@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/adapters/devin.ts

@@ -10,13 +10,14 @@ import type { AdapterEvent, OcxAssistantMessage, OcxContentPart, OcxMessage, Ocx
 import { namespacedToolName } from "../types";
 import type { IncomingMeta, ProviderAdapter } from "./base";
 import { streamChatEventsWithResetRetry, devinStatedResetWaitMs, allocateCascadeId, CloudChatError, type ChatHistoryItem, type ToolDef } from "./devin/cloud-direct";
-import type { ContentPart } from "./devin/cloud-direct/chat";
-import { getCachedCatalog, type CacheEntry } from "./devin/cloud-direct/catalog";
-import { collapseDevinModelUid } from "./devin/live-models";
+import type { CloudChatEvent, ContentPart } from "./devin/cloud-direct/chat";
+import { getCachedCatalog, type CacheEntry, type ModelCatalogEntry } from "./devin/cloud-direct/catalog";
+import { collapseDevinModelUid, devinFamiliesOf, devinFamilyBaseId, selectDevinFamilyMember, type DevinVariantRequest } from "./devin/live-models";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiServer } from "../oauth/devin";
-import { isProviderIssuedThinkingSignature } from "../responses/reasoning-envelope";
+import { devinAssistantReasoning, encodeDevinSignature, hasAnthropicSignature } from "./devin/reasoning-signature";
 import { SendBudgetExhaustedError } from "../lib/upstream-retry";
+import { devinContextOverflowEvent, isDevinHistoryOverflow } from "./devin/context-overflow";
 
 /**
  * Combine two usage frames from one turn by keeping the larger count per field.
@@ -54,6 +55,49 @@ export function mergeDevinUsage(previous: OcxUsage, next: OcxUsage): OcxUsage {
  */
 const DEVIN_CLIENT_CLOSED_MESSAGE = "client closed request";
 
+/** Below the bridge's upstream stall deadline, so held reasoning never reads as a stall. */
+const HELD_REASONING_HEARTBEAT_MS = 15_000;
+/** Once either limit is crossed, forward the signed attempt and disable fallback. */
+const HELD_REASONING_MAX_EVENTS = 1_024;
+const HELD_REASONING_MAX_PAYLOAD_BYTES = 1024 * 1024;
+
+type DevinUsageEvent = Extract<CloudChatEvent, { kind: "usage" }>;
+
+function toOcxDevinUsage(event: DevinUsageEvent): OcxUsage {
+  const total = event.totalTokens ?? ((event.promptTokens ?? 0) + (event.completionTokens ?? 0));
+  return {
+    inputTokens: event.promptTokens ?? 0,
+    outputTokens: event.completionTokens ?? 0,
+    ...(total > 0 ? { totalTokens: total } : {}),
+    ...(event.cachedInputTokens !== undefined ? { cachedInputTokens: event.cachedInputTokens } : {}),
+    ...(event.cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens: event.cacheCreationInputTokens } : {}),
+    ...(event.reasoningTokens !== undefined ? { reasoningOutputTokens: event.reasoningTokens } : {}),
+  };
+}
+
+function toCloudDevinUsage(usage: OcxUsage): DevinUsageEvent {
+  return {
+    kind: "usage",
+    promptTokens: usage.inputTokens,
+    completionTokens: usage.outputTokens,
+    totalTokens: usage.totalTokens,
+    cachedInputTokens: usage.cachedInputTokens,
+    cacheCreationInputTokens: usage.cacheCreationInputTokens,
+    reasoningTokens: usage.reasoningOutputTokens,
+  };
+}
+
+/** The retry's cumulative usage plus the refused attempt's final counts. */
+function addDevinUsage(event: DevinUsageEvent, prior: DevinUsageEvent): DevinUsageEvent {
+  const sum = (a?: number, b?: number) => (a === undefined && b === undefined ? undefined : (a ?? 0) + (b ?? 0));
+  const out: DevinUsageEvent = { ...event };
+  for (const key of ["promptTokens", "completionTokens", "totalTokens", "cachedInputTokens", "cacheCreationInputTokens", "reasoningTokens"] as const) {
+    const value = sum(event[key], prior[key]);
+    if (value !== undefined) out[key] = value;
+  }
+  return out;
+}
+
 /** Map a cloud-direct failure onto the structured fields the error event carries. */
 export function devinErrorClassification(error: unknown): { status?: number; errorType?: string; retryable?: boolean } {
   const status = error instanceof CloudChatError ? error.status : undefined;
@@ -131,7 +175,9 @@ const SWE2_EFFORT: Record<string, "medium" | "high" | "max"> = {
 
 /**
  * Resolve an explicit effort onto a SWE-2 lane, or undefined when this is not a
- * SWE-2 id or the caller named no usable effort. Undefined leaves every existing
+ * SWE-2 id or the caller named no usable effort. Reached only when the catalog
+ * is unavailable or lacks family metadata; otherwise the catalog's SWE-2 family
+ * rows decide, with the same rounding. Undefined leaves every existing
  * path untouched, which is what keeps other model families on suffix precedence.
  */
 function resolveSwe2Variant(modelId: string, reasoningEffort?: string): string | undefined {
@@ -140,17 +186,92 @@ function resolveSwe2Variant(modelId: string, reasoningEffort?: string): string |
   return mapped ? `swe-2-${mapped}` : undefined;
 }
 
+const VARIANT_EFFORT_TOKENS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max"]);
+const EFFORT_ALIASES: Record<string, string> = { off: "none", ultra: "max" };
+
 /**
- * Resolve the wire model UID using the live catalog as the source of truth.
- * Cognition's catalog lists most models with an effort suffix
- * (e.g. `gpt-5-6-sol-high`); the base id alone is not accepted for those.
+ * Read hyphen-separated variant tokens as a request. Any token outside the
+ * vocabulary voids the whole value, so an unknown effort changes nothing
+ * rather than half-applying. `priority` is the uid spelling of Fast Mode on
+ * the GPT rows; a caller never sends it as effort (see CALLER_EFFORT_VALUES).
+ */
+function variantRequestOf(tokens: string[], allowPriority: boolean): DevinVariantRequest | undefined {
+  const request: DevinVariantRequest = {};
+  for (const raw of tokens) {
+    const token = EFFORT_ALIASES[raw] ?? raw;
+    if (VARIANT_EFFORT_TOKENS.has(token)) request.effort = token;
+    else if (token === "fast" || (allowPriority && token === "priority")) request.fast = true;
+    else if (token === "1m") request.longContext = true;
+    else return undefined;
+  }
+  return request;
+}
+
+function callerVariantRequest(reasoningEffort: string | undefined): DevinVariantRequest | undefined {
+  const value = reasoningEffort?.toLowerCase();
+  if (!value) return undefined;
+  const aliased = EFFORT_ALIASES[value] ?? value;
+  if (!CALLER_EFFORT_VALUES.has(aliased) && aliased !== "minimal") return undefined;
+  return variantRequestOf(aliased.split("-"), false);
+}
+
+/**
+ * Resolve through the catalog's family metadata (ClientModelConfig #23/#30/#31).
+ * Returns undefined when the id belongs to no family, which leaves the
+ * suffix-based path for legacy rows and catalogs without that metadata.
  *
- * If the catalog is available: use the exact UID when it exists, otherwise
- * append the reasoning effort (or `medium` default) and pick a variant the
- * account actually has.
+ * The family id wins over an identical row uid on purpose: bare `swe-1-7` is
+ * the Max row while the family default is `swe-1-7-medium`, and `glm-5-2` is
+ * both the family id and its default row. A caller naming the family means the
+ * family, so no effort selects the default member and an effort moves only the
+ * effort axis. A caller naming a member row keeps that row's other axes.
+ */
+function resolveFamilyUid(catalog: CacheEntry, modelId: string, reasoningEffort?: string): string | undefined {
+  const families = devinFamiliesOf(catalog);
+  const caller = callerVariantRequest(reasoningEffort);
+  let members = families.get(modelId);
+  let anchor: ModelCatalogEntry | undefined;
+  let fromId: DevinVariantRequest = {};
+  if (!members) {
+    const row = catalog.byUid.get(modelId);
+    if (row?.familyUid) {
+      members = families.get(devinFamilyBaseId(row.familyUid));
+      if (members) anchor = row;
+    }
+  }
+  if (!members) {
+    // A suffixed spelling the catalog does not list (`swe-1-7-high`) still
+    // names a family; its suffix is the request.
+    const base = collapseDevinModelUid(modelId);
+    const suffix = base !== modelId ? variantRequestOf(modelId.slice(base.length + 1).split("-"), true) : undefined;
+    members = suffix ? families.get(base) : undefined;
+    if (suffix) fromId = suffix;
+  }
+  if (!members) return undefined;
+  if (anchor && !caller) return anchor.modelUid;
+  const request: DevinVariantRequest = {
+    ...fromId,
+    ...(caller?.effort ? { effort: caller.effort } : {}),
+    ...(caller?.fast || fromId.fast ? { fast: true } : {}),
+    ...(caller?.longContext || fromId.longContext ? { longContext: true } : {}),
+  };
+  // A disabled row the caller named keeps its uid when the request still lands
+  // on it (`swe-2-max` asked for at `max`), so the chat preflight reports that
+  // row's tier refusal instead of quietly serving a different tier. A request
+  // for a different variant still passes over disabled rows.
+  if (anchor?.disabled && selectDevinFamilyMember(members, request, anchor, { includeDisabled: true }) === anchor) {
+    return anchor.modelUid;
+  }
+  return selectDevinFamilyMember(members, request, anchor)?.modelUid;
+}
+
+/**
+ * Resolve the wire model UID using the live catalog as the source of truth.
  *
- * If the catalog is unavailable (degraded mode): append the effort suffix
- * for any base id that doesn't already carry one, mirroring the catalog shape.
+ * With family metadata in the catalog, resolution picks a family member by
+ * axis (see resolveFamilyUid). Without it — legacy rows, an older catalog, or
+ * no catalog at all — the id is resolved by suffix: an exact or suffixed UID is
+ * kept, otherwise the reasoning effort (or `medium`) is appended.
  */
 async function resolveWireModelUid(
   rawModelId: string,
@@ -160,28 +281,33 @@ async function resolveWireModelUid(
   catalog?: CacheEntry | null,
 ): Promise<string> {
   const modelId = normalizeDevinModelId(rawModelId);
+  // Callers that already read the catalog this turn pass it in; an explicit
+  // null records a failed lookup and must not trigger a same-turn retry —
+  // failures are not cached, so re-reading would only pay another timeout.
+  const entry = catalog !== undefined ? catalog : await getCachedCatalog(apiKey, host);
+  if (entry) {
+    const fromFamily = resolveFamilyUid(entry, modelId, reasoningEffort);
+    if (fromFamily) return fromFamily;
+  }
   // Explicit effort wins over a suffix the picker already baked into the id, so
   // `swe-2-high` asked for at `medium` becomes `swe-2-medium` instead of ignoring
   // the caller. Runs before the shortcut below, which would otherwise return early.
   const swe2 = resolveSwe2Variant(modelId, reasoningEffort);
   if (swe2) return swe2;
   if (hasEffortSuffix(modelId)) return modelId;
-  // Callers that already read the catalog this turn pass it in; an explicit
-  // null records a failed lookup and must not trigger a same-turn retry —
-  // failures are not cached, so re-reading would only pay another timeout.
-  const entry = catalog !== undefined ? catalog : await getCachedCatalog(apiKey, host);
+  const effort = reasoningEffort && CALLER_EFFORT_VALUES.has(reasoningEffort) ? reasoningEffort : "medium";
   if (entry) {
     if (entry.byUid.has(modelId)) return modelId;
-    const effort = reasoningEffort && CALLER_EFFORT_VALUES.has(reasoningEffort) ? reasoningEffort : "medium";
     const suffixed = `${modelId}-${effort}`;
     if (entry.byUid.has(suffixed)) return suffixed;
-    // Fall back to any enabled variant of this base model.
-    for (const uid of entry.byUid.keys()) {
-      if (uid.startsWith(modelId + "-") && !entry.byUid.get(uid)?.disabled) return uid;
+    // Any enabled variant of this exact base. The base must match after
+    // collapsing, not as a string prefix: `claude-opus-5-` prefixes
+    // `claude-opus-5-5-low` and `gpt-5-4-` prefixes `gpt-5-4-mini-low`.
+    for (const [uid, row] of entry.byUid) {
+      if (!row.disabled && uid !== modelId && collapseDevinModelUid(uid) === modelId) return uid;
     }
   }
   // Degraded mode: append the default effort suffix.
-  const effort = reasoningEffort && CALLER_EFFORT_VALUES.has(reasoningEffort) ? reasoningEffort : "medium";
   return `${modelId}-${effort}`;
 }
 
@@ -198,7 +324,9 @@ const positiveTokenCount = (value: unknown): number | undefined =>
 /**
  * Read a per-model token count for the exact UID selected for this turn.
  *
- * Tries the selected UID and then its collapsed base id, preferring the
+ * Tries the selected UID, then its catalog family id (the picker id, e.g.
+ * `claude-sonnet-4-6` for `claude-sonnet-4-6-thinking`), then its collapsed
+ * base id, preferring the
  * canonical spelling and accepting dotted or case-folded saved hints — the same
  * normalization the inference request applies to the model id. Where several
  * spellings match one id, the smallest wins: a ceiling stated twice is
@@ -207,9 +335,10 @@ const positiveTokenCount = (value: unknown): number | undefined =>
 function devinModelTokenHint(
   record: Record<string, number> | undefined,
   modelUid: string,
+  familyBase?: string,
 ): number | undefined {
   if (!record) return undefined;
-  for (const id of [modelUid, collapseDevinModelUid(modelUid)]) {
+  for (const id of [modelUid, ...(familyBase ? [familyBase] : []), collapseDevinModelUid(modelUid)]) {
     const exact = Object.hasOwn(record, id) ? positiveTokenCount(record[id]) : undefined;
     if (exact !== undefined) return exact;
     const matches = Object.entries(record)
@@ -221,26 +350,6 @@ function devinModelTokenHint(
   return undefined;
 }
 
-/**
- * Resolve the INPUT ceiling for the exact UID selected for this turn. Catalog
- * ClientModelConfig #18 and CompletionConfiguration #3 both carry input tokens;
- * the independent output cap is not subtracted here. Smaller operator hints
- * cap live evidence, never enlarge it. No evidence leaves the encoder's 128k
- * fallback intact; an unrelated or opt-in long-context variant is not evidence.
- */
-function resolveDevinMaxInputTokens(
-  provider: OcxProviderConfig,
-  modelUid: string,
-  liveWindow?: number,
-): number | undefined {
-  const contextHint = devinModelTokenHint(provider.modelContextWindows, modelUid)
-    ?? positiveTokenCount(provider.contextWindow);
-  const inputHint = devinModelTokenHint(provider.modelMaxInputTokens, modelUid);
-  const ceilings = [positiveTokenCount(liveWindow), contextHint, inputHint]
-    .filter((value): value is number => value !== undefined);
-  return ceilings.length > 0 ? Math.min(...ceilings) : undefined;
-}
-
 /**
  * Resolve the OUTPUT ceiling for this turn, highest authority first:
  *
@@ -248,16 +357,17 @@ function resolveDevinMaxInputTokens(
  *    explicit cap is a request, so a small one is never widened into a
  *    configured larger one;
  * 2. the configured per-model cap (`modelMaxOutputTokens`), read through the
- *    same UID-aware hint lookup the input ceiling uses;
+ *    through the UID-aware hint lookup above;
  * 3. the provider-wide `defaultMaxOutputTokens`;
- * 4. undefined, which leaves the cloud-direct encoder's own 8192 fallback in
- *    place for a provider that configured nothing.
+ * 4. the catalog's own ceiling for the selected UID (ModelInfo #13) — without
+ *    it every uncapped turn stopped at the encoder's 8192, far below the
+ *    128k most rows advertise;
+ * 5. undefined, which leaves the cloud-direct encoder's 8192 fallback in
+ *    place when there is no catalog and nothing configured.
  *
- * This is NOT the history ceiling, and the two must not collapse into one
- * number. CompletionConfiguration #2 is the output cap and #3 is the context
- * window, so feeding a context window into this resolver would ask Cognition to
- * generate a whole window's worth of output. Nothing here reads
- * `contextWindow` or `modelContextWindows` for that reason.
+ * A context window is not an output cap: feeding one into CompletionConfiguration
+ * #2 would ask Cognition to generate a whole window's worth of output. Nothing
+ * here reads `contextWindow` or `modelContextWindows` for that reason.
  *
  * Step 1 keeps the caller's raw value rather than `positiveTokenCount`: the
  * inbound parser owns what a caller may send, and re-filtering here would
@@ -268,16 +378,37 @@ function resolveDevinMaxOutputTokens(
   provider: OcxProviderConfig,
   modelUid: string,
   requested: number | undefined,
+  catalogRow?: Pick<ModelCatalogEntry, "maxOutputTokens" | "familyUid">,
 ): number | undefined {
   if (typeof requested === "number") return requested;
-  return devinModelTokenHint(provider.modelMaxOutputTokens, modelUid)
-    ?? positiveTokenCount(provider.defaultMaxOutputTokens);
+  const familyBase = catalogRow?.familyUid ? devinFamilyBaseId(catalogRow.familyUid) : undefined;
+  return devinModelTokenHint(provider.modelMaxOutputTokens, modelUid, familyBase)
+    ?? positiveTokenCount(provider.defaultMaxOutputTokens)
+    ?? positiveTokenCount(catalogRow?.maxOutputTokens);
 }
 
-/** Pure test seams; runtime uses the same resolvers immediately before dispatch. */
-export const resolveDevinMaxInputTokensForTests = resolveDevinMaxInputTokens;
+/** Pure test seam; runtime uses the same resolver immediately before dispatch. */
 export const resolveDevinMaxOutputTokensForTests = resolveDevinMaxOutputTokens;
 
+/** The classifier reads the selected UID's catalog input window, capped by configured limits. */
+function resolveDevinContextWindow(
+  provider: OcxProviderConfig,
+  modelUid: string,
+  catalogRow?: Pick<ModelCatalogEntry, "contextWindow" | "familyUid">,
+): number | undefined {
+  const familyBase = catalogRow?.familyUid ? devinFamilyBaseId(catalogRow.familyUid) : undefined;
+  const limits = [
+    positiveTokenCount(catalogRow?.contextWindow),
+    devinModelTokenHint(provider.modelContextWindows, modelUid, familyBase),
+    positiveTokenCount(provider.contextWindow),
+    devinModelTokenHint(provider.modelMaxInputTokens, modelUid, familyBase),
+  ].filter((value): value is number => value !== undefined);
+  return limits.length > 0 ? Math.min(...limits) : undefined;
+}
+
+/** Pure test seam for configured caps and selected-row lookup. */
+export const resolveDevinContextWindowForTests = resolveDevinContextWindow;
+
 export class DevinMissingCredentialError extends Error {
   constructor() {
     super("Devin live transport requires a Devin API key. Run ocx login devin to sign in with your Cognition/Devin account.");
@@ -364,45 +495,16 @@ function assistantText(message: OcxAssistantMessage): string {
     // Thinking stays out of the replayed TEXT: folding chain-of-thought into
     // assistant text sends it back as visible prior output, which the model
     // then treats as something it said to the user. It is replayed in its own
-    // field instead — see assistantThinking below.
+    // field instead — see devinAssistantReasoning.
     .map((part) => (part.type === "text" ? part.text : ""))
     .filter(Boolean)
     .join("\n");
 }
 
-/**
- * The assistant turn's own reasoning, for replay in ChatMessagePrompt #11.
- *
- * This adapter previously asserted that Cognition has no reasoning-replay
- * field and dropped the thinking outright, so a reasoning model restarted its
- * chain on every turn of a tool loop. The field exists: two independent
- * clients of the same service write #11 thinking with #12 signature and #18
- * signature_type on the assistant prompt.
- *
- * Field #12 attests the exact text at #11, and the wire has room for one pair.
- * Every block that carries text is replayed, so the chain stays intact; the
- * signature rides along only when the text being replayed IS the text it
- * attests, which is exactly the single-block case. Several independently signed
- * blocks send an unsigned prompt rather than pairing one block's attestation
- * with another block's words. A signature-only block attests encrypted thinking
- * that is not being replayed at all, so it is not one of these blocks and
- * cannot contribute the pair.
- */
-function assistantThinking(
-  message: OcxAssistantMessage,
-): { thinking?: string; signature?: string } {
-  const blocks = message.content.filter(
-    (part): part is Extract<typeof part, { type: "thinking" }> => part.type === "thinking",
-  ).filter(part => Boolean(part.thinking));
-  if (blocks.length === 0) return {};
-  const signature = blocks.length === 1 ? blocks[0]!.signature : undefined;
-  return {
-    thinking: blocks.map(part => part.thinking).join("\n"),
-    ...(isProviderIssuedThinkingSignature(signature) ? { signature } : {}),
-  };
-}
-
-export function mapOcxMessagesToDevin(parsed: OcxParsedRequest): ChatHistoryItem[] {
+export function mapOcxMessagesToDevin(
+  parsed: OcxParsedRequest,
+  options: { withholdAnthropicSignatures?: boolean } = {},
+): ChatHistoryItem[] {
   const items: ChatHistoryItem[] = [];
   // Cognition is not an OpenAI host, and this adapter does advertise a real
   // client tool catalog (proto #10 via `mapOcxToolsToDevin`), so the same
@@ -421,13 +523,17 @@ export function mapOcxMessagesToDevin(parsed: OcxParsedRequest): ChatHistoryItem
   if (system) items.push({ role: "system", content: system });
 
   for (const message of parsed.context.messages) {
-    const mapped = mapOneMessage(message);
+    const mapped = mapOneMessage(message, parsed.modelId, options);
     if (mapped) items.push(mapped);
   }
   return items;
 }
 
-function mapOneMessage(message: OcxMessage): ChatHistoryItem | undefined {
+function mapOneMessage(
+  message: OcxMessage,
+  modelId: string,
+  options: { withholdAnthropicSignatures?: boolean },
+): ChatHistoryItem | undefined {
   if (message.role === "user" || message.role === "developer") {
     const content = mapOcxContentToWire(message.content);
     // An image with no caption text is a complete user message on its own.
@@ -439,10 +545,10 @@ function mapOneMessage(message: OcxMessage): ChatHistoryItem | undefined {
   if (message.role === "assistant") {
     const toolCalls = assistantToolCalls(message);
     const text = assistantText(message);
-    const reasoning = assistantThinking(message);
+    const reasoning = devinAssistantReasoning(message, modelId, options.withholdAnthropicSignatures === true);
     // A turn that produced only reasoning is still worth replaying: dropping it
     // is what makes the next turn re-derive the same chain.
-    if (!text && toolCalls.length === 0 && !reasoning.thinking) return undefined;
+    if (!text && toolCalls.length === 0 && !reasoning.thinking && !reasoning.signature) return undefined;
     return {
       role: "assistant",
       content: text || "",
@@ -451,6 +557,10 @@ function mapOneMessage(message: OcxMessage): ChatHistoryItem | undefined {
     };
   }
   if (message.role === "toolResult") {
+    // #9 alone is not enough: live, with a neutral "hello world" result flagged
+    // as an error, only gemini-3-8-flash reported a failure; swe-1-6,
+    // gpt-6-sol-low and gpt-5-6-luna-low read it as success. So the flag rides
+    // with the in-band marker rather than replacing it.
     const wireContent = mapOcxContentToWire(message.content);
     const toolContent = message.isError
       ? (typeof wireContent === "string"
@@ -461,6 +571,7 @@ function mapOneMessage(message: OcxMessage): ChatHistoryItem | undefined {
       role: "tool",
       content: toolContent,
       tool_call_id: message.toolCallId,
+      ...(message.isError ? { is_error: true } : {}),
     };
   }
   return undefined;
@@ -613,8 +724,8 @@ export function createDevinAdapter(
       // entry: an EU or FedStart account that used provider.baseUrl would send
       // every RPC to the US server it is not provisioned on.
       const host = resolveDevinApiServer(provider.baseUrl, credentialProviderId, apiKey);
-      // One catalog read per turn serves model-UID resolution, the input
-      // ceiling, and the chat pre-flight inside streamChatEvents. Failures are
+      // One catalog read per turn serves model-UID resolution, the output
+      // cap, and the chat pre-flight inside streamChatEvents. Failures are
       // not cached, so a second read would only pay another fetch timeout on
       // an otherwise valid turn.
       const catalog = await getCachedCatalog(apiKey, host, incoming.abortSignal);
@@ -627,6 +738,11 @@ export function createDevinAdapter(
       let openToolId: string | undefined;
       let usage: OcxUsage | undefined;
       let stopReason: string | undefined;
+      // Kept outside the try so the catch can tell an oversized history from a bad request.
+      let producedOutput = false;
+      let contextWindow: number | undefined;
+      let messages: ChatHistoryItem[] = [];
+      let tools: ToolDef[] | undefined;
 
       const closeOpenTool = () => {
         if (!openToolId) return;
@@ -636,11 +752,11 @@ export function createDevinAdapter(
 
       try {
         // Read the selected UID's catalog row, not the picker's collapsed base.
-        const maxInputTokens = resolveDevinMaxInputTokens(
-          provider, modelUid, catalog?.byUid.get(modelUid)?.contextWindow,
-        );
+        contextWindow = resolveDevinContextWindow(provider, modelUid, catalog?.byUid.get(modelUid));
+        messages = mapOcxMessagesToDevin(parsed);
+        tools = mapOcxToolsToDevin(parsed.context.tools);
         const maxOutputTokens = resolveDevinMaxOutputTokens(
-          provider, modelUid, parsed.options.maxOutputTokens,
+          provider, modelUid, parsed.options.maxOutputTokens, catalog?.byUid.get(modelUid),
         );
         // A combo child has not committed an outer response yet. Holding its preflight through
         // a reset wait would also hold the next-target fallback with no client keepalive.
@@ -648,18 +764,23 @@ export function createDevinAdapter(
         // An admitted HTTP turn owns globally shared capacity until this call
         // emits. Without an explicit wait allowance, preserve the typed reset
         // delay in generated diagnostic wording and return immediately.
-        for await (const event of streamChatEventsWithResetRetry({
+        const signedMessages = mapOcxMessagesToDevin(parsed);
+        // A Claude signature is replayed because it is what carries the reasoning into this
+        // turn, but Cognition streams Claude's thinking as a summary the signature does not
+        // cover, and some replays are refused with invalid_argument before any output. That
+        // refusal is retried once with the Anthropic signatures withheld and the text kept.
+        const unsignedMessages = hasAnthropicSignature(signedMessages, parsed.modelId)
+          ? mapOcxMessagesToDevin(parsed, { withholdAnthropicSignatures: true })
+          : undefined;
+        const request = (messages: ChatHistoryItem[]) => streamChatEventsWithResetRetry({
           apiKey,
           apiServerUrl: host,
           modelUid,
           catalog,
-          messages: mapOcxMessagesToDevin(parsed),
-          tools: mapOcxToolsToDevin(parsed.context.tools),
+          messages,
+          tools,
           cascadeId,
-          // Input and output ceilings are separate wire fields. Omitting the
-          // input hint used to force every model through the 128k default.
           completionOpts: {
-            ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
             ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),
             ...(typeof parsed.options.temperature === "number" ? { temperature: parsed.options.temperature } : {}),
             ...(typeof parsed.options.topP === "number" ? { topP: parsed.options.topP } : {}),
@@ -675,7 +796,80 @@ export function createDevinAdapter(
             onPhysicalSend: incoming.onPhysicalSend,
             onRecoveryWithheld: incoming.onRecoveryWithheld,
           },
-        })) {
+        });
+        async function* withSignatureFallback() {
+          if (!unsignedMessages) {
+            yield* request(signedMessages);
+            return;
+          }
+          // Events from the signed attempt are held until its outcome is known: a refusal
+          // after reasoning would otherwise leave the client with the refused attempt's
+          // reasoning and signature, and the next turn would replay that signature against
+          // the retry's thinking.
+          const held: CloudChatEvent[] = [];
+          // Usage is still real: the refused attempt was processed, so its final counts are
+          // added to every usage frame of the retry (frames are cumulative per request).
+          let refusedUsage: OcxUsage | undefined;
+          let visible = false;
+          let heldPayloadBytes = 0;
+          // The iterator may pause before a trailer. A timer feeds the bridge during that
+          // pause without starting another upstream read or marking replay unsafe.
+          const heartbeatTimer = setInterval(() => {
+            if (!visible) emit({ type: "heartbeat" });
+          }, HELD_REASONING_HEARTBEAT_MS);
+          try {
+            for await (const event of request(signedMessages)) {
+              // Only visible output makes a retry unsafe. Live, the refusal often lands after the
+              // model has streamed its reasoning, its signature and a finish frame, and nothing else.
+              if (!visible && (event.kind === "text" || event.kind === "tool_call_start" || event.kind === "tool_call_args")) {
+                visible = true;
+                clearInterval(heartbeatTimer);
+                yield* held.splice(0);
+              }
+              if (visible) {
+                yield event;
+                continue;
+              }
+              held.push(event);
+              if (event.kind === "usage") {
+                const next = toOcxDevinUsage(event);
+                refusedUsage = refusedUsage ? mergeDevinUsage(refusedUsage, next) : next;
+              }
+              if (event.kind === "reasoning") heldPayloadBytes += event.text.length * 2;
+              if (event.kind === "reasoning_signature") heldPayloadBytes += event.signature.length * 2;
+              if (held.length > HELD_REASONING_MAX_EVENTS || heldPayloadBytes > HELD_REASONING_MAX_PAYLOAD_BYTES) {
+                visible = true;
+                clearInterval(heartbeatTimer);
+                yield* held.splice(0);
+              }
+            }
+          } catch (error) {
+            clearInterval(heartbeatTimer);
+            if (visible || !(error instanceof CloudChatError && error.code === "invalid_argument")) {
+              yield* held.splice(0);
+              throw error;
+            }
+            // Emitted first so the counts survive a retry that reports no usage or fails early.
+            const cumulativeRefusedUsage = refusedUsage ? toCloudDevinUsage(refusedUsage) : undefined;
+            if (cumulativeRefusedUsage) yield cumulativeRefusedUsage;
+            try {
+              for await (const event of request(unsignedMessages)) {
+                yield event.kind === "usage" && cumulativeRefusedUsage ? addDevinUsage(event, cumulativeRefusedUsage) : event;
+              }
+            } catch (retryError) {
+              if (retryError instanceof SendBudgetExhaustedError) {
+                incoming.onRecoveryWithheld?.({ reason: "retry-send-budget" });
+                throw error;
+              }
+              throw retryError;
+            }
+            return;
+          } finally {
+            clearInterval(heartbeatTimer);
+          }
+          yield* held.splice(0);
+        }
+        for await (const event of withSignatureFallback()) {
           if (incoming.abortSignal?.aborted) {
             // Emitting nothing here left the bridge to synthesize adapter_eof.
             // Say what happened instead, the way the other runTurn-only adapter
@@ -684,6 +878,7 @@ export function createDevinAdapter(
             emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false, ...(usage ? { usage } : {}) });
             return;
           }
+          if (event.kind === "text" || event.kind === "reasoning" || event.kind === "tool_call_start") producedOutput = true;
           if (event.kind === "text") {
             closeOpenTool();
             if (event.text) emit({ type: "text_delta", text: event.text });
@@ -696,7 +891,7 @@ export function createDevinAdapter(
           if (event.kind === "reasoning_signature") {
             // Carried back out so the next turn can replay it in the prompt's
             // signature field; an unsigned replay is what the service ignores.
-            emit({ type: "thinking_signature", signature: event.signature });
+            emit({ type: "thinking_signature", signature: encodeDevinSignature(event.signature, event.signatureType) });
             continue;
           }
           if (event.kind === "tool_call_start") {
@@ -724,15 +919,7 @@ export function createDevinAdapter(
             continue;
           }
           if (event.kind === "usage") {
-            const total = event.totalTokens ?? ((event.promptTokens ?? 0) + (event.completionTokens ?? 0));
-            const next: OcxUsage = {
-              inputTokens: event.promptTokens ?? 0,
-              outputTokens: event.completionTokens ?? 0,
-              ...(total > 0 ? { totalTokens: total } : {}),
-              ...(event.cachedInputTokens !== undefined ? { cachedInputTokens: event.cachedInputTokens } : {}),
-              ...(event.cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens: event.cacheCreationInputTokens } : {}),
-              ...(event.reasoningTokens !== undefined ? { reasoningOutputTokens: event.reasoningTokens } : {}),
-            };
+            const next = toOcxDevinUsage(event);
             // Merge rather than replace. A turn can carry more than one usage
             // frame, and the counters are cumulative, so a later partial frame
             // that omits a field used to zero a count the earlier frame had
@@ -756,6 +943,12 @@ export function createDevinAdapter(
         // The Responses boundary already maps this local refusal to its structured 429 code.
         // Converting it to an adapter event would make it an ordinary untyped upstream error.
         if (error instanceof SendBudgetExhaustedError) throw error;
+        if (error instanceof CloudChatError && isDevinHistoryOverflow({
+          code: error.code, producedOutput, contextWindow, messages, tools,
+        })) {
+          emit({ ...devinContextOverflowEvent(), ...(usage ? { usage } : {}) });
+          return;
+        }
         const message = error instanceof CloudChatError
           ? ("Devin cloud error" + (error.code ? " " + error.code : "") + ": " + error.message)
           : error instanceof Error ? error.message : String(error);