@bitkyc08/opencodex 2.28.0 → 2.29.0

package/src/server/responses/responses-field-backfill.ts

@@ -24,6 +24,7 @@ import {
   sseDataPayload,
   type SseBlockRewrite,
 } from "../sse-payload-rewrite";
+import { isCompactionItemType } from "../../responses/compaction";
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -119,16 +120,6 @@ function backfillContentArray(content: unknown): unknown {
   return changed ? repaired : content;
 }
 
-/**
- * Item types that are NOT Responses output items and must be returned byte-for-byte.
- *
- * `compaction` is the `/v1/responses/compact` wire format, not a Responses output item. It has
- * no `id` in that contract, so synthesizing one changes a response body the client compares
- * exactly. The backfill exists to satisfy strict Responses decoders; a shape those decoders
- * never see is outside its remit.
- */
-const NON_RESPONSES_ITEM_TYPES: ReadonlySet<string> = new Set(["compaction"]);
-
 /**
  * Walk an output item and backfill output_text parts in its content.
  * Also backfills a missing required id on the item itself.
@@ -136,7 +127,12 @@ const NON_RESPONSES_ITEM_TYPES: ReadonlySet<string> = new Set(["compaction"]);
  */
 function backfillOutputItem(item: unknown, slot: ItemIdSlot): unknown {
   if (!isPlainObject(item)) return item;
-  if (typeof item.type === "string" && NON_RESPONSES_ITEM_TYPES.has(item.type)) return item;
+  // The compact wire family is the `/v1/responses/compact` format, not a Responses output item.
+  // Those items have no `id` in that contract, so synthesizing one changes a response body the
+  // client compares exactly — and the client replays the item on every later turn, where the
+  // minting backend rejects it as modified. The backfill exists to satisfy strict Responses
+  // decoders; a shape those decoders never see is outside its remit.
+  if (isCompactionItemType(item.type)) return item;
   const content = item.content;
   const repaired = backfillContentArray(content);
   const withId = backfillItemId(item, slot);

package/src/server/responses/terminal-guard.ts

@@ -117,7 +117,7 @@ export function analyzeTerminalTurn(parsed: OcxParsedRequest, events: readonly A
   return { decision: "continue", reason: "suspicious_no_tool", assistantText: text, userText, hasToolCall };
 }
 
-function assistantMessageFromEvents(events: readonly AdapterEvent[]): OcxAssistantMessage | undefined {
+function assistantMessageFromEvents(events: readonly AdapterEvent[], timestamp: number): OcxAssistantMessage | undefined {
   let text = "";
   let thinking = "";
   let signature: string | undefined;
@@ -134,14 +134,18 @@ function assistantMessageFromEvents(events: readonly AdapterEvent[]): OcxAssista
   }
   if (text) content.push({ type: "text", text });
   if (content.length === 0) return undefined;
-  return { role: "assistant", content, timestamp: Date.now() };
+  return { role: "assistant", content, timestamp };
 }
 
 export function buildContinuationRequest(parsed: OcxParsedRequest, events: readonly AdapterEvent[]): OcxParsedRequest {
   const messages = [...parsed.context.messages];
-  const assistant = assistantMessageFromEvents(events);
+  // One clock read for the whole rebuild. Two Date.now() calls could straddle a millisecond
+  // boundary, which made the retained-heartbeat contract test fail intermittently in CI on a
+  // 1ms skew between the assistant message and the nudge that follows it.
+  const timestamp = Date.now();
+  const assistant = assistantMessageFromEvents(events, timestamp);
   if (assistant) messages.push(assistant);
-  messages.push({ role: "developer", content: TERMINAL_GUARD_NUDGE, timestamp: Date.now() });
+  messages.push({ role: "developer", content: TERMINAL_GUARD_NUDGE, timestamp });
   return { ...parsed, context: { ...parsed.context, messages } };
 }
 
@@ -153,6 +157,16 @@ export interface GuardedEventStreamOptions {
   maxAutoContinuations?: number;
 }
 
+/**
+ * Events that are useful to the downstream stream consumer but carry no state used by the
+ * terminal-continuation decision or its rebuilt request. Keep them out of the retained event
+ * list so adapter liveness markers and arbitrarily large tool-argument fragments cannot make
+ * the guard's per-turn memory grow without adding any continuation semantics.
+ */
+export function isTerminalGuardPassthroughOnly(event: AdapterEvent): boolean {
+  return event.type === "heartbeat" || event.type === "tool_call_delta";
+}
+
 function mergeUsage(first: OcxUsage | undefined, second: OcxUsage | undefined): OcxUsage | undefined {
   if (!first) return second;
   if (!second) return first;
@@ -193,13 +207,10 @@ export async function* guardTerminalEventStream(options: GuardedEventStreamOptio
     const seen: AdapterEvent[] = [];
     let terminalSeen = false;
     for await (const event of source) {
-      // A heartbeat is adapter liveness, not turn content: it exists so the bridge watchdog
-      // can tell a buffering adapter from a hung one. Retaining it here would put an
-      // unbounded number of empty markers into `seen`, which feeds both the continuation
-      // analysis and the rebuilt request — and the openai-chat adapter now emits one per
-      // tool-call delta, so a long argument payload alone could grow this array without
-      // limit. The empty-completion guard already passes them through unretained; match it.
-      if (event.type === "heartbeat") {
+      // Liveness markers and tool argument fragments are passed through to the bridge, but
+      // neither analyzeTerminalTurn nor buildContinuationRequest consumes them. Retaining the
+      // fragments would duplicate arbitrarily large argument payloads in `seen` for no effect.
+      if (isTerminalGuardPassthroughOnly(event)) {
         yield event;
         continue;
       }

package/src/server/responses-custom-tool-repair.ts

@@ -2,6 +2,7 @@ import type { TranslatorBudget } from "../lib/translator-budget";
 import {
   customToolItemId,
   restoreRoutedCustomCalls,
+  routedCustomToolWireName,
   unwrapRoutedCustomToolArguments,
 } from "../responses/custom-tool-compat";
 import {
@@ -181,7 +182,8 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       && typeof parsed.item.name === "string"
     ) {
       const upstreamItemId = typeof parsed.item.id === "string" ? parsed.item.id : undefined;
-      const routed = names.has(parsed.item.name);
+      const wireName = routedCustomToolWireName(parsed.item);
+      const routed = wireName !== undefined && names.has(wireName);
       if (upstreamItemId) {
         if (routed) {
           itemNames.set(upstreamItemId, parsed.item.name);

package/src/server/responses-reasoning-summary-rewrite.ts

@@ -34,6 +34,13 @@ function reasoningTextOf(item: Record<string, unknown>): string {
 /** Move a reasoning item's content channel into the summary channel. */
 function reasoningItemToSummaryShape(item: Record<string, unknown>): Record<string, unknown> {
   if (item.type !== "reasoning") return item;
+  // `encrypted_content` is opaque, state-bearing provider data, so the entire item must retain its
+  // upstream shape unless that backend has an explicit replay contract permitting a rewrite. This
+  // defensively protects content-channel backends that do issue blobs when the client replays the
+  // stored item. The delta rewrite can still provide the expandable trace for the live turn.
+  // DeepSeek — the provider this rewrite was verified against — is `statelessResponses` and issues
+  // no blob, so it is unaffected.
+  if (typeof item.encrypted_content === "string" && item.encrypted_content.length > 0) return item;
   const text = reasoningTextOf(item);
   // Items that already use the summary channel (or carry no content text at
   // all) are left untouched: rewriting them could clear a valid summary.

package/src/server/responses-tool-search-repair.ts

@@ -1,5 +1,6 @@
 import {
   isTranslatorBudgetExceededError,
+  TranslatorBudgetExceededError,
   type TranslatorBudget,
 } from "../lib/translator-budget";
 import {
@@ -24,6 +25,19 @@ type PendingArgumentBlock = {
 
 const MAX_PENDING_ARGUMENT_FRAMES = 256;
 const MAX_PENDING_ARGUMENT_BYTES = 1024 * 1024;
+const MAX_CLASSIFIED_ITEM_IDS = 256;
+const MAX_CLASSIFIED_ITEM_ID_BYTES = 256 * 1024;
+
+class ClassifiedItemIdCountExceededError extends Error {
+  readonly code = "translation_buffer_limit";
+  readonly kind = "item_ids";
+  readonly limitItems = MAX_CLASSIFIED_ITEM_IDS;
+
+  constructor() {
+    super(`translator item_ids count exceeded ${MAX_CLASSIFIED_ITEM_IDS} items`);
+    this.name = "ClassifiedItemIdCountExceededError";
+  }
+}
 
 /**
  * Public Responses gateways stream a lowered search as a normal function lifecycle. Codex expects
@@ -36,6 +50,7 @@ export function createRoutedToolSearchRestoreBlockRewrite(
 ): SseBlockRewrite {
   const routedItemIds = new Set<string>();
   const ordinaryItemIds = new Set<string>();
+  let classifiedItemIdBytes = 0;
   let pendingArguments: PendingArgumentBlock[] = [];
   let pendingArgumentBytes = 0;
   let passthrough = false;
@@ -49,10 +64,45 @@ export function createRoutedToolSearchRestoreBlockRewrite(
     }
     pendingArguments = [];
     pendingArgumentBytes = 0;
+    if (classifiedItemIdBytes > 0) {
+      budget?.releaseRetained(classifiedItemIdBytes, { kind: "item_ids" });
+    }
+    classifiedItemIdBytes = 0;
     routedItemIds.clear();
     ordinaryItemIds.clear();
   };
 
+  const clearOrdinaryItemIds = (): void => {
+    let releasedBytes = 0;
+    for (const itemId of ordinaryItemIds) {
+      releasedBytes += Buffer.byteLength(JSON.stringify(itemId), "utf8");
+    }
+    ordinaryItemIds.clear();
+    classifiedItemIdBytes = Math.max(0, classifiedItemIdBytes - releasedBytes);
+    if (releasedBytes > 0) budget?.releaseRetained(releasedBytes, { kind: "item_ids" });
+  };
+
+  const classifyItemId = (itemId: string, routed: boolean): void => {
+    const target = routed ? routedItemIds : ordinaryItemIds;
+    const previous = routed ? ordinaryItemIds : routedItemIds;
+    if (target.has(itemId)) return;
+    if (previous.delete(itemId)) {
+      target.add(itemId);
+      return;
+    }
+
+    if (routedItemIds.size + ordinaryItemIds.size >= MAX_CLASSIFIED_ITEM_IDS) {
+      throw new ClassifiedItemIdCountExceededError();
+    }
+    const retainedBytes = Buffer.byteLength(JSON.stringify(itemId), "utf8");
+    if (classifiedItemIdBytes + retainedBytes > MAX_CLASSIFIED_ITEM_ID_BYTES) {
+      throw new TranslatorBudgetExceededError("item_ids", MAX_CLASSIFIED_ITEM_ID_BYTES);
+    }
+    budget?.chargeRetained(retainedBytes, { kind: "item_ids" });
+    target.add(itemId);
+    classifiedItemIdBytes += retainedBytes;
+  };
+
   const retainPending = (
     block: string,
     itemId: string | undefined,
@@ -73,7 +123,7 @@ export function createRoutedToolSearchRestoreBlockRewrite(
       // that we forget what we already classified: an item restored to `tool_search_call`
       // upstream of here would otherwise start emitting `function_call_arguments.*` again and
       // the client would see a mixed private/public lifecycle for one call.
-      ordinaryItemIds.clear();
+      clearOrdinaryItemIds();
       return flushed;
     }
     if (retainedBytes > 0) {
@@ -90,7 +140,7 @@ export function createRoutedToolSearchRestoreBlockRewrite(
         passthrough = true;
         // Same reasoning as the frame/byte overflow above: an already-restored routed item
         // must keep its frames suppressed even once buffering stops.
-        ordinaryItemIds.clear();
+        clearOrdinaryItemIds();
         return flushed;
       }
     }
@@ -135,7 +185,11 @@ export function createRoutedToolSearchRestoreBlockRewrite(
   const rewrite: SseBlockRewrite = (block: string): readonly string[] => {
     if (disposed) return [block];
     const payload = sseDataPayload(block);
-    if (payload === null || payload === "[DONE]") return [block];
+    if (payload === null) return [block];
+    if (payload === "[DONE]") {
+      releaseAll();
+      return [block];
+    }
     let parsed: unknown;
     try {
       parsed = JSON.parse(payload);
@@ -145,11 +199,16 @@ export function createRoutedToolSearchRestoreBlockRewrite(
     if (!isPlainObject(parsed)) return [block];
 
     const type = typeof parsed.type === "string" ? parsed.type : "";
+    const terminal = type === "response.completed" || type === "response.failed" || type === "response.incomplete";
     // After overflow we stop BUFFERING unknown frames, but an item already restored to
     // `tool_search_call` must keep its public argument frames suppressed — otherwise the client
     // receives a private item followed by `function_call_arguments.*` for the same id, which is
     // exactly the mixed lifecycle this rewrite exists to prevent. Everything else passes through.
     if (passthrough) {
+      if (terminal) {
+        releaseAll();
+        return [block];
+      }
       const passthroughItemId = typeof parsed.item_id === "string" ? parsed.item_id : undefined;
       const isArgumentEvent = type === "response.function_call_arguments.delta"
         || type === "response.function_call_arguments.done";
@@ -169,22 +228,14 @@ export function createRoutedToolSearchRestoreBlockRewrite(
     ) {
       const itemId = typeof parsed.item.id === "string" ? parsed.item.id : undefined;
       const routed = names.has(parsed.item.name);
-      if (itemId) {
-        if (routed) {
-          routedItemIds.add(itemId);
-          ordinaryItemIds.delete(itemId);
-        } else {
-          ordinaryItemIds.add(itemId);
-          routedItemIds.delete(itemId);
-        }
-      }
+      if (itemId) classifyItemId(itemId, routed);
       const pending = takePending(itemId, outputIndex);
       const restored = routed ? restoreRoutedToolSearchCalls(parsed, names) : { value: parsed, changed: false };
       const restoredBlock = restored.changed
         ? replaceSseDataPayload(block, JSON.stringify(restored.value))
         : block;
       // Classification is retained past `output_item.done` for BOTH kinds, until the terminal
-      // event releases everything.
+      // event releases the bounded, budgeted state.
       //
       // `done` ends the item, not the id's relevance. Forgetting a ROUTED id let a trailing
       // `function_call_arguments.*` — which some upstreams emit after done — fall through to
@@ -204,7 +255,6 @@ export function createRoutedToolSearchRestoreBlockRewrite(
     }
     if (argumentEvent && itemId && routedItemIds.has(itemId)) return [];
 
-    const terminal = type === "response.completed" || type === "response.failed" || type === "response.incomplete";
     if (!terminal) return [block];
     const restored = restoreRoutedToolSearchCalls(parsed, names);
     releaseAll();

package/src/sidecar/auth.ts

@@ -0,0 +1,92 @@
+/**
+ * The one place that decides whether a sidecar may treat ChatGPT or Anthropic
+ * auth as PRESENT (#2188). Web-search and vision consumed two hand-rolled
+ * copies of the Anthropic predicate and no Codex-login predicate at all —
+ * provider presence was standing in for "logged in", which let a fresh install
+ * with the built-in forward provider but no credential offer Luna as a
+ * describer it could never run.
+ *
+ * Both flags are request-context-free: they read config plus the stored
+ * account state, never headers. Per-request usability (exact accounts,
+ * generation fences) stays in resolveFirstUsableOpenAiSidecar and the
+ * executors; this module only answers "is this side worth offering at all?".
+ */
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { listOpenAiForwardSidecarCandidates } from "../providers/openai-sidecar";
+import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
+import { isCodexAccountUsable } from "../codex/account-usability";
+import { MAIN_CODEX_ACCOUNT_ID, isSelectableCodexPoolAccount } from "../codex/account-id";
+import { getAccountSet } from "../oauth/store";
+
+export interface SidecarAuthState {
+  /** ChatGPT login usable: canonical forward provider AND a live stored credential. */
+  isCodexAuth: boolean;
+  /** Enabled anthropic-adapter OAuth provider whose active account is not marked for reauth. */
+  isAnthropicAuth: boolean;
+  /** The provider an Anthropic-side executor would dispatch through, when isAnthropicAuth. */
+  anthropicProviderName?: string;
+  anthropicProvider?: OcxProviderConfig;
+}
+
+/**
+ * Fixed auth-slot models (#2188): logged-in sides keep these candidates even
+ * when the picker hides or disables them. The slot is the LOGIN's entitlement,
+ * not the catalog's.
+ */
+export const AUTH_SLOT_MODELS = {
+  codex: "gpt-5.6-luna",
+  anthropic: "claude-haiku-4-5",
+} as const;
+
+export interface SidecarAuthSlot {
+  provider: string;
+  id: string;
+  slot: keyof typeof AUTH_SLOT_MODELS;
+}
+
+/** Login-shaped, not provider-shaped: a forward provider with no credential is NOT Codex auth. */
+function hasUsableCodexLogin(config: OcxConfig): boolean {
+  if (listOpenAiForwardSidecarCandidates(config).length === 0) return false;
+  if (isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID)) return true;
+  return (config.codexAccounts ?? []).some(account =>
+    isSelectableCodexPoolAccount(account) && isCodexAccountUsable(config, account.id));
+}
+
+/**
+ * The predicate previously duplicated as findAnthropicSidecarProvider
+ * (web-search) and findAnthropicVisionProvider (vision): first enabled
+ * anthropic-adapter OAuth provider whose ACTIVE stored account holds a usable
+ * credential. getAccountSet + needsReauth, not getCredential — a terminally
+ * invalid account must not present as auth (audit F1).
+ */
+function findAnthropicAuthProvider(
+  config: OcxConfig,
+): { providerName: string; provider: OcxProviderConfig } | undefined {
+  for (const [providerName, provider] of Object.entries(config.providers)) {
+    if (provider.disabled === true) continue;
+    if (provider.adapter !== "anthropic" || provider.authMode !== "oauth") continue;
+    const set = getAccountSet(providerName);
+    const active = set?.accounts.find(account => account.id === set.activeAccountId);
+    if (active && active.needsReauth !== true) return { providerName, provider };
+  }
+  return undefined;
+}
+
+export function resolveSidecarAuth(config: OcxConfig): SidecarAuthState {
+  const anthropic = findAnthropicAuthProvider(config);
+  return {
+    isCodexAuth: hasUsableCodexLogin(config),
+    isAnthropicAuth: anthropic !== undefined,
+    ...(anthropic ? { anthropicProviderName: anthropic.providerName, anthropicProvider: anthropic.provider } : {}),
+  };
+}
+
+/** The auth-entitled fixed candidates. Emitted regardless of picker visibility. */
+export function sidecarAuthSlots(auth: SidecarAuthState): SidecarAuthSlot[] {
+  const slots: SidecarAuthSlot[] = [];
+  if (auth.isCodexAuth) slots.push({ provider: OPENAI_CODEX_PROVIDER_ID, id: AUTH_SLOT_MODELS.codex, slot: "codex" });
+  if (auth.isAnthropicAuth && auth.anthropicProviderName) {
+    slots.push({ provider: auth.anthropicProviderName, id: AUTH_SLOT_MODELS.anthropic, slot: "anthropic" });
+  }
+  return slots;
+}

package/src/sidecar/candidates.ts

@@ -0,0 +1,83 @@
+/**
+ * The unified picker-visibility candidate set both sidecars consume (#2188).
+ *
+ * Rule 1 (picker): a model may be OFFERED as a sidecar backend only if the
+ * management picker would show it — the same `listManagementModelRows` rows
+ * the GUI Models tab renders, minus disabled rows. Rule 1's only exception is
+ * the auth slots: a logged-in side keeps its fixed slot model (Luna/Haiku)
+ * even when the picker hides it, because the slot is the login's entitlement.
+ *
+ * Vision additionally applies rule 2 (− provably text-only); web-search
+ * applies its own rule 2 (∩ probed backend with an executor) in
+ * src/web-search/backends.ts. Both start from THIS set so the two sidecars
+ * cannot diverge on what "visible" means.
+ */
+import type { OcxConfig } from "../types";
+import { listManagementModelRows } from "../server/management/model-rows";
+import { modelAcceptsImageInput, type VisionCandidateModel } from "../vision/eligibility";
+import { sidecarAuthSlots, type SidecarAuthState } from "./auth";
+
+export interface SidecarCandidate {
+  provider: string;
+  id: string;
+  native?: boolean;
+  inputModalities?: string[];
+  /** True when this row is an auth-slot entitlement rather than a picker row. */
+  authSlot?: boolean;
+}
+
+/**
+ * (picker-visible rows) ∪ (auth slots). De-duplicated by provider+id with the
+ * auth-slot flag winning, so a slot model that is ALSO picker-visible still
+ * reads as slot-backed. A catalog outage degrades to slots only — the settings
+ * routes must not 500 and must keep the logged-in floor populated.
+ */
+export async function pickerVisibleSidecarCandidates(
+  config: OcxConfig,
+  auth: SidecarAuthState,
+): Promise<SidecarCandidate[]> {
+  let rows: Awaited<ReturnType<typeof listManagementModelRows>> = [];
+  try { rows = await listManagementModelRows(config); } catch { rows = []; }
+  const byKey = new Map<string, SidecarCandidate>();
+  for (const row of rows) {
+    if (row.disabled === true) continue;
+    byKey.set(`${row.provider}/${row.id}`, {
+      provider: row.provider,
+      id: row.id,
+      ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
+      ...(row.native ? { native: true } : {}),
+    });
+  }
+  for (const slot of sidecarAuthSlots(auth)) {
+    byKey.set(`${slot.provider}/${slot.id}`, {
+      provider: slot.provider,
+      id: slot.id,
+      // Slot models are known image-capable; their only exclusion path is the
+      // provider's explicit consumer list (same stance as baselineCandidate).
+      inputModalities: ["text", "image"],
+      authSlot: true,
+    });
+  }
+  return [...byKey.values()];
+}
+
+/**
+ * Rule 2 for vision: drop rows PROVABLY text-only. Unknown stays eligible —
+ * the picker filter (rule 1) already bounded the set, so permissive-unknown
+ * no longer expands to the whole catalog.
+ */
+export function visionSidecarCandidates(
+  config: Pick<OcxConfig, "providers">,
+  all: readonly SidecarCandidate[],
+): SidecarCandidate[] {
+  return all.filter(candidate => modelAcceptsImageInput(config, toVisionCandidate(candidate)) !== false);
+}
+
+function toVisionCandidate(candidate: SidecarCandidate): VisionCandidateModel {
+  return {
+    provider: candidate.provider,
+    id: candidate.id,
+    ...(candidate.inputModalities ? { inputModalities: candidate.inputModalities } : {}),
+    ...(candidate.native ? { native: true } : {}),
+  };
+}

package/src/types/config.ts

@@ -128,7 +128,7 @@ export interface OcxClaudeCodeConfig {
    */
   subagentEffort?: "low" | "medium" | "high" | "xhigh" | "max";
   /** Claude-originated web-search override. Unset fields inherit the global sidecar settings. */
-  webSearchSidecar?: { backend?: "openai" | "anthropic"; model?: string };
+  webSearchSidecar?: { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa"; model?: string };
   /** Claude-originated vision override. Unset fields inherit the global sidecar settings. */
   visionSidecar?: { backend?: "openai" | "anthropic"; model?: string };
   /** Persisted Claude Desktop four-family routing profile. */
@@ -790,12 +790,33 @@ export interface OcxWebSearchSidecarConfig {
   /**
    * Which backend actually runs the server-side search. "openai" replays the hosted web_search via
    * the ChatGPT forward provider (gpt-mini sidecar); "anthropic" runs web_search_20250305 on a Claude
-   * model authenticated by the STORED anthropic OAuth credential. Unset resolves to "anthropic" when a
-   * usable anthropic OAuth credential exists, else "openai".
-   */
-  backend?: "openai" | "anthropic";
+   * model authenticated by the STORED anthropic OAuth credential. "xai" runs Grok hosted web_search
+   * and optional x_search through stored Grok OAuth. "gemini" (google_search grounding via the
+   * Antigravity CCA transport) and "exa" (non-LLM search JSON via an operator key) are explicit-only
+   * and stay inactive until their executors ship. Unset ALWAYS resolves to "openai"; no backend is ever
+   * auto-selected from credential availability (that once sent incompatible models to the
+   * Anthropic API — see resolveSidecarBackend).
+   */
+  backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa";
   /** Sidecar model that runs the real server-side web_search (must be a native ChatGPT model). */
   model?: string;
+  /**
+   * Operator-supplied Exa API key for the "exa" backend. Management GET responses never echo it,
+   * and src/lib/redact.ts strips it from any logged structure or error string.
+   */
+  exaApiKey?: string;
+  /**
+   * Opt-in X (Twitter) search for the xai backend: adds the hosted x_search tool next to
+   * web_search. Limits are doc-validated at the management layer AND in the executor:
+   * handles <=20 per list, allow XOR exclude, ISO-8601 dates.
+   */
+  xSearch?: {
+    enabled?: boolean;
+    allowedXHandles?: string[];
+    excludedXHandles?: string[];
+    fromDate?: string;
+    toDate?: string;
+  };
   /** Reasoning effort for the sidecar — "minimal" (non-thinking) keeps it fast/cheap. */
   reasoning?: string;
   /** Max searches executed per main-model turn (loop guard). */

package/src/types/provider.ts

@@ -204,6 +204,11 @@ export interface OcxProviderConfig {
    * `ocxr1` envelopes are still stripped because no upstream can decrypt them.
    */
   preserveResponsesReasoningContent?: boolean;
+  /**
+   * Explicit opt-in for a relay that genuinely fronts OpenAI and can decode native
+   * compaction blobs. Absent or false degrades foreign blobs to an opaque note.
+   */
+  decodesNativeCompactionBlobs?: boolean;
   /**
    * Explicit opt-in for non-registry private-network destinations such as localhost, RFC1918,
    * link-local, or unique-local upstreams. Metadata endpoints remain blocked.
@@ -341,6 +346,12 @@ export interface OcxProviderConfig {
    * Use for non-forward Responses gateways that reserve a hosted tool namespace server-side.
    */
   modelPreferHostedTools?: Record<string, string[]>;
+  /**
+   * Whether the Responses upstream accepts OpenAI's extended hosted web_search fields.
+   * Set false only for a provider whose native contract rejects them; absence preserves
+   * passthrough compatibility for OpenAI and unclassified gateways.
+   */
+  supportsOpenAiWebSearchToolFields?: boolean;
   /**
    * Provider-local repair for Responses gateways whose lifecycle snapshots omit canonical
    * fields or closing events (#893). Disabled by default and applied only to client-facing
@@ -400,6 +411,13 @@ export interface OcxProviderConfig {
    * mid-work; non-`openai-chat` adapters ignore this flag.
    */
   terminalContinuationGuard?: boolean;
+  /**
+   * Opt-in for OpenAI-compatible chat gateways that may close after emitting a complete
+   * tool-call delta without `finish_reason` or `[DONE]`. The adapter accepts that EOF only
+   * when every pending call has a non-empty name and complete JSON-object arguments;
+   * incomplete JSON, missing arguments, and empty streams remain truncation errors.
+   */
+  openaiChatEofTolerance?: boolean;
   /**
    * Opt-in: forward `prompt_cache_key` to the upstream `/chat/completions` body.
    * OpenAI-specific extension; strict backends (Groq, Cerebras, etc.) reject unknown

package/src/types/request.ts

@@ -65,6 +65,11 @@ export interface OcxParsedRequest {
   _clientThreadId?: string;
   /** Provider/account/model-bound namespace for process-local raw-reasoning replay. */
   _reasoningReplayScope?: OcxReasoningReplayScopeRef;
+  /**
+   * Set by bindRouteReasoningReplayScope after a proven serving-identity change, or by
+   * prepareOpaqueBlobRecovery after an authoritative rejection; consumers strip replayed blobs.
+   */
+  _stripReasoningEncryptedContent?: boolean;
   /**
    * Optional authenticated tenant/operator namespace for Cursor thread→conversation derivation.
    * When absent (single-operator local proxy), derivation stays local-scoped.
@@ -79,6 +84,10 @@ export interface OcxParsedRequest {
   _kiroAuthContext?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
   /** Provider-private continuation metadata resolved from the Responses previous_response_id chain. */
   _providerContinuation?: OcxProviderContinuationState;
+  /** Persisted continuation considered only after the final physical route is known. */
+  _providerContinuationCandidate?: OcxProviderContinuationState;
+  /** Exact process-local route owner attached to newly persisted provider state. */
+  _providerContinuationOwner?: OcxProviderContinuationOwner;
   /**
    * The hosted `{type:"web_search", ...}` tool config, stashed when Codex enables web search. Routed
    * (non-OpenAI) providers can't run it server-side, so the proxy re-exposes it as a function tool and
@@ -251,16 +260,33 @@ export interface OcxRequestOptions {
 
 export type OcxMessagePhase = "commentary" | "final_answer";
 
+/** Non-secret, process-local owner fence for provider-private continuation state. */
+export interface OcxProviderContinuationOwner {
+  [field: string]: string | number;
+  version: 1;
+  providerName: string;
+  providerDestinationIdentity: string;
+  adapterName: string;
+  modelId: string;
+  credentialIdentity: string;
+}
+
 /**
  * Provider-private state that must follow a locally expanded `previous_response_id` chain.
  * Kept out of public Responses output and persisted only in the bounded local continuation cache.
  */
 export interface OcxProviderContinuationState {
+  /** Proxy-authored owner metadata; stripped before provider adapters receive the state. */
+  __ocxOwner?: OcxProviderContinuationOwner;
   cursor?: {
+    [field: string]: unknown;
     conversationId?: string;
     checkpointUsable?: boolean;
+    /** Opaque process-local Cursor ConversationStateStructure snapshot ref. Never raw protobuf. */
+    checkpointRef?: string;
   };
   kiro?: {
+    [field: string]: unknown;
     conversationId?: string;
   };
   [provider: string]: Record<string, unknown> | undefined;

package/src/types.ts

@@ -43,6 +43,7 @@ export type {
   OcxAssistantContentPart,
   OcxRequestOptions,
   OcxMessagePhase,
+  OcxProviderContinuationOwner,
   OcxProviderContinuationState,
   AdapterEvent,
   OcxUrlCitation,

package/src/usage/log.ts

@@ -29,6 +29,7 @@ export type AttemptRecoveryKind =
   | "rate-limit-429"
   | "anthropic-oauth-429"
   | "image-413"
+  | "opaque-blob-rejection"
   | "empty-completion";
 
 export interface PersistedUsageAttempt {
@@ -218,6 +219,7 @@ const ATTEMPT_RECOVERY_KINDS = new Set<AttemptRecoveryKind>([
   "rate-limit-429",
   "anthropic-oauth-429",
   "image-413",
+  "opaque-blob-rejection",
   "empty-completion",
 ]);
 const USAGE_STATUSES = new Set<UsageStatus>([