@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/server/responses/advisor-slot.ts

@@ -0,0 +1,336 @@
+/**
+ * Core-owned registration slot for the optional advisor subsystem (src/advisor).
+ *
+ * This file is the ONLY thing the core Responses path knows about the advisor. It holds the
+ * structural plan interface and the event-stream guard — pure protocol machinery over
+ * src/types — and imports nothing from src/advisor at runtime. The optional subsystem registers
+ * a factory through advisor-plan-slot at host activation; an advisor-disabled install therefore executes no advisor
+ * code and imports no advisor module (same seam discipline as src/lab).
+ *
+ * Guard semantics (mirrors guardTerminalEventStream):
+ * - synthetic `advisor` tool-call events are HELD — the Codex client never sees the tool, the
+ *   call, or its arguments;
+ * - on a clean `done`, each held call is consulted through the plan, the advice is appended as a
+ *   paired assistant-toolCall + toolResult message pair, and the worker is re-dispatched via the
+ *   SAME continuation machinery the terminal guard uses;
+ * - real (non-advisor) tool calls end interception for the leg: the turn belongs to the client;
+ * - usage from intercepted legs is merged into the final terminal event so worker accounting
+ *   stays complete; the advisor's own usage is a separate loopback request and never merges here;
+ * - consultations and worker continuations have separate hard per-request bounds. Exhaustion
+ *   removes the tool; one final limit-result continuation is allowed, then a typed error ends it.
+ */
+import type {
+  AdapterEvent,
+  OcxAssistantContentPart,
+  OcxAssistantMessage,
+  OcxMessage,
+  OcxParsedRequest,
+  OcxToolResultMessage,
+  OcxUsage,
+} from "../../types";
+import { mergeUsage } from "./terminal-guard";
+
+export const ADVISOR_TOOL_NAME = "advisor";
+
+/** Hard bound on advisor consultations per worker request (recursion guard). */
+export const MAX_ADVISOR_CONSULTATIONS_PER_REQUEST = 3;
+/** At most one final worker continuation after consultation exhaustion. */
+export const MAX_ADVISOR_CONTINUATIONS_PER_REQUEST = MAX_ADVISOR_CONSULTATIONS_PER_REQUEST + 1;
+
+/** Per-leg retention caps for rebuilding the assistant message (see terminal-guard's bounded retention). */
+const MAX_LEG_TEXT_CHARS = 16 * 1_024;
+const MAX_LEG_THINKING_CHARS = 16 * 1_024;
+
+/** Outcome of one consultation, as the plan reports it to the guard. */
+export interface AdvisorConsultOutcome {
+  ok: boolean;
+  /** Formatted, wrapper-marked advice text ready to hand to the worker. */
+  content: string;
+  isError: boolean;
+  /** The consultation was cancelled by the caller (client abort) — not a provider failure. */
+  cancelled?: boolean;
+  /**
+   * Operator config blocked the consultation before any outbound call. Not a provider
+   * failure: preflight must release a claim instead of recording a cooldown.
+   */
+  blocked?: "consent" | "settings";
+}
+
+/** The structural plan the optional advisor subsystem registers per request. */
+export interface AdvisorPlan {
+  /**
+   * Run one consultation for the current conversation state. Implementations own dedup,
+   * logging, and usage accounting; the guard only consumes the outcome.
+   */
+  consult(
+    parsed: OcxParsedRequest,
+    reason: "manual",
+    question: string | undefined,
+  ): Promise<AdvisorConsultOutcome>;
+  /**
+   * Runtime-owned text for a failed or limited consultation. The guard never composes failure
+   * prose itself: the implementation neutralizes untrusted text so no guard path can emit
+   * something the provenance detector would read as genuine advice.
+   */
+  formatUnavailable(kind: "manual" | "limit", error: string): string;
+}
+
+interface HeldAdvisorCall {
+  id: string;
+  name: string;
+  argsBuf: string;
+  closed: boolean;
+  providerMetadata?: import("../../types").OcxProviderOpaqueToolCallMetadata;
+}
+
+function parseAdvisorArgs(argsBuf: string): { question?: string } {
+  if (argsBuf.trim() === "") return {};
+  try {
+    const parsed: unknown = JSON.parse(argsBuf);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const question = (parsed as { question?: unknown }).question;
+      if (typeof question === "string" && question.trim() !== "") return { question: question.slice(0, 2_000) };
+    }
+  } catch { /* malformed args → no focus question */ }
+  return {};
+}
+
+function assistantMessageFromLeg(
+  events: readonly AdapterEvent[],
+  held: readonly HeldAdvisorCall[],
+  timestamp: number,
+): OcxAssistantMessage | undefined {
+  let text = "";
+  let thinking = "";
+  let signature: string | undefined;
+  const redacted: string[] = [];
+  for (const event of events) {
+    if (event.type === "text_delta") text += event.text;
+    else if (event.type === "thinking_delta") thinking += event.thinking;
+    else if (event.type === "thinking_signature") signature = event.signature;
+    else if (event.type === "redacted_thinking") redacted.push(event.data);
+  }
+  if (text.length > MAX_LEG_TEXT_CHARS) text = text.slice(0, MAX_LEG_TEXT_CHARS);
+  if (thinking.length > MAX_LEG_THINKING_CHARS) thinking = thinking.slice(0, MAX_LEG_THINKING_CHARS);
+  const content: OcxAssistantContentPart[] = [];
+  if (thinking || signature || redacted.length > 0) {
+    content.push({ type: "thinking", thinking, ...(signature ? { signature } : {}), ...(redacted.length > 0 ? { redacted } : {}) });
+  }
+  if (text) content.push({ type: "text", text });
+  for (const call of held) {
+    if (!call.closed) continue;
+    content.push({
+      type: "toolCall",
+      id: call.id,
+      name: call.name,
+      arguments: parseAdvisorArgs(call.argsBuf),
+      ...(call.providerMetadata ? { providerMetadata: call.providerMetadata } : {}),
+    });
+  }
+  if (content.length === 0) return undefined;
+  return { role: "assistant", content, timestamp };
+}
+
+function advisorToolResult(
+  call: HeldAdvisorCall,
+  outcome: AdvisorConsultOutcome,
+  timestamp: number,
+): OcxToolResultMessage {
+  return {
+    role: "toolResult",
+    toolCallId: call.id,
+    toolName: ADVISOR_TOOL_NAME,
+    content: outcome.content,
+    isError: outcome.isError,
+    timestamp,
+  };
+}
+
+export interface AdvisorGuardOptions {
+  parsed: OcxParsedRequest;
+  plan: AdvisorPlan;
+  firstEvents: AsyncIterable<AdapterEvent>;
+  /** One bounded worker continuation re-dispatch (same machinery as the terminal guard). */
+  continuation: (parsed: OcxParsedRequest) => AsyncIterable<AdapterEvent> | Promise<AsyncIterable<AdapterEvent>>;
+}
+
+/**
+ * Wrap a worker event stream with advisor interception. Registered on the parsed request as
+ * `_advisorGuard` by the sidecar planner; adapter delivery applies it when present.
+ */
+export function createAdvisorStreamGuard(options: AdvisorGuardOptions): AsyncGenerator<AdapterEvent> {
+  const guard = createAdvisorGuard(options.plan);
+  return guard(options);
+}
+export function createAdvisorGuard(plan: AdvisorPlan): NonNullable<OcxParsedRequest["_advisorGuard"]> {
+  // Shared across invocations of this request's guard, including an empty-completion retry.
+  let consultations = 0;
+  let continuations = 0;
+  let finalContinuationUsed = false;
+  return async function* guardAdvisorStream(options: Omit<AdvisorGuardOptions, "plan">): AsyncGenerator<AdapterEvent> {
+    const maxConsultations = MAX_ADVISOR_CONSULTATIONS_PER_REQUEST;
+    let parsed = options.parsed;
+    let accumulatedUsage: OcxUsage | undefined;
+    let source: AsyncIterable<AdapterEvent> = options.firstEvents;
+
+    while (true) {
+      const held: HeldAdvisorCall[] = [];
+      const legEvents: AdapterEvent[] = [];
+      let legTextChars = 0;
+      let legThinkingChars = 0;
+      let pending: HeldAdvisorCall | null = null;
+      // While a tool call is open, its delta/end events belong to that call. Advisor calls are
+      // held from the output; real calls pass through untouched.
+      let holdingCurrent = false;
+      let hasRealToolCall = false;
+      let terminalConsumed = false;
+      let terminalEvent: Extract<AdapterEvent, { type: "done" }> | undefined;
+
+      for await (const event of source) {
+        if (event.type === "tool_call_start") {
+          if (pending) { held.push(pending); pending = null; }
+          pending = { id: event.id, name: event.name, argsBuf: "", closed: false, ...(event.providerMetadata ? { providerMetadata: event.providerMetadata } : {}) };
+          holdingCurrent = event.name === ADVISOR_TOOL_NAME;
+          if (!holdingCurrent) hasRealToolCall = true;
+          else continue;
+        } else if (event.type === "tool_call_delta") {
+          if (pending) pending.argsBuf += event.arguments;
+          if (holdingCurrent) continue;
+        } else if (event.type === "tool_call_end") {
+          if (pending) {
+            pending.closed = true;
+            if (pending.name === ADVISOR_TOOL_NAME) held.push(pending);
+            pending = null;
+          }
+          if (holdingCurrent) {
+            holdingCurrent = false;
+            continue;
+          }
+        } else if (event.type === "done") {
+          if (pending) { held.push(pending); pending = null; }
+          terminalEvent = event;
+          terminalConsumed = true;
+          break;
+        } else if (event.type === "incomplete" || event.type === "error") {
+          // A broken leg cannot safely anchor a continuation: surface the terminal as-is.
+          if (pending) { pending = null; }
+          const usage = mergeUsage(accumulatedUsage, event.usage);
+          yield usage ? { ...event, usage } : event;
+          return;
+        } else {
+          // Retain (bounded) the leg's visible content so the rebuilt assistant message is complete.
+          if (event.type === "text_delta") {
+            legTextChars += event.text.length;
+            if (legTextChars <= MAX_LEG_TEXT_CHARS) legEvents.push(event);
+          } else if (event.type === "thinking_delta") {
+            legThinkingChars += event.thinking.length;
+            if (legThinkingChars <= MAX_LEG_THINKING_CHARS) legEvents.push(event);
+          } else if (
+            event.type === "thinking_signature"
+            || event.type === "redacted_thinking"
+          ) {
+            legEvents.push(event);
+          }
+        }
+        yield event;
+      }
+
+      const advisorCalls = held.filter(call => call.name === ADVISOR_TOOL_NAME && call.closed);
+      const shouldIntercept = terminalConsumed
+        && terminalEvent?.stopReason !== "max_tokens"
+        && terminalEvent?.stopReason !== "content_filter"
+        && advisorCalls.length > 0
+        && !hasRealToolCall;
+
+      if (!shouldIntercept) {
+        // Plain leg: surface the terminal with merged usage from any earlier intercepted legs.
+        if (terminalEvent) {
+          const usage = mergeUsage(accumulatedUsage, terminalEvent.usage);
+          yield usage ? { ...terminalEvent, usage } : terminalEvent;
+        }
+        return;
+      }
+
+      // Consume this leg's done — the continuation replaces it.
+      accumulatedUsage = mergeUsage(accumulatedUsage, terminalEvent?.usage);
+      if (continuations >= MAX_ADVISOR_CONTINUATIONS_PER_REQUEST || finalContinuationUsed) {
+        yield {
+          type: "error",
+          status: 502,
+          errorType: "advisor_continuation_limit",
+          message: "Advisor worker continuation limit reached; no further worker calls were sent.",
+          ...(accumulatedUsage ? { usage: accumulatedUsage } : {}),
+        };
+        return;
+      }
+      // A repeated call after tool removal gets one last paired limit result, never a loop.
+      const isFinalContinuation = consultations >= maxConsultations;
+      // Reserve before any consultation await, so simultaneous guard entries share the bound.
+      continuations += 1;
+      finalContinuationUsed ||= isFinalContinuation;
+      const timestamp = Date.now();
+      const assistant = assistantMessageFromLeg(legEvents, advisorCalls, timestamp);
+      const messages: OcxMessage[] = [...parsed.context.messages];
+      if (assistant) messages.push(assistant);
+
+      for (const call of advisorCalls) {
+        if (consultations >= maxConsultations) {
+          // Runtime-owned limit text: not advice, and never a genuine advice wrapper.
+          messages.push(advisorToolResult(call, {
+            ok: false,
+            isError: true,
+            content: plan.formatUnavailable("limit", "consultation limit reached for this request"),
+          }, timestamp));
+          continue;
+        }
+        consultations += 1;
+        const args = parseAdvisorArgs(call.argsBuf);
+        // Later calls in the same leg must see what came before them: the rebuilt worker turn
+        // and every earlier advisor result in this leg's accumulated messages.
+        const consultParsed: OcxParsedRequest = {
+          ...parsed,
+          context: { ...parsed.context, messages },
+        };
+        let outcome: AdvisorConsultOutcome;
+        try {
+          outcome = await plan.consult(consultParsed, "manual", args.question);
+        } catch (error) {
+          // Runtime-owned failure text only: the implementation neutralizes untrusted exception
+          // text so it can never forge a genuine advice wrapper.
+          outcome = {
+            ok: false,
+            isError: true,
+            content: plan.formatUnavailable("manual", error instanceof Error ? error.message : String(error)),
+          };
+        }
+        messages.push(advisorToolResult(call, outcome, timestamp));
+      }
+
+      const exhausted = consultations >= maxConsultations;
+      const tools = exhausted
+        ? parsed.context.tools?.filter(tool => !tool.advisor && tool.name !== ADVISOR_TOOL_NAME)
+        : parsed.context.tools;
+      const choice = parsed.options.toolChoice;
+      const nextParsed: OcxParsedRequest = {
+        ...parsed,
+        context: { ...parsed.context, messages, tools },
+        options: exhausted && ((typeof choice === "object" && choice !== null && "name" in choice && choice.name === ADVISOR_TOOL_NAME)
+          || (choice === "required" && !tools?.length))
+          ? { ...parsed.options, toolChoice: "auto" }
+          : parsed.options,
+      };
+      parsed = nextParsed;
+      yield { type: "assistant_boundary" };
+      try {
+        source = await options.continuation(parsed);
+      } catch (error) {
+        yield {
+          type: "error",
+          message: error instanceof Error ? error.message : String(error),
+          ...(accumulatedUsage ? { usage: accumulatedUsage } : {}),
+        };
+        return;
+      }
+    }
+  };
+}

package/src/server/responses/code-mode-collab-surface.ts

@@ -77,13 +77,104 @@ interface RenderedTool { name: string; raw: string }
 /** The declaration fence codex-rs opens: three backticks and "ts". */
 const DECLARATION_FENCE_SHAPE: Fence = { char: "`", length: 3 };
 
-/** A complete declaration as render_code_mode_sample emits it, single- or multi-line. */
-function isCompleteDeclaration(body: readonly string[], name: string): boolean {
+const DECLARATION_PREFIX = "declare const tools: { ";
+const PROMISE_SEPARATOR = "): Promise<";
+const DECLARATION_SUFFIX = ">; };";
+// Bounds keep a caller-controlled description linear work: a rendered listing is a heading, a
+// description, and a small declaration per tool, so anything this large cannot be the codex-rs
+// shape this parser exists to recognize.
+const MAX_DESCRIPTION_LENGTH = 1 << 20;
+const MAX_DECLARATION_LENGTH = 64 * 1024;
+
+const isSpace = (ch: string | undefined): boolean => ch === undefined || /\s/.test(ch);
+
+/**
+ * The declared tool name when body is a complete declaration as render_code_mode_sample emits it,
+ * single- or multi-line, else undefined. Fixed boundaries plus one forward scan that balances the
+ * parameter list's brackets and the return type's generics: no backtracking, so a fence body full
+ * of candidate separators stays linear work.
+ */
+function completeDeclarationName(body: readonly string[]): string | undefined {
   const text = body.join("\n");
-  const prefix = "declare const tools: { " + name + "(";
-  if (!text.startsWith(prefix)) return false;
+  if (text.length > MAX_DECLARATION_LENGTH) return undefined;
+  if (!text.startsWith(DECLARATION_PREFIX) || !text.endsWith(DECLARATION_SUFFIX)) return undefined;
+  const signature = text.slice(DECLARATION_PREFIX.length, -DECLARATION_SUFFIX.length);
+  const openParen = signature.indexOf("(");
+  const name = openParen > 0 ? signature.slice(0, openParen) : "";
+  if (!/^[A-Za-z_$][\w$]*$/.test(name)) return undefined;
   // A named, typed parameter (`args` for functions, `input` for freeform) and a non-empty return type.
-  return /^(?:args|input): \S[\s\S]*\): Promise<[^>\s][\s\S]*>; \};$/.test(text.slice(prefix.length));
+  const rest = signature.slice(openParen + 1);
+  const typed = rest.startsWith("args: ") ? 6 : rest.startsWith("input: ") ? 7 : -1;
+  if (typed < 0 || isSpace(rest[typed])) return undefined;
+  // Quoted text and comments are opaque to delimiter matching. Each skip advances
+  // past its text once; an unterminated region cannot contain a closing declaration.
+  const isOpaqueTypeText = (at: number): boolean => {
+    const ch = rest[at];
+    return ch === '"' || ch === "'" || ch === "`"
+      || ch === "/" && (rest[at + 1] === "/" || rest[at + 1] === "*");
+  };
+  const skipTypeText = (at: number): number | undefined => {
+    const quote = rest[at]!;
+    if (quote === "/" && rest[at + 1] === "/") {
+      let i = at + 2;
+      while (i < rest.length && rest[i] !== "\n" && rest[i] !== "\r"
+        && rest[i] !== "\u2028" && rest[i] !== "\u2029") i += 1;
+      return i < rest.length ? i : undefined;
+    }
+    if (quote === "/" && rest[at + 1] === "*") {
+      const end = rest.indexOf("*/", at + 2);
+      return end < 0 ? undefined : end + 1;
+    }
+    let i = at + 1;
+    while (i < rest.length) {
+      const ch = rest[i]!;
+      if (ch === "\\") i += 2;
+      else if (ch === quote) return i;
+      else i += 1;
+    }
+    return undefined;
+  };
+  // The parameter list ends at the ')' that balances the opening '(': a ')' nested inside the
+  // parameter's own type (e.g. `args: (a: string) => Promise<void>`) cannot pose as the separator.
+  // The type must also say something before that ')': `args: )` or `args: /* note */)` names no type.
+  let depth = 1;
+  let close = -1;
+  let typeContent = false;
+  for (let at = typed; at < rest.length; at += 1) {
+    const ch = rest[at]!;
+    if (isOpaqueTypeText(at)) {
+      if (ch !== "/") typeContent = true; // a quoted literal is a type, a comment is not
+      const end = skipTypeText(at);
+      if (end === undefined) return undefined;
+      at = end;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth += 1;
+    else if (ch === ")" || ch === "]" || ch === "}") depth -= 1;
+    if (depth === 0) { close = at; break; }
+    if (!isSpace(ch)) typeContent = true;
+  }
+  if (close < 0 || !typeContent || !rest.startsWith(PROMISE_SEPARATOR, close)) return undefined;
+  const head = rest[close + PROMISE_SEPARATOR.length];
+  if (head === ">" || isSpace(head)) return undefined;
+  // The return type runs to the stripped suffix, which already supplied exactly one '>' for the
+  // Promise's '<': generic depth must stay positive to the end and land at exactly 1 — a '>' that
+  // reaches zero ('Promise<unknown>; garbage') is surplus text, a depth left above 1
+  // ('Promise<Map<string, unknown') never closed its own generic, and a '=>' arrow never counts.
+  let generic = 1;
+  for (let at = close + PROMISE_SEPARATOR.length; at < rest.length; at += 1) {
+    const ch = rest[at]!;
+    if (isOpaqueTypeText(at)) {
+      const end = skipTypeText(at);
+      if (end === undefined) return undefined;
+      at = end;
+      continue;
+    }
+    if (ch === "<") generic += 1;
+    else if (ch === ">" && rest[at - 1] !== "=") generic -= 1;
+    if (generic === 0) return undefined;
+  }
+  return generic === 1 ? name : undefined;
 }
 
 /** codex-rs normalize_code_mode_identifier: invalid identifier characters become `_`. */
@@ -114,9 +205,21 @@ function renderedHeading(match: RegExpExecArray): RenderedTool | undefined {
  * alone. Lines inside a quoted fence can neither open a section nor declare a tool.
  */
 function renderedNestedTools(description: string): RenderedTool[] {
+  if (description.length > MAX_DESCRIPTION_LENGTH) return [];
   const lines = description.split("\n");
   const rendered: RenderedTool[] = [];
   const pending: RenderedTool[] = [];
+  // Ascending indexes into `pending` per name, so a declaration finds its owner in one lookup
+  // instead of rescanning every pending heading.
+  const pendingByName = new Map<string, number[]>();
+  const dropPendingTo = (length: number): void => {
+    while (pending.length > length) {
+      const removed = pending.pop()!;
+      const indexes = pendingByName.get(removed.name)!;
+      indexes.pop();
+      if (indexes.length === 0) pendingByName.delete(removed.name);
+    }
+  };
   let fence: Fence | undefined;
   for (let i = 0; i < lines.length; i += 1) {
     const line = lines[i]!;
@@ -127,7 +230,11 @@ function renderedNestedTools(description: string): RenderedTool[] {
     const match = TOOL_HEADING.exec(line);
     if (match) {
       const heading = renderedHeading(match);
-      if (heading) pending.push(heading);
+      if (heading) {
+        const indexes = pendingByName.get(heading.name);
+        if (indexes) indexes.push(pending.length); else pendingByName.set(heading.name, [pending.length]);
+        pending.push(heading);
+      }
       continue;
     }
     if (line === DECLARATION_LEAD && lines[i + 1] === DECLARATION_FENCE) {
@@ -137,10 +244,11 @@ function renderedNestedTools(description: string): RenderedTool[] {
       const body = lines.slice(i + 2, close);
       // The outermost pending heading with the declared name owns it, so a same-name heading quoted
       // inside the tool's own description cannot take over the genuine section.
-      const owner = pending.findIndex(tool => isCompleteDeclaration(body, tool.name));
+      const declared = completeDeclarationName(body);
+      const owner = declared === undefined ? -1 : pendingByName.get(declared)?.[0] ?? -1;
       if (owner >= 0) {
         rendered.push(pending[owner]!);
-        pending.length = owner;
+        dropPendingTo(owner);
       }
       i = close;
       continue;

package/src/server/responses/core-combo-failure.ts

@@ -16,6 +16,7 @@ import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { formatErrorResponse } from "../../bridge";
 import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
 import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
+import { MODEL_NOT_ALLOWED_FOR_KEY } from "../admission-model-scope";
 import { usageFromResponsesPayload } from "../request-log";
 import type { ResponsesTerminalStatus } from "../../bridge";
 
@@ -49,6 +50,9 @@ export async function consumeComboFailure(
   // display-safe body carries a recognized quota message.
   let quotaConfirmedByBody = false;
   const serverError = response.status >= 500 && response.status < 600;
+  // A local key-scope refusal is already the client's answer: rebuilding it as an upstream_error
+  // would hide the stable model_not_allowed_for_key type clients branch on.
+  let scopeRefusalBody: string | undefined;
   try {
     const body = await readBoundedResponseBody(response, { signal, reportUtf8Validity: serverError });
     // A 5xx body counts as quota or classification evidence only when it decoded as valid
@@ -71,6 +75,9 @@ export async function consumeComboFailure(
         upstreamMessage = normalized.message;
         upstreamType = normalized.type;
       }
+      if (nonReplayable && response.status === 403 && upstreamType === MODEL_NOT_ALLOWED_FOR_KEY) {
+        scopeRefusalBody = body.text;
+      }
     }
   } catch (error) {
     if (signal?.aborted) throw error;
@@ -106,7 +113,9 @@ export async function consumeComboFailure(
     now,
     includeDefault: false,
   });
-  const failureResponse = formatErrorResponse(
+  const failureResponse = scopeRefusalBody !== undefined
+    ? new Response(scopeRefusalBody, { status: 403, headers: { "Content-Type": "application/json" } })
+    : formatErrorResponse(
     response.status,
     cyberFailure ? (upstreamType ?? CYBER_POLICY_ERROR_CODE) : "upstream_error",
     message,

package/src/server/responses/core-combo.ts

@@ -1,3 +1,5 @@
+import { effectiveAzureOutputBudget } from "../../adapters/azure";
+import { resolveWireProtocolOverride } from "../adapter-resolve";
 import type { CodexAccountModelRefusal } from "../../combos/failover";
 import {
   isCodexReasoningEffort,
@@ -712,12 +714,31 @@ export async function executeComboResponses(
         retryAfter: String(Math.max(1, Math.ceil(remainingQuotaCooldownMs / 1000))),
       }) : lastFailure;
   };
+  // The caller's output ceiling, captured once so a floor applied to one target never
+  // leaks into the next. An established parent estimate wins; otherwise (combo dispatch
+  // precedes request preparation) the caller's own positive cap is reserved.
+  const callerBudget = isPlainObject(body) ? body.max_output_tokens : undefined;
+  const callerOutputCeilingTokens = logCtx.spendOutputCeilingTokens
+    ?? (typeof callerBudget === "number" && Number.isFinite(callerBudget) && callerBudget > 0
+      ? Math.trunc(callerBudget) : undefined);
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
     // The inherited spend tracker observes this parent log, before the child has its own label.
     logCtx.spendPoolId = targetRoute.providerName;
+    // Combo prepays before its child normalizes the route; the parent tracker must
+    // already see this target's effective cap rather than a previous target's cap.
+    const spendProvider = resolveWireProtocolOverride(targetRoute.providerName, targetRoute.modelId,
+      targetRoute.provider, options.inboundWire ?? "responses", targetRoute.staticPolicy);
+    const outputBudget = effectiveAzureOutputBudget(spendProvider, callerBudget);
+    if (outputBudget !== callerBudget && typeof outputBudget === "number" && outputBudget > 0) {
+      logCtx.spendOutputCeilingTokens = Math.trunc(outputBudget);
+    } else if (callerOutputCeilingTokens === undefined) {
+      delete logCtx.spendOutputCeilingTokens;
+    } else {
+      logCtx.spendOutputCeilingTokens = callerOutputCeilingTokens;
+    }
     // Derive the target's allowance before booking its initial send; the booking occupies it.
     const targetSendBudget = comboSendScope
       ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)

package/src/server/responses/core-lifetime.ts

@@ -1,5 +1,6 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
+import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
   isNativePassthroughSseResponse,
   markNativePassthroughSseResponse,
@@ -67,6 +68,7 @@ export function finalizeAccountLease(response: Response, release: () => void): R
     async cancel(reason) { try { await reader.cancel(reason); } finally { finish(); } },
   });
   const wrapped = new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  if (isNonReplayableResponse(response)) markResponseNonReplayable(wrapped);
   if (isNativePassthroughSseResponse(response)) markNativePassthroughSseResponse(wrapped);
   if (isEagerRelaySseResponse(response)) markEagerRelaySseResponse(wrapped);
   if (isPreinspectedJsonResponse(response)) markPreinspectedJsonResponse(wrapped);

package/src/server/responses/core-normalize.ts

@@ -1,3 +1,4 @@
+import { effectiveAzureOutputBudget } from "../../adapters/azure";
 import { sanitizeLogMetadataString } from "../../lib/redact";
 import type { RouteResult } from "../../router";
 import type { InboundWire } from "../../providers/registry";
@@ -211,6 +212,16 @@ export async function applyFinalRouteRequestNormalization(args: {
   logCtx.model = virtualModel?.selectedModelId ?? route.modelId;
   logCtx.provider = route.providerName;
   logCtx.spendPoolId = route.providerName;
+  // Admission precedes adapter serialization. Reserve the same explicit output cap
+  // the final destination will send, and recompute from the caller on every fallback.
+  const rawBudget = parsed._rawBody && typeof parsed._rawBody === "object"
+    ? (parsed._rawBody as { max_output_tokens?: unknown }).max_output_tokens : undefined;
+  const outputBudget = effectiveAzureOutputBudget(route.provider,
+    route.provider.adapter === "azure" || route.provider.adapter === "azure-openai"
+      ? rawBudget : parsed.options.maxOutputTokens);
+  if (typeof outputBudget === "number" && outputBudget > 0) {
+    logCtx.spendOutputCeilingTokens = Math.trunc(outputBudget);
+  }
   logCtx.providerAdapter = route.provider.adapter;
   logCtx.routeDecision = route.routeDecision;
   logCtx.policyEligibility = route.policyEligibility;