@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/adapters/devin/cloud-direct/stated-reset-retry.ts

@@ -0,0 +1,103 @@
+/**
+ * Same-target retry of an explicit, pre-output 429 refusal with a stated
+ * recovery delay. No event-producing attempt is ever automatically replayed.
+ * This is a refusal-specific policy, not a claim that every eventless POST
+ * is idempotent; ambiguous transport failures still propagate unchanged.
+ */
+import { parseRetryAfterFromMessage } from '../../../lib/retry-delay.js';
+import { abortError, sleepWithAbort } from '../../../lib/upstream-retry.js';
+import { CloudChatError, streamChatEvents, type CloudChatEvent, type CloudChatRequest } from './chat.js';
+
+/** 1 initial attempt plus at most 2 replays. */
+export const STATED_RESET_MAX_REPLAYS = 2;
+/** Default cumulative wait allowance for one invocation (30 minutes). */
+export const STATED_RESET_MAX_WAIT_MS = 1_800_000;
+/** Absolute maximum cumulative allowance, including explicit overrides. */
+export const STATED_RESET_WAIT_CEILING_MS = 3_600_000;
+
+function statedResetMaxWaitMs(): number {
+  const raw = process.env.OPENCODEX_DEVIN_STATED_RESET_WAIT_MS?.trim();
+  if (!raw) return STATED_RESET_MAX_WAIT_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) return STATED_RESET_MAX_WAIT_MS;
+  // Zero explicitly disables local waiting. Values above one hour are capped.
+  return Math.min(Math.floor(parsed), STATED_RESET_WAIT_CEILING_MS);
+}
+export const statedResetMaxWaitMsForTests = statedResetMaxWaitMs;
+
+export interface StatedResetRetryOptions {
+  /** Test seam: defaults to the real cloud stream. */
+  stream?: (req: CloudChatRequest) => AsyncGenerator<CloudChatEvent>;
+  /** Test seam: must either honour the whole delay or reject on cancellation. */
+  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+  maxReplays?: number;
+  /** CUMULATIVE wait allowance, not a fresh allowance on every failure. */
+  maxWaitMs?: number;
+}
+
+function replayLimit(value: number | undefined): number {
+  if (value === undefined) return STATED_RESET_MAX_REPLAYS;
+  if (!Number.isInteger(value) || value < 0 || value > STATED_RESET_MAX_REPLAYS) {
+    throw new RangeError('maxReplays must be an integer from 0 to 2');
+  }
+  return value;
+}
+
+function waitLimit(value: number | undefined): number {
+  if (value === undefined) return statedResetMaxWaitMs();
+  if (!Number.isFinite(value) || value < 0) {
+    throw new RangeError('maxWaitMs must be a finite non-negative number');
+  }
+  return Math.min(Math.floor(value), STATED_RESET_WAIT_CEILING_MS);
+}
+
+export async function* streamChatEventsWithResetRetry(
+  req: CloudChatRequest,
+  options?: StatedResetRetryOptions,
+): AsyncGenerator<CloudChatEvent> {
+  const stream = options?.stream ?? streamChatEvents;
+  const sleep = options?.sleep ?? sleepWithAbort;
+  const maxReplays = replayLimit(options?.maxReplays);
+  const maxWaitMs = waitLimit(options?.maxWaitMs);
+  let replays = 0;
+  let waitedMs = 0;
+  while (true) {
+    // Check again after sleeping: cancellation can race with timer completion.
+    // A pre-aborted request must not even enter a custom transport.
+    if (req.signal?.aborted) throw abortError(req.signal);
+    let yielded = false;
+    try {
+      for await (const event of stream(req)) {
+        // Latch before yielding, so a consumer-injected error is post-output.
+        yielded = true;
+        yield event;
+      }
+      return;
+    } catch (error) {
+      if (req.signal?.aborted) throw abortError(req.signal);
+      const waitSec = !yielded
+        && error instanceof CloudChatError
+        && error.status === 429
+        ? parseRetryAfterFromMessage(error.message)
+        : undefined;
+      const waitMs = waitSec === undefined ? undefined : waitSec * 1000;
+      if (
+        waitMs === undefined
+        || replays >= maxReplays
+        || waitMs > maxWaitMs - waitedMs
+      ) {
+        // Never shorten a provider's minimum delay to fit the local budget.
+        // Keep the original refusal so outer policy can preserve its metadata.
+        throw error;
+      }
+      replays += 1;
+      // Charge the complete scheduled wait once, before sleeping. This is a
+      // sleep allowance, not a wall-clock deadline on generation or timer
+      // scheduling: waking a few milliseconds late must not reject an already
+      // approved one-hour retry. No later wait can spend this allowance again.
+      waitedMs += waitMs;
+      await sleep(waitMs, req.signal);
+      if (req.signal?.aborted) throw abortError(req.signal);
+    }
+  }
+}

package/src/adapters/devin.ts

@@ -9,9 +9,9 @@
 import type { AdapterEvent, OcxAssistantMessage, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTool, OcxToolCall, OcxToolResultMessage, OcxUsage } from "../types";
 import { namespacedToolName } from "../types";
 import type { IncomingMeta, ProviderAdapter } from "./base";
-import { streamChatEvents, allocateCascadeId, CloudChatError, type ChatHistoryItem, type ToolDef } from "./devin/cloud-direct";
+import { streamChatEventsWithResetRetry, allocateCascadeId, CloudChatError, type ChatHistoryItem, type ToolDef } from "./devin/cloud-direct";
 import type { ContentPart } from "./devin/cloud-direct/chat";
-import { getCachedCatalog } from "./devin/cloud-direct/catalog";
+import { getCachedCatalog, type CacheEntry } from "./devin/cloud-direct/catalog";
 import { collapseDevinModelUid } from "./devin/live-models";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiServer } from "../oauth/devin";
@@ -155,6 +155,7 @@ async function resolveWireModelUid(
   apiKey: string,
   host: string,
   reasoningEffort?: string,
+  catalog?: CacheEntry | null,
 ): Promise<string> {
   const modelId = normalizeDevinModelId(rawModelId);
   // Explicit effort wins over a suffix the picker already baked into the id, so
@@ -163,15 +164,18 @@ async function resolveWireModelUid(
   const swe2 = resolveSwe2Variant(modelId, reasoningEffort);
   if (swe2) return swe2;
   if (hasEffortSuffix(modelId)) return modelId;
-  const catalog = await getCachedCatalog(apiKey, host);
-  if (catalog) {
-    if (catalog.byUid.has(modelId)) return modelId;
+  // Callers that already read the catalog this turn pass it in; an explicit
+  // null records a failed lookup and must not trigger a same-turn retry —
+  // failures are not cached, so re-reading would only pay another timeout.
+  const entry = catalog !== undefined ? catalog : await getCachedCatalog(apiKey, host);
+  if (entry) {
+    if (entry.byUid.has(modelId)) return modelId;
     const effort = reasoningEffort && CALLER_EFFORT_VALUES.has(reasoningEffort) ? reasoningEffort : "medium";
     const suffixed = `${modelId}-${effort}`;
-    if (catalog.byUid.has(suffixed)) return suffixed;
+    if (entry.byUid.has(suffixed)) return suffixed;
     // Fall back to any enabled variant of this base model.
-    for (const uid of catalog.byUid.keys()) {
-      if (uid.startsWith(modelId + "-") && !catalog.byUid.get(uid)?.disabled) return uid;
+    for (const uid of entry.byUid.keys()) {
+      if (uid.startsWith(modelId + "-") && !entry.byUid.get(uid)?.disabled) return uid;
     }
   }
   // Degraded mode: append the default effort suffix.
@@ -186,6 +190,46 @@ async function resolveWireModelUid(
  */
 export const resolveWireModelUidForTests = resolveWireModelUid;
 
+/**
+ * Resolve the INPUT ceiling for the exact UID selected for this turn. Catalog
+ * ClientModelConfig #18 and CompletionConfiguration #3 both carry input tokens;
+ * the independent output cap is not subtracted here. Smaller operator hints
+ * cap live evidence, never enlarge it. No evidence leaves the encoder's 128k
+ * fallback intact; an unrelated or opt-in long-context variant is not evidence.
+ */
+function resolveDevinMaxInputTokens(
+  provider: OcxProviderConfig,
+  modelUid: string,
+  liveWindow?: number,
+): number | undefined {
+  const positive = (value: unknown): number | undefined =>
+    typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+  const baseId = collapseDevinModelUid(modelUid);
+  const configured = (record: Record<string, number> | undefined): number | undefined => {
+    if (!record) return undefined;
+    for (const id of [modelUid, baseId]) {
+      // Prefer the canonical spelling; retain dotted/case-folded saved hints,
+      // matching the model-id normalization used for the inference request.
+      const exact = Object.hasOwn(record, id) ? positive(record[id]) : undefined;
+      if (exact !== undefined) return exact;
+      const matches = Object.entries(record)
+        .filter(([key]) => normalizeDevinModelId(key).toLowerCase() === id.toLowerCase())
+        .map(([, value]) => positive(value))
+        .filter((value): value is number => value !== undefined);
+      if (matches.length > 0) return Math.min(...matches);
+    }
+    return undefined;
+  };
+  const contextHint = configured(provider.modelContextWindows) ?? positive(provider.contextWindow);
+  const inputHint = configured(provider.modelMaxInputTokens);
+  const ceilings = [positive(liveWindow), contextHint, inputHint]
+    .filter((value): value is number => value !== undefined);
+  return ceilings.length > 0 ? Math.min(...ceilings) : undefined;
+}
+
+/** Pure test seam; runtime uses the same resolver immediately before dispatch. */
+export const resolveDevinMaxInputTokensForTests = resolveDevinMaxInputTokens;
+
 export class DevinMissingCredentialError extends Error {
   constructor() {
     super("Devin live transport requires a Devin API key. Run ocx login devin to sign in with your Cognition/Devin account.");
@@ -493,7 +537,16 @@ export function createDevinAdapter(
       // entry: an EU or FedStart account that used provider.baseUrl would send
       // every RPC to the US server it is not provisioned on.
       const host = resolveDevinApiServer(provider.baseUrl, credentialProviderId);
-      const modelUid = await resolveWireModelUid(rawModelId, apiKey, host, parsed.options.reasoning);
+      // One catalog read per turn serves model-UID resolution, the input
+      // ceiling, and the chat pre-flight inside streamChatEvents. Failures are
+      // not cached, so a second read would only pay another fetch timeout on
+      // an otherwise valid turn.
+      const catalog = await getCachedCatalog(apiKey, host, incoming.abortSignal);
+      if (incoming.abortSignal?.aborted) {
+        emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false });
+        return;
+      }
+      const modelUid = await resolveWireModelUid(rawModelId, apiKey, host, parsed.options.reasoning, catalog);
       const returnedToolNames = buildDevinReturnedToolNameMap(parsed.context.tools);
       let openToolId: string | undefined;
       let usage: OcxUsage | undefined;
@@ -506,17 +559,26 @@ export function createDevinAdapter(
       };
 
       try {
-        for await (const event of streamChatEvents({
+        // Read the selected UID's catalog row, not the picker's collapsed base.
+        const maxInputTokens = resolveDevinMaxInputTokens(
+          provider, modelUid, catalog?.byUid.get(modelUid)?.contextWindow,
+        );
+        // The reset-retry wrapper waits out a 429 that states its own recovery
+        // delay ("limit will reset in 35 seconds") and replays the identical
+        // request — but only while zero events have been yielded, so a
+        // post-output failure still takes the terminal path untouched.
+        for await (const event of streamChatEventsWithResetRetry({
           apiKey,
           apiServerUrl: host,
           modelUid,
+          catalog,
           messages: mapOcxMessagesToDevin(parsed),
           tools: mapOcxToolsToDevin(parsed.context.tools),
           cascadeId,
-          // Without these the request falls back to the encoder's defaults
-          // (8192 output, a 128k context window, temperature 0.7), so a client
-          // that asked for a 4k cap never got one.
+          // Input and output ceilings are separate wire fields. Omitting the
+          // input hint used to force every model through the 128k default.
           completionOpts: {
+            ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
             ...(typeof parsed.options.maxOutputTokens === "number" ? { maxOutputTokens: parsed.options.maxOutputTokens } : {}),
             ...(typeof parsed.options.temperature === "number" ? { temperature: parsed.options.temperature } : {}),
             ...(typeof parsed.options.topP === "number" ? { topP: parsed.options.topP } : {}),

package/src/adapters/google-antigravity-wire.ts

@@ -97,8 +97,35 @@ export function antigravitySessionId(parsed: OcxParsedRequest): string {
  * collision, is the failure mode this function exists to prevent.
  */
 function clientThreadAnchor(parsed: OcxParsedRequest): string | undefined {
-  const threadId = parsed._clientThreadId?.trim();
-  return threadId ? `codex-thread:${threadId}` : undefined;
+  // `_clientThreadId` carries `x-codex-parent-thread-id`, which every parallel child of one
+  // parent presents identically, so anchoring on it alone collapsed concurrent children onto a
+  // single upstream Cloud Code Assist session (#5033).
+  //
+  // A thread id is only unique WITHIN its parent, which is why `codexConversationIdentity` keys
+  // on both. #5054 anchored on the child alone and therefore only moved the collision: two
+  // parents can each have a child of the same id (#5058). The pair is the identity, joined by a
+  // NUL so the encoding is injective: no Codex id contains one, so a pair cannot be re-read as a
+  // different pair, nor as the parent-only anchor below.
+  //
+  // Deliberately NOT the general lane key: `codexConversationKeyFor` is an HMAC under a
+  // process-random secret, so it changes across a proxy restart — and instability, not sharing,
+  // is the failure mode this derivation has to avoid. These ids are Codex's own values and
+  // survive both compaction and restart.
+  const own = parsed._codexOwnThreadId?.trim();
+  const parent = parsed._clientThreadId?.trim();
+  if (own && parent) return `codex-thread:${parent}\u0000${own}`;
+  // Parent-only clients keep the anchor they already had.
+  if (parent) return `codex-thread:${parent}`;
+  // A parentless ROOT deliberately omits the parent header. `src/server/context-history.ts` says
+  // so in as many words: root model requests use (session-id=root, thread-id=root) and do not
+  // fabricate a parent key. It has no pair to key on, and #5054's claim that a root presents
+  // `thread-id` equal to its parent was simply wrong.
+  //
+  // So it keeps the pre-#5054 anchor rather than gaining an own-thread one. That is not a
+  // preference: durable Antigravity replay state is keyed by model plus session id, and moving a
+  // root's anchor on upgrade strands every signature stored under the old session — the exact
+  // instability this derivation exists to avoid, introduced while fixing sharing.
+  return undefined;
 }
 
 /** A Gemini content part as it appears in an Antigravity request body. */

package/src/adapters/google-http.ts

@@ -112,7 +112,14 @@ export async function fetchGoogleWithRetry(
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;
       if (err instanceof SendBudgetExhaustedError) {
-        if (pendingResponse) return ctx.returnRawErrors ? pendingResponse : normalizeFinalGoogleError(label, pendingResponse, ctx.abortSignal);
+        if (pendingResponse) {
+          // The ladder had already classified this response as retryable and was about to send
+          // again; the budget refused. Returning the original response is right — it is a real
+          // upstream answer — but it used to leave the log indistinguishable from a request
+          // where no retry was ever eligible (#5044).
+          ctx.onRecoveryWithheld?.({ reason: "retry-send-budget" });
+          return ctx.returnRawErrors ? pendingResponse : normalizeFinalGoogleError(label, pendingResponse, ctx.abortSignal);
+        }
         throw err;
       }
       lastError = err;

package/src/adapters/google.ts

@@ -57,7 +57,6 @@ const GOOGLE_BREVITY_INSTRUCTION = [
 
 const ANTIGRAVITY_REJECTED_CLAUDE_SDK_PARAGRAPH =
   "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
-
 /**
  * CCA Flash generations that reject the Claude-Agent identity paragraph.
  *
@@ -102,6 +101,20 @@ function stripAntigravityRejectedClaudeSdkParagraph(systemText: string): string
     .join("\n\n");
 }
 
+/**
+ * Strips Claude Code CLI's internal billing header (`x-anthropic-billing-header: ...`)
+ * at the start of the system prompt, because Cloud Code Assist / Google Antigravity inspects
+ * `systemInstruction` and rejects requests containing Anthropic billing metadata with
+ * HTTP 429 RESOURCE_EXHAUSTED.
+ *
+ * Matching is restricted to the prompt start (`^` without the `/m` multiline flag) so that
+ * user prompts discussing billing headers in intermediate lines are never modified, and
+ * prompts without a billing header preserve their leading whitespace untouched.
+ */
+function stripAntigravityBillingHeader(systemText: string): string {
+  return systemText.replace(/^x-anthropic-billing-header:[^\n]*\n*/, "");
+}
+
 /**
  * Documented output ceiling for a Google-surface model, or `undefined` when the id is not
  * recognized.
@@ -276,6 +289,7 @@ function messagesToGeminiFormat(
   parsed: OcxParsedRequest,
   identityModelId: string,
   stripRejectedClaudeSdkParagraph = false,
+  isCloudCodeAssist = false,
 ): { systemInstruction?: unknown; contents: unknown[]; replayedCallIds: string[] } {
   // Neutralize Codex's GPT-5 identity line (Gemini/Antigravity share this path) so a routed model
   // never misreports as GPT-5/OpenAI, and never leaks the proxy identity upstream.
@@ -285,9 +299,12 @@ function messagesToGeminiFormat(
     ...(toolCatalogNudge ? [toolCatalogNudge] : []),
     GOOGLE_BREVITY_INSTRUCTION,
   ].join("\n\n"), identityModelId);
-  const systemText = stripRejectedClaudeSdkParagraph
-    ? stripAntigravityRejectedClaudeSdkParagraph(identifiedSystemText)
+  let systemText = isCloudCodeAssist
+    ? stripAntigravityBillingHeader(identifiedSystemText)
     : identifiedSystemText;
+  if (stripRejectedClaudeSdkParagraph) {
+    systemText = stripAntigravityRejectedClaudeSdkParagraph(systemText);
+  }
   const systemInstruction = { parts: [{ text: systemText }] };
 
   const contents: unknown[] = [];
@@ -833,12 +850,14 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         && /^gemini-/.test(routedModelId) && !isImageCapableModel(parsed.modelId);
       // AI Studio's `-tiered` spelling is wire-only; CCA aliases may migrate to another generation.
       const identityModelId = provider.googleMode === "cloud-code-assist" ? routedModelId : parsed.modelId;
-      const stripRejectedClaudeSdkParagraph = provider.googleMode === "cloud-code-assist"
+      const isCloudCodeAssist = provider.googleMode === "cloud-code-assist";
+      const stripRejectedClaudeSdkParagraph = isCloudCodeAssist
         && rejectsClaudeSdkParagraph(parsed.modelId, routedModelId);
       const { systemInstruction, contents, replayedCallIds } = messagesToGeminiFormat(
         parsed,
         identityModelId,
         stripRejectedClaudeSdkParagraph,
+        isCloudCodeAssist,
       );
       lastInjectedCallIds = [...replayedCallIds];
       lastReasoningReplayScope = parsed._reasoningReplayScope;

package/src/adapters/openai-chat/response-events.ts

@@ -1,4 +1,5 @@
 import { diagnoseInvalidToolCalls, isRecord, type InvalidToolCallDiagnostic } from "./tool-call-validation";
+import { TranslatorBudgetExceededError, type TranslatorBudget } from "../../lib/translator-budget";
 import type { AdapterEvent, OcxUsage } from "../../types";
 
 export function stopReasonFor(finishReason: unknown): "max_tokens" | "content_filter" | undefined {
@@ -22,6 +23,9 @@ export interface ReasoningDetailSegment {
   text: string;
 }
 
+const MAX_REASONING_DETAIL_KEY_BYTES = 1024;
+const MAX_REASONING_DETAIL_SEGMENTS = 1024;
+
 /**
  * Structured `reasoning_details` array (MiniMax M-series with `reasoning_split`).
  * Each segment's key scopes cumulative-snapshot tracking: upstream repeats the
@@ -35,6 +39,11 @@ export function reasoningDetailSegmentsFrom(record: Record<string, unknown>): Re
     const item: unknown = raw[i];
     if (!isRecord(item)) continue;
     if (typeof item.text !== "string" || item.text.length === 0) continue;
+    // Parsing retains nothing, so it rejects nothing. The non-streaming
+    // parseResponse path shares this function and reads only `text`; failing a
+    // whole valid response there because an opaque upstream id is long would be
+    // a new rejection unrelated to the retention bound. The key cap lives with
+    // the map that holds the key; see the tracker below.
     const key = typeof item.id === "string" && item.id.length > 0
       ? `id:${item.id}`
       : typeof item.index === "number"
@@ -45,6 +54,58 @@ export function reasoningDetailSegmentsFrom(record: Record<string, unknown>): Re
   return segments;
 }
 
+/**
+ * Per-stream cumulative-snapshot store for structured `reasoning_details`. Each stream chunk
+ * repeats a detail's full text-so-far, so deltas are derived by prefix-diffing per segment key;
+ * a piece that does not extend the previous snapshot is appended whole, which keeps incremental
+ * senders parseable on the same path. Retained key+text bytes are charged to the translator
+ * budget under the `reasoning` kind, and both the key length and the segment count are capped
+ * here, where the map actually retains them, so a hostile upstream cannot grow it without bound.
+ */
+export function createReasoningDetailSnapshotTracker(budget: TranslatorBudget): {
+  ingest(segment: ReasoningDetailSegment): string | null;
+  release(): void;
+} {
+  const snapshots = new Map<string, string>();
+  const encoder = new TextEncoder();
+  let retainedBytes = 0;
+  return {
+    ingest(segment) {
+      const existing = snapshots.get(segment.key);
+      if (existing === undefined && encoder.encode(segment.key).byteLength > MAX_REASONING_DETAIL_KEY_BYTES) {
+        throw new TranslatorBudgetExceededError("reasoning", MAX_REASONING_DETAIL_KEY_BYTES);
+      }
+      if (existing === undefined && snapshots.size >= MAX_REASONING_DETAIL_SEGMENTS) {
+        throw new TranslatorBudgetExceededError("reasoning", MAX_REASONING_DETAIL_SEGMENTS);
+      }
+      const prev = existing ?? "";
+      if (segment.text === prev) return null;
+      const extendsPrev = segment.text.startsWith(prev);
+      const next = extendsPrev ? segment.text : prev + segment.text;
+      const previousBytes = existing === undefined
+        ? 0
+        : encoder.encode(segment.key).byteLength + encoder.encode(prev).byteLength;
+      const nextBytes = encoder.encode(segment.key).byteLength + encoder.encode(next).byteLength;
+      const reservation = budget.reserveTransient(nextBytes, { kind: "reasoning" });
+      try {
+        snapshots.set(segment.key, next);
+        reservation.commitRetained();
+        budget.releaseRetained(previousBytes, { kind: "reasoning" });
+        retainedBytes += nextBytes - previousBytes;
+      } catch (error) {
+        reservation.release();
+        throw error;
+      }
+      return extendsPrev ? segment.text.slice(prev.length) : segment.text;
+    },
+    release() {
+      budget.releaseRetained(retainedBytes, { kind: "reasoning" });
+      retainedBytes = 0;
+      snapshots.clear();
+    },
+  };
+}
+
 /** Single-segment `reasoning_details` entry for replaying preserved reasoning (MiniMax wire shape). */
 export function reasoningDetailSegmentForWire(text: string): Record<string, unknown> {
   return { type: "reasoning.text", id: "reasoning-text-1", format: "MiniMax-response-v1", index: 0, text };

package/src/adapters/openai-chat.ts

@@ -23,6 +23,7 @@ import {
   type InvalidToolCallDiagnostic,
 } from "./openai-chat/tool-call-validation";
 import {
+  createReasoningDetailSnapshotTracker,
   invalidChoicesEvent,
   invalidToolCallsEvent,
   reasoningDetailSegmentsFrom,
@@ -385,7 +386,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       // full text-so-far, so deltas are derived by prefix-diffing per segment key.
       // A piece that does not extend the previous snapshot is appended whole, which
       // keeps incremental senders parseable on the same path.
-      const reasoningDetailSnapshots = new Map<string, string>();
+      const reasoningDetailTracker = createReasoningDetailSnapshotTracker(budget);
       // Gate on the routed model, not list length: a mixed openai-chat provider
       // can list MiniMax ids without putting every sibling on MiniMax semantics.
       const reasoningDetailsOptIn = modelInList(provider.reasoningDetailsModels, lastRequestedModelId ?? "");
@@ -448,15 +449,8 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
           const detailSegments = reasoningDetailsOptIn ? reasoningDetailSegmentsFrom(delta) : [];
           if (detailSegments.length > 0) {
             for (const segment of detailSegments) {
-              const prev = reasoningDetailSnapshots.get(segment.key) ?? "";
-              if (segment.text === prev) continue;
-              if (segment.text.startsWith(prev)) {
-                reasoningDetailSnapshots.set(segment.key, segment.text);
-                yield { type: "reasoning_raw_delta", text: segment.text.slice(prev.length) };
-              } else {
-                reasoningDetailSnapshots.set(segment.key, prev + segment.text);
-                yield { type: "reasoning_raw_delta", text: segment.text };
-              }
+              const reasoningDelta = reasoningDetailTracker.ingest(segment);
+              if (reasoningDelta !== null) yield { type: "reasoning_raw_delta", text: reasoningDelta };
             }
           } else {
             const reasoningText = reasoningTextFrom(delta);
@@ -692,6 +686,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         throw error;
       } finally {
         budget.releaseRetained(bufferBytes, { kind: "live_transient" });
+        reasoningDetailTracker.release();
         closeToolCalls();
         reader.releaseLock();
       }

package/src/adapters/openai-responses/passthrough.ts

@@ -36,7 +36,8 @@ import { scrubOcxCompactionItems, stripCanonicalOnlyToolFields, stripCanonicalOn
 import { stripCanonicalForwardPromptCacheOptions, stripDeprecatedPromptCacheRetention } from "./prompt-cache";
 import { isPlainObject } from "./internal";
 import { normalizeToolSchemas, promoteClientLoadedTools, stripUnsupportedHostedTools } from "./tool-schema";
-import { annotateEmptyResponsesToolOutputs, backfillWebSearchQueries, normalizeResponsesToolResultAdjacency, repairOrphanedInputItems, repairOversizedReplayCallIds, repairUnidentifiedToolOutputItems } from "./tool-output-recovery";
+import { annotateEmptyResponsesToolOutputs, backfillWebSearchQueries, normalizeResponsesToolResultAdjacency, repairOrphanedInputItems, repairOversizedReplayCallIds, repairUnidentifiedToolOutputItems, restoreBridgedWebSearchCalls } from "./tool-output-recovery";
+import { bridgeSearchReplayScope } from "../../responses/bridge-search-replay-cache";
 import { applyTierDecisionToResponsesBody, normalizeCanonicalForwardContinuationEnvelope, normalizeCanonicalForwardPromptEnvelope, stripCanonicalForwardSamplingParams, stripPreviousResponseId, stripStatefulResponsesParams, stripUnsupportedForwardParams } from "./canonical-forward";
 import { normalizeImageGenClientTools, preferConfiguredHostedTools } from "./image-gen";
 import { stripMuseSparkUnsupportedWebSearchFields, stripOpenAiOnlyWebSearchFields } from "./web-search";
@@ -321,6 +322,14 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         outBody = repairOversizedReplayCallIds(outBody);
       }
       outBody = stripUnsupportedReasoningSummaryDelivery(outBody, parsed.modelId);
+      // #4587: on a bridged provider, hand the destination back the search call and result the
+      // proxy executed on its behalf, in place of the hosted cell the caller replays. Scoped to
+      // this destination and recorded by the bridge itself, so a provider without the opt-in
+      // computes no identity and keeps the body reference it already had. This runs before the
+      // query backfill below because a restored cell is no longer a web_search_call to repair.
+      if (provider.webSearchBridge?.enabled === true) {
+        outBody = restoreBridgedWebSearchCalls(outBody, bridgeSearchReplayScope(provider.baseUrl));
+      }
       // Repair stored history from before the bridge emitted both keys, in either
       // direction: a conversation that already recorded a web_search_call replays it
       // every turn, and a strict parser rejects the whole request over the missing key —

package/src/adapters/openai-responses/tool-output-recovery.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { EMPTY_TOOL_OUTPUT_ANNOTATION, isWhitespaceOnlyTextPartArray } from "../empty-tool-output-annotation";
 import { isPlainObject } from "./internal";
+import { peekBridgeSearchReplay } from "../../responses/bridge-search-replay-cache";
 
 const MAX_RESPONSES_CALL_ID_LENGTH = 64;
 
@@ -265,6 +266,80 @@ export function backfillWebSearchQueries(body: unknown): unknown {
   return changed ? { ...body, input } : body;
 }
 
+/**
+ * Give a bridged destination back its own search call and result (issue #4587).
+ *
+ * When `providers.<name>.webSearchBridge` is armed, the proxy intercepts the destination's
+ * `function_call` named `web_search`, runs the search, and shows the CALLER a hosted
+ * `web_search_call` cell. The caller stores that cell and replays it on every later turn, so the
+ * destination receives an item type it never produced, carrying a query and sources but no result.
+ * It typically responds by searching again.
+ *
+ * This restores the exchange the destination actually had: the cell becomes the destination's own
+ * `function_call`, immediately followed by the `function_call_output` the bridge produced for
+ * it, in the cell's original position. It runs before the first leg of the next turn is
+ * dispatched, which is the only place it can run — by the time the bridge wraps a turn, that
+ * turn's first leg is already on the wire.
+ *
+ * Three things it deliberately does not do:
+ *   - It never re-runs a search. A missing memo entry means the result is gone, and paying for a
+ *     second search would answer the model with a different search than its history claims.
+ *   - It never invents result text. A miss leaves the item exactly as the caller sent it, which is
+ *     the behaviour every unbridged conversation already has.
+ *   - It never restores a call id the body already carries. If the history somehow holds that
+ *     `function_call` too, emitting a second one would be a duplicate the upstream must reject.
+ *
+ * Entries are scoped to the upstream destination, so a history replayed against a different
+ * provider cannot resurrect a call that provider never made. Callers pass `undefined` for any
+ * provider without the bridge armed, and the common path then returns the original reference.
+ */
+export function restoreBridgedWebSearchCalls(body: unknown, destinationScope: string | undefined): unknown {
+  if (destinationScope === undefined) return body;
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+  const input = body.input;
+
+  // Cheap pre-check: nothing to do for a conversation that carries no hosted search cell at all,
+  // which is every turn before the model's first bridged search.
+  let hasCell = false;
+  for (const item of input) {
+    if (isPlainObject(item) && item.type === "web_search_call" && typeof item.id === "string") {
+      hasCell = true;
+      break;
+    }
+  }
+  if (!hasCell) return body;
+
+  const occupiedCallIds = new Set<string>();
+  for (const item of input) {
+    if (isPlainObject(item) && typeof item.call_id === "string") occupiedCallIds.add(item.call_id);
+  }
+
+  let changed = false;
+  const restored: unknown[] = [];
+  for (const item of input) {
+    if (isPlainObject(item) && item.type === "web_search_call" && typeof item.id === "string") {
+      const memo = peekBridgeSearchReplay(destinationScope, item.id);
+      if (memo && !occupiedCallIds.has(memo.callId)) {
+        changed = true;
+        occupiedCallIds.add(memo.callId);
+        restored.push({
+          type: "function_call",
+          ...(memo.sourceItemId ? { id: memo.sourceItemId } : {}),
+          call_id: memo.callId,
+          name: memo.name,
+          // The bridge records the complete arguments text from the call's own done frame; the
+          // empty-object fallback matches what a continuation leg would have sent.
+          arguments: memo.argumentsText.length > 0 ? memo.argumentsText : "{}",
+        });
+        restored.push({ type: "function_call_output", call_id: memo.callId, output: memo.output });
+        continue;
+      }
+    }
+    restored.push(item);
+  }
+  return changed ? { ...body, input: restored } : body;
+}
+
 export function repairOrphanedInputItems(body: unknown, dropReasoning: boolean, synthesizeMissingCallOutputs = false): unknown {
   if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
   const input = body.input;