@bitkyc08/opencodex 2.88.0 → 2.89.0

package/src/server/responses/context-overflow.ts

@@ -1,5 +1,8 @@
 import { bridgeToResponsesSSE, formatErrorResponse } from "../../bridge";
 import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
+import { isThroughputLimitText } from "../../claude/outbound";
+import { isDefiniteContextOverflow } from "../../combos/failover";
+import { classifyError } from "../../lib/errors";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import type { AdapterEvent } from "../../types";
 
@@ -32,8 +35,11 @@ export function jsonContextOverflowResponse(message = PROVIDER_INPUT_TOO_LARGE_M
   }, { status: 413, headers: { "Cache-Control": "no-store" } });
 }
 
-async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEvent> {
-  yield {
+/** The terminal error event every context overflow is reported as, streaming or in-stream. */
+export function contextOverflowEvent(
+  message = PROVIDER_INPUT_TOO_LARGE_MESSAGE,
+): Extract<AdapterEvent, { type: "error" }> {
+  return {
     type: "error",
     message,
     status: 413,
@@ -43,6 +49,139 @@ async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEv
   };
 }
 
+async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEvent> {
+  yield contextOverflowEvent(message);
+}
+
+/**
+ * Whether a web-search or image-bridge failure is the provider refusing an oversized input.
+ *
+ * An HTTP 413 is classified by status alone, exactly as the main path does. A 400/422 needs a
+ * definite overflow phrase in the provider message (the rule combo failover already trusts), so a
+ * plain bad request stays what it was, and rate-window wording ("too many tokens per minute")
+ * never reads as an overflow: compacting does not fix a throughput limit. An adapter that already
+ * classified its own failure as `context_length_exceeded` keeps that verdict whatever status it
+ * rode on. The local translator limit is excluded: compacting cannot shrink a buffer this proxy owns.
+ */
+export function isSidecarContextOverflow(
+  status: number | undefined,
+  message: string,
+  code?: string | null,
+): boolean {
+  if (code === "translation_buffer_limit" || code === "rate_limit_exceeded") return false;
+  if (code === "context_length_exceeded") return true;
+  if (status === 413) return true;
+  return (status === 400 || status === 422) && !isThroughputLimitText(message)
+    && isDefiniteContextOverflow(status, message);
+}
+
+/**
+ * The in-stream terminal for a sidecar overflow. A bare 413 carries no provider wording worth
+ * keeping and gets the proxy-owned message. A worded verdict keeps its own status and message:
+ * that is the evidence combo failover reads to try a larger-context target, and replacing it
+ * would end the chain at the first target that was merely too small.
+ */
+export function sidecarContextOverflowEvent(
+  status: number | undefined,
+  message: string,
+): Extract<AdapterEvent, { type: "error" }> {
+  return status === undefined || !message || (status === 413 && !isDefiniteContextOverflow(413, message))
+    ? contextOverflowEvent()
+    : { ...contextOverflowEvent(message), status };
+}
+
+/** One sidecar loop failure, with what the loop knew when it raised it. */
+export interface SidecarLoopFailure {
+  status: number;
+  message: string;
+  event?: Extract<AdapterEvent, { type: "error" }>;
+  /** The provider's own `error.code`, read from a bounded display-safe body. */
+  upstreamCode?: string;
+  /** The failed response was marked non-replayable: the provider may already have run the turn. */
+  nonReplayable?: boolean;
+}
+
+/**
+ * The overflow terminal a sidecar loop failure should end with, or `undefined` to keep the
+ * failure as it is. A non-replayable failure keeps its verdict: an overflow would invite a
+ * compacted resend of a turn the provider may already have run. An adapter event marked
+ * `retryable: false` under any other code is that adapter's own verdict and is not reread.
+ */
+export function sidecarLoopOverflowEvent(
+  failure: SidecarLoopFailure,
+): Extract<AdapterEvent, { type: "error" }> | undefined {
+  if (failure.nonReplayable) return undefined;
+  const code = failure.event?.code ?? failure.upstreamCode;
+  if (failure.event?.retryable === false && code !== "context_length_exceeded") return undefined;
+  if (!isSidecarContextOverflow(failure.status, failure.message, code)) return undefined;
+  return sidecarContextOverflowEvent(failure.event?.status ?? failure.status, failure.message);
+}
+
+/**
+ * The in-stream terminal for a sidecar loop failure that carries no adapter event, or
+ * `undefined` to keep the loop's existing generic event. An overflow ends as the overflow
+ * terminal. A failure this classifier deliberately kept (non-replayable, or an upstream
+ * `rate_limit_exceeded`) gets an explicit code whenever the bridge's wording heuristics would
+ * otherwise rename it `context_length_exceeded` and undo that verdict on the wire.
+ */
+export function sidecarLoopTerminalEvent(
+  failure: SidecarLoopFailure,
+): Extract<AdapterEvent, { type: "error" }> | undefined {
+  const overflow = sidecarLoopOverflowEvent(failure);
+  if (overflow || failure.event) return overflow;
+  if (classifyError(failure.status, "upstream_error", failure.message).code !== "context_length_exceeded") return undefined;
+  const rateLimited = failure.upstreamCode === "rate_limit_exceeded";
+  return {
+    type: "error",
+    status: failure.status,
+    message: failure.message,
+    errorType: rateLimited ? "rate_limit_error" : "upstream_error",
+    code: failure.upstreamCode ?? "upstream_error",
+    ...(failure.nonReplayable ? { retryable: false } : {}),
+  };
+}
+
+/** Read a provider's `error.code` from an already bounded, display-safe error body. */
+export function upstreamErrorCode(text: string): string | undefined {
+  try {
+    const code = (JSON.parse(text) as { error?: { code?: unknown } } | null)?.error?.code;
+    return typeof code === "string" && code.length <= 128 ? code : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const sidecarOverflowResponses = new WeakSet<Response>();
+
+/** Tag a loop's first-iteration JSON failure that the sidecar boundary should map to an overflow. */
+export function markSidecarContextOverflow(response: Response, failure: SidecarLoopFailure): Response {
+  if (sidecarLoopOverflowEvent(failure)) sidecarOverflowResponses.add(response);
+  return response;
+}
+
+/**
+ * Map a sidecar loop's pre-stream HTTP failure onto the main path's overflow contract (#7316).
+ *
+ * Both loops answer a failed first iteration with their own small JSON error, so the overflow
+ * would otherwise reach Codex as a bare non-2xx that it resends unchanged through its retry
+ * budget. The loop classified the failure while it still had the provider's status, wording,
+ * code and replay verdict, and tagged the response; anything untagged is returned untouched.
+ * Combo attempts do not come through here: the combo layer reads the raw failure for its hop
+ * decision and maps a final 413 itself. A failure answered with `x-should-retry: false` keeps
+ * its status and header, so that contract never turns into an invitation to resend.
+ */
+export function sidecarContextOverflowResponse(
+  response: Response,
+  options: { stream: boolean; modelId: string; translatorBudget: TranslatorBudget },
+): Response {
+  if (response.ok || !sidecarOverflowResponses.has(response)) return response;
+  if (response.headers.get("x-should-retry") === "false") return response;
+  void response.body?.cancel().catch(() => {});
+  return options.stream
+    ? streamingContextOverflowResponse(options.modelId, options.translatorBudget)
+    : jsonContextOverflowResponse();
+}
+
 /**
  * Convert a pre-stream provider 413 into the terminal Responses event Codex understands.
  *

package/src/server/responses/core-codex-account.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig, OcxParsedRequest } from "../../types";
 import type { CodexAuthContext, CodexAuthPolicyConfig } from "../../codex/auth-context";
 import type { CodexUpstreamOutcome } from "../../codex/routing";
@@ -144,7 +145,7 @@ export function recordCodexPreOutputRefusalOutcome(
   modelId: string,
 ): void {
   if (!isCodexWsPreOutputRefusal(response) || codexWsPreOutputRefusalOutcomeRecorded(response)) return;
-  if (!usesCodexForwardPoolAuth(authCtx, provider)) return;
+  if (!usesCodexForwardPoolAuth(authCtx, provider) || wasPermanentAccountRefusal(response)) return;
   noteCodexWsPreOutputRefusalOutcome(response);
   recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
     threadId: authCtx.affinityKey,
@@ -855,6 +856,10 @@ export async function retryCodexPoolOnAlternateAccount(
     options.deferCodexResetDerivedCooldown,
   );
   const recordFirstOutcome = (): void => {
+    if (wasPermanentAccountRefusal(firstResponse)) {
+      noteCodexWsPreOutputRefusalOutcome(firstResponse);
+      return;
+    }
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
       threadId: firstAuthCtx.affinityKey,
@@ -1032,6 +1037,7 @@ export async function retryCodexPoolOnAlternateAccount(
             providerName: route.providerName,
             modelId: route.modelId,
             preOutputRefusalHold: args.preOutputRefusalHold,
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: retryAuthCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,

package/src/server/responses/core-combo.ts

@@ -45,6 +45,7 @@ import {
 } from "../../combos";
 import { formatErrorResponse } from "../../bridge";
 import { SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
+import { redactSecretString, sanitizeLogMetadataString } from "../../lib/redact";
 import {
   expandPreviousResponseInput,
   previousResponseReplayFailure,
@@ -98,6 +99,7 @@ import type { CodexAuthContext } from "../../codex/auth-context";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import { beginRequestAttempt, sealRequestAttemptIdentity, finishRequestAttempt } from "../request-log";
 import { rememberComboForLane } from "./combo-session-recall";
+import { COMBO_TOOL_LOOP_PIN_REASON, toolLoopPinnedPick } from "./combo-tool-loop-pin";
 import { runTurnAdapterSseResponses } from "./core-lifetime";
 import { normalizePersistedJevDecision } from "../../usage/jev-stats";
 import {
@@ -589,7 +591,19 @@ export async function executeComboResponses(
     waitForCooldownMs: combo.waitForCooldownMs,
     abortSignal: options.abortSignal,
   });
-  let pick = await pickWithWait({
+  // An in-flight tool loop stays on the target that issued its calls while that target is still
+  // selectable (#7298). Override routes never record a lane target, so they never pin either.
+  const toolLoopPin = options.compactionRoutingOverride || options.mainHardLockFallbackOverride
+    ? undefined
+    : toolLoopPinnedPick({
+      config,
+      comboId,
+      lane: sessionLaneIdFromRequest(req.headers),
+      body,
+      eligible: target => (meteredAllowed || !target.metered) && targetEligible(target),
+      now: initialNow,
+    });
+  let pick = toolLoopPin ?? await pickWithWait({
     eligible: targetEligible,
     now: initialNow,
   });
@@ -625,7 +639,7 @@ export async function executeComboResponses(
       : comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, targetEligible));
   }
   let jevDecision: JevDecision | undefined;
-  if (combo.strategy === "jev") {
+  if (combo.strategy === "jev" && !toolLoopPin) {
     const choices = eligibleJevComboChoices(config, comboId, targetEligible, Date.now());
     const first = choices[0];
     if (!first) {
@@ -653,6 +667,7 @@ export async function executeComboResponses(
         isDestinationAllowed: (providerName, modelId) => routeAllowedByScope(
           resolveAdmissionModelScope(config, options.admission), { providerName, modelId },
         ),
+        ...(combo.decisionQuotaSignals === true ? { decisionQuotaSignals: true, decisionQuotaTiers: combo.decisionQuotaTiers } : {}),
         ...(combo.decisionProvider ? { decisionProvider: combo.decisionProvider } : {}),
         ...(combo.decisionModel
           ? {
@@ -696,6 +711,7 @@ export async function executeComboResponses(
         ? { chosenProbability: decision.chosenProbability }
         : {}),
       ...(decision.usage ? { usage: decision.usage } : {}),
+      ...(decision.quota ? { quota: decision.quota } : {}),
     });
     console.debug("[combo] JEV decision", {
       backend: decision.backend,
@@ -713,8 +729,11 @@ export async function executeComboResponses(
   // One immutable combo selection trace, before any child dispatch; child
   // adoption below must never replace it with a concrete child route trace.
   const decision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
-  logCtx.routeDecision = options.memoryModelPhase
-    ? { ...decision, selected: { ...decision.selected, reason: memoryModelRouteReason(options.memoryModelPhase) } }
+  const selectedReason = options.memoryModelPhase
+    ? memoryModelRouteReason(options.memoryModelPhase)
+    : toolLoopPin ? COMBO_TOOL_LOOP_PIN_REASON : undefined;
+  logCtx.routeDecision = selectedReason
+    ? { ...decision, selected: { ...decision.selected, reason: selectedReason } }
     : decision;
 
   const originalReasoning = body && typeof body === "object" && !Array.isArray(body)
@@ -1193,8 +1212,15 @@ export async function executeComboResponses(
       }
       return lastFailure;
     }
+    // A bare status made a revoked credential read as a provider outage. Log only the parsed
+    // code and message, never the raw envelope, as one redacted, bounded line.
+    const failureReason = sanitizeLogMetadataString(
+      redactSecretString([failure.upstreamCode, failure.upstreamMessage].filter(Boolean).join(": ")).replace(/\s+/g, " "),
+      200,
+    );
     console.warn(
-      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${failure.response.status} after ${Date.now() - started}ms`,
+      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${failure.response.status}`
+        + ` after ${Date.now() - started}ms${failureReason ? `: ${failureReason}` : ""}`,
     );
     const failureNow = Date.now();
     const attemptedTargets = pick.attempted;

package/src/server/responses/core.ts

@@ -12,6 +12,7 @@ import { createInferenceSendBudget } from "../inference/context";
 import { finalizeOwnedTranslatorBudget, finalizeAccountLease } from "./core-lifetime";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { executeComboResponses } from "./core-combo";
+import { registerTurn, unregisterTurn } from "../lifecycle";
 import { runWithCompactionRecovery } from "./compaction-recovery";
 /**
  * Route one `/v1/responses` request through the adapter pipeline: recovery loop, passthrough
@@ -67,15 +68,17 @@ export async function handleComboResponses(
   logCtx: RequestLogContext,
   options: HandleResponsesOptions & { translatorBudget: TranslatorBudget },
 ): Promise<Response> {
-  return executeComboResponses(
-    req,
-    rawBody,
-    comboId,
-    config,
-    logCtx,
-    options,
-    requestDispatchers,
-  );
+  // Each child relay binds the turn's lease and unbinds it when its stream ends; the lease is
+  // released once nothing is bound. Hold it for the whole ladder so a refused child's relay
+  // cannot settle the turn the next target still runs in ("turn already settled"). An accepted
+  // child's stream is bound before this returns and keeps the lease until it ends.
+  const ladder = new AbortController();
+  registerTurn(ladder, options.turnAdmissionLease);
+  try {
+    return await executeComboResponses(req, rawBody, comboId, config, logCtx, options, requestDispatchers);
+  } finally {
+    if (options.turnAdmissionLease && "bindAbortController" in options.turnAdmissionLease) unregisterTurn(ladder);
+  }
 }
 const requestDispatchers: ResponsesDispatchers = { handleResponses, handleComboResponses };
 export { adapterNeedsForcedContinuation } from "./core-replay";

package/src/server/responses/empty-completion-guard.ts

@@ -172,6 +172,7 @@ export function mergeUsage(
   const cachedInputTokens = sumOptional("cachedInputTokens");
   const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
   const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
+  const cacheCreation1hInputTokens = sumOptional("cacheCreation1hInputTokens");
   const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
   const providerCredits = sumOptional("providerCredits");
   const contextTotalTokens = second.contextTotalTokens ?? first.contextTotalTokens;
@@ -188,6 +189,7 @@ export function mergeUsage(
     ...(cachedInputTokens !== undefined ? { cachedInputTokens } : {}),
     ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
     ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
+    ...(cacheCreation1hInputTokens !== undefined ? { cacheCreation1hInputTokens } : {}),
     ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
     ...(providerCredits !== undefined ? { providerCredits } : {}),
     ...(first.estimated || second.estimated ? { estimated: true } : {}),

package/src/server/responses/fetch-helpers.ts

@@ -31,6 +31,7 @@ import {
 } from "../../lib/provider-egress";
 import { redactSecretString } from "../../lib/redact";
 import { outboundCredentials } from "../../lib/outbound-credential-registry";
+import { compressUpstreamRequestBody, isCanonicalCodexResponsesUrl } from "./request-compression";
 
 export { withUpstreamHttpVersion };
 
@@ -48,6 +49,17 @@ const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
 const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
 // Survives queued credential rebuilds and executor replacement without importing budget owners.
 const PHYSICAL_DISPATCH = Symbol.for("opencodex.physical-dispatch");
+// Final destination and headers after plugin rewrites and queued rebuilds, for observers that
+// must attribute a response to the credential that actually reached the wire.
+const PHYSICAL_SEND_OBSERVER = Symbol.for("opencodex.physical-send-observer");
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  physical?: (sameDestination: boolean, headers: Headers) => void;
+};
+/** Init fragment that reports the final send of the observer's attempt; empty when nothing observes. */
+export function physicalSendObserverInit(observer: AccountAutoPauseObserver | undefined, target: string): Record<symbol, unknown> {
+  const physical = observer?.physical;
+  return physical ? { [PHYSICAL_SEND_OBSERVER]: (destination: string, headers: Headers) => physical(destination === target, headers) } : {};
+}
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
 // Replacement admission waits on the client signal, outside the response-header deadline.
@@ -206,18 +218,27 @@ export function sendWithConnectionPolicy(
   // Bun can reset large native Codex string uploads before receiving headers while
   // the identical UTF-8 buffer succeeds. Convert only at the final HTTP send so
   // WebSocket selection still sees the serialized string and no retry is added.
+  // Opt-in compression (#7247) takes precedence at the same boundary and also yields bytes. Every
+  // retry and HTTP fallback re-enters here with the caller's original string, so each send derives
+  // its own coded bytes; `headers` is already this send's private copy.
   const target = input instanceof Request ? input.url : String(input);
   const body = init?.body;
-  const largeCodexBody = typeof body === "string"
-    && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
+  const compressed = compressUpstreamRequestBody(target, body, headers);
+  if (compressed) {
+    headers.set("Content-Encoding", compressed.encoding);
+    headers.delete("Content-Length");
+  }
+  const largeCodexBody = !compressed && typeof body === "string"
+    && isCanonicalCodexResponsesUrl(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
+  (init as Record<symbol, ((destination: string, headers: Headers) => void) | undefined> | undefined)?.[PHYSICAL_SEND_OBSERVER]?.(target, headers);
   // Final headers, after plugin rewrites: an upstream can only echo what it received here, so the
   // request log refuses any diagnostic that repeats one of these values (see request-log-terminal-status).
   outboundCredentials().remember(headers);
   return physicalFetch(input, {
     ...init,
-    ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
+    ...(compressed ? { body: compressed.body } : largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),
@@ -228,6 +249,7 @@ export function sendWithConnectionPolicy(
 }
 
 export interface ProviderFetchOptions {
+  accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => AccountAutoPauseObserver | undefined;
   /**
    * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
    *
@@ -344,7 +366,7 @@ export function providerFetch(
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
-  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+  const unobserved = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
     reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
     const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
@@ -381,6 +403,15 @@ export function providerFetch(
     }
     return httpFetch(input, init, reacquirePacing);
   };
+  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+    reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
+    const observe = options.accountAutoPause?.(providerName, provider,
+      new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+    const observedInit = observe?.physical
+      ? { ...init, ...physicalSendObserverInit(observe, input instanceof Request ? input.url : String(input)) } : init;
+    const response = await unobserved(input, observedInit, reacquirePacing);
+    return observe ? observe(response) : response;
+  };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
   const waitForPacing = async (signal?: AbortSignal): Promise<ProviderRequestSlot | undefined> => {
     if (pacingSlotAcquired) {

package/src/server/responses/jev-model-invoke.ts

@@ -1,6 +1,7 @@
 import { readBoundedResponseBytes } from "../../lib/bounded-body";
 import { JevModelInvokeError, type JevModelInvoke, type JevModelInvokeResult } from "../../combos/jev-model-backend";
 import { JEV_MAX_REQUEST_BYTES, JEV_MAX_RESPONSE_BYTES } from "../../combos/jev";
+import { serializeJevModelRequest } from "../../combos/jev-model-request";
 import type { OcxConfig } from "../../types";
 import { codexEffortRank, isCodexReasoningEffort } from "../../reasoning-effort";
 import { routeConcreteModel } from "../../router";
@@ -92,7 +93,7 @@ function decodeSse(bytes: Uint8Array): JevModelInvokeResult {
  * bounds billed output (including reasoning) and gives the spend reservation a nonzero ceiling;
  * a truncated answer is malformed and fails open like any other bad reply.
  */
-export const JEV_MODEL_MAX_OUTPUT_TOKENS = 1024;
+export { JEV_MODEL_MAX_OUTPUT_TOKENS } from "../../combos/jev-model-request";
 
 /**
  * The cheapest reasoning effort the decision model declares, so a reasoning model cannot spend
@@ -121,19 +122,17 @@ export function jevDecisionReasoningEffort(config: OcxConfig, model: string): st
  * or conversation header. It therefore runs on credentials configured on provider rows only.
  */
 export function createJevModelInvoker(context: JevModelInvokerContext): JevModelInvoke {
-  return async ({ model, instructions, input, signal }) => {
+  return async ({ model, instructions, input, signal, withoutQuota }) => {
     const effort = jevDecisionReasoningEffort(context.config, model);
-    const body = JSON.stringify({
-      model,
-      stream: true,
-      store: false,
-      instructions,
-      input: [{ role: "user", content: [{ type: "input_text", text: input }] }],
-      tools: [],
-      max_output_tokens: JEV_MODEL_MAX_OUTPUT_TOKENS,
-      ...(effort ? { reasoning: { effort } } : {}),
-    });
-    if (new TextEncoder().encode(body).byteLength > JEV_MAX_REQUEST_BYTES) {
+    let body = serializeJevModelRequest({ model, instructions, input }, effort);
+    /** True when the serialized decision request exceeds the request byte limit. */
+    const oversized = () => new TextEncoder().encode(body).byteLength > JEV_MAX_REQUEST_BYTES;
+    let quotaOmitted = false;
+    if (oversized() && withoutQuota) {
+      body = serializeJevModelRequest({ model, ...withoutQuota }, effort);
+      quotaOmitted = true;
+    }
+    if (oversized()) {
       throw new JevModelInvokeError("malformed", "decision request too large");
     }
     const lease = tryAdmitTurn(undefined, signal);
@@ -178,7 +177,7 @@ export function createJevModelInvoker(context: JevModelInvokerContext): JevModel
           return terminalResult(parsed, "");
         })();
       usage = result.usage;
-      return result;
+      return quotaOmitted ? { ...result, quotaOmitted: true } : result;
     } finally {
       // No final log row is written for this detached context, so settle its spend here.
       childLog.spendTracker?.settle(childLog.usage ?? (usage

package/src/server/responses/native-steering-log.ts

@@ -24,7 +24,7 @@ export function createNativeSteeringLogObserver(logCtx: RequestLogContext, onFir
       if (usage && (usages.has(event.response.id) || usages.size < MAX_NATIVE_STEERING_RESPONSES)) {
         // Retain numeric counters only, never arbitrary rawUsage metadata.
         const counters: OcxUsage = { inputTokens: usage.inputTokens, outputTokens: usage.outputTokens };
-        for (const key of ["totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "reasoningOutputTokens"] as const) {
+        for (const key of ["totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "cacheCreation1hInputTokens", "reasoningOutputTokens"] as const) {
           if (typeof usage[key] === "number") counters[key] = usage[key];
         }
         usages.set(event.response.id, counters);
@@ -33,7 +33,7 @@ export function createNativeSteeringLogObserver(logCtx: RequestLogContext, onFir
     if (!usages.size) return;
     const total: OcxUsage = { inputTokens: 0, outputTokens: 0 };
     for (const usage of usages.values()) {
-      for (const key of ["inputTokens", "outputTokens", "totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "reasoningOutputTokens"] as const) {
+      for (const key of ["inputTokens", "outputTokens", "totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "cacheCreation1hInputTokens", "reasoningOutputTokens"] as const) {
         const value = usage[key];
         if (typeof value === "number" && Number.isFinite(value)) total[key] = (total[key] ?? 0) + value;
       }

package/src/server/responses/passthrough-delivery.ts

@@ -1,3 +1,4 @@
+import { wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { isNativeControlResponse } from "./native-response-control";
 import { createOutboundCredentialMask, createTerminalErrorRedactionBlockRewrite } from "./terminal-error-redaction";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
@@ -527,7 +528,7 @@ export async function deliverPassthroughResponse(
       } else if (!shouldDeferCodexResetDerivedCooldown(
         upstreamResponse,
         options.deferCodexResetDerivedCooldown,
-      ) && !isReplayRefusalResponse(upstreamResponse)) {
+      ) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
         // A refusal this proxy made is not evidence about the account. Recording it would
         // classify the synthetic 429 as quota exhaustion and write a default cooldown against
         // a credential the request may never have reached, and that false signal outlives the
@@ -572,7 +573,7 @@ export async function deliverPassthroughResponse(
     // through sanitizePassthroughHeaders) so a redirect to a dead host can never
     // masquerade as a pre-connection failure after the credential was seen.
     // The numeric outcome above already classified it neutral — no streak.
-    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse)) {
+    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
       return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
     }
     if (upstreamResponse.status >= 300 && upstreamResponse.status < 400) {