@iislee/opencodex 2.31.0 → 2.35.0

package/src/server/relay.ts

@@ -1,4 +1,12 @@
 import type { ResponsesTerminalStatus } from "../bridge";
+import {
+  cyberPolicyErrorType,
+  CYBER_POLICY_ERROR_CODE,
+  CYBER_POLICY_FALLBACK_MESSAGE,
+  isCyberPolicyCode,
+  isCyberPolicyMessage,
+} from "../lib/errors";
+import { redactSecretString } from "../lib/redact";
 import { isTranslatorBudgetExceededError } from "../lib/translator-budget";
 import { isUsageDebugEnabled } from "../usage/debug";
 import {
@@ -16,6 +24,7 @@ import {
   joinSseFrameBytes,
   MAX_CLIENT_SSE_FRAME_BYTES,
 } from "./sse-frame-buffer";
+import { replaceSseDataPayload } from "./sse-payload-rewrite";
 
 const nativePassthroughSseResponses = new WeakSet<Response>();
 const eagerRelaySseResponses = new WeakSet<Response>();
@@ -24,6 +33,30 @@ export const MAX_INSPECTION_SSE_FRAME_BYTES = MAX_CLIENT_SSE_FRAME_BYTES;
 export const MAX_COMPLETED_OUTPUT_ITEMS = 256;
 export const MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES = 8 * 1024 * 1024;
 export const MAX_TAIL_ERROR_MESSAGE_CHARS = 512;
+const ADAPTER_EOF_INCOMPLETE_PAYLOAD = JSON.stringify({
+  type: "response.incomplete",
+  response: {
+    status: "incomplete",
+    incomplete_details: { reason: "adapter_eof" },
+  },
+});
+const DONE_SSE_FRAME_TEXT = "data: [DONE]\n\n";
+const FAILED_TAIL_FALLBACK_PAYLOAD = JSON.stringify({
+  type: "response.failed",
+  response: {
+    status: "failed",
+    error: {
+      type: "upstream_error",
+      code: "upstream_reset",
+      message: "Upstream stream terminated unexpectedly",
+    },
+    last_error: {
+      type: "upstream_error",
+      code: "upstream_reset",
+      message: "Upstream stream terminated unexpectedly",
+    },
+  },
+});
 
 export type InspectionCounters = {
   frameBufferHighWaterBytes: number;
@@ -99,6 +132,21 @@ export function buildFailedTailPayload(err: unknown): string {
   });
 }
 
+function buildFailedTailPayloadOrFallback(err: unknown): string {
+  try {
+    return buildFailedTailPayload(err);
+  } catch {
+    // Error.message and String(error) may execute hostile accessors. Preserve a
+    // bounded protocol terminal even when diagnostic serialization is unsafe.
+    return FAILED_TAIL_FALLBACK_PAYLOAD;
+  }
+}
+
+export function failedTailFrame(encoder: TextEncoder, err: unknown): Uint8Array {
+  const payload = buildFailedTailPayloadOrFallback(err);
+  return encoder.encode(`\n\nevent: response.failed\ndata: ${payload}\n\n${DONE_SSE_FRAME_TEXT}`);
+}
+
 export type SseTerminalOutputBoundary = {
   feed(chunk: Uint8Array): Uint8Array;
   finish(): Uint8Array;
@@ -111,13 +159,16 @@ export type SseTerminalOutputBoundary = {
  * Frame-aware client output boundary shared by both native Responses relays.
  * It buffers only the current incomplete SSE block under the same hard byte
  * cap as inspection, forwards complete blocks through the first Responses
- * terminal, and drops every later block/byte.
+ * terminal, and drops every later block/byte. A premature [DONE] is held until
+ * a terminal arrives so clean EOF can synthesize one terminal and one sentinel.
  */
 export function createSseTerminalOutputBoundary(): SseTerminalOutputBoundary {
   const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
   const framer = new BoundedSseFrameBuffer(MAX_INSPECTION_SSE_FRAME_BYTES);
   let terminal = false;
   let done = false;
+  let pendingDone: { block: Uint8Array; delimiter: Uint8Array } | null = null;
   let disposed = false;
 
   const processFrames = (
@@ -129,16 +180,37 @@ export function createSseTerminalOutputBoundary(): SseTerminalOutputBoundary {
     for (const frame of frames) {
       const payload = sseDataPayload(decoder.decode(frame.block));
       const isDone = payload === "[DONE]";
-      // Preserve every frame through the first Responses terminal. A [DONE]
-      // frame is also preserved when it immediately follows that terminal in
-      // the same upstream chunk; every later non-DONE frame is dropped.
-      if (!responsesTerminal || isDone) output.push(frame.block, frame.delimiter);
+      const parsed = payload === null ? undefined : parseSsePayload(payload);
+      const policyError = parsed !== undefined && isPolicyRewriteType(parsed)
+        ? cyberPolicyTerminalError(parsed)
+        : undefined;
+      const outboundBlock = policyError
+        ? encoder.encode(rewritePolicyTerminalBlock(
+          decoder.decode(frame.block),
+          policyFailurePayload(policyError, parsed),
+        ))
+        : frame.block;
       if (isDone) {
         done = true;
+        if (responsesTerminal) {
+          output.push(outboundBlock, frame.delimiter);
+        } else if (!pendingDone) {
+          // Do not expose a sentinel before a Responses terminal. If EOF
+          // follows, the synthetic incomplete path owns the one sentinel;
+          // if a terminal arrives later, this pending frame is emitted then.
+          pendingDone = { block: outboundBlock, delimiter: frame.delimiter };
+        }
         continue;
       }
-      if (!responsesTerminal && payload && terminalStatusFromSsePayload(payload)) {
+      // Preserve every frame through the first Responses terminal. Every
+      // later non-DONE frame is dropped.
+      if (!responsesTerminal) output.push(outboundBlock, frame.delimiter);
+      if (!responsesTerminal && payload && terminalStatusFromParsed(parsed)) {
         responsesTerminal = true;
+        if (pendingDone) {
+          output.push(pendingDone.block, pendingDone.delimiter);
+          pendingDone = null;
+        }
       }
     }
     if (responsesTerminal) {
@@ -155,13 +227,22 @@ export function createSseTerminalOutputBoundary(): SseTerminalOutputBoundary {
     },
     finish() {
       if (disposed || terminal) return new Uint8Array(0);
-      return framer.finish();
+      const tail = framer.finish();
+      if (tail.byteLength === 0) return new Uint8Array(0);
+      // EOF may cut off the final SSE block before its blank-line delimiter.
+      // Feed it through the exact same parser/rewrite/terminal path as a
+      // complete frame, using a synthetic delimiter so the client receives a
+      // dispatchable event rather than an unterminated tail.
+      const tailText = decoder.decode(tail);
+      const delimiter = encoder.encode(tailText.includes("\r\n") ? "\r\n\r\n" : "\n\n");
+      return processFrames([{ block: tail, delimiter }]);
     },
     terminalSeen: () => terminal,
     doneSeen: () => done,
     dispose() {
       if (disposed) return;
       disposed = true;
+      pendingDone = null;
       framer.dispose();
     },
   };
@@ -198,7 +279,7 @@ export function relaySseWithFailedTail(
     // Preserve through the terminal block only, add the conventional sentinel
     // when there was no real [DONE] data event, then stop reading upstream.
     if (!terminalBoundary.doneSeen()) {
-      controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+      controller.enqueue(doneFrame(encoder));
     }
     closed = true;
     controller.close();
@@ -219,6 +300,16 @@ export function relaySseWithFailedTail(
           if (done) {
             const tail = terminalBoundary.finish();
             if (tail.byteLength > 0) controller.enqueue(tail);
+            if (terminalBoundary.terminalSeen()) {
+              if (!terminalBoundary.doneSeen()) controller.enqueue(doneFrame(encoder));
+            } else {
+              // A clean upstream EOF is still a failed Responses turn when no
+              // protocol terminal arrived. Make that state explicit so Codex
+              // does not treat HTTP 200 + bare EOF as a retryable disconnect.
+              const incomplete = adapterEofIncompleteFrame(encoder);
+              controller.enqueue(incomplete);
+              controller.enqueue(doneFrame(encoder));
+            }
             terminalBoundary.dispose();
             controller.close();
             return;
@@ -228,8 +319,10 @@ export function relaySseWithFailedTail(
         }
       } catch (err) {
         let partial: Uint8Array = new Uint8Array(0);
+        let tailTerminal = false;
         try {
           partial = terminalBoundary.finish();
+          tailTerminal = terminalBoundary.terminalSeen();
         } catch {
           // A near-cap ambiguous delimiter tail may itself overflow at EOF.
           // Preserve the original read/framing failure and continue emitting
@@ -237,11 +330,14 @@ export function relaySseWithFailedTail(
         }
         terminalBoundary.dispose();
         if (closed) return;
-        const payload = buildFailedTailPayload(err);
         try {
           if (partial.byteLength > 0) controller.enqueue(partial);
-          // Leading blank line terminates a partial SSE block so the failed frame parses cleanly.
-          controller.enqueue(encoder.encode(`\n\nevent: response.failed\ndata: ${payload}\n\ndata: [DONE]\n\n`));
+          if (tailTerminal) {
+            if (!terminalBoundary.doneSeen()) controller.enqueue(doneFrame(encoder));
+          } else {
+            // Leading blank line terminates a partial SSE block so the failed frame parses cleanly.
+            controller.enqueue(failedTailFrame(encoder, err));
+          }
           controller.close();
         } catch { /* client already torn down */ }
         upstream.abort();
@@ -276,15 +372,139 @@ export function sseDataPayload(block: string): string | null {
   return data.length > 0 ? data.join("\n") : null;
 }
 
-export function terminalStatusFromSsePayload(payload: string): ResponsesTerminalStatus | null {
-  if (payload === "[DONE]") return null;
+type JsonRecord = Record<string, unknown>;
+
+function asJsonRecord(value: unknown): JsonRecord | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as JsonRecord
+    : null;
+}
+
+function stringField(record: JsonRecord | null, key: string): string | undefined {
+  const value = record?.[key];
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+/**
+ * Return a high-confidence policy error carried by an upstream terminal shape.
+ * Deliberately inspect structured error fields and known refusal copy only — a
+ * bare `cyber_policy` token in an unrelated payload is not sufficient.
+ */
+function cyberPolicyTerminalError(parsed: unknown): { message: string; type?: string } | undefined {
+  const root = asJsonRecord(parsed);
+  if (!root) return undefined;
+  const response = asJsonRecord(root.response);
+  const candidates = [
+    asJsonRecord(root.error),
+    asJsonRecord(root.last_error),
+    asJsonRecord(response?.error),
+    asJsonRecord(response?.incomplete_details),
+    root,
+    response,
+  ];
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    if (isCyberPolicyCode(stringField(candidate, "code"))) {
+      return {
+        message: stringField(candidate, "message")
+          ?? CYBER_POLICY_FALLBACK_MESSAGE,
+        ...(stringField(candidate, "type") ? { type: stringField(candidate, "type") } : {}),
+      };
+    }
+  }
+  for (const candidate of candidates) {
+    const message = stringField(candidate, "message");
+    if (message && isCyberPolicyMessage(message)) {
+      return {
+        message,
+        ...(stringField(candidate, "type") ? { type: stringField(candidate, "type") } : {}),
+      };
+    }
+  }
+  return undefined;
+}
+
+function parseSsePayload(payload: string): unknown | undefined {
+  if (payload === "[DONE]") return undefined;
   try {
-    return terminalStatusFromParsed(JSON.parse(payload));
+    return JSON.parse(payload);
   } catch {
-    return null;
+    return undefined;
   }
 }
 
+function isPolicyRewriteType(parsed: unknown): boolean {
+  const type = asJsonRecord(parsed)?.type;
+  return type === "response.failed" || type === "response.incomplete" || type === "error";
+}
+
+function rewritePolicyTerminalBlock(block: string, payload: string): string {
+  const newline = block.includes("\r\n") ? "\r\n" : "\n";
+  const rewritten = replaceSseDataPayload(block, payload);
+  const lines = rewritten.split(/\r?\n/);
+  let eventRewritten = false;
+  const withEvent = lines.map(line => {
+    if (!eventRewritten && line.startsWith("event:")) {
+      eventRewritten = true;
+      return "event: response.failed";
+    }
+    return line;
+  });
+  if (!eventRewritten) withEvent.unshift("event: response.failed");
+  return withEvent.join(newline);
+}
+
+function policyFailurePayload(policyError: { message: string; type?: string }, parsed: unknown): string {
+  const error = {
+    type: cyberPolicyErrorType(policyError.type),
+    code: CYBER_POLICY_ERROR_CODE,
+    message: redactSecretString(policyError.message).slice(0, MAX_TAIL_ERROR_MESSAGE_CHARS),
+  };
+  const root = asJsonRecord(parsed);
+  const originalResponse = asJsonRecord(root?.response);
+  const preservedResponse = Object.fromEntries(
+    Object.entries(originalResponse ?? {}).filter(([key]) => key !== "incomplete_details"),
+  );
+  const response = {
+    ...preservedResponse,
+    status: "failed",
+    error,
+    last_error: error,
+    retryable: false,
+  };
+  // Responses event metadata such as sequence_number is normally top-level.
+  // Keep it (and any other non-error, non-response fields) while replacing only
+  // the protocol type and error envelope.
+  const preservedRoot = root
+    ? Object.fromEntries(Object.entries(root).filter(([key]) => (
+      key !== "type"
+      && key !== "response"
+      && key !== "error"
+      && key !== "last_error"
+      && key !== "retryable"
+    )))
+    : {};
+  return JSON.stringify({
+    ...preservedRoot,
+    type: "response.failed",
+    retryable: false,
+    response,
+  });
+}
+
+export function adapterEofIncompleteFrame(encoder: TextEncoder): Uint8Array {
+  return encoder.encode(`event: response.incomplete\ndata: ${ADAPTER_EOF_INCOMPLETE_PAYLOAD}\n\n`);
+}
+
+export function doneFrame(encoder: TextEncoder): Uint8Array {
+  return encoder.encode(DONE_SSE_FRAME_TEXT);
+}
+
+export function terminalStatusFromSsePayload(payload: string): ResponsesTerminalStatus | null {
+  if (payload === "[DONE]") return null;
+  return terminalStatusFromParsed(parseSsePayload(payload));
+}
+
 /** True when a native Responses SSE payload carries the FIRST kind of non-empty model output. */
 export function isFirstOutputSsePayload(payload: string | null): boolean {
   if (!payload || payload === "[DONE]") return false;
@@ -322,14 +542,16 @@ function createFirstOutputReporter(onFirstOutput?: () => void): {
 }
 
 export function terminalStatusFromParsed(parsed: unknown): ResponsesTerminalStatus | null {
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  switch ((parsed as { type?: unknown }).type) {
+  const type = asJsonRecord(parsed)?.type;
+  switch (type) {
     case "response.completed":
       return "completed";
     case "response.failed":
       return "failed";
     case "response.incomplete":
-      return "incomplete";
+      return cyberPolicyTerminalError(parsed) ? "failed" : "incomplete";
+    case "error":
+      return cyberPolicyTerminalError(parsed) ? "failed" : null;
     default:
       return null;
   }
@@ -800,6 +1022,9 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
     }
     reportFirstOutput.parsed(parsed);
     const status = terminalStatusFromParsed(parsed);
+    const policyTerminal = status === "failed"
+      && isPolicyRewriteType(parsed)
+      && cyberPolicyTerminalError(parsed) !== undefined;
     if (status) sawTerminal = true;
     if (!reported && handlers.onTerminal && status) {
       try {
@@ -808,7 +1033,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
           handlers.logCtx.transportPhase = "terminal_sse";
           handlers.logCtx.terminalSource = "upstream";
         }
-        handlers.onTerminal(status);
+        handlers.onTerminal(status, policyTerminal ? 400 : undefined);
       } finally {
         if (status === "failed" || status === "incomplete") clearCompletedItems();
       }
@@ -1087,6 +1312,13 @@ function startBoundedInspectionPump(options: InspectionPumpOptions): void {
         }
       }
     } catch {
+      // A read error can follow a final SSE block without its blank-line
+      // delimiter. Flush that candidate before classifying the transport as a
+      // synthetic reset; otherwise a real completed/failed/policy terminal is
+      // downgraded to 502 on the inspection branch.
+      if (!cancelled) {
+        try { inspector.finish(); } catch { /* preserve the original read error */ }
+      }
       if (clientGone) clientGoneWithoutTerminal = !inspector.terminalSeen();
       else if (!cancelled) options.onReadError?.();
     } finally {

package/src/server/request-log-conversation.ts

@@ -61,6 +61,57 @@ export function sessionIdHeaderFromRequest(headers: Headers): string | null {
   return headers.get("session_id") ?? headers.get("session-id");
 }
 
+/**
+ * Fixed-size logical turn lane (#820).
+ *
+ * A lane must be as SPECIFIC as the identity available, which is the opposite of what
+ * `codexPoolAffinityKey` wants. Affinity deliberately prefers the parent thread so a whole
+ * subagent fan-out pins to one account; a lane keyed that way would put every parallel
+ * subagent of one parent into a single lane and reject all but the first with 503 — the
+ * fan-out is the normal case, not an abuse.
+ *
+ * So the parent is a QUALIFIER, never the lane on its own when a child thread exists: the
+ * pair separates siblings while still keeping one conversation's overlapping turns together.
+ */
+export function sessionLaneIdFromRequest(headers: Headers): string | undefined {
+  const parent = normalizeLogConversationId(headers.get("x-codex-parent-thread-id"));
+  const thread = normalizeLogConversationId(headers.get("thread-id"));
+  const session = normalizeLogConversationId(sessionIdHeaderFromRequest(headers));
+  const specific = thread ?? session;
+  if (parent && specific) return `${parent}\u0000${specific}`;
+  return specific ?? parent;
+}
+
+function firstSanitizedConversationId(
+  ...values: Array<string | null | undefined>
+): string | undefined {
+  for (const value of values) {
+    const sanitized = sanitizeConversationIdInput(value);
+    if (sanitized) return sanitized;
+  }
+  return undefined;
+}
+
+/**
+ * Conversation namespace for reasoning replay. Unlike the persisted log id, this stays the raw
+ * sanitized identity so mixed headers that carry the same conversation still hit one serving
+ * record. Do not hash, and do not prefer session_id over a true per-conversation thread/Cursor
+ * identity: session_id can be synthesized from a shared prompt_cache_key.
+ */
+export function reasoningReplayConversationIdFromResponsesRequest(input: {
+  clientThreadId?: string;
+  threadIdHeader?: string | null;
+  cursorConversationId?: string;
+  sessionIdHeader?: string | null;
+}): string | undefined {
+  return firstSanitizedConversationId(
+    input.clientThreadId,
+    input.threadIdHeader,
+    input.cursorConversationId,
+    input.sessionIdHeader,
+  );
+}
+
 export function conversationIdFromResponsesRequest(input: {
   clientThreadId?: string;
   sessionIdHeader?: string | null;

package/src/server/request-log.ts

@@ -6,6 +6,7 @@ import {
   httpStatusFromTerminalError as httpStatusFromClassifiedTerminalError,
   isClientClosedMessage,
   isCyberPolicyCode,
+  isCyberPolicyMessage,
 } from "../lib/errors";
 import { CODEX_CONFIG_PATH, readRootTomlString } from "../codex/paths";
 import { readCodexCatalogPath } from "../codex/catalog";
@@ -62,9 +63,18 @@ export interface RequestLogContext {
    *  product: widening that enum would merge Responses and Chat Completions,
    *  since both leave it undefined. */
   inboundProtocol?: "responses" | "chat" | "messages";
+  /**
+   * Set when an adapter answered the turn locally and no upstream request was made
+   * (`ProviderAdapter.localTerminal`). A fixed identifier naming the code path, never
+   * conversation-derived: it exists so a request log showing zero sends is explainable
+   * rather than looking like a lost request.
+   */
+  localTerminalReason?: string;
   /** Stable non-PII Codex Pool account identity for durable usage attribution. */
   accountLogLabel?: string;
   requestedModel?: string;
+  /** User-facing alias selector when routing resolved one; native model remains `model`. */
+  requestedAlias?: string;
   /** Original bare helper model when the opt-in shadow-call route rewrote this request. */
   shadowCallRewrittenFrom?: string;
   /** Internal structural combo identity; omitted from RequestLogEntry/JSONL. */
@@ -130,6 +140,12 @@ export interface RequestLogEntry {
   /** TTFT: ms from request start to the first non-empty model output delta; unset for non-streaming/tool-only. */
   firstOutputMs?: number;
   surface?: "claude" | "claude-desktop" | "grok";
+  /**
+   * Set when the proxy answered this turn locally and sent nothing upstream. Without it a zero-send
+   * row is indistinguishable from a request that vanished. A fixed adapter-supplied identifier,
+   * never conversation-derived.
+   */
+  localTerminalReason?: string;
   /** The matched configured key's id. Set ONLY for admissionKind "configured" —
    *  never a sentinel, so a hand-edited entry whose id happens to be "loopback"
    *  cannot absorb unrelated traffic. */
@@ -144,6 +160,7 @@ export interface RequestLogEntry {
   /** Best-effort chat/session correlation for Logs grouping (#330). */
   conversationId?: string;
   requestedModel?: string;
+  requestedAlias?: string;
   /** Original bare helper model when the opt-in shadow-call route rewrote this request. */
   shadowCallRewrittenFrom?: string;
   requestedEffort?: string;
@@ -259,6 +276,7 @@ export function requestLogEntryFromPersistedUsage(entry: PersistedUsageEntry): R
       ? { accountLogLabel: entry.accountLogLabel }
       : {}),
     ...(entry.requestedModel ? { requestedModel: entry.requestedModel } : {}),
+    ...(entry.requestedAlias ? { requestedAlias: entry.requestedAlias } : {}),
     ...(entry.shadowCallRewrittenFrom
       ? { shadowCallRewrittenFrom: entry.shadowCallRewrittenFrom }
       : {}),
@@ -379,6 +397,7 @@ export function addRequestLog(entry: RequestLogEntry) {
       ...(entry.conversationId ? { conversationId: entry.conversationId } : {}),
       ...(entry.resolvedModel ? { resolvedModel: entry.resolvedModel } : {}),
       ...(entry.requestedModel ? { requestedModel: entry.requestedModel } : {}),
+      ...(entry.requestedAlias ? { requestedAlias: entry.requestedAlias } : {}),
       ...(entry.shadowCallRewrittenFrom
         ? { shadowCallRewrittenFrom: entry.shadowCallRewrittenFrom }
         : {}),
@@ -764,7 +783,7 @@ function captureUpstreamErrorParsed(
       last_error?: { message?: unknown };
       response?: {
         error?: { type?: unknown; code?: unknown; message?: unknown };
-        incomplete_details?: { reason?: unknown };
+        incomplete_details?: { reason?: unknown; message?: unknown };
       };
     };
     captureTerminalHttpStatus(logCtx, json);
@@ -778,7 +797,8 @@ function captureUpstreamErrorParsed(
     if (logCtx.upstreamError) return;
     const message = json?.error?.message
       ?? json?.last_error?.message
-      ?? json?.response?.error?.message;
+      ?? json?.response?.error?.message
+      ?? json?.response?.incomplete_details?.message;
     if (typeof message === "string" && message.trim()) {
       logCtx.upstreamError = redactSecretString(message).slice(0, 500);
       return;
@@ -817,25 +837,43 @@ function captureTerminalHttpStatus(
   logCtx: RequestLogContext,
   json: {
     type?: unknown;
-    response?: { error?: { type?: unknown; code?: unknown; message?: unknown } };
+    code?: unknown;
+    message?: unknown;
+    error?: { type?: unknown; code?: unknown; message?: unknown };
+    last_error?: { type?: unknown; code?: unknown; message?: unknown };
+    response?: {
+      error?: { type?: unknown; code?: unknown; message?: unknown };
+      incomplete_details?: { code?: unknown; message?: unknown };
+    };
   },
 ): void {
   if (logCtx.terminalHttpStatus !== undefined) return;
-  if (json.type !== "response.failed") return;
-  const error = json.response?.error;
-  if (!error || typeof error !== "object") return;
-  const terminalCode = error.code === null || typeof error.code === "string"
-    ? error.code
-    : undefined;
-  if (isCyberPolicyCode(terminalCode)) {
+  const type = json.type;
+  if (type !== "response.failed" && type !== "response.incomplete" && type !== "error") return;
+  const responseError = json.response?.error;
+  const responseDetails = json.response?.incomplete_details;
+  const candidates = [json.error, json.last_error, responseError, responseDetails, json];
+  const policy = candidates.some(candidate => (
+    candidate?.code === null || typeof candidate?.code === "string"
+  ) && isCyberPolicyCode(candidate.code as string | null | undefined))
+    || candidates.some(candidate => (
+      typeof candidate?.message === "string"
+      && candidate.message.trim().length > 0
+      && isCyberPolicyMessage(candidate.message)
+    ));
+  if (policy) {
     logCtx.terminalErrorCode = CYBER_POLICY_ERROR_CODE;
-  } else {
-    delete logCtx.terminalErrorCode;
+    logCtx.terminalHttpStatus = 400;
+    return;
   }
+  if (type !== "response.failed" || !responseError || typeof responseError !== "object") return;
+  const responseCode = responseError.code === null || typeof responseError.code === "string"
+    ? responseError.code
+    : undefined;
   logCtx.terminalHttpStatus = httpStatusFromTerminalError({
-    type: typeof error.type === "string" ? error.type : undefined,
-    code: terminalCode,
-    message: typeof error.message === "string" ? error.message : undefined,
+    type: typeof responseError.type === "string" ? responseError.type : undefined,
+    code: responseCode,
+    message: typeof responseError.message === "string" ? responseError.message : undefined,
   });
 }
 
@@ -917,6 +955,7 @@ export function addFinalRequestLog(
     logCtx.usage,
     logCtx.usageLogInputTokens,
     contextWindowForModel(logCtx.providerAdapter ?? logCtx.provider, logCtx.model),
+    logCtx.localTerminalReason !== undefined,
   );
   const attempts = logCtx.attempts?.map(attempt => ({
     ...attempt,
@@ -944,11 +983,15 @@ export function addFinalRequestLog(
     ...(logCtx.apiKeyId ? { apiKeyId: logCtx.apiKeyId } : {}),
     ...(logCtx.admissionKind ? { admissionKind: logCtx.admissionKind } : {}),
     ...(logCtx.inboundProtocol ? { inboundProtocol: logCtx.inboundProtocol } : {}),
+    ...(logCtx.localTerminalReason
+      ? { localTerminalReason: sanitizeLogMetadataString(logCtx.localTerminalReason) }
+      : {}),
     ...(isCodexUsageAccountLogLabel(logCtx.accountLogLabel)
       ? { accountLogLabel: logCtx.accountLogLabel }
       : {}),
     ...(logCtx.conversationId ? { conversationId: logCtx.conversationId } : {}),
     ...(logCtx.requestedModel ? { requestedModel: logCtx.requestedModel } : {}),
+    ...(logCtx.requestedAlias ? { requestedAlias: logCtx.requestedAlias } : {}),
     ...(shadowCallRewrittenFrom ? { shadowCallRewrittenFrom } : {}),
     ...(logCtx.requestedEffort ? { requestedEffort: logCtx.requestedEffort } : {}),
     ...(logCtx.effectiveEffort ? { effectiveEffort: logCtx.effectiveEffort } : {}),
@@ -1007,6 +1050,15 @@ export function filterRequestLogs(logs: RequestLogEntry[], params: URLSearchPara
   if (conversationId) {
     filtered = filtered.filter(entry => matchesLogConversationId(entry.conversationId, conversationId));
   }
+  // #2704: there was no `model` clause at all, so `?model=x` was ACCEPTED and silently
+  // ignored -- worse than an error, because it yields wrong conclusions from output that
+  // looks correct. Attempts are matched for the same reason `provider` matches them: a
+  // request that failed over should be findable by the model that actually served it.
+  const model = params.get("model")?.trim();
+  if (model) {
+    filtered = filtered.filter(entry => entry.model === model
+      || entry.attempts?.some(attempt => attempt.model === model));
+  }
   const status = params.get("status")?.trim().toLowerCase();
   if (status) {
     filtered = /^[1-5]xx$/.test(status)
@@ -1076,6 +1128,7 @@ function finalizedUsage(
   usage: OcxUsage | undefined,
   inputTokenEstimate: number | undefined,
   contextWindow: number | undefined,
+  locallyAnswered = false,
 ): FinalizedUsageResult {
   // The ESTIMATE itself is capped at the model's context window (codex-router PR #140). The
   // combined value below keeps its max(inputTokens, estimate) behavior — a provider-reported
@@ -1085,7 +1138,7 @@ function finalizedUsage(
     && inputTokenEstimate >= 0
     ? capEstimateAtContextWindow(inputTokenEstimate, contextWindow)
     : undefined;
-  const finalUsage = usageForFinalLog(adapter, usage);
+  const finalUsage = usageForFinalLog(adapter, usage, locallyAnswered);
   const usageFallback = !finalUsage && estimate !== undefined
     ? { inputTokens: estimate, outputTokens: 0, estimated: true }
     : undefined;
@@ -1185,6 +1238,7 @@ export function finishRequestAttempt(
     usage ?? attempt.usage,
     attempt.inputTokenEstimate,
     contextWindowForModel(attempt.adapter, attempt.model),
+    attempt.locallyAnswered === true,
   );
   attempt.status = status;
   attempt.durationMs = Math.max(0, durationMs);