the guarded transport commits its attempt;
+                // counters and permits still wait for the physical executor after pacing.
+                if (deferredRefetch) transportState.noteRoutedAttemptSend(retryEstimate, recoveryKind ?? recovery);
+                const confirmDispatch = () => {
+                  if (refetchAllowance?.permit && !refetchPermitUsed) {
+                    if (!refetchAllowance.permit.use()) throw new SendBudgetExhaustedError(safeHostLabel(retryRequest.url));
+                    refetchPermitUsed = true;
+                  }
+                  if (!deferredRefetch) transportState.noteRoutedAttemptSend(retryEstimate, recoveryKind ?? recovery);
+                  // Eligible pools confirm after pacing at the physical executor; legacy
+                  // helper paths retain their existing thunk admission boundary.
+                  onDispatch?.();
+                  if (preserveFailureResponse) replacementAdmitted = true;
+                  if (!refetchAllowance) chargeFastDowngradeWorkflowSend();
+                };
+                if (!deferredRefetch) confirmDispatch();
                 return fetchWithHeaderTimeout(retryRequest.url,
                   applyUpstreamRecoveryInit({
                     method: retryRequest.method, headers: retryRequest.headers, body: retryRequest.body,
                   }, recoveryKind), upstream.signal, connectMs, parsed.stream,
                   providerFetch(route.provider, options.codexWsRuntimeIdentity, {
                     dispatchOverride: oauthDispatch(retryRequest),
+                    onPhysicalDispatch: deferredRefetch ? () => {
+                      if (!deferredRefetch.beforeDispatch()) throw new SendBudgetExhaustedError(safeHostLabel(retryRequest.url));
+                      confirmDispatch();
+                    } : undefined,
                     providerName: route.providerName,
                     modelId: route.modelId,
                     beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
@@ -723,14 +799,14 @@ export async function prepareAdapterExchange(
                 ...(refetchAllowance
                   ? {
                     attempts: refetchAllowance.attempts,
-                    onSendsConsumed: transientSendReporter(refetchAllowance.permit),
+                    onSendsConsumed: deferredRefetch?.report ?? refetchReporter,
                   }
                   : {}),
               },
             );
           } finally {
-            // Refunds only a reservation whose send never happened -- an abort settled before
-            // the thunk ran. A used or externally settled permit ignores this.
+            // Refund only a reservation whose send never reached its admission boundary.
+            // A used or externally settled permit ignores this.
             refetchAllowance?.permit?.release();
           }
         } finally {
@@ -744,6 +820,13 @@ export async function prepareAdapterExchange(
           releaseCodexAuthContextProbeLease(admissionState.authCtx);
           return { failed: storageRefusal };
         }
+        const scopeRefusal = unwrapUpstreamRetryEvidenceError(err);
+        if (!options.abortSignal?.aborted && scopeRefusal instanceof AdmissionModelDeniedError) {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          releaseCodexAuthContextProbeLease(admissionState.authCtx);
+          return { failed: admissionModelDeniedResponse(scopeRefusal) };
+        }
         const codexRefusal = !options.abortSignal?.aborted && mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(err), {
           now: Date.now(), accountSelector: route.codexAccountNamespace,
         });
@@ -768,8 +851,7 @@ export async function prepareAdapterExchange(
           return { failed: formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(refusal)) };
         }
         if (refusal instanceof AnthropicAccountCooldownError) {
-          return { failed: formatErrorResponse(429, "rate_limit_error", refusal.message,
-            refusal.retryAfterSeconds === null ? undefined : { retryAfter: String(refusal.retryAfterSeconds) }) };
+          return { failed: anthropicPoolCooldownResponse(refusal, { comboAttempt: options.comboAttempt, logCtx }) };
         }
         // Same rule on the recovery leg: the ladder refused to send again, so the answer names
         // this proxy rather than the provider it never reached.
@@ -980,32 +1062,83 @@ export async function prepareAdapterExchange(
           promptCacheKey: parsed.options.promptCacheKey,
         });
         if (!rotated) break;
-        // Release the failed response's socket before retrying; unread bodies otherwise linger
-        // until runtime cleanup (one per rotated key).
-        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
-        route.provider = rotated;
-        const selectionFailure = await resolveRotatedCopilotSelection();
-        if (selectionFailure) return selectionFailure;
-        invalidateSameTargetRequest();
-        transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
-          config.cacheRetention,
-        );
-        bindRouteReasoningReplayScope({
-          parsed,
-          providerName: route.providerName,
-          provider: route.provider,
-          adapterName: transportState.activeAdapter.name,
-        });
-       const result = await rebuildAndRefetch("key-401");
-       if ("failed" in result) return result.failed;
-       upstreamResponse = result;
-        // A recovery refetch can itself die on an ambiguous pre-header reset, and the refusal
-        // that answers it is a 429. Every arm below keys on 429, so letting it fall through
-        // hands the marked refusal to the next waiting arm and replays the send it exists to
-        // stop. Re-enter the loop guard instead, which returns it unchanged.
-        if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-     }
+        if (billingRecoveryActive && (options.abortSignal?.aborted || upstream.signal.aborted)) {
+          cleanupUpstreamAbort(); upstream.abort(); return clientCancelledResponse();
+        }
+        const billingHop = (billingPoolRequest || billingRecoveryActive)
+          ? reserveCredentialHop("auth-recovery", `${route.providerName}|${route.modelId}|key-401`,
+            transportState.activeAdapter.fetchResponse === undefined)
+          : undefined;
+        if (billingHop && !billingHop.allowed) break;
+        const failedResponse = billingPoolRequest || billingRecoveryActive ? await retainFailureResponse() : undefined;
+        try {
+          // Release the failed response's socket before retrying; unread bodies otherwise linger
+          // until runtime cleanup (one per rotated key).
+          if (!failedResponse) try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+          route.provider = rotated;
+          const selectionFailure = await resolveRotatedCopilotSelection();
+          if (selectionFailure) return selectionFailure;
+          invalidateSameTargetRequest();
+          transportState.activeAdapter = resolveSelectionAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+            config.cacheRetention,
+          );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: transportState.activeAdapter.name,
+          });
+          if (billingHop) sendBudgetState.pendingHopPermit = billingHop.permit;
+          const result = await rebuildAndRefetch("key-401",
+            billingHop ? () => { billingHop.permit?.use(); } : undefined, failedResponse);
+          if ("failed" in result) {
+            if (result.failed !== failedResponse) return result.failed;
+            break;
+          }
+          if (failedResponse) {
+            try { void failedResponse.body?.cancel().catch(() => {}); } catch { /* closed */ }
+          }
+          upstreamResponse = result;
+          // A recovery refetch can itself die on an ambiguous pre-header reset, and the refusal
+          // that answers it is a 429. Every arm below keys on 429, so letting it fall through
+          // hands the marked refusal to the next waiting arm and replays the send it exists to
+          // stop. Re-enter the loop guard instead, which returns it unchanged.
+          if (isNonReplayableResponse(upstreamResponse)) continue recovery;
+        } finally {
+          if (billingHop) { sendBudgetState.pendingHopPermit = undefined; billingHop.permit?.release(); }
+        }
+      }
+
+      while ((upstreamResponse.status === 400 || upstreamResponse.status === 402) && hasKeyPoolFailover(route.provider)) {
+        const rotated = await rotateAnthropicBillingKeyOnResponse(upstreamResponse, config, route.providerName, route.provider,
+          { signal: upstream.signal, promptCacheKey: parsed.options.promptCacheKey });
+        if (upstream.signal.aborted || options.abortSignal?.aborted) {
+          cleanupUpstreamAbort(); upstream.abort(); return clientCancelledResponse();
+        }
+        if (!rotated) break;
+        billingRecoveryActive = true;
+        const hop = reserveCredentialHop("auth-recovery", `${route.providerName}|${route.modelId}|key-401`,
+          transportState.activeAdapter.fetchResponse === undefined);
+        if (!hop.allowed) break;
+        const failedResponse = await retainFailureResponse();
+        try {
+          route.provider = rotated;
+          invalidateSameTargetRequest();
+          transportState.activeAdapter = resolveSelectionAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy), config.cacheRetention);
+          bindRouteReasoningReplayScope({ parsed, providerName: route.providerName, provider: route.provider, adapterName: transportState.activeAdapter.name });
+          sendBudgetState.pendingHopPermit = hop.permit;
+          const result = await rebuildAndRefetch("key-401", () => { hop.permit?.use(); }, failedResponse);
+          if ("failed" in result) {
+            if (result.failed !== failedResponse) return result.failed;
+            break;
+          }
+          try { void failedResponse.body?.cancel().catch(() => {}); } catch { /* closed */ }
+          upstreamResponse = result;
+          continue recovery;
+        } finally { sendBudgetState.pendingHopPermit = undefined; hop.permit?.release(); }
+      }
 
       // Anthropic fast mode refused (no usage credits, organization not enabled, model outside
       // the lane, fast pool empty): resend once at standard speed, as Claude Code does. This
@@ -1024,7 +1157,7 @@ export async function prepareAdapterExchange(
         const hop = reserveCredentialHop(
           "repair",
           `${route.providerName}|${route.modelId}|anthropic-fast-downgrade`,
-          !adapterOwnsDispatch && (transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null),
+          !adapterOwnsDispatch && genericRefetchCountsSends(),
         );
         if (hop.allowed) {
           anthropicFastDowngradeGuard.attempted = true;
@@ -1093,7 +1226,9 @@ export async function prepareAdapterExchange(
        upstreamResponse = result;
         // The refusal is a 429 too: without this the while condition is still true and the
         // next configured attempt replays it on the same target.
-        if (isNonReplayableResponse(upstreamResponse)) continue recovery;
+        if (isNonReplayableResponse(upstreamResponse)
+          || (isAnthropicBillingKeyPool(route.provider)
+            && [400, 402].includes(upstreamResponse.status))) continue recovery;
      }
 
       // Multi-key 429 failover: rotate to the next pool key (cooldown-aware) and retry the
@@ -1128,30 +1263,53 @@ export async function prepareAdapterExchange(
           quotaResetAt,
         });
         if (!rotated) break;
-        // Release the failed response's socket before retrying; unread bodies otherwise linger
-        // until runtime cleanup (one per rotated key under a rate-limit storm).
-        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
-        route.provider = rotated;
-        const selectionFailure = await resolveRotatedCopilotSelection();
-        if (selectionFailure) return selectionFailure;
-        invalidateSameTargetRequest();
-        transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
-          config.cacheRetention,
-        );
-        bindRouteReasoningReplayScope({
-          parsed,
-          providerName: route.providerName,
-          provider: route.provider,
-          adapterName: transportState.activeAdapter.name,
-        });
-       const result = await rebuildAndRefetch("key-429");
-       if ("failed" in result) return result.failed;
-       upstreamResponse = result;
-        // Rotating on the refusal would also write a cooldown against a key that rate-limited
-        // nothing, which outlives the request.
-        if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-     }
+        if (billingRecoveryActive && (options.abortSignal?.aborted || upstream.signal.aborted)) {
+          cleanupUpstreamAbort(); upstream.abort(); return clientCancelledResponse();
+        }
+        const billingHop = (billingPoolRequest || billingRecoveryActive)
+          ? reserveCredentialHop("auth-recovery", `${route.providerName}|${route.modelId}|key-429`,
+            transportState.activeAdapter.fetchResponse === undefined)
+          : undefined;
+        if (billingHop && !billingHop.allowed) break;
+        const failedResponse = billingPoolRequest || billingRecoveryActive ? await retainFailureResponse() : undefined;
+        try {
+          // Release the failed response's socket before retrying; unread bodies otherwise linger
+          // until runtime cleanup (one per rotated key under a rate-limit storm).
+          if (!failedResponse) try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+          route.provider = rotated;
+          const selectionFailure = await resolveRotatedCopilotSelection();
+          if (selectionFailure) return selectionFailure;
+          invalidateSameTargetRequest();
+          transportState.activeAdapter = resolveSelectionAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+            config.cacheRetention,
+          );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: transportState.activeAdapter.name,
+          });
+          if (billingHop) sendBudgetState.pendingHopPermit = billingHop.permit;
+          const result = await rebuildAndRefetch("key-429",
+            billingHop ? () => { billingHop.permit?.use(); } : undefined, failedResponse);
+          if ("failed" in result) {
+            if (result.failed !== failedResponse) return result.failed;
+            break;
+          }
+          if (failedResponse) {
+            try { void failedResponse.body?.cancel().catch(() => {}); } catch { /* closed */ }
+          }
+          upstreamResponse = result;
+          // Rotating on the refusal would also write a cooldown against a key that rate-limited
+          // nothing, which outlives the request.
+          if (isNonReplayableResponse(upstreamResponse)
+            || (billingRecoveryActive && upstreamResponse.status === 401)
+            || (route.provider.adapter === "anthropic" && [400, 402].includes(upstreamResponse.status))) continue recovery;
+        } finally {
+          if (billingHop) { sendBudgetState.pendingHopPermit = undefined; billingHop.permit?.release(); }
+        }
+      }
 
       // Anthropic OAuth: recover a rate limit or proven account entitlement refusal
       // before output, within the shared request and account rotation limits.
@@ -1398,7 +1556,17 @@ export async function prepareAdapterExchange(
           // The hop's permit is already settled by the dispatch boundary above; continuing
           // only skips the remaining arms, it does not abandon a reservation.
           if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-       } catch {
+       } catch (err) {
+          // A local admission denial is terminal for the whole request: rotating to another
+          // account cannot re-scope the key, so the refusal answers in place of the 429.
+          const scopeRefusal = unwrapUpstreamRetryEvidenceError(err);
+          if (!options.abortSignal?.aborted && scopeRefusal instanceof AdmissionModelDeniedError) {
+            hop.permit?.release();
+            cleanupUpstreamAbort();
+            upstream.abort();
+            releaseCodexAuthContextProbeLease(admissionState.authCtx);
+            return admissionModelDeniedResponse(scopeRefusal);
+          }
          // A throw before the send — snapshot fetch, credential application, adapter
           // resolution — must hand the reservation back. Without this the ladder charges the
           // request for a send it never made, and a later recovery in the same request is
@@ -1539,9 +1707,13 @@ export async function prepareAdapterExchange(
         imageRetryAttempted = true;
         transportState.imageTierBias = 1;
         invalidateSameTargetRequest();
-        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
-        const result = await rebuildAndRefetch("image-413");
-        if ("failed" in result) return result.failed;
+        const failedResponse = await retainFailureResponse();
+        const result = await rebuildAndRefetch("image-413", undefined, failedResponse);
+        if ("failed" in result) {
+          if (result.failed !== failedResponse) return result.failed;
+          break recovery;
+        }
+        try { void failedResponse.body?.cancel().catch(() => {}); } catch { /* closed */ }
         upstreamResponse = result;
         continue recovery;
       }
@@ -1658,6 +1830,14 @@ export async function prepareAdapterExchange(
           requestState.subagentFallbackAccountId,
         );
       }
+      // The last pool account just refused on spent quota and recovery found no replacement:
+      // answer the usage limit now (#6991), so Codex stops instead of retrying into the local
+      // refusal that every later attempt meets until the first window reopens.
+      const poolUsageLimit = upstreamResponse.status === 429 && anthropicInstance && route.provider.authMode === "oauth"
+        ? anthropicRoutingFor(anthropicInstance).anthropicPoolUsageLimitAfterRefusal(Date.now(), transportState.anthropicRouteDecision, route.modelId)
+        : null;
+      // Combo children returned above; the flag is passed anyway so this site states the same rule.
+      if (poolUsageLimit) return anthropicPoolCooldownResponse(poolUsageLimit, { comboAttempt: options.comboAttempt, logCtx });
       // Upstreams occasionally echo request details in error bodies — scrub token-shaped
       // material before it reaches the client-facing error surface.
       const upstreamRetryAfter = upstreamResponse.headers.get("retry-after");

package/src/server/responses/advisor-plan-slot.ts

@@ -0,0 +1,27 @@
+/** Core-owned, config-scoped registration. An inactive install has no Advisor factory. */
+import type { OcxConfig, OcxParsedRequest, OcxTool } from "../../types";
+
+export interface AdvisorPlanInput {
+  config: OcxConfig;
+  workerIdentity: string;
+  workerModelId: string;
+  abortSignal?: AbortSignal;
+}
+
+export interface RegisteredAdvisorPlan {
+  tool: OcxTool;
+  preflightInject(parsed: OcxParsedRequest): Promise<boolean>;
+  attachGuard(parsed: OcxParsedRequest): void;
+}
+
+type AdvisorPlanFactory = (input: AdvisorPlanInput) => Promise<RegisteredAdvisorPlan | null>;
+const factories = new WeakMap<OcxConfig, AdvisorPlanFactory>();
+
+export function setAdvisorPlanFactory(config: OcxConfig, factory: AdvisorPlanFactory | null): void {
+  if (factory) factories.set(config, factory);
+  else factories.delete(config);
+}
+
+export function createRegisteredAdvisorPlan(input: AdvisorPlanInput): Promise<RegisteredAdvisorPlan | null> | null {
+  return factories.get(input.config)?.(input) ?? null;
+}