@bitkyc08/opencodex 2.56.0 → 2.58.0

package/src/server/responses/adapter-dispatch.ts

@@ -1,3 +1,4 @@
+import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
@@ -11,7 +12,6 @@ import { trackStreamLifetime } from "../lifecycle";
 import {
   recordAdapterReasoning,
   recordAdapterTier,
-  noteAttemptSend,
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
 } from "../request-log";
@@ -72,7 +72,12 @@ import { consumeComboFailure } from "./core-combo-failure";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
 import { isFixedCodexAccount } from "./core-codex-account";
 import { recordSubagentQuotaFailureForThreadSpawn } from "../../codex/subagent-model-fallback";
-import { isCyberPolicyCode, CYBER_POLICY_FALLBACK_MESSAGE, CYBER_POLICY_ERROR_CODE } from "../../lib/errors";
+import {
+  isCyberPolicyCode,
+  CYBER_POLICY_FALLBACK_MESSAGE,
+  CYBER_POLICY_ERROR_CODE,
+  SEND_BUDGET_EXHAUSTED_CODE,
+} from "../../lib/errors";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { cancelBodyOnAbort } from "../../lib/abort";
 
@@ -115,11 +120,12 @@ export async function prepareAdapterExchange(
     | "genericFailoverAccountId"
     | "genericFailovers"
     | "applyFailoverSnapshot"
+    | "noteRoutedAttemptSend"
   >,
   responseEffects: Pick<ResponsesEffects, "cancelResponseCompletion" | "notifyResponseComplete" | "refreshRequestToolAliases">,
   sendBudgetState: Pick<
     ResponsesSendBudget,
-    | "adapterSendBudget"
+    | "adapterDispatchBudget"
     | "noteAdapterPhysicalSend"
     | "remainingTransientSendBudget"
     | "noteTransientSends"
@@ -127,6 +133,7 @@ export async function prepareAdapterExchange(
     | "recoveryClassFor"
     | "sendBudgetExhausted"
     | "reserveCredentialHop"
+    | "pendingHopPermit"
   >,
 ) {
   const { options, config, logCtx, req } = requestContext;
@@ -151,7 +158,7 @@ export async function prepareAdapterExchange(
   } = requestState;
   const { cancelResponseCompletion, notifyResponseComplete, refreshRequestToolAliases } = responseEffects;
   const {
-    adapterSendBudget,
+    adapterDispatchBudget,
     noteAdapterPhysicalSend,
     remainingTransientSendBudget,
     noteTransientSends,
@@ -272,15 +279,16 @@ export async function prepareAdapterExchange(
   let upstreamResponse: Response;
   try {
     if (transportState.activeAdapter.fetchResponse) {
-      noteAttemptSend(logCtx.activeAttempt, inputTokenEstimate);
+      transportState.noteRoutedAttemptSend(inputTokenEstimate);
       await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, upstream.signal);
       upstreamResponse = await transportState.activeAdapter.fetchResponse(builtInitialRequest, {
         abortSignal: upstream.signal,
         timeoutMs: connectMs,
-        sendBudget: adapterSendBudget,
+        sendBudget: adapterDispatchBudget,
         onPhysicalSend: send => noteAdapterPhysicalSend(inputTokenEstimate, send),
         stream: parsed.stream,
         executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              pacingSlotAcquired: true,
               dispatchOverride: oauthDispatch(builtInitialRequest),
           providerName: route.providerName,
           modelId: route.modelId,
@@ -300,7 +308,7 @@ export async function prepareAdapterExchange(
         : fetchWithResetRetry;
       upstreamResponse = await fetchWithRetryPolicy(
         recovery => {
-          noteAttemptSend(logCtx.activeAttempt, inputTokenEstimate, recovery);
+          transportState.noteRoutedAttemptSend(inputTokenEstimate, recovery);
           return fetchWithHeaderTimeout(builtInitialRequest.url, applyUpstreamRecoveryInit({
             method: builtInitialRequest.method,
             headers: builtInitialRequest.headers,
@@ -331,6 +339,13 @@ export async function prepareAdapterExchange(
     cleanupUpstreamAbort();
     upstream.abort();
     if (options.abortSignal?.aborted) return clientCancelledResponse();
+    // A budget refusal is a decision this process made, not an upstream fault. Reporting it as
+    // 502 does more than mislabel it: the Codex client retries 5xx and does not retry a 429, so
+    // blaming the provider makes the caller send the whole turn again -- the amplification this
+    // budget exists to stop. The passthrough path has answered 429 here since #4546.
+    if (err instanceof SendBudgetExhaustedError) {
+      return formatErrorResponse(429, SEND_BUDGET_EXHAUSTED_CODE, err.message);
+    }
     const msg = describeUpstreamConnectFailure(err, connectMs);
     return formatErrorResponse(502, "upstream_error", msg);
   } finally {
@@ -412,10 +427,10 @@ export async function prepareAdapterExchange(
       logCtx.providerAdapter = transportState.activeAdapter.name;
       sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
       recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
-      noteAttemptSend(logCtx.activeAttempt, retryEstimate, recovery);
       try {
         try {
           if (transportState.activeAdapter.fetchResponse) {
+            transportState.noteRoutedAttemptSend(retryEstimate, recovery);
             await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, upstream.signal);
             // The dispatch boundary is HERE, not before the pacing wait: that wait can reject for
             // an abort, a saturated queue, an expired slot or a removed provider, and none of
@@ -425,10 +440,11 @@ export async function prepareAdapterExchange(
             return await transportState.activeAdapter.fetchResponse(retryRequest, {
               abortSignal: upstream.signal,
               timeoutMs: connectMs,
-            sendBudget: adapterSendBudget,
+            sendBudget: adapterDispatchBudget,
               onPhysicalSend: send => noteAdapterPhysicalSend(retryEstimate, send),
               stream: parsed.stream,
               executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+                pacingSlotAcquired: true,
               dispatchOverride: oauthDispatch(retryRequest),
                 providerName: route.providerName,
                 modelId: route.modelId,
@@ -461,6 +477,7 @@ export async function prepareAdapterExchange(
                 if (refetchAllowance?.permit && !refetchAllowance.permit.use()) {
                   throw new SendBudgetExhaustedError(safeHostLabel(retryRequest.url));
                 }
+                transportState.noteRoutedAttemptSend(retryEstimate, recoveryKind ?? recovery);
                 // Same boundary on the helper path: the thunk is what reaches the wire, and it
                 // can be refused above before it does. use() past the first attempt is a no-op.
                 onDispatch?.();
@@ -499,12 +516,23 @@ export async function prepareAdapterExchange(
         if (options.abortSignal?.aborted) {
           return { failed: clientCancelledResponse() };
         }
+        // Same rule on the recovery leg: the ladder refused to send again, so the answer names
+        // this proxy rather than the provider it never reached.
+        if (err instanceof SendBudgetExhaustedError) {
+          return { failed: formatErrorResponse(429, SEND_BUDGET_EXHAUSTED_CODE, err.message) };
+        }
         const msg = describeUpstreamConnectFailure(err, connectMs);
         return { failed: formatErrorResponse(502, "upstream_error", msg) };
       }
     };
     // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
     recovery: for (;;) {
+      // Preserve the terminal verdict through adapter and combo error formatting.
+      // This also covers a reset reached by a 401/429/413 recovery refetch.
+      if (isNonReplayableResponse(upstreamResponse)) {
+        cleanupUpstreamAbort();
+        return upstreamResponse;
+      }
       if (
         upstreamResponse.status === 401
         && isOAuth401ReplayProvider
@@ -593,6 +621,11 @@ export async function prepareAdapterExchange(
         const result = await rebuildAndRefetch("key-401");
         if ("failed" in result) return result.failed;
         upstreamResponse = result;
+        // A recovery refetch can itself die on an ambiguous pre-header reset, and the refusal
+        // that answers it is a 429. Every arm below keys on 429, so letting it fall through
+        // hands the marked refusal to the next waiting arm and replays the send it exists to
+        // stop. Re-enter the loop guard instead, which returns it unchanged.
+        if (isNonReplayableResponse(upstreamResponse)) continue recovery;
       }
 
       // Same-target 429 wait-and-retry (opt-in `retryOn429`, issue #487). Codex never retries
@@ -633,6 +666,9 @@ export async function prepareAdapterExchange(
         const result = await rebuildAndRefetch("rate-limit-429");
         if ("failed" in result) return result.failed;
         upstreamResponse = result;
+        // The refusal is a 429 too: without this the while condition is still true and the
+        // next configured attempt replays it on the same target.
+        if (isNonReplayableResponse(upstreamResponse)) continue recovery;
       }
 
       // Multi-key 429 failover: rotate to the next pool key (cooldown-aware) and retry the
@@ -664,6 +700,9 @@ export async function prepareAdapterExchange(
         const result = await rebuildAndRefetch("key-429");
         if ("failed" in result) return result.failed;
         upstreamResponse = result;
+        // Rotating on the refusal would also write a cooldown against a key that rate-limited
+        // nothing, which outlives the request.
+        if (isNonReplayableResponse(upstreamResponse)) continue recovery;
       }
 
       // Opt-in Anthropic OAuth account pool (#294): cool the failed account and retry
@@ -700,6 +739,7 @@ export async function prepareAdapterExchange(
           const result = await rebuildAndRefetch("anthropic-oauth-429");
           if ("failed" in result) return result.failed;
           upstreamResponse = result;
+          if (isNonReplayableResponse(upstreamResponse)) continue recovery;
         } catch {
           break;
         }
@@ -722,9 +762,23 @@ export async function prepareAdapterExchange(
         // rebuildAndRefetch, so the roster cap alone would let one request walk the roster on
         // an allowance the rest of the request cannot see. A refusal ends the ladder with the
         // real 429 already in hand, which is the decided exhaustion contract.
+        //
+        // Who settles this reservation depends on who dispatches the replay (#4709). An
+        // adapter that owns its ladder -- Kiro's reset loop, Cursor's transport loop --
+        // reserves once per physical send and would charge the same replay again; the helper
+        // path reports it again through `onSendsConsumed`. Both turned one physical send into
+        // two charges, and once the allowance was spent, into a synthetic error in place of
+        // the 429 this hop was recovering from. The wire protocol is resolved from the
+        // provider and model, not from the account, so an account rotation cannot move the
+        // replay between these two shapes.
+        const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
         const hop = reserveCredentialHop(
           "auth-recovery",
           `${route.providerName}|${route.modelId}|adapter-recovery-oauth-429`,
+          // Only a helper-routed replay reports this send back. A reset-only refetch reports
+          // nothing and an adapter ladder settles the booking itself, so promising an external
+          // report on either would leave a booking pending until it swallowed a later charge.
+          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
         );
         if (!hop.allowed) break;
         const nextAccountId = rotateGenericOAuthAccountOn429(
@@ -755,16 +809,33 @@ export async function prepareAdapterExchange(
           );
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
           recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
-          // Confirm at the dispatch boundary, not here: a rebuild can fail while shaping the
-          // request and return `{ failed }` without reaching the wire, and a permit confirmed
-          // before that would hold the charge for a send that never happened.
-          const result = await rebuildAndRefetch("oauth-account-429", () => { hop.permit?.use(); });
+          // The replay IS this hop's send, so hand the reservation down and let the layer that
+          // dispatches settle it: `adapterDispatchBudget` spends it on the adapter's first
+          // reservation, and the retry helper's reporter settles the external booking.
+          sendBudgetState.pendingHopPermit = hop.permit;
+          let result: Response | { failed: Response };
+          try {
+            // Confirm at the dispatch boundary, not here: a rebuild can fail while shaping the
+            // request and return `{ failed }` without reaching the wire, and a permit confirmed
+            // before that would hold the charge for a send that never happened. An
+            // adapter-owned ladder is the exception -- its own reservation is the confirmation,
+            // and settling here first would hand it a dead permit, which it reads as an
+            // exhausted request and stops sending on.
+            result = await rebuildAndRefetch("oauth-account-429", () => {
+              if (!adapterOwnsDispatch) hop.permit?.use();
+            });
+          } finally {
+            sendBudgetState.pendingHopPermit = undefined;
+          }
           if ("failed" in result) {
             // A no-op if the boundary was reached; a refund if the rebuild died before it.
             hop.permit?.release();
             return result.failed;
           }
           upstreamResponse = result;
+          // The hop's permit is already settled by the dispatch boundary above; continuing
+          // only skips the remaining arms, it does not abandon a reservation.
+          if (isNonReplayableResponse(upstreamResponse)) continue recovery;
         } catch {
           // A throw before the send — snapshot fetch, credential application, adapter
           // resolution — must hand the reservation back. Without this the ladder charges the

package/src/server/responses/codex-ws-exchange.ts

@@ -1,3 +1,6 @@
+import { mergeSteeringContinuation } from "./native-steering-settings";
+import { markNativeControlResponse } from "./native-response-control";
+import type { NativeResponseControl } from "./native-response-control";
 import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 import { isSafeResponseHeader } from "../safe-response-headers";
 import { CodexWsMetadata, type CodexWsQuotaObserver } from "./codex-ws-metadata";
@@ -6,10 +9,12 @@ import { CodexWsCorrelation } from "./codex-ws-correlation";
 import type { CodexWsSession } from "./codex-ws-session";
 import { UPGRADE_DEADLINE_MS, CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES,
   MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage,
-  codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
+  codexWsCreateFrameExceedsLimit, codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
   type CodexWsFailureStage, type CodexWsStageRecord } from "./codex-ws-wire";
 
 interface ExchangeOptions {
+  nativeControl?: NativeResponseControl;
+  beforeContinuation?: () => Promise<void>;
   session: CodexWsSession;
   url: string;
   init: RequestInit;
@@ -86,7 +91,7 @@ function wrappedRejectionResponse(payload: Record<string, unknown>, prelude: Hea
 
 /** The sole SSE exchange state machine for both one-shot and retained sockets. */
 export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
-  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch, bunVersion } = options;
+  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch, bunVersion, nativeControl, beforeContinuation } = options;
   const { frameText, headers } = prepared;
   const signal = init.signal ?? undefined;
   return new Promise<Response>((resolve, reject) => {
@@ -116,6 +121,8 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
     const metadata = url === CODEX_RESPONSES_HTTP_URL ? new CodexWsMetadata(onQuota) : null;
     const correlation = session.retainable ? new CodexWsCorrelation(session.reused, id => session.hasCompleted(id)) : null;
     let detachOwner = () => {};
+    let detachSteering = () => {};
+    let continuationBase: Record<string, unknown> | undefined;
     // Liveness while waiting for the first response event (metadata path only): the
     // silence timer is re-armed by every inbound frame or pong; the pinger runs on a fixed
     // interval so a peer that answers pings can never trip the silence bound while alive.
@@ -142,6 +149,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       metadata?.finish();
       correlation?.finish();
       detachOwner();
+      detachSteering();
       ws.removeEventListener("open", onOpen);
       ws.removeEventListener("message", onMessage);
       ws.removeEventListener("close", onClose);
@@ -198,6 +206,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       const response = new Response(stream, { status: 200, headers: responseHeaders });
       metadata?.commit();
       markCodexWsResponse(response, Boolean(metadata && onQuota));
+      if (nativeControl) markNativeControlResponse(response);
       markCodexWsStage(response, stageRecord(null));
       committedResponse = response;
       resolve(response);
@@ -329,6 +338,54 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       }
       if (terminal || settledPreOpen || signal?.aborted) return;
       sent = true;
+      try {
+        if (nativeControl) {
+          // Parsed once: the base body is immutable for this exchange, and a
+          // full-replay frame runs to megabytes. It seeds continuationBase on
+          // the first create frame.
+          let base: Record<string, unknown> | undefined;
+          detachSteering = nativeControl.attach(frame => {
+            const sendControl = () => {
+              if (terminal || signal?.aborted || session.closed || ws.readyState !== WebSocket.OPEN) {
+                throw new Error("Native steering connection is no longer available");
+              }
+              beforeDispatch?.(new Headers(headers));
+              let outgoing = frame;
+              if (frame.type === "response.create") {
+                // Generation overrides have passed route policy; identity/tools remain pinned.
+                // Keep the last explicit wire settings for later explicit and automatic successors.
+                base ??= JSON.parse(frameText) as Record<string, unknown>;
+                continuationBase ??= base;
+                outgoing = nativeControl.kind === "steering"
+                  ? mergeSteeringContinuation(continuationBase, frame)
+                  : { ...continuationBase, input: frame.input, previous_response_id: frame.previous_response_id };
+              }
+              const text = JSON.stringify(outgoing);
+              if (codexWsCreateFrameExceedsLimit(text)) {
+                throw new Error("Native steering frame exceeds the transport byte limit");
+              }
+              if (frame.type === "response.create") continuationBase = outgoing;
+              try { ws.send(text); } catch {
+                // A send failure has unknown delivery. Never replay or fall back.
+                failStream("Native steering send failed; delivery is unknown");
+                throw new Error("Native steering send failed; delivery is unknown");
+              }
+            };
+            if (frame.type === "response.create" && beforeContinuation) {
+              // Explicit tool-result continuations are physical request starts;
+              // they keep provider pacing and revalidate auth AFTER the wait.
+              void beforeContinuation().then(sendControl).catch(() => failStream("Native steering continuation could not be dispatched; do not automatically replay queued input"));
+            } else sendControl();
+          }, error => failStream(error));
+        }
+      } catch (error) {
+        // An attach failure is an ownership conflict, not a failed send: no frame
+        // left the process, but the channel can never bind, so resolving the HTTP
+        // fallback here would silently degrade a multi-agent turn into an ordinary
+        // one. Fail the turn visibly instead.
+        failStream(error);
+        return;
+      }
       try {
         ws.send(frameText);
         sentAt = Date.now();
@@ -400,8 +457,12 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         return;
       }
       if (!controlFrame && !type.startsWith("response.") && type !== "error") return;
+      let steeringEnded = false;
       if (!controlFrame) {
-        try { correlation?.accept(normalized.payload); } catch (error) { failStream(error); return; }
+        try {
+          if (nativeControl) steeringEnded = nativeControl.observe(normalized.payload);
+          else correlation?.accept(normalized.payload);
+        } catch (error) { failStream(error); return; }
         // Correlation must run first: a reused socket's foreign-stream error settles as a
         // non-replayable 502 above, never as the refused-create 4xx projection below, which
         // is the one status family that could authorize an account replay.
@@ -443,7 +504,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         return;
       }
       if (!controlFrame) relayedEvents += 1;
-      if (type === "response.completed" || type === "response.failed" || type === "response.incomplete" || type === "error") {
+      if (nativeControl ? steeringEnded : (type === "response.completed" || type === "response.failed" || type === "response.incomplete" || type === "error")) {
         const completedId = correlation?.completed(normalized.payload) ?? null;
         terminal = true;
         cleanup();

package/src/server/responses/codex-ws-wire.ts

@@ -108,6 +108,11 @@ export type CodexWsStageRecord = Omit<CodexWsFailureStage, "requestBytes"> & {
 const codexWsStageByResponse = new WeakMap<Response, CodexWsStageRecord>();
 
 export function markCodexWsStage(response: Response, record: CodexWsStageRecord): void {
+  const current = codexWsStageByResponse.get(response);
+  if (current) {
+    Object.assign(current, record);
+    return;
+  }
   codexWsStageByResponse.set(response, record);
 }
 

package/src/server/responses/collaboration.ts

@@ -30,7 +30,7 @@ import {
 } from "../../combos";
 import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
-import { dottedToolName, modelInList, namespacedToolName, toolChoiceToolPredicate } from "../../types";
+import { dottedToolName, modelInList, namespacedToolName, NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES, toolChoiceToolPredicate } from "../../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../../types";
 import {
   forceRefreshOAuthAccessSnapshot,
@@ -83,7 +83,6 @@ import {
   catalogModelSupportsServiceTier,
   finishRequestAttempt,
   inspectResponseLogJson,
-  noteAttemptSend,
   readConfiguredCodexServiceTier,
   requestLogSpeedLabel,
   sealRequestAttemptIdentity,
@@ -152,6 +151,36 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
       dottedAliasOwners.set(t.name, null);
     }
   }
+  // Bare echo alias (`name` with no namespace spelling, #4679): some providers — observed
+  // on the muse family via Command Code — echo a namespaced tool by its bare name. The
+  // bare spelling is only a safe alias while it names ONE tool and cannot be read as
+  // another identity's canonical or dotted spelling.
+  // Code-mode helper spellings never gain a bare alias (#4679 review), whatever namespace
+  // declares them and whatever put the alias there. The list is owned by `src/types/tools.ts`,
+  // beside the names it protects, because the copy that used to live here drifted to a single
+  // namespace and had to be widened twice.
+  const bareAliasOwners = new Map<string, string | null>();
+  for (const t of authorizedTools) {
+    // Bare (no-namespace) declarations participate as owners too: a namespaced tool whose
+    // bare name equals a bare-declared function must not gain the bare alias, mirroring how
+    // the tool_choice bare path refuses ambiguous owners across the whole request catalog.
+    const identity = JSON.stringify([t.namespace ?? null, t.name]);
+    const owner = bareAliasOwners.get(t.name);
+    if (owner === undefined) bareAliasOwners.set(t.name, identity);
+    else if (owner !== identity) bareAliasOwners.set(t.name, null);
+  }
+  for (const t of authorizedTools) {
+    const canonical = namespacedToolName(t.namespace, t.name);
+    const owner = bareAliasOwners.get(canonical);
+    if (owner !== undefined && owner !== JSON.stringify([t.namespace, t.name])) {
+      bareAliasOwners.set(canonical, null);
+    }
+    const dotted = dottedToolName(t.namespace, t.name);
+    const dottedOwner = bareAliasOwners.get(dotted);
+    if (dottedOwner !== undefined && dottedOwner !== JSON.stringify([t.namespace, t.name])) {
+      bareAliasOwners.set(dotted, null);
+    }
+  }
   for (const t of authorizedTools) {
     // Upstream output is untrusted: only restore calls for tools the caller authorized.
     const wireName = namespacedToolName(t.namespace, t.name);
@@ -175,6 +204,30 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
         toolNsMap.set(dottedName, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
         if (t.parameters && typeof t.parameters === "object") toolParameterSchemas.set(dottedName, t.parameters);
       }
+      // Bare echo alias (`name` with no namespace spelling, #4679): same tool identity as
+      // the flattened wire name, so a provider that drops the namespace prefix still
+      // restores against this entry. Ambiguous bare names were resolved to null above;
+      // skipping them falls back to the spellings every provider can still echo.
+      // Code-mode helper spellings never gain a bare alias, from ANY namespace (#4792 review).
+      // Scoping this to `collaboration` was too narrow to be a boundary: a declaration such as
+      // `mcp__remote.exec` donated bare `exec` to the declared set, and normalizeDeclaredToolName
+      // then rewrote an undeclared `apply_patch`, `exec_command` or `write_stdin` onto it
+      // (src/types/tools.ts). No namespace may turn helper normalization on for a catalog that
+      // never declared the code-mode shell.
+      //
+      // The namespaced tool stays usable AS ITSELF: `ns__name` is added unconditionally above
+      // and `ns.name` whenever it is unambiguous, so only the namespace-dropping echo fallback
+      // is withdrawn, and only for these six spellings.
+      if (
+        bareAliasOwners.get(t.name) === JSON.stringify([t.namespace, t.name])
+        && !NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES.has(t.name)
+      ) {
+        budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
+        declaredToolNames.add(t.name);
+        budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([t.name, t.namespace, t.name])).byteLength, { kind: "retained_collectors" });
+        toolNsMap.set(t.name, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
+        if (t.parameters && typeof t.parameters === "object") toolParameterSchemas.set(t.name, t.parameters);
+      }
     }
     if (t.freeform) {
       budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
@@ -201,6 +254,20 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
   // Some routed providers echo a bare tool_choice selector instead of the flattened catalog
   // name. Accept only selectors the client actually sent and only when the full request catalog
   // contains one tool with that logical name.
+  //
+  // A helper spelling selected this way is split rather than refused (#4819). The two things a
+  // bare alias does are separable, and passthrough already relies on that: identity RESTORATION
+  // runs before authorization there, rewriting the echoed bare name to the namespaced identity
+  // the caller declared, and the guard then authorizes `ns__name`. DECLARATION is the part that
+  // is unsafe, because a declared-name set carrying bare `exec` is what makes
+  // `normalizeDeclaredToolName` rewrite an undeclared `apply_patch`, `exec_command` or
+  // `write_stdin` onto the selected tool (src/types/tools.ts).
+  //
+  // So a helper spelling gets the `toolNsMap` entry and not the `declaredToolNames` entry. The
+  // caller nominated exactly one tool by name, `bareNameCounts` proves nothing else answers to
+  // it, and restoring it authorizes nothing the request did not already declare. The echo path
+  // above withholds both, because a bare echo is a guess rather than a nomination and #4679
+  // pinned that shape (`tests/responses/bare-echo-alias.test.ts`).
   const choice = parsed.options.toolChoice;
   const bareChoiceNames = new Set(
     choice && typeof choice === "object"
@@ -213,8 +280,11 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
   }
   for (const t of authorizedTools) {
     if (!t.namespace || !bareChoiceNames.has(t.name) || bareNameCounts.get(t.name) !== 1 || declaredToolNames.has(t.name)) continue;
-    budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
-    declaredToolNames.add(t.name);
+    // Restore the identity; declare the name only when it is not a helper spelling.
+    if (!NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES.has(t.name)) {
+      budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });
+      declaredToolNames.add(t.name);
+    }
     budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([t.name, t.namespace, t.name])).byteLength, { kind: "retained_collectors" });
     toolNsMap.set(t.name, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
     if (t.parameters && typeof t.parameters === "object") {

package/src/server/responses/combo-session-recall.ts

@@ -8,14 +8,46 @@ interface ComboRecallEntry {
   target: Pick<OcxComboTarget, "provider" | "model">;
   responseModel: string;
   at: number;
+  /** UTF-8 size of `responseModel`, the only client-influenced field of unbounded length. */
+  bytes: number;
 }
 
 const RECALL_CAPACITY = 256;
 const RECALL_TTL_MS = 30 * 60 * 1000;
+/**
+ * A model id is provider-reported and arrives on the response, so nothing upstream of here
+ * bounds its length. Lane keys are already SHA-256 digests, so the model string is the only
+ * field that can grow, and 256 lanes alone do not bound the bytes they hold.
+ */
+const RECALL_MODEL_BYTES_MAX = 1024;
+const RECALL_TOTAL_BYTES_MAX = 64 * 1024;
 const recall = new Map<string, ComboRecallEntry>();
+let recallBytes = 0;
 let lastReconciledGeneration = 0;
 let liveOwners: Pick<GenerationContext, "comboIds" | "comboTargets" | "providerNames"> | undefined;
 
+/** Every removal path goes through here so the byte counter can never drift from the map. */
+function deleteEntry(lane: string): boolean {
+  const entry = recall.get(lane);
+  if (!entry) return false;
+  recall.delete(lane);
+  recallBytes -= entry.bytes;
+  return true;
+}
+
+/**
+ * UTF-8 size of a remembered model id, or null when it is too large to retain.
+ *
+ * The code-unit test runs first and is the part that matters: a UTF-8 encoding is never smaller
+ * than the code-unit count, so an oversized string is rejected without encoding it, and the
+ * bound cannot be defeated by paying the allocation it exists to prevent.
+ */
+function boundedModelBytes(responseModel: string): number | null {
+  if (responseModel.length > RECALL_MODEL_BYTES_MAX) return null;
+  const bytes = Buffer.byteLength(responseModel, "utf8");
+  return bytes > RECALL_MODEL_BYTES_MAX ? null : bytes;
+}
+
 function ownsEntry(context: Pick<GenerationContext, "comboIds" | "comboTargets" | "providerNames">, entry: ComboRecallEntry): boolean {
   return context.comboIds.has(entry.comboId)
     && context.providerNames.has(entry.target.provider)
@@ -32,14 +64,29 @@ export function rememberComboForLane(
   if (!lane || !comboId || !responseModel.trim()) return;
   // Reject even a same-named recreated owner: its previous in-flight turn is obsolete.
   if (writerGeneration < Math.max(lastReconciledGeneration, captureConfigGeneration())) return;
-  const entry = { comboId, target: { provider: target.provider, model: target.model }, responseModel, at: Date.now() };
+  // An unretainable model id DECLINES the write; it must not clear the lane. Every other
+  // rejection above returns the same way, and clearing here would let a late completion erase
+  // a newer selection that this function has no ordering information to compare against.
+  const bytes = boundedModelBytes(responseModel);
+  if (bytes === null) return;
+  const entry = {
+    comboId,
+    target: { provider: target.provider, model: target.model },
+    responseModel,
+    at: Date.now(),
+    bytes,
+  };
   if (liveOwners && !ownsEntry(liveOwners, entry)) return;
-  recall.delete(lane);
+  deleteEntry(lane);
   recall.set(lane, entry);
-  while (recall.size > RECALL_CAPACITY) {
+  recallBytes += bytes;
+  // Insertion order is recency order, because every write re-inserts its lane at the back.
+  // Evicting from the front therefore drops the least recently written lane, never this one:
+  // a single entry is capped well below the aggregate budget, so it always fits.
+  while (recall.size > RECALL_CAPACITY || recallBytes > RECALL_TOTAL_BYTES_MAX) {
     const oldest = recall.keys().next().value;
-    if (oldest === undefined) break;
-    recall.delete(oldest);
+    if (oldest === undefined || oldest === lane) break;
+    deleteEntry(oldest);
   }
 }
 
@@ -57,12 +104,25 @@ export function recallComboForLane(
     || !Object.hasOwn(config.providers, entry.target.provider)
     || !provider || provider.disabled === true
     || !combo?.targets.some(target => targetKey(target) === targetKey(entry.target))) {
-    recall.delete(lane);
+    deleteEntry(lane);
     return undefined;
   }
   return entry.responseModel === model ? entry.comboId : undefined;
 }
 
+/**
+ * Periodic expiry. Without it a lane that is never read again and never touched by a config
+ * reconciliation holds its entry for the life of the process: the existing TTL is only
+ * evaluated on read or on generation change.
+ */
+export function sweepExpiredComboRecall(now: number): number {
+  let removed = 0;
+  for (const [lane, entry] of recall) {
+    if (now - entry.at >= RECALL_TTL_MS && deleteEntry(lane)) removed += 1;
+  }
+  return removed;
+}
+
 export function reconcileComboRecall(context: GenerationContext): number {
   if (context.generation <= lastReconciledGeneration) return 0;
   lastReconciledGeneration = context.generation;
@@ -74,8 +134,7 @@ export function reconcileComboRecall(context: GenerationContext): number {
   let removed = 0;
   for (const [lane, entry] of recall) {
     if (!ownsEntry(context, entry) || Date.now() - entry.at >= RECALL_TTL_MS) {
-      recall.delete(lane);
-      removed += 1;
+      if (deleteEntry(lane)) removed += 1;
     }
   }
   return removed;
@@ -84,6 +143,7 @@ export function reconcileComboRecall(context: GenerationContext): number {
 /** Test-only reset, alongside the combo rotation/cooldown resets. */
 export function clearComboRecallForTests(): void {
   recall.clear();
+  recallBytes = 0;
   lastReconciledGeneration = 0;
   liveOwners = undefined;
 }