@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/server/responses/core-opaque-recovery.ts

@@ -259,8 +259,15 @@ export function isSelfIdentifiedOpaqueBlobRejection(bodyText: string): boolean {
       }
     }
 
-    // The flat stream-error envelope carries type/message at the top level rather than under
-    // an error object; the same anchored identity applies there.
+    // Flat SSE error events carry their code/message beside type:error, without a nested
+    // error object. Match only the same dedicated code or exact verification identity.
+    if ((record.error === undefined || record.error === null)
+      && (record.type === "error" || record.type === "invalid_request_error")
+      && (record.code === "invalid_encrypted_content" || ((record.code === null || record.code === undefined)
+        && typeof record.message === "string" && record.message.startsWith("The encrypted content ")
+        && record.message.endsWith(" could not be verified. Reason: Encrypted content could not be decrypted or parsed.")))) return true;
+
+    // The caller-mismatch identity also arrives as a flat typed error.
     if (
       record.type === "invalid_request_error"
       && typeof record.message === "string"
@@ -277,14 +284,14 @@ export function isSelfIdentifiedOpaqueBlobRejection(bodyText: string): boolean {
 
 
 /**
- * Opted-in native reasoning retention forwards ciphertext another model or account minted. ChatGPT
- * can refuse it inside a 200 stream -- a Codex WebSocket `error` frame or `response.failed` --
- * rather than as an HTTP 4xx, so the passthrough inspects the zero-output prelude of exactly these
- * requests. Ordinary turns keep the function-output-only inspection.
+ * Opaque state can be refused inside a 200 stream rather than as an HTTP 4xx. The passthrough
+ * inspects its bounded zero-output prelude even when a restored thread has no serving record;
+ * successful native ciphertext remains unchanged and blobless turns do not gain inspection.
  */
 export function retainedReasoningStreamCandidate(parsed: OcxParsedRequest, outboundBody: string | undefined): boolean {
-  return parsed._nativeReasoningRetainedAcrossRoute === true
-    && parsed._stripReasoningEncryptedContent !== true
+  // A restored thread has no process-local serving record. Inspect its actual outbound
+  // opaque state too; only an explicit zero-output rejection can authorize the rebuild.
+  return parsed._stripReasoningEncryptedContent !== true
     && outboundResponsesBodyCarriesOpaqueBlob(outboundBody);
 }
 
@@ -310,7 +317,7 @@ export function retainedReasoningStreamRejection(
 
 
 /**
- * Whether an upstream Responses 4xx authoritatively rejected opaque replay state.
+ * Whether an upstream Responses 4xx or explicitly identified 502 rejected opaque replay state.
  *
  * The outbound-body check is intentional: the inbound transcript may contain a proxy envelope or
  * compaction blob that the adapter already lowered, in which case a replay would be byte-identical.
@@ -329,8 +336,10 @@ export function shouldAttemptOpaqueBlobRecovery(args: {
   const acceptedStatus = (args.status >= 400 && args.status < 500)
     || (
       args.status === 502
-      && outboundResponsesBodyCarriesEncryptedFunctionOutput(args.outboundBody)
-      && isEncryptedFunctionOutputRejection(args.errorBody)
+      // Gateways can project a reasoning-only rejection as 502. The existing strict
+      // identity classifier below still excludes generic gateway/transport failures.
+      && (!isEncryptedFunctionOutputRejection(args.errorBody)
+        || outboundResponsesBodyCarriesEncryptedFunctionOutput(args.outboundBody))
     );
   return acceptedStatus
     && adapterSpeaksResponsesWire(args.adapterName)

package/src/server/responses/core.ts

@@ -12,6 +12,7 @@ import { createInferenceSendBudget } from "../inference/context";
 import { finalizeOwnedTranslatorBudget, finalizeAccountLease } from "./core-lifetime";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { executeComboResponses } from "./core-combo";
+import { registerTurn, unregisterTurn } from "../lifecycle";
 import { runWithCompactionRecovery } from "./compaction-recovery";
 /**
  * Route one `/v1/responses` request through the adapter pipeline: recovery loop, passthrough
@@ -67,15 +68,17 @@ export async function handleComboResponses(
   logCtx: RequestLogContext,
   options: HandleResponsesOptions & { translatorBudget: TranslatorBudget },
 ): Promise<Response> {
-  return executeComboResponses(
-    req,
-    rawBody,
-    comboId,
-    config,
-    logCtx,
-    options,
-    requestDispatchers,
-  );
+  // Each child relay binds the turn's lease and unbinds it when its stream ends; the lease is
+  // released once nothing is bound. Hold it for the whole ladder so a refused child's relay
+  // cannot settle the turn the next target still runs in ("turn already settled"). An accepted
+  // child's stream is bound before this returns and keeps the lease until it ends.
+  const ladder = new AbortController();
+  registerTurn(ladder, options.turnAdmissionLease);
+  try {
+    return await executeComboResponses(req, rawBody, comboId, config, logCtx, options, requestDispatchers);
+  } finally {
+    if (options.turnAdmissionLease && "bindAbortController" in options.turnAdmissionLease) unregisterTurn(ladder);
+  }
 }
 const requestDispatchers: ResponsesDispatchers = { handleResponses, handleComboResponses };
 export { adapterNeedsForcedContinuation } from "./core-replay";

package/src/server/responses/deepseek-image-files.ts

@@ -0,0 +1,121 @@
+import type { TranslatorBudget } from "../../lib/translator-budget";
+import type { AdapterRequest } from "../../adapters/base";
+import { readBoundedResponseBody } from "../../lib/bounded-body";
+
+// DeepSeek's image-token accounting does not include the inline base64 wire cost.
+// https://api-docs.deepseek.com/guides/vision/ documents a separate 48 MiB body cap.
+const INLINE_THRESHOLD = 40 * 1024 * 1024;
+const TARGET_BYTES = 32 * 1024 * 1024;
+const MAX_FILE_BYTES = 64 * 1024 * 1024;
+const MAX_REPAIR_BYTES = 128 * 1024 * 1024;
+const MAX_CACHE_ENTRIES = 512;
+const CACHE_MS = 50 * 60 * 1000;
+let activeRepairs = 0;
+const files = new Map<string, { id: string; until: number }>();
+
+/** Narrow parsed JSON objects without treating arrays as image or message records. */
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Only the first-party Responses image contract, never a similarly named gateway. */
+export function needsDeepSeekImageFiles(request: AdapterRequest): boolean {
+  const url = new URL(request.url);
+  return url.origin === "https://api.deepseek.com"
+    && (url.pathname === "/responses" || url.pathname === "/v1/responses")
+    && request.method === "POST"
+    && Buffer.byteLength(request.body, "utf8") > INLINE_THRESHOLD;
+}
+
+/**
+ * Replace older inline images with same-account, expiring file references. The client history
+ * and images stay intact; provider token usage and Codex's compaction policy remain truthful.
+ * The caller owns the provider's transport, cancellation and credential-selection fence.
+ */
+export async function deepSeekImageFileBody(
+  request: AdapterRequest,
+  execute: typeof globalThis.fetch,
+  abortSignal?: AbortSignal,
+  options?: { allowedModels: readonly string[]; budget?: TranslatorBudget },
+): Promise<string | undefined> {
+  if (!options?.allowedModels.length || !needsDeepSeekImageFiles(request)) return undefined;
+  const requestBytes = Buffer.byteLength(request.body, "utf8");
+  if (requestBytes > MAX_REPAIR_BYTES) throw new Error("DeepSeek image replay exceeds the 128 MiB repair limit; compact the request.");
+  if (activeRepairs >= 2) throw new Error("DeepSeek image replay preparation is busy; retry after an active request completes.");
+  activeRepairs++;
+  const releaseCopy = options.budget?.observeAcceptedRequestCopy(requestBytes * 2);
+  try {
+    abortSignal?.throwIfAborted();
+    const body: unknown = JSON.parse(request.body);
+    if (!record(body) || !options.allowedModels.includes(String(body.model))
+      || !Array.isArray(body.input)) return undefined;
+    const auth = new Headers(request.headers).get("authorization");
+    if (!auth) return undefined;
+    const scope = new Bun.CryptoHasher("sha256").update(auth).digest("hex");
+    const signal = AbortSignal.any([...(abortSignal ? [abortSignal] : []), AbortSignal.timeout(60_000)]);
+    let bytes = Buffer.byteLength(request.body, "utf8");
+    let changed = false;
+    for (const item of body.input) {
+      if (!record(item)) continue;
+      const parts = item.type === "function_call_output" || item.type === "custom_tool_call_output"
+        ? item.output : item.role === "user" || item.role === "developer" ? item.content : undefined; // DeepSeek rejects other roles' images.
+      if (!Array.isArray(parts)) continue;
+      for (const part of parts) {
+        if (bytes <= TARGET_BYTES) break;
+        // file_id ignores detail; keep explicit low-resolution requests inline.
+        if (!record(part) || part.type !== "input_image" || part.file_id !== undefined
+          || part.detail === "low" || typeof part.image_url !== "string") continue;
+        const match = /^data:(image\/(?:png|jpeg|webp|gif));base64,/.exec(part.image_url);
+        if (!match) continue;
+        signal.throwIfAborted();
+        const data = part.image_url.slice(match[0].length);
+        if (data.length > Math.ceil(MAX_FILE_BYTES / 3) * 4) continue;
+        const hash = new Bun.CryptoHasher("sha256").update(part.image_url).digest("hex");
+        const key = `${scope}:${hash}`;
+        let entry = files.get(key);
+        if (entry && entry.until <= Date.now()) { files.delete(key); entry = undefined; }
+        if (!entry) {
+          // Conservative peak: UTF-16 base64 slice/re-encoding, decoded buffer, Blob and multipart.
+          const releaseUpload = options.budget?.observeExternallyCapped("provider_image_upload", data.length * 4 + Math.ceil(data.length * 3 / 4) * 3 + 65_536);
+          try {
+            const image = Buffer.from(data, "base64");
+            if (image.length > MAX_FILE_BYTES || image.toString("base64") !== data) continue;
+            const form = new FormData();
+            form.set("purpose", "user_data");
+            form.set("expires_after[anchor]", "created_at");
+            form.set("expires_after[seconds]", "3600");
+            form.set("file", new Blob([image], { type: match[1] }), "image");
+            // Never follow a redirect with credentials or copy request-specific Content-Length.
+            const response = await execute("https://api.deepseek.com/files", {
+              method: "POST", headers: { authorization: auth }, body: form, signal, redirect: "manual",
+            });
+            if (!response.ok) {
+              await response.body?.cancel();
+              throw new Error(`DeepSeek image upload failed (HTTP ${response.status}); conversation images were preserved.`);
+            }
+            const result = await readBoundedResponseBody(response, { signal, maxBytes: 65_536 });
+            let uploaded: unknown;
+            try { uploaded = JSON.parse(result.text); } catch { /* Safe, fixed error below. */ }
+            if (result.truncated || !record(uploaded) || typeof uploaded.id !== "string"
+              || !/^file-api-[A-Za-z0-9_-]{1,200}$/.test(uploaded.id)) {
+              throw new Error("DeepSeek image upload returned an invalid file reference; conversation images were preserved.");
+            }
+            // Cache only opaque ids and hashes, not image bytes or plaintext credentials.
+            entry = { id: uploaded.id, until: Date.now() + CACHE_MS };
+            if (typeof uploaded.expires_at === "number") entry.until = Math.min(entry.until, uploaded.expires_at * 1000 - 60_000);
+            while (files.size >= MAX_CACHE_ENTRIES) files.delete(files.keys().next().value!);
+            files.set(key, entry);
+          } finally { releaseUpload?.(); }
+        }
+        const removedBytes = part.image_url.length + "image_url".length;
+        delete part.image_url;
+        part.file_id = entry.id;
+        bytes += entry.id.length + "file_id".length - removedBytes;
+        changed = true;
+      }
+    }
+    if (!changed) return undefined;
+    const releaseSerialization = options.budget?.observeExternallyCapped("passthrough_serialization", requestBytes * 2);
+    try { return JSON.stringify(body); } finally { releaseSerialization?.(); }
+  } finally { releaseCopy?.(); activeRepairs--; }
+}

package/src/server/responses/empty-completion-guard.ts

@@ -172,6 +172,7 @@ export function mergeUsage(
   const cachedInputTokens = sumOptional("cachedInputTokens");
   const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
   const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
+  const cacheCreation1hInputTokens = sumOptional("cacheCreation1hInputTokens");
   const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
   const providerCredits = sumOptional("providerCredits");
   const contextTotalTokens = second.contextTotalTokens ?? first.contextTotalTokens;
@@ -188,6 +189,7 @@ export function mergeUsage(
     ...(cachedInputTokens !== undefined ? { cachedInputTokens } : {}),
     ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
     ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
+    ...(cacheCreation1hInputTokens !== undefined ? { cacheCreation1hInputTokens } : {}),
     ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
     ...(providerCredits !== undefined ? { providerCredits } : {}),
     ...(first.estimated || second.estimated ? { estimated: true } : {}),
@@ -241,6 +243,11 @@ export async function* guardEmptyCompletionEventStream(
     heldBytes = 0;
     return released;
   };
+  // Held events from a discarded attempt are released with the retry's output, so a boundary
+  // keeps the retry's reasoning from being appended to the discarded attempt's reasoning item.
+  const markRetryBoundary = () => {
+    if (held.length > 0 && held.at(-1)?.type !== "assistant_boundary") held.push({ type: "assistant_boundary" });
+  };
 
   while (true) {
     let terminalSeen = false;
@@ -277,6 +284,7 @@ export async function* guardEmptyCompletionEventStream(
         if (retries < maxRetries) {
           // Suppress the terminal: the client must never see a completed event
           // for a turn that produced nothing. Retry the identical turn.
+          markRetryBoundary();
           retries += 1;
           try {
             source = await options.continuation();
@@ -298,6 +306,7 @@ export async function* guardEmptyCompletionEventStream(
           // malformed function call). Nothing actionable reached the client, so this is the same
           // replay-safe shape as an empty completion: retry the identical turn once.
           usage = mergeUsage(usage, event.usage);
+          markRetryBoundary();
           retries += 1;
           try {
             source = await options.continuation();
@@ -349,6 +358,7 @@ export async function* guardEmptyCompletionEventStream(
       // actionable reached the client. Retry once, then surface a stated error
       // instead of letting the bridge reduce the turn to adapter_eof.
       if (!sawContent && !passthrough && retries < maxRetries) {
+        markRetryBoundary();
         retries += 1;
         try {
           source = await options.continuation();

package/src/server/responses/fetch-helpers.ts

@@ -1,4 +1,5 @@
 import type { NativeResponseControl } from "./native-response-control";
+import { PROVIDER_HEADER_DEADLINE as HEADER_DEADLINE, type ProviderHeaderDeadline as HeaderDeadline } from "../../lib/provider-admission-wait";
 import type { CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import type { Server } from "bun";
 import {
@@ -31,6 +32,7 @@ import {
 } from "../../lib/provider-egress";
 import { redactSecretString } from "../../lib/redact";
 import { outboundCredentials } from "../../lib/outbound-credential-registry";
+import { compressUpstreamRequestBody, isCanonicalCodexResponsesUrl } from "./request-compression";
 
 export { withUpstreamHttpVersion };
 
@@ -48,11 +50,19 @@ const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
 const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
 // Survives queued credential rebuilds and executor replacement without importing budget owners.
 const PHYSICAL_DISPATCH = Symbol.for("opencodex.physical-dispatch");
+// Final destination and headers after plugin rewrites and queued rebuilds, for observers that
+// must attribute a response to the credential that actually reached the wire.
+const PHYSICAL_SEND_OBSERVER = Symbol.for("opencodex.physical-send-observer");
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  physical?: (sameDestination: boolean, headers: Headers) => void;
+};
+/** Init fragment that reports the final send of the observer's attempt; empty when nothing observes. */
+export function physicalSendObserverInit(observer: AccountAutoPauseObserver | undefined, target: string): Record<symbol, unknown> {
+  const physical = observer?.physical;
+  return physical ? { [PHYSICAL_SEND_OBSERVER]: (destination: string, headers: Headers) => physical(destination === target, headers) } : {};
+}
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
-// Replacement admission waits on the client signal, outside the response-header deadline.
-const HEADER_DEADLINE = Symbol("header-deadline");
-type HeaderDeadline = { clientSignal: AbortSignal; pause(): void; resume(): void };
 
 /**
  * Announce once, per provider, that an explicit egress route moved this provider off the
@@ -206,18 +216,27 @@ export function sendWithConnectionPolicy(
   // Bun can reset large native Codex string uploads before receiving headers while
   // the identical UTF-8 buffer succeeds. Convert only at the final HTTP send so
   // WebSocket selection still sees the serialized string and no retry is added.
+  // Opt-in compression (#7247) takes precedence at the same boundary and also yields bytes. Every
+  // retry and HTTP fallback re-enters here with the caller's original string, so each send derives
+  // its own coded bytes; `headers` is already this send's private copy.
   const target = input instanceof Request ? input.url : String(input);
   const body = init?.body;
-  const largeCodexBody = typeof body === "string"
-    && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
+  const compressed = compressUpstreamRequestBody(target, body, headers);
+  if (compressed) {
+    headers.set("Content-Encoding", compressed.encoding);
+    headers.delete("Content-Length");
+  }
+  const largeCodexBody = !compressed && typeof body === "string"
+    && isCanonicalCodexResponsesUrl(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
+  (init as Record<symbol, ((destination: string, headers: Headers) => void) | undefined> | undefined)?.[PHYSICAL_SEND_OBSERVER]?.(target, headers);
   // Final headers, after plugin rewrites: an upstream can only echo what it received here, so the
   // request log refuses any diagnostic that repeats one of these values (see request-log-terminal-status).
   outboundCredentials().remember(headers);
   return physicalFetch(input, {
     ...init,
-    ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
+    ...(compressed ? { body: compressed.body } : largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),
@@ -227,7 +246,22 @@ export function sendWithConnectionPolicy(
   });
 }
 
+interface CodexWsExecutor { provider: OcxProviderConfig; http: typeof globalThis.fetch }
+const codexWsExecutors = new WeakMap<object, CodexWsExecutor>();
+const codexWsExecutor = (send: (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => Promise<Response>, binding: CodexWsExecutor) => {
+  codexWsExecutors.set(send, binding);
+  return send as typeof globalThis.fetch;
+};
+/**
+ * Set for the executor a `dispatchOverride` receives on the WS branch: it must not get HTTP-only
+ * send policy. `provider` is the one WS eligibility was checked against; a dispatch-time
+ * replacement was not, so it sends through `http` (the same fallback) instead.
+ */
+export const codexWsExecutorBinding = (execute: unknown): CodexWsExecutor | undefined =>
+  typeof execute === "function" ? codexWsExecutors.get(execute) : undefined;
+
 export interface ProviderFetchOptions {
+  accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => AccountAutoPauseObserver | undefined;
   /**
    * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
    *
@@ -308,7 +342,9 @@ export function providerFetch(
   ) as typeof globalThis.fetch);
   const httpFetch = Object.assign(
     async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
-      reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
+      reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>,
+      // False only for the HTTP fallback of a WS send the override already wrapped: one logical send.
+      override: ProviderFetchOptions["dispatchOverride"] | null = options.dispatchOverride) => {
       // Refuse before any dispatch side effect where that is sound. `beforeDispatch` commits
       // attempt accounting and consumes admission state, so a refusal firing after it would
       // charge an attempt for a send that never happens, and a throwing hook would mask the
@@ -318,7 +354,7 @@ export function providerFetch(
       // full decision can be made now. With an override, only the configured value is checked:
       // the override may rebuild against a different host and select a different transport, and
       // refusing on this destination would reject a request whose real route is fine.
-      if (options.dispatchOverride) egressFor(input);
+      if (override) egressFor(input);
       else providerEgressSendInit(egressBinding, transport, input);
       // The hook inspects the outgoing headers and refuses the send by throwing; it is not a
       // mutator, and the copy it receives is deliberately not threaded onward. `Connection`
@@ -335,8 +371,8 @@ export function providerFetch(
           else if (!notified) { options.onPhysicalDispatch!(); notified = true; }
         } } : {}),
       };
-      return options.dispatchOverride
-        ? options.dispatchOverride(input, dispatchInit, dispatch, reacquirePacing)
+      return override
+        ? override(input, dispatchInit, dispatch, reacquirePacing)
         : dispatch(input, dispatchInit);
     },
     { preconnect },
@@ -344,7 +380,7 @@ export function providerFetch(
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
-  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+  const unobserved = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
     reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
     const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
@@ -375,12 +411,27 @@ export function providerFetch(
         options.onPhysicalDispatch?.();
       };
       const fallback = ((url: Parameters<typeof globalThis.fetch>[0], fallbackInit?: RequestInit) =>
-        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit, reacquirePacing)) as typeof globalThis.fetch;
-      return codexWsUpstreamFetch(input, init, fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
-        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold);
+        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit, reacquirePacing, null)) as typeof globalThis.fetch;
+      const wsSend = codexWsExecutor((url: Parameters<typeof globalThis.fetch>[0], wsInit?: RequestInit) => codexWsUpstreamFetch(String(url), wsInit ?? init,
+        fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
+        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold),
+        { provider, http: markEgressTransparentExecutor(fallback) });
+      // A WS frame is a physical send like any other, so it runs the same override: that is where a
+      // key-auth send is committed to its attempt row and the send budget is rebound to the
+      // credential that left. Without it a key-auth WS turn logged `sendCount: 0`.
+      return options.dispatchOverride ? options.dispatchOverride(input, init, wsSend, reacquirePacing) : wsSend(input, init);
     }
     return httpFetch(input, init, reacquirePacing);
   };
+  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+    reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
+    const observe = options.accountAutoPause?.(providerName, provider,
+      new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+    const observedInit = observe?.physical
+      ? { ...init, ...physicalSendObserverInit(observe, input instanceof Request ? input.url : String(input)) } : init;
+    const response = await unobserved(input, observedInit, reacquirePacing);
+    return observe ? observe(response) : response;
+  };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
   const waitForPacing = async (signal?: AbortSignal): Promise<ProviderRequestSlot | undefined> => {
     if (pacingSlotAcquired) {

package/src/server/responses/input-admission.ts

@@ -55,6 +55,9 @@ const REMOTE_IMAGE_TOKENS = 850;
 /** Decoded image bytes per token. Coarse tile-count proxy, not a provider formula. */
 const IMAGE_BYTES_PER_TOKEN = 750;
 
+/** Compressed-audio bytes per token. More conservative than the image proxy. */
+const AUDIO_BYTES_PER_TOKEN = 256;
+
 export interface InputAdmissionResult {
   admitted: boolean;
   estimatedTokens: number;
@@ -85,6 +88,7 @@ function imageTokens(imageUrl: string): number {
 function contentPartTokens(part: OcxContentPart, modelId: string): number {
   if (part.type === "image") return imageTokens(part.imageUrl);
   if (part.type === "video") return imageTokens(part.videoUrl);
+  if (part.type === "audio") return base64PayloadTokens(part.data, AUDIO_BYTES_PER_TOKEN);
   // An inline document is a base64 payload, not a sentence: estimating it from its marker would
   // admit a request whose real input is orders of magnitude larger. Counted arithmetically —
   // rebuilding the data URL here would materialize a second request-sized string just to measure it.
@@ -92,10 +96,10 @@ function contentPartTokens(part: OcxContentPart, modelId: string): number {
   return estimateTokens(part.text, modelId);
 }
 
-function base64PayloadTokens(base64: string): number {
+function base64PayloadTokens(base64: string, bytesPerToken = IMAGE_BYTES_PER_TOKEN): number {
   if (base64.length === 0) return 0;
   const decoded = Math.floor((base64.length * 3) / 4);
-  return Math.max(1, Math.ceil(decoded / IMAGE_BYTES_PER_TOKEN));
+  return Math.max(1, Math.ceil(decoded / bytesPerToken));
 }
 
 function contentTokens(content: string | readonly OcxContentPart[], modelId: string): number {

package/src/server/responses/jev-model-invoke.ts

@@ -1,6 +1,7 @@
 import { readBoundedResponseBytes } from "../../lib/bounded-body";
 import { JevModelInvokeError, type JevModelInvoke, type JevModelInvokeResult } from "../../combos/jev-model-backend";
 import { JEV_MAX_REQUEST_BYTES, JEV_MAX_RESPONSE_BYTES } from "../../combos/jev";
+import { serializeJevModelRequest } from "../../combos/jev-model-request";
 import type { OcxConfig } from "../../types";
 import { codexEffortRank, isCodexReasoningEffort } from "../../reasoning-effort";
 import { routeConcreteModel } from "../../router";
@@ -92,7 +93,7 @@ function decodeSse(bytes: Uint8Array): JevModelInvokeResult {
  * bounds billed output (including reasoning) and gives the spend reservation a nonzero ceiling;
  * a truncated answer is malformed and fails open like any other bad reply.
  */
-export const JEV_MODEL_MAX_OUTPUT_TOKENS = 1024;
+export { JEV_MODEL_MAX_OUTPUT_TOKENS } from "../../combos/jev-model-request";
 
 /**
  * The cheapest reasoning effort the decision model declares, so a reasoning model cannot spend
@@ -121,19 +122,17 @@ export function jevDecisionReasoningEffort(config: OcxConfig, model: string): st
  * or conversation header. It therefore runs on credentials configured on provider rows only.
  */
 export function createJevModelInvoker(context: JevModelInvokerContext): JevModelInvoke {
-  return async ({ model, instructions, input, signal }) => {
+  return async ({ model, instructions, input, signal, withoutQuota }) => {
     const effort = jevDecisionReasoningEffort(context.config, model);
-    const body = JSON.stringify({
-      model,
-      stream: true,
-      store: false,
-      instructions,
-      input: [{ role: "user", content: [{ type: "input_text", text: input }] }],
-      tools: [],
-      max_output_tokens: JEV_MODEL_MAX_OUTPUT_TOKENS,
-      ...(effort ? { reasoning: { effort } } : {}),
-    });
-    if (new TextEncoder().encode(body).byteLength > JEV_MAX_REQUEST_BYTES) {
+    let body = serializeJevModelRequest({ model, instructions, input }, effort);
+    /** True when the serialized decision request exceeds the request byte limit. */
+    const oversized = () => new TextEncoder().encode(body).byteLength > JEV_MAX_REQUEST_BYTES;
+    let quotaOmitted = false;
+    if (oversized() && withoutQuota) {
+      body = serializeJevModelRequest({ model, ...withoutQuota }, effort);
+      quotaOmitted = true;
+    }
+    if (oversized()) {
       throw new JevModelInvokeError("malformed", "decision request too large");
     }
     const lease = tryAdmitTurn(undefined, signal);
@@ -178,7 +177,7 @@ export function createJevModelInvoker(context: JevModelInvokerContext): JevModel
           return terminalResult(parsed, "");
         })();
       usage = result.usage;
-      return result;
+      return quotaOmitted ? { ...result, quotaOmitted: true } : result;
     } finally {
       // No final log row is written for this detached context, so settle its spend here.
       childLog.spendTracker?.settle(childLog.usage ?? (usage

package/src/server/responses/main-hard-lock-routing.ts

@@ -1,6 +1,8 @@
 import type { OcxConfig } from "../../types";
 import { resolveComboId } from "../../combos";
-import { isBareOpenAiFamilyModel } from "../../router";
+import { isBareOpenAiFamilyModel, previewRouteModel } from "../../router";
+import { resolveChosenTarget } from "./shadow-target-availability";
+import { getRoutingProfile, resolvePolicyProfileId } from "../../routing/profile";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
 import {
   getMainAccountHardLockStatus,
@@ -10,6 +12,8 @@ import { codexQuotaScopeForModel } from "../../codex/routing/health-store";
 import { getEligiblePoolAccounts } from "../../codex/routing/selection";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
+/** Resolves to a synchronous ownership proof, or null when the caller does not own the locked main. */
+export type MainHardLockCallerCheck = (sourceModel: string) => Promise<(() => boolean) | null>;
 
 function isConfiguredComboSelector(config: OcxConfig, modelId: string): boolean {
   const comboId = resolveComboId(config, modelId);
@@ -72,11 +76,12 @@ function rawModelOf(body: unknown): { raw: Record<string, unknown>; model: strin
  * - Luna Reserve keeps its own admission policy (`assertReserveAdmission`); its helper
  *   traffic is not operator chat and must not silently change models.
  */
-export function applyMainHardLockFallbackOverride(
+export async function applyMainHardLockFallbackOverride(
   body: unknown,
   config: OcxConfig,
-  now = Date.now(),
-): MainHardLockFallbackOverride | null {
+  now?: number,
+  callerCheck?: MainHardLockCallerCheck,
+): Promise<MainHardLockFallbackOverride | null> {
   const parsed = rawModelOf(body);
   if (!parsed) return null;
   const fallback = resolveMainAccountHardLockFallback(config);
@@ -85,14 +90,34 @@ export function applyMainHardLockFallbackOverride(
   if (!isBareOpenAiFamilyModel(parsed.model)
     || parsed.model === NATIVE_RESERVE_MODEL
     || isConfiguredComboSelector(config, parsed.model)) return null;
-  if (getMainAccountHardLockStatus(config, now).state !== "blocked") return null;
   const accountMode = providerCodexAccountMode(
     OPENAI_CODEX_PROVIDER_ID,
     config.providers?.[OPENAI_CODEX_PROVIDER_ID],
   );
-  if (accountMode !== "direct"
-    && getEligiblePoolAccounts(config, undefined, now, codexQuotaScopeForModel(parsed.model)).length > 0) {
-    return null;
+  if (accountMode === "direct") {
+    // Direct may forward a different caller's healthy credential. Only stored-main substitution
+    // or an observed-main match owes this lock. Recheck usage after the startup binding wait.
+    const stillOwnsLockedMain = callerCheck ? await callerCheck(parsed.model) : null;
+    // Everything from here to the rewrite is synchronous, so this proof cannot go stale before it.
+    if (!stillOwnsLockedMain?.()) return null;
+    if (getMainAccountHardLockStatus(config, now ?? Date.now()).state !== "blocked") return null;
+  } else {
+    if (getMainAccountHardLockStatus(config, now ?? Date.now()).state !== "blocked") return null;
+    if (getEligiblePoolAccounts(config, undefined, now ?? Date.now(), codexQuotaScopeForModel(parsed.model)).length > 0) return null;
+  }
+
+  // Combos and policies keep their own dispatch admission and declared failover/evidence.
+  // Other chosen targets must resolve now; a removed qualifier cannot become a default send.
+  const policyId = resolvePolicyProfileId(config, fallback.model);
+  if (!isConfiguredComboSelector(config, fallback.model)
+    && !(policyId && getRoutingProfile(config, policyId))) {
+    try {
+      const target = resolveChosenTarget(fallback.model, model => previewRouteModel(config, model));
+      if ("unavailable" in target) return null;
+    } catch {
+      // An unavailable target keeps the source lock's refusal without touching the body.
+      return null;
+    }
   }
 
   parsed.raw.model = fallback.model;

package/src/server/responses/native-steering-log.ts

@@ -24,7 +24,7 @@ export function createNativeSteeringLogObserver(logCtx: RequestLogContext, onFir
       if (usage && (usages.has(event.response.id) || usages.size < MAX_NATIVE_STEERING_RESPONSES)) {
         // Retain numeric counters only, never arbitrary rawUsage metadata.
         const counters: OcxUsage = { inputTokens: usage.inputTokens, outputTokens: usage.outputTokens };
-        for (const key of ["totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "reasoningOutputTokens"] as const) {
+        for (const key of ["totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "cacheCreation1hInputTokens", "reasoningOutputTokens"] as const) {
           if (typeof usage[key] === "number") counters[key] = usage[key];
         }
         usages.set(event.response.id, counters);
@@ -33,7 +33,7 @@ export function createNativeSteeringLogObserver(logCtx: RequestLogContext, onFir
     if (!usages.size) return;
     const total: OcxUsage = { inputTokens: 0, outputTokens: 0 };
     for (const usage of usages.values()) {
-      for (const key of ["inputTokens", "outputTokens", "totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "reasoningOutputTokens"] as const) {
+      for (const key of ["inputTokens", "outputTokens", "totalTokens", "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens", "cacheCreation1hInputTokens", "reasoningOutputTokens"] as const) {
         const value = usage[key];
         if (typeof value === "number" && Number.isFinite(value)) total[key] = (total[key] ?? 0) + value;
       }