@bitkyc08/opencodex 2.6.26-preview.20260705 → 2.6.28-preview.20260707

package/src/{ws-bridge.ts → server/ws-bridge.ts}

@@ -1,11 +1,12 @@
 import type { ServerWebSocket } from "bun";
-import { FORWARD_HEADERS } from "./adapters/openai-responses";
-import type { CodexAuthContext } from "./codex-auth-context";
-import { headersForCodexAuthContext } from "./codex-auth-context";
-import type { ResponsesTerminalStatus } from "./bridge";
+import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import type { CodexAuthContext } from "../codex/auth-context";
+import { headersForCodexAuthContext } from "../codex/auth-context";
+import type { ResponsesTerminalStatus } from "../bridge";
 
 const OPEN = 1;
 type ResponsesTerminalReporter = (status: ResponsesTerminalStatus) => void;
+type ResponsesPayloadObserver = (payload: string) => void;
 const SAFE_RESPONSE_HEADER_EXACT = new Set([
   "retry-after",
   "x-request-id",
@@ -169,7 +170,11 @@ function sendProtocolError(ws: ServerWebSocket<WsData>, status: number, message:
 export async function pumpResponsesSseToWebSocket(
   ws: ServerWebSocket<WsData>,
   sseStream: ReadableStream<Uint8Array>,
-  options: { isCurrent?: () => boolean; onTerminal?: ResponsesTerminalReporter } = {},
+  options: {
+    isCurrent?: () => boolean;
+    onTerminal?: ResponsesTerminalReporter;
+    onSsePayload?: ResponsesPayloadObserver;
+  } = {},
 ): Promise<void> {
   const reader = sseStream.getReader();
   const isCurrent = options.isCurrent ?? (() => true);
@@ -193,6 +198,11 @@ export async function pumpResponsesSseToWebSocket(
   const handlePayload = (payload: string): boolean => {
     if (!isCurrent()) return true;
     if (payload === "[DONE]") return false;
+    try {
+      options.onSsePayload?.(payload);
+    } catch {
+      /* payload observation must not affect WebSocket delivery */
+    }
     const type = payloadType(payload);
     if (!type) {
       reportTerminal("incomplete");
@@ -248,14 +258,24 @@ export function sendResponsesJsonAsEvents(
   ws: ServerWebSocket<WsData>,
   response: Record<string, unknown>,
   onTerminal?: ResponsesTerminalReporter,
+  onPayload?: ResponsesPayloadObserver,
 ): void {
+  const sendObservedFrame = (payload: Record<string, unknown>) => {
+    const text = JSON.stringify(payload);
+    try {
+      onPayload?.(text);
+    } catch {
+      /* payload observation must not affect WebSocket delivery */
+    }
+    sendTextFrame(ws, text);
+  };
   const output = Array.isArray(response.output) ? response.output : [];
-  sendJsonFrame(ws, {
+  sendObservedFrame({
     type: "response.created",
     response: { ...response, status: "in_progress", output: [] },
   });
   output.forEach((item, outputIndex) => {
-    sendJsonFrame(ws, {
+    sendObservedFrame({
       type: "response.output_item.done",
       output_index: outputIndex,
       item,
@@ -264,7 +284,7 @@ export function sendResponsesJsonAsEvents(
   const finalStatus = response.status === "failed" || response.status === "incomplete"
     ? response.status
     : "completed";
-  sendJsonFrame(ws, {
+  sendObservedFrame({
     type: `response.${finalStatus}` as "response.completed" | "response.failed" | "response.incomplete",
     response: { ...response, status: finalStatus },
   });
@@ -290,7 +310,10 @@ export async function sendResponseToWebSocket(
   ws: ServerWebSocket<WsData>,
   response: Response,
   isCurrent: () => boolean,
-  options: { onTerminal?: ResponsesTerminalReporter } = {},
+  options: {
+    onTerminal?: ResponsesTerminalReporter;
+    onSsePayload?: ResponsesPayloadObserver;
+  } = {},
 ): Promise<void> {
   if (!isCurrent()) {
     await response.body?.cancel().catch(() => {});
@@ -316,7 +339,11 @@ export async function sendResponseToWebSocket(
   }
 
   if (contentType.includes("text/event-stream")) {
-    await pumpResponsesSseToWebSocket(ws, response.body, { isCurrent, onTerminal: options.onTerminal });
+    await pumpResponsesSseToWebSocket(ws, response.body, {
+      isCurrent,
+      onTerminal: options.onTerminal,
+      onSsePayload: options.onSsePayload,
+    });
     return;
   }
 
@@ -324,7 +351,7 @@ export async function sendResponseToWebSocket(
     const text = await response.text();
     if (!isCurrent()) return;
     const json = JSON.parse(text) as Record<string, unknown>;
-    sendResponsesJsonAsEvents(ws, json, options.onTerminal);
+    sendResponsesJsonAsEvents(ws, json, options.onTerminal, options.onSsePayload);
     return;
   }
 
@@ -334,7 +361,11 @@ export async function sendResponseToWebSocket(
     return;
   }
   if (looksLikeSse(prefix)) {
-    await pumpResponsesSseToWebSocket(ws, stream, { isCurrent, onTerminal: options.onTerminal });
+    await pumpResponsesSseToWebSocket(ws, stream, {
+      isCurrent,
+      onTerminal: options.onTerminal,
+      onSsePayload: options.onSsePayload,
+    });
     return;
   }
 
@@ -343,7 +374,7 @@ export async function sendResponseToWebSocket(
   const trimmed = text.trim();
   if (trimmed.startsWith("{")) {
     const json = JSON.parse(trimmed) as Record<string, unknown>;
-    sendResponsesJsonAsEvents(ws, json, options.onTerminal);
+    sendResponsesJsonAsEvents(ws, json, options.onTerminal, options.onSsePayload);
     return;
   }
 

package/src/service.ts

@@ -11,11 +11,11 @@ import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort } from "./config";
 import { loadConfig } from "./config";
-import { restoreNativeCodex } from "./codex-inject";
-import { durableBunPath, durableBunRuntime } from "./bun-runtime";
-import { isProcessAlive, stopProxy } from "./process-control";
-import { serviceApiTokenFilePath } from "./service-secrets";
-import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./win-paths";
+import { restoreNativeCodex } from "./codex/inject";
+import { durableBunPath, durableBunRuntime } from "./lib/bun-runtime";
+import { isProcessAlive, stopProxy } from "./lib/process-control";
+import { serviceApiTokenFilePath } from "./lib/service-secrets";
+import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./lib/win-paths";
 
 const LABEL = "com.opencodex.proxy";
 const TASK = "opencodex-proxy";
@@ -23,8 +23,8 @@ const TASK = "opencodex-proxy";
 function cliEntry(): { bun: string; cli: string } {
   // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than
   // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a
-  // standalone Bun is later removed. cli.ts sits next to this module.
-  return { bun: durableBunPath(), cli: join(import.meta.dir, "cli.ts") };
+  // standalone Bun is later removed. The CLI entry lives at src/cli/index.ts.
+  return { bun: durableBunPath(), cli: join(import.meta.dir, "cli", "index.ts") };
 }
 
 function plistPath(): string {
@@ -709,8 +709,11 @@ export async function serviceCommand(sub?: string): Promise<void> {
       assertServiceEnvironmentMatchesInstall();
       ops.stop();
       await stopTrackedProxyForServiceCommand();
-      restoreNativeCodex();
-      console.log("✅ service stopped + native Codex restored.");
+      {
+        const restore = restoreNativeCodex();
+        if (restore.success) console.log("✅ service stopped + native Codex restored.");
+        else console.error(`⚠️ service stopped, but native Codex restore FAILED: ${restore.message}\nRun \`ocx restore\` (or check $CODEX_HOME/config.toml) before using native Codex.`);
+      }
       break;
     case "status": {
       const s = ops.status();
@@ -724,10 +727,15 @@ export async function serviceCommand(sub?: string): Promise<void> {
       ops.stop();
       await stopTrackedProxyForServiceCommand();
       ops.uninstall();
-      restoreNativeCodex();
+      {
+        const restore = restoreNativeCodex();
+        if (!restore.success) {
+          console.error(`⚠️ native Codex restore FAILED: ${restore.message}\nRun \`ocx restore\` before using native Codex.`);
+        }
+      }
       removeServiceInstallState();
       try { if (existsSync(serviceApiTokenFilePath())) unlinkSync(serviceApiTokenFilePath()); } catch { /* best-effort */ }
-      console.log("✅ service uninstalled + native Codex restored.");
+      console.log("✅ service uninstalled.");
       break;
     default:
       console.error("Usage: ocx service [install|start|stop|status|uninstall|remove]");

package/src/types.ts

@@ -5,6 +5,8 @@ export interface OcxParsedRequest {
   stream: boolean;
   options: OcxRequestOptions;
   _rawBody?: unknown;
+  /** True when the proxy expanded a previous_response_id request into a full input replay. */
+  _previousResponseInputExpanded?: boolean;
   /** Provider-private stable Cursor conversation id resolved from the Responses previous_response_id chain. */
   _cursorConversationId?: string;
   /**
@@ -19,6 +21,13 @@ export interface OcxParsedRequest {
    * answer/"Sources:" text can't bleed into and corrupt the model's schema-constrained output.
    */
   _structuredOutput?: boolean;
+  /**
+   * True when the input carried `{type:"compaction_trigger"}` — Codex remote compaction v2 asking
+   * this turn to produce a `{type:"compaction"}` output item. Routed adapters can't natively;
+   * the server runs the model as a summarizer and the bridge emits a synthetic compaction item
+   * (see src/responses/compaction.ts).
+   */
+  _compactionRequest?: boolean;
 }
 
 export interface OcxContext {
@@ -85,6 +94,8 @@ export interface OcxThinkingContent {
   thinking: string;
   signature?: string;
   itemId?: string;
+  /** Raw Anthropic redacted_thinking block payloads to replay verbatim (order preserved). */
+  redacted?: string[];
 }
 
 export interface OcxToolCall {
@@ -182,6 +193,10 @@ export type AdapterEvent =
   | { type: "heartbeat" }
   | { type: "text_delta"; text: string }
   | { type: "thinking_delta"; thinking: string }
+  // Anthropic extended-thinking round-trip: signature_delta for the current thinking block, and
+  // opaque redacted_thinking blocks. Both must be replayed verbatim or tool-use turns 400.
+  | { type: "thinking_signature"; signature: string }
+  | { type: "redacted_thinking"; data: string }
   | { type: "reasoning_raw_delta"; text: string }
   | { type: "tool_call_start"; id: string; name: string }
   | { type: "tool_call_delta"; arguments: string }
@@ -337,6 +352,12 @@ export interface OcxProviderConfig {
   /** Keep provider settings on disk but exclude it from routing and model/catalog listings. */
   disabled?: boolean;
   apiKey?: string;
+  /**
+   * Multi-key pool (API-key twin of OAuth multiauth). `apiKey` always mirrors the ACTIVE
+   * entry so routing stays single-key; managed via /api/providers/keys. A legacy bare
+   * `apiKey` seeds a one-entry pool on first management touch.
+   */
+  apiKeyPool?: Array<{ id: string; key: string; label?: string; addedAt?: number }>;
   defaultModel?: string;
   models?: string[];
   /**
@@ -400,6 +421,12 @@ export interface OcxProviderConfig {
   autoToolChoiceOnlyModels?: string[];
   /** Model ids that expect prior assistant `reasoning_content` to be preserved in chat history. */
   preserveReasoningContentModels?: string[];
+  /**
+   * Model ids whose reasoning is a vendor `thinking: {type: enabled|disabled}` toggle on the
+   * chat-completions wire (MiMo v2.x, GLM 5/5.1 style), NOT an OpenAI `reasoning_effort` ladder.
+   * The openai-chat adapter translates the mapped effort into the thinking toggle for these.
+   */
+  thinkingToggleModels?: string[];
   /** Anthropic-compatible gateways that need custom tool names escaped on the wire. */
   escapeBuiltinToolNames?: boolean;
   /**

package/src/{update.ts → update/index.ts}

@@ -2,7 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readFileSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
-import { getConfigDir, readPid, readRuntimePort } from "./config";
+import { getConfigDir, readPid, readRuntimePort } from "../config";
 
 /**
  * A `codex-history-backup-*.json` surviving a stop means the native-history restore was
@@ -19,7 +19,7 @@ export function historyRestoreIncomplete(configDir = getConfigDir()): boolean {
 }
 
 export const PKG = "@bitkyc08/opencodex";
-const HERE = dirname(fileURLToPath(import.meta.url)); // .../opencodex/src
+const HERE = dirname(fileURLToPath(import.meta.url)); // .../opencodex/src/update
 
 export type Installer = "bun" | "npm" | "source";
 export type Channel = "latest" | "preview";
@@ -32,7 +32,7 @@ export function detectInstall(): Installer {
 
 export function currentVersion(): string {
   try {
-    return (JSON.parse(readFileSync(join(HERE, "..", "package.json"), "utf8")).version as string) ?? "?";
+    return (JSON.parse(readFileSync(join(HERE, "..", "..", "package.json"), "utf8")).version as string) ?? "?";
   } catch {
     return "?";
   }
@@ -105,7 +105,7 @@ export async function runUpdate(): Promise<void> {
   // unloads it permanently, so a successful update must reinstall/restart it afterwards.
   let serviceWasInstalled = false;
   try {
-    const { isServiceInstalled } = await import("./service");
+    const { isServiceInstalled } = await import("../service");
     serviceWasInstalled = isServiceInstalled();
   } catch { /* best-effort */ }
 
@@ -140,7 +140,7 @@ export async function runUpdate(): Promise<void> {
     // Re-bake the bundled Bun path into the Codex autostart shim on every
     // platform when one is installed (refresh-only; never installs fresh).
     try {
-      const { isCodexShimInstalled, installCodexShim } = await import("./codex-shim");
+      const { isCodexShimInstalled, installCodexShim } = await import("../codex/shim");
       if (isCodexShimInstalled()) {
         const result = installCodexShim();
         if (result.installed) console.log(`🔧 ${result.message}`);

package/src/{update-job.ts → update/job.ts}

@@ -2,9 +2,9 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { atomicWriteFile, getConfigDir, readPid } from "./config";
-import { killProxy } from "./process-control";
-import { isServiceInstalled } from "./service";
+import { atomicWriteFile, getConfigDir, readPid } from "../config";
+import { killProxy } from "../lib/process-control";
+import { isServiceInstalled } from "../service";
 import {
   type Channel,
   type Installer,
@@ -14,8 +14,8 @@ import {
   latestVersion,
   updateCommand,
   updateCommandStr,
-} from "./update";
-import { isNewer } from "./update-notify";
+} from "./index";
+import { isNewer } from "./notify";
 
 const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/latest";
 const UPDATE_JOB_FILENAME = "update-job.json";
@@ -79,7 +79,8 @@ function nodeBin(): string {
 }
 
 function packageLauncherPath(): string {
-  return join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "ocx.mjs");
+  // This module lives at src/update/job.ts — the launcher is <pkg-root>/bin/ocx.mjs.
+  return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "bin", "ocx.mjs");
 }
 
 function formatCommand(bin: string, args: string[]): string {

package/src/{update-notify.ts → update/notify.ts}

@@ -2,8 +2,8 @@ import { spawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
-import { atomicWriteFile, getConfigDir } from "./config";
-import { hasStarPromptRun } from "./star-prompt";
+import { atomicWriteFile, getConfigDir } from "../config";
+import { hasStarPromptRun } from "../cli/star-prompt";
 import {
   type Channel,
   currentVersion,
@@ -12,7 +12,7 @@ import {
   runUpdate,
   updateCommandStr,
   updateTag,
-} from "./update";
+} from "./index";
 
 const VERSION_FILENAME = "version.json";
 const REFRESH_INTERVAL_MS = 20 * 60 * 60 * 1000; // 20h, matching codex-rs

package/src/{usage-debug.ts → usage/debug.ts}

@@ -1,8 +1,8 @@
 import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { getConfigDir } from "./config";
-import { redactSecretString, redactSecrets } from "./redact";
-import type { OcxUsage } from "./types";
+import { getConfigDir } from "../config";
+import { redactSecretString, redactSecrets } from "../lib/redact";
+import type { OcxUsage } from "../types";
 
 export const USAGE_DEBUG_ENV = "OPENCODEX_USAGE_DEBUG";
 export const USAGE_DEBUG_BODY_SAMPLE_BYTES = 2048;

package/src/{usage-log.ts → usage/log.ts}

@@ -1,8 +1,8 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
-import { getConfigDir } from "./config";
-import { usageDisplayTotalTokens } from "./usage-totals";
-import type { OcxUsage } from "./types";
+import { getConfigDir } from "../config";
+import { usageDisplayTotalTokens } from "./totals";
+import type { OcxUsage } from "../types";
 
 export type UsageStatus = "reported" | "unreported" | "unsupported" | "estimated";
 

package/src/{usage-summary.ts → usage/summary.ts}

@@ -1,6 +1,6 @@
-import { baseProviderLabel } from "./provider-label";
-import { usageDisplayTotalTokens } from "./usage-totals";
-import type { PersistedUsageEntry, UsageStatus } from "./usage-log";
+import { baseProviderLabel } from "../providers/label";
+import { usageDisplayTotalTokens } from "./totals";
+import type { PersistedUsageEntry, UsageStatus } from "./log";
 
 export type UsageRange = "7d" | "30d" | "all";
 

package/src/{usage-totals.ts → usage/totals.ts}

@@ -1,4 +1,4 @@
-import type { OcxUsage } from "./types";
+import type { OcxUsage } from "../types";
 
 function cacheDetailTokens(usage: OcxUsage): number | undefined {
   const hasRead = typeof usage.cacheReadInputTokens === "number";

package/src/vision/describe.ts

@@ -1,8 +1,8 @@
 import type { OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
-import { signalWithTimeout, cancelBodyOnAbort } from "../abort";
-import { sidecarEnter } from "../sidecar-tracker";
-import { fetchWithResetRetry } from "../upstream-retry";
+import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import { fetchWithResetRetry } from "../lib/upstream-retry";
 import { parseSidecarSSE } from "../web-search/parse";
 import type { SidecarOutcomeRecorder } from "../web-search/executor";
 

package/src/vision/index.ts

@@ -1,7 +1,7 @@
 import type { OcxConfig, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTextContent } from "../types";
 import { modelInList } from "../types";
 import { describeImage, type VisionSettings } from "./describe";
-import type { CodexAuthContext } from "../codex-auth-context";
+import type { CodexAuthContext } from "../codex/auth-context";
 import type { SidecarOutcomeRecorder } from "../web-search/executor";
 
 export { describeImage } from "./describe";
@@ -145,3 +145,23 @@ export async function describeImagesInPlace(
     msg.content = newParts;
   }
 }
+
+/**
+ * Fail-closed image strip for sidecar-covered models when NO sidecar plan exists (no forward
+ * provider / missing forwarded auth / sidecar disabled): the upstream is text-only, so forwarding
+ * raw images would 400 or silently confuse it. Replace each image with an explicit marker so the
+ * model (and the user, via its reply) knows the image was dropped rather than ignored.
+ */
+export function stripImagesInPlace(parsed: OcxParsedRequest): boolean {
+  let stripped = false;
+  for (const msg of parsed.context.messages) {
+    if (!carriesImages(msg.role) || !Array.isArray(msg.content)) continue;
+    const parts = msg.content as OcxContentPart[];
+    if (!parts.some(p => p.type === "image")) continue;
+    msg.content = parts.map(p => p.type === "image"
+      ? { type: "text", text: "[image omitted: this model is text-only and the vision sidecar is unavailable (no ChatGPT login)]" } as OcxContentPart
+      : p);
+    stripped = true;
+  }
+  return stripped;
+}

package/src/web-search/executor.ts

@@ -1,10 +1,10 @@
 import type { OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
-import { signalWithTimeout, cancelBodyOnAbort } from "../abort";
-import { sidecarEnter } from "../sidecar-tracker";
-import { fetchWithResetRetry } from "../upstream-retry";
+import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import { fetchWithResetRetry } from "../lib/upstream-retry";
 import { parseSidecarSSE, type WebSearchResult } from "./parse";
-import type { CodexUpstreamOutcome } from "../codex-routing";
+import type { CodexUpstreamOutcome } from "../codex/routing";
 
 export interface SidecarSettings {
   model: string;

package/src/web-search/index.ts

@@ -1,7 +1,7 @@
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../types";
 import { modelInList } from "../types";
 import type { SidecarSettings } from "./executor";
-import type { CodexAuthContext } from "../codex-auth-context";
+import type { CodexAuthContext } from "../codex/auth-context";
 
 export { runWithWebSearch } from "./loop";
 export { buildWebSearchTool, extractHostedWebSearch, WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";

package/src/web-search/loop.ts

@@ -1,10 +1,10 @@
 import type { ProviderAdapter } from "../adapters/base";
-import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderConfig } from "../types";
+import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxThinkingContent } from "../types";
 import { namespacedToolName } from "../types";
 import { bridgeToResponsesSSE } from "../bridge";
 import { runWebSearch, type SidecarOutcome, type SidecarOutcomeRecorder, type SidecarSettings } from "./executor";
-import { cancelBodyOnAbort } from "../abort";
-import { fetchWithResetRetry } from "../upstream-retry";
+import { cancelBodyOnAbort } from "../lib/abort";
+import { fetchWithResetRetry } from "../lib/upstream-retry";
 import { formatWebSearchResults } from "./format-result";
 import { WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";
 
@@ -92,6 +92,32 @@ async function* replay(events: AdapterEvent[]): AsyncGenerator<AdapterEvent> {
   for (const e of events) yield e;
 }
 
+/**
+ * Collect the thinking block that preceded a web_search call in this iteration's events, so the
+ * replayed assistant turn can carry it. Anthropic extended thinking REQUIRES the assistant
+ * message that contains tool_use to start with its signed thinking/redacted_thinking blocks —
+ * replaying a bare toolCall 400s ("Expected `thinking` or `redacted_thinking`, but found
+ * `tool_use`"). The signature validity gate stays in the anthropic adapter; other adapters
+ * ignore or serialize the part harmlessly.
+ */
+function extractIterationThinking(events: AdapterEvent[]): OcxThinkingContent | null {
+  let thinking = "";
+  let signature: string | undefined;
+  const redacted: string[] = [];
+  for (const e of events) {
+    if (e.type === "thinking_delta") thinking += e.thinking;
+    else if (e.type === "thinking_signature") signature = e.signature;
+    else if (e.type === "redacted_thinking") redacted.push(e.data);
+  }
+  if (!thinking && !signature && redacted.length === 0) return null;
+  return {
+    type: "thinking",
+    thinking,
+    ...(signature ? { signature } : {}),
+    ...(redacted.length > 0 ? { redacted } : {}),
+  };
+}
+
 /** Normalize a query for failed-query de-duplication (case/whitespace-insensitive). */
 function normalizeQuery(q: string): string {
   return q.trim().toLowerCase().replace(/\s+/g, " ");
@@ -142,6 +168,13 @@ export interface WebSearchLoopDeps {
   forceEmptyResponseId?: boolean;
   abortSignal?: AbortSignal;
   recordSidecarOutcome?: SidecarOutcomeRecorder;
+  /** Per-iteration deadline for routed model calls (mirrors the normal path's connectTimeoutMs). */
+  connectTimeoutMs?: number;
+  /**
+   * 429 key-failover hook: rotate the provider's active pool key and return a rebuilt adapter,
+   * or null when the pool is exhausted (same semantics as the normal routed path).
+   */
+  on429?: (retryAfterHeader: string | null) => ProviderAdapter | null;
 }
 
 /**
@@ -151,7 +184,9 @@ export interface WebSearchLoopDeps {
  * streamed Responses SSE. web_search calls are executed internally and never relayed to Codex.
  */
 export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Response> {
-  const { parsed, adapter, selectedForwardHeaders, forwardProvider, hostedTool, settings, maxSearches, abortSignal, recordSidecarOutcome } = deps;
+  const { parsed, selectedForwardHeaders, forwardProvider, hostedTool, settings, maxSearches, abortSignal, recordSidecarOutcome } = deps;
+  // Mutable: 429 key-failover (deps.on429) can swap in a rebuilt adapter mid-loop.
+  let adapter = deps.adapter;
   if (!adapter.parseResponse) return jsonError(500, "web-search sidecar requires a non-streaming adapter");
 
   const messages: OcxMessage[] = [...parsed.context.messages];
@@ -196,22 +231,41 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       ...parsed, stream: false,
       context: { ...parsed.context, messages: iterMessages, tools: forceAnswer ? toolsNoWebSearch : allTools },
     };
-    const request = await adapter.buildRequest(iterParsed, { headers: selectedForwardHeaders });
-    let resp: Response;
-    try {
-      resp = adapter.fetchResponse
-        ? await adapter.fetchResponse(request, { abortSignal: signal })
-        : await fetchWithResetRetry(
-            () => fetch(request.url, {
-              method: request.method,
-              headers: request.headers,
-              body: request.body,
-              signal,
-            }),
-            { abortSignal: signal, label: "web-search-loop" },
-          );
-    } catch (e) {
-      throw new LoopError(502, `Provider unreachable: ${e instanceof Error ? e.message : String(e)}`);
+    // Per-iteration deadline: routed calls elsewhere carry connectTimeoutMs; without it a hung
+    // upstream would stall the whole loop until the client gives up.
+    const iterationSignal = deps.connectTimeoutMs
+      ? AbortSignal.any([signal, AbortSignal.timeout(deps.connectTimeoutMs)])
+      : signal;
+    const fetchOnce = async (): Promise<Response> => {
+      const request = await adapter.buildRequest(iterParsed, { headers: selectedForwardHeaders });
+      try {
+        return adapter.fetchResponse
+          ? await adapter.fetchResponse(request, { abortSignal: iterationSignal, ...(deps.connectTimeoutMs ? { timeoutMs: deps.connectTimeoutMs } : {}) })
+          : await fetchWithResetRetry(
+              () => fetch(request.url, {
+                method: request.method,
+                headers: request.headers,
+                body: request.body,
+                signal: iterationSignal,
+              }),
+              { abortSignal: iterationSignal, label: "web-search-loop" },
+            );
+      } catch (e) {
+        if (!signal.aborted && iterationSignal.aborted) {
+          throw new LoopError(504, `Provider timeout after ${deps.connectTimeoutMs}ms during web-search`);
+        }
+        throw new LoopError(502, `Provider unreachable: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    };
+    let resp = await fetchOnce();
+    // 429 key-failover parity with the normal routed path: rotate pool keys until one responds
+    // or the pool is exhausted (deps.on429 returns null — cooldown map guarantees termination).
+    while (resp.status === 429 && deps.on429) {
+      const rotated = deps.on429(resp.headers.get("retry-after"));
+      if (!rotated?.parseResponse) break;
+      try { void resp.body?.cancel(); } catch { /* already consumed */ }
+      adapter = rotated;
+      resp = await fetchOnce();
     }
     if (!resp.ok) {
       const t = await resp.text().catch(() => "");
@@ -242,7 +296,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
   // valid, and surface as ONE search cell carrying every attempted query. A real search (one that
   // hits the sidecar) shows the spinner WHILE the batch runs. Empty/limit/repeat placeholders never
   // emit a cell (matching the prior single-query behavior).
-  async function* runSearchCall(call: WebSearchCall): AsyncGenerator<AdapterEvent> {
+  async function* runSearchCall(call: WebSearchCall, precedingThinking?: OcxThinkingContent | null): AsyncGenerator<AdapterEvent> {
     const results: { query: string; outcome: SidecarOutcome }[] = [];
     let beganCell = false;
     if (call.queries.length === 0) {
@@ -279,7 +333,11 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       : { query: call.queries[0] ?? "" };
     messages.push({
       role: "assistant",
-      content: [{ type: "toolCall", id: call.id, name: WEB_SEARCH_TOOL_NAME, arguments: callArgs }],
+      content: [
+        // Signed thinking must precede tool_use on replay (Anthropic extended thinking).
+        ...(precedingThinking ? [precedingThinking] : []),
+        { type: "toolCall" as const, id: call.id, name: WEB_SEARCH_TOOL_NAME, arguments: callArgs },
+      ],
       timestamp: now,
     });
     // One aggregated tool result. isError only when EVERY query failed (a partial success is usable).
@@ -357,8 +415,10 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         yield* replay(split.passthrough);
         return;
       }
-      for (const call of split.calls) {
-        yield* runSearchCall(call);
+      // The thinking that led to the search belongs to the FIRST call's assistant replay turn.
+      const iterationThinking = extractIterationThinking(split.passthrough);
+      for (const [callIndex, call] of split.calls.entries()) {
+        yield* runSearchCall(call, callIndex === 0 ? iterationThinking : null);
       }
     }
   }