@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/server/management/fallback-routes.ts

@@ -0,0 +1,75 @@
+/**
+ * `GET|PUT /api/fallback`: the OCX-11 fallback state (`ocx.fallback/1`) and its one scoped write.
+ *
+ * GET is a passive read. A Remote Link Child reaches it through the read-only link relay
+ * (`LINK_MANAGEMENT_READ_PATHS`); there it drops link aliases (`buildFallbackState` passive). PUT
+ * runs on the Home only: a Child's relay and CLI refuse writes before sending.
+ */
+import type { ManagementContext } from "./context";
+import { jsonResponse } from "../auth-cors";
+import { mutatePersistedConfig } from "../../config";
+import { isPassiveRead } from "../../lib/passive-read";
+import { readLinkStore, type LinkRecord } from "../../link/store";
+import { linkStorePath } from "../../link/paths";
+import { applyFallbackWrite, buildFallbackState, parseFallbackWrites } from "../../routing/fallback-state";
+import { managementBodyTooLargeResponse, readManagementJsonBody } from "./body";
+
+function links(ctx: ManagementContext): LinkRecord[] {
+  try {
+    return (ctx.deps.readLinkStore?.() ?? readLinkStore(linkStorePath())).links;
+  } catch {
+    return [];
+  }
+}
+
+function view(ctx: ManagementContext): Response {
+  const response = jsonResponse(buildFallbackState(ctx.config, { links: links(ctx), passive: isPassiveRead() }), 200, ctx.req, ctx.config);
+  response.headers.set("cache-control", "no-store");
+  return response;
+}
+
+export async function handleFallbackRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+  if (url.pathname === "/api/fallback" && req.method === "GET") return view(ctx);
+  if (url.pathname === "/api/fallback" && req.method === "PUT") return await writeFallback(ctx);
+  return null;
+}
+
+async function writeFallback(ctx: ManagementContext): Promise<Response> {
+  const { req, config } = ctx;
+  let body: unknown;
+  try {
+    body = await readManagementJsonBody(req);
+  } catch (error) {
+    return managementBodyTooLargeResponse(error, req, config)
+      ?? jsonResponse({ error: "invalid JSON body", code: "invalid_request" }, 400, req, config);
+  }
+  const parsed = parseFallbackWrites(body);
+  if (!parsed.ok) return jsonResponse({ error: parsed.error, code: "invalid_request" }, 400, req, config);
+  const known = links(ctx);
+  for (const write of parsed.writes) {
+    if (write.scope !== "device") continue;
+    // A link alias names its link; otherwise the key must be a known link id or data key id.
+    const byAlias = known.find(link => link.alias === write.key);
+    if (byAlias) write.key = byAlias.id;
+    // Clearing stays possible for a device that is gone (a revoked link, a deleted data key):
+    // its entry still lists in the state, and clearing a missing entry is a no-op.
+    if (write.value === null) continue;
+    const exists = known.some(link => link.id === write.key)
+      || (config.apiKeys ?? []).some(entry => entry.id === write.key);
+    if (!exists) {
+      return jsonResponse({ error: "unknown device: use a link id or alias from ocx link status, or a Hub data key id", code: "unknown_device" }, 404, req, config);
+    }
+  }
+  const outcome = mutatePersistedConfig(persisted => {
+    let changed = false;
+    for (const write of parsed.writes) changed = applyFallbackWrite(persisted, write) || changed;
+    return { changed, value: persisted.fallback === undefined ? undefined : structuredClone(persisted.fallback) };
+  });
+  if (outcome.status === "unavailable") {
+    return jsonResponse({ error: "config.json is " + outcome.reason + "; fallback settings were not saved", code: "config_unavailable" }, 409, req, config);
+  }
+  if (outcome.value === undefined) delete config.fallback;
+  else config.fallback = outcome.value;
+  return view(ctx);
+}

package/src/server/management/link-enrollment.ts

@@ -3,6 +3,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { assertSshAlias, buildExecArgv, buildFingerprintArgv, buildProbeArgv, REMOTE_COMMAND_NOT_FOUND, REMOTE_PLATFORM_UNSUPPORTED, remoteOcxArgv } from "../../link/ssh-argv";
 import { parseFingerprintLine } from "../../link/fingerprint";
+import { detectRemotePlatform, isWindowsShellRefusal, WINDOWS_CHILD_REFUSAL } from "../../link/remote-platform";
+import type { SshRunner } from "../../link/ssh-runner";
 import { LINK_CATALOG_MAX_BYTES, LINK_RELAY_VERIFY_MS, isChildHealth, linkCommandBudget, linkRestartBudget, parseChildHttp, remoteChildHttpArgv, REMOTE_CURL_PREFLIGHT } from "../../link/remote-probe";
 import { newLinkId, type LinkStore } from "../../link/store";
 import { SshRunnerError, boundHint, sshFailureHint, sshRunnerErrorHint, type SshRunResult } from "../../link/ssh-runner";
@@ -24,11 +26,23 @@ async function serialized(state: LinkRouteState, alias: string, action: () => Pr
 }
 
 function remoteFailure(result: SshRunResult, code: string, message: string): Response | null {
-  if (result.code === REMOTE_PLATFORM_UNSUPPORTED) return fail("remote_platform_unsupported", "Remote Link Children require macOS or Linux; Windows is unsupported.", 409);
+  if (result.code === REMOTE_PLATFORM_UNSUPPORTED || (result.code !== 0 && isWindowsShellRefusal(result.stderr))) return windowsRefusal();
   if (result.code === REMOTE_COMMAND_NOT_FOUND) return fail("remote_ocx_missing", "ocx was not found on the remote host.", 502, sshFailureHint(result.stderr));
   return result.code === 0 ? null : fail(code, message, 502, sshFailureHint(result.stderr));
 }
 
+function windowsRefusal(): Response {
+  return fail("remote_platform_unsupported", WINDOWS_CHILD_REFUSAL, 409);
+}
+
+/**
+ * Pre-issuance Windows gate for a failed remote command: exit 125, the English cmd/PowerShell
+ * refusal, or (for localized shells) the fixed %OS% probe against the same host key.
+ */
+async function windowsChild(runner: SshRunner, alias: string, knownHostsFile: string, result: SshRunResult): Promise<boolean> {
+  return result.code !== 0 && await detectRemotePlatform(runner, alias, knownHostsFile, result) === "windows";
+}
+
 export async function probe(ctx: ManagementContext, state: LinkRouteState): Promise<Response> {
   const value = await readManagementJsonBodyOr(ctx.req, null);
   const body = exactBody(value, ["alias"]) ?? exactBody(value, ["alias", "includeVersion"]);
@@ -44,7 +58,8 @@ export async function probe(ctx: ManagementContext, state: LinkRouteState): Prom
       const started = now();
       const result = await runner.run(buildProbeArgv({ alias, tempKnownHostsFile: path }), { timeoutMs: 30_000 });
       const latency = Math.max(0, now() - started);
-      if (result.code !== 0) return fail("probe_failed", "SSH host probing failed.", 502, sshFailureHint(result.stderr));
+      // cmd.exe and PowerShell refuse the POSIX `true` the probe runs; say Windows, not "probe failed".
+      if (result.code !== 0) return await windowsChild(runner, alias, path, result) ? windowsRefusal() : fail("probe_failed", "SSH host probing failed.", 502, sshFailureHint(result.stderr));
       const fp = await runner.run(buildFingerprintArgv(path), { timeoutMs: 10_000 });
       if (fp.code !== 0) return fail("fingerprint_failed", "The SSH host fingerprint could not be read.", 502, sshFailureHint(fp.stderr));
       const parsed = parseFingerprintLine(fp.stdout.trim());
@@ -53,6 +68,7 @@ export async function probe(ctx: ManagementContext, state: LinkRouteState): Prom
       let ocxVersion: string | undefined;
       if (body.includeVersion === true) {
         const versionResult = await runner.run(buildExecArgv({ alias, argv: remoteOcxArgv(["--version"]), knownHostsFile: path }), { timeoutMs: 30_000 });
+        if (await windowsChild(runner, alias, path, versionResult)) return windowsRefusal();
         const denied = remoteFailure(versionResult, "version_probe_failed", "The remote ocx version could not be read.");
         if (denied) return denied;
         const parsedVersion = parseVersion(versionResult.stdout);
@@ -84,7 +100,9 @@ export async function confirmHost(ctx: ManagementContext, state: LinkRouteState)
     writeFileSync(path, pending.knownHostLine + "\n", { mode: 0o600 });
     try {
       const started = now();
-      const result = await runnerFor(ctx).run(buildExecArgv({ alias, argv: remoteOcxArgv(["--version"]), knownHostsFile: path }), { timeoutMs: 30_000 });
+      const runner = runnerFor(ctx);
+      const result = await runner.run(buildExecArgv({ alias, argv: remoteOcxArgv(["--version"]), knownHostsFile: path }), { timeoutMs: 30_000 });
+      if (await windowsChild(runner, alias, path, result)) return windowsRefusal();
       const denied = remoteFailure(result, "version_probe_failed", "The remote ocx version could not be confirmed.");
       if (denied) return denied;
       const version = parseVersion(result.stdout);

package/src/server/management/link-route-state.ts

@@ -27,6 +27,8 @@ export interface LinkRouteListener {
   status(): { state: "off" | "listening" | "failed"; port: number | null; reason: string | null };
   close(): Promise<void>;
   onAuthenticatedCatalog(listener: (apiKeyId: string) => void): () => void;
+  /** Optional so route fakes stay small; without it every link reports an unknown peer. */
+  peerObservation?(linkId: string): import("../../link/peer-report").LinkPeerEntry;
 }
 
 export interface LinkRouteState {

package/src/server/management/link-routes.ts

@@ -6,7 +6,11 @@ import { clearCompensationFailed, compensationPath, readCompensation } from "../
 import { loadHostCandidates } from "../../link/ssh-config";
 import { newLinkId, type LinkStore } from "../../link/store";
 import { sshFailureHint, sshRunnerErrorHint } from "../../link/ssh-runner";
-import { projectLinkStatus, type LinkStatusDto } from "../../link/status-projection";
+import { attachLinkPeers, attachLinkTunnelDiagnostics, projectLinkStatus, type LinkStatusDto } from "../../link/status-projection";
+import { homeLinkChildParity } from "../../link/child-parity";
+import { localLinkPeer } from "../../link/compatibility";
+import { packageVersion } from "../../lib/package-version";
+import { buildPeerFeatures } from "../../remote/features";
 import { isLinkPort } from "../../link/ports";
 import { joinHome, type ClientLinkJoinDeps } from "../../client/link-join";
 import { clientLinkStatusIdentity } from "../../client/link-status";
@@ -264,10 +268,12 @@ export async function handleLinkRoutes(ctx: ManagementContext, suppliedState?: L
     if (denied) return denied;
     const store = readStoreFor(ctx);
     const listenerStatus = state.listener.status();
+    const supervisorStates = state.supervisor.status();
     const dto: LinkStatusDto = projectLinkStatus(
-      store, state.supervisor.status(), listenerStatus, ctx.config, readCompensation(),
+      store, supervisorStates, listenerStatus, ctx.config, readCompensation(),
       ctx.config.runtimeRole === "client" ? clientLinkTunnelStatus() : null,
       ctx.config.runtimeRole === "client" && ctx.config.client?.link ? clientLinkStatusIdentity(ctx.config.client.link.linkId) : null,
+      linkId => homeLinkChildParity.get(linkId),
     );
     for (const link of dto.links) {
       const failure = state.compensationFailures?.get(link.id);
@@ -277,6 +283,14 @@ export async function handleLinkRoutes(ctx: ManagementContext, suppliedState?: L
       const failure = state.compensationFailures?.get(store.links[0].id);
       if (failure) Object.assign(dto.child, { state: "failed" as const, since: failure.since, reason: failure.reason });
     }
+    // Opt-in: an older `ocx link status` validates the document key by key and would reject the
+    // added fields, so only a caller that asks for compatibility gets `local` and `peer`.
+    if (url.searchParams.get("compatibility") === "1") {
+      attachLinkPeers(dto, localLinkPeer(packageVersion("0.0.0"), buildPeerFeatures()),
+        linkId => state.listener.peerObservation?.(linkId) ?? { observed: null, refused: null });
+    }
+    // The same opt-in for each Home-initiated tunnel's retry progress and last failure cause.
+    if (url.searchParams.get("diagnostics") === "1") attachLinkTunnelDiagnostics(dto, supervisorStates);
     // A dashboard session also learns why it cannot join as a Child. The admin-token answer stays
     // the exact K16 document that `ocx link status` validates key by key.
     const denial = ctx.principal === "gui-session" ? joinDenied(ctx) : null;

package/src/server/management/provider-routes.ts

@@ -1726,7 +1726,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       return jsonResponse({ ok: false, latencyMs: 0, error: "Antigravity project unavailable — re-run `ocx login google-antigravity`" });
     }
     const { method, url: modelsUrl, headers } = buildModelsRequest(prov, apiKey, name, {
-      oauthApiBaseUrl: snapshot?.apiBaseUrl,
+      oauthApiBaseUrl: snapshot?.apiBaseUrl, workbuddy: snapshot?.workbuddy,
     });
     const discovery = resolveProviderModelDiscovery(name, prov);
     const started = Date.now();

package/src/server/management/quota-pool-routes.ts

@@ -0,0 +1,24 @@
+/**
+ * `GET /api/quota-pool`: the `ocx.quota-pool/1` read GOAT consumes (see src/quota-pool/).
+ *
+ * Same management authorization as the neighbouring reads; a Remote Link Child reaches it through
+ * the read-only link relay (`LINK_MANAGEMENT_READ_PATHS`) and a Hub client through its hub relay.
+ * The read is always passive: there is no refresh form, so nothing here can make the Home probe.
+ */
+import type { ManagementContext } from "./context";
+import { jsonResponse } from "../auth-cors";
+
+export async function handleQuotaPoolRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+  // Any query (including a stray refresh=1) is ignored: the read has no active form.
+  if (url.pathname === "/api/quota-pool" && req.method === "GET") {
+    const { readQuotaPool } = await import("../../quota-pool/assemble");
+    const result = await readQuotaPool(config);
+    const response = result.ok
+      ? jsonResponse(result.pool, 200, req, config)
+      : jsonResponse({ error: result.error }, 503, req, config);
+    response.headers.set("cache-control", "no-store");
+    return response;
+  }
+  return null;
+}

package/src/server/management/route-registry.ts

@@ -370,6 +370,9 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
   { method: "GET", path: "/api/provider-presets", module: "server/management/provider-routes", mutates: false },
   { method: "GET", path: "/api/provider-quotas", module: "server/management/provider-routes", mutates: false },
+  { method: "GET", path: "/api/quota-pool", module: "server/management/quota-pool-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The ocx.quota-pool/1 read is a machine contract GOAT consumes over management and the link relay; the CLI shows the same caches through ocx provider quota and ocx account.", owner: "ocx-1 quota pool", ownerDoc: "structure/quota-pool.md" } },
+  { method: "GET", path: "/api/fallback", module: "server/management/fallback-routes", mutates: false },
+  { method: "PUT", path: "/api/fallback", module: "server/management/fallback-routes", mutates: true },
   { method: "GET", path: "/api/provider-request-pacing", module: "server/management/provider-key-pacing-routes", mutates: false },
   { method: "GET", path: "/api/providers", module: "server/management/provider-routes", mutates: false },
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },

package/src/server/management-api.ts

@@ -161,6 +161,20 @@ async function handleLowQuotaRoutesOnDemand(ctx: ManagementContext): Promise<Res
   return handleLowQuotaRoutes(ctx);
 }
 
+/** Lazy for the same reason: the quota-pool assembler pulls every quota cache reader. */
+async function handleQuotaPoolRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/quota-pool", false)) return null;
+  const { handleQuotaPoolRoutes } = await import("./management/quota-pool-routes");
+  return handleQuotaPoolRoutes(ctx);
+}
+
+/** Lazy: the OCX-11 fallback state view and its write live off the dashboard's common path. */
+async function handleFallbackRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/fallback", false)) return null;
+  const { handleFallbackRoutes } = await import("./management/fallback-routes");
+  return handleFallbackRoutes(ctx);
+}
+
 /**
  * Lazy like the Lab and routing-profile handlers, and for the same recorded reason: this file is
  * mounted for every dashboard request, so a static import would put the workflow-budget ledger
@@ -351,6 +365,8 @@ export async function handleManagementAPI(
     ??     (await handleRequestHistoryRoutes(ctx))
     ??     (await handleQuotaResetRoutesOnDemand(ctx))
     ??     (await handleLowQuotaRoutesOnDemand(ctx))
+    ??     (await handleQuotaPoolRoutesOnDemand(ctx))
+    ??     (await handleFallbackRoutesOnDemand(ctx))
     ??     (await handleWorkflowBudgetRoutesOnDemand(ctx))
     ??     (await handleCodexAgentRoleRoutesOnDemand(ctx))
     ??     (await handleProtocolRoutesOnDemand(ctx))

package/src/server/management-auth.ts

@@ -73,6 +73,7 @@ import {
 } from "./gui-session";
 import { hasLocalDesktopSnapshotCapability } from "./local-desktop-snapshot-auth";
 import { hasLocalAccountSwitchCapability } from "./local-account-switch-auth";
+import { authorizationCredential } from "../lib/authorization-scheme";
 export type { GuiSessionBootstrap, GuiSessionRequestContext } from "./gui-session";
 
 const LOCAL_READ_REPLAY_LIMIT = 256;
@@ -545,7 +546,7 @@ function hasGuiPairCapability(
 
 function requestManagementCredential(req: Request): string | null {
   return req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
+    || authorizationCredential(req.headers)
     || null;
 }
 

package/src/server/port-reclaim.ts

@@ -405,22 +405,37 @@ async function runOwnerLookup(file: string, args: string[], timeoutMs: number):
   return stdout;
 }
 
+export type LoopbackOwnerLookupResult = {
+  kind: "match" | "mismatch" | "lookup_error" | "deadline";
+  elapsedMs: number;
+};
+
 export interface LoopbackOwnerLookupIo {
   platform?: NodeJS.Platform;
+  nowMs?: () => number;
+  scheduleDeadline?: (callback: () => void, timeoutMs: number) => () => void;
   readProc?: (path: string) => Promise<string>;
   listFds?: (path: string) => Promise<string[]>;
   readFdLink?: (path: string) => Promise<string>;
   run?: (file: string, args: string[], timeoutMs: number) => Promise<string>;
 }
 
-/** Async, bounded proof that this PID owns the IPv4 loopback LISTEN socket used by the relay. */
-export async function ownsIpv4LoopbackListener(
+/**
+ * Classify fresh IPv4 loopback LISTEN ownership within the bounded lookup deadline.
+ * Only match proves the expected PID; mismatch, inspection failure and timeout remain distinct.
+ * elapsedMs uses a monotonic clock by default, and no raw OS output is returned.
+ */
+export async function inspectIpv4LoopbackListener(
   port: number,
   expectedPid: number,
   io: LoopbackOwnerLookupIo = {},
-): Promise<boolean> {
+): Promise<LoopbackOwnerLookupResult> {
+  const now = io.nowMs ?? (() => performance.now());
+  const startedAt = now();
+  const result = (kind: LoopbackOwnerLookupResult["kind"]): LoopbackOwnerLookupResult =>
+    ({ kind, elapsedMs: Math.max(0, now() - startedAt) });
   if (!Number.isInteger(port) || port < 1 || port > 65535
-    || !Number.isSafeInteger(expectedPid) || expectedPid < 1) return false;
+    || !Number.isSafeInteger(expectedPid) || expectedPid < 1) return result("mismatch");
   const platform = io.platform ?? process.platform;
   const lookup = async (): Promise<boolean> => {
     if (platform === "linux") {
@@ -458,13 +473,40 @@ export async function ownsIpv4LoopbackListener(
     }
     return false;
   };
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const deadline = new Promise<false>(resolve => {
-    timer = setTimeout(() => resolve(false), OWNER_LOOKUP_TIMEOUT_MS);
+  const scheduleDeadline = io.scheduleDeadline ?? ((callback, timeoutMs) => {
+    const timer = setTimeout(callback, timeoutMs);
     timer.unref?.();
+    return () => clearTimeout(timer);
   });
-  try { return await Promise.race([lookup().catch(() => false), deadline]); }
-  finally { if (timer) clearTimeout(timer); }
+  let cancelDeadline: (() => void) | undefined;
+  const deadline = new Promise<LoopbackOwnerLookupResult["kind"]>(resolve => {
+    cancelDeadline = scheduleDeadline(() => resolve("deadline"), OWNER_LOOKUP_TIMEOUT_MS);
+  });
+  const inspected = lookup().then(
+    matches => matches ? "match" as const : "mismatch" as const,
+    error => {
+      const failure = error as {
+        killed?: boolean; signal?: string | null; code?: unknown; stdout?: unknown; stderr?: unknown;
+      } | null;
+      // lsof exits 1 with no output when no socket matches its selectors.
+      if (platform === "darwin" && failure?.code === 1 && !failure.killed
+        && failure.signal == null && failure.stdout === "" && failure.stderr === "") return "mismatch" as const;
+      // execFile's timeout kills with SIGTERM; other spawn/exit/buffer errors are lookup failures.
+      return failure?.killed === true && failure.signal === "SIGTERM" && failure.code === null
+        ? "deadline" as const : "lookup_error" as const;
+    },
+  );
+  try { return result(await Promise.race([inspected, deadline])); }
+  finally { cancelDeadline?.(); }
+}
+
+/** Boolean compatibility API: only a proven match admits the listener. */
+export async function ownsIpv4LoopbackListener(
+  port: number,
+  expectedPid: number,
+  io: LoopbackOwnerLookupIo = {},
+): Promise<boolean> {
+  return (await inspectIpv4LoopbackListener(port, expectedPid, io)).kind === "match";
 }
 
 /**

package/src/server/request-log-conversation.ts

@@ -172,6 +172,55 @@ export function conversationIdFromResponsesRequest(input: {
   );
 }
 
+/**
+ * Hermes Agent session affinity header for log correlation (#330).
+ * Kept separate from runtime/session identities so it cannot affect lanes or routing.
+ */
+export function conversationIdFromHermesHeader(headers: Headers): string | undefined {
+  return normalizeLogConversationId(headers.get("x-hermes-conversation-id"));
+}
+
+/**
+ * Validates and normalizes native header candidates in priority order for logging:
+ * parent-thread -> session_id -> session-id -> thread-id.
+ * Each candidate spelling is evaluated and normalized independently so an empty or
+ * whitespace-only candidate (e.g. empty session_id) cannot suppress a subsequent valid candidate.
+ */
+export function nativeLogConversationIdFromHeaders(headers: Headers): string | undefined {
+  return (
+    normalizeLogConversationId(headers.get("x-codex-parent-thread-id")) ??
+    normalizeLogConversationId(headers.get("session_id")) ??
+    normalizeLogConversationId(headers.get("session-id")) ??
+    normalizeLogConversationId(headers.get("thread-id"))
+  );
+}
+
+/** The request-log context's conversation slot; structural so callers need not import request-log. */
+export interface LogConversationSlot {
+  conversationId?: string;
+  conversationIdIsHermesFallback?: boolean;
+}
+
+/**
+ * Record a native log identity. Fills an empty slot or replaces the log-only Hermes fallback,
+ * so a native id found late (Responses preparation, a Cursor conversation created mid-turn)
+ * still wins. A caller-owned id already in the slot (routed Claude metadata) is kept.
+ */
+export function assignNativeLogConversationId(slot: LogConversationSlot, nativeId: string | undefined): void {
+  if (!nativeId || (slot.conversationId && !slot.conversationIdIsHermesFallback)) return;
+  slot.conversationId = nativeId;
+  delete slot.conversationIdIsHermesFallback;
+}
+
+/** Fill an empty slot with the log-only Hermes digest, marked so any native id replaces it. */
+export function fillHermesLogConversationFallback(slot: LogConversationSlot, headers: Headers): void {
+  if (slot.conversationId) return;
+  const hermes = conversationIdFromHermesHeader(headers);
+  if (!hermes) return;
+  slot.conversationId = hermes;
+  slot.conversationIdIsHermesFallback = true;
+}
+
 /**
  * Claude Code metadata.user_id only — never the system-hash Desktop fallback.
  * Hashes the raw user_id once (same opacity goal as inbound prompt_cache_key).

package/src/server/request-log.ts

@@ -150,6 +150,8 @@ export interface RequestLogContext extends UpstreamErrorDiagnostics {
   lastOutputAt?: number;
   /** Best-effort chat/session correlation for Logs grouping (#330). Opaque; omit when unknown. */
   conversationId?: string;
+  /** In-memory only: conversationId holds the log-only Hermes digest, which a native id replaces. */
+  conversationIdIsHermesFallback?: boolean;
   surface?: "claude" | "claude-desktop" | "grok";
   /** The matched configured key's id. Set ONLY for admissionKind "configured" —
    *  never a sentinel, so a hand-edited entry whose id happens to be "loopback"

package/src/server/responses/agent-task-recovery.ts

@@ -104,7 +104,7 @@ function findEnvelope(input: unknown): AgentEnvelope | null {
     const type = input[itemIndex] && typeof input[itemIndex] === "object"
       ? (input[itemIndex] as { type?: unknown }).type
       : undefined;
-    if (type !== "compaction_trigger" && type !== "additional_tools") break;
+    if (type !== "compaction_trigger" && type !== "additional_tools" && type !== "configuration_update") break;
     itemIndex -= 1;
   }
 

package/src/server/responses/anthropic-thinking-recovery.ts

@@ -130,6 +130,7 @@ export function createAnthropicThinkingRecovery(
       || response.status !== "completed" || !Array.isArray(response.output) || response.output.length === 0
       || !rejectedScope
       || rejectedScope.clientThreadId !== parsed._reasoningReplayScope?.clientThreadId
+      || rejectedScope.clientPrincipalId !== parsed._reasoningReplayScope?.clientPrincipalId
       || JSON.stringify(rejectedScope.current) !== JSON.stringify(parsed._reasoningReplayScope?.current)) return;
     remembered = true;
     rememberReasoningReplayOpaqueBlobRejection(rejectedScope, rejectedPayloads);

package/src/server/responses/compact.ts

@@ -129,13 +129,14 @@ import {
   ForwardAdmissionCredentialError,
   contextPrincipalIdOf,
   hasForwardableCodexBearer,
+  resolveContextPrincipal,
   validateForwardAdmissionCredential,
 } from "../auth-cors";
 import type { DataPlaneAdmission } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
 import { buildResponsesTransport, copyResponsesClientMetadata } from "../../adapters/openai-responses/transport";
-import { scrubOcxCompactionItems, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough } from "../../adapters/openai-responses/request-strips";
+import { scrubOcxCompactionItems, stripCanonicalOnlyInputItems, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough } from "../../adapters/openai-responses/request-strips";
 import { dropResponsesReasoningInputItems } from "../../adapters/openai-responses/reasoning";
 import { requiresPlaintextReasoningReplay } from "../../adapters/openai-responses/passthrough";
 import { destinationDecodesNativeCompactionBlob, isOpenAiOperatedResponsesDestination } from "../../providers/openai-tiers-destination";
@@ -1002,7 +1003,12 @@ export async function handleResponsesCompact(
         cursorConversationId: gatewayReplayParsed._cursorConversationId,
         sessionIdHeader: sessionIdHeaderFromRequest(req.headers),
       });
-      if (clientThreadId) gatewayReplayParsed._reasoningReplayScope = { clientThreadId };
+      if (clientThreadId) {
+        gatewayReplayParsed._reasoningReplayScope = {
+          clientThreadId,
+          clientPrincipalId: resolveContextPrincipal(req, config, admission),
+        };
+      }
     }
     let compactUrl = gatewayTransport ? `${gatewayTransport.url.replace(/\/+$/, "")}/compact` : `${base}/responses/compact`;
     const compactTargetKey = `${route.providerName}|${route.modelId}|compact`;
@@ -1155,7 +1161,7 @@ export async function handleResponsesCompact(
           replayBody = stripInternalChatMessageMetadataPassthrough(replayBody) as typeof replayBody;
         }
         return isOpenAiOperatedResponsesDestination(sendProvider)
-          ? replayBody : stripCanonicalOnlyTopLevelFields(replayBody);
+          ? replayBody : stripCanonicalOnlyInputItems(stripCanonicalOnlyTopLevelFields(replayBody));
       };
       const doFetch = (upstreamRecovery?: UpstreamSendRecovery) => fetchWithHeaderTimeout(
         compactUrl,
@@ -1723,7 +1729,9 @@ export async function handleResponsesCompact(
     // The routed compaction turn is a handoff inside the same logical request, so it draws the
     // REMAINDER. Minting here is what let a native attempt spend three sends and the routed
     // fallback spend four more.
-    const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRecoveryKind: "compaction-v1", compactionRoutingOverride: options.compactionRoutingOverride, ...(admission ? { admission } : {}) });
+    // internalReq keeps only FORWARD_HEADERS, so the caller principal is resolved from req.
+    const replayPrincipal = { clientPrincipalId: resolveContextPrincipal(req, config, admission) };
+    const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRecoveryKind: "compaction-v1", compactionRoutingOverride: options.compactionRoutingOverride, replayPrincipal, ...(admission ? { admission } : {}) });
     if (req.signal.aborted) {
       void response.body?.cancel(req.signal.reason).catch(() => undefined);
       return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");

package/src/server/responses/core-auth.ts

@@ -46,6 +46,7 @@ import { forceRefreshMainAccountToken } from "../../codex/main-account";
 import { rebindPoolCreditPolicy } from "../../codex/pool-credit-policy";
 import { safeCallerSessionId } from "../caller-session-identity";
 import { copyResponsesClientMetadata } from "../../adapters/openai-responses/transport";
+import { AgentAssertionUnsupportedError, agentAssertionUnsupportedResponse, authorizationCredential, carryAgentAssertionForCallerBearer, hasAgentAssertionAuthorization } from "../../lib/authorization-scheme";
 
 /** Normalize caller aliases only on native egress; preserve ingress and fallback identity. */
 export function withClaudeNativeSession(headers: Headers, provider: OcxProviderConfig, sessionId?: string): Headers {
@@ -205,6 +206,9 @@ export async function resolveResponsesCodexAuth(
   retainAccountForUploadedFiles = false,
 ): Promise<ResponsesAuthResolution> {
   let authCtx: CodexAuthContext | undefined;
+  // Ingress already refuses assertion_only; a later internal hop must not reach a pool or
+  // routed credential with it either, because that would be a silent credential swap.
+  if (hasAgentAssertionAuthorization(req.headers)) return { ok: false, response: agentAssertionUnsupportedResponse() };
   try {
     let authInputHeaders = codexRouteCredentialDomainHeaders(
       req,
@@ -332,7 +336,7 @@ export async function resolveResponsesCodexAuth(
     } else {
       // Even adapters that ignore caller auth must not retain a proxy secret for
       // a later internal hop or a future transport change.
-      const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+      const bearer = authorizationCredential(headers);
       if (bearer && isProxyAdmissionSecret(bearer, config)) {
         headers.delete("authorization");
         headers.delete("chatgpt-account-id");
@@ -343,6 +347,11 @@ export async function resolveResponsesCodexAuth(
     if (options.compactionRecoveryKind === "compaction-v1") {
       copyResponsesClientMetadata(headers, authInputHeaders, route.provider);
     }
+    // dual_header: the assertion is first-party only and travels only beside the caller's own
+    // unchanged Bearer, compared with the ORIGINAL request (injected credentials do not count).
+    if (isCanonicalOpenAiForwardProvider(route.provider) && authCtx?.kind === "main" && !substituteMainCredential) {
+      carryAgentAssertionForCallerBearer(headers, req.headers);
+    }
     return {
       ok: true,
       authCtx,
@@ -364,6 +373,7 @@ export async function resolveResponsesCodexAuth(
     if (err instanceof ForwardAdmissionCredentialError) {
       return { ok: false, response: formatErrorResponse(401, "authentication_error", err.message) };
     }
+    if (err instanceof AgentAssertionUnsupportedError) return { ok: false, response: agentAssertionUnsupportedResponse() };
     const response = mapCodexAuthContextErrorToResponse(err, {
       accountSelector: route.codexAccountNamespace,
       now: Date.now(),