@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/adapters/devin/cloud-direct/stated-reset-retry.ts

@@ -0,0 +1,140 @@
+/**
+ * Same-target retry of an explicit, pre-output 429 refusal with a stated
+ * recovery delay. No event-producing attempt is ever automatically replayed.
+ * This is a refusal-specific policy, not a claim that every eventless POST
+ * is idempotent; ambiguous transport failures still propagate unchanged.
+ */
+import { parseRetryAfterFromMessage } from '../../../lib/retry-delay.js';
+import type { AdapterFetchContext } from '../../base.js';
+import { createAdapterPhysicalSend } from '../../physical-send.js';
+import { abortError, SendBudgetExhaustedError, sleepWithAbort } from '../../../lib/upstream-retry.js';
+import { CloudChatError, streamChatEvents, type CloudChatEvent, type CloudChatRequest } from './chat.js';
+
+/** 1 initial attempt plus at most 2 replays. */
+export const STATED_RESET_MAX_REPLAYS = 2;
+/** Default cumulative wait allowance for one invocation (30 minutes). */
+export const STATED_RESET_MAX_WAIT_MS = 1_800_000;
+/** Absolute maximum cumulative allowance, including explicit overrides. */
+export const STATED_RESET_WAIT_CEILING_MS = 3_600_000;
+
+function statedResetMaxWaitMs(): number {
+  const raw = process.env.OPENCODEX_DEVIN_STATED_RESET_WAIT_MS?.trim();
+  if (!raw) return STATED_RESET_MAX_WAIT_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) return STATED_RESET_MAX_WAIT_MS;
+  // Zero explicitly disables local waiting. Values above one hour are capped.
+  return Math.min(Math.floor(parsed), STATED_RESET_WAIT_CEILING_MS);
+}
+export const statedResetMaxWaitMsForTests = statedResetMaxWaitMs;
+
+export interface StatedResetRetryOptions {
+  /** Test seam: defaults to the real cloud stream. */
+  stream?: (req: CloudChatRequest) => AsyncGenerator<CloudChatEvent>;
+  /** Test seam: must either honour the whole delay or reject on cancellation. */
+  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+  maxReplays?: number;
+  /** CUMULATIVE wait allowance, not a fresh allowance on every failure. */
+  maxWaitMs?: number;
+  /** Request-wide execution authority. Absent preserves context-free callers' unlimited fetch. */
+  execution?: Pick<
+    AdapterFetchContext,
+    "executor" | "sendBudget" | "onPhysicalSend" | "onRecoveryWithheld"
+  >;
+}
+
+function replayLimit(value: number | undefined): number {
+  if (value === undefined) return STATED_RESET_MAX_REPLAYS;
+  if (!Number.isInteger(value) || value < 0 || value > STATED_RESET_MAX_REPLAYS) {
+    throw new RangeError('maxReplays must be an integer from 0 to 2');
+  }
+  return value;
+}
+
+function waitLimit(value: number | undefined): number {
+  if (value === undefined) return statedResetMaxWaitMs();
+  if (!Number.isFinite(value) || value < 0) {
+    throw new RangeError('maxWaitMs must be a finite non-negative number');
+  }
+  return Math.min(Math.floor(value), STATED_RESET_WAIT_CEILING_MS);
+}
+
+export async function* streamChatEventsWithResetRetry(
+  req: CloudChatRequest,
+  options?: StatedResetRetryOptions,
+): AsyncGenerator<CloudChatEvent> {
+  const stream = options?.stream ?? streamChatEvents;
+  const sleep = options?.sleep ?? sleepWithAbort;
+  const maxReplays = replayLimit(options?.maxReplays);
+  const maxWaitMs = waitLimit(options?.maxWaitMs);
+  const execution = options?.execution;
+  // One sender owns the whole invocation so ordinals span the initial POST and both replays.
+  // Its executor remains lazy: replay admission happens after the provider-stated wait, never
+  // while a reservation could be held for up to an hour.
+  const send = execution
+    ? createAdapterPhysicalSend({ ...execution, abortSignal: req.signal })
+    : undefined;
+  let replays = 0;
+  let waitedMs = 0;
+  let replaySourceError: CloudChatError | undefined;
+  while (true) {
+    // Check again after sleeping: cancellation can race with timer completion.
+    // A pre-aborted request must not even enter a custom transport.
+    if (req.signal?.aborted) throw abortError(req.signal);
+    let yielded = false;
+    try {
+      const recovery = replays > 0 ? "rate-limit-429" as const : undefined;
+      const attemptRequest = send
+        ? {
+            ...req,
+            executor: ((input, init) => send({
+              url: typeof input === "string" ? input : input instanceof URL ? input.href : input.url,
+              ...(recovery ? { sendClass: "auth-recovery" as const, recovery } : {}),
+              dispatch: executor => executor(input, init),
+            })) as typeof globalThis.fetch,
+          }
+        : req;
+      for await (const event of stream(attemptRequest)) {
+        // Latch before yielding, so a consumer-injected error is post-output.
+        yielded = true;
+        yield event;
+      }
+      return;
+    } catch (error) {
+      if (req.signal?.aborted) throw abortError(req.signal);
+      if (!yielded && error instanceof SendBudgetExhaustedError && replaySourceError) {
+        // The provider's refusal is the real upstream answer. A local cap can withhold its
+        // recovery, but replacing the 429 would erase the status and stated reset metadata.
+        execution?.onRecoveryWithheld?.({ reason: "retry-send-budget" });
+        throw replaySourceError;
+      }
+      const retryableError = !yielded
+        && error instanceof CloudChatError
+        && error.status === 429
+        ? error
+        : undefined;
+      const waitSec = retryableError
+        ? parseRetryAfterFromMessage(retryableError.message)
+        : undefined;
+      const waitMs = waitSec === undefined ? undefined : waitSec * 1000;
+      if (
+        retryableError === undefined
+        || waitMs === undefined
+        || replays >= maxReplays
+        || waitMs > maxWaitMs - waitedMs
+      ) {
+        // Never shorten a provider's minimum delay to fit the local budget.
+        // Keep the original refusal so outer policy can preserve its metadata.
+        throw error;
+      }
+      replays += 1;
+      replaySourceError = retryableError;
+      // Charge the complete scheduled wait once, before sleeping. This is a
+      // sleep allowance, not a wall-clock deadline on generation or timer
+      // scheduling: waking a few milliseconds late must not reject an already
+      // approved one-hour retry. No later wait can spend this allowance again.
+      waitedMs += waitMs;
+      await sleep(waitMs, req.signal);
+      if (req.signal?.aborted) throw abortError(req.signal);
+    }
+  }
+}

package/src/adapters/devin.ts

@@ -9,12 +9,14 @@
 import type { AdapterEvent, OcxAssistantMessage, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTool, OcxToolCall, OcxToolResultMessage, OcxUsage } from "../types";
 import { namespacedToolName } from "../types";
 import type { IncomingMeta, ProviderAdapter } from "./base";
-import { streamChatEvents, allocateCascadeId, CloudChatError, type ChatHistoryItem, type ToolDef } from "./devin/cloud-direct";
+import { streamChatEventsWithResetRetry, allocateCascadeId, CloudChatError, type ChatHistoryItem, type ToolDef } from "./devin/cloud-direct";
 import type { ContentPart } from "./devin/cloud-direct/chat";
-import { getCachedCatalog } from "./devin/cloud-direct/catalog";
+import { getCachedCatalog, type CacheEntry } from "./devin/cloud-direct/catalog";
 import { collapseDevinModelUid } from "./devin/live-models";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiServer } from "../oauth/devin";
+import { isProviderIssuedThinkingSignature } from "../responses/reasoning-envelope";
+import { SendBudgetExhaustedError } from "../lib/upstream-retry";
 
 /**
  * Combine two usage frames from one turn by keeping the larger count per field.
@@ -155,6 +157,7 @@ async function resolveWireModelUid(
   apiKey: string,
   host: string,
   reasoningEffort?: string,
+  catalog?: CacheEntry | null,
 ): Promise<string> {
   const modelId = normalizeDevinModelId(rawModelId);
   // Explicit effort wins over a suffix the picker already baked into the id, so
@@ -163,15 +166,18 @@ async function resolveWireModelUid(
   const swe2 = resolveSwe2Variant(modelId, reasoningEffort);
   if (swe2) return swe2;
   if (hasEffortSuffix(modelId)) return modelId;
-  const catalog = await getCachedCatalog(apiKey, host);
-  if (catalog) {
-    if (catalog.byUid.has(modelId)) return modelId;
+  // Callers that already read the catalog this turn pass it in; an explicit
+  // null records a failed lookup and must not trigger a same-turn retry —
+  // failures are not cached, so re-reading would only pay another timeout.
+  const entry = catalog !== undefined ? catalog : await getCachedCatalog(apiKey, host);
+  if (entry) {
+    if (entry.byUid.has(modelId)) return modelId;
     const effort = reasoningEffort && CALLER_EFFORT_VALUES.has(reasoningEffort) ? reasoningEffort : "medium";
     const suffixed = `${modelId}-${effort}`;
-    if (catalog.byUid.has(suffixed)) return suffixed;
+    if (entry.byUid.has(suffixed)) return suffixed;
     // Fall back to any enabled variant of this base model.
-    for (const uid of catalog.byUid.keys()) {
-      if (uid.startsWith(modelId + "-") && !catalog.byUid.get(uid)?.disabled) return uid;
+    for (const uid of entry.byUid.keys()) {
+      if (uid.startsWith(modelId + "-") && !entry.byUid.get(uid)?.disabled) return uid;
     }
   }
   // Degraded mode: append the default effort suffix.
@@ -186,6 +192,46 @@ async function resolveWireModelUid(
  */
 export const resolveWireModelUidForTests = resolveWireModelUid;
 
+/**
+ * Resolve the INPUT ceiling for the exact UID selected for this turn. Catalog
+ * ClientModelConfig #18 and CompletionConfiguration #3 both carry input tokens;
+ * the independent output cap is not subtracted here. Smaller operator hints
+ * cap live evidence, never enlarge it. No evidence leaves the encoder's 128k
+ * fallback intact; an unrelated or opt-in long-context variant is not evidence.
+ */
+function resolveDevinMaxInputTokens(
+  provider: OcxProviderConfig,
+  modelUid: string,
+  liveWindow?: number,
+): number | undefined {
+  const positive = (value: unknown): number | undefined =>
+    typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+  const baseId = collapseDevinModelUid(modelUid);
+  const configured = (record: Record<string, number> | undefined): number | undefined => {
+    if (!record) return undefined;
+    for (const id of [modelUid, baseId]) {
+      // Prefer the canonical spelling; retain dotted/case-folded saved hints,
+      // matching the model-id normalization used for the inference request.
+      const exact = Object.hasOwn(record, id) ? positive(record[id]) : undefined;
+      if (exact !== undefined) return exact;
+      const matches = Object.entries(record)
+        .filter(([key]) => normalizeDevinModelId(key).toLowerCase() === id.toLowerCase())
+        .map(([, value]) => positive(value))
+        .filter((value): value is number => value !== undefined);
+      if (matches.length > 0) return Math.min(...matches);
+    }
+    return undefined;
+  };
+  const contextHint = configured(provider.modelContextWindows) ?? positive(provider.contextWindow);
+  const inputHint = configured(provider.modelMaxInputTokens);
+  const ceilings = [positive(liveWindow), contextHint, inputHint]
+    .filter((value): value is number => value !== undefined);
+  return ceilings.length > 0 ? Math.min(...ceilings) : undefined;
+}
+
+/** Pure test seam; runtime uses the same resolver immediately before dispatch. */
+export const resolveDevinMaxInputTokensForTests = resolveDevinMaxInputTokens;
+
 export class DevinMissingCredentialError extends Error {
   constructor() {
     super("Devin live transport requires a Devin API key. Run ocx login devin to sign in with your Cognition/Devin account.");
@@ -209,6 +255,17 @@ function textFromParts(content: string | OcxContentPart[] | undefined): string {
   return content.map((part) => (part.type === "text" ? part.text : "")).filter(Boolean).join("\n");
 }
 
+const MAX_DEVIN_REMOTE_IMAGE_URL_CHARS = 8_192;
+
+function boundedDevinRemoteImageReference(imageUrl: string): string | undefined {
+  if (imageUrl.length > MAX_DEVIN_REMOTE_IMAGE_URL_CHARS) return undefined;
+  try {
+    return new URL(imageUrl).protocol === "https:" ? imageUrl : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Convert inbound content parts to the multimodal shape the wire encoder accepts.
  *
@@ -217,9 +274,10 @@ function textFromParts(content: string | OcxContentPart[] | undefined): string {
  * text-only string and a message whose only content was an image was dropped
  * entirely, which is why a pasted screenshot killed the turn and the only
  * workaround was running OCR before sending. A data: URL carries everything
- * field #10 needs; a remote https URL cannot be inlined without a fetch, so it
- * stays as an explicit text reference rather than pretending the model can see
- * a picture it cannot. Video has no Devin field and is skipped.
+ * field #10 needs; a bounded remote https URL cannot be inlined without a fetch,
+ * so it stays as an explicit text reference rather than pretending the model can
+ * see a picture it cannot. Unsupported and oversized references become a fixed
+ * omission marker, never attacker-sized prompt text. Video has no Devin field.
  */
 function mapOcxContentToWire(content: string | OcxContentPart[] | undefined): string | ContentPart[] {
   if (typeof content === "string" || !Array.isArray(content)) return content ?? "";
@@ -230,7 +288,13 @@ function mapOcxContentToWire(content: string | OcxContentPart[] | undefined): st
     } else if (part.type === "image") {
       const m = part.imageUrl.match(/^data:([^;]+);base64,(.+)$/);
       if (m) out.push({ type: "image", mimeType: m[1]!, base64Data: m[2]! });
-      else out.push({ type: "text", text: `[image url: ${part.imageUrl}]` });
+      else {
+        const remoteReference = boundedDevinRemoteImageReference(part.imageUrl);
+        out.push({
+          type: "text",
+          text: remoteReference ? `[image url: ${remoteReference}]` : "[image omitted: unsupported or oversized URL]",
+        });
+      }
     }
   }
   return out;
@@ -266,23 +330,26 @@ function assistantText(message: OcxAssistantMessage): string {
  * clients of the same service write #11 thinking with #12 signature and #18
  * signature_type on the assistant prompt.
  *
- * The signature attests the thinking it was produced with, so a block without
- * one contributes its text and nothing else rather than borrowing a neighbour's.
+ * Field #12 attests the exact text at #11, and the wire has room for one pair.
+ * Every block that carries text is replayed, so the chain stays intact; the
+ * signature rides along only when the text being replayed IS the text it
+ * attests, which is exactly the single-block case. Several independently signed
+ * blocks send an unsigned prompt rather than pairing one block's attestation
+ * with another block's words. A signature-only block attests encrypted thinking
+ * that is not being replayed at all, so it is not one of these blocks and
+ * cannot contribute the pair.
  */
 function assistantThinking(
   message: OcxAssistantMessage,
 ): { thinking?: string; signature?: string } {
   const blocks = message.content.filter(
     (part): part is Extract<typeof part, { type: "thinking" }> => part.type === "thinking",
-  );
+  ).filter(part => Boolean(part.thinking));
   if (blocks.length === 0) return {};
-  const thinking = blocks.map(b => b.thinking).filter(Boolean).join("\n");
-  // Only one signature can ride the prompt, so take the last block that has
-  // one: that is the block the turn actually ended on.
-  const signature = blocks.filter(b => b.signature).at(-1)?.signature;
+  const signature = blocks.length === 1 ? blocks[0]!.signature : undefined;
   return {
-    ...(thinking ? { thinking } : {}),
-    ...(signature ? { signature } : {}),
+    thinking: blocks.map(part => part.thinking).join("\n"),
+    ...(isProviderIssuedThinkingSignature(signature) ? { signature } : {}),
   };
 }
 
@@ -446,6 +513,10 @@ export function createDevinAdapter(
 
   return {
     name: "devin",
+    // Every GetChatMessage send, including the first, is admitted through the shared budget and
+    // reported from the executor that dispatches it. The caller therefore leaves the first
+    // send's accounting here rather than logging it before admission can refuse it.
+    reportsPhysicalSends: true,
 
     buildRequest() {
       return {
@@ -493,7 +564,16 @@ export function createDevinAdapter(
       // entry: an EU or FedStart account that used provider.baseUrl would send
       // every RPC to the US server it is not provisioned on.
       const host = resolveDevinApiServer(provider.baseUrl, credentialProviderId);
-      const modelUid = await resolveWireModelUid(rawModelId, apiKey, host, parsed.options.reasoning);
+      // One catalog read per turn serves model-UID resolution, the input
+      // ceiling, and the chat pre-flight inside streamChatEvents. Failures are
+      // not cached, so a second read would only pay another fetch timeout on
+      // an otherwise valid turn.
+      const catalog = await getCachedCatalog(apiKey, host, incoming.abortSignal);
+      if (incoming.abortSignal?.aborted) {
+        emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false });
+        return;
+      }
+      const modelUid = await resolveWireModelUid(rawModelId, apiKey, host, parsed.options.reasoning, catalog);
       const returnedToolNames = buildDevinReturnedToolNameMap(parsed.context.tools);
       let openToolId: string | undefined;
       let usage: OcxUsage | undefined;
@@ -506,22 +586,38 @@ export function createDevinAdapter(
       };
 
       try {
-        for await (const event of streamChatEvents({
+        // Read the selected UID's catalog row, not the picker's collapsed base.
+        const maxInputTokens = resolveDevinMaxInputTokens(
+          provider, modelUid, catalog?.byUid.get(modelUid)?.contextWindow,
+        );
+        // The reset-retry wrapper waits out a 429 that states its own recovery
+        // delay ("limit will reset in 35 seconds") and replays the identical
+        // request — but only while zero events have been yielded, so a
+        // post-output failure still takes the terminal path untouched.
+        for await (const event of streamChatEventsWithResetRetry({
           apiKey,
           apiServerUrl: host,
           modelUid,
+          catalog,
           messages: mapOcxMessagesToDevin(parsed),
           tools: mapOcxToolsToDevin(parsed.context.tools),
           cascadeId,
-          // Without these the request falls back to the encoder's defaults
-          // (8192 output, a 128k context window, temperature 0.7), so a client
-          // that asked for a 4k cap never got one.
+          // Input and output ceilings are separate wire fields. Omitting the
+          // input hint used to force every model through the 128k default.
           completionOpts: {
+            ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
             ...(typeof parsed.options.maxOutputTokens === "number" ? { maxOutputTokens: parsed.options.maxOutputTokens } : {}),
             ...(typeof parsed.options.temperature === "number" ? { temperature: parsed.options.temperature } : {}),
             ...(typeof parsed.options.topP === "number" ? { topP: parsed.options.topP } : {}),
           },
           signal: incoming.abortSignal,
+        }, {
+          execution: {
+            executor: incoming.providerFetch,
+            sendBudget: incoming.sendBudget,
+            onPhysicalSend: incoming.onPhysicalSend,
+            onRecoveryWithheld: incoming.onRecoveryWithheld,
+          },
         })) {
           if (incoming.abortSignal?.aborted) {
             // Emitting nothing here left the bridge to synthesize adapter_eof.
@@ -600,6 +696,9 @@ export function createDevinAdapter(
           emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false, ...(usage ? { usage } : {}) });
           return;
         }
+        // The Responses boundary already maps this local refusal to its structured 429 code.
+        // Converting it to an adapter event would make it an ordinary untyped upstream error.
+        if (error instanceof SendBudgetExhaustedError) throw error;
         const message = error instanceof CloudChatError
           ? ("Devin cloud error" + (error.code ? " " + error.code : "") + ": " + error.message)
           : error instanceof Error ? error.message : String(error);

package/src/adapters/google-antigravity-replay.ts

@@ -629,7 +629,7 @@ export function antigravityUsesReplayCache(model: string): boolean {
  * neither the wire metadata nor the replay cache can supply a real one, this is the official
  * validator-bypass token.
  */
-const THOUGHT_SIGNATURE_BYPASS = "skip_thought_signature_validator";
+export const THOUGHT_SIGNATURE_BYPASS = "skip_thought_signature_validator";
 
 /**
  * True when the model speaks the Gemini wire dialect that requires a thought signature on the

package/src/adapters/google-antigravity-wire.ts

@@ -77,7 +77,7 @@ export function antigravitySessionId(parsed: OcxParsedRequest): string {
   //
   // Clients that send no thread header keep the text anchor and its instability; this is a scoped
   // repair, not a universal one.
-  const text = clientThreadAnchor(parsed) ?? firstUserText(parsed);
+  const text = codexThreadAnchor(parsed).preimage ?? firstUserText(parsed);
   if (!text) return `-${Math.floor(Math.random() * 9e18).toString()}`;
   const digest = createHash("sha256").update(text, "utf8").digest();
   const masked = digest.readBigUInt64BE(0) & 0x7fffffffffffffffn;
@@ -96,9 +96,60 @@ export function antigravitySessionId(parsed: OcxParsedRequest): string {
  * functionCall identity (name+args), so a shared id does not misattribute them. Instability, not
  * collision, is the failure mode this function exists to prevent.
  */
-function clientThreadAnchor(parsed: OcxParsedRequest): string | undefined {
-  const threadId = parsed._clientThreadId?.trim();
-  return threadId ? `codex-thread:${threadId}` : undefined;
+function codexThreadAnchor(parsed: OcxParsedRequest): {
+  kind: "parent-and-own" | "parent-only" | "absent";
+  preimage?: string;
+} {
+  // `_clientThreadId` carries `x-codex-parent-thread-id`, which every parallel child of one
+  // parent presents identically, so anchoring on it alone collapsed concurrent children onto a
+  // single upstream Cloud Code Assist session (#5033).
+  //
+  // A thread id is only unique WITHIN its parent, which is why `codexConversationIdentity` keys
+  // on both. #5054 anchored on the child alone and therefore only moved the collision: two
+  // parents can each have a child of the same id (#5058). The pair is the identity, joined by a
+  // NUL so the encoding is injective: no Codex id contains one, so a pair cannot be re-read as a
+  // different pair, nor as the parent-only anchor below.
+  //
+  // Deliberately NOT the general lane key: `codexConversationKeyFor` is an HMAC under a
+  // process-random secret, so it changes across a proxy restart — and instability, not sharing,
+  // is the failure mode this derivation has to avoid. These ids are Codex's own values and
+  // survive both compaction and restart.
+  const own = parsed._codexOwnThreadId?.trim();
+  const parent = parsed._clientThreadId?.trim();
+  if (own && parent) return { kind: "parent-and-own", preimage: `codex-thread:${parent}\u0000${own}` };
+  // Parent-only clients keep the anchor they already had.
+  if (parent) return { kind: "parent-only", preimage: `codex-thread:${parent}` };
+  // A parentless ROOT deliberately omits the parent header. `src/server/context-history.ts` says
+  // so in as many words: root model requests use (session-id=root, thread-id=root) and do not
+  // fabricate a parent key. It has no pair to key on, and #5054's claim that a root presents
+  // `thread-id` equal to its parent was simply wrong.
+  //
+  // So it keeps the pre-#5054 anchor rather than gaining an own-thread one. That is not a
+  // preference: durable Antigravity replay state is keyed by model plus session id, and moving a
+  // root's anchor on upgrade strands every signature stored under the old session — the exact
+  // instability this derivation exists to avoid, introduced while fixing sharing.
+  return { kind: "absent" };
+}
+
+/**
+ * Which class of anchor {@link antigravitySessionId} derives this request's session id from.
+ *
+ * The id itself identifies a live conversation and is a Google-visible wire value, so it is not
+ * something a user can paste into a public bug report. The class is: it distinguishes the four
+ * stability regimes above — a Codex parent/child pair, a parent-only client, the content-derived
+ * text anchor that compaction can move, and the random fallback that changes every turn — while
+ * carrying no identity at all.
+ *
+ * It reads the SAME decision the id derivation reads, so the two cannot disagree about which
+ * regime a request is in. What it does not do is change how the id itself is derived: nothing
+ * about a Google-visible wire value moves because a diagnostic wants to describe it.
+ */
+export type AntigravitySessionAnchor = "parent-and-own" | "parent-only" | "text" | "none";
+
+export function antigravitySessionAnchor(parsed: OcxParsedRequest): AntigravitySessionAnchor {
+  const anchor = codexThreadAnchor(parsed);
+  if (anchor.kind !== "absent") return anchor.kind;
+  return firstUserText(parsed) ? "text" : "none";
 }
 
 /** A Gemini content part as it appears in an Antigravity request body. */

package/src/adapters/google-http.ts

@@ -2,8 +2,10 @@ import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { createAdapterPhysicalSend } from "./physical-send";
 import type { SendClass } from "../lib/request-execution-budget";
 import type { AttemptRecoveryKind } from "../usage/log";
+import { debugProviderDiagnosticLazy } from "../lib/debug";
 import { isQuotaExhaustedBody, retryableGoogleStatus, safeGoogleHttpErrorMessage } from "./google-errors";
-import { repairGoogleInvalidRequestBody } from "./google-wire-compiler";
+import { repairGoogleInvalidRequestBodyWithReport } from "./google-wire-compiler";
+import type { GoogleToolSchemaPolicy, GoogleToolSchemaProfile } from "./google-tool-schema";
 import { normalizeUpstreamHttpErrorResponse, readDisplaySafeErrorPayloadText } from "./upstream-http-error";
 import {
   abortError,
@@ -22,6 +24,8 @@ const GOOGLE_RETRY_MAX_MS = 2_000;
 export interface GoogleRetryOptions {
   /** Repair-and-replay structurally invalid 400 bodies (Vertex/Antigravity behavior). */
   repairInvalid400?: boolean;
+  toolSchemaProfile?: GoogleToolSchemaProfile;
+  toolSchemaPolicy?: GoogleToolSchemaPolicy;
 }
 
 async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
@@ -45,6 +49,8 @@ export async function fetchGoogleWithRetry(
   opts: GoogleRetryOptions = {},
 ): Promise<Response> {
   const repairInvalid400 = opts.repairInvalid400 ?? true;
+  const toolSchemaProfile = opts.toolSchemaProfile ?? { endpointClass: "vertex" };
+  const toolSchemaPolicy = opts.toolSchemaPolicy ?? "compatible";
   const timeoutMs = ctx.timeoutMs ?? 200_000;
   const send = createAdapterPhysicalSend(ctx);
   let lastError: unknown;
@@ -77,10 +83,22 @@ export async function fetchGoogleWithRetry(
         } catch (error) {
           if (ctx.abortSignal?.aborted) throw error;
         }
-        const repairedBody = repairGoogleInvalidRequestBody(activeRequest.body, payloadText);
-        if (repairedBody !== undefined) {
+        const repair = repairGoogleInvalidRequestBodyWithReport(activeRequest.body, payloadText, toolSchemaProfile);
+        if (repair !== undefined) {
+          if (repair.toolSchemaLoss) {
+            const changedSendAllowed = toolSchemaPolicy !== "reject-lossy";
+            debugProviderDiagnosticLazy("google", "google-tool-schema-repair", () => ({
+              ...repair.toolSchemaLoss,
+              phase: "repair",
+              declarationCount: repair.toolSchemaDeclarationCount ?? 0,
+              changedSendAllowed,
+            }));
+            if (!changedSendAllowed) {
+              return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
+            }
+          }
           compatibilityReplayUsed = true;
-          activeRequest = { ...activeRequest, body: repairedBody };
+          activeRequest = { ...activeRequest, body: repair.body };
           pendingResponse = res;
           sendClass = "repair";
           attempt--; // The changed-request replay is separate from transient retry accounting.
@@ -112,7 +130,14 @@ export async function fetchGoogleWithRetry(
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;
       if (err instanceof SendBudgetExhaustedError) {
-        if (pendingResponse) return ctx.returnRawErrors ? pendingResponse : normalizeFinalGoogleError(label, pendingResponse, ctx.abortSignal);
+        if (pendingResponse) {
+          // The ladder had already classified this response as retryable and was about to send
+          // again; the budget refused. Returning the original response is right — it is a real
+          // upstream answer — but it used to leave the log indistinguishable from a request
+          // where no retry was ever eligible (#5044).
+          ctx.onRecoveryWithheld?.({ reason: "retry-send-budget" });
+          return ctx.returnRawErrors ? pendingResponse : normalizeFinalGoogleError(label, pendingResponse, ctx.abortSignal);
+        }
         throw err;
       }
       lastError = err;
@@ -138,16 +163,37 @@ export async function fetchGoogleWithRetry(
  * demand" spikes, plus plain rate-limit 429s, both of which previously failed immediately
  * because the default server fetch path only retries connection resets.
  */
-export function fetchDirectGeminiWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
-  return fetchGoogleWithRetry("Gemini", request, { ...ctx, returnRawErrors: true }, { repairInvalid400: false });
+export function fetchDirectGeminiWithRetry(
+  request: AdapterRequest,
+  ctx: AdapterFetchContext = {},
+  schemaPolicy: Pick<GoogleRetryOptions, "toolSchemaProfile" | "toolSchemaPolicy"> = {},
+): Promise<Response> {
+  return fetchGoogleWithRetry("Gemini", request, { ...ctx, returnRawErrors: true }, {
+    ...schemaPolicy,
+    repairInvalid400: false,
+  });
 }
 
 /** Vertex AI retry wrapper. */
-export function fetchVertexWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
-  return fetchGoogleWithRetry("Vertex AI", request, ctx);
+export function fetchVertexWithRetry(
+  request: AdapterRequest,
+  ctx: AdapterFetchContext = {},
+  schemaPolicy: Pick<GoogleRetryOptions, "toolSchemaProfile" | "toolSchemaPolicy"> = {},
+): Promise<Response> {
+  return fetchGoogleWithRetry("Vertex AI", request, ctx, {
+    toolSchemaProfile: { endpointClass: "vertex" },
+    ...schemaPolicy,
+  });
 }
 
 /** Antigravity (Cloud Code Assist) retry wrapper. */
-export function fetchAntigravityWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
-  return fetchGoogleWithRetry("Antigravity", request, ctx);
+export function fetchAntigravityWithRetry(
+  request: AdapterRequest,
+  ctx: AdapterFetchContext = {},
+  schemaPolicy: Pick<GoogleRetryOptions, "toolSchemaProfile" | "toolSchemaPolicy"> = {},
+): Promise<Response> {
+  return fetchGoogleWithRetry("Antigravity", request, ctx, {
+    toolSchemaProfile: { endpointClass: "cloud-code-assist" },
+    ...schemaPolicy,
+  });
 }