@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/server/responses/fetch-helpers.ts

@@ -9,6 +9,7 @@ import type { OcxProviderConfig } from "../../types";
 import type { WsData } from "../ws-bridge";
 import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 import { withUpstreamHttpVersion } from "../../lib/upstream-http-version";
+import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 
 export { withUpstreamHttpVersion };
 
@@ -56,6 +57,10 @@ export interface ProviderFetchOptions {
   modelId?: string;
   /** One pacing slot was acquired immediately before this fetch wrapper was created. */
   pacingSlotAcquired?: boolean;
+  /** Captured selected-account observer, attached before the native WS send. */
+  onCodexWsQuota?: CodexWsQuotaObserver;
+  /** Synchronous admission at actual credential dispatch, after pacing/backoff. */
+  beforeDispatch?: (headers: Headers) => void;
 }
 
 export function providerFetch(
@@ -68,8 +73,10 @@ export function providerFetch(
     base.preconnect?.(...args);
   };
   const httpFetch = Object.assign(
-    (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) =>
-      base(input, { ...withUpstreamHttpVersion(input, init, provider), timeout: 0 }),
+    async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+      options.beforeDispatch?.(new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+      return base(input, { ...withUpstreamHttpVersion(input, init, provider), timeout: 0 });
+    },
     { preconnect },
   ) as typeof globalThis.fetch;
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
@@ -82,7 +89,7 @@ export function providerFetch(
       // used, protocol pin included: a WS turn that falls back is serving the
       // request over HTTP, and dropping the provider's `upstreamHttpVersion`
       // there would silently negotiate a transport the operator ruled out.
-      return codexWsUpstreamFetch(input, init, httpFetch, runtime);
+      return codexWsUpstreamFetch(input, init, httpFetch, runtime, options.onCodexWsQuota, options.beforeDispatch);
     }
     return httpFetch(input, init);
   };

package/src/server/responses/input-admission.ts

@@ -19,16 +19,23 @@ import type { OcxContentPart, OcxParsedRequest, OcxProviderConfig } from "../../
 /**
  * Multiplier applied to the ceiling before refusing.
  *
- * 2.5, not something tighter, because `estimateTokens` can overshoot by 1.6x on its own.
- * `cjkRatio` samples every `stride`-th character, so a payload of fixed-width records whose
- * length aligns with the stride samples as 100% CJK while being ~1.6% CJK, firing the
- * 2.5-chars/token clamp instead of the 4.0 default. Measured on Bun 1.3.14: 126,046 chars,
- * true CJK ratio 0.0161, sampled ratio 1.0, estimate inflated 1.6x. Since 4.0 / 2.5 = 1.6
- * is that branch maximum divergence, a threshold at or under 1.6 would convert the
- * estimator error bar into false 413s.
+ * 2.5, not something tighter, because the estimate is a heuristic and the cost of being wrong
+ * is asymmetric: a false refusal fails a turn the provider would have answered, while an
+ * over-admission merely pays for one round trip the provider then rejects itself.
  *
- * 2.5 sits above it with room for the ~10% model-family ratio spread, and still refuses the
- * #1412 shape (10x) four times over.
+ * The original margin was sized against a sampling artifact — `cjkRatio` read every stride-th
+ * character, so a payload of fixed-width records could sample as 100% CJK while being 1.6% CJK
+ * and inflate the estimate by 4.0/2.5 = 1.6x. That sampler is gone: CJK characters are now
+ * counted exactly, so that particular 1.6x divergence cannot occur and the headroom it bought is
+ * no longer spent on it.
+ *
+ * The margin is still 2.5 because the estimator it guards got LARGER, not smaller. Counting the
+ * two scripts separately raises a pure-Latin estimate by 1.25x and a Korean one by up to 1.67x
+ * against the previous model, which consumes real headroom: measured against the old estimator's
+ * scale, 2.5 now behaves like roughly 2.0x for Latin and 1.5x for Korean-dominant input. That is
+ * the intended direction — the estimates are closer to what providers actually charge, so the
+ * same multiplier is a tighter and more honest bound — and it still refuses the #1412 shape
+ * (10x compounding) several times over.
  */
 export const ADMISSION_TOLERANCE = 2.5;
 

package/src/server/responses/responses-field-backfill.ts

@@ -174,7 +174,7 @@ function backfillOutputItem(item: unknown, slot: ItemIdSlot, inferredStatus: str
  *
  * Deliberately does NOT backfill `created_at`. #2639 proposed it for the same
  * strict-decoder reason as `status`, but the proxy also relays some upstream
- * responses verbatim, and `tests/server-combo-failover-e2e.test.ts` asserts a
+ * responses verbatim, and `tests/server/server-combo-failover-e2e.test.ts` asserts a
  * combo backup response is returned byte-exact. Injecting a field the upstream
  * never sent breaks that contract. Both cannot hold for the same body, so the
  * `created_at` half needs its own decision about which contract yields; it is

package/src/server/responses/ws-upstream.ts

@@ -12,12 +12,17 @@
 // returned event frames as an SSE byte stream, so every downstream consumer
 // (passthrough relay, adapter parsers, usage sniffing) is unchanged.
 
-import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 import { compareBunVersions } from "../../lib/bun-stream-caps";
-
-const CODEX_RESPONSES_HTTP_URL = "https://chatgpt.com/backend-api/codex/responses";
-const CODEX_RESPONSES_WS_URL = "wss://chatgpt.com/backend-api/codex/responses";
-const WS_BETA = "responses_websockets=2026-02-06";
+import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
+import { CODEX_RESPONSES_HTTP_URL, CODEX_RESPONSES_WS_URL, prepareCodexHttpInit, prepareCodexWsRequest } from "./codex-ws-request";
+import { codexWsExchange } from "./codex-ws-exchange";
+import { CodexWsSession } from "./codex-ws-session";
+import { codexWsPool, codexWsReuseIdentity } from "./codex-ws-pool";
+import { codexWsCreateFrameExceedsLimit } from "./codex-ws-wire";
+export { CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES, MAX_CODEX_WS_QUEUE_BYTES,
+  MAX_CODEX_WS_CREATE_FRAME_BYTES, CODEX_WS_CREATE_FRAME_LIMIT_BYTES, codexWsCreateFrameExceedsLimit,
+  isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse } from "./codex-ws-wire";
+export const MIN_BOUNDED_CODEX_WS_BUN_VERSION = "1.4.0";
 
 /**
  * Dial URL for a request URL. The canonical ChatGPT backend keeps its constant;
@@ -48,36 +53,6 @@ function isResponsesWebsocketEligibleUrl(url: string): boolean {
   return parsed.protocol === "https:"
     && parsed.pathname.endsWith("/responses");
 }
-// If the 101 never arrives (network black hole), give SSE a chance well before
-// the caller's connect timeout (default 200s) would fire.
-const UPGRADE_DEADLINE_MS = 10_000;
-// Keep the push-based WS transport inside the same memory envelope as the
-// bounded SSE relays that consume this response. Unlike fetch response bodies,
-// a WebSocket cannot be paused when a ReadableStream applies backpressure, so
-// an upstream that outruns the consumer must be disconnected.
-export const MAX_CODEX_WS_FRAME_BYTES = MAX_CLIENT_SSE_FRAME_BYTES;
-export const MAX_CODEX_WS_QUEUE_BYTES = 8 * 1024 * 1024;
-export const MIN_BOUNDED_CODEX_WS_BUN_VERSION = "1.4.0";
-// The backend drops any inbound message of 16 MiB or more: it closes the socket
-// (1009) without a Responses terminal event, which reaches clients as a bare
-// 502 upstream_server_error. Measured against the live endpoint 2026-08-23:
-// 16,777,000 B completed, 16,777,300 B closed in ~1s, every time. The same
-// request body succeeds over HTTP SSE, so the ceiling belongs to this transport
-// alone (see #2426). A full-replay thread reaches it with ~11 pasted
-// screenshots, and then never recovers, because each retry resends the frame.
-export const MAX_CODEX_WS_CREATE_FRAME_BYTES = 16 * 1024 * 1024;
-// Bun frames the payload it is handed, so the send-side budget is the JSON text
-// itself, and nothing is appended between the check and the send. The margin is
-// a conservative cushion, not a computed requirement: it covers RFC 6455 frame
-// overhead in case the backend counts it (14 bytes at this payload size — an
-// 8-byte extended length plus a 4-byte client mask, leaving ~65.5 KiB spare),
-// and it leaves room for a future caller that appends to the frame.
-const CODEX_WS_CREATE_FRAME_MARGIN_BYTES = 64 * 1024;
-export const CODEX_WS_CREATE_FRAME_LIMIT_BYTES =
-  MAX_CODEX_WS_CREATE_FRAME_BYTES - CODEX_WS_CREATE_FRAME_MARGIN_BYTES;
-/** Close code the backend uses for an oversized message (RFC 6455 "message too big"). */
-const WS_CLOSE_MESSAGE_TOO_BIG = 1009;
-
 export type BunRuntimeIdentity = {
   version: string;
   versionWithSha: string;
@@ -85,13 +60,6 @@ export type BunRuntimeIdentity = {
 
 export type BunRuntimeGateInput = string | BunRuntimeIdentity;
 
-const codexWsUpstreamResponses = new WeakSet<Response>();
-
-/** True only for a successful Codex WebSocket upgrade, never an HTTP fallback. */
-export function isCodexWsUpstreamResponse(response: Response): boolean {
-  return codexWsUpstreamResponses.has(response);
-}
-
 export function currentBunRuntimeIdentity(): BunRuntimeIdentity {
   return {
     version: Bun.version,
@@ -153,102 +121,17 @@ export function shouldUseCodexWsUpstream(
   }
 }
 
-const CLOSED_BEFORE_TERMINAL = "codex websocket closed before a Responses terminal event";
-
-type ResponsesWsRelayEvent = {
-  type: string;
-  text: string;
-};
-
-/**
- * Responses WebSocket uses `response.done` as its terminal event, while the
- * SSE Responses surface uses status-specific terminal events. Normalize the
- * WS-only discriminator before relaying so the existing SSE consumers can
- * settle the turn and the socket close cannot be mistaken for a drop. Unknown
- * or missing status values fail closed instead of being reported as success.
- */
-function normalizeResponsesWsRelayEvent(text: string): ResponsesWsRelayEvent | null {
-  let payload: unknown;
-  try {
-    payload = JSON.parse(text);
-  } catch {
-    return null;
-  }
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
-  const record = payload as Record<string, unknown>;
-  if (typeof record.type !== "string") return null;
-  if (record.type !== "response.done") return { type: record.type, text };
-
-  const response = record.response;
-  const status = response && typeof response === "object" && !Array.isArray(response)
-    ? (response as Record<string, unknown>).status
-    : undefined;
-  const type = status === "completed"
-    ? "response.completed"
-    : status === "failed"
-      ? "response.failed"
-      : status === "incomplete" || status === "cancelled"
-        ? "response.incomplete"
-        : "response.failed";
-  const normalizedRecord: Record<string, unknown> = { ...record, type };
-  if (type === "response.failed" && status !== "failed") {
-    normalizedRecord.response = response && typeof response === "object" && !Array.isArray(response)
-      ? { ...(response as Record<string, unknown>), status: "failed" }
-      : { status: "failed" };
-  }
-  return { type, text: JSON.stringify(normalizedRecord) };
-}
-
-/**
- * The close code is the only thing that separates "the backend refused this
- * payload" from "the network dropped", and both used to reach the caller as the
- * same bare 502. Naming the oversized case here puts that distinction in the
- * message the client receives.
- *
- * It does NOT reach the request log as a typed code. The eager relay turns any
- * stream error into a generic `upstream_reset` synthetic terminal
- * (`relay.ts`, `relay-eager.ts`) without feeding that frame back through the
- * inspector, so `/api/logs` keeps neither this message nor a specific code —
- * only `streamAborted`. Machine-readable typing would mean changing the error
- * taxonomy, which is deliberately out of scope for this transport fix.
- */
-function closedBeforeTerminalMessage(event: unknown): string {
-  const detail = event as { code?: unknown; reason?: unknown } | null | undefined;
-  const code = typeof detail?.code === "number" ? detail.code : null;
-  const reason = typeof detail?.reason === "string" ? detail.reason.trim() : "";
-  if (code === null) return CLOSED_BEFORE_TERMINAL;
-  const suffix = reason ? ` ${code} ${reason}` : ` ${code}`;
-  if (code === WS_CLOSE_MESSAGE_TOO_BIG) {
-    return `codex websocket rejected the request frame as too large (close${suffix});`
-      + ` requests at or above ${MAX_CODEX_WS_CREATE_FRAME_BYTES} bytes must use the HTTP SSE transport`;
-  }
-  return `${CLOSED_BEFORE_TERMINAL} (close${suffix})`;
-}
-
-/**
- * True when the `response.create` frame is at or above the backend's inbound
- * message ceiling, so this turn must take the HTTP SSE path instead.
- *
- * Sizing a 16 MiB string should not cost a 16 MiB copy. UTF-8 never encodes
- * below one byte per UTF-16 code unit and never above three, so both tails are
- * settled from the string length alone; only the narrow band between them pays
- * for a real byte count, and `Buffer.byteLength` measures without allocating.
- */
-export function codexWsCreateFrameExceedsLimit(
-  frameText: string,
-  limitBytes: number = CODEX_WS_CREATE_FRAME_LIMIT_BYTES,
-): boolean {
-  if (frameText.length >= limitBytes) return true;
-  if (frameText.length * 3 < limitBytes) return false;
-  return Buffer.byteLength(frameText, "utf8") >= limitBytes;
-}
-
 export function codexWsUpstreamFetch(
   url: string,
   init: RequestInit,
   sseFallback: typeof globalThis.fetch,
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
+  onQuota?: CodexWsQuotaObserver,
+  beforeDispatch?: (headers: Headers) => void,
 ): Promise<Response> {
+  const prepared = prepareCodexWsRequest(url, init);
+  if (!prepared) return sseFallback(url, prepareCodexHttpInit(url, init));
+  init = prepared.httpInit;
   if (!bunSupportsBoundedCodexWsRelay(runtime)) {
     return sseFallback(url, init);
   }
@@ -257,16 +140,7 @@ export function codexWsUpstreamFetch(
     return Promise.reject(signal.reason ?? new DOMException("The operation was aborted.", "AbortError"));
   }
 
-  let frameText: string;
-  try {
-    const body = JSON.parse(init.body as string) as Record<string, unknown>;
-    // The WS create frame is implicitly streaming; the backend rejects the
-    // HTTP-only `stream` flag inside a frame.
-    delete body.stream;
-    frameText = JSON.stringify({ ...body, type: "response.create" });
-  } catch {
-    return sseFallback(url, init);
-  }
+  const { frameText, headers } = prepared;
 
   // Decide before dialing. Once the socket is open the caller already holds a
   // streaming Response, so the oversized close can only be surfaced as a stream
@@ -276,187 +150,29 @@ export function codexWsUpstreamFetch(
     return sseFallback(url, init);
   }
 
-  const headers: Record<string, string> = {};
-  new Headers(init.headers ?? {}).forEach((value, key) => {
-    // HTTP-body framing headers do not apply to a WS handshake.
-    if (key === "content-type" || key === "content-length" || key === "accept" || key === "accept-encoding") return;
-    headers[key] = value;
-  });
-  headers["openai-beta"] = headers["openai-beta"]
-    ? headers["openai-beta"].includes("responses_websockets")
-      ? headers["openai-beta"]
-      : `${headers["openai-beta"]}, ${WS_BETA}`
-    : WS_BETA;
   // A genuine caller `originator` is already in these headers via the forward
   // set. Never fabricate one here: pool/forward traffic must not impersonate
   // Codex CLI, per the metadata-integrity contract. (The backend's fast lane
   // keys on WS + originator, so callers without the tag simply keep their own
   // provenance and scheduling.)
 
-  return new Promise<Response>((resolve, reject) => {
-    let ws: WebSocket;
-    try {
-      // Bun accepts per-handshake headers; the DOM lib types only list protocol arrays.
-      ws = new WebSocket(wsUpstreamUrlFor(url), { headers } as unknown as string[]);
-    } catch {
-      resolve(sseFallback(url, init));
-      return;
+  // A local refusal is not a failed upgrade and must never enter the SSE fallback path.
+  try {
+    beforeDispatch?.(new Headers(headers));
+  } catch (error) {
+    return Promise.reject(error);
+  }
+  let session: CodexWsSession;
+  try {
+    const identity = codexWsReuseIdentity(url, headers, frameText);
+    session = (identity ? codexWsPool.acquire(identity, wsUpstreamUrlFor(url), headers) : null)
+      ?? new CodexWsSession(wsUpstreamUrlFor(url), headers);
+    if (!session.busy && !session.reserve()) {
+      session.dispose();
+      return sseFallback(url, init);
     }
-
-    let opened = false;
-    let settledPreOpen = false;
-    let terminal = false;
-    let controller: ReadableStreamDefaultController<Uint8Array> | null = null;
-    const encoder = new TextEncoder();
-
-    const failStream = (message: string) => {
-      if (terminal) return;
-      terminal = true;
-      try { controller?.error(new Error(message)); } catch { /* stream already done */ }
-      try { ws.close(); } catch { /* already closing */ }
-    };
-
-    const upgradeTimer = setTimeout(() => {
-      if (opened || settledPreOpen) return;
-      settledPreOpen = true;
-      try { ws.close(); } catch { /* already closing */ }
-      resolve(sseFallback(url, init));
-    }, UPGRADE_DEADLINE_MS);
-
-    const onAbort = () => {
-      if (!opened) {
-        if (settledPreOpen) return;
-        // Settle BEFORE close(): the close handler treats a pre-open close as
-        // an upgrade rejection and would dial the SSE fallback for a request
-        // the caller just cancelled.
-        settledPreOpen = true;
-        clearTimeout(upgradeTimer);
-        try { ws.close(); } catch { /* already closing */ }
-        reject(signal?.reason ?? new DOMException("The operation was aborted.", "AbortError"));
-        return;
-      }
-      if (controller && !terminal) {
-        terminal = true;
-        // Mirror an aborted fetch: the body read rejects with the abort reason.
-        try { controller.error(signal?.reason ?? new DOMException("The operation was aborted.", "AbortError")); } catch { /* stream already done */ }
-      }
-      // Error the body before close(): test doubles and some runtimes dispatch
-      // close synchronously, and the caller's abort reason must stay authoritative.
-      try { ws.close(); } catch { /* already closing */ }
-    };
-    signal?.addEventListener("abort", onAbort, { once: true });
-
-    ws.addEventListener("open", () => {
-      if (settledPreOpen) return;
-      clearTimeout(upgradeTimer);
-      try {
-        ws.send(frameText);
-      } catch {
-        // send() throwing means the frame never left, so no upstream turn
-        // started and the SSE resend cannot double-generate. Falling back
-        // (instead of erroring a synthetic 200 body) keeps the pre-stream
-        // HTTP error/refresh/failover machinery in charge.
-        settledPreOpen = true;
-        try { ws.close(); } catch { /* already closing */ }
-        resolve(sseFallback(url, init));
-        return;
-      }
-      opened = true;
-      const stream = new ReadableStream<Uint8Array>({
-        start(c) { controller = c; },
-        cancel() { try { ws.close(); } catch { /* already closing */ } },
-      }, new ByteLengthQueuingStrategy({ highWaterMark: MAX_CODEX_WS_QUEUE_BYTES }));
-      const response = new Response(stream, {
-        status: 200,
-        // The 101 response headers (x-codex-*-reset-at quota hints) are not
-        // exposed by Bun's WebSocket; the periodic quota poller covers those.
-        headers: { "content-type": "text/event-stream; charset=utf-8" },
-      });
-      codexWsUpstreamResponses.add(response);
-      resolve(response);
-    });
-
-    ws.addEventListener("message", (event) => {
-      if (!controller || terminal) return;
-      const text = typeof event.data === "string" ? event.data : "";
-      if (!text) return;
-      // UTF-8 byte length is always at least the JS string length. Reject this
-      // cheap lower bound before parsing so an obviously oversized frame does
-      // not create another large object graph.
-      if (text.length > MAX_CODEX_WS_FRAME_BYTES) {
-        failStream("codex websocket frame exceeds the response size limit");
-        return;
-      }
-      const rawEncodedText = encoder.encode(text);
-      if (rawEncodedText.byteLength > MAX_CODEX_WS_FRAME_BYTES) {
-        failStream("codex websocket frame exceeds the response size limit");
-        return;
-      }
-      const normalized = normalizeResponsesWsRelayEvent(text);
-      if (!normalized) return;
-      const { type } = normalized;
-      const encodedText = normalized.text === text ? rawEncodedText : encoder.encode(normalized.text);
-      if (encodedText.byteLength > MAX_CODEX_WS_FRAME_BYTES) {
-        failStream("codex websocket frame exceeds the response size limit");
-        return;
-      }
-      // Relay only the event surface the SSE path produces today. WS-only
-      // frames (codex.rate_limits, responsesapi.websocket_timing) are dropped
-      // so downstream clients see exactly the stream shape they always got.
-      if (!type.startsWith("response.") && type !== "error") return;
-      const prefix = encoder.encode(`event: ${type}\ndata: `);
-      const suffix = encoder.encode("\n\n");
-      const frameBytes = prefix.byteLength + encodedText.byteLength + suffix.byteLength;
-      if (frameBytes > MAX_CLIENT_SSE_FRAME_BYTES) {
-        failStream("codex websocket frame exceeds the response size limit");
-        return;
-      }
-      const availableBytes = controller.desiredSize ?? 0;
-      if (frameBytes > availableBytes) {
-        failStream("codex websocket response exceeded the buffered queue limit");
-        return;
-      }
-      const sseFrame = new Uint8Array(frameBytes);
-      sseFrame.set(prefix);
-      sseFrame.set(encodedText, prefix.byteLength);
-      sseFrame.set(suffix, prefix.byteLength + encodedText.byteLength);
-      try {
-        controller.enqueue(sseFrame);
-      } catch {
-        failStream("codex websocket response stream closed while enqueueing");
-        return;
-      }
-      if (type === "response.completed" || type === "response.failed" || type === "response.incomplete" || type === "error") {
-        terminal = true;
-        try { controller.close(); } catch { /* already closed */ }
-        try { ws.close(); } catch { /* already closing */ }
-      }
-    });
-
-    ws.addEventListener("close", (event: unknown) => {
-      signal?.removeEventListener("abort", onAbort);
-      if (!opened) {
-        if (settledPreOpen) return;
-        settledPreOpen = true;
-        clearTimeout(upgradeTimer);
-        // Upgrade rejected (401/403/429/5xx). Retry over plain SSE so the real
-        // HTTP status reaches the existing refresh/rotation handlers. No turn
-        // started upstream, so the resend cannot double-generate.
-        resolve(sseFallback(url, init));
-        return;
-      }
-      if (controller && !terminal) {
-        terminal = true;
-        // Connection dropped before a Responses terminal event. A clean EOF
-        // here would reach clients with no response.completed/failed at all —
-        // relaySseWithFailedTail() only synthesizes a failed terminal when the
-        // body read THROWS. Error the stream like a reset TCP socket.
-        try { controller.error(new Error(closedBeforeTerminalMessage(event))); } catch { /* stream already done */ }
-      }
-    });
-
-    ws.addEventListener("error", () => {
-      /* Bun always follows error with close; the close handler settles. */
-    });
-  });
+  } catch {
+    return sseFallback(url, init);
+  }
+  return codexWsExchange({ session, url, init, prepared, sseFallback, onQuota, beforeDispatch });
 }

package/src/server/responses-custom-tool-repair.ts

@@ -1,6 +1,7 @@
 import type { TranslatorBudget } from "../lib/translator-budget";
-import { normalizeApplyPatchDelimiters } from "../responses/apply-patch-envelope";
-import { compileCodeModeHelperInput } from "../responses/code-mode-helper-compat";
+import { mayBecomePatchEnvelope, normalizeApplyPatchDelimiters } from "../responses/apply-patch-envelope";
+import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
+import { declaresCodeModeExec } from "../types/tools";
 import {
   customToolItemId,
   restoreRoutedCustomCalls,
@@ -316,6 +317,16 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       if (FREEFORM_WRAP_PREFIX.startsWith(open.argumentsText)) return [];
       const fullInput = partialCustomToolInput(open.argumentsText);
       if (fullInput === null) return [];
+      // Hold a buffer that could still become a complete patch envelope. The done event
+      // recompiles such a body into an apply_patch helper call, so streaming the envelope
+      // bytes first and replacing them at completion is the rewind this path forbids.
+      // Mirrors the same hold in `src/bridge.ts`.
+      if (
+        declaresCodeModeExec(declaredNames)
+        && itemNames.get(upstreamItemId)?.namespace === undefined
+        && itemNames.get(upstreamItemId)?.name === "exec"
+        && mayBecomePatchEnvelope(fullInput)
+      ) return [];
       if (!fullInput.startsWith(open.emittedInput) || fullInput.length === open.emittedInput.length) return [];
       const inputDelta = fullInput.slice(open.emittedInput.length);
       open.emittedInput = fullInput;
@@ -340,12 +351,17 @@ export function createRoutedCustomToolRestoreBlockRewrite(
         : openCalls.get(upstreamItemId)?.argumentsText ?? "";
       const { arguments: _arguments, ...rest } = parsed;
       const itemName = itemNames.get(upstreamItemId);
+      // Name-based alias first; otherwise a raw patch envelope submitted as the `exec` body
+      // resolves to the same apply_patch helper (devlog/_plan/260905_apply_patch_envelope_gap).
+      const helper = itemName?.aliased
+        ? itemName.name
+        : resolveCodeModeHelperName(undefined, itemName?.name ?? "", source, itemName?.namespace, declaredNames);
       const next = {
         ...rest,
         type: nextType,
         item_id: customToolItemId(upstreamItemId),
-        input: itemName?.aliased
-          ? compileCodeModeHelperInput(source, itemName.name)
+        input: helper
+          ? compileCodeModeHelperInput(source, helper)
           : unwrapRoutedCustomToolArguments(source, itemName?.name ?? "", itemName?.namespace),
       };
       return [replaceSseDataPayload(replaceSseEventName(block, nextType), JSON.stringify(next))];