@bitkyc08/opencodex 2.17.0 → 2.18.2

package/src/adapters/cursor/tool-definitions.ts

@@ -200,6 +200,12 @@ export function cursorRequestHasShellAlias(tools: readonly Pick<OcxTool, "namesp
   return tools?.some(isBareCodexExecCommandTool) ?? false;
 }
 
+function cursorRequestHasExecutionPath(
+  tools: readonly Pick<OcxTool, "namespace" | "name">[] | undefined,
+): boolean {
+  return tools?.some(isCursorExecutionPathTool) ?? false;
+}
+
 export function cursorRequestAdvertisesApplyPatch(
   tools: readonly Pick<OcxTool, "namespace" | "name" | "freeform">[] | undefined,
   toolChoice?: OcxRequestOptions["toolChoice"],
@@ -249,14 +255,14 @@ export function cursorStructuredEditTools(
       name: CURSOR_EDIT_FILE_TOOL,
       cursorStructuredEdit: true,
       description:
-        "Replace one block of exact text in a file. OpenCodex converts the replacement into a Codex apply_patch change, which the Codex client applies with its normal approval and sandbox policy. old_string must match the current file content exactly at exactly one location (apply_patch rejects ambiguous hunks). Matching is line-based, so an edit cannot add or remove only the file's final newline, and old_string/new_string that are identical after line normalization are rejected as a no-op.",
+        "Replace one block of text in a file. OpenCodex converts the replacement into a Codex apply_patch change. Copy old_string and new_string with their exact leading whitespace — Codex may locate a line after trimming indent, but it writes new_string verbatim, so stripped indent silently corrupts the file. An empty old_string with a non-empty new_string creates a new file (Add File). If the same text appears more than once, the first match is updated. Matching is line-based, so an edit cannot add or remove only the file's final newline, and old_string/new_string that are identical after line normalization are rejected as a no-op.",
       parameters: { ...CURSOR_EDIT_FILE_INPUT_SCHEMA },
     },
     {
       name: CURSOR_MULTI_EDIT_TOOL,
       cursorStructuredEdit: true,
       description:
-        "Apply several exact-text replacements to one file. OpenCodex converts the edits into a single Codex apply_patch change, which the Codex client applies with its normal approval and sandbox policy. Each old_string must match the current file content exactly at exactly one location (apply_patch rejects ambiguous hunks). Edits are independent: every old_string is matched against the ORIGINAL file content, so a later edit must not rely on text introduced by an earlier one. Matching is line-based, so an edit cannot add or remove only the file's final newline, and old_string/new_string that are identical after line normalization are rejected as a no-op.",
+        "Apply several text replacements to one file. OpenCodex converts them into one Codex apply_patch change. Copy each old_string/new_string with exact leading whitespace. If a later edit's old_string is the text after an earlier replacement, OpenCodex folds those edits into one original-file hunk. Independent edits stay separate hunks. An empty old_string with a non-empty new_string creates a new file (Add File); do not mix that with an independent Update on the same path. If the same text appears more than once, the first match is updated. Matching is line-based, so an edit cannot add or remove only the file's final newline, and identical old/new after line normalization are rejected as a no-op.",
       parameters: { ...CURSOR_MULTI_EDIT_INPUT_SCHEMA },
     },
   ];
@@ -421,7 +427,7 @@ export function shouldUseNativeExecOnlyForGenericToolUse(
   text: string,
 ): boolean {
   const trimmed = text.trim();
-  if (trimmed.length === 0 || !cursorRequestHasShellAlias(tools) || !isGenericToolUseCountDemoPrompt(trimmed)) return false;
+  if (trimmed.length === 0 || !cursorRequestHasExecutionPath(tools) || !isGenericToolUseCountDemoPrompt(trimmed)) return false;
   return !/\b(?:mcp|resource|resources|tool_search|plugin|plugins|app connector|github)\b/i.test(trimmed)
     && !/(?:리소스|플러그인|깃허브|github)/i.test(trimmed);
 }
@@ -432,7 +438,7 @@ export function cursorToolsForActivePrompt<T extends Pick<OcxTool, "namespace" |
   toolChoice?: OcxRequestOptions["toolChoice"],
 ): readonly T[] | undefined {
   if (!shouldUseNativeExecOnlyForGenericToolUse(tools, activeText)) return tools;
-  const execTools = tools?.filter(isBareCodexExecCommandTool);
+  const execTools = tools?.filter(isCursorExecutionPathTool);
   const catalog = tools ?? [];
   if (execTools?.length && !execTools.some(tool => cursorToolAllowedByChoice(tool, toolChoice, catalog))) return tools;
   return execTools && execTools.length > 0 ? execTools : tools;
@@ -558,7 +564,7 @@ export function buildCursorToolGuidanceSystemNote(
   // Host-shell-neutral: the Codex client executes bridge commands, and may differ from
   // the OpenCodex proxy OS (LAN/SSH remote-proxy). Always cover PowerShell 5.1 pitfalls.
   const hostShellNote = hasBareExec
-    ? "Match shell syntax to the Codex client host that runs the bridge (not only the proxy OS). Windows PowerShell 5.1: no CMD `cd /d`, no bash heredocs (`<<EOF`); `&&`/`||` are unsupported parser errors — prefer the bridge working-directory argument for directory changes, and use `if ($?) { ... }` for success-gated follow-up steps; do not treat `;` as a substitute for `&&`. POSIX: use portable commands. After a shell failure, make at most one corrected bridge attempt, then report the error and stop — do not repeat equivalent failing commands."
+    ? "Match shell syntax to the Codex client host that runs the bridge (not only the proxy OS). Windows PowerShell 5.1: no CMD `cd /d`, no bash heredocs (`<<EOF`); `&&`/`||` are unsupported parser errors — prefer the bridge working-directory argument for directory changes, and use `if ($?) { ... }` for success-gated follow-up steps; do not treat `;` as a substitute for `&&`. POSIX: use portable commands (`cat`/`ls`/`rg`); never emit Get-Content or Get-ChildItem unless the host shell is PowerShell. After a shell failure, make at most one corrected bridge attempt, then report the error and stop — do not repeat equivalent failing commands."
     : undefined;
   const notes = [
     `Cursor tool calls: available tool names are exactly ${listedNames}.`,
@@ -582,7 +588,7 @@ export function buildCursorToolGuidanceSystemNote(
       : undefined,
     hasApplyPatch
       ? structuredEditNames.length > 0
-        ? `For file edits, prefer the structured edit tools ${quotedNames(structuredEditNames)} — they take exact-match replacements that OpenCodex converts into Codex \`apply_patch\` changes for approval. Use \`apply_patch\` directly only when you can emit its exact freeform syntax (\`*** Begin Patch\` envelope with \`@@\` hunks and \`-\`/\`+\` line prefixes); never emit patch-like plain text as tool arguments.`
+        ? `For file edits, prefer the structured edit tools ${quotedNames(structuredEditNames)} — they take replacements that OpenCodex converts into Codex \`apply_patch\` changes. Include exact leading whitespace in old_string/new_string. Use \`apply_patch\` directly only with a \`*** Begin Patch\` envelope and bare \`@@\` hunks (never git-style \`@@ -n,m +n,m @@\`); never emit patch-like plain text as tool arguments.`
         : "For file edits, use the `apply_patch` tool, not built-in file write/delete tools."
       : undefined,
     hasBareExec

package/src/adapters/google.ts

@@ -45,6 +45,25 @@ const GOOGLE_BREVITY_INSTRUCTION = [
   "- This applies only to intermediate progress text. Your final answer after the work is done is exempt: write it in full and at whatever length the task requires.",
 ].join("\n");
 
+/**
+ * Google renamed the current Gemini Flash generations on the Generative Language API,
+ * appending a `-tiered` suffix (`gemini-3.7-flash` -> `gemini-3.7-flash-tiered`). The
+ * old `gemini-3.7-flash` path 404s, so a saved config or registry entry naming the base
+ * id must be resolved here before it reaches the URL. The user-facing id is deliberately
+ * left alone: the picker, the catalog, the usage log and the price overlays all stay
+ * keyed on the base id, and only the wire path learns the new spelling.
+ */
+const GEMINI_DIRECT_WIRE_RENAMES: Record<string, string> = {
+  "gemini-3.7-flash": "gemini-3.7-flash-tiered",
+  "gemini-3.6-flash": "gemini-3.6-flash-tiered",
+};
+
+function resolveDirectGeminiWireModelId(modelId: string): string {
+  return Object.hasOwn(GEMINI_DIRECT_WIRE_RENAMES, modelId)
+    ? GEMINI_DIRECT_WIRE_RENAMES[modelId]!
+    : modelId;
+}
+
 /** Vertex API key: provider.apiKey if it looks real (not a sentinel), else GOOGLE_CLOUD_API_KEY env. */
 function resolveVertexApiKey(optKey?: string): string | undefined {
   const realKey = optKey && !optKey.startsWith("<") && optKey !== "N/A" ? optKey : undefined;
@@ -353,7 +372,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
             parsed.modelId,
             mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning),
           ).wireModelId
-        : parsed.modelId;
+        : resolveDirectGeminiWireModelId(parsed.modelId);
       const { systemInstruction, contents } = messagesToGeminiFormat(parsed, routedModelId);
       const tools = toolsToGeminiFormat(parsed);
 
@@ -501,7 +520,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       }
 
       // ai-studio (default): Generative Language API + x-goog-api-key.
-      const url = `${provider.baseUrl}/v1beta/models/${parsed.modelId}:${method}${streamParam}`;
+      const url = `${provider.baseUrl}/v1beta/models/${routedModelId}:${method}${streamParam}`;
       const apiKey = provider.apiKey?.trim();
       if (!apiKey) throw new Error("google (AI Studio) requires a non-empty API key");
       headers["x-goog-api-key"] = apiKey;

package/src/bridge.ts

@@ -92,10 +92,11 @@ function responseError(status: number, type: string, message: string): OcxErrorP
  * non-stream adapters degrade a bad payload to `{}`.
  */
 function toolCallArgumentsUsable(args: string): boolean {
+  if (args.length === 0) return true;
   const trimmed = args.trim();
-  if (!trimmed) return true;
+  if (!trimmed) return false;
   try {
-    JSON.parse(trimmed);
+    JSON.parse(args);
     return true;
   } catch {
     return false;
@@ -1593,6 +1594,15 @@ function buildResponseJSONWithBudget(
   };
 
   for (const e of events) {
+    if (errorEvent) {
+      // Match streaming: once the turn fails, later parallel calls must not become executable
+      // completed output. Still release every retained event in order and preserve terminal usage.
+      if (e.type === "error" || e.type === "incomplete" || e.type === "done") {
+        usage = e.usage ?? usage;
+      }
+      if (budget) releaseTranslatedEvent(e, budget);
+      continue;
+    }
     switch (e.type) {
       case "assistant_boundary":
         flushText("commentary");

package/src/cli/index.ts

@@ -216,6 +216,17 @@ async function handleStart(options: { block?: boolean } = {}) {
   const requestedPort = parsePortOption();
   const owner = await findProxyOwnerBeforeJournalRecovery();
   if (owner.live) {
+    // Service-wrapper context (opencodex-service.cmd `:loop`): a healthy proxy from
+    // ANY source means the requested port is already served. Exit 0 so the wrapper's
+    // `if %ERRORLEVEL% NEQ 0` retry loop terminates instead of respawning every 5s
+    // against a listener it can never claim (observed as an endless
+    // "Proxy already running" service.log loop).
+    // Only the exact "1" sentinel takes this path — the same check syncCleanup
+    // uses — so an env value like "0" or "false" cannot bypass the conflict error.
+    if (process.env.OCX_SERVICE === "1") {
+      console.log(`Proxy already running (PID ${owner.live.pid ?? owner.pidSnapshot ?? "unknown"}, port ${owner.live.port}); service wrapper staying out of the way.`);
+      process.exit(0);
+    }
     console.error(`⚠️  Proxy already running (PID ${owner.live.pid ?? owner.pidSnapshot ?? "unknown"}, port ${owner.live.port}). Use 'ocx stop' first.`);
     process.exit(1);
   }

package/src/codex/app-server-processes.ts

@@ -350,7 +350,7 @@ export function listWindowsSnapshots(): ProcessSnapshot[] {
   // executable resolves from the trusted System32 directory (never PATH), and
   // windowsHide keeps the enumeration console-less on desktop sessions (#1278).
   const output = execFileSync(resolveTrustedWindowsPowerShellExe(), [
-    "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
+    "-NoProfile", "-NoLogo", "-NonInteractive",
     "-Command",
     psCommand,
   ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 8_000, windowsHide: true });
@@ -461,7 +461,7 @@ function readDarwinProcStartMs(pid: number): number | null {
 function readWindowsProcStartMs(pid: number): number | null {
   try {
     const out = execFileSync(resolveTrustedWindowsPowerShellExe(), [
-      "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
+      "-NoProfile", "-NoLogo", "-NonInteractive",
       "-Command",
       `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").CreationDate.ToUniversalTime().ToString("o")`,
     ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 8_000, windowsHide: true }).trim();
@@ -517,7 +517,7 @@ export function readProcessStartMsBatch(
     try {
       const filter = pids.map(pid => `ProcessId=${pid}`).join(" OR ");
       const stdout = execFileSync(resolveTrustedWindowsPowerShellExe(), [
-        "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
+        "-NoProfile", "-NoLogo", "-NonInteractive",
         "-Command",
         `Get-CimInstance Win32_Process -Filter "${filter}" | ForEach-Object { "$($_.ProcessId)\t$($_.CreationDate.ToUniversalTime().ToString("o"))" }`,
       ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, windowsHide: true });

package/src/codex/user-identity.ts

@@ -53,15 +53,22 @@ function refuse(message: string, cause?: unknown): never {
 }
 
 function windowsIdentityPowerShellCommand(expression: string): string[] {
+  // PowerShell 5.1 can encode redirected native/host output with the active
+  // Windows code page. Base64 contains ASCII only, while the payload is
+  // explicitly UTF-16LE, so Korean and Western profile paths arrive unchanged.
+  const deterministicOutput = [
+    "$ErrorActionPreference = 'Stop'",
+    `$ocxValue = [string](${expression})`,
+    "$ocxBytes = [System.Text.Encoding]::Unicode.GetBytes($ocxValue)",
+    "[Console]::Out.Write([Convert]::ToBase64String($ocxBytes))",
+  ].join("; ");
   return [
     resolveTrustedWindowsPowerShellExe(),
     "-NoLogo",
     "-NoProfile",
     "-NonInteractive",
-    "-WindowStyle",
-    "Hidden",
     "-Command",
-    expression,
+    deterministicOutput,
   ];
 }
 
@@ -93,6 +100,28 @@ export function windowsIdentityPowerShellSpawnOptionsForTests(): ReturnType<
   return windowsIdentityPowerShellSpawnOptions();
 }
 
+function decodeWindowsIdentityPowerShellOutput(output: Uint8Array): string {
+  let encoded: string;
+  try {
+    encoded = new TextDecoder("utf-8", { fatal: true }).decode(output).trim();
+  } catch (cause) {
+    refuse("Windows effective-account lookup returned a malformed value.", cause);
+  }
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) {
+    refuse("Windows effective-account lookup returned a malformed value.");
+  }
+  const bytes = Buffer.from(encoded, "base64");
+  if (bytes.length % 2 !== 0 || bytes.toString("base64") !== encoded) {
+    refuse("Windows effective-account lookup returned a malformed value.");
+  }
+  return bytes.toString("utf16le").trim();
+}
+
+/** Test-only decode seam for the deterministic PowerShell output contract. */
+export function decodeWindowsIdentityPowerShellOutputForTests(output: Uint8Array): string {
+  return decodeWindowsIdentityPowerShellOutput(output);
+}
+
 function powershellValue(expression: string): string {
   let command: string[];
   try {
@@ -105,15 +134,16 @@ function powershellValue(expression: string): string {
     // `windowsHide` is the popup fix (#1278): the desktop proxy parent runs
     // without a console, so a console-subsystem child spawned without
     // CREATE_NO_WINDOW gets a fresh visible console window at startup and on
-    // every config write. `-WindowStyle Hidden` alone does not stop the
-    // allocation; the flag behind `windowsHide` does.
+    // every config write. Do not add PowerShell's `-WindowStyle Hidden` here:
+    // Bun 1.3.14 can fail that direct CLI combination before the SID command
+    // executes (#1589); the process-level `windowsHide` flag is sufficient.
     result = Bun.spawnSync(command, windowsIdentityPowerShellSpawnOptions());
   } catch (cause) {
     refuse("Windows effective-account lookup could not start.", cause);
   }
   if (result.exitedDueToTimeout) refuse("Windows effective-account lookup timed out.");
   if (result.exitCode !== 0) refuse("Windows effective-account lookup failed.");
-  const value = new TextDecoder().decode(result.stdout).trim();
+  const value = decodeWindowsIdentityPowerShellOutput(result.stdout ?? Buffer.alloc(0));
   if (!value) refuse("Windows effective-account lookup returned an empty value.");
   return value;
 }

package/src/config.ts

@@ -3578,8 +3578,6 @@ function readProcessCommandLine(pid: number): string | undefined {
         "-NoProfile",
         "-NoLogo",
         "-NonInteractive",
-        "-WindowStyle",
-        "Hidden",
         "-Command",
         `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}").CommandLine`,
       ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000, windowsHide: true });

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "b8810736c02b3cf34dbd0119082924f56a48e435cd9a0768c68c428f8e128cda"
+      "sha256": "c49e32901436d0c5d16ce428689fc389ce9647256fa7a1143afa2d96b046a30d"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -46,7 +46,7 @@
     },
     {
       "path": "src/adapters/client-fingerprint.ts",
-      "sha256": "6954cdf0885a7b55d179926117239c90e7f938b23ffd8c1b02392d183df4a253"
+      "sha256": "db85c96fb739ada2ddb2b811722d497cec0cbe692fa816920da6a97d10c202e4"
     },
     {
       "path": "src/adapters/command-code.ts",
@@ -102,7 +102,7 @@
     },
     {
       "path": "src/adapters/cursor/live-transport.ts",
-      "sha256": "7cc03eea3bb6b8ebd99dd134546e997d3eaf10e7c430a1bd7a0e3e283607ccef"
+      "sha256": "247e48058e2d22e282d2d49652cde998c5d13f36197898562510d99746993711"
     },
     {
       "path": "src/adapters/cursor/mcp-config.ts",
@@ -150,7 +150,7 @@
     },
     {
       "path": "src/adapters/cursor/protobuf-events.ts",
-      "sha256": "a5732084a5562242b7184321723ecf1a6e0009080d69f82fbea3ac66969d135f"
+      "sha256": "16faa16a8f5eeb5022a2f7332bd0739189bf3cd5b6dc1267730b14a78786bc08"
     },
     {
       "path": "src/adapters/cursor/protobuf-request.ts",
@@ -166,7 +166,7 @@
     },
     {
       "path": "src/adapters/cursor/tool-definitions.ts",
-      "sha256": "be643963a3f36fe2c68bafb3f3a82ba5e9b59114d689f79cf83383c5852ff34f"
+      "sha256": "95b440c3456085df1216ed1eb2659025edfc49e6ba121bd8231b46f32fa88870"
     },
     {
       "path": "src/adapters/cursor/transport-retry.ts",
@@ -210,7 +210,7 @@
     },
     {
       "path": "src/adapters/google.ts",
-      "sha256": "b2e57cd169f7b2a044624d64df557aff05424c06c026ffd055f0e009770325a4"
+      "sha256": "5fd50e67930ddac30951c2764b5dc8852252e75690fa4c7068a8f36d85932f82"
     },
     {
       "path": "src/adapters/identity.ts",
@@ -298,7 +298,7 @@
     },
     {
       "path": "src/bridge.ts",
-      "sha256": "137c6d4b5cc3e7c932fed242b5200469171ae786b4835bec7f667f15a1d79a75"
+      "sha256": "47ccd936f3abd32d98ea9f044d35acd353b16ee1c9f0f0542f4b519f63f52221"
     },
     {
       "path": "src/chat/inbound.ts",
@@ -462,7 +462,7 @@
     },
     {
       "path": "src/cli/index.ts",
-      "sha256": "63e8747afb606295340bd30598d7112b75efb2a89353234a874df42c5fc7e1a7"
+      "sha256": "d8c530cd151adc3ecbc243a63d5297c8c18001345aaaa708842d854e854faa6a"
     },
     {
       "path": "src/cli/init.ts",
@@ -606,7 +606,7 @@
     },
     {
       "path": "src/codex/app-server-processes.ts",
-      "sha256": "66f866e499edc75d7530a1a9230e77e7d9f6553579c64141ba73630f6ea91a7d"
+      "sha256": "4c55315be736f3e8fb0e19569d96d1235592d07a10fd243aa16a9d6925227f5f"
     },
     {
       "path": "src/codex/auth-api.ts",
@@ -930,7 +930,7 @@
     },
     {
       "path": "src/codex/user-identity.ts",
-      "sha256": "f16cc31184e7e00128545f9c6b59664ed17f0a5f08c606cf3731f752493a1f23"
+      "sha256": "e2cb675b208f7ad2fdd64c5d05d9c439511f786f3887ea5cb54d87b6fe7fe8a2"
     },
     {
       "path": "src/codex/warmup.ts",
@@ -966,7 +966,7 @@
     },
     {
       "path": "src/config.ts",
-      "sha256": "d98507303396605a2f698448295572038d6f30f3593af58910d04ecec918e9b8"
+      "sha256": "142ca0d8026b63ddceb2b347b4f27dd6912b908ccf351016352e9423445fa2ef"
     },
     {
       "path": "src/generated/model-metadata.ts",
@@ -1666,7 +1666,7 @@
     },
     {
       "path": "src/lib/token-estimate.ts",
-      "sha256": "2c3cc4b8193166ca100197ca22202b06ac98c02547ffe32f3e0f8720190b9897"
+      "sha256": "c90473299655c86ef0118f5a265a71c100bf92e52172d6464a16c8f6ea300ca5"
     },
     {
       "path": "src/lib/tool-argument-integers.ts",
@@ -1694,15 +1694,19 @@
     },
     {
       "path": "src/lib/windows-elevation.ts",
-      "sha256": "9ef8a94484a6c4a95d3270aa10302f8e747ce54efed926c640f0cbdac13e6c27"
+      "sha256": "eeb579420c42318232ffdf924dba46d3ec172fb7dd8d83930a2985dfbc875d4a"
     },
     {
       "path": "src/lib/windows-secret-acl.ts",
-      "sha256": "beefa22c1aef684743785fecd75cad6cd84bf8acdf035a16e64930ac3402da4c"
+      "sha256": "6cbb7d5a6d9e5a1d73058af79ac02611e5cebc01fc49c7daf39ab8b0f9b41f53"
+    },
+    {
+      "path": "src/lib/windows-text.ts",
+      "sha256": "b5b4505de8b0e99df6548e2c6359e57066378b3e1e7ef3fe210e8ecd4aec8367"
     },
     {
       "path": "src/lib/windows-user-principal.ts",
-      "sha256": "4830ed6cfeb040fb25603cd0f98079b56c46b8e325dc4bac0771ecd118a51cd4"
+      "sha256": "c8974defc31bc73364c57ef906befd5142e32467655cefbcf8f764db6ef5c896"
     },
     {
       "path": "src/lib/winsw.ts",
@@ -1770,7 +1774,7 @@
     },
     {
       "path": "src/oauth/index.ts",
-      "sha256": "cbe370cd31412914b4cd2f565fd519eb45897ebd4ec7284503f68926017e127d"
+      "sha256": "e42ad175a0eaf9a4ab524066ee825e81b4cd16c3671cb2051968f87a56c46cb7"
     },
     {
       "path": "src/oauth/key-providers.ts",
@@ -1810,7 +1814,7 @@
     },
     {
       "path": "src/oauth/store.ts",
-      "sha256": "dda6e0d1d63ef43291aba437fc63749808a85ca039bfbf3e98b82b0368718f4a"
+      "sha256": "61c14ad05498f0146aec503f8618a4249d8064967377c6c782437276c9ab0ac5"
     },
     {
       "path": "src/oauth/token-guardian.ts",
@@ -1838,7 +1842,7 @@
     },
     {
       "path": "src/providers/antigravity-models.ts",
-      "sha256": "cbe65f34a127ad44fd8f6bd2214553b238449b4f10d948d5ed67f4b163964874"
+      "sha256": "005e17707703842d91d9b18aa6f28375bda6b49efff07cb7642c597ee0bcdc8b"
     },
     {
       "path": "src/providers/api-keys.ts",
@@ -1866,7 +1870,7 @@
     },
     {
       "path": "src/providers/free-directory.ts",
-      "sha256": "cdcdb72b65bf2655bf9a8dd0a9b77d76ac35ebc8082c1065816a4fc9d785d2c4"
+      "sha256": "e984f4a79b202e702f4e73386c479fbe96293e6e99ac97d91ddd410e15999087"
     },
     {
       "path": "src/providers/github-copilot-transport.ts",
@@ -1938,7 +1942,7 @@
     },
     {
       "path": "src/providers/registry.ts",
-      "sha256": "7d6a712c9ae027d409c2d367ba77c13ceba46ecaab8199a68c3984c9ea5c4c04"
+      "sha256": "78f6cda9b3a114e72656e88645b062e96af413f9af7e0241246f37473d086b7f"
     },
     {
       "path": "src/providers/slug-codec.ts",
@@ -2138,7 +2142,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "cc6461e629f1f5e373d81ebee0720a9ba85c7deedded457bbd398ac962e0e404"
+      "sha256": "e909c5777cac73894273ab6ce9a0e635dc55a74de726cc6a6f71c4409a695ba2"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2206,7 +2210,7 @@
     },
     {
       "path": "src/server/management/logs-usage-routes.ts",
-      "sha256": "645c8902e0d3b589a5b20a7d607fb9b40197f34a4c73945a4bf9fd91336bf15e"
+      "sha256": "0f4b36868f53fe7314ba5393f1270045eb8d260058620ab34f4aa343ce0b4b80"
     },
     {
       "path": "src/server/management/model-routes.ts",
@@ -2310,7 +2314,7 @@
     },
     {
       "path": "src/server/request-log.ts",
-      "sha256": "036af24421d796ba82cd52c8ed97dbead949a471c9a212fe74f1aed2b87edf8a"
+      "sha256": "e7111d92152cdedf0e771d719bddee0150124d14bcac13610662dcbed3b75869"
     },
     {
       "path": "src/server/responses-custom-tool-repair.ts",
@@ -2362,15 +2366,15 @@
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "b8e42c1e0be113256d7318ee6dc3dc4cb7d045867e9e5412ccdfd64fa07111cb"
+      "sha256": "1dde5ae551f6baadb2dd0cca790d43d6ce1ae223568ebbc8d9a0d68c41cf7ef6"
     },
     {
       "path": "src/server/responses/encrypted-payload.ts",
-      "sha256": "d0f83a3a8f5bdce327fe32e744f8bfbc8695e7cb2981a1dffc67daf8aa302d93"
+      "sha256": "0e48bc0b453fc6b037d334d06a6454af46d8214f29b286a197d0bfdee138e215"
     },
     {
       "path": "src/server/responses/fetch-helpers.ts",
-      "sha256": "c0dd5255a485b23fcef54378cd1ea2eac40f7824952050f8e9db9c3d02f0e2d2"
+      "sha256": "1043b5b66d5d8c43bd3600200d86cbd6bb5af5614bc4fa17bebc2134b854ca99"
     },
     {
       "path": "src/server/responses/passthrough-error.ts",
@@ -2378,7 +2382,7 @@
     },
     {
       "path": "src/server/responses/policy-fallback.ts",
-      "sha256": "64592e4c703941f9d860d0f575a7944f16dbca487b08fd8d2536e0b92f188fca"
+      "sha256": "7f824ac3b25fa7b9716e81daec7fbfab75bd1c08098ab8195b22404922dae856"
     },
     {
       "path": "src/server/responses/terminal-guard.ts",
@@ -2390,7 +2394,7 @@
     },
     {
       "path": "src/server/responses/ws-upstream.ts",
-      "sha256": "f697ac29a3b1965c4d77531abd69ed382d938ed503c951834205cffe6d8e9757"
+      "sha256": "9d76c39ae90cb8a2256a851fddd25c8d508816689a2768d9d578ff1ee908ae61"
     },
     {
       "path": "src/server/search.ts",
@@ -2430,11 +2434,11 @@
     },
     {
       "path": "src/service-manager-probe.ts",
-      "sha256": "ec12b537eccc4310ad07ea504da84e99331ded66e233bb0e54945f8b781bf932"
+      "sha256": "6a9efca4e86bb940654475254c6600f377d1fa96a430f70c47fa0781145fca6f"
     },
     {
       "path": "src/service.ts",
-      "sha256": "1438465d669c54759319ed6a689517967ed8fc66463870dda547ac123d43c0df"
+      "sha256": "da173595e82233c5b20b78026255027004f0eea388fc66a7bf073229dd69e45e"
     },
     {
       "path": "src/stall-timeout.ts",
@@ -2506,7 +2510,7 @@
     },
     {
       "path": "src/tray/windows.ts",
-      "sha256": "3ca49da1758a7d82be178f4370bed3f1a62bfd052d83b6f79575c19b1d69c1bd"
+      "sha256": "d571ce0ea715feeb5aebd1f623a06b604f7b1e7f3445fca6ea755bd871415746"
     },
     {
       "path": "src/types.ts",
@@ -2522,7 +2526,7 @@
     },
     {
       "path": "src/update/job.ts",
-      "sha256": "af0aeb7c8c3f24fd93306d0def7695482b1a0792268c2e67dcb76b586e4ffa85"
+      "sha256": "60bb9f289105ff55fbf96d15de28e3305ad881f1fcd1f0b2a216eff50e7ff498"
     },
     {
       "path": "src/update/notify.ts",
@@ -2570,7 +2574,7 @@
     },
     {
       "path": "src/usage/summary.ts",
-      "sha256": "393dd15c9ef4aa7e597bdb0005658595bb567271b559414f203d2a4f81223842"
+      "sha256": "7c73078f67bb6b14f8448b794cd1e622f47517f5686efe1cd3553580afe98122"
     },
     {
       "path": "src/usage/totals.ts",

package/src/lib/token-estimate.ts

@@ -55,15 +55,32 @@ function cjkRatio(text: string): number {
   return sampled === 0 ? 0 : cjk / sampled;
 }
 
+/**
+ * Cap an estimated token count at a model's context window (codex-router PR #140).
+ *
+ * A request the provider answered cannot have exceeded the window, so the estimate is never
+ * allowed to claim it did: the estimate only ever substitutes a reported-zero (or missing)
+ * input count, and a value above the window would be provably false. Positive or missing
+ * reported counts are never rewritten here — this bounds the heuristic estimate itself.
+ * Non-positive or non-integer windows (unknown model) leave the estimate untouched.
+ */
+export function capEstimateAtContextWindow(estimate: number, contextWindow: number | undefined): number {
+  return typeof contextWindow === "number" && Number.isInteger(contextWindow) && contextWindow > 0
+    ? Math.min(estimate, contextWindow)
+    : estimate;
+}
+
 /**
  * Estimate the token count of a text blob. Pure and deterministic.
  * Returns 0 for empty/whitespace-free-empty input; otherwise ceil(length / ratio), min 1.
+ * When `contextWindow` is a positive integer the estimate is capped at it: a request the
+ * provider answered cannot have exceeded the window, so the estimate must not claim it did.
  */
-export function estimateTokens(text: string, modelId?: string): number {
+export function estimateTokens(text: string, modelId?: string, contextWindow?: number): number {
   if (!text) return 0;
   const len = text.length;
   if (len === 0) return 0;
   let ratio = charsPerToken(modelId);
   if (cjkRatio(text) > CJK_RATIO_THRESHOLD) ratio = Math.min(ratio, CJK_CHARS_PER_TOKEN);
-  return Math.max(1, Math.ceil(len / ratio));
+  return capEstimateAtContextWindow(Math.max(1, Math.ceil(len / ratio)), contextWindow);
 }

package/src/lib/windows-elevation.ts

@@ -612,6 +612,43 @@ export function runWindowsElevated(file: string, args: string[]): Promise<number
   return startPowerShellCommand(script).completion.then(result => result.exitCode);
 }
 
+/**
+ * Register one scheduled-task definition without exposing a mutable XML pathname to
+ * the elevated process. The XML bytes are fixed in the encoded PowerShell command
+ * before UAC; Register-ScheduledTask receives that string directly after elevation.
+ */
+export function runWindowsElevatedScheduledTaskRegistration(
+  taskName: string,
+  xml: string,
+): Promise<number> {
+  const xmlBase64 = Buffer.from(xml, "utf16le").toString("base64");
+  const inner = [
+    `$taskName = ${psSingleQuote(taskName)}`,
+    `$xmlBase64 = ${psSingleQuote(xmlBase64)}`,
+    "$xml = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($xmlBase64))",
+    "Register-ScheduledTask -TaskName $taskName -Xml $xml -Force -ErrorAction Stop | Out-Null",
+  ].join("; ");
+  const encodedCommand = Buffer.from(inner, "utf16le").toString("base64");
+  const script = [
+    `$p = Start-Process -FilePath ${psSingleQuote(windowsPowerShell())}`,
+    ` -ArgumentList ${psSingleQuote(buildWindowsElevatedArgumentList([
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand",
+      encodedCommand,
+    ]))}`,
+    " -Verb RunAs -WindowStyle Hidden -PassThru -Wait",
+    `if ($null -eq $p) { exit ${OCX_ELEVATED_UAC_CANCELLED} }`,
+    "$null = $p.Handle",
+    `if ($null -eq $p.ExitCode) { exit ${OCX_ELEVATED_PROTOCOL_FAILED} }`,
+    "exit $p.ExitCode",
+  ].join("; ");
+
+  return startPowerShellCommand(script).completion.then(result => result.exitCode);
+}
+
 /**
  * Build the elevated (post-UAC) script: create → run → optional delete rollback.
  * Returns only OpenCodex protocol exit codes (never raw schtasks codes, never 1223).

package/src/lib/windows-secret-acl.ts

@@ -388,6 +388,13 @@ export function forgetEphemeralSecretPath(tempPath: string): void {
   timedOutPaths.delete(`optional:${tempPath}`);
 }
 
+/** Directory counterpart for a proven-absent ephemeral staging root. */
+export function forgetEphemeralSecretDir(tempPath: string): void {
+  hardenedDirectories.delete(tempPath);
+  timedOutPaths.delete(`required:${tempPath}`);
+  timedOutPaths.delete(`optional:${tempPath}`);
+}
+
 /** Test seam: timeout memo sets return to baseline after ephemeral cleanup. */
 export function timedOutSecretPathCountForTests(): number {
   return timedOutPaths.size;