@iislee/opencodex 2.31.0 → 2.35.0

package/src/responses/parser.ts

@@ -11,7 +11,7 @@ import type {
   OcxToolCall,
   OcxReasoningReplayScopeRef,
 } from "../types";
-import { namespacedToolName, toolChoiceCandidates } from "../types";
+import { createToolChoiceResolver, namespacedToolName } from "../types";
 import { responsesRequestSchema } from "./schema";
 import { providerMetadataFromResponsesFunctionCall } from "./provider-opaque-metadata";
 import { lookupReplayThoughtSignature } from "./thought-signature-replay";
@@ -45,6 +45,7 @@ type InputBlock =
   | { type: "input_text"; text: string }
   | { type: "text"; text: string }
   | { type: "input_image"; image_url?: string; file_id?: string; detail?: string }
+  | { type: "input_video"; video_url?: string }
   | { type: "input_file"; file_id?: string; filename?: string; file_data?: string };
 
 /** A usable reference string, or undefined. Empty strings and non-strings are not references. */
@@ -80,6 +81,9 @@ function inputContentParts(blocks: unknown): string | OcxContentPart[] {
       }
       // No usable reference: omit the block. A "[image: ?]" marker would claim an attachment
       // the request never carried, which is worse than dropping malformed input.
+    } else if (block.type === "input_video") {
+      const videoUrl = nonEmptyString(block.video_url);
+      if (videoUrl) parts.push({ type: "video", videoUrl });
     } else if (block.type === "input_file") {
       const b = block as { file_id?: string; filename?: string; file_data?: string };
       const fileId = nonEmptyString(b.file_id);
@@ -758,8 +762,9 @@ export function parseRequest(
   const tc = mapToolChoice(data.tool_choice);
   if (tc && typeof tc === "object") {
     const selectors = "allowedTools" in tc ? tc.allowedTools : [tc.name];
+    const resolver = createToolChoiceResolver(mergedTools);
     for (const selector of selectors) {
-      if (toolChoiceCandidates(mergedTools, selector).length > 1) {
+      if (resolver.candidateCount(selector) > 1) {
         throw new Error(`ambiguous tool_choice name: ${selector}`);
       }
     }

package/src/responses/reasoning-replay-cache.ts

@@ -29,6 +29,7 @@ import type {
 const MAX_ENTRIES = 64;
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
+const OPAQUE_BLOB_REJECTION_TTL_MS = 5 * 60 * 1000;
 const replayIdentityKey = randomBytes(32);
 const CREDENTIAL_HEADER_NAMES = new Set([
   "authorization",
@@ -58,10 +59,17 @@ interface ServingIdentityEntry {
   at: number;
 }
 
+interface OpaqueBlobRejectionEntry {
+  bytes: number;
+  at: number;
+}
+
 const entries = new Map<string, CacheEntry>();
 const servingIdentities = new Map<string, ServingIdentityEntry>();
+const opaqueBlobRejections = new Map<string, OpaqueBlobRejectionEntry>();
 let totalBytes = 0;
 let servingIdentityTotalBytes = 0;
+let opaqueBlobRejectionTotalBytes = 0;
 let clockForTests: (() => number) | null = null;
 
 const now = (): number => clockForTests?.() ?? Date.now();
@@ -142,11 +150,31 @@ function servingIdentityFor(
   return { threadId, identity: JSON.stringify(identityTuple) };
 }
 
+function opaqueBlobRejectionKeyFor(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): string | undefined {
+  const current = servingIdentityFor(scope);
+  return current ? JSON.stringify([current.threadId, current.identity]) : undefined;
+}
+
+function deleteOpaqueBlobRejection(key: string): void {
+  const entry = opaqueBlobRejections.get(key);
+  if (!entry) return;
+  opaqueBlobRejections.delete(key);
+  opaqueBlobRejectionTotalBytes -= entry.bytes;
+}
+
+function sweepExpiredOpaqueBlobRejections(at: number): void {
+  for (const [key, entry] of opaqueBlobRejections) {
+    if (at - entry.at >= OPAQUE_BLOB_REJECTION_TTL_MS) deleteOpaqueBlobRejection(key);
+  }
+}
+
 /**
- * Compare this request's route with the last successfully serving route for its client thread.
+ * Compare this request's route with the last successfully serving route for its conversation.
  * A live mismatch means replayed opaque reasoning was minted by another backend and must not be
  * forwarded to this one. Comparison deliberately does not refresh or replace the recorded route:
- * a failed candidate request did not serve the thread.
+ * a failed candidate request did not serve the conversation.
  *
  * Serving provenance uses restart-stable destination and credential dimensions so token
  * generations and other volatile credential material cannot create false route changes. Missing
@@ -164,7 +192,7 @@ export function reasoningReplayServingIdentityChanged(
   return previous !== undefined && previous.identity !== current.identity;
 }
 
-/** Record the route only after it has successfully served the client thread. */
+/** Record the route only after it has successfully served the conversation. */
 export function commitReasoningReplayServingIdentity(
   scope: OcxReasoningReplayScopeRef | undefined,
 ): void {
@@ -200,6 +228,54 @@ export function commitReasoningReplayServingIdentity(
   }
 }
 
+/**
+ * Whether this exact conversation and durable serving identity previously rejected opaque replay.
+ *
+ * The five serving dimensions deliberately match the serving record. Missing durable destination
+ * or credential identity is unknown and never falls back to process-local dimensions. The five
+ * minute TTL is shorter than the serving record's hour: a stale memo silently degrades reasoning,
+ * while expiry costs one visible recovery round trip and can safely re-establish the memo.
+ */
+export function reasoningReplayOpaqueBlobRejectionMemoized(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): boolean {
+  const key = opaqueBlobRejectionKeyFor(scope);
+  if (!key) return false;
+  const at = now();
+  sweepExpiredOpaqueBlobRejections(at);
+  return opaqueBlobRejections.has(key);
+}
+
+/** Record only after a blobless retry succeeded for this durable serving identity. */
+export function rememberReasoningReplayOpaqueBlobRejection(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): void {
+  const key = opaqueBlobRejectionKeyFor(scope);
+  if (!key) return;
+  const bytes = Buffer.byteLength(key, "utf8");
+  if (bytes > MAX_TOTAL_BYTES) return;
+  const at = now();
+  sweepExpiredOpaqueBlobRejections(at);
+  if (opaqueBlobRejections.has(key)) deleteOpaqueBlobRejection(key);
+  opaqueBlobRejections.set(key, { bytes, at });
+  opaqueBlobRejectionTotalBytes += bytes;
+  while (
+    (opaqueBlobRejectionTotalBytes > MAX_TOTAL_BYTES || opaqueBlobRejections.size > MAX_ENTRIES)
+    && opaqueBlobRejections.size > 1
+  ) {
+    let oldestKey: string | undefined;
+    let oldestAt = Infinity;
+    for (const [candidateKey, entry] of opaqueBlobRejections) {
+      if (entry.at < oldestAt) {
+        oldestAt = entry.at;
+        oldestKey = candidateKey;
+      }
+    }
+    if (oldestKey === undefined) break;
+    deleteOpaqueBlobRejection(oldestKey);
+  }
+}
+
 function processLocalIdentity(domain: string, material: string): string {
   return createHmac("sha256", replayIdentityKey)
     .update(domain)
@@ -420,7 +496,9 @@ export function peekReasoningForCall(
 export function clearReasoningReplayCacheForTests(clock?: (() => number) | null): void {
   entries.clear();
   servingIdentities.clear();
+  opaqueBlobRejections.clear();
   totalBytes = 0;
   servingIdentityTotalBytes = 0;
+  opaqueBlobRejectionTotalBytes = 0;
   clockForTests = clock ?? null;
 }

package/src/responses/schema.ts

@@ -11,6 +11,10 @@ const inputImageBlockSchema = z.object({
 }).refine(v => typeof v.image_url === "string" || typeof v.file_id === "string", {
   message: "input_image requires at least one of image_url or file_id",
 });
+const inputVideoBlockSchema = z.object({
+  type: z.literal("input_video"),
+  video_url: z.string().min(1),
+});
 const inputFileBlockSchema = z.object({
   type: z.literal("input_file"),
   file_id: z.string().optional(),
@@ -24,7 +28,7 @@ const reasoningTextSchema = z.object({ type: z.literal("reasoning_text"), text:
 // codex-rs FunctionCallOutputContentItem (protocol/src/models.rs): input_text | input_image | encrypted_content.
 const encryptedContentBlockSchema = z.object({ type: z.literal("encrypted_content"), encrypted_content: z.string() });
 
-const inputContentBlockSchema = z.union([inputTextSchema, plainTextSchema, inputImageBlockSchema, inputFileBlockSchema]);
+const inputContentBlockSchema = z.union([inputTextSchema, plainTextSchema, inputImageBlockSchema, inputVideoBlockSchema, inputFileBlockSchema]);
 const outputContentBlockSchema = z.union([outputTextSchema, plainTextSchema, outputRefusalSchema]);
 // Tool outputs on the wire mix codex-rs FunctionCallOutputContentItem with legacy output blocks.
 const toolOutputContentBlockSchema = z.union([

package/src/responses/state.ts

@@ -18,6 +18,12 @@ import {
 const MAX_STORED_RESPONSES = 1_000;
 const RESPONSE_TTL_MS = 60 * 60 * 1_000;
 const SNAPSHOT_DEBOUNCE_MS = 2_000;
+/** Snapshot size below which the debounce stays at its base value. */
+const SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES = 1 * 1024 * 1024;
+/** Ceiling for the stretched debounce. Continuation state is only read after a
+ *  restart, and a graceful shutdown flushes, so the exposure a longer debounce adds
+ *  is bounded by a hard kill — paid against rewriting the whole snapshot every 2 s. */
+const SNAPSHOT_DEBOUNCE_MAX_MS = 30_000;
 /** In-memory high-water byte cap across all entries. Forced store:false retention (kiro/cursor
  * continuation chains) stores the full expanded input each turn — ~quadratic bytes per chain —
  * so a count cap alone cannot bound memory. Oldest-first eviction applies past this mark. */
@@ -90,6 +96,43 @@ let oldestResidentId: string | undefined;
 let oldestResidentAt: number | null = null;
 let byteCapOverride: number | null = null;
 let stateRevision = 0;
+/** Byte length and digest of the last snapshot actually written, for the
+ *  identical-payload skip and the size-scaled debounce. The payload itself is not
+ *  retained: at the 24 MiB bound that would double the snapshot's memory cost. */
+let lastSnapshotBytes = 0;
+let lastSnapshotDigest: string | null = null;
+// The resolved file the digest above describes. Keeping it means a config-dir
+// change or a retargeted symlink is a miss rather than a false "unchanged".
+let lastSnapshotTarget: string | null = null;
+
+/**
+ * Is the snapshot on disk still byte-for-byte what we last wrote?
+ *
+ * The cached digest proves what this process wrote, not what is there now. Size is
+ * checked first so the common mismatch costs a `stat`, and the content comparison
+ * only runs when the size already agrees. Any read failure answers "no" and the
+ * caller rewrites — the safe direction.
+ */
+async function snapshotOnDiskMatches(path: string, payload: string, payloadBytes: number): Promise<boolean> {
+  try {
+    const file = Bun.file(path);
+    if (file.size !== payloadBytes) return false;
+    if (await file.text() !== payload) return false;
+    // Content matching is not the whole invariant. This file holds persisted request
+    // and response bodies, and `atomicWriteFileAsync` writes it owner-only; the
+    // unconditional rewrite used to restore that on every mutation. Skipping without
+    // checking would let a broadened mode persist indefinitely, so treat a widened
+    // file as "does not match" and let the caller rewrite it through the hardening
+    // path. POSIX only — Windows ACLs are re-applied by that same write path.
+    if (process.platform !== "win32") {
+      const mode = statSync(path).mode & 0o777;
+      if (mode !== 0o600) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
 const spillCounters = { writes: 0, writeFailures: 0, readFailures: 0 };
 /**
  * Admission-boundary observability (test-visible). directSpills: oversized
@@ -788,9 +831,38 @@ async function writeBoundedSnapshot(path: string): Promise<SnapshotWriteOutcome>
         entries.push(persistEntry);
       }
       entries.reverse();
-      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-      try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
-      await atomicWriteFileAsync(path, JSON.stringify({ version: 2, states: entries }));
+      const payload = JSON.stringify({ version: 2, states: entries });
+      const payloadBytes = Buffer.byteLength(payload, "utf8");
+      const payloadDigest = Bun.hash(payload).toString(36);
+      // A mutation does not always change what gets persisted: entries past the
+      // per-entry or total byte bound are dropped from the selection, and spill
+      // demotion moves bytes out of it. Re-writing a byte-identical 24 MiB file
+      // buys nothing, so compare first — but the cached digest describes what THIS
+      // process last wrote, which is not the same claim as "that is what is on disk
+      // now". A second proxy sharing the home, or anything that rewrites the file
+      // in place, leaves the digest describing bytes that are gone. Before every
+      // release-of-a-write, the previous behaviour rewrote unconditionally and so
+      // repaired that silently; skipping without checking would turn a repaired
+      // snapshot into a lost one at the next restart.
+      //
+      // Verify against the file itself, keyed to the resolved target so a retargeted
+      // symlink is also a miss. Reading back a matching-size file costs far less
+      // than the atomic replace it avoids, and only happens when the digest already
+      // matched — the amplification this fixes is the repeated WRITE, not the read.
+      const unchanged = lastSnapshotDigest !== null
+        && payloadDigest === lastSnapshotDigest
+        && payloadBytes === lastSnapshotBytes
+        && lastSnapshotTarget === resolveWriteTarget(path)
+        && existsSync(path)
+        && await snapshotOnDiskMatches(path, payload, payloadBytes);
+      if (!unchanged) {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
+        await atomicWriteFileAsync(path, payload);
+        lastSnapshotDigest = payloadDigest;
+        lastSnapshotBytes = payloadBytes;
+        lastSnapshotTarget = resolveWriteTarget(path);
+      }
       persistAttemptHookForTests?.();
       if (revision === stateRevision) return "stable";
     }
@@ -809,11 +881,26 @@ function drainPendingSpillUnlinks(): void {
   }
 }
 
+/**
+ * Debounce scaled by the size of the last snapshot written.
+ *
+ * The whole snapshot is re-serialized and atomically replaced on every flush, so at
+ * the 24 MiB bound a fixed 2 s debounce is up to ~12 MB/s of write amplification for
+ * state nothing reads until the next start (#2460). Small snapshots keep the base
+ * cadence; the stretch is linear in size and clamped, so the write rate is roughly
+ * flat instead of growing with the file.
+ */
+function snapshotDebounceMs(): number {
+  if (lastSnapshotBytes <= SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES) return SNAPSHOT_DEBOUNCE_MS;
+  const scaled = Math.round(SNAPSHOT_DEBOUNCE_MS * (lastSnapshotBytes / SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES));
+  return Math.min(scaled, SNAPSHOT_DEBOUNCE_MAX_MS);
+}
+
 function schedulePersistAt(path: string, replace = false): void {
   if (persistTimer && !replace) return;
   if (persistTimer) clearTimeout(persistTimer);
   pendingPersistPath = path;
-  persistTimer = setTimeout(() => { void persistNow(path); }, SNAPSHOT_DEBOUNCE_MS);
+  persistTimer = setTimeout(() => { void persistNow(path); }, snapshotDebounceMs());
   (persistTimer as { unref?: () => void }).unref?.();
 }
 
@@ -1418,6 +1505,9 @@ export function clearResponseStateMemoryForTests(): void {
   replayScopeMismatchDrops = 0;
   replayOverlapSkips = 0;
   persistAttemptHookForTests = null;
+  lastSnapshotBytes = 0;
+  lastSnapshotDigest = null;
+  lastSnapshotTarget = null;
   loaded = false;
 }
 

package/src/responses/thought-signature-replay.ts

@@ -308,6 +308,23 @@ export function lookupReplayThoughtSignature(
   return entry.sig;
 }
 
+/** Drop a remembered signature for a specific callId and scope (e.g. when upstream rejects it). */
+export function forgetThoughtSignatureForReplay(
+  callId: string,
+  scope: OcxReasoningReplayScopeRef | undefined,
+): boolean {
+  const key = keyFor(callId, scope);
+  if (key === undefined) return false;
+  load();
+  const entry = entries.get(key);
+  if (!entry) return false;
+  entries.delete(key);
+  totalBytes -= entry.sig.length;
+  prune(Date.now());
+  void persist();
+  return true;
+}
+
 /** Test seams: clear in-memory state and the loaded flag without touching the file. */
 export function resetThoughtSignatureReplayForTests(): void {
   entries = new Map();

package/src/responses/turn-termination.ts

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import type { OcxAssistantMessage, OcxMessage, OcxParsedRequest } from "../types";
+
+const DELIVERED_FINAL_ANSWER_TTL_MS = 60 * 60 * 1_000;
+const DELIVERED_FINAL_ANSWER_MAX_ENTRIES = 1_024;
+
+interface DeliveredFinalAnswerRecord {
+  fingerprint: string;
+  createdAt: number;
+}
+
+const scopesByRequest = new WeakMap<OcxParsedRequest, string>();
+const deliveredFinalAnswers = new Map<string, DeliveredFinalAnswerRecord>();
+
+function pruneDeliveredFinalAnswers(at = Date.now()): void {
+  for (const [scope, record] of deliveredFinalAnswers) {
+    if (at - record.createdAt > DELIVERED_FINAL_ANSWER_TTL_MS) deliveredFinalAnswers.delete(scope);
+  }
+  while (deliveredFinalAnswers.size > DELIVERED_FINAL_ANSWER_MAX_ENTRIES) {
+    const oldest = deliveredFinalAnswers.keys().next().value;
+    if (oldest === undefined) break;
+    deliveredFinalAnswers.delete(oldest);
+  }
+}
+
+function textFingerprint(text: string): string {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+
+function assistantText(message: OcxAssistantMessage): string | undefined {
+  if (message.content.some(part => part.type === "toolCall")) return undefined;
+  const text = message.content
+    .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
+    .map(part => part.text)
+    .join("");
+  return text.trim().length > 0 ? text : undefined;
+}
+
+function deliveredFinalAnswerText(response: unknown): string | undefined {
+  if (!response || typeof response !== "object" || Array.isArray(response)) return undefined;
+  const output = (response as { output?: unknown }).output;
+  if (!Array.isArray(output)) return undefined;
+  for (let i = output.length - 1; i >= 0; i--) {
+    const item = output[i];
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const message = item as { type?: unknown; role?: unknown; phase?: unknown; content?: unknown };
+    if (message.type !== "message" || message.role !== "assistant" || message.phase !== "final_answer") continue;
+    if (!Array.isArray(message.content)) return undefined;
+    const text = message.content
+      .filter(part => !!part && typeof part === "object" && !Array.isArray(part)
+        && (part as { type?: unknown }).type === "output_text"
+        && typeof (part as { text?: unknown }).text === "string")
+      .map(part => (part as { text: string }).text)
+      .join("");
+    return text.trim().length > 0 ? text : undefined;
+  }
+  return undefined;
+}
+
+/** Bind the normalized per-conversation digest without adding proxy-private fields to the wire body. */
+export function bindTurnTerminationScope(parsed: OcxParsedRequest, scope: string | undefined): void {
+  // Only the normalized log-conversation digest may key this process-wide map. Refusing any raw
+  // fallback prevents a future caller from retaining a client header or account identifier here.
+  if (!scope || !/^[0-9a-f]{32}$/.test(scope)) return;
+  scopesByRequest.set(parsed, scope);
+}
+
+/** Remember only a final-answer message the proxy actually emitted for this exact conversation. */
+export function rememberDeliveredFinalAnswer(parsed: OcxParsedRequest, response: unknown): void {
+  const scope = scopesByRequest.get(parsed);
+  if (!scope) return;
+  const text = deliveredFinalAnswerText(response);
+  if (!text) return;
+  const at = Date.now();
+  pruneDeliveredFinalAnswers(at);
+  // Refresh insertion order so cap eviction removes the least recently delivered conversation.
+  deliveredFinalAnswers.delete(scope);
+  deliveredFinalAnswers.set(scope, { fingerprint: textFingerprint(text), createdAt: at });
+  pruneDeliveredFinalAnswers(at);
+}
+
+/**
+ * Match only when the delivered assistant answer is still the trailing content-bearing message.
+ * A later user/tool-result message is new work and must reach the provider, even though every
+ * legitimate next turn necessarily contains such a message somewhere in its history.
+ */
+export function hasRecordedTrailingDeliveredFinalAnswer(
+  parsed: OcxParsedRequest,
+  messages: readonly OcxMessage[],
+): boolean {
+  const scope = scopesByRequest.get(parsed);
+  if (!scope) return false;
+  pruneDeliveredFinalAnswers();
+  const record = deliveredFinalAnswers.get(scope);
+  if (!record) return false;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message.role !== "assistant") return false;
+    const text = assistantText(message as OcxAssistantMessage);
+    if (text === undefined) {
+      if ((message as OcxAssistantMessage).content.some(part => part.type === "toolCall")) return false;
+      continue;
+    }
+    return textFingerprint(text) === record.fingerprint;
+  }
+  return false;
+}

package/src/router.ts

@@ -32,6 +32,7 @@ import {
   OPENAI_CODEX_PROVIDER_ID,
 } from "./providers/openai-tiers";
 import { decodeRoutedModelIdOrThrow, encodeRoutedModelId } from "./providers/slug-codec";
+import { resolveModelAlias } from "./providers/default-aliases";
 import { getStaleCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
 import {
@@ -116,6 +117,7 @@ export function knownModelIdsForProvider(
     registry?.modelReasoningEffortMap,
     registry?.modelMaxOutputTokens,
     registry?.modelSupportsServiceTier,
+    registry?.modelSupportsVerbosity,
   ]) {
     for (const id of Object.keys(map ?? {})) ids.add(id);
   }
@@ -312,6 +314,10 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       : undefined,
     provider.modelSupportsServiceTier,
   );
+  const modelSupportsVerbosity = mergeRecordFill(
+    registryEntry.modelSupportsVerbosity,
+    provider.modelSupportsVerbosity,
+  );
   const noVisionModels = mergeStringArray(registryEntry.noVisionModels, provider.noVisionModels);
   const noReasoningModels = mergeStringArray(registryEntry.noReasoningModels, provider.noReasoningModels);
   const noTemperatureModels = mergeStringArray(registryEntry.noTemperatureModels, provider.noTemperatureModels);
@@ -426,6 +432,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     ...(modelMaxInputTokens ? { modelMaxInputTokens } : {}),
     ...(modelMaxOutputTokens ? { modelMaxOutputTokens } : {}),
     ...(modelSupportsServiceTier ? { modelSupportsServiceTier } : {}),
+    ...(modelSupportsVerbosity ? { modelSupportsVerbosity } : {}),
     ...(modelReasoningEfforts ? { modelReasoningEfforts } : {}),
     ...(modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts } : {}),
     ...(reasoningEffortMap ? { reasoningEffortMap } : {}),
@@ -640,7 +647,14 @@ function routeModelInternal(
   //    slash-containing model ids (e.g. "anthropic/claude-...") fall through when
   //    no such provider exists.
   if (slash > 0) {
-    const provName = modelId.slice(0, slash);
+    const requestedProvider = modelId.slice(0, slash);
+    const provName = hasOwnProvider(config.providers, requestedProvider)
+      ? requestedProvider
+      : Object.entries(config.providers).find(([, provider]) =>
+        typeof provider.alias === "string" && provider.alias.toLowerCase() === requestedProvider.toLowerCase())?.[0];
+    if (!provName) {
+      // A genuine slash-containing native model id still falls through unchanged.
+    } else {
     if (provName === LEGACY_CHATGPT_PROVIDER_ID || provName === LEGACY_OPENAI_MULTI_PROVIDER_ID) {
       throw new Error(`No provider configured for model: ${modelId}`);
     }
@@ -656,14 +670,20 @@ function routeModelInternal(
       }
       // Codex-facing alias ids (`provider/vendor-model`) decode back to the native
       // slash id via an exact known-id lookup; raw full-slash selectors keep working.
+      const requestedModel = modelId.slice(slash + 1);
+      const decoded = decodeRoutedModelIdOrThrow(requestedModel, known);
+      const nativeModel = known.includes(decoded)
+        ? decoded
+        : resolveModelAlias(config, prov, known, requestedModel) ?? decoded;
       return routeResult(
         provName,
         prov,
-        decodeRoutedModelIdOrThrow(modelId.slice(slash + 1), known),
+        nativeModel,
         "explicit-provider",
         "explicit-provider-namespace",
       );
     }
+    }
   }
 
   if (isBareOpenAiFamilyModel(modelId)) {
@@ -693,6 +713,24 @@ function routeModelInternal(
     }
   }
 
+  const aliasMatches: Array<{ provider: string; model: string; qualified: string }> = [];
+  for (const [provName, prov] of activeProviderEntries(config)) {
+    const known = knownModelIdsForProvider(provName, prov, config);
+    const native = resolveModelAlias(config, prov, known, modelId);
+    if (native) aliasMatches.push({
+      provider: provName,
+      model: native,
+      qualified: `${prov.alias || provName}/${modelId}`,
+    });
+  }
+  if (aliasMatches.length > 1) {
+    throw new Error(`model alias '${modelId}' is ambiguous: ${aliasMatches.map(match => match.qualified).sort().join(", ")}`);
+  }
+  if (aliasMatches[0]) {
+    const match = aliasMatches[0];
+    return routeResult(match.provider, config.providers[match.provider], match.model, "explicit-provider", "model-alias");
+  }
+
   if (config.defaultProvider === LEGACY_CHATGPT_PROVIDER_ID) {
     throw new Error(`No provider configured for model: ${modelId}`);
   }

package/src/routing/analytics.ts

@@ -119,6 +119,7 @@ const COOLDOWN_RECOVERY_KINDS = new Set([
   "key-429",
   "oauth-401",
   "anthropic-oauth-429",
+  "oauth-account-429",
 ]);
 
 function percentile(sorted: number[], p: number): number | undefined {

package/src/routing/quota.ts

@@ -41,6 +41,12 @@ function codexAccountQuotaEvidence(accountId: string, plan?: string): RouteQuota
   const percents = [
     ...(monthly ? [] : [quota.weeklyPercent]),
     quota.monthlyPercent,
+    // The burst window is upstream-enforced independently of the governing window, so an
+    // account at 97% here has 3% headroom whatever its weekly figure says. This was invisible
+    // while the header parser misfiled 5h readings into weeklyPercent - routing saw the burst
+    // by accident. Once that is fixed, omitting it here reports 88% headroom for an account
+    // that is one request away from a 429. computeCodexUsageScore already folds it in.
+    quota.shortPercent,
   ].filter((value): value is number => typeof value === "number" && Number.isFinite(value));
   const maxPercent = percents.length > 0 ? Math.max(...percents) : undefined;
   // Credits-only snapshots prove neither usage nor exhaustion. Unknown must not
@@ -49,6 +55,10 @@ function codexAccountQuotaEvidence(accountId: string, plan?: string): RouteQuota
   const resets = [
     ...(monthly ? [] : [quota.weeklyResetAt]),
     quota.monthlyResetAt,
+    // Pair the reset with the window that can actually gate the next request: a burst-limited
+    // account recovers in hours, and reporting a distant weekly reset would defer a retry that
+    // is already safe.
+    quota.shortResetAt,
   ].filter((value): value is number => typeof value === "number" && Number.isFinite(value))
     .filter(value => value > Date.now());
   return {