@bitkyc08/opencodex 2.87.0 → 2.89.0

package/src/server/responses/core-combo.ts

@@ -45,6 +45,7 @@ import {
 } from "../../combos";
 import { formatErrorResponse } from "../../bridge";
 import { SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
+import { redactSecretString, sanitizeLogMetadataString } from "../../lib/redact";
 import {
   expandPreviousResponseInput,
   previousResponseReplayFailure,
@@ -98,6 +99,7 @@ import type { CodexAuthContext } from "../../codex/auth-context";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import { beginRequestAttempt, sealRequestAttemptIdentity, finishRequestAttempt } from "../request-log";
 import { rememberComboForLane } from "./combo-session-recall";
+import { COMBO_TOOL_LOOP_PIN_REASON, toolLoopPinnedPick } from "./combo-tool-loop-pin";
 import { runTurnAdapterSseResponses } from "./core-lifetime";
 import { normalizePersistedJevDecision } from "../../usage/jev-stats";
 import {
@@ -144,7 +146,8 @@ function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId
  * through `accountLogLabel`, but the per-request account budget can end the pool's own rotation
  * before the last refused account is recorded. Hand that account to the pool's rotator, which
  * cools it under the pool's own Retry-After policy, and spare the target only when the pool still
- * has an eligible sibling. A lone account or an all-cooled pool returns null and cools the target.
+ * has an eligible sibling. The rotator only peeks round-robin here: nothing is sent to that sibling.
+ * A lone account or an all-cooled pool returns null and cools the target.
  */
 function cooledGenericOAuthAccountLabel(
   config: OcxConfig, providerName: string, modelId: string, label: string | undefined, retryAfter: string | undefined,
@@ -155,7 +158,7 @@ function cooledGenericOAuthAccountLabel(
   const matches = getAccountSet(providerName)?.accounts.filter(account =>
     oauthAccountLogLabel(account.id, base) === label) ?? [];
   return matches.length === 1
-    && rotateGenericOAuthAccountOn429(config, providerName, matches[0]!.id, retryAfter, Date.now(), modelId)
+    && rotateGenericOAuthAccountOn429(config, providerName, matches[0]!.id, retryAfter, Date.now(), modelId, false)
     ? label : undefined;
 }
 
@@ -588,7 +591,19 @@ export async function executeComboResponses(
     waitForCooldownMs: combo.waitForCooldownMs,
     abortSignal: options.abortSignal,
   });
-  let pick = await pickWithWait({
+  // An in-flight tool loop stays on the target that issued its calls while that target is still
+  // selectable (#7298). Override routes never record a lane target, so they never pin either.
+  const toolLoopPin = options.compactionRoutingOverride || options.mainHardLockFallbackOverride
+    ? undefined
+    : toolLoopPinnedPick({
+      config,
+      comboId,
+      lane: sessionLaneIdFromRequest(req.headers),
+      body,
+      eligible: target => (meteredAllowed || !target.metered) && targetEligible(target),
+      now: initialNow,
+    });
+  let pick = toolLoopPin ?? await pickWithWait({
     eligible: targetEligible,
     now: initialNow,
   });
@@ -624,7 +639,7 @@ export async function executeComboResponses(
       : comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, targetEligible));
   }
   let jevDecision: JevDecision | undefined;
-  if (combo.strategy === "jev") {
+  if (combo.strategy === "jev" && !toolLoopPin) {
     const choices = eligibleJevComboChoices(config, comboId, targetEligible, Date.now());
     const first = choices[0];
     if (!first) {
@@ -652,6 +667,7 @@ export async function executeComboResponses(
         isDestinationAllowed: (providerName, modelId) => routeAllowedByScope(
           resolveAdmissionModelScope(config, options.admission), { providerName, modelId },
         ),
+        ...(combo.decisionQuotaSignals === true ? { decisionQuotaSignals: true, decisionQuotaTiers: combo.decisionQuotaTiers } : {}),
         ...(combo.decisionProvider ? { decisionProvider: combo.decisionProvider } : {}),
         ...(combo.decisionModel
           ? {
@@ -695,6 +711,7 @@ export async function executeComboResponses(
         ? { chosenProbability: decision.chosenProbability }
         : {}),
       ...(decision.usage ? { usage: decision.usage } : {}),
+      ...(decision.quota ? { quota: decision.quota } : {}),
     });
     console.debug("[combo] JEV decision", {
       backend: decision.backend,
@@ -712,8 +729,11 @@ export async function executeComboResponses(
   // One immutable combo selection trace, before any child dispatch; child
   // adoption below must never replace it with a concrete child route trace.
   const decision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
-  logCtx.routeDecision = options.memoryModelPhase
-    ? { ...decision, selected: { ...decision.selected, reason: memoryModelRouteReason(options.memoryModelPhase) } }
+  const selectedReason = options.memoryModelPhase
+    ? memoryModelRouteReason(options.memoryModelPhase)
+    : toolLoopPin ? COMBO_TOOL_LOOP_PIN_REASON : undefined;
+  logCtx.routeDecision = selectedReason
+    ? { ...decision, selected: { ...decision.selected, reason: selectedReason } }
     : decision;
 
   const originalReasoning = body && typeof body === "object" && !Array.isArray(body)
@@ -1192,8 +1212,15 @@ export async function executeComboResponses(
       }
       return lastFailure;
     }
+    // A bare status made a revoked credential read as a provider outage. Log only the parsed
+    // code and message, never the raw envelope, as one redacted, bounded line.
+    const failureReason = sanitizeLogMetadataString(
+      redactSecretString([failure.upstreamCode, failure.upstreamMessage].filter(Boolean).join(": ")).replace(/\s+/g, " "),
+      200,
+    );
     console.warn(
-      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${failure.response.status} after ${Date.now() - started}ms`,
+      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${failure.response.status}`
+        + ` after ${Date.now() - started}ms${failureReason ? `: ${failureReason}` : ""}`,
     );
     const failureNow = Date.now();
     const attemptedTargets = pick.attempted;

package/src/server/responses/core-lifetime.ts

@@ -1,4 +1,5 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
+import { carryResponseToolOwnership } from "./response-tool-ownership";
 import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
 import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
@@ -50,7 +51,7 @@ export function finalizeOwnedTranslatorBudget(response: Response, budget: Transl
   if (isPreinspectedJsonResponse(response)) markPreinspectedJsonResponse(finalizedResponse);
   if (isNonReplayableResponse(response)) markResponseNonReplayable(finalizedResponse);
   if (runTurnAdapterSseResponses.has(response)) runTurnAdapterSseResponses.add(finalizedResponse);
-  return finalizedResponse;
+  return carryResponseToolOwnership(response, finalizedResponse);
 }
 
 /** Release a serving-account slot when the client body ends, errors or is cancelled. */
@@ -75,7 +76,7 @@ export function finalizeAccountLease(response: Response, release: () => void, on
   if (isEagerRelaySseResponse(response)) markEagerRelaySseResponse(wrapped);
   if (isPreinspectedJsonResponse(response)) markPreinspectedJsonResponse(wrapped);
   if (runTurnAdapterSseResponses.has(response)) runTurnAdapterSseResponses.add(wrapped);
-  return wrapped;
+  return carryResponseToolOwnership(response, wrapped);
 }
 
 

package/src/server/responses/core-options.ts

@@ -177,6 +177,8 @@ export interface HandleResponsesOptions {
   nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /** The Claude client's typed `web_search_*` / `web_fetch_*` declarations; kept only for `inboundWire: "anthropic"`. */
   anthropicServerTools?: readonly Record<string, unknown>[];
+  /** The Claude client's replayable server-tool exchanges (`replayedAnthropicServerBlocks`); same scope. */
+  anthropicServerReplay?: ReadonlyMap<string, readonly Record<string, unknown>[]>;
   /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
   droidDefaultEffort?: string;
   /** PF-07: the Chat source a combo child may send natively; set only by the Chat ingress. */

package/src/server/responses/core-replay.ts

@@ -1,3 +1,5 @@
+import { bindAnthropicRejectionPolicy } from "../../adapters/anthropic-rejection-memo";
+import { getReasoningReplayOpaqueBlobRejection } from "../../responses/reasoning-replay-cache";
 import type {
   OcxProviderContinuationOwner,
   OcxProviderContinuationState,
@@ -177,8 +179,10 @@ export function bindRouteReasoningReplayScope(args: {
       parsed._dropForeignReasoningItemIds = true;
     }
   }
+  const rejectionMemo = getReasoningReplayOpaqueBlobRejection(parsed._reasoningReplayScope);
+  bindAnthropicRejectionPolicy(parsed, adapterName === "anthropic" ? rejectionMemo : undefined);
   if (reasoningReplayOpaqueBlobRejectionMemoized(parsed._reasoningReplayScope)) {
-    parsed._stripReasoningEncryptedContent = true;
+    if (adapterName !== "anthropic" || rejectionMemo?.mode !== "selective") parsed._stripReasoningEncryptedContent = true;
     parsed._stripNativeCompactionEncryptedContent = true;
     parsed._dropForeignReasoningItemIds = true;
   }

package/src/server/responses/core.ts

@@ -12,6 +12,7 @@ import { createInferenceSendBudget } from "../inference/context";
 import { finalizeOwnedTranslatorBudget, finalizeAccountLease } from "./core-lifetime";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { executeComboResponses } from "./core-combo";
+import { registerTurn, unregisterTurn } from "../lifecycle";
 import { runWithCompactionRecovery } from "./compaction-recovery";
 /**
  * Route one `/v1/responses` request through the adapter pipeline: recovery loop, passthrough
@@ -67,15 +68,17 @@ export async function handleComboResponses(
   logCtx: RequestLogContext,
   options: HandleResponsesOptions & { translatorBudget: TranslatorBudget },
 ): Promise<Response> {
-  return executeComboResponses(
-    req,
-    rawBody,
-    comboId,
-    config,
-    logCtx,
-    options,
-    requestDispatchers,
-  );
+  // Each child relay binds the turn's lease and unbinds it when its stream ends; the lease is
+  // released once nothing is bound. Hold it for the whole ladder so a refused child's relay
+  // cannot settle the turn the next target still runs in ("turn already settled"). An accepted
+  // child's stream is bound before this returns and keeps the lease until it ends.
+  const ladder = new AbortController();
+  registerTurn(ladder, options.turnAdmissionLease);
+  try {
+    return await executeComboResponses(req, rawBody, comboId, config, logCtx, options, requestDispatchers);
+  } finally {
+    if (options.turnAdmissionLease && "bindAbortController" in options.turnAdmissionLease) unregisterTurn(ladder);
+  }
 }
 const requestDispatchers: ResponsesDispatchers = { handleResponses, handleComboResponses };
 export { adapterNeedsForcedContinuation } from "./core-replay";

package/src/server/responses/empty-completion-guard.ts

@@ -172,6 +172,7 @@ export function mergeUsage(
   const cachedInputTokens = sumOptional("cachedInputTokens");
   const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
   const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
+  const cacheCreation1hInputTokens = sumOptional("cacheCreation1hInputTokens");
   const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
   const providerCredits = sumOptional("providerCredits");
   const contextTotalTokens = second.contextTotalTokens ?? first.contextTotalTokens;
@@ -188,6 +189,7 @@ export function mergeUsage(
     ...(cachedInputTokens !== undefined ? { cachedInputTokens } : {}),
     ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
     ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
+    ...(cacheCreation1hInputTokens !== undefined ? { cacheCreation1hInputTokens } : {}),
     ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
     ...(providerCredits !== undefined ? { providerCredits } : {}),
     ...(first.estimated || second.estimated ? { estimated: true } : {}),

package/src/server/responses/fetch-helpers.ts

@@ -31,6 +31,7 @@ import {
 } from "../../lib/provider-egress";
 import { redactSecretString } from "../../lib/redact";
 import { outboundCredentials } from "../../lib/outbound-credential-registry";
+import { compressUpstreamRequestBody, isCanonicalCodexResponsesUrl } from "./request-compression";
 
 export { withUpstreamHttpVersion };
 
@@ -48,6 +49,17 @@ const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
 const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
 // Survives queued credential rebuilds and executor replacement without importing budget owners.
 const PHYSICAL_DISPATCH = Symbol.for("opencodex.physical-dispatch");
+// Final destination and headers after plugin rewrites and queued rebuilds, for observers that
+// must attribute a response to the credential that actually reached the wire.
+const PHYSICAL_SEND_OBSERVER = Symbol.for("opencodex.physical-send-observer");
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  physical?: (sameDestination: boolean, headers: Headers) => void;
+};
+/** Init fragment that reports the final send of the observer's attempt; empty when nothing observes. */
+export function physicalSendObserverInit(observer: AccountAutoPauseObserver | undefined, target: string): Record<symbol, unknown> {
+  const physical = observer?.physical;
+  return physical ? { [PHYSICAL_SEND_OBSERVER]: (destination: string, headers: Headers) => physical(destination === target, headers) } : {};
+}
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
 // Replacement admission waits on the client signal, outside the response-header deadline.
@@ -206,18 +218,27 @@ export function sendWithConnectionPolicy(
   // Bun can reset large native Codex string uploads before receiving headers while
   // the identical UTF-8 buffer succeeds. Convert only at the final HTTP send so
   // WebSocket selection still sees the serialized string and no retry is added.
+  // Opt-in compression (#7247) takes precedence at the same boundary and also yields bytes. Every
+  // retry and HTTP fallback re-enters here with the caller's original string, so each send derives
+  // its own coded bytes; `headers` is already this send's private copy.
   const target = input instanceof Request ? input.url : String(input);
   const body = init?.body;
-  const largeCodexBody = typeof body === "string"
-    && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
+  const compressed = compressUpstreamRequestBody(target, body, headers);
+  if (compressed) {
+    headers.set("Content-Encoding", compressed.encoding);
+    headers.delete("Content-Length");
+  }
+  const largeCodexBody = !compressed && typeof body === "string"
+    && isCanonicalCodexResponsesUrl(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
+  (init as Record<symbol, ((destination: string, headers: Headers) => void) | undefined> | undefined)?.[PHYSICAL_SEND_OBSERVER]?.(target, headers);
   // Final headers, after plugin rewrites: an upstream can only echo what it received here, so the
   // request log refuses any diagnostic that repeats one of these values (see request-log-terminal-status).
   outboundCredentials().remember(headers);
   return physicalFetch(input, {
     ...init,
-    ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
+    ...(compressed ? { body: compressed.body } : largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),
@@ -228,6 +249,7 @@ export function sendWithConnectionPolicy(
 }
 
 export interface ProviderFetchOptions {
+  accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => AccountAutoPauseObserver | undefined;
   /**
    * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
    *
@@ -344,7 +366,7 @@ export function providerFetch(
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
-  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+  const unobserved = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
     reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
     const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
@@ -381,6 +403,15 @@ export function providerFetch(
     }
     return httpFetch(input, init, reacquirePacing);
   };
+  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+    reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
+    const observe = options.accountAutoPause?.(providerName, provider,
+      new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+    const observedInit = observe?.physical
+      ? { ...init, ...physicalSendObserverInit(observe, input instanceof Request ? input.url : String(input)) } : init;
+    const response = await unobserved(input, observedInit, reacquirePacing);
+    return observe ? observe(response) : response;
+  };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
   const waitForPacing = async (signal?: AbortSignal): Promise<ProviderRequestSlot | undefined> => {
     if (pacingSlotAcquired) {

package/src/server/responses/jev-model-invoke.ts

@@ -1,6 +1,7 @@
 import { readBoundedResponseBytes } from "../../lib/bounded-body";
 import { JevModelInvokeError, type JevModelInvoke, type JevModelInvokeResult } from "../../combos/jev-model-backend";
 import { JEV_MAX_REQUEST_BYTES, JEV_MAX_RESPONSE_BYTES } from "../../combos/jev";
+import { serializeJevModelRequest } from "../../combos/jev-model-request";
 import type { OcxConfig } from "../../types";
 import { codexEffortRank, isCodexReasoningEffort } from "../../reasoning-effort";
 import { routeConcreteModel } from "../../router";
@@ -92,7 +93,7 @@ function decodeSse(bytes: Uint8Array): JevModelInvokeResult {
  * bounds billed output (including reasoning) and gives the spend reservation a nonzero ceiling;
  * a truncated answer is malformed and fails open like any other bad reply.
  */
-export const JEV_MODEL_MAX_OUTPUT_TOKENS = 1024;
+export { JEV_MODEL_MAX_OUTPUT_TOKENS } from "../../combos/jev-model-request";
 
 /**
  * The cheapest reasoning effort the decision model declares, so a reasoning model cannot spend
@@ -121,19 +122,17 @@ export function jevDecisionReasoningEffort(config: OcxConfig, model: string): st
  * or conversation header. It therefore runs on credentials configured on provider rows only.
  */
 export function createJevModelInvoker(context: JevModelInvokerContext): JevModelInvoke {
-  return async ({ model, instructions, input, signal }) => {
+  return async ({ model, instructions, input, signal, withoutQuota }) => {
     const effort = jevDecisionReasoningEffort(context.config, model);
-    const body = JSON.stringify({
-      model,
-      stream: true,
-      store: false,
-      instructions,
-      input: [{ role: "user", content: [{ type: "input_text", text: input }] }],
-      tools: [],
-      max_output_tokens: JEV_MODEL_MAX_OUTPUT_TOKENS,
-      ...(effort ? { reasoning: { effort } } : {}),
-    });
-    if (new TextEncoder().encode(body).byteLength > JEV_MAX_REQUEST_BYTES) {
+    let body = serializeJevModelRequest({ model, instructions, input }, effort);
+    /** True when the serialized decision request exceeds the request byte limit. */
+    const oversized = () => new TextEncoder().encode(body).byteLength > JEV_MAX_REQUEST_BYTES;
+    let quotaOmitted = false;
+    if (oversized() && withoutQuota) {
+      body = serializeJevModelRequest({ model, ...withoutQuota }, effort);
+      quotaOmitted = true;
+    }
+    if (oversized()) {
       throw new JevModelInvokeError("malformed", "decision request too large");
     }
     const lease = tryAdmitTurn(undefined, signal);
@@ -178,7 +177,7 @@ export function createJevModelInvoker(context: JevModelInvokerContext): JevModel
           return terminalResult(parsed, "");
         })();
       usage = result.usage;
-      return result;
+      return quotaOmitted ? { ...result, quotaOmitted: true } : result;
     } finally {
       // No final log row is written for this detached context, so settle its spend here.
       childLog.spendTracker?.settle(childLog.usage ?? (usage

package/src/server/responses/native-steering-log.ts

@@ -24,7 +24,7 @@ export function createNativeSteeringLogObserver(logCtx: RequestLogContext, onFir
       if (usage && (usages.has(event.response.id) || usages.size < MAX_NATIVE_STEERING_RESPONSES)) {
         // Retain numeric counters only, never arbitrary rawUsage metadata.
         const counters: OcxUsage = { inputTokens: usage.inputTokens, outputTokens: usage.outputTokens };
-        for (const key of ["totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "reasoningOutputTokens"] as const) {
+        for (const key of ["totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "cacheCreation1hInputTokens", "reasoningOutputTokens"] as const) {
           if (typeof usage[key] === "number") counters[key] = usage[key];
         }
         usages.set(event.response.id, counters);
@@ -33,7 +33,7 @@ export function createNativeSteeringLogObserver(logCtx: RequestLogContext, onFir
     if (!usages.size) return;
     const total: OcxUsage = { inputTokens: 0, outputTokens: 0 };
     for (const usage of usages.values()) {
-      for (const key of ["inputTokens", "outputTokens", "totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "reasoningOutputTokens"] as const) {
+      for (const key of ["inputTokens", "outputTokens", "totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "cacheCreation1hInputTokens", "reasoningOutputTokens"] as const) {
         const value = usage[key];
         if (typeof value === "number" && Number.isFinite(value)) total[key] = (total[key] ?? 0) + value;
       }

package/src/server/responses/passthrough-delivery.ts

@@ -1,3 +1,4 @@
+import { wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { isNativeControlResponse } from "./native-response-control";
 import { createOutboundCredentialMask, createTerminalErrorRedactionBlockRewrite } from "./terminal-error-redaction";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
@@ -527,7 +528,7 @@ export async function deliverPassthroughResponse(
       } else if (!shouldDeferCodexResetDerivedCooldown(
         upstreamResponse,
         options.deferCodexResetDerivedCooldown,
-      ) && !isReplayRefusalResponse(upstreamResponse)) {
+      ) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
         // A refusal this proxy made is not evidence about the account. Recording it would
         // classify the synthetic 429 as quota exhaustion and write a default cooldown against
         // a credential the request may never have reached, and that false signal outlives the
@@ -572,7 +573,7 @@ export async function deliverPassthroughResponse(
     // through sanitizePassthroughHeaders) so a redirect to a dead host can never
     // masquerade as a pre-connection failure after the credential was seen.
     // The numeric outcome above already classified it neutral — no streak.
-    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse)) {
+    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
       return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
     }
     if (upstreamResponse.status >= 300 && upstreamResponse.status < 400) {

package/src/server/responses/passthrough-dispatch.ts

@@ -1,3 +1,5 @@
+import { recoverAutoPausedAccount } from "./account-auto-pause-recovery";
+import { adoptCodexWsStage, capturePassthroughAffinity } from "./passthrough-observations";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { requestPacingOverloadResponse } from "./pacing-overload";
 import { recordDistributedResponseFailure } from "../../providers/api-key-response-ownership";
@@ -99,7 +101,6 @@ import {
   upstreamHostCircuitOpenResponse,
   usesCodexForwardPoolAuth,
   codexWsQuotaObserver,
-  isFixedCodexAccount,
   codexPoolAccountModel400Denial,
   shouldRetryCodexPoolAccountQuota,
   shouldRetryCodexPoolAccountTransient,
@@ -111,7 +112,7 @@ import {
   clearCodexModelDenialEvidence,
   recordCodexModelDenialEvidence,
 } from "../../codex/model-entitlements";
-import { codexWsSocketDeathStage, isCodexWsUpstreamResponse, readCodexWsStage } from "./codex-ws-wire";
+import { codexWsSocketDeathStage, isCodexWsUpstreamResponse } from "./codex-ws-wire";
 import { linkAbortSignal } from "./core-lifetime";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import { checkOutboundBodySize, describeOutboundBodyRefusal } from "./outbound-body-guard";
@@ -130,6 +131,7 @@ import {
 } from "../../lib/upstream-retry";
 import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import { classifyTransportFailureKind, transportErrorCode } from "../../lib/upstream-reachability";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
@@ -152,7 +154,6 @@ import {
   rotateGenericOAuthAccountOn429,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
-import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import {
   attemptOpaqueBlobRecovery,
@@ -201,6 +202,7 @@ export async function preparePassthroughExchange(
     | "genericFailoverAccountId"
     | "passiveQuotaWriterGeneration"
     | "oauthDispatch"
+    | "recoverAutoPausedSelection"
     | "resolveSelectionAdapter"
     | "resolveCopilotSelection"
     | "copilotRefusalResponse"
@@ -733,22 +735,11 @@ export async function preparePassthroughExchange(
       }
       nativeHostState.lease = null;
     };
-    /**
-     * #4191: a Codex WS exchange pins its content-free stage record on the
-     * Response it resolves (markCodexWsStage). Adopting the record here, at
-     * the single funnel every physical upstream response passes through,
-     * binds it to the attempt that actually served it — including the 502/504
-     * pre-response JSON settles that never reach the SSE relay.
-     */
-    const adoptCodexWsStage = (response: Response): void => {
-      const stage = readCodexWsStage(response);
-      if (stage && logCtx.activeAttempt) logCtx.activeAttempt.codexWsStage = stage;
-    };
     let upstreamResponse: Response, lastDistributedResponse: Response | undefined;
     const adoptObservedResponse = <T extends Response>(response: T): T => {
       if (!isNonReplayableResponse(response)) lastDistributedResponse = response.status === 401 || response.status === 429 ? response : undefined;
       settleObservedHostResponse();
-      adoptCodexWsStage(response);
+      adoptCodexWsStage(response, logCtx);
       return response;
     };
     let passthroughEstimate = typeof request.usageLog?.inputTokens === "number"
@@ -1050,6 +1041,7 @@ export async function preparePassthroughExchange(
               providerName: route.providerName,
               modelId: route.modelId,
               onPhysicalDispatch: receiptMode ? sendBudgetState.noteInitialDispatch : undefined,
+              accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                 ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1187,6 +1179,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1209,8 +1202,18 @@ export async function preparePassthroughExchange(
 
     // Keep recovery kinds in sync with the generic `recovery:` loop below.
     passthroughRecovery: for (;;) {
+      if (wasAccountAutoPaused(upstreamResponse) && route.provider.authMode !== "forward") {
+        const recovered = await recoverAutoPausedAccount({ requestKey: transportState, reserve: reserveCredentialHop,
+          remaining: transientSendCapFor(transientRetryPolicyFor(route.provider)?.attempts, sendBudgetState.targetSendsUsed),
+          refresh: () => transportState.recoverAutoPausedSelection(parsed), refetch: () => rebuildAndRefetch("oauth-account-429"), setPermit: permit => { sendBudgetState.pendingHopPermit = permit; } });
+        if (!recovered) break;
+        if ("failed" in recovered) return recovered.failed;
+        upstreamResponse = recovered; continue passthroughRecovery;
+      }
+
+
     if (
-      upstreamResponse.status === 401
+      upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
       && (admissionState.authCtx.kind === "main-pool" || admissionState.authCtx.kind === "pool")
       && usesCodexForwardPoolAuth(admissionState.authCtx, route.provider)
       && codex401ReplayKind === null
@@ -1293,6 +1296,7 @@ export async function preparePassthroughExchange(
             dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
             providerName: route.providerName,
             modelId: route.modelId,
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
             beforeDispatch: headers => {
               replayGuard?.(headers);
@@ -1336,14 +1340,14 @@ export async function preparePassthroughExchange(
       continue passthroughRecovery;
     }
 
-    if (codex401ReplayKind !== null && upstreamResponse.status === 401) break;
+    if (codex401ReplayKind !== null && upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)) break;
 
     // Native Responses providers return before the generic adapter recovery loop below. Keep
     // their OAuth contract identical: one pre-stream 401 forces a credential refresh and one
     // rebuilt replay. xAI's current subscription models use this branch now that their official
     // Grok CLI catalog declares the Responses backend.
     if (
-      upstreamResponse.status === 401
+      upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
       && isOAuth401ReplayProvider
       && transportState.sentOAuthSnapshot
       && !oauth401ReplayAttempted
@@ -1440,6 +1444,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1586,6 +1591,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1608,18 +1614,7 @@ export async function preparePassthroughExchange(
         || captureAuthCtx.kind === "pool"
         || captureAuthCtx.kind === "main-pool",
     ): void => {
-      if (!isCanonicalOpenAiForwardProvider(route.provider)) return;
-      captureCodexAffinityDiagnostic({
-        inboundHeaders: req.headers,
-        outboundHeaders: captureRequest.headers,
-        authKind: captureAuthCtx.kind,
-        accountMode: route.codexAccountMode,
-        fixedAccount: isFixedCodexAccount(captureAuthCtx),
-        credentialSubstituted,
-        accountGatedModel: ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId),
-        wireModelNormalized: parsed.modelId !== route.modelId,
-        status: response.status,
-      });
+      capturePassthroughAffinity(response, req.headers, captureRequest.headers, captureAuthCtx, route, parsed.modelId, credentialSubstituted);
     };
     recordDistributedResponseFailure(lastDistributedResponse ?? upstreamResponse, config, route.providerName, options.abortSignal);
     captureAffinityResponse(upstreamResponse);
@@ -1646,7 +1641,9 @@ export async function preparePassthroughExchange(
         options.abortSignal,
         parsed.modelId,
       );
-      if (model400Denial !== undefined) {
+      if (wasAccountAutoPaused(upstreamResponse)) {
+        poolRetryOutcome = upstreamResponse.status;
+      } else if (model400Denial !== undefined) {
         // Spend this refusal on more than one retry. It is the account's own authenticated
         // answer about this model, and the roster cache that selection otherwise reads expires
         // five minutes after a catalog sync fills it -- so without remembering this, the next
@@ -1679,7 +1676,7 @@ export async function preparePassthroughExchange(
         // ladder does have one — retrying the account the refreshed roster still grants — and
         // keeps it. An earlier revision also broke here on a non-400 outcome, which no test could
         // justify because this flag already produced the identical result.
-        const storedReplaySpent = codex401ReplayKind === "stored";
+        const storedReplaySpent = codex401ReplayKind === "stored" && !wasAccountAutoPaused(upstreamResponse);
         const retry = await retryCodexPoolOnAlternateAccount({
           callerAuthHeaders,
           config,
@@ -1698,7 +1695,7 @@ export async function preparePassthroughExchange(
           httpOnly: canonicalBufferedJson,
           preOutputRefusalHold: preOutputRefusalHold(),
           onResponse: (response, retryAuthCtx, retryRequest) => {
-            adoptCodexWsStage(response);
+            adoptCodexWsStage(response, logCtx);
             captureAffinityResponse(
               response,
               retryAuthCtx,

package/src/server/responses/passthrough-execution.ts

@@ -14,6 +14,7 @@ import { guardDirectPassthroughBodyInactivity } from "../../lib/response-body-in
 import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
+import { attachResponseToolOwnership } from "./response-tool-ownership";
 
 /** Owns the native host lease across dispatch, recovery, and response construction. */
 export async function executePassthroughResponse(
@@ -50,11 +51,11 @@ export async function executePassthroughResponse(
     // Delivery has already classified SSE (including a missing upstream content type)
     // and consumed bounded JSON/errors. Guard only its remaining direct body, outside
     // the relay/lifetime wrappers so their prefetch cannot arm our inactivity clock.
-    return guardDirectPassthroughBodyInactivity(
+    return attachResponseToolOwnership(guardDirectPassthroughBodyInactivity(
       response,
       nativeExchange.upstream.signal,
       resolveStallTimeoutMs(requestContext.config.stallTimeoutSec, { localUpstream: nativeExchange.localUpstream }),
-    );
+    ), nativeExchange.providerExecutedCallTypes);
   } finally {
     if (nativeHostState.lease) {
       releaseUpstreamHostAdmission(nativeHostState.lease);