@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/server/responses/fetch-helpers.ts

@@ -12,6 +12,7 @@ import type { WsData } from "../ws-bridge";
 import {
   requestPacingMaxConcurrentRequests,
   sendTrackingRequestSlot,
+  trackProviderRequestSlotBody,
   waitForProviderRequestSlot,
   type ProviderRequestSlot,
 } from "../../providers/request-pacing";
@@ -49,6 +50,9 @@ const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
 const PHYSICAL_DISPATCH = Symbol.for("opencodex.physical-dispatch");
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
+// Replacement admission waits on the client signal, outside the response-header deadline.
+const HEADER_DEADLINE = Symbol("header-deadline");
+type HeaderDeadline = { clientSignal: AbortSignal; pause(): void; resume(): void };
 
 /**
  * Announce once, per provider, that an explicit egress route moved this provider off the
@@ -139,6 +143,7 @@ export function wantsFreshConnection(
 export interface PaceAwareFetch {
   waitForPacing?: (signal?: AbortSignal) => Promise<ProviderRequestSlot | undefined>;
   unpacedFetch?: typeof globalThis.fetch;
+  fetchWithPacingSlot?: (slot: ProviderRequestSlot | undefined, input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => Promise<Response>;
 }
 
 export type ProviderFetch = typeof globalThis.fetch & PaceAwareFetch;
@@ -252,7 +257,8 @@ export interface ProviderFetchOptions {
    */
   preOutputRefusalHold?: CodexWsPreOutputRefusalHold;
   /** Revalidate/rebuild a queued request at its physical send boundary, after pacing. */
-  dispatchOverride?: (input: Parameters<typeof globalThis.fetch>[0], init: RequestInit, execute: typeof globalThis.fetch) => Promise<Response>;
+  dispatchOverride?: (input: Parameters<typeof globalThis.fetch>[0], init: RequestInit, execute: typeof globalThis.fetch,
+    reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => Promise<Response>;
 }
 
 /** Compose provider pacing and transport admission; receipts run only at executor entry. */
@@ -301,7 +307,8 @@ export function providerFetch(
     { preconnect },
   ) as typeof globalThis.fetch);
   const httpFetch = Object.assign(
-    async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+    async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+      reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
       // Refuse before any dispatch side effect where that is sound. `beforeDispatch` commits
       // attempt accounting and consumes admission state, so a refusal firing after it would
       // charge an attempt for a send that never happens, and a throwing hook would mask the
@@ -329,30 +336,33 @@ export function providerFetch(
         } } : {}),
       };
       return options.dispatchOverride
-        ? options.dispatchOverride(input, dispatchInit, dispatch)
+        ? options.dispatchOverride(input, dispatchInit, dispatch, reacquirePacing)
         : dispatch(input, dispatchInit);
     },
     { preconnect },
-  ) as typeof globalThis.fetch;
+  );
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
-  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+    reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
     const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
       && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
-      if (options.providerName && requestPacingMaxConcurrentRequests(provider, options.modelId) > 0) {
+      const keyedPacing = provider.requestPacing?.enabled
+        && (provider.requestPacing.keys || provider.requestPacing.keySelection === "round-robin");
+      if (keyedPacing || (options.providerName && requestPacingMaxConcurrentRequests(provider, options.modelId) > 0)) {
         if (!pacingWebsocketDowngradeWarned.has(providerName)
           && pacingWebsocketDowngradeWarned.size < EGRESS_DOWNGRADE_NOTICE_LIMIT) {
           pacingWebsocketDowngradeWarned.add(providerName);
-          console.warn(`[opencodex] provider ${JSON.stringify(redactSecretString(providerName))} has a request concurrency cap; serving over HTTP/SSE.`);
+          console.warn(`[opencodex] provider ${JSON.stringify(redactSecretString(providerName))} requires guarded request pacing; serving over HTTP/SSE.`);
         }
-        return httpFetch(input, init);
+        return httpFetch(input, init, reacquirePacing);
       }
       const egress = egressFor(input);
       if (providerEgressIsExplicit(egress)) {
         warnEgressWebsocketDowngradeOnce(providerName, describeProviderEgressForLog(egress));
-        return httpFetch(input, init);
+        return httpFetch(input, init, reacquirePacing);
       }
       // The fallback has to be the same HTTP fetch the non-WS branch would have
       // used, protocol pin included: a WS turn that falls back is serving the
@@ -365,11 +375,11 @@ export function providerFetch(
         options.onPhysicalDispatch?.();
       };
       const fallback = ((url: Parameters<typeof globalThis.fetch>[0], fallbackInit?: RequestInit) =>
-        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit)) as typeof globalThis.fetch;
+        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit, reacquirePacing)) as typeof globalThis.fetch;
       return codexWsUpstreamFetch(input, init, fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
         async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold);
     }
-    return httpFetch(input, init);
+    return httpFetch(input, init, reacquirePacing);
   };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
   const waitForPacing = async (signal?: AbortSignal): Promise<ProviderRequestSlot | undefined> => {
@@ -392,15 +402,35 @@ export function providerFetch(
       throw new Error("A provider name is required for request concurrency pacing");
     }
   };
-  const wrapped = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
-    return sendTrackingRequestSlot(await waitForPacing(init?.signal ?? undefined), () => unpaced(input, init));
+  const fetchWithPacingSlot = async (slot: ProviderRequestSlot | undefined, input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+    const reacquirePacing = async (refreshed: OcxProviderConfig, modelId?: string) => {
+      if (options.turnScopedPacing) throw new Error("Cannot replace a turn-scoped pacing lease during dispatch");
+      if (!options.providerName) throw new Error("Refreshed dispatch requires a named pacing owner");
+      slot?.release();
+      slot = undefined;
+      const deadline = (init as Record<symbol, HeaderDeadline> | undefined)?.[HEADER_DEADLINE];
+      deadline?.pause();
+      try {
+        slot = await waitForProviderRequestSlot(providerName, refreshed, modelId, deadline?.clientSignal ?? init?.signal ?? undefined);
+      } finally { deadline?.resume(); }
+    };
+    try {
+      const response = await unpaced(input, init, reacquirePacing);
+      return trackProviderRequestSlotBody(slot, response);
+    } catch (error) {
+      slot?.release();
+      throw error;
+    }
   };
+  const wrapped = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) =>
+    fetchWithPacingSlot(await waitForPacing(init?.signal ?? undefined), input, init);
   // The returned wrapper forwards its init down to `dispatch`, which applies the route at the
   // physical send. Adapters that hand this executor back as `provider.fetch` (Cursor does)
   // therefore still carry a per-provider route instead of being refused as opaque.
   const paceAware = Object.assign(wrapped, {
     preconnect,
     waitForPacing,
+    fetchWithPacingSlot,
     unpacedFetch: Object.assign(unpaced, { preconnect }),
   });
   markEgressTransparentExecutor(paceAware as unknown as typeof globalThis.fetch);
@@ -432,6 +462,9 @@ export function storedPoolReplayDispatchNotifier(
     notified = true;
     onDispatch();
   };
+  const notifyWithSlot = (slot: ProviderRequestSlot | undefined): void => {
+    try { notifyOnce(); } catch (error) { slot?.release(); throw error; }
+  };
   const unpacedSource = executor.unpacedFetch ?? executor;
   const unpaced = Object.assign(
     (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
@@ -441,12 +474,21 @@ export function storedPoolReplayDispatchNotifier(
     { preconnect: unpacedSource.preconnect },
   ) as ProviderFetch["unpacedFetch"];
   const wrapped = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+    if (executor.fetchWithPacingSlot) {
+      const slot = await executor.waitForPacing?.(init?.signal ?? undefined);
+      notifyWithSlot(slot);
+      return executor.fetchWithPacingSlot(slot, input, init);
+    }
     return sendTrackingRequestSlot(await executor.waitForPacing?.(init?.signal ?? undefined), () => unpaced!(input, init));
   };
   return Object.assign(wrapped, {
     preconnect: executor.preconnect,
     waitForPacing: executor.waitForPacing,
     unpacedFetch: unpaced,
+    ...(executor.fetchWithPacingSlot ? { fetchWithPacingSlot: (slot: ProviderRequestSlot | undefined, input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+      notifyWithSlot(slot);
+      return executor.fetchWithPacingSlot!(slot, input, init);
+    } } : {}),
   }) as ProviderFetch;
 }
 
@@ -470,24 +512,36 @@ export async function fetchWithHeaderTimeout(
   let timer: ReturnType<typeof setTimeout> | undefined;
   try {
     const timeout = new AbortController();
-    timer = setTimeout(() => {
-      if (!timeout.signal.aborted) timeout.abort(new DOMException("Timeout elapsed", "TimeoutError"));
-    }, timeoutMs);
+    const deadline: HeaderDeadline = {
+      clientSignal: abortSignal,
+      pause() { if (timer) clearTimeout(timer); timer = undefined; },
+      resume() {
+        this.pause();
+        timer = setTimeout(() => {
+          if (!timeout.signal.aborted) timeout.abort(new DOMException("Timeout elapsed", "TimeoutError"));
+        }, timeoutMs);
+      },
+    };
+    deadline.resume();
     const headers = new Headers(init.headers);
     // Compressed SSE can be held until the decompressor has a complete block. Streaming calls
     // default to identity for low-latency frame delivery, while an explicit caller choice wins.
     if (preferIdentityEncoding && !headers.has("accept-encoding")) {
       headers.set("accept-encoding", "identity");
     }
-    return await sendTrackingRequestSlot(slot, () => fetchExecutor(url, {
+    const dispatchInit = {
       ...init,
       headers,
       // Never replay provider credentials or request bodies to a redirect destination.
       // Preserve the 3xx for the owner's existing response/health policy (#914, #1471).
-      redirect: "manual",
+      redirect: "manual" as const,
       signal: AbortSignal.any([abortSignal, timeout.signal]),
+      [HEADER_DEADLINE]: deadline,
       timeout: 0,
-    }));
+    };
+    return pacing.fetchWithPacingSlot
+      ? await pacing.fetchWithPacingSlot(slot, url, dispatchInit)
+      : await sendTrackingRequestSlot(slot, () => fetchExecutor(url, dispatchInit));
   } finally {
     if (timer) clearTimeout(timer);
     if (!slot?.bodyTracked) slot?.release();

package/src/server/responses/main-hard-lock-routing.ts

@@ -0,0 +1,109 @@
+import type { OcxConfig } from "../../types";
+import { resolveComboId } from "../../combos";
+import { isBareOpenAiFamilyModel } from "../../router";
+import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
+import {
+  getMainAccountHardLockStatus,
+  resolveMainAccountHardLockFallback,
+} from "../../codex/main-account-hard-lock";
+import { codexQuotaScopeForModel } from "../../codex/routing/health-store";
+import { getEligiblePoolAccounts } from "../../codex/routing/selection";
+import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { providerCodexAccountMode } from "../../providers/registry";
+
+function isConfiguredComboSelector(config: OcxConfig, modelId: string): boolean {
+  const comboId = resolveComboId(config, modelId);
+  return Boolean(comboId && Object.hasOwn(config.combos ?? {}, comboId));
+}
+
+function targetsBlockedCanonicalOpenAi(config: OcxConfig, modelId: string): boolean {
+  if (isBareOpenAiFamilyModel(modelId) && !isConfiguredComboSelector(config, modelId)) return true;
+  const slash = modelId.indexOf("/");
+  if (slash <= 0) return false;
+  const providerName = modelId.slice(0, slash);
+  const rest = modelId.slice(slash + 1);
+  if (providerName !== OPENAI_CODEX_PROVIDER_ID || !isBareOpenAiFamilyModel(rest)) return false;
+  const provider = config.providers?.[OPENAI_CODEX_PROVIDER_ID];
+  return !provider || isCanonicalOpenAiForwardProvider({
+    ...provider,
+    ...(provider.authMode === undefined ? { authMode: "forward" as const } : {}),
+  });
+}
+
+/**
+ * What one rewritten request carries so the log can show the model the client asked for
+ * while the pipeline routes the fallback. The rewrite happens before combo dispatch reads
+ * `model`, so the rest of the pipeline sees an ordinary request for the target selector.
+ */
+export interface MainHardLockFallbackOverride {
+  sourceModel: string;
+  targetModel: string;
+}
+
+function rawModelOf(body: unknown): { raw: Record<string, unknown>; model: string } | undefined {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return undefined;
+  const raw = body as Record<string, unknown>;
+  return typeof raw.model === "string" && raw.model.trim().length > 0
+    ? { raw, model: raw.model }
+    : undefined;
+}
+
+/**
+ * Extended main-account hard-lock settings: when the lock blocks and no Codex account can
+ * serve the request, rewrite it to the configured fallback model instead of letting the
+ * dispatch refuse.
+ *
+ * Every guard bounds the rewrite to exactly the traffic the lock would otherwise fail, so
+ * the setting can never widen what the lock protects:
+ *
+ * - The lock must be enabled AND reading `blocked` right now — `ready`, `unknown` and the
+ *   explicit opt-out all admit, and the release is this same observation, so the reroute
+ *   ends on its own the moment the blocking windows drop below their thresholds.
+ * - `getEligiblePoolAccounts` is the selection choke point the dispatch itself consults,
+ *   so "the pool can serve it" is one shared answer, not a second opinion: a usable pool
+ *   account (or any eligible account) keeps the request on Codex, and a pool drained to
+ *   empty is what makes the fallback the request's only way through. The main account is
+ *   already excluded there while blocked.
+ * - Only bare Codex-native selectors qualify. Provider-qualified rows, combos, account
+ *   namespaces and policy routes name their own destination on purpose; rewriting those
+ *   would override an explicit choice, so they keep the lock's refusal.
+ * - A Codex-native fallback target is refused outright: rerouting gpt-* to gpt-* would
+ *   re-enter the same refusal, and the honest behavior is the refusal, not a loop.
+ * - Luna Reserve keeps its own admission policy (`assertReserveAdmission`); its helper
+ *   traffic is not operator chat and must not silently change models.
+ */
+export function applyMainHardLockFallbackOverride(
+  body: unknown,
+  config: OcxConfig,
+  now = Date.now(),
+): MainHardLockFallbackOverride | null {
+  const parsed = rawModelOf(body);
+  if (!parsed) return null;
+  const fallback = resolveMainAccountHardLockFallback(config);
+  if (!fallback) return null;
+  if (targetsBlockedCanonicalOpenAi(config, fallback.model)) return null;
+  if (!isBareOpenAiFamilyModel(parsed.model)
+    || parsed.model === NATIVE_RESERVE_MODEL
+    || isConfiguredComboSelector(config, parsed.model)) return null;
+  if (getMainAccountHardLockStatus(config, now).state !== "blocked") return null;
+  const accountMode = providerCodexAccountMode(
+    OPENAI_CODEX_PROVIDER_ID,
+    config.providers?.[OPENAI_CODEX_PROVIDER_ID],
+  );
+  if (accountMode !== "direct"
+    && getEligiblePoolAccounts(config, undefined, now, codexQuotaScopeForModel(parsed.model)).length > 0) {
+    return null;
+  }
+
+  parsed.raw.model = fallback.model;
+  if (fallback.reasoningEffort !== undefined) {
+    const reasoning = parsed.raw.reasoning;
+    parsed.raw.reasoning = {
+      ...(reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)
+        ? reasoning as Record<string, unknown>
+        : {}),
+      effort: fallback.reasoningEffort,
+    };
+  }
+  return { sourceModel: parsed.model, targetModel: fallback.model };
+}

package/src/server/responses/native-response-control.ts

@@ -4,6 +4,7 @@ import type { NativeSteeringReplayObserver } from "./native-steering-replay";
 import type { ProviderExecutedCallType } from "../responses-undeclared-tool-guard";
 
 import { isInjectionRequest } from "./native-injection-protocol";
+import { registerProviderResponseProvenance } from "../../providers/request-pacing";
 
 /** Shared transport ownership, not a shared steer/inject protocol state machine. */
 export interface NativeResponseControl {
@@ -25,9 +26,10 @@ export interface NativeResponseControl {
 
 export const OPENAI_API_RESPONSES_URL = "https://api.openai.com/v1/responses";
 
-const nativeControlResponses = new WeakSet<Response>();
+const nativeControlResponses = new WeakMap<Response, true>();
+registerProviderResponseProvenance(nativeControlResponses);
 /** Mark the exact response for multi-response delivery without serializing a wire field. */
-export function markNativeControlResponse(response: Response): Response { nativeControlResponses.add(response); return response; }
+export function markNativeControlResponse(response: Response): Response { nativeControlResponses.set(response, true); return response; }
 /** Recognize a marked native response by identity, not by caller-controlled content. */
 export function isNativeControlResponse(response: Response): boolean { return nativeControlResponses.has(response); }
 

package/src/server/responses/passthrough-delivery.ts

@@ -58,6 +58,7 @@ import {
   hasResponsesSnapshotRepair,
   createResponsesSnapshotBlockRewrite,
 } from "../responses-snapshot-repair";
+import { rewriteResponsesIncompleteReasonJson } from "../../responses/incomplete-reason";
 import { createResponsesModelPayloadRewrite, rewriteResponsesModelJson } from "../responses-model-rewrite";
 import { createImageGenCallRestoreRewrite, restoreImageGenCallsInJson } from "../responses-image-gen-repair";
 import {
@@ -108,6 +109,7 @@ import { createResponsesFunctionToolRepairBlockRewrite } from "../responses-func
 import {
   createUndeclaredToolCallGuardBlockRewrite,
   currentTurnWireToolCatalogBody,
+  UNDECLARED_TOOL_CALL_ERROR_CODE,
   undeclaredToolCallNameInResponse,
   undeclaredToolCallMessage,
   normalizeDefaultNamespaceInJson,
@@ -437,8 +439,7 @@ export async function deliverPassthroughResponse(
     normalizeFunctionCompletionJson,
   } = nativeExchange;
   const { commitReasoningReplayServingRoute, recordTerminalOutcomes } = responseEffects;
-  const { parsed, subagentQuotaFailureModel, clientRequestedStream, translatorBudget, inboundWire } = requestState;
-  const enforceDeclaredToolNames = inboundWire !== "chat" && inboundWire !== "anthropic";
+  const { parsed, subagentQuotaFailureModel, clientRequestedStream, translatorBudget } = requestState;
   const { openAiSidecar } = sidecarState;
   const { requestBindings } = transportState;
 
@@ -768,6 +769,7 @@ export async function deliverPassthroughResponse(
         : undefined;
       // Compose opt-in payload rewrites into one parse/stringify pass (image-gen restore first).
       const payloadRewrites = [
+        rewriteResponsesIncompleteReasonJson,
         createImageGenCallRestoreRewrite(imageGenCallAliases),
         // #3217: a call whose namespace repeats its own name is unroutable in codex-rs.
         createSelfNamedToolCallNamespaceScrubRewrite(selfNamedNamespaceScrubAuthorization),
@@ -857,14 +859,17 @@ export async function deliverPassthroughResponse(
           : undefined,
         // Last: every rewrite above can still rename or reshape a call item, so the guard must
         // compare the names the client will actually receive against the declared catalog.
-        nativeExchange.undeclaredToolGuardActive
+        // Deferred-catalog wires keep the rewrite for its normalization half only: a provider's
+        // `default.X` call still collapses to the declared `X`, but an undeclared name is the
+        // client's own deferred registry's business, not this proxy's verdict.
+        nativeExchange.undeclaredToolGuardActive || declaredWireToolNames.size > 0
           ? createUndeclaredToolCallGuardBlockRewrite(
             declaredWireToolNames,
             declaredNamelessClientCallTypes,
             providerExecutedCallTypes,
             declaredBareWireToolNames,
             recoverableBareCustomWireToolNames,
-            enforceDeclaredToolNames,
+            { refuseUndeclared: nativeExchange.undeclaredToolGuardActive },
           )
           : undefined,
         grokUpstreamEchoEnabled
@@ -1314,7 +1319,7 @@ export async function deliverPassthroughResponse(
         const modelRewritten = parsed._responseModelId !== undefined && parsed._responseModelId !== parsed.modelId
           ? rewriteResponsesModelJson(repaired, parsed._responseModelId)
           : repaired;
-        return modelRewritten;
+        return rewriteResponsesIncompleteReasonJson(modelRewritten);
       })();
       if (plaintextV2RestoreFailed) {
         return formatErrorResponse(502, "upstream_error", PLAINTEXT_V2_AGENT_MESSAGE_RESTORE_OVERFLOW_MESSAGE);
@@ -1322,10 +1327,7 @@ export async function deliverPassthroughResponse(
       if (grokUpstreamEchoEnabled) {
         clientJson = stripGrokUpstreamEnvelopeEchoFromResponsesJson(clientJson);
       }
-      // #1700: same inbound-wire refusal policy as the SSE relay above. Both the plain JSON answer and
-      // the reframed-SSE branch below are built from this body, so one check covers them. This
-      // runs BEFORE the continuation cache write below: a refused turn must not become state a
-      // later `previous_response_id` replay can expand from.
+      // Both response formats use this body, before a refused turn can enter continuation state.
       if (nativeExchange.undeclaredToolGuardActive) {
         const undeclared = (() => {
           try {
@@ -1341,9 +1343,15 @@ export async function deliverPassthroughResponse(
             return undefined;
           }
         })();
-        if (enforceDeclaredToolNames && undeclared !== undefined) {
-          return formatErrorResponse(502, "upstream_error", undeclaredToolCallMessage(undeclared));
+        if (undeclared !== undefined) {
+          return formatErrorResponse(502, "upstream_error", undeclaredToolCallMessage(undeclared), {
+            code: UNDECLARED_TOOL_CALL_ERROR_CODE,
+          });
         }
+      }
+      // Same split as the SSE rewrite: normalization applies whenever a declared name exists,
+      // even on wires whose deferred catalog stands the refusal down.
+      if (declaredWireToolNames.size > 0) {
         clientJson = normalizeDefaultNamespaceInJson(
           clientJson,
           declaredWireToolNames,

package/src/server/responses/passthrough-dispatch.ts

@@ -1,4 +1,6 @@
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
+import { requestPacingOverloadResponse } from "./pacing-overload";
+import { recordDistributedResponseFailure } from "../../providers/api-key-response-ownership";
 import { createSteeringSettingsNormalizer } from "./native-steering-policy";
 import { nativeResponseControlEligible } from "./native-response-control";
 import { NativeInjectionReplay } from "./native-injection-replay";
@@ -21,6 +23,7 @@ import { imageGenToolCallAliases } from "../responses-image-gen-repair";
 import { rememberResponseState, isBodyNonPersistable } from "../../responses/state";
 import {
   currentTurnWireToolCatalogBody,
+  hasExplicitEmptyToolCatalog,
   hasExplicitWireToolCatalog,
   collectDeclaredWireToolNames,
   collectDeclaredBareWireToolNames,
@@ -140,7 +143,7 @@ import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { refreshPoolForwardAuth, refreshNativeMainForwardAuth, withClaudeNativeSession } from "./core-auth";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import type { OAuthAccessSnapshot } from "../../oauth";
-import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { OAuthAccountPausedError, OAuthLoginRequiredError, OAuthTokenRefreshBusyError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
 import { AnthropicAccountCooldownError } from "../../oauth/anthropic-routing";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
@@ -153,7 +156,7 @@ import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import {
   attemptOpaqueBlobRecovery,
-  isEncryptedFunctionOutputRejection,
+  isEncryptedFunctionOutputRejection, retainedReasoningStreamCandidate, retainedReasoningStreamRejection,
   outboundResponsesBodyCarriesEncryptedFunctionOutput,
   resetStreamedOpaqueBlobLogContext,
   consoleGoUploadRejectionBody,
@@ -187,6 +190,7 @@ export async function preparePassthroughExchange(
     | "selectedForwardHeaders"
     | "clientRequestedStream"
     | "inboundWire"
+    | "clientDeclaredEmptyToolCatalog"
     | "substituteMainCredential"
     | "callerAuthHeaders"
     | "subagentFallbackAccountId"
@@ -253,6 +257,7 @@ export async function preparePassthroughExchange(
     responseStateOptions,
     clientRequestedStream,
     inboundWire,
+    clientDeclaredEmptyToolCatalog,
     substituteMainCredential,
     callerAuthHeaders,
   } = requestState;
@@ -531,10 +536,18 @@ export async function preparePassthroughExchange(
           declaredWireToolNames.add(name);
         }
       }
+      // Chat and Anthropic inbounds may deliver tools deferred/partially: their client registry
+      // owns the full catalog, so this guard cannot read the translated body as the authorization
+      // boundary. An explicit empty catalog — flagged by the translating ingress or present
+      // verbatim in a replayed body — is still a deny-all the caller declared; everything else
+      // stays deferred to the caller's own tool handling.
       undeclaredToolGuardActive = (
-        declaredWireToolNames.size > 0
-        || clientDeclaredNamelessCallTypes.size > 0
-        || clientExplicitWireToolCatalog
+        inboundWire === "responses"
+          ? declaredWireToolNames.size > 0
+            || clientDeclaredNamelessCallTypes.size > 0
+            || clientExplicitWireToolCatalog
+          : clientDeclaredEmptyToolCatalog
+            || hasExplicitEmptyToolCatalog(clientToolAuthorizationBody)
       ) && route.provider.authMode !== "forward";
       options.nativeControl?.configureToolAuthorization?.(
         undeclaredToolGuardActive,
@@ -731,7 +744,9 @@ export async function preparePassthroughExchange(
       const stage = readCodexWsStage(response);
       if (stage && logCtx.activeAttempt) logCtx.activeAttempt.codexWsStage = stage;
     };
+    let upstreamResponse: Response, lastDistributedResponse: Response | undefined;
     const adoptObservedResponse = <T extends Response>(response: T): T => {
+      if (!isNonReplayableResponse(response)) lastDistributedResponse = response.status === 401 || response.status === 429 ? response : undefined;
       settleObservedHostResponse();
       adoptCodexWsStage(response);
       return response;
@@ -748,7 +763,6 @@ export async function preparePassthroughExchange(
     const upstream = new AbortController();
     const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal ?? req.signal);
     const connectMs = config.connectTimeoutMs ?? 200_000;
-    let upstreamResponse: Response;
     /**
      * This leg's transient-5xx ladder cap, from the provider's own `transientRetryOn5xx`.
      *
@@ -881,7 +895,6 @@ export async function preparePassthroughExchange(
     ): Response | undefined => {
       const result = checkOutboundBodySize(builtRequest.body, config.maxUpstreamBodyBytes);
       if (result.admitted) return undefined;
-
       // This returns before the surrounding fetch/finally owns the observation, so release
       // it here or one refused body holds translator budget for the process lifetime.
       builtRequest.releaseBodyObservation?.();
@@ -919,6 +932,7 @@ export async function preparePassthroughExchange(
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
         return clientCancelledResponse();
       }
+      if (lastDistributedResponse) recordDistributedResponseFailure(lastDistributedResponse, config, route.providerName, options.abortSignal);
       // A budget refusal is a proxy decision, not an upstream fault. Reporting it as
       // 502 upstream_error would blame the provider for a limit this process applied, and
       // would record a fake reachability failure against the account's health.
@@ -934,12 +948,12 @@ export async function preparePassthroughExchange(
         bindRefreshedAdapter(refusal.adapter);
         return handoffToChat(refusal.adapter);
       }
-      const copilotRefusal = copilotRefusalResponse(refusal);
-      if (copilotRefusal) {
+      const dispatchRefusal = requestPacingOverloadResponse(refusal) ?? copilotRefusalResponse(refusal);
+      if (dispatchRefusal) {
         releaseUpstreamHostAdmission(nativeHostState.lease);
         nativeHostState.lease = null;
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
-        return copilotRefusal;
+        return dispatchRefusal;
       }
       // Pacing may outlive the selected account's admission. No fetch occurred, so do
       // not turn an operator pause into a 502 or charge it to host/account health.
@@ -1195,7 +1209,6 @@ export async function preparePassthroughExchange(
 
     // Keep recovery kinds in sync with the generic `recovery:` loop below.
     passthroughRecovery: for (;;) {
-
     if (
       upstreamResponse.status === 401
       && (admissionState.authCtx.kind === "main-pool" || admissionState.authCtx.kind === "pool")
@@ -1347,6 +1360,8 @@ export async function preparePassthroughExchange(
       } catch (err) {
         upstream.abort();
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
+        if (options.abortSignal?.aborted || req.signal.aborted) return clientCancelledResponse();
+        if (err instanceof OAuthTokenRefreshBusyError) return formatErrorResponse(503, "server_error", publicOAuthAuthenticationErrorMessage(err), { retryAfter: "1" });
         return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(err));
       }
       if (route.provider.googleMode === "cloud-code-assist" && !refreshed.projectId) {
@@ -1515,7 +1530,6 @@ export async function preparePassthroughExchange(
         )) noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
       }
     }
-
     // Same-target 429 wait-and-retry (opt-in `retryOn429`) for key-auth providers on the
     // passthrough wire. This branch returns before the recovery loop below, so Responses-shaped
     // key-auth gateways (e.g. the built-in DeepSeek preset) would otherwise surface 429
@@ -1586,7 +1600,6 @@ export async function preparePassthroughExchange(
         return transportFailureResponse(err);
       }
     }
-
     const captureAffinityResponse = (
       response: Response,
       captureAuthCtx: CodexAuthContext = admissionState.authCtx,
@@ -1608,8 +1621,8 @@ export async function preparePassthroughExchange(
         status: response.status,
       });
     };
+    recordDistributedResponseFailure(lastDistributedResponse ?? upstreamResponse, config, route.providerName, options.abortSignal);
     captureAffinityResponse(upstreamResponse);
-
     if (usesCodexForwardPoolAuth(admissionState.authCtx, route.provider)) {
       let poolRetryOutcome: number | undefined;
       // A success is the freshest evidence there is about this pair, and it outranks any earlier
@@ -1738,7 +1751,7 @@ export async function preparePassthroughExchange(
       && (recoveryContentType.includes("text/event-stream") || (!recoveryContentType && upstreamRequestsStream))
       && !opaqueBlobRecoveryGuard.attempted
       && !configuredTransientSendBudgetExhausted()
-      && outboundResponsesBodyCarriesEncryptedFunctionOutput(request.body);
+      && (outboundResponsesBodyCarriesEncryptedFunctionOutput(request.body) || (!sendBudgetState.ambiguousResendSpent && retainedReasoningStreamCandidate(parsed, request.body)));
     if (streamedFunctionOutputCandidate) {
       const preflightLog: RequestLogContext = { model: logCtx.model, provider: logCtx.provider };
       const preflight = await preflightComboStreamResponse(upstreamResponse, preflightLog,
@@ -1751,7 +1764,7 @@ export async function preparePassthroughExchange(
           // intentionally understands only Responses error/message fields. Preserve only this
           // exact identity so the projected 502 can enter the existing single-shot recovery.
           if (decryptRejection) preflightLog.upstreamError = ENCRYPTED_FUNCTION_OUTPUT_REJECTION;
-          return decryptRejection;
+          return decryptRejection || (!sendBudgetState.ambiguousResendSpent && retainedReasoningStreamRejection(payload, parsed, request.body, preflightLog));
         }, {
           allowMissingContentType: !recoveryContentType && upstreamRequestsStream,
           replayReadErrors: true,