@bitkyc08/opencodex 2.36.0-preview.20260829 → 2.36.0

package/src/adapters/cursor/tool-result-normalize.ts

@@ -13,7 +13,7 @@ import {
   EMPTY_EXEC_OUTPUT_MESSAGE,
   EMPTY_EXEC_OUTPUT_REGEX,
   FAILED_EXEC_OUTPUT_MESSAGE,
-  FAILED_EXEC_OUTPUT_REGEX,
+  isFailedEmptyExecWrapper,
   isCodexExecBridgeTool,
 } from "../exec-tool-result-normalize";
 
@@ -23,7 +23,7 @@ import {
  * `Script failed`, so restore that arm here rather than widening the shared one.
  */
 function isEmptyOrFailedExecWrapper(text: string): boolean {
-  return EMPTY_EXEC_OUTPUT_REGEX.test(text) || FAILED_EXEC_OUTPUT_REGEX.test(text);
+  return EMPTY_EXEC_OUTPUT_REGEX.test(text) || isFailedEmptyExecWrapper(text);
 }
 
 const COMPUTER_USE_TOOL_NAMES = new Set([
@@ -99,7 +99,7 @@ export function normalizeCursorToolResultText(
       // A `Script failed` wrapper is empty but NOT a success: reporting it as an empty success
       // would erase the only failure signal. Text classification stays separate from Cursor's
       // isError policy, which the Computer Use branch above owns.
-      text: FAILED_EXEC_OUTPUT_REGEX.test(text.trim()) ? FAILED_EXEC_OUTPUT_MESSAGE : EMPTY_EXEC_OUTPUT_MESSAGE,
+      text: isFailedEmptyExecWrapper(text.trim()) ? FAILED_EXEC_OUTPUT_MESSAGE : EMPTY_EXEC_OUTPUT_MESSAGE,
       isError: false,
       changed: true,
     };

package/src/adapters/cursor/transport-retry.ts

@@ -2,7 +2,7 @@ import type { CursorRunRequest, CursorServerMessage } from "./types";
 import type { CursorTransport, CursorTransportFactory, CursorTransportFactoryInput } from "./transport";
 import { abortError, retryBackoffDelayMs, sleepWithAbort } from "../../lib/upstream-retry";
 import { debugProviderDiagnostic } from "../../lib/debug";
-import { safeCursorErrorMessage } from "./cursor-errors";
+import { isCursorRootEnvelopeError, safeCursorErrorMessage } from "./cursor-errors";
 
 // Compat: historical name for the shared abortable sleep, kept for external callers.
 export { sleepWithAbort as abortAwareSleep } from "../../lib/upstream-retry";
@@ -18,6 +18,10 @@ export const CURSOR_RETRY_MAX_MS = 2_000;
  * never replay a turn the Cursor server might already have accepted.
  */
 export function isRetryableCursorError(err: unknown): boolean {
+  // Local envelope failures are deterministic: the same request produces the same rejection.
+  // Checked before the text heuristics below, which would otherwise have to infer this from
+  // wording.
+  if (isCursorRootEnvelopeError(err)) return false;
   const code = typeof err === "object" && err && "code" in err ? String((err as { code?: unknown }).code ?? "") : "";
   const message = err instanceof Error ? err.message : typeof err === "string" ? err : "";
   const haystack = `${code} ${message}`.toLowerCase();

package/src/adapters/cursor.ts

@@ -3,7 +3,7 @@ import type { AdapterEvent, OcxProviderConfig } from "../types";
 import type { ProviderAdapter } from "./base";
 import { isTranslatorBudgetExceededError } from "../lib/translator-budget";
 import { cursorExecDeniedMessage, cursorRequestDeclaresFullAccess } from "./cursor/exec-policy";
-import { isCursorBenignCancelError, isCursorInvalidArgumentError, safeCursorErrorMessage, type CursorSizeContext } from "./cursor/cursor-errors";
+import { isCursorBenignCancelError, isCursorInvalidArgumentError, isCursorRootEnvelopeError, safeCursorErrorMessage, type CursorSizeContext } from "./cursor/cursor-errors";
 import { cursorCheckpointModelAffinityId, inferCursorContextWindow, isCursorExternalWireModel } from "./cursor/discovery";
 import { createCursorKvStore, type CursorKvStore } from "./cursor/kv-store";
 import { mapCursorServerMessage } from "./cursor/message-mapper";
@@ -70,6 +70,14 @@ function safeCursorTransportError(err: unknown, sizeContext?: CursorSizeContext)
   if (err instanceof CursorMissingCredentialError) {
     return "Cursor live transport is enabled, but no Cursor access token is configured. Set provider.apiKey or OPENCODEX_CURSOR_TEST_TOKEN.";
   }
+  // A locally raised envelope rejection is already safe, specific, and actionable: it was composed
+  // here from our own measurements and contains no upstream text. Passing it through
+  // `safeCursorErrorMessage` would collapse it to the bare label "Cursor invalid request" (it
+  // matches the "invalid"/"exceeds" keyword branch) and discard the counts that tell the operator
+  // which limit was hit and by how much.
+  if (isCursorRootEnvelopeError(err)) {
+    return err instanceof Error ? `Cursor invalid request: ${err.message}` : "Cursor invalid request";
+  }
   const message = err instanceof Error ? err.message : typeof err === "string" ? err : undefined;
   if (message) return safeCursorErrorMessage(message, sizeContext);
   return "Cursor upstream error: transport failed before completion.";
@@ -485,6 +493,12 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
           ...(isTranslatorBudgetExceededError(err)
             ? { status: 502, errorType: "upstream_error", code: "translation_buffer_limit" }
             : {}),
+          // A local envelope rejection is a client error with a stable code, and the caller needs
+          // that code to distinguish "this conversation cannot be sent" from a transient upstream
+          // fault. Without this the class was flattened to a bare message and the code was lost.
+          ...(isCursorRootEnvelopeError(err)
+            ? { status: 400, errorType: "invalid_request_error", code: "cursor_root_envelope_limit", retryable: false }
+            : {}),
           ...(partialUsage ? { usage: partialUsage } : {}),
         });
       }

package/src/adapters/empty-tool-output-annotation.ts

@@ -0,0 +1,43 @@
+/**
+ * Shared wire text and emptiness contract for present-but-empty tool outputs.
+ *
+ * Both the OpenAI Chat and Responses adapters use this module so the two wires
+ * cannot drift again: only a pure text/refusal part array whose joined content
+ * trims empty is "present but empty". Image, file, encrypted-content and any
+ * other non-text part is real output and is never replaced by the annotation.
+ */
+
+/** Wire text used when a present-but-empty tool output must stay visible to the model. */
+export const EMPTY_TOOL_OUTPUT_ANNOTATION =
+  "[ocx] empty tool output: the tool ran but produced no stdout or return value; do not treat this as success, failure, or user-provided input.";
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Part types that carry wire text on either adapter (Chat uses `text`, Responses uses `input_text`/`output_text`). */
+const TEXT_PART_TYPES = new Set(["text", "input_text", "output_text"]);
+
+/**
+ * True when every part is text/refusal and the joined text/refusal content trims
+ * empty. An empty array is the array twin of a blank string. Any image, file,
+ * encrypted-content or other non-text part makes the array non-empty so the
+ * model still receives the real payload.
+ */
+export function isWhitespaceOnlyTextPartArray(parts: readonly unknown[]): boolean {
+  if (parts.length === 0) return true;
+  let joined = "";
+  for (const part of parts) {
+    if (!isPlainObject(part)) return false;
+    if (typeof part.type === "string" && TEXT_PART_TYPES.has(part.type) && typeof part.text === "string") {
+      joined += part.text;
+      continue;
+    }
+    if (part.type === "refusal" && typeof part.refusal === "string") {
+      joined += part.refusal;
+      continue;
+    }
+    return false;
+  }
+  return joined.trim() === "";
+}

package/src/adapters/exec-tool-result-normalize.ts

@@ -17,13 +17,78 @@
  * `Script failed` is deliberately NOT in this set. A failed cell with no captured output is still
  * a FAILURE, and the success guidance below ("not a blocked tool", "do not re-run") would erase the
  * only signal that anything went wrong — reachable through Responses history, where
- * `function_call_output` is parsed with `isError: false`. Cursor keeps its own broader regex for
- * Computer Use, where a failed wrapper is separately marked `isError`.
+ * `function_call_output` is parsed with `isError: false`. Cursor combines this set with
+ * `isFailedEmptyExecWrapper` below for Computer Use, where a failed wrapper is separately marked
+ * `isError`.
  */
 export const EMPTY_EXEC_OUTPUT_REGEX = /^(?:(?:Script completed|Command finished|Execution finished)[^\n]*\n+)?(?:Wall time[^\n]*\n+)?(?:Output:\s*)?(?:<empty>)?\s*$/;
 
-/** Wrapper for a cell that FAILED without emitting output: empty, but not a success. */
-export const FAILED_EXEC_OUTPUT_REGEX = /^Script failed[^\n]*\n*(?:Wall time[^\n]*\n*)?(?:Output:\s*)?(?:<empty>)?\s*$/;
+function skipFailedWrapperBlankSeparators(text: string, start: number): number {
+  let index = start;
+  while (index < text.length) {
+    if (text[index] === "\n") {
+      index += 1;
+      continue;
+    }
+    // A CRLF blank line is one separator, not a stray carriage return. The regex this replaced
+    // matched only `\n`, so a Windows-produced wrapper never classified and the failure guidance
+    // was silently replaced by the empty-SUCCESS message on that platform.
+    if (text[index] === "\r" && text[index + 1] === "\n") {
+      index += 2;
+      continue;
+    }
+    break;
+  }
+  return index;
+}
+
+function skipFailedWrapperWhitespace(text: string, start: number): number {
+  let index = start;
+  while (index < text.length && text[index]!.trim() === "") index += 1;
+  return index;
+}
+
+function skipFailedWrapperLine(text: string, start: number): number {
+  const newline = text.indexOf("\n", start);
+  return newline === -1 ? text.length : skipFailedWrapperBlankSeparators(text, newline + 1);
+}
+
+/**
+ * Wrapper for a cell that FAILED without emitting output: empty, but not a success.
+ *
+ * A single forward scan, replacing a regex whose `\n*` and `\s*` runs sat adjacent over the same
+ * span and could be made to backtrack on a long whitespace run followed by one non-matching
+ * character. Every loop here advances an index monotonically and the token checks are fixed-length,
+ * so the work is bounded by the input length with no path that retries a prefix.
+ *
+ * Two boundaries are load-bearing and both were divergences in an earlier attempt at this rewrite:
+ *
+ * - Whitespace after `Output:` may precede the marker, so an INDENTED `<empty>` still classifies.
+ *   Rejecting it would leave the wrapper unnormalized and the failure unexplained.
+ * - Only whitespace may follow the marker, so a DUPLICATE `<empty>` still does not classify.
+ *   Accepting it would erase a real payload as an empty failed wrapper — the damaging direction.
+ *
+ * Behaviour is otherwise identical to the regex; the CRLF separators above are the only
+ * intentional change, verified against a 63-shape differential corpus.
+ */
+export function isFailedEmptyExecWrapper(trimmed: string): boolean {
+  if (!trimmed.startsWith("Script failed")) return false;
+
+  const firstNewline = trimmed.indexOf("\n", "Script failed".length);
+  if (firstNewline === -1) return true;
+
+  let index = skipFailedWrapperBlankSeparators(trimmed, firstNewline + 1);
+  if (trimmed.startsWith("Wall time", index)) {
+    index = skipFailedWrapperLine(trimmed, index);
+  }
+  if (trimmed.startsWith("Output:", index)) {
+    index = skipFailedWrapperWhitespace(trimmed, index + "Output:".length);
+  }
+  if (trimmed.startsWith("<empty>", index)) {
+    index += "<empty>".length;
+  }
+  return skipFailedWrapperWhitespace(trimmed, index) === trimmed.length;
+}
 
 /** Guidance for a failed cell whose output was empty: the failure must survive normalization. */
 export const FAILED_EXEC_OUTPUT_MESSAGE =
@@ -94,6 +159,6 @@ export function normalizeEmptyExecToolResultText(
   if (!isCodexExecBridgeTool(options.toolName, options.toolNamespace)) return undefined;
   const trimmed = text.trim();
   // Failure first: a failed wrapper must never be described as an empty success.
-  if (FAILED_EXEC_OUTPUT_REGEX.test(trimmed)) return FAILED_EXEC_OUTPUT_MESSAGE;
+  if (isFailedEmptyExecWrapper(trimmed)) return FAILED_EXEC_OUTPUT_MESSAGE;
   return EMPTY_EXEC_OUTPUT_REGEX.test(trimmed) ? EMPTY_EXEC_OUTPUT_MESSAGE : undefined;
 }

package/src/adapters/google.ts

@@ -54,6 +54,16 @@ const GOOGLE_BREVITY_INSTRUCTION = [
   "- This applies only to intermediate progress text. Your final answer after the work is done is exempt: write it in full and at whatever length the task requires.",
 ].join("\n");
 
+const ANTIGRAVITY_REJECTED_CLAUDE_SDK_PARAGRAPH =
+  "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+
+function stripAntigravityRejectedClaudeSdkParagraph(systemText: string): string {
+  return systemText
+    .split("\n\n")
+    .filter(paragraph => paragraph !== ANTIGRAVITY_REJECTED_CLAUDE_SDK_PARAGRAPH)
+    .join("\n\n");
+}
+
 /**
  * Documented output ceiling for a Google-surface model, or `undefined` when the id is not
  * recognized.
@@ -227,15 +237,19 @@ function geminiOrphanToolResultParts(msg: OcxToolResultMessage): unknown[] {
 function messagesToGeminiFormat(
   parsed: OcxParsedRequest,
   identityModelId: string,
+  stripRejectedClaudeSdkParagraph = false,
 ): { systemInstruction?: unknown; contents: unknown[]; replayedCallIds: string[] } {
   // Neutralize Codex's GPT-5 identity line (Gemini/Antigravity share this path) so a routed model
   // never misreports as GPT-5/OpenAI, and never leaks the proxy identity upstream.
   const toolCatalogNudge = buildNonOpenAIToolCatalogNudgeForTools(parsed.context.tools, parsed.options.toolChoice);
-  const systemText = identifyRoutedModel([
+  const identifiedSystemText = identifyRoutedModel([
     ...(parsed.context.systemPrompt ?? []),
     ...(toolCatalogNudge ? [toolCatalogNudge] : []),
     GOOGLE_BREVITY_INSTRUCTION,
   ].join("\n\n"), identityModelId);
+  const systemText = stripRejectedClaudeSdkParagraph
+    ? stripAntigravityRejectedClaudeSdkParagraph(identifiedSystemText)
+    : identifiedSystemText;
   const systemInstruction = { parts: [{ text: systemText }] };
 
   const contents: unknown[] = [];
@@ -733,7 +747,13 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           : resolveDirectGeminiWireModelId(parsed.modelId, provider.directGeminiWireRenames !== false);
       // AI Studio's `-tiered` spelling is wire-only; CCA aliases may migrate to another generation.
       const identityModelId = provider.googleMode === "cloud-code-assist" ? routedModelId : parsed.modelId;
-      const { systemInstruction, contents, replayedCallIds } = messagesToGeminiFormat(parsed, identityModelId);
+      const stripRejectedClaudeSdkParagraph = provider.googleMode === "cloud-code-assist"
+        && parsed.modelId === "gemini-3.7-flash";
+      const { systemInstruction, contents, replayedCallIds } = messagesToGeminiFormat(
+        parsed,
+        identityModelId,
+        stripRejectedClaudeSdkParagraph,
+      );
       lastInjectedCallIds = [...replayedCallIds];
       lastReasoningReplayScope = parsed._reasoningReplayScope;
       const tools = toolsToGeminiFormat(parsed);

package/src/adapters/kiro.ts

@@ -1062,6 +1062,27 @@ async function* parseKiroAttemptEvents(
       try { yield event; } finally { retention.releaseEvent(event); }
     }
   };
+  // A valid private completion answer supersedes the progress prose staged during the SAME
+  // inference: Kiro emits answer-like text and then calls the completion tool, so releasing both
+  // makes the bridge close the commentary message and open a second one with near-identical text
+  // (#2819 follow-up). Consume the collection instead — drop the redundant text, keep every
+  // non-text event, and release retention either way.
+  //
+  // This is deliberately the ONLY suppression site. The outer drain in `parseKiroAttempt` is also
+  // the leftover flush for early terminal returns (stream, protocol, and provider failures), so
+  // teaching it to discard text would hide the only commentary a failed turn ever produced.
+  // Splicing here leaves that drain empty on the completion path and untouched everywhere else.
+  const consumeSupersededByCompletion = async function* (
+    events: AdapterEvent[],
+  ): AsyncGenerator<AdapterEvent> {
+    for (const event of events.splice(0)) {
+      try {
+        if (event.type !== "text_delta") yield event;
+      } finally {
+        retention.releaseEvent(event);
+      }
+    }
+  };
 
   const providerState = (): { kiro: { conversationId: string } } | undefined =>
     returnedConversationId ? { kiro: { conversationId: returnedConversationId } } : undefined;
@@ -1466,12 +1487,15 @@ async function* parseKiroAttemptEvents(
     });
 
     if (mode === "required") {
-      yield* emitRetained(deferred.splice(0));
+      // A valid completion answer makes this inference's staged prose redundant; anything else
+      // still flushes exactly as before (bounded fallback, explicit stops, real tool calls).
+      if (completionAnswer !== undefined) yield* consumeSupersededByCompletion(deferred);
+      else yield* emitRetained(deferred.splice(0));
     }
 
     if (mode === "text_fallback") {
       if (completionAnswer !== undefined) {
-        yield* emitRetained(fallbackEvents);
+        yield* consumeSupersededByCompletion(fallbackEvents);
         yield { type: "text_delta", text: completionAnswer, phase: "final_answer" };
         return {
           assistantText,

package/src/adapters/ollama-native-url.ts

@@ -0,0 +1,111 @@
+/**
+ * URL policy for Ollama's native REST API.
+ *
+ * The built-in Ollama provider historically stored an OpenAI-compatible `/v1` base URL.  The
+ * native adapter deliberately canonicalizes that compatibility spelling only for Ollama's known
+ * local/cloud hosts.  An arbitrary custom host with a `/v1` path is never silently rewritten.
+ */
+
+export type OllamaNativeEndpointKind = "local" | "cloud" | "custom";
+
+const LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1"]);
+const CLOUD_HOSTNAMES = new Set(["ollama.com"]);
+const REJECTED_CLOUD_ALIAS_HOSTNAMES = new Set(["www.ollama.com"]);
+
+function normalizedHostname(url: URL): string {
+  const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+  return hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+}
+
+function normalizedPath(url: URL): string {
+  const path = url.pathname.replace(/\/+$/, "");
+  return path === "/" ? "" : path;
+}
+
+function endpointKind(url: URL): OllamaNativeEndpointKind {
+  // WHATWG URL keeps IPv6 brackets in `hostname` on Bun/Node (`[::1]`), while the
+  // loopback policy is stored in its canonical host form (`::1`).
+  const hostname = normalizedHostname(url);
+  if (REJECTED_CLOUD_ALIAS_HOSTNAMES.has(hostname)) {
+    throw new Error("ollama-native requires canonical Ollama Cloud host ollama.com; www.ollama.com is rejected");
+  }
+  if (LOCAL_HOSTNAMES.has(hostname)) return "local";
+  if (CLOUD_HOSTNAMES.has(hostname)) return "cloud";
+  return "custom";
+}
+
+function assertCloudTransport(url: URL, kind: OllamaNativeEndpointKind): void {
+  if (kind !== "cloud") return;
+  if (url.protocol !== "https:") {
+    throw new Error("ollama-native canonical Ollama Cloud requires HTTPS");
+  }
+  if (url.port) {
+    throw new Error("ollama-native canonical Ollama Cloud rejects non-default ports");
+  }
+}
+
+function parseBaseUrl(baseUrl: string): URL {
+  const trimmed = baseUrl.trim();
+  if (!trimmed) throw new Error("ollama-native requires a non-empty baseUrl");
+
+  let url: URL;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw new Error("ollama-native requires an absolute http(s) baseUrl");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("ollama-native only supports http(s) base URLs");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error("ollama-native baseUrl must not contain credentials, a query, or a fragment");
+  }
+  return url;
+}
+
+/** Return the endpoint family used by native authentication policy. */
+export function ollamaNativeEndpointKind(baseUrl: string): OllamaNativeEndpointKind {
+  const url = parseBaseUrl(baseUrl);
+  const kind = endpointKind(url);
+  assertCloudTransport(url, kind);
+  return kind;
+}
+
+/** True when the base URL points at canonical Ollama Cloud (not a self-hosted destination). */
+export function isCanonicalOllamaCloudUrl(baseUrl: string): boolean {
+  return ollamaNativeEndpointKind(baseUrl) === "cloud";
+}
+
+/**
+ * Build the native chat endpoint from a configured base URL.
+ *
+ * Recognized compatibility forms on canonical Ollama hosts:
+ *   - `/`, `/api`, `/api/chat`
+ *   - legacy `/v1` and `/v1/chat/completions`
+ *
+ * For an unrelated custom host only `/`, `/api`, and `/api/chat` are accepted.  In particular,
+ * `/v1` is rejected instead of being stripped or guessed at.
+ */
+export function ollamaNativeChatUrl(baseUrl: string): string {
+  const url = parseBaseUrl(baseUrl);
+  const kind = endpointKind(url);
+  assertCloudTransport(url, kind);
+  const path = normalizedPath(url);
+  const canonicalPaths = new Set(["", "/api", "/api/chat", "/v1", "/v1/chat/completions"]);
+  const customPaths = new Set(["", "/api", "/api/chat"]);
+
+  if (kind === "custom" && !customPaths.has(path)) {
+    throw new Error(
+      `ollama-native refuses custom baseUrl path "${path || "/"}"; use a native root, /api, or /api/chat`,
+    );
+  }
+  if (kind !== "custom" && !canonicalPaths.has(path)) {
+    throw new Error(
+      `ollama-native refuses Ollama baseUrl path "${path || "/"}"; use root, /v1, /api, or /api/chat`,
+    );
+  }
+
+  if (kind === "cloud") url.hostname = normalizedHostname(url);
+  url.pathname = "/api/chat";
+  return url.toString();
+}