@bitkyc08/opencodex 2.87.0 → 2.89.0

package/src/server/responses/anthropic-thinking-recovery.ts

@@ -0,0 +1,153 @@
+import { anthropicRejectionPolicy, bindAnthropicRejectionPolicy, rejectedAnthropicPayloads } from "../../adapters/anthropic-rejection-memo";
+import { normalizeUpstreamErrorText, readDisplaySafeErrorText } from "./core-errors";
+import { sanitizeNonReplayableUpstreamError } from "./non-replayable-error";
+import { isLikelyRealAnthropicThinkingSignature } from "../../adapters/anthropic";
+import type { AdapterEvent, OcxParsedRequest } from "../../types";
+import { upstreamErrorMessageFromPayload } from "../../lib/errors";
+import { readBoundedResponseBody } from "../../lib/bounded-body";
+import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { rememberReasoningReplayOpaqueBlobRejection } from "../../responses/reasoning-replay-cache";
+import { prepareOpaqueBlobRecovery, type OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
+
+/** Only the explicit conversation-binding refusal authorizes removing signed history. */
+export function isAnthropicThinkingSignatureBindingRejectionMessage(message: string): boolean {
+  return message.includes("Invalid `signature` in `thinking` block")
+    && message.includes("The block is bound to a different conversation");
+}
+
+function carriesThinkingState(parsed: OcxParsedRequest): boolean {
+  return parsed.context.messages.some(message => message.role === "assistant"
+    && message.content.some(part => part.type === "thinking"
+      && (isLikelyRealAnthropicThinkingSignature(part.signature)
+        || part.redacted?.some(data => typeof data === "string" && data.length > 0))));
+}
+
+/** One request owns both the HTTP refusal and initial-event recovery, never a fresh retry guard. */
+export function createAnthropicThinkingRecovery(
+  parsed: OcxParsedRequest,
+  signal: AbortSignal,
+  guard: OpaqueBlobRecoveryGuard,
+  canRetry: () => boolean,
+) {
+  let rejectedScope: OcxParsedRequest["_reasoningReplayScope"];
+  let rejectedPayloads: ReadonlySet<string> | undefined;
+  let armed = false;
+  let outputSeen = false;
+  let completed = false;
+  let failed = false;
+  let remembered = false;
+
+  const prepare = (message: string, adapterName: string, attempt = parsed, response?: Response): boolean => {
+    if (signal.aborted || !canRetry() || adapterName !== "anthropic" || guard.attempted
+      || parsed._stripReasoningEncryptedContent === true || !carriesThinkingState(attempt)
+      || !isAnthropicThinkingSignatureBindingRejectionMessage(message)) return false;
+    rejectedPayloads = rejectedAnthropicPayloads(response);
+    // A real send must prove that it serialized opaque history; otherwise rebuilding could
+    // repeat the same request. Direct event-policy callers have no HTTP body to identify.
+    if (response && !rejectedPayloads?.size) return false;
+    const previous = anthropicRejectionPolicy(parsed);
+    if (rejectedPayloads && previous?.mode === "selective") {
+      const merged = new Set(previous.fingerprints);
+      for (const payload of rejectedPayloads) merged.add(payload);
+      rejectedPayloads = merged.size <= 256 ? merged : undefined;
+    }
+    guard.attempted = true;
+    armed = true;
+    const scope = parsed._reasoningReplayScope;
+    rejectedScope = scope ? { ...scope, current: scope.current ? { ...scope.current } : undefined } : undefined;
+    if (!rejectedPayloads) {
+      prepareOpaqueBlobRecovery(parsed);
+      if (attempt !== parsed) prepareOpaqueBlobRecovery(attempt);
+    }
+    const policy = rejectedPayloads ? { mode: "selective" as const, fingerprints: rejectedPayloads } : { mode: "blanket" as const };
+    bindAnthropicRejectionPolicy(parsed, policy);
+    bindAnthropicRejectionPolicy(attempt, policy);
+    return true;
+  };
+
+  const prepareHttp = async (response: Response, adapterName: string, attempt = parsed): Promise<boolean> => {
+    if (signal.aborted || !canRetry() || response.status !== 400 || isNonReplayableResponse(response)
+      || adapterName !== "anthropic" || guard.attempted
+      || parsed._stripReasoningEncryptedContent === true || !carriesThinkingState(attempt)) return false;
+    try {
+      const body = await readBoundedResponseBody(response.clone(), { signal });
+      if (!body.displaySafe || body.truncated) return false;
+      const message = upstreamErrorMessageFromPayload(JSON.parse(body.text) as unknown);
+      return typeof message === "string" && prepare(message, adapterName, attempt, response);
+    } catch {
+      return false;
+    }
+  };
+
+  const observe = (event: AdapterEvent): void => {
+    if (!armed) return;
+    if (event.type === "error" || event.type === "incomplete") failed = true;
+    if (event.type === "done") completed = true;
+    if ((event.type === "text_delta" && event.text.length > 0) || event.type === "tool_call_end") outputSeen = true;
+  };
+
+  async function* wrap(
+    events: AsyncIterable<AdapterEvent>,
+    retry: () => AsyncIterable<AdapterEvent>,
+    adapterName: () => string,
+    replayAllowed = true,
+    response?: Response,
+    attempt = parsed,
+  ): AsyncGenerator<AdapterEvent> {
+    let source = events;
+    let replaySafe = replayAllowed;
+    while (true) {
+      const iterator = source[Symbol.asyncIterator]();
+      let recovered = false;
+      try {
+        while (true) {
+          const next = await iterator.next();
+          if (next.done) return;
+          const event = next.value;
+          if (replaySafe && event.type === "error" && prepare(event.message, adapterName(), attempt, response)) {
+            // Close the rejected body before acquiring another dispatch/pacing slot.
+            await iterator.return?.();
+            source = retry();
+            recovered = true;
+            break;
+          }
+          // Even hidden reasoning, boundaries, and tool activity fence a replay. A heartbeat
+          // carrying a side-effect latch is never evidence that a turn is safe to repeat.
+          replaySafe &&= event.type === "heartbeat" && event.replayUnsafe !== true;
+          observe(event);
+          yield event;
+        }
+      } finally {
+        if (!recovered) await iterator.return?.();
+      }
+    }
+  }
+
+  const rememberSuccess = (response: Readonly<Record<string, unknown>>): void => {
+    // HTTP 200, EOF, or a guard-generated completion alone cannot prove the stripped send worked.
+    // The delivery owner calls this only after its bridge/fold validated a successful terminal.
+    if (!armed || remembered || signal.aborted || failed || !completed || !outputSeen
+      || response.status !== "completed" || !Array.isArray(response.output) || response.output.length === 0
+      || !rejectedScope
+      || rejectedScope.clientThreadId !== parsed._reasoningReplayScope?.clientThreadId
+      || JSON.stringify(rejectedScope.current) !== JSON.stringify(parsed._reasoningReplayScope?.current)) return;
+    remembered = true;
+    rememberReasoningReplayOpaqueBlobRejection(rejectedScope, rejectedPayloads);
+  };
+  // The search owner supplies only a fully validated current iteration, never search-card output.
+  const observeIteration = (events: readonly AdapterEvent[]): void => {
+    outputSeen = false;
+    completed = false;
+    for (const event of events) observe(event);
+  };
+  const projectHttpFailure = async (response: Response, abortSignal: AbortSignal): Promise<Extract<AdapterEvent, { type: "error" }>> => {
+    const nonReplayable = isNonReplayableResponse(response);
+    if (nonReplayable) response = await sanitizeNonReplayableUpstreamError(response, abortSignal);
+    const text = await readDisplaySafeErrorText(response, abortSignal, `Provider error ${response.status}`);
+    const error = normalizeUpstreamErrorText(text, `Provider error ${response.status}`);
+    return { type: "error", status: response.status, message: error.message ?? error.safeText,
+      errorType: error.type ?? "upstream_error", ...(error.code ? { code: error.code } : {}),
+      ...(nonReplayable ? { retryable: false } : {}) };
+  };
+  return { prepareHttp, prepareEvent: prepare, observeIteration, projectHttpFailure, wrap, rememberSuccess };
+}

package/src/server/responses/combo-session-recall.ts

@@ -110,6 +110,31 @@ export function recallComboForLane(
   return entry.responseModel === model ? entry.comboId : undefined;
 }
 
+/**
+ * The concrete target that completed the lane's last turn for `comboId`, under the same
+ * freshness and ownership rules as `recallComboForLane`. A lane answered by another combo, or
+ * whose target left the combo or was disabled, recalls nothing.
+ */
+export function recallComboTargetForLane(
+  config: OcxConfig,
+  lane: string | undefined,
+  comboId: string,
+): Pick<OcxComboTarget, "provider" | "model"> | undefined {
+  if (!lane || !comboId) return undefined;
+  const entry = recall.get(lane);
+  if (!entry || entry.comboId !== comboId) return undefined;
+  const combo = getCombo(config, entry.comboId);
+  const provider = config.providers[entry.target.provider];
+  if (Date.now() - entry.at >= RECALL_TTL_MS
+    || !Object.hasOwn(config.providers, entry.target.provider)
+    || !provider || provider.disabled === true
+    || !combo?.targets.some(target => targetKey(target) === targetKey(entry.target))) {
+    deleteEntry(lane);
+    return undefined;
+  }
+  return { provider: entry.target.provider, model: entry.target.model };
+}
+
 /**
  * Periodic expiry. Without it a lane that is never read again and never touched by a config
  * reconciliation holds its entry for the life of the process: the existing TTL is only

package/src/server/responses/combo-stream-preflight.ts

@@ -4,6 +4,7 @@ import { comboFailureDecision } from "../../combos";
 import { httpStatusFromTerminalError } from "../../lib/errors";
 import type { RequestFailureStage } from "../../lib/request-failure-model";
 import type { RequestLogContext } from "../request-log";
+import { carryResponseToolOwnership } from "./response-tool-ownership";
 import { createSseInspector } from "../relay";
 import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 
@@ -114,12 +115,14 @@ function retryableZeroOutputTerminal(payload: unknown): boolean {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
   const event = payload as {
     type?: unknown;
-    response?: { incomplete_details?: { reason?: unknown } };
+    response?: { incomplete_details?: { reason?: unknown }; output?: unknown };
   };
   if (bareErrorIsRetryable(event)) return true;
   if (event.type === "response.failed") return true;
   if (event.type !== "response.incomplete") return false;
   const reason = event.response?.incomplete_details?.reason;
+  // A terminal-only upstream can carry output without preceding delta/item events.
+  if (reason === undefined) return !Array.isArray(event.response?.output) || event.response.output.length === 0;
   return typeof reason === "string" && RETRYABLE_ZERO_OUTPUT_INCOMPLETE_REASONS.has(reason);
 }
 
@@ -198,11 +201,11 @@ function replayBufferedResponse(
       reader.cancel(reason).catch(() => undefined);
     },
   });
-  return new Response(body, {
+  return carryResponseToolOwnership(response, new Response(body, {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers,
-  });
+  }));
 }
 
 function failedTerminalResponse(

package/src/server/responses/combo-tool-loop-pin.ts

@@ -0,0 +1,70 @@
+/**
+ * Combo target pinning for an in-flight tool loop (#7298).
+ *
+ * A combo picks a target per request. A tool loop is several requests that together form one
+ * assistant turn: the model emits a call, the client runs it, and the next request carries the
+ * result back. Re-picking between those requests hands the second half of a turn to a model that
+ * did not produce the first half. That is wasteful at best (a cold prompt cache, a different
+ * plan) and a hard failure at worst: DeepSeek's thinking mode refuses a tool continuation whose
+ * call carries no reasoning it can read, and a GPT turn never leaves one.
+ *
+ * So a continuation whose input ends in a tool output keeps the target that completed the lane's
+ * previous turn, as long as that target is still selectable right now: enabled, still in the
+ * combo, out of cooldown and passing every per-request eligibility filter the caller supplies.
+ * When it is not, normal selection (and normal failover) runs, and the strict serializers make
+ * the foreign history acceptable instead: see `backfillBareToolCallTurnReasoning` and the Chat
+ * adapter's reasoning placeholder.
+ *
+ * A new user message is never pinned; re-deciding per user turn is what a combo is for.
+ */
+import { pickComboTarget, targetKey, type ComboPick } from "../../combos";
+import type { NormalizedComboTarget } from "../../combos/types";
+import type { OcxConfig } from "../../types";
+import { recallComboTargetForLane } from "./combo-session-recall";
+
+export const COMBO_TOOL_LOOP_PIN_REASON = "combo-tool-loop-pin";
+
+function isToolOutputItem(item: unknown): boolean {
+  if (!item || typeof item !== "object" || Array.isArray(item)) return false;
+  const type = (item as { type?: unknown }).type;
+  return typeof type === "string" && type.endsWith("_output");
+}
+
+/**
+ * Whether this request resumes an assistant turn by returning tool results: its Responses
+ * `input` (or Chat `messages`) ends with a tool output.
+ */
+export function isToolLoopContinuation(body: unknown): boolean {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  const { input, messages } = body as { input?: unknown; messages?: unknown };
+  if (Array.isArray(input)) return input.length > 0 && isToolOutputItem(input[input.length - 1]);
+  if (Array.isArray(messages) && messages.length > 0) {
+    const last = messages[messages.length - 1];
+    return !!last && typeof last === "object" && (last as { role?: unknown }).role === "tool";
+  }
+  return false;
+}
+
+/**
+ * The pick that keeps a tool loop on its previous target, or undefined to select normally.
+ * Uses a non-mutating preview so a pinned request never disturbs round-robin rotation state.
+ */
+export function toolLoopPinnedPick(args: {
+  config: OcxConfig;
+  comboId: string;
+  lane: string | undefined;
+  body: unknown;
+  eligible: (target: NormalizedComboTarget) => boolean;
+  now?: number;
+}): ComboPick | undefined {
+  if (!isToolLoopContinuation(args.body)) return undefined;
+  const previous = recallComboTargetForLane(args.config, args.lane, args.comboId);
+  if (!previous) return undefined;
+  const previousKey = targetKey(previous);
+  const pick = pickComboTarget(args.config, args.comboId, {
+    eligible: target => targetKey(target) === previousKey && args.eligible(target),
+    now: args.now,
+    preview: true,
+  });
+  return pick ? { ...pick, attempted: [previousKey] } : undefined;
+}

package/src/server/responses/compact.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { createPhysicalSendReporter, rebindPhysicalSend } from "../../lib/request-execution-budget";
 import { createInferenceSendBudget } from "../inference/context";
@@ -1058,6 +1059,7 @@ export async function handleResponsesCompact(
     ) => {
       // A gateway response is not evidence about any Codex account.
       if (gatewayTransport || !usesCodexForwardPoolAuth(ctx, route.provider)) return;
+      if ((outcome === 401 || outcome === 403) && upstream && wasPermanentAccountRefusal(upstream)) return;
       recordCodexUpstreamOutcome(config, ctx.accountId, outcome, {
         ...meta,
         threadId: ctx.kind === "pool" || ctx.kind === "main-pool" ? ctx.affinityKey : undefined,
@@ -1166,6 +1168,7 @@ export async function handleResponsesCompact(
         providerFetch(sendProvider, undefined, {
           providerName: route.providerName,
           modelId: route.modelId,
+          accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: sendAuthCtx }, headers),
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
             ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
           dispatchOverride: sendProvider.authMode !== "forward" && sendProvider.apiKey
@@ -1287,7 +1290,7 @@ export async function handleResponsesCompact(
 
     recordDistributedResponseFailure(upstream, config, route.providerName, req.signal);
     if (
-      upstream.status === 401
+      upstream.status === 401 && !wasPermanentAccountRefusal(upstream)
       && (authCtx.kind === "main-pool" || authCtx.kind === "pool")
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, compactProvider)
@@ -1411,12 +1414,12 @@ export async function handleResponsesCompact(
     // surfaces to the client, which retries the compact task OUTSIDE the logical request
     // — reporting exhausted retries while another pool account sat idle (#913).
     if (
-      (upstream.status === 429 || upstream.status === 402)
+      (upstream.status === 429 || upstream.status === 402 || wasAccountAutoPaused(upstream))
       // A replay refusal this proxy synthesized carries 429 for the client's benefit only.
       // It is not pool quota evidence, and the alternate account below is another send of a
       // compact turn that may already have been processed.
       && !isNonReplayableResponse(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
@@ -1521,7 +1524,7 @@ export async function handleResponsesCompact(
     // the same guards as the quota move, and a 5xx whose body confirms quota keeps today's path.
     if (
       shouldRetryCodexPoolAccountTransient(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
@@ -1642,7 +1645,7 @@ export async function handleResponsesCompact(
       inspectResponseLogJson(logCtx, compactText);
       if (!options.compactionRoutingOverride) forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
-    } else if (!options.compactionRoutingOverride && quotaFailure && !storedPool401ReplayAttempted) {
+    } else if (!options.compactionRoutingOverride && quotaFailure && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))) {
       const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {

package/src/server/responses/compaction-recovery.ts

@@ -1,4 +1,5 @@
 import type { AdapterEvent, OcxConfig } from "../../types";
+import { carryResponseToolOwnership } from "./response-tool-ownership";
 import { routeConcreteModel, type RouteResult } from "../../router";
 import { copyPlainData } from "../../lib/plain-data";
 import { jsonUtf8Bytes } from "../../lib/json-byte-size";
@@ -78,6 +79,7 @@ async function bufferedJson(response: Response, signal: AbortSignal): Promise<{
   headers.delete("content-length");
   headers.delete("content-encoding");
   const replacement = new Response(bytes.bytes, { status: response.status, statusText: response.statusText, headers });
+  carryResponseToolOwnership(response, replacement);
   if (isNonReplayableResponse(response)) markResponseNonReplayable(replacement);
   try {
     const json: unknown = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.bytes));

package/src/server/responses/context-overflow.ts

@@ -1,5 +1,8 @@
 import { bridgeToResponsesSSE, formatErrorResponse } from "../../bridge";
 import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
+import { isThroughputLimitText } from "../../claude/outbound";
+import { isDefiniteContextOverflow } from "../../combos/failover";
+import { classifyError } from "../../lib/errors";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import type { AdapterEvent } from "../../types";
 
@@ -32,8 +35,11 @@ export function jsonContextOverflowResponse(message = PROVIDER_INPUT_TOO_LARGE_M
   }, { status: 413, headers: { "Cache-Control": "no-store" } });
 }
 
-async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEvent> {
-  yield {
+/** The terminal error event every context overflow is reported as, streaming or in-stream. */
+export function contextOverflowEvent(
+  message = PROVIDER_INPUT_TOO_LARGE_MESSAGE,
+): Extract<AdapterEvent, { type: "error" }> {
+  return {
     type: "error",
     message,
     status: 413,
@@ -43,6 +49,139 @@ async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEv
   };
 }
 
+async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEvent> {
+  yield contextOverflowEvent(message);
+}
+
+/**
+ * Whether a web-search or image-bridge failure is the provider refusing an oversized input.
+ *
+ * An HTTP 413 is classified by status alone, exactly as the main path does. A 400/422 needs a
+ * definite overflow phrase in the provider message (the rule combo failover already trusts), so a
+ * plain bad request stays what it was, and rate-window wording ("too many tokens per minute")
+ * never reads as an overflow: compacting does not fix a throughput limit. An adapter that already
+ * classified its own failure as `context_length_exceeded` keeps that verdict whatever status it
+ * rode on. The local translator limit is excluded: compacting cannot shrink a buffer this proxy owns.
+ */
+export function isSidecarContextOverflow(
+  status: number | undefined,
+  message: string,
+  code?: string | null,
+): boolean {
+  if (code === "translation_buffer_limit" || code === "rate_limit_exceeded") return false;
+  if (code === "context_length_exceeded") return true;
+  if (status === 413) return true;
+  return (status === 400 || status === 422) && !isThroughputLimitText(message)
+    && isDefiniteContextOverflow(status, message);
+}
+
+/**
+ * The in-stream terminal for a sidecar overflow. A bare 413 carries no provider wording worth
+ * keeping and gets the proxy-owned message. A worded verdict keeps its own status and message:
+ * that is the evidence combo failover reads to try a larger-context target, and replacing it
+ * would end the chain at the first target that was merely too small.
+ */
+export function sidecarContextOverflowEvent(
+  status: number | undefined,
+  message: string,
+): Extract<AdapterEvent, { type: "error" }> {
+  return status === undefined || !message || (status === 413 && !isDefiniteContextOverflow(413, message))
+    ? contextOverflowEvent()
+    : { ...contextOverflowEvent(message), status };
+}
+
+/** One sidecar loop failure, with what the loop knew when it raised it. */
+export interface SidecarLoopFailure {
+  status: number;
+  message: string;
+  event?: Extract<AdapterEvent, { type: "error" }>;
+  /** The provider's own `error.code`, read from a bounded display-safe body. */
+  upstreamCode?: string;
+  /** The failed response was marked non-replayable: the provider may already have run the turn. */
+  nonReplayable?: boolean;
+}
+
+/**
+ * The overflow terminal a sidecar loop failure should end with, or `undefined` to keep the
+ * failure as it is. A non-replayable failure keeps its verdict: an overflow would invite a
+ * compacted resend of a turn the provider may already have run. An adapter event marked
+ * `retryable: false` under any other code is that adapter's own verdict and is not reread.
+ */
+export function sidecarLoopOverflowEvent(
+  failure: SidecarLoopFailure,
+): Extract<AdapterEvent, { type: "error" }> | undefined {
+  if (failure.nonReplayable) return undefined;
+  const code = failure.event?.code ?? failure.upstreamCode;
+  if (failure.event?.retryable === false && code !== "context_length_exceeded") return undefined;
+  if (!isSidecarContextOverflow(failure.status, failure.message, code)) return undefined;
+  return sidecarContextOverflowEvent(failure.event?.status ?? failure.status, failure.message);
+}
+
+/**
+ * The in-stream terminal for a sidecar loop failure that carries no adapter event, or
+ * `undefined` to keep the loop's existing generic event. An overflow ends as the overflow
+ * terminal. A failure this classifier deliberately kept (non-replayable, or an upstream
+ * `rate_limit_exceeded`) gets an explicit code whenever the bridge's wording heuristics would
+ * otherwise rename it `context_length_exceeded` and undo that verdict on the wire.
+ */
+export function sidecarLoopTerminalEvent(
+  failure: SidecarLoopFailure,
+): Extract<AdapterEvent, { type: "error" }> | undefined {
+  const overflow = sidecarLoopOverflowEvent(failure);
+  if (overflow || failure.event) return overflow;
+  if (classifyError(failure.status, "upstream_error", failure.message).code !== "context_length_exceeded") return undefined;
+  const rateLimited = failure.upstreamCode === "rate_limit_exceeded";
+  return {
+    type: "error",
+    status: failure.status,
+    message: failure.message,
+    errorType: rateLimited ? "rate_limit_error" : "upstream_error",
+    code: failure.upstreamCode ?? "upstream_error",
+    ...(failure.nonReplayable ? { retryable: false } : {}),
+  };
+}
+
+/** Read a provider's `error.code` from an already bounded, display-safe error body. */
+export function upstreamErrorCode(text: string): string | undefined {
+  try {
+    const code = (JSON.parse(text) as { error?: { code?: unknown } } | null)?.error?.code;
+    return typeof code === "string" && code.length <= 128 ? code : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const sidecarOverflowResponses = new WeakSet<Response>();
+
+/** Tag a loop's first-iteration JSON failure that the sidecar boundary should map to an overflow. */
+export function markSidecarContextOverflow(response: Response, failure: SidecarLoopFailure): Response {
+  if (sidecarLoopOverflowEvent(failure)) sidecarOverflowResponses.add(response);
+  return response;
+}
+
+/**
+ * Map a sidecar loop's pre-stream HTTP failure onto the main path's overflow contract (#7316).
+ *
+ * Both loops answer a failed first iteration with their own small JSON error, so the overflow
+ * would otherwise reach Codex as a bare non-2xx that it resends unchanged through its retry
+ * budget. The loop classified the failure while it still had the provider's status, wording,
+ * code and replay verdict, and tagged the response; anything untagged is returned untouched.
+ * Combo attempts do not come through here: the combo layer reads the raw failure for its hop
+ * decision and maps a final 413 itself. A failure answered with `x-should-retry: false` keeps
+ * its status and header, so that contract never turns into an invitation to resend.
+ */
+export function sidecarContextOverflowResponse(
+  response: Response,
+  options: { stream: boolean; modelId: string; translatorBudget: TranslatorBudget },
+): Response {
+  if (response.ok || !sidecarOverflowResponses.has(response)) return response;
+  if (response.headers.get("x-should-retry") === "false") return response;
+  void response.body?.cancel().catch(() => {});
+  return options.stream
+    ? streamingContextOverflowResponse(options.modelId, options.translatorBudget)
+    : jsonContextOverflowResponse();
+}
+
 /**
  * Convert a pre-stream provider 413 into the terminal Responses event Codex understands.
  *

package/src/server/responses/core-codex-account.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig, OcxParsedRequest } from "../../types";
 import type { CodexAuthContext, CodexAuthPolicyConfig } from "../../codex/auth-context";
 import type { CodexUpstreamOutcome } from "../../codex/routing";
@@ -144,7 +145,7 @@ export function recordCodexPreOutputRefusalOutcome(
   modelId: string,
 ): void {
   if (!isCodexWsPreOutputRefusal(response) || codexWsPreOutputRefusalOutcomeRecorded(response)) return;
-  if (!usesCodexForwardPoolAuth(authCtx, provider)) return;
+  if (!usesCodexForwardPoolAuth(authCtx, provider) || wasPermanentAccountRefusal(response)) return;
   noteCodexWsPreOutputRefusalOutcome(response);
   recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
     threadId: authCtx.affinityKey,
@@ -855,6 +856,10 @@ export async function retryCodexPoolOnAlternateAccount(
     options.deferCodexResetDerivedCooldown,
   );
   const recordFirstOutcome = (): void => {
+    if (wasPermanentAccountRefusal(firstResponse)) {
+      noteCodexWsPreOutputRefusalOutcome(firstResponse);
+      return;
+    }
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
       threadId: firstAuthCtx.affinityKey,
@@ -975,8 +980,8 @@ export async function retryCodexPoolOnAlternateAccount(
   const maxRetrySends = retrySameConfirmedAccount ? 7 : 1;
   let retrySendCount = 0;
   // The gated-model 400 has no roster kind; it stays unattributed as before.
-  const moveRecovery: AttemptRecoveryKind | undefined = outcomeStatus === 429 || outcomeStatus === 402
-    ? "oauth-account-429"
+  const moveRecovery: AttemptRecoveryKind | undefined = outcomeStatus === 429 ? "oauth-account-429"
+    : outcomeStatus === 402 ? "oauth-account-402"
     : isTransientUpstreamStatus(outcomeStatus) ? "transient-5xx" : undefined;
   let upstreamResponse: Response;
   try {
@@ -1032,6 +1037,7 @@ export async function retryCodexPoolOnAlternateAccount(
             providerName: route.providerName,
             modelId: route.modelId,
             preOutputRefusalHold: args.preOutputRefusalHold,
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: retryAuthCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,