npm - @bitkyc08/opencodex - Versions diffs - 2.58.0 → 2.60.0 - Mend

@bitkyc08/opencodex 2.58.0 → 2.60.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (303) hide show

package/README.md +28 -10
package/gui/dist/assets/index-BTuCbqQd.css +1 -0
package/gui/dist/assets/index-DoBVdPHP.js +134 -0
package/gui/dist/index.html +2 -2
package/gui/dist/provider-icons/crusoe.svg +1 -0
package/gui/dist/provider-icons/opper.svg +3 -0
package/package.json +4 -1
package/src/adapters/anthropic-image-codec.ts +16 -2
package/src/adapters/anthropic-image-normalize.ts +49 -2
package/src/adapters/anthropic.ts +4 -1
package/src/adapters/base.ts +34 -1
package/src/adapters/coding-agent/turn.ts +22 -2
package/src/adapters/command-code.ts +50 -3
package/src/adapters/cursor/catalog.ts +11 -0
package/src/adapters/cursor/checkpoint-store.ts +3 -0
package/src/adapters/cursor/discovery.ts +11 -8
package/src/adapters/cursor/effort-map.ts +16 -2
package/src/adapters/cursor/envelope-echo.ts +55 -2
package/src/adapters/cursor/live-transport.ts +26 -9
package/src/adapters/cursor/message-mapper.ts +3 -2
package/src/adapters/cursor/protobuf-request.ts +8 -5
package/src/adapters/cursor/request-builder.ts +21 -4
package/src/adapters/cursor/thread-continuity.ts +105 -31
package/src/adapters/cursor/tool-guidance.ts +5 -4
package/src/adapters/cursor/transport.ts +19 -0
package/src/adapters/cursor.ts +45 -2
package/src/adapters/devin/cloud-direct/chat.ts +14 -3
package/src/adapters/devin/cloud-direct/index.ts +7 -0
package/src/adapters/devin/cloud-direct/stated-reset-retry.ts +140 -0
package/src/adapters/devin.ts +125 -26
package/src/adapters/google-antigravity-replay.ts +1 -1
package/src/adapters/google-antigravity-wire.ts +55 -4
package/src/adapters/google-http.ts +57 -11
package/src/adapters/google-tool-schema.ts +595 -31
package/src/adapters/google-wire-compiler.ts +93 -10
package/src/adapters/google-wire-shape.ts +461 -0
package/src/adapters/google.ts +60 -10
package/src/adapters/openai-chat/response-events.ts +61 -0
package/src/adapters/openai-chat-images.ts +3 -1
package/src/adapters/openai-chat.ts +10 -11
package/src/adapters/openai-responses/image-gen.ts +8 -6
package/src/adapters/openai-responses/passthrough.ts +25 -4
package/src/adapters/openai-responses/reasoning.ts +7 -0
package/src/adapters/openai-responses/tool-output-recovery.ts +75 -0
package/src/adapters/openai-responses/tool-schema.ts +19 -7
package/src/adapters/opencode-go-additional-tools.ts +12 -2
package/src/adapters/responses-tool-schema.ts +76 -46
package/src/adapters/run-turn-queue.ts +17 -4
package/src/bridge/response-json.ts +1 -1
package/src/bridge/sse.ts +28 -35
package/src/claude/context-windows.ts +22 -0
package/src/claude/outbound.ts +35 -4
package/src/cli/account-api.ts +4 -3
package/src/cli/account-extended.ts +26 -6
package/src/cli/account-orca-import.ts +63 -0
package/src/cli/account.ts +32 -4
package/src/cli/capabilities.ts +40 -0
package/src/cli/claude.ts +29 -1
package/src/cli/codex-cli-update.ts +97 -2
package/src/cli/dispatch.ts +57 -3
package/src/cli/doctor.ts +218 -4
package/src/cli/help.ts +4 -1
package/src/cli/hub.ts +3 -2
package/src/cli/index.ts +95 -22
package/src/cli/models-runtime.ts +33 -4
package/src/cli/opencode.ts +2 -2
package/src/cli/provider.ts +13 -1
package/src/cli/registry.ts +11 -1
package/src/cli/runtime-api.ts +44 -0
package/src/cli/start-args.ts +94 -0
package/src/cli/system-command.ts +2 -0
package/src/client/machine-api.ts +6 -5
package/src/client/machine-listener.ts +16 -3
package/src/client/runtime.ts +26 -2
package/src/clients/config-export/constants.ts +2 -3
package/src/clients/config-export.ts +5 -5
package/src/codex/account-store.ts +146 -5
package/src/codex/auth-api/account-list.ts +19 -11
package/src/codex/auth-api/pool-quota-probe.ts +44 -10
package/src/codex/auth-api/routes.ts +17 -2
package/src/codex/auth-context.ts +16 -12
package/src/codex/catalog/build-entries.ts +25 -4
package/src/codex/catalog/derive-entry.ts +8 -1
package/src/codex/catalog/effort.ts +10 -6
package/src/codex/catalog/gather-capture.ts +22 -2
package/src/codex/catalog/model-hints.ts +66 -33
package/src/codex/catalog/parsing.ts +90 -5
package/src/codex/catalog/provider-models.ts +19 -2
package/src/codex/catalog/reserve-warn.ts +96 -0
package/src/codex/catalog/retained-sync.ts +41 -26
package/src/codex/catalog/routed-gather.ts +61 -3
package/src/codex/cli-installation-identity.ts +210 -0
package/src/codex/cli-installation-targets.ts +158 -0
package/src/codex/context-compat.ts +5 -2
package/src/codex/convergence.ts +5 -0
package/src/codex/desired-state.ts +4 -1
package/src/codex/history-job.ts +6 -6
package/src/codex/history-provider.ts +24 -167
package/src/codex/history-rollout-read.ts +174 -0
package/src/codex/history-state-open.ts +105 -0
package/src/codex/inject/config-toml.ts +44 -2
package/src/codex/inject.ts +3 -2
package/src/codex/internal/catalog-writer.ts +33 -1
package/src/codex/lineage.ts +83 -32
package/src/codex/loopback-target.ts +31 -0
package/src/codex/main-account-hard-lock.ts +2 -1
package/src/codex/main-account.ts +10 -3
package/src/codex/main-device-reauth.ts +17 -9
package/src/codex/model-cache.ts +47 -0
package/src/codex/model-entitlements.ts +80 -2
package/src/codex/observed-model-denials.ts +230 -0
package/src/codex/orca-auth-source.ts +94 -0
package/src/codex/orca-import.ts +219 -0
package/src/codex/prompt-text-probe.ts +289 -16
package/src/codex/quota-401-recovery.ts +12 -0
package/src/codex/quota-types.ts +65 -0
package/src/codex/quota.ts +24 -19
package/src/codex/routing/cooldown-math.ts +8 -47
package/src/codex/routing/pin-drain.ts +57 -0
package/src/codex/routing.ts +20 -16
package/src/codex/shim.ts +1 -1
package/src/codex/subagent-model-fallback.ts +114 -2
package/src/codex/windows-installation-files.ts +224 -0
package/src/combos/failover.ts +125 -5
package/src/config/admitted-identity.ts +222 -0
package/src/config/diagnostics.ts +43 -1
package/src/config/feature-flags.ts +5 -0
package/src/config/load-degrade.ts +33 -0
package/src/config/pending-teardown.ts +8 -0
package/src/config/process-state.ts +36 -3
package/src/config/provider-relative-send-path.ts +16 -0
package/src/config/proxy-env.ts +31 -7
package/src/config/schema/compaction-triggers.ts +11 -0
package/src/config/schema/config-schema.ts +25 -0
package/src/config/schema/leaf-validators.ts +76 -17
package/src/config.ts +2 -2
package/src/generated/compatibility-version.json +410 -258
package/src/generated/model-metadata.ts +1 -1
package/src/grok/reset-coupons.ts +38 -19
package/src/images/loop.ts +6 -1
package/src/integrations/aside-profile-context.ts +37 -3
package/src/integrations/aside-profile-journal.ts +68 -3
package/src/integrations/aside-profiles.ts +128 -3
package/src/integrations/mutation-plan.ts +815 -0
package/src/integrations/writer.ts +85 -99
package/src/lab/live/transport.ts +4 -0
package/src/lab/live/types.ts +5 -0
package/src/lab/subject/behavior-fingerprint.ts +1 -1
package/src/lib/admin-secrets.ts +9 -1
package/src/lib/bounded-body.ts +4 -2
package/src/lib/debug-log-buffer.ts +6 -1
package/src/lib/debug.ts +23 -0
package/src/lib/destination-policy.ts +48 -6
package/src/lib/errors.ts +82 -15
package/src/lib/http-response-semantics.ts +57 -0
package/src/lib/lab-live-pinned-sender.ts +26 -12
package/src/lib/local-destinations.ts +32 -5
package/src/lib/pinned-http.ts +142 -2
package/src/lib/plain-data.ts +103 -0
package/src/lib/process-control.ts +13 -5
package/src/lib/provider-outbound.ts +53 -5
package/src/lib/proxy-env.ts +70 -3
package/src/lib/request-execution-budget.ts +11 -3
package/src/lib/response-body-inactivity.ts +193 -0
package/src/lib/retry-delay.ts +69 -0
package/src/lib/socks5-fetch.ts +741 -0
package/src/lib/spend-ledger-owner.ts +364 -0
package/src/lib/spend-reservation-ledger.ts +332 -35
package/src/lib/windows-system-proxy.ts +16 -11
package/src/lib/workflow-budget.ts +145 -8
package/src/oauth/account-quota-rank.ts +72 -15
package/src/oauth/callback-server.ts +4 -3
package/src/oauth/generic-account-failover.ts +41 -27
package/src/oauth/health.ts +12 -1
package/src/oauth/index.ts +3 -107
package/src/oauth/login-flow-state.ts +127 -0
package/src/oauth/orcarouter.ts +15 -2
package/src/oauth/store.ts +8 -0
package/src/providers/codex-capacity.ts +9 -0
package/src/providers/derive.ts +34 -17
package/src/providers/devin-cli-authmode-migration.ts +14 -10
package/src/providers/devin-provider-merge-migration.ts +33 -12
package/src/providers/free-directory.ts +20 -2
package/src/providers/key-failover.ts +327 -25
package/src/providers/model-rename-migration.ts +56 -1
package/src/providers/model-rename-startup.ts +7 -5
package/src/providers/openai-sidecar.ts +4 -0
package/src/providers/openai-virtual-models.ts +42 -2
package/src/providers/opencode-go-transport.ts +14 -5
package/src/providers/quota/antigravity.ts +22 -2
package/src/providers/quota/report-cache.ts +3 -0
package/src/providers/quota/vendor-probes-key.ts +1 -1
package/src/providers/registry/entries-core.ts +39 -17
package/src/providers/registry/entries-extended.ts +131 -1
package/src/providers/registry/model-ids.ts +168 -0
package/src/providers/registry/model-seeds.ts +87 -21
package/src/providers/registry/types.ts +2 -0
package/src/providers/resolved-model-policy-merge.ts +167 -0
package/src/providers/resolved-model-policy.ts +406 -0
package/src/providers/stale-vision-classification-migration.ts +137 -0
package/src/responses/apply-patch-envelope.ts +32 -11
package/src/responses/bridge-search-replay-cache.ts +152 -0
package/src/responses/code-mode-helper-compat.ts +26 -16
package/src/responses/custom-tool-compat.ts +1 -1
package/src/responses/freeform-wrapper-scan.ts +279 -0
package/src/responses/hosted-tool-policy.ts +85 -2
package/src/responses/legacy-dotted-tool-name-repair.ts +134 -0
package/src/responses/progressive-freeform-input.ts +130 -0
package/src/responses/reasoning-envelope.ts +30 -0
package/src/responses/schema.ts +9 -2
package/src/responses/state.ts +5 -12
package/src/responses/tool-name-aliases.ts +15 -1
package/src/router.ts +91 -115
package/src/routing/compatibility/behavior.ts +9 -0
package/src/routing/compatibility/subject.ts +16 -1
package/src/server/adapter-resolve.ts +9 -0
package/src/server/auth-cors.ts +29 -0
package/src/server/chat-completions.ts +13 -5
package/src/server/chat-native-sse.ts +26 -9
package/src/server/chat-native.ts +10 -4
package/src/server/claude-messages.ts +30 -5
package/src/server/effort-row.ts +11 -3
package/src/server/grok-responses-control-frame.ts +160 -1
package/src/server/gui-static.ts +36 -2
package/src/server/inbound-body-admission.ts +187 -0
package/src/server/index/serve-options.ts +86 -29
package/src/server/index/spend-ledger-lifecycle.ts +66 -0
package/src/server/index/websocket-handler.ts +6 -1
package/src/server/index.ts +24 -25
package/src/server/management/api-access.ts +3 -4
package/src/server/management/aside-profile-routes.ts +266 -7
package/src/server/management/config-routes.ts +48 -7
package/src/server/management/context.ts +3 -0
package/src/server/management/integration-routes.ts +287 -5
package/src/server/management/metrics-routes.ts +20 -0
package/src/server/management/model-rows.ts +224 -12
package/src/server/management/provider-capability-config.ts +35 -7
package/src/server/management/provider-routes.ts +70 -18
package/src/server/management/route-registry.ts +14 -0
package/src/server/management/shared.ts +10 -3
package/src/server/management/system-restart.ts +7 -2
package/src/server/management/system-routes.ts +2 -0
package/src/server/management/usage-aggregate-cache.ts +4 -0
package/src/server/management-api.ts +2 -0
package/src/server/management-auth.ts +15 -1
package/src/server/proxy-liveness.ts +97 -2
package/src/server/readiness.ts +29 -10
package/src/server/relay-eager.ts +24 -2
package/src/server/relay.ts +136 -34
package/src/server/request-log.ts +80 -3
package/src/server/request-metrics.ts +236 -0
package/src/server/responses/adapter-continuation.ts +74 -30
package/src/server/responses/adapter-delivery.ts +39 -8
package/src/server/responses/adapter-dispatch.ts +63 -30
package/src/server/responses/compact.ts +89 -18
package/src/server/responses/compaction-routing.ts +111 -0
package/src/server/responses/core-codex-account.ts +90 -24
package/src/server/responses/core-combo.ts +7 -7
package/src/server/responses/core-normalize.ts +16 -15
package/src/server/responses/core-opaque-recovery.ts +1 -0
package/src/server/responses/core-options.ts +4 -0
package/src/server/responses/encrypted-payload.ts +20 -2
package/src/server/responses/fetch-helpers.ts +68 -2
package/src/server/responses/passthrough-delivery.ts +41 -15
package/src/server/responses/passthrough-dispatch.ts +145 -53
package/src/server/responses/passthrough-execution.ts +11 -1
package/src/server/responses/policy-fallback.ts +5 -13
package/src/server/responses/request-prepare.ts +96 -17
package/src/server/responses/request-send-budget.ts +89 -8
package/src/server/responses/request-sidecar-auth.ts +17 -9
package/src/server/responses/request-spend.ts +38 -9
package/src/server/responses/request-transport.ts +15 -12
package/src/server/responses/run-turn-execution.ts +45 -8
package/src/server/responses/sidecar-execution.ts +19 -2
package/src/server/responses/ws-upstream.ts +16 -28
package/src/server/responses-custom-tool-repair.ts +29 -56
package/src/server/responses-undeclared-tool-guard.ts +31 -1
package/src/server/sse-frame-buffer.ts +12 -10
package/src/server/sse-payload-rewrite.ts +37 -10
package/src/server/system-env-shell.ts +5 -1
package/src/server/system-env.ts +7 -1
package/src/server/workflow-refusal.ts +56 -2
package/src/service/cli.ts +16 -6
package/src/service/guards.ts +10 -0
package/src/service/health.ts +43 -0
package/src/service/state.ts +7 -2
package/src/tray/windows-tray.ps1 +155 -3
package/src/types/accounts.ts +4 -0
package/src/types/config.ts +111 -6
package/src/types/provider.ts +37 -0
package/src/types/request.ts +9 -1
package/src/types/tools.ts +14 -0
package/src/types/wire.ts +9 -1
package/src/types.ts +1 -0
package/src/usage/expected-prices.ts +28 -0
package/src/usage/log.ts +87 -4
package/src/vision/eligibility.ts +88 -9
package/src/vision/plan.ts +34 -10
package/src/web-search/executor.ts +41 -2
package/src/web-search/loop.ts +6 -1
package/src/web-search/passthrough-bridge.ts +39 -5
package/gui/dist/assets/index-BbrHOIY0.js +0 -128
package/gui/dist/assets/index-C5-RdDmD.css +0 -1

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-BbrHOIY0.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-C5-RdDmD.css">
+    <script type="module" crossorigin src="/assets/index-DoBVdPHP.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BTuCbqQd.css">
   </head>
   <body>
     <div id="root"></div>

package/gui/dist/provider-icons/crusoe.svg ADDED Viewed

@@ -0,0 +1 @@

+ <svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Crusoe</title><path d="M12 0L4.583 6.583c-3.23 2.869-3.23 7.965 0 10.834L12 24l7.417-6.583c3.23-2.869 3.23-7.965 0-10.834L12 0z" fill="url(#lobe-icons-crusoe-_R_0_)"></path><defs><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-crusoe-_R_0_" x1="18.919" x2="4.853" y1="5.595" y2="18.301"><stop stop-color="#F4BF45"></stop><stop offset=".35" stop-color="#E48047"></stop><stop offset=".69" stop-color="#C73361"></stop><stop offset="1" stop-color="#A42F5F"></stop></linearGradient></defs></svg>

package/gui/dist/provider-icons/opper.svg ADDED Viewed

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 315 315" fill="#000000">
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M159.78 315C71.53 315 0 244.49 0 157.5C0 -18.9499 159.78 0.650075 159.78 0.650075C159.78 87.2201 88.36 157.4 0.2 157.5C149.8 157.64 159.78 315 159.78 315ZM160.52 217.98C160.52 217.98 156.94 161.65 105.04 157.52C120.6 157.34 160.52 151.54 160.52 96.5601C160.52 151.54 200.44 157.34 216 157.52C164.1 161.63 160.52 217.98 160.52 217.98Z"/>
+</svg>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.58.0",
+  "version": "2.60.0",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",
@@ -83,6 +83,9 @@
     "@types/bun": "1.4.0",
     "typescript": "7.0.2"
   },
+  "optionalDependencies": {
+    "wreq-js": "2.3.1"
+  },
   "overrides": {
     "@hono/node-server": "2.1.0",
     "fast-uri": "^3.1.7",

package/src/adapters/anthropic-image-codec.ts CHANGED Viewed

@@ -41,7 +41,9 @@ export const MAX_INPUT_BASE64_LENGTH = 64 * MiB;
  * would widen the adapter contract with no demonstrated need.
  */
 export const IMAGE_NORMALIZE_CONCURRENCY = 4;
-export const MAX_INPUT_PIXELS = 100_000_000;
+// Keep one decoded RGBA surface below 64 MiB. Native codecs may allocate additional
+// working buffers, so this is paired with process-wide admission in the normalizer.
+export const MAX_INPUT_PIXELS = 16_000_000;
 /** Formats Anthropic accepts as-is; anything else must be transcoded or dropped. */
@@ -50,6 +52,8 @@ const PASSTHROUGH_MEDIA = new Set(["image/jpeg", "image/png", "image/gif", "imag
 export interface NormalizeOptions {
   /** Shift every image's starting ladder position down (413 retry tightening; 030). */
   tierBias?: number;
+  /** Cancels queued native decode work and stops pulling more images. */
+  abortSignal?: AbortSignal;
   /** Test seam: replaces the Bun.Image encode path (audit round 1, blocker 6). */
   encode?: EncodeFn;
   /** Test seam: replaces the pass-through decode validation (C-gate round 1, blocker 1). */
@@ -275,6 +279,9 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
   const meta = await image.metadata();
   const w = typeof meta.width === "number" ? meta.width : 0;
   const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
   let pipeline = new Bun.Image(input);
   if (w > spec.maxEdge || h > spec.maxEdge) {
     const scale = spec.maxEdge / Math.max(w, h);
@@ -290,7 +297,14 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
  * instead of riding pass-through to an Anthropic 400 (C-gate round 1, blocker 1).
  */
 export const bunImageValidate: ValidateFn = async input => {
-  await new Bun.Image(input).resize(1, 1).jpeg({ quality: 1 }).toBuffer();
+  const image = new Bun.Image(input);
+  const meta = await image.metadata();
+  const w = typeof meta.width === "number" ? meta.width : 0;
+  const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
+  await image.resize(1, 1).jpeg({ quality: 1 }).toBuffer();
 };
 /**

package/src/adapters/anthropic-image-normalize.ts CHANGED Viewed

@@ -32,6 +32,37 @@ import { recordedEmittedPosition, recordEmittedPosition } from "./anthropic-imag
 import { IMAGE_NORMALIZE_CONCURRENCY, MAX_INPUT_BASE64_LENGTH, MAX_INPUT_PIXELS } from "./anthropic-image-codec";
 import type { NormalizeOptions } from "./anthropic-image-codec";
+const IMAGE_DECODE_PROCESS_CONCURRENCY = IMAGE_NORMALIZE_CONCURRENCY;
+let activeImageDecodes = 0;
+const imageDecodeWaiters: Array<() => void> = [];
+async function enterImageDecode(signal?: AbortSignal): Promise<() => void> {
+  if (signal?.aborted) throw signal.reason ?? new DOMException("Aborted", "AbortError");
+  let transferred = false;
+  if (activeImageDecodes >= IMAGE_DECODE_PROCESS_CONCURRENCY) {
+    await new Promise<void>((resolve, reject) => {
+      const admit = (): void => {
+        transferred = true;
+        signal?.removeEventListener("abort", abort);
+        resolve();
+      };
+      const abort = (): void => {
+        const index = imageDecodeWaiters.indexOf(admit);
+        if (index >= 0) imageDecodeWaiters.splice(index, 1);
+        reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+      };
+      imageDecodeWaiters.push(admit);
+      signal?.addEventListener("abort", abort, { once: true });
+    });
+  }
+  if (!transferred) activeImageDecodes++;
+  return () => {
+    const next = imageDecodeWaiters.shift();
+    if (next) next();
+    else activeImageDecodes--;
+  };
+}
 const UNDECODABLE_TEXT = "[image omitted: undecodable or corrupt image data]";
 const BOMB_TEXT = "[image omitted: image too large to process safely]";
 const OVERFLOW_DROP_TEXT = "[image omitted: total image payload exceeded the provider request budget; older images were dropped]";
@@ -104,8 +135,24 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   const budget = options.budget ?? TOTAL_IMAGE_BASE64_BUDGET;
   const overflowAction = options.overflowAction ?? "none";
   const processLimit = options.processLimit ?? Number.POSITIVE_INFINITY;
+  const abortSignal = options.abortSignal;
   const n = targets.length;
+  const process = async (b64: string, pos: number, mediaType: string) => {
+    if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+    const leave = await enterImageDecode(abortSignal);
+    try {
+      // Re-check after admission: an abort landing between dequeue and decode-start
+      // must not begin decoding (an in-flight native decode cannot be interrupted).
+      if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+      const result = await processAt(b64, pos, mediaType, encode, validate);
+      if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+      return result;
+    } finally {
+      leave();
+    }
+  };
   // sourceB64/sourceMedia are the ORIGINAL input (encode source + cache identity);
   // size always reflects the bytes currently ON the wire for this target (the core is
   // the only mutator, so tracked size cannot drift from reality).
@@ -167,7 +214,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
       // age tier on a cold store, which is the pre-#4532 behaviour.
       const recorded = recordedEmittedPosition(b64, sourceMedia);
       const pos = Math.min((recorded ?? initialPosition(newestFirstIndex, 0)) + Math.max(0, bias), TERMINAL_POS);
-      const result = await processAt(b64, pos, sourceMedia, encode, validate);
+      const result = await process(b64, pos, sourceMedia);
       if (result.kind === "failed") {
         target.drop(UNDECODABLE_TEXT);
         if (target.retainsBytesOnDrop) {
@@ -209,7 +256,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   while (sum > budget) {
     const entry = entries.find((e): e is Entry => e !== null && !e.done);
     if (!entry) break; // all terminal — overflowAction below decides
-    const result = await processAt(entry.sourceB64, entry.pos + 1, entry.sourceMedia, encode, validate);
+    const result = await process(entry.sourceB64, entry.pos + 1, entry.sourceMedia);
     if (result.kind === "failed") {
       entry.target.drop(UNDECODABLE_TEXT);
       if (entry.target.retainsBytesOnDrop) {

package/src/adapters/anthropic.ts CHANGED Viewed

@@ -945,7 +945,10 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
       // Primary image layer: resize/re-encode to fit Anthropic limits without dropping
       // (anthropic-image-normalize.ts); the guard below remains the deterministic backstop.
       // imageTierBias > 0 = upstream-413 tightened retry (030): start every image one tier lower.
-      await normalizeAnthropicImages(messages, { tierBias: incoming?.imageTierBias ?? 0 });
+      await normalizeAnthropicImages(messages, {
+        tierBias: incoming?.imageTierBias ?? 0,
+        abortSignal: incoming?.abortSignal,
+      });
       // Anthropic rejects many-image requests (>20 images) carrying any image over
       // 2000px per side; see anthropic-image-guard.ts for the full limit policy.
       enforceAnthropicImageLimits(messages);

package/src/adapters/base.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { AdapterEvent, OcxParsedRequest } from "../types";
 import type { TranslatorBudget } from "../lib/translator-budget";
 import type { RequestExecutionBudget } from "../lib/request-execution-budget";
-import type { AttemptRecoveryKind } from "../usage/log";
+import type { AttemptRecoveryKind, AttemptRecoveryWithheld } from "../usage/log";
 import type { AdapterTierMetadata } from "../providers/fastwire";
 /** Metadata about the caller's incoming request, for auth-forwarding adapters. */
@@ -31,11 +31,34 @@ export interface IncomingMeta {
    * behind it (#4546).
    */
   sendBudget?: RequestExecutionBudget;
+  /**
+   * Physical-send observations for runTurn adapters. Without the same callback carried by
+   * AdapterFetchContext, an adapter-owned replay spends the shared budget but remains absent
+   * from the request's sendCount.
+   */
+  onPhysicalSend?: (send: { ordinal: number; recovery?: AttemptRecoveryKind }) => void;
+  /**
+   * Recovery refusals for runTurn adapters. A refused replay is not a send, so this separate
+   * channel explains why recovery stopped without inflating physical-send telemetry.
+   */
+  onRecoveryWithheld?: (withheld: { reason: AttemptRecoveryWithheld }) => void;
 }
 export interface ProviderAdapter {
   name: string;
+  /**
+   * This adapter reports every physical inference send through `IncomingMeta.onPhysicalSend`,
+   * including its first.
+   *
+   * The caller normally logs the first send before handing control over, which is correct for a
+   * transport whose sends it can see. An adapter that admits its own sends through the shared
+   * budget can have that first send refused, and a send logged before admission is a send the
+   * log claims and the wire never made. Setting this moves the first send's accounting to the
+   * boundary where it is actually dispatched.
+   */
+  reportsPhysicalSends?: boolean;
   /**
    * Convert an already-read provider HTTP error into client-safe text. This hook must be pure and
    * return fully redacted output: callers may pass untrusted provider headers and payload text.
@@ -168,6 +191,16 @@ export interface AdapterFetchContext {
    * to `sendCount` and no regression could assert a count for them (#4546).
    */
   onPhysicalSend?: (send: { ordinal: number; recovery?: AttemptRecoveryKind }) => void;
+  /**
+   * Observes a recovery this adapter was ready to make and did not, because the send budget
+   * refused the dispatch.
+   *
+   * Separate from `onPhysicalSend` because nothing was sent: folding it in would inflate
+   * `sendCount`, the one number that means "requests this proxy actually made". Without it a
+   * log with one send cannot distinguish "no recovery was eligible" from "one was and the
+   * budget withheld it", and those need opposite follow-ups (#5044).
+   */
+  onRecoveryWithheld?: (withheld: { reason: AttemptRecoveryWithheld }) => void;
 }
 /**

package/src/adapters/coding-agent/turn.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { spawn as nodeSpawn, type ChildProcess, type SpawnOptions } from "node:child_process";
+import { execFileSync, spawn as nodeSpawn, type ChildProcess, type SpawnOptions } from "node:child_process";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../types";
 import { commandInvocation } from "../../lib/win-exec";
 import type { IncomingMeta } from "../base";
@@ -8,6 +8,9 @@ import { resolveCodingAgentBinary, resolveProfileByBaseUrl, type CodingAgentProv
 /** Injectable spawn for tests; production uses node:child_process. */
 export type SpawnFn = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
+/** Injectable Windows process-tree terminator; production uses taskkill /T /F. */
+export type KillWindowsProcessTreeFn = (pid: number) => void;
 /** Per-turn injectables: spawn/which seams for tests plus wall-clock ceilings for timeout, kill grace, and bounded reap. */
 export interface CodingAgentDeps {
   spawn?: SpawnFn;
@@ -20,6 +23,8 @@ export interface CodingAgentDeps {
   reapTimeoutMs?: number;
   /** Test seam for Windows command-shim invocation. */
   platform?: NodeJS.Platform;
+  /** Test seam for terminating a Windows CLI and all descendants. */
+  killWindowsProcessTree?: KillWindowsProcessTreeFn;
 }
 const DEFAULT_TIMEOUT_MS = 300_000;
@@ -27,6 +32,14 @@ const DEFAULT_KILL_GRACE_MS = 2_000;
 /** Bound captured stderr so an error message can never carry an unbounded (or secret) payload. */
 const MAX_STDERR_BYTES = 8 * 1024;
+function killWindowsProcessTree(pid: number): void {
+  const taskkill = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\taskkill.exe`;
+  execFileSync(taskkill, ["/PID", String(pid), "/T", "/F"], {
+    stdio: "pipe",
+    windowsHide: true,
+  });
+}
 /** Env keys a CLI needs to run; everything else is dropped so the child env is scoped and deterministic. */
 const INHERITED_ENV_KEYS = [
   "PATH", "HOME", "USERPROFILE", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "TEMP", "TMP",
@@ -93,6 +106,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const killGraceMs = deps.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
   const reapTimeoutMs = deps.reapTimeoutMs ?? (killGraceMs * 2 + 250);
+  const platform = deps.platform ?? process.platform;
   if (incoming.abortSignal?.aborted) {
     emit({ type: "error", message: "Coding-agent turn was aborted before start." });
@@ -140,7 +154,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   const args = buildArgs(profile, parsed, provider);
   const env = buildEnv(profile, apiKey);
-  const invocation = commandInvocation(binary, args, deps.platform ?? process.platform, { env });
+  const invocation = commandInvocation(binary, args, platform, { env });
   let child: ChildProcess;
   try {
@@ -197,6 +211,12 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   const kill = (): void => {
     if (killed || child.killed) return;
     killed = true;
+    if (platform === "win32" && child.pid !== undefined) {
+      try {
+        (deps.killWindowsProcessTree ?? killWindowsProcessTree)(child.pid);
+        return;
+      } catch { /* fall back to terminating the direct child */ }
+    }
     try { child.kill("SIGTERM"); } catch { /* already gone */ }
     killTimer = setTimeout(() => {
       try { child.kill("SIGKILL"); } catch { /* already gone */ }

package/src/adapters/command-code.ts CHANGED Viewed

@@ -8,7 +8,7 @@ import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./bas
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { debugDroppedFrame } from "../lib/debug";
-import { configuredReasoningEfforts } from "../reasoning-effort";
+import { configuredReasoningEfforts, modelRecordValue } from "../reasoning-effort";
 import { commandCodeReasoningEfforts, refreshCommandCodeReasoningEfforts } from "../providers/command-code-efforts";
 import { identifyRoutedModel } from "./identity";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
@@ -483,13 +483,51 @@ async function fetchCommandCode(request: AdapterRequest, ctx: AdapterFetchContex
   }
 }
+/**
+ * Has the operator declared their own ladders authoritative for this provider?
+ *
+ * Comparing a configured row against the shipped table cannot answer this. `providerConfigSeed`
+ * copies the whole table into every materialized preset, and both enrichment and routing keep a
+ * persisted row over the current seed, so a row written by an older release keeps its old value
+ * and starts LOOKING like an operator edit the moment the shipped table is corrected — at which
+ * point the stale row would outrank the correction and disable the rejection repair below.
+ * Provenance has to be declared rather than inferred, so it is: `providerConfigSeed` never
+ * writes this flag, which makes its presence something only a human can have caused.
+ */
+function operatorChoseCommandCodeLadder(provider: OcxProviderConfig, canonicalId: string): boolean {
+  if (provider.modelReasoningEffortsAuthoritative !== true) return false;
+  return modelRecordValue(provider.modelReasoningEfforts, canonicalId) !== undefined;
+}
+/**
+ * Resolve the ladder this request may draw a wire effort from.
+ *
+ * The shipped table is a default, not a ceiling the operator cannot reach past. Until this
+ * existed the adapter read `commandCodeReasoningEfforts() ?? configuredReasoningEfforts()`, so a
+ * model with a row ignored configuration outright while a model without one honoured it — and
+ * the catalog disagreed with both, because `configuredReasoningEfforts` is what advertises the
+ * picker. An operator who widened a pinned row saw the wider ladder offered in Codex and then
+ * watched the adapter strip the rung on the way out (#5096).
+ *
+ * An operator who sets `modelReasoningEffortsAuthoritative` now resolves through the same
+ * function the catalog uses, so the picker and the wire agree, and sanitization, tier healing and
+ * learned-refusal dropping apply to it. Every other provider keeps the shipped table, including a
+ * value learned by a profile refresh.
+ */
+function commandCodeEffortLadder(provider: OcxProviderConfig, canonicalId: string): readonly string[] | undefined {
+  if (operatorChoseCommandCodeLadder(provider, canonicalId)) {
+    return configuredReasoningEfforts(provider, canonicalId);
+  }
+  return commandCodeReasoningEfforts(canonicalId) ?? configuredReasoningEfforts(provider, canonicalId);
+}
 function supportedCommandCodeEffort(provider: OcxProviderConfig, modelId: string, requested: string | undefined): string | undefined {
   if (!requested || requested === "none") return undefined;
   // Compatibility ids (deepseek-v4-flash / glm-5.2) must resolve to their canonical
   // Command Code id before the effort lookup, or legacy requests silently lose the
   // reasoning effort because the official table is keyed by the canonical ids.
   const canonicalId = canonicalCommandCodeModelId(modelId);
-  const supported = commandCodeReasoningEfforts(canonicalId) ?? configuredReasoningEfforts(provider, canonicalId);
+  const supported = commandCodeEffortLadder(provider, canonicalId);
   if (!supported) return undefined;
   // Only remap xhigh/ultra→max for models whose official profile documents that
   // aliasing (deepseek v4, glm-5.2). Muse Spark's upstream accepts xhigh as a
@@ -501,7 +539,11 @@ function supportedCommandCodeEffort(provider: OcxProviderConfig, modelId: string
     lower === "zai-org/glm-5.2";
   if (requested === "xhigh" && !supported.includes("xhigh") && supported.includes("max")) {
     wire = "max";
-  } else if (requested === "ultra" && needsAlias && supported.includes("max")) {
+  } else if (requested === "ultra" && needsAlias && !supported.includes("ultra") && supported.includes("max")) {
+    // The xhigh branch above already refuses to alias a rung the ladder advertises; ultra has to
+    // match it. No shipped row offers ultra, so this changes nothing for the built-in table — but
+    // an authoritative operator ladder that does offer it would otherwise advertise ultra in the
+    // picker and quietly send max, which is the catalog/wire disagreement this file just fixed.
     wire = "max";
   }
   return (supported as readonly string[]).includes(wire) ? wire : undefined;
@@ -576,6 +618,11 @@ export function createCommandCodeAdapter(provider: OcxProviderConfig): ProviderA
         try { return (JSON.parse(request.body) as { params?: { model?: unknown } }).params?.model; } catch { return undefined; }
       })();
       if (typeof modelId !== "string") return response;
+      // An operator who wrote this ladder authorized the rung deliberately. Replaying the turn
+      // without it would answer at the provider default and hide a wrong configuration behind a
+      // successful-looking response, so the upstream rejection is what the caller gets. The
+      // downgrade below stays for the shipped table, where the rung was never the caller's idea.
+      if (operatorChoseCommandCodeLadder(provider, canonicalCommandCodeModelId(modelId))) return response;
       const refreshed = await refreshCommandCodeReasoningEfforts(modelId, executor);
       if (!refreshed || refreshed.includes(currentEffort)) return response;
       const retry = requestWithoutReasoningEffort(request);

package/src/adapters/cursor/catalog.ts CHANGED Viewed

@@ -60,6 +60,8 @@ const CONTEXT_500K = 500 * K;
 const CONTEXT_1M = 1_000 * K;
 /** Gemini publishes the exact power-of-two window, not a rounded 1M. */
 const CONTEXT_GEMINI = 1_048_576;
+/** Meta publishes 1,048,576 for both Muse Spark 1.3 tiers (dev.meta.ai/docs/models). */
+const CONTEXT_MUSE = 1_048_576;
 const FULL = ["low", "medium", "high", "xhigh", "max"] as const;
 const T = "thinking-then-effort" as const;
@@ -211,6 +213,15 @@ export const CURSOR_CAPABILITIES: Record<string, CursorCapability> = {
     defaultVariant: "regular",
     variants: { regular: { levels: ["low", "medium", "high"] } },
   },
+  // Seeded from the live GetUsableModels roster attached to #4820, which advertises six
+  // muse-spark-1.3 effort variants. The ladder stops at xhigh on purpose: see the matching
+  // effort-map entry for why Cursor advertising `-max` is not evidence that it runs.
+  "muse-spark-1.3": {
+    displayName: "Muse Spark 1.3",
+    window: CONTEXT_MUSE,
+    defaultVariant: "regular",
+    variants: { regular: { levels: ["minimal", "low", "medium", "high", "xhigh"] } },
+  },
   "kimi-k3": {
     displayName: "Kimi K3",
     window: CONTEXT_1M,

package/src/adapters/cursor/checkpoint-store.ts CHANGED Viewed

@@ -42,6 +42,7 @@ export interface CursorCheckpointSnapshot {
   coveredMessageCount?: number;
   prefixDigest?: string;
   systemDigest?: string;
+  toolSuspended?: boolean;
 }
 interface CursorCheckpointStore {
@@ -229,6 +230,7 @@ export function commitCursorCheckpoint(input: {
   coveredMessageCount?: number;
   prefixDigest?: string;
   systemDigest?: string;
+  toolSuspended?: boolean;
 }): string | undefined {
   if (!input.conversationId || !input.modelId || input.checkpointBytes.byteLength === 0) return undefined;
   if (input.checkpointBytes.byteLength > CURSOR_CHECKPOINT_MAX_TOTAL_BYTES) return undefined;
@@ -258,6 +260,7 @@ export function commitCursorCheckpoint(input: {
     ...(input.coveredMessageCount !== undefined ? { coveredMessageCount: input.coveredMessageCount } : {}),
     ...(input.prefixDigest ? { prefixDigest: input.prefixDigest } : {}),
     ...(input.systemDigest ? { systemDigest: input.systemDigest } : {}),
+    ...(input.toolSuspended ? { toolSuspended: true } : {}),
   };
   const blobIds = collectCheckpointBlobIds(input.checkpointBytes);
   if (blobIds === undefined) return undefined;

package/src/adapters/cursor/discovery.ts CHANGED Viewed

@@ -305,15 +305,18 @@ export function isCursorRouterModelId(modelId: string): boolean {
 export function filterCursorConfiguredModelsByLiveDiscovery<T extends { id: string }>(
   configured: readonly T[],
   liveIds: readonly string[],
+  maxModeLiveIds: readonly string[] = [],
 ): T[] {
-  return configured.filter(model =>
-    !CURSOR_KNOWN_UNCALLABLE_MODEL_IDS.has(model.id)
-    && (
-      isCursorRouterModelId(model.id)
-      // Synthetic ultra rows ride their base model's account availability.
-      || isCursorModelAvailableForAccount(cursorUltraBaseModelId(model.id) ?? model.id, liveIds)
-    ),
-  );
+  return configured.filter(model => {
+    if (CURSOR_KNOWN_UNCALLABLE_MODEL_IDS.has(model.id)) return false;
+    if (isCursorRouterModelId(model.id)) return true;
+    const ultraBase = cursorUltraBaseModelId(model.id);
+    return isCursorModelAvailableForAccount(ultraBase ?? model.id, liveIds)
+      // Successful discovery is authoritative: synthetic ultra rows additionally require the
+      // account-specific Max Mode capability. Discovery failures bypass this filter and retain
+      // the static seed under the caller's existing degraded-catalog policy.
+      && (ultraBase === undefined || isCursorModelAvailableForAccount(ultraBase, maxModeLiveIds));
+  });
 }
 /**

package/src/adapters/cursor/effort-map.ts CHANGED Viewed

@@ -38,8 +38,10 @@ const CURSOR_MODEL_EFFORT_TIERS: Record<string, readonly string[]> = {
   "claude-opus-5-fast": ["low", "medium", "high"],
   "claude-sonnet-5": ["low", "medium", "high", "xhigh", "max"],
   "glm-5.2": ["high", "max"],
-  // 260825 live GetUsableModels. gemini-3.6-flash is the only Cursor model exposing `minimal`;
-  // listing it here is also what admits the suffix into CANONICAL_EFFORT_SUFFIXES below.
+  // 260825 live GetUsableModels. gemini-3.6-flash was the first Cursor model exposing
+  // `minimal`; listing a rung here is also what admits the suffix into
+  // CANONICAL_EFFORT_SUFFIXES below. muse-spark-1.3 now carries it too, so `minimal` no
+  // longer depends on this single row.
   "gemini-3.6-flash": ["minimal", "low", "medium", "high"],
   "gemini-3.7-flash": ["low", "medium", "high"],
   // 260903 preemptive: gemini-3.8-flash seeded ahead of Cursor's lineup update, the same way
@@ -91,6 +93,18 @@ const CURSOR_MODEL_EFFORT_TIERS: Record<string, readonly string[]> = {
   "gpt-5.6-sol": ["low", "medium", "high", "xhigh", "max"],
   "gpt-5.6-terra": ["low", "medium", "high", "xhigh", "max"],
   "gpt-5.6-luna": ["low", "medium", "high", "xhigh", "max"],
+  // 260916 live GetUsableModels (#4820) advertises muse-spark-1.3 at minimal, low, medium,
+  // high, xhigh AND max. The seed stops at xhigh deliberately.
+  //
+  // Meta publishes minimal..xhigh for Muse Spark and lists no `max` at all
+  // (dev.meta.ai/docs/reasoning), and an independent OpenCode Zen probe of
+  // muse-spark-1.3-contributor-free rejected max with `unknown variant` — both already
+  // recorded on META_MUSE_REASONING_EFFORTS in src/providers/registry/model-seeds.ts.
+  // Cursor advertising a wire id is not evidence that Run accepts it; that is exactly the
+  // advertised-but-not-callable shape CURSOR_KNOWN_UNCALLABLE_MODEL_IDS was created for.
+  // Publishing the rung anyway would invent a capability on two sources' contrary evidence.
+  // Add `max` here once a Cursor Run at max is observed to succeed.
+  "muse-spark-1.3": ["minimal", "low", "medium", "high", "xhigh"],
 };
 /** All effort suffixes accepted when matching live Cursor model ids to configured base ids. */

package/src/adapters/cursor/envelope-echo.ts CHANGED Viewed

@@ -13,6 +13,58 @@
  */
 const ECHO_MARKERS = ["[Tool Result]", "[Tool Error]", "[tool_result]"] as const;
+function isEchoMarkerLine(line: string): boolean {
+  return (ECHO_MARKERS as readonly string[]).includes(line.replace(/^[ \t]+/, ""));
+}
+/**
+ * Drop echoed tool-result envelopes from assistant history before Cursor root replay.
+ *
+ * The prefix sniffer catches an echo that STARTS a turn, but grok-4.6 routinely writes a real
+ * sentence first and pastes the envelope after it. That text has already reached the client and
+ * is stored as assistant output, so replaying it verbatim re-primes the next turn with the very
+ * envelope the model is copying.
+ *
+ * Scope starts AT the marker line and runs to the next blank line, rather than to the end of
+ * the message. The echoed envelope has no terminator we can recognise — we build it as a marker
+ * line plus arbitrary result text (protobuf-request.ts), and the observed copies are not
+ * byte-exact, so matching against the replayed envelope is not available either. Truncating to
+ * the end of the message was the alternative, and it discards a genuine answer whenever the
+ * model resumes after the echo. A blank line is the one boundary the model reliably writes when
+ * it goes back to prose.
+ *
+ * The tradeoff is explicit: an echoed envelope whose pasted result itself contains a blank line
+ * leaves its remainder in replay. That is the safer direction to be wrong in — conversation
+ * remint, not this filter, is the primary defence against a poisoned conversation, and this only
+ * stops the transcript from feeding itself.
+ *
+ * Only whole-line markers count, so prose such as "the string [Tool Result] appeared" survives.
+ */
+export function stripAssistantEchoedToolEnvelope(text: string): string {
+  if (!text || !ECHO_MARKERS.some(marker => text.includes(marker))) return text;
+  const newline = text.includes("\r\n") ? "\r\n" : "\n";
+  const lines = text.split(/\r?\n/);
+  const kept: string[] = [];
+  let dropped = false;
+  let index = 0;
+  while (index < lines.length) {
+    const line = lines[index] ?? "";
+    if (!isEchoMarkerLine(line)) {
+      kept.push(line);
+      index += 1;
+      continue;
+    }
+    dropped = true;
+    index += 1;
+    // The envelope body is the contiguous non-blank run after the marker. The blank line that
+    // ends it is left in place, so surviving prose on either side stays separated.
+    while (index < lines.length && (lines[index] ?? "").trim() !== "") index += 1;
+  }
+  if (!dropped) return text;
+  return kept.join(newline).trimEnd();
+}
 const MAX_SNIFF_BYTES = 40;
 /** Mid-stream observer: max leading whitespace on a line before matching disarms. */
 const MAX_MIDSTREAM_LINE_INDENT = 128;
@@ -66,8 +118,9 @@ export interface MidstreamEchoFinding {
  * MIDDLE of an agent message — after legitimate leading text — one of them
  * carrying a whitespace-spliced call-id ("fc_x mar-y" instead of "fc_x-y").
  * Deltas at that point have already reached the client, so this observer
- * never throws and never withholds output: it records findings so the
- * adapter can emit a structured diagnostic at turn end. Only fixed marker
+ * never throws and never withholds output. It records findings so the adapter
+ * can emit a structured diagnostic and remint the conversation for the next
+ * turn at turn end. Only fixed marker
  * enums, numeric offsets, and corruption booleans are retained — never
  * content bytes.
  */