@bitkyc08/opencodex 2.65.0 → 2.66.0-preview.20260925

package/src/adapters/anthropic.ts

@@ -523,6 +523,54 @@ function anthropicKeyUsesBearer(provider: OcxProviderConfig): boolean {
   return provider.apiKeyTransport === "bearer";
 }
 
+/** The `anthropic-version` every Messages request from this proxy pins. */
+export const ANTHROPIC_API_VERSION = "2023-06-01";
+
+/**
+ * The fixed headers of every Messages request this proxy builds, before credentials. Shared by
+ * the adapter and the managed native lane so both pin the same version and client identity.
+ */
+export function anthropicBaseRequestHeaders(stream: boolean | undefined): Record<string, string> {
+  return {
+    "Content-Type": "application/json",
+    "anthropic-version": ANTHROPIC_API_VERSION,
+    "Accept": stream ? "text/event-stream" : "application/json",
+    "User-Agent": "@anthropic-ai/sdk/0.74.0",
+  };
+}
+
+/** Key-auth credential placement: `x-api-key`, or a bearer when the provider asks for one. */
+export function applyAnthropicKeyAuth(headers: Record<string, string>, provider: OcxProviderConfig): void {
+  if (typeof provider.apiKey !== "string") return;
+  if (anthropicKeyUsesBearer(provider)) headers["Authorization"] = `Bearer ${provider.apiKey}`;
+  else headers["x-api-key"] = provider.apiKey;
+}
+
+/**
+ * OAuth (Claude Pro/Max) credential placement: the bearer, the OAuth beta pair and the Claude
+ * Code client fingerprint. Shared by the adapter and the managed native lane.
+ */
+export function applyAnthropicOAuthAuth(headers: Record<string, string>, accessToken: string): void {
+  headers["Authorization"] = `Bearer ${accessToken}`;
+  headers["anthropic-beta"] = ANTHROPIC_OAUTH_BETA;
+  // Match the real Claude Code CLI request fingerprint: a valid OAuth token with an empty
+  // header set is a non-first-party signature. (cch billing-header signing is intentionally
+  // out of scope — brittle and version-coupled.)
+  Object.assign(headers, CLAUDE_CODE_HEADERS);
+  headers["X-Claude-Code-Session-Id"] = claudeCodeSessionId(accessToken);
+  headers["x-client-request-id"] = crypto.randomUUID();
+}
+
+/** The provider's Messages endpoint, refusing a base URL with an unresolved `{placeholder}`. */
+export function resolveAnthropicMessagesUrl(provider: Pick<OcxProviderConfig, "baseUrl">): string {
+  const url = anthropicMessagesUrl(provider.baseUrl);
+  const unresolvedPlaceholder = url.match(/\{[^}]*\}/)?.[0];
+  if (unresolvedPlaceholder) {
+    throw new Error(`anthropic baseUrl contains unresolved ${unresolvedPlaceholder}`);
+  }
+  return url;
+}
+
 /** Map a Responses reasoning effort to an Anthropic extended-thinking budget (tokens, >= 1024). */
 function reasoningBudget(effort: string): number {
   switch (effort) {
@@ -802,6 +850,9 @@ function messagesToAnthropicFormat(
             if (text) preface.push({ type: "text", text });
           } else if (part.type === "thinking") {
             const t = part as OcxThinkingContent;
+            // History minted under another serving identity (or already rejected as opaque) is not
+            // this destination's to verify: drop its opaque blocks, as the Responses passthrough does.
+            if (parsed._stripReasoningEncryptedContent === true) continue;
             // Redacted blocks replay verbatim FIRST (they preceded the visible thinking block
             // in the original stream order preserved by the bridge envelope).
             for (const data of t.redacted ?? []) {
@@ -1129,35 +1180,15 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
         body.tool_choice = { ...settledToolChoice, disable_parallel_tool_use: true };
       }
 
-      const url = anthropicMessagesUrl(provider.baseUrl);
-      const unresolvedPlaceholder = url.match(/\{[^}]*\}/)?.[0];
-      if (unresolvedPlaceholder) {
-        throw new Error(`anthropic baseUrl contains unresolved ${unresolvedPlaceholder}`);
-      }
+      const url = resolveAnthropicMessagesUrl(provider);
       // Anthropic fast mode: `speed` is only accepted beside its beta; without it the API
       // answers 400 "speed: Extra inputs are not permitted". The beta is merged below, after
       // any header override, so a request never carries one without the other.
       const fastSpeed = anthropicFastSpeed(parsed, provider);
       if (fastSpeed) body.speed = fastSpeed.value;
-      const headers: Record<string, string> = {
-        "Content-Type": "application/json",
-        "anthropic-version": "2023-06-01",
-        "Accept": parsed.stream ? "text/event-stream" : "application/json",
-        "User-Agent": "@anthropic-ai/sdk/0.74.0",
-      };
-      if (isOAuth) {
-        headers["Authorization"] = `Bearer ${provider.apiKey}`;
-        headers["anthropic-beta"] = ANTHROPIC_OAUTH_BETA;
-        // Match the real Claude Code CLI request fingerprint: a valid OAuth token with an empty
-        // header set is a non-first-party signature. (cch billing-header signing is intentionally
-        // out of scope — brittle and version-coupled.)
-        Object.assign(headers, CLAUDE_CODE_HEADERS);
-        headers["X-Claude-Code-Session-Id"] = claudeCodeSessionId(provider.apiKey);
-        headers["x-client-request-id"] = crypto.randomUUID();
-      } else {
-        if (anthropicKeyUsesBearer(provider)) headers["Authorization"] = `Bearer ${provider.apiKey}`;
-        else headers["x-api-key"] = provider.apiKey;
-      }
+      const headers = anthropicBaseRequestHeaders(parsed.stream);
+      if (isOAuth) applyAnthropicOAuthAuth(headers, provider.apiKey);
+      else applyAnthropicKeyAuth(headers, provider);
       if (provider.headers) Object.assign(headers, provider.headers);
       mergeAnthropicBetaHeader(headers, fastSpeed?.betas ?? []);
 

package/src/adapters/coding-agent/protocol.ts

@@ -80,14 +80,11 @@ export async function* readJsonLines(
   const maxLineBytes = limits.maxLineBytes ?? MAX_STREAM_LINE_BYTES;
   const maxTotalBytes = limits.maxTotalBytes ?? MAX_STREAM_TOTAL_BYTES;
   const decoder = new TextDecoder();
-  const encoder = new TextEncoder();
-  let buffer = "";
+  let parts: string[] = [];
+  let lineBytes = 0;
   let totalBytes = 0;
 
   const flushLine = function* (line: string): Generator<StreamMessage> {
-    if (encoder.encode(line).byteLength > maxLineBytes) {
-      throw new CodingAgentStreamLimitError("Coding-agent stream line exceeded the byte ceiling");
-    }
     const trimmed = line.trim();
     if (!trimmed) return; // Blank lines and whitespace-only lines are ignored as padding.
     let parsed: unknown;
@@ -108,26 +105,39 @@ export async function* readJsonLines(
     yield parsed as StreamMessage;
   };
 
+  // Decode continuously for split UTF-8/BOM semantics, but search and measure only new
+  // decoded segments. Joining once per frame avoids repeatedly flattening a growing rope.
+  const consume = function* (text: string): Generator<StreamMessage> {
+    let start = 0;
+    while (start < text.length) {
+      const newline = text.indexOf("\n", start);
+      const end = newline < 0 ? text.length : newline;
+      const part = text.slice(start, end);
+      lineBytes += Buffer.byteLength(part);
+      if (lineBytes > maxLineBytes) {
+        throw new CodingAgentStreamLimitError("Coding-agent stream line exceeded the byte ceiling");
+      }
+      if (part) parts.push(part);
+      if (newline < 0) break;
+      const line = parts.join("");
+      parts = [];
+      lineBytes = 0;
+      yield* flushLine(line);
+      start = newline + 1;
+    }
+  };
+
   for await (const chunk of chunks) {
     totalBytes += chunk.byteLength;
     if (totalBytes > maxTotalBytes) {
       throw new CodingAgentStreamLimitError("Coding-agent stream exceeded the total byte ceiling");
     }
-    buffer += decoder.decode(chunk, { stream: true });
-    let newline = buffer.indexOf("\n");
-    while (newline >= 0) {
-      const line = buffer.slice(0, newline);
-      buffer = buffer.slice(newline + 1);
-      yield* flushLine(line);
-      newline = buffer.indexOf("\n");
-    }
-    if (encoder.encode(buffer).byteLength > maxLineBytes) {
-      throw new CodingAgentStreamLimitError("Coding-agent stream line exceeded the byte ceiling");
-    }
+    yield* consume(decoder.decode(chunk, { stream: true }));
   }
-  // Flush the decoder's trailing bytes and any final line without a newline terminator.
-  buffer += decoder.decode();
-  if (buffer.trim()) yield* flushLine(buffer);
+  // Flush incomplete UTF-8 through the same decoded-byte accounting before parsing EOF.
+  yield* consume(decoder.decode());
+  const finalLine = parts.join("");
+  if (finalLine.trim()) yield* flushLine(finalLine);
 }
 
 function asRecord(value: unknown): Record<string, unknown> | undefined {

package/src/adapters/cursor/live-transport.ts

@@ -1,3 +1,4 @@
+import { CursorForegroundShellOwner } from "./native-foreground-shell";
 import http2 from "node:http2";
 import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
 import { namespacedToolName, type OcxProviderConfig, type OcxUsage } from "../../types";
@@ -531,6 +532,8 @@ class LiveCursorTransport implements CursorTransport {
   private mcpPrepared?: Promise<void>;
   private releaseMcpObservation?: () => void;
   private blobRequestScope?: CursorBlobRequestScopeToken;
+  private readonly foregroundShellOwner = new CursorForegroundShellOwner();
+  private requestSignal?: AbortSignal;
   private shellCleanup?: Promise<BackgroundShellTerminationReport>;
   // Per-turn diagnostic counters/timestamps when provider debug is on (`ocx debug provider on`). Stamped in open(), cleared on
   // close; safe to read after a stream failure because open() owns the only writer before run().
@@ -610,6 +613,7 @@ class LiveCursorTransport implements CursorTransport {
   }
 
   async *run(request: CursorRunRequest, signal?: AbortSignal): AsyncIterable<CursorServerMessage> {
+    this.requestSignal = signal;
     const queue: Array<{ message: CursorServerMessage; bytes: number }> = [];
     let notify: (() => void) | undefined;
     let done = false;
@@ -947,10 +951,14 @@ class LiveCursorTransport implements CursorTransport {
   }
 
   private startShellCleanup(): Promise<BackgroundShellTerminationReport> {
-    return this.shellCleanup ??= terminateBackgroundShellsForSession(this.shellOwnerId);
+    return this.shellCleanup ??= Promise.all([
+      terminateBackgroundShellsForSession(this.shellOwnerId),
+      this.foregroundShellOwner.close(),
+    ]).then(([backgroundReport]) => backgroundReport);
   }
 
   async close(): Promise<void> {
+    const shellCleanup = this.startShellCleanup();
     if (this.heartbeat) clearInterval(this.heartbeat);
     if (this.turnEndedCloseTimer) clearTimeout(this.turnEndedCloseTimer);
     this.clearPendingFinalize();
@@ -963,10 +971,11 @@ class LiveCursorTransport implements CursorTransport {
     this.releaseMcpObservation?.();
     this.releaseMcpObservation = undefined;
     void this.mcpManager?.dispose();
-    await this.startShellCleanup();
+    await shellCleanup;
   }
 
   private cancelCursorRun(): void {
+    void this.startShellCleanup();
     this.expectedClose = true;
     this.clearPendingFinalize();
     if (this.heartbeat) clearInterval(this.heartbeat);
@@ -1164,6 +1173,7 @@ class LiveCursorTransport implements CursorTransport {
       fail,
       finish,
       clearTimer: () => {
+        void this.startShellCleanup();
         this.clearFirstFrameTimer();
         this.clearStreamHealthTimer();
       },
@@ -1403,6 +1413,8 @@ class LiveCursorTransport implements CursorTransport {
       failAndClear(realErr);
     };
     const onStreamEnd = () => {
+      // Native frameWork can be awaiting a shell; cancel before waiting for it to drain.
+      void this.startShellCleanup();
       this.clearFirstFrameTimer();
       debugProviderDiagnostic("cursor", "stream-end", {
         committed: this.committed,
@@ -1496,6 +1508,7 @@ class LiveCursorTransport implements CursorTransport {
       stream!.on("trailers", onTrailers);
       stream!.on("error", onStreamError);
       stream!.on("end", onStreamEnd);
+      stream!.on("close", () => { void this.startShellCleanup(); });
     }
 
     signal?.addEventListener("abort", () => {
@@ -1569,7 +1582,9 @@ class LiveCursorTransport implements CursorTransport {
       // an eventual invalid_argument cannot cause the adapter's fresh-conversation fallback to
       // run the same local action twice.
       push({ type: "local_side_effect" });
-      const replies = await handleCursorNativeExec(message.message.value, this.execContext);
+      const replies = await handleCursorNativeExec(message.message.value, {
+        ...this.execContext, foregroundShellOwner: this.foregroundShellOwner, signal: this.requestSignal,
+      });
       for (const reply of replies) this.writeConnectFrame(encodeConnectFrame(reply));
       return;
     }

package/src/adapters/cursor/native-exec-shell.ts

@@ -1,5 +1,6 @@
-import { spawn, spawnSync, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { resolve } from "node:path";
+import { foregroundShellUnavailableMessage, runForegroundShell, type CursorForegroundShellOwner } from "./native-foreground-shell";
 import { create } from "@bufbuild/protobuf";
 import {
   BackgroundShellSpawnErrorSchema,
@@ -123,39 +124,11 @@ export function rejectShellExecForPolicy(execMsg: ExecServerMessage, hint?: stri
   return execBytes(execMsg, "shellResult", rejectedShellResult(args.command, resolve(args.workingDirectory || process.cwd()), Date.now(), hint));
 }
 
-export function shellExec(execMsg: ExecServerMessage): Uint8Array {
-  if (execMsg.message.case !== "shellArgs") throw new Error("invalid shell exec");
-  const args = execMsg.message.value;
-  const cwd = resolve(args.workingDirectory || process.cwd());
-  const started = Date.now();
-  const result = spawnSync(args.command, { cwd, shell: true, encoding: "utf8", timeout: args.hardTimeout || 120_000 });
-  const elapsed = Date.now() - started;
-  const stdout = String(result.stdout ?? "");
-  const stderr = String(result.stderr ?? "");
-  const code = typeof result.status === "number" ? result.status : 1;
-  if (code === 0) {
-    return execBytes(execMsg, "shellResult", create(ShellResultSchema, {
-      result: {
-        case: "success",
-        value: create(ShellSuccessSchema, { command: args.command, workingDirectory: cwd, exitCode: code, signal: "", stdout, stderr, executionTime: elapsed }),
-      },
-    }));
-  }
-  return execBytes(execMsg, "shellResult", create(ShellResultSchema, {
-    result: {
-      case: "failure",
-      value: create(ShellFailureSchema, {
-        command: args.command,
-        workingDirectory: cwd,
-        exitCode: code,
-        signal: String(result.signal ?? ""),
-        stdout,
-        stderr,
-        executionTime: elapsed,
-        aborted: !!result.error,
-      }),
-    },
-  }));
+export function shellExec(execMsg: ExecServerMessage, redirectHint?: string): Uint8Array {
+  // Synchronous shellArgs needs the same admission fence as shellStreamArgs;
+  // changing wire shape must not bypass the missing descendant owner.
+  // Without a catalog hint, keep the default bridge redirect (#604) after the reason.
+  return rejectShellExecForPolicy(execMsg, foregroundShellUnavailableMessage(redirectHint ?? nativeShellDisabledMessage()));
 }
 
 export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage, hint?: string): Uint8Array[] {
@@ -178,7 +151,12 @@ export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage, hint?
   ];
 }
 
-export async function shellStreamExec(execMsg: ExecServerMessage): Promise<Uint8Array[]> {
+export async function shellStreamExec(
+  execMsg: ExecServerMessage,
+  owner?: CursorForegroundShellOwner,
+  signal?: AbortSignal,
+  redirectHint?: string,
+): Promise<Uint8Array[]> {
   if (execMsg.message.case !== "shellStreamArgs") throw new Error("invalid shell stream exec");
   const args = execMsg.message.value;
   const cwd = resolve(args.workingDirectory || process.cwd());
@@ -188,36 +166,13 @@ export async function shellStreamExec(execMsg: ExecServerMessage): Promise<Uint8
       event: { case: "start", value: create(ShellStreamStartSchema, { sandboxPolicy: args.requestedSandboxPolicy }) },
     })),
   ];
-  const result = await new Promise<{ stdout: string; stderr: string; code: number; aborted: boolean }>(resolvePromise => {
-    const child = spawn(args.command, { cwd, shell: true });
-    let stdout = "";
-    let stderr = "";
-    let aborted = false;
-    const timeout = setTimeout(() => {
-      aborted = true;
-      child.kill();
-    }, args.hardTimeout || 120_000);
-    child.stdout.on("data", chunk => {
-      stdout += String(chunk);
-    });
-    child.stderr.on("data", chunk => {
-      stderr += String(chunk);
-    });
-    child.on("close", code => {
-      clearTimeout(timeout);
-      resolvePromise({ stdout, stderr, code: code ?? 1, aborted });
-    });
-    child.on("error", err => {
-      clearTimeout(timeout);
-      resolvePromise({ stdout, stderr: stderr + errorText(err), code: 1, aborted });
-    });
-  });
-  if (result.stdout) {
+  const result = await runForegroundShell(args.command, cwd, args.hardTimeout ?? 120_000, owner, signal, redirectHint ?? nativeShellDisabledMessage());
+  if (result.stdout && !result.aborted) {
     replies.push(execBytes(execMsg, "shellStream", create(ShellStreamSchema, {
       event: { case: "stdout", value: create(ShellStreamStdoutSchema, { data: result.stdout }) },
     })));
   }
-  if (result.stderr) {
+  if (result.stderr && !result.aborted) {
     replies.push(execBytes(execMsg, "shellStream", create(ShellStreamSchema, {
       event: { case: "stderr", value: create(ShellStreamStderrSchema, { data: result.stderr }) },
     })));
@@ -237,7 +192,7 @@ export async function shellStreamExec(execMsg: ExecServerMessage): Promise<Uint8
             command: args.command,
             workingDirectory: cwd,
             exitCode: result.code,
-            signal: "",
+            signal: result.signal,
             stdout: result.stdout,
             stderr: result.stderr,
             executionTime: Date.now() - started,
@@ -251,7 +206,7 @@ export async function shellStreamExec(execMsg: ExecServerMessage): Promise<Uint8
             command: args.command,
             workingDirectory: cwd,
             exitCode: result.code,
-            signal: "",
+            signal: result.signal,
             stdout: result.stdout,
             stderr: result.stderr,
             executionTime: Date.now() - started,

package/src/adapters/cursor/native-exec.ts

@@ -1,3 +1,4 @@
+import type { CursorForegroundShellOwner } from "./native-foreground-shell";
 import { createHash } from "node:crypto";
 import { enforceAppOwnedMemoryBudget } from "../../lib/app-owned-memory";
 import { create } from "@bufbuild/protobuf";
@@ -66,6 +67,8 @@ export type CursorNativeExecDeps = CursorNativeNetworkDeps & CursorNativeToolDep
 export interface CursorNativeExecContext extends CursorNativeExecDeps {
   /** Stable owner for background shells created by this transport session. */
   sessionId?: string;
+  foregroundShellOwner?: CursorForegroundShellOwner;
+  signal?: AbortSignal;
   mcpToolDefs?: McpToolDefinition[];
   clientToolDefs?: McpToolDefinition[];
   /** Unsafe opt-in escape hatch for Cursor server-driven local fs/shell/fetch execution. */
@@ -706,8 +709,8 @@ export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: C
   if (execCase === "deleteArgs") return [deps.rejectNativeFileMutations ? rejectDeleteExecForApplyPatch(execMsg, deps.structuredEditAvailable === true) : deleteExec(execMsg)];
   if (execCase === "lsArgs") return [lsExec(execMsg)];
   if (execCase === "grepArgs") return [grepExec(execMsg)];
-  if (execCase === "shellArgs") return [shellExec(execMsg)];
-  if (execCase === "shellStreamArgs") return shellStreamExec(execMsg);
+  if (execCase === "shellArgs") return [shellExec(execMsg, deps.nativeExecRedirectHint)];
+  if (execCase === "shellStreamArgs") return shellStreamExec(execMsg, deps.foregroundShellOwner, deps.signal, deps.nativeExecRedirectHint);
   if (execCase === "backgroundShellSpawnArgs") return [backgroundShellSpawnExec(execMsg, deps.sessionId ?? "")];
   if (execCase === "writeShellStdinArgs") return [writeShellStdinExec(execMsg, deps.sessionId ?? "")];
   if (execCase === "fetchArgs") return [await fetchExec(execMsg, deps)];

package/src/adapters/cursor/native-foreground-shell.ts

@@ -0,0 +1,44 @@
+export interface ForegroundShellResult {
+  stdout: string;
+  stderr: string;
+  code: number;
+  aborted: boolean;
+  signal: string;
+}
+
+/** Keep the transport's shutdown fence even while foreground execution is unavailable. */
+export class CursorForegroundShellOwner {
+  private closed = false;
+
+  get activeCount(): number { return 0; }
+  get isClosed(): boolean { return this.closed; }
+
+  async close(): Promise<void> { this.closed = true; }
+}
+
+export function foregroundShellUnavailableMessage(redirectHint?: string): string {
+  return "Cursor foreground native shell is unavailable without kernel-backed descendant ownership. "
+    + (redirectHint ?? "Use the client shell tool instead.");
+}
+
+export function runForegroundShell(
+  _command: string,
+  _cwd: string,
+  _hardTimeout: number,
+  owner = new CursorForegroundShellOwner(),
+  signal?: AbortSignal,
+  redirectHint?: string,
+): Promise<ForegroundShellResult> {
+  // A POSIX process group is not a descendant owner: a child can leave it with
+  // setsid(), including after closing its inherited pipes. Windows needs a job
+  // object for the same lifetime guarantee. Neither backend exists here, so reject
+  // BEFORE spawn rather than reporting group disappearance as complete cleanup.
+  const cancelled = owner.isClosed || signal?.aborted;
+  return Promise.resolve({
+    stdout: "",
+    stderr: cancelled ? "Cursor shell cancelled." : foregroundShellUnavailableMessage(redirectHint),
+    code: 1,
+    aborted: true,
+    signal: "",
+  });
+}

package/src/adapters/devin/cloud-direct/chat.ts

@@ -1289,7 +1289,13 @@ export async function* streamChatEvents(req: CloudChatRequest): AsyncGenerator<C
     // The status line is carried on the error. A cap or an expired credential
     // delivered instead as a Connect EOS trailer is mapped by
     // connectTrailerHttpStatus at the trailer sites below.
-    throw new CloudChatError(`GetChatMessage failed (HTTP ${resp.status})`, undefined, undefined, resp.status);
+    const error = new CloudChatError(`GetChatMessage failed (HTTP ${resp.status})`, undefined, undefined, resp.status);
+    // No consumer will drain this body. Cancellation must neither replace the
+    // status error nor delay it if a transport's cancel promise never settles.
+    try {
+      void resp.body?.cancel(error).catch(() => undefined);
+    } catch { /* Non-conforming streams can throw synchronously from cancel. */ }
+    throw error;
   }
   if (!resp.body) {
     throw new CloudChatError('GetChatMessage response had no body stream');

package/src/adapters/exec-tool-result-normalize.ts

@@ -20,8 +20,11 @@
  * `function_call_output` is parsed with `isError: false`. Cursor combines this set with
  * `isFailedEmptyExecWrapper` below for Computer Use, where a failed wrapper is separately marked
  * `isError`.
+ *
+ * `(?=(X))\1` pins each wildcard run to its maximal match — without it, adjacent `\n+`/`\s*`
+ * runs can repartition a newline block combinatorially (the ReDoS shape this had before).
  */
-export const EMPTY_EXEC_OUTPUT_REGEX = /^(?:(?:Script completed|Command finished|Execution finished)[^\n]*\n+)?(?:Wall time[^\n]*\n+)?(?:Output:\s*)?(?:<empty>)?\s*$/;
+export const EMPTY_EXEC_OUTPUT_REGEX = /^(?:(?:Script completed|Command finished|Execution finished)(?=([^\n]*))\1(?=(\n+))\2)?(?:Wall time(?=([^\n]*))\3(?=(\n+))\4)?(?:Output:(?=(\s*))\5)?(?:<empty>)?(?=(\s*))\6$/;
 
 function skipFailedWrapperBlankSeparators(text: string, start: number): number {
   let index = start;

package/src/adapters/google.ts

@@ -456,6 +456,18 @@ function messagesToGeminiFormat(
     }
   }
 
+  // A functionCall turn may not open the request: the upstream requires it to follow a user or
+  // function-response turn, and rejects with "function call turn comes immediately after a user
+  // turn or after a function response turn" (HTTP 400, #5008). Context compaction can truncate a
+  // long history so it opens on an assistant tool call. Prepend a user nudge, the same repair
+  // Kiro applies to assistant-head turns (src/adapters/kiro/payload.ts). A model head carrying
+  // only text is left alone: no upstream rule against it is demonstrated, and repairing it would
+  // inject a turn into valid requests.
+  const firstTurn = contents[0] as { role?: string; parts?: Array<{ functionCall?: unknown }> } | undefined;
+  if (firstTurn?.role === "model" && firstTurn.parts?.some(p => p.functionCall !== undefined)) {
+    contents.unshift({ role: "user", parts: [{ text: "(continue)" }] });
+  }
+
   // Gemini API and Claude-on-Antigravity reject assistant-tail (model-tail in Gemini terms)
   // histories. Gemini fails upstream with "Requests ending with a model turn are not supported"
   // (HTTP 400), while Claude fails with "This model does not support assistant message prefill.

package/src/adapters/ollama-native.ts

@@ -88,6 +88,7 @@ interface NativeStreamToolCall {
   nativeIndex?: number;
   arguments: Record<string, unknown>;
   argumentBytes: number;
+  metadataBytes: number;
 }
 
 interface NativeStreamState {
@@ -106,6 +107,10 @@ type NativeReadResult = { done: false; value: Uint8Array } | { done: true; value
 
 const NATIVE_THINK_VALUES = new Set(["low", "medium", "high", "max"]);
 const NATIVE_TOOL_ID_MAX_LENGTH = 256;
+const NATIVE_TOOL_NAME_MAX_BYTES = 1024;
+const NATIVE_MAX_PENDING_TOOL_CALLS = 128;
+// Account for the retained Map key and call bookkeeping in addition to the provider's name.
+const NATIVE_TOOL_CALL_BOOKKEEPING_BYTES = 128;
 const NATIVE_TOOL_ID_CONTROL = /[\u0000-\u001f\u007f]/u;
 
 function isRecord(value: unknown): value is JsonRecord {
@@ -598,6 +603,10 @@ function nativeMessageEvents(message: JsonRecord, state: NativeStreamState, budg
       }
       const fn = rawCall.function;
       if (typeof fn.name !== "string" || !fn.name.trim()) throw new Error("ollama-native response tool call had no name");
+      const nameBytes = new TextEncoder().encode(fn.name).byteLength;
+      if (nameBytes > NATIVE_TOOL_NAME_MAX_BYTES) {
+        throw new Error(`ollama-native response tool call name exceeded ${NATIVE_TOOL_NAME_MAX_BYTES} bytes`);
+      }
       const args = assertObjectArguments(fn.arguments, "response tool call");
       const index = isFiniteNonNegativeInteger(fn.index) ? fn.index : undefined;
       const nativeId = validNativeToolCallId(rawCall.id);
@@ -610,6 +619,9 @@ function nativeMessageEvents(message: JsonRecord, state: NativeStreamState, budg
       if (!existing && !state.allowParallelToolCalls && state.toolCalls.size > 0) {
         throw new Error("ollama-native provider emitted parallel tool calls while parallelToolCalls:false was requested");
       }
+      if (!existing && state.toolCalls.size >= NATIVE_MAX_PENDING_TOOL_CALLS) {
+        throw new Error(`ollama-native response exceeded ${NATIVE_MAX_PENDING_TOOL_CALLS} pending tool calls`);
+      }
       if (existing) {
         if (existing.name !== fn.name) throw new Error("ollama-native response reused a tool-call index for another function");
         if (nativeId && existing.nativeId && nativeId !== existing.nativeId) {
@@ -627,12 +639,25 @@ function nativeMessageEvents(message: JsonRecord, state: NativeStreamState, budg
           ...(index !== undefined ? { nativeIndex: index } : {}),
           arguments: args,
           argumentBytes: 0,
+          metadataBytes: 0,
         };
         budget.openCall(call.budgetKey);
         try {
+          const metadataBytes = nameBytes + NATIVE_TOOL_CALL_BOOKKEEPING_BYTES;
+          // Name and bookkeeping are retained call metadata, not arguments: charging them to the
+          // call's budget key would consume the per-call argument allowance. Keep them on the
+          // shared retained budget and release them when the call closes.
+          budget.chargeRetained(metadataBytes, {
+            kind: "tool_args",
+          });
+          call.metadataBytes = metadataBytes;
           replaceNativeToolArguments(call, args, budget);
           state.toolCalls.set(key, call);
         } catch (error) {
+          if (call.metadataBytes > 0) {
+            budget.releaseRetained(call.metadataBytes, { kind: "tool_args" });
+            call.metadataBytes = 0;
+          }
           budget.closeCall(call.budgetKey);
           throw error;
         }
@@ -687,7 +712,13 @@ function replaceNativeToolArguments(
 }
 
 function releaseNativeStateBuffers(state: NativeStreamState, budget: TranslatorBudget): void {
-  for (const call of state.toolCalls.values()) budget.closeCall(call.budgetKey);
+  for (const call of state.toolCalls.values()) {
+    if (call.metadataBytes > 0) {
+      budget.releaseRetained(call.metadataBytes, { kind: "tool_args" });
+      call.metadataBytes = 0;
+    }
+    budget.closeCall(call.budgetKey);
+  }
 }
 
 function nativeBodyMessage(value: unknown): JsonRecord {