@bitkyc08/opencodex 2.64.0 → 2.65.0

package/src/responses/parser.ts

@@ -18,6 +18,7 @@ import { lookupReplayThoughtSignature } from "./thought-signature-replay";
 import { compactionItemToText, isCompactionItemType } from "./compaction";
 import { previousResponseReplayPrefixLength } from "./state";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
+import { hasRoutedIdentity, nameRoutedIdentity } from "../adapters/identity";
 import { extractHostedWebSearch, WEB_SEARCH_TOOL_NAME } from "../web-search/synthetic-tool";
 import { buildImageTool, extractHostedImageGeneration, IMAGE_GEN_TOOL_NAME } from "../images/synthetic-tool";
 import { toolSearchDescription, toolSearchParameters } from "./tool-search-compat";
@@ -121,6 +122,33 @@ export function hasValidatedActiveReasoningEffort(options: Pick<OcxRequestOption
 }
 
 
+/**
+ * Name this request's destination in an instruction text inherited from a stored session block.
+ *
+ * Returns the input unchanged when it carries no sentence of ours, which is every request that has
+ * not gone through a sub-agent spawn. The catalog block is model-neutral on disk (#5217) and some
+ * routed adapters build their own system text instead of calling `identifyRoutedModel`, so both the
+ * neutral line and a sentence naming an earlier model are handled here — request time is the first
+ * point where the destination model is known.
+ */
+function nameDestinationText(text: string, modelId: string): string {
+  return hasRoutedIdentity(text) ? nameRoutedIdentity(text, modelId) : text;
+}
+
+function nameDestinationContent(
+  content: string | OcxContentPart[],
+  modelId: string,
+): string | OcxContentPart[] {
+  if (typeof content === "string") return nameDestinationText(content, modelId);
+  let changed = false;
+  const parts = content.map((part) => {
+    if (part.type !== "text" || !hasRoutedIdentity(part.text)) return part;
+    changed = true;
+    return { ...part, text: nameRoutedIdentity(part.text, modelId) };
+  });
+  return changed ? parts : content;
+}
+
 export function parseRequest(
   body: unknown,
   parseOptions?: { replayCacheScope?: OcxReasoningReplayScopeRef },
@@ -168,7 +196,10 @@ export function parseRequest(
   let continuationConversationMessageIndex: number | undefined;
 
   if (typeof data.instructions === "string" && data.instructions.length > 0) {
-    systemPrompt.push(data.instructions);
+    // #5217: this is the stored session instruction block. A sub-agent spawned on a DIFFERENT model
+    // receives the parent's copy verbatim, so the identity sentence inside it names the parent
+    // unless it is renamed here, where the destination model is known.
+    systemPrompt.push(nameDestinationText(data.instructions, data.model));
   }
 
   if (typeof data.input === "string") {
@@ -274,14 +305,25 @@ export function parseRequest(
             const flat = typeof text === "string"
               ? text
               : text.map(p => (p.type === "text" || p.type === "document" ? p.text : "")).join("");
-            if (flat.length > 0) systemPrompt.push(flat);
+            // #5217: a system-role item is instruction text, exactly like `instructions` and a
+            // developer item, so it needs the same request-time naming — it lands in the system
+            // block verbatim, and Codex replays the parent's copy to a sub-agent on another model.
+            if (flat.length > 0) systemPrompt.push(nameDestinationText(flat, data.model));
             break;
           }
           case "user":
           case "developer": {
             pendingReasoning.length = 0;
             const content = inputContentParts(msg.content);
-            messages.push({ role: msg.role, content, timestamp: now });
+            messages.push({
+              role: msg.role,
+              // #5217: Codex replays the PARENT session's instruction block as the worker's
+              // developer message, so a sub-agent on another model inherits an identity sentence
+              // naming the parent. Only this proxy's own sentence is rewritten, and only on a
+              // developer item; user turns are the caller's content and stay byte-identical.
+              content: msg.role === "developer" ? nameDestinationContent(content, data.model) : content,
+              timestamp: now,
+            });
             break;
           }
           case "assistant": {

package/src/router.ts

@@ -26,6 +26,7 @@ import {
 import { registryModelIdKeys } from "./providers/registry/model-ids";
 import { applyDirectReasoningEffortContracts, hasLegacyClinePassReasoningEfforts } from "./providers/derive";
 import { cloneFastWire } from "./providers/fastwire";
+import { fastSwitchOff } from "./providers/fast-opt-in";
 import {
   providerMatchesRegistryTransportWithStaticGuards,
   providerSupportsLiveModelDiscovery,
@@ -339,6 +340,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const noReasoningModels = staticPolicy.noReasoningModels;
   const noTemperatureModels = staticPolicy.noTemperatureModels;
   const noTopPModels = staticPolicy.noTopPModels;
+  const noStopModels = staticPolicy.noStopModels;
   const noPenaltyModels = staticPolicy.noPenaltyModels;
   const noJsonSchemaModels = staticPolicy.noJsonSchemaModels;
   const autoToolChoiceOnlyModels = staticPolicy.autoToolChoiceOnlyModels;
@@ -392,6 +394,9 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     ...(provider.supportsServiceTier === undefined && registryEntry.supportsServiceTier !== undefined
       ? { supportsServiceTier: registryEntry.supportsServiceTier }
       : {}),
+    // An off Fast switch is a provider-wide denial on the runtime provider, so a Fast policy
+    // resolved without the provider name still refuses (providerFastSwitchOff).
+    ...(fastSwitchOff(provider, registryEntry) ? { supportsServiceTier: false } : {}),
     // Registry-only web-search capability: without this backfill a saved provider row reaches
     // the Responses adapter with the flag `undefined`, so the capability gate added in #2262
     // reads "unclassified" and forwards Codex's OpenAI-only `web_search` config fields. xAI
@@ -482,6 +487,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     ...(noReasoningModels ? { noReasoningModels } : {}),
     ...(noTemperatureModels ? { noTemperatureModels } : {}),
     ...(noTopPModels ? { noTopPModels } : {}),
+    ...(noStopModels ? { noStopModels } : {}),
     ...(noPenaltyModels ? { noPenaltyModels } : {}),
     ...(noJsonSchemaModels ? { noJsonSchemaModels } : {}),
     ...(autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels } : {}),

package/src/server/auth-cors.ts

@@ -744,6 +744,12 @@ export function providerManagementConfigError(
     // validation and then rejected by the seed comparison, so canonical OpenAI could never
     // set OR clear it — the value was admitted and then refused in the same request.
     delete canonicalCandidate.annotateEmptyToolOutputs;
+    // Canonical ChatGPT keeps WebSocket as the default, but an operator may
+    // select the existing HTTP/SSE path without changing its auth or endpoint.
+    if (raw.upstreamWebsocket !== undefined) {
+      if (raw.upstreamWebsocket !== false) return "provider openai upstreamWebsocket must be false or omitted";
+      delete canonicalCandidate.upstreamWebsocket;
+    }
     const canonical = seed && (options?.allowOperatorOverlays
       ? matchesCanonicalProviderSeed(canonicalCandidate, seed)
       : sameCanonicalProviderSeed(canonicalCandidate, seed));
@@ -950,6 +956,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   mcpMaxResultBytes: "editor",
   modelAdapters: "editor",
   fastWire: "editor",
+  fastEnabled: "editor",
   baseUrl: "editor",
   responsesPath: "editor",
   chatCompletionsPath: "editor",
@@ -1042,6 +1049,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   noReasoningModels: "editor",
   noTemperatureModels: "editor",
   noTopPModels: "editor",
+  noStopModels: "editor",
   noPenaltyModels: "editor",
   noStructuredOutputModels: "editor",
   noJsonSchemaModels: "editor",

package/src/server/chat-completions.ts

@@ -328,7 +328,9 @@ async function handleChatCompletionsWithBudget(
     // This enrichment is optional for routed/non-main providers. If native main
     // is fenced, omit it and let auth-context reject only a final physical-main
     // selection while healthy pool/provider routes continue.
-    if (tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
+    const isCanonicalPool = settledRoute && isCanonicalOpenAiForwardProvider(settledRoute.provider)
+      && settledRoute.codexAccountMode === "pool";
+    if (!isCanonicalPool && tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
       try {
         const { getMainAccountToken } = await import("../codex/main-account");
         const token = getMainAccountToken();

package/src/server/claude-messages.ts

@@ -17,12 +17,14 @@ import { jsonUtf8Bytes } from "../lib/json-byte-size";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
+import { createToolCallIdAllocator } from "../adapters/tool-call-id";
 import { AnthropicRequestError, DesktopModelMappingUnavailableError, anthropicToResponsesTranslation, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
 import { isKnownDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
-import { resolveAlias, claudeCodeNativeAlias } from "../claude/alias";
+import { resolveAlias, claudeCodeNativeAlias, legacyAliasForNative } from "../claude/alias";
 import { recordDesktopRequest } from "../claude/desktop-health";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
+import { claudeCodeForIngress } from "../claude/intercept/model-bindings";
 import { analyzeClaudeCompatibility, isClaudeCompatibilityMode } from "../claude/compatibility";
 import {
   applyReplayRefusalClientHeaders,
@@ -85,6 +87,11 @@ import {
 
 type Rec = Record<string, unknown>;
 
+/** Which listener a Claude Messages request arrived on. Only the intercept ingress honours bindings. */
+export interface ClaudeIngressOptions {
+  claudeIntercept?: boolean;
+}
+
 /**
  * Decode a Claude selector that may carry the fast marker.
  *
@@ -112,7 +119,8 @@ function decodeClaudeFastSelector(raw: string, cc?: OcxConfig["claudeCode"]): st
 function decodeFablePickerAlias(raw: string, cc?: OcxConfig["claudeCode"]): string {
   const decoded = resolveInboundModel(raw, cc);
   if (!decoded.startsWith("claude-fable-")) return raw;
-  return claudeCodeNativeAlias(decoded) === raw ? decoded : raw;
+  // A picker value saved before the ocx-claude spelling keeps the native passthrough too.
+  return claudeCodeNativeAlias(decoded) === raw || legacyAliasForNative(decoded) === raw ? decoded : raw;
 }
 
 function isRec(v: unknown): v is Rec {
@@ -195,8 +203,9 @@ function wantsNativePassthrough(
   config: OcxConfig,
   requestPolicy: RequestPolicyView,
   model: unknown,
+  cc: OcxConfig["claudeCode"] = config.claudeCode,
 ): model is string {
-  if (config.claudeCode?.nativePassthrough === false) return false;
+  if (cc?.nativePassthrough === false) return false;
   if (typeof model !== "string" || !/^(claude|anthropic)/i.test(model)) return false;
   // Authorization and x-api-key both belong to the upstream on this branch. An exposed listener
   // therefore requires the dedicated admission header even though the routed Messages surface
@@ -207,7 +216,8 @@ function wantsNativePassthrough(
   }
   if (!hasAnthropicNativeCredential(req, config)) return false;
   // An alias or modelMap hit means the user asked for a ROUTED model: translate instead.
-  return resolveInboundModel(model, config.claudeCode) === model;
+  // `cc` carries first-party intercept bindings for requests on the claude-intercept ingress.
+  return resolveInboundModel(model, cc) === model;
 }
 
 function shouldForwardNativeHeader(name: string, value: string, config: OcxConfig): boolean {
@@ -406,6 +416,44 @@ export function tapAnthropicSseForLog(
   });
 }
 
+/**
+ * `tool_use.id` / `tool_result.tool_use_id` must match Anthropic's wire contract
+ * (`^[a-zA-Z0-9_-]+$`, <=64 chars). Third-party models mint other shapes — Devin's
+ * swe-2 emits `Bash:0#<hex>` — and a session history carrying them 400s the moment it
+ * is switched to a native Anthropic model ("messages.N.content.M.tool_use.id: String
+ * should match pattern"). The adapter path normalizes these via
+ * adapters/tool-call-id.ts (#1780); this passthrough bypasses that adapter, so the same
+ * allocator runs here. Stateless per request: conforming ids pass through byte-identical
+ * (prompt-cache keys untouched), rewritten ids keep call/result pairing stable.
+ * An empty id has no representable wire form, and forwarding `""` is what Anthropic
+ * rejects (#1767), so the request fails locally with a 400 before any upstream fetch.
+ */
+function sanitizePassthroughToolCallIds(messages: unknown[]): void {
+  const blocks: Rec[] = [];
+  for (const message of messages) {
+    if (!isRec(message) || !Array.isArray(message.content)) continue;
+    for (const block of message.content) if (isRec(block)) blocks.push(block);
+  }
+  const fieldOf = (block: Rec): "id" | "tool_use_id" | undefined => {
+    if (typeof block.type !== "string") return undefined;
+    if (block.type.endsWith("tool_use")) return "id";
+    if (block.type.endsWith("tool_result")) return "tool_use_id";
+    return undefined;
+  };
+  const callIds = createToolCallIdAllocator();
+  for (const block of blocks) {
+    const field = fieldOf(block);
+    if (field && typeof block[field] === "string") callIds.reserve(block[field] as string);
+  }
+  for (const block of blocks) {
+    const field = fieldOf(block);
+    if (!field || typeof block[field] !== "string") continue;
+    const wire = callIds.allocate(block[field] as string);
+    if (wire === undefined) throw new AnthropicRequestError(`${block.type} block has an empty ${field}`);
+    block[field] = wire;
+  }
+}
+
 async function anthropicNativePassthrough(
   req: Request,
   config: OcxConfig,
@@ -435,6 +483,7 @@ async function anthropicNativePassthrough(
   if (Array.isArray(body.messages)) {
     await normalizeAnthropicImages(body.messages, { abortSignal: req.signal });
     enforceAnthropicImageLimits(body.messages);
+    sanitizePassthroughToolCallIds(body.messages);
   }
   const headers = new Headers();
   req.headers.forEach((value, name) => {
@@ -637,11 +686,12 @@ export async function handleClaudeMessages(
   logCtx: RequestLogContext,
   logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
   requestPolicy: RequestPolicyView = config,
+  ingress: ClaudeIngressOptions = {},
 ): Promise<Response> {
   const translatorBudget = createTranslatorBudget();
   try {
     return finalizeTranslatorBudgetResponse(
-      await handleClaudeMessagesWithBudget(req, config, logCtx, translatorBudget, logIds, requestPolicy),
+      await handleClaudeMessagesWithBudget(req, config, logCtx, translatorBudget, logIds, requestPolicy, ingress),
       translatorBudget,
     );
   } catch (error) {
@@ -663,6 +713,7 @@ async function handleClaudeMessagesWithBudget(
   translatorBudget: TranslatorBudget,
   logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
   requestPolicy: RequestPolicyView = config,
+  ingress: ClaudeIngressOptions = {},
 ): Promise<Response> {
   logCtx.surface = "claude";
   const disabled = claudeInboundDisabled(config);
@@ -670,6 +721,8 @@ async function handleClaudeMessagesWithBudget(
     if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 403, { closeReason: "non_stream" });
     return disabled;
   }
+  // Model resolution reads this view; every other claudeCode setting keeps reading `config`.
+  const cc = claudeCodeForIngress(config.claudeCode, ingress.claudeIntercept === true);
 
   let anthropicBody: unknown;
   let internalBody: Rec;
@@ -698,7 +751,7 @@ async function handleClaudeMessagesWithBudget(
       }
     }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
-      anthropicBody.model = decodeFablePickerAlias(anthropicBody.model, config.claudeCode);
+      anthropicBody.model = decodeFablePickerAlias(anthropicBody.model, cc);
     }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
       requestedModel = anthropicBody.model;
@@ -709,7 +762,7 @@ async function handleClaudeMessagesWithBudget(
       ({ fastRow, effortRow } = parseSyntheticRowId(
         requestedModel,
         config,
-        () => decodeClaudeFastSelector(requestedModel, config.claudeCode),
+        () => decodeClaudeFastSelector(requestedModel, cc),
       ));
       if (effortRow) {
         anthropicBody.model = effortRow.baseId;
@@ -723,7 +776,7 @@ async function handleClaudeMessagesWithBudget(
       "messages",
       anthropicBody,
       isRec(anthropicBody) && typeof anthropicBody.model === "string"
-        ? resolveInboundModel(anthropicBody.model, config.claudeCode)
+        ? resolveInboundModel(anthropicBody.model, cc)
         : undefined,
       req.headers.get("anthropic-beta") ?? undefined,
     );
@@ -744,7 +797,7 @@ async function handleClaudeMessagesWithBudget(
     // caller's body with the caller's credential and never runs the Anthropic adapter, so the
     // proxy-owned `speed` + beta (anthropic-speed wire) and its usage.speed observation would be
     // silently skipped. Translation reaches the adapter, which owns both.
-    if (!effortRow && !fastRow && isRec(anthropicBody) && wantsNativePassthrough(req, config, requestPolicy, anthropicBody.model)) {
+    if (!effortRow && !fastRow && isRec(anthropicBody) && wantsNativePassthrough(req, config, requestPolicy, anthropicBody.model, cc)) {
       return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
     }
     // Capture source semantics before effort rewriting or translation drops fields.
@@ -780,7 +833,7 @@ async function handleClaudeMessagesWithBudget(
       };
       delete anthropicBody.thinking;
     }
-    const translation = anthropicToResponsesTranslation(anthropicBody, config.claudeCode, translatorBudget);
+    const translation = anthropicToResponsesTranslation(anthropicBody, cc, translatorBudget);
     internalBody = translation.body;
     // The Anthropic translator builds its body from model/input/store/stream plus sampling
     // fields only, so the caller intent is applied to the TRANSLATED body rather than the
@@ -1212,9 +1265,11 @@ export async function handleClaudeCountTokens(
   req: Request,
   config: OcxConfig,
   requestPolicy: RequestPolicyView = config,
+  ingress: ClaudeIngressOptions = {},
 ): Promise<Response> {
   const disabled = claudeInboundDisabled(config);
   if (disabled) return disabled;
+  const cc = claudeCodeForIngress(config.claudeCode, ingress.claudeIntercept === true);
 
   let body: unknown;
   const translatorBudget = createTranslatorBudget();
@@ -1246,20 +1301,20 @@ export async function handleClaudeCountTokens(
       model = stripOneMillionMarker(countRoute);
       raw.model = model;
     }
-    model = decodeFablePickerAlias(model, config.claudeCode);
+    model = decodeFablePickerAlias(model, cc);
     raw.model = model;
     // Fast-only: count_tokens never parsed an effort row, so it must not start. It returns a
     // token estimate and sends no tier, so only the IDENTITY is corrected - without this the
     // synthetic id reaches native passthrough as a model Anthropic has never heard of.
     const countFastRow = parseFastOnlyRowId(
-      config, () => decodeClaudeFastSelector(model, config.claudeCode),
+      config, () => decodeClaudeFastSelector(model, cc),
     );
     if (countFastRow) {
       model = countFastRow.baseId;
       raw.model = model;
     }
-    captureClaudeInbound("count_tokens", raw, resolveInboundModel(model, config.claudeCode), req.headers.get("anthropic-beta") ?? undefined);
-    if (wantsNativePassthrough(req, config, requestPolicy, model)) {
+    captureClaudeInbound("count_tokens", raw, resolveInboundModel(model, cc), req.headers.get("anthropic-beta") ?? undefined);
+    if (wantsNativePassthrough(req, config, requestPolicy, model, cc)) {
       return await anthropicNativePassthrough(req, config, { model, provider: "anthropic-native", surface: "claude" }, undefined, raw, "/v1/messages/count_tokens");
     }
     const inputTokens = estimateClaudeRequestTokens(raw, model);

package/src/server/grok-upstream-envelope-echo.ts

@@ -0,0 +1,120 @@
+import { ToolEnvelopeEchoFilter, stripToolEnvelopeEcho } from "../lib/tool-envelope-echo-filter";
+import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function outputText(value: unknown, replacement?: (index: number, content: number, text: string) => string): void {
+  if (!record(value) || !Array.isArray(value.output)) return;
+  value.output.forEach((item: unknown, index: number) => {
+    if (!record(item) || !Array.isArray(item.content)) return;
+    item.content.forEach((part: unknown, content: number) => {
+      if (record(part) && part.type === "output_text" && typeof part.text === "string") {
+        part.text = replacement?.(index, content, part.text) ?? stripToolEnvelopeEcho(part.text);
+      }
+    });
+  });
+}
+
+/**
+ * The echo only appears when the model has seen a replayed tool envelope: a tool call or tool output
+ * in this request's input, or a stored conversation continued through previous_response_id (its history
+ * lives upstream and may hold tool results). A first turn with neither is never filtered, so a
+ * legitimate answer that starts a line with "[Tool Result]" reaches the client intact.
+ */
+export function responsesRequestMayReplayToolOutput(rawBody: unknown): boolean {
+  if (!record(rawBody)) return false;
+  if (typeof rawBody.previous_response_id === "string" && rawBody.previous_response_id !== "") return true;
+  if (!Array.isArray(rawBody.input)) return false;
+  // A tool call counts too: xAI's paired tool-result repair answers a dangling call with a synthetic
+  // output on the outbound request, so the model sees a tool result the caller never sent.
+  return rawBody.input.some(item => record(item) && typeof item.type === "string" && /_call(_output)?$/.test(item.type));
+}
+
+/** Completed non-streaming Responses bodies use the same line-aware marker rule. */
+export function stripGrokUpstreamEnvelopeEchoFromResponsesJson(json: string): string {
+  try {
+    const value = JSON.parse(json) as unknown;
+    outputText(value);
+    return JSON.stringify(value);
+  } catch {
+    return json;
+  }
+}
+
+type TextState = {
+  filter: ToolEnvelopeEchoFilter;
+  delivered: string;
+  lastDeltaBlock: string;
+  lastDeltaEvent: Record<string, unknown>;
+};
+
+/** Keep xAI text deltas, done events, terminal snapshots and replay state in agreement. */
+export function createGrokUpstreamEnvelopeEchoBlockRewrite(
+  onCompletedResponse?: (response: Record<string, unknown>) => void,
+): SseBlockRewrite {
+  const states = new Map<string, TextState>();
+  const key = (output: unknown, content: unknown): string =>
+    `${typeof output === "number" ? output : 0}:${typeof content === "number" ? content : 0}`;
+  const flush = (state: TextState): string[] => {
+    const suffix = state.filter.finish();
+    if (!suffix) return [];
+    state.delivered += suffix;
+    return [replaceSseDataPayload(state.lastDeltaBlock, JSON.stringify({ ...state.lastDeltaEvent, delta: suffix }))];
+  };
+  return (block) => {
+    const payload = sseDataPayload(block);
+    if (payload === null) return [block];
+    if (payload === "[DONE]") return [...[...states.values()].flatMap(flush), block];
+    let event: unknown;
+    try { event = JSON.parse(payload); } catch { return [block]; }
+    if (!record(event) || typeof event.type !== "string") return [block];
+    if (event.type === "response.output_text.delta" && typeof event.delta === "string") {
+      const id = key(event.output_index, event.content_index);
+      let state = states.get(id);
+      if (!state) {
+        state = { filter: new ToolEnvelopeEchoFilter(), delivered: "", lastDeltaBlock: block, lastDeltaEvent: event };
+        states.set(id, state);
+      }
+      state.lastDeltaBlock = block;
+      state.lastDeltaEvent = event;
+      const delta = state.filter.feed(event.delta);
+      state.delivered += delta;
+      if (!delta) return [];
+      return [replaceSseDataPayload(block, JSON.stringify({ ...event, delta }))];
+    }
+    if (event.type === "response.output_text.done") {
+      const state = states.get(key(event.output_index, event.content_index));
+      if (!state) {
+        if (typeof event.text !== "string") return [block];
+        event.text = stripToolEnvelopeEcho(event.text);
+        return [replaceSseDataPayload(block, JSON.stringify(event))];
+      }
+      const pending = flush(state);
+      event.text = state.delivered;
+      return [...pending, replaceSseDataPayload(block, JSON.stringify(event))];
+    }
+    if (event.type === "response.output_item.done" && record(event.item)) {
+      const index = typeof event.output_index === "number" ? event.output_index : 0;
+      const pending: string[] = [];
+      if (Array.isArray(event.item.content)) {
+        event.item.content.forEach((part: unknown, content: number) => {
+          if (!record(part) || part.type !== "output_text" || typeof part.text !== "string") return;
+          const state = states.get(key(index, content));
+          if (state) { pending.push(...flush(state)); part.text = state.delivered; }
+          else part.text = stripToolEnvelopeEcho(part.text);
+        });
+      }
+      return [...pending, replaceSseDataPayload(block, JSON.stringify(event))];
+    }
+    if (event.type === "response.completed" && record(event.response)) {
+      const pending = [...states.values()].flatMap(flush);
+      outputText(event.response, (index, content, text) =>
+        states.get(key(index, content))?.delivered ?? stripToolEnvelopeEcho(text));
+      onCompletedResponse?.(event.response);
+      return [...pending, replaceSseDataPayload(block, JSON.stringify(event))];
+    }
+    return [block];
+  };
+}

package/src/server/index/claude-intercept-lifecycle.ts

@@ -1,4 +1,5 @@
 import type { Server } from "bun";
+import type { PickerRouteInput } from "../../claude/intercept/picker-models";
 import {
   startClaudeIntercept,
   type ClaudeInterceptHandle,
@@ -18,6 +19,28 @@ export interface ClaudeInterceptLifecycle<T> {
   stop(): Promise<void>;
 }
 
+/**
+ * Routes for Desktop's Code-tab picker: the same inputs `/api/sync` gives the gateway profile
+ * (src/server/management/config-routes.ts), read from the persisted config at call time. Dynamic
+ * imports keep the catalog and discovery off the synchronous startup path.
+ */
+export async function loadPickerRoutesFromCatalog(): Promise<PickerRouteInput> {
+  const [{ loadConfig }, { fetchAllModels }, catalog] = await Promise.all([
+    import("../../config"),
+    import("../management-api"),
+    import("../../codex/catalog"),
+  ]);
+  const config = loadConfig();
+  const models = await fetchAllModels(config);
+  return {
+    nativeSlugs: [...catalog.desktopVisibleNativeSlugs(config)],
+    routedModels: catalog.filterCatalogVisibleModels(models, config)
+      .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow })),
+    ...(config.claudeCode?.desktopProfile ? { profile: config.claudeCode.desktopProfile } : {}),
+    nativeContextCap: catalog.nativeContextLimits(config),
+  };
+}
+
 export function createClaudeInterceptLifecycle<T>(): ClaudeInterceptLifecycle<T> {
   let listener: Server<T> | null = null;
   let pending: Promise<ClaudeInterceptHandle<T> | null> = Promise.resolve(null);
@@ -27,6 +50,7 @@ export function createClaudeInterceptLifecycle<T>(): ClaudeInterceptLifecycle<T>
       const dispatch = options.dispatch;
       pending = startClaudeIntercept<T>({
         ...options,
+        loadPickerRoutes: options.loadPickerRoutes ?? loadPickerRoutesFromCatalog,
         dispatch: (req, requestServer) => {
           listener ??= requestServer;
           return dispatch(req, requestServer);

package/src/server/index/serve-options.ts

@@ -1475,7 +1475,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           return withCors(anthropicErrorResponse(403, "cross-origin data-plane request blocked", "permission_error"), req, policy);
         }
         return runAdmittedHttpTurn(req, policy, async () => withCors(
-          await handleClaudeCountTokens(req, config, policy),
+          await handleClaudeCountTokens(req, config, policy, { claudeIntercept: ingress === "claude-intercept" }),
           req,
           policy,
         ));
@@ -1506,7 +1506,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // pre-translation stream + native passthrough callbacks) — do not re-wrap the
         // translated Anthropic stream here.
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => withCors(
-          await handleClaudeMessages(req, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy),
+          await handleClaudeMessages(req, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy, { claudeIntercept: ingress === "claude-intercept" }),
           req,
           policy,
         ), { requestId, start, logCtx });

package/src/server/index.ts

@@ -61,6 +61,7 @@ import {
   registerDefaultAppOwnedObservedBuffers,
 } from "../lib/app-owned-memory-stores";
 import { acquireServerBackgroundLifecycle } from "./background-lifecycle";
+import { startPackageRefresh, stopPackageRefresh } from "../update/refresh-scheduler";
 import { activateLab, labActivationRequired } from "../lib/lab-activation";
 import { runOpenAiTierStartupMigration } from "../providers/openai-tier-startup";
 import { runAlibabaRegionStartupMigration } from "../providers/alibaba-region-startup";
@@ -746,6 +747,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   const nativeStop = server.stop.bind(server);
   const loopbackListenerRef = loopbackServer;
   const managementIngressRef = managementIngressServer;
+  let packageRefreshStopped = false;
   Object.defineProperty(server, "stop", {
     configurable: true,
     value: async (closeActiveConnections?: boolean): Promise<void> => {
@@ -754,6 +756,10 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
       // Disarm the package-tree restart timer before listener teardown: a queued
       // replacement callback must not call acceptSystemRestart() after stop() has
       // begun, or it would schedule a drain-and-restart on a stopped server.
+      if (!packageRefreshStopped) {
+        packageRefreshStopped = true;
+        stopPackageRefresh();
+      }
       packageTreeIntegrity.dispose();
       // The orchestration lives in `runListenerShutdown` so its two competing properties —
       // cleanup completes, failure propagates — are testable without a live socket.
@@ -874,6 +880,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     });
   }
 
+  startPackageRefresh();
   return server;
 }