@bitkyc08/opencodex 2.14.1 → 2.14.2

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "c2501a020b2b8a7c01f0199dc7a1d7763d82181fe7a329bd2b265fd7474ec994"
+      "sha256": "e9ef4aa5a62aa64f795882518ae1821b3b49b5ce002310f3b1b5e5b512abdc05"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -50,7 +50,7 @@
     },
     {
       "path": "src/adapters/command-code.ts",
-      "sha256": "7b969b84c92664588d5b427676743b05169ccc9b26b140e244279186b6c08b4a"
+      "sha256": "e92d27e7988deaad93169778a57ca0afbf2f94b1ea14ba382618ea7617f14e3f"
     },
     {
       "path": "src/adapters/cursor.ts",
@@ -158,7 +158,7 @@
     },
     {
       "path": "src/adapters/cursor/request-builder.ts",
-      "sha256": "d2a9a7fe975c4c858df2bcb5b2b2c5ba43a931b1a959a18dcc504613fabc1eb1"
+      "sha256": "b2c76bb40171e70827c0119c28f246f41332dbc6965035abe37054220795ea30"
     },
     {
       "path": "src/adapters/cursor/thread-continuity.ts",
@@ -166,7 +166,7 @@
     },
     {
       "path": "src/adapters/cursor/tool-definitions.ts",
-      "sha256": "66f6c5c6b6f25c0d58cd63f6a23b8e3bf4192ac8f3608b1cfe37c9bec7d5901c"
+      "sha256": "be643963a3f36fe2c68bafb3f3a82ba5e9b59114d689f79cf83383c5852ff34f"
     },
     {
       "path": "src/adapters/cursor/transport-retry.ts",
@@ -262,7 +262,7 @@
     },
     {
       "path": "src/adapters/kiro.ts",
-      "sha256": "a134e30227b79c9ee6c64124f40f86150b06b5f1175dde565f31f14679a499e8"
+      "sha256": "c396bcf9810a1381f71957f95ed8399a13e240f5dc6be878c8836dfa7ca66f52"
     },
     {
       "path": "src/adapters/mimo-free.ts",
@@ -274,7 +274,7 @@
     },
     {
       "path": "src/adapters/openai-chat.ts",
-      "sha256": "7700ec687a4cb7516c9cc975ac6726ab1ad858fe4b39a342aea155bd2be291c4"
+      "sha256": "1fcd9a2da1e675026fa2ac03b396cefa7cd62e3c1baf27844bbe7fd589c70275"
     },
     {
       "path": "src/adapters/openai-responses-url.ts",
@@ -282,7 +282,7 @@
     },
     {
       "path": "src/adapters/openai-responses.ts",
-      "sha256": "78013f261ce7f7b5f06ad8fa02f49c8d5c58ab4a2718d8571d41812cfe71b605"
+      "sha256": "9c8d4483c0dacf3bf0562f08fe61b43d3c3107f1a978d66fc916c3da5dfe1d17"
     },
     {
       "path": "src/adapters/run-turn-queue.ts",
@@ -290,7 +290,7 @@
     },
     {
       "path": "src/adapters/tool-catalog-nudge.ts",
-      "sha256": "b20b726a97b85e4199ad2bcf2dfebf4040b392224e9f3b9671b00abb2c54ca81"
+      "sha256": "bf2bc3f1860ef7264df4a2f438df55cc46326c31e1a16e37f1d92b5446b5937b"
     },
     {
       "path": "src/adapters/upstream-http-error.ts",
@@ -298,7 +298,7 @@
     },
     {
       "path": "src/bridge.ts",
-      "sha256": "20c2c4b1f40828b01a223e64c415dd34c98acb0fcd78ece6dab7bfee333a5b22"
+      "sha256": "137c6d4b5cc3e7c932fed242b5200469171ae786b4835bec7f667f15a1d79a75"
     },
     {
       "path": "src/chat/inbound.ts",
@@ -466,7 +466,7 @@
     },
     {
       "path": "src/cli/init.ts",
-      "sha256": "211045465b1ecf46b0653234b8339425d42ee2fbcbdf216525ec6ed57ab20b3e"
+      "sha256": "753945880735c59dd35f3e2143a9b032945769f3ef9d8f5859c64b4493db39d0"
     },
     {
       "path": "src/cli/integrations.ts",
@@ -638,7 +638,7 @@
     },
     {
       "path": "src/codex/catalog.ts",
-      "sha256": "b3a69c6d7093c4acd570f02e2704d8e3c804c14114e461444d208e9d69db1670"
+      "sha256": "ae99f51a899f5fdd753b1bd605b47d8f658885648cf26e5d1d001b5f75bb8134"
     },
     {
       "path": "src/codex/catalog/account-models.ts",
@@ -654,7 +654,7 @@
     },
     {
       "path": "src/codex/catalog/effort.ts",
-      "sha256": "f76a68fa34639b16c044990af869b4be5e6dd326741b7c0e3f0f9655f22f4da3"
+      "sha256": "c859382789a4edf333b0e269dac54ff3a29cb205de9d07e36979a20c93fbef02"
     },
     {
       "path": "src/codex/catalog/filesystem-evidence.ts",
@@ -666,23 +666,23 @@
     },
     {
       "path": "src/codex/catalog/metadata.ts",
-      "sha256": "49066e273177f772fa0adc6ee9ecb8258e3b9591d244d01fc3f6fdf0d2e695a6"
+      "sha256": "da2aff0057e1b98d62e481043b2f16fb9679b4df4226e9754963b7262fde2691"
     },
     {
       "path": "src/codex/catalog/native-models.ts",
-      "sha256": "86d7789553db1b2d70f7183c39fab59921dd704403370a0a8a7909adeff78e02"
+      "sha256": "3d8a70d56fee1cf503da01c62608b338c3ec293114d1825c0bd1f96f817cda99"
     },
     {
       "path": "src/codex/catalog/parsing.ts",
-      "sha256": "b73918da5145d0422484d29bcaf05d00cd044ef1866187ff36168cfcb1aa16d9"
+      "sha256": "2c3e16a4615e98d0bea0acee6994661eddeb7df80488a44d4bec253bb7ca1e79"
     },
     {
       "path": "src/codex/catalog/provider-fetch.ts",
-      "sha256": "9f2bb70bcc8efe942b13c7b94cb06387948a2db8baba9042114787f3a5de8931"
+      "sha256": "61c35c9a09ada9c79f2b2979612e6ef618d735afa0b33d5f5915b5ab2e39ccde"
     },
     {
       "path": "src/codex/catalog/sync.ts",
-      "sha256": "c285b373e030af62e33976ccb7e8b0f6ec2741783e24853404fdf1dfc4c19283"
+      "sha256": "6f2846d1b03ffb21b73381ba833703f14b303532c0ef028945cd463ecc639beb"
     },
     {
       "path": "src/codex/codex-write-lock.ts",
@@ -966,7 +966,7 @@
     },
     {
       "path": "src/config.ts",
-      "sha256": "dbbabcdc1f62870ed69ecc6da675b7f82705d3f97179ad4841ad4ca368cd5932"
+      "sha256": "d98507303396605a2f698448295572038d6f30f3593af58910d04ecec918e9b8"
     },
     {
       "path": "src/generated/model-metadata.ts",
@@ -1474,7 +1474,7 @@
     },
     {
       "path": "src/lib/app-owned-memory-stores.ts",
-      "sha256": "d4852d93145f8a765bf0374bd37e734970e2eb50bb559ea8a42f3921aa05e8c9"
+      "sha256": "947c1cd5bdff6e15de778a76eb4d2d4cf103bf482354d2736003807b2e8d409c"
     },
     {
       "path": "src/lib/app-owned-memory.ts",
@@ -1652,6 +1652,10 @@
       "path": "src/lib/token-estimate.ts",
       "sha256": "2c3cc4b8193166ca100197ca22202b06ac98c02547ffe32f3e0f8720190b9897"
     },
+    {
+      "path": "src/lib/tool-argument-integers.ts",
+      "sha256": "f0a2d8dea66735881d7aebf98ebe3b2657fb6422f540289e0aba1721d17ec990"
+    },
     {
       "path": "src/lib/translator-budget.ts",
       "sha256": "872d5d35eb0d2ee099fc4ab4bf3b9331c6207d4282f61f2c1b11a5a36c00d981"
@@ -1782,7 +1786,7 @@
     },
     {
       "path": "src/oauth/nous.ts",
-      "sha256": "76013229a77a53b3eab34d14f73e84ecef693f4e7939e37414570cb5ff751549"
+      "sha256": "49fb089b01a8a118e575069d2308912b7fd661ef882913193b0e9f4d8df28201"
     },
     {
       "path": "src/oauth/pkce.ts",
@@ -1826,7 +1830,7 @@
     },
     {
       "path": "src/providers/base-url-choices.ts",
-      "sha256": "ec5f3f084616f79dde7149d1bb5dc88bb9b3c406cd08698e499863c15c375c7f"
+      "sha256": "f75c050dd851d38fd90335def782699aea43f89930dfff95060fa88d9724a9a6"
     },
     {
       "path": "src/providers/codex-capacity.ts",
@@ -1834,7 +1838,7 @@
     },
     {
       "path": "src/providers/command-code-efforts.ts",
-      "sha256": "437845ad99e09307450889f149dd7770a69770dbcd4d024506f560e739804292"
+      "sha256": "279cf80e7d2a3e2019f23bb8761f4cb7a6a58d0ce754b974e1b3d759c76bbff1"
     },
     {
       "path": "src/providers/context-cap.ts",
@@ -1876,13 +1880,21 @@
       "path": "src/providers/model-discovery.ts",
       "sha256": "298d6f169883bfd5de3b6059fb3ae71c07328d0cec85cf4e188b80e78a50edc6"
     },
+    {
+      "path": "src/providers/model-rename-migration.ts",
+      "sha256": "cc3bd468dba3387eff13aedaa1fc48e68ea328fb5bc77c02d17bd84dce5e6393"
+    },
+    {
+      "path": "src/providers/model-rename-startup.ts",
+      "sha256": "8a143284d736759bf63c8cb296c19e61dec9596dfc781d8dd87038778153f55f"
+    },
     {
       "path": "src/providers/openai-sidecar.ts",
       "sha256": "d07ec55e8600563fa9cbdb9e535cfecb8163b8235aa44547c9359f6ca8ce62d1"
     },
     {
       "path": "src/providers/openai-tier-startup.ts",
-      "sha256": "5dc89dd548d71a5f5e25b85a5f924125f4faeb74c23a327f74294eb40ba414d0"
+      "sha256": "41256c1ef4b2271168a52dcfb3ab986077cfa8edc0386230a01f5b196155ca42"
     },
     {
       "path": "src/providers/openai-tiers.ts",
@@ -1906,11 +1918,11 @@
     },
     {
       "path": "src/providers/quota.ts",
-      "sha256": "d2d0f30c3e8dad900c8dce0ba0278a975f809b5e39830def8d59fe8663aefa99"
+      "sha256": "fa2d207d569be34fd50fd72b90389e3e4147c5101cce4318629f3f21172a5e9a"
     },
     {
       "path": "src/providers/registry.ts",
-      "sha256": "f2a1b6f538bc7939bb98d9d0187c3350c6c46d9c844a3019a9f56582aa816c12"
+      "sha256": "cfa71c40b3f93b2e21e62838ddbfb42ff93577b077f6aadbe34158089aedb307"
     },
     {
       "path": "src/providers/slug-codec.ts",
@@ -1954,11 +1966,11 @@
     },
     {
       "path": "src/responses/spill-store.ts",
-      "sha256": "f16559b63a214861cbbc47908653b831ae7ade2aa88f1cfd3c0907373d668f99"
+      "sha256": "c0cd3343d0803eb6d14203f19d6ee38f33110042d8aa896cc9f60bd422ca8f21"
     },
     {
       "path": "src/responses/state.ts",
-      "sha256": "7d5586e7b48ced98e9ca38ee077fc828a53ab2425651c258688b43fb608542e7"
+      "sha256": "59952393060143aae734770fbf78761a8cc69e5b6335c6452bdf5ac7da686bb4"
     },
     {
       "path": "src/responses/tool-groups.ts",
@@ -2102,7 +2114,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "cdf8ee40eeed9a69cfcb7ab95730b131ba57dad547349f74d585ffca97f171b9"
+      "sha256": "cff5571eb50f6ec315fa2f3ddd835d3bdd25b59c94a5b991771f066ad3e3ffc2"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2138,7 +2150,7 @@
     },
     {
       "path": "src/server/management/api-key-usage.ts",
-      "sha256": "37ef0b22cb1b7b2a03177c39cf609ebe40183aeadeab11462a17e67cc2e6848f"
+      "sha256": "86a9fbebb6986d115b46e32da123b706d9ee773881bfa5e13b9d87554d89001f"
     },
     {
       "path": "src/server/management/body.ts",
@@ -2170,7 +2182,7 @@
     },
     {
       "path": "src/server/management/logs-usage-routes.ts",
-      "sha256": "bcd6c00783c78a3dd1a5b71a482f15595fefcf07610506729e309bd312b3e2f2"
+      "sha256": "645c8902e0d3b589a5b20a7d607fb9b40197f34a4c73945a4bf9fd91336bf15e"
     },
     {
       "path": "src/server/management/model-routes.ts",
@@ -2190,7 +2202,7 @@
     },
     {
       "path": "src/server/management/provider-routes.ts",
-      "sha256": "d5a5a4980f1a5cf56a994a8d2b454c86c376ec9161b3e67903b1fc768bf59cf2"
+      "sha256": "af98e4f45ae93adcc5e66e2b51f0dc08c0a3406924b5a63b97698dcdc1eeeb1d"
     },
     {
       "path": "src/server/management/request-history-routes.ts",
@@ -2226,7 +2238,7 @@
     },
     {
       "path": "src/server/management/usage-summary-cache.ts",
-      "sha256": "fb1b889f645afb2efb02f49d78f3390c504d073867af627ace9d29f97318fc9f"
+      "sha256": "a8a386202dac11802e51c3bef85ce868363f80ed05aef9db3775109e40a2aba2"
     },
     {
       "path": "src/server/management/vision-sidecar-options.ts",
@@ -2314,7 +2326,7 @@
     },
     {
       "path": "src/server/responses/collaboration.ts",
-      "sha256": "e3bcb01890c2d5e3b2f5032de223a537455c21bf06a134e4f5c828c6b56dc243"
+      "sha256": "bfeef4d9bf5538d850446d5805769779518b62f8ef33693ecfd1c48f8545093e"
     },
     {
       "path": "src/server/responses/compact.ts",
@@ -2322,7 +2334,7 @@
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "e115d89db4e94c910ea74976c259260b6dd9f6d0238a82ba16a3fe49b12bfa86"
+      "sha256": "c67fdae5470a8d0c234e24d7d062bf351ec35c911550363c8d73199f4059fc95"
     },
     {
       "path": "src/server/responses/encrypted-payload.ts",
@@ -2370,7 +2382,7 @@
     },
     {
       "path": "src/server/startup-health-cache.ts",
-      "sha256": "2ef39b33ec79cd6f8d1bf9040ce1510c32142a643d7a9e2ba56690fe23995da5"
+      "sha256": "0193264ad0f951085d774e052342385aa5043fa2b0dbd5fba224a4b790604f1f"
     },
     {
       "path": "src/server/system-env.ts",
@@ -2526,7 +2538,7 @@
     },
     {
       "path": "src/usage/log.ts",
-      "sha256": "b96cacb9e6eaac59eeaee8f5124a985cc0d14169364401eec80a10a8d3a24a76"
+      "sha256": "db69314bab2520a05889a3cef8c1de042ecdcdb67792f687399eb23c140e2c75"
     },
     {
       "path": "src/usage/summary.ts",

package/src/lib/app-owned-memory-stores.ts

@@ -34,6 +34,10 @@ import {
   evictOldestUsageSummaryForBudget,
   usageSummaryRetainedStoreSnapshot,
 } from "../server/management/usage-summary-cache";
+import {
+  discardRetainedUsageSnapshot,
+  retainedUsageSnapshotStats,
+} from "../usage/log";
 import {
   cursorBlobRetainedStoreSnapshot,
   evictOldestCursorBlobForBudget,
@@ -57,6 +61,18 @@ function ringSnapshot(metrics: { entries: number; bytes: number; oldestAt: numbe
   };
 }
 
+/** The retained usage tail is a single all-or-nothing entry: evicting it drops the whole tail. */
+function usageSnapshotRetainedStoreSnapshot(): RetainedStoreSnapshot {
+  const stats = retainedUsageSnapshotStats();
+  return {
+    count: stats.count,
+    bytes: stats.bytes,
+    evictableBytes: stats.bytes,
+    pinnedBytes: 0,
+    oldestAt: stats.oldestAt,
+  };
+}
+
 function providerDebugSnapshot(): RetainedStoreSnapshot {
   return ringSnapshot(debugBufferMetrics());
 }
@@ -134,6 +150,12 @@ export const APP_OWNED_RETAINED_STORE_REGISTRATIONS = [
     snapshot: usageSummaryRetainedStoreSnapshot,
     evictOldest: evictOldestUsageSummaryForBudget,
   },
+  {
+    id: "usage_snapshot",
+    category: "caches",
+    snapshot: usageSnapshotRetainedStoreSnapshot,
+    evictOldest: discardRetainedUsageSnapshot,
+  },
   {
     id: "cursor_blobs",
     category: "blobs",

package/src/lib/tool-argument-integers.ts

@@ -0,0 +1,158 @@
+// Schema-aware repair for integer tool arguments that arrive as floats (issue #1611).
+//
+// Grok serializes integer tool-call arguments through a float representation, so
+// `yield_time_ms: 120000` leaves the provider as `120000.0`. Codex declares those
+// fields as Rust integer types, so it rejects the call BEFORE running the tool:
+//
+//   failed to parse function arguments: invalid type: floating point `120000.0`, expected u64
+//
+// That is a hard failure, not a degradation — the model gets no result and retries
+// the same float. Nothing on the routed path reconciled argument values against the
+// declared schema, so the `.0` passed straight through.
+//
+// The boundary this file draws is INTENT, not convenience:
+//   - an integral float in an integer-typed field is a representation artifact, and
+//     `120000.0` has exactly one integer reading, so it is repaired;
+//   - `1.5` in an integer field is a genuine disagreement with the schema and is left
+//     alone so it still fails, rather than being truncated into a plausible lie.
+// Anything without a declared `integer` type is never touched.
+
+/** JSON Schema subset we need; provider tool schemas are untrusted input. */
+type SchemaNode = Record<string, unknown>;
+
+function asSchema(value: unknown): SchemaNode | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as SchemaNode
+    : undefined;
+}
+
+/** True when the node declares `integer`, including `["integer","null"]` unions. */
+function declaresInteger(schema: SchemaNode): boolean {
+  const type = schema.type;
+  if (type === "integer") return true;
+  return Array.isArray(type) && type.includes("integer");
+}
+
+/**
+ * Resolve a local `$ref` (`#/$defs/Foo`, `#/definitions/Foo`).
+ *
+ * Only same-document refs are followed: a remote ref is not fetchable here, and a
+ * schema we cannot resolve must leave its values untouched rather than guessed at.
+ */
+function resolveRef(schema: SchemaNode, root: SchemaNode, seen: Set<string>): SchemaNode | undefined {
+  const ref = schema.$ref;
+  if (typeof ref !== "string" || !ref.startsWith("#/")) return schema;
+  if (seen.has(ref)) return undefined; // cyclic $ref: stop rather than recurse forever
+  seen.add(ref);
+  let node: unknown = root;
+  for (const rawSegment of ref.slice(2).split("/")) {
+    const segment = rawSegment.replace(/~1/g, "/").replace(/~0/g, "~");
+    const current = asSchema(node);
+    if (!current) return undefined;
+    node = current[segment];
+  }
+  const resolved = asSchema(node);
+  return resolved ? resolveRef(resolved, root, seen) : undefined;
+}
+
+/** Composition keywords whose branches may carry the integer declaration. */
+const COMPOSITION_KEYS = ["anyOf", "oneOf", "allOf"] as const;
+
+function compositionBranches(schema: SchemaNode): SchemaNode[] {
+  const branches: SchemaNode[] = [];
+  for (const key of COMPOSITION_KEYS) {
+    const value = schema[key];
+    if (!Array.isArray(value)) continue;
+    for (const branch of value) {
+      const node = asSchema(branch);
+      if (node) branches.push(node);
+    }
+  }
+  return branches;
+}
+
+/**
+ * A JS number can only represent integers exactly up to 2^53-1. Beyond that a
+ * rewrite would emit a silently different value, so the original text stays.
+ */
+function safelyIntegral(value: number): boolean {
+  return Number.isInteger(value) && Math.abs(value) <= Number.MAX_SAFE_INTEGER;
+}
+
+interface CoerceResult {
+  value: unknown;
+  changed: boolean;
+}
+
+function coerceValue(value: unknown, schema: SchemaNode | undefined, root: SchemaNode, depth: number): CoerceResult {
+  // A hostile or deeply nested schema must not blow the stack.
+  if (depth > 64) return { value, changed: false };
+  const resolved = schema ? resolveRef(schema, root, new Set()) : undefined;
+
+  if (typeof value === "number") {
+    if (!resolved) return { value, changed: false };
+    const integerDeclared = declaresInteger(resolved)
+      || compositionBranches(resolved).some(declaresInteger);
+    // Not an integer field, already an integer, non-integral, or unrepresentable:
+    // in every one of those cases the received value is the right thing to keep.
+    if (!integerDeclared || !safelyIntegral(value)) return { value, changed: false };
+    // `120000.0` and `120000` are the same JS number; the difference is only in the
+    // serialized text, which is repaired by re-stringifying the parsed value.
+    return { value, changed: true };
+  }
+
+  if (Array.isArray(value)) {
+    const itemSchema = resolved ? asSchema(resolved.items) : undefined;
+    let changed = false;
+    const next = value.map(entry => {
+      const result = coerceValue(entry, itemSchema, root, depth + 1);
+      if (result.changed) changed = true;
+      return result.value;
+    });
+    return changed ? { value: next, changed } : { value, changed: false };
+  }
+
+  const object = asSchema(value);
+  if (!object) return { value, changed: false };
+
+  const properties = resolved ? asSchema(resolved.properties) : undefined;
+  const additional = resolved ? asSchema(resolved.additionalProperties) : undefined;
+  let changed = false;
+  const next: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(object)) {
+    const childSchema = asSchema(properties?.[key]) ?? additional;
+    const result = coerceValue(entry, childSchema, root, depth + 1);
+    if (result.changed) changed = true;
+    next[key] = result.value;
+  }
+  return changed ? { value: next, changed } : { value, changed: false };
+}
+
+/**
+ * Repair integral floats in a tool-call arguments STRING against the tool's declared
+ * parameter schema.
+ *
+ * Returns the original string unchanged when there is no schema, the payload does not
+ * parse, or nothing needed repair — so an unaffected call keeps its exact bytes and
+ * this stays a no-op for every provider that already emits real integers.
+ */
+export function coerceIntegerToolArguments(
+  args: string,
+  parameters: Record<string, unknown> | undefined,
+): string {
+  if (!parameters || !args) return args;
+  // Cheap reject: a payload with no fractional-looking number cannot need repair.
+  if (!/\d\.\d/.test(args)) return args;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(args);
+  } catch {
+    // Malformed or still-streaming arguments are not this function's problem; the
+    // existing paths already handle them.
+    return args;
+  }
+  const root = parameters as SchemaNode;
+  const result = coerceValue(parsed, root, root, 0);
+  if (!result.changed) return args;
+  return JSON.stringify(result.value);
+}

package/src/oauth/nous.ts

@@ -39,6 +39,7 @@ import { join } from "node:path";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { getAuthStorePath } from "./store";
 import { atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "../config";
+import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 export const NOUS_PORTAL_BASE_URL = "https://portal.nousresearch.com";
 export const NOUS_INFERENCE_BASE_URL = "https://inference-api.nousresearch.com/v1";
@@ -87,6 +88,44 @@ interface NousJwtPayload {
   [key: string]: unknown;
 }
 
+async function readOAuthBytes(response: Response, signal: AbortSignal): Promise<Uint8Array> {
+  const { bytes, oversized } = await readBoundedResponseBytes(response, {
+    maxBytes: BOUNDED_BODY_MAX_BYTES,
+    signal,
+  });
+  if (oversized) {
+    throw new NousTokenError(
+      response.status,
+      "response_too_large",
+      `Nous Portal OAuth response exceeded the ${BOUNDED_BODY_MAX_BYTES}-byte limit`,
+    );
+  }
+  return bytes;
+}
+
+function parseOAuthJson(bytes: Uint8Array): unknown {
+  const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+    ? parsed as Record<string, unknown>
+    : {};
+}
+
+async function readOAuthJson(response: Response, signal: AbortSignal): Promise<unknown> {
+  return parseOAuthJson(await readOAuthBytes(response, signal));
+}
+
+async function readOAuthJsonOrEmpty(response: Response, signal: AbortSignal): Promise<unknown> {
+  const bytes = await readOAuthBytes(response, signal);
+  try {
+    return parseOAuthJson(bytes);
+  } catch {
+    // Preserve the pre-PR behavior for empty/HTML/malformed JSON only. Body
+    // read failures, timeouts, caller cancellation, and size-limit errors have
+    // already escaped readOAuthBytes and must retain their real identity.
+    return {};
+  }
+}
+
 // ── Durable refresh-intent (review blocker #2) ──────────────────────────────
 // A refresh-intent file records that we submitted `refreshToken` to the Portal
 // and whether we are certain the rotated token was persisted. It lives next to
@@ -495,6 +534,7 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
   expiresInMs: number;
   intervalMs: number;
 }> {
+  const effectiveSignal = requestSignal(signal);
   const response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/device/code`, {
     method: "POST",
     headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
@@ -503,14 +543,16 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
       scope: NOUS_OAUTH_SCOPE,
     }),
     redirect: "error",
-    signal: requestSignal(signal),
+    signal: effectiveSignal,
   });
-  if (!response.ok) throw tokenErrorFromPayload(response.status, await response.json().catch(() => ({})));
+  if (!response.ok) {
+    throw tokenErrorFromPayload(response.status, await readOAuthJsonOrEmpty(response, effectiveSignal));
+  }
   // A successful HTTP response may still carry an empty/HTML/non-JSON body.
   // Fall back to an empty object so the required-field check below produces the
   // clear "missing required fields" validation error instead of leaking a raw
   // JSON parser exception.
-  const payload = (await response.json().catch(() => ({}))) as NousDeviceAuthorizationResponse;
+  const payload = await readOAuthJsonOrEmpty(response, effectiveSignal) as NousDeviceAuthorizationResponse;
   const userCode = nonEmptyString(payload.user_code);
   const deviceCode = nonEmptyString(payload.device_code);
   const verificationUri = nonEmptyString(payload.verification_uri_complete) ?? nonEmptyString(payload.verification_uri);
@@ -549,6 +591,7 @@ async function pollForToken(
   while (Date.now() < deadline) {
     if (signal?.aborted) throw new Error("Login cancelled");
     let response: Response;
+    const effectiveSignal = requestSignal(signal);
     try {
       response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/token`, {
         method: "POST",
@@ -559,7 +602,7 @@ async function pollForToken(
           grant_type: "urn:ietf:params:oauth:grant-type:device_code",
         }),
         redirect: "error",
-        signal: requestSignal(signal),
+        signal: effectiveSignal,
       });
     } catch (netErr) {
       // Genuine cancellation must abort immediately. Any other transport-level
@@ -571,13 +614,15 @@ async function pollForToken(
       if (await sleepUntilDeadline(waitMs)) continue;
       break;
     }
+    // Parse under the same deadline that covered the request headers. Keep the
+    // read outside the fetch retry catch: a bounded-reader error or caller
+    // cancellation is an observed response failure, not a safe poll retry.
+    const payload = await readOAuthJsonOrEmpty(response, effectiveSignal) as NousTokenResponse;
     // Parse once and pass the payload through to the failure path (review #8),
     // so we never try to re-read a body that has already been consumed.
     // Normalize a successful-but-non-object body (for example valid JSON
     // `null`) to an empty object so the required-field validation below
     // produces a terminal NousTokenError instead of a raw TypeError.
-    const parsed = (await response.json().catch(() => ({}))) as unknown;
-    const payload = (parsed && typeof parsed === "object" ? parsed : {}) as NousTokenResponse;
     if (Date.now() >= deadline) break;
     if (response.ok) return parseTokenPayload(payload, "");
     const error = payload.error;
@@ -670,6 +715,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
   }
 
   let response: Response;
+  const effectiveSignal = requestSignal(signal);
   try {
     response = await fetch(`${baseUrl}/api/oauth/token`, {
       method: "POST",
@@ -683,7 +729,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
         client_id: NOUS_OAUTH_CLIENT_ID,
       }),
       redirect: "error",
-      signal: requestSignal(signal),
+      signal: effectiveSignal,
     });
   } catch (netErr) {
     // The request may have reached the server and rotated the token even on a
@@ -703,7 +749,6 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
 
   if (!response.ok) {
     const status = response.status;
-    const payload = await response.json().catch(() => ({}));
     // The request reached the Portal's token endpoint. A non-2xx response does
     // NOT establish that the single-use refresh token was not consumed: 429
     // rate limits, unknown/custom 4xx, and gateway-generated client-class
@@ -719,6 +764,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
       // The pre-dispatch "submitted" intent is still on disk, which also
       // blocks replay; surface the original HTTP error below.
     }
+    const payload = await readOAuthJsonOrEmpty(response, effectiveSignal);
     throw tokenErrorFromPayload(status, payload);
   }
 
@@ -727,7 +773,10 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
   // replay it. On success we deliberately LEAVE the intent as "submitted"
   // (the store clears it once the rotated token is persisted).
   try {
-    const creds = parseTokenPayload((await response.json()) as NousTokenResponse, refreshToken);
+    const creds = parseTokenPayload(
+      (await readOAuthJson(response, effectiveSignal)) as NousTokenResponse,
+      refreshToken,
+    );
     return creds;
   } catch (e) {
     try {