@bitkyc08/opencodex 2.67.0 → 2.68.0-preview.20260927

package/src/adapters/physical-send.ts

@@ -2,9 +2,14 @@ import type { AdapterFetchContext } from "./base";
 import type { SendClass } from "../lib/request-execution-budget";
 import type { AttemptRecoveryKind } from "../usage/log";
 import { abortError, SendBudgetExhaustedError } from "../lib/upstream-retry";
+import {
+  releaseProviderRequestSlot,
+  sendTrackingRequestSlot,
+  type ProviderRequestSlot,
+} from "../providers/request-pacing";
 
 type PacedFetch = typeof globalThis.fetch & {
-  waitForPacing?: (signal?: AbortSignal) => Promise<void>;
+  waitForPacing?: (signal?: AbortSignal) => Promise<ProviderRequestSlot | void>;
   unpacedFetch?: typeof globalThis.fetch;
 };
 
@@ -37,13 +42,15 @@ export function createAdapterPhysicalSend(ctx: AdapterFetchContext = {}, fallbac
       ctx.onPhysicalSend?.({ ordinal, ...(options.recovery ? { recovery: options.recovery } : {}) });
       return (executor.unpacedFetch ?? executor)(input, init);
     }) as typeof globalThis.fetch;
+    let slot: ProviderRequestSlot | undefined;
     try {
-      await executor.waitForPacing?.(ctx.abortSignal);
+      slot = (await executor.waitForPacing?.(ctx.abortSignal)) || undefined;
       if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
       await options.beforeDispatch?.();
       if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
-      return await options.dispatch(physicalExecutor);
+      return await sendTrackingRequestSlot(slot, () => options.dispatch(physicalExecutor));
     } finally {
+      releaseProviderRequestSlot(slot);
       permit?.release();
     }
   };

package/src/adapters/registry.ts

@@ -3,6 +3,7 @@ import { createAzureAdapter } from "./azure";
 import type { ProviderAdapter } from "./base";
 import { createClaudeCliAdapter } from "./claude-cli/adapter";
 import { withClinePassDeepSeekV4ToolReplayCompatibility } from "./cline-pass-deepseek-v4-tool-replay";
+import { withUniqueToolCallIds } from "./unique-tool-call-ids";
 import { createCodeBuddyAdapter } from "./codebuddy/adapter";
 import { createQoderAdapter } from "./qoder/adapter";
 import { createCommandCodeAdapter } from "./command-code";
@@ -84,7 +85,7 @@ export const ADAPTER_REGISTRY = {
     wire: "openai-chat",
     mutation: "codex-owned",
     create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) =>
-      withClinePassDeepSeekV4ToolReplayCompatibility(createOpenAIChatAdapter(provider)),
+      withUniqueToolCallIds(withClinePassDeepSeekV4ToolReplayCompatibility(createOpenAIChatAdapter(provider))),
   },
   "ollama-native": {
     wire: "ollama-native",

package/src/adapters/responses-tool-schema.ts

@@ -96,9 +96,32 @@ function usesUnicodePropertyEscape(pattern: string): boolean {
   return false;
 }
 
+/**
+ * Rewrite each unescaped `\0` not followed by a digit to the equivalent `\x00`. Both spell NUL
+ * in ECMAScript and Python `re`, but some destinations' schema validators refuse `\0` inside a
+ * character class: Meta's Responses API answers 400 "is not a \"regex\"" to Claude Code's
+ * Artifact tool, whose file-path parameters carry `^[^\0]*$`. `\0` followed by a digit is an
+ * octal escape in Python, so it is left alone. Returns the input when nothing changed.
+ */
+function rewriteNulEscapes(pattern: string): string {
+  let out: string | undefined;
+  let copied = 0;
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "\\") continue;
+    const next = pattern[i + 1];
+    if (next === "0" && !/[0-9]/.test(pattern[i + 2] ?? "")) {
+      out = (out ?? "") + pattern.slice(copied, i) + "\\x00";
+      copied = i + 2;
+    }
+    i++;
+  }
+  return out === undefined ? pattern : out + pattern.slice(copied);
+}
+
 /**
  * Remove unsupported Unicode property escapes from scalar `pattern` constraints in ordinary
- * positive schema positions. This keeps built-in Artifact tools usable on Python-re backends;
+ * positive schema positions, and spell `\0` as `\x00` (rewriteNulEscapes). This keeps built-in
+ * Artifact tools usable on Python-re backends and on Meta's Responses API;
  * the omitted constraint is not enforced by this proxy and tools must validate their inputs.
  *
  * Regex-keyed objects are preserved. Removing a matcher can lose evaluated-property annotations
@@ -181,8 +204,13 @@ export function stripUnicodePropertyPatterns(node: unknown, inNameBag = false):
       continue;
     }
     const [key, value] = next.value;
-    if (!frame.inNameBag && key === "pattern" && typeof value === "string" && usesUnicodePropertyEscape(value)) {
-      delete (cloneContainer(frame) as Record<string, unknown>)[key];
+    if (!frame.inNameBag && key === "pattern" && typeof value === "string") {
+      if (usesUnicodePropertyEscape(value)) {
+        delete (cloneContainer(frame) as Record<string, unknown>)[key];
+        continue;
+      }
+      const rewritten = rewriteNulEscapes(value);
+      if (rewritten !== value) (cloneContainer(frame) as Record<string, unknown>)[key] = rewritten;
       continue;
     }
     if (!frame.inNameBag && (PRESERVED_PATTERN_SUBTREES.has(key) || SCHEMA_LITERAL_VALUE_KEYS.has(key))) {

package/src/adapters/run-turn-queue.ts

@@ -132,14 +132,22 @@ export interface AdapterEventPreflight {
   error?: Extract<AdapterEvent, { type: "error" }>;
   empty: boolean;
   replayUnsafe: boolean;
+  ready?: boolean;
+  timedOut?: boolean;
 }
 
 async function* replay(
   buffered: readonly AdapterEvent[],
   iterator: AsyncIterator<AdapterEvent>,
+  pendingNext?: Promise<IteratorResult<AdapterEvent>>,
 ): AsyncGenerator<AdapterEvent> {
   try {
     for (const event of buffered) yield event;
+    if (pendingNext) {
+      const next = await pendingNext;
+      if (next.done) return;
+      yield next.value;
+    }
     while (true) {
       const next = await iterator.next();
       if (next.done) return;
@@ -153,31 +161,61 @@ async function* replay(
 export async function preflightAdapterEvents(
   source: AsyncIterable<AdapterEvent>,
   classifyFirstEvent?: (event: AdapterEvent) => Extract<AdapterEvent, { type: "error" }> | undefined,
+  options?: { maxWaitMs?: number; honorReady?: boolean },
 ): Promise<AdapterEventPreflight> {
   const iterator = source[Symbol.asyncIterator]();
   const buffered: AdapterEvent[] = [];
   let replayUnsafe = false;
-  while (true) {
-    const next = await iterator.next();
-    if (next.done) return { stream: replay(buffered, iterator), empty: true, replayUnsafe };
-    if (next.value.type === "heartbeat") {
-      replayUnsafe ||= next.value.replayUnsafe === true;
+  const maxWaitMs = options?.maxWaitMs;
+  if (maxWaitMs !== undefined && maxWaitMs <= 0) {
+    return { stream: replay(buffered, iterator), empty: false, replayUnsafe, timedOut: true };
+  }
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  let timeoutPromise: Promise<"timeout"> | undefined;
+  if (maxWaitMs !== undefined) {
+    timeoutPromise = new Promise(resolve => {
+      timeout = setTimeout(() => resolve("timeout"), maxWaitMs);
+    });
+  }
+  try {
+    while (true) {
+      const pendingNext = iterator.next();
+      const raced = timeoutPromise ? await Promise.race([pendingNext, timeoutPromise]) : await pendingNext;
+      if (raced === "timeout") {
+        return {
+          stream: replay(buffered, iterator, pendingNext),
+          empty: false,
+          replayUnsafe,
+          timedOut: true,
+        };
+      }
+      const next = raced;
+      if (next.done) return { stream: replay(buffered, iterator), empty: true, replayUnsafe };
+      if (next.value.type === "heartbeat") {
+        replayUnsafe ||= next.value.replayUnsafe === true;
+        // Preserve the latch in replay even after the original unsafe heartbeat is evicted.
+        buffered.push(replayUnsafe ? { ...next.value, replayUnsafe: true } : next.value);
+        if (next.value.preflightReady === true && options?.honorReady !== false) {
+          return { stream: replay(buffered, iterator), empty: false, replayUnsafe, ready: true };
+        }
+        if (buffered.length > PREFLIGHT_HEARTBEAT_RETAIN_LIMIT) buffered.shift();
+        continue;
+      }
+      const classifiedError = replayUnsafe ? undefined : classifyFirstEvent?.(next.value);
+      if (classifiedError) {
+        buffered.push(classifiedError);
+        await iterator.return?.();
+        return { stream: replay(buffered, iterator), error: classifiedError, empty: false, replayUnsafe };
+      }
       buffered.push(next.value);
-      if (buffered.length > PREFLIGHT_HEARTBEAT_RETAIN_LIMIT) buffered.shift();
-      continue;
-    }
-    const classifiedError = replayUnsafe ? undefined : classifyFirstEvent?.(next.value);
-    if (classifiedError) {
-      buffered.push(classifiedError);
-      await iterator.return?.();
-      return { stream: replay(buffered, iterator), error: classifiedError, empty: false, replayUnsafe };
-    }
-    buffered.push(next.value);
-    if (next.value.type === "error") {
-      await iterator.return?.();
-      return { stream: replay(buffered, iterator), error: next.value, empty: false, replayUnsafe };
+      if (next.value.type === "error") {
+        await iterator.return?.();
+        return { stream: replay(buffered, iterator), error: next.value, empty: false, replayUnsafe };
+      }
+      return { stream: replay(buffered, iterator), empty: false, replayUnsafe };
     }
-    return { stream: replay(buffered, iterator), empty: false, replayUnsafe };
+  } finally {
+    if (timeout !== undefined) clearTimeout(timeout);
   }
 }
 
@@ -221,10 +259,12 @@ export function createAdapterEventQueue(opts?: {
       // marker is not ordering — it is a latch. Dropping the incoming event
       // would discard the only record that Cursor already performed a local
       // side effect, and preflight would then permit an OAuth replay of it.
-      if (event.replayUnsafe === true && tail.replayUnsafe !== true) {
-        return { type: "heartbeat", replayUnsafe: true };
-      }
-      return tail;
+      if (event.replayUnsafe !== true && event.preflightReady !== true) return tail;
+      return {
+        type: "heartbeat",
+        ...(tail.replayUnsafe === true || event.replayUnsafe === true ? { replayUnsafe: true as const } : {}),
+        ...(tail.preflightReady === true || event.preflightReady === true ? { preflightReady: true as const } : {}),
+      };
     }
     if (event.type === "text_delta" && tail.type === "text_delta" && tail.phase === event.phase) {
       if (tail.text.length + event.text.length > COALESCE_MAX_CHUNK_LENGTH) return null;

package/src/adapters/unique-tool-call-ids.ts

@@ -0,0 +1,63 @@
+import type { ProviderAdapter } from "./base";
+import type { AdapterEvent, OcxMessage } from "../types";
+import { createToolCallIdReminter, reservedToolCallIdsFromHistory } from "./openai-chat/tool-call-id-remint";
+
+/**
+ * Give every tool call in a conversation a wire id the client has not already stored.
+ *
+ * The openai-chat adapter forwards `tool_calls[].id` upstream-verbatim, which is correct for an
+ * upstream that mints a fresh random id per call. An upstream that derives the id from the call's
+ * position in its response mints the same `call-0-0` on every turn. The client has already paired
+ * that id with an earlier call, so it drops the duplicate; the dropped call has no result, the turn
+ * reads as an assistant message with no content, and the model re-issues the same call forever.
+ *
+ * Applied as a wrapper rather than inside the adapter so the adapter's own id handling stays
+ * untouched, matching how this repository already scopes a wire-compatibility policy
+ * (`withClinePassDeepSeekV4ToolReplayCompatibility`).
+ *
+ * Reminting happens at emission — on the events the adapter yields — never at ingestion: ingestion
+ * matches streamed deltas and continuation fragments against the id the upstream sent, so rewriting
+ * there would strip a pending call of its own identity mid-stream. The ids to avoid come from the
+ * caller's own history, captured where the request is built because that is the only point that sees
+ * the inbound conversation; the client is the authority on which ids are taken, since it is the side
+ * that discards the duplicates the proxy would otherwise never observe.
+ *
+ * The first occurrence of an id is emitted byte-identical, so prompt-cache keys, reasoning-replay
+ * lookups, and upstreams that already mint unique ids are unaffected.
+ */
+export function withUniqueToolCallIds(adapter: ProviderAdapter): ProviderAdapter {
+  // Set where the request is built and consumed by the two emission paths below — the same
+  // build-into-parse handoff the openai-chat adapter already uses for its requested model id. The
+  // identity default means a parse that runs without a build cannot fail: it has no history to
+  // collide with.
+  let remintToolCallId: (rawId: string) => string = id => id;
+
+  const remintEvents = (events: AdapterEvent[]): AdapterEvent[] =>
+    events.map(event => event.type === "tool_call_start" ? { ...event, id: remintToolCallId(event.id) } : event);
+
+  return {
+    ...adapter,
+
+    async buildRequest(parsed, incoming) {
+      const history: OcxMessage[] | undefined = parsed.context?.messages;
+      remintToolCallId = createToolCallIdReminter(
+        Array.isArray(history) ? reservedToolCallIdsFromHistory(history) : [],
+      );
+      return adapter.buildRequest(parsed, incoming);
+    },
+
+    async *parseStream(response, budget, tierMetadata): AsyncGenerator<AdapterEvent> {
+      for await (const event of adapter.parseStream(response, budget, tierMetadata)) {
+        yield event.type === "tool_call_start" ? { ...event, id: remintToolCallId(event.id) } : event;
+      }
+    },
+
+    ...(adapter.parseResponse
+      ? {
+        async parseResponse(response, budget, tierMetadata) {
+          return remintEvents(await adapter.parseResponse!(response, budget, tierMetadata));
+        },
+      }
+      : {}),
+  };
+}

package/src/adapters/xai-web-search.ts

@@ -1,6 +1,7 @@
 import type { OcxProviderConfig } from "../types";
 import { debugProviderDiagnostic } from "../lib/debug";
 import { isXaiResponsesDestination } from "../providers/xai-transport";
+import { isOpenCodeGoResponsesUrl } from "./opencode-go-additional-tools";
 
 const CODEX_WEB_SEARCH_TOOL = "web_search";
 const CODEX_WEB_SEARCH_PREVIEW_TOOL = "web_search_preview";
@@ -146,6 +147,24 @@ function hasToolType(tools: unknown, type: string): boolean {
   return Array.isArray(tools) && tools.some(tool => isPlainObject(tool) && tool.type === type);
 }
 
+/**
+ * OpenCode Go serves Grok on its Responses endpoint by relaying to xAI, and relays xAI's schema
+ * verbatim. Probed 2026-09-26 on `https://opencode.ai/zen/go/v1/responses` with grok-4.6 and
+ * grok-4.7, one field per request: `external_web_access` and `search_context_size` -> 400
+ * "Argument not supported", `web_search_preview` -> 422 `unknown variant`, while a plain
+ * `web_search` with `search_content_types`, `enable_image_search`, `user_location` or
+ * `filters` -> 200 and performs live searches. That is the xAI dialect exactly, so the same
+ * normalization applies. Sibling Go models (Luna, Muse Spark) accept the OpenAI fields and are
+ * left alone. Membership is by family prefix: an exact-id match is what let grok-4.7 reach this
+ * endpoint unnormalized once it joined grok-4.6 on the Responses wire.
+ */
+function isOpenCodeGoGrokResponses(modelId: unknown, responseUrl: string | undefined): boolean {
+  return typeof modelId === "string"
+    && modelId.trim().toLowerCase().startsWith("grok-")
+    && typeof responseUrl === "string"
+    && isOpenCodeGoResponsesUrl(responseUrl);
+}
+
 /**
  * Make Codex's hosted web-search declaration acceptable to xAI Responses without changing other
  * providers or mutating the caller-owned request body.
@@ -157,12 +176,23 @@ function hasToolType(tools: unknown, type: string): boolean {
  * `web_search_preview` -> 422 `unknown variant`, `external_web_access` -> 400 on every value,
  * `search_context_size` -> 400, while `user_location` and `search_content_types` -> 200. Identical
  * to the public API, which is what makes one shared gate correct.
+ *
+ * Grok models on the exact OpenCode Go Responses URL speak the same dialect and share this gate;
+ * see `isOpenCodeGoGrokResponses`. `target` carries the final model id and request URL for that
+ * check, and callers without it keep the xAI-host-only behavior.
  */
 export function normalizeXaiResponsesWebSearch(
   body: unknown,
   provider: Pick<OcxProviderConfig, "baseUrl">,
+  target?: { modelId?: unknown; responseUrl?: string },
 ): unknown {
-  if (!isXaiResponsesDestination(provider) || !isPlainObject(body)) return body;
+  if (!isPlainObject(body)) return body;
+  const xaiDestination = isXaiResponsesDestination(provider);
+  if (!xaiDestination && !isOpenCodeGoGrokResponses(target?.modelId, target?.responseUrl)) return body;
+  // On Go, a wrapper emptied here stays in place: Go promotion (opencode-go-additional-tools.ts)
+  // removes every wrapper before the wire and splits them into history and current turn by
+  // index against _replayPrefixLen, so deleting one would shift the current turn into history.
+  const keepEmptiedWrappers = !xaiDestination;
 
   let next: Record<string, unknown> = body;
   if (Array.isArray(body.tools)) {
@@ -188,7 +218,7 @@ export function normalizeXaiResponsesWebSearch(
         continue;
       }
       inputChanged = true;
-      if (rewritten.tools.length > 0) input.push({ ...item, tools: rewritten.tools });
+      if (rewritten.tools.length > 0 || keepEmptiedWrappers) input.push({ ...item, tools: rewritten.tools });
     }
     if (inputChanged) next = { ...next, input };
   }

package/src/bridge/sse.ts

@@ -73,6 +73,12 @@ export function bridgeToResponsesSSE(
   options?: {
     responseId?: string;
     stallTimeoutSec?: number;
+    /**
+     * The upstream is local infrastructure (loopback / private / `.local` / `.lan`); an unset
+     * `stallTimeoutSec` then resolves to disabled so a slow local model is not cut mid-turn.
+     * Wire keep-alives still re-arm the client's idle clock either way.
+     */
+    localUpstream?: boolean;
     hideThinkingSummary?: boolean;
     /**
      * Remote compaction v2 turn: accumulate all assistant text and, on done, emit ONE synthetic
@@ -341,7 +347,9 @@ export function bridgeToResponsesSSE(
         ? encoder.encode(': opencodex heartbeat\n\n')
         : encoder.encode('event: response.heartbeat\ndata: {"type":"response.heartbeat"}\n\n');
       let stallTicks = 0;
-      const stallSec = resolveStallTimeoutSec(options?.stallTimeoutSec);
+      const stallSec = resolveStallTimeoutSec(options?.stallTimeoutSec, {
+        localUpstream: options?.localUpstream,
+      });
       const maxStallTicks = Math.ceil((stallSec * 1000) / heartbeatMs);
 
       let currentMsg: {
@@ -1407,7 +1415,11 @@ export function bridgeToResponsesSSE(
           if (upstreamActivity) {
             upstreamActivity = false;
             stallTicks = 0;
-          } else if (++stallTicks >= maxStallTicks) {
+          } else if (stallSec > 0 && ++stallTicks >= maxStallTicks) {
+            // stallSec of 0 is an explicit disabled budget (local upstream, or the operator's
+            // stallTimeoutSec: 0). Never let `maxStallTicks === 0` arm a kill on the first beat:
+            // with it the `>= 0` comparison is true the moment a single tick lands, which would
+            // terminate a healthy silent local model after ~2s instead of leaving it alone.
             if (!attemptTerminationCleanup(() => {
               if (currentMsg) closeCurrentMessage();
               if (currentReasoning) closeCurrentReasoning();

package/src/chat/inbound.ts

@@ -57,11 +57,21 @@ function contentToText(content: unknown): string {
 // route-eligibility predicate and this translator cannot drift apart again.
 const imageUrlFromPart = chatImageUrlFromPart;
 
-function videoUrlFromPart(part: Rec): string | null {
+/**
+ * A caller's video part, with the `processing` mode Gemini's agentic video
+ * understanding is requested by (#3271). The object form is the only one that
+ * can carry it — `video_url` as a bare string has nowhere to put it.
+ */
+function videoFromPart(part: Rec): { url: string; processing?: string } | null {
   if (part.type !== "video_url") return null;
   const videoUrl = part.video_url;
-  if (typeof videoUrl === "string" && videoUrl.length > 0) return videoUrl;
-  if (isRec(videoUrl) && typeof videoUrl.url === "string" && videoUrl.url.length > 0) return videoUrl.url;
+  if (typeof videoUrl === "string" && videoUrl.length > 0) return { url: videoUrl };
+  if (isRec(videoUrl) && typeof videoUrl.url === "string" && videoUrl.url.length > 0) {
+    const processing = typeof videoUrl.processing === "string" && videoUrl.processing.length > 0
+      ? videoUrl.processing
+      : undefined;
+    return { url: videoUrl.url, ...(processing ? { processing } : {}) };
+  }
   return null;
 }
 
@@ -91,9 +101,13 @@ function userContentToBlocks(content: unknown): Rec[] {
       });
       continue;
     }
-    const videoUrl = videoUrlFromPart(raw);
-    if (videoUrl) {
-      blocks.push({ type: "input_video", video_url: videoUrl });
+    const video = videoFromPart(raw);
+    if (video) {
+      blocks.push({
+        type: "input_video",
+        video_url: video.url,
+        ...(video.processing ? { processing: video.processing } : {}),
+      });
       continue;
     }
     const file = fileFromPart(raw);

package/src/claude/agents-inject.ts

@@ -23,6 +23,7 @@ import { effectiveBlockedSkillNames, resolveInboundModel } from "./inbound";
 import { AnthropicRequestError } from "./inbound-records";
 import { knownModelIdsForProvider } from "../router";
 import { decodeRoutedModelIdOrThrow } from "../providers/slug-codec";
+import { siblingOfLivePort } from "../codex/sibling-start";
 
 export interface ClaudeAgentDef {
   file: string;
@@ -285,6 +286,9 @@ export function injectClaudeAgentDefs(
   /** Hub-sourced roster on a connected client; see `buildClaudeAgentDefs`. */
   rosterOverride?: readonly string[],
 ): string[] | null {
+  // `~/.claude/agents` is shared with the live proxy a sibling instance runs beside, which owns
+  // both its roster and its pruning (`src/codex/sibling-start.ts`).
+  if (siblingOfLivePort() !== null) return null;
   if (config.claudeCode?.enabled === false || config.claudeCode?.injectAgents === false) {
     // Disabled: prune verified-owned files so stale definitions stop loading
     // in future sessions (audit 071 #3). The roster override is irrelevant here by

package/src/claude/desktop-3p.ts

@@ -193,8 +193,26 @@ function collectDesktop3pModels(
     const rendered = renderDesktopProfile(reconciled, profileModels);
     const aliasesByRoute = new Map<string, string>();
     for (const model of rendered) {
+      const realAnthropic = model.route.startsWith("anthropic/claude-");
+      if (!realAnthropic && realAnthropicIds.has(model.name)) {
+        console.warn(`[opencodex] Claude Desktop profile alias ${model.name} for ${model.route} conflicts with a real Anthropic model; skipping the routed model`);
+        continue;
+      }
       aliasesByRoute.set(model.route, model.name);
-      if (!model.route.startsWith("anthropic/claude-")) registry.set(model.name, model.route);
+      if (!realAnthropic) {
+        registry.set(model.name, model.route);
+        // Profiles persist their historical date slots, while Desktop receives
+        // a non-date wire id. Keep the date form resolvable for running/stale
+        // sessions during the migration.
+        const storedAlias = reconciled.assignments[model.route]?.alias;
+        if (storedAlias && storedAlias !== model.name) {
+          if (realAnthropicIds.has(storedAlias)) {
+            console.warn(`[opencodex] Claude Desktop stored alias ${storedAlias} for ${model.route} conflicts with a real Anthropic model; ignoring the alias`);
+          } else {
+            registry.set(storedAlias, model.route);
+          }
+        }
+      }
       models.push({
         name: model.name,
         labelOverride: model.label,
@@ -203,25 +221,33 @@ function collectDesktop3pModels(
         ...(model.supports1m ? { supports1m: true, prefer1m: true } : {}),
       });
     }
-    // Legacy hashes are compatibility-only and can collide. Bind them in stable route order so
-    // changing a family default or rendered ordering can never silently rebind an old Desktop id.
+    // Hash aliases from both pre-profile generations are compatibility-only and can
+    // collide. Bind them in stable route order so changing a family default or
+    // rendered ordering can never silently rebind an old Desktop id.
     for (const model of [...rendered].sort((a, b) => a.route.localeCompare(b.route))) {
       if (model.route.startsWith("anthropic/claude-")) continue;
       const providerEnd = model.route.indexOf("/");
       const provider = model.route.slice(0, providerEnd);
       const id = model.route.slice(providerEnd + 1);
-      const legacy = legacyDesktop3pAlias(provider, id);
-      const existing = registry.get(legacy);
-      if (existing && existing !== model.route) {
-        console.warn(`[opencodex] Claude Desktop legacy alias collision: ${legacy} stays bound to ${existing}; ignoring ${model.route}`);
-        continue;
+      for (const legacy of [desktop3pAlias(provider, id), legacyDesktop3pAlias(provider, id)]) {
+        if (realAnthropicIds.has(legacy)) {
+          console.warn(`[opencodex] Claude Desktop legacy alias ${legacy} for ${model.route} conflicts with a real Anthropic model; ignoring the alias`);
+          continue;
+        }
+        const existing = registry.get(legacy);
+        if (existing && existing !== model.route) {
+          console.warn(`[opencodex] Claude Desktop legacy alias collision: ${legacy} stays bound to ${existing}; ignoring ${model.route}`);
+          continue;
+        }
+        registry.set(legacy, model.route);
       }
-      registry.set(legacy, model.route);
     }
     desktop3pAliasesByRoute = aliasesByRoute;
     return { models, registry, realAnthropicIds };
   }
 
+  const aliasesByRoute = new Map<string, string>();
+  const emittedNames = new Set<string>();
   for (const { provider, id, contextWindow } of candidates) {
     const route = `${provider}/${id}`;
     const alias = desktop3pAlias(provider, id);
@@ -232,13 +258,20 @@ function collectDesktop3pModels(
       // Real Anthropic model: keep it OUT of the decode registry — registering it would
       // make resolveInboundModel() non-identity and kill the sk-ant native passthrough
       // (audit 133 #1). It still appears in the static Desktop model list below.
+      if (emittedNames.has(alias)) continue;
       models.push({
         name: alias,
         labelOverride: `${displayModelId(id)} (${provider})`,
         anthropicFamilyTier: "opus",
         ...supports1m,
-      ...(supports1m.supports1m ? { prefer1m: true as const } : {}),
+        ...(supports1m.supports1m ? { prefer1m: true as const } : {}),
       });
+      emittedNames.add(alias);
+      aliasesByRoute.set(route, alias);
+      continue;
+    }
+    if (realAnthropicIds.has(alias)) {
+      console.warn(`[opencodex] Claude Desktop 3P alias ${alias} for ${route} conflicts with a real Anthropic model; skipping the routed model`);
       continue;
     }
     const existingRoute = registry.get(alias);
@@ -250,7 +283,11 @@ function collectDesktop3pModels(
     registry.set(alias, route);
     // Back-compat decode for Desktop configs written before the opus-4-8 rename.
     const legacy = legacyDesktop3pAlias(provider, id);
-    if (!registry.has(legacy)) registry.set(legacy, route);
+    if (realAnthropicIds.has(legacy)) {
+      console.warn(`[opencodex] Claude Desktop legacy alias ${legacy} for ${route} conflicts with a real Anthropic model; ignoring the alias`);
+    } else if (!registry.has(legacy)) {
+      registry.set(legacy, route);
+    }
     models.push({
       name: alias,
       labelOverride: `${displayModelId(id)} (${provider})`,
@@ -258,10 +295,11 @@ function collectDesktop3pModels(
       ...supports1m,
       ...(supports1m.supports1m ? { prefer1m: true as const } : {}),
     });
+    aliasesByRoute.set(route, alias);
   }
 
   if (models[0]) models[0].isFamilyDefault = true;
-  desktop3pAliasesByRoute = new Map(candidates.map(({ provider, id }) => [`${provider}/${id}`, desktop3pAlias(provider, id)]));
+  desktop3pAliasesByRoute = aliasesByRoute;
   return { models, registry, realAnthropicIds };
 }
 
@@ -308,7 +346,9 @@ export function isUnresolvedDesktop3pAlias(id: string): boolean {
   // identity only; it neither enables a tier nor strips an exact full catalog ID.
   const base = id.endsWith("--fast") ? id.slice(0, -"--fast".length) : id;
   if (isKnownDesktop3pModelId(base)) return false;
-  return validDateAlias(base) || /^claude-opus-4-(?:8-)?[a-z][a-z0-9]{2}$/.test(base);
+  return validDateAlias(base)
+    || /^claude-opus-4-(?:8-)?[a-z][a-z0-9]{2}$/.test(base)
+    || /^claude-opus-4-8-p[0-9a-z]{3}$/.test(base);
 }
 
 /** Alias selected by the installed profile registry, falling back to the legacy hash shape. */

package/src/claude/desktop-profile.ts

@@ -28,9 +28,11 @@ export interface RenderedDesktopModel extends DesktopProfileModel {
 // design, so the set only grows). Years before 2026 stay rejected: dated
 // ids like `claude-opus-4-8-20250201` are real model snapshot ids, not
 // managed aliases, and the inbound decoder relies on that distinction.
-// Every emitted suffix stays 8 digits so modelMap date-stripping keeps
-// working.
+// The persisted slot stays date-shaped for stable allocation and migration.
+// renderDesktopProfile() converts it to a letter-first wire id because current
+// Claude Desktop strips terminal dates before comparing model identities.
 const DATE_ALIAS = /^claude-opus-4-8-(202[6-9]\d{4}|203[0-5]\d{4})$/;
+const PROFILE_WIRE_PREFIX = "claude-opus-4-8-";
 const LEGACY_YEAR = 2026;
 const LEGACY_DAY_COUNT = 365;
 const ALIAS_FIRST_YEAR = 2026;
@@ -123,6 +125,24 @@ export function validDateAlias(alias: string): boolean {
   return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
 }
 
+/**
+ * Turn a persisted date slot into a unique non-date Desktop wire id.
+ *
+ * The 2026-2035 namespace has fewer than 3,888 days, so a `p`-prefixed
+ * three-character base36 slot has ample room. The four-character suffix is
+ * disjoint from both terminal dates and the historical three-character hash
+ * namespace used by profiles written before this allocator existed.
+ */
+export function desktopProfileWireAlias(alias: string): string {
+  const match = DATE_ALIAS.exec(alias);
+  if (!match || !validDateAlias(alias)) return alias;
+  const year = Number(match[1]!.slice(0, 4));
+  const month = Number(match[1]!.slice(4, 6));
+  const day = Number(match[1]!.slice(6, 8));
+  const slot = Math.round((Date.UTC(year, month - 1, day) - Date.UTC(ALIAS_FIRST_YEAR, 0, 1)) / 86_400_000);
+  return `${PROFILE_WIRE_PREFIX}p${slot.toString(36).padStart(3, "0")}`;
+}
+
 export function parseDesktopProfile(value: unknown): DesktopProfile {
   if (!isPlainObject(value)) throw new DesktopProfileError("must be an object");
   // `appliedFingerprint`/`appliedAt` are written back by the apply route once a profile
@@ -235,7 +255,24 @@ export function reconcileDesktopProfile(
   const assignments: DesktopProfile["assignments"] = Object.fromEntries(
     Object.entries(profile.assignments).map(([route, assignment]) => [route, { ...assignment }]),
   );
-  const used = new Set(Object.values(assignments).map(value => value.alias));
+  const activeRealAliases = new Set(models
+    .filter(model => isRealAnthropicRoute(model.route))
+    .map(model => routeModelId(model.route)));
+  const displacedRoutes = Object.entries(assignments)
+    .filter(([route, assignment]) => !isRealAnthropicRoute(route) && activeRealAliases.has(assignment.alias))
+    .map(([route]) => route)
+    .sort();
+  const displaced = new Set(displacedRoutes);
+  const used = new Set(Object.entries(assignments)
+    .filter(([route]) => !displaced.has(route))
+    .map(([, assignment]) => assignment.alias));
+  for (const alias of activeRealAliases) used.add(alias);
+  for (const route of displacedRoutes) {
+    const assignment = assignments[route]!;
+    const alias = allocateAlias(route, used);
+    used.add(alias);
+    assignments[route] = { ...assignment, alias };
+  }
   for (const model of [...models].sort((a, b) => a.route.localeCompare(b.route))) {
     if (assignments[model.route]) continue;
     const alias = allocateAlias(model.route, used);
@@ -319,7 +356,7 @@ export function renderDesktopProfile(
     const assignment = parsed.assignments[route]!;
     return {
       ...model,
-      name: assignment.alias,
+      name: isRealAnthropicRoute(route) ? assignment.alias : desktopProfileWireAlias(assignment.alias),
       family: assignment.family,
       isFamilyDefault: effectiveDefaults[assignment.family] === route,
       supports1m: typeof model.contextWindow === "number" && model.contextWindow >= 1_000_000,