@bitkyc08/opencodex 2.68.0 → 2.69.0

package/src/adapters/coding-agent/turn.ts

@@ -3,6 +3,7 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../types";
+import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
 import { commandInvocation } from "../../lib/win-exec";
 import { isStandaloneBinary } from "../../lib/standalone";
 import { modelRecordValue } from "../../reasoning-effort";
@@ -10,9 +11,11 @@ import type { IncomingMeta } from "../base";
 import {
   buildConversationInput,
   CodingAgentProtocolError,
+  MAX_TOOL_BLOCK_STARTS,
   mapStreamMessageToEvents,
   projectedHistoryCharLimit,
   readJsonLines,
+  releaseOpenToolBlocks,
   toolBridgeInitError,
   type StreamParseState,
 } from "./protocol";
@@ -369,6 +372,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   };
 
   let streamProtocolError: string | undefined;
+  let streamProtocolCode: string | undefined;
   let turnError: string | undefined;
   // A successful result frame that arrived after every captured tool call completed but
   // before message_stop. The bridge contract still ends the leg with the synthesized
@@ -381,6 +385,9 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
     sawPartialThinking: false,
     sawTerminalResult: false,
     openToolBlocks: new Map(),
+    translatorBudget: incoming.translatorBudget,
+    maxToolBlockStarts: toolBridge?.maxTurnToolCalls,
+    strictToolBlockCapture: Boolean(toolBridge),
     partialToolCallIds: toolBridge ? new Set<string>() : undefined,
   };
 
@@ -403,7 +410,6 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
     if (!stdout) throw new CodingAgentProtocolError(`${profile.label} CLI produced no stdout stream`);
     try {
       let initValidated = false;
-      let toolCallStarts = 0;
       let failClosed = false;
       for await (const message of readJsonLines(stdout)) {
         if (incoming.abortSignal?.aborted) break;
@@ -447,6 +453,18 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
           }
         }
         const mappedEvents = mapStreamMessageToEvents(message, state);
+        if (state.toolCallLimitExceeded) {
+          emitOnce({
+            type: "error",
+            message: `Coding-agent CLI returned more than the ${Math.min(MAX_TOOL_BLOCK_STARTS, state.maxToolBlockStarts ?? MAX_TOOL_BLOCK_STARTS)}-tool-call turn limit.`,
+            status: 502,
+            errorType: "upstream_error",
+            code: "tool_call_limit",
+            retryable: false,
+          });
+          kill();
+          break;
+        }
         if (toolBridge && state.uncapturedToolUse) {
           emitOnce({
             type: "error",
@@ -474,20 +492,6 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
             break;
           }
           if (toolBridge && event.type === "tool_call_start") {
-            toolCallStarts += 1;
-            if (toolCallStarts > toolBridge.maxTurnToolCalls) {
-              emitOnce({
-                type: "error",
-                message: `Coding-agent CLI returned more than the ${toolBridge.maxTurnToolCalls}-tool-call turn limit.`,
-                status: 502,
-                errorType: "upstream_error",
-                code: "tool_call_limit",
-                retryable: false,
-              });
-              failClosed = true;
-              kill();
-              break;
-            }
             const wireName = toolBridge.emittedNameMap.get(event.name);
             if (wireName === undefined) {
               emitOnce({
@@ -593,8 +597,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
           break;
         }
         if (toolBridge && !terminalEmitted && state.sawMessageStop && (state.completedToolCalls ?? 0) > 0) {
-          // Raw tool_use starts are gated before buffering, so every completed call was admitted
-          // after the bridge init handshake.
+          // The raw-start gate above already refused any call opened before the handshake.
           // The capture-only MCP handler never answers, so the CLI parks after message_stop.
           // The completed tool_use blocks are this turn's structured output: end the leg here
           // and terminate the tree; the client executes, and the next request continues.
@@ -615,11 +618,13 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
     } catch (err) {
       kill();
       streamProtocolError = err instanceof Error ? err.message : String(err);
+      if (isTranslatorBudgetExceededError(err)) streamProtocolCode = err.code;
     }
   } catch (err) {
     kill();
     turnError = err instanceof Error ? err.message : String(err);
   } finally {
+    releaseOpenToolBlocks(state);
     cleanup();
     if (toolBridgeDir) {
       await rm(toolBridgeDir, { recursive: true, force: true }).catch(() => undefined);
@@ -666,7 +671,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
         message: redactSecrets(streamProtocolError, profile.tokenEnv, apiKey),
         status: 502,
         errorType: "upstream_error",
-        code: "protocol_error",
+        code: streamProtocolCode ?? "protocol_error",
         retryable: false,
       });
     } else if (child.exitCode !== null && child.exitCode !== 0) {

package/src/adapters/google-errors.ts

@@ -1,6 +1,19 @@
 import { parseUpstreamJsonPayload, safeUpstreamErrorString, sanitizeUpstreamErrorText } from "./upstream-http-error";
 import { isLocationUnsupportedMessage } from "../lib/errors";
 
+export const ANTIGRAVITY_VALIDATION_REQUIRED_PREFIX = "Antigravity account validation required (VALIDATION_REQUIRED)";
+
+function hasAntigravityValidationReason(payloadText: string): boolean {
+  const payload = parseUpstreamJsonPayload(payloadText);
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const error = (payload as { error?: unknown }).error;
+  if (!error || typeof error !== "object" || Array.isArray(error)) return false;
+  const details = (error as { details?: unknown }).details;
+  return Array.isArray(details) && details.some(detail =>
+    detail !== null && typeof detail === "object" && !Array.isArray(detail)
+    && (detail as { reason?: unknown }).reason === "VALIDATION_REQUIRED");
+}
+
 /** Pull the human detail out of the Google API error envelope `{error:{message,status,code}}`. */
 function googleErrorDetail(payloadText: string): { message?: string; status?: string } {
   const trimmed = payloadText.trim();
@@ -98,7 +111,9 @@ function classifyGoogle(label: string, status: number | undefined, enumStatus: s
  */
 export function safeGoogleHttpErrorMessage(label: string, status: number, payloadText: string): string {
   const { message, status: enumStatus } = googleErrorDetail(payloadText);
-  const prefix = classifyGoogle(label, status, enumStatus, [message, enumStatus].filter(Boolean).join(" "));
+  const prefix = label === "Antigravity" && status === 403 && hasAntigravityValidationReason(payloadText)
+    ? ANTIGRAVITY_VALIDATION_REQUIRED_PREFIX
+    : classifyGoogle(label, status, enumStatus, [message, enumStatus].filter(Boolean).join(" "));
   const detail = message ? sanitizeUpstreamErrorText(message).slice(0, 500) : `HTTP ${status}`;
   return `${prefix}: ${detail}`;
 }

package/src/adapters/google-http.ts

@@ -7,6 +7,7 @@ import { isQuotaExhaustedBody, retryableGoogleStatus, safeGoogleHttpErrorMessage
 import { repairGoogleInvalidRequestBodyWithReport } from "./google-wire-compiler";
 import type { GoogleToolSchemaPolicy, GoogleToolSchemaProfile } from "./google-tool-schema";
 import { normalizeUpstreamHttpErrorResponse, readDisplaySafeErrorPayloadText } from "./upstream-http-error";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 import {
   abortError,
   cancelResponseBodyBestEffort,
@@ -29,6 +30,19 @@ export interface GoogleRetryOptions {
 }
 
 async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
+  if (label === "Antigravity" && res.status === 403) {
+    const body = await readBoundedResponseBody(res, {
+      maxBytes: 4096, totalTimeoutMs: 2000, firstByteTimeoutMs: 2000,
+      inactivityTimeoutMs: 2000, signal,
+    });
+    const headers = new Headers(res.headers);
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+    return new Response(safeGoogleHttpErrorMessage(label, res.status,
+      body.displaySafe && !body.truncated ? body.text : ""), {
+      status: res.status, statusText: res.statusText, headers,
+    });
+  }
   return normalizeUpstreamHttpErrorResponse(res, {
     signal,
     formatMessage: payloadText => safeGoogleHttpErrorMessage(label, res.status, payloadText),

package/src/adapters/openai-chat/passthrough.ts

@@ -1,3 +1,4 @@
+import { protectGlmSummaryBudget } from "./summary-budget";
 import { openAIChatTransport, stripBracketedModelSuffix } from "./wire";
 import type { AdapterRequest } from "../base";
 import { frameAgentRouterMessages } from "../agentrouter";
@@ -72,6 +73,7 @@ export function buildOpenAIChatPassthroughRequest(
   for (const field of CHAT_PASSTHROUGH_FIELDS) {
     if (rawBody[field] !== undefined) body[field] = rawBody[field];
   }
+  if (protectGlmSummaryBudget(body, provider.baseUrl, body.reasoning_effort)) body.reasoning_effort = "low";
   const rawEfforts = modelRecordValue(provider.modelReasoningEfforts, modelId) ?? provider.reasoningEfforts;
   const reasoningDisabled = modelInList(provider.noReasoningModels, modelId) || rawEfforts?.length === 0;
   if (reasoningDisabled) {

package/src/adapters/openai-chat/summary-budget.ts

@@ -0,0 +1,72 @@
+import { modelRecordValue } from "../../reasoning-effort";
+import type { OcxParsedRequest, OcxProviderConfig } from "../../types";
+
+export function resolveMaxTokens(provider: OcxProviderConfig, parsed: OcxParsedRequest): number | undefined {
+  return parsed.options.maxOutputTokens
+    ?? modelRecordValue(provider.modelMaxOutputTokens, parsed.modelId)
+    ?? provider.defaultMaxOutputTokens;
+}
+
+function textContent(value: unknown): string | undefined {
+  if (typeof value === "string") return value;
+  if (!Array.isArray(value)) return undefined;
+  const text: string[] = [];
+  for (const part of value) {
+    if (!part || part.type !== "text" || typeof part.text !== "string") return undefined;
+    text.push(part.text);
+  }
+  return text.join("\n");
+}
+
+const PROTECTED_SUMMARY_CAP = 8192;
+/** A real checkpoint carries the conversation it summarizes; a short probe is not one (#5465). */
+const MIN_CHECKPOINT_TRANSCRIPT_CHARS = 2000;
+
+/** The mitigation is scoped to Z.AI's own endpoints; another gateway serving the same model id is not. */
+function isZaiEndpoint(baseUrl: string | undefined): boolean {
+  if (!baseUrl) return false;
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "z.ai" || host.endsWith(".z.ai");
+  } catch {
+    return false;
+  }
+}
+
+function isTinyCap(value: unknown): value is number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 1024;
+}
+
+/**
+ * Aside's emergency checkpoint is a standalone summary, not an ordinary short answer (#5465).
+ * Runs at the physical Chat destination, after all combo effort overrides, so `effort` is the
+ * effective effort. Only the exhausting tiers (`high`/`max`) on Z.AI's GLM-5.3-Flash, for the
+ * two-message checkpoint shape with a real `<conversation>` transcript, qualify. Each tiny cap
+ * field is raised on its own, so a caller's larger cap is never shrunk.
+ */
+export function protectGlmSummaryBudget(
+  body: Record<string, unknown>,
+  baseUrl: string | undefined,
+  effort: unknown,
+): boolean {
+  if (!isZaiEndpoint(baseUrl)) return false;
+  if (effort !== "high" && effort !== "max") return false;
+  if (typeof body.model !== "string"
+      || !/^(?:(?:zai|z-ai|zai-org)\/)?glm-5\.3-flash$/i.test(body.model)) return false;
+  if (body.tools !== undefined && (!Array.isArray(body.tools) || body.tools.length > 0)) return false;
+  if (!isTinyCap(body.max_tokens) && !isTinyCap(body.max_completion_tokens)) return false;
+  const messages = body.messages;
+  if (!Array.isArray(messages) || messages.length !== 2) return false;
+  const [system, user] = messages;
+  if (!system || !user || !["system", "developer"].includes(system.role) || user.role !== "user"
+      || system.tool_calls || user.tool_calls || system.function_call || user.function_call) return false;
+  const instruction = textContent(system.content);
+  const transcript = textContent(user.content);
+  if (instruction === undefined || transcript === undefined) return false;
+  if (!/\b(?:summari[sz](?:e|ation|er|ing)|summary|checkpoint)\b/i.test(instruction)) return false;
+  if (!/<conversation>[\s\S]*<\/conversation>/i.test(transcript)) return false;
+  if (transcript.length < MIN_CHECKPOINT_TRANSCRIPT_CHARS) return false;
+  if (isTinyCap(body.max_tokens)) body.max_tokens = PROTECTED_SUMMARY_CAP;
+  if (isTinyCap(body.max_completion_tokens)) body.max_completion_tokens = PROTECTED_SUMMARY_CAP;
+  return true;
+}

package/src/adapters/openai-chat/tool-call-id-remint.ts

@@ -17,6 +17,7 @@ import type { OcxMessage } from "../../types";
  */
 export function createToolCallIdReminter(reservedIds: Iterable<string>): (rawId: string) => string {
   const occupied = new Set(reservedIds);
+  const nextSuffixByWidthAndPrefix = new Map<string, number>();
   return rawId => {
     if (!occupied.has(rawId)) {
       occupied.add(rawId);
@@ -25,16 +26,24 @@ export function createToolCallIdReminter(reservedIds: Iterable<string>): (rawId:
     // A non-conforming source is sanitized, never dropped: the wire still needs an id, and the
     // occupied check below covers a sanitized form that now equals some other call's id.
     const base = isConformingToolCallId(rawId) ? rawId : rawId.replace(/[^a-zA-Z0-9_-]/g, "_");
-    for (let n = 2; ; n++) {
+    for (let n = 2; ;) {
       // Hyphen, not underscore: an id that extends another id as `<earlier>_<digits>` is parsed by
       // at least one client as a batch sub-call of `<earlier>`, which pairs the second call's
       // result to the first call. A `-<n>` suffix is in the same id family without that reading.
       const suffix = `-${n}`;
-      const candidate = base.slice(0, Math.max(1, MAX_TOOL_CALL_ID_LENGTH - suffix.length)) + suffix;
+      // A wider suffix retains less of the base, so siblings that were separate at -9
+      // can converge at -10. Resume in the candidate's actual width/prefix domain.
+      const prefix = base.slice(0, Math.max(1, MAX_TOOL_CALL_ID_LENGTH - suffix.length));
+      const cursorKey = `${suffix.length}:${prefix}`;
+      const next = nextSuffixByWidthAndPrefix.get(cursorKey);
+      if (next !== undefined && next > n) { n = next; continue; }
+      const candidate = prefix + suffix;
+      nextSuffixByWidthAndPrefix.set(cursorKey, n + 1);
       if (!occupied.has(candidate)) {
         occupied.add(candidate);
         return candidate;
       }
+      n++;
     }
   };
 }

package/src/adapters/openai-chat.ts

@@ -1,11 +1,12 @@
 import { hasShrinkableOpenAIChatImages, normalizeOpenAIChatImages } from "./openai-chat-images";
+import { protectGlmSummaryBudget, resolveMaxTokens } from "./openai-chat/summary-budget";
 import { chatParallelToolCallsWireValue } from "./openai-chat/parallel-tool-calls";
 import { applyExplicitChatReasoningWirePolicy } from "./openai-chat/reasoning-wire";
 import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "./base";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../types";
 import { modelInList } from "../types";
 import { createInlineThinkContentSplitter, splitInlineThinkContent } from "./inline-think-tags";
-import { mapReasoningEffort, modelRecordValue } from "../reasoning-effort";
+import { mapReasoningEffort } from "../reasoning-effort";
 import { debugProviderDiagnostic } from "../lib/debug";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { isDebugEnabled } from "../lib/debug-settings";
@@ -51,12 +52,6 @@ export { stripBracketedModelSuffix } from "./openai-chat/wire";
 export { buildOpenAIChatPassthroughRequest } from "./openai-chat/passthrough";
 export { formatOpenAIChatErrorBody } from "./openai-chat/errors";
 
-function resolveMaxTokens(provider: OcxProviderConfig, parsed: OcxParsedRequest): number | undefined {
-  return parsed.options.maxOutputTokens
-    ?? modelRecordValue(provider.modelMaxOutputTokens, parsed.modelId)
-    ?? provider.defaultMaxOutputTokens;
-}
-
 function thinkingBudgetForEffort(parsed: OcxParsedRequest, reasoningEffort: string, maxOutputTokens?: number): number | undefined {
   if (parsed.options.reasoning === "minimal") return 0;
   const maxBudget = maxOutputTokens ?? 32768;
@@ -150,12 +145,14 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
           body.stop = parsed.options.stopSequences;
         }
         const reasoningDisabled = modelInList(provider.noReasoningModels, parsed.modelId);
-        const reasoningEffort = mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning);
+        const requestedEffort = protectGlmSummaryBudget(body, provider.baseUrl, parsed.options.reasoning)
+          ? "low" : parsed.options.reasoning;
+        const reasoningEffort = mapReasoningEffort(provider, parsed.modelId, requestedEffort);
         const explicitReasoning = applyExplicitChatReasoningWirePolicy({
           provider,
           modelId: parsed.modelId,
           hasTools: !!tools,
-          requestedEffort: parsed.options.reasoning,
+          requestedEffort,
           wireEffort: reasoningEffort,
           reasoningDisabled,
           body,

package/src/bridge/response-json.ts

@@ -86,6 +86,8 @@ function buildResponseJSONWithBudget(
     toolNsMap?: Map<string, { namespace: string; name: string; freeform?: true }>;
     /** Request-visible tool names. Required for client calls when enforcement is explicitly enabled. */
     declaredToolNames?: ReadonlySet<string>;
+    /** Bare custom declarations; unlike freeformToolNames, excludes foreign namespace children. */
+    bareCustomToolNames?: ReadonlySet<string>;
     /** See `bridgeToResponsesSSE`: enforcement is separate from normalization (#4735). */
     enforceDeclaredToolNames?: boolean;
     /** Declared parameter schema per tool name; repairs integral-float integer args (#1611). */
@@ -451,7 +453,7 @@ function buildResponseJSONWithBudget(
           rememberReasoningForCall(e.id, rawReasoningForNextToolCall, replayCacheScope);
         }
         flushToolCall();
-        const effectiveName = normalizeDeclaredToolName(e.name, options?.declaredToolNames);
+        const effectiveName = normalizeDeclaredToolName(e.name, options?.declaredToolNames, undefined, options?.bareCustomToolNames);
         if (
           (options?.enforceDeclaredToolNames === true || options?.declaredToolNames != null)
           && options?.enforceDeclaredToolNames !== false

package/src/bridge/sse.ts

@@ -101,6 +101,8 @@ export function bridgeToResponsesSSE(
     onUsage?: (usage: OcxUsage | undefined) => void;
     /** Request-visible tool names. Required for client calls when enforcement is explicitly enabled. */
     declaredToolNames?: ReadonlySet<string>;
+    /** Bare custom declarations; unlike freeformToolNames, excludes foreign namespace children. */
+    bareCustomToolNames?: ReadonlySet<string>;
     /**
      * Whether `declaredToolNames` is an authorization boundary this proxy enforces, or only the
      * catalog used to normalize provider-invented names back to declared ones.
@@ -1013,7 +1015,7 @@ export function bridgeToResponsesSSE(
                 rememberReasoningForCall(event.id, rawReasoningForNextToolCall, replayCacheScope);
               }
               if (currentToolCall) closeCurrentToolCall();
-              const effectiveName = normalizeDeclaredToolName(event.name, options?.declaredToolNames);
+              const effectiveName = normalizeDeclaredToolName(event.name, options?.declaredToolNames, undefined, options?.bareCustomToolNames);
               const codeModeHelperName = effectiveName === "exec" && event.name !== effectiveName
                 ? event.name
                 : undefined;

package/src/claude/desktop-picker.ts

@@ -8,7 +8,7 @@ import type { OcxConfig } from "../types";
 import { claudeDesktopIntegrationEnabled } from "../codex/desired-state";
 import { getConfigDir } from "../config/paths";
 import { readFileSync, existsSync } from "node:fs";
-import { pickerCaCertPath, pickerCaFingerprints, ensurePickerCa, issuePickerLeaf, pickerLeafCertPath } from "./intercept/picker-ca";
+import { pickerCaCertPath, pickerCaFingerprints, ensurePickerCa, issuePickerLeaf, pickerLeafCertPath, publishedPickerCaSha256 } from "./intercept/picker-ca";
 import { inspectPickerTrust, trustPickerCa, untrustPickerCa } from "./intercept/picker-trust";
 import type { PickerRuntime } from "./intercept/picker-runtime";
 import type { PickerTrustState, SecurityRunner } from "./intercept/picker-trust";
@@ -36,6 +36,8 @@ export interface DesktopPickerStatus {
   supported: boolean;
   trust: PickerTrustState;
   profile: DesktopPickerProfileInspection["kind"];
+  /** SHA-256 of this process's picker authority, so a CLI can verify the file it is about to trust; null when no authority exists yet. */
+  caSha256: string | null;
   listenerReady: boolean;
   effective: boolean;
   reason: DesktopPickerReason;
@@ -107,6 +109,7 @@ function emptyStatus(config: OcxConfig, platform: NodeJS.Platform, reason: Deskt
     models: 0,
     snapshotAt: null,
     lastBootstrapAt: null,
+    caSha256: null,
   };
 }
 
@@ -154,6 +157,7 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
       models: runtime.models,
       snapshotAt: runtime.snapshotAt,
       lastBootstrapAt: runtime.lastBootstrapAt,
+      caSha256: publishedPickerCaSha256(deps.configDir),
     };
   }
 
@@ -231,7 +235,7 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
       let trust = await inspectPickerTrust(pickerLeafCertPath(deps.configDir), caSha1, deps.security, platform);
       observedTrust = trust;
       if (trust !== "trusted" && options.context === "server") {
-        const added = await trustPickerCa(caPath, deps.security, platform);
+        const added = await trustPickerCa(caPath, deps.security, platform, { pem: ca.certPem });
         trustedByAttempt = added.ok;
         trust = await inspectPickerTrust(pickerLeafCertPath(deps.configDir), caSha1, deps.security, platform);
         observedTrust = trust;

package/src/claude/desktop-system-proxy.ts

@@ -0,0 +1,155 @@
+import type { OcxConfig } from "../types";
+import {
+  readWindowsProxyBypassRegistry,
+  readWindowsSystemProxy,
+  windowsProxyOverrideBypasses,
+  type WindowsProxyBypassValues,
+  type WindowsSystemProxyResult,
+} from "../lib/windows-system-proxy";
+import { inspectDesktopFirstParty, observeClaudeDesktopMode } from "./desktop-first-party";
+import { desktopFirstPartyDesired } from "./first-party-settings";
+
+/**
+ * Whether the Windows system proxy silently bypasses Desktop first-party mode.
+ *
+ * When Claude Desktop starts the Code tab's Claude Code process, it resolves the operating
+ * system proxy for the API host and, when that yields an HTTP proxy, passes it to the process
+ * as `HTTPS_PROXY`/`HTTP_PROXY`. That inherited value takes precedence over the `env` block
+ * OpenCodex writes into the user's `~/.claude/settings.json` (only Claude Code managed settings
+ * override it), so Code-tab traffic goes to the system proxy and never reaches the intercept.
+ * Routed subagent models then fail, and nothing else reports why. A system proxy such as Clash or
+ * v2rayN, with no bypass for the API host, is the common case.
+ *
+ * Observe-only: this reads the registry and never changes it. A PAC script and WPAD automatic
+ * detection decide per request, so they are reported as undecidable rather than guessed, and a
+ * failed read is reported as unreadable rather than as an absent value. Like the other doctor
+ * proxy surfaces it never prints the proxy value, which can carry credentials.
+ */
+
+export const FIRST_PARTY_API_HOST = "api.anthropic.com";
+
+export type DesktopSystemProxyVerdict = "no-proxy" | "bypassed" | "conflict" | "pac" | "auto-detect" | "unreadable";
+
+export type DesktopSystemProxyAssessment =
+  | { kind: "not-applicable" }
+  | {
+    kind: DesktopSystemProxyVerdict;
+    /** settings.json carries an owned first-party env that no longer matches the port or token. */
+    settingsStale: boolean;
+    /** WPAD detection is on (or unknown) next to a static proxy; a WPAD script would win. */
+    autoDetectAlsoOn: boolean;
+  };
+
+export type DesktopFirstPartySettingsState = "applied" | "stale" | "off";
+
+export interface DesktopSystemProxyInput {
+  platform: NodeJS.Platform;
+  firstParty: DesktopFirstPartySettingsState;
+  systemProxy: WindowsSystemProxyResult;
+  /** `null` when the Internet Settings key could not be read. */
+  bypass: WindowsProxyBypassValues | null;
+}
+
+function classify(systemProxy: WindowsSystemProxyResult, bypass: WindowsProxyBypassValues | null): DesktopSystemProxyVerdict {
+  if (bypass === null || systemProxy.kind === "unreadable") return "unreadable";
+  if (bypass.autoConfigUrl) return "pac";
+  // Desktop skips SOCKS entries, and an http=-only value does not cover an https:// API host.
+  const covering = systemProxy.kind === "proxy" && Boolean(systemProxy.httpsUrl);
+  if (!covering) return bypass.autoDetect === false ? "no-proxy" : "auto-detect";
+  // A failed WPAD lookup falls back to the static proxy, so a static conflict stands either way.
+  return windowsProxyOverrideBypasses(bypass.proxyOverride, FIRST_PARTY_API_HOST) ? "bypassed" : "conflict";
+}
+
+export function assessDesktopSystemProxy(input: DesktopSystemProxyInput): DesktopSystemProxyAssessment {
+  if (input.platform !== "win32" || input.firstParty === "off") return { kind: "not-applicable" };
+  const kind = classify(input.systemProxy, input.bypass);
+  return {
+    kind,
+    settingsStale: input.firstParty === "stale",
+    autoDetectAlsoOn: kind === "bypassed" && input.bypass?.autoDetect !== false,
+  };
+}
+
+const STALE_LINES = [
+  "      The OpenCodex first-party env in ~/.claude/settings.json is stale (proxy port or token changed);",
+  "      run `ocx ensure`, then re-run `ocx doctor`.",
+];
+
+function verdictLines(kind: DesktopSystemProxyVerdict): string[] {
+  switch (kind) {
+    case "no-proxy":
+      return ["  ok  No Windows system proxy covers the Claude API; the Code tab uses the OpenCodex proxy from settings.json."];
+    case "bypassed":
+      return [`  ok  ${FIRST_PARTY_API_HOST} is on the Windows proxy bypass list; the Code tab uses the OpenCodex proxy from settings.json.`];
+    case "pac":
+      return [
+        "  --  Windows uses a proxy auto-config (PAC) script, so OpenCodex cannot tell whether Claude Desktop",
+        `      sends ${FIRST_PARTY_API_HOST} through a proxy. If routed models fail in the Code tab, make the script return DIRECT for it.`,
+      ];
+    case "auto-detect":
+      return [
+        "  --  Windows automatic proxy detection (WPAD) is on or could not be read, so OpenCodex cannot tell whether",
+        `      Claude Desktop sends ${FIRST_PARTY_API_HOST} through a proxy. If routed models fail in the Code tab, turn off`,
+        "      \"Automatically detect settings\" or make the network's WPAD script return DIRECT for it.",
+      ];
+    case "unreadable":
+      return ["  --  Could not read the Windows proxy settings."];
+    case "conflict":
+      return [
+        `  !!  The Windows system proxy applies to ${FIRST_PARTY_API_HOST}. Claude Desktop passes it to the Code tab`,
+        "      as HTTPS_PROXY, which takes precedence over the OpenCodex proxy in ~/.claude/settings.json,",
+        "      so first-party routing is bypassed and routed models fail there.",
+        `      Fix: add ${FIRST_PARTY_API_HOST} to your proxy client's system-proxy bypass list (Clash Verge: system_proxy_bypass),`,
+        "      then fully quit and reopen Claude Desktop.",
+      ];
+  }
+}
+
+export function formatDesktopSystemProxyLines(assessment: DesktopSystemProxyAssessment): string[] {
+  if (assessment.kind === "not-applicable") return [];
+  const clear = assessment.kind === "no-proxy" || assessment.kind === "bypassed";
+  // A stale env never earns an `ok`: the Code tab would reach a proxy URL that no longer matches.
+  if (clear && assessment.settingsStale) return [`  --  ${STALE_LINES[0]!.trimStart()}`, STALE_LINES[1]!];
+  const lines = verdictLines(assessment.kind);
+  if (assessment.autoDetectAlsoOn) {
+    lines.push("      Automatic proxy detection (WPAD) is also on; a WPAD script on this network would decide instead.");
+  }
+  if (assessment.settingsStale) lines.push(...STALE_LINES);
+  return lines;
+}
+
+export interface DesktopSystemProxyDeps {
+  platform?: NodeJS.Platform;
+  firstPartyState?: () => DesktopFirstPartySettingsState;
+  readSystemProxy?: () => WindowsSystemProxyResult;
+  readBypass?: () => WindowsProxyBypassValues | null;
+}
+
+function liveFirstPartyState(
+  config: Pick<OcxConfig, "claudeCode" | "clientIntegrations" | "port" | "runtimeRole">,
+): DesktopFirstPartySettingsState {
+  try {
+    const settings = inspectDesktopFirstParty(config).settings.kind;
+    if (settings !== "applied" && settings !== "stale") return "off";
+    return desktopFirstPartyDesired(config, observeClaudeDesktopMode(config)) ? settings : "off";
+  } catch { // no-excuse-ok: catch -- unreadable Claude settings are no first-party evidence.
+    return "off";
+  }
+}
+
+/** Reads the live state. Registry reads run only on Windows with a Desktop first-party env. */
+export function collectDesktopSystemProxy(
+  config: Pick<OcxConfig, "claudeCode" | "clientIntegrations" | "port" | "runtimeRole">,
+  deps: DesktopSystemProxyDeps = {},
+): DesktopSystemProxyAssessment {
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "win32") return { kind: "not-applicable" };
+  const firstParty = (deps.firstPartyState ?? (() => liveFirstPartyState(config)))();
+  if (firstParty === "off") return { kind: "not-applicable" };
+  return assessDesktopSystemProxy({
+    platform,
+    firstParty,
+    systemProxy: (deps.readSystemProxy ?? readWindowsSystemProxy)(),
+    bypass: (deps.readBypass ?? readWindowsProxyBypassRegistry)(),
+  });
+}

package/src/claude/inbound-model-options.ts

@@ -96,7 +96,13 @@ export function effortFromOutputConfig(outputConfig: unknown): string | undefine
   return typeof effort === "string" && OUTPUT_CONFIG_EFFORTS.has(effort) ? effort : undefined;
 }
 
-export function formatFromOutputConfig(outputConfig: unknown): Rec | undefined {
+function isFineTunedOpenAiTarget(model: string | undefined): boolean {
+  if (!model) return false;
+  const separator = model.lastIndexOf("/");
+  return model.slice(separator + 1).startsWith("ft:");
+}
+
+export function formatFromOutputConfig(outputConfig: unknown, resolvedModel?: string): Rec | undefined {
   if (!isRec(outputConfig) || !isRec(outputConfig.format)) return undefined;
   const format = outputConfig.format;
   if (
@@ -115,7 +121,9 @@ export function formatFromOutputConfig(outputConfig: unknown): Rec | undefined {
     name: "response",
     schema: format.schema,
     // Strict Structured Outputs also needs an object at the root; a root anyOf/oneOf is refused.
-    strict: format.schema.type === "object" && satisfiesOpenAiStrictSchema(format.schema),
+    strict: format.schema.type === "object"
+      && !Object.hasOwn(format.schema, "anyOf") && !Object.hasOwn(format.schema, "oneOf")
+      && satisfiesOpenAiStrictSchema(format.schema, isFineTunedOpenAiTarget(resolvedModel)),
   };
 }
 

package/src/claude/inbound.ts

@@ -460,7 +460,7 @@ function translateAnthropicRequest(
   if (Array.isArray(raw.stop_sequences) && raw.stop_sequences.length > 0) {
     body.stop = raw.stop_sequences.filter((s): s is string => typeof s === "string");
   }
-  const outputConfigFormat = formatFromOutputConfig(raw.output_config);
+  const outputConfigFormat = formatFromOutputConfig(raw.output_config, body.model as string);
   if (outputConfigFormat) body.text = { format: outputConfigFormat };
   let cacheKeySource: ClaudeCacheKeySource = null;
   if (isRec(raw.metadata) && typeof raw.metadata.user_id === "string") {

package/src/claude/intercept/picker-ca-cleanup.ts

@@ -0,0 +1,31 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  acknowledgePendingPickerCaUntrust,
+  pendingPickerCaHasLivePublishedOwner,
+  readPendingPickerCaUntrust,
+} from "./picker-ca";
+import { untrustPickerCa, type SecurityRunner } from "./picker-trust";
+
+/** Drain exactly the recorded public predecessor; keep its journal on any uncertainty. */
+export async function drainPendingPickerCaUntrust(
+  configDir: string,
+  security?: SecurityRunner,
+  platform?: NodeJS.Platform,
+): Promise<boolean> {
+  const pending = readPendingPickerCaUntrust(configDir);
+  if (!pending) return true;
+  if (pendingPickerCaHasLivePublishedOwner(configDir, pending)) return false;
+
+  const privateDir = mkdtempSync(join(tmpdir(), "ocx-picker-untrust-"));
+  try {
+    const publicCopy = join(privateDir, "ca.pem");
+    writeFileSync(publicCopy, pending.certPem, { mode: 0o600 });
+    const result = await untrustPickerCa(publicCopy, pending.sha1, security, platform);
+    if (!result.ok) return false;
+    return acknowledgePendingPickerCaUntrust(configDir, pending, result);
+  } finally {
+    rmSync(privateDir, { recursive: true, force: true });
+  }
+}