@bitkyc08/opencodex 2.87.0 → 2.88.0

package/src/images/loop.ts

@@ -1,3 +1,5 @@
+import type { createAnthropicThinkingRecovery } from "../server/responses/anthropic-thinking-recovery";
+import { bindAnthropicRejectionResponse } from "../adapters/anthropic-rejection-memo";
 /**
  * Media bridge agentic loop — supports both image and video generation sidecars.
  *
@@ -23,7 +25,7 @@ import { bridgeToResponsesSSE } from "../bridge";
 import { isTerminalRefusalIncomplete } from "../bridge/terminal-refusal";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { readBoundedResponseBody } from "../lib/bounded-body";
-import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait } from "../lib/upstream-retry";
+import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait, isNonReplayableResponse, SendBudgetExhaustedError } from "../lib/upstream-retry";
 import { rateLimitRetryDelayMs } from "../providers/key-failover";
 import { releaseProviderRequestSlot, sendTrackingRequestSlot, type ProviderRequestSlot } from "../providers/request-pacing";
 import {
@@ -33,7 +35,7 @@ import {
   TRANSLATOR_MAX_TURN_BYTES,
   TranslatorBudgetExceededError,
 } from "../lib/translator-budget";
-import { parseStreamWithProgress, RoutedModelInactivityError, WebSearchStreamProtocolError } from "../web-search/progress-stream";
+import { parseStreamWithProgress, RoutedModelInactivityError, WebSearchStreamProtocolError, WebSearchAdapterEventError } from "../web-search/progress-stream";
 import { fulfillImageCall } from "./fulfill";
 import { parseVideoCallArgs, pollVideoWithHeartbeats, buildVideoResult, createVideoBudget } from "./fulfill-video";
 import { submitVideoJob } from "./xai-video-client";
@@ -270,17 +272,18 @@ function extractIterationThinking(events: AdapterEvent[]): OcxThinkingContent[]
   return parts;
 }
 
-function jsonError(status: number, message: string): Response {
-  return new Response(JSON.stringify({ error: { message, type: "upstream_error", code: null } }), {
+function jsonError(status: number, message: string, event?: Extract<AdapterEvent, { type: "error" }>): Response {
+  return new Response(JSON.stringify({ error: { message, type: event?.errorType ?? "upstream_error", code: event?.code ?? null,
+    ...(event?.retryable === false ? { retryable: false } : {}) } }), {
     status,
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", ...(event?.retryable === false ? { "x-should-retry": "false" } : {}) },
   });
 }
 
 /** Hard provider/parse failure inside an iteration. The eager first iteration converts it to a
  *  non-2xx jsonError; later (already-streaming) iterations surface it as an in-stream error event. */
 class LoopError extends Error {
-  constructor(readonly status: number, message: string) {
+  constructor(readonly status: number, message: string, readonly event?: Extract<AdapterEvent, { type: "error" }>) {
     super(message);
     this.name = "LoopError";
   }
@@ -291,6 +294,7 @@ class LoopError extends Error {
  * metadata, and the optional image/video bridge plans.
  */
 export interface ImageBridgeDeps {
+  thinkingRecovery?: ReturnType<typeof createAnthropicThinkingRecovery>;
   parsed: OcxParsedRequest;
   clientToolCatalogRestriction?: ClientToolCatalogRestriction;
   adapter: ProviderAdapter;
@@ -321,7 +325,7 @@ export interface ImageBridgeDeps {
   /** Provider-specific fetch (e.g. xAI transport wrapper). Falls back to global fetch. */
   fetchImpl?: typeof globalThis.fetch;
   /** Bind physical dispatch to this iteration's built request; pacing remains owned by the loop. */
-  fetchForRequest?: (request: AdapterRequest, parsed: OcxParsedRequest, adapter: ProviderAdapter) => typeof globalThis.fetch;
+  fetchForRequest?: (request: AdapterRequest, parsed: OcxParsedRequest, adapter: ProviderAdapter, recovery?: AttemptRecoveryKind) => typeof globalThis.fetch;
   /** Reserve the routed provider's next request-start slot before each adapter dispatch. */
   waitForRequestSlot?: (signal?: AbortSignal) => Promise<ProviderRequestSlot | void>;
   /** Raw adapter usage at the terminal event, pre wire-normalization (see bridgeToResponsesSSE onUsage). */
@@ -464,6 +468,8 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
   interface IterationResponse {
     response: Response;
     responseAdapter: ProviderAdapter;
+    parsed?: OcxParsedRequest;
+    retryThinking?: () => Promise<IterationResponse>;
     /** runTurn events are already bounded; consume them without replaying or charging twice. */
     collectedEvents?: AdapterEvent[];
   }
@@ -634,7 +640,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
           cachedRequest = request;
           cachedAdapter = requestAdapter;
         }
-        const requestFetch = deps.fetchForRequest?.(request, iterParsed, requestAdapter) ?? fetchImpl;
+        const requestFetch = deps.fetchForRequest?.(request, iterParsed, requestAdapter, recovery) ?? fetchImpl;
         let response: Response;
         try {
           if (requestAdapter.fetchResponse) {
@@ -685,7 +691,8 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         } finally {
           request.releaseBodyObservation?.();
         }
-        return { response, responseAdapter: requestAdapter };
+        bindAnthropicRejectionResponse(request, response);
+        return { response, responseAdapter: requestAdapter, parsed: iterParsed };
       };
 
       let prepared = await fetchOnce(adapter);
@@ -739,9 +746,18 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         prepared = await fetchOnce(adapter, rotated.recoveryKind);
       }
 
+      if (await deps.thinkingRecovery?.prepareHttp(prepared.response, prepared.responseAdapter.name, iterParsed)) {
+        try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+        cachedRequest = undefined;
+        prepared = await fetchOnce(adapter, "opaque-blob-rejection");
+      }
       // Final headers have arrived. Clear only the deadline timer before ANY body read.
       headerDeadline.clear();
       if (!prepared.response.ok) {
+        if (deps.thinkingRecovery && prepared.responseAdapter.name === "anthropic") {
+          const event = await deps.thinkingRecovery.projectHttpFailure(prepared.response, signal);
+          throw new LoopError(event.status ?? prepared.response.status, event.message, event);
+        }
         let body: Awaited<ReturnType<typeof readBoundedResponseBody>>;
         try {
           body = await readBoundedResponseBody(prepared.response, { signal });
@@ -762,9 +778,21 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         const suffix = formatted ? `: ${formatted.slice(0, 400)}` : "";
         throw new LoopError(prepared.response.status, `Provider error ${prepared.response.status}${suffix}`);
       }
-      return prepared;
+      return { ...prepared, retryThinking: async () => {
+        cachedRequest = undefined;
+        headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+        try { return await fetchOnce(adapter, "opaque-blob-rejection"); }
+        catch (error) {
+          if (signal.aborted) throw new LoopError(499, "client closed request during image-bridge");
+          if (headerDeadline.didExpire()) throw new LoopError(504,
+            `Provider response-header timeout after ${connectTimeoutMs}ms during image-bridge`);
+          throw error;
+        } finally { headerDeadline.clear(); deps.onIterationEnd?.(); }
+      } };
     } catch (error) {
       if (isTranslatorBudgetExceededError(error)) throw error;
+      if (error instanceof SendBudgetExhaustedError) throw new LoopError(429, error.message,
+        { type: "error", status: 429, errorType: "rate_limit_error", code: error.code, message: error.message, retryable: false });
       if (headerDeadline.didExpire()) {
         throw new LoopError(504, `Provider response-header timeout after ${connectTimeoutMs}ms during image-bridge`);
       }
@@ -791,14 +819,31 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
     const iterationBudget = prepared.collectedEvents ? undefined : createIterationEventBudget();
     try {
       if (iterationBudget) {
-        const parse = prepared.responseAdapter.parseStream.bind(prepared.responseAdapter);
-        for await (const event of parseStreamWithProgress(prepared.response, parse, {
-          signal,
-          inactivityTimeoutMs: stallTimeoutMs,
-          translatorBudget,
-          // A pass that fails was still billed; the error terminal below reports it with the hidden passes.
-          onErrorUsage: usage => { hiddenUsage = addUsage(hiddenUsage, usage); },
-        })) {
+        const parse = async function* (current: IterationResponse): AsyncGenerator<AdapterEvent> {
+          if (!current.response.ok && deps.thinkingRecovery) {
+            yield await deps.thinkingRecovery.projectHttpFailure(current.response, signal);
+            return;
+          }
+          try {
+            yield* parseStreamWithProgress(current.response, current.responseAdapter.parseStream.bind(current.responseAdapter), {
+              signal, inactivityTimeoutMs: stallTimeoutMs, translatorBudget,
+              preserveAdapterError: deps.thinkingRecovery !== undefined,
+              onErrorUsage: usage => { hiddenUsage = addUsage(hiddenUsage, usage); },
+            });
+          } catch (error) {
+            if (!(error instanceof WebSearchAdapterEventError)) throw error;
+            if (!error.replaySafe) yield { type: "heartbeat", replayUnsafe: true };
+            yield isNonReplayableResponse(current.response)
+              ? { ...error.event, message: "Provider stream error: upstream diagnostic withheld for a non-replayable failure", retryable: false }
+              : error.event;
+          }
+        };
+        const source = deps.thinkingRecovery && prepared.retryThinking
+          ? deps.thinkingRecovery.wrap(parse(prepared), async function* () {
+              yield* parse(await prepared.retryThinking!());
+            }, () => prepared.responseAdapter.name, !isNonReplayableResponse(prepared.response), prepared.response, prepared.parsed)
+          : parse(prepared);
+        for await (const event of source) {
           if (event.type === "heartbeat") yield event;
           else {
             iterationBudget.retain(event);
@@ -812,6 +857,9 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         throw error;
       }
       if (signal.aborted) throw new LoopError(499, "client closed request during image-bridge");
+      if (error instanceof LoopError) throw error;
+      if (error instanceof SendBudgetExhaustedError) throw new LoopError(429, error.message,
+        { type: "error", status: 429, errorType: "rate_limit_error", code: error.code, message: error.message, retryable: false });
       if (error instanceof RoutedModelInactivityError) throw new LoopError(504, error.message);
       if (error instanceof WebSearchStreamProtocolError) throw new LoopError(502, error.message);
       throw new LoopError(502, `Provider stream error: ${error instanceof Error ? error.message : String(error)}`);
@@ -829,8 +877,9 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       if (terminal.code === "translation_buffer_limit") {
         throw new TranslatorBudgetExceededError("retained_collectors", TRANSLATOR_MAX_TURN_BYTES);
       }
-      throw new LoopError(502, terminal.message);
+      throw new LoopError(terminal.status ?? 502, terminal.message, terminal);
     }
+    deps.thinkingRecovery?.observeIteration(events);
     return scanEventsForImageCall(events, mediaToolNames);
   };
 
@@ -845,7 +894,9 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       firstPrepared = await prepareIterationDrained(maxRounds <= 0);
     } catch (e) {
       if (abortSignal) abortSignal.removeEventListener("abort", linkAbort);
-      if (e instanceof LoopError) return jsonError(e.status, e.message);
+      if (e instanceof LoopError) return jsonError(e.status, e.message, e.event);
+      if (e instanceof SendBudgetExhaustedError) return jsonError(429, e.message,
+        { type: "error", status: 429, errorType: "rate_limit_error", code: e.code, message: e.message, retryable: false });
       throw e;
     }
   }
@@ -1101,7 +1152,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
             yield {
               type: "error",
               message: e instanceof LoopError ? e.message : (e instanceof Error ? e.message : String(e)),
-              ...(e instanceof LoopError ? { status: e.status } : {}),
+              ...(e instanceof LoopError ? { status: e.status, ...(e.event ?? {}) } : {}),
               ...(usage ? { usage } : {}),
             };
           }

package/src/lib/request-failure-model.ts

@@ -223,6 +223,8 @@ const RECOVERY_KIND_CAUSE = {
   "rate-limit-429": "rate-limit",
   "anthropic-oauth-429": "rate-limit",
   "oauth-account-429": "rate-limit",
+  // A 402 is the account's quota, not a transient limit; only another account can serve it.
+  "oauth-account-402": "quota-exhausted",
   "image-413": "payload-too-large",
   // The gateway rejects a body it accepts seconds later and the replay is byte-identical, so
   // nothing about the payload was wrong; the origin declined to take it at that moment.

package/src/oauth/generic-account-failover.ts

@@ -483,7 +483,8 @@ export function noteGenericPoolSelection(
  * Cool the account that actually 429'd and name the next eligible one, or null.
  *
  * Returns the id only; the caller mints the credential so a failed refresh does not leave the
- * cooldown applied to an account we then could not use.
+ * cooldown applied to an account we then could not use. `commit: false` still cools the failed
+ * account but only peeks the round-robin ring, for callers that will not dispatch the answer.
  */
 export function rotateGenericOAuthAccountOn429(
   config: OcxConfig,
@@ -492,9 +493,10 @@ export function rotateGenericOAuthAccountOn429(
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   requestedModelId?: string | null,
+  commit = true,
 ): string | null {
   return rotateGenericOAuthAccountOnRefusal(config, providerName, failedAccountId, "rate",
-    retryAfterHeader, now, requestedModelId);
+    retryAfterHeader, now, requestedModelId, undefined, commit);
 }
 
 /** Kiro adds account-scoped refusal classes; all other providers retain their 429 policy. */
@@ -507,6 +509,7 @@ export function rotateGenericOAuthAccountOnRefusal(
   now = Date.now(),
   requestedModelId?: string | null,
   monthlyCooldownMs?: number,
+  commit = true,
 ): string | null {
   if (kind === "other" || (providerName !== "kiro" && kind !== "rate")) return null;
   if (!isGenericOAuthFailoverEnabled(config, providerName)) return null;
@@ -566,8 +569,8 @@ export function rotateGenericOAuthAccountOnRefusal(
   }
   if (strategy === "round-robin") {
     // PICK here, not peek: the failure already happened and this answer is the one being used,
-    // so the ring genuinely advances.
-    return pickRoundRobinAccount(
+    // so the ring genuinely advances. A caller that only asks whether a sibling exists peeks.
+    return (commit ? pickRoundRobinAccount : peekRoundRobinAccount)(
       genericPoolKey(providerName),
       candidates,
       genericStickyLimit(config, providerName),

package/src/protocols/encoders/adapter-events.ts

@@ -28,7 +28,7 @@
  * completed-response effects belong to the caller, which folds the same events with
  * `buildResponseJSON` at the terminal through `beforeTerminal`.
  */
-import type { AdapterEvent, OcxMessagePhase, OcxProviderContinuationState, OcxUsage } from "../../types";
+import type { AdapterEvent, AnthropicServerBlocks, OcxMessagePhase, OcxProviderContinuationState, OcxUsage } from "../../types";
 import { normalizeDeclaredToolName } from "../../types";
 import { coerceIntegerToolArguments } from "../../lib/tool-argument-integers";
 import { classifyError, isCyberPolicyCode, type OcxErrorPayload } from "../../lib/errors";
@@ -61,7 +61,7 @@ export interface ClientWebSearch {
   status: "completed" | "failed";
   queries: string[];
   sources: { url: string; title?: string }[];
-  fetch?: { url: string; result: unknown };
+  anthropic?: AnthropicServerBlocks;
 }
 
 /**
@@ -412,9 +412,9 @@ export function encodeAdapterEventStream(
     budget.closeCall(call.callId);
     currentToolCall = null;
   };
-  const closeCurrentWebSearch = (status: "completed" | "failed", queries: string[], sources?: { url: string; title?: string }[], fetch?: ClientWebSearch["fetch"]) => {
+  const closeCurrentWebSearch = (status: "completed" | "failed", queries: string[], sources?: { url: string; title?: string }[], anthropic?: AnthropicServerBlocks) => {
     if (!currentWebSearch) return;
-    writer.webSearchDone({ itemId: currentWebSearch.itemId, status, queries, sources: sources ?? [], ...(fetch ? { fetch } : {}) });
+    writer.webSearchDone({ itemId: currentWebSearch.itemId, status, queries, sources: sources ?? [], ...(anthropic ? { anthropic } : {}) });
     currentWebSearch = null;
   };
   const appendToolArgs = (call: OpenToolCall, fragment: string) => {
@@ -689,7 +689,7 @@ export function encodeAdapterEventStream(
               if (currentWebSearch) closeCurrentWebSearch("completed", []);
               currentWebSearch = { itemId: `ws_${uuid()}`, eventId: event.id };
             }
-            closeCurrentWebSearch(event.status ?? "completed", event.queries, safeWebSearchSources(event.sources), event.fetch);
+            closeCurrentWebSearch(event.status ?? "completed", event.queries, safeWebSearchSources(event.sources), event.anthropic);
             break;
           }
           case "done": {

package/src/protocols/encoders/messages.ts

@@ -345,9 +345,9 @@ function createAnthropicMessageWriter(
         type: "web_search_call",
         id: search.itemId,
         status: search.status,
-        action: webSearchAction(search.queries, search.fetch),
+        action: webSearchAction(search.queries, search.anthropic),
         ...(search.sources.length > 0 ? { sources: search.sources } : {}),
-        ...(search.fetch ? { fetch_result: search.fetch.result } : {}),
+        ...(search.anthropic ? { anthropic_blocks: search.anthropic } : {}),
       });
       const toolIndex = blockIndex++;
       emit("content_block_start", {

package/src/providers/opencode-zen-rate-limit.ts

@@ -70,6 +70,9 @@ export function enrichOpenCodeZenRateLimitMessage(
   message: string,
   opts: {
     status: number;
+    /** Parsed upstream error type, when available. */
+    upstreamErrorType?: string | null;
+    upstreamErrorCode?: string | null;
     providerName?: string;
     baseUrl?: string;
     adapter?: string;
@@ -84,7 +87,9 @@ export function enrichOpenCodeZenRateLimitMessage(
 ): string {
   if (opts.status !== 429) return message;
   if (!isOpenCodeZenRateLimitProvider(opts)) return message;
-  if (!/rate\s*limit/i.test(message)) return message;
+  const errorText = `${opts.upstreamErrorType ?? ""} ${opts.upstreamErrorCode ?? ""} ${message}`.replace(/[_-]/g, " ");
+  if (/\b(?:quota|billing)\b|\busage\s+limit\b|\binsufficient\s+(?:credits?|balance|funds)\b|\b(?:credits?|balance)\s+(?:exhausted|depleted)\b/i.test(errorText)) return message;
+  if (opts.upstreamErrorType !== "rate_limit_error" && !/rate\s*limit/i.test(message)) return message;
   if (message.includes(ENRICHMENT_MARKER)) return message;
 
   const upstreamRetry = validateClientRetryAfterHeader(
@@ -165,7 +170,7 @@ export function enrichOpenCodeZenFreeTierMessage(
 }
 
 /**
- * Single entry point for Zen upstream-error guidance on the Responses wire: short-window
+ * Single entry point for Zen upstream-error guidance on Responses and native Messages: short-window
  * rate limits first, then the keyless free-tier admission refusal. Each layer is a no-op
  * outside its own case, so the composition is safe for every other upstream failure.
  */

package/src/responses/reasoning-replay-cache.ts

@@ -46,6 +46,7 @@ export function nativeReasoningTagMatches(expected: string | undefined, presente
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
 const OPAQUE_BLOB_REJECTION_TTL_MS = 5 * 60 * 1000;
+const MAX_OPAQUE_BLOB_REJECTION_FINGERPRINTS = 256;
 const replayIdentityKey = randomBytes(32);
 const CREDENTIAL_HEADER_NAMES = new Set([
   "authorization",
@@ -78,8 +79,14 @@ interface ServingIdentityEntry {
 interface OpaqueBlobRejectionEntry {
   bytes: number;
   at: number;
+  /** Undefined retains the legacy blanket rejection; only payload digests are stored here. */
+  fingerprints?: ReadonlySet<string>;
 }
 
+export type ReasoningReplayOpaqueBlobRejection =
+  | { mode: "blanket" }
+  | { mode: "selective"; fingerprints: ReadonlySet<string> };
+
 const entries = new Map<string, CacheEntry>();
 const servingIdentities = new Map<string, ServingIdentityEntry>();
 const opaqueBlobRejections = new Map<string, OpaqueBlobRejectionEntry>();
@@ -310,18 +317,57 @@ export function reasoningReplayOpaqueBlobRejectionMemoized(
   return opaqueBlobRejections.has(key);
 }
 
+/** Undefined means no live memo; a selective result owns a defensive copy of its digests. */
+export function getReasoningReplayOpaqueBlobRejection(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): ReasoningReplayOpaqueBlobRejection | undefined {
+  const key = opaqueBlobRejectionKeyFor(scope);
+  if (!key) return undefined;
+  sweepExpiredOpaqueBlobRejections(now());
+  const entry = opaqueBlobRejections.get(key);
+  return entry === undefined ? undefined : entry.fingerprints === undefined ? { mode: "blanket" }
+    : { mode: "selective", fingerprints: new Set(entry.fingerprints) };
+}
+
+/** Incomplete, invalid or unbounded enumerations cannot safely narrow the legacy rejection. */
+function boundedRejectionFingerprints(fingerprints: ReadonlySet<string> | undefined): Set<string> | undefined {
+  if (fingerprints === undefined) return undefined;
+  const copy = new Set<string>();
+  try {
+    // The intrinsic validates a real Set without trusting an overridden iterator or size getter.
+    for (const value of Set.prototype.values.call(fingerprints) as IterableIterator<unknown>) {
+      if (typeof value !== "string" || value.length !== 64 || !/^[a-f0-9]{64}$/.test(value)
+        || copy.size >= MAX_OPAQUE_BLOB_REJECTION_FINGERPRINTS) return undefined;
+      copy.add(value);
+    }
+  } catch { return undefined; }
+  return copy.size > 0 ? copy : undefined;
+}
+
 /** Record only after a blobless retry succeeded for this durable serving identity. */
 export function rememberReasoningReplayOpaqueBlobRejection(
   scope: OcxReasoningReplayScopeRef | undefined,
+  fingerprints?: ReadonlySet<string>,
 ): void {
   const key = opaqueBlobRejectionKeyFor(scope);
   if (!key) return;
-  const bytes = Buffer.byteLength(key, "utf8");
-  if (bytes > MAX_TOTAL_BYTES) return;
+  const keyBytes = Buffer.byteLength(key, "utf8");
+  if (keyBytes > MAX_TOTAL_BYTES) return;
   const at = now();
   sweepExpiredOpaqueBlobRejections(at);
-  if (opaqueBlobRejections.has(key)) deleteOpaqueBlobRejection(key);
-  opaqueBlobRejections.set(key, { bytes, at });
+  const previous = opaqueBlobRejections.get(key);
+  let merged = previous && previous.fingerprints === undefined ? undefined : boundedRejectionFingerprints(fingerprints);
+  if (merged && previous?.fingerprints) {
+    for (const fingerprint of previous.fingerprints) {
+      merged.add(fingerprint);
+      if (merged.size > MAX_OPAQUE_BLOB_REJECTION_FINGERPRINTS) { merged = undefined; break; }
+    }
+  }
+  // A near-limit key can still retain its existing blanket memo if the digest set will not fit.
+  if (merged && keyBytes + merged.size * 64 > MAX_TOTAL_BYTES) merged = undefined;
+  const bytes = keyBytes + (merged?.size ?? 0) * 64;
+  if (previous) deleteOpaqueBlobRejection(key);
+  opaqueBlobRejections.set(key, { bytes, at, ...(merged ? { fingerprints: merged } : {}) });
   opaqueBlobRejectionTotalBytes += bytes;
   while (
     (opaqueBlobRejectionTotalBytes > MAX_TOTAL_BYTES || opaqueBlobRejections.size > MAX_ENTRIES)

package/src/routing/analytics.ts

@@ -12,7 +12,7 @@
  */
 
 import type { PersistedUsageEntry } from "../usage/log";
-import { estimateRequestCost, serviceTierContext } from "../usage/cost";
+import { computeEntryCost } from "../usage/summary";
 import { openRequestHistoryIndex, requestHistoryDb } from "./history/indexer";
 
 export const ANALYTICS_MAX_ROWS = 50_000;
@@ -122,6 +122,7 @@ const COOLDOWN_RECOVERY_KINDS = new Set([
   "oauth-account-403",
   "anthropic-oauth-429",
   "oauth-account-429",
+  "oauth-account-402",
 ]);
 
 function percentile(sorted: number[], p: number): number | undefined {
@@ -158,19 +159,10 @@ function cooldownTriggering(entry: PersistedUsageEntry | null, status: number):
   });
 }
 
-function successCostUsd(
-  row: Pick<ScannedRow, "provider" | "model">,
-  entry: PersistedUsageEntry,
-): number | null {
-  if (!entry.usage) return null;
-  const estimate = estimateRequestCost({
-    provider: row.provider,
-    model: row.model,
-    usage: entry.usage,
-    usageStatus: entry.usageStatus,
-    serviceTier: serviceTierContext(entry),
-  });
-  return estimate ? estimate.cost.total : null;
+/** Same attempt-aware pricing as /api/usage, so a refused retry before a measured send is priced. */
+function successCostUsd(entry: PersistedUsageEntry): number | null {
+  const { isPriced, costTotal } = computeEntryCost(entry);
+  return isPriced ? costTotal : null;
 }
 
 export async function computeRoutingAnalytics(
@@ -245,7 +237,7 @@ export async function computeRoutingAnalytics(
     if (kind === "success") {
       const entry = parseEntry(row.rowJson);
       if (entry) {
-        rowCostUsd = successCostUsd(row, entry);
+        rowCostUsd = successCostUsd(entry);
         if (rowCostUsd !== null) {
           costTotalUsd += rowCostUsd;
           costCount += 1;

package/src/server/claude-messages.ts

@@ -33,7 +33,7 @@ import { resolveAlias, claudeCodeNativeAlias, legacyAliasForNative } from "../cl
 import { recordDesktopRequest } from "../claude/desktop-health";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
-import { declaredAnthropicServerTools } from "../claude/inbound-content-options";
+import { declaredAnthropicServerTools, replayedAnthropicServerBlocks } from "../claude/inbound-content-options";
 import { claudeCodeForIngress } from "../claude/intercept/model-bindings";
 import { classifyInterceptClient } from "../claude/intercept/client-class";
 import { analyzeClaudeCompatibility, isClaudeCompatibilityMode } from "../claude/compatibility";
@@ -1133,6 +1133,7 @@ async function handleClaudeMessagesWithBudget(
     nativeReasoningMint,
     // Out of body like the replay above: the core hands these to an Anthropic destination only.
     anthropicServerTools: declaredAnthropicServerTools(anthropicBody),
+    anthropicServerReplay: replayedAnthropicServerBlocks(anthropicBody),
     claudeGoAffinity: { sessionLane: claudeGoSessionLane },
     claudeNativeSessionId,
     stripClaudeMainAuthForNoncanonicalForward: true,

package/src/server/index/live-sideband.ts

@@ -40,8 +40,9 @@ export const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
  *
  * What must never happen is neither: an immortal socket plus a destination that silently accepts
  * the orphaned delta. `tests/responses/ws-endpoint.test.ts` holds exactly that pair together.
- * Raising the timeout off 0 is still worth doing for its own reasons (a dead peer holds a socket
- * forever today), and Bun caps the value at 255 seconds, well inside the bound below.
+ * Responses admission separately reclaims its least recently used idle connection under
+ * capacity pressure. That is not a time limit, so expired-reference validation remains required.
+ * Keeping this shared timeout at 0 also preserves quiet live/voice sessions.
  */
 export const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
 /** Ceiling a finite websocket idle timeout must stay under, in seconds. See above. */

package/src/server/index/serve-options.ts

@@ -1618,11 +1618,17 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // Promote a caller `x-session-id` before admission, as Responses and Messages do (#6520):
         // the ChatGPT bridge forwards only canonical session headers, so the raw marker is lost.
         const sessionReq = withCallerSessionIdentity(req, admission);
-        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
-          await handleChatCompletions(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
-          req,
-          policy,
-        ), { requestId, start, logCtx });
+        // Only expose an id when the handler or a logged refusal owns its history row.
+        let ownsRequestLog = false;
+        const response = await runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => {
+          ownsRequestLog = true;
+          return withCors(
+            await handleChatCompletions(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
+            req,
+            policy,
+          );
+        }, { requestId, start, logCtx, onLogged: () => { ownsRequestLog = true; } });
+        return ownsRequestLog ? withRequestLogId(response, requestId) : response;
       }
 
       if (url.pathname === "/v1/audio/transcriptions" && req.method === "POST") {

package/src/server/index/websocket-handler.ts

@@ -89,6 +89,7 @@ import {
 import type { ServeOptionsContext } from "./serve-options";
 import type { RequestMetricsRecorder } from "../request-metrics";
 import { resolveInboundBodyLimitBytes } from "../request-decompress";
+import { responseToolOwnership } from "../responses/response-tool-ownership";
 
 /**
  * The WebSocket half of the Bun.serve options, split out of serve-options.ts to keep that file
@@ -184,6 +185,8 @@ export function createWebsocketHandler(
           }
           return;
         }
+        if (ws.data.responsesActivity?.closing) return;
+        ws.data.responsesActivity?.touch();
         const rawBytes = typeof raw === "string" ? Buffer.byteLength(raw) : raw.byteLength;
         if (rawBytes > MAX_WS_FRAME_BYTES) {
           sendJsonFrame(ws, buildWsErrorFrame(413, {
@@ -223,6 +226,7 @@ export function createWebsocketHandler(
             if (frame.type === "response.inject") {
               if (!ws.data.nativeControl?.inject) throw new NativeSteeringError("injection_not_supported", "Native injection is disabled or unavailable on this route.");
               ws.data.nativeControl.inject(frame);
+              ws.data.responsesActivity?.acceptResults(frame.input);
               return;
             }
             if (frame.type === "response.steer") {
@@ -230,7 +234,10 @@ export function createWebsocketHandler(
               ws.data.nativeControl.steer(frame);
               return;
             }
-            if (ws.data.nativeControl?.continue(frame)) return;
+            if (ws.data.nativeControl?.continue(frame)) {
+              ws.data.responsesActivity?.acceptResults(frame.input);
+              return;
+            }
           } catch (error) {
             sendJsonFrame(ws, buildWsErrorFrame(400, {
               type: "invalid_request_error",
@@ -294,6 +301,7 @@ export function createWebsocketHandler(
         }
 
         // Only a genuinely admitted turn may receive steering or continuations.
+        const finishActivity = ws.data.responsesActivity?.beginTurn(frame.input);
         ws.data.nativeControl = nativeControl;
         const payload: Record<string, unknown> = { ...frame };
         delete payload.type;
@@ -346,11 +354,16 @@ export function createWebsocketHandler(
                 terminalRecorder = recorder;
               },
             });
+            const observeLog = nativeControl?.relayActive
+              ? createNativeSteeringLogObserver(logCtx, () => recordFirstOutput(logCtx, start))
+              : (payload: string) => inspectResponseLogSsePayload(logCtx, payload);
+            const providerExecuted = responseToolOwnership(response);
             await sendResponseToWebSocket(ws, response, isCurrent, {
               untilEof: nativeControl?.relayActive === true,
-              onSsePayload: nativeControl?.relayActive
-                ? createNativeSteeringLogObserver(logCtx, () => recordFirstOutput(logCtx, start))
-                : payload => inspectResponseLogSsePayload(logCtx, payload),
+              onSsePayload: payload => {
+                ws.data.responsesActivity?.observePayload(payload, providerExecuted);
+                observeLog(payload);
+              },
               onTerminal: status => {
                 terminalRecorder?.(status, logCtx.terminalHttpStatus);
                 finalizeLog(httpStatusForRequestLogTerminal(status, logCtx), {
@@ -392,6 +405,7 @@ export function createWebsocketHandler(
               /* socket already gone or send dropped */
             }
           } finally {
+            finishActivity?.();
             turnAdmissionLease.release();
             if (ws.data.nativeControl === nativeControl) ws.data.nativeControl = undefined;
             if (!logged && turnAbort.signal.aborted) finalizeLog(499);