@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/server/responses/compaction-recovery.ts

@@ -7,9 +7,11 @@ import { readBoundedResponseBytes } from "../../lib/bounded-body";
 import { isRequestExecutionBudget, type RequestExecutionBudget, type SingleUseDispatchPermit } from "../../lib/request-execution-budget";
 import { isNonReplayableResponse, isNonReplayableUpstreamCode, markResponseNonReplayable, TRANSIENT_RETRY_MAX_ATTEMPTS } from "../../lib/upstream-retry";
 import { isCyberPolicyCode, isTerminalRefusalCode } from "../../lib/errors";
-import { isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint, supportsNativeResponsesCompactionTrigger } from "../../providers/openai-tiers";
 import { bridgeToResponsesSSE, formatErrorResponse } from "../../bridge";
 import { buildCompactV1Output, decodeCompactionSummary, encodeCompactionSummary, extractCompactUserMessages } from "../../responses/compaction";
+import { decodeRetainedCompaction, encodeRetainedCompaction } from "../../responses/retained-compaction";
+import { collectReasoningTexts } from "../../responses/reasoning-retention";
 import { finishRequestAttempt, usageFromResponsesPayload, type RequestLogContext } from "../request-log";
 import { linkRequestSessionLane } from "../request-log-conversation";
 import { isNativePassthroughSseResponse, markNativePassthroughSseResponse, isEagerRelaySseResponse, markEagerRelaySseResponse } from "../relay";
@@ -55,15 +57,17 @@ function portableBody(body: Record<string, unknown>): boolean {
   if (!Array.isArray(body.input) || body.store === true || conversationCarriesUploadedFiles(body)) return false;
   // Native ciphertext cannot be summarized by another provider. Never silently replace it with a note.
   if (body.input.some(item => record(item) && ["compaction", "compaction_summary", "context_compaction"].includes(String(item.type))
-    && typeof item.encrypted_content === "string" && !item.encrypted_content.startsWith("ocx1:"))) return false;
+    && typeof item.encrypted_content === "string" && !item.encrypted_content.startsWith("ocx1:") && !decodeRetainedCompaction(item.encrypted_content))) return false;
   const input = body.input.filter(item => !record(item) || item.type !== "compaction_trigger");
   return selfContainedResponsesBody({ ...body, store: false, input });
 }
 
-function routed(route: RouteResult): boolean {
+function routed(route: RouteResult, kind: "compaction-v1" | "compaction-v2"): boolean {
   return !route.combo && route.routeKind !== "policy" && route.routeReason !== "default-provider"
     && !isCanonicalOpenAiForwardProvider(route.provider)
-    && !supportsNativeResponsesCompactEndpoint(route.providerName, route.provider);
+    && !(kind === "compaction-v1"
+      ? supportsNativeResponsesCompactEndpoint(route.providerName, route.provider)
+      : supportsNativeResponsesCompactionTrigger(route.provider));
 }
 
 /** One reader, bounded bytes, and an exact replacement body; never clone a live stream. */
@@ -89,6 +93,7 @@ export async function runWithCompactionRecovery(
   req: Request, config: OcxConfig, logCtx: RequestLogContext, options: Options, dispatch: Dispatch,
 ): Promise<Response> {
   const recovery = readCompactionRecoveryConfig(config.compactionRecovery);
+  const kind = options.compactionRecoveryKind ?? "compaction-v2";
   if (!recovery || options.compactionRecoveryAttempted || options.comboAttempt || (options.inboundWire && options.inboundWire !== "responses")) {
     return dispatch(req, config, logCtx, options);
   }
@@ -132,7 +137,7 @@ export async function runWithCompactionRecovery(
     },
     onCompactionRecoveryRoute(route) {
       options.onCompactionRecoveryRoute?.(route);
-      if (snapshot && routed(route)) sourceRoute = { ...route };
+      if (snapshot && routed(route, kind)) sourceRoute = { ...route };
     },
     onCompactionRecoveryAdapterEvent(event) {
       options.onCompactionRecoveryAdapterEvent?.(event);
@@ -151,7 +156,7 @@ export async function runWithCompactionRecovery(
     if (!snapshot || !sourceRoute || signal.aborted || req.signal.aborted || isNonReplayableResponse(response)) return keep(response);
     let target: RouteResult;
     try { target = routeConcreteModel(config, recovery.model); } catch { return keep(response); }
-    if (!routed(target) || identity(sourceRoute) === identity(target)) return keep(response);
+    if (!routed(target, kind) || identity(sourceRoute) === identity(target)) return keep(response);
     const originalModel = firstOptions.compactionRoutingOverride?.sourceModel ?? String(snapshot.model);
     // Use the established protocol commit boundary. For runTurn streams the direct event
     // observer additionally preserves side-effect heartbeats that the bridge does not publish.
@@ -289,7 +294,8 @@ export async function runWithCompactionRecovery(
     const compactions = items.filter(value => record(value) && value.type === "compaction");
     const permitted = items.every(value => record(value) && (value.type === "compaction" || value.type === "reasoning"));
     const item = permitted && compactions.length === 1 ? compactions[0] as Record<string, unknown> : undefined;
-    const summary = item && typeof item.encrypted_content === "string" ? decodeCompactionSummary(item.encrypted_content) : null;
+    const structured = item && typeof item.encrypted_content === "string" ? decodeRetainedCompaction(item.encrypted_content) : null;
+    const summary = structured?.summary ?? (item && typeof item.encrypted_content === "string" ? decodeCompactionSummary(item.encrypted_content) : null);
     if (json?.status !== "completed" || !summary?.trim()) {
       void completed.response.body?.cancel().catch(() => undefined);
       restoreSourceLog?.(completed.response.status);
@@ -298,11 +304,13 @@ export async function runWithCompactionRecovery(
     // v1 unpacks this text through buildCompactV1Output, which already re-adds retained user
     // messages as items; embedding them here too would duplicate the same text in the output.
     const preserved = options.compactionRecoveryKind === "compaction-v1" ? summary : (() => {
-      const retained = buildCompactV1Output(extractCompactUserMessages(snapshot.input), summary).slice(0, -1);
+      const usersOnly = Array.isArray(snapshot.input) ? snapshot.input.filter(item => collectReasoningTexts([item]).length === 0) : snapshot.input;
+      const retained = buildCompactV1Output(extractCompactUserMessages(usersOnly), summary).slice(0, -1);
       const userText = extractCompactUserMessages(retained).map((text, index) => `User message ${index + 1}:\n${text}`).join("\n\n");
       return `${summary}\n\nRetained original user messages (verbatim; preserve their goals and constraints):\n${userText}`;
     })();
-    item!.encrypted_content = encodeCompactionSummary(preserved);
+    const encryptedContent = structured ? encodeRetainedCompaction(preserved, structured.reasoning) : encodeCompactionSummary(preserved);
+    item!.encrypted_content = encryptedContent;
     json.model = originalModel;
     void completed.response.body?.cancel().catch(() => undefined);
     void response.body?.cancel().catch(() => undefined);
@@ -310,7 +318,7 @@ export async function runWithCompactionRecovery(
       const usage = usageFromResponsesPayload(json.usage);
       async function* events(): AsyncGenerator<AdapterEvent> {
         yield { type: "text_delta", text: preserved };
-        yield { type: "done", ...(usage ? { usage } : {}) };
+        yield { type: "done", compactionEncryptedContent: encryptedContent, ...(usage ? { usage } : {}) };
       }
       return new Response(bridgeToResponsesSSE(events(), originalModel, undefined, undefined, undefined, undefined, 2_000,
         { compaction: true, translatorBudget: options.translatorBudget, onCompletedResponse: () => options.onResponseComplete?.(originalModel) }), { headers: { "content-type": "text/event-stream" } });

package/src/server/responses/compaction-retention.ts

@@ -0,0 +1,61 @@
+import { rmSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../../config";
+import type { OcxConfig, OcxParsedRequest } from "../../types";
+import type { TranslatorBudget } from "../../lib/translator-budget";
+import { parseRequest } from "../../responses/parser";
+import { applyReasoningRetention, appendRetentionNotice } from "../../responses/reasoning-retention";
+import { encodeRetainedCompaction } from "../../responses/retained-compaction";
+import { finalizeAccountLease } from "./core-lifetime";
+
+export class InvalidRetainedCompactionSummary extends Error {}
+
+/** One routed v2 attempt owns its local retention until its response ends or is cancelled. */
+export function prepareCompactionRetention(
+  parsed: OcxParsedRequest,
+  config: OcxConfig,
+  contextWindow: number | undefined,
+  budget: TranslatorBudget,
+  signal: AbortSignal,
+) {
+  if (config.reasoningRetention?.enabled !== true) return undefined;
+  const raw = parsed._rawBody as Record<string, unknown>;
+  const retention = applyReasoningRetention(raw.input, {
+    archiveDir: join(getConfigDir(), "reasoning-archive"), contextWindow,
+    ...config.reasoningRetention,
+  });
+  if (!retention.retainedReasoning && !retention.archived) return undefined;
+  let committed = false;
+  let disposed = false;
+  let bytes = 0;
+  const dispose = () => {
+    if (disposed) return;
+    disposed = true;
+    signal.removeEventListener("abort", dispose);
+    delete parsed._compactionRetention;
+    budget.releaseRetained(bytes, { kind: "retained_collectors" });
+    if (!committed && retention.archived) rmSync(retention.archived.path, { force: true });
+  };
+  try {
+    const reasoning = retention.retainedReasoning?.map(item => item.content[0]!.text) ?? [];
+    const retainedBytes = Buffer.byteLength(JSON.stringify(reasoning));
+    budget.chargeRetained(retainedBytes, { kind: "retained_collectors" });
+    bytes = retainedBytes;
+    const body = { ...raw, model: parsed.modelId, input: retention.input };
+    const messages = parseRequest(body, { replayCacheScope: parsed._reasoningReplayScope }).context.messages;
+    parsed._rawBody = body;
+    parsed.context.messages = messages;
+    const callbacks: NonNullable<OcxParsedRequest["_compactionRetention"]> = {
+      encode(summary) {
+        if (disposed || signal.aborted) throw new Error("Compaction was cancelled");
+        if (!summary.trim()) throw new InvalidRetainedCompactionSummary("Compaction returned an empty summary");
+        return encodeRetainedCompaction(appendRetentionNotice(summary, retention.archived), reasoning);
+      },
+      commit() { if (!disposed && !signal.aborted) committed = true; },
+    };
+    Object.defineProperty(parsed, "_compactionRetention", { value: callbacks, configurable: true });
+    if (signal.aborted) { dispose(); throw signal.reason; }
+    signal.addEventListener("abort", dispose, { once: true });
+    return { dispose, deliver: (response: Response) => finalizeAccountLease(response, dispose, dispose) };
+  } catch (error) { dispose(); throw error; }
+}

package/src/server/responses/context-overflow.ts

@@ -17,21 +17,25 @@ export function lateAttributionLimitResponse(): Response {
 export const PROVIDER_INPUT_TOO_LARGE_MESSAGE =
   "The provider rejected this turn because its input exceeds the provider size or context limit. Reduce the current input or compact the conversation before retrying.";
 
-/** Preserve non-streaming HTTP failure semantics without exposing an upstream body. */
-export function jsonContextOverflowResponse(): Response {
+/**
+ * Preserve non-streaming HTTP failure semantics without exposing an upstream body. `message` is
+ * replaced only for the proxy's own wording, never with upstream text: when every combo target
+ * was refused by local input admission, no provider saw the turn and saying one did is false.
+ */
+export function jsonContextOverflowResponse(message = PROVIDER_INPUT_TOO_LARGE_MESSAGE): Response {
   return Response.json({
     error: {
-      message: PROVIDER_INPUT_TOO_LARGE_MESSAGE,
+      message,
       type: "invalid_request_error",
       code: "context_length_exceeded",
     },
   }, { status: 413, headers: { "Cache-Control": "no-store" } });
 }
 
-async function* contextOverflowEvents(): AsyncGenerator<AdapterEvent> {
+async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEvent> {
   yield {
     type: "error",
-    message: PROVIDER_INPUT_TOO_LARGE_MESSAGE,
+    message,
     status: 413,
     errorType: "invalid_request_error",
     code: "context_length_exceeded",
@@ -51,9 +55,10 @@ async function* contextOverflowEvents(): AsyncGenerator<AdapterEvent> {
 export function streamingContextOverflowResponse(
   modelId: string,
   translatorBudget: TranslatorBudget,
+  message = PROVIDER_INPUT_TOO_LARGE_MESSAGE,
 ): Response {
   return new Response(bridgeToResponsesSSE(
-    contextOverflowEvents(),
+    contextOverflowEvents(message),
     modelId,
     undefined,
     undefined,

package/src/server/responses/core-auth.ts

@@ -43,6 +43,7 @@ import { codexAuthContextLogLabel } from "../../codex/account-label";
 import { forceRefreshMainAccountToken } from "../../codex/main-account";
 import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
 import { safeCallerSessionId } from "../caller-session-identity";
+import { copyResponsesClientMetadata } from "../../adapters/openai-responses/transport";
 
 /** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
 export function withClaudeNativeSession(headers: Headers, provider: OcxProviderConfig, sessionId?: string): Headers {
@@ -335,6 +336,11 @@ export async function resolveResponsesCodexAuth(
         headers.delete("chatgpt-account-id");
       }
     }
+    // Codex auth materialization keeps only its credential allowlist. A compact-v1 handoff
+    // must also retain the permitted client fingerprint for its routed summarizer send.
+    if (options.compactionRecoveryKind === "compaction-v1") {
+      copyResponsesClientMetadata(headers, authInputHeaders, route.provider);
+    }
     return {
       ok: true,
       authCtx,

package/src/server/responses/core-codex-account.ts

@@ -32,6 +32,7 @@ import {
   type CodexWsPreOutputRefusalHold,
 } from "./codex-ws-wire";
 import type { RequestLogContext } from "../request-log";
+import type { AttemptRecoveryKind } from "../../usage/log";
 import type { DataPlaneAdmission } from "../auth-cors";
 import type { InboundWire } from "../../providers/registry";
 import type { BunRuntimeGateInput } from "./ws-upstream";
@@ -909,6 +910,8 @@ export async function retryCodexPoolOnAlternateAccount(
       applyAccountChangeConversationStateScrub({
         body: parsed._rawBody,
         parsed,
+        preserveReasoningEncryptedContent: isCanonicalOpenAiForwardProvider(retryProvider)
+          && parsed._nativeReasoningRetention?.accountSwitch === true,
         bindingKey: binding.bindingKey,
         servingAccountId: binding.accountId,
         priorAccountId: firstAuthCtx.accountId,
@@ -971,6 +974,10 @@ export async function retryCodexPoolOnAlternateAccount(
   // What this diff does fix is that the rungs are now CHARGED instead of free.
   const maxRetrySends = retrySameConfirmedAccount ? 7 : 1;
   let retrySendCount = 0;
+  // The gated-model 400 has no roster kind; it stays unattributed as before.
+  const moveRecovery: AttemptRecoveryKind | undefined = outcomeStatus === 429 || outcomeStatus === 402
+    ? "oauth-account-429"
+    : isTransientUpstreamStatus(outcomeStatus) ? "transient-5xx" : undefined;
   let upstreamResponse: Response;
   try {
     while (true) {
@@ -1005,7 +1012,10 @@ export async function retryCodexPoolOnAlternateAccount(
         // The move is a physical send like any other, so the root workflow is charged too.
         chargeWorkflowSends(args.options.workflowRootId, 1);
       }
-      noteProviderAttemptSend(logCtx, route.providerName, route.provider, passthroughEstimate);
+      // A move seals the first account's attempt here. Give it the status that account actually
+      // answered, not the 502 the split infers, and name why the second send exists.
+      if (logCtx.activeAttempt && logCtx.activeAttempt.status < 100) logCtx.activeAttempt.status = firstResponse.status;
+      noteProviderAttemptSend(logCtx, route.providerName, route.provider, passthroughEstimate, moveRecovery);
       try {
         upstreamResponse = await fetchWithHeaderTimeout(
           request.url,

package/src/server/responses/core-combo-failure.ts

@@ -3,6 +3,7 @@ import { parseRetryAfterMs } from "../../combos";
 import type { ConsumedComboFailure, HandleResponsesOptions } from "./core-options";
 import type { OcxUsage } from "../../types";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
+import { carryAnthropicRefusalCredential } from "../../oauth/anthropic-account-refusal";
 import { codexQuotaFailureMessage, codexQuotaOutcomeMeta } from "./core-codex-account";
 import {
   isRateLimitOrQuotaFailureMessage,
@@ -16,6 +17,7 @@ import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { formatErrorResponse } from "../../bridge";
 import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
 import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
+import { MODEL_NOT_ALLOWED_FOR_KEY } from "../admission-model-scope";
 import { usageFromResponsesPayload } from "../request-log";
 import type { ResponsesTerminalStatus } from "../../bridge";
 
@@ -49,6 +51,9 @@ export async function consumeComboFailure(
   // display-safe body carries a recognized quota message.
   let quotaConfirmedByBody = false;
   const serverError = response.status >= 500 && response.status < 600;
+  // A local key-scope refusal is already the client's answer: rebuilding it as an upstream_error
+  // would hide the stable model_not_allowed_for_key type clients branch on.
+  let scopeRefusalBody: string | undefined;
   try {
     const body = await readBoundedResponseBody(response, { signal, reportUtf8Validity: serverError });
     // A 5xx body counts as quota or classification evidence only when it decoded as valid
@@ -71,6 +76,9 @@ export async function consumeComboFailure(
         upstreamMessage = normalized.message;
         upstreamType = normalized.type;
       }
+      if (nonReplayable && response.status === 403 && upstreamType === MODEL_NOT_ALLOWED_FOR_KEY) {
+        scopeRefusalBody = body.text;
+      }
     }
   } catch (error) {
     if (signal?.aborted) throw error;
@@ -106,7 +114,9 @@ export async function consumeComboFailure(
     now,
     includeDefault: false,
   });
-  const failureResponse = formatErrorResponse(
+  const failureResponse = scopeRefusalBody !== undefined
+    ? new Response(scopeRefusalBody, { status: 403, headers: { "Content-Type": "application/json" } })
+    : formatErrorResponse(
     response.status,
     cyberFailure ? (upstreamType ?? CYBER_POLICY_ERROR_CODE) : "upstream_error",
     message,
@@ -116,6 +126,7 @@ export async function consumeComboFailure(
     },
   );
   if (nonReplayable) markResponseNonReplayable(failureResponse);
+  carryAnthropicRefusalCredential(response, failureResponse);
   return {
     response: failureResponse,
     ...(nonReplayable ? { nonReplayable: true } : {}),

package/src/server/responses/core-combo.ts

@@ -1,10 +1,12 @@
+import { effectiveAzureOutputBudget } from "../../adapters/azure";
+import { resolveWireProtocolOverride } from "../adapter-resolve";
 import type { CodexAccountModelRefusal } from "../../combos/failover";
 import {
   isCodexReasoningEffort,
   isDeclaredReasoningEffort,
   resolveEffortAtOrBelow,
 } from "../../reasoning-effort";
-import { resolveAdmissionModelScope, routeAllowedByScope } from "../admission-model-scope";
+import { admissionMayUseMeteredComboTargets, resolveAdmissionModelScope, routeAllowedByScope } from "../admission-model-scope";
 import { recordAttemptRequestedEffort } from "../request-log";
 import {
   CODEX_TEXT_GUARDED_BUDGET_POLICY,
@@ -29,6 +31,7 @@ import {
   comboDefaultEffort,
   isComboTargetInCooldown,
   snapshotComboQuotaCooldowns,
+  comboExclusionReasons,
   noteComboSuccess,
   comboFailureDecision,
   advanceComboAfterFailure,
@@ -50,14 +53,17 @@ import {
 import { hasUnreadableEncryptedAgentTask } from "./encrypted-payload";
 import { routeConcreteModel, comboRouteDecisionTrace } from "../../router";
 import { memoryModelRouteReason } from "./memory-models";
-import { poolAccountProviderLabel } from "../../providers/label";
+import { baseProviderLabel, poolAccountProviderLabel } from "../../providers/label";
 import { getAccountSet } from "../../oauth/store";
+import { anthropicRefusalCredentialIsCurrent } from "../../oauth/anthropic-account-refusal";
 import { configuredAnthropicInstance } from "../../providers/anthropic-instance";
+import { isAnthropicBillingFailure } from "../../providers/anthropic-billing-refusal";
 import {
   anthropicRoutingFor,
   formatAnthropicProviderForLog,
 } from "../../oauth/anthropic-routing";
-import { codexAccountLogLabel } from "../../codex/account-label";
+import { codexAccountLogLabel, oauthAccountLogLabel } from "../../codex/account-label";
+import { isGenericFailoverProvider, rotateGenericOAuthAccountOn429 } from "../../oauth/generic-account-failover";
 import { codexQuotaScopeForModel, getCodexQuotaHealthSnapshot } from "../../codex/routing";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import type { AgentTaskRecoveryFailureReason } from "./agent-task-recovery";
@@ -133,6 +139,48 @@ function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId
     ? label : undefined;
 }
 
+/**
+ * The generic OAuth pool's counterpart of `cooledPoolAccountLabel`. Its 429 names one account
+ * through `accountLogLabel`, but the per-request account budget can end the pool's own rotation
+ * before the last refused account is recorded. Hand that account to the pool's rotator, which
+ * cools it under the pool's own Retry-After policy, and spare the target only when the pool still
+ * has an eligible sibling. A lone account or an all-cooled pool returns null and cools the target.
+ */
+function cooledGenericOAuthAccountLabel(
+  config: OcxConfig, providerName: string, modelId: string, label: string | undefined, retryAfter: string | undefined,
+): string | undefined {
+  const provider = config.providers[providerName];
+  if (!label || !provider || !isGenericFailoverProvider(providerName, provider)) return undefined;
+  const base = baseProviderLabel(providerName);
+  const matches = getAccountSet(providerName)?.accounts.filter(account =>
+    oauthAccountLogLabel(account.id, base) === label) ?? [];
+  return matches.length === 1
+    && rotateGenericOAuthAccountOn429(config, providerName, matches[0]!.id, retryAfter, Date.now(), modelId)
+    ? label : undefined;
+}
+
+/**
+ * A 402 credit-balance refusal names one Anthropic OAuth account -- the evidence the pool already
+ * accepts on a 403 -- but the pool rotates only on 401/403/429, so the 402 reaches the combo with
+ * that account still selectable. Cool it under the pool's entitlement backoff and spare the target
+ * only while a sibling is eligible; a lone account or an exhausted pool still cools the target.
+ */
+function creditRefusedAnthropicAccountLabel(
+  config: OcxConfig, providerName: string, modelId: string, label: string | undefined,
+  message: string, code: string | null | undefined, response: Response,
+): string | undefined {
+  const instance = configuredAnthropicInstance(config, providerName);
+  if (!label || !instance || config.providers[providerName]?.authMode !== "oauth"
+    || !isAnthropicBillingFailure(402, message, code)) return undefined;
+  const routing = anthropicRoutingFor(instance);
+  const matches = getAccountSet(instance)?.accounts.filter(account =>
+    formatAnthropicProviderForLog(instance, account.id) === label) ?? [];
+  return matches.length === 1
+    && anthropicRefusalCredentialIsCurrent(response, instance, matches[0]!.id)
+    && routing.recordAnthropicAccountRefusal(config, matches[0]!.id, 403, null)
+    && routing.getEligibleAnthropicAccounts(Date.now(), modelId).length > 0
+    ? label : undefined;
+}
 
 /**
  * True only for the Anthropic OAuth pool's OWN "all accounts cooled" 429. Its Retry-After is the
@@ -249,6 +297,30 @@ interface JevComboChoice {
   candidate: JevCandidate;
 }
 
+/** A target's JEV effort choices, or undefined when an explicit allowlist has none still supported. */
+function jevChoiceEfforts(
+  config: OcxConfig,
+  target: NonNullable<ReturnType<typeof getCombo>>["targets"][number],
+): OcxComboDefaultEffort[] | undefined {
+  let ladder: string[] | undefined;
+  try {
+    const route = routeConcreteModel(config, targetKey(target));
+    ladder = supportedLadderFor({ provider: route.provider, modelId: route.modelId });
+  } catch {
+    // Preserve the existing routing-failure surface. Unknown capability becomes the explicit
+    // no-effort choice rather than broadening JEV's effort allowlist.
+    ladder = undefined;
+  }
+  const supportedEfforts = (ladder ?? []).filter(isCodexReasoningEffort) as OcxComboDefaultEffort[];
+  const configuredEfforts = target.reasoningEfforts;
+  const reasoningEfforts = configuredEfforts === undefined
+    ? supportedEfforts
+    : configuredEfforts.filter(effort => supportedEfforts.includes(effort));
+  // An explicit allowlist is restrictive. If catalog capabilities drift until no configured
+  // effort remains supported, omit the target instead of silently broadening JEV's choices.
+  return configuredEfforts !== undefined && reasoningEfforts.length === 0 ? undefined : reasoningEfforts;
+}
+
 /** Enumerate the current ordinary Combo eligibility set without retaining attempted picks. */
 function eligibleJevComboChoices(
   config: OcxConfig,
@@ -267,23 +339,8 @@ function eligibleJevComboChoices(
     excluded.add(key);
     // The TypeSafe row owns a decision credential, not an inference transport.
     if (pick.target.provider === JEV_PROVIDER_ID) continue;
-    let ladder: string[] | undefined;
-    try {
-      const route = routeConcreteModel(config, key);
-      ladder = supportedLadderFor({ provider: route.provider, modelId: route.modelId });
-    } catch {
-      // Preserve the existing routing-failure surface. Unknown capability becomes the explicit
-      // no-effort choice rather than broadening JEV's effort allowlist.
-      ladder = undefined;
-    }
-    const supportedEfforts = (ladder ?? []).filter(isCodexReasoningEffort) as OcxComboDefaultEffort[];
-    const configuredEfforts = pick.target.reasoningEfforts;
-    const reasoningEfforts = configuredEfforts === undefined
-      ? supportedEfforts
-      : configuredEfforts.filter(effort => supportedEfforts.includes(effort));
-    // An explicit allowlist is restrictive. If catalog capabilities drift until no configured
-    // effort remains supported, omit the target instead of silently broadening JEV's choices.
-    if (configuredEfforts !== undefined && reasoningEfforts.length === 0) continue;
+    const reasoningEfforts = jevChoiceEfforts(config, pick.target);
+    if (!reasoningEfforts) continue;
     choices.push({
       pick: { ...pick, attempted: [key] },
       candidate: {
@@ -315,9 +372,10 @@ export async function executeComboResponses(
   options: HandleResponsesOptions & { translatorBudget: TranslatorBudget },
   requestDispatchers: ResponsesDispatchers,
 ): Promise<Response> {
-  const requestedModel = typeof (rawBody as { model?: unknown } | null)?.model === "string"
-    ? (rawBody as { model: string }).model
-    : `combo/${comboId}`;
+  const requestedModel = options.mainHardLockFallbackOverride?.sourceModel
+    ?? (typeof (rawBody as { model?: unknown } | null)?.model === "string"
+      ? (rawBody as { model: string }).model
+      : `combo/${comboId}`);
   Object.assign(logCtx, {
     requestedModel,
     model: requestedModel,
@@ -447,8 +505,10 @@ export async function executeComboResponses(
   let comboPayloadReadable = false;
   const payloadEligible = (target: (typeof combo.targets)[number]): boolean =>
     comboPayloadReadable || !unreadableEncryptedAgentTask || canDecryptUnreadableAgentTask(target);
+  const meteredAllowed = admissionMayUseMeteredComboTargets(config, options.admission, combo);
   const targetEligible = (target: (typeof combo.targets)[number]): boolean =>
-    (combo.strategy !== "jev" || target.provider !== JEV_PROVIDER_ID)
+    (meteredAllowed || !target.metered)
+    && (combo.strategy !== "jev" || target.provider !== JEV_PROVIDER_ID)
     && payloadEligible(target)
     && reasoningReplayEligible(target)
     && (protocolLanes?.pickable(target) ?? true);
@@ -522,6 +582,9 @@ export async function executeComboResponses(
     now?: number;
   }) => pickComboTargetWithWait(config, comboId, {
     ...pickOptions,
+    // Every pick, including the recovery picks that skip `targetEligible`, keeps metered
+    // targets away from callers that may not spend on them.
+    eligible: target => (meteredAllowed || !target.metered) && (pickOptions.eligible?.(target) ?? true),
     waitForCooldownMs: combo.waitForCooldownMs,
     abortSignal: options.abortSignal,
   });
@@ -541,7 +604,8 @@ export async function executeComboResponses(
       );
       return options.abortSignal?.aborted
         ? clientCancelledResponse()
-        : comboUnavailable(comboId);
+        : comboUnavailable(comboId, undefined,
+          comboExclusionReasons(config, comboId, target => meteredAllowed || !target.metered));
     }
     if (!(await recoverUnreadableEncryptedTask())) {
       return options.abortSignal?.aborted
@@ -557,13 +621,16 @@ export async function executeComboResponses(
     if (onlyReplayIncompatibleTargetsRemain()) return targetIncompatibleResponse();
     return options.abortSignal?.aborted
       ? clientCancelledResponse()
-      : comboUnavailable(comboId);
+      : comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, targetEligible));
   }
   let jevDecision: JevDecision | undefined;
   if (combo.strategy === "jev") {
     const choices = eligibleJevComboChoices(config, comboId, targetEligible, Date.now());
     const first = choices[0];
-    if (!first) return comboUnavailable(comboId);
+    if (!first) {
+      return comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, target =>
+        targetEligible(target) && target.provider !== JEV_PROVIDER_ID && jevChoiceEfforts(config, target) !== undefined));
+    }
     const resolvedFailOpenEffort = resolveEffortAtOrBelow(
       "medium",
       first.candidate.reasoningEfforts,
@@ -677,6 +744,9 @@ export async function executeComboResponses(
   // is gone, so carry the loop's own classification decision instead of re-deriving a
   // weaker one from the status alone (#4149).
   let lastFailureClassifiesOverflow = false;
+  // Local input admission refusals (#1524), while every failed target so far was one: such a
+  // target sent nothing, so an exhausted ladder must not be reported as a provider rejection.
+  let localAdmissionRefusals: string[] | undefined = [];
   // The first quota/rate-limit refusal of the ladder. A fallback that then refuses its own
   // credential or plan (401/403, or a 400 the ladder hopped past) says nothing about why the
   // request failed: the primary target ran out. Returning that fallback refusal told clients
@@ -712,12 +782,31 @@ export async function executeComboResponses(
         retryAfter: String(Math.max(1, Math.ceil(remainingQuotaCooldownMs / 1000))),
       }) : lastFailure;
   };
+  // The caller's output ceiling, captured once so a floor applied to one target never
+  // leaks into the next. An established parent estimate wins; otherwise (combo dispatch
+  // precedes request preparation) the caller's own positive cap is reserved.
+  const callerBudget = isPlainObject(body) ? body.max_output_tokens : undefined;
+  const callerOutputCeilingTokens = logCtx.spendOutputCeilingTokens
+    ?? (typeof callerBudget === "number" && Number.isFinite(callerBudget) && callerBudget > 0
+      ? Math.trunc(callerBudget) : undefined);
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
     // The inherited spend tracker observes this parent log, before the child has its own label.
     logCtx.spendPoolId = targetRoute.providerName;
+    // Combo prepays before its child normalizes the route; the parent tracker must
+    // already see this target's effective cap rather than a previous target's cap.
+    const spendProvider = resolveWireProtocolOverride(targetRoute.providerName, targetRoute.modelId,
+      targetRoute.provider, options.inboundWire ?? "responses", targetRoute.staticPolicy);
+    const outputBudget = effectiveAzureOutputBudget(spendProvider, callerBudget);
+    if (outputBudget !== callerBudget && typeof outputBudget === "number" && outputBudget > 0) {
+      logCtx.spendOutputCeilingTokens = Math.trunc(outputBudget);
+    } else if (callerOutputCeilingTokens === undefined) {
+      delete logCtx.spendOutputCeilingTokens;
+    } else {
+      logCtx.spendOutputCeilingTokens = callerOutputCeilingTokens;
+    }
     // Derive the target's allowance before booking its initial send; the booking occupies it.
     const targetSendBudget = comboSendScope
       ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
@@ -832,7 +921,8 @@ export async function executeComboResponses(
         // The live config can change while the child is streaming. Never retain credentials.
         const currentCombo = getCombo(config, comboId);
         const provider = config.providers[completedTarget.provider];
-        if (!options.compactionRoutingOverride && Object.hasOwn(config.providers, completedTarget.provider)
+        if (!options.compactionRoutingOverride && !options.mainHardLockFallbackOverride
+          && Object.hasOwn(config.providers, completedTarget.provider)
           && provider && provider.disabled !== true
           && currentCombo?.targets.some(target => targetKey(target) === targetKey(completedTarget))) {
           rememberComboForLane(sessionLaneIdFromRequest(req.headers), comboId, completedTarget, model, writerGeneration);
@@ -1024,6 +1114,12 @@ export async function executeComboResponses(
       Date.now() - started,
       failure.usage,
     );
+    if (failure.upstreamCode === "input_admission_refused" && attempt.sendCount === 0) {
+      attempt.errorCode = failure.upstreamCode;
+      localAdmissionRefusals?.push(failure.upstreamMessage ?? "");
+    } else {
+      localAdmissionRefusals = undefined;
+    }
     attemptRetained = true;
     lastFailure = failure.response;
     if (!quotaFailure && (lastFailure.status === 429 || lastFailure.status === 402)) {
@@ -1107,12 +1203,16 @@ export async function executeComboResponses(
     const failedTargetKey = targetKey(pick.target);
     let failedTargetCooldownRecorded = false;
     // The dispatch rewrote this to name the pool account that actually served the turn.
-    const failedAccount = cooledPoolAccountLabel(
-      config,
-      pick.target.provider,
-      pick.target.model,
-      poolAccountProviderLabel(childLog.provider, pick.target.provider),
-    );
+    const poolAccountLabel = poolAccountProviderLabel(childLog.provider, pick.target.provider);
+    const failedAccount = failure.response.status === 402
+      ? creditRefusedAnthropicAccountLabel(
+        config, pick.target.provider, pick.target.model, poolAccountLabel, failure.classificationText, failure.upstreamCode,
+        failure.response,
+      )
+      : cooledPoolAccountLabel(config, pick.target.provider, pick.target.model, poolAccountLabel)
+      ?? (failure.response.status === 429 && failureCooldownScope === "target"
+      ? cooledGenericOAuthAccountLabel(config, pick.target.provider, pick.target.model, childLog.accountLogLabel, failure.retryAfter)
+      : undefined);
     // The target still cools on the pool's own refusal (the anti-hammer guard), but for the local
     // fallback rather than the pool's restated per-account Retry-After.
     const poolLocalRefusal = isAnthropicPoolLocalRefusal(
@@ -1204,9 +1304,14 @@ export async function executeComboResponses(
     lastFailure?.status === 413
     && lastFailureClassifiesOverflow
   ) {
+    if (localAdmissionRefusals?.length) logCtx.errorCode = "input_admission_refused";
+    const localMessage = localAdmissionRefusals?.length
+      ? `opencodex refused this turn locally; nothing was sent upstream. No target of combo ${comboId} `
+        + `that was tried can fit its input: ${localAdmissionRefusals.join(" ")} Compact the conversation before retrying.`
+      : undefined;
     return (rawBody as { stream?: unknown } | null)?.stream === true
-      ? streamingContextOverflowResponse(requestedModel, options.translatorBudget)
-      : jsonContextOverflowResponse();
+      ? streamingContextOverflowResponse(requestedModel, options.translatorBudget, localMessage)
+      : jsonContextOverflowResponse(localMessage);
   }
   return failure;
 }

package/src/server/responses/core-errors.ts

@@ -8,7 +8,7 @@ import {
   DecompressedBodyTooLargeError,
   describeInboundBodyRefusal,
 } from "../request-decompress";
-import { comboCooldownRetryAfterSeconds } from "../../combos";
+import { comboCooldownRetryAfterSeconds, NoAvailableComboTargetsError } from "../../combos";
 import type { AgentTaskRecoveryFailureReason } from "./agent-task-recovery";
 
 /**
@@ -115,8 +115,8 @@ export function comboUnavailableResponse(
 }
 
 
-export function comboUnavailable(comboId: string, now = Date.now()): Response {
-  return comboUnavailableResponse(`No available targets for combo: ${comboId}`, {
+export function comboUnavailable(comboId: string, now = Date.now(), reasons = ""): Response {
+  return comboUnavailableResponse(new NoAvailableComboTargetsError(comboId, reasons).message, {
     retryAfter: comboCooldownRetryAfterSeconds(comboId, now),
   });
 }