@bitkyc08/opencodex 2.59.0 → 2.60.0

package/src/adapters/google.ts

@@ -1,5 +1,5 @@
 import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
-import { debugDroppedFrame } from "../lib/debug";
+import { debugDroppedFrame, debugProviderDiagnosticLazy } from "../lib/debug";
 import { createToolCallIdAllocator } from "./tool-call-id";
 import { createImageBudget, materializeInlineImage, MAX_ENCODED_BYTES_PER_IMAGE, artifactHttpUrl } from "../images/artifacts";
 import type {
@@ -20,8 +20,10 @@ import { getVertexAccessToken } from "../lib/gcp-adc";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
 import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
 import { isVertexTruncatedTurn, vertexTruncationErrorMessage } from "./google-truncation";
-import { ANTIGRAVITY_REQUEST_UA, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
+import { ANTIGRAVITY_REQUEST_UA, antigravitySessionAnchor, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
+import { summarizeGoogleWireShape } from "./google-wire-shape";
 import { compileGoogleWireBody } from "./google-wire-compiler";
+import type { GoogleToolSchemaLossReport, GoogleToolSchemaProfile } from "./google-tool-schema";
 import { identifyRoutedModel } from "./identity";
 import {
   antigravityUsesReplayCache,
@@ -737,6 +739,14 @@ function invalidGoogleShapeEvent(
 }
 
 export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  const toolSchemaPolicy = provider.googleToolSchemaPolicy ?? "compatible";
+  const toolSchemaProfile = {
+    endpointClass: provider.googleMode ?? "ai-studio",
+  } satisfies GoogleToolSchemaProfile;
+  const reportToolSchemaLoss = (report: GoogleToolSchemaLossReport): void => {
+    if (!report.lossy && report.uncertainComparisons === 0) return;
+    debugProviderDiagnosticLazy("google", "google-tool-schema-loss", () => ({ ...report }));
+  };
   // Per-request closure: resolveAdapter builds a fresh adapter per request (server.ts), so buildRequest
   // can stash the CCA model/session for parseStream's reasoning-replay observation.
   let antigravityModel: string | undefined;
@@ -799,7 +809,11 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
     ...(provider.googleMode === "vertex" || provider.googleMode === "cloud-code-assist"
       ? {
           fetchResponse: (request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response> =>
-            (provider.googleMode === "cloud-code-assist" ? fetchAntigravityWithRetry : fetchVertexWithRetry)(request, ctx),
+            (provider.googleMode === "cloud-code-assist" ? fetchAntigravityWithRetry : fetchVertexWithRetry)(
+              request,
+              ctx,
+              { toolSchemaProfile, toolSchemaPolicy },
+            ),
           formatErrorBody: (status: number, _headers: Headers, payloadText: string): string =>
             (provider.googleMode === "cloud-code-assist" ? safeAntigravityHttpErrorMessage : safeVertexHttpErrorMessage)(status, payloadText),
         }
@@ -970,7 +984,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           const fcc = (existing.functionCallingConfig ?? {}) as Record<string, unknown>;
           draftRequest.toolConfig = { ...existing, functionCallingConfig: { ...fcc, mode: "VALIDATED" } };
         }
-        const compiled = compileGoogleWireBody(draftRequest);
+        const compiled = compileGoogleWireBody(draftRequest, toolSchemaProfile, toolSchemaPolicy);
+        reportToolSchemaLoss(compiled.toolSchemaLossReport);
         const request = compiled.body;
         restoreGoogleToolName = compiled.restoreToolName;
         // Compile names before replay: signatures are keyed by the exact provider-visible name.
@@ -989,6 +1004,20 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           // Vertex and AI Studio share one decision. A second check here would append a
           // duplicate nudge whenever signature sanitization reshapes the tail afterwards.
         }
+        // Opt-in structural description of the request that is about to leave (#5008).
+        //
+        // Passed as a BUILDER, not a value: the lazy form gates before invoking it, so a session
+        // with provider debug off never pays the walk, and it evaluates the projection inside its
+        // own try/catch, so a throw in here cannot turn a built request into a rejected one. The
+        // projection only reads `request`, so the bytes below are the same either way.
+        debugProviderDiagnosticLazy("google", "antigravity-wire-shape", () => summarizeGoogleWireShape(request, {
+          sessionAnchor: antigravitySessionAnchor(parsed),
+          // Signed at translation time, from client history or the durable store. The
+          // Antigravity session cache signs afterwards, inside applyAntigravityReplay, and the
+          // projection attributes that remainder to the cache rather than to this count.
+          historySignedCalls: replayedCallIds.length,
+          replayScopeBound: parsed._reasoningReplayScope !== undefined,
+        }));
         const envelope = {
           model: wireModelId,
           // The envelope's `userAgent` field is a protocol constant ("antigravity"), distinct from
@@ -1006,7 +1035,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       }
 
       if (provider.googleMode === "vertex") {
-        const compiled = compileGoogleWireBody(body);
+        const compiled = compileGoogleWireBody(body, toolSchemaProfile, toolSchemaPolicy);
+        reportToolSchemaLoss(compiled.toolSchemaLossReport);
         restoreGoogleToolName = compiled.restoreToolName;
         const vertexProject = provider.project || process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT || "api-key";
         const vertexLocation = provider.location || process.env.GOOGLE_CLOUD_LOCATION || "global";
@@ -1052,7 +1082,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       if (!apiKey) throw new Error("google (AI Studio) requires a non-empty API key");
       headers["x-goog-api-key"] = apiKey;
 
-      const compiled = compileGoogleWireBody(body);
+      const compiled = compileGoogleWireBody(body, toolSchemaProfile, toolSchemaPolicy);
+      reportToolSchemaLoss(compiled.toolSchemaLossReport);
       restoreGoogleToolName = compiled.restoreToolName;
       return { url, method: "POST", headers, body: JSON.stringify(compiled.body) };
     },

package/src/adapters/openai-chat-images.ts

@@ -13,7 +13,9 @@ import {
 export const OPENAI_CHAT_IMAGE_BASE64_BUDGET = 3_670_016; // 3.5MiB
 
 export interface NormalizeOpenAIChatImagesOptions
-  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {}
+  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {
+  abortSignal?: AbortSignal;
+}
 
 /** Whether `value` is a plain object, so message and part shapes can be walked safely. */
 function isRecord(value: unknown): value is Record<string, unknown> {

package/src/adapters/openai-chat.ts

@@ -297,7 +297,11 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         };
       };
       if (hasShrinkableOpenAIChatImages(messages)) {
-        return normalizeOpenAIChatImages(messages, { tierBias: incoming?.imageTierBias }).then(finish, finish);
+        const imageOptions = { tierBias: incoming?.imageTierBias, abortSignal: incoming?.abortSignal };
+        return normalizeOpenAIChatImages(messages, imageOptions).then(finish, error => {
+          if (incoming?.abortSignal?.aborted) throw error;
+          return finish();
+        });
       }
       return finish();
     },

package/src/adapters/openai-responses/image-gen.ts

@@ -101,14 +101,17 @@ export function preferConfiguredHostedTools(
   }
 
   let input = body.input;
-  const strippedAdditionalToolsIndices = new Set<number>();
+  // Indices arrive in increasing order, so the first stripped container is already
+  // the minimum — tracking it directly avoids spreading an attacker-sized Set into
+  // Math.min's argument list.
+  let firstStrippedAdditionalToolsIndex: number | undefined;
   if (Array.isArray(body.input)) {
     let nestedChanged = false;
     const mappedInput = body.input.map((item, index) => {
       if (!isPlainObject(item) || item.type !== "additional_tools" || !Array.isArray(item.tools)) return item;
       const nestedTools = stripGroup(item.tools);
       if (nestedTools === item.tools) return item;
-      strippedAdditionalToolsIndices.add(index);
+      firstStrippedAdditionalToolsIndex ??= index;
       nestedChanged = true;
       return { ...item, tools: nestedTools };
     });
@@ -127,17 +130,16 @@ export function preferConfiguredHostedTools(
     || (Array.isArray(input) && input.some(item => isPlainObject(item)
       && item.type === "additional_tools"
       && hasHostedImageGenTool(item.tools)));
-  if ((strippedTopLevelImageGenTool || strippedAdditionalToolsIndices.size > 0) && !hasHostedImageGenDeclaration) {
+  if ((strippedTopLevelImageGenTool || firstStrippedAdditionalToolsIndex !== undefined) && !hasHostedImageGenDeclaration) {
     if (strippedTopLevelImageGenTool && Array.isArray(tools)) {
       tools = [...tools, { type: HOSTED_IMAGE_GENERATION_TOOL }];
-    } else if (strippedAdditionalToolsIndices.size > 0 && Array.isArray(input)) {
+    } else if (firstStrippedAdditionalToolsIndex !== undefined && Array.isArray(input)) {
       // Restore into the FIRST stripped container only. Tool declarations are
       // request-scoped, not container-scoped — the containers are separate carriers for
       // one tool set, so a single hosted declaration covers the request. An earlier
       // revision restored into every stripped container and put `image_generation` on
       // the wire twice; review caught it.
-      const firstStripped = Math.min(...strippedAdditionalToolsIndices);
-      input = input.map((item, index) => index === firstStripped
+      input = input.map((item, index) => index === firstStrippedAdditionalToolsIndex
         && isPlainObject(item)
         && Array.isArray(item.tools)
         ? { ...item, tools: [...item.tools, { type: HOSTED_IMAGE_GENERATION_TOOL }] }

package/src/adapters/openai-responses/passthrough.ts

@@ -18,6 +18,7 @@ import type { TranslatorBudget } from "../../lib/translator-budget";
 import { rewriteRoutedCustomToolsForUpstream } from "../../responses/custom-tool-compat";
 import { rewriteRoutedToolSearchForUpstream } from "../../responses/tool-search-compat";
 import { rewriteRoutedNamespaceToolsForUpstream } from "../../responses/namespace-tool-compat";
+import { repairLegacyDottedToolCallNames } from "../../responses/legacy-dotted-tool-name-repair";
 import { preparePlaintextV2AgentMessages } from "../../responses/plaintext-v2-agent-messages";
 import { isMetaAiResponsesDestination, rewriteMuseToolNamesForUpstream } from "../../responses/muse-tool-name-alias";
 import { openaiResponsesUrl } from "../openai-responses-url";
@@ -31,7 +32,7 @@ import {
 import {
   createAdapterTierMetadata,
 } from "../../providers/fastwire";
-import { mapRoutedResponsesReasoningEffort, normalizeConfiguredReasoningSummaryDelivery, sanitizeReasoningInputContent, stripDisabledReasoningSummaries, stripDisabledVerbosity, stripUnsupportedReasoningSummaryDelivery } from "./reasoning";
+import { dropResponsesReasoningInputItems, mapRoutedResponsesReasoningEffort, normalizeConfiguredReasoningSummaryDelivery, sanitizeReasoningInputContent, stripDisabledReasoningSummaries, stripDisabledVerbosity, stripUnsupportedReasoningSummaryDelivery } from "./reasoning";
 import { scrubOcxCompactionItems, stripCanonicalOnlyToolFields, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough, stripInvalidItemIds, stripItemIdsWhenUnstored } from "./request-strips";
 import { stripCanonicalForwardPromptCacheOptions, stripDeprecatedPromptCacheRetention } from "./prompt-cache";
 import { isPlainObject } from "./internal";
@@ -295,6 +296,9 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       if (forward || stateless || pairedToolResults) {
         outBody = repairOrphanedInputItems(outBody, unexpandedMiss, synthesizeMissingCallOutputs);
       }
+      if (provider.dropResponsesReasoningItems === true) {
+        outBody = dropResponsesReasoningInputItems(outBody);
+      }
       if (adjacentToolResults) {
         outBody = normalizeResponsesToolResultAdjacency(outBody);
       }
@@ -335,6 +339,12 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       // every turn, and a strict parser rejects the whole request over the missing key —
       // `queries` for DeepSeek (#930), `query` for Console Go (#3071).
       outBody = backfillWebSearchQueries(outBody);
+      // #5095: a conversation that already contains a `default.`-prefixed call name is refused by
+      // the upstream `^[a-zA-Z0-9_-]+$` name pattern on every later turn that replays it, so the
+      // task cannot be compacted or continued at all. Repair the replayed item here, before the
+      // canonical-destination split below, because the reported failure was a side chat on a plain
+      // OpenAI model inheriting history a routed provider had damaged.
+      outBody = repairLegacyDottedToolCallNames(outBody);
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         outBody = stripInternalChatMessageMetadataPassthrough(outBody);
         // The same class of private field, one level up, but keyed on the DESTINATION rather than
@@ -397,14 +407,16 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         // Last, so promoted namespace children are also cleared of Codex-private fields.
         outBody = stripCanonicalOnlyToolFields(outBody, provider.supportsOpenAiWebSearchToolFields === false);
       }
-      if (!forward) outBody = normalizeOpenCodeGoAdditionalTools(outBody, url);
+      if (!forward) {
+        outBody = normalizeOpenCodeGoAdditionalTools(outBody, url, parsed._replayPrefixLen);
+      }
       // Same predicate as the routedCompaction gate in handleResponses(): an authMode check would
       // let a noncanonical custom forward provider skip this rewrite while the server still routes
       // it as a summarizer turn (#422). The compaction body build removes the tool surface and must
       // therefore be the last routed transform that may depend on those declarations. Structural
       // sanitizers below can still run after it.
       outBody = normalizeResponsesCodeMode(outBody, parsed, provider);
-      if (parsed._compactionRequest === true && !isCanonicalOpenAiForwardProvider(provider)) {
+      if (parsed._compactionRequest === true && (!isCanonicalOpenAiForwardProvider(provider) || parsed._portableCompaction === true)) {
         outBody = buildRoutedCompactionBody(outBody);
       }
       // Run after routed compaction so nested input_image parts are replaced before a malformed

package/src/adapters/openai-responses/reasoning.ts

@@ -4,6 +4,13 @@ import { OCX_REASONING_PREFIX } from "../../responses/reasoning-envelope";
 import { configuredReasoningEfforts, mapReasoningEffort, modelRecordValue } from "../../reasoning-effort";
 import { isPlainObject } from "./internal";
 
+/** Drop only replayed Responses reasoning items; all other continuation input stays untouched. */
+export function dropResponsesReasoningInputItems(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+  const input = body.input.filter(item => !isPlainObject(item) || item.type !== "reasoning");
+  return input.length === body.input.length ? body : { ...body, input };
+}
+
 /**
  * Sanitize reasoning input by field policy, not by preserving each item's shape. Retaining a
  * native `encrypted_content` guarantees only that blob value: `status` is always removed;

package/src/adapters/opencode-go-additional-tools.ts

@@ -3,7 +3,11 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 /** Console Go accepts public tools but rejects the private additional_tools input wrapper. */
-export function normalizeOpenCodeGoAdditionalTools(body: unknown, responseUrl: string): unknown {
+export function normalizeOpenCodeGoAdditionalTools(
+  body: unknown,
+  responseUrl: string,
+  replayPrefixLength = 0,
+): unknown {
   let destination: URL;
   try {
     destination = new URL(responseUrl);
@@ -20,10 +24,16 @@ export function normalizeOpenCodeGoAdditionalTools(body: unknown, responseUrl: s
 
   const input: unknown[] = [];
   const promoted: unknown[] = [];
+  const currentTurnStart = Number.isFinite(replayPrefixLength)
+    ? Math.min(body.input.length, Math.max(0, Math.trunc(replayPrefixLength)))
+    : 0;
   let changed = false;
-  for (const item of body.input) {
+  for (const [index, item] of body.input.entries()) {
     if (isRecord(item) && item.type === "additional_tools" && Array.isArray(item.tools)) {
       changed = true;
+      // Replayed wrappers are conversation history, not authority for the current request.
+      // Go cannot accept the wrapper itself, so remove it without promoting its catalog.
+      if (index < currentTurnStart) continue;
       // Custom/search/namespace lowering already owns identity and deduplication. This pass
       // only moves declarations, including hosted tools that intentionally have no name.
       for (const tool of item.tools) promoted.push(tool);

package/src/bridge/sse.ts

@@ -17,11 +17,10 @@ import {
 } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import {
-  freeformFallbackKeys,
   mayBecomePatchEnvelope,
   repairFreeformToolInput,
-  unwrapFreeformToolInput,
 } from "../responses/apply-patch-envelope";
+import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
 import { encodeCompactionSummary } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
@@ -153,153 +152,6 @@ export function bridgeToResponsesSSE(
       ? compileCodeModeHelperInput(args, helper, codeModeHelperName ?? toolName)
       : repairFreeformToolInput(args, toolName, namespace);
   };
-  // Best-effort unwrap of a PARTIAL freeform arg buffer for live input streaming
-  // (`response.custom_tool_call_input.delta` — codex-rs uses it for UI preview only;
-  // the completed custom_tool_call item stays authoritative). Compact `{"input":"...`
-  // buffers get their string value progressively unescaped; anything else streams raw.
-  const JSON_WHITESPACE = new Set([" ", "\t", "\n", "\r"]);
-  type WrapperOpening =
-    | { state: "none" }
-    | { state: "prefix" }
-    | { state: "open"; valueStart: number };
-  /**
-   * Where the string value of `{"<key>":"` begins, tolerating the insignificant whitespace
-   * `JSON.parse` accepts.
-   *
-   * The earlier form of this compared the buffer against the compact literal `{"key":"`, so a
-   * wrapper written with spaces or newlines matched no prefix at all, streamed as raw JSON
-   * deltas and then completed as the unwrapped body. That is the same delta/completion
-   * disagreement #5047 closed for compact wrappers, reached through a different spelling:
-   * `unwrapFreeformToolInput` reads the completed text with `JSON.parse`, which does not care
-   * how the object is laid out, so neither can the streaming side.
-   */
-  const wrapperOpening = (args: string, key: string): WrapperOpening => {
-    let index = 0;
-    for (const token of ["{", `"${key}"`, ":", '"']) {
-      while (index < args.length && JSON_WHITESPACE.has(args[index]!)) index++;
-      if (index >= args.length) return { state: "prefix" };
-      for (const expected of token) {
-        if (index >= args.length) return { state: "prefix" };
-        if (args[index] !== expected) return { state: "none" };
-        index++;
-      }
-    }
-    return { state: "open", valueStart: index };
-  };
-  /**
-   * Whether a body could still grow into one complete outer Markdown fence.
-   *
-   * `stripMarkdownCodeFence` removes such a fence at completion for exactly the two tools that
-   * own the grammar, so a fenced body's streamed bytes and its completed input disagree unless
-   * the stream holds. A buffer that does not open with a fence can never acquire one, so
-   * ordinary bodies are unaffected; a buffer that does keeps its preview suppressed for the
-   * whole call, because a closing fence can still be followed by more text that withdraws it.
-   */
-  const mayBecomeFencedBody = (text: string, toolName: string): boolean => {
-    if (toolName !== "exec" && toolName !== "apply_patch") return false;
-    const head = text.trimStart();
-    if (head === "") return true;
-    return head.startsWith("```") || "```".startsWith(head);
-  };
-  /** The two-character escapes JSON defines, and nothing else. */
-  const JSON_ESCAPES = new Map<string, string>([
-    ['"', '"'], ["\\", "\\"], ["/", "/"],
-    ["b", "\b"], ["f", "\f"], ["n", "\n"], ["r", "\r"], ["t", "\t"],
-  ]);
-  const LOW_SURROGATE_ESCAPE = /^\\u[dD][c-fC-F][0-9a-fA-F]{2}$/;
-  /**
-   * The decoded prefix of a JSON string body, stopping at the first byte it cannot resolve.
-   *
-   * Every stop is a hold rather than a guess, because `JSON.parse` decides the completed value
-   * and anything invented here would be retracted. Three of them are not obvious:
-   *
-   * An escape JSON does not define makes the whole wrapper unparseable no matter what arrives
-   * next, so completion falls back to the raw text. Returning `null` for that case stops the
-   * preview rather than continuing to decode a value the completed item will never carry.
-   * `\\b` and `\\f` are defined, and were previously decoded to the letters b and f.
-   *
-   * A lone high surrogate is not a character. Emitting one alone puts an unpaired code unit in a
-   * delta the client has to decode by itself, so the pair is emitted together or not at all.
-   */
-  const decodeJsonStringPrefix = (body: string): string | null => {
-    let out = "";
-    for (let i = 0; i < body.length; i++) {
-      const c = body[i];
-      if (c === '"') break; // unescaped closing quote: value complete
-      if (c !== "\\") { out += c; continue; }
-      const n = body[i + 1];
-      if (n === undefined) break; // escape split across chunks: wait for more
-      if (n === "u") {
-        const hex = body.slice(i + 2, i + 6);
-        if (hex.length < 4) break; // split across chunks: wait for more
-        if (!/^[0-9a-fA-F]{4}$/.test(hex)) return null; // never parses
-        const code = parseInt(hex, 16);
-        if (code >= 0xd800 && code <= 0xdbff) {
-          const low = body.slice(i + 6, i + 12);
-          if (!LOW_SURROGATE_ESCAPE.test(low)) break;
-          out += String.fromCharCode(code, parseInt(low.slice(2), 16));
-          i += 11;
-          continue;
-        }
-        out += String.fromCharCode(code);
-        i += 5;
-        continue;
-      }
-      const escaped = JSON_ESCAPES.get(n);
-      if (escaped === undefined) return null; // never parses
-      out += escaped;
-      i += 1;
-    }
-    return out;
-  };
-  /**
-   * The value to stream so far, or `null` to HOLD because nothing can be decided yet.
-   *
-   * `input` is decidable from its prefix: `unwrapFreeformToolInput` returns it whenever the
-   * key is present, whatever else the object carries, so its value can be unescaped
-   * progressively and never retracted.
-   *
-   * One case escapes that claim and is accepted rather than fixed: a duplicate `input` key.
-   * `JSON.parse` keeps the last one, so `{"input":"a","input":"b"}` streams a and completes with
-   * b. Closing it means holding every canonical wrapper until its object parses, which is the
-   * progressive streaming this path exists to provide. The completed item stays authoritative,
-   * and no model emits a duplicate key in practice.
-   *
-   * A wrapper that turns invalid AFTER streaming has committed has the same shape and the same
-   * answer. `{"input":"a` followed by `\\qb"}` has already published a when the undefined escape
-   * arrives, and completion returns the raw text because nothing parses. The preview stops
-   * there: no rewind, and no decoded text the completed item does not contain. Bounding the
-   * damage is what is available without giving up progressive streaming, and the args are
-   * unusable in that case whichever representation wins.
-   *
-   * A fallback key is not. It only unwraps when it is the SINGLE string field, and a second
-   * key can still arrive — so a value emitted early would have to be taken back. That is the
-   * rewind this holds instead: stream nothing until the object closes, then publish the one
-   * repaired body. The routed passthrough in `responses-custom-tool-repair.ts` already holds
-   * any object prefix for the same reason (#5047).
-   */
-  const freeformPartialInput = (args: string, toolName: string): string | null => {
-    const openings = ["input", ...freeformFallbackKeys(toolName)]
-      .map(key => ({ key, opening: wrapperOpening(args, key) }));
-    const canonical = openings[0]!.opening;
-    if (canonical.state === "open") {
-      const decoded = decodeJsonStringPrefix(args.slice(canonical.valueStart));
-      if (decoded === null) return null;
-      return mayBecomeFencedBody(decoded, toolName) ? null : decoded;
-    }
-    if (openings.some(entry => entry.opening.state === "open")) {
-      // Committed to a fallback wrapper. Undecidable until the object is complete.
-      try {
-        JSON.parse(args);
-      } catch {
-        return null;
-      }
-      return unwrapFreeformToolInput(args, toolName);
-    }
-    // Still an ambiguous prefix of some wrapper: which wrapper, if any, is not known yet.
-    if (openings.some(entry => entry.opening.state === "prefix")) return null;
-    return mayBecomeFencedBody(args, toolName) ? null : args;
-  };
   // tool_search_call carries arguments as a JSON object ({query, limit}); parse the model's arg string.
   const parseArgsObj = (args: string): Record<string, unknown> => {
     try { const o = JSON.parse(args); return o && typeof o === "object" ? o : {}; } catch { return {}; }
@@ -1199,7 +1051,7 @@ export function bridgeToResponsesSSE(
                   });
                 }
                 if (currentToolCall.freeform && !currentToolCall.codeModeHelperName) {
-                  // `freeformPartialInput` holds while the buffer is still an ambiguous prefix
+                  // `progressiveFreeformInput` holds while the buffer is still an ambiguous prefix
                   // of a JSON wrapper; otherwise stream only the unwrapped input suffix, never
                   // rewinding on a mode flip.
                   //
@@ -1209,7 +1061,7 @@ export function bridgeToResponsesSSE(
                   // is the same disagreement in the other direction.
                   const ownsFreeformGrammar = currentToolCall.namespace === undefined
                     || currentToolCall.namespace === "functions";
-                  const full = freeformPartialInput(
+                  const full = progressiveFreeformInput(
                     currentToolCall.args,
                     ownsFreeformGrammar ? currentToolCall.name : "",
                   );

package/src/cli/account-extended.ts

@@ -403,16 +403,16 @@ export async function cmdAutoSwitch(args: string[], deps: AccountDeps): Promise<
     // shared kernel, and absent is a server that does not speak this field at all. Collapsing
     // false into absent would render the live feature as an unknown capability.
     const inert = typeof settings.inert === "boolean" ? settings.inert : null;
-    // A stored threshold only steers selection once the pool consumes it, which is exactly
-    // what `inert: false` reports.
-    const enabled = inert === false && storedThreshold !== null;
+    // A positive stored threshold only steers selection once the pool consumes it, which is
+    // exactly what `inert: false` reports. Zero remains the explicit disabled value.
+    const enabled = inert === false && storedThreshold !== null && storedThreshold > 0;
     if (wantsJson) {
       console.log(JSON.stringify({ provider: name, autoSwitchThreshold: storedThreshold, enabled, poolEnabled, inert }, null, 2));
     } else {
       const value = storedThreshold === null ? "unset" : `${storedThreshold}%`;
       const state = inert === false ? (enabled ? "on" : "off") : inert === true ? "inactive" : "unavailable";
       const why = inert === false
-        ? (enabled ? "applied by this pool" : "no threshold stored")
+        ? (enabled ? "applied by this pool" : storedThreshold === 0 ? "usage-based switching disabled" : "no threshold stored")
         : inert === true ? "not applied by this pool" : "threshold support is unknown";
       console.log(`auto-switch: ${state} (stored threshold ${value}; ${why})`);
     }

package/src/cli/dispatch.ts

@@ -945,9 +945,9 @@ export type StartOwnerDecision = "refuse" | "service-stay-out" | "sibling";
  *
  * The #3106 guard exists so a bare `start` cannot shadow a healthy configured-port
  * proxy with an ephemeral-port copy. An interactive `--port X` naming a DIFFERENT
- * port than the live proxy's is an explicit sibling request, not that shadow — and
- * refusing it also broke every spawned-launcher test on a machine running a real
- * proxy, because the probe reaches the machine-global port across sandbox homes.
+ * port than the live proxy's is an explicit sibling request, not that shadow. The
+ * state-directory spend-ledger lease makes the final same-home refusal; keeping this
+ * decision allows isolated homes on one machine to remain independent.
  * The service wrapper always passes the configured port and keeps its exact
  * stay-out-of-the-way semantics: it never takes the sibling path.
  */

package/src/cli/doctor.ts

@@ -1505,8 +1505,16 @@ export async function runDoctor(args: string[] = []): Promise<void> {
   // cannot break a legitimately green pipeline.
 
   console.log("\nCodex agent role files");
-  const tomlFallbackRoles = scanCodexAgentRolesWithTomlModelFallback(resolveCodexHomeDirImpl());
-  if (tomlFallbackRoles.length === 0) {
+  let roleScanError: unknown;
+  const tomlFallbackRoles = scanCodexAgentRolesWithTomlModelFallback(
+    resolveCodexHomeDirImpl(),
+    cause => {
+      roleScanError = cause;
+    },
+  );
+  if (roleScanError) {
+    console.log(`  [WARN] unable to scan $CODEX_HOME/agents/*.toml: ${String(roleScanError)}`);
+  } else if (tomlFallbackRoles.length === 0) {
     console.log("  ok     no per-role model_fallback fields in $CODEX_HOME/agents/*.toml");
   } else {
     console.log(`  [WARN] ${tomlFallbackRoles.length} agent role file${tomlFallbackRoles.length === 1 ? "" : "s"} contain${tomlFallbackRoles.length === 1 ? "s" : ""} \`model_fallback\`: ${tomlFallbackRoles.join(", ")}`);
@@ -1514,13 +1522,24 @@ export async function runDoctor(args: string[] = []): Promise<void> {
   }
   // opencodex does not write these files; the Codex desktop external-agent import does, and it
   // drops the model pin on the way in. Observe-only: doctor never repairs or removes them.
-  const unpinnedDerivedRoles = scanOpencodexDerivedCodexAgentRolesWithoutModelPin(resolveCodexHomeDirImpl());
-  if (unpinnedDerivedRoles.length === 0) {
-    console.log("  ok     every opencodex-derived role file in $CODEX_HOME/agents/*.toml pins a model");
-  } else {
-    console.log(`  [WARN] ${unpinnedDerivedRoles.length} opencodex-derived role file${unpinnedDerivedRoles.length === 1 ? "" : "s"} without a \`model\` pin: ${unpinnedDerivedRoles.map(role => `${role}.toml`).join(", ")}`);
-    console.log("        Codex runs these roles on the parent model, so a spawn records one role and another model. The `ocx-route` directive in the file cannot pin them: it is honoured only on the Claude Code `/v1/messages` path and is inert on `/v1/responses`.");
-    console.log("        Add `model = \"<id>\"` to each file, or remove them. They usually come from the Codex desktop external-agent import of ~/.claude/agents/ocx-*.md; set `[desktop] external-agent-import-sync-item-types` with `SUBAGENTS = false` to stop it recreating them.");
+  // Both role scans share the same directory listing, so a failure above already reported the
+  // cause; skip the second scan rather than warn twice or print a false "ok".
+  if (!roleScanError) {
+    const unpinnedDerivedRoles = scanOpencodexDerivedCodexAgentRolesWithoutModelPin(
+      resolveCodexHomeDirImpl(),
+      cause => {
+        roleScanError = cause;
+      },
+    );
+    if (roleScanError) {
+      console.log(`  [WARN] unable to scan $CODEX_HOME/agents/*.toml: ${String(roleScanError)}`);
+    } else if (unpinnedDerivedRoles.length === 0) {
+      console.log("  ok     every opencodex-derived role file in $CODEX_HOME/agents/*.toml pins a model");
+    } else {
+      console.log(`  [WARN] ${unpinnedDerivedRoles.length} opencodex-derived role file${unpinnedDerivedRoles.length === 1 ? "" : "s"} without a \`model\` pin: ${unpinnedDerivedRoles.map(role => `${role}.toml`).join(", ")}`);
+      console.log("        Codex runs these roles on the parent model, so a spawn records one role and another model. The `ocx-route` directive in the file cannot pin them: it is honoured only on the Claude Code `/v1/messages` path and is inert on `/v1/responses`.");
+      console.log("        Add `model = \"<id>\"` to each file, or remove them. They usually come from the Codex desktop external-agent import of ~/.claude/agents/ocx-*.md; set `[desktop] external-agent-import-sync-item-types` with `SUBAGENTS = false` to stop it recreating them.");
+    }
   }
 
   const dual = collectWslDualInstall();

package/src/cli/hub.ts

@@ -228,8 +228,9 @@ export function hubInviteCommand(
   managementUrl: string,
   clients: OcxConnectedClientId[],
 ): string {
-  const clientsFlag = clients.length > 0 ? ` --clients ${clients.join(",")}` : "";
-  return `echo '${code}' | ocx connect ${dataUrl} --management-url ${managementUrl}${clientsFlag} --pairing-code-stdin`;
+  const shellQuote = (value: string): string => `'${value.replaceAll("'", `'"'"'`)}'`;
+  const clientsFlag = clients.length > 0 ? ` --clients ${shellQuote(clients.join(","))}` : "";
+  return `echo ${shellQuote(code)} | ocx connect ${shellQuote(dataUrl)} --management-url ${shellQuote(managementUrl)}${clientsFlag} --pairing-code-stdin`;
 }
 
 async function runInvite(args: string[], deps: HubCommandDeps): Promise<number> {

package/src/cli/index.ts

@@ -78,6 +78,7 @@ import {
 } from "./tray-proxy";
 import { requestBoundSystemRestart } from "./system-restart-client";
 import { installCrashGuards } from "../lib/crash-guard";
+import { SpendLedgerOwnerError } from "../lib/spend-ledger-owner";
 import { redactUrlForLog } from "../lib/redact";
 import { dispatchCommand, decideBusyPreferredPort, decideStartWithLiveOwner } from "./dispatch";
 import { AuxiliaryListenerBindError, findAvailablePort, isAddrInUse, PortUnavailableError, shouldPersistSelectedPort, waitForPortAvailable } from "../server/ports";
@@ -418,8 +419,8 @@ async function handleStart(options: { block?: boolean } = {}) {
     // to bake the service (observed: a probe on 10198 left the service pinned there).
     siblingStart = true;
     console.warn(
-      `Proxy already running on port ${owner.live.port}; starting a second instance on requested port ${requestedPort}. `
-      + `The new instance takes over this home's pid/runtime records and Codex config while it runs.`,
+      `Proxy already running on port ${owner.live.port}; requested a second instance on port ${requestedPort}. `
+      + `Startup continues only for an independent OPENCODEX_HOME; one state directory has one spend-ledger writer.`,
     );
   }
 
@@ -463,6 +464,10 @@ async function handleStart(options: { block?: boolean } = {}) {
       scheduleCatalogPrewarm();
       break;
     } catch (err) {
+      if (err instanceof SpendLedgerOwnerError) {
+        console.error(`❌ ${err.message}`);
+        process.exit(1);
+      }
       if (err instanceof AuxiliaryListenerBindError || !isAddrInUse(err) || attempt >= 2) throw err;
       if (requestedPort !== undefined) {
         console.log(`⚠️  Port ${port} was taken while starting; waiting to retry the same port...`);

package/src/cli/opencode.ts

@@ -41,7 +41,7 @@ import type {
 } from "../clients/config-export";
 import { filterCatalogVisibleModels, visibleNativeSlugs } from "../codex/catalog";
 import { commandInvocation } from "../lib/win-exec";
-import { configuredAdminToken } from "../lib/admin-secrets";
+import { configuredAdminToken, opencodeCatalogToken } from "../lib/admin-secrets";
 import { localManagementOrigin } from "../lib/local-destinations";
 import { directLocalHttpFetch } from "../server/direct-local-http";
 import { loadServiceTokenFromFile, serviceApiTokenFilePath } from "../lib/service-secrets";
@@ -684,7 +684,7 @@ export async function cmdOpencode(args: string[]): Promise<number> {
   try {
     const managementToken = configuredAdminToken();
     if (!managementToken) throw new Error("No local admin token is available; check the running proxy's home.");
-    proxyModels = await fetchOpencodeProxyModels(live, managementToken, {
+    proxyModels = await fetchOpencodeProxyModels(live, opencodeCatalogToken(managementToken), {
       managementOrigin: localManagementOrigin({ ...startupConfig, hostname: live.hostname }, live.port),
     });
   } catch (error) {