@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/server/responses/combo-session-recall.ts

@@ -110,6 +110,31 @@ export function recallComboForLane(
   return entry.responseModel === model ? entry.comboId : undefined;
 }
 
+/**
+ * The concrete target that completed the lane's last turn for `comboId`, under the same
+ * freshness and ownership rules as `recallComboForLane`. A lane answered by another combo, or
+ * whose target left the combo or was disabled, recalls nothing.
+ */
+export function recallComboTargetForLane(
+  config: OcxConfig,
+  lane: string | undefined,
+  comboId: string,
+): Pick<OcxComboTarget, "provider" | "model"> | undefined {
+  if (!lane || !comboId) return undefined;
+  const entry = recall.get(lane);
+  if (!entry || entry.comboId !== comboId) return undefined;
+  const combo = getCombo(config, entry.comboId);
+  const provider = config.providers[entry.target.provider];
+  if (Date.now() - entry.at >= RECALL_TTL_MS
+    || !Object.hasOwn(config.providers, entry.target.provider)
+    || !provider || provider.disabled === true
+    || !combo?.targets.some(target => targetKey(target) === targetKey(entry.target))) {
+    deleteEntry(lane);
+    return undefined;
+  }
+  return { provider: entry.target.provider, model: entry.target.model };
+}
+
 /**
  * Periodic expiry. Without it a lane that is never read again and never touched by a config
  * reconciliation holds its entry for the life of the process: the existing TTL is only

package/src/server/responses/combo-stream-preflight.ts

@@ -115,12 +115,14 @@ function retryableZeroOutputTerminal(payload: unknown): boolean {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
   const event = payload as {
     type?: unknown;
-    response?: { incomplete_details?: { reason?: unknown } };
+    response?: { incomplete_details?: { reason?: unknown }; output?: unknown };
   };
   if (bareErrorIsRetryable(event)) return true;
   if (event.type === "response.failed") return true;
   if (event.type !== "response.incomplete") return false;
   const reason = event.response?.incomplete_details?.reason;
+  // A terminal-only upstream can carry output without preceding delta/item events.
+  if (reason === undefined) return !Array.isArray(event.response?.output) || event.response.output.length === 0;
   return typeof reason === "string" && RETRYABLE_ZERO_OUTPUT_INCOMPLETE_REASONS.has(reason);
 }
 
@@ -222,8 +224,13 @@ function failedTerminalResponse(
     : topLevelError && typeof topLevelError === "object" && !Array.isArray(topLevelError)
       ? topLevelError as Record<string, unknown>
     : {
-      type: "upstream_error",
-      code: "upstream_server_error",
+      // A caller-validated flat error can carry its identity beside type:error.
+      // Retain it when that caller established a 400, rather than discarding the
+      // rejection code before the single-shot opaque-state recovery sees it.
+      type: terminalPayload.type === "error" && logCtx.terminalHttpStatus === 400
+        ? "invalid_request_error" : "upstream_error",
+      code: terminalPayload.type === "error" && logCtx.terminalHttpStatus === 400
+        ? (typeof terminalPayload.code === "string" ? terminalPayload.code : null) : "upstream_server_error",
       message: typeof terminalPayload.message === "string"
         ? terminalPayload.message
         : logCtx.upstreamError ?? "Provider stream failed before producing output",

package/src/server/responses/combo-tool-loop-pin.ts

@@ -0,0 +1,70 @@
+/**
+ * Combo target pinning for an in-flight tool loop (#7298).
+ *
+ * A combo picks a target per request. A tool loop is several requests that together form one
+ * assistant turn: the model emits a call, the client runs it, and the next request carries the
+ * result back. Re-picking between those requests hands the second half of a turn to a model that
+ * did not produce the first half. That is wasteful at best (a cold prompt cache, a different
+ * plan) and a hard failure at worst: DeepSeek's thinking mode refuses a tool continuation whose
+ * call carries no reasoning it can read, and a GPT turn never leaves one.
+ *
+ * So a continuation whose input ends in a tool output keeps the target that completed the lane's
+ * previous turn, as long as that target is still selectable right now: enabled, still in the
+ * combo, out of cooldown and passing every per-request eligibility filter the caller supplies.
+ * When it is not, normal selection (and normal failover) runs, and the strict serializers make
+ * the foreign history acceptable instead: see `backfillBareToolCallTurnReasoning` and the Chat
+ * adapter's reasoning placeholder.
+ *
+ * A new user message is never pinned; re-deciding per user turn is what a combo is for.
+ */
+import { pickComboTarget, targetKey, type ComboPick } from "../../combos";
+import type { NormalizedComboTarget } from "../../combos/types";
+import type { OcxConfig } from "../../types";
+import { recallComboTargetForLane } from "./combo-session-recall";
+
+export const COMBO_TOOL_LOOP_PIN_REASON = "combo-tool-loop-pin";
+
+function isToolOutputItem(item: unknown): boolean {
+  if (!item || typeof item !== "object" || Array.isArray(item)) return false;
+  const type = (item as { type?: unknown }).type;
+  return typeof type === "string" && type.endsWith("_output");
+}
+
+/**
+ * Whether this request resumes an assistant turn by returning tool results: its Responses
+ * `input` (or Chat `messages`) ends with a tool output.
+ */
+export function isToolLoopContinuation(body: unknown): boolean {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  const { input, messages } = body as { input?: unknown; messages?: unknown };
+  if (Array.isArray(input)) return input.length > 0 && isToolOutputItem(input[input.length - 1]);
+  if (Array.isArray(messages) && messages.length > 0) {
+    const last = messages[messages.length - 1];
+    return !!last && typeof last === "object" && (last as { role?: unknown }).role === "tool";
+  }
+  return false;
+}
+
+/**
+ * The pick that keeps a tool loop on its previous target, or undefined to select normally.
+ * Uses a non-mutating preview so a pinned request never disturbs round-robin rotation state.
+ */
+export function toolLoopPinnedPick(args: {
+  config: OcxConfig;
+  comboId: string;
+  lane: string | undefined;
+  body: unknown;
+  eligible: (target: NormalizedComboTarget) => boolean;
+  now?: number;
+}): ComboPick | undefined {
+  if (!isToolLoopContinuation(args.body)) return undefined;
+  const previous = recallComboTargetForLane(args.config, args.lane, args.comboId);
+  if (!previous) return undefined;
+  const previousKey = targetKey(previous);
+  const pick = pickComboTarget(args.config, args.comboId, {
+    eligible: target => targetKey(target) === previousKey && args.eligible(target),
+    now: args.now,
+    preview: true,
+  });
+  return pick ? { ...pick, attempted: [previousKey] } : undefined;
+}

package/src/server/responses/compact.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { createPhysicalSendReporter, rebindPhysicalSend } from "../../lib/request-execution-budget";
 import { createInferenceSendBudget } from "../inference/context";
@@ -87,6 +88,7 @@ import {
   recordCodexUpstreamOutcome,
   type CodexUpstreamOutcome,
 } from "../../codex/routing";
+import { codexFailureWindowOutcomeMeta } from "../../codex/routing/failure-window";
 import {
   applyAccountChangeConversationStateScrub,
   conversationStateBindingFromAuth,
@@ -1058,8 +1060,10 @@ export async function handleResponsesCompact(
     ) => {
       // A gateway response is not evidence about any Codex account.
       if (gatewayTransport || !usesCodexForwardPoolAuth(ctx, route.provider)) return;
+      if ((outcome === 401 || outcome === 403) && upstream && wasPermanentAccountRefusal(upstream)) return;
       recordCodexUpstreamOutcome(config, ctx.accountId, outcome, {
         ...meta,
+        ...codexFailureWindowOutcomeMeta(ctx),
         threadId: ctx.kind === "pool" || ctx.kind === "main-pool" ? ctx.affinityKey : undefined,
         fixedAccount: ctx.fixedAccount,
         modelId: selectedModelId,
@@ -1166,6 +1170,7 @@ export async function handleResponsesCompact(
         providerFetch(sendProvider, undefined, {
           providerName: route.providerName,
           modelId: route.modelId,
+          accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: sendAuthCtx }, headers),
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
             ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
           dispatchOverride: sendProvider.authMode !== "forward" && sendProvider.apiKey
@@ -1287,7 +1292,7 @@ export async function handleResponsesCompact(
 
     recordDistributedResponseFailure(upstream, config, route.providerName, req.signal);
     if (
-      upstream.status === 401
+      upstream.status === 401 && !wasPermanentAccountRefusal(upstream)
       && (authCtx.kind === "main-pool" || authCtx.kind === "pool")
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, compactProvider)
@@ -1411,12 +1416,12 @@ export async function handleResponsesCompact(
     // surfaces to the client, which retries the compact task OUTSIDE the logical request
     // — reporting exhausted retries while another pool account sat idle (#913).
     if (
-      (upstream.status === 429 || upstream.status === 402)
+      (upstream.status === 429 || upstream.status === 402 || wasAccountAutoPaused(upstream))
       // A replay refusal this proxy synthesized carries 429 for the client's benefit only.
       // It is not pool quota evidence, and the alternate account below is another send of a
       // compact turn that may already have been processed.
       && !isNonReplayableResponse(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
@@ -1521,7 +1526,7 @@ export async function handleResponsesCompact(
     // the same guards as the quota move, and a 5xx whose body confirms quota keeps today's path.
     if (
       shouldRetryCodexPoolAccountTransient(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
@@ -1642,7 +1647,7 @@ export async function handleResponsesCompact(
       inspectResponseLogJson(logCtx, compactText);
       if (!options.compactionRoutingOverride) forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
-    } else if (!options.compactionRoutingOverride && quotaFailure && !storedPool401ReplayAttempted) {
+    } else if (!options.compactionRoutingOverride && quotaFailure && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))) {
       const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {

package/src/server/responses/context-overflow.ts

@@ -1,5 +1,8 @@
 import { bridgeToResponsesSSE, formatErrorResponse } from "../../bridge";
 import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
+import { isThroughputLimitText } from "../../claude/outbound";
+import { isDefiniteContextOverflow } from "../../combos/failover";
+import { classifyError } from "../../lib/errors";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import type { AdapterEvent } from "../../types";
 
@@ -32,8 +35,11 @@ export function jsonContextOverflowResponse(message = PROVIDER_INPUT_TOO_LARGE_M
   }, { status: 413, headers: { "Cache-Control": "no-store" } });
 }
 
-async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEvent> {
-  yield {
+/** The terminal error event every context overflow is reported as, streaming or in-stream. */
+export function contextOverflowEvent(
+  message = PROVIDER_INPUT_TOO_LARGE_MESSAGE,
+): Extract<AdapterEvent, { type: "error" }> {
+  return {
     type: "error",
     message,
     status: 413,
@@ -43,6 +49,139 @@ async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEv
   };
 }
 
+async function* contextOverflowEvents(message: string): AsyncGenerator<AdapterEvent> {
+  yield contextOverflowEvent(message);
+}
+
+/**
+ * Whether a web-search or image-bridge failure is the provider refusing an oversized input.
+ *
+ * An HTTP 413 is classified by status alone, exactly as the main path does. A 400/422 needs a
+ * definite overflow phrase in the provider message (the rule combo failover already trusts), so a
+ * plain bad request stays what it was, and rate-window wording ("too many tokens per minute")
+ * never reads as an overflow: compacting does not fix a throughput limit. An adapter that already
+ * classified its own failure as `context_length_exceeded` keeps that verdict whatever status it
+ * rode on. The local translator limit is excluded: compacting cannot shrink a buffer this proxy owns.
+ */
+export function isSidecarContextOverflow(
+  status: number | undefined,
+  message: string,
+  code?: string | null,
+): boolean {
+  if (code === "translation_buffer_limit" || code === "rate_limit_exceeded") return false;
+  if (code === "context_length_exceeded") return true;
+  if (status === 413) return true;
+  return (status === 400 || status === 422) && !isThroughputLimitText(message)
+    && isDefiniteContextOverflow(status, message);
+}
+
+/**
+ * The in-stream terminal for a sidecar overflow. A bare 413 carries no provider wording worth
+ * keeping and gets the proxy-owned message. A worded verdict keeps its own status and message:
+ * that is the evidence combo failover reads to try a larger-context target, and replacing it
+ * would end the chain at the first target that was merely too small.
+ */
+export function sidecarContextOverflowEvent(
+  status: number | undefined,
+  message: string,
+): Extract<AdapterEvent, { type: "error" }> {
+  return status === undefined || !message || (status === 413 && !isDefiniteContextOverflow(413, message))
+    ? contextOverflowEvent()
+    : { ...contextOverflowEvent(message), status };
+}
+
+/** One sidecar loop failure, with what the loop knew when it raised it. */
+export interface SidecarLoopFailure {
+  status: number;
+  message: string;
+  event?: Extract<AdapterEvent, { type: "error" }>;
+  /** The provider's own `error.code`, read from a bounded display-safe body. */
+  upstreamCode?: string;
+  /** The failed response was marked non-replayable: the provider may already have run the turn. */
+  nonReplayable?: boolean;
+}
+
+/**
+ * The overflow terminal a sidecar loop failure should end with, or `undefined` to keep the
+ * failure as it is. A non-replayable failure keeps its verdict: an overflow would invite a
+ * compacted resend of a turn the provider may already have run. An adapter event marked
+ * `retryable: false` under any other code is that adapter's own verdict and is not reread.
+ */
+export function sidecarLoopOverflowEvent(
+  failure: SidecarLoopFailure,
+): Extract<AdapterEvent, { type: "error" }> | undefined {
+  if (failure.nonReplayable) return undefined;
+  const code = failure.event?.code ?? failure.upstreamCode;
+  if (failure.event?.retryable === false && code !== "context_length_exceeded") return undefined;
+  if (!isSidecarContextOverflow(failure.status, failure.message, code)) return undefined;
+  return sidecarContextOverflowEvent(failure.event?.status ?? failure.status, failure.message);
+}
+
+/**
+ * The in-stream terminal for a sidecar loop failure that carries no adapter event, or
+ * `undefined` to keep the loop's existing generic event. An overflow ends as the overflow
+ * terminal. A failure this classifier deliberately kept (non-replayable, or an upstream
+ * `rate_limit_exceeded`) gets an explicit code whenever the bridge's wording heuristics would
+ * otherwise rename it `context_length_exceeded` and undo that verdict on the wire.
+ */
+export function sidecarLoopTerminalEvent(
+  failure: SidecarLoopFailure,
+): Extract<AdapterEvent, { type: "error" }> | undefined {
+  const overflow = sidecarLoopOverflowEvent(failure);
+  if (overflow || failure.event) return overflow;
+  if (classifyError(failure.status, "upstream_error", failure.message).code !== "context_length_exceeded") return undefined;
+  const rateLimited = failure.upstreamCode === "rate_limit_exceeded";
+  return {
+    type: "error",
+    status: failure.status,
+    message: failure.message,
+    errorType: rateLimited ? "rate_limit_error" : "upstream_error",
+    code: failure.upstreamCode ?? "upstream_error",
+    ...(failure.nonReplayable ? { retryable: false } : {}),
+  };
+}
+
+/** Read a provider's `error.code` from an already bounded, display-safe error body. */
+export function upstreamErrorCode(text: string): string | undefined {
+  try {
+    const code = (JSON.parse(text) as { error?: { code?: unknown } } | null)?.error?.code;
+    return typeof code === "string" && code.length <= 128 ? code : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const sidecarOverflowResponses = new WeakSet<Response>();
+
+/** Tag a loop's first-iteration JSON failure that the sidecar boundary should map to an overflow. */
+export function markSidecarContextOverflow(response: Response, failure: SidecarLoopFailure): Response {
+  if (sidecarLoopOverflowEvent(failure)) sidecarOverflowResponses.add(response);
+  return response;
+}
+
+/**
+ * Map a sidecar loop's pre-stream HTTP failure onto the main path's overflow contract (#7316).
+ *
+ * Both loops answer a failed first iteration with their own small JSON error, so the overflow
+ * would otherwise reach Codex as a bare non-2xx that it resends unchanged through its retry
+ * budget. The loop classified the failure while it still had the provider's status, wording,
+ * code and replay verdict, and tagged the response; anything untagged is returned untouched.
+ * Combo attempts do not come through here: the combo layer reads the raw failure for its hop
+ * decision and maps a final 413 itself. A failure answered with `x-should-retry: false` keeps
+ * its status and header, so that contract never turns into an invitation to resend.
+ */
+export function sidecarContextOverflowResponse(
+  response: Response,
+  options: { stream: boolean; modelId: string; translatorBudget: TranslatorBudget },
+): Response {
+  if (response.ok || !sidecarOverflowResponses.has(response)) return response;
+  if (response.headers.get("x-should-retry") === "false") return response;
+  void response.body?.cancel().catch(() => {});
+  return options.stream
+    ? streamingContextOverflowResponse(options.modelId, options.translatorBudget)
+    : jsonContextOverflowResponse();
+}
+
 /**
  * Convert a pre-stream provider 413 into the terminal Responses event Codex understands.
  *

package/src/server/responses/core-auth.ts

@@ -2,6 +2,7 @@ import type { OcxProviderConfig, OcxConfig } from "../../types";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import type { RouteResult } from "../../router";
+import { routeConcreteModel } from "../../router";
 import type { HandleResponsesOptions } from "./core-options";
 import {
   hasForwardableCodexBearer,
@@ -24,6 +25,7 @@ import {
   CodexAuthContextError,
   applyCodexAuthContextToProvider,
   stripCodexRuntimeProviderFields,
+  mainAccountHardLockCallerProof,
 } from "../../codex/auth-context";
 import { codexAccountSelectionForTurn, tryClaimNativeMainProfileForTurn } from "../lifecycle";
 import { isNativeMainTrafficBlocked } from "../../codex/native-profile-startup";
@@ -590,3 +592,21 @@ export async function refreshNativeMainForwardAuth(args: {
     }) ?? nativeMainRefreshFailureResponse(error) };
   }
 }
+
+/** Inspect the original credential domain, before fallback changes the route or drops headers. */
+export function mainHardLockFallbackCallerCheck(
+  req: Request, config: OcxConfig, options: HandleResponsesOptions,
+): (sourceModel: string) => Promise<(() => boolean) | null> {
+  return async sourceModel => {
+    let sourceRoute: ReturnType<typeof routeConcreteModel>;
+    try { sourceRoute = routeConcreteModel(config, sourceModel); }
+    // This preview cannot replace the normal routing phase's existing error response.
+    catch { return null; }
+    const headers = codexRouteCredentialDomainHeaders(req, sourceRoute, options, false, config);
+    const { substituteMainCredential } = codexRouteCredentialOwnership(headers, config, sourceRoute, options);
+    return mainAccountHardLockCallerProof(headers, options.codexAuthPolicy ?? config, {
+      substituteMainCredentialForDirect: substituteMainCredential,
+      signal: options.abortSignal ?? req.signal,
+    });
+  };
+}

package/src/server/responses/core-codex-account.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig, OcxParsedRequest } from "../../types";
 import type { CodexAuthContext, CodexAuthPolicyConfig } from "../../codex/auth-context";
 import type { CodexUpstreamOutcome } from "../../codex/routing";
@@ -10,6 +11,7 @@ import { claimMainQuotaDispatchForWs, isMainQuotaDispatchLive, renewMainQuotaDis
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { isCodexAccountGenerationLive } from "../../codex/account-store";
+import { codexFailureWindowOutcomeMeta } from "../../codex/routing/failure-window";
 import { applyAccountQuotaFromUpstreamHeaders as applyCapturedCodexQuota } from "../../codex/quota";
 import type { RouteResult } from "../../router";
 import {
@@ -92,20 +94,19 @@ export function sidecarOutcomeRecorder(
   config: OcxConfig,
   authCtx: CodexAuthContext,
 ): ((outcome: CodexUpstreamOutcome) => void) | undefined {
-  return authCtx.kind === "pool" || authCtx.kind === "main-pool"
-    ? outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
-      threadId: authCtx.affinityKey,
-      fixedAccount: authCtx.fixedAccount,
-      probeLeaseId: authCtx.probeLeaseId,
-      probeQuotaScope: authCtx.probeQuotaScope,
-      writerGeneration: authCtx.writerGeneration,
-      // A vision or web-search sidecar can return 401/403, and that is evidence about the exact
-      // stored credential it used. Without the generation it becomes an account-wide quarantine
-      // that a replacement inherits (#2892 gap 4). `main-pool` has no stored-record generation, so
-      // it keeps the unfenced account-wide semantics.
-      ...(authCtx.kind === "pool" ? { credentialGeneration: authCtx.generation } : {}),
-    })
-    : undefined;
+  if (authCtx.kind !== "pool" && authCtx.kind !== "main-pool") return undefined;
+  const windowMeta = codexFailureWindowOutcomeMeta(authCtx);
+  return outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+    ...windowMeta,
+    threadId: authCtx.affinityKey,
+    fixedAccount: authCtx.fixedAccount,
+    probeLeaseId: authCtx.probeLeaseId,
+    probeQuotaScope: authCtx.probeQuotaScope,
+    writerGeneration: authCtx.writerGeneration,
+    // Quarantine retains its stored-credential fence. main-pool has no stored-record
+    // generation; its separate dispatch proof above fences only failure-window samples.
+    ...(authCtx.kind === "pool" ? { credentialGeneration: authCtx.generation } : {}),
+  });
 }
 
 
@@ -144,9 +145,10 @@ export function recordCodexPreOutputRefusalOutcome(
   modelId: string,
 ): void {
   if (!isCodexWsPreOutputRefusal(response) || codexWsPreOutputRefusalOutcomeRecorded(response)) return;
-  if (!usesCodexForwardPoolAuth(authCtx, provider)) return;
+  if (!usesCodexForwardPoolAuth(authCtx, provider) || wasPermanentAccountRefusal(response)) return;
   noteCodexWsPreOutputRefusalOutcome(response);
   recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
+    ...codexFailureWindowOutcomeMeta(authCtx),
     threadId: authCtx.affinityKey,
     fixedAccount: authCtx.fixedAccount,
     modelId,
@@ -675,6 +677,7 @@ export async function retryCodexPoolOnAlternateAccount(
     if (codexWsPreOutputRefusalOutcomeRecorded(firstResponse)) return;
     noteCodexWsPreOutputRefusalOutcome(firstResponse);
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
+      ...codexFailureWindowOutcomeMeta(firstAuthCtx),
       threadId: firstAuthCtx.affinityKey,
       fixedAccount: firstAuthCtx.fixedAccount,
       modelId: route.modelId,
@@ -692,6 +695,7 @@ export async function retryCodexPoolOnAlternateAccount(
     if (outcomeStatus === firstResponse.status || (outcomeStatus !== 429 && outcomeStatus !== 402)) return;
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...codexQuotaOutcomeMeta(firstResponse),
+      ...codexFailureWindowOutcomeMeta(firstAuthCtx),
       threadId: firstAuthCtx.affinityKey,
       modelId: route.modelId,
       probeLeaseId: codexProbeLeaseId(firstAuthCtx),
@@ -855,8 +859,13 @@ export async function retryCodexPoolOnAlternateAccount(
     options.deferCodexResetDerivedCooldown,
   );
   const recordFirstOutcome = (): void => {
+    if (wasPermanentAccountRefusal(firstResponse)) {
+      noteCodexWsPreOutputRefusalOutcome(firstResponse);
+      return;
+    }
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
+      ...codexFailureWindowOutcomeMeta(firstAuthCtx),
       threadId: firstAuthCtx.affinityKey,
       modelId: route.modelId,
       probeLeaseId: codexProbeLeaseId(firstAuthCtx),
@@ -1032,6 +1041,7 @@ export async function retryCodexPoolOnAlternateAccount(
             providerName: route.providerName,
             modelId: route.modelId,
             preOutputRefusalHold: args.preOutputRefusalHold,
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: retryAuthCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1143,6 +1153,7 @@ export function codexForwardTerminalOutcomeRecorder(
   logCtx?: RequestLogContext,
 ): ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined {
   if (!usesCodexForwardPoolAuth(authCtx, provider)) return undefined;
+  const windowMeta = codexFailureWindowOutcomeMeta(authCtx);
   return (status, httpStatusOverride) => {
     const quotaStatus = [httpStatusOverride, logCtx?.terminalHttpStatus]
       .find(value => value === 429 || value === 402);
@@ -1151,6 +1162,7 @@ export function codexForwardTerminalOutcomeRecorder(
       // request. Don't penalize account health; record success to clear any
       // prior soft-avoid so a healthy account isn't stuck avoided.
       recordCodexUpstreamOutcome(config, authCtx.accountId, 200, {
+        ...windowMeta,
         threadId: authCtx.affinityKey,
         fixedAccount: authCtx.fixedAccount,
         modelId,
@@ -1174,6 +1186,7 @@ export function codexForwardTerminalOutcomeRecorder(
       ? 200
       : (quotaStatus ?? httpStatusOverride ?? logCtx?.terminalHttpStatus ?? 502);
     recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+      ...windowMeta,
       threadId: authCtx.affinityKey,
       fixedAccount: authCtx.fixedAccount,
       modelId,

package/src/server/responses/core-combo.ts

@@ -45,6 +45,7 @@ import {
 } from "../../combos";
 import { formatErrorResponse } from "../../bridge";
 import { SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
+import { redactSecretString, sanitizeLogMetadataString } from "../../lib/redact";
 import {
   expandPreviousResponseInput,
   previousResponseReplayFailure,
@@ -98,6 +99,7 @@ import type { CodexAuthContext } from "../../codex/auth-context";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import { beginRequestAttempt, sealRequestAttemptIdentity, finishRequestAttempt } from "../request-log";
 import { rememberComboForLane } from "./combo-session-recall";
+import { COMBO_TOOL_LOOP_PIN_REASON, toolLoopPinnedPick } from "./combo-tool-loop-pin";
 import { runTurnAdapterSseResponses } from "./core-lifetime";
 import { normalizePersistedJevDecision } from "../../usage/jev-stats";
 import {
@@ -589,7 +591,19 @@ export async function executeComboResponses(
     waitForCooldownMs: combo.waitForCooldownMs,
     abortSignal: options.abortSignal,
   });
-  let pick = await pickWithWait({
+  // An in-flight tool loop stays on the target that issued its calls while that target is still
+  // selectable (#7298). Override routes never record a lane target, so they never pin either.
+  const toolLoopPin = options.compactionRoutingOverride || options.mainHardLockFallbackOverride
+    ? undefined
+    : toolLoopPinnedPick({
+      config,
+      comboId,
+      lane: sessionLaneIdFromRequest(req.headers),
+      body,
+      eligible: target => (meteredAllowed || !target.metered) && targetEligible(target),
+      now: initialNow,
+    });
+  let pick = toolLoopPin ?? await pickWithWait({
     eligible: targetEligible,
     now: initialNow,
   });
@@ -625,7 +639,7 @@ export async function executeComboResponses(
       : comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, targetEligible));
   }
   let jevDecision: JevDecision | undefined;
-  if (combo.strategy === "jev") {
+  if (combo.strategy === "jev" && !toolLoopPin) {
     const choices = eligibleJevComboChoices(config, comboId, targetEligible, Date.now());
     const first = choices[0];
     if (!first) {
@@ -653,6 +667,7 @@ export async function executeComboResponses(
         isDestinationAllowed: (providerName, modelId) => routeAllowedByScope(
           resolveAdmissionModelScope(config, options.admission), { providerName, modelId },
         ),
+        ...(combo.decisionQuotaSignals === true ? { decisionQuotaSignals: true, decisionQuotaTiers: combo.decisionQuotaTiers } : {}),
         ...(combo.decisionProvider ? { decisionProvider: combo.decisionProvider } : {}),
         ...(combo.decisionModel
           ? {
@@ -696,6 +711,7 @@ export async function executeComboResponses(
         ? { chosenProbability: decision.chosenProbability }
         : {}),
       ...(decision.usage ? { usage: decision.usage } : {}),
+      ...(decision.quota ? { quota: decision.quota } : {}),
     });
     console.debug("[combo] JEV decision", {
       backend: decision.backend,
@@ -713,8 +729,11 @@ export async function executeComboResponses(
   // One immutable combo selection trace, before any child dispatch; child
   // adoption below must never replace it with a concrete child route trace.
   const decision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
-  logCtx.routeDecision = options.memoryModelPhase
-    ? { ...decision, selected: { ...decision.selected, reason: memoryModelRouteReason(options.memoryModelPhase) } }
+  const selectedReason = options.memoryModelPhase
+    ? memoryModelRouteReason(options.memoryModelPhase)
+    : toolLoopPin ? COMBO_TOOL_LOOP_PIN_REASON : undefined;
+  logCtx.routeDecision = selectedReason
+    ? { ...decision, selected: { ...decision.selected, reason: selectedReason } }
     : decision;
 
   const originalReasoning = body && typeof body === "object" && !Array.isArray(body)
@@ -1146,6 +1165,9 @@ export async function executeComboResponses(
       : comboFailureDecision(failure.response.status, failure.classificationText, {
         code: failure.upstreamCode,
         codexModelRefusal: failure.codexModelRefusal,
+        // The adapter the failed leg actually resolved: a configured `kiro` provider can route a
+        // model through another wire via `modelAdapters`, and an unresolved leg grants no hop.
+        failedAdapter: childLog.providerAdapter,
       });
     const wantsStream = (rawBody as { stream?: unknown } | null)?.stream === true;
     // Local byte admission has its own diagnostic; do not relabel it as an upstream refusal.
@@ -1193,8 +1215,15 @@ export async function executeComboResponses(
       }
       return lastFailure;
     }
+    // A bare status made a revoked credential read as a provider outage. Log only the parsed
+    // code and message, never the raw envelope, as one redacted, bounded line.
+    const failureReason = sanitizeLogMetadataString(
+      redactSecretString([failure.upstreamCode, failure.upstreamMessage].filter(Boolean).join(": ")).replace(/\s+/g, " "),
+      200,
+    );
     console.warn(
-      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${failure.response.status} after ${Date.now() - started}ms`,
+      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${failure.response.status}`
+        + ` after ${Date.now() - started}ms${failureReason ? `: ${failureReason}` : ""}`,
     );
     const failureNow = Date.now();
     const attemptedTargets = pick.attempted;