@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/adapters/cursor.ts

@@ -3,7 +3,7 @@ import type { AdapterEvent, OcxProviderConfig } from "../types";
 import type { ProviderAdapter } from "./base";
 import { isTranslatorBudgetExceededError } from "../lib/translator-budget";
 import { cursorExecDeniedMessage, cursorRequestDeclaresFullAccess } from "./cursor/exec-policy";
-import { isCursorBenignCancelError, isCursorInvalidArgumentError, isCursorOverflowRemintCandidate, isCursorRootEnvelopeError, safeCursorErrorMessage, type CursorSizeContext } from "./cursor/cursor-errors";
+import { isCursorBenignCancelError, isCursorIncompleteToolCallMessage, isCursorInvalidArgumentError, isCursorOverflowRemintCandidate, isCursorRootEnvelopeError, safeCursorErrorMessage, type CursorSizeContext } from "./cursor/cursor-errors";
 import { cursorCheckpointModelAffinityId, inferCursorContextWindow, isCursorExternalWireModel } from "./cursor/discovery";
 import { createCursorKvStore, type CursorKvStore } from "./cursor/kv-store";
 import { mapCursorServerMessage } from "./cursor/message-mapper";
@@ -32,8 +32,14 @@ import { isDebugEnabled } from "../lib/debug-settings";
 import { createAdapterTierMetadata } from "../providers/fastwire";
 import { estimateTokens } from "../lib/token-estimate";
 import {
+  clearCursorIncompleteToolRemint,
+  cursorIncompleteToolRemintScopeKey,
+  clearCursorEnvelopeEchoRemint,
+  cursorEnvelopeEchoRemintScopeKey,
   cursorOverflowRemintScopeKey,
   markCursorOverflowSurfaced,
+  recordCursorIncompleteToolRemint,
+  recordCursorEnvelopeEchoRemint,
   recordCursorOverflowRemint,
   rememberCursorThreadConversation,
   shouldSkipCursorOverflowRemint,
@@ -99,11 +105,20 @@ function safeCursorTransportError(err: unknown, sizeContext?: CursorSizeContext)
  * estimate over the outgoing text vs the model's context window. Only used to keep
  * SMALL requests on the 429 class — unknown/large stays on the overflow mapping.
  */
-function cursorRequestSizeContext(request: { modelId: string; system: string[]; messages: { content: string }[] }): CursorSizeContext {
+function cursorRequestSizeContext(request: {
+  modelId: string;
+  _cursorIdentityScope?: string;
+  system: string[];
+  messages: { content: string }[];
+}): CursorSizeContext {
   const text = [...request.system, ...request.messages.map(message => message.content)].join("\n");
   return {
     estimatedInputTokens: estimateTokens(text, request.modelId),
-    contextWindow: inferCursorContextWindow(request.modelId),
+    // Prefers this identity scope's checkpoint `maxTokens` over the id heuristic
+    // so a plan-gated ceiling participates in the 0.5-window overflow vs 429 prior.
+    contextWindow: inferCursorContextWindow(request.modelId, {
+      identityScope: request._cursorIdentityScope,
+    }),
   };
 }
 
@@ -171,7 +186,10 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
         }
         const inheritedCheckpointRef = _parsed._providerContinuation?.cursor?.checkpointRef;
         const previousConversationId = _parsed._cursorConversationId;
-        let request = createCursorRequest(_parsed);
+        let request = {
+          ...createCursorRequest(_parsed),
+          _cursorIdentityScope: _parsed._cursorIdentityScope?.trim() || "local",
+        };
         requestSizeContext = cursorRequestSizeContext(request);
         // The builder may derive a stable provider id from the client thread when Responses state
         // is unavailable. Rekey only existing state; there is nothing to migrate on a fresh turn,
@@ -190,6 +208,8 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
         let completedNormally = false;
         let lastTransport: { captured?: Uint8Array } | undefined;
         let emittedClientTool = false;
+        let sawIncompleteToolCall = false;
+        let sawMidstreamEnvelopeEcho = false;
         // Ordering proof for tool-suspended checkpoints: true only when the newest captured
         // checkpoint bytes arrived AFTER the turn emitted a client tool call, i.e. upstream
         // serialized its suspended-on-tool-call state. Only that snapshot can safely resume
@@ -332,6 +352,9 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
                },
              });
              for (const event of events) {
+                if (event.type === "error" && isCursorIncompleteToolCallMessage(event.message)) {
+                  sawIncompleteToolCall = true;
+                }
                 if (!guardsSettled()) {
                   if (event.type === "text_delta") {
                     guardHeld.push(event);
@@ -371,7 +394,9 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
                 }
                 if (event.type !== "heartbeat") emittedOutput = true;
                 if (event.type === "done") {
-                  for (const finding of midstreamObserver?.findings() ?? []) {
+                  const midstreamFindings = midstreamObserver?.findings() ?? [];
+                  if (midstreamFindings.length > 0) sawMidstreamEnvelopeEcho = true;
+                  for (const finding of midstreamFindings) {
                     debugProviderDiagnostic("cursor", "midstream-envelope-echo", {
                       wireModel: activeRequest.modelId,
                       conversationHash: activeRequest.conversationId.slice(0, 16),
@@ -413,7 +438,10 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
         const remintConversationId = (failedConversationId: string) => {
           lastTransport = undefined;
           _parsed._cursorConversationId = undefined;
-          const next = createCursorRequest(_parsed, { forceFreshConversation: true });
+          const next = {
+            ...createCursorRequest(_parsed, { forceFreshConversation: true }),
+            _cursorIdentityScope: _parsed._cursorIdentityScope?.trim() || "local",
+          };
           rekeyContextUsage(failedConversationId, next.conversationId);
           _parsed._cursorConversationId = next.conversationId;
           // Persist recovery for store:false clients that send any stable Cursor thread owner, so
@@ -514,6 +542,69 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             }
           }
         }
+        const incompleteToolRemintScopeKey =
+          _parsed._cursorIsolateConversation !== true
+          && request.contextUsageStoreCheckpoints !== false
+            ? cursorIncompleteToolRemintScopeKey(
+                cursorClientThreadOwner(_parsed),
+                _parsed._cursorIdentityScope,
+              )
+            : null;
+        // Incomplete-tool errors are streamed, not thrown. Do not retry this turn; rotate only
+        // the next turn's id. request-prepare currently isolates compaction, but adapter callers
+        // can bypass that upstream invariant, so checkpoint storage is the local isolation boundary.
+        if (sawIncompleteToolCall && incompleteToolRemintScopeKey) {
+          if (recordCursorIncompleteToolRemint(incompleteToolRemintScopeKey)) {
+            if (inheritedCheckpointRef) invalidateCursorCheckpoint(inheritedCheckpointRef);
+            debugProviderDiagnostic("cursor", "incomplete-tool-remint", {
+              wireModel: request.modelId,
+              conversationHash: request.conversationId.slice(0, 16),
+            });
+            remintConversationId(request.conversationId);
+          } else {
+            debugProviderDiagnostic("cursor", "incomplete-tool-remint-exhausted", {
+              wireModel: request.modelId,
+              conversationHash: request.conversationId.slice(0, 16),
+            });
+          }
+        } else if (!sawIncompleteToolCall && completedNormally && incompleteToolRemintScopeKey) {
+          clearCursorIncompleteToolRemint(incompleteToolRemintScopeKey);
+        }
+        // A mid-stream envelope echo has ALREADY reached the client — the prefix sniffer only
+        // watches the first bytes of a turn, and grok-4.6 writes a real sentence before pasting
+        // the envelope. It cannot be quarantined, so the recovery is the same as the
+        // incomplete-tool case: leave this turn alone and rotate the next turn's id, otherwise
+        // the stored echo is replayed and primes the model to echo again.
+        //
+        // Its own budget, not the incomplete-tool one: echoing is cheap and repeatable while an
+        // incomplete client-tool stream is rare and structural, so a shared counter would let a
+        // persistently echoing model spend the allowance the other recovery needs. Skipped when
+        // the incomplete-tool arm already reminted this turn — one rotation is enough.
+        const envelopeEchoRemintScopeKey =
+          _parsed._cursorIsolateConversation !== true
+          && request.contextUsageStoreCheckpoints !== false
+            ? cursorEnvelopeEchoRemintScopeKey(
+                cursorClientThreadOwner(_parsed),
+                _parsed._cursorIdentityScope,
+              )
+            : null;
+        if (sawMidstreamEnvelopeEcho && !sawIncompleteToolCall && envelopeEchoRemintScopeKey) {
+          if (recordCursorEnvelopeEchoRemint(envelopeEchoRemintScopeKey)) {
+            if (inheritedCheckpointRef) invalidateCursorCheckpoint(inheritedCheckpointRef);
+            debugProviderDiagnostic("cursor", "midstream-envelope-echo-remint", {
+              wireModel: request.modelId,
+              conversationHash: request.conversationId.slice(0, 16),
+            });
+            remintConversationId(request.conversationId);
+          } else {
+            debugProviderDiagnostic("cursor", "midstream-envelope-echo-remint-exhausted", {
+              wireModel: request.modelId,
+              conversationHash: request.conversationId.slice(0, 16),
+            });
+          }
+        } else if (!sawMidstreamEnvelopeEcho && completedNormally && envelopeEchoRemintScopeKey) {
+          clearCursorEnvelopeEchoRemint(envelopeEchoRemintScopeKey);
+        }
         if (
           request.checkpointInvalidationReason
           && request.checkpointInvalidationReason !== "missing_ref"

package/src/adapters/devin/cloud-direct/chat.ts

@@ -35,7 +35,7 @@ import {
 } from './wire.js';
 import { buildMetadata } from './metadata.js';
 import { getCachedUserJwt } from './auth.js';
-import { getCachedCatalog, ModelNotAvailableError } from './catalog.js';
+import { getCachedCatalog, ModelNotAvailableError, type CacheEntry } from './catalog.js';
 import { anySignal, cancelBodyOnAbort } from '../../../lib/abort.js';
 import { resolveDevinApiBaseUrl } from '../../../oauth/devin/api-base.js';
 
@@ -1046,6 +1046,13 @@ export interface CloudChatRequest {
   completionOpts?: BuildArgs['completionOpts'];
   /** Override request_type (default = 5, CASCADE). */
   requestType?: number;
+  /**
+   * Catalog the caller already resolved this turn. An explicit `null`
+   * records a failed lookup: the pre-flight below then skips its own fetch
+   * instead of paying a second catalog timeout on the same turn. Omit the
+   * field to let the pre-flight perform its own cached lookup.
+   */
+  catalog?: CacheEntry | null;
   /** Abort signal — closes the fetch stream. */
   signal?: AbortSignal;
 }
@@ -1140,7 +1147,9 @@ export async function* streamChatEvents(req: CloudChatRequest): AsyncGenerator<C
   // error and the trailer-error path below enriches the message in-place.
   // Treat an empty catalog (schema drift / unexpected response) as "no catalog"
   // so chat passes through instead of failing every request.
-  const catalog = await getCachedCatalog(req.apiKey, host, req.signal).catch(() => null);
+  const catalog = req.catalog !== undefined
+    ? req.catalog
+    : await getCachedCatalog(req.apiKey, host, req.signal).catch(() => null);
   if (catalog && catalog.byUid.size > 0) {
     const entry = catalog.byUid.get(req.modelUid);
     if (!entry) {

package/src/adapters/devin/cloud-direct/index.ts

@@ -49,6 +49,13 @@ export {
   type ToolDef,
 } from './chat.js';
 
+export {
+  streamChatEventsWithResetRetry,
+  STATED_RESET_MAX_REPLAYS,
+  STATED_RESET_MAX_WAIT_MS,
+  type StatedResetRetryOptions,
+} from './stated-reset-retry.js';
+
 export {
   mintUserJwt,
   getCachedUserJwt,

package/src/adapters/devin/cloud-direct/stated-reset-retry.ts

@@ -0,0 +1,103 @@
+/**
+ * Same-target retry of an explicit, pre-output 429 refusal with a stated
+ * recovery delay. No event-producing attempt is ever automatically replayed.
+ * This is a refusal-specific policy, not a claim that every eventless POST
+ * is idempotent; ambiguous transport failures still propagate unchanged.
+ */
+import { parseRetryAfterFromMessage } from '../../../lib/retry-delay.js';
+import { abortError, sleepWithAbort } from '../../../lib/upstream-retry.js';
+import { CloudChatError, streamChatEvents, type CloudChatEvent, type CloudChatRequest } from './chat.js';
+
+/** 1 initial attempt plus at most 2 replays. */
+export const STATED_RESET_MAX_REPLAYS = 2;
+/** Default cumulative wait allowance for one invocation (30 minutes). */
+export const STATED_RESET_MAX_WAIT_MS = 1_800_000;
+/** Absolute maximum cumulative allowance, including explicit overrides. */
+export const STATED_RESET_WAIT_CEILING_MS = 3_600_000;
+
+function statedResetMaxWaitMs(): number {
+  const raw = process.env.OPENCODEX_DEVIN_STATED_RESET_WAIT_MS?.trim();
+  if (!raw) return STATED_RESET_MAX_WAIT_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) return STATED_RESET_MAX_WAIT_MS;
+  // Zero explicitly disables local waiting. Values above one hour are capped.
+  return Math.min(Math.floor(parsed), STATED_RESET_WAIT_CEILING_MS);
+}
+export const statedResetMaxWaitMsForTests = statedResetMaxWaitMs;
+
+export interface StatedResetRetryOptions {
+  /** Test seam: defaults to the real cloud stream. */
+  stream?: (req: CloudChatRequest) => AsyncGenerator<CloudChatEvent>;
+  /** Test seam: must either honour the whole delay or reject on cancellation. */
+  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+  maxReplays?: number;
+  /** CUMULATIVE wait allowance, not a fresh allowance on every failure. */
+  maxWaitMs?: number;
+}
+
+function replayLimit(value: number | undefined): number {
+  if (value === undefined) return STATED_RESET_MAX_REPLAYS;
+  if (!Number.isInteger(value) || value < 0 || value > STATED_RESET_MAX_REPLAYS) {
+    throw new RangeError('maxReplays must be an integer from 0 to 2');
+  }
+  return value;
+}
+
+function waitLimit(value: number | undefined): number {
+  if (value === undefined) return statedResetMaxWaitMs();
+  if (!Number.isFinite(value) || value < 0) {
+    throw new RangeError('maxWaitMs must be a finite non-negative number');
+  }
+  return Math.min(Math.floor(value), STATED_RESET_WAIT_CEILING_MS);
+}
+
+export async function* streamChatEventsWithResetRetry(
+  req: CloudChatRequest,
+  options?: StatedResetRetryOptions,
+): AsyncGenerator<CloudChatEvent> {
+  const stream = options?.stream ?? streamChatEvents;
+  const sleep = options?.sleep ?? sleepWithAbort;
+  const maxReplays = replayLimit(options?.maxReplays);
+  const maxWaitMs = waitLimit(options?.maxWaitMs);
+  let replays = 0;
+  let waitedMs = 0;
+  while (true) {
+    // Check again after sleeping: cancellation can race with timer completion.
+    // A pre-aborted request must not even enter a custom transport.
+    if (req.signal?.aborted) throw abortError(req.signal);
+    let yielded = false;
+    try {
+      for await (const event of stream(req)) {
+        // Latch before yielding, so a consumer-injected error is post-output.
+        yielded = true;
+        yield event;
+      }
+      return;
+    } catch (error) {
+      if (req.signal?.aborted) throw abortError(req.signal);
+      const waitSec = !yielded
+        && error instanceof CloudChatError
+        && error.status === 429
+        ? parseRetryAfterFromMessage(error.message)
+        : undefined;
+      const waitMs = waitSec === undefined ? undefined : waitSec * 1000;
+      if (
+        waitMs === undefined
+        || replays >= maxReplays
+        || waitMs > maxWaitMs - waitedMs
+      ) {
+        // Never shorten a provider's minimum delay to fit the local budget.
+        // Keep the original refusal so outer policy can preserve its metadata.
+        throw error;
+      }
+      replays += 1;
+      // Charge the complete scheduled wait once, before sleeping. This is a
+      // sleep allowance, not a wall-clock deadline on generation or timer
+      // scheduling: waking a few milliseconds late must not reject an already
+      // approved one-hour retry. No later wait can spend this allowance again.
+      waitedMs += waitMs;
+      await sleep(waitMs, req.signal);
+      if (req.signal?.aborted) throw abortError(req.signal);
+    }
+  }
+}

package/src/adapters/devin.ts

@@ -9,9 +9,9 @@
 import type { AdapterEvent, OcxAssistantMessage, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTool, OcxToolCall, OcxToolResultMessage, OcxUsage } from "../types";
 import { namespacedToolName } from "../types";
 import type { IncomingMeta, ProviderAdapter } from "./base";
-import { streamChatEvents, allocateCascadeId, CloudChatError, type ChatHistoryItem, type ToolDef } from "./devin/cloud-direct";
+import { streamChatEventsWithResetRetry, allocateCascadeId, CloudChatError, type ChatHistoryItem, type ToolDef } from "./devin/cloud-direct";
 import type { ContentPart } from "./devin/cloud-direct/chat";
-import { getCachedCatalog } from "./devin/cloud-direct/catalog";
+import { getCachedCatalog, type CacheEntry } from "./devin/cloud-direct/catalog";
 import { collapseDevinModelUid } from "./devin/live-models";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiServer } from "../oauth/devin";
@@ -155,6 +155,7 @@ async function resolveWireModelUid(
   apiKey: string,
   host: string,
   reasoningEffort?: string,
+  catalog?: CacheEntry | null,
 ): Promise<string> {
   const modelId = normalizeDevinModelId(rawModelId);
   // Explicit effort wins over a suffix the picker already baked into the id, so
@@ -163,15 +164,18 @@ async function resolveWireModelUid(
   const swe2 = resolveSwe2Variant(modelId, reasoningEffort);
   if (swe2) return swe2;
   if (hasEffortSuffix(modelId)) return modelId;
-  const catalog = await getCachedCatalog(apiKey, host);
-  if (catalog) {
-    if (catalog.byUid.has(modelId)) return modelId;
+  // Callers that already read the catalog this turn pass it in; an explicit
+  // null records a failed lookup and must not trigger a same-turn retry —
+  // failures are not cached, so re-reading would only pay another timeout.
+  const entry = catalog !== undefined ? catalog : await getCachedCatalog(apiKey, host);
+  if (entry) {
+    if (entry.byUid.has(modelId)) return modelId;
     const effort = reasoningEffort && CALLER_EFFORT_VALUES.has(reasoningEffort) ? reasoningEffort : "medium";
     const suffixed = `${modelId}-${effort}`;
-    if (catalog.byUid.has(suffixed)) return suffixed;
+    if (entry.byUid.has(suffixed)) return suffixed;
     // Fall back to any enabled variant of this base model.
-    for (const uid of catalog.byUid.keys()) {
-      if (uid.startsWith(modelId + "-") && !catalog.byUid.get(uid)?.disabled) return uid;
+    for (const uid of entry.byUid.keys()) {
+      if (uid.startsWith(modelId + "-") && !entry.byUid.get(uid)?.disabled) return uid;
     }
   }
   // Degraded mode: append the default effort suffix.
@@ -186,6 +190,46 @@ async function resolveWireModelUid(
  */
 export const resolveWireModelUidForTests = resolveWireModelUid;
 
+/**
+ * Resolve the INPUT ceiling for the exact UID selected for this turn. Catalog
+ * ClientModelConfig #18 and CompletionConfiguration #3 both carry input tokens;
+ * the independent output cap is not subtracted here. Smaller operator hints
+ * cap live evidence, never enlarge it. No evidence leaves the encoder's 128k
+ * fallback intact; an unrelated or opt-in long-context variant is not evidence.
+ */
+function resolveDevinMaxInputTokens(
+  provider: OcxProviderConfig,
+  modelUid: string,
+  liveWindow?: number,
+): number | undefined {
+  const positive = (value: unknown): number | undefined =>
+    typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+  const baseId = collapseDevinModelUid(modelUid);
+  const configured = (record: Record<string, number> | undefined): number | undefined => {
+    if (!record) return undefined;
+    for (const id of [modelUid, baseId]) {
+      // Prefer the canonical spelling; retain dotted/case-folded saved hints,
+      // matching the model-id normalization used for the inference request.
+      const exact = Object.hasOwn(record, id) ? positive(record[id]) : undefined;
+      if (exact !== undefined) return exact;
+      const matches = Object.entries(record)
+        .filter(([key]) => normalizeDevinModelId(key).toLowerCase() === id.toLowerCase())
+        .map(([, value]) => positive(value))
+        .filter((value): value is number => value !== undefined);
+      if (matches.length > 0) return Math.min(...matches);
+    }
+    return undefined;
+  };
+  const contextHint = configured(provider.modelContextWindows) ?? positive(provider.contextWindow);
+  const inputHint = configured(provider.modelMaxInputTokens);
+  const ceilings = [positive(liveWindow), contextHint, inputHint]
+    .filter((value): value is number => value !== undefined);
+  return ceilings.length > 0 ? Math.min(...ceilings) : undefined;
+}
+
+/** Pure test seam; runtime uses the same resolver immediately before dispatch. */
+export const resolveDevinMaxInputTokensForTests = resolveDevinMaxInputTokens;
+
 export class DevinMissingCredentialError extends Error {
   constructor() {
     super("Devin live transport requires a Devin API key. Run ocx login devin to sign in with your Cognition/Devin account.");
@@ -493,7 +537,16 @@ export function createDevinAdapter(
       // entry: an EU or FedStart account that used provider.baseUrl would send
       // every RPC to the US server it is not provisioned on.
       const host = resolveDevinApiServer(provider.baseUrl, credentialProviderId);
-      const modelUid = await resolveWireModelUid(rawModelId, apiKey, host, parsed.options.reasoning);
+      // One catalog read per turn serves model-UID resolution, the input
+      // ceiling, and the chat pre-flight inside streamChatEvents. Failures are
+      // not cached, so a second read would only pay another fetch timeout on
+      // an otherwise valid turn.
+      const catalog = await getCachedCatalog(apiKey, host, incoming.abortSignal);
+      if (incoming.abortSignal?.aborted) {
+        emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false });
+        return;
+      }
+      const modelUid = await resolveWireModelUid(rawModelId, apiKey, host, parsed.options.reasoning, catalog);
       const returnedToolNames = buildDevinReturnedToolNameMap(parsed.context.tools);
       let openToolId: string | undefined;
       let usage: OcxUsage | undefined;
@@ -506,17 +559,26 @@ export function createDevinAdapter(
       };
 
       try {
-        for await (const event of streamChatEvents({
+        // Read the selected UID's catalog row, not the picker's collapsed base.
+        const maxInputTokens = resolveDevinMaxInputTokens(
+          provider, modelUid, catalog?.byUid.get(modelUid)?.contextWindow,
+        );
+        // The reset-retry wrapper waits out a 429 that states its own recovery
+        // delay ("limit will reset in 35 seconds") and replays the identical
+        // request — but only while zero events have been yielded, so a
+        // post-output failure still takes the terminal path untouched.
+        for await (const event of streamChatEventsWithResetRetry({
           apiKey,
           apiServerUrl: host,
           modelUid,
+          catalog,
           messages: mapOcxMessagesToDevin(parsed),
           tools: mapOcxToolsToDevin(parsed.context.tools),
           cascadeId,
-          // Without these the request falls back to the encoder's defaults
-          // (8192 output, a 128k context window, temperature 0.7), so a client
-          // that asked for a 4k cap never got one.
+          // Input and output ceilings are separate wire fields. Omitting the
+          // input hint used to force every model through the 128k default.
           completionOpts: {
+            ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
             ...(typeof parsed.options.maxOutputTokens === "number" ? { maxOutputTokens: parsed.options.maxOutputTokens } : {}),
             ...(typeof parsed.options.temperature === "number" ? { temperature: parsed.options.temperature } : {}),
             ...(typeof parsed.options.topP === "number" ? { topP: parsed.options.topP } : {}),

package/src/adapters/google-antigravity-wire.ts

@@ -97,8 +97,35 @@ export function antigravitySessionId(parsed: OcxParsedRequest): string {
  * collision, is the failure mode this function exists to prevent.
  */
 function clientThreadAnchor(parsed: OcxParsedRequest): string | undefined {
-  const threadId = parsed._clientThreadId?.trim();
-  return threadId ? `codex-thread:${threadId}` : undefined;
+  // `_clientThreadId` carries `x-codex-parent-thread-id`, which every parallel child of one
+  // parent presents identically, so anchoring on it alone collapsed concurrent children onto a
+  // single upstream Cloud Code Assist session (#5033).
+  //
+  // A thread id is only unique WITHIN its parent, which is why `codexConversationIdentity` keys
+  // on both. #5054 anchored on the child alone and therefore only moved the collision: two
+  // parents can each have a child of the same id (#5058). The pair is the identity, joined by a
+  // NUL so the encoding is injective: no Codex id contains one, so a pair cannot be re-read as a
+  // different pair, nor as the parent-only anchor below.
+  //
+  // Deliberately NOT the general lane key: `codexConversationKeyFor` is an HMAC under a
+  // process-random secret, so it changes across a proxy restart — and instability, not sharing,
+  // is the failure mode this derivation has to avoid. These ids are Codex's own values and
+  // survive both compaction and restart.
+  const own = parsed._codexOwnThreadId?.trim();
+  const parent = parsed._clientThreadId?.trim();
+  if (own && parent) return `codex-thread:${parent}\u0000${own}`;
+  // Parent-only clients keep the anchor they already had.
+  if (parent) return `codex-thread:${parent}`;
+  // A parentless ROOT deliberately omits the parent header. `src/server/context-history.ts` says
+  // so in as many words: root model requests use (session-id=root, thread-id=root) and do not
+  // fabricate a parent key. It has no pair to key on, and #5054's claim that a root presents
+  // `thread-id` equal to its parent was simply wrong.
+  //
+  // So it keeps the pre-#5054 anchor rather than gaining an own-thread one. That is not a
+  // preference: durable Antigravity replay state is keyed by model plus session id, and moving a
+  // root's anchor on upgrade strands every signature stored under the old session — the exact
+  // instability this derivation exists to avoid, introduced while fixing sharing.
+  return undefined;
 }
 
 /** A Gemini content part as it appears in an Antigravity request body. */

package/src/adapters/google-http.ts

@@ -1,4 +1,7 @@
 import type { AdapterFetchContext, AdapterRequest } from "./base";
+import { createAdapterPhysicalSend } from "./physical-send";
+import type { SendClass } from "../lib/request-execution-budget";
+import type { AttemptRecoveryKind } from "../usage/log";
 import { isQuotaExhaustedBody, retryableGoogleStatus, safeGoogleHttpErrorMessage } from "./google-errors";
 import { repairGoogleInvalidRequestBody } from "./google-wire-compiler";
 import { normalizeUpstreamHttpErrorResponse, readDisplaySafeErrorPayloadText } from "./upstream-http-error";
@@ -8,6 +11,8 @@ import {
   fetchWithAttemptDeadline,
   retryBackoffDelayMs,
   sleepWithAbort,
+  SendBudgetExhaustedError,
+  isConnectionResetError,
 } from "../lib/upstream-retry";
 
 const GOOGLE_RETRY_ATTEMPTS = 3;
@@ -41,18 +46,30 @@ export async function fetchGoogleWithRetry(
 ): Promise<Response> {
   const repairInvalid400 = opts.repairInvalid400 ?? true;
   const timeoutMs = ctx.timeoutMs ?? 200_000;
-  const executor = ctx.executor ?? globalThis.fetch;
+  const send = createAdapterPhysicalSend(ctx);
   let lastError: unknown;
   let activeRequest = request;
   let compatibilityReplayUsed = false;
+  let pendingResponse: Response | undefined;
+  let retryDelayMs = 0;
+  let sendClass: SendClass = "transient";
+  let recovery: AttemptRecoveryKind | undefined;
   for (let attempt = 0; attempt < GOOGLE_RETRY_ATTEMPTS; attempt++) {
     if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
     try {
-      const res = await fetchWithAttemptDeadline(activeRequest.url, {
-        method: activeRequest.method,
-        headers: activeRequest.headers,
-        body: activeRequest.body,
-      }, timeoutMs, ctx.abortSignal, ctx.stream, executor);
+      const res = await send({ url: activeRequest.url, sendClass, recovery,
+        beforeDispatch: async () => {
+          if (retryDelayMs > 0) await sleepWithAbort(retryDelayMs, ctx.abortSignal);
+          if (pendingResponse) cancelResponseBodyBestEffort(pendingResponse);
+          pendingResponse = undefined;
+        },
+        dispatch: executor => fetchWithAttemptDeadline(activeRequest.url, {
+          method: activeRequest.method, headers: activeRequest.headers, body: activeRequest.body,
+        }, timeoutMs, ctx.abortSignal, ctx.stream, executor),
+      });
+      retryDelayMs = 0;
+      sendClass = "transient";
+      recovery = undefined;
       if (res.status === 400 && repairInvalid400 && !compatibilityReplayUsed) {
         let payloadText = "";
         try {
@@ -64,7 +81,8 @@ export async function fetchGoogleWithRetry(
         if (repairedBody !== undefined) {
           compatibilityReplayUsed = true;
           activeRequest = { ...activeRequest, body: repairedBody };
-          cancelResponseBodyBestEffort(res);
+          pendingResponse = res;
+          sendClass = "repair";
           attempt--; // The changed-request replay is separate from transient retry accounting.
           continue;
         }
@@ -75,7 +93,7 @@ export async function fetchGoogleWithRetry(
       // A 429 may be a transient rate limit (retry) or hard quota exhaustion (do NOT retry —
       // it won't recover for hours and burns retries). Peek the body to tell them apart.
       if (res.status === 429) {
-        const peekTarget = ctx.returnRawErrors ? res.clone() : res;
+        const peekTarget = res.clone();
         const peek = await readDisplaySafeErrorPayloadText(peekTarget, ctx.abortSignal);
         if (isQuotaExhaustedBody(peek)) {
           return ctx.returnRawErrors ? res : normalizeUpstreamHttpErrorResponse(res, {
@@ -84,20 +102,34 @@ export async function fetchGoogleWithRetry(
           });
         }
       }
-      cancelResponseBodyBestEffort(res);
-      await sleepWithAbort(retryBackoffDelayMs(attempt, {
+      pendingResponse = res;
+      recovery = res.status === 429 ? "rate-limit-429" : "transient-5xx";
+      retryDelayMs = retryBackoffDelayMs(attempt, {
         baseDelayMs: GOOGLE_RETRY_BASE_MS,
         maxDelayMs: GOOGLE_RETRY_MAX_MS,
         headers: res.headers,
-      }), ctx.abortSignal);
+      });
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;
+      if (err instanceof SendBudgetExhaustedError) {
+        if (pendingResponse) {
+          // The ladder had already classified this response as retryable and was about to send
+          // again; the budget refused. Returning the original response is right — it is a real
+          // upstream answer — but it used to leave the log indistinguishable from a request
+          // where no retry was ever eligible (#5044).
+          ctx.onRecoveryWithheld?.({ reason: "retry-send-budget" });
+          return ctx.returnRawErrors ? pendingResponse : normalizeFinalGoogleError(label, pendingResponse, ctx.abortSignal);
+        }
+        throw err;
+      }
       lastError = err;
       if (attempt === GOOGLE_RETRY_ATTEMPTS - 1) throw err;
-      await sleepWithAbort(retryBackoffDelayMs(attempt, {
+      sendClass = "transient";
+      recovery = isConnectionResetError(err) ? "connection-reset" : undefined;
+      retryDelayMs = retryBackoffDelayMs(attempt, {
         baseDelayMs: GOOGLE_RETRY_BASE_MS,
         maxDelayMs: GOOGLE_RETRY_MAX_MS,
-      }), ctx.abortSignal);
+      });
     }
   }
   throw lastError ?? new Error(`${label} fetch failed`);