@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/server/responses/run-turn-execution.ts

@@ -30,7 +30,7 @@ import {
   rotateGenericOAuthAccountOn429,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
-import { OAuthAccountPausedError, publicOAuthAuthenticationErrorMessage, type OAuthAccessSnapshot } from "../../oauth/index";
+import { OAuthAccountPausedError, OAuthTokenRefreshBusyError, publicOAuthAuthenticationErrorMessage, type OAuthAccessSnapshot } from "../../oauth/index";
 import { tryAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { formatErrorResponse, bridgeToResponsesSSE, buildResponseJSON } from "../../bridge";
@@ -49,12 +49,14 @@ import { rememberResponseState } from "../../responses/state";
 import { trackStreamLifetime } from "../lifecycle";
 import { awaitThoughtSignatureDurability } from "../../responses/thought-signature-replay";
 import { undeclaredToolCallMessage } from "../responses-undeclared-tool-guard";
+import { emptyToolCatalogRefusal, guardEmptyToolCatalogEvents, guardEmptyToolCatalogStream } from "../../lib/empty-tool-catalog";
 // LOCAL PATCH (runturn-websearch)
 import { planWebSearch } from "../../web-search";
 import { runTurnWebSearchInitialParsed, runTurnWebSearchLoop } from "../../web-search/run-turn-loop";
 import { WEB_SEARCH_TOOL_NAME } from "../../web-search/synthetic-tool";
 import { orderDevinMessagesOutput } from "../../claude/devin-output-order";
 import { unboundPoolSpendRefusalMessage } from "../workflow-refusal";
+import { claudeUsagePreflight } from "../../adapters/claude-cli/usage-admission";
 
 // LOCAL PATCH (runturn-websearch): top-level fields route binding or the
 // adapter itself may write during a turn. Iteration-local `turnParsed` objects
@@ -71,13 +73,16 @@ const RUNTURN_WS_ROUTE_STATE_KEYS = [
   "_providerContinuationOwner",
   "_providerContinuationCandidate",
   "_stripReasoningEncryptedContent",
+  "_stripNativeCompactionEncryptedContent",
+  "_nativeReasoningRetention",
+  "_nativeReasoningRetainedAcrossRoute",
   "_dropForeignReasoningItemIds",
   "_reasoningReplayScope",
 ] as const;
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function executeResponsesRunTurn(
-  requestContext: Pick<ResponsesRequestContext, "options" | "logCtx" | "config">,
+  requestContext: Pick<ResponsesRequestContext, "req" | "options" | "logCtx" | "config">,
   admissionState: ResponsesAdmissionState,
   requestState: Pick<
     PreparedResponsesRequest,
@@ -87,6 +92,7 @@ export async function executeResponsesRunTurn(
     | "translatorBudget"
     | "inboundWire"
     | "toolBridgeMaps"
+    | "clientToolCatalogRestriction"
     | "rememberKiroDeliveredFinalAnswer"
     | "responseStateOptions"
   >,
@@ -127,7 +133,7 @@ export async function executeResponsesRunTurn(
   >,
   completionPolicy: Pick<ResponsesCompletionPolicy, "emptyCompletionGuardEnabled">,
 ): Promise<Response> {
-  const { options, logCtx, config } = requestContext;
+  const { req, options, logCtx, config } = requestContext;
   const {
     selectionIsCurrent,
     adapterBindings,
@@ -169,6 +175,33 @@ export async function executeResponsesRunTurn(
   const releaseSearchProbeLease = (): void => {
     sidecarState.openAiSidecar?.releaseProbeLease?.();
   };
+  // Publish the known subscription pause before headers or a CLI turn, preserving its reset
+  // across both Responses and translated Chat instead of presenting a retryable generic 502.
+  if (transportState.runTurnAdapter.name === "claude-cli") {
+    let usage: Awaited<ReturnType<typeof claudeUsagePreflight>>;
+    try {
+      usage = await claudeUsagePreflight(parsed.modelId);
+    } catch (error) {
+      // The outer cleanup does not own the sidecar's probe lease: hand it back before rethrowing.
+      releaseSearchProbeLease();
+      throw error;
+    }
+    if (usage.state === "exhausted") {
+      cancelResponseCompletion();
+      releaseSearchProbeLease();
+      const refusal = new Response(JSON.stringify({ error: {
+        type: "rate_limit_error", code: "claude_subscription_cooldown", param: null,
+        message: usage.message ?? "Claude subscription usage is exhausted.",
+      } }), {
+        status: 429,
+        headers: { "Content-Type": "application/json",
+          ...(usage.resetAt ? { "Retry-After": String(Math.max(1, Math.ceil((usage.resetAt - Date.now()) / 1000))) } : {}),
+        },
+      });
+      markResponseNonReplayable(refusal);
+      return refusal;
+    }
+  }
   // When Codex declared hosted web_search and a sidecar plan resolves, drive
   // the routed model through the same search interception the fetch-path loop
   // runs — injected as a function tool, calls intercepted, results appended to
@@ -186,7 +219,9 @@ export async function executeResponsesRunTurn(
   }
 
     const runTurnAbort = new AbortController();
-    const cleanupRunTurnAbort = linkAbortSignal(runTurnAbort, options.abortSignal);
+    const cleanupRequestAbort = linkAbortSignal(runTurnAbort, req.signal);
+    const cleanupOptionAbort = linkAbortSignal(runTurnAbort, options.abortSignal);
+    const cleanupRunTurnAbort = (): void => { cleanupRequestAbort(); cleanupOptionAbort(); };
     const devinProducers = new Set<AbortController>();
     const orderMessagesOutput = (source: AsyncIterable<AdapterEvent>): AsyncIterable<AdapterEvent> =>
       inboundWire === "anthropic" && transportState.runTurnAdapter.name === "devin" && !routedCompaction
@@ -197,12 +232,13 @@ export async function executeResponsesRunTurn(
     const queue = createAdapterEventQueue({
       onBacklogExceeded: () => runTurnAbort.abort(),
     });
-    const refreshRunTurnSelection = async (): Promise<void> => {
-      if (selectionIsCurrent(adapterBindings.get(transportState.runTurnAdapter))) return;
+    const refreshRunTurnSelection = async (): Promise<boolean> => {
+      if (selectionIsCurrent(adapterBindings.get(transportState.runTurnAdapter))) return false;
       await refreshRunTurnAdapter(parsed);
       bindRouteReasoningReplayScope({ parsed, providerName: route.providerName, provider: route.provider,
         adapterName: transportState.runTurnAdapter.name, oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot });
       sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.runTurnAdapter.name, logCtx.accountLogLabel);
+      return true;
     };
     // Initial admission must settle before the streaming Response commits HTTP 200.
     // Let the outer Responses facade preserve the local retryable-429 contract.
@@ -256,13 +292,18 @@ export async function executeResponsesRunTurn(
         if (!pacingSlotAcquired) {
           pacingSlot = await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
         }
-        await refreshRunTurnSelection();
+        const selectionChanged = await refreshRunTurnSelection();
         const selectedBinding = adapterBindings.get(transportState.runTurnAdapter);
         if (lastKeyFailure && selectedBinding?.kind === "api-key"
           && failedKeys.has(selectedBinding.provider.apiKey ?? "")) {
           emit(lastKeyFailure);
           return;
         }
+        if (selectionChanged) {
+          releaseProviderRequestSlot(pacingSlot);
+          pacingSlot = undefined;
+          pacingSlot = await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
+        }
         // LOCAL PATCH (runturn-websearch): refreshRunTurnSelection binds route
         // state onto `parsed`; mirror it onto the iteration-local copy the
         // adapter actually receives.
@@ -436,7 +477,19 @@ export async function executeResponsesRunTurn(
     // selected; the turn then moves to a surviving stored account, or, with none, the client
     // gets the login instruction instead of an opaque upstream 401.
     let oauth401ReplayAttempted = false;
-    let pausedAuthRecovery = false;
+    let authRecoveryRefusal: Response | undefined;
+    const refuseLocalAuthRecovery = (error: Extract<AdapterEvent, { type: "error" }>, cause: unknown): boolean => {
+      const cancelled = runTurnAbort.signal.aborted;
+      if (!cancelled && !(cause instanceof OAuthTokenRefreshBusyError) && !(cause instanceof OAuthAccountPausedError)) return false;
+      const status = cancelled ? 499 : cause instanceof OAuthTokenRefreshBusyError ? 503 : 403;
+      const errorType = cancelled ? "client_cancelled" : status === 503 ? "server_error" : "permission_error";
+      const message = cancelled ? "Client cancelled request" : publicOAuthAuthenticationErrorMessage(cause);
+      // If a readiness heartbeat already committed SSE, the mapped event remains retryable
+      // capacity rather than retaining the rejected credential's authentication error/code.
+      Object.assign(error, { status, errorType, message, code: undefined, retryable: status === 503 });
+      authRecoveryRefusal = formatErrorResponse(status, errorType, message, status === 503 ? { retryAfter: "1" } : undefined);
+      return true;
+    };
     const recoverRunTurnAdapterOnPreflight401 = async (
       error: Extract<AdapterEvent, { type: "error" }>,
     ): Promise<boolean> => {
@@ -450,9 +503,7 @@ export async function executeResponsesRunTurn(
         try {
           admitted = await applyFailoverSnapshot(await refreshResolvedOAuthSelection(sent));
         } catch (err) {
-          if (err instanceof OAuthAccountPausedError) {
-            pausedAuthRecovery = true;
-            Object.assign(error, { status: 403, errorType: "permission_error", message: publicOAuthAuthenticationErrorMessage(err) });
+          if (refuseLocalAuthRecovery(error, err)) {
             hop.permit?.release();
             return false;
           }
@@ -475,7 +526,9 @@ export async function executeResponsesRunTurn(
       } catch (err) {
         // Applying the alternate can still fail, e.g. when a newer manual selection points back
         // at the flagged account; the client then needs the login instruction, not the raw 401.
-        Object.assign(error, { errorType: "authentication_error", message: publicOAuthAuthenticationErrorMessage(err) });
+        if (!refuseLocalAuthRecovery(error, err)) {
+          Object.assign(error, { errorType: "authentication_error", message: publicOAuthAuthenticationErrorMessage(err) });
+        }
         hop.permit?.release();
         return false;
       }
@@ -699,14 +752,19 @@ export async function executeResponsesRunTurn(
       return orderMessagesOutput(retryQueue.stream());
     };
 
-    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = toolBridgeMaps;
+    const clientToolCatalog = requestState.clientToolCatalogRestriction && route.provider.authMode !== "forward"
+      ? requestState.clientToolCatalogRestriction : undefined;
+    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = clientToolCatalog
+      ? { ...toolBridgeMaps, ...clientToolCatalog } : toolBridgeMaps;
     const enforceDeclaredToolNames = inboundWire !== "chat" && inboundWire !== "anthropic";
     const classifyUndeclaredFirstTool = (
       event: AdapterEvent,
     ): Extract<AdapterEvent, { type: "error" }> | undefined => {
-      if (!enforceDeclaredToolNames || event.type !== "tool_call_start") return undefined;
       // This tool is declared to the adapter by the private search loop.
-      if (wsPlan && event.name === WEB_SEARCH_TOOL_NAME) return undefined;
+      if (wsPlan && event.type === "tool_call_start" && event.name === WEB_SEARCH_TOOL_NAME) return undefined;
+      const emptyCatalogRefusal = emptyToolCatalogRefusal(event, clientToolCatalog);
+      if (emptyCatalogRefusal) return emptyCatalogRefusal;
+      if (!enforceDeclaredToolNames || event.type !== "tool_call_start") return undefined;
       const effectiveName = normalizeDeclaredToolName(event.name, declaredToolNames, undefined, bareCustomToolNames);
       if (declaredToolNames.has(effectiveName)) return undefined;
       return {
@@ -752,13 +810,13 @@ export async function executeResponsesRunTurn(
         // Preflight holds only heartbeats and the first meaningful event. A first-event 429 can be
         // replayed transparently; after any output reaches the bridge, a later error stays terminal.
         eventSource = await preflightRunTurnFailover(eventSource, wsFirstParsed, preflightDeadlineAt);
-        if (pausedAuthRecovery) {
+        if (authRecoveryRefusal) {
           cancelResponseCompletion();
           runTurnAbort.abort();
           queue.close();
           cleanupRunTurnAbort();
           releaseSearchProbeLease();
-          return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(new OAuthAccountPausedError()));
+          return authRecoveryRefusal;
         }
       }
       if (grokDevinPreflight) {
@@ -776,9 +834,13 @@ export async function executeResponsesRunTurn(
         if (preflight.error || preflight.empty) {
           runTurnAbort.abort();
           queue.close();
-          const message = preflight.error?.message ?? "Adapter ended before producing a response";
-          const failure = formatErrorResponse(preflight.error?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? 503 : 502,
-            preflight.error?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : "upstream_error", redactSecretString(message));
+          const classified = adapterFailureFromEvent(preflight.error ?? {
+            type: "error", status: 502, message: "Adapter ended before producing a response",
+          });
+          const storageRefusal = preflight.error?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE;
+          const failure = formatErrorResponse(storageRefusal ? 503 : classified.httpStatus,
+            storageRefusal ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : classified.error.type,
+            redactSecretString(classified.error.message), { code: classified.error.code, classified: true });
           // A replay-unsafe heartbeat means the adapter already ran a local side effect, so the
           // combo must not send this turn to another target: the failure stays with this child.
           if (preflight.replayUnsafe) markResponseNonReplayable(failure);
@@ -824,7 +886,7 @@ export async function executeResponsesRunTurn(
           console.warn(emptyCompletionNotice(route.providerName, route.modelId));
         });
       const sseStream = bridgeToResponsesSSE(
-        guardedSource, parsed._responseModelId ?? parsed.modelId, toolNsMap, freeformToolNames, toolSearchToolNames,
+        guardEmptyToolCatalogStream(guardedSource, clientToolCatalog, translatorBudget), parsed._responseModelId ?? parsed.modelId, toolNsMap, freeformToolNames, toolSearchToolNames,
         () => {
           cancelResponseCompletion();
           runTurnAbort.abort();
@@ -840,9 +902,11 @@ export async function executeResponsesRunTurn(
           declaredToolNames,
           bareCustomToolNames,
           enforceDeclaredToolNames,
+          // Same wire split: only a Responses client (Codex) needs the refusal as a failure.
+          terminalRefusalAsFailed: enforceDeclaredToolNames,
           toolParameterSchemas,
           ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
-          ...(routedCompaction ? { compaction: true } : {}),
+          ...(routedCompaction ? { compaction: true, compactionRetention: parsed._compactionRetention } : {}),
           // grok-build's strict decoder dies on the typed response.heartbeat frame; its
           // eventsource layer tolerates comment keep-alives. Codex needs the opposite.
           ...(logCtx.surface === "grok" ? { heartbeatStyle: "comment" as const } : {}),
@@ -897,13 +961,13 @@ export async function executeResponsesRunTurn(
       for await (const event of await preflightRunTurnFailover(
         (async function* () { yield* firstAttemptEvents; })(),
       )) runTurnEvents.push(event);
-      if (pausedAuthRecovery) {
+      if (authRecoveryRefusal) {
         cancelResponseCompletion();
         runTurnAbort.abort();
         queue.close();
         cleanupRunTurnAbort();
         releaseSearchProbeLease();
-        return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(new OAuthAccountPausedError()));
+        return authRecoveryRefusal;
       }
     }
     if (grokDevinPreflight) {
@@ -961,6 +1025,7 @@ export async function executeResponsesRunTurn(
         }
         events = searched;
       }
+      events = guardEmptyToolCatalogEvents(events, clientToolCatalog, translatorBudget);
       if (options.comboAttempt) {
         const firstMeaningfulIndex = events.findIndex(event => event.type !== "heartbeat");
         const firstMeaningful = firstMeaningfulIndex === -1 ? undefined : events[firstMeaningfulIndex];
@@ -974,12 +1039,13 @@ export async function executeResponsesRunTurn(
           ? classifyUndeclaredFirstTool(firstMeaningful)
           : undefined;
         if (!firstMeaningful || firstMeaningful.type === "error" || classifiedError) {
-          const message = classifiedError?.message ?? (firstMeaningful?.type === "error"
-            ? firstMeaningful.message
-            : "Adapter ended before producing a response");
+          const classified = adapterFailureFromEvent(classifiedError ?? (firstMeaningful?.type === "error"
+            ? firstMeaningful
+            : { type: "error", status: 502, message: "Adapter ended before producing a response" }));
           const storageRefusal = firstMeaningful?.type === "error" && firstMeaningful.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE;
-          const failure = formatErrorResponse(storageRefusal ? 503 : 502,
-            storageRefusal ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : "upstream_error", redactSecretString(message));
+          const failure = formatErrorResponse(storageRefusal ? 503 : classified.httpStatus,
+            storageRefusal ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : classified.error.type,
+            redactSecretString(classified.error.message), { code: classified.error.code, classified: true });
           if (replayUnsafe) markResponseNonReplayable(failure);
           return failure;
         }
@@ -997,7 +1063,7 @@ export async function executeResponsesRunTurn(
         freeformToolNames,
         bareCustomToolNames,
         toolSearchToolNames,
-        ...(routedCompaction ? { compaction: true } : {}),
+        ...(routedCompaction ? { compaction: true, compactionRetention: parsed._compactionRetention } : {}),
         onProviderState: state => { providerState = state; },
         onUsage: usage => {
           transportState.bindKeyUsageFromBridge(usage);

package/src/server/responses/sidecar-execution.ts

@@ -1,3 +1,4 @@
+import { createAnthropicThinkingRecovery } from "./anthropic-thinking-recovery";
 import { rotateAnthropicAccountOnResponseForInstance } from "../../oauth/anthropic-account-refusal";
 import type { ResponsesRequestContext } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
@@ -20,8 +21,8 @@ import {
   runWithImageBridge,
   clampImageMaxRounds,
 } from "../../images";
-import type { ProviderAdapter } from "../../adapters/base";
-import type { OcxParsedRequest } from "../../types";
+import type { AdapterRequest, ProviderAdapter } from "../../adapters/base";
+import type { OcxParsedRequest, OcxUsage } from "../../types";
 import { rotateProviderTransportOn429, rateLimitRetryPolicyFor } from "../../providers/key-failover";
 import {
   isGenericOAuthFailoverEnabled,
@@ -32,7 +33,7 @@ import {
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
 import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
-import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { isNonReplayableResponse, SendBudgetExhaustedError } from "../../lib/upstream-retry";
 import { unwrapUpstreamRetryEvidenceError } from "../../codex/auth-context";
 import { AdmissionModelDeniedError, admissionModelDeniedResponse } from "../admission-model-scope";
 import { noteKiroMonthlyRefusal, noteKiroServedSuccess } from "../../providers/kiro-usage";
@@ -50,6 +51,7 @@ import { providerFetch } from "./fetch-helpers";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { recordAdapterReasoning, recordAdapterTier } from "../request-log";
 import { normalizeLogConversationId } from "../request-log-conversation";
+import { attemptAccountChanged } from "../request-log-account-rotation";
 import { rememberResponseState } from "../../responses/state";
 import { trackStreamLifetime } from "../lifecycle";
 import { isAntigravityRawValidationRefusal } from "./antigravity-validation-refusal";
@@ -65,6 +67,7 @@ export async function executeResponsesSidecars(
     | "inboundWire"
     | "selectedForwardHeaders"
     | "translatorBudget"
+    | "clientToolCatalogRestriction"
     | "toolBridgeMaps"
     | "rememberKiroDeliveredFinalAnswer"
     | "responseStateOptions"
@@ -98,7 +101,7 @@ export async function executeResponsesSidecars(
     | "notifyResponseComplete"
     | "cancelResponseCompletion"
   >,
-  sendBudgetState: Pick<ResponsesSendBudget, "reserveCredentialHop" | "refundableAdapterDispatchBudget" | "adapterDispatchBudget" | "noteInitialDispatch" | "noteAdapterPhysicalSend" | "noteAdapterRecoveryWithheld" | "pendingHopPermit">,
+  sendBudgetState: Pick<ResponsesSendBudget, "sendBudgetExhausted" | "reserveCredentialHop" | "refundableAdapterDispatchBudget" | "adapterDispatchBudget" | "noteInitialDispatch" | "noteAdapterPhysicalSend" | "noteAdapterRecoveryWithheld" | "pendingHopPermit">,
 ) {
   const { config, options, logCtx } = requestContext;
   const antigravityPoolActivated = requestState.route.providerName === "google-antigravity"
@@ -377,7 +380,7 @@ export async function executeResponsesSidecars(
       recoveryKind = "oauth-account-429";
       if (!options.comboInitialSend && canRunWebSearch && route.providerName === "google-antigravity")
         sendBudgetState.pendingHopPermit = hop.permit;
-      else sidecarBudget.ownCredentialHop(hop.permit);
+      else sidecarBudget.ownCredentialHop(hop.permit, (canRunWebSearch || !!imgPlan || !!vidPlan) && transportState.adapter.name === "anthropic");
     } else if (
       // Anthropic's pool is excluded from generic failover, so without this arm a 429 inside a
       // web-search or image-bridge turn was terminal even with the pool fully enabled -- while
@@ -417,8 +420,9 @@ export async function executeResponsesSidecars(
         hop.permit?.release();
         return null;
       }
-      recoveryKind = originalResponse?.status === 401 ? "oauth-401" : "anthropic-oauth-429";
-      sidecarBudget.ownCredentialHop(hop.permit);
+      recoveryKind = originalResponse?.status === 401 ? "oauth-401"
+        : originalResponse?.status === 403 ? "oauth-account-403" : "anthropic-oauth-429";
+      sidecarBudget.ownCredentialHop(hop.permit, (canRunWebSearch || !!imgPlan || !!vidPlan) && transportState.adapter.name === "anthropic");
     } else {
       // No key pool, no generic OAuth roster, no Anthropic pool could produce a replacement
       // credential. The 429 is terminal for this sidecar turn.
@@ -451,6 +455,44 @@ export async function executeResponsesSidecars(
     });
     return { adapter: rotatedAdapter, recoveryKind };
   };
+  // One guard follows the active sidecar across all iterations. Enforced spend has no
+  // authoritative receipt for earlier legacy sends, so recovery cannot claim headroom there.
+  const thinkingRecovery = createAnthropicThinkingRecovery(parsed,
+    options.abortSignal ?? new AbortController().signal, { attempted: false },
+    () => !sendBudgetState.sendBudgetExhausted()
+      && !!sendBudgetState.adapterDispatchBudget
+      && sendBudgetState.adapterDispatchBudget.spendEnforced !== true);
+  const thinkingReceipt = (request: AdapterRequest, adapter: ProviderAdapter, recovery?: AttemptRecoveryKind) =>
+    adapter.name !== "anthropic" ? {} : { onPhysicalDispatch: () => {
+      if (recovery === "opaque-blob-rejection") {
+        const decision = sendBudgetState.adapterDispatchBudget?.reserveDispatch({
+          sendClass: "repair", targetKey: `${route.providerName}|${request.url}|${route.modelId}`,
+        });
+        if (sendBudgetState.adapterDispatchBudget?.spendEnforced || !decision?.allowed) {
+          if (decision?.allowed) decision.permit.release();
+          throw new SendBudgetExhaustedError("sidecar thinking recovery");
+        }
+        try { sendBudgetState.noteInitialDispatch(decision.permit); }
+        finally { decision.permit.release(); }
+      } else {
+        const existing = sidecarBudget.fetchOptions(adapter).onPhysicalDispatch;
+        if (existing) existing();
+        else {
+          const prepaid = sendBudgetState.pendingHopPermit;
+          sendBudgetState.pendingHopPermit = undefined;
+          sendBudgetState.noteInitialDispatch(prepaid);
+        }
+      }
+    } };
+  // A loop's hidden rounds before a rotation were spent by the account it left. Bill them to that
+  // account's attempt while it is still open; the next send seals it. Declined when that send
+  // keeps the account (no new attempt), so the loop's final total still carries them.
+  const billRotatedUsage = (usage: OcxUsage): boolean => {
+    const attempt = logCtx.activeAttempt;
+    if (!attempt || !attemptAccountChanged(attempt.accountLogLabel, logCtx.accountLogLabel, attempt.provider, logCtx.provider)) return false;
+    transportState.bindKeyUsageFromBridge(usage);
+    return true;
+  };
   if ((imgPlan || vidPlan) && wsPlan) {
     // Web search takes priority when both are active — the media bridge cannot run
     // alongside runWithWebSearch. Surface a runtime signal so the user knows their
@@ -508,6 +550,8 @@ export async function executeResponsesSidecars(
     );
     const imgResponse = await runWithImageBridge({
       parsed, adapter: transportState.adapter,
+      ...(transportState.adapter.name === "anthropic" ? { thinkingRecovery } : {}),
+      clientToolCatalogRestriction: route.provider.authMode === "forward" ? undefined : requestState.clientToolCatalogRestriction,
       incomingMeta: { headers: requestState.selectedForwardHeaders, providerName: route.providerName, abortSignal: options.abortSignal, translatorBudget, ...(options.comboInitialSend ? { providerFetch: imageProviderFetch } : {}), ...sidecarBudget.incomingMeta },
       onProducerStart: sidecarBudget.takeProducerOwnership,
       onProducerEnd: sidecarBudget.release,
@@ -527,10 +571,11 @@ export async function executeResponsesSidecars(
       stallTimeoutSec: config.stallTimeoutSec,
       waitForRequestSlot: imageProviderFetch.waitForPacing,
       fetchImpl: imageProviderFetch.unpacedFetch ?? imageProviderFetch,
-      fetchForRequest: (request, iterParsed, adapter) => {
+      fetchForRequest: (request, iterParsed, adapter, recovery) => {
         const fetch = providerFetch(route.provider, options.codexWsRuntimeIdentity, {
           dispatchOverride: oauthDispatch(request, iterParsed),
           providerName: route.providerName, modelId: route.modelId, ...sidecarBudget.fetchOptions(adapter),
+          ...thinkingReceipt(request, adapter, recovery),
         });
         return fetch.unpacedFetch ?? fetch;
       },
@@ -549,11 +594,14 @@ export async function executeResponsesSidecars(
         transportState.bindKeyUsageFromBridge(usage);
       },
       on429: rotateSidecarProviderOn429,
+      onRotatedUsage: billRotatedUsage,
       retryOn429Policy: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro")
         ? null : rateLimitRetryPolicyFor(route.provider),
       onFirstOutput: noteSidecarOutput,
       ...(options.forceEmptyResponseId ? { forceEmptyResponseId: true } : {}),
+      terminalRefusalAsFailed: inboundWire !== "chat" && inboundWire !== "anthropic",
       onCompletedResponse: (response, providerState) => {
+        if (!options.abortSignal?.aborted) thinkingRecovery.rememberSuccess(response);
         const served = transportState.replayOAuthCredentialSnapshot;
         if (route.providerName === "kiro" && response.status === "completed" && served
           && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
@@ -603,10 +651,13 @@ export async function executeResponsesSidecars(
       })(input, init)) as typeof globalThis.fetch;
     const loopResponse = await runWithWebSearch({
       parsed, adapter: transportState.adapter,
+      ...(transportState.adapter.name === "anthropic" ? { thinkingRecovery } : {}),
+      clientToolCatalogRestriction: route.provider.authMode === "forward" ? undefined : requestState.clientToolCatalogRestriction,
       onIterationEnd: sidecarBudget.releaseUnsentHop,
-      fetchForRequest: (request, iterParsed, adapter) => providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+      fetchForRequest: (request, iterParsed, adapter, recovery) => providerFetch(route.provider, options.codexWsRuntimeIdentity, {
         dispatchOverride: oauthDispatch(request, iterParsed),
         providerName: route.providerName, modelId: route.modelId, ...sidecarBudget.fetchOptions(adapter),
+        ...thinkingReceipt(request, adapter, recovery),
       }),
       incomingMeta: {
         headers: requestState.selectedForwardHeaders,
@@ -633,6 +684,7 @@ export async function executeResponsesSidecars(
       settings: wsPlan.settings,
       maxSearches: wsPlan.maxSearches,
       forceEmptyResponseId: true,
+      terminalRefusalAsFailed: inboundWire !== "chat" && inboundWire !== "anthropic",
       abortSignal: options.abortSignal,
       onFirstOutput: noteSidecarOutput,
       onRequestBuilt: request => {
@@ -651,6 +703,7 @@ export async function executeResponsesSidecars(
       stallTimeoutSec: wsPlan.stallTimeoutSec,
       streamRoutedModelOutput: wsPlan.streamRoutedModelOutput,
       on429: rotateSidecarProviderOn429,
+      onRotatedUsage: billRotatedUsage,
       ...(!options.comboInitialSend && route.providerName === "google-antigravity" ? { onIterationEnd: () => {
         // The next Antigravity adapter dispatch claims this permit. If request construction,
         // admission or cancellation stopped it first, return the unused send allowance.
@@ -665,6 +718,7 @@ export async function executeResponsesSidecars(
         if (route.providerName === "kiro" && response.status === "completed" && served
           && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
         commitReasoningReplayServingRoute();
+        if (!options.abortSignal?.aborted) thinkingRecovery.rememberSuccess(response);
         notifyResponseComplete(response);
       },
     });

package/src/server/responses/sidecar-send-budget.ts

@@ -22,8 +22,8 @@ export function createSidecarSendBudget(
   };
   return {
     /** Retain a Combo hop until dispatch; direct requests keep eager settlement. */
-    ownCredentialHop(permit?: SingleUseDispatchPermit): void {
-      if (!initial) { permit?.use(); return; } // Preserve direct callers' reporting contract.
+    ownCredentialHop(permit?: SingleUseDispatchPermit, retainUntilDispatch = false): void {
+      if (!initial && !retainUntilDispatch) { permit?.use(); return; } // Preserve direct callers' reporting contract.
       releaseHop();
       hopPermit = permit;
       budget.pendingHopPermit = permit;

package/src/server/responses/terminal-guard.ts

@@ -1,6 +1,6 @@
+import { assistantReplayContent } from "../../responses/assistant-replay";
 import type {
   AdapterEvent,
-  OcxAssistantContentPart,
   OcxAssistantMessage,
   OcxParsedRequest,
   OcxUsage,
@@ -121,21 +121,7 @@ export function analyzeTerminalTurn(parsed: OcxParsedRequest, events: readonly A
 }
 
 function assistantMessageFromEvents(events: readonly AdapterEvent[], timestamp: number): OcxAssistantMessage | undefined {
-  let text = "";
-  let thinking = "";
-  let signature: string | undefined;
-  const redacted: string[] = [];
-  for (const event of events) {
-    if (event.type === "text_delta") text += event.text;
-    else if (event.type === "thinking_delta") thinking += event.thinking;
-    else if (event.type === "thinking_signature") signature = event.signature;
-    else if (event.type === "redacted_thinking") redacted.push(event.data);
-  }
-  const content: OcxAssistantContentPart[] = [];
-  if (thinking || signature || redacted.length > 0) {
-    content.push({ type: "thinking", thinking, ...(signature ? { signature } : {}), ...(redacted.length > 0 ? { redacted } : {}) });
-  }
-  if (text) content.push({ type: "text", text });
+  const content = assistantReplayContent(events);
   if (content.length === 0) return undefined;
   return { role: "assistant", content, timestamp };
 }

package/src/server/responses-undeclared-tool-guard.ts

@@ -298,7 +298,7 @@ export function collectProviderExecutedCallTypes(body: unknown): Set<ProviderExe
   return callTypes;
 }
 
-function isAuthorizedProviderExecutedCall(
+export function isAuthorizedProviderExecutedCall(
   item: Record<string, unknown>,
   callTypes: ProviderExecutedCallTypes,
 ): boolean {

package/src/server/ws-bridge.ts

@@ -11,6 +11,7 @@ import { BoundedSseFrameBuffer } from "./sse-frame-buffer";
 import { sseDataPayload as parseSseBlock } from "./sse-payload-rewrite";
 import { safeResponseHeaders } from "./safe-response-headers";
 import type { AudioSocketTarget } from "./audio-dictation";
+import type { CodexWebSocketActivity } from "../codex/websocket-activity";
 
 export { safeResponseHeaders } from "./safe-response-headers";
 
@@ -19,6 +20,7 @@ type ResponsesTerminalReporter = (status: ResponsesTerminalStatus) => void;
 type ResponsesPayloadObserver = (payload: string) => void;
 
 export interface WsData {
+  responsesActivity?: CodexWebSocketActivity;
   nativeControl?: NativeResponseControl;
   /** Content-free per-turn explanation; never a model capability assertion. */
   nativeSteeringUnavailable?: string;

package/src/service/auth-preflight.ts

@@ -0,0 +1,71 @@
+/**
+ * The install/repair preflight over the data-plane credential, plus the retry command it
+ * names. Split out of `guards.ts` so the guard module stops importing `diagnostics`.
+ *
+ * Direction of the remaining edge is deliberate: this module asks `guards` for
+ * `assertNotAdminToken` and `diagnostics` for the install verdict, and neither imports it back.
+ */
+import { loadConfig } from "../config";
+import { isLoopbackHostname } from "../codex/loopback-target";
+import { readServiceApiTokenState, serviceApiTokenFilePath } from "../lib/service-secrets";
+import { diagnoseService } from "./diagnostics";
+import type { ServiceDiagnostic } from "./diagnostics";
+import { assertNotAdminToken } from "./guards";
+
+/**
+ * The `ocx` command a user should rerun for the service state they actually have.
+ *
+ * `installed` alone is not enough: `repairService()` refuses a Task-Scheduler-plus-WinSW
+ * conflict outright, so recommending repair there names a command guaranteed to fail.
+ * Install IS the valid conflict recovery, because `installWindows` removes the native
+ * backend first. Exported so the guard tests the real selector rather than a copy of it.
+ */
+export function serviceRetryCommand(
+  diag: Pick<ServiceDiagnostic, "installed" | "conflict"> = diagnoseService(),
+): string {
+  return diag.installed && !diag.conflict ? "ocx service repair" : "ocx service install";
+}
+
+/**
+ * Preflight for `service install` / `service repair` on the data-plane credential.
+ *
+ * It used to DEMAND `OPENCODEX_API_AUTH_TOKEN` for a non-loopback hostname, and it threw
+ * even when `~/.opencodex/service-api-token` already held a perfectly good token. That is
+ * the defect behind the incident this unit exists to close (#4236): an operator exported the
+ * ADMIN token as OPENCODEX_API_AUTH_TOKEN because `install` asked for a token, the hub then
+ * crash-looped on `assertNotAdminToken`, and `service repair` asked for the same env var
+ * again — so the only remembered way to make the command proceed was the thing that broke it.
+ *
+ * Nobody should have to export a token by hand to run a hub. {@link writeServiceApiTokenFile}
+ * provisions one, so the only conditions left that install cannot fix are an admin-token
+ * collision in the environment and a token file that exists but cannot be used.
+ */
+export function assertServiceAuthEnvironment(): void {
+  const config = loadConfig();
+  // Both collision checks come BEFORE the loopback short-circuit, because the launch wrapper
+  // exports the token file unconditionally (`buildServiceShellCommand` cats it whenever it
+  // exists, whatever the hostname): a management token in either source fences the whole
+  // management plane closed at boot, even on a loopback install that needs no admission
+  // secret. Returning early is what let that broken state through.
+  const present = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
+  if (present) assertNotAdminToken(present);
+  const state = readServiceApiTokenState();
+  // An existing FILE holding the admin token is the incident shape itself, and the first round
+  // only checked the env var — so install/repair reused it and the hub crash-looped at boot.
+  // On a machine connected to a hub this same file holds that hub's issued client key, which
+  // is never a management token, so the check is a no-op there.
+  if (state.kind === "present") assertNotAdminToken(state.token, process.env, "file");
+  if (isLoopbackHostname(config.hostname)) return;
+  if (present) return;
+  // Absent is fine — install/repair generates one below. `unsafe` is not: the writer refuses
+  // to replace a path it cannot vouch for, so say so here, where the operator can still act,
+  // instead of failing mid-install. Reached from `service repair` as well as `install`, so
+  // name a command that can actually succeed (see serviceRetryCommand).
+  if (state.kind !== "unsafe") return;
+  const diag = diagnoseService();
+  throw new Error(
+    `The data-plane token file cannot be used (${state.reason}): ${serviceApiTokenFilePath()}. `
+      + `Move it aside, then rerun \`${serviceRetryCommand(diag)}\`; the service provisions a `
+      + "fresh owner-only token and needs nothing from the environment.",
+  );
+}