@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/server/responses/core-options.ts

@@ -22,6 +22,8 @@ import type { RequestLogContext } from "../request-log";
 import type { UpstreamHostAdmissionLease } from "../../codex/upstream-host-health";
 import type { AccountLease } from "../../oauth/kiro-account-load";
 import type { PolicyRequestScope } from "./policy-request-scope";
+import type { OcxParsedRequest } from "../../types";
+import type { PolicyRequestEvidence } from "../../routing/evaluator";
 
 export interface ConsumedComboFailure {
   response: Response;
@@ -30,6 +32,8 @@ export interface ConsumedComboFailure {
   codexModelRefusal?: CodexAccountModelRefusal;
   /** Structured upstream `error.code` when present in the failure body. */
   upstreamCode?: string;
+  /** Sanitized structured `error.message`; compared only against proxy-owned constants, never emitted. */
+  upstreamMessage?: string;
   /** Complete structured provider type, retained for conservative recovery classification. */
   upstreamType?: string;
   /** Valid numeric/date value used only for cooldown calculation. */
@@ -59,6 +63,32 @@ export interface ClientEncoderOption {
   stream: boolean;
   model: string;
   inputTokenFloor?: number;
+  /**
+   * `direct` when the request side also skipped the internal Responses body (the Antigravity
+   * direct lane), so the attempt's request path is traced as `[inbound, ir, upstream]`.
+   */
+  requestLane?: "bridge" | "direct";
+}
+
+/**
+ * The Antigravity direct lane (`protocols.rollout.antigravityDirect`). The ingress sends the core
+ * a Responses body that carries only the request settings; the conversation is decoded straight
+ * from the client body. Request preparation applies `decode` at the parse seam, reads routing
+ * evidence from `evidence`, and calls `restoreBridgeConversation` if the final route is not the
+ * one the lane was decided for, so every `_rawBody` reader of another adapter sees the full
+ * bridge body.
+ */
+export interface DirectRequestOption {
+  protocol: "chat" | "messages";
+  /** The concrete route the ingress decided the lane for. */
+  providerName: string;
+  modelId: string;
+  /** Policy-routing evidence from the client body; the settings-only body has no `input`. */
+  evidence: PolicyRequestEvidence;
+  /** The settings-only parse with the directly decoded conversation in place of its empty one. */
+  decode(base: OcxParsedRequest): OcxParsedRequest;
+  /** The bridge projection's conversation fields (`input`, `instructions`, `tools`). */
+  bridgeConversation(): Record<string, unknown>;
 }
 
 export interface HandleResponsesOptions {
@@ -135,6 +165,13 @@ export interface HandleResponsesOptions {
    * it. Omitted means a genuine Responses inbound.
    */
   inboundWire?: InboundWire;
+  /**
+   * Set by a translating ingress (Chat / Anthropic) when the client sent an explicit empty
+   * tool catalog. Those wires may defer tool delivery, so their translated body carries no
+   * readable catalog boundary; an explicit `[]` is still a deny-all declaration and the
+   * undeclared-tool guard enforces it. Absent catalogs and partial catalogs stay deferred.
+   */
+  clientDeclaredEmptyToolCatalog?: boolean;
   nativeReasoningReplay?: ReadonlyMap<string, string>;
   nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
@@ -200,6 +237,15 @@ export interface HandleResponsesOptions {
    * rebuilds headers and carries the fact through this flag.
    */
   visionDescribeTerminal?: boolean;
+  /**
+   * Terminal advisor marker: true when the inbound request IS the advisor sidecar's own loopback
+   * consultation. The advisor planner then never plans a consultation — a depth cap of 1 that
+   * keeps Worker → Advisor → Advisor recursion impossible (same structure as
+   * {@linkcode visionDescribeTerminal}). The Chat surface detects the raw
+   * `x-opencodex-advisor-internal` header before its bridge rebuilds headers and carries the
+   * fact through this flag.
+   */
+  advisorInternal?: boolean;
   /**
    * Set only by the Chat and Messages ingresses when `protocols.rollout.directEncoders` is on and
    * the settled route is one non-Responses target. Adapter delivery then encodes the adapter
@@ -208,6 +254,8 @@ export interface HandleResponsesOptions {
    * returning a Responses body, which the ingress converts as before.
    */
   clientEncoder?: ClientEncoderOption;
+  /** Set only by the Chat or Messages ingress on an eligible Antigravity route; see {@link DirectRequestOption}. */
+  directRequest?: DirectRequestOption;
 }
 
 /** Values shared by the call, not a bag of mutable pipeline state. */

package/src/server/responses/core-replay.ts

@@ -125,11 +125,13 @@ export function bindRouteReasoningReplayScope(args: {
   if (owner) parsed._nativeReasoningBoundOwner = owner;
   else delete parsed._nativeReasoningBoundOwner;
   if (parsed._nativeReasoningReplay?.size) {
+    const rejected = new Set<string>();
     for (const [blob, tag] of parsed._nativeReasoningReplay) {
       if (!nativeReasoningTagMatches(nativeReasoningTag(owner, blob), tag)) {
-        stripNativeReasoningBlob(parsed, blob);
+        rejected.add(blob);
       }
     }
+    if (rejected.size) stripNativeReasoningBlobs(parsed, rejected);
   }
   const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
   const continuationOwner = providerContinuationOwnerFromReplayIdentity(
@@ -169,11 +171,11 @@ export function bindRouteReasoningReplayScope(args: {
   bindProviderContinuationForRoute(parsed, continuationOwner);
 }
 
-function stripNativeReasoningBlob(parsed: OcxParsedRequest, blob: string): void {
+function stripNativeReasoningBlobs(parsed: OcxParsedRequest, rejected: ReadonlySet<string>): void {
   const input = (parsed._rawBody as { input?: unknown } | undefined)?.input;
   if (Array.isArray(input)) {
     for (const item of input) {
-      if (item && typeof item === "object" && item.type === "reasoning" && item.encrypted_content === blob) {
+      if (item && typeof item === "object" && item.type === "reasoning" && rejected.has(item.encrypted_content)) {
         delete item.encrypted_content;
         delete item.id;
       }
@@ -187,7 +189,8 @@ function stripNativeReasoningBlob(parsed: OcxParsedRequest, blob: string): void
         const item: unknown = JSON.parse(part.signature);
         if (!item || typeof item !== "object" || Array.isArray(item)) continue;
         const reasoning = item as Record<string, unknown>;
-        if (reasoning.type !== "reasoning" || reasoning.encrypted_content !== blob) continue;
+        if (reasoning.type !== "reasoning" || typeof reasoning.encrypted_content !== "string"
+          || !rejected.has(reasoning.encrypted_content)) continue;
         delete reasoning.encrypted_content;
         delete reasoning.id;
         part.signature = JSON.stringify(reasoning);

package/src/server/responses/core.ts

@@ -48,7 +48,7 @@ export async function handleResponses(
   abortSignal.addEventListener("abort", cancel, { once: true });
   try {
     const response = await runWithCompactionRecovery(req, config, logCtx, {
-      ...options,
+      ...options, abortSignal,
       openAiSidecarAuth: options.openAiSidecarAuth === undefined
         ? captureExplicitOpenAiCallerAuth(req.headers, config) : options.openAiSidecarAuth,
       nativeCallerAuth: options.nativeCallerAuth === undefined

package/src/server/responses/deferred-collab-surface.ts

@@ -0,0 +1,158 @@
+/**
+ * Deferred V1 collaboration evidence from Codex's `<tools>` world-state fragment (#6844).
+ *
+ * When the model supports tool search (every OpenCodex catalog row), codex-rs registers the V1
+ * collaboration tools as DEFERRED (core/src/tools/spec_plan.rs, add_collaboration_tools) under the
+ * fixed namespace `multi_agent_v1` (core/src/tools/handlers/multi_agents_spec.rs). Neither the wire
+ * tools nor the code-mode exec description then mention them. With the deferred_tool_world_state
+ * feature on (default off upstream; Codex Desktop sessions were observed receiving it), codex-rs
+ * instead tells the model which namespaces it can load, in a developer fragment
+ * (core/src/context/world_state/tools.rs):
+ *
+ *   <tools>
+ *   Deferred tool namespaces:
+ *   - multi_agent_v1: Tools for spawning and managing sub-agents.
+ *   </tools>
+ *
+ * Later turns carry only diffs ("Added deferred tool namespaces:", "Removed deferred tool
+ * namespaces:", "No deferred tool namespaces remain."), so membership is replayed in input order.
+ * The fragment is capped at 4 KiB: rows may be name-only, and whole rows may be replaced by
+ * "... <n> additional namespaces omitted." (tools_budget.rs).
+ *
+ * The evidence is positive-only and conservative:
+ * - only developer messages are read, each text part on its own, and only a part that is exactly
+ *   one fragment after trimming; text that merely mentions the tag is ignored;
+ * - a fragment that starts like one but breaks the line grammar clears what was carried, because a
+ *   lost removal could have been multi_agent_v1; omitted removals clear for the same reason, and
+ *   omitted rows never establish a namespace;
+ * - it counts only beside a host that can load deferred tools: a genuine code-mode exec or a
+ *   structured tool_search tool. A caller's own exec or a function merely named tool_search is not
+ *   one.
+ *
+ * Capability boundary: the row proves that some deferred multi_agent_v1 tool is registered, not
+ * that spawn_agent is. Upstream can split them only through an embedder-supplied ToolPolicy
+ * allowlist; its one production allowlist (the guardian reviewer) admits no V1 tool at all, and
+ * the V1 depth limit disables the surface as a unit, so Codex CLI and Desktop never send a
+ * management-only V1 namespace. A developer item can also be impersonated by whoever writes the
+ * conversation. Both cases receive advisory guidance they cannot act on; nothing is enforced here.
+ */
+import type { OcxMessage, OcxParsedRequest, OcxTool } from "../../types";
+import type { CodeModeExecAnalysis } from "./code-mode-collab-surface";
+
+const MULTI_AGENT_V1_NAMESPACE = "multi_agent_v1";
+const OPEN_TAG = "<tools>";
+const CLOSE_TAG = "</tools>";
+const SNAPSHOT_HEADER = "Deferred tool namespaces:";
+const ADDED_HEADER = "Added deferred tool namespaces:";
+const REMOVED_HEADER = "Removed deferred tool namespaces:";
+const EMPTY_STATE = "No deferred tool namespaces remain.";
+// A description is opaque: upstream copies its first line verbatim, which may hold any character
+// except \n, including U+2028/U+2029 that `.` would refuse.
+const ROW = /^- ([^:\s]+)(?:: [\s\S]*)?$/;
+const OMISSION = /^\.\.\. \d+ additional namespaces omitted\.$/;
+
+type Fragment =
+  | { kind: "malformed" }
+  | { kind: "snapshot"; rows: Set<string>; empty: boolean }
+  | { kind: "diff"; added: Set<string>; removed: Set<string>; removedOmitted: boolean; empty: boolean };
+
+/** One standalone fragment, a malformed one, or nothing (text that is not a fragment). */
+function parseFragment(text: string): Fragment | null {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith(OPEN_TAG)) return null;
+  if (!trimmed.endsWith(CLOSE_TAG) || trimmed.length < OPEN_TAG.length + CLOSE_TAG.length) return { kind: "malformed" };
+  const body = trimmed.slice(OPEN_TAG.length, trimmed.length - CLOSE_TAG.length);
+  let group: "snapshot" | "added" | "removed" | undefined;
+  // Upstream renders each group at most once, Added before Removed, and skips empty groups.
+  const seen = new Set<"snapshot" | "added" | "removed">();
+  let groupHasEntries = true;
+  let empty = false;
+  const rows = { snapshot: new Set<string>(), added: new Set<string>(), removed: new Set<string>() };
+  let removedOmitted = false;
+  const open = (next: "snapshot" | "added" | "removed"): boolean => {
+    if (seen.has(next) || !groupHasEntries) return false;
+    if (next === "added" && seen.has("removed")) return false;
+    seen.add(next);
+    group = next;
+    groupHasEntries = false;
+    return true;
+  };
+  for (const raw of body.split("\n")) {
+    const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+    if (line === "") continue;
+    // The empty-state notice closes the fragment; nothing may follow it.
+    if (empty) return { kind: "malformed" };
+    if (line === SNAPSHOT_HEADER) { if (!open("snapshot")) return { kind: "malformed" }; continue; }
+    if (line === ADDED_HEADER) { if (!open("added")) return { kind: "malformed" }; continue; }
+    if (line === REMOVED_HEADER) { if (!open("removed")) return { kind: "malformed" }; continue; }
+    if (line === EMPTY_STATE) {
+      if (!groupHasEntries) return { kind: "malformed" };
+      empty = true;
+      continue;
+    }
+    if (group === undefined) return { kind: "malformed" };
+    groupHasEntries = true;
+    if (OMISSION.test(line)) {
+      if (group === "removed") removedOmitted = true;
+      continue;
+    }
+    const row = ROW.exec(line);
+    if (!row) return { kind: "malformed" };
+    rows[group].add(row[1]!);
+  }
+  if (!groupHasEntries) return { kind: "malformed" };
+  const sawSnapshot = seen.has("snapshot");
+  const sawDiff = seen.has("added") || seen.has("removed");
+  if (sawSnapshot && sawDiff) return { kind: "malformed" };
+  if (sawSnapshot) return { kind: "snapshot", rows: rows.snapshot, empty };
+  if (!sawDiff && !empty) return { kind: "malformed" };
+  for (const name of rows.added) if (rows.removed.has(name)) return { kind: "malformed" };
+  return { kind: "diff", added: rows.added, removed: rows.removed, removedOmitted, empty };
+}
+
+function developerTexts(message: OcxMessage): string[] {
+  if (message.role !== "developer") return [];
+  if (typeof message.content === "string") return [message.content];
+  return message.content.flatMap(part => (part.type === "text" ? [part.text] : []));
+}
+
+/** Replays every fragment in input order; true when multi_agent_v1 is currently known deferred. */
+function deferredNamespacesIncludeV1(messages: readonly OcxMessage[]): boolean {
+  const current = new Set<string>();
+  for (const message of messages) {
+    for (const text of developerTexts(message)) {
+      const fragment = parseFragment(text);
+      if (fragment === null) continue;
+      switch (fragment.kind) {
+        case "malformed":
+          current.clear();
+          break;
+        case "snapshot":
+          current.clear();
+          for (const name of fragment.rows) current.add(name);
+          break;
+        case "diff":
+          if (fragment.removedOmitted) current.clear();
+          for (const name of fragment.added) current.add(name);
+          for (const name of fragment.removed) current.delete(name);
+          break;
+      }
+      if (fragment.kind !== "malformed" && fragment.empty) current.clear();
+    }
+  }
+  return current.has(MULTI_AGENT_V1_NAMESPACE);
+}
+
+function declaresStructuredToolSearch(tools: readonly OcxTool[] | undefined): boolean {
+  return (tools ?? []).some(tool => !tool.namespace && tool.toolSearch === true);
+}
+
+/**
+ * True when the request's own developer history says V1 collaboration tools are deferred and the
+ * request comes from a host that can load deferred tools.
+ */
+export function deferredV1Evidence(parsed: OcxParsedRequest, codeMode: CodeModeExecAnalysis): boolean {
+  if (!codeMode.genuineExec && !declaresStructuredToolSearch(parsed.context.tools)) return false;
+  return deferredNamespacesIncludeV1(parsed.context.messages);
+}
+

package/src/server/responses/deferred-send-reporter.ts

@@ -0,0 +1,25 @@
+import type { PhysicalSendReporter } from "../../lib/request-execution-budget";
+
+/** Retry thunks can fail in pacing; settle only starts admitted at the physical executor. */
+export function deferPhysicalSendReporter(physical: PhysicalSendReporter) {
+  let dispatched = 0;
+  let reported = 0;
+  const report: PhysicalSendReporter = () => {
+    const count = dispatched - reported;
+    if (count <= 0) return;
+    physical(count);
+    reported += count;
+  };
+  // The retry helper owns attempts, while the physical callback owns spend admission.
+  report.beforeSend = () => true;
+  report.execute = physical.execute;
+  report.close = () => { report(0); physical.close?.(); };
+  return {
+    report,
+    beforeDispatch(): boolean {
+      if (physical.beforeSend && !physical.beforeSend()) return false;
+      dispatched++;
+      return true;
+    },
+  };
+}

package/src/server/responses/fetch-helpers.ts

@@ -1,4 +1,5 @@
 import type { NativeResponseControl } from "./native-response-control";
+import type { CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import type { Server } from "bun";
 import {
   codexWsUpstreamFetch,
@@ -28,6 +29,7 @@ import {
   type ProviderEgressBinding,
 } from "../../lib/provider-egress";
 import { redactSecretString } from "../../lib/redact";
+import { outboundCredentials } from "../../lib/outbound-credential-registry";
 
 export { withUpstreamHttpVersion };
 
@@ -205,6 +207,9 @@ export function sendWithConnectionPolicy(
     && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
+  // Final headers, after plugin rewrites: an upstream can only echo what it received here, so the
+  // request log refuses any diagnostic that repeats one of these values (see request-log-terminal-status).
+  outboundCredentials().remember(headers);
   return physicalFetch(input, {
     ...init,
     ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
@@ -240,6 +245,12 @@ export interface ProviderFetchOptions {
   beforeDispatch?: (headers: Headers) => void;
   /** One-shot receipt after final local HTTP admission, immediately before executor entry. */
   onPhysicalDispatch?: () => void;
+  /**
+   * Opt-in (#6969): let a Codex WebSocket send hold empty lifecycle frames so an authoritative
+   * upstream refusal before any output settles as a replayable gateway status. Only a caller that
+   * restores the projection afterwards (restoreCodexWsPreOutputRefusal) may set it.
+   */
+  preOutputRefusalHold?: CodexWsPreOutputRefusalHold;
   /** Revalidate/rebuild a queued request at its physical send boundary, after pacing. */
   dispatchOverride?: (input: Parameters<typeof globalThis.fetch>[0], init: RequestInit, execute: typeof globalThis.fetch) => Promise<Response>;
 }
@@ -356,7 +367,7 @@ export function providerFetch(
       const fallback = ((url: Parameters<typeof globalThis.fetch>[0], fallbackInit?: RequestInit) =>
         httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit)) as typeof globalThis.fetch;
       return codexWsUpstreamFetch(input, init, fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
-        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce);
+        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold);
     }
     return httpFetch(input, init);
   };

package/src/server/responses/passthrough-delivery.ts

@@ -108,6 +108,7 @@ import { createResponsesFunctionToolRepairBlockRewrite } from "../responses-func
 import {
   createUndeclaredToolCallGuardBlockRewrite,
   currentTurnWireToolCatalogBody,
+  UNDECLARED_TOOL_CALL_ERROR_CODE,
   undeclaredToolCallNameInResponse,
   undeclaredToolCallMessage,
   normalizeDefaultNamespaceInJson,
@@ -408,6 +409,7 @@ export async function deliverPassthroughResponse(
     | "noteInspectedPayload"
     | "normalizeFunctionCompletionJson"
     | "localUpstream"
+    | "terminalOutcomeRecorded"
   >,
 ): Promise<Response> {
   const { route } = requestState;
@@ -436,8 +438,7 @@ export async function deliverPassthroughResponse(
     normalizeFunctionCompletionJson,
   } = nativeExchange;
   const { commitReasoningReplayServingRoute, recordTerminalOutcomes } = responseEffects;
-  const { parsed, subagentQuotaFailureModel, clientRequestedStream, translatorBudget, inboundWire } = requestState;
-  const enforceDeclaredToolNames = inboundWire !== "chat" && inboundWire !== "anthropic";
+  const { parsed, subagentQuotaFailureModel, clientRequestedStream, translatorBudget } = requestState;
   const { openAiSidecar } = sidecarState;
   const { requestBindings } = transportState;
 
@@ -486,7 +487,9 @@ export async function deliverPassthroughResponse(
       ? (status: ResponsesTerminalStatus, httpStatusOverride?: number): void => {
         if (terminalOutcomeRecorded) return;
         terminalOutcomeRecorded = true;
-        recordTerminalOutcome(status, httpStatusOverride);
+        // A restored pre-output refusal whose account outcome dispatch already wrote (#6969) keeps
+        // every other terminal callback but must not write the same refusal a second time.
+        if (!nativeExchange.terminalOutcomeRecorded) recordTerminalOutcome(status, httpStatusOverride);
       }
       : undefined;
     const terminalBodyWillRecord = !!terminalRecorder && upstreamResponse.ok && isEventStream;
@@ -854,14 +857,17 @@ export async function deliverPassthroughResponse(
           : undefined,
         // Last: every rewrite above can still rename or reshape a call item, so the guard must
         // compare the names the client will actually receive against the declared catalog.
-        nativeExchange.undeclaredToolGuardActive
+        // Deferred-catalog wires keep the rewrite for its normalization half only: a provider's
+        // `default.X` call still collapses to the declared `X`, but an undeclared name is the
+        // client's own deferred registry's business, not this proxy's verdict.
+        nativeExchange.undeclaredToolGuardActive || declaredWireToolNames.size > 0
           ? createUndeclaredToolCallGuardBlockRewrite(
             declaredWireToolNames,
             declaredNamelessClientCallTypes,
             providerExecutedCallTypes,
             declaredBareWireToolNames,
             recoverableBareCustomWireToolNames,
-            enforceDeclaredToolNames,
+            { refuseUndeclared: nativeExchange.undeclaredToolGuardActive },
           )
           : undefined,
         grokUpstreamEchoEnabled
@@ -1319,10 +1325,7 @@ export async function deliverPassthroughResponse(
       if (grokUpstreamEchoEnabled) {
         clientJson = stripGrokUpstreamEnvelopeEchoFromResponsesJson(clientJson);
       }
-      // #1700: same inbound-wire refusal policy as the SSE relay above. Both the plain JSON answer and
-      // the reframed-SSE branch below are built from this body, so one check covers them. This
-      // runs BEFORE the continuation cache write below: a refused turn must not become state a
-      // later `previous_response_id` replay can expand from.
+      // Both response formats use this body, before a refused turn can enter continuation state.
       if (nativeExchange.undeclaredToolGuardActive) {
         const undeclared = (() => {
           try {
@@ -1338,9 +1341,15 @@ export async function deliverPassthroughResponse(
             return undefined;
           }
         })();
-        if (enforceDeclaredToolNames && undeclared !== undefined) {
-          return formatErrorResponse(502, "upstream_error", undeclaredToolCallMessage(undeclared));
+        if (undeclared !== undefined) {
+          return formatErrorResponse(502, "upstream_error", undeclaredToolCallMessage(undeclared), {
+            code: UNDECLARED_TOOL_CALL_ERROR_CODE,
+          });
         }
+      }
+      // Same split as the SSE rewrite: normalization applies whenever a declared name exists,
+      // even on wires whose deferred catalog stands the refusal down.
+      if (declaredWireToolNames.size > 0) {
         clientJson = normalizeDefaultNamespaceInJson(
           clientJson,
           declaredWireToolNames,

package/src/server/responses/passthrough-dispatch.ts

@@ -21,6 +21,7 @@ import { imageGenToolCallAliases } from "../responses-image-gen-repair";
 import { rememberResponseState, isBodyNonPersistable } from "../../responses/state";
 import {
   currentTurnWireToolCatalogBody,
+  hasExplicitEmptyToolCatalog,
   hasExplicitWireToolCatalog,
   collectDeclaredWireToolNames,
   collectDeclaredBareWireToolNames,
@@ -91,7 +92,7 @@ import {
   safeHostLabel,
 } from "./fetch-helpers";
 import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
-import { clientCancelledResponse } from "./core-errors";
+import { anthropicPoolCooldownResponse, clientCancelledResponse } from "./core-errors";
 import {
   upstreamHostCircuitOpenResponse,
   usesCodexForwardPoolAuth,
@@ -101,6 +102,8 @@ import {
   shouldRetryCodexPoolAccountQuota,
   shouldRetryCodexPoolAccountTransient,
   retryCodexPoolOnAlternateAccount,
+  PoolPreOutputRefusals,
+  poolPreOutputRefusalHold,
 } from "./core-codex-account";
 import {
   clearCodexModelDenialEvidence,
@@ -185,6 +188,7 @@ export async function preparePassthroughExchange(
     | "selectedForwardHeaders"
     | "clientRequestedStream"
     | "inboundWire"
+    | "clientDeclaredEmptyToolCatalog"
     | "substituteMainCredential"
     | "callerAuthHeaders"
     | "subagentFallbackAccountId"
@@ -251,6 +255,7 @@ export async function preparePassthroughExchange(
     responseStateOptions,
     clientRequestedStream,
     inboundWire,
+    clientDeclaredEmptyToolCatalog,
     substituteMainCredential,
     callerAuthHeaders,
   } = requestState;
@@ -529,10 +534,18 @@ export async function preparePassthroughExchange(
           declaredWireToolNames.add(name);
         }
       }
+      // Chat and Anthropic inbounds may deliver tools deferred/partially: their client registry
+      // owns the full catalog, so this guard cannot read the translated body as the authorization
+      // boundary. An explicit empty catalog — flagged by the translating ingress or present
+      // verbatim in a replayed body — is still a deny-all the caller declared; everything else
+      // stays deferred to the caller's own tool handling.
       undeclaredToolGuardActive = (
-        declaredWireToolNames.size > 0
-        || clientDeclaredNamelessCallTypes.size > 0
-        || clientExplicitWireToolCatalog
+        inboundWire === "responses"
+          ? declaredWireToolNames.size > 0
+            || clientDeclaredNamelessCallTypes.size > 0
+            || clientExplicitWireToolCatalog
+          : clientDeclaredEmptyToolCatalog
+            || hasExplicitEmptyToolCatalog(clientToolAuthorizationBody)
       ) && route.provider.authMode !== "forward";
       options.nativeControl?.configureToolAuthorization?.(
         undeclaredToolGuardActive,
@@ -949,8 +962,7 @@ export async function preparePassthroughExchange(
           return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(refusal));
         }
         if (refusal instanceof AnthropicAccountCooldownError) {
-          return formatErrorResponse(429, "rate_limit_error", refusal.message,
-            refusal.retryAfterSeconds === null ? undefined : { retryAfter: String(refusal.retryAfterSeconds) });
+          return anthropicPoolCooldownResponse(refusal, { comboAttempt: options.comboAttempt, logCtx });
         }
         return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(refusal));
       }
@@ -1005,6 +1017,9 @@ export async function preparePassthroughExchange(
     // Stable per request: the Combo booking (`reserveDispatch`) already started and froze the spend
     // policy, so `spendEnforced` cannot change before dispatch even though no reporter starts it here.
     const receiptMode = !sendBudgetState.adapterSendBudget?.spendEnforced && Boolean(options.comboInitialSend);
+    // #6969: Pool sends hold empty lifecycle frames so a pre-output refusal reaches the ladder below.
+    const preOutputRefusals = new PoolPreOutputRefusals();
+    const preOutputRefusalHold = () => poolPreOutputRefusalHold(admissionState.authCtx, route.provider, connectMs, options.comboAttempt);
     try {
       // Transient-5xx pre-stream retry (devlog/_plan/260716_claudecode_hardening/010):
       // the ChatGPT backend emits transient 502/520s that an immediate retry absorbs.
@@ -1035,11 +1050,12 @@ export async function preparePassthroughExchange(
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                 ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
+              preOutputRefusalHold: preOutputRefusalHold(),
             }),
             route.provider.authMode === "forward")
             // Every real attempt response — including an intermediate 5xx the
             // retry wrapper replaces — proves the host was reached (#914 review).
-            .then(adoptObservedResponse);
+            .then(adoptObservedResponse).then(preOutputRefusals.observe);
         },
         { abortSignal: upstream.signal, label: safeHostLabel(request.url),
           attempts: sendBudgetState.initialSendAllowance(transientSendAttempts()),
@@ -1050,6 +1066,8 @@ export async function preparePassthroughExchange(
         },
       );
     } catch (err) {
+      preOutputRefusals.recordOnLocalExit(err, options.abortSignal?.aborted === true || req.signal.aborted,
+        config, admissionState.authCtx, route.provider, route.modelId);
       return transportFailureResponse(err);
     } finally {
       request.releaseBodyObservation?.();
@@ -1676,6 +1694,7 @@ export async function preparePassthroughExchange(
           passthroughEstimate,
           stream: upstreamRequestsStream,
           httpOnly: canonicalBufferedJson,
+          preOutputRefusalHold: preOutputRefusalHold(),
           onResponse: (response, retryAuthCtx, retryRequest) => {
             adoptCodexWsStage(response);
             captureAffinityResponse(
@@ -1702,6 +1721,8 @@ export async function preparePassthroughExchange(
         }
       }
     }
+    // #6969: a projection nothing above recovered goes on as the original stream, before any reader.
+    upstreamResponse = preOutputRefusals.restore(upstreamResponse);
     // The deterministic route record cannot classify history it never observed (restart, expiry,
     // eviction, or an older transcript). Inspect only a bounded clone of a 4xx whose exact outbound
     // Responses body still carries opaque state, then rebuild once through the ordinary adapter
@@ -1969,6 +1990,7 @@ export async function preparePassthroughExchange(
     connectMs,
     localUpstream,
     upstreamResponse,
+    terminalOutcomeRecorded: preOutputRefusals.outcomeRecorded,
   };
 }