@bitkyc08/opencodex 2.56.0 → 2.57.0

package/src/adapters/openai-chat/tool-name-registry.ts

@@ -0,0 +1,166 @@
+import { createHash } from "node:crypto";
+import { namespacedToolName, type OcxParsedRequest, type OcxTool } from "../../types";
+import { frameAgentRouterMessages } from "../agentrouter";
+
+const MAX_CHAT_TOOL_NAME_LENGTH = 64;
+const ALIAS_HINT_CHARS = 16;
+const RESERVED_ALIAS_PATTERN = /^ocx_[a-zA-Z0-9_-]{16}_[a-zA-Z0-9_-]{43}$/;
+type ToolIdentity = Readonly<Pick<OcxTool, "namespace" | "name">>;
+
+export interface OpenAIChatToolNameRegistry {
+  alias(tool: ToolIdentity): string;
+  aliasWireName(wireName: string): string;
+  restore(wireName: string): string;
+}
+
+interface OpenAIChatToolNameScope {
+  messages(parsed: OcxParsedRequest, baseUrl: string, messages: readonly unknown[]): unknown;
+  registry(): OpenAIChatToolNameRegistry;
+  restore(wireName: string): string;
+}
+
+function identityKey(tool: ToolIdentity): string {
+  return JSON.stringify([tool.namespace ?? null, tool.name]);
+}
+
+function boundedAlias(tool: ToolIdentity, wireName: string): string {
+  const hint = wireName
+    .replace(/[^a-zA-Z0-9_-]/g, "_")
+    .slice(-ALIAS_HINT_CHARS)
+    .padStart(ALIAS_HINT_CHARS, "_");
+  const key = identityKey(tool);
+  const digest = createHash("sha256")
+    .update(key)
+    .digest("base64url");
+  return `ocx_${hint}_${digest}`;
+}
+
+/** Catalog declarations plus structured calls retained in replay history. */
+export function openAIChatToolNameIdentities(parsed: OcxParsedRequest): ToolIdentity[] {
+  const identities: ToolIdentity[] = [...(parsed.context.tools ?? [])];
+  for (const message of parsed.context.messages) {
+    if (message.role !== "assistant" || !Array.isArray(message.content)) continue;
+    for (const part of message.content) {
+      if (part.type !== "toolCall") continue;
+      identities.push({
+        name: part.name,
+        ...(part.namespace === undefined ? {} : { namespace: part.namespace }),
+      });
+    }
+  }
+  return identities;
+}
+
+/**
+ * One collision domain for a translated Chat Completions request.
+ *
+ * Namespaced names whose flattened spelling exceeds Chat Completions' 64-character function-name
+ * bound are rewritten. Ordinary names and bare names pass through byte-for-byte unless they occupy
+ * the reserved alias spelling; those are re-aliased so no declaration can shadow another identity's
+ * deterministic alias. Distinct identities sharing one flattened spelling each keep an identity
+ * alias, while replay rewriting leaves that ambiguous spelling untouched. Echoed aliases restore to
+ * the original flattened name consumed by the Responses bridge's existing namespace map.
+ */
+export function createOpenAIChatToolNameRegistry(
+  tools: readonly ToolIdentity[] | undefined,
+): OpenAIChatToolNameRegistry {
+  const identities = new Map<string, ToolIdentity>();
+  for (const tool of tools ?? []) identities.set(identityKey(tool), tool);
+  const sortedIdentities = [...identities.entries()]
+    .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+
+  const aliasesByIdentity = new Map<string, string>();
+  const aliasesByWireName = new Map<string, string>();
+  const originalsByAlias = new Map<string, string>();
+  const wireOwners = new Map<string, string | null>();
+  for (const [key, tool] of sortedIdentities) {
+    const wireName = namespacedToolName(tool.namespace, tool.name);
+    const owner = wireOwners.get(wireName);
+    if (owner === undefined) wireOwners.set(wireName, key);
+    else if (owner !== key) wireOwners.set(wireName, null);
+  }
+
+  const aliasOwners = new Map<string, string>();
+  const wireClaims = new Map<string, { key: string; alias: string } | null>();
+  for (const [key, tool] of sortedIdentities) {
+    const wireName = namespacedToolName(tool.namespace, tool.name);
+    const candidate = (tool.namespace !== undefined && wireName.length > MAX_CHAT_TOOL_NAME_LENGTH)
+      || RESERVED_ALIAS_PATTERN.test(wireName)
+      || wireOwners.get(wireName) === null
+      ? boundedAlias(tool, wireName)
+      : wireName;
+    // A full SHA-256 collision is not safely attributable. Keep the later identity's native
+    // spelling instead of failing the request or stealing the first identity's restore entry.
+    const alias = aliasOwners.has(candidate) ? wireName : candidate;
+    aliasesByIdentity.set(key, alias);
+    if (!aliasOwners.has(alias)) aliasOwners.set(alias, key);
+    if (alias !== wireName) originalsByAlias.set(alias, wireName);
+
+    const claim = wireClaims.get(wireName);
+    if (claim === undefined) wireClaims.set(wireName, { key, alias });
+    else if (claim !== null && claim.key !== key) wireClaims.set(wireName, null);
+  }
+  for (const [wireName, claim] of wireClaims) {
+    if (claim !== null) aliasesByWireName.set(wireName, claim.alias);
+  }
+
+  return {
+    alias(tool: ToolIdentity): string {
+      const key = identityKey(tool);
+      const known = aliasesByIdentity.get(key);
+      if (known !== undefined) return known;
+      return namespacedToolName(tool.namespace, tool.name);
+    },
+    aliasWireName(wireName: string): string {
+      return aliasesByWireName.get(wireName) ?? wireName;
+    },
+    restore(wireName: string): string {
+      return originalsByAlias.get(wireName) ?? wireName;
+    },
+  };
+}
+
+export function restoreOpenAIChatToolName(
+  registry: OpenAIChatToolNameRegistry,
+  wireName: string,
+): string {
+  return registry.restore(wireName);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Rewrite replayed assistant tool calls after the ordinary message converter has flattened them. */
+export function aliasOpenAIChatMessageToolNames(
+  messages: readonly unknown[],
+  registry: OpenAIChatToolNameRegistry,
+): unknown[] {
+  return messages.map(message => {
+    if (!isRecord(message) || !Array.isArray(message.tool_calls)) return message;
+    let changed = false;
+    const toolCalls = message.tool_calls.map(toolCall => {
+      if (!isRecord(toolCall) || !isRecord(toolCall.function)
+          || typeof toolCall.function.name !== "string") return toolCall;
+      const name = registry.aliasWireName(toolCall.function.name);
+      if (name === toolCall.function.name) return toolCall;
+      changed = true;
+      return { ...toolCall, function: { ...toolCall.function, name } };
+    });
+    return changed ? { ...message, tool_calls: toolCalls } : message;
+  });
+}
+
+export function withOpenAIChatToolNames<T>(
+  build: (scope: OpenAIChatToolNameScope) => T,
+): T {
+  let registry = createOpenAIChatToolNameRegistry(undefined);
+  return build({
+    messages(parsed, baseUrl, messages): unknown {
+      registry = createOpenAIChatToolNameRegistry(openAIChatToolNameIdentities(parsed));
+      return frameAgentRouterMessages(baseUrl, aliasOpenAIChatMessageToolNames(messages, registry));
+    },
+    registry: () => registry,
+    restore: wireName => restoreOpenAIChatToolName(registry, wireName),
+  });
+}

package/src/adapters/openai-chat/tool-schema.ts

@@ -1,7 +1,8 @@
 import { isNativeOpenAIChatTarget } from "./wire";
+import { createOpenAIChatToolNameRegistry, type OpenAIChatToolNameRegistry } from "./tool-name-registry";
 import { isXaiSchemaTarget, lookupLocalJsonPointer, normalizeXaiToolParameters } from "../xai-tool-schema";
 import { stripResponsesOnlyEncryptedMarker, stripUnicodePropertyPatterns } from "../responses-tool-schema";
-import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../../types";
+import { isAllowedToolChoice, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../../types";
 import type { OcxParsedRequest, OcxProviderConfig } from "../../types";
 
 const ZEN_SCHEMA_MAP_KEYS = new Set(["properties", "$defs", "definitions"]);
@@ -409,7 +410,11 @@ function normalizeMoonshotToolParameters(parameters: unknown): Record<string, un
   return isXaiObjectSchema(normalized) ? normalized : rooted;
 }
 
-export function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderConfig): unknown[] | undefined {
+export function toolsToChatFormat(
+  parsed: OcxParsedRequest,
+  provider: OcxProviderConfig,
+  registry: OpenAIChatToolNameRegistry = createOpenAIChatToolNameRegistry(parsed.context.tools),
+): unknown[] | undefined {
   if (!parsed.context.tools || parsed.context.tools.length === 0) return undefined;
   const tools = parsed.context.tools.filter(toolChoiceToolPredicate(parsed.options.toolChoice, parsed.context.tools));
   if (tools.length === 0) return undefined;
@@ -427,7 +432,7 @@ export function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProvide
     return [{
       type: "function",
       function: {
-        name: namespacedToolName(t.namespace, t.name),
+        name: registry.alias(t),
         ...(t.description ? { description: t.description } : {}),
         parameters,
         ...(t.strict !== undefined ? { strict: t.strict } : {}),
@@ -437,8 +442,12 @@ export function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProvide
   return formatted.length > 0 ? formatted : undefined;
 }
 
-export function toolsToChatFormatForProvider(parsed: OcxParsedRequest, provider: OcxProviderConfig): unknown[] | undefined {
-  const base = toolsToChatFormat(parsed, provider);
+export function toolsToChatFormatForProvider(
+  parsed: OcxParsedRequest,
+  provider: OcxProviderConfig,
+  registry: OpenAIChatToolNameRegistry = createOpenAIChatToolNameRegistry(parsed.context.tools),
+): unknown[] | undefined {
+  const base = toolsToChatFormat(parsed, provider, registry);
   const azureChat = isAzureOpenAiChatTarget(provider);
   const zenChat = shouldSanitizeZenToolParameters(provider);
   if (!base || (!zenChat && !azureChat)) return base;
@@ -463,15 +472,24 @@ export function toolChoiceToChatFormat(
   tc: OcxParsedRequest["options"]["toolChoice"],
   tools: OcxParsedRequest["context"]["tools"],
   provider: OcxProviderConfig,
+  registry: OpenAIChatToolNameRegistry = createOpenAIChatToolNameRegistry(tools),
 ): unknown {
   if (!tc) return undefined;
   if (isAllowedToolChoice(tc)) {
     if (tc.mode === "required" && tc.allowedTools.length === 1 && isNativeOpenAIChatTarget(provider)) {
-      return { type: "function", function: { name: resolveToolChoiceWireName(tools, tc.allowedTools[0]) } };
+      return {
+        type: "function",
+        function: { name: registry.aliasWireName(resolveToolChoiceWireName(tools, tc.allowedTools[0])) },
+      };
     }
     return tc.mode === "required" ? "required" : "auto";
   }
   if (tc === "auto" || tc === "none" || tc === "required") return tc;
-  if ("name" in tc) return { type: "function", function: { name: resolveToolChoiceWireName(tools, tc.name) } };
+  if ("name" in tc) {
+    return {
+      type: "function",
+      function: { name: registry.aliasWireName(resolveToolChoiceWireName(tools, tc.name)) },
+    };
+  }
   return undefined;
 }

package/src/adapters/openai-chat.ts

@@ -6,7 +6,6 @@ import { mapReasoningEffort, modelRecordValue } from "../reasoning-effort";
 import { debugProviderDiagnostic } from "../lib/debug";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { isDebugEnabled } from "../lib/debug-settings";
-import { frameAgentRouterMessages } from "./agentrouter";
 import { openRouterProviderPayload, resolveOpenRouterRouting } from "../providers/openrouter-routing";
 import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../providers/vercel-gateway-routing";
 import { fastPolicyForModel } from "../providers/service-tier";
@@ -39,6 +38,7 @@ import {
   upstreamErrorEvent,
 } from "./openai-chat/errors";
 import { messagesToChatFormat } from "./openai-chat/messages";
+import { withOpenAIChatToolNames } from "./openai-chat/tool-name-registry";
 import { isNativeOpenAIChatTarget, openAIChatTransport, stripBracketedModelSuffix } from "./openai-chat/wire";
 import { toolChoiceToChatFormat, toolsToChatFormatForProvider } from "./openai-chat/tool-schema";
 
@@ -88,7 +88,7 @@ function canSerializeOpenAIChatServiceTier(
 
 export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAdapter {
   let lastRequestedModelId: string | undefined;
-  return {
+  return withOpenAIChatToolNames(toolNames => ({
     name: "openai-chat",
 
     formatErrorBody: formatOpenAIChatErrorBody,
@@ -96,10 +96,10 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
     buildRequest(parsed: OcxParsedRequest, incoming?: IncomingMeta) {
       lastRequestedModelId = parsed.modelId;
       const { url, headers, hasCredential } = openAIChatTransport(provider);
-      const messages = frameAgentRouterMessages(provider.baseUrl, messagesToChatFormat(parsed, provider));
+      const messages = toolNames.messages(parsed, provider.baseUrl, messagesToChatFormat(parsed, provider));
       const finish = (): AdapterRequest => {
-        const tools = toolsToChatFormatForProvider(parsed, provider);
-        const toolChoice = toolChoiceToChatFormat(parsed.options.toolChoice, parsed.context.tools, provider);
+        const tools = toolsToChatFormatForProvider(parsed, provider, toolNames.registry());
+        const toolChoice = toolChoiceToChatFormat(parsed.options.toolChoice, parsed.context.tools, provider, toolNames.registry());
 
         const body: Record<string, unknown> = {
           model: provider.modelSuffixBracketStrip ? stripBracketedModelSuffix(parsed.modelId) : parsed.modelId,
@@ -365,7 +365,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
             return "terminate";
           }
           if (!call.id) call.id = `call_${++toolCallSeq}`;
-          yield { type: "tool_call_start", id: call.id, name: call.name };
+          yield { type: "tool_call_start", id: call.id, name: toolNames.restore(call.name) };
           if (call.args.length > 0) yield { type: "tool_call_delta", arguments: call.args };
           yield { type: "tool_call_end" };
         }
@@ -801,7 +801,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
               logInvalidToolCalls("response", rawToolCalls);
               return [invalidToolCallsEvent(rawToolCalls, "response", usage)];
             }
-            events.push({ type: "tool_call_start", id, name });
+            events.push({ type: "tool_call_start", id, name: toolNames.restore(name) });
             events.push({ type: "tool_call_delta", arguments: args });
             events.push({ type: "tool_call_end" });
           }
@@ -818,5 +818,5 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         budget.releaseRetained(responseBytes, { kind: "retained_collectors" });
       }
     },
-  };
+  }));
 }

package/src/adapters/openai-responses/passthrough.ts

@@ -41,6 +41,19 @@ import { applyTierDecisionToResponsesBody, normalizeCanonicalForwardContinuation
 import { normalizeImageGenClientTools, preferConfiguredHostedTools } from "./image-gen";
 import { stripMuseSparkUnsupportedWebSearchFields, stripOpenAiOnlyWebSearchFields } from "./web-search";
 
+/**
+ * Identifies DeepSeek's strict Responses replay contract: tool-bearing continuations need
+ * plaintext reasoning and cannot consume opaque reasoning state. The two existing flags are
+ * current evidence for that one provider contract, not equivalent capabilities: preservation
+ * keeps plaintext reasoning on the wire, while adjacency marks its strict tool-history shape.
+ * The moment a second provider needs this behavior, replace this derivation with an explicit
+ * registry capability rather than extending the inference.
+ */
+export function requiresPlaintextReasoningReplay(provider: OcxProviderConfig): boolean {
+  return provider.preserveResponsesReasoningContent === true
+    && provider.requiresAdjacentResponsesToolResults === true;
+}
+
 // Headers relayed verbatim from the caller in OAuth-passthrough ("forward") mode.
 // Exported so the web-search sidecar reuses the exact same forwarded-auth set for its ChatGPT call.
 export const FORWARD_HEADERS = [
@@ -64,6 +77,16 @@ export const FORWARD_HEADERS = [
   CODEX_RESPONSES_LITE_HEADER,
 ];
 
+/** Preserve the caller fingerprint unless the provider explicitly owns that header. */
+function applyCallerUserAgentFallback(
+  headers: Record<string, string>,
+  incoming: IncomingMeta,
+): void {
+  if (Object.keys(headers).some(name => name.toLowerCase() === "user-agent")) return;
+  const userAgent = incoming.headers.get("user-agent");
+  if (userAgent) headers["User-Agent"] = userAgent;
+}
+
 /** Replace every `input_image` part under a routed-compaction body with a short marker. */
 function stripInputImagesDeep(value: unknown): unknown {
   if (Array.isArray(value)) return value.map(stripInputImagesDeep);
@@ -221,6 +244,10 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
         if (provider.headers) Object.assign(headers, provider.headers);
       }
+      // Some Responses-compatible gateways select their Codex compatibility path from the real
+      // client fingerprint. This is a single non-credential fallback, not broader caller-header
+      // forwarding. Static provider headers remain authoritative in either auth mode.
+      applyCallerUserAgentFallback(headers, incoming);
 
       const forward = provider.authMode === "forward";
       let convertedRoutedCustomToolNames: Set<string> | undefined;
@@ -357,6 +384,10 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         }
       }
       const threadServingIdentityChanged = parsed._stripReasoningEncryptedContent === true;
+      // Providers with the strict plaintext tool-continuation contract cannot consume any
+      // encrypted reasoning blob, including one whose provenance is unknown. Combo routing
+      // separately refuses a proven cross-route replay when no plaintext exists; this final
+      // serializer guard ensures the foreign opaque state is never forwarded regardless.
       const sanitizedBody = normalizeToolSchemas(
         stripItemIdsWhenUnstored(
           stripInvalidItemIds(
@@ -370,7 +401,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
                 {
                   preserveRawReasoningContent: provider.preserveResponsesReasoningContent === true,
                   dropNullContentChannel: !isOpenAiOperatedResponsesDestination(provider),
-                  stripEncryptedContent: threadServingIdentityChanged,
+                  stripEncryptedContent: threadServingIdentityChanged || requiresPlaintextReasoningReplay(provider),
                 },
               ),
               provider,

package/src/bridge/errors.ts

@@ -1,3 +1,10 @@
+import {
+  isNonReplayableUpstreamCode,
+  isReplayRefusalCode,
+  markReplayRefusalResponse,
+  markResponseNonReplayable,
+  REPLAY_REFUSED_STATUS,
+} from "../lib/upstream-retry";
 import {
   adapterFailureFromMessage,
   classifyError,
@@ -18,17 +25,34 @@ export function formatErrorResponse(
     error.code = CYBER_POLICY_ERROR_CODE;
     error.type = cyberPolicyErrorType(type);
   }
-  const finalStatus = error.code === CYBER_POLICY_ERROR_CODE ? 400 : status;
+  // Only the allowlisted transport verdicts survive this formatter. Do not forward
+  // arbitrary provider codes, and preserve the existing cyber-policy precedence.
+  const replayBlocked = error.code !== CYBER_POLICY_ERROR_CODE
+    && isNonReplayableUpstreamCode(options?.code);
+  if (replayBlocked) error.code = options!.code!;
+  // The replay refusal owns its status as well as its code. A combo or adapter formatter
+  // reaches here holding the upstream-shaped status it was about to report, and inheriting
+  // that would hand the client a 5xx it is configured to retry four times.
+  const finalStatus = error.code === CYBER_POLICY_ERROR_CODE
+    ? 400
+    : isReplayRefusalCode(error.code) ? REPLAY_REFUSED_STATUS : status;
   const headers = new Headers({ "Content-Type": "application/json" });
   const retryAfter = options?.retryAfter?.trim();
   if (error.code !== CYBER_POLICY_ERROR_CODE
+    && !replayBlocked
     && retryAfter
     && retryAfter.length > 0
     && retryAfter.length <= 128) {
     headers.set("Retry-After", retryAfter);
   }
-  return new Response(JSON.stringify({ error }), {
+  const response = new Response(JSON.stringify({ error }), {
     status: finalStatus,
     headers,
   });
+  if (replayBlocked) markResponseNonReplayable(response);
+  // Re-wrapping is where the refusal loses its provenance: combo failure consumption parses
+  // the JSON and builds a new Response, and the code alone does not tell a later quota
+  // recorder that no upstream produced this status. Carry the narrower marker across too.
+  if (replayBlocked && isReplayRefusalCode(error.code)) markReplayRefusalResponse(response);
+  return response;
 }

package/src/bridge/response-json.ts

@@ -68,6 +68,8 @@ function buildResponseJSONWithBudget(
     toolNsMap?: Map<string, { namespace: string; name: string; freeform?: true }>;
     /** Request-visible tool names. When present, an upstream call outside this set fails closed. */
     declaredToolNames?: ReadonlySet<string>;
+    /** See `bridgeToResponsesSSE`: enforcement is separate from normalization (#4735). */
+    enforceDeclaredToolNames?: boolean;
     /** Declared parameter schema per tool name; repairs integral-float integer args (#1611). */
     toolParameterSchemas?: ReadonlyMap<string, Record<string, unknown>>;
     freeformToolNames?: Set<string>;
@@ -432,7 +434,11 @@ function buildResponseJSONWithBudget(
         }
         flushToolCall();
         const effectiveName = normalizeDeclaredToolName(e.name, options?.declaredToolNames);
-        if (options?.declaredToolNames && !options.declaredToolNames.has(effectiveName)) {
+        if (
+          options?.declaredToolNames
+          && options.enforceDeclaredToolNames !== false
+          && !options.declaredToolNames.has(effectiveName)
+        ) {
           errorEvent = {
             type: "error",
             message: `routed provider emitted undeclared client tool "${effectiveName}"; only request-declared tools may be called`,

package/src/bridge/sse.ts

@@ -88,6 +88,20 @@ export function bridgeToResponsesSSE(
     onUsage?: (usage: OcxUsage | undefined) => void;
     /** Request-visible tool names. When present, an upstream call outside this set fails closed. */
     declaredToolNames?: ReadonlySet<string>;
+    /**
+     * Whether `declaredToolNames` is an authorization boundary this proxy enforces, or only the
+     * catalog used to normalize provider-invented names back to declared ones.
+     *
+     * Defaults to enforcing. The chat and Anthropic inbound wires set it false: those specs make
+     * the server relay a tool call and leave execution or refusal to the client's own runner, and
+     * harnesses on them legitimately defer part of their catalog (#4735).
+     *
+     * It is a separate flag rather than simply withholding `declaredToolNames`, because the set
+     * also drives `normalizeDeclaredToolName` and `declaresCodeModeExec`. Passing `undefined`
+     * turns those off too, so a provider that invents `default.lookup` for a declared `lookup`
+     * would reach the client under the invented name instead of the normalized one.
+     */
+    enforceDeclaredToolNames?: boolean;
     /** Declared parameter schema per tool name; repairs integral-float integer args (#1611). */
     toolParameterSchemas?: ReadonlyMap<string, Record<string, unknown>>;
     /**
@@ -1008,7 +1022,11 @@ export function bridgeToResponsesSSE(
                 : undefined;
               const mapped = toolNsMap?.get(effectiveName);
               const realName = mapped?.name ?? effectiveName;
-              if (options?.declaredToolNames && !options.declaredToolNames.has(effectiveName)) {
+              if (
+                options?.declaredToolNames
+                && options.enforceDeclaredToolNames !== false
+                && !options.declaredToolNames.has(effectiveName)
+              ) {
                 const failure = responseError(
                   502,
                   "upstream_error",

package/src/claude/desktop-profile.ts

@@ -22,8 +22,34 @@ export interface RenderedDesktopModel extends DesktopProfileModel {
   supports1m: boolean;
 }
 
-const DATE_ALIAS = /^claude-opus-4-8-(2026\d{4})$/;
-const DAY_COUNT_2026 = 365;
+// Managed-namespace date aliases run 2026-2035. The original 2026-only
+// (365 slots) design failed with "all 365 encoded date slots are occupied"
+// once a catalog exceeded 365 routes (stale assignments are retained by
+// design, so the set only grows). Years before 2026 stay rejected: dated
+// ids like `claude-opus-4-8-20250201` are real model snapshot ids, not
+// managed aliases, and the inbound decoder relies on that distinction.
+// Every emitted suffix stays 8 digits so modelMap date-stripping keeps
+// working.
+const DATE_ALIAS = /^claude-opus-4-8-(202[6-9]\d{4}|203[0-5]\d{4})$/;
+const LEGACY_YEAR = 2026;
+const LEGACY_DAY_COUNT = 365;
+const ALIAS_FIRST_YEAR = 2026;
+const ALIAS_LAST_YEAR = 2035;
+
+function isLeapYear(year: number): boolean {
+  return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+}
+
+function daysInAliasYear(year: number): number {
+  return isLeapYear(year) ? 366 : 365;
+}
+
+export const TOTAL_ALIAS_SLOTS = (() => {
+  let total = 0;
+  for (let year = ALIAS_FIRST_YEAR; year <= ALIAS_LAST_YEAR; year += 1) total += daysInAliasYear(year);
+  return total;
+})();
+export const ALIAS_YEAR_RANGE = { first: ALIAS_FIRST_YEAR, last: ALIAS_LAST_YEAR } as const;
 
 export class DesktopProfileError extends Error {
   constructor(message: string, readonly path = "profile") {
@@ -119,7 +145,7 @@ export function parseDesktopProfile(value: unknown): DesktopProfile {
     if (isRealAnthropicRoute(route)) {
       if (raw.alias !== routeModelId(route)) throw new DesktopProfileError("real Anthropic routes must keep their exact model id", `profile.assignments.${route}.alias`);
     } else if (!validDateAlias(raw.alias)) {
-      throw new DesktopProfileError("must be a valid claude-opus-4-8-2026MMDD alias", `profile.assignments.${route}.alias`);
+      throw new DesktopProfileError("must be a valid claude-opus-4-8-YYYYMMDD alias", `profile.assignments.${route}.alias`);
     }
     if (aliases.has(raw.alias)) throw new DesktopProfileError(`duplicate alias "${raw.alias}"`, `profile.assignments.${route}.alias`);
     aliases.add(raw.alias);
@@ -144,26 +170,57 @@ export function parseDesktopProfile(value: unknown): DesktopProfile {
   return { version: 1, assignments, defaults, ...appliedMarkers(value) };
 }
 
-function dayOfYearAlias(dayIndex: number): string {
-  const date = new Date(Date.UTC(2026, 0, dayIndex + 1));
+function formatSlotDate(year: number, dayOfYear: number): string {
+  const date = new Date(Date.UTC(year, 0, dayOfYear));
   const y = date.getUTCFullYear();
   const m = String(date.getUTCMonth() + 1).padStart(2, "0");
   const d = String(date.getUTCDate()).padStart(2, "0");
   return `claude-opus-4-8-${y}${m}${d}`;
 }
 
+// Legacy 2026 ring, byte-identical to the original allocator: the same route
+// must keep resolving to the same 2026 alias it always had, and a probe over
+// a nearly-full 2026 set must land on the same free date as before.
+function legacyDayAlias(dayIndex: number): string {
+  return formatSlotDate(LEGACY_YEAR, dayIndex + 1);
+}
+
+// Overflow ring for catalogs past 365 routes (2027-2035). Probed only after
+// every legacy slot is taken, so existing profiles never shift into it.
+const OVERFLOW_FIRST_YEAR = LEGACY_YEAR + 1;
+const OVERFLOW_SLOT_COUNT = TOTAL_ALIAS_SLOTS - LEGACY_DAY_COUNT;
+
+function overflowSlotAlias(slotIndex: number): string {
+  let remaining = ((slotIndex % OVERFLOW_SLOT_COUNT) + OVERFLOW_SLOT_COUNT) % OVERFLOW_SLOT_COUNT;
+  for (let year = OVERFLOW_FIRST_YEAR; year <= ALIAS_LAST_YEAR; year += 1) {
+    const days = daysInAliasYear(year);
+    if (remaining < days) return formatSlotDate(year, remaining + 1);
+    remaining -= days;
+  }
+  throw new DesktopProfileError("slot index out of range", "profile.assignments");
+}
+
 function routeStartDay(route: string): number {
-  return createHash("sha256").update(route).digest().readUInt32BE(0) % DAY_COUNT_2026;
+  return createHash("sha256").update(route).digest().readUInt32BE(0) % LEGACY_DAY_COUNT;
+}
+
+function routeOverflowStart(route: string): number {
+  return createHash("sha256").update(route).digest().readUInt32BE(4) % OVERFLOW_SLOT_COUNT;
 }
 
 function allocateAlias(route: string, used: Set<string>): string {
   if (isRealAnthropicRoute(route)) return routeModelId(route);
   const start = routeStartDay(route);
-  for (let offset = 0; offset < DAY_COUNT_2026; offset += 1) {
-    const alias = dayOfYearAlias((start + offset) % DAY_COUNT_2026);
+  for (let offset = 0; offset < LEGACY_DAY_COUNT; offset += 1) {
+    const alias = legacyDayAlias((start + offset) % LEGACY_DAY_COUNT);
+    if (!used.has(alias)) return alias;
+  }
+  const overflowStart = routeOverflowStart(route);
+  for (let offset = 0; offset < OVERFLOW_SLOT_COUNT; offset += 1) {
+    const alias = overflowSlotAlias((overflowStart + offset) % OVERFLOW_SLOT_COUNT);
     if (!used.has(alias)) return alias;
   }
-  throw new DesktopProfileError("all 365 encoded date slots are occupied", `profile.assignments.${route}.alias`);
+  throw new DesktopProfileError(`all ${TOTAL_ALIAS_SLOTS} encoded date slots are occupied`, `profile.assignments.${route}.alias`);
 }
 
 export function reconcileDesktopProfile(

package/src/claude/outbound.ts

@@ -212,6 +212,8 @@ interface OpenBlock {
   argsBuf?: string;
   argsBufBytes?: number;
   webSearchArgsEmitted?: boolean;
+  /** True once ordinary function-call arguments were emitted to Anthropic SSE. */
+  toolArgsEmitted?: boolean;
   callId?: string;
   /** Last fixed-size reasoning identity (item + summary/content index) seen by this block. */
   reasoningPartKey?: string;
@@ -488,6 +490,7 @@ export function responsesSseToAnthropicSse(
               argsBuf: "",
               argsBufBytes: 0,
               webSearchArgsEmitted: false,
+              toolArgsEmitted: false,
             };
             break;
           }
@@ -518,6 +521,14 @@ export function responsesSseToAnthropicSse(
               type: "content_block_delta", index: open.index,
               delta: { type: "input_json_delta", partial_json: data.delta },
             });
+            open.toolArgsEmitted = true;
+            break;
+          }
+          case "response.function_call_arguments.done": {
+            if (!open || open.kind !== "tool_use" || open.bufferWebSearchArgs || open.toolArgsEmitted) break;
+            if (typeof data.arguments !== "string" || data.arguments.length === 0) break;
+            emit("content_block_delta", { type: "content_block_delta", index: open.index, delta: { type: "input_json_delta", partial_json: data.arguments } });
+            open.toolArgsEmitted = true;
             break;
           }
           case "response.output_item.done": {
@@ -565,6 +576,13 @@ export function responsesSseToAnthropicSse(
                   delta: { type: "input_json_delta", partial_json: JSON.stringify(sanitizeWebSearchInput(parsed)) },
                 });
                 open.webSearchArgsEmitted = true;
+              } else if (!open.bufferWebSearchArgs && !open.toolArgsEmitted
+                && typeof item.arguments === "string" && item.arguments.length > 0) {
+                emit("content_block_delta", {
+                  type: "content_block_delta", index: open.index,
+                  delta: { type: "input_json_delta", partial_json: item.arguments },
+                });
+                open.toolArgsEmitted = true;
               }
               closeOpenBlock();
             }

package/src/cli/account-main.ts

@@ -245,7 +245,7 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     }
     if (noWait) {
       printStatus({ flowId: startFlowId, ...pending });
-      console.log("follow up: ocx account main reauth status --flow " + startFlowId);
+      if (!wantsJson) console.log("follow up: ocx account main reauth status --flow " + startFlowId);
       return 0;
     }
     // Blocking wait bounded by the service flow expiry (15-minute grant + margin).

package/src/cli/capabilities.ts

@@ -710,10 +710,10 @@ export const CAPABILITIES: readonly Capability[] = [
   },
   {
     command: ["system", "codex-restart"],
-    summary: "Restart the Codex app-server.",
+    summary: "Restart the Codex desktop app and app-servers.",
     routes: [{ method: "POST", path: "/api/system/codex-restart" }],
     flags: [
-      { name: "--yes", value: "boolean", summary: "Required: restarts the operator's running Codex app-server." },
+      { name: "--yes", value: "boolean", summary: "Required: fully quits and relaunches the operator's Codex desktop app and restarts its app-servers." },
       { name: "--json", value: "boolean", summary: "Emit the restart result as JSON." },
     ],
     mutates: true,