@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/server/responses/run-turn-execution.ts

@@ -12,7 +12,7 @@ import {
   adapterNeedsForcedContinuation,
   adapterResponseReachedServingTerminal,
 } from "./core-replay";
-import { sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
+import { noteAttemptRecoveryWithheld, sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
 import { waitForProviderRequestSlot, RequestPacingQueueOverloadError } from "../../providers/request-pacing";
 import type { AdapterEventQueue } from "../../adapters/run-turn-queue";
 import type { AttemptRecoveryKind } from "../../usage/log";
@@ -79,7 +79,11 @@ export async function executeResponsesRunTurn(
   >,
   sendBudgetState: Pick<
     ResponsesSendBudget,
-    "adapterDispatchBudget" | "reserveCredentialHop" | "pendingHopPermit"
+    | "adapterDispatchBudget"
+    | "noteAdapterPhysicalSend"
+    | "noteAdapterRecoveryWithheld"
+    | "reserveCredentialHop"
+    | "pendingHopPermit"
   >,
   completionPolicy: Pick<ResponsesCompletionPolicy, "emptyCompletionGuardEnabled">,
 ): Promise<Response> {
@@ -100,7 +104,12 @@ export async function executeResponsesRunTurn(
     rememberKiroDeliveredFinalAnswer,
     responseStateOptions,
   } = requestState;
-  const { adapterDispatchBudget, reserveCredentialHop } = sendBudgetState;
+  const {
+    adapterDispatchBudget,
+    noteAdapterPhysicalSend,
+    noteAdapterRecoveryWithheld,
+    reserveCredentialHop,
+  } = sendBudgetState;
   const { emptyCompletionGuardEnabled } = completionPolicy;
   const {
     cancelResponseCompletion,
@@ -146,7 +155,11 @@ export async function executeResponsesRunTurn(
           await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
         }
         await refreshRunTurnSelection();
-        transportState.noteRoutedAttemptSend(logCtx.usageLogInputTokens, recovery);
+        // An adapter that reports its own sends accounts for the first one at the boundary that
+        // dispatches it. Logging here would claim a send that the adapter's own budget can still
+        // refuse, which is exactly what happens once earlier recovery has spent the allowance.
+        const reportsOwnSends = transportState.runTurnAdapter.reportsPhysicalSends === true;
+        if (!reportsOwnSends) transportState.noteRoutedAttemptSend(logCtx.usageLogInputTokens, recovery);
         const runTurnProviderFetch = providerFetch(
           route.provider,
           options.codexWsRuntimeIdentity,
@@ -169,6 +182,14 @@ export async function executeResponsesRunTurn(
             // The only way the request budget reaches a transport the adapter owns. Without it
             // a Cursor turn's inner ladder was three physical sends the cap read as one.
             ...(adapterDispatchBudget ? { sendBudget: adapterDispatchBudget } : {}),
+            onPhysicalSend: send => noteAdapterPhysicalSend(
+              logCtx.usageLogInputTokens,
+              // The attempt's own recovery kind still labels its first send when the adapter
+              // does not supply one of its own.
+              { ...send, ...(send.recovery ?? recovery ? { recovery: send.recovery ?? recovery } : {}) },
+              { includeFirst: reportsOwnSends },
+            ),
+            onRecoveryWithheld: noteAdapterRecoveryWithheld,
           },
           targetQueue.push,
         );
@@ -231,12 +252,21 @@ export async function executeResponsesRunTurn(
         "auth-recovery",
         `${route.providerName}|${route.modelId}|runturn-oauth-429`,
       );
-      if (!hop.allowed) return false;
+      if (!hop.allowed) {
+        // The roster bound above already said this credential set may rotate again; the shared
+        // request budget is what refused. Returning false lets the preflight 429 reach the
+        // client unchanged, which is right, but it used to leave a log indistinguishable from
+        // a request where no rotation was ever available (#5044).
+        noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
+        return false;
+      }
       const nextAccountId = rotateGenericOAuthAccountOn429(
         config,
         route.providerName,
         transportState.genericFailoverAccountId,
         null,
+        Date.now(),
+        route.modelId,
       );
       if (!nextAccountId) {
         hop.permit?.release();
@@ -245,7 +275,8 @@ export async function executeResponsesRunTurn(
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
         transportState.genericFailovers += 1;
-        if (!await applyFailoverSnapshot(snapshot)) {
+        const admittedSnapshot = await applyFailoverSnapshot(snapshot);
+        if (!admittedSnapshot) {
           hop.permit?.release();
           return false;
         }
@@ -263,6 +294,7 @@ export async function executeResponsesRunTurn(
           route.modelId,
           route.provider,
           inboundWire,
+          route.staticPolicy,
         );
         const rotatedAdapter = resolveSelectionAdapter(rotatedProvider, config.cacheRetention);
         if (!rotatedAdapter.runTurn) {
@@ -275,7 +307,10 @@ export async function executeResponsesRunTurn(
           providerName: route.providerName,
           provider: rotatedProvider,
           adapterName: rotatedAdapter.name,
-          oauthCredentialSnapshot: { accountId: snapshot.accountId, generation: snapshot.generation },
+          oauthCredentialSnapshot: {
+            accountId: admittedSnapshot.accountId,
+            generation: admittedSnapshot.generation,
+          },
           codexAuthContext: admissionState.authCtx,
           forwardHeaders: requestState.selectedForwardHeaders,
         });
@@ -299,7 +334,9 @@ export async function executeResponsesRunTurn(
       try {
         while (true) {
           const preflight = await preflightAdapterEvents(source);
-          if (!preflight.error || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
+          if (preflight.replayUnsafe
+            || !preflight.error
+            || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
             return preflight.stream;
           }
           const retryQueue = createAdapterEventQueue({

package/src/server/responses/sidecar-execution.ts

@@ -17,6 +17,7 @@ import {
   clampImageMaxRounds,
 } from "../../images";
 import type { ProviderAdapter } from "../../adapters/base";
+import type { OcxParsedRequest } from "../../types";
 import { rotateProviderTransportOn429, rateLimitRetryPolicyFor } from "../../providers/key-failover";
 import {
   GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
@@ -155,6 +156,7 @@ export async function executeResponsesSidecars(
   const rotateSidecarProviderOn429 = async (
     retryAfter: string | null,
     responseHeaders?: Headers,
+    retryParsed?: OcxParsedRequest,
   ): Promise<ProviderAdapter | null> => {
     const rotated = rotateProviderTransportOn429(config, route.providerName, route.provider, {
       retryAfter,
@@ -186,6 +188,8 @@ export async function executeResponsesSidecars(
         route.providerName,
         transportState.genericFailoverAccountId,
         retryAfter,
+        Date.now(),
+        route.modelId,
       );
       if (!nextAccountId) {
         hop.permit?.release();
@@ -194,7 +198,7 @@ export async function executeResponsesSidecars(
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
         transportState.genericFailovers += 1;
-        if (!await applyFailoverSnapshot(snapshot)) {
+        if (!await applyFailoverSnapshot(snapshot, retryParsed)) {
           hop.permit?.release();
           return null;
         }
@@ -252,9 +256,22 @@ export async function executeResponsesSidecars(
       return null;
     }
     const rotatedAdapter = resolveSelectionAdapter(
-      resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+      resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
       config.cacheRetention,
     );
+    // The sidecar loops build each attempt from an iteration-local shallow copy of parsed, so a
+    // rebind that lands only on the outer request never reaches the wire: the retry would pair
+    // the new bearer with the previous account's Kiro routing metadata and continuation identity.
+    // Rebind the exact request the rotated adapter will be built from (same pattern as the
+    // continuation loop's nextParsed); when the hook ran without one, the outer bind below stands.
+    if (retryParsed && retryParsed !== parsed) {
+      bindRouteReasoningReplayScope({
+        parsed: retryParsed,
+        providerName: route.providerName,
+        provider: route.provider,
+        adapterName: rotatedAdapter.name,
+      });
+    }
     bindRouteReasoningReplayScope({
       parsed,
       providerName: route.providerName,

package/src/server/responses/ws-upstream.ts

@@ -16,7 +16,7 @@ import type { NativeResponseControl } from "./native-response-control";
 // (passthrough relay, adapter parsers, usage sniffing) is unchanged.
 
 import { compareBunVersions } from "../../lib/bun-stream-caps";
-import { resolveProxyRoute } from "../../lib/proxy-env";
+import { resolveProxyRoute, socks5ProxyFromEnv } from "../../lib/proxy-env";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { CODEX_RESPONSES_HTTP_URL, CODEX_RESPONSES_WS_URL, prepareCodexHttpInit, prepareCodexWsRequest } from "./codex-ws-request";
 import { codexWsExchange } from "./codex-ws-exchange";
@@ -29,33 +29,14 @@ export { CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_M
 export const MIN_BOUNDED_CODEX_WS_BUN_VERSION = "1.4.0";
 
 /**
- * Dial URL for a request URL. The canonical ChatGPT backend keeps its constant;
- * an operator-opted OpenAI-compatible upstream swaps https for wss on the same
- * path so gateways that serve the Responses WebSocket protocol on their
- * /v1/responses path get the same fast lane. Plain HTTP remains on SSE because
- * a provider WS handshake would otherwise send credentials and request data
- * without transport encryption.
+ * Dial URL for a first-party Responses endpoint. The canonical ChatGPT backend
+ * keeps its constant; the api.openai.com Responses endpoint swaps https for wss
+ * on the same path. No other upstream may enter the WebSocket lane.
  */
 function wsUpstreamUrlFor(httpUrl: string): string {
   if (httpUrl === CODEX_RESPONSES_HTTP_URL) return CODEX_RESPONSES_WS_URL;
-  return httpUrl.replace(/^http(s?):/, "ws$1:");
-}
-
-/**
- * An operator-opted OpenAI-compatible upstream only joins the WS lane for
- * Responses endpoints: the WebSocket path speaks the Responses event protocol,
- * and every downstream consumer (adapter parsers, usage sniffing, SSE relay)
- * assumes that wire. Other paths (chat completions, images, search) stay HTTP.
- */
-function isResponsesWebsocketEligibleUrl(url: string): boolean {
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return false;
-  }
-  return parsed.protocol === "https:"
-    && parsed.pathname.endsWith("/responses");
+  if (httpUrl === OPENAI_API_RESPONSES_URL) return httpUrl.replace(/^http(s?):/, "ws$1:");
+  throw new Error("unsupported Codex WebSocket upstream");
 }
 export type BunRuntimeIdentity = {
   version: string;
@@ -107,8 +88,14 @@ export function shouldUseCodexWsUpstream(
   upstreamWebsocketConfigured = false,
 ): boolean {
   if (!bunSupportsBoundedCodexWsRelay(runtime)) return false;
-  if (url !== CODEX_RESPONSES_HTTP_URL && !upstreamWebsocketConfigured) return false;
-  if (upstreamWebsocketConfigured && !isResponsesWebsocketEligibleUrl(url)) return false;
+  if (socks5ProxyFromEnv()) return false;
+  // Bun's client WebSocket API delivers only fully assembled messages and has
+  // no enforceable inbound payload limit. Keep arbitrary provider endpoints on
+  // bounded HTTP/SSE until the client can reject fragmented text and binary
+  // messages during ingestion rather than after allocation. The first-party
+  // api.openai.com lane still requires the operator opt-in.
+  if (url !== CODEX_RESPONSES_HTTP_URL
+    && !(upstreamWebsocketConfigured && url === OPENAI_API_RESPONSES_URL)) return false;
   if ((init?.method ?? "GET").toUpperCase() !== "POST") return false;
   const body = init?.body;
   if (typeof body !== "string") return false;
@@ -138,7 +125,8 @@ export function codexWsUpstreamFetch(
   const prepared = prepareCodexWsRequest(url, init);
   if (!prepared) return sseFallback(url, prepareCodexHttpInit(url, init));
   init = prepared.httpInit;
-  if (!bunSupportsBoundedCodexWsRelay(runtime)) {
+  if ((url !== CODEX_RESPONSES_HTTP_URL && url !== OPENAI_API_RESPONSES_URL)
+    || !bunSupportsBoundedCodexWsRelay(runtime)) {
     return sseFallback(url, init);
   }
   const signal = init.signal ?? undefined;

package/src/server/responses-custom-tool-repair.ts

@@ -1,6 +1,7 @@
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { mayBecomePatchEnvelope, normalizeApplyPatchDelimiters } from "../responses/apply-patch-envelope";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
+import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
 import { declaresCodeModeExec } from "../types/tools";
 import {
   customToolItemId,
@@ -15,50 +16,10 @@ import {
   type SseBlockRewrite,
 } from "./sse-payload-rewrite";
 
-/** Exact compact prefix used by our upstream rewriter; progressive matching also
- *  tolerates insignificant JSON whitespace via FREEFORM_WRAP_PREFIX_RE. */
-const FREEFORM_WRAP_PREFIX = '{"input":"';
-const FREEFORM_WRAP_PREFIX_RE = /^\s*\{\s*"input"\s*:\s*"/;
-
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
-/**
- * Progressive decode of the freeform `{ "input": "…" }` wrapper.
- * Returns null when the accumulated text does not (yet) match that wrapper so
- * callers suppress deltas and rely on `response.custom_tool_call_input.done`.
- */
-function partialCustomToolInput(argumentsText: string): string | null {
-  const match = FREEFORM_WRAP_PREFIX_RE.exec(argumentsText);
-  if (!match) return null;
-  const body = argumentsText.slice(match[0]!.length);
-  let output = "";
-  for (let index = 0; index < body.length; index++) {
-    const char = body[index];
-    if (char === '"') break;
-    if (char !== "\\") {
-      output += char;
-      continue;
-    }
-    const escaped = body[index + 1];
-    if (escaped === undefined) break;
-    index += 1;
-    if (escaped === "n") output += "\n";
-    else if (escaped === "t") output += "\t";
-    else if (escaped === "r") output += "\r";
-    else if (escaped === "b") output += "\b";
-    else if (escaped === "f") output += "\f";
-    else if (escaped === "u") {
-      const hex = body.slice(index + 1, index + 5);
-      if (hex.length !== 4 || !/^[0-9a-fA-F]{4}$/.test(hex)) break;
-      output += String.fromCharCode(Number.parseInt(hex, 16));
-      index += 4;
-    } else output += escaped;
-  }
-  return output;
-}
-
 function replaceSseEventName(block: string, type: string): string {
   const newline = block.includes("\r\n") ? "\r\n" : "\n";
   const lines = block.split(/\r?\n/);
@@ -298,7 +259,7 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       releaseCall(upstreamItemId);
       return [replaceSseDataPayload(block, JSON.stringify({
         ...parsed,
-        input: helper ? compileCodeModeHelperInput(source, helper) : source,
+        input: helper ? compileCodeModeHelperInput(source, helper, name) : source,
       }))];
     }
     if (
@@ -332,21 +293,33 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       openCalls.set(upstreamItemId, open);
       // A helper alias will become JavaScript at completion, never raw patch/JSON.
       if (itemNames.get(upstreamItemId)?.aliased) return [];
-      // Still accumulating toward the compact wrapper, or an unrecognized shape:
-      // suppress progressive emission and let the done event carry input.
-      if (FREEFORM_WRAP_PREFIX.startsWith(open.argumentsText)) return [];
-      const fullInput = partialCustomToolInput(open.argumentsText);
+      const itemName = itemNames.get(upstreamItemId);
+      const ownsFreeformGrammar = itemName?.namespace === undefined
+        || itemName?.namespace === "functions";
+      const fullInput = progressiveFreeformInput(
+        open.argumentsText,
+        ownsFreeformGrammar ? itemName?.name ?? "" : "",
+      );
       if (fullInput === null) return [];
-      // Hold a buffer that could still become a complete patch envelope. The done event
-      // recompiles such a body into an apply_patch helper call, so streaming the envelope
-      // bytes first and replacing them at completion is the rewind this path forbids.
-      // Mirrors the same hold in `src/bridge.ts`.
-      if (
-        declaresCodeModeExec(declaredNames)
-        && itemNames.get(upstreamItemId)?.namespace === undefined
-        && itemNames.get(upstreamItemId)?.name === "exec"
-        && mayBecomePatchEnvelope(fullInput)
-      ) return [];
+      // This routed path historically holds every unrecognized JSON object until done.
+      // The shared decoder streams ordinary raw input, so retain the stricter routed rule
+      // when no recognized wrapper transformed the accumulated object.
+      if (fullInput === open.argumentsText && open.argumentsText.trimStart().startsWith("{")) return [];
+      // Hold a buffer that could still become a complete patch envelope, for either of the two
+      // reasons completion rewrites one. Both are the same rewind this path forbids, and both
+      // mirror `src/bridge/sse.ts`.
+      //
+      // `exec`: the done event recompiles such a body into an apply_patch helper call.
+      // `apply_patch`: `normalizeApplyPatchDelimiters` rewrites a decorated
+      // `*** Begin Patch ***` envelope at completion, so the decorated markers would be
+      // published and then replaced by the normalized ones. Before the shared decoder, this
+      // path held every non-canonical shape and so never reached that case; now that ordinary
+      // raw input streams, the second reason has to be stated explicitly.
+      const mayCompile = declaresCodeModeExec(declaredNames)
+        && itemName?.namespace === undefined
+        && itemName?.name === "exec";
+      const mayNormalize = ownsFreeformGrammar && itemName?.name === "apply_patch";
+      if ((mayCompile || mayNormalize) && mayBecomePatchEnvelope(fullInput)) return [];
       if (!fullInput.startsWith(open.emittedInput) || fullInput.length === open.emittedInput.length) return [];
       const inputDelta = fullInput.slice(open.emittedInput.length);
       open.emittedInput = fullInput;
@@ -381,7 +354,7 @@ export function createRoutedCustomToolRestoreBlockRewrite(
         type: nextType,
         item_id: customToolItemId(upstreamItemId),
         input: helper
-          ? compileCodeModeHelperInput(source, helper)
+          ? compileCodeModeHelperInput(source, helper, itemName?.name ?? "")
           : unwrapRoutedCustomToolArguments(source, itemName?.name ?? "", itemName?.namespace),
       };
       return [replaceSseDataPayload(replaceSseEventName(block, nextType), JSON.stringify(next))];

package/src/server/responses-undeclared-tool-guard.ts

@@ -1,4 +1,9 @@
-import { collectAmbiguousDottedAliases, dottedAliasIsUnambiguous, wireToolInnerName } from "../responses/tool-name-aliases";
+import {
+  collectAmbiguousDottedAliases,
+  dottedAliasIsUnambiguous,
+  isSchemaValidResponsesToolName,
+  wireToolInnerName,
+} from "../responses/tool-name-aliases";
 import {
   dottedToolName,
   NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES,
@@ -512,6 +517,31 @@ export function normalizeDefaultNamespaceInItem(
         return { value: { ...item, name: bare }, changed: true };
       }
     }
+    // Authorization and emission were reading two different resolvers for the same question.
+    // `undeclaredNameInItem` resolves an emitted name through `normalizeDeclaredToolName`, which
+    // maps a `default.`-prefixed code-mode helper onto the declared `exec` (#4412) as well as a
+    // `default.`-prefixed bare tool (#4176); the rewrite above learned only the second case. So a
+    // routed Muse turn under a code-mode catalog had `default.view_image` ACCEPTED as `exec` and
+    // then relayed under the name the upstream schema rejects. Codex stored
+    // `{"type":"function_call","name":"default.view_image"}`, answered "unsupported call", and
+    // every later replay of that history — a side chat, a compaction — was refused on
+    // `input[N].name` for the lifetime of the conversation (#5095).
+    //
+    // Emit the name the guard authorized rather than a second, weaker opinion about it. The two
+    // must agree: a name good enough to admit is the name the client has to receive.
+    //
+    // Gated on the name actually being unusable, so this branch cannot touch a name the upstream
+    // accepts whatever the resolver would have said about it. The routed-custom-tool and
+    // namespace restores run earlier in the same chain and already rewrite the shapes they own,
+    // which leaves this as the boundary check for the names no restore claimed.
+    if (!isSchemaValidResponsesToolName(name)) {
+      const authorized = normalizeDeclaredToolName(name, declared, declaredBare);
+      if (
+        authorized !== name
+        && declared.has(authorized)
+        && isSchemaValidResponsesToolName(authorized)
+      ) return { value: { ...item, name: authorized }, changed: true };
+    }
   }
   return { value: item, changed: false };
 }

package/src/server/sse-frame-buffer.ts

@@ -2,6 +2,8 @@ import { isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
 
 export const MAX_CLIENT_SSE_FRAME_BYTES = 4 * 1024 * 1024;
 
+export const EMPTY_BYTES = new Uint8Array(0);
+
 const LF_LF = Uint8Array.of(10, 10);
 const LF_CR_LF = Uint8Array.of(10, 13, 10);
 const CR_LF_LF = Uint8Array.of(13, 10, 10);
@@ -155,8 +157,8 @@ function isResponsesTerminalFrame(block: Uint8Array): boolean {
 export class BoundedSseFrameBuffer {
   private readonly maxFrameBytes: number;
   private readonly maxFramesPerFeed: number;
-  private delimiterTail: Uint8Array = new Uint8Array(0);
-  private candidate: Uint8Array = new Uint8Array(0);
+  private delimiterTail: Uint8Array = EMPTY_BYTES;
+  private candidate: Uint8Array = EMPTY_BYTES;
   private candidateBytes = 0;
   private disposed = false;
 
@@ -172,8 +174,8 @@ export class BoundedSseFrameBuffer {
   }
 
   private clear(): void {
-    this.delimiterTail = new Uint8Array(0);
-    this.candidate = new Uint8Array(0);
+    this.delimiterTail = EMPTY_BYTES;
+    this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
   }
 
@@ -209,12 +211,12 @@ export class BoundedSseFrameBuffer {
   }
 
   private takeCandidate(): Uint8Array {
-    if (this.candidateBytes === 0) return new Uint8Array(0);
+    if (this.candidateBytes === 0) return EMPTY_BYTES;
     const block = this.candidate.slice(0, this.candidateBytes);
     // Release the working allocation after each complete frame. This avoids
     // retaining a rare multi-MiB frame allocation for the rest of a long-lived
     // stream; normal small-frame allocation remains bounded by feed's frame cap.
-    this.candidate = new Uint8Array(0);
+    this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
     return block;
   }
@@ -225,7 +227,7 @@ export class BoundedSseFrameBuffer {
 
     const frames: BoundedSseFrame[] = [];
     const previousTail = this.delimiterTail;
-    this.delimiterTail = new Uint8Array(0);
+    this.delimiterTail = EMPTY_BYTES;
     const tailLength = previousTail.byteLength;
     const totalLength = tailLength + chunk.byteLength;
     const byteAt = (index: number): number => index < tailLength
@@ -286,10 +288,10 @@ export class BoundedSseFrameBuffer {
 
   /** Return the final unterminated block bytes and release all retained state. */
   finish(): Uint8Array {
-    if (this.disposed) return new Uint8Array(0);
+    if (this.disposed) return EMPTY_BYTES;
     try {
       this.retain(this.delimiterTail);
-      this.delimiterTail = new Uint8Array(0);
+      this.delimiterTail = EMPTY_BYTES;
       return this.takeCandidate();
     } finally {
       this.clear();
@@ -307,7 +309,7 @@ export class BoundedSseFrameBuffer {
 export function joinSseFrameBytes(parts: readonly Uint8Array[]): Uint8Array {
   let byteLength = 0;
   for (const part of parts) byteLength += part.byteLength;
-  if (byteLength === 0) return new Uint8Array(0);
+  if (byteLength === 0) return EMPTY_BYTES;
   if (parts.length === 1 && parts[0]!.byteLength === byteLength) return parts[0]!;
   const joined = new Uint8Array(byteLength);
   let offset = 0;

package/src/server/sse-payload-rewrite.ts

@@ -178,17 +178,44 @@ export function createSseBlockBuffer(
 
 /** Join all data lines from one SSE event according to the event-stream field rules. */
 export function sseDataPayload(block: string): string | null {
-  const data: string[] = [];
-  for (const line of block.split(/\r?\n/)) {
-    if (line === "data") {
-      data.push("");
-      continue;
+  let result = "";
+  let found = false;
+  let lineStart = 0;
+  const len = block.length;
+
+  while (lineStart < len) {
+    const nextNewline = block.indexOf("\n", lineStart);
+    let lineEnd = nextNewline === -1 ? len : nextNewline;
+    const nextStart = nextNewline === -1 ? len : nextNewline + 1;
+    if (lineEnd > lineStart && block.charCodeAt(lineEnd - 1) === 13) {
+      lineEnd -= 1;
     }
-    if (!line.startsWith("data:")) continue;
-    const value = line.slice(5);
-    data.push(value.startsWith(" ") ? value.slice(1) : value);
+
+    const lineLen = lineEnd - lineStart;
+    if (lineLen === 4 && block.startsWith("data", lineStart)) {
+      if (found) {
+        result += "\n";
+      } else {
+        found = true;
+      }
+    } else if (lineLen >= 5 && block.startsWith("data:", lineStart)) {
+      let valueStart = lineStart + 5;
+      if (valueStart < lineEnd && block.charCodeAt(valueStart) === 32) {
+        valueStart += 1;
+      }
+      const value = block.slice(valueStart, lineEnd);
+      if (found) {
+        result += "\n" + value;
+      } else {
+        result = value;
+        found = true;
+      }
+    }
+
+    lineStart = nextStart;
   }
-  return data.length > 0 ? data.join("\n") : null;
+
+  return found ? result : null;
 }
 
 /** Replace an SSE event's data field while preserving non-data fields and newline style. */
@@ -203,7 +230,7 @@ export function replaceSseDataPayload(block: string, payload: string): string {
       continue;
     }
     if (!replaced) {
-      rewritten.push(`data: ${payload}`);
+      rewritten.push(...payload.split(/\r?\n/).map(line => `data: ${line}`));
       replaced = true;
     }
   }

package/src/server/system-env-shell.ts

@@ -1,7 +1,7 @@
 import { accessSync, constants, readFileSync, writeFileSync, unlinkSync, mkdirSync, statSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { getConfigDir } from "../config";
-import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionTokens, type AuthDetectDeps } from "../claude/auth-detect";
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
 import { ANTHROPIC_PARENT_ENV_SLOTS, trustedNodeLauncherContext, type AnthropicParentEnvSlot } from "../cli/launcher-context";
@@ -128,6 +128,10 @@ export function writeShellEnvFile(
   if (config.claudeCode?.alwaysEnableEffort === true) {
     lines.push(conditional("CLAUDE_CODE_ALWAYS_ENABLE_EFFORT", "1"));
   }
+  // Tool-search deferral (#4838): opt-in, conditional like every other lever so a
+  // value already exported in the user's shell wins.
+  const toolSearch = claudeToolSearchEnv(config.claudeCode?.toolSearch);
+  if (toolSearch !== undefined) lines.push(conditional("ENABLE_TOOL_SEARCH", toolSearch));
   const shellEnvPath = getShellEnvFilePath();
   recordOwnedConfigPath(getConfigDir(), shellEnvPath);
   mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });

package/src/server/system-env.ts

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
-import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER } from "../claude/auth-detect";
 import { isProxyAdmissionSecret } from "./auth-cors";
 import type { OcxConfig } from "../types";
@@ -33,6 +33,7 @@ const MANAGED_SYSTEM_ENV_NAMES = new Set<string>([
   "DISABLE_COMPACT",
   "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
   "CLAUDE_CODE_ALWAYS_ENABLE_EFFORT",
+  "ENABLE_TOOL_SEARCH",
 ]);
 
 interface SystemEnvTracking {
@@ -309,6 +310,11 @@ export async function injectSystemEnv(
     if (config.claudeCode?.alwaysEnableEffort === true) {
       injectLever("CLAUDE_CODE_ALWAYS_ENABLE_EFFORT", "1");
     }
+    // Tool-search deferral (#4838): same opt-in contract as `ocx claude`, so a machine
+    // whose Claude Code is launched from Dock/launchd gets the setting it configured
+    // instead of only terminal sessions. injectLever keeps a user-owned launchd value.
+    const toolSearch = claudeToolSearchEnv(config.claudeCode?.toolSearch);
+    if (toolSearch !== undefined) injectLever("ENABLE_TOOL_SEARCH", toolSearch);
 
     // Shell-hook env file: works for new shells in already-running Terminal.app.
     writeShellEnvFile(port, config, modelEnv, auto, deps);