@bitkyc08/opencodex 2.25.0 → 2.26.0

package/src/grok/inject.ts

@@ -324,7 +324,7 @@ export function buildGrokManagedBlock(
       `[model.${alias}]`,
       `model = ${tomlString(model.id)}`,
       `base_url = ${tomlString(baseUrl)}`,
-      'api_backend = "chat_completions"',
+      'api_backend = "responses"',
       'api_key = "opencodex-loopback"',
       `name = ${tomlString(model.name ?? `OCX ${model.id}`)}`,
       // Best-effort attribution tag for the usage dashboard. Upstream Grok sends

package/src/images/loop.ts

@@ -508,6 +508,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
               timeoutMs: connectTimeoutMs,
               returnRawErrors: true,
               stream: true,
+              executor: fetchImpl,
             });
           } else {
             response = await fetchWithResetRetry(

package/src/integrations/registry.ts

@@ -27,6 +27,8 @@ import {
   opencodeGlobalConfigPath,
   openclawConfigPath,
   openclawHomeDir,
+  zcodeConfigPath,
+  zcodeHomeDir,
   type ExportClientId,
 } from "../clients/config-export";
 
@@ -119,6 +121,11 @@ export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientS
     configPath: (env = process.env, home = homedir()) => mcodeConfigPath(env, home),
     detectDir: (env = process.env, home = homedir()) => mcodeHomeDir(env, home),
   },
+  zcode: {
+    id: "zcode",
+    configPath: (env = process.env, home = homedir()) => zcodeConfigPath(env, home),
+    detectDir: (env = process.env, home = homedir()) => zcodeHomeDir(env, home),
+  },
 };
 
 export const INTEGRATION_CLIENT_IDS: readonly IntegrationClientId[] =

package/src/lab/automation/config-persistence.ts

@@ -6,11 +6,11 @@ import {
   linkSync,
   openSync,
   readFileSync,
-  renameSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
+import { renameAtomicFile } from "../../lib/windows-atomic-replace";
 import {
   ensureLabDirs,
   labAutomationPolicyPath,
@@ -217,7 +217,7 @@ function writeConfigUnlocked(
     if (configCommitFaultForTests === "before_publish") {
       throw new LabAutomationError("synthetic automation config commit failure", "invalid_state");
     }
-    renameSync(tmp, path);
+    renameAtomicFile(tmp, path, undefined, "lab-automation");
     return normalized;
   } finally {
     if (fd !== null) closeSync(fd);

package/src/lab/automation/persistence.ts

@@ -6,11 +6,11 @@ import {
   linkSync,
   openSync,
   readFileSync,
-  renameSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
+import { renameAtomicFile } from "../../lib/windows-atomic-replace";
 import {
   ensureLabDirs,
   labAutomationPolicyPath,
@@ -125,7 +125,7 @@ function atomicWriteJson(path: string, payload: unknown): void {
   const tmp = join(dir, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
   const text = JSON.stringify(payload);
   writeFileSync(tmp, text, { encoding: "utf8", mode: 0o600 });
-  renameSync(tmp, path);
+  renameAtomicFile(tmp, path, undefined, "lab-automation");
 }
 
 function basename(path: string): string {

package/src/lab/ledger/purge.ts

@@ -5,6 +5,7 @@ import {
   type TrustedArtifactDir,
 } from "../artifacts/secure-fs";
 import { ArtifactFsError } from "../artifacts/secure-fs";
+import { renameAtomicFile } from "../../lib/windows-atomic-replace";
 import {
   LAB_EVENT_SCHEMA_VERSION,
   LAB_PRODUCER,
@@ -29,7 +30,6 @@ import {
   fsyncSync,
   openSync,
   readdirSync,
-  renameSync,
   rmSync,
   unlinkSync,
   writeSync,
@@ -79,7 +79,7 @@ function atomicRewriteLedger(ledgerPath: string, events: LabEvent[]): void {
     } finally {
       closeSync(fd);
     }
-    renameSync(tmpPath, ledgerPath);
+    renameAtomicFile(tmpPath, ledgerPath, undefined, "lab-ledger");
     renamed = true;
   } catch (err) {
     if (!renamed) {

package/src/lab/subject/behavior-fingerprint.ts

@@ -5,7 +5,7 @@ import type { LabBehaviorSource, LabBehaviorValues } from "../live/types";
 const CLOSED_KEYS = new Set([
   "wire.adapter", "wire.upstreamProtocol", "wire.responsesPath", "wire.commandCodeVersion", "wire.modelSuffixMode",
   "auth.mode", "auth.transport",
-  "responses.stateful", "responses.upstreamStreaming", "responses.serviceTier", "responses.snapshotRepair", "responses.itemIdRepair",
+  "responses.stateful", "responses.upstreamStreaming", "responses.serviceTier", "responses.fastWireKind", "responses.fastWireValue", "responses.snapshotRepair", "responses.itemIdRepair",
   "limits.contextWindow", "limits.maxInputTokens", "limits.maxOutputTokens",
   "modalities.input",
   "sampling.omitTemperature", "sampling.omitTopP", "sampling.omitPenalties",
@@ -72,6 +72,6 @@ export function normalizeBehaviorValues(values: LabBehaviorValues): LabBehaviorV
 
 /** Hash the authoritative production resolver output; Lab performs validation/canonicalization only. */
 export function buildBehaviorFingerprintV1(values: LabBehaviorValues): string {
-  const payload = { schemaVersion: 1, resolverVersion: 1, values: normalizeBehaviorValues(values) };
+  const payload = { schemaVersion: 1, resolverVersion: 2, values: normalizeBehaviorValues(values) };
   return createHash("sha256").update(jcsStringify(payload)).digest("hex");
 }

package/src/lib/config-ownership.ts

@@ -5,7 +5,6 @@ import {
   readFileSync,
   readdirSync,
   realpathSync,
-  renameSync,
   rmdirSync,
   unlinkSync,
   writeFileSync,
@@ -13,6 +12,7 @@ import {
 import { randomUUID } from "node:crypto";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import type { GenerationContext } from "./state-store-sweeper";
+import { renameAtomicFile } from "./windows-atomic-replace";
 
 export const CONFIG_OWNER_FILE = ".opencodex-owner.json";
 export const CONFIG_UNINSTALL_MANIFEST = ".opencodex-uninstall.json";
@@ -232,7 +232,10 @@ function writeManifest(configDir: string, manifest: ConfigUninstallManifest): vo
   const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
   writeFileSync(temp, `${JSON.stringify(manifest, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
   try {
-    renameSync(temp, path);
+    // Same Windows sharing-violation tolerance the config writer has: a
+    // scanner holding the manifest must not turn uninstall bookkeeping into a
+    // hard failure.
+    renameAtomicFile(temp, path, undefined, "config-ownership");
   } catch (error) {
     try { unlinkSync(temp); } catch { /* best effort */ }
     throw error;

package/src/lib/destination-policy.ts

@@ -241,10 +241,18 @@ export function assessUrlDestination(url: string): UrlDestinationAssessment | nu
  * Returns the validated addresses so direct callers can pin the connect peer and
  * avoid a second, rebindable resolution. DNS failures remain fail-closed here;
  * the provider proxy wrapper alone may recognize that typed failure and degrade.
+ *
+ * `allowBenchmarkAddresses` is an explicit outbound-only opt-in for Clash/Surge/
+ * Mihomo fake-IP DNS (IANA benchmark space 198.18.0.0/15, credit #1748): a hostname
+ * answer in that range is accepted without marking the destination private, so the
+ * caller can keep the hostname on its configured HTTP(S) proxy path. It applies to
+ * resolved answers only — a literal 198.18.x URL still rejects — and mixed answers
+ * that include any other non-public address still fail. Callers that do not pass it
+ * (image and Lab fetch) keep rejecting benchmark space.
  */
 export async function resolvePublicAddresses(
   url: string,
-  options?: string | { context?: string; allowPrivateNetwork?: boolean },
+  options?: string | { context?: string; allowPrivateNetwork?: boolean; allowBenchmarkAddresses?: boolean },
 ): Promise<{
   hostname: string;
   addresses: { address: string; family: number }[];
@@ -254,6 +262,7 @@ export async function resolvePublicAddresses(
     ? `${options.trim() || "image"} URL`
     : options?.context?.trim() || "image URL";
   const privateNetworkAllowed = typeof options === "object" && options?.allowPrivateNetwork === true;
+  const benchmarkAllowed = typeof options === "object" && options?.allowBenchmarkAddresses === true;
   let hostname: string;
   try {
     hostname = normalizeHostname(new URL(url.trim()).hostname);
@@ -294,6 +303,14 @@ export async function resolvePublicAddresses(
     const ipKind = isIP(address) || (family === 4 || family === 6 ? family : 0);
     const assessment = ipKind === 4 ? classifyIpv4(address) : ipKind === 6 ? classifyIpv6(normalizeHostname(address)) : null;
     if (!assessment || assessment.kind !== "public") {
+      // Hostname → 198.18.0.0/15 under the explicit opt-in is Clash/Surge/Mihomo
+      // fake-IP DNS, not a LAN provider. Accept it without allowPrivateNetwork and
+      // do not mark the destination private, so the caller's HTTP(S)_PROXY path
+      // still applies (credit #1748).
+      if (benchmarkAllowed && assessment?.kind === "private" && assessment.detail === "benchmark address") {
+        validatedAddresses.push({ address, family: ipKind === 4 || ipKind === 6 ? ipKind : (family || 4) });
+        continue;
+      }
       const allowedPrivateAddress = privateNetworkAllowed
         && assessment
         && (assessment.kind === "loopback" || assessment.kind === "private");

package/src/lib/provider-outbound.ts

@@ -148,6 +148,13 @@ async function providerOutboundRequest(
     resolved = await resolveAddresses(url, {
       context: "provider URL",
       allowPrivateNetwork: allowPrivate,
+      // Clash/Surge/Mihomo fake-IP DNS (198.18.0.0/15) answers are admitted only
+      // when this exact host will use the configured outbound proxy: the hostname
+      // then rides the proxy as an ordinary CONNECT instead of failing as a private
+      // destination or being pin-connected to the fake-IP (credit #1748). A NO_PROXY
+      // match is a direct route, so it keeps the benchmark answer rejected. Image/Lab
+      // fetch never passes this flag.
+      allowBenchmarkAddresses: proxyConfigured && !noProxyMatches(parsed),
     });
   } catch (error) {
     const dnsResolutionFailed = error instanceof DestinationDnsResolutionError

package/src/lib/redact.ts

@@ -443,6 +443,17 @@ export function redactSecretString(value: string): string {
   return redacted;
 }
 
+/** Shared bounded representation for caller-controlled scalar metadata stored in logs. */
+export function sanitizeLogMetadataString(value: unknown, maxLength = 64): string | undefined {
+  if (typeof value !== "string" || !Number.isInteger(maxLength) || maxLength < 1) return undefined;
+  // Remove every control/line-separator code point that common terminals and log viewers
+  // can render as a record boundary before the value reaches a single-line log field.
+  const filtered = value.trim().replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, "");
+  if (!filtered) return undefined;
+  const redacted = redactSecretString(filtered).trim();
+  return redacted ? redacted.slice(0, maxLength) : undefined;
+}
+
 export function redactSecrets(value: unknown): unknown {
   if (typeof value === "string") return redactSecretString(value);
   if (Array.isArray(value)) return value.map(item => redactSecrets(item));

package/src/lib/tool-argument-integers.ts

@@ -1,4 +1,7 @@
-// Schema-aware repair for integer tool arguments that arrive as floats (issue #1611).
+// Schema-aware repair for tool arguments whose serialized representation disagrees
+// with the declared schema in a way that has exactly one faithful reading.
+//
+// Case 1 — integer fields arriving as integral floats (issue #1611).
 //
 // Grok serializes integer tool-call arguments through a float representation, so
 // `yield_time_ms: 120000` leaves the provider as `120000.0`. Codex declares those
@@ -15,7 +18,23 @@
 //     `120000.0` has exactly one integer reading, so it is repaired;
 //   - `1.5` in an integer field is a genuine disagreement with the schema and is left
 //     alone so it still fails, rather than being truncated into a plausible lie.
-// Anything without a declared `integer` type is never touched.
+//
+// Case 2 — string fields arriving as bare integers (issue #1938).
+//
+// Cursor-served models emit `{"cell_id": 4}` where the schema declares
+// `{"type": "string"}`. Codex rejects the call before the tool runs (invalid type:
+// integer `4`, expected a string), and the model never self-corrects, so every such
+// call is a hard failure loop. A safely-integral JSON number in a string-declared
+// field has exactly one faithful string reading (`4` -> `"4"`), so it is repaired
+// under the same intent boundary:
+//   - only when the field declares `string` and no numeric type (a
+//     `["integer","string"]` union accepts the number as-is and is left alone);
+//   - a non-integral number (`4.5`) in a string field is a genuine disagreement and
+//     is left alone so it still fails;
+//   - beyond 2^53-1 the parsed value may differ from the serialized text, so the
+//     original bytes stay.
+//
+// Anything without a declared `integer`/`string` type is never touched.
 
 /** JSON Schema subset we need; provider tool schemas are untrusted input. */
 type SchemaNode = Record<string, unknown>;
@@ -33,6 +52,21 @@ function declaresInteger(schema: SchemaNode): boolean {
   return Array.isArray(type) && type.includes("integer");
 }
 
+/** True when the node declares `string`, including `["string","null"]` unions. */
+function declaresString(schema: SchemaNode): boolean {
+  const type = schema.type;
+  if (type === "string") return true;
+  return Array.isArray(type) && type.includes("string");
+}
+
+/** True when the node accepts a JSON number (`integer` or `number`), so a numeric
+ * value is already schema-valid and must not be rewritten into a string. */
+function declaresNumeric(schema: SchemaNode): boolean {
+  const type = schema.type;
+  if (type === "integer" || type === "number") return true;
+  return Array.isArray(type) && (type.includes("integer") || type.includes("number"));
+}
+
 /**
  * Resolve a local `$ref` (`#/$defs/Foo`, `#/definitions/Foo`).
  *
@@ -91,8 +125,17 @@ function coerceValue(value: unknown, schema: SchemaNode | undefined, root: Schem
 
   if (typeof value === "number") {
     if (!resolved) return { value, changed: false };
-    const integerDeclared = declaresInteger(resolved)
-      || compositionBranches(resolved).some(declaresInteger);
+    const branches = compositionBranches(resolved);
+    const integerDeclared = declaresInteger(resolved) || branches.some(declaresInteger);
+    if (!integerDeclared && safelyIntegral(value)) {
+      // Issue #1938: a bare integer in a string-only field has exactly one faithful
+      // string reading. A field that also accepts a numeric type keeps the number.
+      const stringDeclared = declaresString(resolved) || branches.some(declaresString);
+      const numericDeclared = declaresNumeric(resolved) || branches.some(declaresNumeric);
+      if (stringDeclared && !numericDeclared) {
+        return { value: String(value), changed: true };
+      }
+    }
     // Not an integer field, already an integer, non-integral, or unrepresentable:
     // in every one of those cases the received value is the right thing to keep.
     if (!integerDeclared || !safelyIntegral(value)) return { value, changed: false };
@@ -141,8 +184,9 @@ export function coerceIntegerToolArguments(
   parameters: Record<string, unknown> | undefined,
 ): string {
   if (!parameters || !args) return args;
-  // Cheap reject: a payload with no fractional-looking number cannot need repair.
-  if (!/\d\.\d/.test(args)) return args;
+  // Cheap reject: a payload with no digit cannot need either repair (integral-float
+  // -> integer, or bare-integer -> string).
+  if (!/\d/.test(args)) return args;
   let parsed: unknown;
   try {
     parsed = JSON.parse(args);

package/src/lib/upstream-http-version.ts

@@ -0,0 +1,57 @@
+import type { OcxProviderConfig, UpstreamHttpVersion } from "../types";
+
+/** True when a provider explicitly selected the HTTP/1.1 compatibility path. */
+export function isPinnedHttp1(version: UpstreamHttpVersion | undefined): boolean {
+  return version === "http1.1" || version === "h1";
+}
+
+/**
+ * Bun's fetch accepts a non-standard `protocol` init to pin the HTTP version
+ * (BunFetchRequestInit.protocol). The DOM lib types do not include it, so the
+ * value is represented through a RequestInit cast at this shared boundary.
+ */
+const UPSTREAM_HTTP_VERSION_PROTOCOL: Record<Exclude<UpstreamHttpVersion, "auto">, string> = {
+  "http1.1": "http1.1",
+  h1: "h1",
+  http2: "http2",
+  h2: "h2",
+};
+
+/** Raised before I/O when a fixed Bun HTTP-version pin cannot apply to the target URL. */
+export class UpstreamHttpVersionTargetError extends Error {
+  readonly code = "upstream_http_version_target";
+
+  constructor(readonly observedProtocol: string) {
+    super(`upstream HTTP version pin requires an HTTPS target (received ${observedProtocol})`);
+    this.name = "UpstreamHttpVersionTargetError";
+  }
+}
+
+/** Attach Bun's `protocol` pin for one explicit version value. */
+export function withUpstreamHttpVersionValue(
+  input: Parameters<typeof globalThis.fetch>[0],
+  init: RequestInit | undefined,
+  version: UpstreamHttpVersion | undefined,
+): RequestInit | undefined {
+  if (!version || version === "auto") return init;
+  // Bun's protocol pin requires an https: target. An explicit fixed-version request must fail
+  // locally when the pin cannot be honored instead of silently negotiating another transport.
+  const target = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  let targetUrl: URL;
+  try {
+    targetUrl = new URL(target);
+  } catch {
+    throw new UpstreamHttpVersionTargetError("unparseable");
+  }
+  if (targetUrl.protocol !== "https:") throw new UpstreamHttpVersionTargetError(targetUrl.protocol);
+  return { ...(init ?? {}), protocol: UPSTREAM_HTTP_VERSION_PROTOCOL[version] } as RequestInit;
+}
+
+/** Attach Bun's `protocol` pin when the provider opted into a fixed HTTP version. */
+export function withUpstreamHttpVersion(
+  input: Parameters<typeof globalThis.fetch>[0],
+  init: RequestInit | undefined,
+  provider: Pick<OcxProviderConfig, "upstreamHttpVersion">,
+): RequestInit | undefined {
+  return withUpstreamHttpVersionValue(input, init, provider.upstreamHttpVersion);
+}

package/src/lib/upstream-retry.ts

@@ -215,6 +215,7 @@ export async function fetchWithAttemptDeadline(
   timeoutMs: number,
   abortSignal?: AbortSignal,
   preferIdentityEncoding = false,
+  executor: typeof globalThis.fetch = globalThis.fetch,
 ): Promise<Response> {
   const attemptTimeout = clearableDeadline(timeoutMs, abortSignal);
   const headers = new Headers(init.headers);
@@ -222,7 +223,7 @@ export async function fetchWithAttemptDeadline(
     headers.set("accept-encoding", "identity");
   }
   try {
-    return await fetch(url, {
+    return await executor(url, {
       ...init,
       headers,
       signal: attemptTimeout.signal,

package/src/lib/windows-atomic-replace.ts

@@ -0,0 +1,155 @@
+/**
+ * Windows-tolerant atomic replace.
+ *
+ * POSIX `rename()` replaces the destination entry unconditionally. Windows can
+ * refuse the same call with EBUSY, EPERM or EACCES while another process holds
+ * the target open — a real-time scanner that just indexed the file, a sync
+ * client, a backup agent. The hold is usually momentary, so a bounded retry
+ * turns an operational failure back into a successful publish.
+ *
+ * The envelope is deliberately small: two retries, 25ms then 50ms, about 75ms
+ * total. It is sized for a scanner blinking, not for a file someone actually
+ * has open. Widening it without evidence would trade a rare failure for a
+ * routine stall.
+ *
+ * This lives in its own module rather than in config.ts because
+ * config-ownership.ts is one of its callers and config.ts already imports
+ * config-ownership.ts — exporting it from there would close an import cycle.
+ */
+
+import { renameSync } from "node:fs";
+
+/**
+ * Which durable publisher retried. A closed union on purpose: the value is a
+ * label in a diagnostic surface, and a path-derived string could carry a
+ * username. The type is the enforcement — a path cannot be passed here without
+ * failing typecheck. (`privacy:scan` reads file text and cannot see a runtime
+ * value, so it is a backstop for the response body, not the guard.)
+ */
+export type ReplacePublisher =
+  | "config"
+  | "prompt-journal"
+  | "config-ownership"
+  | "claude-agents"
+  | "lab-automation"
+  | "lab-ledger"
+  | "storage-cleanup"
+  | "tray";
+
+/** The Windows error codes this module treats as a momentary hold. */
+export type ReplaceRetryCode = "EBUSY" | "EPERM" | "EACCES";
+
+export interface ReplaceRetryCounts {
+  /** Replaces that hit this code and were retried. */
+  retried: number;
+  /** Replaces that exhausted every retry and threw. */
+  exhausted: number;
+}
+
+/**
+ * Keyed by publisher AND code. The code is the diagnostic half: EBUSY from a
+ * scanner, EACCES from a permissions problem and EPERM from a lock are three
+ * different stories, and collapsing them would leave the counters unable to
+ * answer the question they exist for.
+ */
+const counters = new Map<string, ReplaceRetryCounts>();
+
+function counterKey(publisher: ReplacePublisher, code: ReplaceRetryCode): string {
+  return `${publisher}:${code}`;
+}
+
+function bump(
+  publisher: ReplacePublisher,
+  code: ReplaceRetryCode,
+  field: keyof ReplaceRetryCounts,
+): void {
+  const key = counterKey(publisher, code);
+  const current = counters.get(key) ?? { retried: 0, exhausted: 0 };
+  current[field] += 1;
+  counters.set(key, current);
+}
+
+/**
+ * Process-lifetime snapshot, keyed `publisher:CODE`. These reset on restart,
+ * which is fine: the question they answer is "does this ever fire at all", not
+ * "how often per hour".
+ */
+export function readWindowsReplaceRetryCounters(): Record<string, ReplaceRetryCounts> {
+  const out: Record<string, ReplaceRetryCounts> = {};
+  for (const [key, counts] of counters) out[key] = { ...counts };
+  return out;
+}
+
+/** Test-only: the counters are module state and cases must not leak into each other. */
+export function resetWindowsReplaceRetryCountersForTests(): void {
+  counters.clear();
+}
+export interface AtomicRenameIO {
+  platform: NodeJS.Platform;
+  rename: (source: string, destination: string) => void;
+  sleep: (milliseconds: number) => void;
+}
+
+const MAX_RETRIES = 2;
+
+/**
+ * Windows sharing violations only, returning the code so the caller can record
+ * which one. Any other error is the caller's to see, immediately.
+ */
+function transientWindowsReplaceCode(
+  platform: NodeJS.Platform,
+  error: unknown,
+): ReplaceRetryCode | null {
+  if (platform !== "win32") return null;
+  const code = (error as NodeJS.ErrnoException).code;
+  return code === "EBUSY" || code === "EPERM" || code === "EACCES" ? code : null;
+}
+
+export function renameAtomicFile(
+  source: string,
+  destination: string,
+  io: AtomicRenameIO = {
+    platform: process.platform,
+    rename: renameSync,
+    sleep: Bun.sleepSync,
+  },
+  publisher: ReplacePublisher = "config",
+): void {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      io.rename(source, destination);
+      return;
+    } catch (error) {
+      const code = transientWindowsReplaceCode(io.platform, error);
+      if (!code) throw error;
+      if (attempt >= MAX_RETRIES) {
+        bump(publisher, code, "exhausted");
+        throw error;
+      }
+      bump(publisher, code, "retried");
+      io.sleep(25 * (attempt + 1));
+    }
+  }
+}
+
+export async function renameAtomicFileAsync(
+  source: string,
+  destination: string,
+  publisher: ReplacePublisher = "config",
+): Promise<void> {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      renameSync(source, destination);
+      return;
+    } catch (error) {
+      const code = transientWindowsReplaceCode(process.platform, error);
+      if (!code) throw error;
+      if (attempt >= MAX_RETRIES) {
+        bump(publisher, code, "exhausted");
+        throw error;
+      }
+      bump(publisher, code, "retried");
+      await Bun.sleep(25 * (attempt + 1));
+    }
+  }
+}

package/src/lib/windows-service-wrappers.ts

@@ -0,0 +1,72 @@
+/**
+ * Shared termination of surviving Windows scheduler launcher/wrapper processes.
+ *
+ * `schtasks /end` ends the task instance but often leaves wscript/cmd running the
+ * `:loop` batch, which brings the proxy back during a stop, a restart, or
+ * post-update reclaim. Both the service teardown path and the update job need
+ * that guarantee, and they used to carry a copy each.
+ *
+ * The copies drifted in both directions, which is why this module exists rather
+ * than a second careful implementation: the updater received the #1589 argv
+ * cleanup that service.ts missed, and service.ts received the canonical-path
+ * scoping the updater missed. One of those gaps could force-terminate a wrapper
+ * belonging to a DIFFERENT OpenCodex home.
+ *
+ * Matching is scoped to the CANONICAL paths of one installation, never a bare
+ * filename, and the path must appear as a COMPLETE command-line token
+ * (wscript.exe spawns the .vbs as an argument; cmd.exe /c runs the .cmd). A
+ * substring match is excluded: an unrelated process whose command line merely
+ * contains the filename, and a wrapper under another home whose path ends with
+ * the same name, must both survive.
+ */
+import { spawnSync } from "node:child_process";
+
+import { resolveTrustedWindowsPowerShellExe } from "./windows-elevation";
+
+/** Quote for PowerShell: single-quote the value and double any embedded quote. */
+function quoteForPowerShell(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+/**
+ * The PowerShell that finds and stops the wrappers for exactly these paths.
+ * Exported for tests: the matching rule is the whole point of this module, and
+ * the spawn itself is best-effort and unobservable.
+ */
+export function windowsWrapperKillScript(paths: readonly string[]): string {
+  return [
+    `$pats = @(${paths.map(quoteForPowerShell).join(", ")});`,
+    "Get-CimInstance Win32_Process | Where-Object {",
+    "  if ($_.ProcessId -eq $PID) { return $false };",
+    "  $c = $_.CommandLine; if (-not $c) { return $false };",
+    "  foreach ($p in $pats) {",
+    "    $i = $c.IndexOf($p, [System.StringComparison]::OrdinalIgnoreCase);",
+    "    if ($i -lt 0) { continue };",
+    "    $before = if ($i -gt 0) { $c.Substring($i - 1, 1) } else { ' ' };",
+    "    $end = $i + $p.Length;",
+    "    $after = if ($end -lt $c.Length) { $c.Substring($end, 1) } else { ' ' };",
+    "    if ($before -match '[\\s\"'']' -and $after -match '[\\s\"'']') { return $true };",
+    "  };",
+    "  $false",
+    "} | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
+  ].join(" ");
+}
+
+/**
+ * Best-effort: never throws, never reports. A wrapper that survives is handled
+ * by the caller's own stop verification.
+ */
+export function killWindowsSchedulerWrappers(paths: {
+  scriptPath: string;
+  launcherPath: string;
+}): void {
+  if (process.platform !== "win32") return;
+  try {
+    spawnSync(resolveTrustedWindowsPowerShellExe(), [
+      // No `-WindowStyle Hidden` here: Bun 1.3.14 can fail that direct CLI pair
+      // before the command runs (#1589). `windowsHide` below is sufficient.
+      "-NoProfile", "-NoLogo", "-NonInteractive",
+      "-Command", windowsWrapperKillScript([paths.scriptPath, paths.launcherPath]),
+    ], { stdio: "ignore", timeout: 5000, windowsHide: true });
+  } catch { /* best-effort */ }
+}

package/src/oauth/google-antigravity.ts

@@ -12,7 +12,7 @@
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { OAuthController, OAuthCredentials } from "./types";
-import { antigravityUserAgent, ANTIGRAVITY_GOOG_API_CLIENT_UA, ANTIGRAVITY_IDE_VERSION } from "../adapters/client-fingerprint";
+import { antigravityUserAgent, ANTIGRAVITY_IDE_VERSION } from "../adapters/client-fingerprint";
 
 const CLIENT_ID = process.env.GOOGLE_ANTIGRAVITY_CLIENT_ID
   || "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
@@ -110,7 +110,7 @@ async function onboardProject(accessToken: string, signal?: AbortSignal): Promis
     if (signal?.aborted) throw signal.reason ?? new Error("Antigravity onboarding aborted");
     const response = await fetch(`${DAILY_API}/${API_VERSION}:onboardUser`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent(), "x-goog-api-client": ANTIGRAVITY_GOOG_API_CLIENT_UA },
+      headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
       // `ide_version` is a version, not a User-Agent. `antigravityUserAgent()` returns the whole
       // header — `antigravity/ide/2.5.5 (aidev_client; os_type=...; arch=...)` — so onboarding was
       // sending a parenthesized UA string in a field the real client fills with `2.5.5`. It is a