@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/server/management/route-registry.ts

@@ -370,6 +370,9 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
   { method: "GET", path: "/api/provider-presets", module: "server/management/provider-routes", mutates: false },
   { method: "GET", path: "/api/provider-quotas", module: "server/management/provider-routes", mutates: false },
+  { method: "GET", path: "/api/quota-pool", module: "server/management/quota-pool-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The ocx.quota-pool/1 read is a machine contract GOAT consumes over management and the link relay; the CLI shows the same caches through ocx provider quota and ocx account.", owner: "ocx-1 quota pool", ownerDoc: "structure/quota-pool.md" } },
+  { method: "GET", path: "/api/fallback", module: "server/management/fallback-routes", mutates: false },
+  { method: "PUT", path: "/api/fallback", module: "server/management/fallback-routes", mutates: true },
   { method: "GET", path: "/api/provider-request-pacing", module: "server/management/provider-key-pacing-routes", mutates: false },
   { method: "GET", path: "/api/providers", module: "server/management/provider-routes", mutates: false },
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },

package/src/server/management-api.ts

@@ -161,6 +161,20 @@ async function handleLowQuotaRoutesOnDemand(ctx: ManagementContext): Promise<Res
   return handleLowQuotaRoutes(ctx);
 }
 
+/** Lazy for the same reason: the quota-pool assembler pulls every quota cache reader. */
+async function handleQuotaPoolRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/quota-pool", false)) return null;
+  const { handleQuotaPoolRoutes } = await import("./management/quota-pool-routes");
+  return handleQuotaPoolRoutes(ctx);
+}
+
+/** Lazy: the OCX-11 fallback state view and its write live off the dashboard's common path. */
+async function handleFallbackRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/fallback", false)) return null;
+  const { handleFallbackRoutes } = await import("./management/fallback-routes");
+  return handleFallbackRoutes(ctx);
+}
+
 /**
  * Lazy like the Lab and routing-profile handlers, and for the same recorded reason: this file is
  * mounted for every dashboard request, so a static import would put the workflow-budget ledger
@@ -351,6 +365,8 @@ export async function handleManagementAPI(
     ??     (await handleRequestHistoryRoutes(ctx))
     ??     (await handleQuotaResetRoutesOnDemand(ctx))
     ??     (await handleLowQuotaRoutesOnDemand(ctx))
+    ??     (await handleQuotaPoolRoutesOnDemand(ctx))
+    ??     (await handleFallbackRoutesOnDemand(ctx))
     ??     (await handleWorkflowBudgetRoutesOnDemand(ctx))
     ??     (await handleCodexAgentRoleRoutesOnDemand(ctx))
     ??     (await handleProtocolRoutesOnDemand(ctx))

package/src/server/management-auth.ts

@@ -73,6 +73,7 @@ import {
 } from "./gui-session";
 import { hasLocalDesktopSnapshotCapability } from "./local-desktop-snapshot-auth";
 import { hasLocalAccountSwitchCapability } from "./local-account-switch-auth";
+import { authorizationCredential } from "../lib/authorization-scheme";
 export type { GuiSessionBootstrap, GuiSessionRequestContext } from "./gui-session";
 
 const LOCAL_READ_REPLAY_LIMIT = 256;
@@ -545,7 +546,7 @@ function hasGuiPairCapability(
 
 function requestManagementCredential(req: Request): string | null {
   return req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
+    || authorizationCredential(req.headers)
     || null;
 }
 

package/src/server/messages-native.ts

@@ -849,6 +849,17 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   }
   releaseRetainedRequest();
 
+  // The last pool account refused on spent quota and rotation found no replacement: answer the
+  // usage limit with its reset (#6991), as the bridge lane does, not the upstream "try again later".
+  const poolUsageLimit = response.status === 429 && oauthBinding
+    ? anthropicRoutingFor(nativeInstance!).anthropicPoolUsageLimitAfterRefusal(Date.now(), oauthBinding.routeDecision, route.modelId)
+    : null;
+  if (poolUsageLimit) {
+    discard(response);
+    cleanupAbort();
+    logCtx.errorCode = "usage_limit_reached";
+    return retainUpstreamMessagesRequestId(localOAuthFailure(poolUsageLimit)!, response.headers);
+  }
   if (!response.ok) {
     let bodyText = "";
     try {

package/src/server/request-log.ts

@@ -1720,8 +1720,10 @@ export function noteProviderAttemptSend(
   if (attempt && attempt.sendCount > 0 && attemptAccountChanged(previous, next, attempt.provider, logCtx.provider)) {
     // An input estimate is not evidence that a failed send used that many tokens.
     delete attempt.inputTokenEstimate;
+    // An account-scoped recovery kind names the status the sealed account answered.
     finishRequestAttempt(attempt, attempt.status >= 100 ? attempt.status
-      : recovery === "key-401" ? 401 : recovery?.includes("429") ? 429 : 502,
+      : recovery === "key-401" || recovery === "oauth-401" ? 401 : recovery === "oauth-account-403" ? 403
+        : recovery === "oauth-account-402" ? 402 : recovery?.includes("429") ? 429 : 502,
     Date.now() - (logCtx.activeAttemptStartedAt ?? Date.now()), attempt.usage);
     // This attempt is being sealed because a NAMED recovery rejected it, so the recovery kind
     // is direct evidence here rather than an inference from history. Without this the sealed
@@ -1850,16 +1852,20 @@ export function finishRequestAttempt(
 export function aggregateAttemptUsage(
   attempts: readonly PersistedUsageAttempt[],
 ): FinalizedUsageResult {
-  const status: UsageStatus = attempts.length > 0
-    && attempts.every(attempt => attempt.usageStatus === "unsupported")
+  // A usage-less attempt that never reached upstream spent nothing (summary.ts `spentNothing`),
+  // so it cannot leave the row's usage unknown.
+  const measured = attempts.filter(attempt => attempt.usage
+    || (attempt.sendCount !== 0 && attempt.locallyAnswered !== true));
+  const status: UsageStatus = measured.length > 0
+    && measured.every(attempt => attempt.usageStatus === "unsupported")
     ? "unsupported"
-    : attempts.some(attempt => (
+    : measured.some(attempt => (
         attempt.usageStatus === "unreported" || attempt.usageStatus === "unsupported"
       ))
       ? "unreported"
-      : attempts.some(attempt => attempt.usageStatus === "estimated")
+      : measured.some(attempt => attempt.usageStatus === "estimated")
         ? "estimated"
-        : attempts.length > 0
+        : measured.length > 0
           ? "reported"
           : "unreported";
 
@@ -1876,7 +1882,10 @@ export function aggregateAttemptUsage(
     return present.length > 0 ? present.reduce((sum, value) => sum + value, 0) : undefined;
   };
   const cachedInputTokens = sumOptional("cachedInputTokens");
-  const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
+  // Readers take `cacheReadInputTokens ?? cachedInputTokens` (usage/cost.ts), so once any attempt
+  // reports the read field, an attempt that only reports `cachedInputTokens` must count in it too.
+  const cacheReadInputTokens = sumOptional("cacheReadInputTokens") === undefined ? undefined
+    : usages.reduce((sum, usage) => sum + (usage.cacheReadInputTokens ?? usage.cachedInputTokens ?? 0), 0);
   const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
   const cacheCreation1hInputTokens = sumOptional("cacheCreation1hInputTokens");
   const reasoningOutputTokens = sumOptional("reasoningOutputTokens");

package/src/server/responses/adapter-continuation.ts

@@ -28,7 +28,7 @@ import {
   fetchWithTransientRetry,
   fetchWithResetRetry,
   applyUpstreamRecoveryInit,
-  isNonReplayableResponse,
+  isNonReplayableResponse, isSameTargetRetryHold,
   prepareSameTarget429Wait,
   SendBudgetExhaustedError,
 } from "../../lib/upstream-retry";
@@ -349,7 +349,7 @@ export function createAdapterContinuations(
         && !kiroReplaySetupFailed
         // A synthesized replay refusal is not a rate limit; replaying the continuation on
         // it would re-send a turn whose first send may already have been processed.
-        && !isNonReplayableResponse(response)
+        && !isNonReplayableResponse(response) && !isSameTargetRetryHold(response)
        && rateLimitPolicy !== null
         && adapterExchange.rateLimitRetries < rateLimitPolicy.attempts
         // The main recovery loop and the passthrough ladder both consult the shared remainder

package/src/server/responses/adapter-dispatch.ts

@@ -9,7 +9,7 @@ import { rotateAnthropicAccountOnResponseForInstance } from "../../oauth/anthrop
 import { authorizeResendForRecovery } from "../../lib/request-resend-gate";
 import { ambiguousResendAllowanceFor, selfContainedResponsesBody } from "./reset-replay";
 import { transientSendCapFor } from "./request-send-budget";
-import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { isNonReplayableResponse, isSameTargetRetryHold } from "../../lib/upstream-retry";
 import { sanitizeNonReplayableUpstreamError } from "./non-replayable-error";
 import { isLocalUpstream } from "../../lib/local-upstream";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
@@ -1239,7 +1239,7 @@ export async function prepareAdapterExchange(
       // replay is lossless. Runs before key failover so "primary-first" setups keep the same
       // key on rate-limit blips; only after the attempts are exhausted does failover run.
       while (
-        upstreamResponse.status === 429
+        upstreamResponse.status === 429 && !isSameTargetRetryHold(upstreamResponse)
         && rateLimitPolicy !== null
         && rateLimitRetries < rateLimitPolicy.attempts
         && !sendBudgetExhausted()

package/src/server/responses/agent-task-recovery.ts

@@ -104,7 +104,7 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
     const type = input[itemIndex] && typeof input[itemIndex] === "object"
       ? (input[itemIndex] as { type?: unknown }).type
       : undefined;
-    if (type !== "compaction_trigger" && type !== "additional_tools") break;
+    if (type !== "compaction_trigger" && type !== "additional_tools" && type !== "configuration_update") break;
     itemIndex -= 1;
   }
 

package/src/server/responses/codex-ws-exchange.ts

@@ -458,6 +458,9 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         return;
       }
       if (terminal || settledPreOpen || signal?.aborted) return;
+      // New sockets have just validated their upgrade; retained sockets carry the
+      // same connection signal into a fresh exchange, never its predecessor's frames.
+      metadata?.seed(session.upgradeHeaders());
       sent = true;
       try {
         if (nativeControl) {

package/src/server/responses/codex-ws-metadata.ts

@@ -6,11 +6,48 @@ export const CODEX_WS_METADATA_MAX_HEADERS = 128;
 export const CODEX_WS_METADATA_MAX_VALUE_BYTES = 4096;
 
 export type CodexWsQuotaObserver = (headers: Headers) => void;
+const REASONING_INCLUDED_HEADER = "x-reasoning-included";
+const HTTP_HEADER_TOKEN = /^[!#$%&'*+.^_`|~0-9a-z-]+$/i;
 
 function record(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+/** Bun emits this payload before validating the upgrade; the session must wait for open. */
+export function readCodexWsUpgradeHeaders(payload: unknown): Headers {
+  try {
+    if (!record(payload) || payload.statusCode !== 101 || !Array.isArray(payload.rawHeaders)
+      || payload.rawHeaders.length % 2 !== 0 || payload.rawHeaders.length > CODEX_WS_METADATA_MAX_HEADERS * 2) return new Headers();
+    const headers = new Headers();
+    let bytes = 0;
+    let connectionNominated = false;
+    for (let i = 0; i < payload.rawHeaders.length; i += 2) {
+      const name = payload.rawHeaders[i];
+      const value = payload.rawHeaders[i + 1];
+      if (typeof name !== "string" || typeof value !== "string"
+        || name.length + value.length > CODEX_WS_METADATA_MAX_BYTES - bytes || !HTTP_HEADER_TOKEN.test(name)
+        || /[\r\n\0]/.test(value)) return new Headers();
+      bytes += Buffer.byteLength(name) + Buffer.byteLength(value);
+      if (bytes > CODEX_WS_METADATA_MAX_BYTES) return new Headers();
+      const lower = name.toLowerCase();
+      if (lower === "connection" && value.split(",").some(token => token.trim().toLowerCase() === REASONING_INCLUDED_HEADER)) {
+        connectionNominated = true;
+      }
+      // Other allowlisted response headers (quota, request id, turn state, model)
+      // describe a response, not a reusable connection. Never retain them here.
+      if (lower === REASONING_INCLUDED_HEADER) {
+        if (Buffer.byteLength(value) > CODEX_WS_METADATA_MAX_VALUE_BYTES) return new Headers();
+        headers.append(lower, value);
+        if (Buffer.byteLength(headers.get(lower)!) > CODEX_WS_METADATA_MAX_VALUE_BYTES) return new Headers();
+      }
+    }
+    return connectionNominated ? new Headers() : headers;
+  } catch {
+    // Missing/unsupported or malformed optional metadata cannot authorize a retry.
+    return new Headers();
+  }
+}
+
 function finiteNonnegative(value: unknown): value is number {
   return typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
@@ -91,6 +128,13 @@ export class CodexWsMetadata {
 
   snapshot(): Headers { return new Headers(this.headers); }
 
+  /** Seed only the connection-level inclusion signal; per-response frames still win. */
+  seed(headers: Headers): void {
+    if (this.ended || this.committed || this.headers.has(REASONING_INCLUDED_HEADER)) return;
+    const value = headers.get(REASONING_INCLUDED_HEADER);
+    if (value !== null) setMetadataHeader(this.headers, REASONING_INCLUDED_HEADER, value);
+  }
+
   private publishQuota(headers: Headers): void {
     // Observation is auxiliary bookkeeping; a consumer exception cannot turn
     // a valid provider frame into a retryable transport failure.

package/src/server/responses/codex-ws-session.ts

@@ -1,3 +1,5 @@
+import { readCodexWsUpgradeHeaders } from "./codex-ws-metadata";
+
 export const MAX_CODEX_WS_SESSION_EXCHANGES = 32;
 
 /** Owns one physical socket; request listeners belong to the exchange, not this object. */
@@ -8,10 +10,13 @@ export class CodexWsSession {
   busy = false;
   private owner?: (reason: Error) => void;
   private readonly completedIds = new Set<string>();
+  private pendingUpgradeHeaders?: Headers;
+  private connectionHeaders?: Headers;
 
   constructor(url: string, headers: Record<string, string>, readonly retainable = false,
     private readonly changed: () => void = () => {}, proxy?: string) {
     this.socket = new WebSocket(url, { headers, ...(proxy ? { proxy } : {}) } as unknown as string[]);
+    this.socket.addEventListener("handshake", this.onHandshake);
     this.socket.addEventListener("open", this.onOpen);
     this.socket.addEventListener("message", this.onIdleMessage);
     this.socket.addEventListener("close", this.onClose);
@@ -20,6 +25,7 @@ export class CodexWsSession {
 
   get reused(): boolean { return this.completedIds.size > 0; }
   hasCompleted(id: string): boolean { return this.completedIds.has(id); }
+  upgradeHeaders(): Headers { return new Headers(this.opened && !this.closed ? this.connectionHeaders : undefined); }
 
   reserve(): boolean {
     if (this.closed || this.busy || (this.opened && this.socket.readyState !== undefined && this.socket.readyState !== 1)) return false;
@@ -71,7 +77,18 @@ export class CodexWsSession {
     }
   }
 
-  private onOpen = (): void => { this.opened = true; };
+  private onHandshake = (event: Event): void => {
+    if (this.opened || this.closed) return;
+    this.pendingUpgradeHeaders = readCodexWsUpgradeHeaders((event as MessageEvent<unknown>).data);
+  };
+  private onOpen = (): void => {
+    if (this.closed) return;
+    // A 101 payload alone is not proof that Bun accepted the handshake.
+    this.connectionHeaders = this.pendingUpgradeHeaders;
+    this.pendingUpgradeHeaders = undefined;
+    this.socket.removeEventListener("handshake", this.onHandshake);
+    this.opened = true;
+  };
   private onIdleMessage = (): void => {
     if (!this.busy) this.dispose(new Error("codex websocket received unsolicited idle data"));
   };
@@ -85,6 +102,9 @@ export class CodexWsSession {
     // The active exchange's close listener retains pre-send fallback semantics.
   };
   private detach(): void {
+    this.pendingUpgradeHeaders = undefined;
+    this.connectionHeaders = undefined;
+    this.socket.removeEventListener("handshake", this.onHandshake);
     this.socket.removeEventListener("open", this.onOpen);
     this.socket.removeEventListener("message", this.onIdleMessage);
     this.socket.removeEventListener("close", this.onClose);

package/src/server/responses/combo-stream-preflight.ts

@@ -224,8 +224,13 @@ function failedTerminalResponse(
     : topLevelError && typeof topLevelError === "object" && !Array.isArray(topLevelError)
       ? topLevelError as Record<string, unknown>
     : {
-      type: "upstream_error",
-      code: "upstream_server_error",
+      // A caller-validated flat error can carry its identity beside type:error.
+      // Retain it when that caller established a 400, rather than discarding the
+      // rejection code before the single-shot opaque-state recovery sees it.
+      type: terminalPayload.type === "error" && logCtx.terminalHttpStatus === 400
+        ? "invalid_request_error" : "upstream_error",
+      code: terminalPayload.type === "error" && logCtx.terminalHttpStatus === 400
+        ? (typeof terminalPayload.code === "string" ? terminalPayload.code : null) : "upstream_server_error",
       message: typeof terminalPayload.message === "string"
         ? terminalPayload.message
         : logCtx.upstreamError ?? "Provider stream failed before producing output",

package/src/server/responses/compact.ts

@@ -88,6 +88,7 @@ import {
   recordCodexUpstreamOutcome,
   type CodexUpstreamOutcome,
 } from "../../codex/routing";
+import { codexFailureWindowOutcomeMeta } from "../../codex/routing/failure-window";
 import {
   applyAccountChangeConversationStateScrub,
   conversationStateBindingFromAuth,
@@ -134,7 +135,7 @@ import type { DataPlaneAdmission } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
 import { buildResponsesTransport, copyResponsesClientMetadata } from "../../adapters/openai-responses/transport";
-import { scrubOcxCompactionItems, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough } from "../../adapters/openai-responses/request-strips";
+import { scrubOcxCompactionItems, stripCanonicalOnlyInputItems, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough } from "../../adapters/openai-responses/request-strips";
 import { dropResponsesReasoningInputItems } from "../../adapters/openai-responses/reasoning";
 import { requiresPlaintextReasoningReplay } from "../../adapters/openai-responses/passthrough";
 import { destinationDecodesNativeCompactionBlob, isOpenAiOperatedResponsesDestination } from "../../providers/openai-tiers-destination";
@@ -1062,6 +1063,7 @@ export async function handleResponsesCompact(
       if ((outcome === 401 || outcome === 403) && upstream && wasPermanentAccountRefusal(upstream)) return;
       recordCodexUpstreamOutcome(config, ctx.accountId, outcome, {
         ...meta,
+        ...codexFailureWindowOutcomeMeta(ctx),
         threadId: ctx.kind === "pool" || ctx.kind === "main-pool" ? ctx.affinityKey : undefined,
         fixedAccount: ctx.fixedAccount,
         modelId: selectedModelId,
@@ -1153,7 +1155,7 @@ export async function handleResponsesCompact(
           replayBody = stripInternalChatMessageMetadataPassthrough(replayBody) as typeof replayBody;
         }
         return isOpenAiOperatedResponsesDestination(sendProvider)
-          ? replayBody : stripCanonicalOnlyTopLevelFields(replayBody);
+          ? replayBody : stripCanonicalOnlyInputItems(stripCanonicalOnlyTopLevelFields(replayBody));
       };
       const doFetch = (upstreamRecovery?: UpstreamSendRecovery) => fetchWithHeaderTimeout(
         compactUrl,

package/src/server/responses/core-auth.ts

@@ -2,6 +2,7 @@ import type { OcxProviderConfig, OcxConfig } from "../../types";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import type { RouteResult } from "../../router";
+import { routeConcreteModel } from "../../router";
 import type { HandleResponsesOptions } from "./core-options";
 import {
   hasForwardableCodexBearer,
@@ -24,6 +25,7 @@ import {
   CodexAuthContextError,
   applyCodexAuthContextToProvider,
   stripCodexRuntimeProviderFields,
+  mainAccountHardLockCallerProof,
 } from "../../codex/auth-context";
 import { codexAccountSelectionForTurn, tryClaimNativeMainProfileForTurn } from "../lifecycle";
 import { isNativeMainTrafficBlocked } from "../../codex/native-profile-startup";
@@ -44,6 +46,7 @@ import { forceRefreshMainAccountToken } from "../../codex/main-account";
 import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
 import { safeCallerSessionId } from "../caller-session-identity";
 import { copyResponsesClientMetadata } from "../../adapters/openai-responses/transport";
+import { AgentAssertionUnsupportedError, agentAssertionUnsupportedResponse, authorizationCredential, carryAgentAssertionForCallerBearer, hasAgentAssertionAuthorization } from "../../lib/authorization-scheme";
 
 /** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
 export function withClaudeNativeSession(headers: Headers, provider: OcxProviderConfig, sessionId?: string): Headers {
@@ -203,6 +206,9 @@ export async function resolveResponsesCodexAuth(
   retainAccountForUploadedFiles = false,
 ): Promise<ResponsesAuthResolution> {
   let authCtx: CodexAuthContext | undefined;
+  // Ingress already refuses assertion_only; a later internal hop must not reach a pool or
+  // routed credential with it either, because that would be a silent credential swap.
+  if (hasAgentAssertionAuthorization(req.headers)) return { ok: false, response: agentAssertionUnsupportedResponse() };
   try {
     let authInputHeaders = codexRouteCredentialDomainHeaders(
       req,
@@ -330,7 +336,7 @@ export async function resolveResponsesCodexAuth(
     } else {
       // Even adapters that ignore caller auth must not retain a proxy secret for
       // a later internal hop or a future transport change.
-      const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+      const bearer = authorizationCredential(headers);
       if (bearer && isProxyAdmissionSecret(bearer, config)) {
         headers.delete("authorization");
         headers.delete("chatgpt-account-id");
@@ -341,6 +347,11 @@ export async function resolveResponsesCodexAuth(
     if (options.compactionRecoveryKind === "compaction-v1") {
       copyResponsesClientMetadata(headers, authInputHeaders, route.provider);
     }
+    // dual_header: the assertion is first-party only and travels only beside the caller's own
+    // unchanged Bearer, compared with the ORIGINAL request (injected credentials do not count).
+    if (isCanonicalOpenAiForwardProvider(route.provider) && authCtx?.kind === "main" && !substituteMainCredential) {
+      carryAgentAssertionForCallerBearer(headers, req.headers);
+    }
     return {
       ok: true,
       authCtx,
@@ -362,6 +373,7 @@ export async function resolveResponsesCodexAuth(
     if (err instanceof ForwardAdmissionCredentialError) {
       return { ok: false, response: formatErrorResponse(401, "authentication_error", err.message) };
     }
+    if (err instanceof AgentAssertionUnsupportedError) return { ok: false, response: agentAssertionUnsupportedResponse() };
     const response = mapCodexAuthContextErrorToResponse(err, {
       accountSelector: route.codexAccountNamespace,
       now: Date.now(),
@@ -590,3 +602,21 @@ export async function refreshNativeMainForwardAuth(args: {
     }) ?? nativeMainRefreshFailureResponse(error) };
   }
 }
+
+/** Inspect the original credential domain, before fallback changes the route or drops headers. */
+export function mainHardLockFallbackCallerCheck(
+  req: Request, config: OcxConfig, options: HandleResponsesOptions,
+): (sourceModel: string) => Promise<(() => boolean) | null> {
+  return async sourceModel => {
+    let sourceRoute: ReturnType<typeof routeConcreteModel>;
+    try { sourceRoute = routeConcreteModel(config, sourceModel); }
+    // This preview cannot replace the normal routing phase's existing error response.
+    catch { return null; }
+    const headers = codexRouteCredentialDomainHeaders(req, sourceRoute, options, false, config);
+    const { substituteMainCredential } = codexRouteCredentialOwnership(headers, config, sourceRoute, options);
+    return mainAccountHardLockCallerProof(headers, options.codexAuthPolicy ?? config, {
+      substituteMainCredentialForDirect: substituteMainCredential,
+      signal: options.abortSignal ?? req.signal,
+    });
+  };
+}

package/src/server/responses/core-codex-account.ts

@@ -11,6 +11,7 @@ import { claimMainQuotaDispatchForWs, isMainQuotaDispatchLive, renewMainQuotaDis
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { isCodexAccountGenerationLive } from "../../codex/account-store";
+import { codexFailureWindowOutcomeMeta } from "../../codex/routing/failure-window";
 import { applyAccountQuotaFromUpstreamHeaders as applyCapturedCodexQuota } from "../../codex/quota";
 import type { RouteResult } from "../../router";
 import {
@@ -93,20 +94,19 @@ export function sidecarOutcomeRecorder(
   config: OcxConfig,
   authCtx: CodexAuthContext,
 ): ((outcome: CodexUpstreamOutcome) => void) | undefined {
-  return authCtx.kind === "pool" || authCtx.kind === "main-pool"
-    ? outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
-      threadId: authCtx.affinityKey,
-      fixedAccount: authCtx.fixedAccount,
-      probeLeaseId: authCtx.probeLeaseId,
-      probeQuotaScope: authCtx.probeQuotaScope,
-      writerGeneration: authCtx.writerGeneration,
-      // A vision or web-search sidecar can return 401/403, and that is evidence about the exact
-      // stored credential it used. Without the generation it becomes an account-wide quarantine
-      // that a replacement inherits (#2892 gap 4). `main-pool` has no stored-record generation, so
-      // it keeps the unfenced account-wide semantics.
-      ...(authCtx.kind === "pool" ? { credentialGeneration: authCtx.generation } : {}),
-    })
-    : undefined;
+  if (authCtx.kind !== "pool" && authCtx.kind !== "main-pool") return undefined;
+  const windowMeta = codexFailureWindowOutcomeMeta(authCtx);
+  return outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+    ...windowMeta,
+    threadId: authCtx.affinityKey,
+    fixedAccount: authCtx.fixedAccount,
+    probeLeaseId: authCtx.probeLeaseId,
+    probeQuotaScope: authCtx.probeQuotaScope,
+    writerGeneration: authCtx.writerGeneration,
+    // Quarantine retains its stored-credential fence. main-pool has no stored-record
+    // generation; its separate dispatch proof above fences only failure-window samples.
+    ...(authCtx.kind === "pool" ? { credentialGeneration: authCtx.generation } : {}),
+  });
 }
 
 
@@ -148,6 +148,7 @@ export function recordCodexPreOutputRefusalOutcome(
   if (!usesCodexForwardPoolAuth(authCtx, provider) || wasPermanentAccountRefusal(response)) return;
   noteCodexWsPreOutputRefusalOutcome(response);
   recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
+    ...codexFailureWindowOutcomeMeta(authCtx),
     threadId: authCtx.affinityKey,
     fixedAccount: authCtx.fixedAccount,
     modelId,
@@ -676,6 +677,7 @@ export async function retryCodexPoolOnAlternateAccount(
     if (codexWsPreOutputRefusalOutcomeRecorded(firstResponse)) return;
     noteCodexWsPreOutputRefusalOutcome(firstResponse);
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
+      ...codexFailureWindowOutcomeMeta(firstAuthCtx),
       threadId: firstAuthCtx.affinityKey,
       fixedAccount: firstAuthCtx.fixedAccount,
       modelId: route.modelId,
@@ -693,6 +695,7 @@ export async function retryCodexPoolOnAlternateAccount(
     if (outcomeStatus === firstResponse.status || (outcomeStatus !== 429 && outcomeStatus !== 402)) return;
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...codexQuotaOutcomeMeta(firstResponse),
+      ...codexFailureWindowOutcomeMeta(firstAuthCtx),
       threadId: firstAuthCtx.affinityKey,
       modelId: route.modelId,
       probeLeaseId: codexProbeLeaseId(firstAuthCtx),
@@ -862,6 +865,7 @@ export async function retryCodexPoolOnAlternateAccount(
     }
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
+      ...codexFailureWindowOutcomeMeta(firstAuthCtx),
       threadId: firstAuthCtx.affinityKey,
       modelId: route.modelId,
       probeLeaseId: codexProbeLeaseId(firstAuthCtx),
@@ -1149,6 +1153,7 @@ export function codexForwardTerminalOutcomeRecorder(
   logCtx?: RequestLogContext,
 ): ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined {
   if (!usesCodexForwardPoolAuth(authCtx, provider)) return undefined;
+  const windowMeta = codexFailureWindowOutcomeMeta(authCtx);
   return (status, httpStatusOverride) => {
     const quotaStatus = [httpStatusOverride, logCtx?.terminalHttpStatus]
       .find(value => value === 429 || value === 402);
@@ -1157,6 +1162,7 @@ export function codexForwardTerminalOutcomeRecorder(
       // request. Don't penalize account health; record success to clear any
       // prior soft-avoid so a healthy account isn't stuck avoided.
       recordCodexUpstreamOutcome(config, authCtx.accountId, 200, {
+        ...windowMeta,
         threadId: authCtx.affinityKey,
         fixedAccount: authCtx.fixedAccount,
         modelId,
@@ -1180,6 +1186,7 @@ export function codexForwardTerminalOutcomeRecorder(
       ? 200
       : (quotaStatus ?? httpStatusOverride ?? logCtx?.terminalHttpStatus ?? 502);
     recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+      ...windowMeta,
       threadId: authCtx.affinityKey,
       fixedAccount: authCtx.fixedAccount,
       modelId,