@bitkyc08/opencodex 2.90.0 → 2.91.0

package/src/server/management-auth.ts

@@ -73,6 +73,7 @@ import {
 } from "./gui-session";
 import { hasLocalDesktopSnapshotCapability } from "./local-desktop-snapshot-auth";
 import { hasLocalAccountSwitchCapability } from "./local-account-switch-auth";
+import { authorizationCredential } from "../lib/authorization-scheme";
 export type { GuiSessionBootstrap, GuiSessionRequestContext } from "./gui-session";
 
 const LOCAL_READ_REPLAY_LIMIT = 256;
@@ -545,7 +546,7 @@ function hasGuiPairCapability(
 
 function requestManagementCredential(req: Request): string | null {
   return req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
+    || authorizationCredential(req.headers)
     || null;
 }
 

package/src/server/responses/agent-task-recovery.ts

@@ -104,7 +104,7 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
     const type = input[itemIndex] && typeof input[itemIndex] === "object"
       ? (input[itemIndex] as { type?: unknown }).type
       : undefined;
-    if (type !== "compaction_trigger" && type !== "additional_tools") break;
+    if (type !== "compaction_trigger" && type !== "additional_tools" && type !== "configuration_update") break;
     itemIndex -= 1;
   }
 

package/src/server/responses/compact.ts

@@ -135,7 +135,7 @@ import type { DataPlaneAdmission } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
 import { buildResponsesTransport, copyResponsesClientMetadata } from "../../adapters/openai-responses/transport";
-import { scrubOcxCompactionItems, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough } from "../../adapters/openai-responses/request-strips";
+import { scrubOcxCompactionItems, stripCanonicalOnlyInputItems, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough } from "../../adapters/openai-responses/request-strips";
 import { dropResponsesReasoningInputItems } from "../../adapters/openai-responses/reasoning";
 import { requiresPlaintextReasoningReplay } from "../../adapters/openai-responses/passthrough";
 import { destinationDecodesNativeCompactionBlob, isOpenAiOperatedResponsesDestination } from "../../providers/openai-tiers-destination";
@@ -1155,7 +1155,7 @@ export async function handleResponsesCompact(
           replayBody = stripInternalChatMessageMetadataPassthrough(replayBody) as typeof replayBody;
         }
         return isOpenAiOperatedResponsesDestination(sendProvider)
-          ? replayBody : stripCanonicalOnlyTopLevelFields(replayBody);
+          ? replayBody : stripCanonicalOnlyInputItems(stripCanonicalOnlyTopLevelFields(replayBody));
       };
       const doFetch = (upstreamRecovery?: UpstreamSendRecovery) => fetchWithHeaderTimeout(
         compactUrl,

package/src/server/responses/core-auth.ts

@@ -46,6 +46,7 @@ import { forceRefreshMainAccountToken } from "../../codex/main-account";
 import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
 import { safeCallerSessionId } from "../caller-session-identity";
 import { copyResponsesClientMetadata } from "../../adapters/openai-responses/transport";
+import { AgentAssertionUnsupportedError, agentAssertionUnsupportedResponse, authorizationCredential, carryAgentAssertionForCallerBearer, hasAgentAssertionAuthorization } from "../../lib/authorization-scheme";
 
 /** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
 export function withClaudeNativeSession(headers: Headers, provider: OcxProviderConfig, sessionId?: string): Headers {
@@ -205,6 +206,9 @@ export async function resolveResponsesCodexAuth(
   retainAccountForUploadedFiles = false,
 ): Promise<ResponsesAuthResolution> {
   let authCtx: CodexAuthContext | undefined;
+  // Ingress already refuses assertion_only; a later internal hop must not reach a pool or
+  // routed credential with it either, because that would be a silent credential swap.
+  if (hasAgentAssertionAuthorization(req.headers)) return { ok: false, response: agentAssertionUnsupportedResponse() };
   try {
     let authInputHeaders = codexRouteCredentialDomainHeaders(
       req,
@@ -332,7 +336,7 @@ export async function resolveResponsesCodexAuth(
     } else {
       // Even adapters that ignore caller auth must not retain a proxy secret for
       // a later internal hop or a future transport change.
-      const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+      const bearer = authorizationCredential(headers);
       if (bearer && isProxyAdmissionSecret(bearer, config)) {
         headers.delete("authorization");
         headers.delete("chatgpt-account-id");
@@ -343,6 +347,11 @@ export async function resolveResponsesCodexAuth(
     if (options.compactionRecoveryKind === "compaction-v1") {
       copyResponsesClientMetadata(headers, authInputHeaders, route.provider);
     }
+    // dual_header: the assertion is first-party only and travels only beside the caller's own
+    // unchanged Bearer, compared with the ORIGINAL request (injected credentials do not count).
+    if (isCanonicalOpenAiForwardProvider(route.provider) && authCtx?.kind === "main" && !substituteMainCredential) {
+      carryAgentAssertionForCallerBearer(headers, req.headers);
+    }
     return {
       ok: true,
       authCtx,
@@ -364,6 +373,7 @@ export async function resolveResponsesCodexAuth(
     if (err instanceof ForwardAdmissionCredentialError) {
       return { ok: false, response: formatErrorResponse(401, "authentication_error", err.message) };
     }
+    if (err instanceof AgentAssertionUnsupportedError) return { ok: false, response: agentAssertionUnsupportedResponse() };
     const response = mapCodexAuthContextErrorToResponse(err, {
       accountSelector: route.codexAccountNamespace,
       now: Date.now(),

package/src/server/responses/core-combo.ts

@@ -1,6 +1,7 @@
 import { effectiveAzureOutputBudget } from "../../adapters/azure";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
-import type { CodexAccountModelRefusal } from "../../combos/failover";
+import { comboCooldownRetryAfterSeconds, type CodexAccountModelRefusal } from "../../combos/failover";
+import { fallbackTriggerForStatus, guardFallbackHop } from "../../routing/fallback-policy";
 import {
   isCodexReasoningEffort,
   isDeclaredReasoningEffort,
@@ -32,6 +33,7 @@ import {
   isComboTargetInCooldown,
   snapshotComboQuotaCooldowns,
   comboExclusionReasons,
+  comboTargetSkipTrigger,
   noteComboSuccess,
   comboFailureDecision,
   advanceComboAfterFailure,
@@ -124,6 +126,20 @@ import { clientWireOf } from "../inference/client-wire";
  */
 export const COMBO_TARGET_BASE_SENDS = CODEX_TEXT_GUARDED_BUDGET_POLICY.baseSendAllowance;
 
+/**
+ * OCX-11: where a combo target physically dispatches, after provider aliases and
+ * blockedModelRedirects. A target that does not resolve keeps its configured selector; its
+ * dispatch fails on its own.
+ */
+function resolvedComboDestination(config: OcxConfig, target: { provider: string; model: string }): { provider: string; model: string } {
+  try {
+    const route = routeConcreteModel(config, `${target.provider}/${target.model}`);
+    return { provider: route.providerName, model: route.modelId };
+  } catch {
+    return { provider: target.provider, model: target.model };
+  }
+}
+
 function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId: string, label: string | undefined): string | undefined {
   if (!label) return undefined;
   const instance = configuredAnthropicInstance(config, providerName);
@@ -638,6 +654,30 @@ export async function executeComboResponses(
       ? clientCancelledResponse()
       : comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, targetEligible));
   }
+  // OCX-11: an ordered failover combo that starts on a later target than its first one, for any
+  // reason (cooling down, provider disabled, cached quota spent, ineligible for this request),
+  // makes a proactive hop, so the fallback policy decides before anything is sent. Both ends are
+  // the resolved destinations, after provider aliases and blockedModelRedirects.
+  const primaryTarget = combo.targets[0];
+  // An allowed hop is recorded only once its dispatch is admitted below.
+  let pendingHopCommit: (() => void) | undefined;
+  if (!toolLoopPin && (combo.strategy ?? "failover") === "failover" && primaryTarget
+    && targetKey(primaryTarget) !== targetKey(pick.target)) {
+    const primaryCooling = isComboTargetInCooldown(comboId, primaryTarget, initialNow);
+    const proactive = guardFallbackHop(config, {
+      site: "combo",
+      route: `combo/${comboId}`,
+      aliases: [requestedModel],
+      from: resolvedComboDestination(config, primaryTarget),
+      to: resolvedComboDestination(config, pick.target),
+      trigger: primaryCooling ? "cooldown" : comboTargetSkipTrigger(config, primaryTarget, initialNow),
+      admission: options.admission,
+      retryAfter: primaryCooling ? comboCooldownRetryAfterSeconds(comboId, initialNow) ?? null : null,
+      now: initialNow,
+    });
+    if (!proactive.ok) return proactive.response;
+    pendingHopCommit = proactive.commit;
+  }
   let jevDecision: JevDecision | undefined;
   if (combo.strategy === "jev" && !toolLoopPin) {
     const choices = eligibleJevComboChoices(config, comboId, targetEligible, Date.now());
@@ -760,6 +800,9 @@ export async function executeComboResponses(
   // no-more-targets branch; a budget refusal ends the ladder one iteration later, where that
   // iteration's own `childLog` is already out of scope.
   let lastFailedChildLog: RequestLogContext | undefined;
+  // The target behind `lastFailure`, so the next dispatch can tell a hop from a same-target retry.
+  let lastFailedTarget: { provider: string; model: string } | undefined;
+  let lastFailedRetryAfter: string | undefined;
   // The exhausted-combo mapping below runs outside the loop, where `failure.upstreamCode`
   // is gone, so carry the loop's own classification decision instead of re-deriving a
   // weaker one from the status alone (#4149).
@@ -812,7 +855,29 @@ export async function executeComboResponses(
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
+    // The physical destination after provider aliases and blockedModelRedirects: hops are
+    // classified by where the request really goes, not by the selector the combo names.
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
+    // OCX-11: every later dispatch after a failure is a hop when the target changed. One check
+    // here covers the ordinary failover pick and the recovery picks alike.
+    if (!firstComboTarget && lastFailure && lastFailedTarget) {
+      const hop = guardFallbackHop(config, {
+        site: "combo",
+        route: `combo/${comboId}`,
+        aliases: [requestedModel],
+        from: lastFailedTarget,
+        to: { provider: targetRoute.providerName, model: targetRoute.modelId },
+        trigger: fallbackTriggerForStatus(lastFailure.status),
+        admission: options.admission,
+        failureStatus: lastFailure.status,
+        retryAfter: lastFailedRetryAfter ?? null,
+      });
+      if (!hop.ok) {
+        if (lastFailedChildLog) adoptFailedChildLog(lastFailedChildLog);
+        return hop.response;
+      }
+      pendingHopCommit = hop.commit;
+    }
     // The inherited spend tracker observes this parent log, before the child has its own label.
     logCtx.spendPoolId = targetRoute.providerName;
     // Combo prepays before its child normalizes the route; the parent tracker must
@@ -851,6 +916,9 @@ export async function executeComboResponses(
       // an earlier one already recorded one.
       return exhaustedFailure();
     }
+    // Admitted: only now is a guarded hop to this target recorded as taken.
+    pendingHopCommit?.();
+    pendingHopCommit = undefined;
     const initialSend = hopDecision?.allowed ? { permit: hopDecision.permit, producerOwned: false } : undefined;
     try {
     comboTargetsDispatched += 1;
@@ -1147,6 +1215,9 @@ export async function executeComboResponses(
       quotaFailedChildLog = childLog;
     }
     lastFailedChildLog = childLog;
+    // The failed child's resolved destination, so the next hop compares physical targets.
+    lastFailedTarget = { provider: targetRoute.providerName, model: targetRoute.modelId };
+    lastFailedRetryAfter = failure.retryAfter;
     // A replacement that answers 200 is unmarked, and its zero-output failure only exists once
     // preflight has rebuilt the stream as a fresh Response. A spent grant never hops: a status the
     // client would resend becomes the refusal, and anything else reaches the client as it is.

package/src/server/responses/encrypted-payload.ts

@@ -265,13 +265,13 @@ export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
   // codex-rs appends one agent_message (any of the four codex-rs message types) at the
   // current input tail. Historical
   // agent messages may be adjacent in full-history bodies; they must not poison the
-  // later task. compaction_trigger/additional_tools are trailing metadata rather than
-  // a newer user turn.
+  // later task. compaction_trigger/additional_tools/configuration_update are trailing
+  // metadata rather than a newer user turn; Codex may record an effort update after the task.
   let index = input.length - 1;
   while (index >= 0) {
     const item = input[index];
     const type = item && typeof item === "object" ? (item as { type?: unknown }).type : undefined;
-    if (type !== "compaction_trigger" && type !== "additional_tools") break;
+    if (type !== "compaction_trigger" && type !== "additional_tools" && type !== "configuration_update") break;
     index -= 1;
   }
   const item = input[index];

package/src/server/responses/main-hard-lock-routing.ts

@@ -1,8 +1,8 @@
 import type { OcxConfig } from "../../types";
 import { resolveComboId } from "../../combos";
-import { isBareOpenAiFamilyModel, previewRouteModel } from "../../router";
+import { isBareOpenAiFamilyModel, previewRouteModel, routeConcreteModel } from "../../router";
 import { resolveChosenTarget } from "./shadow-target-availability";
-import { getRoutingProfile, resolvePolicyProfileId } from "../../routing/profile";
+import { getRoutingProfile, resolvePolicyProfileId, type NormalizedRoutingProfile } from "../../routing/profile";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
 import {
   getMainAccountHardLockStatus,
@@ -12,6 +12,7 @@ import { codexQuotaScopeForModel } from "../../codex/routing/health-store";
 import { getEligiblePoolAccounts } from "../../codex/routing/selection";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
+import { FallbackRefusedError, guardFallbackHop, type FallbackAdmission, type FallbackTarget } from "../../routing/fallback-policy";
 /** Resolves to a synchronous ownership proof, or null when the caller does not own the locked main. */
 export type MainHardLockCallerCheck = (sourceModel: string) => Promise<(() => boolean) | null>;
 
@@ -81,6 +82,7 @@ export async function applyMainHardLockFallbackOverride(
   config: OcxConfig,
   now?: number,
   callerCheck?: MainHardLockCallerCheck,
+  admission?: FallbackAdmission,
 ): Promise<MainHardLockFallbackOverride | null> {
   const parsed = rawModelOf(body);
   if (!parsed) return null;
@@ -120,6 +122,21 @@ export async function applyMainHardLockFallbackOverride(
     }
   }
 
+  // OCX-11: the reroute is a proactive model hop; refused, the request is answered with the
+  // fallback refusal and the body is left untouched.
+  const hop = guardFallbackHop(config, {
+    site: "hard-lock",
+    route: parsed.model,
+    from: { provider: OPENAI_CODEX_PROVIDER_ID, model: parsed.model },
+    to: hardLockTargetOf(config, parsed.model, fallback.model),
+    trigger: "hard_lock",
+    admission,
+    ...(now !== undefined ? { now } : {}),
+  });
+  if (!hop.ok) throw new FallbackRefusedError(hop.response);
+  // The rewrite is this site's admission: the body now names the fallback model.
+  hop.commit();
+
   parsed.raw.model = fallback.model;
   if (fallback.reasoningEffort !== undefined) {
     const reasoning = parsed.raw.reasoning;
@@ -132,3 +149,38 @@ export async function applyMainHardLockFallbackOverride(
   }
   return { sourceModel: parsed.model, targetModel: fallback.model };
 }
+
+/**
+ * The hop's destination for the fallback policy, read from config only. A routing profile picks
+ * its candidate from request-history evidence, and evaluating it here would open that index under
+ * OPENCODEX_HOME just to classify the hop (on Windows the open handle then outlives the request's
+ * home); the profile's own dispatch still evaluates it. Its declared candidates are classified
+ * instead, as the hop the profile could take: a candidate on another provider makes it a provider
+ * hop. Combos, account namespaces and concrete targets resolve from config alone.
+ */
+function hardLockTargetOf(config: OcxConfig, sourceModel: string, model: string): FallbackTarget {
+  const policyId = resolvePolicyProfileId(config, model);
+  const profile = policyId ? getRoutingProfile(config, policyId) : undefined;
+  if (profile) return profileHopTarget(config, sourceModel, profile);
+  try {
+    const route = previewRouteModel(config, model);
+    return { provider: route.providerName, model: route.modelId };
+  } catch {
+    const slash = model.indexOf("/");
+    return slash > 0 ? { provider: model.slice(0, slash), model: model.slice(slash + 1) } : { provider: "", model };
+  }
+}
+
+function profileHopTarget(config: OcxConfig, sourceModel: string, profile: NormalizedRoutingProfile): FallbackTarget {
+  const targets = profile.candidates.map((candidate): FallbackTarget => {
+    try {
+      const route = routeConcreteModel(config, candidate.provider + "/" + candidate.model);
+      return { provider: route.providerName, model: route.modelId };
+    } catch {
+      return { provider: candidate.provider, model: candidate.model };
+    }
+  });
+  return targets.find(target => target.provider !== OPENAI_CODEX_PROVIDER_ID)
+    ?? targets.find(target => target.model !== sourceModel)
+    ?? { provider: OPENAI_CODEX_PROVIDER_ID, model: sourceModel };
+}

package/src/server/responses/policy-fallback.ts

@@ -13,6 +13,7 @@ import { resolvePolicyProfileId } from "../../routing/profile";
 import { parseSyntheticRowId } from "../fast-row";
 import { routeConcreteModel } from "../../router";
 import { isPolicyCandidateRefusal, policyWireDestination, type PolicyRequestScope } from "./policy-request-scope";
+import { fallbackTriggerForStatus, guardFallbackHop } from "../../routing/fallback-policy";
 
 type CoreHandler = typeof handleResponsesCore;
 type CoreOptions = Parameters<CoreHandler>[3];
@@ -25,6 +26,23 @@ function candidateKey(candidate: Pick<RouteCandidateTrace, "provider" | "model">
   return `${candidate.provider}\u0000${candidate.model}`;
 }
 
+/**
+ * OCX-11: the destination a candidate physically dispatches to, after provider aliases and
+ * blockedModelRedirects, so the fallback guard compares where requests really go. A candidate
+ * that does not resolve keeps its own selector.
+ */
+function resolvedPolicyTarget(
+  config: OcxConfig,
+  candidate: Pick<RouteCandidateTrace, "provider" | "model">,
+): { provider: string; model: string } {
+  try {
+    const routed = routeConcreteModel(config, `${candidate.provider}/${candidate.model}`);
+    return { provider: routed.providerName, model: routed.modelId };
+  } catch {
+    return { provider: candidate.provider, model: candidate.model };
+  }
+}
+
 function staysWithinPolicyAfterRedirect(
   config: OcxConfig,
   policyEligibility: ReadonlySet<string>,
@@ -219,12 +237,32 @@ export async function handleResponsesWithPolicyFallback(
   policyScope.triedDestinations.add(policyScope.preparedDestination ?? policyWireDestination({
     providerName: initialTrace.selected.provider, modelId: initialTrace.selected.model,
   }));
+  let current = resolvedPolicyTarget(config, initialTrace.selected);
+  const policyRoute = `policy/${initialTrace.profile!.id}`;
 
   while (!storedPool401ReplayDispatched && await shouldHopPolicyCandidate(response, req.signal)) {
     if (req.signal.aborted) return response;
     const next = rankPolicyFallbackCandidates(initialTrace, tried)
       .find(candidate => staysWithinPolicyAfterRedirect(config, policyEligibility, candidate, policyScope.triedDestinations));
     if (!next) return response;
+    // OCX-11: the next candidate is a hop; the fallback policy decides before it is sent, on the
+    // redirected destination the guard above already validated.
+    const nextTarget = resolvedPolicyTarget(config, next);
+    const hop = guardFallbackHop(config, {
+      site: "routing-profile",
+      route: policyRoute,
+      aliases: [initialRequestedModel ?? initialTrace.requestedModel],
+      from: current,
+      to: nextTarget,
+      trigger: fallbackTriggerForStatus(response.status),
+      admission: options.admission,
+      failureStatus: response.status,
+      retryAfter: response.headers.get("retry-after"),
+    });
+    if (!hop.ok) {
+      try { await response.body?.cancel(); } catch { /* the refusal replaces this body */ }
+      return hop.response;
+    }
     tried.add(candidateKey(next));
 
     // Retain the failed response's log owner until a candidate actually replaces it. This is
@@ -243,7 +281,12 @@ export async function handleResponsesWithPolicyFallback(
             if (!Object.hasOwn(failureLog, key)) Reflect.deleteProperty(logCtx, key);
           }
           Object.assign(logCtx, failureLog);
-        } else response = nextResponse;
+        } else {
+          // Dispatched: only a candidate that was not locally skipped counts as a taken hop.
+          hop.commit();
+          response = nextResponse;
+          current = nextTarget;
+        }
         if (policyScope.preparedDestination) policyScope.triedDestinations.add(policyScope.preparedDestination);
       } catch (error) {
         const overload = requestPacingOverloadResponse(error);

package/src/server/responses/request-prepare.ts

@@ -160,6 +160,7 @@ import {
 import { acquireUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { applyCompactionRoutingOverride, compactionRoutingKeepsProviderIdentity } from "./compaction-routing";
 import { applyMainHardLockFallbackOverride } from "./main-hard-lock-routing";
+import { FallbackRefusedError } from "../../routing/fallback-policy";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import {
   conversationStateBindingFromAuth,
@@ -367,10 +368,11 @@ export async function prepareResponsesRequest(
     && !shadowCallIntercepted && !shadowCallMatches && !memoryModelApplies && !threadSpawn && inboundWire === "responses") {
     try {
       options.mainHardLockFallbackOverride = await applyMainHardLockFallbackOverride(
-        body, config, undefined, mainHardLockFallbackCallerCheck(req, config, options),
+        body, config, undefined, mainHardLockFallbackCallerCheck(req, config, options), options.admission,
       );
     } catch (error) {
       if (options.abortSignal?.aborted || req.signal.aborted) return clientCancelledResponse();
+      if (error instanceof FallbackRefusedError) return error.response;
       const mapped = mapCodexAuthContextErrorToResponse(error, { now: Date.now() });
       if (mapped) return mapped;
       throw error;
@@ -1005,7 +1007,9 @@ export async function prepareResponsesRequest(
       subagentFallbackModelEligibleAccountIdsForModel,
       fallbackChain,
       candidateRoute => canPassThroughEncryptedV2AgentTask(candidateRoute, inboundWire),
+      options.admission,
     );
+    if (fallback?.refusal) return fallback.refusal;
     if (fallback) {
       (logCtx as unknown as Record<string, unknown>).subagentModelFallbackFrom = fallback.from;
       (logCtx as unknown as Record<string, unknown>).subagentModelFallbackTo = fallback.to;
@@ -1219,11 +1223,15 @@ export async function prepareResponsesRequest(
                 recoverySelectionOptions,
                 subagentFallbackAccountPreview,
                 subagentFallbackModelEligibleAccountIdsForModel,
+                undefined,
+                undefined,
+                options.admission,
               );
             } finally {
               recoverySelectionAdmission?.release();
             }
           })();
+          if (fallback?.refusal) return fallback.refusal;
           if (fallback) {
             (logCtx as unknown as Record<string, unknown>).subagentModelFallbackFrom = fallback.from;
             (logCtx as unknown as Record<string, unknown>).subagentModelFallbackTo = fallback.to;

package/src/server/restart-replacement.ts

@@ -214,6 +214,9 @@ export interface ReplacementStartIo extends ReplacementReadinessIo {
   logPath?: string | null;
   parentPid?: number;
   retryDelayMs?: number;
+  /** Exit waits for a terminated not-ready replacement; tests shorten them. */
+  termWaitMs?: number;
+  killWaitMs?: number;
 }
 
 export interface ReplacementStartRequest {
@@ -227,10 +230,19 @@ export interface ReplacementStartRequest {
   waitForHealth: boolean;
   /** The replacement's environment, already prepared by the caller; the parent marker is added here. */
   env: NodeJS.ProcessEnv;
+  /**
+   * What a replacement still unready at the deadline means. `handoff` (the default, every
+   * standalone restart) hands off to it anyway, because the parent is about to exit and release
+   * what it may be waiting for. `terminate` is for a parent that keeps serving when the
+   * replacement fails (the client runtime): the replacement is stopped, its exit is observed, and
+   * the call rejects with `not_ready`, so nothing that may still bind the port survives.
+   */
+  notReady?: "handoff" | "terminate";
 }
 
 type AttemptOutcome =
-  | { kind: "spawned" | "ready" | "not-ready"; pid: number | undefined }
+  | { kind: "spawned" | "ready"; pid: number | undefined }
+  | { kind: "not-ready"; pid: number | undefined; terminate: () => Promise<boolean> }
   | { kind: "early-exit"; pid: number | undefined; code: number | null; signal: NodeJS.Signals | null };
 
 function pinnedPort(port: number | undefined): number | undefined {
@@ -314,7 +326,11 @@ function runReplacementAttempt(
       void waitForReplacementReady(child.pid, parentPid, expectedPort, { ...io, cancelled: () => settled }).then(
         // Never kill a live ordinary start at its valid reclaim boundary. Parent exit is the
         // final resource release the child may still be waiting for.
-        ready => { settle({ kind: ready ? "ready" : "not-ready", pid: child.pid }); },
+        ready => {
+          settle(ready
+            ? { kind: "ready", pid: child.pid }
+            : { kind: "not-ready", pid: child.pid, terminate: () => terminateReplacement(child, io) });
+        },
         err => { settle({ error: err }); },
       );
     };
@@ -369,6 +385,11 @@ export async function spawnReplacementStart(
         continue;
       }
       if (outcome.kind === "not-ready") {
+        if (request.notReady === "terminate") {
+          const exited = await outcome.terminate();
+          log?.note(`replacement pid ${pid} did not answer within the readiness window; ${exited ? "stopped it" : "it did not exit after SIGKILL"}`);
+          throw handoffError(exited ? "not_ready" : "not_ready_unstopped");
+        }
         console.warn("Restart replacement is still starting after the readiness window; handing off to it anyway");
         log?.note(`replacement pid ${pid} is still starting after the readiness window; handing off anyway`);
       } else {
@@ -380,3 +401,30 @@ export async function spawnReplacementStart(
     log?.close();
   }
 }
+
+/** Exit-observation budgets for {@link terminateReplacement}. */
+export const REPLACEMENT_TERM_WAIT_MS = 3_000;
+export const REPLACEMENT_KILL_WAIT_MS = 2_000;
+
+function waitForChildExit(child: ChildProcess, ms: number, sleep: (ms: number) => Promise<void>): Promise<boolean> {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
+  return new Promise<boolean>(resolve => {
+    let done = false;
+    const finish = (exited: boolean) => { if (!done) { done = true; child.off("exit", onExit); resolve(exited); } };
+    const onExit = () => finish(true);
+    child.once("exit", onExit);
+    void sleep(ms).then(() => finish(child.exitCode !== null || child.signalCode !== null));
+  });
+}
+
+/**
+ * Stop a replacement that never answered: SIGTERM, wait for its exit, then SIGKILL and wait again.
+ * True only once the exit was observed; a kill call alone is not proof the port is free.
+ */
+async function terminateReplacement(child: ChildProcess, io: ReplacementStartIo): Promise<boolean> {
+  const sleep = io.sleep ?? Bun.sleep;
+  try { child.kill("SIGTERM"); } catch { /* exited between the check and the signal */ }
+  if (await waitForChildExit(child, io.termWaitMs ?? REPLACEMENT_TERM_WAIT_MS, sleep)) return true;
+  try { child.kill("SIGKILL"); } catch { /* exited between the check and the signal */ }
+  return waitForChildExit(child, io.killWaitMs ?? REPLACEMENT_KILL_WAIT_MS, sleep);
+}

package/src/server/ws-bridge.ts

@@ -12,6 +12,7 @@ import { sseDataPayload as parseSseBlock } from "./sse-payload-rewrite";
 import { safeResponseHeaders } from "./safe-response-headers";
 import type { AudioSocketTarget } from "./audio-dictation";
 import type { CodexWebSocketActivity } from "../codex/websocket-activity";
+import { AGENT_ASSERTION_HEADER } from "../lib/authorization-scheme";
 
 export { safeResponseHeaders } from "./safe-response-headers";
 
@@ -131,6 +132,10 @@ export function selectForwardHeaders(
   if (codexOverride) {
     selected.set("authorization", `Bearer ${codexOverride.accessToken}`);
     selected.set("chatgpt-account-id", codexOverride.chatgptAccountId);
+  } else {
+    // Kept for the WS turn pipeline, which drops it again everywhere except first-party Direct.
+    const assertion = headers.get(AGENT_ASSERTION_HEADER);
+    if (assertion) selected.set(AGENT_ASSERTION_HEADER, assertion);
   }
   return selected;
 }

package/src/service/cli.ts

@@ -11,6 +11,7 @@ import { statusWinswRaw, type WinswStatus } from "../lib/winsw";
 import { withWindowsServiceMutationLock } from "../lib/windows-service-mutation-lock";
 import { maybeShowStarPrompt } from "../cli/star-prompt";
 import { serviceStatusReport } from "./diagnostics";
+import { collectServiceStatusJson } from "./status-json";
 import { assertServiceAuthEnvironment } from "./auth-preflight";
 import { assertServiceEnvironmentMatchesInstall } from "./guards";
 import { resolveServiceListenPort } from "./definition";
@@ -47,10 +48,14 @@ export function normalizeServiceSubcommand(sub?: string): string {
   return sub ?? "install";
 }
 
+const SERVICE_JSON_STATUS_ONLY = "--json applies to `ocx service status` only.";
+
 export interface ParsedServiceArgs {
   sub: string;
   backend: ServiceBackend | null;
   invalid: string[];
+  /** `--json`: accepted for `status` only; planServiceCommand rejects it elsewhere. */
+  json: boolean;
 }
 
 export type ServiceInstallationState = "installed" | "absent" | "unknown";
@@ -140,6 +145,9 @@ export function planServiceCommand(
   if (parsed.invalid.length > 0) {
     return { ok: false, message: `Unknown service option: ${parsed.invalid.join(" ")}` };
   }
+  if (parsed.json && parsed.sub !== "status") {
+    return { ok: false, message: SERVICE_JSON_STATUS_ONLY };
+  }
   if (parsed.backend && parsed.sub !== "install") {
     return { ok: false, message: "--native/--scheduler apply to `ocx service install` only; other subcommands use the installed backend." };
   }
@@ -174,9 +182,11 @@ export function planServiceCommand(
 export function parseServiceArgs(args: string[]): ParsedServiceArgs {
   let sub: string | undefined;
   let backend: ServiceBackend | null = null;
+  let json = false;
   const invalid: string[] = [];
   for (const arg of args) {
-    if (arg === "--native") {
+    if (arg === "--json") json = true;
+    else if (arg === "--native") {
       if (backend === "scheduler") { invalid.push("--native (conflicts with --scheduler)"); continue; }
       backend = "native";
     }
@@ -188,7 +198,7 @@ export function parseServiceArgs(args: string[]): ParsedServiceArgs {
     else if (sub === undefined) sub = arg;
     else invalid.push(arg);
   }
-  return { sub: normalizeServiceSubcommand(sub), backend, invalid };
+  return { sub: normalizeServiceSubcommand(sub), backend, invalid, json };
 }
 
 /** Remove the service credential only when no client connection can own it. */
@@ -243,6 +253,12 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       process.exitCode = 1;
       return;
     }
+  // Answered before platformOps() resolves: the JSON status reaches no install, start, stop,
+  // repair or migration path, and an unsupported platform still gets a document, not an exit.
+  if (command === "status" && parsed.json) {
+    console.log(JSON.stringify(await collectServiceStatusJson(), null, 2));
+    return;
+  }
   if (command === "repair" || command === "restart") {
     const verb: ServiceRepairVerb = command === "restart" ? "restart" : "repair";
     assertServiceEnvironmentMatchesInstall();
@@ -488,6 +504,13 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
   };
 
   const preliminary = parseServiceArgs(filteredArgs);
+  // `claim` parses its own --json. Any other verb is refused here, before the Desktop check
+  // and the Windows mutation lock, so a misplaced --json never reaches either.
+  if (preliminary.json && preliminary.sub !== "status" && preliminary.sub !== "claim") {
+    console.error(SERVICE_JSON_STATUS_ONLY);
+    process.exitCode = 1;
+    return;
+  }
   if (preliminary.invalid.length === 0) {
     const refusal = desktopServiceCommandRefusal(preliminary.sub, undefined, supervisionLatch);
     if (refusal) {