@bitkyc08/opencodex 2.6.7 → 2.6.8

package/src/adapters/google-tool-schema.ts

@@ -0,0 +1,89 @@
+type Schema = Record<string, unknown>;
+
+// Gemini / Antigravity (CCA) accept only an OpenAPI-3.0 subset for function `parameters`. Codex
+// emits full JSON-Schema (draft 2020-12) tool definitions, so passing them through verbatim makes
+// CCA reject the whole request with "Request contains an invalid argument" / "Unknown name ...".
+// Every keyword below was confirmed live against the Antigravity backend to trigger a 400.
+const DROPPED_SCHEMA_KEYS = new Set([
+  "$schema", "$id", "$comment", "$ref", "$defs", "definitions",
+  "examples", "patternProperties", "if", "then", "else",
+  "uniqueItems", "additionalItems", "unevaluatedProperties", "unevaluatedItems",
+  "dependentRequired", "dependentSchemas", "propertyNames", "contains",
+]);
+
+const MAX_DEREF_DEPTH = 64;
+
+function resolveRef(ref: string, defs: Map<string, unknown>): unknown {
+  // Only local pointers into the schema's own $defs/definitions are supported (e.g.
+  // "#/$defs/Foo"). Anything else cannot be inlined, so it collapses to an unconstrained object.
+  const match = /^#\/(?:\$defs|definitions)\/(.+)$/.exec(ref);
+  if (!match) return undefined;
+  return defs.get(decodeURIComponent(match[1].replace(/~1/g, "/").replace(/~0/g, "~")));
+}
+
+function collectDefs(root: unknown, defs: Map<string, unknown>): void {
+  if (!root || typeof root !== "object") return;
+  for (const bag of ["$defs", "definitions"] as const) {
+    const group = (root as Schema)[bag];
+    if (group && typeof group === "object" && !Array.isArray(group)) {
+      for (const [name, value] of Object.entries(group as Schema)) {
+        if (!defs.has(name)) defs.set(name, value);
+      }
+    }
+  }
+}
+
+function normalizeType(value: unknown, out: Schema): void {
+  // JSON-Schema allows `type` to be an array (e.g. ["string","null"]); OpenAPI 3.0 does not.
+  // Collapse to the first non-null type and mark the field nullable when "null" was present.
+  if (!Array.isArray(value)) {
+    out.type = value;
+    return;
+  }
+  const nonNull = value.filter(t => t !== "null");
+  if (value.includes("null")) out.nullable = true;
+  if (nonNull.length > 0) out.type = nonNull[0];
+}
+
+function sanitize(node: unknown, defs: Map<string, unknown>, depth: number): unknown {
+  if (Array.isArray(node)) return node.map(item => sanitize(item, defs, depth));
+  if (!node || typeof node !== "object") return node;
+  const input = node as Schema;
+
+  if (typeof input.$ref === "string" && depth < MAX_DEREF_DEPTH) {
+    const target = resolveRef(input.$ref, defs);
+    if (target && typeof target === "object") {
+      const merged: Schema = { ...(target as Schema) };
+      for (const [key, value] of Object.entries(input)) {
+        if (key !== "$ref") merged[key] = value;
+      }
+      return sanitize(merged, defs, depth + 1);
+    }
+  }
+
+  const out: Schema = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (DROPPED_SCHEMA_KEYS.has(key)) continue;
+    if (key === "type") { normalizeType(value, out); continue; }
+    if (key === "const") { out.enum = [value]; continue; }
+    if (key === "exclusiveMinimum" && typeof value === "number") { out.minimum = value; continue; }
+    if (key === "exclusiveMaximum" && typeof value === "number") { out.maximum = value; continue; }
+    if (key === "additionalProperties") {
+      // A boolean additionalProperties is accepted, but a nested schema is only meaningful with
+      // its own sanitize pass.
+      out.additionalProperties = typeof value === "boolean" ? value : sanitize(value, defs, depth);
+      continue;
+    }
+    out[key] = sanitize(value, defs, depth);
+  }
+  return out;
+}
+
+export function sanitizeGeminiToolParameters(parameters: unknown): Record<string, unknown> {
+  const defs = new Map<string, unknown>();
+  collectDefs(parameters, defs);
+  const result = sanitize(parameters, defs, 0);
+  return result && typeof result === "object" && !Array.isArray(result)
+    ? result as Record<string, unknown>
+    : { type: "object" };
+}

package/src/adapters/google-truncation.ts

@@ -0,0 +1,13 @@
+import { redactSecretString } from "../redact";
+
+/** Gemini/Vertex finishReason values that mean the turn was cut off, not cleanly stopped. */
+const TRUNCATION_REASONS = new Set(["MAX_TOKENS", "MALFORMED_FUNCTION_CALL"]);
+
+export function isVertexTruncationReason(finishReason: string | undefined): boolean {
+  return finishReason !== undefined && TRUNCATION_REASONS.has(finishReason);
+}
+
+export function vertexTruncationErrorMessage(reason?: string): string {
+  const suffix = reason ? ` (${redactSecretString(reason).slice(0, 160)})` : "";
+  return `Vertex AI response truncated upstream before the turn completed${suffix}`;
+}

package/src/adapters/google.ts

@@ -1,4 +1,4 @@
-import type { ProviderAdapter } from "./base";
+import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
 import { debugDroppedFrame } from "../debug";
 import type {
   AdapterEvent,
@@ -12,6 +12,31 @@ import type {
 } from "../types";
 import { isAllowedToolChoice, namespacedToolName, toolAllowedByChoice } from "../types";
 import { contentPartsToText, parseDataUrl } from "./image";
+import { getVertexAccessToken } from "../lib/gcp-adc";
+import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
+import { isVertexTruncationReason, vertexTruncationErrorMessage } from "./google-truncation";
+import { ANTIGRAVITY_REQUEST_UA, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
+import { sanitizeGeminiToolParameters } from "./google-tool-schema";
+import { antigravityUsesReplayCache, applyAntigravityReplay, clearAntigravityReplay, observeAntigravityReplay } from "./google-antigravity-replay";
+
+// Google-family models (Gemini/Vertex/Antigravity) tend to emit long running commentary between
+// tool calls. This steers them to keep the BETWEEN-STEP text to one line and reason internally
+// while still driving tools to completion. The FINAL answer is explicitly exempt so task output is
+// not truncated. Appended to systemInstruction for the `google` adapter only, so non-Google
+// providers are unaffected.
+const GOOGLE_BREVITY_INSTRUCTION = [
+  "Output style for this session:",
+  "- While you are still working (between tool calls), keep any text you emit to a single short line; do not narrate at length.",
+  "- Do detailed reasoning internally, not as visible intermediate output.",
+  "- Prefer taking the next tool action over explaining; keep calling tools until the task is complete.",
+  "- This applies only to intermediate progress text. Your final answer after the work is done is exempt: write it in full and at whatever length the task requires.",
+].join("\n");
+
+/** Vertex API key: provider.apiKey if it looks real (not a sentinel), else GOOGLE_CLOUD_API_KEY env. */
+function resolveVertexApiKey(optKey?: string): string | undefined {
+  const realKey = optKey && !optKey.startsWith("<") && optKey !== "N/A" ? optKey : undefined;
+  return realKey || process.env.GOOGLE_CLOUD_API_KEY;
+}
 
 /**
  * Inline image parts (Gemini `inline_data`) extracted from tool-result content. Only base64 data URLs
@@ -30,9 +55,8 @@ function toolResultImageParts(content: string | OcxContentPart[]): unknown[] {
 }
 
 function messagesToGeminiFormat(parsed: OcxParsedRequest): { systemInstruction?: unknown; contents: unknown[] } {
-  const systemInstruction = parsed.context.systemPrompt?.length
-    ? { parts: [{ text: parsed.context.systemPrompt.join("\n\n") }] }
-    : undefined;
+  const systemText = [...(parsed.context.systemPrompt ?? []), GOOGLE_BREVITY_INSTRUCTION].join("\n\n");
+  const systemInstruction = { parts: [{ text: systemText }] };
 
   const contents: unknown[] = [];
 
@@ -63,7 +87,14 @@ function messagesToGeminiFormat(parsed: OcxParsedRequest): { systemInstruction?:
           if (p.type === "text") parts.push({ text: (p as OcxTextContent).text });
           else if (p.type === "toolCall") {
             const tc = p as OcxToolCall;
-            parts.push({ functionCall: { name: namespacedToolName(tc.namespace, tc.name), args: tc.arguments } });
+            // Preserve the thought signature on the function-call part so Antigravity/Gemini-3
+            // reasoning continuity survives history-driven (stateless) turns, not just same-process
+            // streaming covered by the replay cache. Only forward a REAL upstream signature — the
+            // Responses parser also stashes synthetic item ids (`fc_...`) on this field, and sending
+            // those as a thoughtSignature breaks continuity (the replay cache supplies the real one).
+            const part: Record<string, unknown> = { functionCall: { name: namespacedToolName(tc.namespace, tc.name), args: tc.arguments } };
+            if (isLikelyRealThoughtSignature(tc.thoughtSignature)) part.thoughtSignature = tc.thoughtSignature;
+            parts.push(part);
           }
         }
         contents.push({ role: "model", parts });
@@ -100,7 +131,7 @@ function toolsToGeminiFormat(parsed: OcxParsedRequest): unknown[] | undefined {
     functionDeclarations: tools.map(t => ({
       name: namespacedToolName(t.namespace, t.name),
       description: t.description,
-      parameters: t.parameters,
+      parameters: sanitizeGeminiToolParameters(t.parameters),
     })),
   }];
 }
@@ -116,10 +147,23 @@ function usageFromGemini(usage: Record<string, number> | undefined): OcxUsage |
 }
 
 export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  // Per-request closure: resolveAdapter builds a fresh adapter per request (server.ts), so buildRequest
+  // can stash the CCA model/session for parseStream's reasoning-replay observation.
+  let antigravityModel: string | undefined;
+  let antigravitySession: string | undefined;
   return {
     name: "google",
 
-    buildRequest(parsed: OcxParsedRequest) {
+    // Vertex + Antigravity get Kiro-style retry/timeout + classified, redacted errors. AI-Studio
+    // Gemini keeps the default server fetch path (fetchResponse stays undefined so server.ts falls back).
+    ...(provider.googleMode === "vertex" || provider.googleMode === "cloud-code-assist"
+      ? {
+          fetchResponse: (request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response> =>
+            (provider.googleMode === "cloud-code-assist" ? fetchAntigravityWithRetry : fetchVertexWithRetry)(request, ctx),
+        }
+      : {}),
+
+    async buildRequest(parsed: OcxParsedRequest) {
       const { systemInstruction, contents } = messagesToGeminiFormat(parsed);
       const tools = toolsToGeminiFormat(parsed);
 
@@ -136,12 +180,67 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
 
       const method = parsed.stream ? "streamGenerateContent" : "generateContent";
       const streamParam = parsed.stream ? "?alt=sse" : "";
-      const url = `${provider.baseUrl}/v1beta/models/${parsed.modelId}:${method}${streamParam}`;
-
       const headers: Record<string, string> = { "Content-Type": "application/json" };
-      if (provider.apiKey) headers["x-goog-api-key"] = provider.apiKey;
       if (provider.headers) Object.assign(headers, provider.headers);
 
+      if (provider.googleMode === "cloud-code-assist") {
+        // Google Antigravity (Cloud Code Assist): wrap the flat Gemini body in the CCA envelope.
+        const base = provider.baseUrl || "https://daily-cloudcode-pa.googleapis.com";
+        const url = `${base}/v1internal:${method}${streamParam}`;
+        const project = provider.project;
+        if (!project) throw new Error("Antigravity requires a discovered Cloud Code Assist project id (re-run `ocx login google-antigravity`).");
+        const sessionId = antigravitySessionId(parsed);
+        antigravityModel = parsed.modelId;
+        antigravitySession = sessionId;
+        // Reasoning continuity: Gemini models re-inject cached thoughtSignatures; Claude-on-Antigravity
+        // sanitizes signatures inline (no cache). Both guard against the upstream 400 on bad signatures.
+        if (Array.isArray((body as { contents?: unknown[] }).contents)) {
+          const contents = (body as { contents: unknown[] }).contents;
+          if (antigravityUsesReplayCache(parsed.modelId)) {
+            applyAntigravityReplay(parsed.modelId, sessionId, contents);
+          } else {
+            sanitizeAntigravityClaudeSignatures(contents);
+          }
+        }
+        // The CCA client serializes `session_id` (snake_case); send both spellings so the
+        // deterministic session id is honored regardless of which the backend accepts.
+        const request: Record<string, unknown> = { ...body, sessionId, session_id: sessionId };
+        const envelope = {
+          model: parsed.modelId,
+          userAgent: ANTIGRAVITY_REQUEST_UA,
+          requestType: "agent",
+          project,
+          requestId: `agent-${crypto.randomUUID()}`,
+          request,
+        };
+        headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
+        if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
+        return { url, method: "POST", headers, body: JSON.stringify(envelope) };
+      }
+
+      if (provider.googleMode === "vertex") {
+        // Vertex AI: project/location endpoint with GCP ADC, or x-goog-api-key fast path.
+        const apiKey = resolveVertexApiKey(provider.apiKey);
+        if (apiKey) {
+          const url = `https://aiplatform.googleapis.com/v1/publishers/google/models/${parsed.modelId}:${method}${streamParam}`;
+          headers["x-goog-api-key"] = apiKey;
+          return { url, method: "POST", headers, body: JSON.stringify(body) };
+        }
+        const project = provider.project || process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT;
+        if (!project) throw new Error("Vertex AI requires a project id (provider.project or GOOGLE_CLOUD_PROJECT/GCLOUD_PROJECT).");
+        const location = provider.location || process.env.GOOGLE_CLOUD_LOCATION;
+        if (!location) throw new Error("Vertex AI requires a location (provider.location or GOOGLE_CLOUD_LOCATION).");
+        const host = location === "global" ? "aiplatform.googleapis.com" : `${location}-aiplatform.googleapis.com`;
+        const url = `https://${host}/v1/projects/${project}/locations/${location}/publishers/google/models/${parsed.modelId}:${method}${streamParam}`;
+        const token = await getVertexAccessToken();
+        headers["Authorization"] = `Bearer ${token}`;
+        return { url, method: "POST", headers, body: JSON.stringify(body) };
+      }
+
+      // ai-studio (default): Generative Language API + x-goog-api-key.
+      const url = `${provider.baseUrl}/v1beta/models/${parsed.modelId}:${method}${streamParam}`;
+      if (provider.apiKey) headers["x-goog-api-key"] = provider.apiKey;
+
       return { url, method: "POST", headers, body: JSON.stringify(body) };
     },
 
@@ -155,6 +254,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       const decoder = new TextDecoder();
       let buffer = "";
       let pendingUsage: OcxUsage | undefined;
+      let toolCallsStarted = 0;
+      let lastFinishReason: string | undefined;
 
       try {
         while (true) {
@@ -176,14 +277,38 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
             // Inline provider error inside a 200 stream → terminal error (see openai-chat.ts).
             if (chunk.error) {
               const err = chunk.error as { message?: string } | undefined;
+              // Clear-on-invalid: a signature rejection means our replayed thoughtSignatures are stale.
+              // Drop the cache entry so the next turn starts clean instead of re-injecting a bad sig.
+              if (provider.googleMode === "cloud-code-assist" && antigravityModel && antigravitySession
+                && /signature|invalid_argument|invalid argument/i.test(err?.message ?? "")) {
+                clearAntigravityReplay(antigravityModel, antigravitySession);
+              }
               yield { type: "error", message: err?.message ?? "upstream error" };
               return;
             }
 
-            const candidates = chunk.candidates as { content?: { parts?: unknown[] }; finishReason?: string }[] | undefined;
+            // Antigravity (CCA) nests the standard Gemini payload under `response`.
+            const root = (provider.googleMode === "cloud-code-assist"
+              ? (chunk.response as Record<string, unknown> | undefined) ?? chunk
+              : chunk);
+            // usageMetadata is a top-level field independent of candidates; read it BEFORE the
+            // candidates guard so a usage-only final chunk is not dropped.
+            const usageMeta = root.usageMetadata as Record<string, number> | undefined;
+            if (usageMeta) {
+              // Accumulate usage; emit a single terminal `done` post-loop so usage is never
+              // dropped on EOF and the stream never yields two `done` events.
+              pendingUsage = usageFromGemini(usageMeta);
+            }
+            const candidates = root.candidates as { content?: { parts?: unknown[] }; finishReason?: string }[] | undefined;
             if (!candidates?.length) continue;
 
+            lastFinishReason = candidates[0].finishReason ?? lastFinishReason;
+
             const parts = candidates[0].content?.parts as { text?: string; functionCall?: { name: string; args: unknown } }[] | undefined;
+            // Antigravity reasoning-replay: record thoughtSignatures from the model parts for the next turn.
+            if (provider.googleMode === "cloud-code-assist" && parts && antigravityModel && antigravitySession) {
+              observeAntigravityReplay(antigravityModel, antigravitySession, parts as unknown[]);
+            }
             if (parts) {
               for (const part of parts) {
                 if (part.text) {
@@ -191,21 +316,22 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
                 }
                 if (part.functionCall) {
                   const id = `call_${crypto.randomUUID().slice(0, 8)}`;
+                  toolCallsStarted++;
                   yield { type: "tool_call_start", id, name: part.functionCall.name };
                   yield { type: "tool_call_delta", arguments: JSON.stringify(part.functionCall.args ?? {}) };
                   yield { type: "tool_call_end" };
                 }
               }
             }
-
-            const usageMeta = chunk.usageMetadata as Record<string, number> | undefined;
-            if (usageMeta) {
-              // Accumulate usage; emit a single terminal `done` post-loop so usage is never
-              // dropped on EOF and the stream never yields two `done` events.
-              pendingUsage = usageFromGemini(usageMeta);
-            }
           }
         }
+        // Fail-closed: a turn cut off mid tool call (MAX_TOKENS / MALFORMED_FUNCTION_CALL) surfaces
+        // an error instead of a silently-incomplete done. Mirrors kiro-truncation.
+        if ((provider.googleMode === "vertex" || provider.googleMode === "cloud-code-assist")
+          && toolCallsStarted > 0 && isVertexTruncationReason(lastFinishReason)) {
+          yield { type: "error", message: vertexTruncationErrorMessage(lastFinishReason) };
+          return;
+        }
         yield { type: "done", usage: pendingUsage };
       } finally {
         reader.releaseLock();
@@ -213,15 +339,25 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
     },
 
     async parseResponse(response: Response): Promise<AdapterEvent[]> {
-      const json = await response.json() as Record<string, unknown>;
+      const raw = await response.json() as Record<string, unknown>;
+      // Antigravity (CCA) nests the standard Gemini payload under `response`; unwrap it.
+      const json = (provider.googleMode === "cloud-code-assist"
+        ? (raw.response as Record<string, unknown> | undefined) ?? raw
+        : raw);
       const events: AdapterEvent[] = [];
 
-      const candidates = json.candidates as { content?: { parts?: { text?: string; functionCall?: { name: string; args: unknown } }[] } }[] | undefined;
+      const candidates = json.candidates as { content?: { parts?: { text?: string; functionCall?: { name: string; args: unknown } }[] }; finishReason?: string }[] | undefined;
+      let toolCallsStarted = 0;
       if (candidates?.[0]?.content?.parts) {
+        // Non-streaming CCA: observe thoughtSignatures for the next turn, same as the stream path.
+        if (provider.googleMode === "cloud-code-assist" && antigravityModel && antigravitySession) {
+          observeAntigravityReplay(antigravityModel, antigravitySession, candidates[0].content.parts as unknown[]);
+        }
         for (const part of candidates[0].content.parts) {
           if (part.text) events.push({ type: "text_delta", text: part.text });
           if (part.functionCall) {
             const id = `call_${crypto.randomUUID().slice(0, 8)}`;
+            toolCallsStarted++;
             events.push({ type: "tool_call_start", id, name: part.functionCall.name });
             events.push({ type: "tool_call_delta", arguments: JSON.stringify(part.functionCall.args ?? {}) });
             events.push({ type: "tool_call_end" });
@@ -229,6 +365,13 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         }
       }
 
+      // Fail-closed truncation, same as the stream path: a non-stream turn cut off mid tool call
+      // (MAX_TOKENS / MALFORMED_FUNCTION_CALL) surfaces an error instead of a silent done.
+      if ((provider.googleMode === "vertex" || provider.googleMode === "cloud-code-assist")
+        && toolCallsStarted > 0 && isVertexTruncationReason(candidates?.[0]?.finishReason)) {
+        return [{ type: "error", message: vertexTruncationErrorMessage(candidates?.[0]?.finishReason) }];
+      }
+
       const usage = json.usageMetadata as Record<string, number> | undefined;
       events.push({
         type: "done",

package/src/adapters/kiro-tools.ts

@@ -3,14 +3,67 @@ import { namespacedToolName } from "../types";
 
 const MAX_KIRO_TOOL_DESCRIPTION = 1024;
 
+// JSON Schema validation/annotation keywords that Kiro's runtimeservice tool-spec validator
+// rejects ("ValidationException: Invalid tool use format."). Codex's built-in tools omit these,
+// but the `memories__*` tools (add_ad_hoc_note/read/search/list) emit pattern/length/range
+// constraints via schemars, which trip the validator. Strip them everywhere in the schema tree;
+// the constraints are advisory for the model, so dropping them does not change tool behavior.
+const KIRO_REJECTED_SCHEMA_KEYS = new Set([
+  "additionalProperties",
+  "pattern",
+  "format",
+  "minLength",
+  "maxLength",
+  "minimum",
+  "maximum",
+  "exclusiveMinimum",
+  "exclusiveMaximum",
+  "multipleOf",
+  "minItems",
+  "maxItems",
+  "uniqueItems",
+  "minProperties",
+  "maxProperties",
+  "contentEncoding",
+  "contentMediaType",
+  "$schema",
+  // Validation-only composition/applicator keywords that Bedrock/Kiro do not support. Unlike
+  // `properties`/`$defs`, these are not plain property->schema maps the model needs, so they are
+  // dropped outright rather than recursed into.
+  "patternProperties",
+  "propertyNames",
+  "dependentSchemas",
+  "dependentRequired",
+  "if",
+  "then",
+  "else",
+  "contains",
+  "unevaluatedProperties",
+  "unevaluatedItems",
+]);
+
+// Keys whose values are maps of *property/definition name -> schema* (not schema keywords). Their
+// child keys must never be treated as schema keywords, or a legitimate property named e.g.
+// "format"/"pattern" would be deleted. We recurse into the value schemas but keep every name intact.
+const SCHEMA_MAP_KEYS = new Set(["properties", "$defs", "definitions"]);
+
+function sanitizeSchemaMap(value: unknown): unknown {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return sanitizeKiroSchema(value);
+  const out: Record<string, unknown> = {};
+  for (const [name, child] of Object.entries(value as Record<string, unknown>)) {
+    out[name] = sanitizeKiroSchema(child);
+  }
+  return out;
+}
+
 function sanitizeKiroSchema(value: unknown): unknown {
   if (Array.isArray(value)) return value.map(sanitizeKiroSchema);
   if (!value || typeof value !== "object") return value;
   const out: Record<string, unknown> = {};
   for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
-    if (key === "additionalProperties") continue;
+    if (KIRO_REJECTED_SCHEMA_KEYS.has(key)) continue;
     if (key === "required" && Array.isArray(child) && child.length === 0) continue;
-    out[key] = sanitizeKiroSchema(child);
+    out[key] = SCHEMA_MAP_KEYS.has(key) ? sanitizeSchemaMap(child) : sanitizeKiroSchema(child);
   }
   return out;
 }

package/src/cli-status.ts

@@ -1,5 +1,6 @@
 import { durableBunRuntime } from "./bun-runtime";
 import { codexAutoStartEnabled, getConfigPath, getPidPath, readConfigDiagnostics, readPid, readRuntimePort, type RuntimePortState } from "./config";
+import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "./codex-plugins-doctor";
 import type { OcxConfig } from "./types";
 import { serviceStatusSummary } from "./service";
 
@@ -44,6 +45,7 @@ export type CliStatusJson = {
   };
   service: { summary: string };
   codexShim: { summary: string };
+  codexPlugins: CodexPluginsDiagnostic;
 };
 
 export type CliStatusView = {
@@ -114,6 +116,7 @@ export async function collectStatus(): Promise<CliStatusView> {
   const serviceSummary = serviceStatusSummary();
   const { codexShimStatus } = await import("./codex-shim");
   const codexShimSummary = codexShimStatus();
+  const codexPlugins = diagnoseCodexBundledPlugins();
   const proxyLabel = pid && health.ok
     ? `running (PID ${pid})`
     : pid
@@ -159,6 +162,7 @@ export async function collectStatus(): Promise<CliStatusView> {
       },
       service: { summary: serviceSummary },
       codexShim: { summary: codexShimSummary },
+      codexPlugins,
     },
   };
 }

package/src/cli.ts

@@ -348,6 +348,13 @@ async function handleStatus() {
   console.log(`   Codex autostart: ${status.json.codexAutostart ? "enabled" : "disabled"}`);
   console.log(`   Service: ${status.json.service.summary}`);
   console.log(`   ${status.json.codexShim.summary}`);
+  if (status.json.codexPlugins.applicable) {
+    const icon = status.json.codexPlugins.stale ? "⚠️ " : "✅";
+    console.log(`   ${icon} Codex bundled plugins: ${status.json.codexPlugins.summary}`);
+    if (status.json.codexPlugins.suggestedRepair) {
+      console.log(`      Suggested: ${status.json.codexPlugins.suggestedRepair}`);
+    }
+  }
 }
 
 function handleRecoverHistory() {