@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/server/responses/main-hard-lock-routing.ts

@@ -0,0 +1,109 @@
+import type { OcxConfig } from "../../types";
+import { resolveComboId } from "../../combos";
+import { isBareOpenAiFamilyModel } from "../../router";
+import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
+import {
+  getMainAccountHardLockStatus,
+  resolveMainAccountHardLockFallback,
+} from "../../codex/main-account-hard-lock";
+import { codexQuotaScopeForModel } from "../../codex/routing/health-store";
+import { getEligiblePoolAccounts } from "../../codex/routing/selection";
+import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { providerCodexAccountMode } from "../../providers/registry";
+
+function isConfiguredComboSelector(config: OcxConfig, modelId: string): boolean {
+  const comboId = resolveComboId(config, modelId);
+  return Boolean(comboId && Object.hasOwn(config.combos ?? {}, comboId));
+}
+
+function targetsBlockedCanonicalOpenAi(config: OcxConfig, modelId: string): boolean {
+  if (isBareOpenAiFamilyModel(modelId) && !isConfiguredComboSelector(config, modelId)) return true;
+  const slash = modelId.indexOf("/");
+  if (slash <= 0) return false;
+  const providerName = modelId.slice(0, slash);
+  const rest = modelId.slice(slash + 1);
+  if (providerName !== OPENAI_CODEX_PROVIDER_ID || !isBareOpenAiFamilyModel(rest)) return false;
+  const provider = config.providers?.[OPENAI_CODEX_PROVIDER_ID];
+  return !provider || isCanonicalOpenAiForwardProvider({
+    ...provider,
+    ...(provider.authMode === undefined ? { authMode: "forward" as const } : {}),
+  });
+}
+
+/**
+ * What one rewritten request carries so the log can show the model the client asked for
+ * while the pipeline routes the fallback. The rewrite happens before combo dispatch reads
+ * `model`, so the rest of the pipeline sees an ordinary request for the target selector.
+ */
+export interface MainHardLockFallbackOverride {
+  sourceModel: string;
+  targetModel: string;
+}
+
+function rawModelOf(body: unknown): { raw: Record<string, unknown>; model: string } | undefined {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return undefined;
+  const raw = body as Record<string, unknown>;
+  return typeof raw.model === "string" && raw.model.trim().length > 0
+    ? { raw, model: raw.model }
+    : undefined;
+}
+
+/**
+ * Extended main-account hard-lock settings: when the lock blocks and no Codex account can
+ * serve the request, rewrite it to the configured fallback model instead of letting the
+ * dispatch refuse.
+ *
+ * Every guard bounds the rewrite to exactly the traffic the lock would otherwise fail, so
+ * the setting can never widen what the lock protects:
+ *
+ * - The lock must be enabled AND reading `blocked` right now — `ready`, `unknown` and the
+ *   explicit opt-out all admit, and the release is this same observation, so the reroute
+ *   ends on its own the moment the blocking windows drop below their thresholds.
+ * - `getEligiblePoolAccounts` is the selection choke point the dispatch itself consults,
+ *   so "the pool can serve it" is one shared answer, not a second opinion: a usable pool
+ *   account (or any eligible account) keeps the request on Codex, and a pool drained to
+ *   empty is what makes the fallback the request's only way through. The main account is
+ *   already excluded there while blocked.
+ * - Only bare Codex-native selectors qualify. Provider-qualified rows, combos, account
+ *   namespaces and policy routes name their own destination on purpose; rewriting those
+ *   would override an explicit choice, so they keep the lock's refusal.
+ * - A Codex-native fallback target is refused outright: rerouting gpt-* to gpt-* would
+ *   re-enter the same refusal, and the honest behavior is the refusal, not a loop.
+ * - Luna Reserve keeps its own admission policy (`assertReserveAdmission`); its helper
+ *   traffic is not operator chat and must not silently change models.
+ */
+export function applyMainHardLockFallbackOverride(
+  body: unknown,
+  config: OcxConfig,
+  now = Date.now(),
+): MainHardLockFallbackOverride | null {
+  const parsed = rawModelOf(body);
+  if (!parsed) return null;
+  const fallback = resolveMainAccountHardLockFallback(config);
+  if (!fallback) return null;
+  if (targetsBlockedCanonicalOpenAi(config, fallback.model)) return null;
+  if (!isBareOpenAiFamilyModel(parsed.model)
+    || parsed.model === NATIVE_RESERVE_MODEL
+    || isConfiguredComboSelector(config, parsed.model)) return null;
+  if (getMainAccountHardLockStatus(config, now).state !== "blocked") return null;
+  const accountMode = providerCodexAccountMode(
+    OPENAI_CODEX_PROVIDER_ID,
+    config.providers?.[OPENAI_CODEX_PROVIDER_ID],
+  );
+  if (accountMode !== "direct"
+    && getEligiblePoolAccounts(config, undefined, now, codexQuotaScopeForModel(parsed.model)).length > 0) {
+    return null;
+  }
+
+  parsed.raw.model = fallback.model;
+  if (fallback.reasoningEffort !== undefined) {
+    const reasoning = parsed.raw.reasoning;
+    parsed.raw.reasoning = {
+      ...(reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)
+        ? reasoning as Record<string, unknown>
+        : {}),
+      effort: fallback.reasoningEffort,
+    };
+  }
+  return { sourceModel: parsed.model, targetModel: fallback.model };
+}

package/src/server/responses/native-response-control.ts

@@ -4,6 +4,7 @@ import type { NativeSteeringReplayObserver } from "./native-steering-replay";
 import type { ProviderExecutedCallType } from "../responses-undeclared-tool-guard";
 
 import { isInjectionRequest } from "./native-injection-protocol";
+import { registerProviderResponseProvenance } from "../../providers/request-pacing";
 
 /** Shared transport ownership, not a shared steer/inject protocol state machine. */
 export interface NativeResponseControl {
@@ -25,9 +26,10 @@ export interface NativeResponseControl {
 
 export const OPENAI_API_RESPONSES_URL = "https://api.openai.com/v1/responses";
 
-const nativeControlResponses = new WeakSet<Response>();
+const nativeControlResponses = new WeakMap<Response, true>();
+registerProviderResponseProvenance(nativeControlResponses);
 /** Mark the exact response for multi-response delivery without serializing a wire field. */
-export function markNativeControlResponse(response: Response): Response { nativeControlResponses.add(response); return response; }
+export function markNativeControlResponse(response: Response): Response { nativeControlResponses.set(response, true); return response; }
 /** Recognize a marked native response by identity, not by caller-controlled content. */
 export function isNativeControlResponse(response: Response): boolean { return nativeControlResponses.has(response); }
 

package/src/server/responses/passthrough-delivery.ts

@@ -58,6 +58,7 @@ import {
   hasResponsesSnapshotRepair,
   createResponsesSnapshotBlockRewrite,
 } from "../responses-snapshot-repair";
+import { rewriteResponsesIncompleteReasonJson } from "../../responses/incomplete-reason";
 import { createResponsesModelPayloadRewrite, rewriteResponsesModelJson } from "../responses-model-rewrite";
 import { createImageGenCallRestoreRewrite, restoreImageGenCallsInJson } from "../responses-image-gen-repair";
 import {
@@ -768,6 +769,7 @@ export async function deliverPassthroughResponse(
         : undefined;
       // Compose opt-in payload rewrites into one parse/stringify pass (image-gen restore first).
       const payloadRewrites = [
+        rewriteResponsesIncompleteReasonJson,
         createImageGenCallRestoreRewrite(imageGenCallAliases),
         // #3217: a call whose namespace repeats its own name is unroutable in codex-rs.
         createSelfNamedToolCallNamespaceScrubRewrite(selfNamedNamespaceScrubAuthorization),
@@ -1317,7 +1319,7 @@ export async function deliverPassthroughResponse(
         const modelRewritten = parsed._responseModelId !== undefined && parsed._responseModelId !== parsed.modelId
           ? rewriteResponsesModelJson(repaired, parsed._responseModelId)
           : repaired;
-        return modelRewritten;
+        return rewriteResponsesIncompleteReasonJson(modelRewritten);
       })();
       if (plaintextV2RestoreFailed) {
         return formatErrorResponse(502, "upstream_error", PLAINTEXT_V2_AGENT_MESSAGE_RESTORE_OVERFLOW_MESSAGE);

package/src/server/responses/passthrough-dispatch.ts

@@ -1,4 +1,6 @@
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
+import { requestPacingOverloadResponse } from "./pacing-overload";
+import { recordDistributedResponseFailure } from "../../providers/api-key-response-ownership";
 import { createSteeringSettingsNormalizer } from "./native-steering-policy";
 import { nativeResponseControlEligible } from "./native-response-control";
 import { NativeInjectionReplay } from "./native-injection-replay";
@@ -141,7 +143,7 @@ import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { refreshPoolForwardAuth, refreshNativeMainForwardAuth, withClaudeNativeSession } from "./core-auth";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import type { OAuthAccessSnapshot } from "../../oauth";
-import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { OAuthAccountPausedError, OAuthLoginRequiredError, OAuthTokenRefreshBusyError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
 import { AnthropicAccountCooldownError } from "../../oauth/anthropic-routing";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
@@ -154,7 +156,7 @@ import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import {
   attemptOpaqueBlobRecovery,
-  isEncryptedFunctionOutputRejection,
+  isEncryptedFunctionOutputRejection, retainedReasoningStreamCandidate, retainedReasoningStreamRejection,
   outboundResponsesBodyCarriesEncryptedFunctionOutput,
   resetStreamedOpaqueBlobLogContext,
   consoleGoUploadRejectionBody,
@@ -742,7 +744,9 @@ export async function preparePassthroughExchange(
       const stage = readCodexWsStage(response);
       if (stage && logCtx.activeAttempt) logCtx.activeAttempt.codexWsStage = stage;
     };
+    let upstreamResponse: Response, lastDistributedResponse: Response | undefined;
     const adoptObservedResponse = <T extends Response>(response: T): T => {
+      if (!isNonReplayableResponse(response)) lastDistributedResponse = response.status === 401 || response.status === 429 ? response : undefined;
       settleObservedHostResponse();
       adoptCodexWsStage(response);
       return response;
@@ -759,7 +763,6 @@ export async function preparePassthroughExchange(
     const upstream = new AbortController();
     const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal ?? req.signal);
     const connectMs = config.connectTimeoutMs ?? 200_000;
-    let upstreamResponse: Response;
     /**
      * This leg's transient-5xx ladder cap, from the provider's own `transientRetryOn5xx`.
      *
@@ -892,7 +895,6 @@ export async function preparePassthroughExchange(
     ): Response | undefined => {
       const result = checkOutboundBodySize(builtRequest.body, config.maxUpstreamBodyBytes);
       if (result.admitted) return undefined;
-
       // This returns before the surrounding fetch/finally owns the observation, so release
       // it here or one refused body holds translator budget for the process lifetime.
       builtRequest.releaseBodyObservation?.();
@@ -930,6 +932,7 @@ export async function preparePassthroughExchange(
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
         return clientCancelledResponse();
       }
+      if (lastDistributedResponse) recordDistributedResponseFailure(lastDistributedResponse, config, route.providerName, options.abortSignal);
       // A budget refusal is a proxy decision, not an upstream fault. Reporting it as
       // 502 upstream_error would blame the provider for a limit this process applied, and
       // would record a fake reachability failure against the account's health.
@@ -945,12 +948,12 @@ export async function preparePassthroughExchange(
         bindRefreshedAdapter(refusal.adapter);
         return handoffToChat(refusal.adapter);
       }
-      const copilotRefusal = copilotRefusalResponse(refusal);
-      if (copilotRefusal) {
+      const dispatchRefusal = requestPacingOverloadResponse(refusal) ?? copilotRefusalResponse(refusal);
+      if (dispatchRefusal) {
         releaseUpstreamHostAdmission(nativeHostState.lease);
         nativeHostState.lease = null;
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
-        return copilotRefusal;
+        return dispatchRefusal;
       }
       // Pacing may outlive the selected account's admission. No fetch occurred, so do
       // not turn an operator pause into a 502 or charge it to host/account health.
@@ -1206,7 +1209,6 @@ export async function preparePassthroughExchange(
 
     // Keep recovery kinds in sync with the generic `recovery:` loop below.
     passthroughRecovery: for (;;) {
-
     if (
       upstreamResponse.status === 401
       && (admissionState.authCtx.kind === "main-pool" || admissionState.authCtx.kind === "pool")
@@ -1358,6 +1360,8 @@ export async function preparePassthroughExchange(
       } catch (err) {
         upstream.abort();
         releaseCodexAuthContextProbeLease(admissionState.authCtx);
+        if (options.abortSignal?.aborted || req.signal.aborted) return clientCancelledResponse();
+        if (err instanceof OAuthTokenRefreshBusyError) return formatErrorResponse(503, "server_error", publicOAuthAuthenticationErrorMessage(err), { retryAfter: "1" });
         return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(err));
       }
       if (route.provider.googleMode === "cloud-code-assist" && !refreshed.projectId) {
@@ -1526,7 +1530,6 @@ export async function preparePassthroughExchange(
         )) noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
       }
     }
-
     // Same-target 429 wait-and-retry (opt-in `retryOn429`) for key-auth providers on the
     // passthrough wire. This branch returns before the recovery loop below, so Responses-shaped
     // key-auth gateways (e.g. the built-in DeepSeek preset) would otherwise surface 429
@@ -1597,7 +1600,6 @@ export async function preparePassthroughExchange(
         return transportFailureResponse(err);
       }
     }
-
     const captureAffinityResponse = (
       response: Response,
       captureAuthCtx: CodexAuthContext = admissionState.authCtx,
@@ -1619,8 +1621,8 @@ export async function preparePassthroughExchange(
         status: response.status,
       });
     };
+    recordDistributedResponseFailure(lastDistributedResponse ?? upstreamResponse, config, route.providerName, options.abortSignal);
     captureAffinityResponse(upstreamResponse);
-
     if (usesCodexForwardPoolAuth(admissionState.authCtx, route.provider)) {
       let poolRetryOutcome: number | undefined;
       // A success is the freshest evidence there is about this pair, and it outranks any earlier
@@ -1749,7 +1751,7 @@ export async function preparePassthroughExchange(
       && (recoveryContentType.includes("text/event-stream") || (!recoveryContentType && upstreamRequestsStream))
       && !opaqueBlobRecoveryGuard.attempted
       && !configuredTransientSendBudgetExhausted()
-      && outboundResponsesBodyCarriesEncryptedFunctionOutput(request.body);
+      && (outboundResponsesBodyCarriesEncryptedFunctionOutput(request.body) || (!sendBudgetState.ambiguousResendSpent && retainedReasoningStreamCandidate(parsed, request.body)));
     if (streamedFunctionOutputCandidate) {
       const preflightLog: RequestLogContext = { model: logCtx.model, provider: logCtx.provider };
       const preflight = await preflightComboStreamResponse(upstreamResponse, preflightLog,
@@ -1762,7 +1764,7 @@ export async function preparePassthroughExchange(
           // intentionally understands only Responses error/message fields. Preserve only this
           // exact identity so the projected 502 can enter the existing single-shot recovery.
           if (decryptRejection) preflightLog.upstreamError = ENCRYPTED_FUNCTION_OUTPUT_REJECTION;
-          return decryptRejection;
+          return decryptRejection || (!sendBudgetState.ambiguousResendSpent && retainedReasoningStreamRejection(payload, parsed, request.body, preflightLog));
         }, {
           allowMissingContentType: !recoveryContentType && upstreamRequestsStream,
           replayReadErrors: true,

package/src/server/responses/passthrough-execution.ts

@@ -14,6 +14,7 @@ import { guardDirectPassthroughBodyInactivity } from "../../lib/response-body-in
 import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
+import { attachResponseToolOwnership } from "./response-tool-ownership";
 
 /** Owns the native host lease across dispatch, recovery, and response construction. */
 export async function executePassthroughResponse(
@@ -50,11 +51,11 @@ export async function executePassthroughResponse(
     // Delivery has already classified SSE (including a missing upstream content type)
     // and consumed bounded JSON/errors. Guard only its remaining direct body, outside
     // the relay/lifetime wrappers so their prefetch cannot arm our inactivity clock.
-    return guardDirectPassthroughBodyInactivity(
+    return attachResponseToolOwnership(guardDirectPassthroughBodyInactivity(
       response,
       nativeExchange.upstream.signal,
       resolveStallTimeoutMs(requestContext.config.stallTimeoutSec, { localUpstream: nativeExchange.localUpstream }),
-    );
+    ), nativeExchange.providerExecutedCallTypes);
   } finally {
     if (nativeHostState.lease) {
       releaseUpstreamHostAdmission(nativeHostState.lease);

package/src/server/responses/request-prepare.ts

@@ -17,7 +17,7 @@ import {
   unreadableEncryptedAgentTaskResponse,
 } from "./core-errors";
 import { parseSyntheticRowId } from "../fast-row";
-import { resolveComboId, comboIdFromRawBody, NoAvailableComboTargetsError } from "../../combos";
+import { resolveComboId, comboIdFromRawBody, comboExclusionReasons, NoAvailableComboTargetsError, pickComboTarget } from "../../combos";
 import { INTERCEPT_TARGET_UNAVAILABLE_CODE, interceptTargetUnavailableResponse, resolveChosenTarget, resolveShadowCallTarget } from "./shadow-target-availability";
 import {
   MEMORY_MODEL_TARGET_UNAVAILABLE_CODE,
@@ -84,6 +84,7 @@ import {
 } from "../../router";
 import { evidenceFromBody } from "../../routing/request-evidence";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { resolveNativeReasoningRetention } from "../../config/schema/native-reasoning-retention";
 import { isThreadSpawnRequest } from "../effort-policy";
 import {
   resolveSubagentFallbackChain,
@@ -133,6 +134,7 @@ import {
 } from "../../codex/loopback-target";
 import { checkComboTargetInputAdmission, checkInputAdmission } from "./input-admission";
 import {
+  admissionMayUseMeteredComboTargets,
   admissionModelDeniedResponse,
   AdmissionModelDeniedError,
   assertRouteAllowedByScope,
@@ -140,6 +142,13 @@ import {
   routeAllowedByScope,
 } from "../admission-model-scope";
 import { nativeContextLimits } from "../../codex/catalog";
+import type { ClientToolCatalogRestriction } from "../../lib/empty-tool-catalog";
+import {
+  currentTurnWireToolCatalogBody,
+  hasExplicitEmptyToolCatalog,
+  collectDeclaredWireToolNames,
+  collectDeclaredBareCustomWireToolNames,
+} from "../responses-undeclared-tool-guard";
 import { streamingContextOverflowResponse } from "./context-overflow";
 import {
   preAuthUpstreamHostCircuitKey,
@@ -149,6 +158,7 @@ import {
 } from "./core-codex-account";
 import { acquireUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { applyCompactionRoutingOverride, compactionRoutingKeepsProviderIdentity } from "./compaction-routing";
+import { applyMainHardLockFallbackOverride } from "./main-hard-lock-routing";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import {
   conversationStateBindingFromAuth,
@@ -286,14 +296,14 @@ export async function prepareResponsesRequest(
       effort: comboEffortRow.effort,
     };
   }
+  const isCompactionTrigger = body !== null && typeof body === "object" && !Array.isArray(body)
+    && Array.isArray((body as { input?: unknown }).input)
+    && ((body as { input: unknown[] }).input).some((item: unknown) =>
+      typeof item === "object" && item !== null && (item as { type?: string }).type === "compaction_trigger");
   // Compaction may send the last client-visible bare model after a combo switch.
   // Configured selectors take precedence; otherwise recall before combo dispatch (#3891).
   if (!concreteSelection && !options.compactionRoutingOverride && body && typeof body === "object" && !Array.isArray(body)) {
     const rawModel = (body as { model?: unknown }).model;
-    const rawInput = (body as { input?: unknown }).input;
-    const isCompactionTrigger = Array.isArray(rawInput)
-      && rawInput.some((item: unknown) =>
-        typeof item === "object" && item !== null && (item as { type?: string }).type === "compaction_trigger");
     if (typeof rawModel === "string" && !rawModel.includes("/") && isCompactionTrigger
       && !comboRows.fastRow && !comboEffortRow
       && !resolveComboId(config, rawModel)) {
@@ -322,6 +332,7 @@ export async function prepareResponsesRequest(
     }
   }
   let shadowCallIntercepted = false;
+  let shadowCallMatches = false;
   // Luna is also selectable by users/children. Both intercept sites use the same
   // per-turn provenance; WS frames must not inherit the handshake's classification.
   const threadSpawn = isThreadSpawnRequest(req.headers);
@@ -331,6 +342,7 @@ export async function prepareResponsesRequest(
     const rawShadowModel = (body as { model?: unknown }).model;
     if (shadowIntercept?.enabled && shadowIntercept.model && typeof rawShadowModel === "string"
       && isShadowSourceModel(rawShadowModel, shadowIntercept.sourceModels)) {
+      shadowCallMatches = true;
       const shadowComboId = resolveComboId(config, shadowIntercept.model);
       if (shadowComboId && Object.hasOwn(config.combos ?? {}, shadowComboId)) {
         shadowCallIntercepted = true;
@@ -344,6 +356,16 @@ export async function prepareResponsesRequest(
       }
     }
   }
+  // The hard-lock fallback owns ordinary turns only, and only after every more specific
+  // routing setting had its chance above: a shadow-intercepted, memory-phased, compaction
+  // or decision turn keeps its own destination, and an intercepted combo selector is
+  // already owned by the intercept. A spawned sub-agent turn names its model on purpose,
+  // the same reason the shadow intercept leaves it alone. Like the sites above it, this
+  // must run before comboIdFromRawBody reads `model`.
+  if (!concreteSelection && !options.compactionRoutingOverride && !isCompactionTrigger && !options.internalDecisionCall
+    && !shadowCallIntercepted && !shadowCallMatches && !memoryModelApplies && !threadSpawn && inboundWire === "responses") {
+    options.mainHardLockFallbackOverride = applyMainHardLockFallbackOverride(body, config);
+  }
   const comboId = !concreteSelection ? comboIdFromRawBody(body, config) : null;
   // A decision model may be a plain model or a non-JEV combo. A JEV combo here would recurse
   // into another decision, so the call is refused and the parent decision fails open.
@@ -430,15 +452,31 @@ export async function prepareResponsesRequest(
 
   let parsed: OcxParsedRequest;
   let toolBridgeMaps: ReturnType<typeof buildToolBridgeMaps>;
+  let clientToolCatalogRestriction: ClientToolCatalogRestriction | undefined;
   try {
     parsed = parseRequest(body);
     // Antigravity direct lane: the body carried only the request settings, so the parse above
     // produced them with an empty conversation; the conversation itself comes straight from the
     // client body. Inside this try so a decode error answers exactly like a parse error.
     if (options.directRequest) parsed = options.directRequest.decode(parsed);
+    parsed._nativeReasoningRetention = resolveNativeReasoningRetention(config);
+    // Capture before route rewrites or hosted sidecars can add tools; replayed catalogs are history.
+    // The direct settings body omits tools, including current legacy Chat functions. Recover
+    // their wire names only when this restriction needs a non-empty decoded catalog.
+    const catalogBody = options.directRequest && options.clientDeclaredEmptyToolCatalog === true && parsed.context.tools?.length
+      ? options.directRequest.bridgeConversation() : parsed._rawBody;
+    const currentCatalog = currentTurnWireToolCatalogBody(catalogBody, parsed._replayPrefixLen);
+    if (options.clientDeclaredEmptyToolCatalog === true || hasExplicitEmptyToolCatalog(currentCatalog)) {
+      clientToolCatalogRestriction = {
+        declaredToolNames: collectDeclaredWireToolNames(currentCatalog),
+        bareCustomToolNames: collectDeclaredBareCustomWireToolNames(currentCatalog),
+      };
+    }
     if (options.inboundWire === "anthropic") {
       parsed._nativeReasoningReplay = options.nativeReasoningReplay;
       parsed._nativeReasoningMint = options.nativeReasoningMint;
+      parsed._anthropicServerTools = options.anthropicServerTools;
+      parsed._anthropicServerReplay = options.anthropicServerReplay;
     }
     parsed._promptCacheKeyIsSharedCohort = options.promptCacheKeyIsSharedCohort;
     // The body may have been rebuilt since the inbound observation (previous-response
@@ -561,7 +599,10 @@ export async function prepareResponsesRequest(
   if (!logCtx.conversationId) {
     logCtx.conversationId = resolvedConversationId;
   }
-  logCtx.requestedModel = options.compactionRoutingOverride?.sourceModel ?? parsed.modelId;
+  // A rewritten turn logs the selector the client asked for, so the usage log never
+  // claims the operator typed the fallback model themselves.
+  logCtx.requestedModel = options.mainHardLockFallbackOverride?.sourceModel
+    ?? options.compactionRoutingOverride?.sourceModel ?? parsed.modelId;
   logCtx.requestedEffort = parsed.options.reasoning;
   // What this request may spend beyond its input, for the durable spend reservation (#4707).
   // Read from the caller rather than from the adapter's serialized body, because the
@@ -582,7 +623,7 @@ export async function prepareResponsesRequest(
   // The selector the caller actually sent, captured before shadow interception
   // or a subagent fallback rewrites it, so a refusal names the client's own
   // request rather than a destination it never asked for.
-  const inboundSelector = parsed.modelId;
+  const inboundSelector = options.mainHardLockFallbackOverride?.sourceModel ?? parsed.modelId;
   const selectorTargetsSecondary = (selector: string): boolean => {
     const slash = selector.indexOf("/");
     if (slash <= 0) return false;
@@ -602,6 +643,19 @@ export async function prepareResponsesRequest(
   }
   const admissionScope = resolveAdmissionModelScope(config, options.admission);
   const captureInboundRoutePolicy = (candidate: RouteResult, captureRequestPolicy = true): RouteResult => {
+    // Router-collapsed aliases bypass the combo loop. Re-pick before capturing destination
+    // policy so random/RR cannot refuse while an unmetered target is still usable.
+    if (candidate.combo?.target.metered && !admissionMayUseMeteredComboTargets(
+      config, options.admission, config.combos?.[candidate.combo.comboId],
+    )) {
+      const pick = pickComboTarget(config, candidate.combo.comboId, { eligible: target => !target.metered });
+      if (!pick) {
+        throw new NoAvailableComboTargetsError(candidate.combo.comboId,
+          comboExclusionReasons(config, candidate.combo.comboId, target => !target.metered));
+      }
+      const routed = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
+      candidate = { ...routed, combo: pick, routeKind: "combo", routeReason: routed.routeReason === "blocked-model-redirect" ? "blocked-model-redirect" : "combo-pick" };
+    }
     // Every route this request path produces passes through here: the direct
     // name, an alias, a policy or combo selection, a compaction override, a
     // shadow-intercept target and both subagent-fallback re-routes. Checking
@@ -668,7 +722,7 @@ export async function prepareResponsesRequest(
     }
     const _sci = config.shadowCallIntercept;
     let shadowRoute: RouteResult | undefined;
-    if (!concreteSelection && !memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !options.internalDecisionCall && !preserveShadowModel && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
+    if (!concreteSelection && !memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !options.mainHardLockFallbackOverride && !options.internalDecisionCall && !preserveShadowModel && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
       const sourcePrefix = shadowSourceModelPrefix(parsed.modelId, _sci.sourceModels)!;
       let sourceIdentity = { providerName: OPENAI_CODEX_PROVIDER_ID, modelId: sourcePrefix };
       try {
@@ -721,15 +775,22 @@ export async function prepareResponsesRequest(
         };
       }
     }
-    if (options.compactionRoutingOverride && !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route)) {
+    if ((options.compactionRoutingOverride && !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route))
+      || options.mainHardLockFallbackOverride) {
       credentialDomainWasRewritten = true;
       // The destination does not share the conversation's credential domain, so it can neither
       // verify the source backend's reasoning ciphertext nor decode its native compaction blob.
       // This is the same condition an account change already reports (account-change-state.ts),
       // and the serializer turns a stored summary into readable text instead of dropping it.
       parsed._stripReasoningEncryptedContent = true;
+      parsed._stripNativeCompactionEncryptedContent = true;
       if (parsed._compactionRequest === true) parsed._portableCompaction = true;
     }
+    // A v1 fallback needs an ocx1 summary for replacement-history decoding, even when this
+    // custom destination separately accepts native v2 triggers. Legacy defaults stay intact.
+    if (options.compactionRecoveryKind === "compaction-v1" && parsed._compactionRequest === true
+      && route.provider.adapter === "openai-responses" && route.provider.supportsNativeCompactionTrigger === true
+      && !isCanonicalOpenAiForwardProvider(route.provider)) parsed._portableCompaction = true;
     logCtx.routeDecision = route.routeDecision;
     logCtx.policyEligibility = route.policyEligibility;
   } catch (err) {
@@ -740,7 +801,7 @@ export async function prepareResponsesRequest(
     if (policyRefusal) return policyRefusal;
     if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
     if (err instanceof NoAvailableComboTargetsError) {
-      return comboUnavailable(err.comboId);
+      return comboUnavailable(err.comboId, undefined, err.reasons);
     }
     if (err instanceof NoEligiblePolicyCandidateError) {
       // Persist the evaluation trace (per-candidate exclusions + the
@@ -958,7 +1019,7 @@ export async function prepareResponsesRequest(
         if (policyRefusal) return policyRefusal;
         if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
         if (err instanceof NoAvailableComboTargetsError) {
-          return comboUnavailable(err.comboId);
+          return comboUnavailable(err.comboId, undefined, err.reasons);
         }
         if (err instanceof NoEligiblePolicyCandidateError) {
           logCtx.routeDecision = err.trace;
@@ -1030,6 +1091,7 @@ export async function prepareResponsesRequest(
             "_promptCacheKeyIsSharedCohort",
             "_cursorClientThreadId",
             "_reasoningReplayScope",
+            "_nativeReasoningRetention",
             "_cursorIsolateConversation",
           ];
           for (const key of kept) {
@@ -1175,7 +1237,7 @@ export async function prepareResponsesRequest(
               if (policyRefusal) return policyRefusal;
               if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
               if (err instanceof NoAvailableComboTargetsError) {
-                return comboUnavailable(err.comboId);
+                return comboUnavailable(err.comboId, undefined, err.reasons);
               }
               if (err instanceof NoEligiblePolicyCandidateError) {
                 logCtx.routeDecision = err.trace;
@@ -1492,6 +1554,8 @@ export async function prepareResponsesRequest(
       applyAccountChangeConversationStateScrub({
         body: parsed._rawBody,
         parsed,
+        preserveReasoningEncryptedContent: isCanonicalOpenAiForwardProvider(route.provider)
+          && parsed._nativeReasoningRetention?.accountSwitch === true,
         bindingKey: binding.bindingKey,
         servingAccountId: binding.accountId,
         logCtx,
@@ -1511,6 +1575,7 @@ export async function prepareResponsesRequest(
   return {
     inboundWire,
     clientDeclaredEmptyToolCatalog: options.clientDeclaredEmptyToolCatalog === true,
+    clientToolCatalogRestriction,
     // Admission facts later route rewrites must not re-derive: the selector the caller sent and
     // the key scope as it stood when this request was admitted.
     inboundSelector,

package/src/server/responses/request-sidecar-auth.ts

@@ -2,7 +2,7 @@ import type { ResponsesRequestContext } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
 import type { ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactionTrigger } from "../../providers/openai-tiers";
 import { omitEarlierCompactionImages } from "../../responses/compaction-images";
 import {
   shouldResolveOpenAiVisionSidecar,
@@ -51,7 +51,7 @@ export async function prepareResponsesSidecarAuth(
   let openAiSidecar: ResolvedOpenAiForwardSidecar | undefined;
   const visionDescribeTerminal = options.visionDescribeTerminal === true;
   const routedCompaction = parsed._compactionRequest === true
-    && (!isCanonicalOpenAiForwardProvider(route.provider) || parsed._portableCompaction === true);
+    && (!supportsNativeResponsesCompactionTrigger(route.provider) || parsed._portableCompaction === true);
   if (routedCompaction) parsed.context.messages = omitEarlierCompactionImages(parsed.context.messages);
   const needsOpenAiVision = !visionDescribeTerminal
     && shouldResolveOpenAiVisionSidecar(config, route.provider, route.modelId, parsed, route.providerName);