@bitkyc08/opencodex 2.20.0 → 2.21.0

package/src/images/loop.ts

@@ -14,8 +14,9 @@ import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "../adapters/
 import { existsSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { createAdapterEventQueue } from "../adapters/run-turn-queue";
-import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderContinuationState, OcxRequestOptions, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
+import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderContinuationState, OcxProviderOpaqueToolCallMetadata, OcxRequestOptions, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
 import { namespacedToolName, toolChoiceToolPredicate } from "../types";
+import { cloneProviderOpaqueToolCallMetadata } from "../responses/provider-opaque-metadata";
 import type { AttemptRecoveryKind } from "../usage/log";
 import { bridgeToResponsesSSE } from "../bridge";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
@@ -93,6 +94,11 @@ interface ImageCall {
   id: string;
   name: string;
   args: string;
+  /**
+   * Provider-opaque metadata from the originating part (issue #1735). Stored PER CALL: a
+   * signature belongs to one specific part, so parallel calls must not share one value.
+   */
+  providerMetadata?: OcxProviderOpaqueToolCallMetadata;
 }
 
 /**
@@ -109,13 +115,13 @@ function scanEventsForImageCall(events: AdapterEvent[], toolNames: Set<string>):
   const calls: ImageCall[] = [];
   const passthrough: AdapterEvent[] = [];
   let hasRealToolCall = false;
-  let pending: { name: string; id: string; argsBuf: string; events: AdapterEvent[] } | null = null;
+  let pending: { name: string; id: string; argsBuf: string; events: AdapterEvent[]; providerMetadata?: OcxProviderOpaqueToolCallMetadata } | null = null;
   const flushPending = (): void => {
     if (!pending) return;
     if (toolNames.has(pending.name)) {
       // Unterminated image call still carries buffered args — fulfill so malformed JSON
       // becomes a normal tool_result error instead of silently vanishing.
-      calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf });
+      calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf, providerMetadata: pending.providerMetadata });
     } else {
       passthrough.push(...pending.events);
       hasRealToolCall = true;
@@ -125,14 +131,14 @@ function scanEventsForImageCall(events: AdapterEvent[], toolNames: Set<string>):
   for (const e of events) {
     if (e.type === "tool_call_start") {
       flushPending();
-      pending = { name: e.name, id: e.id, argsBuf: "", events: [e] };
+      pending = { name: e.name, id: e.id, argsBuf: "", events: [e], providerMetadata: e.providerMetadata };
     } else if (e.type === "tool_call_delta" && pending) {
       pending.argsBuf += e.arguments;
       pending.events.push(e);
     } else if (e.type === "tool_call_end" && pending) {
       pending.events.push(e);
       if (toolNames.has(pending.name)) {
-        calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf });
+        calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf, providerMetadata: pending.providerMetadata });
       } else {
         passthrough.push(...pending.events);
         hasRealToolCall = true;
@@ -871,6 +877,10 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
                 id: call.id,
                 name: call.name,
                 arguments: args,
+                // Clone per call: parallel media calls each keep their own signature.
+                ...(cloneProviderOpaqueToolCallMetadata(call.providerMetadata)
+                  ? { providerMetadata: cloneProviderOpaqueToolCallMetadata(call.providerMetadata) }
+                  : {}),
               })),
             ],
             timestamp: now,

package/src/providers/registry.ts

@@ -1977,7 +1977,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // 260710 GLM-5.2 context and path-specific ids: Tier-2 evidence in
   // devlog/_plan/260710_provider_hardening/002_research_cn.md.
   // 260814: glm-5.3 / glm-5.3[1m] added per docs.z.ai/devpack/latest-model, which lists them as
-  // Coding Plan ids on this same endpoint. Capabilities mirror 5.2 until Z.AI publishes tables.
+  // Coding Plan ids on this same endpoint.
+  // 260815: docs.z.ai/guides/llm/glm-5.3 now publishes the capability table (thinking, streaming,
+  // function calling, caching, structured output) and a 128K output budget, recorded here as the
+  // exact 131_072 every other source in this repo uses for that model. Coding Plan pricing stays
+  // unpublished, so no cost entry is asserted.
   {
     id: "zai", label: "Z.AI — GLM Coding Plan", baseUrl: "https://api.z.ai/api/coding/paas/v4", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://z.ai/manage-apikey/apikey-list", defaultModel: "glm-5.3",
@@ -1988,6 +1992,8 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     modelSuffixBracketStrip: true,
     noVisionModels: ZAI_GLM_5X_MODELS,
     modelReasoningEfforts: ZAI_GLM_5X_REASONING_EFFORTS,
+    modelDefaultReasoningEfforts: Object.fromEntries(ZAI_GLM_53_MODELS.map(id => [id, "max"])),
+    modelMaxOutputTokens: Object.fromEntries(ZAI_GLM_53_MODELS.map(id => [id, 131_072])),
     modelSupportsReasoningSummaries: Object.fromEntries(ZAI_GLM_5X_MODELS.map(id => [id, true])),
     preserveReasoningContentModels: ZAI_GLM_5X_MODELS,
   },

package/src/responses/custom-tool-compat.ts

@@ -70,6 +70,9 @@ function rewriteForUpstream(
       || isPlainObject(value.format)
       || isPlainObject(value.parameters);
     if (!isDefinition) return { ...rest, type: "function" };
+    const inputDescription = value.name === "exec"
+      ? "JavaScript source for unified exec. Use await tools.exec_command(...) for shell commands and text(...) to return textual output; do not provide a bare shell command."
+      : "Raw input for this client-executed custom tool.";
     return {
       ...rest,
       type: "function",
@@ -78,7 +81,7 @@ function rewriteForUpstream(
         properties: {
           input: {
             type: "string",
-            description: "Raw input for this client-executed custom tool.",
+            description: inputDescription,
           },
         },
         required: ["input"],

package/src/responses/parser.ts

@@ -12,6 +12,7 @@ import type {
 } from "../types";
 import { namespacedToolName } from "../types";
 import { responsesRequestSchema } from "./schema";
+import { providerMetadataFromResponsesFunctionCall } from "./provider-opaque-metadata";
 import { compactionItemToText } from "./compaction";
 import { previousResponseReplayPrefixLength } from "./state";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
@@ -498,7 +499,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
       }
 
       if (effectiveType === "function_call") {
-        const call = item as { id?: string; call_id: string; name: string; arguments?: string; namespace?: string };
+        const call = item as { id?: string; call_id: string; name: string; arguments?: string; namespace?: string; extra_content?: unknown };
         // Tolerate empty/non-JSON arguments (e.g. a no-arg tool call serialized as "") instead of
         // throwing — a single poisoned history item would otherwise 400 every subsequent turn.
         let args: Record<string, unknown> = {};
@@ -519,6 +520,11 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           type: "toolCall", id: call.call_id, name: call.name, arguments: args,
           ...(call.namespace ? { namespace: call.namespace } : {}),
         };
+        // Provider-opaque metadata (e.g. a Gemini thought signature) travels with the call so a
+        // history-replayed or previous_response_id turn rebuilds the same signed part instead of
+        // depending on the same-process replay cache (issue #1735).
+        const providerMetadata = providerMetadataFromResponsesFunctionCall(call);
+        if (providerMetadata) toolCall.providerMetadata = providerMetadata;
         assistantHolderWithReasoning().content.push(toolCall);
         continue;
       }

package/src/responses/provider-opaque-metadata.ts

@@ -0,0 +1,73 @@
+/**
+ * Provider-opaque tool-call metadata across the Responses boundary (issue #1735).
+ *
+ * Gemini issues a `thoughtSignature` on the exact part that carries a function call, and the
+ * next request is only valid if that signature comes back on the part rebuilt from that same
+ * call. Every synthetic loop in this proxy (web search, images, continuation replay) tears a
+ * tool call down into id/name/arguments and builds a fresh one, which silently dropped the
+ * signature and left only the same-process replay cache to paper over it. History replay and
+ * `previous_response_id` had no cache to fall back on.
+ *
+ * This module is the single seam where that metadata crosses into and out of the Responses
+ * wire, so a loop that rebuilds a call only has to carry one field instead of knowing about
+ * any provider. Values are treated as opaque: never parsed, merged, re-encoded, or synthesized.
+ */
+import type { OcxProviderOpaqueToolCallMetadata } from "../types";
+
+/** Wire shape: `extra_content.google.thought_signature` on a Responses function_call item. */
+interface ResponsesExtraContent {
+  google?: { thought_signature?: unknown };
+}
+
+function isObj(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Same ceiling the Antigravity replay cache already enforces on a stored signature. An opaque
+ * token this large is not a real signature, and accepting it would let a caller push unbounded
+ * state through history replay.
+ */
+const MAX_SIGNATURE_BYTES = 64 * 1024;
+
+function isCarryableSignature(value: unknown): value is string {
+  if (typeof value !== "string" || value.length === 0) return false;
+  // Cheap length pre-check: UTF-8 is at most 3 bytes per UTF-16 code unit for the BMP, so this
+  // skips the encode for the overwhelmingly common short case.
+  if (value.length <= MAX_SIGNATURE_BYTES / 3) return true;
+  return Buffer.byteLength(value, "utf8") <= MAX_SIGNATURE_BYTES;
+}
+
+/** Read provider metadata off an inbound Responses function_call item. */
+export function providerMetadataFromResponsesFunctionCall(
+  item: { extra_content?: unknown } | undefined,
+): OcxProviderOpaqueToolCallMetadata | undefined {
+  const extra = item?.extra_content;
+  if (!isObj(extra)) return undefined;
+  const google = (extra as ResponsesExtraContent).google;
+  if (!isObj(google)) return undefined;
+  const signature = google.thought_signature;
+  if (!isCarryableSignature(signature)) return undefined;
+  return { google: { thoughtSignature: signature } };
+}
+
+/** Serialize provider metadata onto an outbound Responses function_call item. */
+export function responsesExtraContentFromProviderMetadata(
+  metadata: OcxProviderOpaqueToolCallMetadata | undefined,
+): { extra_content: { google: { thought_signature: string } } } | undefined {
+  const signature = metadata?.google?.thoughtSignature;
+  if (!isCarryableSignature(signature)) return undefined;
+  return { extra_content: { google: { thought_signature: signature } } };
+}
+
+/**
+ * Copy metadata for a rebuilt tool call. A signature belongs to one specific part, so a loop
+ * that fans one model response into several calls must copy per call and never share or merge.
+ */
+export function cloneProviderOpaqueToolCallMetadata(
+  metadata: OcxProviderOpaqueToolCallMetadata | undefined,
+): OcxProviderOpaqueToolCallMetadata | undefined {
+  const signature = metadata?.google?.thoughtSignature;
+  if (!isCarryableSignature(signature)) return undefined;
+  return { google: { thoughtSignature: signature } };
+}

package/src/responses/schema.ts

@@ -64,6 +64,12 @@ const functionCallItemSchema = z.object({
   name: z.string().min(1),
   namespace: z.string().optional(),
   arguments: z.string().optional(),
+  // Provider-opaque metadata that must survive the round trip verbatim (issue #1735). The shape
+  // is bounded on purpose: only the one nested key we round-trip is modeled, so an unexpected
+  // payload cannot ride through as arbitrary passthrough state.
+  extra_content: z.object({
+    google: z.object({ thought_signature: z.string().optional() }).optional(),
+  }).optional(),
 });
 const functionCallOutputItemSchema = z.object({
   type: z.literal("function_call_output"),

package/src/server/auth-cors.ts

@@ -140,17 +140,53 @@ export function browserSecurityHeaders(): Record<string, string> {
   };
 }
 
+/**
+ * Baseline data-plane request headers. ChatGPT-Account-Id is required for browser/Electron
+ * ChatGPT & Codex App voice preflights (direct forward auth matches the bearer to this account
+ * id). The OpenAI-Alpha .. X-OAI-Attestation block covers GPT-Live voice protocol headers
+ * relayed by the /v1/live call-create path.
+ */
+const STATIC_ALLOWED_REQUEST_HEADERS =
+  "Content-Type, Authorization, X-OpenCodex-API-Key, X-Api-Key, Anthropic-Version, Anthropic-Beta, ChatGPT-Account-Id, OpenAI-Alpha, X-Session-Id, Session-Id, Thread-Id, Originator, X-OAI-Attestation";
+
+/**
+ * A fixed allow-list cannot enumerate vendor telemetry headers: the OpenAI and Anthropic
+ * browser SDKs send `X-Stainless-*` describing runtime and retry state, and the browser blocks
+ * the real request when the preflight omits even one of them (#1773).
+ *
+ * Echo what an already-allowed origin asked for, and fall back to the static list otherwise.
+ * The echo is deliberately gated on the origin check that ran first: this widens which headers
+ * an admitted caller may send, never which origins are admitted, and it grants nothing to an
+ * origin that would have been rejected anyway. Authentication is unchanged — the preflight
+ * itself carries no credential and produces no auth or account-pool side effect.
+ */
+function allowedRequestHeaders(req?: Request): string {
+  const requested = req?.headers.get("Access-Control-Request-Headers")?.trim();
+  if (!requested) return STATIC_ALLOWED_REQUEST_HEADERS;
+  const seen = new Set(STATIC_ALLOWED_REQUEST_HEADERS.split(",").map(h => h.trim().toLowerCase()));
+  const extra: string[] = [];
+  for (const raw of requested.split(",")) {
+    const name = raw.trim();
+    // Header names are case-insensitive on the wire, so normalize before de-duplicating;
+    // echo the caller's spelling for the ones we add.
+    if (!name || seen.has(name.toLowerCase())) continue;
+    seen.add(name.toLowerCase());
+    extra.push(name);
+  }
+  return extra.length === 0 ? STATIC_ALLOWED_REQUEST_HEADERS : `${STATIC_ALLOWED_REQUEST_HEADERS}, ${extra.join(", ")}`;
+}
+
 export function corsHeaders(req?: Request, config?: RequestPolicyView): Record<string, string> {
   const origin = req?.headers.get("Origin");
-  const allowOrigin = origin && req && config && isAllowedRequestOrigin(req, config) ? origin : _corsOrigin;
+  const originAllowed = Boolean(origin && req && config && isAllowedRequestOrigin(req, config));
+  const allowOrigin = originAllowed && origin ? origin : _corsOrigin;
   return {
     "Access-Control-Allow-Origin": allowOrigin,
     "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-    // ChatGPT-Account-Id is required for browser/Electron ChatGPT & Codex App voice preflights
-    // (direct forward auth matches the bearer to this account id). The OpenAI-Alpha .. X-OAI-Attestation
-    // block covers GPT-Live voice protocol headers relayed by the /v1/live call-create path.
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-OpenCodex-API-Key, X-Api-Key, Anthropic-Version, Anthropic-Beta, ChatGPT-Account-Id, OpenAI-Alpha, X-Session-Id, Session-Id, Thread-Id, Originator, X-OAI-Attestation",
-    "Vary": "Origin",
+    "Access-Control-Allow-Headers": allowedRequestHeaders(originAllowed ? req : undefined),
+    // A response that varies by the request's headers must say so, or a shared cache can
+    // replay one client's allow-list to a client that asked for different headers.
+    "Vary": "Origin, Access-Control-Request-Headers",
     ...browserSecurityHeaders(),
   };
 }

package/src/server/system-env.ts

@@ -335,7 +335,7 @@ export async function injectSystemEnv(port: number, config: OcxConfig): Promise<
     // without a token — keep it in sync with this proxy's /v1/models. Best-effort.
     try {
       const { refreshGatewayModelCacheFromProxy } = await import("../claude/gateway-cache");
-      await refreshGatewayModelCacheFromProxy(port);
+      await refreshGatewayModelCacheFromProxy(port, { admissionConfig: config });
     } catch { /* best-effort */ }
 
     // Roster agent definitions (devlog 070): same launch-time sync for plain `claude`.

package/src/types.ts

@@ -180,10 +180,27 @@ export interface OcxToolCall {
   arguments: Record<string, unknown>;
   customWireName?: string;
   thoughtSignature?: string;
+  /**
+   * Provider-issued opaque metadata that must survive the whole round trip unchanged
+   * (issue #1735). A signed Gemini part is only valid when its signature comes back on the
+   * SAME part it was issued for, so this travels with the individual tool call rather than
+   * being matched by name/arguments after the fact.
+   */
+  providerMetadata?: OcxProviderOpaqueToolCallMetadata;
   /** MCP namespace (e.g. "mcp__context7") when this call targets a namespaced tool. */
   namespace?: string;
 }
 
+/**
+ * Opaque, provider-scoped tool-call metadata. Values are never parsed, merged, re-encoded, or
+ * synthesized — they are carried verbatim or not at all.
+ */
+export interface OcxProviderOpaqueToolCallMetadata {
+  google?: {
+    thoughtSignature?: string;
+  };
+}
+
 export type OcxAssistantContentPart = OcxTextContent | OcxThinkingContent | OcxToolCall;
 
 export interface OcxTool {
@@ -328,7 +345,7 @@ export type AdapterEvent =
   // Never rendered — it only rides the reasoning item's envelope so the next request can replay it.
   | { type: "kiro_redacted_reasoning"; data: string }
   | { type: "reasoning_raw_delta"; text: string }
-  | { type: "tool_call_start"; id: string; name: string }
+  | { type: "tool_call_start"; id: string; name: string; providerMetadata?: OcxProviderOpaqueToolCallMetadata }
   | { type: "tool_call_delta"; arguments: string }
   | { type: "tool_call_end" }
   /** Internal boundary between a guarded first pass and its one-shot continuation. */

package/src/web-search/loop.ts

@@ -1,6 +1,7 @@
 import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "../adapters/base";
-import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
+import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxProviderOpaqueToolCallMetadata, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
 import { namespacedToolName, toolChoiceToolPredicate } from "../types";
+import { cloneProviderOpaqueToolCallMetadata } from "../responses/provider-opaque-metadata";
 import type { AttemptRecoveryKind } from "../usage/log";
 import { bridgeToResponsesSSE } from "../bridge";
 import { runWebSearch, type SidecarOutcome, type SidecarOutcomeRecorder, type SidecarSettings } from "./executor";
@@ -32,6 +33,11 @@ interface WebSearchCall {
   // empty array means the model called the tool with neither `query` nor `queries` (handled as an
   // empty-query placeholder).
   queries: string[];
+  /**
+   * Provider-opaque metadata from the originating part (issue #1735). Stored PER CALL so a
+   * signature can never migrate to a different call when the model batches several.
+   */
+  providerMetadata?: OcxProviderOpaqueToolCallMetadata;
 }
 
 /**
@@ -69,7 +75,7 @@ export function scanEventsForWebSearch(events: AdapterEvent[]): {
   const passthrough: AdapterEvent[] = [];
   let hasRealToolCall = false;
   let hasMalformedToolCall = false;
-  let pending: { name: string; id: string; argsBuf: string; closed: boolean; events: AdapterEvent[] } | null = null;
+  let pending: { name: string; id: string; argsBuf: string; closed: boolean; events: AdapterEvent[]; providerMetadata?: OcxProviderOpaqueToolCallMetadata } | null = null;
   const isBlank = (value: string): boolean => value.trim().length === 0;
   const flushPending = (): void => {
     // A pending call that never saw tool_call_end is structurally malformed.
@@ -84,7 +90,7 @@ export function scanEventsForWebSearch(events: AdapterEvent[]): {
     if (e.type === "tool_call_start") {
       flushPending();
       if (isBlank(e.id) || isBlank(e.name)) hasMalformedToolCall = true;
-      pending = { name: e.name, id: e.id, argsBuf: "", closed: false, events: [e] };
+      pending = { name: e.name, id: e.id, argsBuf: "", closed: false, events: [e], providerMetadata: e.providerMetadata };
     } else if (e.type === "tool_call_delta") {
       // Orphan delta (no open call) is malformed.
       if (!pending) hasMalformedToolCall = true;
@@ -100,7 +106,7 @@ export function scanEventsForWebSearch(events: AdapterEvent[]): {
         pending.events.push(e);
         pending.closed = true;
         if (pending.name === WEB_SEARCH_TOOL_NAME) {
-          calls.push({ id: pending.id, queries: parseQueries(pending.argsBuf) });
+          calls.push({ id: pending.id, queries: parseQueries(pending.argsBuf), providerMetadata: pending.providerMetadata });
         } else {
           passthrough.push(...pending.events);
           if (!isBlank(pending.id) && !isBlank(pending.name)) hasRealToolCall = true;
@@ -678,7 +684,17 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         // Signed thinking must precede tool_use on replay (Anthropic extended thinking), and
         // unsigned raw reasoning has to ride along for providers that require it back (#688).
         ...precedingThinking,
-        { type: "toolCall" as const, id: call.id, name: WEB_SEARCH_TOOL_NAME, arguments: callArgs },
+        {
+          type: "toolCall" as const,
+          id: call.id,
+          name: WEB_SEARCH_TOOL_NAME,
+          arguments: callArgs,
+          // Re-attach the signature to the rebuilt call so a sidecar turn keeps Gemini
+          // reasoning continuity instead of relying on the same-process replay cache.
+          ...(cloneProviderOpaqueToolCallMetadata(call.providerMetadata)
+            ? { providerMetadata: cloneProviderOpaqueToolCallMetadata(call.providerMetadata) }
+            : {}),
+        },
       ],
       timestamp: now,
     });