@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/responses/reasoning-retention.ts

@@ -4,14 +4,21 @@
  * Provider ciphertext and signatures are never included in the portable retained items.
  */
 
+import { Database } from "bun:sqlite";
 import { expandRetainedCompactionInput } from "./retained-compaction";
-import { closeSync, mkdirSync, openSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, closeSync, lstatSync, mkdirSync, openSync, opendirSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { estimateTokens } from "../lib/token-estimate";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
 
 export const DEFAULT_REASONING_RETENTION_PERCENT = 20;
 export const DEFAULT_MAX_REASONING_TOKENS = 100_000;
+/** Compiled-in aggregate ceiling for the on-disk reasoning archive directory. */
+export const DEFAULT_ARCHIVE_MAX_BYTES = 512 * 1024 * 1024;
+export const DEFAULT_ARCHIVE_MAX_FILES = 256;
 
 export interface ReasoningRetentionOptions {
   /** Directory that receives archived reasoning files. */
@@ -24,6 +31,10 @@ export interface ReasoningRetentionOptions {
   maxTokens?: number;
   /** Clock injection for tests. */
   now?: number;
+  /** Aggregate archive byte ceiling. Defaults to 512 MiB; smaller values are a test seam. */
+  archiveMaxBytes?: number;
+  /** Aggregate archive file-count ceiling. Defaults to 256; smaller values are a test seam. */
+  archiveMaxFiles?: number;
 }
 
 export interface ReasoningArchive {
@@ -100,6 +111,183 @@ function retentionTokenCap(value: number | undefined): number {
     : DEFAULT_MAX_REASONING_TOKENS;
 }
 
+/** Aggregate-capacity refusal: the archive directory is at or over its compiled-in ceiling. */
+export class ReasoningArchiveQuotaError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveQuotaError";
+  }
+}
+
+/** The sibling archive lock is held by another cooperating writer. */
+export class ReasoningArchiveBusyError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveBusyError";
+  }
+}
+
+/** Unsafe or uninspectable archive state; the attempt is refused without touching anything. */
+export class ReasoningArchiveError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveError";
+  }
+}
+
+const ARCHIVE_SEPARATOR = "\n\n---\n\n";
+const ARCHIVE_SEPARATOR_BYTES = Buffer.byteLength(ARCHIVE_SEPARATOR, "utf8");
+const ARCHIVE_LOCK_SIDECARS = ["-journal", "-wal", "-shm"] as const;
+
+function archiveCap(value: number | undefined, fallback: number): number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+
+/** lstat that treats a vanished path as absent and refuses anything it cannot classify. */
+function archiveLstat(path: string): ReturnType<typeof lstatSync> | undefined {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw new ReasoningArchiveError(`reasoning archive path is not inspectable: ${path}`, { cause: error });
+  }
+}
+
+function assertRegularArchiveDirectory(archiveDir: string): void {
+  const entry = archiveLstat(archiveDir);
+  if (!entry?.isDirectory() || entry.isSymbolicLink()) {
+    throw new ReasoningArchiveError(`reasoning archive directory is not a regular directory: ${archiveDir}`);
+  }
+}
+
+function assertRegularArchiveLockPath(lockPath: string): void {
+  const entry = archiveLstat(lockPath);
+  if (entry !== undefined && (!entry.isFile() || entry.isSymbolicLink())) {
+    throw new ReasoningArchiveError(`reasoning archive lock path is not a regular file: ${lockPath}`);
+  }
+}
+
+/** Exact UTF-8 byte total of the would-be archive payload, computed before any joined string exists. */
+function archivePayloadBytes(texts: string[]): number {
+  let bytes = texts.length > 0 ? (texts.length - 1) * ARCHIVE_SEPARATOR_BYTES : 0;
+  for (const text of texts) {
+    const next = bytes + Buffer.byteLength(text, "utf8");
+    if (!Number.isSafeInteger(next)) {
+      throw new ReasoningArchiveError("reasoning archive payload byte size is not representable");
+    }
+    bytes = next;
+  }
+  return bytes;
+}
+
+interface ArchiveUsage {
+  files: number;
+  bytes: number;
+}
+
+/**
+ * Non-recursive accounting of every committed, remnant and foreign file. Anything that is not a
+ * plain regular file refuses closed; an entry vanishing mid-scan is already gone and skipped.
+ */
+function scanArchiveUsage(archiveDir: string, maxBytes: number, maxFiles: number): ArchiveUsage {
+  let directory: ReturnType<typeof opendirSync> | undefined;
+  let files = 0;
+  let bytes = 0;
+  let inspected = 0;
+  let failure: ReasoningArchiveError | undefined;
+  try {
+    // One entry per read: a legacy over-capacity directory must not first become an array
+    // or an unbounded read-ahead buffer on this synchronous request path.
+    directory = opendirSync(archiveDir, { bufferSize: 1 });
+    let entry;
+    while ((entry = directory.readSync()) !== null) {
+      inspected += 1;
+      if (!entry.isFile()) {
+        throw new ReasoningArchiveError(`reasoning archive entry is not a regular file: ${entry.name}`);
+      }
+      const stat = archiveLstat(join(archiveDir, entry.name));
+      if (stat === undefined) {
+        if (inspected >= maxFiles) throw new ReasoningArchiveError("reasoning archive scan changed beyond its inspection limit");
+        continue;
+      }
+      if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new ReasoningArchiveError(`reasoning archive entry is not a regular file: ${entry.name}`);
+      }
+      files += 1;
+      bytes += Number(stat.size);
+      if (files >= maxFiles || bytes > maxBytes) break; // refusal is already certain
+      if (inspected >= maxFiles) throw new ReasoningArchiveError("reasoning archive scan changed beyond its inspection limit");
+    }
+  } catch (error) {
+    failure = error instanceof ReasoningArchiveError ? error
+      : new ReasoningArchiveError("reasoning archive directory cannot be scanned", { cause: error });
+  } finally {
+    try { directory?.closeSync(); } catch (error) {
+      failure ??= new ReasoningArchiveError("reasoning archive directory could not be closed", { cause: error });
+    }
+  }
+  if (failure !== undefined) throw failure;
+  return { files, bytes };
+}
+
+function isSqliteBusy(error: unknown): boolean {
+  const code = error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : "";
+  const message = error instanceof Error ? error.message : "";
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
+}
+
+/**
+ * Serialize usage scan, exclusive create, write and close for one physical archive directory
+ * across cooperating processes. The sibling SQLite write transaction is the lock: the OS
+ * releases it on process exit, so no stale-owner reclamation is needed. busy_timeout=0 keeps
+ * the synchronous request path fail-fast instead of freezing the event loop.
+ */
+function withArchiveQuotaLockSync<T>(archiveDir: string, fn: () => T): T {
+  const normalized = archiveDir.replace(/[/\\]+$/, "");
+  const base = basename(normalized);
+  if (!base || base === "." || base === "..") {
+    throw new ReasoningArchiveError(`reasoning archive directory is not a usable path: ${archiveDir}`);
+  }
+  const parent = dirname(normalized);
+  assertNotRealHomeUnderTest(parent);
+  const lockPath = `${normalized}.lock`;
+  // The lock lives beside the archive inside the config home; foreign parents need no manifest entry.
+  if (parent === getConfigDir()) {
+    recordOwnedConfigPath(parent, lockPath);
+    for (const suffix of ARCHIVE_LOCK_SIDECARS) recordOwnedConfigPath(parent, `${lockPath}${suffix}`);
+  }
+  assertRegularArchiveLockPath(lockPath);
+  let database: Database;
+  try {
+    database = new Database(lockPath, { create: true });
+  } catch (error) {
+    throw new ReasoningArchiveError(`reasoning archive lock could not be opened: ${lockPath}`, { cause: error });
+  }
+  try {
+    try { chmodSync(lockPath, 0o600); } catch { /* platform may ignore chmod */ }
+    assertRegularArchiveLockPath(lockPath);
+    database.exec("PRAGMA locking_mode = NORMAL; PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+  } catch (error) {
+    try { database.close(); } catch { /* acquisition already failed */ }
+    if (error instanceof ReasoningArchiveError) throw error;
+    if (isSqliteBusy(error)) {
+      throw new ReasoningArchiveBusyError(
+        `reasoning archive lock is held by another writer: ${lockPath}`,
+        { cause: error },
+      );
+    }
+    throw new ReasoningArchiveError(`reasoning archive lock could not be acquired: ${lockPath}`, { cause: error });
+  }
+  try {
+    return fn();
+  } finally {
+    try { database.exec("ROLLBACK"); } catch { /* close below still releases the OS lock */ }
+    try { database.close(); } catch { /* the OS lock is released with the handle */ }
+  }
+}
+
 /** Separate reasoning locally before dispatch; unknown windows enforce the absolute cap. */
 export function applyReasoningRetention(
   input: unknown,
@@ -130,17 +318,36 @@ export function applyReasoningRetention(
       content: [{ type: "input_text", text }] })),
   };
 
-  mkdirSync(options.archiveDir, { recursive: true, mode: 0o700 });
+  const archiveBytes = archiveCap(options.archiveMaxBytes, DEFAULT_ARCHIVE_MAX_BYTES);
+  const archiveFiles = archiveCap(options.archiveMaxFiles, DEFAULT_ARCHIVE_MAX_FILES);
+  const incomingBytes = archivePayloadBytes(texts);
   const stamp = new Date(options.now ?? Date.now()).toISOString().replace(/[:.]/g, "-");
   const path = join(options.archiveDir, "reasoning-" + stamp + "-" + Math.random().toString(36).slice(2, 8) + ".md");
-  // Only a successful exclusive open grants ownership; an occupied path is never removed.
-  const fd = openSync(path, "wx", 0o600);
-  let failure: unknown;
-  try { writeFileSync(fd, texts.join("\n\n---\n\n"), "utf-8"); } catch (error) { failure = error; }
-  try { closeSync(fd); } catch (error) { failure ??= error; }
-  if (failure !== undefined) {
-    try { rmSync(path); } catch { /* preserve the original I/O error; cleanup is best-effort */ }
-    throw failure;
+  try {
+    mkdirSync(options.archiveDir, { recursive: true, mode: 0o700 });
+    assertRegularArchiveDirectory(options.archiveDir);
+    withArchiveQuotaLockSync(options.archiveDir, () => {
+      assertRegularArchiveDirectory(options.archiveDir);
+      const usage = scanArchiveUsage(options.archiveDir, archiveBytes, archiveFiles);
+      if (usage.files >= archiveFiles || incomingBytes > archiveBytes - usage.bytes) {
+        throw new ReasoningArchiveQuotaError(
+          `reasoning archive is at capacity: ${usage.files} file(s), ${usage.bytes} byte(s) under ${options.archiveDir}; delete older archives to archive more`,
+        );
+      }
+      // Only a successful exclusive open grants ownership; an occupied path is never removed.
+      const fd = openSync(path, "wx", 0o600);
+      let failure: unknown;
+      try { writeFileSync(fd, texts.join(ARCHIVE_SEPARATOR), "utf-8"); } catch (error) { failure = error; }
+      try { closeSync(fd); } catch (error) { failure ??= error; }
+      if (failure !== undefined) {
+        try { rmSync(path); } catch { /* preserve the original I/O error; cleanup is best-effort */ }
+        throw failure;
+      }
+    });
+  } catch (error) {
+    if (error instanceof ReasoningArchiveQuotaError || error instanceof ReasoningArchiveBusyError
+      || error instanceof ReasoningArchiveError) throw error;
+    throw new ReasoningArchiveError("reasoning archive could not be written", { cause: error });
   }
 
   const limitDescription = windowKnown

package/src/responses/schema.ts

@@ -27,10 +27,9 @@ const inputFileBlockSchema = z.object({
   file_data: z.string().optional(),
 });
 // codex-rs protocol/src/models.rs sends audio as input_audio with an audio_url, in
-// both user content and tool output. Accepting the block keeps a legitimate audio turn
-// out of the malformed-item catch-all. The translated IR records only its PRESENCE —
-// there is no audio carrier and no adapter-level refusal; a typed unsupported-modality
-// signal reaching final adapter dispatch remains a recorded residual.
+// both user content and tool output. The translated IR preserves supported inline
+// WAV/MP3 bytes and the Chat adapter sends them as input_audio; other wires and
+// unsupported formats are refused at the final translated-adapter boundary.
 const inputAudioBlockSchema = z.object({
   type: z.literal("input_audio"),
   audio_url: z.string().min(1),

package/src/responses/web-search-replay.ts

@@ -0,0 +1,147 @@
+/**
+ * Parse-time rebuild of replayed hosted `web_search_call` cells for routed providers (#7269).
+ *
+ * Codex replays the cell it was shown, which carries the query and at most a source list, never the
+ * result text. Dropping the cell made a routed model forget it had searched: after a client tool
+ * call ended the turn, the next request carried no trace of the search, so the model searched and
+ * ran its tools again in a loop.
+ *
+ * When search is declared, the parser rewrites each cell into the `web_search` function call and
+ * output the routed model made, at the raw-input level, so the ordinary call/output handling owns
+ * turn batching and reasoning attachment. The call takes the cell's place; its output is deferred to
+ * the end of the contiguous run of call/output items that follows, so a cell inside a parallel
+ * client batch never splits it. The output is a fallback built from the cell alone; the web-search
+ * sidecar swaps in the result it recorded for the cell, and removes the pairs again when it does not
+ * run, because the synthetic tool is then undeclared (src/web-search/sidecar-search-replay.ts).
+ */
+import { isObj } from "./parser-content";
+import { WEB_SEARCH_TOOL_NAME } from "../web-search/synthetic-tool";
+import type { OcxReplayedWebSearchCell } from "../types";
+
+const MAX_FIELD_CHARS = 2048;
+const MAX_LIST_ENTRIES = 20;
+const CELL_ID = /^[A-Za-z0-9_-]{1,128}$/;
+
+/** Call items of a batch; a call after the batch's first output starts the next assistant turn. */
+const CALL_TYPES = new Set(["function_call", "custom_tool_call", "local_shell_call", "tool_search_call"]);
+/** Output items of a batch. Anything that is neither a call nor an output ends the batch. */
+const OUTPUT_TYPES = new Set(["function_call_output", "custom_tool_call_output", "local_shell_call_output", "tool_search_output"]);
+
+function capped(value: string): string {
+  return value.length <= MAX_FIELD_CHARS ? value : `${value.slice(0, MAX_FIELD_CHARS)}…`;
+}
+
+function queriesOf(action: Record<string, unknown>): string[] {
+  const queries = Array.isArray(action.queries)
+    ? action.queries.filter((query): query is string => typeof query === "string" && query.trim() !== "")
+    : [];
+  if (queries.length === 0 && typeof action.query === "string" && action.query.trim() !== "") queries.push(action.query);
+  return queries.slice(0, MAX_LIST_ENTRIES).map(capped);
+}
+
+function sourcesOf(item: Record<string, unknown>, action: Record<string, unknown>): string[] {
+  const lines: string[] = [];
+  const seen = new Set<string>();
+  for (const list of [item.sources, action.sources]) {
+    if (!Array.isArray(list)) continue;
+    for (const source of list) {
+      if (lines.length >= MAX_LIST_ENTRIES) return lines;
+      if (!isObj(source) || typeof source.url !== "string" || seen.has(source.url)) continue;
+      seen.add(source.url);
+      lines.push(typeof source.title === "string" && source.title.trim() !== ""
+        ? `- ${capped(source.title)} <${capped(source.url)}>`
+        : `- <${capped(source.url)}>`);
+    }
+  }
+  return lines;
+}
+
+/** The call arguments and fallback result text for one replayed cell. */
+export function replayedWebSearchContent(item: Record<string, unknown>): { arguments: Record<string, unknown>; result: string; failed: boolean } {
+  const action = isObj(item.action) ? item.action : {};
+  const failed = item.status === "failed";
+  const queries = queriesOf(action);
+  const lines: string[] = [];
+  if (action.type === "open_page" && typeof action.url === "string") {
+    lines.push(`Earlier page open: <${capped(action.url)}>.`);
+  } else if (action.type === "find_in_page" && typeof action.url === "string") {
+    lines.push(`Earlier find in page <${capped(action.url)}>${typeof action.pattern === "string" ? ` for "${capped(action.pattern)}"` : ""}.`);
+  } else {
+    lines.push(queries.length > 0 ? `Earlier web search for: ${queries.map(query => `"${query}"`).join(", ")}.` : "Earlier web search.");
+  }
+  if (failed) {
+    lines.push("This search failed and returned no results.");
+  } else {
+    lines.push("The result text of this search is not available in the replayed conversation history.");
+    const sources = sourcesOf(item, action);
+    if (sources.length > 0) lines.push("Sources it returned (titles and URLs only, untrusted):", ...sources);
+  }
+  return { arguments: queries.length > 1 ? { queries } : { query: queries[0] ?? "" }, result: lines.join("\n"), failed };
+}
+
+export interface RewrittenWebSearchInput {
+  items: unknown[];
+  /** Original input index per rewritten item, for boundaries measured on the caller's input. */
+  sourceIndexes: number[];
+  cells: OcxReplayedWebSearchCell[];
+}
+
+/** Rewrite replayed cells into web_search call/output pairs; undefined when the input has none. */
+export function rewriteReplayedWebSearchCells(input: readonly unknown[]): RewrittenWebSearchInput | undefined {
+  if (!input.some(item => isObj(item) && item.type === "web_search_call")) return undefined;
+  // A synthetic call id must not collide with any client call id, nor with another cell's.
+  const taken = new Set(input.flatMap(item => isObj(item) && typeof item.call_id === "string" ? [item.call_id] : []));
+  // First suffix each base has not settled yet; taken stays the collision check on every candidate,
+  // so seeded ids and ids handed out under another base still block the smallest free suffix.
+  const nextSuffix = new Map<string, number>();
+  const allocate = (base: string): string => {
+    if (!taken.has(base)) {
+      taken.add(base);
+      return base;
+    }
+    let n = nextSuffix.get(base) ?? 1;
+    let id = `${base}_${n}`;
+    while (taken.has(id)) id = `${base}_${++n}`;
+    nextSuffix.set(base, n + 1);
+    taken.add(id);
+    return id;
+  };
+  const items: unknown[] = [];
+  const sourceIndexes: number[] = [];
+  const cells: OcxReplayedWebSearchCell[] = [];
+  const seenCells = new Set<string>();
+  let pending: Array<{ item: unknown; sourceIndex: number }> = [];
+  // True once the current batch reached its outputs: the next call opens a new assistant turn.
+  let outputPhase = false;
+  const flush = () => {
+    for (const entry of pending) { items.push(entry.item); sourceIndexes.push(entry.sourceIndex); }
+    pending = [];
+    outputPhase = false;
+  };
+  input.forEach((item, sourceIndex) => {
+    const type = isObj(item) ? item.type : undefined;
+    if (isObj(item) && type === "web_search_call") {
+      const cellId = typeof item.id === "string" && CELL_ID.test(item.id) ? item.id : undefined;
+      // The same cell replayed twice is one search.
+      if (cellId && seenCells.has(cellId)) return;
+      if (cellId) seenCells.add(cellId);
+      if (outputPhase) flush();
+      const content = replayedWebSearchContent(item);
+      const callId = allocate(cellId ?? "ws_replay");
+      cells.push({ ...(cellId ? { cellId } : {}), callId, failed: content.failed });
+      items.push({ type: "function_call", call_id: callId, name: WEB_SEARCH_TOOL_NAME, arguments: JSON.stringify(content.arguments) });
+      sourceIndexes.push(sourceIndex);
+      pending.push({ item: { type: "function_call_output", call_id: callId, output: content.result }, sourceIndex });
+      return;
+    }
+    if (typeof type === "string" && OUTPUT_TYPES.has(type)) {
+      outputPhase = true;
+    } else if (!(typeof type === "string" && CALL_TYPES.has(type)) || outputPhase) {
+      flush();
+    }
+    items.push(item);
+    sourceIndexes.push(sourceIndex);
+  });
+  flush();
+  return { items, sourceIndexes, cells };
+}

package/src/routing/compatibility/behavior.ts

@@ -4,6 +4,7 @@ import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { PROVIDER_REGISTRY } from "../../providers/registry";
 import { fastPolicyForModel, serviceTierSupportFromPolicy } from "../../providers/service-tier";
 import { resolveProviderAuthTransport } from "../../providers/fastwire";
+import { defaultAnthropicCacheRetention } from "../../adapters/anthropic/cache-retention";
 import { localFingerprint } from "../../lab/digest";
 import type { LabBehaviorSource, LabBehaviorValues } from "../../lab/live/types";
 
@@ -237,7 +238,9 @@ export function resolveProductionBehaviorValues(
     }),
     "tools.builtinNameEscaping": behaviorRow("provider_config", effective.escapeBuiltinToolNames === true),
     "cache.forwarding": behaviorRow("provider_config", effective.promptCacheKey === true),
-    "cache.retention": behaviorRow("global_config", config.cacheRetention ?? "short"),
+    // The wire TTL, not just the setting: an omitted value means 1h on first-party Anthropic.
+    "cache.retention": behaviorRow("global_config", config.cacheRetention
+      ?? (adapter === "anthropic" ? defaultAnthropicCacheRetention(effective) : "short")),
     "anthropic.eofPolicy": behaviorRow("provider_config", effective.anthropicEofTolerance === true ? "tolerant" : "strict"),
     "openai-chat.eofPolicy": behaviorRow("provider_config", effective.openaiChatEofTolerance === true ? "tolerant" : "strict"),
     "google.mode": behaviorRow("provider_config", effective.googleMode ?? null),

package/src/server/auth-cors.ts

@@ -40,6 +40,7 @@ import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import { anthropicOAuthInstanceConfigError } from "../config/schema/anthropic-account-pool";
+import { accountAutoPausePolicySchema } from "../config/schema/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
@@ -740,6 +741,9 @@ export function providerManagementConfigError(
     return "provider must be a plain object";
   }
   const raw = provider as Record<string, unknown>;
+  if (raw.accountAutoPause !== undefined && !accountAutoPausePolicySchema.safeParse(raw.accountAutoPause).success) {
+    return "accountAutoPause must be an object with optional boolean enabled and integer consecutiveFailures (1-100)";
+  }
   const contextTiersError = contextTierRecordConfigError(raw.modelContextTiers);
   if (contextTiersError) return contextTiersError;
   const capabilitiesError = modelCapabilitiesConfigError(raw.modelCapabilities);
@@ -796,6 +800,8 @@ export function providerManagementConfigError(
     // sends recover, not what the canonical forward seed is. Validated below
     // (retryOnResetPolicyConfigError).
     delete canonicalCandidate.retryOnReset;
+    // Validated account eligibility policy is independent of the canonical transport.
+    delete canonicalCandidate.accountAutoPause;
     // Context windows are the same kind of user-owned overlay as requestPacing: the operator
     // narrowing what their own native rows advertise. They can only ever LOWER the measured
     // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
@@ -1087,6 +1093,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   apiKeyPool: "redacted",
   // Ordering preference only; it names no key material, so an editor may read and set it.
   apiKeyPoolStrategy: "editor",
+  accountAutoPause: "editor",
   apiKeySelectionRevision: "runtime",
   _apiKeyAttempt: "runtime",
   defaultModel: "editor",

package/src/server/background-lifecycle.ts

@@ -1,5 +1,6 @@
 import type { OcxConfig, StorageCleanupPolicy } from "../types";
 import { registerCodexLowQuotaProtection, type LowQuotaRegistration } from "../codex/low-quota-protection";
+import { resolveLowQuotaDesktopSink } from "../codex/low-quota-desktop-notifier";
 import type { LowQuotaEvent } from "../codex/low-quota-events";
 import { startStateStoreSweeper } from "../lib/state-store-sweeper";
 import {
@@ -209,7 +210,7 @@ export function acquireServerBackgroundLifecycle(
     fanoutRevoked: false,
     applyPolicy,
     resources: acquireServerResourceOwner(),
-    lowQuota: registerCodexLowQuotaProtection(config),
+    lowQuota: registerCodexLowQuotaProtection(config, { desktopSink: () => resolveLowQuotaDesktopSink() }),
   };
   try {
     if (!processLoops) {

package/src/server/chat-native.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../oauth/account-auto-pause";
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
 import { observeAdvisorNativeReasoning } from "./inference/advisor-diagnostics";
@@ -30,7 +31,7 @@ import {
   applyUpstreamRecoveryInit,
   fetchWithResetRetry,
   fetchWithTransientRetry,
-  isNonReplayableResponse,
+  isNonReplayableResponse, isSameTargetRetryHold,
   isReplayRefusalCode,
   isReplayRefusalResponse,
   prepareSameTarget429Wait,
@@ -44,10 +45,7 @@ import {
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
   wrapWithZeroOutputRefetch,
 } from "../lib/upstream-retry";
-import {
-  isTranslatorBudgetExceededError,
-  type TranslatorBudget,
-} from "../lib/translator-budget";
+import { isTranslatorBudgetExceededError, type TranslatorBudget } from "../lib/translator-budget";
 import { authorizeResendForRecovery } from "../lib/request-resend-gate";
 import { ambiguousResendAllowanceFor, selfContainedChatBody } from "./responses/reset-replay";
 import {
@@ -64,11 +62,10 @@ import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import { stampApiKeyAccountLabel } from "../providers/label";
 import { distributedKeyPhysicalFetch, distributedKeyResponseOwner } from "../providers/api-key-response-ownership";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../providers/api-key-selection";
-import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate-limit";
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, physicalSendObserverInit, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { isLocalUpstream } from "../lib/local-upstream";
 import { linkAbortSignal } from "./responses";
 import {
@@ -88,6 +85,7 @@ import { workflowRefusalResponse } from "./workflow-refusal";
 import type { ComboProtocolSource } from "./responses/core-combo-native";
 import type { ProtocolEnvelope } from "../protocols/envelope";
 import { nativeChatReplayScope, bindNativeChatReplayScope, nativeChatReasoningCapture } from "./chat-native-reasoning";
+import { resolveMistralTransport } from "../providers/mistral-transport";
 
 export { isNativeChatRouteEligible, nativeChatDeclineReason } from "./chat-native-eligibility";
 
@@ -335,7 +333,8 @@ export async function runNativeChatAttempt(
     refusal.headers.set("Retry-After", String(error.retryAfterSeconds));
     return refusal;
   }
-  let activeProvider: OcxProviderConfig = route.provider;
+  // Key selection re-resolves the transport; a single-key route still needs canonical Mistral pacing.
+  let activeProvider: OcxProviderConfig = resolveMistralTransport(route.provider);
   stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
   const spendTracker = sendBudget ? undefined : attachRequestSpendTracker(req, logCtx);
   const physicalBudget = sendBudget ?? createInferenceSendBudget(req, logCtx);
@@ -365,6 +364,8 @@ export async function runNativeChatAttempt(
       config.fastMode,
       route.providerName,
       replayScope,
+      undefined,
+      translatorBudget,
     );
     observeAdvisorNativeReasoning(req.headers, logCtx, request.body);
     return request;
@@ -449,7 +450,7 @@ export async function runNativeChatAttempt(
   let responseOwnsDistributedKey = true;
   const send = async (
     request: AdapterRequest,
-    recovery?: "rate-limit-429" | "key-429" | "key-401" | UpstreamSendRecovery,
+    recovery?: "rate-limit-429" | "key-401" | "key-429" | UpstreamSendRecovery,
     singleShot = false,
   ): Promise<Response> => {
     try {
@@ -516,6 +517,7 @@ export async function runNativeChatAttempt(
               const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
                 poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
               }), execution.comboDispatchPermit);
+              const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, activeProvider, { config, oauth: undefined }, headers);
               let dispatched: Response;
               try {
                 // Capture this request's spend policy at its first physical boundary, including
@@ -538,6 +540,7 @@ export async function runNativeChatAttempt(
                   request.url,
                   applyUpstreamRecoveryInit({
                     ...init, method: request.method, headers, body: request.body,
+                    ...physicalSendObserverInit(observeAutoPause, request.url),
                   }, transportRecovery),
                   // Reselection can replace the provider transport and the wire shape, so the
                   // egress route is bound to the provider this send actually uses. Omitting it
@@ -552,7 +555,7 @@ export async function runNativeChatAttempt(
               responseOwnsDistributedKey = !activeProvider._apiKeyAttempt?.distributed
                 || distributedKeyResponseOwner(dispatched, config, route.providerName) !== null;
               if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-              return dispatched;
+              return observeAutoPause ? observeAutoPause(dispatched) : dispatched;
             },
           }),
         );
@@ -585,13 +588,30 @@ export async function runNativeChatAttempt(
     response = await send(activeRequest);
     const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
     let retries = 0;
+    let autoPauseMoves = 0;
+    for (;;) {
+      const priorResponse = response;
+      for (; wasAccountAutoPaused(response) && config.providers[route.providerName]?.apiKey && autoPauseMoves < 3 && transientSendAvailable(); autoPauseMoves++) {
+        const fresh = resolveCurrentProviderApiKeyTransport(config, route.providerName, { ...activeProvider, _apiKeyAttempt: undefined });
+        const next = fresh && (selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh);
+        if (!next) break;
+        try { void response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+        activeProvider = next;
+        stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
+        activeAdapter = createOpenAIChatAdapter(activeProvider);
+        releaseRetainedRequest();
+        activeRequest = buildActiveRequest();
+        retainRequest(activeRequest);
+        response = await send(activeRequest, "key-401");
+      }
+
     while (
       response.status === 429
       // A 429 this proxy synthesized for a refused reset replay is not a provider rate
       // limit: waiting and re-sending here is exactly the duplicate inference the refusal
       // exists to stop. It kept the same shape under the old 502 only because 502 never
       // matched this branch.
-      && !isNonReplayableResponse(response)
+      && !isNonReplayableResponse(response) && !isSameTargetRetryHold(response)
       && retryPolicy
       && retries < retryPolicy.attempts
       && transientSendAvailable()
@@ -632,6 +652,10 @@ export async function runNativeChatAttempt(
       retainRequest(activeRequest);
       response = await send(activeRequest, failureStatus === 401 ? "key-401" : "key-429");
     }
+      if (response !== priorResponse && wasAccountAutoPaused(response)) continue;
+      break;
+    }
+
   } catch (error) {
     releaseRetainedRequest();
     cleanupAbort();
@@ -694,20 +718,12 @@ export async function runNativeChatAttempt(
       && (isCyberPolicyCode(upstreamCode) || isCyberPolicyMessage(upstreamMessage))
       ? upstreamMessage
       : detail ? `Provider error ${response.status}: ${detail}` : `Provider error ${response.status}`;
-    // Zen's keyless free tier refuses the request outright rather than rate-limiting it, and
-    // the raw `MissingSessionID` tells a user nothing about why or what to do (#4121).
-    const clientMessage = enrichOpenCodeZenFreeTierMessage(message, {
-      providerName: route.providerName,
-      baseUrl: route.provider.baseUrl,
-      adapter: route.provider.adapter,
-      upstreamErrorType: upstreamType,
-    });
     const classified = classifyError(
       response.status,
       upstreamType ?? (response.status === 401 ? "authentication_error"
         : response.status === 429 ? "rate_limit_error"
           : response.status >= 500 ? "server_error" : "invalid_request_error"),
-      clientMessage,
+      message,
     );
     // The verdict is read once, from the response that carries it and from the code a
     // re-wrapped body kept -- never from the status, which a real rate limit shares.