@juspay/neurolink 12.40.3 → 12.41.0

package/dist/cli/commands/proxy.js

@@ -1650,7 +1650,11 @@ export async function createProxyStartApp(params) {
     // Keep bridge capabilities, accounting and cancellation in this worker
     // across supervisor generation switches; never re-enter the public listener.
     (request) => app.fetch(request));
-    const codexRouteGroup = createCodexProxyRoutes("");
+    const codexRouteGroup = createCodexProxyRoutes("", runtimeConfigProvider, params.port, 
+    // Same in-process loopback discipline as the OpenAI->Anthropic bridge:
+    // stay in this worker across supervisor generation switches, never
+    // re-enter the public listener.
+    (request) => app.fetch(request));
     const geminiRouteGroup = createGeminiProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
     const allProxyRoutes = [
         ...routeGroup.routes,

package/dist/proxy/accountLedger.js

@@ -166,6 +166,7 @@ async function advanceCursor(fileName, cursor) {
             outputTokens: finiteNumber(record.outputTokens),
             cacheReadTokens: finiteNumber(record.cacheReadTokens),
             cacheCreationTokens: finiteNumber(record.cacheCreationTokens),
+            cacheCreation1hTokens: finiteNumber(record.cacheCreation1hTokens),
             clientApp: resolveClientApp(record),
         };
         // A later record for the same request enriches the earlier one — it must
@@ -198,6 +199,7 @@ async function advanceCursor(fileName, cursor) {
                 outputTokens: Math.max(previous.outputTokens, next.outputTokens),
                 cacheReadTokens: Math.max(previous.cacheReadTokens, next.cacheReadTokens),
                 cacheCreationTokens: Math.max(previous.cacheCreationTokens, next.cacheCreationTokens),
+                cacheCreation1hTokens: Math.max(previous.cacheCreation1hTokens, next.cacheCreation1hTokens),
                 // Likewise keep a real model name over a placeholder.
                 model: next.model && next.model !== "-" ? next.model : previous.model,
             }
@@ -339,6 +341,7 @@ export async function readAccountUsage(date = currentUsageDate()) {
                     total: entry.inputTokens + entry.outputTokens,
                     cacheReadTokens: entry.cacheReadTokens,
                     cacheCreationTokens: entry.cacheCreationTokens,
+                    cacheCreation1hTokens: entry.cacheCreation1hTokens,
                 });
                 row.costUsd += cost;
                 client.costUsd += cost;

package/dist/proxy/codexOutboundCache.d.ts

@@ -0,0 +1,52 @@
+import type { ClaudeMessage, ClaudeTextBlock, CodexAnthropicAffinityKey, CodexNativeRequest } from "../types/index.js";
+/**
+ * Thrown by `assertClaudeSystemPrefixShape` and `assertClaudeMessagesAlternate`
+ * when the translated request does not have the shape breakpoint placement
+ * (or Anthropic's role-alternation requirement) depends on. Never logged and
+ * swallowed — a silent violation here defeats caching with no visible
+ * symptom besides a slow-moving cache-hit-rate metric, or turns into an
+ * undifferentiated Anthropic 400.
+ */
+export declare class ClaudeSystemPrefixShapeError extends Error {
+}
+/**
+ * Enforces that `system` is exactly the stable developer-block prefix before
+ * a caller marks breakpoint 1 on its last element. `translateCodexRequestToClaude`
+ * is contracted to produce `system` containing only the developer-role-derived
+ * blocks and nothing else — `environment_context` and any other per-turn
+ * payload belong in `messages`. `system[system.length-1]` is only a safe
+ * breakpoint-1 anchor while that invariant holds; trusting it silently would
+ * be exactly the failure this guards against.
+ */
+export declare function assertClaudeSystemPrefixShape(system: ClaudeTextBlock[] | string | undefined, expectedLength: number): void;
+/**
+ * Throws, naming the offending index, when `messages` is not alternation-safe.
+ *
+ * Anthropic requires alternating `user`/`assistant` roles. A native Codex
+ * request can carry two consecutive `user`-role items (an auto-injected
+ * notice immediately followed by the literal user turn, or a synthetic
+ * `environment_context` pair) — mapped 1:1 into `ClaudeMessage` entries that
+ * would otherwise reach Anthropic as back-to-back `user` messages and get
+ * rejected on every request that hits it. Merging same-role Codex items into
+ * one Claude message with multiple content blocks is translation-correctness
+ * work owned by `translateCodexRequestToClaude`, not this guard's job — this
+ * only turns a missed merge into an attributable thrown error at the new
+ * hop's boundary instead of an undifferentiated Anthropic 400.
+ */
+export declare function assertClaudeMessagesAlternate(messages: ReadonlyArray<ClaudeMessage>): void;
+/**
+ * Derives the session-affinity key a Codex-origin request supplies to the
+ * Claude pipeline's existing session-affinity machinery, so consecutive
+ * turns of one conversation route back to the account already holding their
+ * cache. Preference order mirrors what a real Codex CLI capture carries:
+ * `prompt_cache_key` (top-level, the client's own pre-computed key — already
+ * exactly the signal being reconstructed) beats `client_metadata.thread_id`
+ * beats `client_metadata.session_id`; a genuinely identity-free request
+ * degrades to a prefix-derived key so at least concurrent turns of the same
+ * agent config bucket together.
+ *
+ * The three-way prefix (`codex-thread:` / `codex-session:` / `codex-prefix:`)
+ * keeps this namespace from colliding with a Claude-Code `metadata.user_id`-
+ * derived UUID or with itself across cases.
+ */
+export declare function codexAnthropicAffinityKey(native: CodexNativeRequest): CodexAnthropicAffinityKey | undefined;

package/dist/proxy/codexOutboundCache.js

@@ -0,0 +1,147 @@
+/**
+ * Codex-outbound fallback: cache-preservation guards and affinity-key
+ * derivation for the Codex -> Anthropic/Vertex hop.
+ *
+ * Owns three things, all pure: the defensive shape check that guards where
+ * `applyClaudeRequestCacheBreakpoints` marks breakpoint 1 (`system` must be
+ * exactly the stable developer-block prefix), the role-alternation guard
+ * that turns a translation defect into a loud, attributable error instead of
+ * a silent Anthropic 400, and the session-affinity key a Codex-origin
+ * request supplies so consecutive turns of one conversation route back to
+ * the account already holding their cache.
+ *
+ * Both guards are scoped to the new Codex-fallback entry point only, called
+ * immediately after `translateCodexRequestToClaude()` and before
+ * `applyClaudeRequestCacheBreakpoints()`. They are not folded into the
+ * shared breakpoint function itself, which the existing OpenAI bridge also
+ * calls: adding a hard throw there would newly reject that bridge's
+ * already-shipped, already-latent-buggy same-role-message traffic that has
+ * shipped without incident.
+ */
+import { createHash } from "node:crypto";
+/**
+ * Thrown by `assertClaudeSystemPrefixShape` and `assertClaudeMessagesAlternate`
+ * when the translated request does not have the shape breakpoint placement
+ * (or Anthropic's role-alternation requirement) depends on. Never logged and
+ * swallowed — a silent violation here defeats caching with no visible
+ * symptom besides a slow-moving cache-hit-rate metric, or turns into an
+ * undifferentiated Anthropic 400.
+ */
+export class ClaudeSystemPrefixShapeError extends Error {
+}
+/**
+ * Enforces that `system` is exactly the stable developer-block prefix before
+ * a caller marks breakpoint 1 on its last element. `translateCodexRequestToClaude`
+ * is contracted to produce `system` containing only the developer-role-derived
+ * blocks and nothing else — `environment_context` and any other per-turn
+ * payload belong in `messages`. `system[system.length-1]` is only a safe
+ * breakpoint-1 anchor while that invariant holds; trusting it silently would
+ * be exactly the failure this guards against.
+ */
+export function assertClaudeSystemPrefixShape(system, expectedLength) {
+    if (!Array.isArray(system)) {
+        throw new ClaudeSystemPrefixShapeError(`expected an array-shaped system prefix, got ${typeof system}`);
+    }
+    if (system.length !== expectedLength) {
+        throw new ClaudeSystemPrefixShapeError(`expected system.length === ${expectedLength} (fixed developer-block prefix), got ${system.length}`);
+    }
+}
+/**
+ * Throws, naming the offending index, when `messages` is not alternation-safe.
+ *
+ * Anthropic requires alternating `user`/`assistant` roles. A native Codex
+ * request can carry two consecutive `user`-role items (an auto-injected
+ * notice immediately followed by the literal user turn, or a synthetic
+ * `environment_context` pair) — mapped 1:1 into `ClaudeMessage` entries that
+ * would otherwise reach Anthropic as back-to-back `user` messages and get
+ * rejected on every request that hits it. Merging same-role Codex items into
+ * one Claude message with multiple content blocks is translation-correctness
+ * work owned by `translateCodexRequestToClaude`, not this guard's job — this
+ * only turns a missed merge into an attributable thrown error at the new
+ * hop's boundary instead of an undifferentiated Anthropic 400.
+ */
+export function assertClaudeMessagesAlternate(messages) {
+    for (let i = 1; i < messages.length; i++) {
+        if (messages[i].role === messages[i - 1].role) {
+            throw new ClaudeSystemPrefixShapeError(`messages[${i}] repeats role "${messages[i].role}" from messages[${i - 1}]` +
+                " — Anthropic requires alternation; the Codex-request translator" +
+                " must merge same-role turns into one message with multiple content blocks");
+        }
+    }
+}
+/**
+ * The leading, turn-stable bytes of a native Codex request: a bounded head of
+ * the developer-role (instructions) text plus the declared tool names, mirroring
+ * `codexCachePrefix` (`codexFallback.ts`) for the opposite direction. Descriptions
+ * and schemas are deliberately left out — they sit behind the instructions in
+ * the prefix, so two requests agreeing on this much already share a cacheable
+ * head worth routing together.
+ */
+const PREFIX_DIGEST_HEAD_CHARS = 8192;
+function codexNativeInstructionsHead(native) {
+    const developerText = native.input
+        .filter((item) => item.type === "message" && item.role === "developer")
+        .flatMap((item) => "content" in item && Array.isArray(item.content) ? item.content : [])
+        .filter((part) => part.type === "input_text")
+        .map((part) => part.text)
+        .join("\n");
+    return developerText.slice(0, PREFIX_DIGEST_HEAD_CHARS);
+}
+function codexNativeToolNames(native) {
+    const additionalTools = native.input
+        .filter((item) => item.type === "additional_tools")
+        .at(-1);
+    if (!additionalTools) {
+        return "";
+    }
+    return additionalTools.tools
+        .flatMap((namespace) => namespace.tools.map((tool) => tool.name))
+        .join("\u0000");
+}
+/**
+ * Hashed bounded-head-plus-tool-names digest of a native Codex request's
+ * turn-stable prefix, used only as the last-resort affinity-key fallback
+ * (`codex-prefix:`) when the wire carries none of `prompt_cache_key` /
+ * `client_metadata.thread_id` / `client_metadata.session_id`. Hashed (rather
+ * than returned raw, as `codexCachePrefix` does) because this value is used
+ * directly as a routing/log key, not as sha256 input a caller hashes itself.
+ */
+function codexNativePrefixDigest(native) {
+    const head = codexNativeInstructionsHead(native);
+    const toolNames = codexNativeToolNames(native);
+    if (!head && !toolNames) {
+        return undefined;
+    }
+    return createHash("sha256").update(`${head}\u0001${toolNames}`).digest("hex");
+}
+/**
+ * Derives the session-affinity key a Codex-origin request supplies to the
+ * Claude pipeline's existing session-affinity machinery, so consecutive
+ * turns of one conversation route back to the account already holding their
+ * cache. Preference order mirrors what a real Codex CLI capture carries:
+ * `prompt_cache_key` (top-level, the client's own pre-computed key — already
+ * exactly the signal being reconstructed) beats `client_metadata.thread_id`
+ * beats `client_metadata.session_id`; a genuinely identity-free request
+ * degrades to a prefix-derived key so at least concurrent turns of the same
+ * agent config bucket together.
+ *
+ * The three-way prefix (`codex-thread:` / `codex-session:` / `codex-prefix:`)
+ * keeps this namespace from colliding with a Claude-Code `metadata.user_id`-
+ * derived UUID or with itself across cases.
+ */
+export function codexAnthropicAffinityKey(native) {
+    const promptCacheKey = native.prompt_cache_key;
+    if (typeof promptCacheKey === "string" && promptCacheKey.length > 0) {
+        return `codex-thread:${promptCacheKey}`;
+    }
+    const threadId = native.client_metadata?.thread_id;
+    if (typeof threadId === "string" && threadId.length > 0) {
+        return `codex-thread:${threadId}`;
+    }
+    const sessionId = native.client_metadata?.session_id;
+    if (typeof sessionId === "string" && sessionId.length > 0) {
+        return `codex-session:${sessionId}`;
+    }
+    const prefix = codexNativePrefixDigest(native);
+    return prefix ? `codex-prefix:${prefix}` : undefined;
+}

package/dist/proxy/codexOutboundFallback.d.ts

@@ -17,8 +17,8 @@
  * `tool_use` block, no kind discriminator) knows which declared tools were
  * `custom` rather than `function`.
  */
-import type { ClaudeRequest } from "../types/index.js";
-import type { CodexNativeRequest, CodexNativeToolKind, CodexTranslationError } from "../types/index.js";
+import type { ClaudeRequest, ClaudeTextBlock } from "../types/index.js";
+import type { CodexNativeInputItem, CodexNativeRequest, CodexNativeToolKind, CodexOutboundFailureInput, CodexOutboundFallbackDecision, CodexTranslationError } from "../types/index.js";
 export declare function parseCodexNativeRequest(raw: unknown): {
     ok: true;
     value: CodexNativeRequest;
@@ -26,6 +26,7 @@ export declare function parseCodexNativeRequest(raw: unknown): {
     ok: false;
     error: CodexTranslationError;
 };
+export declare function buildSystemBlocksFromDeveloperMessages(items: readonly CodexNativeInputItem[]): ClaudeTextBlock[];
 export declare function translateCodexRequestToClaude(request: CodexNativeRequest, target: {
     provider: "anthropic" | "vertex";
     model: string;
@@ -37,3 +38,27 @@ export declare function translateCodexRequestToClaude(request: CodexNativeReques
     ok: false;
     error: CodexTranslationError;
 };
+/** Caps how many times one request may cross between engines (Codex->Anthropic
+ *  or Anthropic->Codex) in a single turn. A crossing is an engine change, never
+ *  a same-engine account rotation, so this bounds `Codex -> Anthropic ->
+ *  Codex -> ...` cycles without limiting ordinary in-pool retries. */
+export declare const MAX_ENGINE_CROSSINGS = 1;
+/** Read a transport error code the same way `codexProxyRoutes.ts`'s own
+ *  (unexported) `getCodexTransportErrorCode` does: a direct `.code`, falling
+ *  back to `.cause.code`. Kept here, independently, as a pure utility the
+ *  trigger-policy classifier can be exercised against without importing a
+ *  route-handler module. */
+export declare function parseCodexErrorCode(error: unknown): string | undefined;
+/**
+ * Classify one `codexProxyRoutes.ts` `dispatch()` failure into an
+ * outbound-fallback eligibility decision. A total function over
+ * `CodexOutboundFailureClass` (exhaustive switch, no `default:`): a missing
+ * case fails to compile under `noImplicitReturns`, never falls through to a
+ * silent `undefined`.
+ *
+ * `context_preflight` / `token_budget` errors are never modeled here: both
+ * are self-contained terminal returns inside `dispatch()`'s own outer `try`,
+ * before any of the four insertion points this classifier serves, so they
+ * never reach it.
+ */
+export declare function classifyCodexOutboundFailure(input: CodexOutboundFailureInput): CodexOutboundFallbackDecision;

package/dist/proxy/codexOutboundFallback.js

@@ -1,6 +1,8 @@
 import { resolveClaudeMaxTokens } from "../utils/tokenLimits.js";
 import { inlineJsonSchema } from "../utils/schemaConversion.js";
+import { modelSupportsForcedToolChoice, claudeDisabledThinkingReplacement, } from "../models/modelRegistry.js";
 import { parseToolArguments } from "./argumentParsing.js";
+import { classifyProxyFailureCode } from "./proxyFailureDetails.js";
 import { recordCodexOutboundSchemaDegraded, recordCodexOutboundUnsupportedField, } from "./proxyTracer.js";
 import { CODEX_STREAM_MAX_TOOL_CALLS, CODEX_STREAM_SIZE_CEILING_BYTES, } from "./streamLimits.js";
 // ---------------------------------------------------------------------------
@@ -132,21 +134,35 @@ export function parseCodexNativeRequest(raw) {
 // output to attach to, regardless of whether the source request bothered to
 // say "auto" out loud. `parallel_tool_calls: false` is inert on `"none"` —
 // there is nothing running in parallel to disable.
-function mapCodexToolChoiceToClaude(choice, parallelToolCalls) {
+//
+// `targetModel` gates a second degradation: some Claude families (Sonnet
+// 5.5, Opus 5.5, Fable/Mythos 5.1 — see modelSupportsForcedToolChoice) answer
+// a forced tool_choice (`any`/named `tool`) with an HTTP 400. For those
+// targets only, a forced choice is downgraded to `{type:"auto"}` (keeping
+// `disable_parallel_tool_use` when the source asked for it) instead of going
+// out as a request the target is guaranteed to reject. Every other target
+// model is unaffected — this is a per-request, per-target decision, not a
+// global behavior change.
+function mapCodexToolChoiceToClaude(choice, parallelToolCalls, targetModel) {
     const disable = parallelToolCalls === false;
     if (choice === undefined || choice === "auto") {
         return disable
             ? { type: "auto", disable_parallel_tool_use: true }
             : { type: "auto" };
     }
+    if (choice === "none") {
+        return { type: "none" };
+    }
+    if (!modelSupportsForcedToolChoice(targetModel)) {
+        return disable
+            ? { type: "auto", disable_parallel_tool_use: true }
+            : { type: "auto" };
+    }
     if (choice === "required") {
         return disable
             ? { type: "any", disable_parallel_tool_use: true }
             : { type: "any" };
     }
-    if (choice === "none") {
-        return { type: "none" };
-    }
     return disable
         ? { type: "tool", name: choice.name, disable_parallel_tool_use: true }
         : { type: "tool", name: choice.name };
@@ -206,8 +222,10 @@ function mapCodexFunctionToolToClaude(tool) {
 }
 function mapCodexCustomToolToClaude(tool) {
     // Lossy, explicitly flagged: no JSON Schema exists for a Lark/regex grammar.
-    // The model is no longer grammar-constrained after this mapping — needs
-    // product sign-off before shipping (§10 of the design).
+    // The model is no longer grammar-constrained after this mapping. SIGNED OFF
+    // 2026-09-28 (design doc §10, ruling 7): grammar/custom tools wrapped as a
+    // single `{input: string}` parameter, with `custom_tool_call` on the way
+    // back, is the shipped behavior — not a placeholder awaiting approval.
     return {
         tool: {
             name: tool.name,
@@ -262,11 +280,23 @@ const REASONING_BUDGET = {
     xhigh: 24576,
     max: 32768,
 };
-function mapCodexReasoningToThinking(reasoning, resolvedMaxTokens) {
+// Codex "no reasoning" never goes out as an explicit `thinking:{type:"disabled"}`
+// — some Claude 5.5/5.1 families reject that shape with a 400 (probed on
+// Vertex, 2026-09-29) because they think adaptively and always on. What
+// "thinking off" means for those targets is decided by
+// claudeDisabledThinkingReplacement: `between_tools` (Sonnet 5.5's lowest
+// setting) when available, otherwise `omit` (nothing sent — the model cannot
+// be turned off, and the field is dropped rather than asking for a rejected
+// state). For every target outside that family the function returns "keep",
+// which here means the historical, unaffected behavior: omit the field.
+function mapCodexReasoningToThinking(reasoning, resolvedMaxTokens, targetModel) {
     if (!reasoning ||
         reasoning.effort === "none" ||
         reasoning.effort === "minimal") {
-        return undefined;
+        const replacement = claudeDisabledThinkingReplacement(targetModel, reasoning?.effort);
+        return replacement === "between_tools"
+            ? { type: "between_tools" }
+            : undefined;
     }
     const table = REASONING_BUDGET[reasoning.effort];
     // Explicit floor: makes the ">= 1024" invariant correct by construction
@@ -395,7 +425,12 @@ function coalesceCodexInputToClaudeMessages(items) {
             : g.blocks,
     }));
 }
-function buildSystemBlocksFromDeveloperMessages(items) {
+// Exported so callers (codexProxyRoutes.ts's cache-preservation wiring) can
+// independently recompute the expected system-prefix length from the same
+// native request `translateCodexRequestToClaude` translated, for
+// `assertClaudeSystemPrefixShape`'s guard against a future translation
+// regression that leaks extra content into `system`.
+export function buildSystemBlocksFromDeveloperMessages(items) {
     return items
         .filter((i) => i.type === "message" && i.role === "developer")
         .flatMap((i) => i.content.map(toClaudeContentPart))
@@ -554,7 +589,7 @@ export function translateCodexRequestToClaude(request, target) {
         .filter((item) => item.type === "additional_tools")
         .at(-1);
     const { tools, toolKindByName, reasons: schemaReasons, } = buildClaudeTools(additionalTools);
-    const toolChoice = mapCodexToolChoiceToClaude(request.tool_choice, request.parallel_tool_calls);
+    const toolChoice = mapCodexToolChoiceToClaude(request.tool_choice, request.parallel_tool_calls, target.model);
     const forcesTool = toolChoice.type === "any" || toolChoice.type === "tool";
     if (forcesTool && !tools) {
         return {
@@ -601,7 +636,7 @@ export function translateCodexRequestToClaude(request, target) {
     // its reasoning is OpenAI ciphertext.
     const thinking = forcesTool || lastAssistantMessageUsesTool(messages)
         ? undefined
-        : mapCodexReasoningToThinking(request.reasoning, maxTokens);
+        : mapCodexReasoningToThinking(request.reasoning, maxTokens, target.model);
     const claudeRequest = {
         model: target.model,
         messages,
@@ -633,3 +668,104 @@ export function translateCodexRequestToClaude(request, target) {
     }
     return { ok: true, value: claudeRequest, toolKindByName };
 }
+// ---------------------------------------------------------------------------
+// §1 Trigger policy (stage-c-trigger.md). Pure classification of a native-
+// Codex-route failure into an outbound-fallback eligibility decision. Owns no
+// dispatch, no HTTP, no account state — `codexProxyRoutes.ts`'s four insertion
+// points call this and still apply their own config/loop-prevention/depth
+// gates on top of a `true` verdict.
+// ---------------------------------------------------------------------------
+/** Caps how many times one request may cross between engines (Codex->Anthropic
+ *  or Anthropic->Codex) in a single turn. A crossing is an engine change, never
+ *  a same-engine account rotation, so this bounds `Codex -> Anthropic ->
+ *  Codex -> ...` cycles without limiting ordinary in-pool retries. */
+export const MAX_ENGINE_CROSSINGS = 1;
+/** Read a transport error code the same way `codexProxyRoutes.ts`'s own
+ *  (unexported) `getCodexTransportErrorCode` does: a direct `.code`, falling
+ *  back to `.cause.code`. Kept here, independently, as a pure utility the
+ *  trigger-policy classifier can be exercised against without importing a
+ *  route-handler module. */
+export function parseCodexErrorCode(error) {
+    if (!error || typeof error !== "object") {
+        return undefined;
+    }
+    const directCode = error.code;
+    if (typeof directCode === "string") {
+        return directCode;
+    }
+    const cause = error.cause;
+    if (!cause || typeof cause !== "object") {
+        return undefined;
+    }
+    const causeCode = cause.code;
+    return typeof causeCode === "string" ? causeCode : undefined;
+}
+/**
+ * Classify one `codexProxyRoutes.ts` `dispatch()` failure into an
+ * outbound-fallback eligibility decision. A total function over
+ * `CodexOutboundFailureClass` (exhaustive switch, no `default:`): a missing
+ * case fails to compile under `noImplicitReturns`, never falls through to a
+ * silent `undefined`.
+ *
+ * `context_preflight` / `token_budget` errors are never modeled here: both
+ * are self-contained terminal returns inside `dispatch()`'s own outer `try`,
+ * before any of the four insertion points this classifier serves, so they
+ * never reach it.
+ */
+export function classifyCodexOutboundFailure(input) {
+    switch (input.failureClass) {
+        case "no_accounts":
+            return {
+                eligible: true,
+                reason: "no Codex accounts are configured for this request",
+            };
+        case "pool_exhausted":
+            return {
+                eligible: true,
+                reason: "every configured Codex account is cooling down or otherwise unhealthy",
+            };
+        case "loop_fallthrough": {
+            // A bare 401/403 is a credential failure on Codex's own OAuth pool,
+            // which says nothing about the fallback target; only the error code can
+            // tell a content-policy 403 from an auth one.
+            if (classifyProxyFailureCode(input.lastErrorCode).retryable === false) {
+                return {
+                    eligible: false,
+                    reason: `the last exhausted account attempt ended in ${input.lastErrorCode ?? "unknown"}, a rejection of the request itself rather than a Codex pool failure`,
+                };
+            }
+            const status = input.lastStatus;
+            if (status !== undefined &&
+                status >= 400 &&
+                status < 500 &&
+                status !== 401 &&
+                status !== 403 &&
+                status !== 429) {
+                return {
+                    eligible: false,
+                    reason: `the last exhausted account attempt ended in a ${status}, a rejection of the request itself rather than a Codex pool failure`,
+                };
+            }
+            return {
+                eligible: true,
+                reason: "the account-retry loop exhausted every eligible Codex account without a terminal response",
+            };
+        }
+        case "non_retryable_transport": {
+            // Reuses the same classifier the Claude engine's own failure handling
+            // relies on, as loop_fallthrough does: a content-policy or
+            // invalid-request code is not a pool problem, and not something a
+            // different upstream is likely to answer differently.
+            if (classifyProxyFailureCode(input.transportErrorCode).retryable === false) {
+                return {
+                    eligible: false,
+                    reason: `transport error ${input.transportErrorCode ?? "unknown"} rejects the request itself, not a Codex pool failure`,
+                };
+            }
+            return {
+                eligible: true,
+                reason: `non-retryable transport error ${input.transportErrorCode ?? "unknown"} exhausted this Codex account attempt`,
+            };
+        }
+    }
+}

package/dist/proxy/codexResponsesFormat.js

@@ -83,14 +83,20 @@ function mapClaudeStopReasonToCodex(stopReason) {
 export function synthesizeCodexUsage(usage) {
     const cacheRead = usage.cache_read_input_tokens;
     const cacheCreation = usage.cache_creation_input_tokens;
+    const cacheCreation1h = usage.cacheCreation1hTokens;
     const inputTokens = usage.input_tokens + (cacheRead ?? 0) + (cacheCreation ?? 0);
-    const details = cacheRead === undefined && cacheCreation === undefined
+    const details = cacheRead === undefined &&
+        cacheCreation === undefined &&
+        cacheCreation1h === undefined
         ? undefined
         : {
             ...(cacheRead === undefined ? {} : { cached_tokens: cacheRead }),
             ...(cacheCreation === undefined
                 ? {}
                 : { cache_write_tokens: cacheCreation }),
+            ...(cacheCreation1h === undefined
+                ? {}
+                : { cache_write_1h_tokens: cacheCreation1h }),
         };
     return {
         input_tokens: inputTokens,

package/dist/proxy/codexToAnthropicFallback.js

@@ -21,6 +21,7 @@
  */
 import { preflightAnthropicStream } from "./streamOutcome.js";
 import { extractSSEEvents } from "./sseInterceptor.js";
+import { readCacheCreation1hTokens, oneHourCacheWriteFields, } from "./proxyTokenUsage.js";
 import { CodexResponsesStreamSerializer, serializeCodexResponse, } from "./codexResponsesFormat.js";
 import { CODEX_STREAM_MAX_TOOL_CALLS, CODEX_STREAM_SIZE_CEILING_BYTES, } from "./streamLimits.js";
 /** Empty by default so an existing caller (no `toolKindByName` argument) keeps
@@ -144,6 +145,7 @@ export async function consumeAnthropicFallbackResponse(response, model, toolKind
     const usage = parsed.usage;
     const cacheCreate = optionalNumber(usage.cache_creation_input_tokens);
     const cacheRead = optionalNumber(usage.cache_read_input_tokens);
+    const cacheCreate1h = readCacheCreation1hTokens(usage);
     const result = {
         ...parsed,
         usage: {
@@ -155,6 +157,7 @@ export async function consumeAnthropicFallbackResponse(response, model, toolKind
             ...(cacheRead === undefined
                 ? {}
                 : { cache_read_input_tokens: cacheRead }),
+            ...oneHourCacheWriteFields(cacheCreate1h),
         },
     };
     return serializeCodexResponse(result, model, toolKindByName);
@@ -204,6 +207,7 @@ export async function createAnthropicFallbackStream(response, model, toolKindByN
         let capturedOutput = 0;
         let capturedCacheCreate;
         let capturedCacheRead;
+        let capturedCacheCreate1h;
         let capturedStopReason = null;
         // input_json_delta also streams for server_tool_use blocks, which have no
         // Codex function_call to feed; only a tool_use block's fragments count.
@@ -220,6 +224,7 @@ export async function createAnthropicFallbackStream(response, model, toolKindByN
                         capturedInput = nonNegativeNumber(usage.input_tokens);
                         capturedCacheCreate = optionalNumber(usage.cache_creation_input_tokens);
                         capturedCacheRead = optionalNumber(usage.cache_read_input_tokens);
+                        capturedCacheCreate1h = readCacheCreation1hTokens(usage);
                     }
                     return undefined;
                 }
@@ -304,6 +309,7 @@ export async function createAnthropicFallbackStream(response, model, toolKindByN
                         ...(capturedCacheRead === undefined
                             ? {}
                             : { cache_read_input_tokens: capturedCacheRead }),
+                        ...oneHourCacheWriteFields(capturedCacheCreate1h),
                     });
                 case "error": {
                     // A mid-stream upstream error ends the turn: without this case it

package/dist/proxy/proxyAnalysis.js

@@ -512,6 +512,9 @@ function summarizeFinalRequests(finalRequests, terminalStreamErrors, attemptsByR
                 outputTokens: request.outputTokens ?? 0,
                 cacheCreationTokens: request.cacheCreationTokens ?? 0,
                 cacheReadTokens: request.cacheReadTokens ?? 0,
+                ...(request.cacheCreation1hTokens !== null
+                    ? { cacheCreation1hTokens: request.cacheCreation1hTokens }
+                    : {}),
             });
             requestsWithUsage += 1;
             inputTokens += billingUsage.input;
@@ -1088,6 +1091,7 @@ export async function analyzeProxyLogs(options) {
                 outputTokens: finiteNumber(record.outputTokens),
                 cacheReadTokens: finiteNumber(record.cacheReadTokens),
                 cacheCreationTokens: finiteNumber(record.cacheCreationTokens),
+                cacheCreation1hTokens: finiteNumber(record.cacheCreation1hTokens),
                 // Read as a boolean only. An absent flag means observed, which keeps
                 // every record written before the flag existed counting as it did.
                 // The merge below drops undefined from the later record, so a