@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/server/claude-messages.ts

@@ -7,6 +7,12 @@
  * unchanged. The Responses output (SSE or JSON) is converted back to Anthropic shape.
  */
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import {
+  admissionModelDeniedResponse,
+  AdmissionModelDeniedError,
+  assertRouteAllowedByScope,
+  resolveAdmissionModelScope,
+} from "./admission-model-scope";
 import { jsonUtf8Bytes } from "../lib/json-byte-size";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
@@ -18,7 +24,14 @@ import { recordDesktopRequest } from "../claude/desktop-health";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
 import { analyzeClaudeCompatibility, isClaudeCompatibilityMode } from "../claude/compatibility";
-import { isTransientUpstreamStatus } from "../lib/upstream-retry";
+import {
+  applyReplayRefusalClientHeaders,
+  carryReplayRefusal,
+  isReplayRefusalResponse,
+  isTransientUpstreamStatus,
+  REPLAY_REFUSED_STATUS,
+  UPSTREAM_RESET_REPLAY_REFUSED_CODE,
+} from "../lib/upstream-retry";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import {
   anthropicErrorBody,
@@ -29,7 +42,7 @@ import {
 } from "../claude/outbound";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
-import { NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
@@ -420,7 +433,7 @@ async function anthropicNativePassthrough(
   // count_tokens too — counts must match what the real send will contain, and the 32MB
   // body cap applies to it equally. Non-message bodies pass through untouched.
   if (Array.isArray(body.messages)) {
-    await normalizeAnthropicImages(body.messages);
+    await normalizeAnthropicImages(body.messages, { abortSignal: req.signal });
     enforceAnthropicImageLimits(body.messages);
   }
   const headers = new Headers();
@@ -815,9 +828,19 @@ async function handleClaudeMessagesWithBudget(
   // verified live 2026-07-11). Strip them for that route; routed providers keep them.
   try {
     const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
+    // Same reason as the native Chat lane: this route can be sent from here, so
+    // the key's scope is applied before the wire is settled.
+    assertRouteAllowedByScope(
+      resolveAdmissionModelScope(config, logIds?.admission),
+      String(internalBody.model ?? ""),
+      route,
+    );
     // Settle the wire once so the sampling decision below reads the effective
     // adapter rather than the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic");
+    route.staticPolicy = captureRouteStaticPolicy(
+      route.providerName, route.modelId, route.provider, route.staticPolicy.effectiveAlias, "anthropic",
+    );
+    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic", route.staticPolicy);
     logCtx.routeDecision = route.routeDecision;
     if (route.provider.adapter === "openai-responses") {
       delete internalBody.max_output_tokens;
@@ -844,6 +867,11 @@ async function handleClaudeMessagesWithBudget(
       if (ladder !== undefined && ladder.length === 0) delete internalBody.reasoning;
     }
   } catch (err) {
+    if (err instanceof AdmissionModelDeniedError) {
+      logCtx.requestedModel = requestedModel;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 403, { closeReason: "non_stream" });
+      return admissionModelDeniedResponse(err);
+    }
     if (err instanceof UnknownRoutingPolicyError) {
       logCtx.requestedModel = requestedModel;
       if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 404, { closeReason: "non_stream" });
@@ -958,6 +986,9 @@ async function handleClaudeMessagesWithBudget(
   const response = logIds ? responseWithDeferredRequestLog(upstream, logIds.requestId, logIds.start, logCtx) : upstream;
 
   if (!response.ok) {
+    // Read the shared provenance verdict before consuming and re-wrapping the body. A refusal
+    // and an ordinary provider rate limit are both 429, so the status cannot distinguish them.
+    const replayRefusal = isReplayRefusalResponse(response);
     // Re-shape the OpenAI-style error envelope into the Anthropic one, preserving status.
     let message = `upstream error (${response.status})`;
     try {
@@ -972,14 +1003,16 @@ async function handleClaudeMessagesWithBudget(
       }
     } catch { /* keep fallback message */ }
     const upstreamRetryAfter = response.headers.get("retry-after");
-    const retryAfter = resolveClientRetryAfter({
-      status: response.status,
-      message,
-      upstreamRetryAfter,
-    })
-      // Instant-retry "0" is a valid client directive but rejected by cooldown parsers.
-      // Preserve it so it still wins over the transient "2" fallback (claude-529 mapping).
-      ?? (upstreamRetryAfter?.trim() === "0" ? "0" : undefined);
+    const retryAfter = replayRefusal
+      ? undefined
+      : resolveClientRetryAfter({
+          status: response.status,
+          message,
+          upstreamRetryAfter,
+        })
+        // Instant-retry "0" is a valid client directive but rejected by cooldown parsers.
+        // Preserve it so it still wins over the transient "2" fallback (claude-529 mapping).
+        ?? (upstreamRetryAfter?.trim() === "0" ? "0" : undefined);
     // Transient upstream 5xx (already retried pre-stream, 010): reclassify as Anthropic
     // 529 overloaded_error so the Claude Code client applies its built-in backoff retry
     // instead of dying on a fatal api_error (260716 sol-builder incident). The request
@@ -990,16 +1023,24 @@ async function handleClaudeMessagesWithBudget(
     const nativeMainFence = response.status === 503
       && upstreamRetryAfter?.trim() === "1"
       && message === CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE;
-    const transient = !nativeMainFence && isTransientUpstreamStatus(response.status);
-    const outStatus = nativeMainFence ? 503 : transient ? 529 : response.status;
-    const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {
+    const transient = !replayRefusal && !nativeMainFence && isTransientUpstreamStatus(response.status);
+    const outStatus = replayRefusal
+      ? REPLAY_REFUSED_STATUS
+      : nativeMainFence ? 503 : transient ? 529 : response.status;
+    const outHeaders = new Headers({ "Content-Type": "application/json" });
+    if (retryAfter) outHeaders.set("Retry-After", retryAfter);
+    else if (transient) outHeaders.set("Retry-After", "2");
+    if (replayRefusal) applyReplayRefusalClientHeaders(outHeaders);
+    const out = new Response(JSON.stringify(anthropicErrorBody(
+      outStatus,
+      message,
+      undefined,
+      replayRefusal ? UPSTREAM_RESET_REPLAY_REFUSED_CODE : undefined,
+    )), {
       status: outStatus,
-      headers: {
-        "Content-Type": "application/json",
-        ...(retryAfter ? { "Retry-After": retryAfter } : (transient ? { "Retry-After": "2" } : {})),
-      },
+      headers: outHeaders,
     });
-    return out;
+    return carryReplayRefusal(response, out);
   }
 
   const contentType = response.headers.get("content-type") ?? "";

package/src/server/effort-row.ts

@@ -30,7 +30,9 @@ export interface EffortRowOptions {
 }
 
 export function isKnownId(knownIds: EffortRowKnownIds | undefined, id: string): boolean {
-  return typeof knownIds === "function" ? knownIds(id) : knownIds?.has(id) === true;
+  return typeof knownIds === "function"
+    ? knownIds(id)
+    : knownIds?.has(id) === true || knownIds?.has(id.toLowerCase()) === true;
 }
 
 export function effortRowId(baseId: string, effort: string): string {
@@ -43,6 +45,12 @@ export function effortRowId(baseId: string, effort: string): string {
  */
 export function knownEffortRowIds(config: OcxConfig): Set<string> {
   const ids = new Set<string>();
+  const addAlias = (id: string): void => {
+    ids.add(id);
+    // Model aliases are resolved case-insensitively. Preserve that contract here so an
+    // alias cannot be mistaken for a synthetic effort row before ordinary routing runs.
+    ids.add(id.toLowerCase());
+  };
   for (const [providerName, provider] of Object.entries(config.providers)) {
     const known = knownModelIdsForProvider(providerName, provider, config);
     const namespaces = [providerName, provider.alias].filter((value): value is string => (
@@ -54,8 +62,8 @@ export function knownEffortRowIds(config: OcxConfig): Set<string> {
       for (const namespace of namespaces) ids.add(`${namespace}/${id}`);
     }
     for (const alias of Object.values(provider.modelAliases ?? {})) {
-      ids.add(alias);
-      for (const namespace of namespaces) ids.add(`${namespace}/${alias}`);
+      addAlias(alias);
+      for (const namespace of namespaces) addAlias(`${namespace}/${alias}`);
     }
   }
   for (const [id, combo] of Object.entries(config.combos ?? {})) {

package/src/server/grok-responses-control-frame.ts

@@ -1,10 +1,137 @@
-import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 
 const GROK_CONTROL_FRAME_TYPES: Record<string, true> = {
   "codex.rate_limits": true,
   "codex.response.metadata": true,
 };
 
+const GROK_RESPONSE_INTEGER_TIMESTAMP_FIELDS = ["created_at", "completed_at"] as const;
+
+type JsonRange = { start: number; end: number };
+
+function skipJsonWhitespace(payload: string, index: number): number {
+  while (index < payload.length && /[\t\n\r ]/.test(payload[index] ?? "")) index += 1;
+  return index;
+}
+
+function findJsonStringEnd(payload: string, start: number): number | undefined {
+  for (let index = start + 1; index < payload.length; index += 1) {
+    if (payload[index] === "\\") index += 1;
+    else if (payload[index] === '"') return index + 1;
+  }
+  return undefined;
+}
+
+function findJsonValueEnd(payload: string, start: number): number | undefined {
+  if (payload[start] === '"') return findJsonStringEnd(payload, start);
+  if (payload[start] !== "{" && payload[start] !== "[") {
+    let index = start;
+    while (index < payload.length && !",}]".includes(payload[index] ?? "")) index += 1;
+    return index;
+  }
+
+  let depth = 0;
+  let inString = false;
+  for (let index = start; index < payload.length; index += 1) {
+    const char = payload[index];
+    if (inString) {
+      if (char === "\\") index += 1;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') inString = true;
+    else if (char === "{" || char === "[") depth += 1;
+    else if (char === "}" || char === "]") {
+      depth -= 1;
+      if (depth === 0) return index + 1;
+    }
+  }
+  return undefined;
+}
+
+function findResponseObjectRange(payload: string): JsonRange | null {
+  let cursor = skipJsonWhitespace(payload, 0);
+  if (payload[cursor] !== "{") return null;
+  cursor += 1;
+  let responseRange: JsonRange | null = null;
+
+  while (cursor < payload.length) {
+    cursor = skipJsonWhitespace(payload, cursor);
+    if (payload[cursor] === "}") return responseRange;
+    if (payload[cursor] !== '"') return null;
+    const keyEnd = findJsonStringEnd(payload, cursor);
+    if (keyEnd === undefined) return null;
+    let key: unknown;
+    try {
+      key = JSON.parse(payload.slice(cursor, keyEnd));
+    } catch {
+      return null;
+    }
+
+    cursor = skipJsonWhitespace(payload, keyEnd);
+    if (payload[cursor] !== ":") return null;
+    const valueStart = skipJsonWhitespace(payload, cursor + 1);
+    const valueEnd = findJsonValueEnd(payload, valueStart);
+    if (valueEnd === undefined) return null;
+    if (key === "response" && payload[valueStart] === "{") {
+      responseRange = { start: valueStart, end: valueEnd };
+    }
+
+    cursor = skipJsonWhitespace(payload, valueEnd);
+    if (payload[cursor] === "}") return responseRange;
+    if (payload[cursor] !== ",") return null;
+    cursor += 1;
+  }
+  return null;
+}
+
+function rewriteIntegralTimestamp(payload: string, field: string, value: number, event: unknown): string | null {
+  const responseRange = findResponseObjectRange(payload);
+  if (responseRange === null) return null;
+  let cursor = responseRange.start + 1;
+  let candidate: { start: number; length: number } | null = null;
+  while (cursor < responseRange.end) {
+    cursor = skipJsonWhitespace(payload, cursor);
+    if (payload[cursor] === "}") break;
+    if (payload[cursor] !== '"') return null;
+    const keyEnd = findJsonStringEnd(payload, cursor);
+    if (keyEnd === undefined) return null;
+    let key: unknown;
+    try {
+      key = JSON.parse(payload.slice(cursor, keyEnd));
+    } catch {
+      return null;
+    }
+    cursor = skipJsonWhitespace(payload, keyEnd);
+    if (payload[cursor] !== ":") return null;
+    const valueStart = skipJsonWhitespace(payload, cursor + 1);
+    const valueEnd = findJsonValueEnd(payload, valueStart);
+    if (valueEnd === undefined || valueEnd > responseRange.end) return null;
+    const valueToken = payload.slice(valueStart, valueEnd).trimEnd();
+    if (
+      key === field &&
+      /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(valueToken) &&
+      valueToken !== String(value) &&
+      Number(valueToken) === value
+    ) {
+      if (candidate !== null) return null;
+      candidate = { start: valueStart, length: valueToken.length };
+    }
+    cursor = skipJsonWhitespace(payload, valueEnd);
+    if (payload[cursor] === "}") break;
+    if (payload[cursor] !== ",") return null;
+    cursor += 1;
+  }
+  if (candidate === null) return payload;
+
+  const rewritten = `${payload.slice(0, candidate.start)}${value}${payload.slice(candidate.start + candidate.length)}`;
+  try {
+    return JSON.stringify(JSON.parse(rewritten)) === JSON.stringify(event) ? rewritten : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Hide Codex-only control frames from Grok's strict Responses decoder.
  *
@@ -41,3 +168,35 @@ export function createGrokResponsesControlFrameBlockRewrite(): SseBlockRewrite {
       : [block];
   };
 }
+
+/** Normalize safe integer response timestamps for Grok's strict Responses decoder. */
+export function createGrokResponsesTimestampBlockRewrite(): SseBlockRewrite {
+  return (block) => {
+    const payload = sseDataPayload(block);
+    if (payload === null || payload === "[DONE]") return [block];
+
+    let event: unknown;
+    try {
+      event = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    if (!event || typeof event !== "object" || Array.isArray(event)) return [block];
+    const eventRecord = event as Record<string, unknown>;
+    if (typeof eventRecord.type !== "string" || !eventRecord.type.startsWith("response.")) return [block];
+    if (!eventRecord.response || typeof eventRecord.response !== "object" || Array.isArray(eventRecord.response)) {
+      return [block];
+    }
+    const response = eventRecord.response as Record<string, unknown>;
+    let rewrittenPayload = payload;
+    for (const field of GROK_RESPONSE_INTEGER_TIMESTAMP_FIELDS) {
+      const value = response[field];
+      if (value === undefined) continue;
+      if (typeof value !== "number" || value < 0 || !Number.isSafeInteger(value)) return [block];
+      const rewritten = rewriteIntegralTimestamp(rewrittenPayload, field, value, event);
+      if (rewritten === null) return [block];
+      rewrittenPayload = rewritten;
+    }
+    return rewrittenPayload === payload ? [block] : [replaceSseDataPayload(block, rewrittenPayload)];
+  };
+}

package/src/server/grok-responses-snapshot-repair.ts

@@ -1,8 +1,13 @@
 /** Strict terminal reconstruction selected by the Grok compatibility marker. */
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { MAX_COMPLETED_OUTPUT_ITEMS, MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES } from "./relay";
-import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 import { isPlainObject, jsonBlock, type RetainedOutputItem } from "./responses-snapshot-codec";
+import {
+  requestToolScope,
+  type RequestToolScope,
+  type RequestToolScopeCorrespondence,
+} from "./responses-request-tool-scope";
 
 type SparseTerminalOpenItem = {
   type: string;
@@ -16,6 +21,20 @@ type SparseTerminalCompletedItem = RetainedOutputItem & {
 
 const MAX_GROK_OPEN_ITEM_IDENTITY_BYTES = MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES;
 
+/** Terminal event this repair publishes when it refused to reconstruct a call faithfully. */
+export const GROK_REFUSED_TERMINAL_EVENT_TYPE = "response.incomplete";
+
+/** `incomplete_details.reason` carried by that terminal. */
+export const GROK_FORBIDDEN_TOOL_CALL_REASON = "forbidden_tool_call";
+
+/** An upstream-supplied name reaches the terminal message; keep it bounded. */
+const MAX_REPORTED_TOOL_NAME_CHARS = 100;
+
+export function forbiddenToolCallMessage(name: string): string {
+  return `routed provider called "${name.slice(0, MAX_REPORTED_TOOL_NAME_CHARS)}", `
+    + "which this request's tool selection excludes; the reconstructed output omits that call";
+}
+
 const GROK_TERMINAL_OUTPUT_ITEM_TYPES = new Set([
   "message",
   "reasoning",
@@ -167,6 +186,45 @@ function plausibleGrokOpenItem(
   };
 }
 
+/**
+ * Publish the refusal on the terminal itself rather than as a silent omission.
+ *
+ * The ordinary reconstruction replaces only the data payload's `output`, so its event name still
+ * describes the payload. A refusal does not: the turn no longer completed the way the upstream
+ * said it did, so the event line moves with the status instead of leaving a client to read a
+ * clean finish off an unchanged `event: response.completed`.
+ */
+function refusedTerminalBlock(
+  block: string,
+  parsed: Record<string, unknown>,
+  response: Record<string, unknown>,
+  output: readonly Record<string, unknown>[],
+  refusedName: string | undefined,
+): string {
+  const payload = JSON.stringify({
+    ...parsed,
+    type: GROK_REFUSED_TERMINAL_EVENT_TYPE,
+    response: {
+      ...response,
+      status: "incomplete",
+      output,
+      incomplete_details: {
+        reason: GROK_FORBIDDEN_TOOL_CALL_REASON,
+        ...(refusedName === undefined ? {} : { message: forbiddenToolCallMessage(refusedName) }),
+      },
+    },
+  });
+  const rewritten = replaceSseDataPayload(block, payload);
+  const newline = block.includes("\r\n") ? "\r\n" : "\n";
+  let eventRewritten = false;
+  const lines = rewritten.split(/\r?\n/).map(line => {
+    if (eventRewritten || !line.startsWith("event:")) return line;
+    eventRewritten = true;
+    return `event: ${GROK_REFUSED_TERMINAL_EVENT_TYPE}`;
+  });
+  return lines.join(newline);
+}
+
 /**
  * Narrow client repair for grok-build's Responses consumer.
  *
@@ -176,12 +234,26 @@ function plausibleGrokOpenItem(
  * empty output. Reconstruct only from real, unique, contiguous, bounded done
  * events whose raw semantics are already valid. Any ambiguity stays byte-level
  * fail-closed; the provider-opt-in snapshot repair above is unchanged.
+ *
+ * The terminal this publishes is one the upstream never sent, so it carries only what the final
+ * outbound request still authorized. A client call outside that request's tool selection is left
+ * out and the terminal says so explicitly. The declaration guard downstream answers the other
+ * half of the question — whether a name was declared at all — and keeps policing the raw stream,
+ * which this rewrite never edits.
  */
 export function createGrokResponsesSparseTerminalBlockRewrite(
   budget?: TranslatorBudget,
+  outboundRequestBody?: unknown,
+  toolIdentityCorrespondence?: RequestToolScopeCorrespondence,
 ): SseBlockRewrite {
+  const toolScope: RequestToolScope | undefined = requestToolScope(
+    outboundRequestBody,
+    toolIdentityCorrespondence,
+  );
   const openItems = new Map<number, SparseTerminalOpenItem>();
   const completedItems = new Map<number, SparseTerminalCompletedItem>();
+  const withheldIndices = new Set<number>();
+  let withheldToolName: string | undefined;
   let aggregateItemBytes = 0;
   let aggregateOpenItemBytes = 0;
   let tainted = false;
@@ -194,6 +266,8 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     }
     openItems.clear();
     completedItems.clear();
+    withheldIndices.clear();
+    withheldToolName = undefined;
     aggregateItemBytes = 0;
     aggregateOpenItemBytes = 0;
     hasVisibleOutput = false;
@@ -217,7 +291,7 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     if (tainted) return;
     const sourceBytes = Buffer.byteLength(JSON.stringify(item), "utf8");
     if (sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES
-      || completedItems.size >= MAX_COMPLETED_OUTPUT_ITEMS
+      || completedItems.size + withheldIndices.size >= MAX_COMPLETED_OUTPUT_ITEMS
       || aggregateItemBytes + sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES) {
       taintAndRelease();
       return;
@@ -228,6 +302,24 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     hasVisibleOutput = hasVisibleOutput || visibleToGrok;
   };
 
+  /**
+   * Record the position of a call this request forbade without retaining the item.
+   *
+   * Only the offending item is dropped. Tainting here instead would discard the assistant text
+   * that arrived in the same turn and leave the client the empty terminal this repair exists to
+   * fix, which punishes the caller for the provider's overreach. The index is kept so the
+   * contiguity proof below still covers the whole output.
+   */
+  const withholdForbiddenCall = (index: number, name: string): void => {
+    if (tainted) return;
+    if (completedItems.size + withheldIndices.size >= MAX_COMPLETED_OUTPUT_ITEMS) {
+      taintAndRelease();
+      return;
+    }
+    withheldIndices.add(index);
+    withheldToolName ??= name.slice(0, MAX_REPORTED_TOOL_NAME_CHARS);
+  };
+
   const closeOpenItem = (index: number): void => {
     const open = openItems.get(index);
     if (!open) return;
@@ -265,6 +357,7 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
       const open = isPlainObject(parsed.item) ? plausibleGrokOpenItem(parsed.item) : null;
       if (outputIndex === undefined || !open
         || openItems.has(outputIndex) || completedItems.has(outputIndex)
+        || withheldIndices.has(outputIndex)
         || openItems.size >= MAX_COMPLETED_OUTPUT_ITEMS) {
         taintAndRelease();
       } else if (!tainted) {
@@ -284,7 +377,8 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     if (type === "response.output_item.done") {
       const item = isPlainObject(parsed.item) ? parsed.item : null;
       const proof = item ? trustedGrokCompletedItem(item) : null;
-      if (outputIndex === undefined || !proof || completedItems.has(outputIndex)) {
+      if (outputIndex === undefined || !proof
+        || completedItems.has(outputIndex) || withheldIndices.has(outputIndex)) {
         taintAndRelease();
         return [block];
       }
@@ -295,7 +389,12 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
         return [block];
       }
       closeOpenItem(outputIndex);
-      retainCompletedItem(outputIndex, item!, proof.visibleToGrok);
+      const forbidden = toolScope?.forbiddenClientToolCallName(item!);
+      if (forbidden === undefined) {
+        retainCompletedItem(outputIndex, item!, proof.visibleToGrok);
+      } else {
+        withholdForbiddenCall(outputIndex, forbidden);
+      }
       return [block];
     }
 
@@ -312,14 +411,18 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
       const outputIsAuthoritative = Array.isArray(output) && output.length > 0;
       const outputIsSparse = !("output" in response)
         || (Array.isArray(output) && output.length === 0);
+      // A withheld call is a reason to publish on its own: the refusal has to reach the client
+      // even when nothing visible survived it, or the turn ends as an ordinary empty finish.
+      const refused = withheldIndices.size > 0;
       if (!outputIsAuthoritative && outputIsSparse && terminalStatusConsistent
-        && completedItems.size > 0 && openItems.size === 0 && hasVisibleOutput) {
+        && openItems.size === 0 && (hasVisibleOutput || refused)) {
         const ordered = [...completedItems.entries()].sort(([left], [right]) => left - right);
-        if (ordered.every(([index], position) => index === position)) {
-          out = jsonBlock({
-            ...parsed,
-            response: { ...response, output: ordered.map(([, retained]) => retained.item) },
-          });
+        const positions = [...completedItems.keys(), ...withheldIndices].sort((left, right) => left - right);
+        if (positions.length > 0 && positions.every((index, position) => index === position)) {
+          const rebuilt = ordered.map(([, retained]) => retained.item);
+          out = refused
+            ? refusedTerminalBlock(block, parsed, response, rebuilt, withheldToolName)
+            : jsonBlock({ ...parsed, response: { ...response, output: rebuilt } });
         }
       }
     }
@@ -330,4 +433,3 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
   rewrite.dispose = reset;
   return rewrite;
 }
-

package/src/server/gui-freshness.ts

@@ -0,0 +1,103 @@
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * Whether the served dashboard bundle predates the sources it was built from.
+ *
+ * The dashboard is a build artifact: `AGENTS.md` records that `gui/` is served from `gui/dist`,
+ * so a checkout that moves forward without `bun run build:gui` keeps serving the previous bundle.
+ * Nothing fails when that happens. The proxy answers, the page loads, and every feature added since
+ * the last build is simply absent — which reads as the feature being broken rather than unbuilt.
+ * A five-day-old bundle hid the entire menu-bar and widget section of the Usage page this way.
+ *
+ * This reports; it never rebuilds. A proxy that compiled a frontend while starting would trade a
+ * silent staleness for a slow, surprising start, and the rebuild belongs to whoever moved the
+ * checkout.
+ */
+export interface GuiBundleFreshness {
+  /** Absolute path of the served bundle, or null when no bundle was found. */
+  bundlePath: string | null;
+  /** Newest mtime under the bundle, in epoch milliseconds. */
+  bundleModifiedMs: number | null;
+  /** Newest mtime under the GUI sources, in epoch milliseconds. */
+  sourceModifiedMs: number | null;
+  /** True only when both sides are known and the sources are strictly newer. */
+  stale: boolean;
+}
+
+/** Directory entries that never carry meaningful build input or output timestamps. */
+const IGNORED_DIRECTORIES = new Set(["node_modules", ".git", ".vite", ".cache"]);
+
+/**
+ * Newest mtime beneath `root`, or null when the tree is missing or empty.
+ *
+ * Walking is bounded by `maxEntries` because this runs on a status path: a pathological tree must
+ * cost a predictable amount rather than stalling the command that reports on it. Hitting the bound
+ * yields the newest value seen so far, which can only make the comparison more conservative.
+ */
+export function newestModifiedMs(root: string, maxEntries = 20_000): number | null {
+  if (!existsSync(root)) return null;
+  let newest: number | null = null;
+  let seen = 0;
+  const queue: string[] = [root];
+  while (queue.length > 0) {
+    const current = queue.pop()!;
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (seen >= maxEntries) return newest;
+      if (entry.isSymbolicLink()) continue;
+      const full = join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (IGNORED_DIRECTORIES.has(entry.name)) continue;
+        queue.push(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      seen += 1;
+      try {
+        const mtime = statSync(full).mtimeMs;
+        if (newest === null || mtime > newest) newest = mtime;
+      } catch {
+        // A file that vanished mid-walk cannot make the bundle look fresher than it is.
+      }
+    }
+  }
+  return newest;
+}
+
+/**
+ * Compare the built bundle against its sources.
+ *
+ * Unknown is not stale. A packaged install has no `gui/src` beside it, and a missing bundle is a
+ * different condition with its own message elsewhere; neither should produce a rebuild warning.
+ */
+export function inspectGuiBundleFreshness(input: {
+  bundlePath: string | null;
+  sourcePath: string;
+}): GuiBundleFreshness {
+  const bundleModifiedMs = input.bundlePath === null ? null : newestModifiedMs(input.bundlePath);
+  const sourceModifiedMs = newestModifiedMs(input.sourcePath);
+  const stale = bundleModifiedMs !== null
+    && sourceModifiedMs !== null
+    && sourceModifiedMs > bundleModifiedMs;
+  return {
+    bundlePath: input.bundlePath,
+    bundleModifiedMs,
+    sourceModifiedMs,
+    stale,
+  };
+}
+
+/** Operator-facing lines for a stale bundle; empty when the bundle is current or unknown. */
+export function staleGuiBundleLines(freshness: GuiBundleFreshness): string[] {
+  if (!freshness.stale) return [];
+  return [
+    "Dashboard bundle is older than the GUI sources, so the page is missing everything built since.",
+    "Rebuild it with: bun run build:gui",
+  ];
+}