@bitkyc08/opencodex 2.39.0 → 2.40.0

package/src/server/management-auth.ts

@@ -1,4 +1,4 @@
-import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import {
   chmodSync,
   closeSync,
@@ -39,35 +39,41 @@ import {
   parseExpectedLocalProviderReloadPid,
   verifyLocalProviderReloadCapability,
 } from "../lib/local-provider-reload-contract";
+import {
+  GUI_PAIR_BROWSER_ORIGIN_HEADER,
+  GUI_PAIR_CAPABILITY_HEADER,
+  GUI_PAIR_EXPECTED_PID_HEADER,
+  GUI_PAIR_EXPIRES_AT_HEADER,
+  GUI_PAIR_NONCE_HEADER,
+  GUI_PAIR_PATH,
+  parseExpectedGuiPairPid,
+  verifyGuiPairCapability,
+} from "../lib/gui-pair-capability";
 import { forgetEphemeralSecretPath, forgetHardenedSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
 import type { OcxConfig } from "../types";
 import {
-  isAllowedManagementOrigin,
-  isApiAuthRequired,
   isDataPlaneAdmissionSecret,
-  isLoopbackHostname,
-  managementRequestOrigin,
-  parseHttpHost,
 } from "./auth-cors";
+import {
+  authorizeGuiSessionRequest,
+  issueGuiSession as issueGuiSessionFromState,
+  type GuiPairingGrantRecord,
+  type GuiSessionBootstrap,
+  type GuiSessionRecord,
+  type GuiSessionRequestContext,
+} from "./gui-session";
+export type { GuiSessionBootstrap, GuiSessionRequestContext } from "./gui-session";
 
-const GUI_SESSION_TTL_MS = 5 * 60_000;
-const GUI_SESSION_LIMIT = 128;
 const LOCAL_READ_REPLAY_LIMIT = 256;
 const consumedLocalReadCapabilities = new Map<string, number>();
 const admittedLocalReadRequests = new WeakSet<Request>();
 const LOCAL_PROVIDER_RELOAD_REPLAY_LIMIT = 256;
 const consumedLocalProviderReloadCapabilities = new Map<string, number>();
 const admittedLocalProviderReloadRequests = new WeakSet<Request>();
-
-interface GuiSessionRecord {
-  csrfToken: string;
-  origin: string;
-  expiresAt: number;
-}
-
-export interface GuiSessionBootstrap extends GuiSessionRecord {
-  token: string;
-}
+const GUI_PAIR_REPLAY_LIMIT = 256;
+const consumedGuiPairCapabilities = new Map<string, number>();
+const admittedGuiPairRequests = new WeakSet<Request>();
+const admittedManagementRequests = new WeakMap<Request, ManagementPrincipal>();
 
 export type ManagementAuthState =
   | {
@@ -75,6 +81,7 @@ export type ManagementAuthState =
     token: string;
     source: "environment" | "file";
     sessions: Map<string, GuiSessionRecord>;
+    pairingGrants: Map<string, GuiPairingGrantRecord>;
   }
   | { available: false; reason: string };
 
@@ -201,7 +208,7 @@ function ready(token: string, source: "environment" | "file", config: OcxConfig)
   if (isDataPlaneAdmissionSecret(token, config)) {
     return fail("management credential conflicts with a data-plane credential");
   }
-  return { available: true, token, source, sessions: new Map() };
+  return { available: true, token, source, sessions: new Map(), pairingGrants: new Map() };
 }
 
 export function initializeManagementAuthState(config: OcxConfig): ManagementAuthState {
@@ -232,41 +239,32 @@ function equalSecret(actual: string, expected: string): boolean {
   return left.length === right.length && timingSafeEqual(left, right);
 }
 
-function removeExpiredSessions(state: Extract<ManagementAuthState, { available: true }>, now = Date.now()): void {
-  for (const [token, session] of state.sessions) {
-    if (session.expiresAt <= now) state.sessions.delete(token);
-  }
-}
-
-function randomSessionSecret(prefix: "ocx_session_"): string {
-  return `${prefix}${randomBytes(32).toString("base64url")}`;
-}
-
 export function issueGuiSession(
   req: Request,
   config: OcxConfig,
   state: ManagementAuthState,
+  context?: GuiSessionRequestContext,
 ): GuiSessionBootstrap | null {
-  if (isApiAuthRequired(config) || !state.available || req.method !== "GET" || !isAllowedManagementOrigin(req, config)) return null;
-  const host = parseHttpHost(req.headers.get("Host"));
-  if (!host || !isLoopbackHostname(host.hostname)) return null;
-  const origin = managementRequestOrigin(req, config);
-  if (!origin) return null;
-  const now = Date.now();
-  removeExpiredSessions(state, now);
-  while (state.sessions.size >= GUI_SESSION_LIMIT) {
-    const oldest = state.sessions.keys().next().value as string | undefined;
-    if (!oldest) break;
-    state.sessions.delete(oldest);
-  }
-  const token = randomSessionSecret("ocx_session_");
-  const session: GuiSessionRecord = {
-    csrfToken: randomBytes(32).toString("base64url"),
-    origin,
-    expiresAt: now + GUI_SESSION_TTL_MS,
+  if (!state.available) return null;
+  return issueGuiSessionFromState(req, config, state, context);
+}
+
+export interface ManagementSessionControl {
+  revokeCurrent(req: Request): boolean;
+}
+
+export function createManagementSessionControl(state: ManagementAuthState): ManagementSessionControl {
+  return {
+    revokeCurrent(req: Request): boolean {
+      if (!state.available) return false;
+      const credential = requestManagementCredential(req);
+      if (!credential) return false;
+      for (const token of state.sessions.keys()) {
+        if (equalSecret(credential, token)) return state.sessions.delete(token);
+      }
+      return false;
+    },
   };
-  state.sessions.set(token, session);
-  return { token, ...session };
 }
 
 /**
@@ -284,6 +282,7 @@ export function issueGuiSession(
 export type ManagementPrincipal =
   | "admin-token"
   | "gui-session"
+  | "gui-pair-capability"
   | "local-read-capability"
   | "local-provider-reload-capability"
   | "system-restart-capability";
@@ -416,6 +415,81 @@ function hasLocalProviderReloadCapability(
   return true;
 }
 
+function hasGuiPairCapability(
+  req: Request,
+  local: LocalManagementAuthContext | undefined,
+): boolean {
+  if (admittedGuiPairRequests.has(req)) return true;
+  if (!local || req.method !== "POST") return false;
+  let url: URL;
+  try {
+    url = new URL(req.url);
+  } catch {
+    return false;
+  }
+  if (url.pathname !== GUI_PAIR_PATH || url.search !== "") return false;
+  const contentLength = req.headers.get("content-length");
+  if (contentLength !== "0" || req.headers.has("transfer-encoding")) return false;
+  const expectedPid = parseExpectedGuiPairPid(req.headers.get(GUI_PAIR_EXPECTED_PID_HEADER));
+  if (expectedPid.kind !== "present" || expectedPid.pid !== local.pid) return false;
+  const expiresAtRaw = req.headers.get(GUI_PAIR_EXPIRES_AT_HEADER);
+  if (!expiresAtRaw || !/^[1-9]\d*$/.test(expiresAtRaw)) return false;
+  const expiresAt = Number(expiresAtRaw);
+  if (!Number.isSafeInteger(expiresAt)) return false;
+  const capability = req.headers.get(GUI_PAIR_CAPABILITY_HEADER);
+  const now = Date.now();
+  if (!verifyGuiPairCapability(
+    local.attestationSecret,
+    req.headers.get(GUI_PAIR_NONCE_HEADER),
+    req.method,
+    url.pathname,
+    req.headers.get(GUI_PAIR_BROWSER_ORIGIN_HEADER),
+    local.pid,
+    local.port,
+    expiresAt,
+    capability,
+    now,
+  )) return false;
+  for (const [consumed, retainedUntil] of consumedGuiPairCapabilities) {
+    if (retainedUntil <= now) consumedGuiPairCapabilities.delete(consumed);
+  }
+  if (!capability) return false;
+  const capabilityDigest = createHash("sha256").update(capability).digest("base64url");
+  if (consumedGuiPairCapabilities.has(capabilityDigest)) return false;
+  if (consumedGuiPairCapabilities.size >= GUI_PAIR_REPLAY_LIMIT) return false;
+  consumedGuiPairCapabilities.set(capabilityDigest, expiresAt);
+  admittedGuiPairRequests.add(req);
+  return true;
+}
+
+function requestManagementCredential(req: Request): string | null {
+  return req.headers.get("x-opencodex-api-key")?.trim()
+    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
+    || null;
+}
+
+function resolveManagementAdmission(
+  req: Request,
+  state: ManagementAuthState,
+  config?: OcxConfig,
+  local?: LocalManagementAuthContext,
+): ManagementPrincipal | null {
+  const cached = admittedManagementRequests.get(req);
+  if (cached) return cached;
+  let principal: ManagementPrincipal | null = null;
+  if (hasSystemRestartCapability(req, local)) principal = "system-restart-capability";
+  else if (hasLocalProviderReloadCapability(req, local)) principal = "local-provider-reload-capability";
+  else if (hasLocalReadCapability(req, local)) principal = "local-read-capability";
+  else if (hasGuiPairCapability(req, local)) principal = "gui-pair-capability";
+  else if (state.available) {
+    const actual = requestManagementCredential(req);
+    if (actual && equalSecret(actual, state.token)) principal = "admin-token";
+    else if (config && authorizeGuiSessionRequest(req, config, state).ok) principal = "gui-session";
+  }
+  if (principal) admittedManagementRequests.set(req, principal);
+  return principal;
+}
+
 /**
  * The principal for a request that already passed `requireManagementAuth`. Kept as a
  * separate resolution (rather than a changed return type) so every existing caller
@@ -429,17 +503,7 @@ export function managementPrincipal(
   config?: OcxConfig,
   local?: LocalManagementAuthContext,
 ): ManagementPrincipal | null {
-  if (hasSystemRestartCapability(req, local)) return "system-restart-capability";
-  if (hasLocalProviderReloadCapability(req, local)) return "local-provider-reload-capability";
-  if (hasLocalReadCapability(req, local)) return "local-read-capability";
-  if (!state.available) return null;
-  const actual = req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
-  if (!actual) return null;
-  if (equalSecret(actual, state.token)) return "admin-token";
-  if (!config) return null;
-  removeExpiredSessions(state);
-  return state.sessions.has(actual) ? "gui-session" : null;
+  return resolveManagementAdmission(req, state, config, local);
 }
 
 export function requireManagementAuth(
@@ -448,9 +512,7 @@ export function requireManagementAuth(
   config?: OcxConfig,
   local?: LocalManagementAuthContext,
 ): Response | null {
-  if (hasSystemRestartCapability(req, local)) return null;
-  if (hasLocalProviderReloadCapability(req, local)) return null;
-  if (hasLocalReadCapability(req, local)) return null;
+  if (resolveManagementAdmission(req, state, config, local)) return null;
   if (!state.available) {
     return Response.json({
       error: "management API unavailable",
@@ -458,25 +520,5 @@ export function requireManagementAuth(
       hint: "Set OPENCODEX_ADMIN_AUTH_TOKEN to bypass file-backed admin token ACL hardening",
     }, { status: 503 });
   }
-  const actual = req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
-  if (actual && equalSecret(actual, state.token)) return null;
-  if (actual && config) {
-    removeExpiredSessions(state);
-    const session = state.sessions.get(actual);
-    if (session) {
-      const requestOrigin = managementRequestOrigin(req, config);
-      const claimedOrigin = req.headers.get("x-opencodex-gui-origin");
-      const browserOrigin = req.headers.get("Origin");
-      const sameOrigin = requestOrigin === session.origin
-        && claimedOrigin === session.origin
-        && (!browserOrigin || browserOrigin === session.origin);
-      const safeMethod = req.method === "GET" || req.method === "HEAD";
-      const csrf = req.headers.get("x-opencodex-csrf-token")?.trim();
-      if (sameOrigin && (safeMethod || (browserOrigin === session.origin && !!csrf && equalSecret(csrf, session.csrfToken)))) {
-        return null;
-      }
-    }
-  }
   return Response.json({ error: "opencodex admin token required" }, { status: 401 });
 }

package/src/server/models-capabilities.ts

@@ -0,0 +1,124 @@
+/**
+ * Extended capability advertisement for the OpenAI-shape `GET /v1/models` list.
+ *
+ * Cursor's local-agent runtime (the "Private Inference" build, `localMode=true`) enables its
+ * reasoning-effort control only when at least one row in `data[]` carries `api_types` naming an
+ * API family it can speak, optionally with a `capabilities` object. Plain OpenAI clients, Grok
+ * Build, and the Codex catalog branch ignore both keys. Every OpenCodex route serves Chat
+ * Completions, Responses and Anthropic Messages, streams, and accepts tool calls, so those are
+ * constants; context length and vision come from catalog data when known and are omitted
+ * otherwise, matching Cursor's optional-field schema.
+ */
+
+/**
+ * Membership is load-bearing for Cursor: its wire selector picks the Anthropic Messages path only
+ * when NO OpenAI-family type (`chat_completions`/`responses`/`openai_chat`/`openai_responses`)
+ * is present. Keep at least one OpenAI-family entry; a unit test guards this.
+ */
+export const OPENCODEX_MODEL_API_TYPES: readonly string[] = Object.freeze(["chat_completions", "responses", "anthropic_messages"]);
+
+export const OPENAI_FAMILY_API_TYPES: ReadonlySet<string> = new Set(["chat_completions", "responses", "openai_chat", "openai_responses"]);
+
+/**
+ * The reasoning-effort ladder Cursor's local-agent runtime attaches to a model, keyed by the
+ * model id after its last `/`. Cursor decides this from its own table rather than from the
+ * gateway's `reasoning_effort` list, so the dashboard can only PREDICT it; the values here
+ * mirror that table (read from the 3.18.25 bundle) and carry no Cursor behavior of their own.
+ * Null means Cursor shows no Reasoning control for the id. Distinct from
+ * `src/adapters/cursor/effort-map.ts`, which maps opencodex efforts onto Cursor's *backend*
+ * tiers for the outbound provider; this is what Cursor's *local* picker renders.
+ */
+const CURSOR_EFFORT_FAMILIES: ReadonlyArray<{ test: RegExp; ladder: readonly string[] }> = [
+  { test: /^gpt-5[.-]6-(?:luna|sol|terra)$/u, ladder: ["low", "medium", "high", "xhigh"] },
+  { test: /^gpt-5(?:\.\d+)?$/u, ladder: ["low", "medium", "high", "xhigh"] },
+  { test: /^claude-opus-5$/u, ladder: ["low", "medium", "high", "xhigh", "max"] },
+  { test: /^claude-opus-4[-.](?:7|8)$/u, ladder: ["low", "medium", "high", "xhigh", "max"] },
+  { test: /^claude-sonnet-5$/u, ladder: ["low", "medium", "high", "xhigh", "max"] },
+  { test: /^claude-opus-4[-.](?:5|6)$/u, ladder: ["low", "medium", "high", "max"] },
+  { test: /^claude-sonnet-4[-.]6$/u, ladder: ["low", "medium", "high", "max"] },
+  { test: /^grok-4[.-](?:3|5|6)(?:-(?:batch|build|nocomp))?$/u, ladder: ["minimal", "low", "medium", "high", "xhigh"] },
+  { test: /^grok-build-latest$/u, ladder: ["minimal", "low", "medium", "high", "xhigh"] },
+  { test: /^gemini-3\.[1-9].*flash-lite/u, ladder: [] },
+  { test: /^gemini-/u, ladder: ["minimal", "low", "medium", "high"] },
+];
+
+export function cursorEffortFamily(modelId: string): string[] | null {
+  let id = modelId.trim().toLowerCase();
+  const slash = id.lastIndexOf("/");
+  if (slash !== -1) id = id.slice(slash + 1);
+  const at = id.indexOf("@");
+  if (at !== -1) id = id.slice(0, at);
+  for (const family of CURSOR_EFFORT_FAMILIES) {
+    if (family.test.test(id)) return family.ladder.length > 0 ? [...family.ladder] : null;
+  }
+  return null;
+}
+
+export interface ModelCapabilityInput {
+  reasoningEfforts?: readonly string[];
+  contextWindow?: number;
+  /**
+   * Larger opt-in window (Cursor "Max Mode"). When it exceeds contextWindow, the row advertises
+   * the long window as context_length and the default window as the long-context threshold,
+   * which makes Cursor's local runtime show a Context selector (default vs long, long marked
+   * as costing more).
+   */
+  longContextWindow?: number;
+  inputModalities?: readonly string[];
+}
+
+export interface ModelCapabilityFields {
+  api_types: readonly string[];
+  capabilities: {
+    context_length?: number;
+    /** Cursor's extended-row filter REQUIRES this to contain "text"; every route emits text. */
+    output_modalities: string[];
+    input_modalities?: string[];
+    supports_tool_use: true;
+    supports_streaming: true;
+    supports_reasoning: boolean;
+    supports_vision?: boolean;
+    reasoning_effort?: string[];
+  };
+  /**
+   * Cursor reads the long-context threshold from `pricing.overrides[].min_prompt_tokens`. That
+   * key sits outside its validated capability schema, so it is the one place a threshold can
+   * be carried without failing row validation (`cost.long_context` is rejected by that schema).
+   */
+  pricing?: { overrides: Array<{ min_prompt_tokens: number }> };
+}
+
+function positiveInt(value: unknown): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
+  const floored = Math.floor(value);
+  return floored > 0 ? floored : undefined;
+}
+
+export function modelCapabilityFields(input: ModelCapabilityInput): ModelCapabilityFields {
+  const efforts = (input.reasoningEfforts ?? []).filter(effort => typeof effort === "string" && effort.length > 0);
+  const contextLength = positiveInt(input.contextWindow);
+  const longContextLength = positiveInt(input.longContextWindow);
+  const hasLongTier = contextLength !== undefined && longContextLength !== undefined && longContextLength > contextLength;
+  const modalities = Array.isArray(input.inputModalities)
+    ? input.inputModalities.filter(modality => typeof modality === "string" && modality.length > 0)
+    : undefined;
+  const supportsVision = modalities !== undefined ? modalities.includes("image") : undefined;
+  return {
+    api_types: [...OPENCODEX_MODEL_API_TYPES],
+    capabilities: {
+      ...(hasLongTier
+        ? { context_length: longContextLength }
+        : contextLength !== undefined ? { context_length: contextLength } : {}),
+      // Once a gateway advertises api_types, Cursor keeps only rows whose output_modalities
+      // include "text"; omitting the key drops the row from the extended catalog.
+      output_modalities: ["text"],
+      ...(modalities !== undefined && modalities.length > 0 ? { input_modalities: [...modalities] } : {}),
+      supports_tool_use: true,
+      supports_streaming: true,
+      supports_reasoning: efforts.length > 0,
+      ...(supportsVision !== undefined ? { supports_vision: supportsVision } : {}),
+      ...(efforts.length > 0 ? { reasoning_effort: [...efforts] } : {}),
+    },
+    ...(hasLongTier ? { pricing: { overrides: [{ min_prompt_tokens: contextLength }] } } : {}),
+  };
+}

package/src/server/ports.ts

@@ -151,6 +151,13 @@ export function shouldPersistSelectedPort(
   configPort: number | undefined,
   selectedPort: number,
   preferredPort: number,
+  options: { sibling?: boolean } = {},
 ): boolean {
+  // A sibling start (`--port X` beside a live proxy on the configured port) is a
+  // second instance, not a new home for this config. Persisting its port rewrote
+  // config.port under the still-running configured-port proxy, and the next
+  // `ocx service` install then baked the sibling's port into the service and
+  // re-pointed every client at a listener that no longer existed.
+  if (options.sibling) return false;
   return selectedPort === preferredPort && configPort !== selectedPort;
 }

package/src/server/proxy-liveness.ts

@@ -22,6 +22,7 @@ export interface HealthzIdentity {
   port?: unknown;
   restartCapability?: unknown;
   providerReloadCapability?: unknown;
+  guiPairCapability?: unknown;
 }
 
 export interface LivenessIo {
@@ -269,6 +270,12 @@ interface ReadyzBody {
   pid?: unknown;
   port?: unknown;
   status?: unknown;
+  // Remote protocol metadata is intentionally additive here. Ordinary
+  // readiness remains compatible with legacy standalone servers; `ocx connect`
+  // validates these fields separately in src/remote/protocol.ts.
+  protocol?: unknown;
+  minimumClientProtocol?: unknown;
+  managementUrl?: unknown;
 }
 
 export interface ReadinessProbeResult {

package/src/server/request-log.ts

@@ -8,6 +8,7 @@ import {
   isClientClosedMessage,
   isCyberPolicyCode,
   isCyberPolicyMessage,
+  upstreamErrorMessageFromPayload,
 } from "../lib/errors";
 import { CODEX_CONFIG_PATH, readRootTomlString } from "../codex/paths";
 import { readCodexCatalogPath } from "../codex/catalog";
@@ -124,6 +125,12 @@ export interface RequestLogContext {
   terminalHttpStatus?: number;
   /** Recognized structured terminal code whose exact identity must survive status mapping. */
   terminalErrorCode?: typeof CYBER_POLICY_ERROR_CODE;
+  /**
+   * Proxy-owned error code for a request OpenCodex terminated locally, before or instead of an
+   * upstream send. Status-derived classification cannot name these: there is no upstream
+   * message to classify, and the status alone would read as a provider failure.
+   */
+  errorCode?: string;
   /** Structured reason from `response.incomplete`; internal-only input to log classification. */
   terminalIncompleteReason?: string;
   affinity?: "reused" | "new_bind" | "rebound" | "cleared";
@@ -794,10 +801,7 @@ function captureUpstreamErrorParsed(
       logCtx.terminalIncompleteReason = reason.trim();
     }
     if (logCtx.upstreamError) return;
-    const message = json?.error?.message
-      ?? json?.last_error?.message
-      ?? json?.response?.error?.message
-      ?? json?.response?.incomplete_details?.message;
+    const message = upstreamErrorMessageFromPayload(parsed);
     if (typeof message === "string" && message.trim()) {
       logCtx.upstreamError = redactSecretString(message).slice(0, 500);
       return;
@@ -927,7 +931,9 @@ export function addFinalRequestLog(
   const effectiveStatus = status >= 500 && logCtx.upstreamError && isClientClosedMessage(logCtx.upstreamError)
     ? 499
     : status;
-  const errorCode = requestLogErrorCode(
+  // A locally assigned code wins: it names a refusal this proxy made itself, which no
+  // status-plus-upstream-message classification can reconstruct.
+  const errorCode = logCtx.errorCode ?? requestLogErrorCode(
     effectiveStatus,
     logCtx.upstreamError,
     logCtx.terminalErrorCode,

package/src/server/responses/agent-task-recovery.ts

@@ -23,6 +23,7 @@ const CODEX_ORIGINATORS = new Set([
   "Codex Desktop",
   "codex_app",
   "codex_work_desktop",
+  "codexless_agent",
 ]);
 const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const OPENAI_TOKEN_ISSUERS = new Set(["https://auth.openai.com", "https://auth.openai.com/"]);

package/src/server/responses/codex-auth-error.ts

@@ -15,6 +15,7 @@ import {
   MainAccountTokenRefreshError,
   MainAuthJsonChangedDuringRefreshError,
 } from "../../codex/main-account";
+import { NativeProfileError } from "../../codex/native-profile-types";
 
 export interface CodexAuthContextErrorResponseOptions {
   accountSelector?: string;
@@ -26,7 +27,8 @@ export function nativeMainRefreshFailureResponse(error: unknown): Response {
     return formatErrorResponse(401, "authentication_error", "Codex main account needs reauthentication");
   }
   if (error instanceof MainAccountTokenRefreshError
-    || error instanceof MainAuthJsonChangedDuringRefreshError) {
+    || error instanceof MainAuthJsonChangedDuringRefreshError
+    || (error instanceof NativeProfileError && error.retryable)) {
     const response = formatErrorResponse(
       503,
       "server_busy",

package/src/server/responses/collaboration.ts

@@ -108,12 +108,16 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
   /** Declared parameter schema per request-visible tool name (#1611 integer repair). */
   toolParameterSchemas: Map<string, Record<string, unknown>>;
   freeformToolNames: Set<string>;
+  bareCustomToolNames: Set<string>;
+  bareFunctionToolNames: Set<string>;
   toolSearchToolNames: Set<string>;
 } {
   const toolNsMap = new Map<string, { namespace: string; name: string; freeform?: true }>();
   const declaredToolNames = new Set<string>();
   const toolParameterSchemas = new Map<string, Record<string, unknown>>();
   const freeformToolNames = new Set<string>();
+  const bareCustomToolNames = new Set<string>();
+  const bareFunctionToolNames = new Set<string>();
   const toolSearchToolNames = new Set<string>();
   const requestedTools = parsed.context.tools ?? [];
   const toolAllowed = toolChoiceToolPredicate(parsed.options.toolChoice, requestedTools);
@@ -133,6 +137,19 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
     if (t.freeform) {
       budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
       freeformToolNames.add(t.name);
+      if (!t.namespace || t.namespace === "functions") {
+        budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
+        bareCustomToolNames.add(t.name);
+      }
+    } else if (
+      !t.toolSearch
+      && !t.webSearch
+      && !t.imageGeneration
+      && !t.videoGeneration
+      && (!t.namespace || t.namespace === "functions")
+    ) {
+      budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
+      bareFunctionToolNames.add(t.name);
     }
     if (t.toolSearch) {
       budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
@@ -162,7 +179,15 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
       toolParameterSchemas.set(t.name, t.parameters);
     }
   }
-  return { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, toolSearchToolNames };
+  return {
+    toolNsMap,
+    declaredToolNames,
+    toolParameterSchemas,
+    freeformToolNames,
+    bareCustomToolNames,
+    bareFunctionToolNames,
+    toolSearchToolNames,
+  };
 }
 
 

package/src/server/responses/combo-stream-preflight.ts

@@ -24,6 +24,24 @@ const TERMINAL_EVENTS = new Set([
   "response.incomplete",
 ]);
 
+const RETRYABLE_ZERO_OUTPUT_INCOMPLETE_REASONS = new Set([
+  "adapter_eof",
+  "missing_terminal_event",
+  "upstream_stall_timeout",
+]);
+
+function retryableZeroOutputTerminal(payload: unknown): boolean {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const event = payload as {
+    type?: unknown;
+    response?: { incomplete_details?: { reason?: unknown } };
+  };
+  if (event.type === "response.failed") return true;
+  if (event.type !== "response.incomplete") return false;
+  const reason = event.response?.incomplete_details?.reason;
+  return typeof reason === "string" && RETRYABLE_ZERO_OUTPUT_INCOMPLETE_REASONS.has(reason);
+}
+
 /**
  * Decide when replaying the request on another combo target would risk duplicating
  * client-visible output or a tool-side effect. Unknown event types commit the child
@@ -128,14 +146,14 @@ export async function preflightComboStreamResponse(
   let bufferedBytes = 0;
   let outputCommitted = false;
   let terminalStatus: ResponsesTerminalStatus | undefined;
-  let failedPayload: Record<string, unknown> | undefined;
+  let retryableTerminalPayload: Record<string, unknown> | undefined;
   const inspector = createSseInspector({
     logCtx,
     onParsedPayload: payload => {
       if (comboStreamPayloadCommitsOutput(payload)) outputCommitted = true;
       if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;
-      if ((payload as { type?: unknown }).type === "response.failed") {
-        failedPayload = payload as Record<string, unknown>;
+      if (retryableZeroOutputTerminal(payload)) {
+        retryableTerminalPayload = payload as Record<string, unknown>;
       }
     },
     onTerminal: status => { terminalStatus = status; },
@@ -162,9 +180,10 @@ export async function preflightComboStreamResponse(
         inspector.feed(retained);
       }
 
-      if (terminalStatus === "failed" && !outputCommitted && failedPayload) {
-        await reader.cancel("retrying zero-output combo stream failure").catch(() => undefined);
-        return { kind: "failed", response: failedTerminalResponse(response, failedPayload, logCtx) };
+      if ((terminalStatus === "failed" || terminalStatus === "incomplete")
+        && !outputCommitted && retryableTerminalPayload) {
+        await reader.cancel("retrying zero-output combo stream terminal").catch(() => undefined);
+        return { kind: "failed", response: failedTerminalResponse(response, retryableTerminalPayload, logCtx) };
       }
       if (next.done || terminalStatus !== undefined || outputCommitted
         || bufferedBytes >= COMBO_STREAM_PREFLIGHT_MAX_BYTES