@bitkyc08/opencodex 2.63.0-preview.20260923 → 2.64.0-preview.20260923

package/src/adapters/openai-chat/tool-schema.ts

@@ -198,6 +198,37 @@ const MOONSHOT_MAX_REF_EXPANSIONS = 512;
  */
 const MOONSHOT_MAX_SCHEMA_DEPTH = 64;
 const MOONSHOT_MAX_SCHEMA_NODES = 4_096;
+const MOONSHOT_MAX_INLINED_SCHEMA_BYTES = 1024 * 1024;
+
+/**
+ * Measure only as far as the caller's remaining allowance. Keeping this iterative avoids
+ * reintroducing the deep-schema stack exhaustion that the normalizer's depth limit prevents.
+ */
+function serializedJsonBytesUpTo(value: unknown, limit: number): number {
+  const encoder = new TextEncoder();
+  const pending: unknown[] = [value];
+  let bytes = 0;
+  while (pending.length > 0 && bytes <= limit) {
+    const item = pending.pop();
+    if (Array.isArray(item)) {
+      bytes += 2 + Math.max(0, item.length - 1);
+      for (const child of item) pending.push(child);
+      continue;
+    }
+    if (isXaiObjectSchema(item)) {
+      const entries = Object.entries(item);
+      bytes += 2 + Math.max(0, entries.length - 1);
+      for (const [key, child] of entries) {
+        bytes += encoder.encode(JSON.stringify(key)).byteLength + 1;
+        pending.push(child);
+      }
+      continue;
+    }
+    const encoded = JSON.stringify(item);
+    bytes += encoder.encode(encoded === undefined ? "null" : encoded).byteLength;
+  }
+  return bytes;
+}
 
 /**
  * Assertion keywords whose meaning under a `$ref` is CONJUNCTION, not replacement. A node
@@ -309,8 +340,19 @@ function composeProperties(
   return combined;
 }
 
+/**
+ * The inline-byte allowance for one request. Sharing it across tools matters: a per-tool
+ * budget would let a large catalog multiply the cap by its tool count, reintroducing the
+ * request amplification this bound exists to prevent.
+ */
+interface MoonshotInlineByteBudget {
+  remaining: number;
+}
+
 interface MoonshotNormalizeState {
   activeRefs: Set<string>;
+  inlineSizeCache: WeakMap<Record<string, unknown>, number>;
+  inlineByteBudget: MoonshotInlineByteBudget;
   remainingExpansions: number;
   remainingNodes: number;
 }
@@ -342,10 +384,37 @@ function normalizeMoonshotSchemaNode(
 
     const target = lookupLocalJsonPointer(root, ref);
     if (isXaiObjectSchema(target)) {
+      // Charge the referenced value before copying it. Object/node counts do not cover large
+      // maps of boolean schemas, which otherwise allow a small input to create hundreds of
+      // full copies before the final request is serialized.
+      let inlineBytes = state.inlineSizeCache.get(target);
+      if (inlineBytes === undefined) {
+        inlineBytes = serializedJsonBytesUpTo(target, MOONSHOT_MAX_INLINED_SCHEMA_BYTES);
+        state.inlineSizeCache.set(target, inlineBytes);
+      }
+      if (inlineBytes > state.inlineByteBudget.remaining) return { $ref: ref };
+      const bytesBefore = state.inlineByteBudget.remaining;
+      const expansionsBefore = state.remainingExpansions;
+      const nodesBefore = state.remainingNodes;
+      state.inlineByteBudget.remaining -= inlineBytes;
       state.remainingExpansions -= 1;
       state.activeRefs.add(ref);
       const resolvedTarget = normalizeMoonshotSchemaNode(target, root, state, depth + 1);
       state.activeRefs.delete(ref);
+      // Nested copies have already spent from the shared allowance. Charge only
+      // growth that their own charges do not cover.
+      const nestedCharges = bytesBefore - inlineBytes - state.inlineByteBudget.remaining;
+      const normalizedBytes = serializedJsonBytesUpTo(
+        resolvedTarget, bytesBefore,
+      );
+      const growthBytes = Math.max(0, normalizedBytes - inlineBytes - nestedCharges);
+      if (growthBytes > state.inlineByteBudget.remaining) {
+        state.inlineByteBudget.remaining = bytesBefore;
+        state.remainingExpansions = expansionsBefore;
+        state.remainingNodes = nodesBefore;
+        return { $ref: ref };
+      }
+      state.inlineByteBudget.remaining -= growthBytes;
       const merged: Record<string, unknown> = Object.create(null) as Record<string, unknown>;
       if (isXaiObjectSchema(resolvedTarget)) {
         for (const [key, value] of Object.entries(resolvedTarget)) merged[key] = value;
@@ -380,6 +449,20 @@ function normalizeMoonshotSchemaNode(
         }
         merged[key] = normalized;
       }
+
+      // Re-normalize only composed properties that retain a $ref alongside sibling keywords
+      if (isXaiObjectSchema(merged.properties)) {
+        for (const [propName, propVal] of Object.entries(merged.properties as Record<string, unknown>)) {
+          if (isXaiObjectSchema(propVal) && typeof propVal.$ref === "string" && moonshotRefTargetKeys(propVal).length > 0) {
+            (merged.properties as Record<string, unknown>)[propName] = normalizeMoonshotSchemaNode(
+              propVal,
+              root,
+              state,
+              depth + 1,
+            );
+          }
+        }
+      }
       return merged;
     }
 
@@ -397,13 +480,49 @@ function normalizeMoonshotSchemaNode(
       ? value
       : normalizeMoonshotSchemaNode(value, root, state, depth + 1);
   }
+
+  // Moonshot MFJS requirements:
+  // 1. Stamp "object" if properties are present, or if allOf defines object properties/variants,
+  //    so Moonshot's validator recognizes the schema as a valid termination condition.
+  // 2. Infer scalar types for bare const and enum keywords.
+  if (out.type === undefined) {
+    const isObjectAllOf = Array.isArray(out.allOf) && out.allOf.some(
+      variant => isXaiObjectSchema(variant) && (
+        variant.type === "object" ||
+        variant.properties !== undefined ||
+        variant.additionalProperties !== undefined
+      ),
+    );
+    if (out.properties !== undefined || out.additionalProperties !== undefined || isObjectAllOf) {
+      out.type = "object";
+    } else if (out.const !== undefined) {
+      const t = typeof out.const;
+      if (t === "string" || t === "number" || t === "boolean") {
+        out.type = t;
+      }
+    } else if (Array.isArray(out.enum) && out.enum.length > 0) {
+      if (out.enum.every(x => typeof x === "string")) {
+        out.type = "string";
+      } else if (out.enum.every(x => typeof x === "number")) {
+        out.type = "number";
+      } else if (out.enum.every(x => typeof x === "boolean")) {
+        out.type = "boolean";
+      }
+    }
+  }
+
   return out;
 }
 
-function normalizeMoonshotToolParameters(parameters: unknown): Record<string, unknown> {
+function normalizeMoonshotToolParameters(
+  parameters: unknown,
+  inlineByteBudget: MoonshotInlineByteBudget,
+): Record<string, unknown> {
   const rooted = ensureRootObjectType(parameters);
   const normalized = normalizeMoonshotSchemaNode(rooted, rooted, {
     activeRefs: new Set<string>(),
+    inlineSizeCache: new WeakMap<Record<string, unknown>, number>(),
+    inlineByteBudget,
     remainingExpansions: MOONSHOT_MAX_REF_EXPANSIONS,
     remainingNodes: MOONSHOT_MAX_SCHEMA_NODES,
   });
@@ -420,11 +539,14 @@ export function toolsToChatFormat(
   if (tools.length === 0) return undefined;
   const xaiTarget = isXaiSchemaTarget(provider);
   const moonshotTarget = !xaiTarget && isMoonshotSchemaTarget(provider);
+  const moonshotInlineByteBudget: MoonshotInlineByteBudget = {
+    remaining: MOONSHOT_MAX_INLINED_SCHEMA_BYTES,
+  };
   const formatted = tools.flatMap(t => {
     const normalized = xaiTarget
       ? normalizeXaiToolParameters(t.parameters)
       : moonshotTarget
-        ? normalizeMoonshotToolParameters(t.parameters)
+        ? normalizeMoonshotToolParameters(t.parameters, moonshotInlineByteBudget)
         : ensureRootObjectType(t.parameters);
     const parameters = stripUnicodePropertyPatterns(stripResponsesOnlyEncryptedMarker(normalized));
 

package/src/adapters/openai-chat.ts

@@ -4,6 +4,7 @@ import { applyExplicitChatReasoningWirePolicy } from "./openai-chat/reasoning-wi
 import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "./base";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../types";
 import { modelInList } from "../types";
+import { createInlineThinkContentSplitter, splitInlineThinkContent } from "./inline-think-tags";
 import { mapReasoningEffort, modelRecordValue } from "../reasoning-effort";
 import { debugProviderDiagnostic } from "../lib/debug";
 import { sseFieldValue } from "../lib/sse-decoder";
@@ -355,6 +356,12 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       // Gate on the routed model, not list length: a mixed openai-chat provider
       // can list MiniMax ids without putting every sibling on MiniMax semantics.
       const reasoningDetailsOptIn = modelInList(provider.reasoningDetailsModels, lastRequestedModelId ?? "");
+      // A gateway with no server-side reasoning parser leaves thinking inline in `content` as
+      // <think> blocks, which would otherwise render as the answer. Passthrough unless opted in.
+      const inlineThink = createInlineThinkContentSplitter(provider.inlineThinkTagModels, lastRequestedModelId, budget);
+      const emitContent = function* (events: AdapterEvent[]): Generator<AdapterEvent> {
+        for (const event of events) { if (event.type === "text_delta") sawUserFacingOutput = true; yield event; }
+      };
 
       const handleDataLine = function* (line: string): Generator<AdapterEvent, "continue" | "terminate"> {
         const rawPayload = sseFieldValue(line, "data");
@@ -362,6 +369,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         const payload = rawPayload.trim();
         if (payload.length === 0) return "continue";
         if (payload === "[DONE]") {
+          yield* emitContent(inlineThink.flush());
           if ((yield* flushToolCalls()) === "terminate") return "terminate";
           const stopReason = stopReasonFor(finishReason);
           yield { type: "done", usage: pendingUsage, ...(stopReason ? { stopReason } : {}) };
@@ -422,8 +430,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
             if (reasoningText !== undefined) yield { type: "reasoning_raw_delta", text: reasoningText };
           }
           if (typeof delta.content === "string" && delta.content.length > 0) {
-            sawUserFacingOutput = true;
-            yield { type: "text_delta", text: delta.content };
+            yield* emitContent(inlineThink.feed(delta.content));
           }
 
           const rawToolCalls = delta.tool_calls;
@@ -562,6 +569,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         }
 
         if (typeof choice.finish_reason === "string" && choice.finish_reason) {
+          yield* emitContent(inlineThink.flush());
           if ((yield* flushToolCalls()) === "terminate") return "terminate";
         }
         return "continue";
@@ -605,6 +613,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         if (buffer.length > 0) {
           if ((yield* handleDataLine(buffer)) === "terminate") return;
         }
+        yield* emitContent(inlineThink.flush());
         const sawFinish = finishReason !== undefined;
         if (!sawFinish && pendingToolCalls.length > 0) {
           // Some OpenAI-compatible gateways close immediately after a complete function-call
@@ -652,6 +661,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       } finally {
         budget.releaseRetained(bufferBytes, { kind: "live_transient" });
         reasoningDetailTracker.release();
+        inlineThink.dispose();
         closeToolCalls();
         reader.releaseLock();
       }
@@ -738,7 +748,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
           if (segments.length > 0) reasoningText = segments.map(s => s.text).join("");
         }
         if (reasoningText !== undefined) events.push({ type: "reasoning_raw_delta", text: reasoningText });
-        if (typeof msg.content === "string") events.push({ type: "text_delta", text: msg.content });
+        if (typeof msg.content === "string") events.push(...splitInlineThinkContent(provider.inlineThinkTagModels, lastRequestedModelId, budget, msg.content));
         const rawToolCalls = msg.tool_calls;
         if (rawToolCalls !== undefined && rawToolCalls !== null) {
           if (!Array.isArray(rawToolCalls)) {

package/src/adapters/openai-responses/passthrough.ts

@@ -15,7 +15,7 @@ import {
   isOpenAiOperatedResponsesDestination,
 } from "../../providers/openai-tiers";
 import type { TranslatorBudget } from "../../lib/translator-budget";
-import { rewriteRoutedCustomToolsForUpstream } from "../../responses/custom-tool-compat";
+import { rewriteRoutedCustomToolsForUpstream, validateFinalCustomToolCompatibility } from "../../responses/custom-tool-compat";
 import { rewriteRoutedToolSearchForUpstream } from "../../responses/tool-search-compat";
 import { rewriteRoutedNamespaceToolsForUpstream } from "../../responses/namespace-tool-compat";
 import { repairLegacyDottedToolCallNames } from "../../responses/legacy-dotted-tool-name-repair";
@@ -295,7 +295,15 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       }
       const synthesizeMissingCallOutputs = !forward && (stateless || pairedToolResults);
       if (forward || stateless || pairedToolResults) {
-        outBody = repairOrphanedInputItems(outBody, unexpandedMiss, synthesizeMissingCallOutputs);
+        // A stateful destination can resolve an output-only delta against the call stored behind
+        // an unexpanded previous_response_id. All other shapes have no hidden call to preserve.
+        const repairOrphanOutputs = forward || stateless || !unexpandedMiss;
+        outBody = repairOrphanedInputItems(
+          outBody,
+          unexpandedMiss,
+          synthesizeMissingCallOutputs,
+          repairOrphanOutputs,
+        );
       }
       if (provider.dropResponsesReasoningItems === true) {
         outBody = dropResponsesReasoningInputItems(outBody);
@@ -450,11 +458,13 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
                   preserveRawReasoningContent: provider.preserveResponsesReasoningContent === true,
                   dropNullContentChannel: !isOpenAiOperatedResponsesDestination(provider),
                   stripEncryptedContent: threadServingIdentityChanged || requiresPlaintextReasoningReplay(provider),
+                  dropForeignItemId: parsed._dropForeignReasoningItemIds === true,
                 },
               ),
               provider,
             ),
           ),
+          isXaiResponsesDestination(provider),
         ),
         isXaiSchemaTarget(provider),
       );
@@ -503,6 +513,9 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       // HTTP and the WebSocket outbound, because the WS path transports this same request
       // instead of rebuilding it.
       observeOutbound(parsed._rawBody, finalBody, headers);
+      if (!isCanonicalOpenAiForwardProvider(provider)) {
+        validateFinalCustomToolCompatibility(finalBody, provider.supportsResponsesCustomTools);
+      }
       const body = JSON.stringify(finalBody);
       const releaseBodyObservation = translatorBudget.observeExternallyCapped(
         "passthrough_serialization",

package/src/adapters/openai-responses/reasoning.ts

@@ -35,6 +35,11 @@ export function sanitizeReasoningInputContent(
     preserveRawReasoningContent?: boolean;
     dropNullContentChannel?: boolean;
     stripEncryptedContent?: boolean;
+    /**
+     * Remove `id` from every reasoning item, with or without a blob, because the ids name items in a
+     * store this destination cannot read; see `OcxParsedRequest._dropForeignReasoningItemIds`.
+     */
+    dropForeignItemId?: boolean;
   },
 ): unknown {
   if (!body || typeof body !== "object" || Array.isArray(body)) return body;
@@ -55,6 +60,10 @@ export function sanitizeReasoningInputContent(
     const missingSummary = !Object.prototype.hasOwnProperty.call(rec, "summary");
     const stripEncryptedContent = hasOcxEnvelope
       || (opts?.stripEncryptedContent === true && hasEncryptedContent);
+    // An id-only item is as foreign as one with a blob: a stateful destination still resolves it
+    // against its own store.
+    const dropItemId = opts?.dropForeignItemId === true
+      && Object.prototype.hasOwnProperty.call(rec, "id");
     // Codex serializes an absent reasoning content channel as `"content": null`. The field is
     // optional and null carries nothing, but a strict gateway rejects the item on its declared type
     // — xAI answers `Could not decode the compaction blob`, naming the sibling `encrypted_content`
@@ -76,7 +85,10 @@ export function sanitizeReasoningInputContent(
     const blankContent = !dropNullContentChannel
       && !opts?.preserveRawReasoningContent
       && (hasRawContent || hasOcxEnvelope);
-    if (!blankContent && !stripOutputStatus && !stripEncryptedContent && !dropNullContentChannel && !missingSummary) {
+    if (
+      !blankContent && !stripOutputStatus && !stripEncryptedContent && !dropNullContentChannel
+      && !missingSummary && !dropItemId
+    ) {
       return item;
     }
     changed = true;
@@ -85,6 +97,7 @@ export function sanitizeReasoningInputContent(
     if (dropNullContentChannel) delete next.content;
     if (stripOutputStatus) delete next.status;
     if (stripEncryptedContent) delete next.encrypted_content;
+    if (dropItemId) delete next.id;
     // Routed models can produce raw `reasoning_text` output items. Codex echoes those in later
     // native GPT requests, but ChatGPT's Responses backend accepts reasoning input only with empty
     // `content`; keep summaries/ids and drop the raw content so native passthrough does not 400.

package/src/adapters/openai-responses/request-strips.ts

@@ -1,4 +1,6 @@
+import { createHash } from "node:crypto";
 import { COMPACT_PROMPT, compactionItemToText, decodeCompactionSummary, isCompactionItemType } from "../../responses/compaction";
+import { debugProviderDiagnostic } from "../../lib/debug";
 import { isPlainObject } from "./internal";
 import { activateDeferredTool } from "./tool-schema";
 import { stripOpenAiOnlyWebSearchFields } from "./web-search";
@@ -169,13 +171,37 @@ export function stripCanonicalOnlyTopLevelFields(body: unknown): unknown {
  * exist, producing a 404. Strip all item IDs in this case — `call_id` pairing is unaffected.
  * Matches codex-rs behavior (core/src/client.rs:918-925).
  */
-export function stripItemIdsWhenUnstored(body: unknown): unknown {
-  if (!isPlainObject(body) || body.store !== false) return body;
+export function stripItemIdsWhenUnstored(body: unknown, requireCustomCallIds = false): unknown {
+  const repairCustomCallIds = requireCustomCallIds === true;
+  if (!isPlainObject(body) || (body.store !== false && !repairCustomCallIds)) return body;
   if (!Array.isArray(body.input)) return body;
 
   let changed = false;
   const input = body.input.map(item => {
-    if (!isPlainObject(item) || !("id" in item)) return item;
+    if (!isPlainObject(item)) return item;
+    if (repairCustomCallIds && item.type === "custom_tool_call") {
+      try {
+        if (typeof item.id === "string" && item.id.startsWith("ctc_")) return item;
+        if (
+          typeof item.call_id !== "string"
+          || typeof item.name !== "string"
+          || typeof item.input !== "string"
+        ) return item;
+        const digest = createHash("sha256")
+          .update(JSON.stringify([item.call_id, item.name, item.input]))
+          .digest("hex")
+          .slice(0, 40);
+        changed = true;
+        debugProviderDiagnostic("openai-responses", "xai-custom-tool-call-id-repaired", {
+          hadId: typeof item.id === "string",
+        });
+        return { ...item, id: `ctc_${digest}` };
+      } catch {
+        debugProviderDiagnostic("openai-responses", "xai-custom-tool-call-id-unrepaired", {});
+        return item;
+      }
+    }
+    if (body.store !== false || !("id" in item)) return item;
     changed = true;
     const next = { ...item };
     delete next.id;

package/src/adapters/openai-responses/tool-output-recovery.ts

@@ -194,7 +194,8 @@ export function repairUnidentifiedToolOutputItems(body: unknown): unknown {
  *   reasoning-bearing assistant turn (#1477). Gated on
  *   `synthesizeMissingCallOutputs` (stateless AND non-forward wires); forward replay keeps
  *   fail-closed behavior.
- * - `function_call_output`/`custom_tool_call_output` without their paired call item
+ * - `function_call_output`/`custom_tool_call_output` without their paired call item, when
+ *   `repairOrphanOutputs` is enabled
  *   ("No tool call found for function call output with call_id ..."). Converted to user
  *   messages so the result text survives. `function_call_output` also pairs with
  *   `local_shell_call` (codex-rs emits shell outputs as function_call_output).
@@ -342,7 +343,12 @@ export function restoreBridgedWebSearchCalls(body: unknown, destinationScope: st
   return changed ? { ...body, input: restored } : body;
 }
 
-export function repairOrphanedInputItems(body: unknown, dropReasoning: boolean, synthesizeMissingCallOutputs = false): unknown {
+export function repairOrphanedInputItems(
+  body: unknown,
+  dropReasoning: boolean,
+  synthesizeMissingCallOutputs = false,
+  repairOrphanOutputs = true,
+): unknown {
   if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
   const input = body.input;
 
@@ -381,7 +387,7 @@ export function repairOrphanedInputItems(body: unknown, dropReasoning: boolean,
       // incomplete. With no call id and no output, preserve the invalid item so validation fails
       // closed rather than pretending any tool result exists.
       const knownNullOutput = callId.length > 0 && item.output == null;
-      if (!paired && (knownNullOutput || usableOutput)) {
+      if (repairOrphanOutputs && !paired && (knownNullOutput || usableOutput)) {
         changed = true;
         repaired.push({
           type: "message",

package/src/adapters/qoder/adapter.ts

@@ -8,8 +8,10 @@ import { QoderScaffoldFilter, QODER_SCAFFOLD_ERROR_CODE, qoderScaffoldErrorMessa
 
 export type QoderAdapterDeps = CodingAgentDeps;
 
-export function buildQoderChildEnv(profile: QoderProfile, apiKey: string): Record<string, string> {
-  return { ...baseScopedEnv(), NO_COLOR: "1", [profile.tokenEnv]: apiKey };
+export function buildQoderChildEnv(profile: QoderProfile, apiKey: string, systemPrompt?: string): Record<string, string> {
+  const promptEnv = profile.region === "cn" ? "QODERCN_APPEND_SYSTEM_PROMPT" : "QODER_APPEND_SYSTEM_PROMPT";
+  return { ...baseScopedEnv(), NO_COLOR: "1", [profile.tokenEnv]: apiKey,
+    ...(systemPrompt ? { [promptEnv]: systemPrompt } : {}) };
 }
 
 /** Single-shot, tools-disabled Qoder CLI invocation; Codex remains the tool owner. */
@@ -27,8 +29,6 @@ export function buildQoderArgs(parsed: OcxParsedRequest, provider: OcxProviderCo
   ];
   const effort = mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning);
   if (effort) args.push("--reasoning-effort", effort);
-  const system = buildSystemPrompt(parsed);
-  if (system) args.push("--append-system-prompt", system);
   return args;
 }
 
@@ -123,15 +123,18 @@ export function createQoderAdapter(provider: OcxProviderConfig, deps: QoderAdapt
         });
         return;
       }
+      // Qoder documents QODER_APPEND_SYSTEM_PROMPT for scoped child configuration.
+      // Keep the folded prompt out of argv and never inherit an ambient vendor prompt.
+      const system = buildSystemPrompt(parsed);
       await runCodingAgentTurn({
-        profiles: QODER_PROFILES,
-        provider,
-        parsed,
-        incoming,
-        emit: guardQoderScaffolding(emit),
-        buildArgs: (_profile, req, prov) => buildQoderArgs(req, prov),
-        buildEnv: (profile, apiKey) => buildQoderChildEnv(profile as QoderProfile, apiKey),
-        deps,
+          profiles: QODER_PROFILES,
+          provider,
+          parsed,
+          incoming,
+          emit: guardQoderScaffolding(emit),
+          buildArgs: (_profile, req, prov) => buildQoderArgs(req, prov),
+          buildEnv: (profile, apiKey) => buildQoderChildEnv(profile as QoderProfile, apiKey, system),
+          deps,
       });
     },
   };

package/src/adapters/qoder/scaffold-guard.ts

@@ -54,11 +54,44 @@ const MAX_MARKER_LENGTH = Math.max(...ALL_MARKERS.map(marker => marker.length));
  * refuse the turn. A stem running to the end of the buffer still counts: more text may be
  * arriving, and reading it as prose is the one reading that could release the block body.
  */
-function reminderOpensHere(lowered: string, at: number): boolean {
-  const after = lowered[at + REMINDER_OPEN.length];
+function reminderOpensHere(text: string, at: number): boolean {
+  const after = text[at + REMINDER_OPEN.length];
   return after === undefined || /[\s/>]/.test(after);
 }
 
+/**
+ * Fold one UTF-16 code unit the way `toLowerCase()` does, when that yields one code unit.
+ *
+ * This keeps every match the lowercased scan used to make. U+212A KELVIN SIGN lowercases to an
+ * ASCII `k`, so `<invo\u212Ae>` was treated as tool markup; an ASCII-only fold would release it.
+ * A character whose lowercase form is longer (such as U+0130) is left as-is.
+ */
+function foldCodeUnit(code: number): number {
+  if (code >= 65 && code <= 90) return code + 32;
+  if (code < 128) return code;
+  const lowered = String.fromCharCode(code).toLowerCase();
+  return lowered.length === 1 ? lowered.charCodeAt(0) : code;
+}
+
+/**
+ * Find a lowercase ASCII marker without transforming `text`.
+ *
+ * Marker offsets must remain offsets into the original string. Unicode lowercasing can expand
+ * one code unit into several (for example, `İ` becomes `i` plus a combining dot), so an index
+ * obtained from `text.toLowerCase()` is unsafe to reuse with `text.slice()`. Folding one code
+ * unit at a time keeps the offsets and the matches.
+ */
+function indexOfMarker(text: string, marker: string, from = 0): number {
+  const last = text.length - marker.length;
+  outer: for (let at = Math.max(0, from); at <= last; at++) {
+    for (let offset = 0; offset < marker.length; offset++) {
+      if (foldCodeUnit(text.charCodeAt(at + offset)) !== marker.charCodeAt(offset)) continue outer;
+    }
+    return at;
+  }
+  return -1;
+}
+
 /**
  * Ceiling on a suppressed block before it is treated as unterminated.
  *
@@ -80,9 +113,10 @@ export interface ScaffoldFilterResult {
 function heldSuffixLength(text: string): number {
   const limit = Math.min(MAX_MARKER_LENGTH - 1, text.length);
   for (let length = limit; length > 0; length--) {
-    const suffix = text.slice(text.length - length).toLowerCase();
     for (const marker of ALL_MARKERS) {
-      if (marker.length > length && marker.startsWith(suffix)) return length;
+      if (marker.length > length && indexOfMarker(text, marker.slice(0, length), text.length - length) >= 0) {
+        return length;
+      }
     }
   }
   return 0;
@@ -114,7 +148,6 @@ export class QoderScaffoldFilter {
     for (;;) {
       if (this.mode === "suppress") {
         const scan = this.suppressedTail + buffer;
-        const scanned = scan.toLowerCase();
         // Unwind nesting rather than ending at the first closer. A reminder containing another
         // reminder would otherwise hand the outer block's remaining body — the MCP server list
         // in the reported leak — to the client as the model's answer, with a successful
@@ -122,11 +155,11 @@ export class QoderScaffoldFilter {
         let cursor = 0;
         let close = -1;
         for (;;) {
-          const nextClose = scanned.indexOf(REMINDER_CLOSE, cursor);
+          const nextClose = indexOfMarker(scan, REMINDER_CLOSE, cursor);
           if (nextClose < 0) break;
-          let nextOpen = scanned.indexOf(REMINDER_OPEN, cursor);
-          while (nextOpen >= 0 && !reminderOpensHere(scanned, nextOpen)) {
-            nextOpen = scanned.indexOf(REMINDER_OPEN, nextOpen + 1);
+          let nextOpen = indexOfMarker(scan, REMINDER_OPEN, cursor);
+          while (nextOpen >= 0 && !reminderOpensHere(scan, nextOpen)) {
+            nextOpen = indexOfMarker(scan, REMINDER_OPEN, nextOpen + 1);
           }
           if (nextOpen >= 0 && nextOpen < nextClose) {
             this.suppressDepth += 1;
@@ -159,11 +192,10 @@ export class QoderScaffoldFilter {
 
       let earliest = -1;
       let found = "";
-      const lowered = buffer.toLowerCase();
       for (const marker of ALL_MARKERS) {
-        let at = lowered.indexOf(marker);
-        while (at >= 0 && marker === REMINDER_OPEN && !reminderOpensHere(lowered, at)) {
-          at = lowered.indexOf(marker, at + 1);
+        let at = indexOfMarker(buffer, marker);
+        while (at >= 0 && marker === REMINDER_OPEN && !reminderOpensHere(buffer, at)) {
+          at = indexOfMarker(buffer, marker, at + 1);
         }
         if (at < 0) continue;
         // A closer sitting exactly where an opener starts cannot happen, so ties are impossible.

package/src/bridge/internal.ts

@@ -114,6 +114,26 @@ export function toolCallArgumentsUsable(args: string): boolean {
   }
 }
 
+/**
+ * Whether an in-progress function-call argument buffer could still become valid JSON.
+ * The first non-whitespace byte must be one that can begin a JSON value. A stream that
+ * already lost its leading `{"` (observed from coding-agent CLIs as `code":"…}`) can only
+ * fail `toolCallArgumentsUsable` at completion, so streaming those fragments publishes
+ * bytes a failed item cannot take back — the same #765 rule that refuses completion.
+ */
+export function toolCallArgumentsCouldBeJson(args: string): boolean {
+  const first = args.trimStart().charAt(0);
+  if (first === "") return true;
+  return first === "{"
+    || first === "["
+    || first === "\""
+    || first === "-"
+    || (first >= "0" && first <= "9")
+    || first === "t"
+    || first === "f"
+    || first === "n";
+}
+
 export function adapterFailureFromEvent(event: Extract<AdapterEvent, { type: "error" }>): { httpStatus: number; error: OcxErrorPayload } {
   const message = redactSecretString(event.message);
   if (event.status === undefined && event.errorType === undefined && event.code === undefined) {

package/src/bridge/sse.ts

@@ -24,6 +24,7 @@ import {
 import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
 import { encodeCompactionSummary } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
+import { mayBecomeCodeModeShellInput } from "../responses/code-mode-shell-input";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
 import { encodeReasoningEnvelope, type ReasoningEnvelope } from "../responses/reasoning-envelope";
 import { rememberReasoningForCall } from "../responses/reasoning-replay-cache";
@@ -47,7 +48,7 @@ import {
   type TranslatorBudget,
   type TranslatorBufferKind,
 } from "../lib/translator-budget";
-import { adapterFailureFromEvent, emptyChunks, joinChunks, ownedBudgetAbandonedMs, responsesUsage, toolCallArgumentsUsable, uuid, webSearchAction } from "./internal";
+import { adapterFailureFromEvent, emptyChunks, joinChunks, ownedBudgetAbandonedMs, responsesUsage, toolCallArgumentsCouldBeJson, toolCallArgumentsUsable, uuid, webSearchAction } from "./internal";
 import type { OutputItem, StringChunks } from "./internal";
 
 function sseEvent(name: string, data: Record<string, unknown>): string {
@@ -1055,10 +1056,17 @@ export function bridgeToResponsesSSE(
                   currentToolCall.callId,
                 ));
                 if (!currentToolCall.freeform && !currentToolCall.toolSearch) {
-                  emit("response.function_call_arguments.delta", {
-                    item_id: currentToolCall.itemId, output_index: currentToolCall.outputIndex,
-                    delta: event.arguments,
-                  });
+                  // Hold fragments whose accumulated buffer can never parse as JSON. Fragments
+                  // already streamed are retained by the client as history even when the item
+                  // fails at completion (the poisoned-replay loop behind inbound "non-JSON
+                  // arguments" warnings); holding costs nothing for healthy streams because the
+                  // completed item still carries the full arguments.
+                  if (toolCallArgumentsCouldBeJson(currentToolCall.args)) {
+                    emit("response.function_call_arguments.delta", {
+                      item_id: currentToolCall.itemId, output_index: currentToolCall.outputIndex,
+                      delta: event.arguments,
+                    });
+                  }
                 }
                 if (currentToolCall.freeform && !currentToolCall.codeModeHelperName) {
                   // `progressiveFreeformInput` holds while the buffer is still an ambiguous prefix
@@ -1089,6 +1097,7 @@ export function bridgeToResponsesSSE(
                     // replaced by the normalized ones.
                     const mayNormalize = ownsFreeformGrammar && currentToolCall.name === "apply_patch";
                     if (!((mayCompile || mayNormalize) && mayBecomePatchEnvelope(full))
+                      && !(mayCompile && mayBecomeCodeModeShellInput(currentToolCall.args, full))
                       && full.startsWith(emitted) && full.length > emitted.length) {
                       emit("response.custom_tool_call_input.delta", {
                         item_id: currentToolCall.itemId, output_index: currentToolCall.outputIndex,