@bitkyc08/opencodex 2.88.0 → 2.89.0

package/src/types/config.ts

@@ -1089,7 +1089,11 @@ export interface OcxConfig {
   modelCacheTtlMs?: number;
   /** Evictable retained app-state budget in MiB. Default 256; valid 64..4096. */
   appOwnedMemoryBudgetMb?: number;
-  /** Anthropic prompt-cache retention: "short" = 5-min ephemeral (default), "long" = 1-hour extended, "none" = disabled. */
+  /**
+   * Anthropic prompt-cache retention: "short" = 5-min ephemeral, "long" = 1-hour extended,
+   * "none" = disabled. Unset = "long" on first-party api.anthropic.com, "short" on
+   * Anthropic-compatible endpoints (adapters/anthropic/cache-retention.ts).
+   */
   cacheRetention?: "none" | "short" | "long";
   /** Web-search sidecar: route web_search for non-OpenAI models through a gpt-mini via ChatGPT passthrough. */
   webSearchSidecar?: OcxWebSearchSidecarConfig;
@@ -1113,6 +1117,9 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  /** Internal policy epochs; null marks malformed disk input and suppresses automatic pause. */
+  accountAutoPausePolicyRevisions?: Record<string, string> | null;
+  codexAccountPauseState?: Record<string, { revision: string; details?: import("./account-auto-pause").AccountPauseDetails }>;
   /**
    * Account ids, `__main__` included, allowed to keep serving from ChatGPT credits once one of
    * their usage windows is full. Every other account is skipped by selection at 100% until its
@@ -1293,6 +1300,13 @@ export interface OcxConfig {
    * that work today — on Azure and custom Responses gateways as well, whose limits are unknown.
    */
   maxUpstreamBodyBytes?: number;
+  /**
+   * Opt-in compression of native ChatGPT Responses HTTP request bodies (#7247): "gzip" or "zstd".
+   * Omitted, "off", or any other value = identity, the default. Applies only at the final HTTP send
+   * to chatgpt.com Codex responses/compact, to string bodies from 1 KiB to 16 MiB; WebSocket turns
+   * and every other destination are unchanged. Compression runs synchronously on the event loop.
+   */
+  upstreamRequestCompression?: "off" | "gzip" | "zstd";
   /**
    * Opt-in ceiling, in bytes, on a decompressed INBOUND data-plane request body (#3573).
    *
@@ -1454,6 +1468,8 @@ export interface OcxComboConfig {
   nativeAlias?: boolean;
   /** Display-only label for the public catalog row. Required for native aliases. */
   displayName?: string;
+  /** Display-only description for the public catalog row; unset keeps the generated text (#7229). */
+  description?: string;
   /**
    * `strategy: "jev"` only: provider id of the decision service. Omitted or `"jev"` uses the
    * canonical TypeSafe endpoint; any other id must name a configured `adapter: "jev-decision"`
@@ -1469,6 +1485,10 @@ export interface OcxComboConfig {
    * whose first call may include a cold model load.
    */
   decisionTimeoutMs?: number;
+  /** JEV-only advisory loaded quota evidence; off/unset leaves request bytes unchanged. */
+  decisionQuotaSignals?: boolean | null;
+  /** Partial 0..100 tier overrides; defaults limited 70/nearlyExhausted 90. null clears. */
+  decisionQuotaTiers?: import("../combos/jev-quota-config").JevQuotaTiers | null;
 }
 
 export type OcxRoutingUnknownEvidenceMode = "allow" | "penalize" | "exclude";
@@ -1757,6 +1777,8 @@ export interface CodexLowQuotaProtectionConfig {
   actions: {
     pause: boolean;
     notify: boolean;
+    /** Opt-in: also hand each notice to this host's OS notifier (macOS, Linux). Requires notify. */
+    desktop?: boolean;
   };
   windows: {
     short: boolean;

package/src/types/provider.ts

@@ -1,4 +1,5 @@
 import type { UpstreamHttpVersion, ReasoningSummaryDelivery, CodexAccountMode } from "./wire";
+import type { AccountAutoPausePolicy, AccountPauseDetails } from "./account-auto-pause";
 import type { AnthropicAccountPoolConfig } from "./anthropic-account-pool";
 
 /**
@@ -448,8 +449,9 @@ export interface OcxProviderConfig {
    */
   preserveResponsesMessageMetadata?: boolean;
   /**
-   * Opt in to lossy hosted-search history notes on ordinary canonical Codex Lite requests.
-   * Default off; only literal true enables it, and non-Lite/native compact stay unchanged.
+   * Opt in to lossy hosted-search history notes on canonical Codex Lite ordinary turns and
+   * native v2 compaction triggers, even when search is declared. Default off; only literal true
+   * enables it. History without a search declaration is always projected, independent of this.
    */
   projectResponsesLiteHostedSearchHistory?: boolean;
   /**
@@ -567,7 +569,9 @@ export interface OcxProviderConfig {
    * entry so routing stays single-key; managed via /api/providers/keys. A legacy bare
    * `apiKey` seeds a one-entry pool on first management touch.
    */
-  apiKeyPool?: Array<{ id: string; key: string; label?: string; addedAt?: number }>;
+  apiKeyPool?: Array<{ id: string; key: string; label?: string; addedAt?: number; disabled?: boolean; pauseDetails?: AccountPauseDetails; pauseRevision?: string }>;
+  /** Explicit opt-in permanent account refusal policy; default off. */
+  accountAutoPause?: AccountAutoPausePolicy;
   /**
    * Optional proactive ordering for `apiKeyPool` when the committed key is already
    * cooling. Deliberately NOT named like the OAuth `accountPoolStrategy`: an API key
@@ -1110,9 +1114,9 @@ export interface OcxProviderConfig {
   googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
   /** Google tool-schema compatibility policy. Omitted preserves compatible report-only behavior. */
   googleToolSchemaPolicy?: "compatible" | "reject-lossy";
-  /** Vertex AI GCP project id (or GOOGLE_CLOUD_PROJECT / GCLOUD_PROJECT env). */
+  /** Vertex AI GCP project id. API keys use it to select the project endpoint; ADC falls back to GOOGLE_CLOUD_PROJECT / GCLOUD_PROJECT env. */
   project?: string;
-  /** Vertex AI location, e.g. "us-central1" or "global" (or GOOGLE_CLOUD_LOCATION env). */
+  /** Vertex AI location, e.g. "us-central1" or "global". API-key project endpoints default to "global"; ADC falls back to GOOGLE_CLOUD_LOCATION env. */
   location?: string;
   /**
    * Cursor adapter only: MCP servers opencodex starts/connects and exposes to the Cursor agent

package/src/types/request.ts

@@ -46,6 +46,14 @@ export interface OcxReasoningReplayScopeRef {
   current?: Readonly<OcxReasoningReplayIdentity>;
 }
 
+/** One replayed hosted search cell, rebuilt as the `web_search` call/result pair `callId`. */
+export interface OcxReplayedWebSearchCell {
+  /** The client-visible cell id; absent when the cell carried no usable id (no recorded result). */
+  cellId?: string;
+  callId: string;
+  failed: boolean;
+}
+
 export interface OcxParsedRequest {
   modelId: string;
   /** Client-facing model selector retained for Anthropic routes after wire-model normalization. */
@@ -152,6 +160,12 @@ export interface OcxParsedRequest {
    * executes searches via the gpt-5.6-luna sidecar (see src/web-search). Absent when not requested.
    */
   _webSearch?: Record<string, unknown>;
+  /**
+   * Replayed hosted `web_search_call` cells the parser rebuilt as `web_search` call/result pairs
+   * (src/responses/web-search-replay.ts). The web-search sidecar swaps in the result it recorded for
+   * a cell, or removes the pairs when it does not run (src/web-search/sidecar-search-replay.ts).
+   */
+  _replayedWebSearchCells?: OcxReplayedWebSearchCell[];
   /** Hosted image_generation tool config stashed for the image bridge sidecar (see src/images). */
   _imageGeneration?: { toolNames: Set<string>; originalTool?: Record<string, unknown> };
   /**
@@ -448,9 +462,10 @@ export type AdapterEvent =
   // "Searching the web" spinner, then `end` once it resolves. The bridge maps begin → an
   // output_item.added(in_progress) and end → the matching output_item.done(completed|failed) under
   // the SAME output index, so the activity animates instead of flashing completed instantly.
-  | { type: "web_search_call_begin"; id: string }
+  // `itemId` lets the loop name the client-visible cell so it can record the result for replay.
+  | { type: "web_search_call_begin"; id: string; itemId?: string }
   | {
-      type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[];
+      type: "web_search_call_end"; id: string; itemId?: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[];
       /** Anthropic's server-side call (adapters/anthropic.ts): its `server_tool_use` and result block, verbatim. */
       anthropic?: AnthropicServerBlocks;
     }
@@ -510,6 +525,8 @@ export interface OcxUrlCitation {
  * - `cachedInputTokens` is cache READ tokens only (a subset of `inputTokens`).
  * - `cacheReadInputTokens`/`cacheCreationInputTokens` carry the read/write split when
  *   the provider reports both; reads mirror `cachedInputTokens`.
+ * - `cacheCreation1hInputTokens` is the 1-hour-TTL subset of `cacheCreationInputTokens`
+ *   (Anthropic `cache_creation.ephemeral_1h_input_tokens`), priced at the 1h write tier.
  * - `totalTokens` = inputTokens + outputTokens. Never re-add cache detail on top.
  */
 export interface OcxUsage {
@@ -527,6 +544,7 @@ export interface OcxUsage {
   cachedInputTokens?: number;
   cacheReadInputTokens?: number;
   cacheCreationInputTokens?: number;
+  cacheCreation1hInputTokens?: number;
   reasoningOutputTokens?: number;
   estimated?: boolean;
   /**

package/src/types.ts

@@ -41,6 +41,7 @@ export {
 export type {
   OcxReasoningReplayIdentity,
   OcxReasoningReplayScopeRef,
+  OcxReplayedWebSearchCell,
   OcxParsedRequest,
   OcxContext,
   OcxMessage,

package/src/usage/cost.ts

@@ -65,6 +65,8 @@ export interface CostTokens {
   output: number;
   cacheRead: number;
   cacheWrite: number;
+  /** The 1-hour-TTL subset of `cacheWrite`, when the provider reports the split. */
+  cacheWrite1h?: number;
 }
 
 export interface CostBreakdown {
@@ -163,22 +165,35 @@ export function normalizeCostTokens(usage: OcxUsage): CostTokens | null {
   for (const cacheRead of candidates) {
     if (![input, output, cacheRead, cacheWrite].every(finiteNonNegative)) return null;
     if (cacheRead + cacheWrite > input) continue;
+    const cacheWrite1h = usage.cacheCreation1hInputTokens;
     return {
       input: Math.max(0, input - cacheRead - cacheWrite),
       output,
       cacheRead,
       cacheWrite,
+      ...(typeof cacheWrite1h === "number" && finiteNonNegative(cacheWrite1h) && cacheWrite1h > 0
+        ? { cacheWrite1h: Math.min(cacheWrite1h, cacheWrite) } : {}),
     };
   }
   return null;
 }
 
+/**
+ * Price of a 1-hour cache write relative to the 5-minute rate that Cost4.cacheWrite records.
+ * Anthropic bills 5m writes at 1.25x and 1h writes at 2x base input, so 2 / 1.25. Scaling the
+ * 5m rate (rather than input) keeps every tier multiplier already applied to the Cost4 and keeps
+ * a free-write row (cacheWrite 0) free.
+ */
+export const CACHE_WRITE_1H_OVER_5M = 2 / 1.25;
+
 /** jawcode unit convention: USD per 1M tokens (jawcode stats/db.ts calculateCatalogCost). */
 export function calculateCost(tokens: CostTokens, cost4: Cost4): CostBreakdown {
   const input = cost4.input * tokens.input / 1_000_000;
   const output = cost4.output * tokens.output / 1_000_000;
   const cacheRead = cost4.cacheRead * tokens.cacheRead / 1_000_000;
-  const cacheWrite = cost4.cacheWrite * tokens.cacheWrite / 1_000_000;
+  const write1h = Math.min(tokens.cacheWrite1h ?? 0, tokens.cacheWrite);
+  const cacheWrite = (cost4.cacheWrite * (tokens.cacheWrite - write1h)
+    + cost4.cacheWrite * CACHE_WRITE_1H_OVER_5M * write1h) / 1_000_000;
   return { input, output, cacheRead, cacheWrite, total: input + output + cacheRead + cacheWrite };
 }
 
@@ -656,6 +671,7 @@ export function estimateComboCost(
     tokens.output += est.tokens.output;
     tokens.cacheRead += est.tokens.cacheRead;
     tokens.cacheWrite += est.tokens.cacheWrite;
+    if (est.tokens.cacheWrite1h) tokens.cacheWrite1h = (tokens.cacheWrite1h ?? 0) + est.tokens.cacheWrite1h;
     cost.input += est.cost.input;
     cost.output += est.cost.output;
     cost.cacheRead += est.cost.cacheRead;

package/src/usage/expected-prices.ts

@@ -125,7 +125,9 @@ const GLM_52: Cost4 = { input: 1.4, output: 4.4, cacheRead: 0.26, cacheWrite: 0
 const GLM_53: Cost4 = { input: 1.4, output: 4.4, cacheRead: 0.26, cacheWrite: 0 };
 const GLM_53_FLASH: Cost4 = { input: 0.15, output: 0.5, cacheRead: 0.03, cacheWrite: 0 };
 const QWEN38_MAX: Cost4 = { input: 2, output: 6, cacheRead: 0, cacheWrite: 0 };
-// Anthropic official list prices (USD / 1M tokens). Cache write uses the published 5-minute rate.
+// Anthropic official list prices (USD / 1M tokens). Cache write uses the published 5-minute rate;
+// writes the usage reports as 1-hour (cache_creation.ephemeral_1h_input_tokens) are priced at
+// 2x base input through CACHE_WRITE_1H_OVER_5M in cost.ts.
 const CLAUDE_SONNET_46: Cost4 = { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3.75 };
 const CLAUDE_OPUS_46: Cost4 = { input: 5, output: 25, cacheRead: 0.5, cacheWrite: 6.25 };
 // Claude Fable 5.1: 10 / 50, 5m cache write 12.50. Cache hits are 0.025x base input

package/src/usage/jev-stats.ts

@@ -1,3 +1,4 @@
+import { normalizeJevQuotaSummary, type JevQuotaDecisionSummary } from "../combos/jev-quota-config";
 import type { OcxComboDefaultEffort } from "../types";
 import type { PersistedUsageEntry } from "./log";
 import { usageDisplayTotalTokens } from "./totals";
@@ -39,6 +40,7 @@ export interface PersistedJevDecisionV1 {
   };
   gate: JevDecisionGate;
   latencyMs: number;
+  quota?: JevQuotaDecisionSummary;
   confidence?: number;
   chosenProbability?: number;
   usage?: {
@@ -182,6 +184,7 @@ export function normalizePersistedJevDecision(value: unknown): PersistedJevDecis
   const confidence = probability(value.confidence);
   const chosenProbability = probability(value.chosenProbability);
   const usage = normalizedDecisionUsage(value.usage);
+  const quota = normalizeJevQuotaSummary(value.quota);
   const backend = value.backend === "typesafe" || value.backend === "systemone" || value.backend === "model"
     ? value.backend
     : undefined;
@@ -196,6 +199,7 @@ export function normalizePersistedJevDecision(value: unknown): PersistedJevDecis
     },
     gate: gate as JevDecisionGate,
     latencyMs,
+    ...(quota ? { quota } : {}),
     ...(confidence !== undefined ? { confidence } : {}),
     ...(chosenProbability !== undefined ? { chosenProbability } : {}),
     ...(usage ? { usage } : {}),

package/src/usage/log.ts

@@ -581,6 +581,7 @@ function normalizeUsageValue(usage: OcxUsage | undefined): OcxUsage | undefined
     ...(typeof usage.cachedInputTokens === "number" ? { cachedInputTokens: usage.cachedInputTokens } : {}),
     ...(typeof usage.cacheReadInputTokens === "number" ? { cacheReadInputTokens: usage.cacheReadInputTokens } : {}),
     ...(typeof usage.cacheCreationInputTokens === "number" ? { cacheCreationInputTokens: usage.cacheCreationInputTokens } : {}),
+    ...(typeof usage.cacheCreation1hInputTokens === "number" ? { cacheCreation1hInputTokens: usage.cacheCreation1hInputTokens } : {}),
     ...(typeof usage.reasoningOutputTokens === "number" ? { reasoningOutputTokens: usage.reasoningOutputTokens } : {}),
     ...(isNonNegativeFiniteNumber(usage.providerCredits) ? { providerCredits: usage.providerCredits } : {}),
     ...(usage.estimated ? { estimated: true } : {}),
@@ -625,6 +626,7 @@ function normalizeAttemptUsage(raw: unknown): OcxUsage | null {
     "cachedInputTokens",
     "cacheReadInputTokens",
     "cacheCreationInputTokens",
+    "cacheCreation1hInputTokens",
     "reasoningOutputTokens",
     "providerCredits",
   ] as const) {

package/src/usage/summary.ts

@@ -520,6 +520,8 @@ function projectedComboUsage(
   let cachedInputTokens = 0;
   let cacheReadInputTokens = 0;
   let cacheCreationInputTokens = 0;
+  let cacheCreation1hInputTokens = 0;
+  let hasCacheWrite1h = false;
   let reasoningOutputTokens = 0;
   let hasUsage = false;
   let hasCacheTelemetry = false;
@@ -540,6 +542,10 @@ function projectedComboUsage(
         cacheReadInputTokens += cache.read;
       }
       if (typeof cache.creation === "number") cacheCreationInputTokens += cache.creation;
+      if (typeof attempt.usage.cacheCreation1hInputTokens === "number") {
+        hasCacheWrite1h = true;
+        cacheCreation1hInputTokens += attempt.usage.cacheCreation1hInputTokens;
+      }
       if (typeof attempt.usage.reasoningOutputTokens === "number") {
         hasReasoningTelemetry = true;
         reasoningOutputTokens += attempt.usage.reasoningOutputTokens;
@@ -559,6 +565,7 @@ function projectedComboUsage(
       inputTokens,
       outputTokens,
       ...(hasCacheTelemetry ? { cachedInputTokens, cacheReadInputTokens, cacheCreationInputTokens } : {}),
+      ...(hasCacheWrite1h ? { cacheCreation1hInputTokens } : {}),
       ...(hasReasoningTelemetry ? { reasoningOutputTokens } : {}),
       ...(estimated ? { estimated: true } : {}),
     }

package/src/web-search/loop.ts

@@ -14,6 +14,7 @@ import { bridgeToResponsesSSE } from "../bridge";
 import { isTerminalRefusalIncomplete } from "../bridge/terminal-refusal";
 import { guardEmptyToolCatalogStream, type ClientToolCatalogRestriction } from "../lib/empty-tool-catalog";
 import { mergeUsage } from "../server/responses/empty-completion-guard";
+import { markSidecarContextOverflow, sidecarLoopTerminalEvent, upstreamErrorCode, type SidecarLoopFailure } from "../server/responses/context-overflow";
 import { runWebSearch, type SidecarOutcome, type SidecarOutcomeRecorder, type SidecarSettings } from "./executor";
 import { runAnthropicWebSearch } from "./anthropic-executor";
 import { runXaiWebSearch, type XaiSearchOptions } from "./xai-executor";
@@ -25,6 +26,7 @@ import { redactSecretString } from "../lib/redact";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait, isNonReplayableResponse, SendBudgetExhaustedError } from "../lib/upstream-retry";
 import { rateLimitRetryDelayMs } from "../providers/key-failover";
+import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import {
   isTranslatorBudgetExceededError,
   TRANSLATOR_MAX_TURN_BYTES,
@@ -33,6 +35,7 @@ import {
 import { formatWebSearchResults } from "./format-result";
 import { parseStreamWithProgress, RoutedModelInactivityError, WebSearchStreamProtocolError, WebSearchAdapterEventError } from "./progress-stream";
 import { WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";
+import { newSidecarSearchCellId, rememberSidecarSearch, restoreSidecarSearchResults } from "./sidecar-search-replay";
 
 const SSE_HEADERS = {
   "Content-Type": "text/event-stream",
@@ -284,12 +287,21 @@ function jsonError(status: number, message: string, event?: Extract<AdapterEvent
 /** Hard provider/parse failure inside an iteration. The eager first iteration converts it to a
  *  non-200 jsonError; later (already-streaming) iterations surface it as an in-stream error event. */
 class LoopError extends Error {
-  constructor(readonly status: number, message: string, readonly event?: Extract<AdapterEvent, { type: "error" }>) {
+  constructor(
+    readonly status: number,
+    message: string,
+    readonly event?: Extract<AdapterEvent, { type: "error" }>,
+    readonly detail?: Pick<SidecarLoopFailure, "upstreamCode" | "nonReplayable">,
+  ) {
     super(message);
     this.name = "LoopError";
   }
 }
 
+function loopFailure(e: LoopError): SidecarLoopFailure {
+  return { status: e.status, message: e.message, ...(e.event ? { event: e.event } : {}), ...e.detail };
+}
+
 /**
  * Dependencies for one web-search loop iteration: parsed request, active adapter,
  * incoming metadata, and the configured search executor.
@@ -417,6 +429,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
     ? Math.floor(deps.stallTimeoutSec * 1000)
     : 300_000;
 
+  // Put recorded results back into replayed search pairs before the first iteration (#7269).
+  restoreSidecarSearchResults(parsed);
   const messages: OcxMessage[] = [...parsed.context.messages];
   const replaySnapshots = new Set<AnthropicReplaySnapshot>();
   const loopT0 = Date.now();
@@ -491,9 +505,11 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         // through the adapter formatter or the generic transport error, which could expose its
         // raw message. A parent/client cancellation still owns the request lifecycle as 499.
         if (signal.aborted) throw new LoopError(499, "client closed request during web-search");
-        throw new LoopError(prepared.response.status, `Provider error ${prepared.response.status}`);
+        throw new LoopError(prepared.response.status, `Provider error ${prepared.response.status}`, undefined,
+          { nonReplayable: isNonReplayableResponse(prepared.response) });
       }
       let formatted = "";
+      let upstreamCode: string | undefined;
       if (body.displaySafe && !body.truncated && body.text.trim() && prepared.responseAdapter.formatErrorBody) {
         try {
           formatted = prepared.responseAdapter.formatErrorBody(
@@ -503,8 +519,10 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           ).trim();
         } catch { /* formatter hooks are best-effort; unsafe raw text is never the fallback */ }
       }
+      if (body.displaySafe && !body.truncated) upstreamCode = upstreamErrorCode(body.text);
       const suffix = formatted ? `: ${formatted.slice(0, 400)}` : "";
-      throw new LoopError(prepared.response.status, `Provider error ${prepared.response.status}${suffix}`);
+      throw new LoopError(prepared.response.status, `Provider error ${prepared.response.status}${suffix}`, undefined,
+        { upstreamCode, nonReplayable: isNonReplayableResponse(prepared.response) });
     }
   };
 
@@ -736,7 +754,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         throw new LoopError(504, `Provider response-header timeout after ${connectTimeoutMs}ms during web-search`);
       }
       if (signal.aborted) throw new LoopError(499, "client closed request during web-search");
-      if (error instanceof LoopError) throw error;
+      if (error instanceof LoopError || error instanceof RequestPacingQueueOverloadError) throw error;
       throw new LoopError(502, `Provider unreachable: ${error instanceof Error ? error.message : String(error)}`);
     } finally {
       headerDeadline.clear();
@@ -834,7 +852,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       if (terminal.code === "translation_buffer_limit") {
         throw new TranslatorBudgetExceededError("retained_collectors", TRANSLATOR_MAX_TURN_BYTES);
       }
-      throw new LoopError(502, terminal.message);
+      // Keep an adapter's own overflow verdict; every other terminal stays a generic 502.
+      throw new LoopError(502, terminal.message, terminal.code === "context_length_exceeded" ? terminal : undefined);
     }
     deps.thinkingRecovery?.observeIteration(events);
     return { ...scanEventsForWebSearch(events), streamedPassthroughCount, events, anthropicReplay };
@@ -849,6 +868,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
   async function* runSearchCall(call: WebSearchCall, precedingThinking: OcxThinkingContent[] = [], appendAssistant = true): AsyncGenerator<AdapterEvent> {
     const results: { query: string; outcome: SidecarOutcome }[] = [];
     let beganCell = false;
+    const cellItemId = newSidecarSearchCellId();
     if (call.queries.length === 0) {
       // The model called web_search with neither query nor queries — count it against the budget
       // (loop-bounding) exactly as the old empty-query placeholder did, but emit no cell.
@@ -870,7 +890,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         // Real sidecar search. Open the cell once, before the first real query runs.
         if (!beganCell) {
           beganCell = true;
-          yield { type: "web_search_call_begin", id: call.id };
+          yield { type: "web_search_call_begin", id: call.id, itemId: cellItemId };
         }
         // F5: the anthropic sidecar authenticates with its own stored OAuth — it never touches the
         // ChatGPT forward headers and must NOT record a Codex/OpenAI pool outcome.
@@ -945,12 +965,15 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
     });
     // One aggregated tool result. isError only when EVERY query failed (a partial success is usable).
     const allFailed = results.every(r => !!r.outcome.error);
+    const resultText = formatWebSearchResults(results, !!parsed._structuredOutput);
     messages.push({
       role: "toolResult", toolCallId: call.id, toolName: WEB_SEARCH_TOOL_NAME,
-      content: formatWebSearchResults(results, !!parsed._structuredOutput),
+      content: resultText,
       isError: allFailed, timestamp: now,
     });
     if (beganCell) {
+      // The client sees only the cell; keep the result so its replay can carry it (#7269).
+      rememberSidecarSearch(parsed, cellItemId, { id: call.id, arguments: callArgs }, resultText);
       // The cell is "completed" if any query produced a usable result, else "failed". `queries`
       // carries every attempted query so Codex renders the native plural label.
       const anySuccess = results.some(r => !r.outcome.error);
@@ -966,7 +989,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         }
       }
       yield {
-        type: "web_search_call_end", id: call.id,
+        type: "web_search_call_end", id: call.id, itemId: cellItemId,
         queries: call.queries,
         status: anySuccess ? "completed" : "failed",
         ...(sources.length > 0 ? { sources } : {}),
@@ -982,7 +1005,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
     firstPrepared = await prepareIterationDrained(false);
   } catch (e) {
     if (abortSignal) abortSignal.removeEventListener("abort", linkAbort);
-    if (e instanceof LoopError) return jsonError(e.status, e.message, e.event);
+    if (e instanceof LoopError) return markSidecarContextOverflow(jsonError(e.status, e.message, e.event), loopFailure(e));
     if (e instanceof SendBudgetExhaustedError) return jsonError(429, e.message,
       { type: "error", message: e.message, errorType: "rate_limit_error", code: e.code, retryable: false });
     throw e;
@@ -1137,10 +1160,13 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           } else {
             if (e instanceof SendBudgetExhaustedError) yield { type: "error", status: 429,
               errorType: "rate_limit_error", code: e.code, message: e.message, retryable: false };
-            else yield e instanceof LoopError && e.event ? e.event
+            // A later iteration's overflow ends the turn as the main path's terminal
+            // context_length_exceeded, so Codex compacts instead of resending (#7316).
+            else yield (e instanceof LoopError ? sidecarLoopTerminalEvent(loopFailure(e)) : undefined)
+              ?? (e instanceof LoopError && e.event ? e.event
               : e instanceof LoopError && deps.thinkingRecovery
                 ? { type: "error", status: e.status, errorType: "upstream_error", message: e.message }
-                : { type: "error", message: e instanceof Error ? e.message : String(e) };
+                : { type: "error", message: e instanceof Error ? e.message : String(e) });
           }
           return;
         }

package/src/web-search/progress-stream.ts

@@ -308,9 +308,12 @@ export async function* parseStreamWithProgress(
         }
         if (event.type === "error") {
           if (event.usage) options.onErrorUsage?.(event.usage);
+          // An adapter's own overflow verdict keeps its typed event so the sidecar can end the
+          // turn as context_length_exceeded (#7316); other errors keep the plain-message shape.
+          const preserve = options.preserveAdapterError || event.code === "context_length_exceeded";
           fail(event.code === "translation_buffer_limit"
             ? new TranslatorBudgetExceededError("live_transient", TRANSLATOR_MAX_TURN_BYTES)
-            : options.preserveAdapterError ? new WebSearchAdapterEventError(event, replaySafe) : new Error(event.message));
+            : preserve ? new WebSearchAdapterEventError(event, replaySafe) : new Error(event.message));
           return;
         }
         replaySafe &&= event.type === "heartbeat" && event.replayUnsafe !== true;

package/src/web-search/run-turn-loop.ts

@@ -43,6 +43,7 @@ import {
   type TranslatorBudget,
 } from "../lib/translator-budget";
 import { jsonUtf8Bytes } from "../lib/json-byte-size";
+import { newSidecarSearchCellId, rememberSidecarSearch, restoreSidecarSearchResults } from "./sidecar-search-replay";
 
 export interface RunTurnWebSearchDeps {
   parsed: OcxParsedRequest;
@@ -77,6 +78,8 @@ export interface RunTurnWebSearchDeps {
  * active: same request plus the synthetic tool so the model can ask to search.
  */
 export function runTurnWebSearchInitialParsed(parsed: OcxParsedRequest): OcxParsedRequest {
+  // Runs before the first dispatch: put recorded results back into replayed search pairs (#7269).
+  restoreSidecarSearchResults(parsed);
   return {
     ...parsed,
     context: {
@@ -296,6 +299,7 @@ export async function* runTurnWebSearchLoop(
   ): AsyncGenerator<AdapterEvent> {
     const results: { query: string; outcome: SidecarOutcome }[] = [];
     let beganCell = false;
+    const cellItemId = newSidecarSearchCellId();
     if (call.queries.length === 0) {
       searchesExecuted++;
       results.push({ query: "", outcome: { text: "", sources: [], error: "the model called web_search with an empty query" } });
@@ -318,7 +322,7 @@ export async function* runTurnWebSearchLoop(
       } else {
         if (!beganCell) {
           beganCell = true;
-          yield { type: "web_search_call_begin", id: call.id };
+          yield { type: "web_search_call_begin", id: call.id, itemId: cellItemId };
         }
         if (abortSignal?.aborted) {
           yield { type: "web_search_call_end", id: call.id, queries: call.queries, status: "failed" };
@@ -358,12 +362,14 @@ export async function* runTurnWebSearchLoop(
       timestamp: now,
     });
     const allFailed = results.every(r => !!r.outcome.error);
+    const resultText = formatWebSearchResults(results, !!parsed._structuredOutput);
     appendMessage({
       role: "toolResult", toolCallId: call.id, toolName: WEB_SEARCH_TOOL_NAME,
-      content: formatWebSearchResults(results, !!parsed._structuredOutput),
+      content: resultText,
       isError: allFailed, timestamp: now,
     });
     if (beganCell) {
+      rememberSidecarSearch(parsed, cellItemId, { id: call.id, arguments: callArgs }, resultText);
       const anySuccess = results.some(r => !r.outcome.error);
       const sources: { url: string; title?: string }[] = [];
       const seenSrc = new Set<string>();
@@ -375,7 +381,7 @@ export async function* runTurnWebSearchLoop(
         }
       }
       yield {
-        type: "web_search_call_end", id: call.id,
+        type: "web_search_call_end", id: call.id, itemId: cellItemId,
         queries: call.queries,
         status: anySuccess ? "completed" : "failed",
         ...(sources.length > 0 ? { sources } : {}),

package/src/web-search/sidecar-search-replay.ts

@@ -0,0 +1,96 @@
+/**
+ * Replay memo for searches the web-search sidecar executed (#7269).
+ *
+ * The sidecar hands the model its search result inside the turn, but the caller only sees a hosted
+ * `web_search_call` cell without the result text. When the turn ends on a client tool call, the
+ * next request replays that cell, which the parser rebuilds as a `web_search` call/result pair
+ * with a fallback result (src/responses/web-search-replay.ts). This module records the real result
+ * under the cell id and puts it back into that pair, or removes the pairs when no sidecar runs:
+ * the synthetic `web_search` tool is then undeclared, and a call to it is an invalid history.
+ *
+ * Storage reuses the bounded, in-memory, never-logged store of the passthrough bridge
+ * (src/responses/bridge-search-replay-cache.ts) under a separate scope. Unlike a bridged
+ * destination call, the sidecar result does not belong to the serving model: the proxy ran it with
+ * its own backend. So the scope is the caller principal and conversation, which lets a model switch
+ * inside the same conversation keep the result, and fails closed without either.
+ */
+import type { OcxMessage, OcxParsedRequest, OcxReasoningReplayScopeRef } from "../types";
+import { peekBridgeSearchReplay, rememberBridgeSearchReplay } from "../responses/bridge-search-replay-cache";
+import { WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";
+
+export function sidecarSearchReplayScope(scope: OcxReasoningReplayScopeRef | undefined): string | undefined {
+  if (!scope?.clientPrincipalId || !scope.clientThreadId) return undefined;
+  return JSON.stringify(["web-search-sidecar", scope.clientPrincipalId, scope.clientThreadId]);
+}
+
+/** A fresh client-visible cell id the loop hands the bridge, so it can key the recorded result. */
+export function newSidecarSearchCellId(): string {
+  return `ws_${crypto.randomUUID().replace(/-/g, "")}`;
+}
+
+export function rememberSidecarSearch(
+  parsed: Pick<OcxParsedRequest, "_reasoningReplayScope">,
+  cellItemId: string,
+  call: { id: string; arguments: Record<string, unknown> },
+  output: string,
+): void {
+  rememberBridgeSearchReplay(sidecarSearchReplayScope(parsed._reasoningReplayScope), cellItemId, {
+    callId: call.id,
+    name: WEB_SEARCH_TOOL_NAME,
+    argumentsText: JSON.stringify(call.arguments),
+    output,
+  });
+}
+
+/**
+ * Swap the recorded result into every replayed search pair the parser rebuilt. A miss keeps the
+ * parser's fallback result; neither rerunning the search nor inventing a result is a recovery.
+ */
+export function restoreSidecarSearchResults(parsed: OcxParsedRequest): void {
+  const cells = parsed._replayedWebSearchCells;
+  if (!cells?.length) return;
+  const scope = sidecarSearchReplayScope(parsed._reasoningReplayScope);
+  for (const cell of cells) {
+    const entry = cell.cellId ? peekBridgeSearchReplay(scope, cell.cellId) : undefined;
+    for (const message of parsed.context.messages) {
+      if (message.role === "toolResult" && message.toolCallId === cell.callId && message.toolName === WEB_SEARCH_TOOL_NAME) {
+        if (entry) message.content = entry.output;
+        if (cell.failed) message.isError = true;
+      } else if (entry && message.role === "assistant") {
+        for (const part of message.content) {
+          if (part.type !== "toolCall" || part.id !== cell.callId || part.name !== WEB_SEARCH_TOOL_NAME) continue;
+          try {
+            const args: unknown = JSON.parse(entry.argumentsText);
+            if (args && typeof args === "object" && !Array.isArray(args)) part.arguments = args as Record<string, unknown>;
+          } catch { /* keep the replayed arguments */ }
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Remove the rebuilt pairs when no sidecar plan resolved, restoring the history the routed
+ * provider saw before #7269. An assistant turn left holding only reasoning goes too, as the parser
+ * dropped reasoning that led straight to a hosted cell.
+ */
+export function stripReplayedSearchPairs(parsed: OcxParsedRequest): void {
+  const cells = parsed._replayedWebSearchCells;
+  if (!cells?.length) return;
+  const ids = new Set(cells.map(cell => cell.callId));
+  const isPair = (part: { type: string; id?: string; name?: string }) =>
+    part.type === "toolCall" && part.name === WEB_SEARCH_TOOL_NAME && part.id !== undefined && ids.has(part.id);
+  const kept: OcxMessage[] = [];
+  for (const message of parsed.context.messages) {
+    if (message.role === "toolResult" && message.toolName === WEB_SEARCH_TOOL_NAME && ids.has(message.toolCallId)) continue;
+    if (message.role === "assistant" && message.content.some(isPair)) {
+      const content = message.content.filter(part => !isPair(part));
+      if (!content.some(part => part.type !== "thinking")) continue;
+      kept.push({ ...message, content });
+      continue;
+    }
+    kept.push(message);
+  }
+  parsed.context.messages = kept;
+  delete parsed._replayedWebSearchCells;
+}