@bitkyc08/opencodex 2.87.0 → 2.88.0

package/src/server/responses/core-combo.ts

@@ -144,7 +144,8 @@ function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId
  * through `accountLogLabel`, but the per-request account budget can end the pool's own rotation
  * before the last refused account is recorded. Hand that account to the pool's rotator, which
  * cools it under the pool's own Retry-After policy, and spare the target only when the pool still
- * has an eligible sibling. A lone account or an all-cooled pool returns null and cools the target.
+ * has an eligible sibling. The rotator only peeks round-robin here: nothing is sent to that sibling.
+ * A lone account or an all-cooled pool returns null and cools the target.
  */
 function cooledGenericOAuthAccountLabel(
   config: OcxConfig, providerName: string, modelId: string, label: string | undefined, retryAfter: string | undefined,
@@ -155,7 +156,7 @@ function cooledGenericOAuthAccountLabel(
   const matches = getAccountSet(providerName)?.accounts.filter(account =>
     oauthAccountLogLabel(account.id, base) === label) ?? [];
   return matches.length === 1
-    && rotateGenericOAuthAccountOn429(config, providerName, matches[0]!.id, retryAfter, Date.now(), modelId)
+    && rotateGenericOAuthAccountOn429(config, providerName, matches[0]!.id, retryAfter, Date.now(), modelId, false)
     ? label : undefined;
 }
 

package/src/server/responses/core-lifetime.ts

@@ -1,4 +1,5 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
+import { carryResponseToolOwnership } from "./response-tool-ownership";
 import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
 import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
@@ -50,7 +51,7 @@ export function finalizeOwnedTranslatorBudget(response: Response, budget: Transl
   if (isPreinspectedJsonResponse(response)) markPreinspectedJsonResponse(finalizedResponse);
   if (isNonReplayableResponse(response)) markResponseNonReplayable(finalizedResponse);
   if (runTurnAdapterSseResponses.has(response)) runTurnAdapterSseResponses.add(finalizedResponse);
-  return finalizedResponse;
+  return carryResponseToolOwnership(response, finalizedResponse);
 }
 
 /** Release a serving-account slot when the client body ends, errors or is cancelled. */
@@ -75,7 +76,7 @@ export function finalizeAccountLease(response: Response, release: () => void, on
   if (isEagerRelaySseResponse(response)) markEagerRelaySseResponse(wrapped);
   if (isPreinspectedJsonResponse(response)) markPreinspectedJsonResponse(wrapped);
   if (runTurnAdapterSseResponses.has(response)) runTurnAdapterSseResponses.add(wrapped);
-  return wrapped;
+  return carryResponseToolOwnership(response, wrapped);
 }
 
 

package/src/server/responses/core-options.ts

@@ -177,6 +177,8 @@ export interface HandleResponsesOptions {
   nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /** The Claude client's typed `web_search_*` / `web_fetch_*` declarations; kept only for `inboundWire: "anthropic"`. */
   anthropicServerTools?: readonly Record<string, unknown>[];
+  /** The Claude client's replayable server-tool exchanges (`replayedAnthropicServerBlocks`); same scope. */
+  anthropicServerReplay?: ReadonlyMap<string, readonly Record<string, unknown>[]>;
   /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
   droidDefaultEffort?: string;
   /** PF-07: the Chat source a combo child may send natively; set only by the Chat ingress. */

package/src/server/responses/core-replay.ts

@@ -1,3 +1,5 @@
+import { bindAnthropicRejectionPolicy } from "../../adapters/anthropic-rejection-memo";
+import { getReasoningReplayOpaqueBlobRejection } from "../../responses/reasoning-replay-cache";
 import type {
   OcxProviderContinuationOwner,
   OcxProviderContinuationState,
@@ -177,8 +179,10 @@ export function bindRouteReasoningReplayScope(args: {
       parsed._dropForeignReasoningItemIds = true;
     }
   }
+  const rejectionMemo = getReasoningReplayOpaqueBlobRejection(parsed._reasoningReplayScope);
+  bindAnthropicRejectionPolicy(parsed, adapterName === "anthropic" ? rejectionMemo : undefined);
   if (reasoningReplayOpaqueBlobRejectionMemoized(parsed._reasoningReplayScope)) {
-    parsed._stripReasoningEncryptedContent = true;
+    if (adapterName !== "anthropic" || rejectionMemo?.mode !== "selective") parsed._stripReasoningEncryptedContent = true;
     parsed._stripNativeCompactionEncryptedContent = true;
     parsed._dropForeignReasoningItemIds = true;
   }

package/src/server/responses/passthrough-execution.ts

@@ -14,6 +14,7 @@ import { guardDirectPassthroughBodyInactivity } from "../../lib/response-body-in
 import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
+import { attachResponseToolOwnership } from "./response-tool-ownership";
 
 /** Owns the native host lease across dispatch, recovery, and response construction. */
 export async function executePassthroughResponse(
@@ -50,11 +51,11 @@ export async function executePassthroughResponse(
     // Delivery has already classified SSE (including a missing upstream content type)
     // and consumed bounded JSON/errors. Guard only its remaining direct body, outside
     // the relay/lifetime wrappers so their prefetch cannot arm our inactivity clock.
-    return guardDirectPassthroughBodyInactivity(
+    return attachResponseToolOwnership(guardDirectPassthroughBodyInactivity(
       response,
       nativeExchange.upstream.signal,
       resolveStallTimeoutMs(requestContext.config.stallTimeoutSec, { localUpstream: nativeExchange.localUpstream }),
-    );
+    ), nativeExchange.providerExecutedCallTypes);
   } finally {
     if (nativeHostState.lease) {
       releaseUpstreamHostAdmission(nativeHostState.lease);

package/src/server/responses/request-prepare.ts

@@ -476,6 +476,7 @@ export async function prepareResponsesRequest(
       parsed._nativeReasoningReplay = options.nativeReasoningReplay;
       parsed._nativeReasoningMint = options.nativeReasoningMint;
       parsed._anthropicServerTools = options.anthropicServerTools;
+      parsed._anthropicServerReplay = options.anthropicServerReplay;
     }
     parsed._promptCacheKeyIsSharedCohort = options.promptCacheKeyIsSharedCohort;
     // The body may have been rebuilt since the inbound observation (previous-response

package/src/server/responses/response-effects.ts

@@ -90,6 +90,7 @@ export function createResponsesEffects(
     delete parsed.context.tools;
     delete parsed._webSearch;
     delete parsed._anthropicServerTools;
+    delete parsed._anthropicServerReplay;
     delete parsed.options.toolChoice;
     delete parsed.options.parallelToolCalls;
     // The compaction turn is a plain prose summary; a surviving structured-output format

package/src/server/responses/response-tool-ownership.ts

@@ -0,0 +1,21 @@
+import type { ProviderExecutedCallType } from "../responses-undeclared-tool-guard";
+
+// Route-authorized execution ownership follows only the response selected for delivery.
+// It never becomes a wire header or mutable state shared by competing route attempts.
+const providerCalls = new WeakMap<Response, ReadonlySet<ProviderExecutedCallType>>();
+
+export function attachResponseToolOwnership(response: Response, types: ReadonlySet<ProviderExecutedCallType>): Response {
+  if (types.size > 0) providerCalls.set(response, new Set(types));
+  return response;
+}
+
+export function responseToolOwnership(response: Response): ReadonlySet<ProviderExecutedCallType> | undefined {
+  return providerCalls.get(response);
+}
+
+/** Carry ownership only when rebuilding the same selected response body. */
+export function carryResponseToolOwnership(source: Response, target: Response): Response {
+  const types = providerCalls.get(source);
+  if (types) providerCalls.set(target, types);
+  return target;
+}

package/src/server/responses/sidecar-execution.ts

@@ -1,3 +1,4 @@
+import { createAnthropicThinkingRecovery } from "./anthropic-thinking-recovery";
 import { rotateAnthropicAccountOnResponseForInstance } from "../../oauth/anthropic-account-refusal";
 import type { ResponsesRequestContext } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
@@ -20,7 +21,7 @@ import {
   runWithImageBridge,
   clampImageMaxRounds,
 } from "../../images";
-import type { ProviderAdapter } from "../../adapters/base";
+import type { AdapterRequest, ProviderAdapter } from "../../adapters/base";
 import type { OcxParsedRequest, OcxUsage } from "../../types";
 import { rotateProviderTransportOn429, rateLimitRetryPolicyFor } from "../../providers/key-failover";
 import {
@@ -32,7 +33,7 @@ import {
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
 import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
-import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { isNonReplayableResponse, SendBudgetExhaustedError } from "../../lib/upstream-retry";
 import { unwrapUpstreamRetryEvidenceError } from "../../codex/auth-context";
 import { AdmissionModelDeniedError, admissionModelDeniedResponse } from "../admission-model-scope";
 import { noteKiroMonthlyRefusal, noteKiroServedSuccess } from "../../providers/kiro-usage";
@@ -100,7 +101,7 @@ export async function executeResponsesSidecars(
     | "notifyResponseComplete"
     | "cancelResponseCompletion"
   >,
-  sendBudgetState: Pick<ResponsesSendBudget, "reserveCredentialHop" | "refundableAdapterDispatchBudget" | "adapterDispatchBudget" | "noteInitialDispatch" | "noteAdapterPhysicalSend" | "noteAdapterRecoveryWithheld" | "pendingHopPermit">,
+  sendBudgetState: Pick<ResponsesSendBudget, "sendBudgetExhausted" | "reserveCredentialHop" | "refundableAdapterDispatchBudget" | "adapterDispatchBudget" | "noteInitialDispatch" | "noteAdapterPhysicalSend" | "noteAdapterRecoveryWithheld" | "pendingHopPermit">,
 ) {
   const { config, options, logCtx } = requestContext;
   const antigravityPoolActivated = requestState.route.providerName === "google-antigravity"
@@ -379,7 +380,7 @@ export async function executeResponsesSidecars(
       recoveryKind = "oauth-account-429";
       if (!options.comboInitialSend && canRunWebSearch && route.providerName === "google-antigravity")
         sendBudgetState.pendingHopPermit = hop.permit;
-      else sidecarBudget.ownCredentialHop(hop.permit);
+      else sidecarBudget.ownCredentialHop(hop.permit, (canRunWebSearch || !!imgPlan || !!vidPlan) && transportState.adapter.name === "anthropic");
     } else if (
       // Anthropic's pool is excluded from generic failover, so without this arm a 429 inside a
       // web-search or image-bridge turn was terminal even with the pool fully enabled -- while
@@ -421,7 +422,7 @@ export async function executeResponsesSidecars(
       }
       recoveryKind = originalResponse?.status === 401 ? "oauth-401"
         : originalResponse?.status === 403 ? "oauth-account-403" : "anthropic-oauth-429";
-      sidecarBudget.ownCredentialHop(hop.permit);
+      sidecarBudget.ownCredentialHop(hop.permit, (canRunWebSearch || !!imgPlan || !!vidPlan) && transportState.adapter.name === "anthropic");
     } else {
       // No key pool, no generic OAuth roster, no Anthropic pool could produce a replacement
       // credential. The 429 is terminal for this sidecar turn.
@@ -454,6 +455,35 @@ export async function executeResponsesSidecars(
     });
     return { adapter: rotatedAdapter, recoveryKind };
   };
+  // One guard follows the active sidecar across all iterations. Enforced spend has no
+  // authoritative receipt for earlier legacy sends, so recovery cannot claim headroom there.
+  const thinkingRecovery = createAnthropicThinkingRecovery(parsed,
+    options.abortSignal ?? new AbortController().signal, { attempted: false },
+    () => !sendBudgetState.sendBudgetExhausted()
+      && !!sendBudgetState.adapterDispatchBudget
+      && sendBudgetState.adapterDispatchBudget.spendEnforced !== true);
+  const thinkingReceipt = (request: AdapterRequest, adapter: ProviderAdapter, recovery?: AttemptRecoveryKind) =>
+    adapter.name !== "anthropic" ? {} : { onPhysicalDispatch: () => {
+      if (recovery === "opaque-blob-rejection") {
+        const decision = sendBudgetState.adapterDispatchBudget?.reserveDispatch({
+          sendClass: "repair", targetKey: `${route.providerName}|${request.url}|${route.modelId}`,
+        });
+        if (sendBudgetState.adapterDispatchBudget?.spendEnforced || !decision?.allowed) {
+          if (decision?.allowed) decision.permit.release();
+          throw new SendBudgetExhaustedError("sidecar thinking recovery");
+        }
+        try { sendBudgetState.noteInitialDispatch(decision.permit); }
+        finally { decision.permit.release(); }
+      } else {
+        const existing = sidecarBudget.fetchOptions(adapter).onPhysicalDispatch;
+        if (existing) existing();
+        else {
+          const prepaid = sendBudgetState.pendingHopPermit;
+          sendBudgetState.pendingHopPermit = undefined;
+          sendBudgetState.noteInitialDispatch(prepaid);
+        }
+      }
+    } };
   // A loop's hidden rounds before a rotation were spent by the account it left. Bill them to that
   // account's attempt while it is still open; the next send seals it. Declined when that send
   // keeps the account (no new attempt), so the loop's final total still carries them.
@@ -520,6 +550,7 @@ export async function executeResponsesSidecars(
     );
     const imgResponse = await runWithImageBridge({
       parsed, adapter: transportState.adapter,
+      ...(transportState.adapter.name === "anthropic" ? { thinkingRecovery } : {}),
       clientToolCatalogRestriction: route.provider.authMode === "forward" ? undefined : requestState.clientToolCatalogRestriction,
       incomingMeta: { headers: requestState.selectedForwardHeaders, providerName: route.providerName, abortSignal: options.abortSignal, translatorBudget, ...(options.comboInitialSend ? { providerFetch: imageProviderFetch } : {}), ...sidecarBudget.incomingMeta },
       onProducerStart: sidecarBudget.takeProducerOwnership,
@@ -540,10 +571,11 @@ export async function executeResponsesSidecars(
       stallTimeoutSec: config.stallTimeoutSec,
       waitForRequestSlot: imageProviderFetch.waitForPacing,
       fetchImpl: imageProviderFetch.unpacedFetch ?? imageProviderFetch,
-      fetchForRequest: (request, iterParsed, adapter) => {
+      fetchForRequest: (request, iterParsed, adapter, recovery) => {
         const fetch = providerFetch(route.provider, options.codexWsRuntimeIdentity, {
           dispatchOverride: oauthDispatch(request, iterParsed),
           providerName: route.providerName, modelId: route.modelId, ...sidecarBudget.fetchOptions(adapter),
+          ...thinkingReceipt(request, adapter, recovery),
         });
         return fetch.unpacedFetch ?? fetch;
       },
@@ -569,6 +601,7 @@ export async function executeResponsesSidecars(
       ...(options.forceEmptyResponseId ? { forceEmptyResponseId: true } : {}),
       terminalRefusalAsFailed: inboundWire !== "chat" && inboundWire !== "anthropic",
       onCompletedResponse: (response, providerState) => {
+        if (!options.abortSignal?.aborted) thinkingRecovery.rememberSuccess(response);
         const served = transportState.replayOAuthCredentialSnapshot;
         if (route.providerName === "kiro" && response.status === "completed" && served
           && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
@@ -618,11 +651,13 @@ export async function executeResponsesSidecars(
       })(input, init)) as typeof globalThis.fetch;
     const loopResponse = await runWithWebSearch({
       parsed, adapter: transportState.adapter,
+      ...(transportState.adapter.name === "anthropic" ? { thinkingRecovery } : {}),
       clientToolCatalogRestriction: route.provider.authMode === "forward" ? undefined : requestState.clientToolCatalogRestriction,
       onIterationEnd: sidecarBudget.releaseUnsentHop,
-      fetchForRequest: (request, iterParsed, adapter) => providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+      fetchForRequest: (request, iterParsed, adapter, recovery) => providerFetch(route.provider, options.codexWsRuntimeIdentity, {
         dispatchOverride: oauthDispatch(request, iterParsed),
         providerName: route.providerName, modelId: route.modelId, ...sidecarBudget.fetchOptions(adapter),
+        ...thinkingReceipt(request, adapter, recovery),
       }),
       incomingMeta: {
         headers: requestState.selectedForwardHeaders,
@@ -683,6 +718,7 @@ export async function executeResponsesSidecars(
         if (route.providerName === "kiro" && response.status === "completed" && served
           && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
         commitReasoningReplayServingRoute();
+        if (!options.abortSignal?.aborted) thinkingRecovery.rememberSuccess(response);
         notifyResponseComplete(response);
       },
     });

package/src/server/responses/sidecar-send-budget.ts

@@ -22,8 +22,8 @@ export function createSidecarSendBudget(
   };
   return {
     /** Retain a Combo hop until dispatch; direct requests keep eager settlement. */
-    ownCredentialHop(permit?: SingleUseDispatchPermit): void {
-      if (!initial) { permit?.use(); return; } // Preserve direct callers' reporting contract.
+    ownCredentialHop(permit?: SingleUseDispatchPermit, retainUntilDispatch = false): void {
+      if (!initial && !retainUntilDispatch) { permit?.use(); return; } // Preserve direct callers' reporting contract.
       releaseHop();
       hopPermit = permit;
       budget.pendingHopPermit = permit;

package/src/server/responses-undeclared-tool-guard.ts

@@ -298,7 +298,7 @@ export function collectProviderExecutedCallTypes(body: unknown): Set<ProviderExe
   return callTypes;
 }
 
-function isAuthorizedProviderExecutedCall(
+export function isAuthorizedProviderExecutedCall(
   item: Record<string, unknown>,
   callTypes: ProviderExecutedCallTypes,
 ): boolean {

package/src/server/ws-bridge.ts

@@ -11,6 +11,7 @@ import { BoundedSseFrameBuffer } from "./sse-frame-buffer";
 import { sseDataPayload as parseSseBlock } from "./sse-payload-rewrite";
 import { safeResponseHeaders } from "./safe-response-headers";
 import type { AudioSocketTarget } from "./audio-dictation";
+import type { CodexWebSocketActivity } from "../codex/websocket-activity";
 
 export { safeResponseHeaders } from "./safe-response-headers";
 
@@ -19,6 +20,7 @@ type ResponsesTerminalReporter = (status: ResponsesTerminalStatus) => void;
 type ResponsesPayloadObserver = (payload: string) => void;
 
 export interface WsData {
+  responsesActivity?: CodexWebSocketActivity;
   nativeControl?: NativeResponseControl;
   /** Content-free per-turn explanation; never a model capability assertion. */
   nativeSteeringUnavailable?: string;

package/src/types/opencode-zen.ts

@@ -1,14 +1,14 @@
-/** Fixed-key OpenCode Zen destinations exposing the native Gemini endpoint. */
+/** Fixed-key OpenCode Zen destinations supporting native model protocols. */
 export interface OpenCodeZenDestination {
   readonly baseUrl?: unknown;
   readonly authMode?: unknown;
   readonly googleMode?: unknown;
 }
 
-export function openCodeZenBaseUrl(provider: OpenCodeZenDestination | undefined): string | undefined {
+/** Match the official Zen destination and API-key authentication. */
+export function openCodeZenKeyBaseUrl(provider: OpenCodeZenDestination | undefined): string | undefined {
   if (!provider || typeof provider.baseUrl !== "string") return undefined;
   if (provider.authMode !== undefined && provider.authMode !== "key") return undefined;
-  if (provider.googleMode !== undefined && provider.googleMode !== "ai-studio") return undefined;
   try {
     const url = new URL(provider.baseUrl.trim());
     const pathname = url.pathname.replace(/\/+$/, "");
@@ -20,6 +20,12 @@ export function openCodeZenBaseUrl(provider: OpenCodeZenDestination | undefined)
   }
 }
 
+/** Gemini's native endpoint applies only in AI Studio mode. */
+export function openCodeZenBaseUrl(provider: OpenCodeZenDestination | undefined): string | undefined {
+  if (provider?.googleMode !== undefined && provider.googleMode !== "ai-studio") return undefined;
+  return openCodeZenKeyBaseUrl(provider);
+}
+
 /** Keep the selected destination; Zen omits AI Studio's /v1beta segment. */
 export function openCodeZenGeminiEndpoint(provider: OpenCodeZenDestination, modelId: string): string | undefined {
   const baseUrl = openCodeZenBaseUrl(provider);

package/src/types/request.ts

@@ -68,6 +68,11 @@ export interface OcxParsedRequest {
    * them, and only for api.anthropic.com; every other destination never sees them.
    */
   _anthropicServerTools?: readonly Record<string, unknown>[];
+  /**
+   * Completed server-tool exchanges from the Claude client's history, keyed by the block that
+   * followed them (`call:<tool_use id>` / `text:<text>`). Same audience as `_anthropicServerTools`.
+   */
+  _anthropicServerReplay?: ReadonlyMap<string, readonly Record<string, unknown>[]>;
   /**
    * Boundary between replayed history and this turn's newly appended input. Usually the
    * items the proxy restored from local previous_response_id state; also set when the
@@ -414,6 +419,9 @@ export interface OcxProviderContinuationState {
   [provider: string]: Record<string, unknown> | undefined;
 }
 
+/** One Anthropic server-side call as the API returned it: `server_tool_use` + its `*_tool_result`. */
+export interface AnthropicServerBlocks { use: Record<string, unknown>; result: Record<string, unknown> }
+
 export type AdapterEvent =
   | { type: "heartbeat"; replayUnsafe?: true; preflightReady?: true }
   | { type: "text_delta"; text: string; phase?: OcxMessagePhase;
@@ -443,8 +451,8 @@ export type AdapterEvent =
   | { type: "web_search_call_begin"; id: string }
   | {
       type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[];
-      /** Anthropic's server-side web_fetch (adapters/anthropic.ts): the opened page and its `web_fetch_tool_result` content, verbatim. */
-      fetch?: { url: string; result: unknown };
+      /** Anthropic's server-side call (adapters/anthropic.ts): its `server_tool_use` and result block, verbatim. */
+      anthropic?: AnthropicServerBlocks;
     }
   | {
       type: "done";

package/src/types/wire.ts

@@ -1,5 +1,5 @@
 import { isOpenCodeGoGeminiDestination, OPENCODE_GO_BASE_URL, OPENCODE_GO_MODEL_WIRES, OPENCODE_GO_LEGACY_NAME_PINS, type OpenCodeGoDestination } from "./opencode-go";
-import { openCodeZenBaseUrl, type OpenCodeZenDestination } from "./opencode-zen";
+import { openCodeZenBaseUrl, openCodeZenKeyBaseUrl, type OpenCodeZenDestination } from "./opencode-zen";
 
 /**
  * Accepted values for the per-provider upstream HTTP-version pin (#1668). Shared by the
@@ -106,7 +106,9 @@ const CREDENTIAL_PINNED_ADAPTERS: Readonly<Record<string, Readonly<Record<string
 
 function prefixPinsFor(providerName: string, provider: WirePinProvider | undefined): Readonly<Record<string, string>> | undefined {
   if (Object.hasOwn(CREDENTIAL_PINNED_ADAPTERS, providerName)) return CREDENTIAL_PINNED_ADAPTERS[providerName];
-  if (providerName === "opencode-zen" && openCodeZenBaseUrl(provider)) return { "gemini-": "google" };
+  if (providerName === "opencode-zen" && openCodeZenKeyBaseUrl(provider)) {
+    return openCodeZenBaseUrl(provider) ? { "gemini-": "google", "claude-": "anthropic" } : { "claude-": "anthropic" };
+  }
   if (!provider || !Object.hasOwn(WIRE_ADAPTER_PIN_PREFIXES, providerName)) return undefined;
   const rule = WIRE_ADAPTER_PIN_PREFIXES[providerName]!;
   return normalizedEndpoint(provider.baseUrl) === rule.endpoint ? rule.prefixes : undefined;

package/src/types.ts

@@ -61,6 +61,7 @@ export type {
   OcxProviderContinuationOwner,
   OcxProviderContinuationState,
   AdapterEvent,
+  AnthropicServerBlocks,
   OcxUrlCitation,
   OcxUsage,
 } from "./types/request";

package/src/usage/summary.ts

@@ -665,8 +665,12 @@ function addEstimatedCost(
   entry: Pick<PersistedUsageEntry, "usageStatus" | "usage" | "attempts">,
   costInfo: EntryCostInfo,
 ): void {
-  if (entry.usageStatus === "unreported" || entry.usageStatus === "unsupported"
-    || (!entry.usage && !entry.attempts?.length)) {
+  // A row of attempts reads `unreported` when any leg lacks usage. Once one leg is measured the row
+  // is metered and the attempt-level pricing decides, matching the model and provider breakdowns.
+  const measuredAttempt = entry.attempts?.some(attempt => attempt.usage && isMeasuredStatus(attempt.usageStatus));
+  if (!measuredAttempt
+    && (entry.usageStatus === "unreported" || entry.usageStatus === "unsupported"
+      || (!entry.usage && !entry.attempts?.length))) {
     totals.unmeteredRequests += 1;
     return;
   }
@@ -822,7 +826,9 @@ function blankRequestCounts(): UsageRequestCounts {
 function spentNothing(attempt: NonNullable<PersistedUsageEntry["attempts"]>[number] | undefined): boolean {
   if (!attempt || attempt.usage) return false;
   if (attempt.sendCount === 0 || attempt.locallyAnswered === true) return true;
-  return attempt.status >= 400 && attempt.streamAborted !== true && attempt.firstOutputMs === undefined;
+  // A 499 is the client hanging up on a send upstream may already be generating for.
+  return attempt.status >= 400 && attempt.status !== 499
+    && attempt.streamAborted !== true && attempt.firstOutputMs === undefined;
 }
 
 function bumpRequestCounts(counts: UsageRequestCounts, facts: number, amount = 1): void {

package/src/usage/telemetry-contract.ts

@@ -32,6 +32,7 @@ export const ATTEMPT_RECOVERY_KIND_ROSTER = Object.freeze([
   "rate-limit-429",
   "anthropic-oauth-429",
   "oauth-account-429",
+  "oauth-account-402",
   "image-413",
   "console-go-upload-retry",
   "opaque-blob-rejection",

package/src/web-search/anthropic-history.ts

@@ -0,0 +1,59 @@
+import type { AdapterEvent, OcxAssistantContentPart, OcxThinkingContent, OcxToolCall } from "../types";
+
+/** Rebuild one validated Anthropic model response without changing its search arguments or order. */
+export function anthropicSearchAssistantContent(events: readonly AdapterEvent[]): OcxAssistantContentPart[] {
+  const content: OcxAssistantContentPart[] = [];
+  let thinking: OcxThinkingContent | undefined;
+  let text: Extract<OcxAssistantContentPart, { type: "text" }> | undefined;
+  let call: OcxToolCall | undefined;
+  let argumentsText = "";
+  for (const event of events) {
+    if (event.type === "heartbeat") continue;
+    // A signature is a replacement snapshot until the next semantic block starts.
+    if (thinking?.signature !== undefined && event.type !== "thinking_signature") thinking = undefined;
+    if (event.type !== "text_delta") text = undefined;
+    switch (event.type) {
+      case "thinking_delta":
+        if (!thinking) { thinking = { type: "thinking", thinking: "" }; content.push(thinking); }
+        thinking.thinking += event.thinking;
+        break;
+      case "thinking_signature":
+        if (!thinking) { thinking = { type: "thinking", thinking: "" }; content.push(thinking); }
+        thinking.signature = event.signature;
+        break;
+      case "redacted_thinking":
+        thinking = undefined;
+        content.push({ type: "thinking", thinking: "", redacted: [event.data] });
+        break;
+      case "text_delta":
+        thinking = undefined;
+        if (event.anthropicThinkingSignature) {
+          text = undefined;
+          content.push({ type: "thinking", thinking: event.text, signature: event.anthropicThinkingSignature });
+          break;
+        }
+        if (!text) { text = { type: "text", text: "" }; content.push(text); }
+        text.text += event.text;
+        break;
+      case "tool_call_start":
+        thinking = undefined;
+        call = { type: "toolCall", id: event.id, name: event.name, arguments: {},
+          ...(event.providerMetadata ? { providerMetadata: event.providerMetadata } : {}) };
+        content.push(call);
+        argumentsText = "";
+        break;
+      case "tool_call_delta":
+        argumentsText += event.arguments;
+        break;
+      case "tool_call_end": {
+        if (!call) throw new Error("search history has an unpaired tool call");
+        const args: unknown = JSON.parse(argumentsText || "{}");
+        if (!args || typeof args !== "object" || Array.isArray(args)) throw new Error("search history tool input is not an object");
+        call.arguments = args as Record<string, unknown>;
+        call = undefined;
+        break;
+      }
+    }
+  }
+  return content;
+}