@bitkyc08/opencodex 2.91.0 → 2.92.0

package/src/server/index/link-relay-sessions.ts

@@ -1,7 +1,7 @@
 import type { Server } from "bun";
 import {
   LINK_RELAY_AUTH_PATH, LINK_RELAY_AUTH_TIMEOUT_MS, LINK_RELAY_AUTH_VERSION,
-  LINK_RELAY_SESSION_HEADER, linkRelayProof, linkRelayProofMatches,
+  LINK_RELAY_PROBE_HEADER, LINK_RELAY_SESSION_HEADER, linkRelayProof, linkRelayProofMatches,
 } from "../../link/relay-auth";
 import { parseLinkPeerReport, type LinkPeerObservations } from "../../link/peer-report";
 
@@ -81,13 +81,17 @@ export function createLinkRelaySessions(options: LinkRelaySessionOptions) {
           linkRelayProofMatches(q.get("proof"), linkRelayProof(candidate, "caller", keyId, linkId, nonce)));
         if (!fingerprint) return refuse();
         options.peers?.observe(linkId, LINK_RELAY_AUTH_VERSION, parseLinkPeerReport(req.headers));
-        const release = acquire();
-        const timer = setTimeout(() => { consume(nonce)?.release(); }, reservationMs);
-        sessions.set(nonce, { peer, keyId, linkId, fingerprint, release, timer, expiresAt: Date.now() + reservationMs });
-        return new Response(null, { status: 204, headers: {
+        const answer = () => new Response(null, { status: 204, headers: {
           "x-opencodex-link-proof": linkRelayProof(fingerprint, "listener", keyId, linkId, nonce)!,
           "cache-control": "no-store",
         } });
+        // A readiness probe closes after this answer and sends no data request, so it reserves
+        // nothing: no session to consume, no capacity and no drain lease held until expiry.
+        if (req.headers.get(LINK_RELAY_PROBE_HEADER) === "1") return answer();
+        const release = acquire();
+        const timer = setTimeout(() => { consume(nonce)?.release(); }, reservationMs);
+        sessions.set(nonce, { peer, keyId, linkId, fingerprint, release, timer, expiresAt: Date.now() + reservationMs });
+        return answer();
       }
       const nonce = req.headers.get(LINK_RELAY_SESSION_HEADER);
       let release: () => void;

package/src/server/index/optional-listeners.ts

@@ -14,6 +14,7 @@ import {
   type LinkListenerStatus,
 } from "./link-listener";
 import { createLinkSupervisor, type LinkSupervisor } from "../../link/supervisor";
+import { flushLinkDiagnostics, recordLinkDiagnostic } from "../../link/diagnostics";
 import { linkManagementRouteAllowed } from "../../link/management-routes";
 import { linkChildParityRouteAllowed } from "../../link/child-parity";
 import { saveConfigPreservingClaudeCode } from "../../config/live-reconcile";
@@ -56,6 +57,9 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
   let activeConfig: OcxConfig | undefined;
   let stopJevQuotaActivation: (() => void) | undefined;
   const supervisor = createLinkSupervisor({
+    // Tunnel state changes and their causes reach <configDir>/link/diagnostics.jsonl (bounded).
+    diagnostic: recordLinkDiagnostic,
+    flushDiagnostics: flushLinkDiagnostics,
     apiKeys: () => activeConfig?.apiKeys ?? [],
     revokeApiKey: id => {
       if (!activeConfig) return false;

package/src/server/local-management-read-client.ts

@@ -51,7 +51,7 @@ export interface LocalManagementReadRequestDeps extends LocalManagementReadDeps
  */
 export async function fetchBoundLocalManagementRead(
   target: LiveProxy,
-  path: LocalManagementReadPath,
+  path: LocalManagementReadPath | `${LocalManagementReadPath}?${string}`,
   deps: LocalManagementReadRequestDeps = {},
 ): Promise<LocalManagementReadResult> {
   if (
@@ -89,6 +89,8 @@ export async function fetchBoundLocalManagementRead(
     const timeoutMs = deps.timeoutMs ?? 4_000;
     const url = `http://${probeHostname(target.hostname)}:${target.port}${path}`;
     const init: RequestInit = {
+      redirect: "error",
+      credentials: "omit",
       headers: {
         [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
         [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,

package/src/server/management/combo-routes.ts

@@ -208,7 +208,6 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const {
       clearComboSelectionState,
       clearComboTargetCooldowns,
-      comboConfigError,
       comboDisabledModelId,
       comboDisabledModelSelectors,
       comboModelId,
@@ -225,6 +224,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...requestedCombo,
       ...(!Object.hasOwn(requestedCombo, "decisionQuotaSignals") && requestedCombo.strategy === "jev" && previous?.decisionQuotaSignals !== undefined ? { decisionQuotaSignals: previous.decisionQuotaSignals } : {}),
       ...(!Object.hasOwn(requestedCombo, "decisionQuotaTiers") && requestedCombo.strategy === "jev" && previous?.decisionQuotaTiers !== undefined ? { decisionQuotaTiers: previous.decisionQuotaTiers } : {}),
+      // The dashboard does not edit the session pin (#7525): an omitted field keeps it on a JEV save.
+      ...(!Object.hasOwn(requestedCombo, "sessionPin") && requestedCombo.strategy === "jev" && previous?.sessionPin != null ? { sessionPin: previous.sessionPin } : {}),
       ...(!Object.hasOwn(requestedCombo, "allowMeteredTargets") && previous?.allowMeteredTargets === true
         ? { allowMeteredTargets: true }
         : {}),
@@ -257,7 +258,7 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(Array.isArray(requestedCombo.targets) && Array.isArray(previous?.targets)
         ? {
             targets: requestedCombo.targets.map(target => {
-              // A non-record entry stays as the client sent it so comboConfigError reports it.
+              // A non-record entry stays as the client sent it so comboConfigIssues reports it.
               // Reading `lastResort` off it here would throw in place of that structured 400.
               if (!isPlainRecord(target)) return target;
               if (["lastResort", "metered"].every(key => Object.hasOwn(target, key))) return target;
@@ -331,8 +332,13 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       excludeComboId: sourceId,
       normalizeDecisionModel: (model: string) => normalizeDecisionModelSelector(prospectiveConfig, model),
     };
-    const error = comboConfigError(id, effectiveCombo, config.providers, validationOptions);
-    if (error) return jsonResponse({ error }, 400);
+    // `field` names the top-level combo field of the first issue, so a client can tell a target or
+    // JEV-setting refusal from an alias or rename one without parsing the message (#7579).
+    const invalid = comboConfigIssues(id, effectiveCombo, config.providers, validationOptions)[0];
+    if (invalid) {
+      const field = invalid.path[0];
+      return jsonResponse({ error: invalid.message, ...(typeof field === "string" ? { field } : {}) }, 400);
+    }
     for (const [otherId, combo] of Object.entries(nextCombos)) {
       if (typeof combo.decisionModel !== "string") continue;
       const issue = otherId === id ? undefined : comboConfigIssues(otherId, combo, config.providers, {

package/src/server/management/link-routes.ts

@@ -6,7 +6,7 @@ import { clearCompensationFailed, compensationPath, readCompensation } from "../
 import { loadHostCandidates } from "../../link/ssh-config";
 import { newLinkId, type LinkStore } from "../../link/store";
 import { sshFailureHint, sshRunnerErrorHint } from "../../link/ssh-runner";
-import { attachLinkPeers, projectLinkStatus, type LinkStatusDto } from "../../link/status-projection";
+import { attachLinkPeers, attachLinkTunnelDiagnostics, projectLinkStatus, type LinkStatusDto } from "../../link/status-projection";
 import { homeLinkChildParity } from "../../link/child-parity";
 import { localLinkPeer } from "../../link/compatibility";
 import { packageVersion } from "../../lib/package-version";
@@ -268,8 +268,9 @@ export async function handleLinkRoutes(ctx: ManagementContext, suppliedState?: L
     if (denied) return denied;
     const store = readStoreFor(ctx);
     const listenerStatus = state.listener.status();
+    const supervisorStates = state.supervisor.status();
     const dto: LinkStatusDto = projectLinkStatus(
-      store, state.supervisor.status(), listenerStatus, ctx.config, readCompensation(),
+      store, supervisorStates, listenerStatus, ctx.config, readCompensation(),
       ctx.config.runtimeRole === "client" ? clientLinkTunnelStatus() : null,
       ctx.config.runtimeRole === "client" && ctx.config.client?.link ? clientLinkStatusIdentity(ctx.config.client.link.linkId) : null,
       linkId => homeLinkChildParity.get(linkId),
@@ -288,6 +289,8 @@ export async function handleLinkRoutes(ctx: ManagementContext, suppliedState?: L
       attachLinkPeers(dto, localLinkPeer(packageVersion("0.0.0"), buildPeerFeatures()),
         linkId => state.listener.peerObservation?.(linkId) ?? { observed: null, refused: null });
     }
+    // The same opt-in for each Home-initiated tunnel's retry progress and last failure cause.
+    if (url.searchParams.get("diagnostics") === "1") attachLinkTunnelDiagnostics(dto, supervisorStates);
     // A dashboard session also learns why it cannot join as a Child. The admin-token answer stays
     // the exact K16 document that `ocx link status` validates key by key.
     const denial = ctx.principal === "gui-session" ? joinDenied(ctx) : null;

package/src/server/management/provider-routes.ts

@@ -1726,7 +1726,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       return jsonResponse({ ok: false, latencyMs: 0, error: "Antigravity project unavailable — re-run `ocx login google-antigravity`" });
     }
     const { method, url: modelsUrl, headers } = buildModelsRequest(prov, apiKey, name, {
-      oauthApiBaseUrl: snapshot?.apiBaseUrl,
+      oauthApiBaseUrl: snapshot?.apiBaseUrl, workbuddy: snapshot?.workbuddy,
     });
     const discovery = resolveProviderModelDiscovery(name, prov);
     const started = Date.now();

package/src/server/port-reclaim.ts

@@ -405,22 +405,37 @@ async function runOwnerLookup(file: string, args: string[], timeoutMs: number):
   return stdout;
 }
 
+export type LoopbackOwnerLookupResult = {
+  kind: "match" | "mismatch" | "lookup_error" | "deadline";
+  elapsedMs: number;
+};
+
 export interface LoopbackOwnerLookupIo {
   platform?: NodeJS.Platform;
+  nowMs?: () => number;
+  scheduleDeadline?: (callback: () => void, timeoutMs: number) => () => void;
   readProc?: (path: string) => Promise<string>;
   listFds?: (path: string) => Promise<string[]>;
   readFdLink?: (path: string) => Promise<string>;
   run?: (file: string, args: string[], timeoutMs: number) => Promise<string>;
 }
 
-/** Async, bounded proof that this PID owns the IPv4 loopback LISTEN socket used by the relay. */
-export async function ownsIpv4LoopbackListener(
+/**
+ * Classify fresh IPv4 loopback LISTEN ownership within the bounded lookup deadline.
+ * Only match proves the expected PID; mismatch, inspection failure and timeout remain distinct.
+ * elapsedMs uses a monotonic clock by default, and no raw OS output is returned.
+ */
+export async function inspectIpv4LoopbackListener(
   port: number,
   expectedPid: number,
   io: LoopbackOwnerLookupIo = {},
-): Promise<boolean> {
+): Promise<LoopbackOwnerLookupResult> {
+  const now = io.nowMs ?? (() => performance.now());
+  const startedAt = now();
+  const result = (kind: LoopbackOwnerLookupResult["kind"]): LoopbackOwnerLookupResult =>
+    ({ kind, elapsedMs: Math.max(0, now() - startedAt) });
   if (!Number.isInteger(port) || port < 1 || port > 65535
-    || !Number.isSafeInteger(expectedPid) || expectedPid < 1) return false;
+    || !Number.isSafeInteger(expectedPid) || expectedPid < 1) return result("mismatch");
   const platform = io.platform ?? process.platform;
   const lookup = async (): Promise<boolean> => {
     if (platform === "linux") {
@@ -458,13 +473,40 @@ export async function ownsIpv4LoopbackListener(
     }
     return false;
   };
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const deadline = new Promise<false>(resolve => {
-    timer = setTimeout(() => resolve(false), OWNER_LOOKUP_TIMEOUT_MS);
+  const scheduleDeadline = io.scheduleDeadline ?? ((callback, timeoutMs) => {
+    const timer = setTimeout(callback, timeoutMs);
     timer.unref?.();
+    return () => clearTimeout(timer);
   });
-  try { return await Promise.race([lookup().catch(() => false), deadline]); }
-  finally { if (timer) clearTimeout(timer); }
+  let cancelDeadline: (() => void) | undefined;
+  const deadline = new Promise<LoopbackOwnerLookupResult["kind"]>(resolve => {
+    cancelDeadline = scheduleDeadline(() => resolve("deadline"), OWNER_LOOKUP_TIMEOUT_MS);
+  });
+  const inspected = lookup().then(
+    matches => matches ? "match" as const : "mismatch" as const,
+    error => {
+      const failure = error as {
+        killed?: boolean; signal?: string | null; code?: unknown; stdout?: unknown; stderr?: unknown;
+      } | null;
+      // lsof exits 1 with no output when no socket matches its selectors.
+      if (platform === "darwin" && failure?.code === 1 && !failure.killed
+        && failure.signal == null && failure.stdout === "" && failure.stderr === "") return "mismatch" as const;
+      // execFile's timeout kills with SIGTERM; other spawn/exit/buffer errors are lookup failures.
+      return failure?.killed === true && failure.signal === "SIGTERM" && failure.code === null
+        ? "deadline" as const : "lookup_error" as const;
+    },
+  );
+  try { return result(await Promise.race([inspected, deadline])); }
+  finally { cancelDeadline?.(); }
+}
+
+/** Boolean compatibility API: only a proven match admits the listener. */
+export async function ownsIpv4LoopbackListener(
+  port: number,
+  expectedPid: number,
+  io: LoopbackOwnerLookupIo = {},
+): Promise<boolean> {
+  return (await inspectIpv4LoopbackListener(port, expectedPid, io)).kind === "match";
 }
 
 /**

package/src/server/request-log-conversation.ts

@@ -172,6 +172,55 @@ export function conversationIdFromResponsesRequest(input: {
   );
 }
 
+/**
+ * Hermes Agent session affinity header for log correlation (#330).
+ * Kept separate from runtime/session identities so it cannot affect lanes or routing.
+ */
+export function conversationIdFromHermesHeader(headers: Headers): string | undefined {
+  return normalizeLogConversationId(headers.get("x-hermes-conversation-id"));
+}
+
+/**
+ * Validates and normalizes native header candidates in priority order for logging:
+ * parent-thread -> session_id -> session-id -> thread-id.
+ * Each candidate spelling is evaluated and normalized independently so an empty or
+ * whitespace-only candidate (e.g. empty session_id) cannot suppress a subsequent valid candidate.
+ */
+export function nativeLogConversationIdFromHeaders(headers: Headers): string | undefined {
+  return (
+    normalizeLogConversationId(headers.get("x-codex-parent-thread-id")) ??
+    normalizeLogConversationId(headers.get("session_id")) ??
+    normalizeLogConversationId(headers.get("session-id")) ??
+    normalizeLogConversationId(headers.get("thread-id"))
+  );
+}
+
+/** The request-log context's conversation slot; structural so callers need not import request-log. */
+export interface LogConversationSlot {
+  conversationId?: string;
+  conversationIdIsHermesFallback?: boolean;
+}
+
+/**
+ * Record a native log identity. Fills an empty slot or replaces the log-only Hermes fallback,
+ * so a native id found late (Responses preparation, a Cursor conversation created mid-turn)
+ * still wins. A caller-owned id already in the slot (routed Claude metadata) is kept.
+ */
+export function assignNativeLogConversationId(slot: LogConversationSlot, nativeId: string | undefined): void {
+  if (!nativeId || (slot.conversationId && !slot.conversationIdIsHermesFallback)) return;
+  slot.conversationId = nativeId;
+  delete slot.conversationIdIsHermesFallback;
+}
+
+/** Fill an empty slot with the log-only Hermes digest, marked so any native id replaces it. */
+export function fillHermesLogConversationFallback(slot: LogConversationSlot, headers: Headers): void {
+  if (slot.conversationId) return;
+  const hermes = conversationIdFromHermesHeader(headers);
+  if (!hermes) return;
+  slot.conversationId = hermes;
+  slot.conversationIdIsHermesFallback = true;
+}
+
 /**
  * Claude Code metadata.user_id only — never the system-hash Desktop fallback.
  * Hashes the raw user_id once (same opacity goal as inbound prompt_cache_key).

package/src/server/request-log.ts

@@ -150,6 +150,8 @@ export interface RequestLogContext extends UpstreamErrorDiagnostics {
   lastOutputAt?: number;
   /** Best-effort chat/session correlation for Logs grouping (#330). Opaque; omit when unknown. */
   conversationId?: string;
+  /** In-memory only: conversationId holds the log-only Hermes digest, which a native id replaces. */
+  conversationIdIsHermesFallback?: boolean;
   surface?: "claude" | "claude-desktop" | "grok";
   /** The matched configured key's id. Set ONLY for admissionKind "configured" —
    *  never a sentinel, so a hand-edited entry whose id happens to be "loopback"

package/src/server/responses/anthropic-thinking-recovery.ts

@@ -130,6 +130,7 @@ export function createAnthropicThinkingRecovery(
       || response.status !== "completed" || !Array.isArray(response.output) || response.output.length === 0
       || !rejectedScope
       || rejectedScope.clientThreadId !== parsed._reasoningReplayScope?.clientThreadId
+      || rejectedScope.clientPrincipalId !== parsed._reasoningReplayScope?.clientPrincipalId
       || JSON.stringify(rejectedScope.current) !== JSON.stringify(parsed._reasoningReplayScope?.current)) return;
     remembered = true;
     rememberReasoningReplayOpaqueBlobRejection(rejectedScope, rejectedPayloads);

package/src/server/responses/compact.ts

@@ -129,6 +129,7 @@ import {
   ForwardAdmissionCredentialError,
   contextPrincipalIdOf,
   hasForwardableCodexBearer,
+  resolveContextPrincipal,
   validateForwardAdmissionCredential,
 } from "../auth-cors";
 import type { DataPlaneAdmission } from "../auth-cors";
@@ -1002,7 +1003,12 @@ export async function handleResponsesCompact(
         cursorConversationId: gatewayReplayParsed._cursorConversationId,
         sessionIdHeader: sessionIdHeaderFromRequest(req.headers),
       });
-      if (clientThreadId) gatewayReplayParsed._reasoningReplayScope = { clientThreadId };
+      if (clientThreadId) {
+        gatewayReplayParsed._reasoningReplayScope = {
+          clientThreadId,
+          clientPrincipalId: resolveContextPrincipal(req, config, admission),
+        };
+      }
     }
     let compactUrl = gatewayTransport ? `${gatewayTransport.url.replace(/\/+$/, "")}/compact` : `${base}/responses/compact`;
     const compactTargetKey = `${route.providerName}|${route.modelId}|compact`;
@@ -1723,7 +1729,9 @@ export async function handleResponsesCompact(
     // The routed compaction turn is a handoff inside the same logical request, so it draws the
     // REMAINDER. Minting here is what let a native attempt spend three sends and the routed
     // fallback spend four more.
-    const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRecoveryKind: "compaction-v1", compactionRoutingOverride: options.compactionRoutingOverride, ...(admission ? { admission } : {}) });
+    // internalReq keeps only FORWARD_HEADERS, so the caller principal is resolved from req.
+    const replayPrincipal = { clientPrincipalId: resolveContextPrincipal(req, config, admission) };
+    const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRecoveryKind: "compaction-v1", compactionRoutingOverride: options.compactionRoutingOverride, replayPrincipal, ...(admission ? { admission } : {}) });
     if (req.signal.aborted) {
       void response.body?.cancel(req.signal.reason).catch(() => undefined);
       return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");

package/src/server/responses/core-combo.ts

@@ -68,7 +68,7 @@ import {
 import { codexAccountLogLabel, oauthAccountLogLabel } from "../../codex/account-label";
 import { isGenericFailoverProvider, rotateGenericOAuthAccountOn429 } from "../../oauth/generic-account-failover";
 import { codexQuotaScopeForModel, getCodexQuotaHealthSnapshot } from "../../codex/routing";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import type { AgentTaskRecoveryFailureReason } from "./agent-task-recovery";
 import {
   agentTaskRecoveryConfig,
@@ -76,6 +76,7 @@ import {
   recoverEncryptedAgentTaskWithResult,
 } from "./agent-task-recovery";
 import { isThreadSpawnRequest, supportedLadderFor } from "../effort-policy";
+import { jevChoiceEfforts } from "./jev-combo-choice";
 import { applyDroidResponsesReasoningDefault } from "../droid-reasoning-default";
 import { isPlainObject } from "../../lib/plain-data";
 import {
@@ -102,6 +103,7 @@ import type { ResponsesTerminalStatus } from "../../bridge";
 import { beginRequestAttempt, sealRequestAttemptIdentity, finishRequestAttempt } from "../request-log";
 import { rememberComboForLane } from "./combo-session-recall";
 import { COMBO_TOOL_LOOP_PIN_REASON, toolLoopPinnedPick } from "./combo-tool-loop-pin";
+import { JEV_SESSION_PIN_ROUTE_REASON, jevSessionPinScope } from "./jev-session-pin";
 import { runTurnAdapterSseResponses } from "./core-lifetime";
 import { normalizePersistedJevDecision } from "../../usage/jev-stats";
 import {
@@ -118,6 +120,7 @@ import { createComboProtocolLanes, dispatchNativeComboChild } from "./core-combo
 import { createJevModelInvoker } from "./jev-model-invoke";
 import { comboRequestedEffortLabel } from "./combo-requested-effort";
 import { clientWireOf } from "../inference/client-wire";
+import { resolveContextPrincipal } from "../auth-cors";
 
 /**
  * Sends one combo target may run on its own before the ladder moves on. A target is a whole
@@ -316,30 +319,6 @@ interface JevComboChoice {
   candidate: JevCandidate;
 }
 
-/** A target's JEV effort choices, or undefined when an explicit allowlist has none still supported. */
-function jevChoiceEfforts(
-  config: OcxConfig,
-  target: NonNullable<ReturnType<typeof getCombo>>["targets"][number],
-): OcxComboDefaultEffort[] | undefined {
-  let ladder: string[] | undefined;
-  try {
-    const route = routeConcreteModel(config, targetKey(target));
-    ladder = supportedLadderFor({ provider: route.provider, modelId: route.modelId });
-  } catch {
-    // Preserve the existing routing-failure surface. Unknown capability becomes the explicit
-    // no-effort choice rather than broadening JEV's effort allowlist.
-    ladder = undefined;
-  }
-  const supportedEfforts = (ladder ?? []).filter(isCodexReasoningEffort) as OcxComboDefaultEffort[];
-  const configuredEfforts = target.reasoningEfforts;
-  const reasoningEfforts = configuredEfforts === undefined
-    ? supportedEfforts
-    : configuredEfforts.filter(effort => supportedEfforts.includes(effort));
-  // An explicit allowlist is restrictive. If catalog capabilities drift until no configured
-  // effort remains supported, omit the target instead of silently broadening JEV's choices.
-  return configuredEfforts !== undefined && reasoningEfforts.length === 0 ? undefined : reasoningEfforts;
-}
-
 /** Enumerate the current ordinary Combo eligibility set without retaining attempted picks. */
 function eligibleJevComboChoices(
   config: OcxConfig,
@@ -358,15 +337,15 @@ function eligibleJevComboChoices(
     excluded.add(key);
     // The TypeSafe row owns a decision credential, not an inference transport.
     if (pick.target.provider === JEV_PROVIDER_ID) continue;
-    const reasoningEfforts = jevChoiceEfforts(config, pick.target);
-    if (!reasoningEfforts) continue;
+    const identity = jevChoiceEfforts(config, pick.target, combo.decisionQuotaSignals === true);
+    if (!identity) continue;
     choices.push({
       pick: { ...pick, attempted: [key] },
       candidate: {
         key,
         provider: pick.target.provider,
         model: pick.target.model,
-        reasoningEfforts,
+        ...identity,
         modelProfile: pick.target.modelProfile,
       },
     });
@@ -405,6 +384,10 @@ export async function executeComboResponses(
   if (!combo) {
     return formatErrorResponse(404, "invalid_request_error", `Unknown combo: ${comboId}`);
   }
+  // Resolve against the original request once; every bridge candidate receives the same trusted
+  // result after its provisional Authorization is removed, including an explicitly keyless result.
+  const replayPrincipal = options.replayPrincipal
+    ?? { clientPrincipalId: resolveContextPrincipal(req, config, options.admission) };
   // PF-07: present only for a Chat combo with `nativeChatCombos` on; otherwise every child
   // takes the bridge below exactly as before.
   const protocolLanes = createComboProtocolLanes({
@@ -481,6 +464,7 @@ export async function executeComboResponses(
       const unavailable = mandatoryResponsesReasoningReplayUnavailable({
         body,
         clientThreadId: reasoningReplayConversationId,
+        clientPrincipalId: replayPrincipal.clientPrincipalId,
         providerName: route.providerName,
         provider: route.provider,
         adapterName: route.provider.adapter,
@@ -623,6 +607,10 @@ export async function executeComboResponses(
     eligible: targetEligible,
     now: initialNow,
   });
+  // Opt-in JEV session pin (#7525); override routes neither read nor write it, like the lane recall.
+  const jevPin = options.compactionRoutingOverride || options.mainHardLockFallbackOverride
+    ? undefined
+    : jevSessionPinScope({ combo, comboId, admission: options.admission, lane: sessionLaneIdFromRequest(req.headers) });
 
   if (unreadableEncryptedAgentTask && !pick) {
     pick = await pickWithWait({ now: initialNow });
@@ -684,7 +672,7 @@ export async function executeComboResponses(
     const first = choices[0];
     if (!first) {
       return comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, target =>
-        targetEligible(target) && target.provider !== JEV_PROVIDER_ID && jevChoiceEfforts(config, target) !== undefined));
+        targetEligible(target) && target.provider !== JEV_PROVIDER_ID && jevChoiceEfforts(config, target, false) !== undefined));
     }
     const resolvedFailOpenEffort = resolveEffortAtOrBelow(
       "medium",
@@ -697,8 +685,13 @@ export async function executeComboResponses(
         : null,
     };
     const decisionStartedAt = Date.now();
+    const pinReuse = jevPin?.reuse(
+      choices.map(choice => choice.candidate),
+      combo.decisionQuotaSignals === true ? { config, tiers: combo.decisionQuotaTiers } : undefined,
+    );
     let decision: JevDecision;
-    try {
+    if (pinReuse?.decision) decision = pinReuse.decision;
+    else try {
       decision = await resolveJevComboDecision({
         body,
         candidates: choices.map(choice => choice.candidate),
@@ -732,6 +725,7 @@ export async function executeComboResponses(
         latencyMs: Math.max(0, Date.now() - decisionStartedAt),
       };
     }
+    if (pinReuse?.released) decision = { ...decision, pinReason: pinReuse.released };
     jevDecision = decision;
     const selected = choices.find(choice => choice.candidate.key === decision.targetKey) ?? first;
     pick = { ...selected.pick, attempted: [targetKey(selected.pick.target)] };
@@ -752,6 +746,8 @@ export async function executeComboResponses(
         : {}),
       ...(decision.usage ? { usage: decision.usage } : {}),
       ...(decision.quota ? { quota: decision.quota } : {}),
+      ...(decision.pinned ? { pinned: true } : {}),
+      ...(decision.pinReason ? { pinReason: decision.pinReason } : {}),
     });
     console.debug("[combo] JEV decision", {
       backend: decision.backend,
@@ -759,6 +755,7 @@ export async function executeComboResponses(
       effort: decision.effort,
       gate: decision.gate,
       latencyMs: decision.latencyMs,
+      ...(decision.pinReason ? { pinReason: decision.pinReason } : {}),
       ...(decision.confidence !== undefined ? { confidence: decision.confidence } : {}),
       ...(decision.chosenProbability !== undefined
         ? { chosenProbability: decision.chosenProbability }
@@ -771,7 +768,7 @@ export async function executeComboResponses(
   const decision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
   const selectedReason = options.memoryModelPhase
     ? memoryModelRouteReason(options.memoryModelPhase)
-    : toolLoopPin ? COMBO_TOOL_LOOP_PIN_REASON : undefined;
+    : toolLoopPin ? COMBO_TOOL_LOOP_PIN_REASON : jevDecision?.pinned ? JEV_SESSION_PIN_ROUTE_REASON : undefined;
   logCtx.routeDecision = selectedReason
     ? { ...decision, selected: { ...decision.selected, reason: selectedReason } }
     : decision;
@@ -858,6 +855,22 @@ export async function executeComboResponses(
     // The physical destination after provider aliases and blockedModelRedirects: hops are
     // classified by where the request really goes, not by the selector the combo names.
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
+    // The hard-lock rewrite may have previewed a different random pick. Enforce this actual
+    // first destination against the locked source, after aliases and redirects resolve.
+    if (firstComboTarget && options.mainHardLockFallbackOverride) {
+      const hop = guardFallbackHop(config, {
+        site: "combo",
+        route: `combo/${comboId}`,
+        aliases: [requestedModel],
+        from: { provider: OPENAI_CODEX_PROVIDER_ID, model: options.mainHardLockFallbackOverride.sourceModel },
+        to: { provider: targetRoute.providerName, model: targetRoute.modelId },
+        trigger: "hard_lock",
+        admission: options.admission,
+      });
+      if (!hop.ok) return hop.response;
+      const declaredCommit = pendingHopCommit;
+      pendingHopCommit = declaredCommit ? () => { declaredCommit(); hop.commit(); } : hop.commit;
+    }
     // OCX-11: every later dispatch after a failure is a hop when the target changed. One check
     // here covers the ordinary failover pick and the recovery picks alike.
     if (!firstComboTarget && lastFailure && lastFailedTarget) {
@@ -1014,6 +1027,7 @@ export async function executeComboResponses(
           && provider && provider.disabled !== true
           && currentCombo?.targets.some(target => targetKey(target) === targetKey(completedTarget))) {
           rememberComboForLane(sessionLaneIdFromRequest(req.headers), comboId, completedTarget, model, writerGeneration);
+          jevPin?.complete(targetKey(completedTarget), initialJevDecision, writerGeneration);
         }
         options.onResponseComplete?.(model);
       },
@@ -1026,6 +1040,8 @@ export async function executeComboResponses(
         if (childLog.terminalIncompleteReason !== undefined) logCtx.terminalIncompleteReason = childLog.terminalIncompleteReason;
         if (childLog.terminalErrorCode !== undefined) logCtx.terminalErrorCode = childLog.terminalErrorCode;
         if (childLog.upstreamError !== undefined) logCtx.upstreamError = childLog.upstreamError;
+        // A committed stream that ends failed is a target failure too; incomplete is an answer.
+        if (status === "failed") jevPin?.forget();
         options.onNativePassthroughTerminal?.(status);
       },
     });
@@ -1065,6 +1081,7 @@ export async function executeComboResponses(
         },
       }) : await requestDispatchers.handleResponses(childRequest, config, childLog, {
         ...options,
+        replayPrincipal,
         // A bridge child is a concrete route; the native source belongs to this loop only.
         ...(options.protocolSource ? { protocolSource: undefined } : {}),
         // After the spread: the child must run on THIS target's ladder, not on the holder the
@@ -1099,6 +1116,7 @@ export async function executeComboResponses(
         retainCancelledAttempt();
         return clientCancelledResponse();
       }
+      jevPin?.forget();
       finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
       throw error;
     }
@@ -1123,6 +1141,7 @@ export async function executeComboResponses(
           retainCancelledAttempt();
           return clientCancelledResponse();
         }
+        jevPin?.forget();
         finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
         throw error;
       }
@@ -1179,6 +1198,7 @@ export async function executeComboResponses(
         retainCancelledAttempt();
         return clientCancelledResponse();
       }
+      jevPin?.forget();
       finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
       throw error;
     }
@@ -1210,6 +1230,8 @@ export async function executeComboResponses(
     }
     attemptRetained = true;
     lastFailure = failure.response;
+    // A real target failure ends the session pin; the next turn is decided afresh (#7525).
+    jevPin?.forget();
     if (!quotaFailure && (lastFailure.status === 429 || lastFailure.status === 402)) {
       quotaFailure = lastFailure;
       quotaFailedChildLog = childLog;

package/src/server/responses/core-lifetime.ts

@@ -1,7 +1,7 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { carryResponseToolOwnership } from "./response-tool-ownership";
 import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
-import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
+import { carryReplayRefusal, isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
   isNativePassthroughSseResponse,
   markNativePassthroughSseResponse,
@@ -76,7 +76,7 @@ export function finalizeAccountLease(response: Response, release: () => void, on
   if (isEagerRelaySseResponse(response)) markEagerRelaySseResponse(wrapped);
   if (isPreinspectedJsonResponse(response)) markPreinspectedJsonResponse(wrapped);
   if (runTurnAdapterSseResponses.has(response)) runTurnAdapterSseResponses.add(wrapped);
-  return carryResponseToolOwnership(response, wrapped);
+  return carryResponseToolOwnership(response, carryReplayRefusal(response, wrapped));
 }
 
 

package/src/server/responses/core-normalize.ts

@@ -358,14 +358,17 @@ export async function applyFinalRouteRequestNormalization(args: {
 
   {
     const { nativeEffortClamp, shouldApplyNativeEffortClamp } = await import("../../codex/catalog");
+    const raw = parsed._rawBody as { reasoning?: { effort?: string } } | undefined;
+    // The parser folds `ultra` to `max` only in options.reasoning; the passthrough adapter
+    // serializes the raw body, so a raw `ultra` must reach the clamp itself (#7590).
+    const rawUltra = raw?.reasoning && typeof raw.reasoning === "object" && raw.reasoning.effort === "ultra";
     const clamped = shouldApplyNativeEffortClamp(route.providerName, route.provider, finalSelectedModelId)
-      ? nativeEffortClamp(route.modelId, parsed.options.reasoning)
+      ? nativeEffortClamp(route.modelId, rawUltra ? "ultra" : parsed.options.reasoning)
       : null;
     if (clamped) {
       parsed.options.reasoning = clamped;
-      const raw = parsed._rawBody as { reasoning?: { effort?: string } } | undefined;
       if (raw?.reasoning && typeof raw.reasoning === "object") raw.reasoning.effort = clamped;
-      logCtx.requestedEffort = `${logCtx.requestedEffort ?? "max"}->${clamped}`;
+      logCtx.requestedEffort = `${logCtx.requestedEffort ?? (rawUltra ? "ultra" : "max")}->${clamped}`;
     }
   }
   // Chat ingress cannot strip effort against a provisional policy pick. Apply the

package/src/server/responses/core-opaque-recovery.ts

@@ -547,6 +547,7 @@ export async function attemptOpaqueBlobRecovery<Failure = Response>(
   const rejectedScope = args.parsed._reasoningReplayScope
     ? {
         clientThreadId: args.parsed._reasoningReplayScope.clientThreadId,
+        clientPrincipalId: args.parsed._reasoningReplayScope.clientPrincipalId,
         ...(args.parsed._reasoningReplayScope.current
           ? { current: { ...args.parsed._reasoningReplayScope.current } }
           : {}),