@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/adapters/cursor/native-exec.ts

@@ -140,6 +140,10 @@ let blobOldestEvictableAt: number | null = null;
 let rejectedEntryTooLarge = 0;
 let rejectedPinnedSaturation = 0;
 let blobExpiryAccountingTimer: ReturnType<typeof setTimeout> | undefined;
+/** Earliest unpinned storedAt+ttl; skip the write-time TTL walk while this is in the future. */
+let blobNextUnpinnedExpiryAt: number | null = null;
+/** Earliest unpinned remote expiry strictly in the future; drives the single reclassify timer. */
+let blobNextRemoteExpiryAt: number | null = null;
 
 function isExpired(entry: CursorBlobEntry, now: number): boolean {
   return now - entry.storedAt >= blobLimits.ttlMs;
@@ -157,6 +161,8 @@ function recomputeBlobClassAccounting(): void {
   let pinnedBytes = 0;
   let evictableBytes = 0;
   let oldestAt: number | null = null;
+  let nextUnpinnedExpiry = Number.POSITIVE_INFINITY;
+  let nextRemoteExpiry = Number.POSITIVE_INFINITY;
   for (const [k, entry] of blobs) {
     const requestPinned = entry.requestPins.size > 0;
     const provenancePinned = entry.provenance === "remote-setBlobArgs" && !isExpired(entry, now);
@@ -169,11 +175,20 @@ function recomputeBlobClassAccounting(): void {
       evictableBytes += entry.sizeBytes + k.length;
       oldestAt = oldestAt === null ? entry.storedAt : Math.min(oldestAt, entry.storedAt);
     }
+    if (!requestPinned) {
+      const expiresAt = entry.storedAt + blobLimits.ttlMs;
+      nextUnpinnedExpiry = Math.min(nextUnpinnedExpiry, expiresAt);
+      if (entry.provenance === "remote-setBlobArgs" && expiresAt > now) {
+        nextRemoteExpiry = Math.min(nextRemoteExpiry, expiresAt);
+      }
+    }
   }
   blobLocalBytes = localBytes;
   blobPinnedBytes = pinnedBytes;
   blobEvictableBytes = evictableBytes;
   blobOldestEvictableAt = oldestAt;
+  blobNextUnpinnedExpiryAt = Number.isFinite(nextUnpinnedExpiry) ? nextUnpinnedExpiry : null;
+  blobNextRemoteExpiryAt = Number.isFinite(nextRemoteExpiry) ? nextRemoteExpiry : null;
   scheduleBlobExpiryAccounting(now);
 }
 
@@ -185,13 +200,8 @@ function reconcileBlobClassAccountingAndEnforce(): void {
 function scheduleBlobExpiryAccounting(now: number): void {
   if (blobExpiryAccountingTimer) clearTimeout(blobExpiryAccountingTimer);
   blobExpiryAccountingTimer = undefined;
-  let nextExpiry = Number.POSITIVE_INFINITY;
-  for (const entry of blobs.values()) {
-    if (entry.provenance !== "remote-setBlobArgs" || entry.requestPins.size > 0) continue;
-    const expiresAt = entry.storedAt + blobLimits.ttlMs;
-    if (expiresAt > now) nextExpiry = Math.min(nextExpiry, expiresAt);
-  }
-  if (!Number.isFinite(nextExpiry)) return;
+  const nextExpiry = blobNextRemoteExpiryAt;
+  if (nextExpiry === null || nextExpiry <= now || !Number.isFinite(nextExpiry)) return;
   blobExpiryAccountingTimer = setTimeout(() => {
     blobExpiryAccountingTimer = undefined;
     reconcileBlobClassAccountingAndEnforce();
@@ -199,6 +209,41 @@ function scheduleBlobExpiryAccounting(now: number): void {
   blobExpiryAccountingTimer.unref?.();
 }
 
+/**
+ * O(1) class/timer update for a newly admitted key when no other row changed.
+ * Full-map recompute stays on replacement, eviction, pin changes, and TTL fire —
+ * the 4096-entry ceiling fill must not walk the store on every remote admit.
+ */
+function accountAdmittedBlob(k: string, entry: CursorBlobEntry, now: number): void {
+  const requestPinned = entry.requestPins.size > 0;
+  const expired = isExpired(entry, now);
+  const provenancePinned = entry.provenance === "remote-setBlobArgs" && !expired;
+  const logicalBytes = entry.sizeBytes + k.length;
+  if (entry.provenance === "local-regenerated") blobLocalBytes += entry.sizeBytes;
+  if (requestPinned || provenancePinned) blobPinnedBytes += logicalBytes;
+  if (!requestPinned && (entry.provenance === "local-regenerated" || expired)) {
+    blobEvictableBytes += logicalBytes;
+    blobOldestEvictableAt = blobOldestEvictableAt === null ? entry.storedAt : Math.min(blobOldestEvictableAt, entry.storedAt);
+  }
+  if (requestPinned) return;
+  const expiresAt = entry.storedAt + blobLimits.ttlMs;
+  blobNextUnpinnedExpiryAt = blobNextUnpinnedExpiryAt === null
+    ? expiresAt
+    : Math.min(blobNextUnpinnedExpiryAt, expiresAt);
+  if (entry.provenance !== "remote-setBlobArgs" || expiresAt <= now) return;
+  const previousRemoteExpiry = blobNextRemoteExpiryAt;
+  blobNextRemoteExpiryAt = previousRemoteExpiry === null
+    ? expiresAt
+    : Math.min(previousRemoteExpiry, expiresAt);
+  if (
+    !blobExpiryAccountingTimer
+    || previousRemoteExpiry === null
+    || expiresAt < previousRemoteExpiry
+  ) {
+    scheduleBlobExpiryAccounting(now);
+  }
+}
+
 function deleteBlob(k: string, recompute = true): number {
   const entry = blobs.get(k);
   if (!entry) return 0;
@@ -246,9 +291,11 @@ function setBlob(
   }
 
   const removals = new Set<string>();
-  for (const [candidateKey, entry] of blobs) {
-    if (candidateKey === k && sameData) continue;
-    if (entry.requestPins.size === 0 && isExpired(entry, now)) removals.add(candidateKey);
+  if (blobNextUnpinnedExpiryAt !== null && now >= blobNextUnpinnedExpiryAt) {
+    for (const [candidateKey, entry] of blobs) {
+      if (candidateKey === k && sameData) continue;
+      if (entry.requestPins.size === 0 && isExpired(entry, now)) removals.add(candidateKey);
+    }
   }
 
   const existingRemovedByTtl = existing !== undefined && removals.has(k);
@@ -326,7 +373,12 @@ function setBlob(
   blobBytes += entry.sizeBytes;
   blobKeyBytes += k.length;
   for (const scope of entry.requestPins) blobRequestScopes.get(scope)?.keys.add(k);
-  reconcileBlobClassAccountingAndEnforce();
+  if (removals.size > 0 || existing !== undefined) {
+    reconcileBlobClassAccountingAndEnforce();
+  } else {
+    accountAdmittedBlob(k, entry, now);
+    enforceAppOwnedMemoryBudget();
+  }
   return { admitted: true, replaced: existing !== undefined };
 }
 

package/src/adapters/cursor/tool-definitions.ts

@@ -5,7 +5,7 @@ import { McpToolDefinitionSchema, McpToolsSchema, type McpToolDefinition } from
 import { CURSOR_EDIT_FILE_TOOL, CURSOR_MULTI_EDIT_TOOL, cursorRequestAdvertisesApplyPatch, cursorToolAllowedByChoice, cursorToolWireName, OCX_RESPONSES_TOOL_PROVIDER } from "./tool-naming";
 import { CURSOR_EDIT_FILE_INPUT_SCHEMA, CURSOR_MULTI_EDIT_INPUT_SCHEMA, cursorToolInputSchema } from "./tool-schemas";
 export { OCX_RESPONSES_TOOL_PROVIDER, CODEX_EXEC_COMMAND_TOOL, CODEX_SHELL_COMMAND_TOOL, CODEX_UNIFIED_EXEC_TOOL, CODEX_WAIT_TOOL, CODEX_APPLY_PATCH_TOOL, CODEX_TOOL_SEARCH_TOOL, CURSOR_EDIT_FILE_TOOL, CURSOR_MULTI_EDIT_TOOL, CURSOR_STRUCTURED_EDIT_TOOLS, CURSOR_EXEC_COMMAND_TOOL, CODEX_SHELL_BRIDGE_TOOL_NAMES, isCodexShellBridgeToolName, resolveShellBridgeAliasKey, cursorToolChoiceAliases, isBareCodexShellBridgeTool, isCursorExecutionPathTool, isCursorWaitTool, isCursorCodeModeExecTool, cursorRequestUsesCodeMode, cursorRequestHasShellAlias, cursorRequestAdvertisesApplyPatch, isCursorStructuredEditToolName, isCursorSyntheticStructuredEditTool, cursorToolWireName, normalizeCursorWireName, normalizeCursorTextToolMarkers, responsesToolNameFromCursorWire, cursorToolAllowedByChoice } from "./tool-naming";
-export { CURSOR_EXEC_COMMAND_INPUT_SCHEMA, CURSOR_EDIT_FILE_INPUT_SCHEMA, CURSOR_MULTI_EDIT_INPUT_SCHEMA, CODEX_SHELL_BRIDGE_ARG_NORMALIZE_SCHEMA, cursorToolInputSchema, cursorToolArgNormalizeSchema, shellBridgeRequiredCommandKeys, defaultShellBridgeArgNormalizeSchema, cursorShellBridgeDropError, nonEmptyShellBridgeCommandFromArgs, cursorShellBridgeArgsValid } from "./tool-schemas";
+export { CURSOR_EXEC_COMMAND_INPUT_SCHEMA, CURSOR_FREEFORM_INPUT_SCHEMA, CURSOR_EDIT_FILE_INPUT_SCHEMA, CURSOR_MULTI_EDIT_INPUT_SCHEMA, CODEX_SHELL_BRIDGE_ARG_NORMALIZE_SCHEMA, cursorToolInputSchema, cursorToolArgNormalizeSchema, shellBridgeRequiredCommandKeys, defaultShellBridgeArgNormalizeSchema, cursorShellBridgeDropError, nonEmptyShellBridgeCommandFromArgs, cursorShellBridgeArgsValid } from "./tool-schemas";
 export { CURSOR_SHELL_ALIAS_SYSTEM_NOTE, CURSOR_GENERIC_TOOL_USE_USER_HINT, isGenericToolUseCountDemoPrompt, requestedCursorToolUseCount, shouldAppendCursorGenericToolUseHint, appendCursorGenericToolUseHint, shouldUseNativeExecOnlyForGenericToolUse, cursorToolsForActivePrompt, buildCursorToolGuidanceSystemNote } from "./tool-guidance";
 
 /**

package/src/adapters/cursor/tool-schemas.ts

@@ -10,11 +10,54 @@ export const CURSOR_EXEC_COMMAND_INPUT_SCHEMA = {
     tty: { type: "boolean", description: "True allocates a PTY for the command; false or omitted uses plain pipes." },
     yield_time_ms: { type: "number", description: "Wait before yielding output. Defaults to 10000 ms; effective range is 250-30000 ms." },
     max_output_tokens: { type: "number", description: "Output token budget. Defaults to 10000 tokens; larger requests may be capped by policy." },
+    sandbox_permissions: {
+      type: "string",
+      enum: ["use_default", "require_escalated"],
+      description: "Per-command sandbox override. Defaults to use_default; use require_escalated for unsandboxed execution.",
+    },
+    justification: {
+      type: "string",
+      description: "User-facing approval question for require_escalated; omit otherwise.",
+    },
+    prefix_rule: {
+      type: "array",
+      items: { type: "string" },
+      description: "Reusable approval prefix for cmd, only with sandbox_permissions: require_escalated.",
+    },
+    login: {
+      type: "boolean",
+      description: "True runs the shell with login semantics; false disables them. Defaults to true.",
+    },
   },
   required: ["cmd"],
   additionalProperties: false,
 } as const;
 
+/** Cursor represents a Responses freeform tool body as one string-valued input field. */
+export const CURSOR_FREEFORM_INPUT_SCHEMA = {
+  type: "object",
+  properties: { input: { type: "string" } },
+  required: ["input"],
+  additionalProperties: false,
+} as const;
+
+function cursorFreeformInputSchema(tool: OcxTool): unknown {
+  const properties = tool.parameters?.properties;
+  const input = properties && typeof properties === "object" && !Array.isArray(properties)
+    ? (properties as Record<string, unknown>).input
+    : undefined;
+  const description = input && typeof input === "object" && !Array.isArray(input)
+    ? (input as Record<string, unknown>).description
+    : undefined;
+  if (typeof description !== "string") return CURSOR_FREEFORM_INPUT_SCHEMA;
+  return {
+    ...CURSOR_FREEFORM_INPUT_SCHEMA,
+    properties: {
+      input: { ...CURSOR_FREEFORM_INPUT_SCHEMA.properties.input, description },
+    },
+  };
+}
+
 /**
  * Structured single-replacement schema advertised to Cursor models in addition to the freeform
  * `apply_patch` tool. Cursor-trained models reliably emit exact-match replacements (the native
@@ -71,6 +114,10 @@ export const CODEX_SHELL_BRIDGE_ARG_NORMALIZE_SCHEMA = {
     yield_time_ms: { type: "number", description: "Wait before yielding output. Defaults to 10000 ms; effective range is 250-30000 ms." },
     max_output_tokens: { type: "number", description: "Output token budget. Defaults to 10000 tokens; larger requests may be capped by policy." },
     max_output_chars: { type: "number", description: "Output character budget when the Responses tool uses chars instead of tokens." },
+    sandbox_permissions: { type: "string", enum: ["use_default", "require_escalated"] },
+    justification: { type: "string" },
+    prefix_rule: { type: "array", items: { type: "string" } },
+    login: { type: "boolean" },
   },
   required: ["command"],
 } as const;
@@ -78,6 +125,12 @@ export const CODEX_SHELL_BRIDGE_ARG_NORMALIZE_SCHEMA = {
 
 /** Schema advertised to Cursor for this tool (may use Cursor-preferred field names like `cmd`). */
 export function cursorToolInputSchema(tool: OcxTool): unknown {
+  if (tool.freeform) {
+    if (isBareCodexShellBridgeTool(tool)) {
+      throw new Error(`freeform Cursor tools cannot use reserved shell bridge name ${tool.name}; use a namespace`);
+    }
+    return cursorFreeformInputSchema(tool);
+  }
   return isBareCodexExecCommandTool(tool) ? CURSOR_EXEC_COMMAND_INPUT_SCHEMA : (tool.parameters ?? {});
 }
 
@@ -87,6 +140,12 @@ export function cursorToolInputSchema(tool: OcxTool): unknown {
  * treating `cmd` as canonical prevents the `cmd` → `command` rewrite Codex requires (#399).
  */
 export function cursorToolArgNormalizeSchema(tool: OcxTool): unknown {
+  if (tool.freeform) {
+    if (isBareCodexShellBridgeTool(tool)) {
+      throw new Error(`freeform Cursor tools cannot use reserved shell bridge name ${tool.name}; use a namespace`);
+    }
+    return cursorFreeformInputSchema(tool);
+  }
   if (isBareCodexShellBridgeTool(tool)) {
     return shellBridgeArgNormalizeSchema(tool);
   }

package/src/adapters/kiro.ts

@@ -44,7 +44,7 @@ import { extractKiroImages, normalizeKiroImages, type KiroImage } from "./kiro-i
 import { sniffImageDimensions } from "./anthropic-image-guard";
 import { fetchKiroWithRetry, noteKiroTransientThrottle } from "./kiro-retry";
 import { convertKiroToolContext } from "./kiro-tools";
-import { normalizeEmptyExecToolResultText } from "./exec-tool-result-normalize";
+import { EMPTY_EXEC_OUTPUT_MESSAGE, normalizeEmptyExecToolResultText } from "./exec-tool-result-normalize";
 import { identifyRoutedModel } from "./identity";
 import { buildNonOpenAIToolCatalogNudgeFromNames, isBareShellBridgeTool, isCodexCodeModeExecTool } from "./tool-catalog-nudge";
 import {
@@ -663,7 +663,7 @@ export function buildKiroPayload(
   }
   const systemPrefix = systemParts.length > 0 ? `${systemParts.join("\n\n")}\n\n` : "";
   const turns: KiroTurn[] = [];
-  const priorCalls = new Map<string, { wireName: string }>();
+  const priorCalls = new Map<string, { wireName: string; rawId: string }>();
   const pushUser = (content: string, images: KiroImage[] = [], toolResults: KiroToolResult[] = []): void => {
     const last = turns.at(-1);
     if (last?.kind === "user") {
@@ -695,7 +695,27 @@ export function buildKiroPayload(
     }
   };
 
+  let adjacentResult: {
+    rawId: string;
+    result: KiroToolResult;
+    texts: string[];
+    count: number;
+    hasImages: boolean;
+  } | undefined;
+  const finishAdjacentResult = (): void => {
+    if (adjacentResult && adjacentResult.count > 1) {
+      if (adjacentResult.texts.some(text => text.trim())) {
+        adjacentResult.result.content = adjacentResult.texts.map(text => ({ text }));
+      } else if (adjacentResult.hasImages || adjacentResult.result.status === "error") {
+        adjacentResult.result.content = [{ text: KIRO_EMPTY_TOOL_RESULT_MESSAGE }];
+      }
+    }
+    adjacentResult = undefined;
+  };
+
   for (const msg of kiroPayloadMessages(parsed)) {
+    // Original-message adjacency matters even when a turn is collapsed or skipped below.
+    if (msg.role !== "toolResult") finishAdjacentResult();
     if (msg.role === "user" || msg.role === "developer") {
       const text = userContentText((msg as { content: string | OcxContentPart[] }).content);
       const images = extractKiroImages((msg as { content: string | OcxContentPart[] }).content);
@@ -714,7 +734,7 @@ export function buildKiroPayload(
         if (priorCalls.has(toolUseId)) throw new Error(`Kiro history contains duplicate tool call id ${JSON.stringify(tc.id)}`);
         const wireName = namespacedToolName(tc.namespace, tc.name);
         const name = registry.alias(wireName);
-        priorCalls.set(toolUseId, { wireName });
+        priorCalls.set(toolUseId, { wireName, rawId: tc.id });
         return { name, input: (tc.arguments ?? {}) as Record<string, unknown>, toolUseId };
       });
       if (!text && toolUses.length === 0) {
@@ -735,26 +755,52 @@ export function buildKiroPayload(
       // the task instead of calling text()/notify(). Checked before `text.trim()` because the
       // wrapper form ("Script completed\nWall time ...\nOutput:\n") is non-blank and would
       // otherwise pass through as if it were real output.
-      const resultText = normalizeEmptyExecToolResultText(text, {
+      const normalizedExecText = normalizeEmptyExecToolResultText(text, {
         toolName: tr.toolName,
         toolNamespace: tr.toolNamespace,
-      }) ?? (text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE);
+      });
+      const resultText = normalizedExecText ?? (text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE);
       const images = extractKiroImages(tr.content);
       const toolUseId = normalizeToolId(tr.toolCallId);
-      if (!priorCalls.has(toolUseId)) {
+      const call = priorCalls.get(toolUseId);
+      if (!call || call.rawId !== tr.toolCallId) {
         throw new Error(`Kiro history contains an orphaned tool result for call ${JSON.stringify(tr.toolCallId)}`);
       }
+      // Keep real whitespace and failed wrappers, but no empty-success wrapper boilerplate.
+      const rawGroupText = text.length > 0 && (!text.trim() || normalizedExecText !== EMPTY_EXEC_OUTPUT_MESSAGE)
+        ? text : undefined;
+      const last = turns.at(-1);
+      if (
+        adjacentResult?.rawId === tr.toolCallId
+        && last?.kind === "user"
+        && last.toolResults.at(-1) === adjacentResult.result
+      ) {
+        adjacentResult.count += 1;
+        adjacentResult.hasImages ||= images.length > 0;
+        if (rawGroupText !== undefined) adjacentResult.texts.push(rawGroupText);
+        last.images.push(...images);
+        if (tr.isError) adjacentResult.result.status = "error";
+        continue;
+      }
+      finishAdjacentResult();
       // Carrier text is a placeholder for an OTHERWISE EMPTY tool-result turn, not a prefix.
       // Passing it here would push proxy filler AHEAD of a human instruction that Claude Code
       // sends in the same turn (mid-turn steering / queued_command, issue #543), burying the
       // newest user intent behind boilerplate. Backfill below only when nothing else speaks.
-      pushUser("", images, [{
+      const result: KiroToolResult = {
         content: [{ text: resultText }],
         status: tr.isError ? "error" : "success",
         toolUseId,
-      }]);
+      };
+      pushUser("", images, [result]);
+      adjacentResult = {
+        rawId: tr.toolCallId, result,
+        texts: rawGroupText === undefined ? [] : [rawGroupText],
+        count: 1, hasImages: images.length > 0,
+      };
     }
   }
+  finishAdjacentResult();
 
   if (turns.length === 0 || turns[0].kind === "assistant") {
     turns.unshift({ kind: "user", content: KIRO_CONTINUATION_MESSAGE, images: [], toolResults: [] });

package/src/adapters/openai-chat.ts

@@ -1660,6 +1660,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       let bufferBytes = 0;
       interface PendingToolCall {
         key: string;
+        indexKey?: string;
         id: string;
         name: string;
         args: string;
@@ -1848,17 +1849,29 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
               const rawId = rawToolCall.id;
               const idDelta = typeof rawId === "string" ? rawId : "";
               const rawIndex = rawToolCall.index;
+              // Only missing/null indexes are absent; every claimed index must be valid.
+              // Unsafe integers can collapse distinct wire indexes onto the same JS number.
+              // Reject before an alias can bind or any pending call can consume the fragment.
+              if (rawIndex !== undefined && rawIndex !== null
+                  && (typeof rawIndex !== "number"
+                    || !Number.isSafeInteger(rawIndex)
+                    || rawIndex < 0)) {
+                return yield* terminateWithError({
+                  ...invalidToolCallsEvent(rawToolCalls, "stream", pendingUsage),
+                  message: "upstream response contained invalid tool calls (invalid index)",
+                });
+              }
 
-              // Resolve the pending call BEFORE judging the fields. Some OpenAI-compatible
+              // Resolve the pending call BEFORE judging repeated string fields. Some OpenAI-compatible
               // streamers repeat an already-sent field as a non-string placeholder on a
               // continuation delta; judging first meant the whole stream died with a 502 even
               // though the value being repeated was already held in canonical form.
-              const key = typeof rawIndex === "number"
-                ? `i:${rawIndex}`
-                : idDelta
-                  ? `id:${idDelta}`
-                  : pendingToolCalls[pendingToolCalls.length - 1]?.key;
+              const indexKey = typeof rawIndex === "number" ? `i:${rawIndex}` : undefined;
+              const key = indexKey ?? (idDelta
+                ? `id:${idDelta}`
+                : pendingToolCalls[pendingToolCalls.length - 1]?.key);
               let call = key !== undefined ? pendingToolCalls.find(c => c.key === key) : undefined;
+              if (!call && indexKey !== undefined) call = pendingToolCalls.find(c => c.indexKey === indexKey);
               if (!call && idDelta) call = pendingToolCalls.find(c => c.id === idDelta);
               if (!call) {
                 call = {
@@ -1872,6 +1885,10 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
                 pendingToolCalls.push(call);
                 budget.openCall(call.key);
               }
+              // An ID-only call may learn its index from a later ID+index fragment. Retain that
+              // alias without changing the key that owns its argument budget. Only the first
+              // observed index binds: a repeated ID on a different index must not alias both.
+              if (indexKey !== undefined && call.indexKey === undefined) call.indexKey = indexKey;
 
               // Tolerance is per FIELD, keyed on that field's own provenance. A canonical name
               // says nothing about whether `arguments` was ever sent as a string, so it cannot

package/src/adapters/openai-responses.ts

@@ -1,3 +1,4 @@
+import { isOpenCodeGo, normalizeOpenCodeGoAgentMessages } from "./opencode-go";
 import { createHash } from "node:crypto";
 import type { IncomingMeta, ProviderAdapter } from "./base";
 import { namespacedToolName, type AdapterEvent, type OcxParsedRequest, type OcxProviderConfig, type OcxUsage, type TierDecision } from "../types";
@@ -2355,6 +2356,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         parsed._rawBody,
         forward || parsed._previousResponseInputExpanded === true,
       );
+      if (!forward && isOpenCodeGo(provider.baseUrl)) outBody = normalizeOpenCodeGoAgentMessages(outBody);
       outBody = mapRoutedResponsesReasoningEffort(outBody, provider, parsed.modelId);
       // stripPreviousResponseId() intentionally returns its input on a no-op. Detach before the
       // tier write so a force-fast/default decision can never mutate parsed._rawBody.
@@ -2427,7 +2429,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         // Codex 0.147 emits private namespace tool groups, while public/third-party Responses
         // gateways accept only flat tool variants. Run after custom/tool-search lowering so
         // namespace children already carry their final public kind before they are promoted.
-        const rewritten = rewriteRoutedNamespaceToolsForUpstream(outBody);
+        const rewritten = rewriteRoutedNamespaceToolsForUpstream(outBody, convertedRoutedCustomToolNames);
         outBody = rewritten.body;
         convertedRoutedNamespaceToolAliases = rewritten.aliases;
         // Preserve xAI's cached-only fail-closed semantics and image-search mapping before the

package/src/adapters/opencode-go.ts

@@ -0,0 +1,35 @@
+/** Match the Go destination, including user-renamed provider entries. */
+export function isOpenCodeGo(baseUrl: string): boolean {
+  try {
+    const url = new URL(baseUrl);
+    return url.origin === "https://opencode.ai" && url.pathname.replace(/\/+$/, "") === "/zen/go/v1";
+  } catch { return false; }
+}
+
+/** Public Responses rejects Codex's private agent_message variant, even with plaintext content. */
+export function normalizeOpenCodeGoAgentMessages(body: unknown): unknown {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
+  const record = body as Record<string, unknown>;
+  if (!Array.isArray(record.input)) return body;
+  let changed = false;
+  const input = record.input.map((item: unknown) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return item;
+    const message = item as Record<string, unknown>;
+    if (message.type !== "agent_message" || !Array.isArray(message.content) || message.content.length === 0) return item;
+    // Genuine ciphertext and unknown part types must retain their existing fail-closed path.
+    if (!message.content.every(part => part && typeof part === "object"
+      && ["input_text", "input_image", "input_file"].includes(part.type))) return item;
+    const identities = Object.fromEntries(["author", "recipient"]
+      .filter(key => typeof message[key] === "string")
+      .map(key => [key, message[key]]));
+    changed = true;
+    return {
+      type: "message", role: "user",
+      content: [
+        ...(Object.keys(identities).length ? [{ type: "input_text", text: `Agent message ${JSON.stringify(identities)}` }] : []),
+        ...message.content,
+      ],
+    };
+  });
+  return changed ? { ...record, input } : body;
+}

package/src/claude/agents-inject.ts

@@ -20,6 +20,7 @@ import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, withOneM
 import { claudeConfigDir } from "./gateway-cache";
 import { DEFAULT_SUBAGENT_MODELS, hasOwnProvider } from "../config";
 import { effectiveBlockedSkillNames, resolveInboundModel } from "./inbound";
+import { AnthropicRequestError } from "./inbound-records";
 import { knownModelIdsForProvider } from "../router";
 import { decodeRoutedModelIdOrThrow } from "../providers/slug-codec";
 
@@ -97,11 +98,17 @@ export function buildClaudeAgentDefs(config: OcxConfig, windows: Record<string,
   const blockedSkills = effectiveBlockedSkillNames(config.claudeCode);
   const blockedSkillsFor = (model: string): readonly string[] => {
     const unmarked = stripOneMillionMarker(model);
-    const nativePassthrough = config.claudeCode?.nativePassthrough !== false
-      && !unmarked.includes("/")
-      && /^(claude|anthropic)(?:-|$)/i.test(unmarked)
-      && resolveInboundModel(unmarked, config.claudeCode) === unmarked;
-    return nativePassthrough ? [] : blockedSkills;
+    try {
+      const nativePassthrough = config.claudeCode?.nativePassthrough !== false
+        && !unmarked.includes("/")
+        && /^(claude|anthropic)(?:-|$)/i.test(unmarked)
+        && resolveInboundModel(unmarked, config.claudeCode) === unmarked;
+      return nativePassthrough ? [] : blockedSkills;
+    } catch (error) {
+      // A stale Desktop selector must not break the roster or acquire native exemptions.
+      if (error instanceof AnthropicRequestError) return blockedSkills;
+      throw error;
+    }
   };
   const defs: ClaudeAgentDef[] = [];
   const usedNames = new Set<string>();

package/src/claude/desktop-3p-library.ts

@@ -0,0 +1,89 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { claudeDesktopConfigLibraryDir, resolveConfigLibraryDir } from "./desktop-3p-paths";
+
+export interface Desktop3pConfigLibraryOptions {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  homeDir?: string;
+}
+
+/**
+ * Resolve the config library from the same user-data root Claude Desktop uses. Keeping this in one
+ * helper prevents the writer and dashboard status probe from agreeing on a path Desktop never reads.
+ *
+ * The resolution itself lives in `./desktop-3p-paths`, which ports Claude Desktop's own `GE()`
+ * branch for branch — including the `-3p` suffix the app appends to its userData root. Dropping
+ * that suffix points us at a directory Desktop never reads (GitHub #539).
+ */
+export function resolveDesktop3pConfigLibraryPath(
+  options: Desktop3pConfigLibraryOptions = {},
+): string {
+  if (options.env === undefined && options.platform === undefined && options.homeDir === undefined) {
+    return claudeDesktopConfigLibraryDir();
+  }
+  return resolveConfigLibraryDir({
+    env: options.env ?? process.env,
+    platform: options.platform ?? process.platform,
+    home: options.homeDir ?? homedir(),
+  });
+}
+
+export interface Desktop3pMetadataEntry {
+  id: string;
+  name: string;
+  [key: string]: unknown;
+}
+
+export interface Desktop3pMetadata {
+  appliedId?: string;
+  entries: Desktop3pMetadataEntry[];
+  [key: string]: unknown;
+}
+
+export function parseMetadata(path: string): Desktop3pMetadata {
+  if (!existsSync(path)) return { entries: [] };
+  const parsed = JSON.parse(readFileSync(path, "utf8")) as Partial<Desktop3pMetadata>;
+  if (!Array.isArray(parsed.entries)) throw new Error("Claude Desktop 3P _meta.json has no entries array");
+  return { ...parsed, entries: parsed.entries };
+}
+
+export const SAFE_DESKTOP_PROFILE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export function isOwnedDesktopEntry(entry: Desktop3pMetadataEntry | undefined): boolean {
+  return entry?.name === "opencodex" || entry?.name === "opencodex-standard";
+}
+
+/** A gateway row is removable; the selected standard row must always remain. */
+export function isOwnedDesktopGatewayEntry(entry: Desktop3pMetadataEntry | undefined): boolean {
+  return entry?.name === "opencodex";
+}
+
+export function profilePath(libraryPath: string, id: string): string {
+  if (!SAFE_DESKTOP_PROFILE_ID.test(id)) throw new Error("desktop_profile_id_unsafe");
+  return join(libraryPath, `${id}.json`);
+}
+
+export const OPENCODEX_DESKTOP_PROFILE_KEYS = new Set([
+  "inferenceProvider",
+  "inferenceCredentialKind",
+  "inferenceGatewayBaseUrl",
+  "inferenceGatewayApiKey",
+  "modelDiscoveryEnabled",
+  "inferenceModels",
+]);
+
+export function readDesktopProfileForeignKeys(path: string): Record<string, unknown> {
+  if (!existsSync(path)) return {};
+  const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+  if (!isRecord(parsed)) throw new Error("Claude Desktop 3P profile is not a JSON object");
+  return Object.fromEntries(
+    Object.entries(parsed).filter(([key]) => !OPENCODEX_DESKTOP_PROFILE_KEYS.has(key)),
+  );
+}
+