@bitkyc08/opencodex 2.7.13 → 2.7.18

package/src/adapters/cursor/live-transport.ts

@@ -15,14 +15,14 @@ import {
   CreatePlanResultSchema,
   CreatePlanSuccessSchema,
   ExaFetchRequestResponseSchema,
-  ExaFetchRequestResponse_RejectedSchema,
+  ExaFetchRequestResponse_ApprovedSchema,
   ExaSearchRequestResponseSchema,
-  ExaSearchRequestResponse_RejectedSchema,
+  ExaSearchRequestResponse_ApprovedSchema,
   InteractionResponseSchema,
   SwitchModeRequestResponseSchema,
   SwitchModeRequestResponse_RejectedSchema,
   WebSearchRequestResponseSchema,
-  WebSearchRequestResponse_RejectedSchema,
+  WebSearchRequestResponse_ApprovedSchema,
   type AgentServerMessage,
   type ExecServerMessage,
   type InteractionQuery,
@@ -181,8 +181,16 @@ export function planMcpArgsHandling(
  *     Codex as visible output so the user still sees it.
  *   - askQuestion: reject with a reason — the agent must proceed autonomously; there is no human to
  *     answer mid-turn. (Future: bridge to a Codex user-input request.)
- *   - switchMode / webSearch / exaSearch / exaFetch: reject (deterministic default; web search has
- *     its own sidecar path outside this transport).
+ *   - webSearch / exaSearch / exaFetch: APPROVE (empty approval). These are approve/reject
+ *     permission gates, not client-run requests — the response schema has no result field, so
+ *     approval delegates the search to Cursor's SERVER, which runs it and injects results into the
+ *     model server-side (the answer then streams back as textDelta; the display-plane
+ *     web_search_tool_call/exa_*_tool_call result frames are native, non-mcp, and safely dropped by
+ *     the event mapper). Rejecting them (the old default) killed the model's web capability on the
+ *     Cursor path. Tradeoff: approval consumes the user's Cursor web-search/Exa quota. The synthetic
+ *     web_search sidecar (src/web-search) is an orthogonal proxy-side path used only when the client
+ *     sends a hosted web_search tool; it does not cover Cursor-native web search.
+ *   - switchMode: reject (deterministic default; no non-interactive mode switch).
  *   - setupVmEnvironment: the result schema has no error case — reply success so the agent is not
  *     left waiting; the command itself was never run locally.
  * Pure (no I/O) for unit testing; `handleServerMessage` writes the frame and emits liveness.
@@ -240,10 +248,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "webSearchRequestResponse",
         value: create(WebSearchRequestResponseSchema, {
-          result: { case: "rejected", value: create(WebSearchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(WebSearchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "webSearchRequestResponse:rejected",
+      replyCase: "webSearchRequestResponse:approved",
     };
   }
   if (q.case === "exaSearchRequestQuery") {
@@ -251,10 +259,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "exaSearchRequestResponse",
         value: create(ExaSearchRequestResponseSchema, {
-          result: { case: "rejected", value: create(ExaSearchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(ExaSearchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "exaSearchRequestResponse:rejected",
+      replyCase: "exaSearchRequestResponse:approved",
     };
   }
   if (q.case === "exaFetchRequestQuery") {
@@ -262,10 +270,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "exaFetchRequestResponse",
         value: create(ExaFetchRequestResponseSchema, {
-          result: { case: "rejected", value: create(ExaFetchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(ExaFetchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "exaFetchRequestResponse:rejected",
+      replyCase: "exaFetchRequestResponse:approved",
     };
   }
   if (q.case === "setupVmEnvironmentArgs") {

package/src/adapters/cursor/native-exec-fs.ts

@@ -44,7 +44,7 @@ function codexNativeMutationRefusal(operation: "write" | "delete"): string {
 }
 
 const NATIVE_LOCAL_EXEC_DISABLED =
-  "Cursor native local filesystem execution is disabled by default because it bypasses Codex approval and sandbox enforcement. Set provider.unsafeAllowNativeLocalExec=true only for trusted local experiments that may read or mutate local files directly.";
+  "Cursor native local filesystem execution is not available for this request. Use the exec_command tool with equivalent shell commands (cat, head, ls, rg, grep) for file reads and searches, or apply_patch for file edits.";
 
 export function rejectReadExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
   if (execMsg.message.case !== "readArgs") throw new Error("invalid read exec");

package/src/adapters/cursor/native-exec-network.ts

@@ -7,7 +7,7 @@ export interface CursorNativeNetworkDeps {
 }
 
 const NATIVE_FETCH_DISABLED =
-  "Cursor native fetch execution is disabled by default because it bypasses Codex approval and sandbox enforcement. Set provider.unsafeAllowNativeLocalExec=true only for trusted local experiments that may make local network requests directly.";
+  "Cursor native fetch execution is not available for this request. Use the exec_command tool with curl or wget to make network requests instead.";
 
 export function rejectFetchExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
   if (execMsg.message.case !== "fetchArgs") throw new Error("invalid fetch exec");

package/src/adapters/cursor/native-exec-shell.ts

@@ -24,7 +24,7 @@ const backgroundShells = new Map<number, { child: ChildProcessWithoutNullStreams
 let nextShellId = 1;
 
 const NATIVE_SHELL_DISABLED =
-  "Cursor native shell execution is disabled by default because it bypasses Codex approval and sandbox enforcement. Set provider.unsafeAllowNativeLocalExec=true only for trusted local experiments that may run local commands directly.";
+  "Cursor native shell execution is not available for this request. Use the exec_command tool to run shell commands instead.";
 
 function rejectedShellResult(command: string, cwd: string, started: number) {
   return create(ShellResultSchema, {

package/src/adapters/cursor/protobuf-request.ts

@@ -108,12 +108,13 @@ function rootPromptMessages(request: CursorRunRequest): Uint8Array[] {
     } else if (message.role === "assistant") {
       const text = assistantRootText(message).trim();
       if (text.length > 0) entries.push(storeCursorBlob(jsonBlob({ role: "assistant", content: [{ type: "text", text }] })));
-      for (const part of message.content) {
-        if (typeof part === "string" || part.type !== "toolCall") continue;
-        const toolName = namespacedToolName(part.namespace, part.name);
-        const callText = `[Tool Call]\ncall_id: ${part.id}\nname: ${toolName}\narguments:\n${JSON.stringify(part.arguments ?? {})}`;
-        entries.push(storeCursorBlob(jsonBlob({ role: "assistant", content: [{ type: "text", text: callText }] })));
-      }
+      // Assistant tool CALLS are intentionally NOT replayed as visible "[Tool Call]" text here.
+      // rootPromptMessagesJson is the model-visible prompt, so a synthetic "[Tool Call]" marker in an
+      // assistant turn gets few-shot-mimicked: the model then emits later (esp. parallel/mixed) tool
+      // calls as inert text instead of real tool frames, halting multi-tool continuations. The paired
+      // tool result below ([Tool Result]/[Tool Error]) carries the call id/name/output Cursor needs to
+      // continue, and conversationTurns replays the native mcpToolCall step. Mirrors request-builder.ts
+      // contentPartToText() which returns undefined for toolCall for the same reason.
     } else if (message.role === "toolResult") {
       const prefix = message.isError ? "[Tool Error]" : "[Tool Result]";
       const text = `${prefix}\n${toolResultToText(message)}`;

package/src/adapters/cursor/tool-definitions.ts

@@ -272,6 +272,9 @@ export function buildCursorToolGuidanceSystemNote(
       ? `Use ${discoveryTools} only for explicit discovery/resource tasks, not generic tool-count demos.`
       : undefined,
     "Do not count or report a tool call unless a tool result was actually returned.",
+    hasBareExec
+      ? "If a built-in file read, directory listing, grep, or shell operation is rejected by the runtime, use \`exec_command\` with the equivalent shell command instead (e.g. \`cat\`, \`ls\`, \`rg\`, \`grep\`). For file edits, use \`apply_patch\` when available."
+      : undefined,
   ].filter((note): note is string => typeof note === "string");
   return notes.join(" ");
 }

package/src/adapters/google-http.ts

@@ -36,7 +36,7 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
         method: request.method,
         headers: request.headers,
         body: request.body,
-      }, timeoutMs, ctx.abortSignal);
+      }, timeoutMs, ctx.abortSignal, ctx.stream);
       if (!retryableGoogleStatus(res.status) || attempt === GOOGLE_RETRY_ATTEMPTS - 1) {
         return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
       }

package/src/adapters/kiro-images.ts

@@ -1,4 +1,5 @@
 import type { OcxContentPart } from "../types";
+import { normalizeImageTargets, type NormalizeOptions, type NormalizeTarget } from "./anthropic-image-normalize";
 
 // CodeWhisperer native image part (matches Kiro IDE wire format): the base64 bytes live directly in
 // userInputMessage.images, NOT in userInputMessageContext. Verified against kiro-gateway.
@@ -33,3 +34,96 @@ export function extractKiroImages(content: string | OcxContentPart[]): KiroImage
   }
   return out;
 }
+
+/**
+ * Conservative POLICY caps for the CodeWhisperer GenerateAssistantResponse payload,
+ * whose limits are undocumented. Derived from adjacent AWS surfaces
+ * (devlog/260714_image_normalization_pipeline/050): Bedrock `Message` allows 20 images
+ * per message (Converse), and `InvokeModel` caps requests at 25,000,000 bytes — 18MiB
+ * bounds the IMAGE share of the body with headroom for text/tools.
+ */
+export const KIRO_IMAGE_BASE64_BUDGET = 18 * 1024 * 1024;
+export const KIRO_MAX_IMAGES_PER_MESSAGE = 20;
+
+const COUNT_CAP_NOTE = "[image omitted: exceeded the 20-image per-message cap; oldest images in this message were dropped]";
+
+/** A kiro wire message that can carry images (history userInputMessage or currentMessage). */
+interface KiroImageCarrier {
+  content?: string;
+  images?: KiroImage[];
+}
+
+function isCarrier(v: unknown): v is KiroImageCarrier {
+  return typeof v === "object" && v !== null;
+}
+
+/** Collect image-bearing userInputMessages in wire order (history oldest-first, then current). */
+function collectKiroImageCarriers(payload: unknown): KiroImageCarrier[] {
+  const state = (payload as { conversationState?: { history?: unknown[]; currentMessage?: { userInputMessage?: unknown } } })?.conversationState;
+  if (!state) return [];
+  const carriers: KiroImageCarrier[] = [];
+  for (const entry of state.history ?? []) {
+    const uim = (entry as { userInputMessage?: unknown })?.userInputMessage;
+    if (isCarrier(uim)) carriers.push(uim);
+  }
+  const current = state.currentMessage?.userInputMessage;
+  if (isCarrier(current)) carriers.push(current);
+  return carriers;
+}
+
+function appendNote(carrier: KiroImageCarrier, note: string): void {
+  carrier.content = carrier.content ? `${carrier.content}\n${note}` : note;
+}
+
+/**
+ * Apply the generous image pipeline to a built CodeWhisperer payload (mutates in
+ * place): per-message 20-image cap first (oldest dropped), then the shared tier
+ * machinery with the kiro budget and terminal-overflow DROP (kiro has no downstream
+ * guard). Test seams (encode/validate) forward into the core.
+ */
+export async function normalizeKiroImages(
+  payload: unknown,
+  opts?: Pick<NormalizeOptions, "encode" | "validate">,
+): Promise<void> {
+  const carriers = collectKiroImageCarriers(payload);
+  if (carriers.length === 0) return;
+
+  // Pre-pass: per-message count cap (drop oldest within the message).
+  for (const carrier of carriers) {
+    const images = carrier.images;
+    if (!images || images.length <= KIRO_MAX_IMAGES_PER_MESSAGE) continue;
+    images.splice(0, images.length - KIRO_MAX_IMAGES_PER_MESSAGE);
+    appendNote(carrier, COUNT_CAP_NOTE);
+  }
+
+  // Targets over the survivors, oldest→newest across carriers. Drops resolve the image
+  // by OBJECT IDENTITY at execution time (indices go stale after earlier splices) and
+  // delete an emptied images field per the builder's omission contract.
+  const targets: NormalizeTarget[] = [];
+  for (const carrier of carriers) {
+    for (const img of carrier.images ?? []) {
+      targets.push({
+        base64: typeof img.source?.bytes === "string" && img.source.bytes.length > 0 ? img.source.bytes : null,
+        mediaType: `image/${(img.format || "jpeg").toLowerCase()}`,
+        replace: (data: string, mediaType: string) => {
+          img.source.bytes = data;
+          img.format = (mediaType.split("/")[1] ?? "jpeg").toLowerCase();
+        },
+        drop: (note: string) => {
+          const arr = carrier.images;
+          if (arr) {
+            const idx = arr.indexOf(img);
+            if (idx !== -1) arr.splice(idx, 1);
+            if (arr.length === 0) delete carrier.images;
+          }
+          appendNote(carrier, note);
+        },
+      });
+    }
+  }
+  await normalizeImageTargets(targets, {
+    budget: KIRO_IMAGE_BASE64_BUDGET,
+    overflowAction: "drop",
+    ...(opts ?? {}),
+  });
+}

package/src/adapters/kiro-retry.ts

@@ -39,7 +39,7 @@ export async function fetchKiroWithRetry(request: AdapterRequest, ctx: AdapterFe
         method: request.method,
         headers: request.headers,
         body: request.body,
-      }, timeoutMs, ctx.abortSignal);
+      }, timeoutMs, ctx.abortSignal, ctx.stream);
       if (!retryableKiroStatus(res.status) || attempt === KIRO_RETRY_ATTEMPTS - 1) {
         return ctx.returnRawErrors ? res : normalizeFinalKiroHttpError(res, ctx.abortSignal);
       }

package/src/adapters/kiro.ts

@@ -25,7 +25,7 @@ import type {
 } from "../types";
 import type { ProviderAdapter } from "./base";
 import type { AdapterFetchContext, AdapterRequest } from "./base";
-import { extractKiroImages, type KiroImage } from "./kiro-images";
+import { extractKiroImages, normalizeKiroImages, type KiroImage } from "./kiro-images";
 import { fetchKiroWithRetry } from "./kiro-retry";
 import { convertKiroToolContext } from "./kiro-tools";
 import { neutralizeIdentity } from "./identity";
@@ -497,7 +497,7 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
   let toolNameMap: Map<string, string> | undefined;
   return {
     name: "kiro",
-    buildRequest(parsed: OcxParsedRequest) {
+    async buildRequest(parsed: OcxParsedRequest) {
       if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
         throw new Error("kiro token missing — run ocx login kiro");
       }
@@ -520,6 +520,10 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       // fake-reasoning contract by injecting effort-derived thinking tags into only the current user turn.
       const built = buildKiroPayload(parsed, profileArn);
       toolNameMap = built.nameMap;
+      // Generous image pipeline (devlog/260714_image_normalization_pipeline/050):
+      // tier-normalize + cap images before serialization so bodyBytes below reflects
+      // the normalized size.
+      await normalizeKiroImages(built.payload);
       const body = JSON.stringify(built.payload);
       debugProviderDiagnostic("kiro", "request", {
         region,

package/src/adapters/openai-chat.ts

@@ -2,6 +2,7 @@ import type { ProviderAdapter } from "./base";
 import type { AdapterEvent, OcxAssistantMessage, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTextContent, OcxThinkingContent, OcxToolCall, OcxUsage } from "../types";
 import { isAllowedToolChoice, modelInList, namespacedToolName, resolveToolChoiceWireName, toolAllowedByChoice } from "../types";
 import { mapReasoningEffort } from "../reasoning-effort";
+import { redactSecretString } from "../lib/redact";
 import { contentPartsToText } from "./image";
 import { neutralizeIdentity } from "./identity";
 import { buildNonOpenAIToolCatalogNudgeForTools, shouldInjectNonOpenAIToolCatalogNudge } from "./tool-catalog-nudge";
@@ -13,6 +14,52 @@ export function stripBracketedModelSuffix(modelId: string): string {
   return modelId.replace(/\[[^\]]*\]\s*$/, "");
 }
 
+// 260715 (issue #126): surface upstream error detail through the web-search sidecar loop.
+// loop.ts only appends a suffix to "Provider error N" when the adapter exposes
+// formatErrorBody; without it, strict OpenAI-compatible backends (NVIDIA NIM pydantic
+// validation, "This model only supports single tool-calls at once!", etc.) were reduced
+// to a bare status code. JSON-only extraction: recognized string fields are returned,
+// HTML/non-JSON bodies yield "" so raw markup is never echoed to the client.
+export function formatOpenAIChatErrorBody(status: number, _headers: Headers, payloadText: string): string {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(payloadText);
+  } catch {
+    return "";
+  }
+  const detail = extractErrorDetail(parsed);
+  if (!detail) return "";
+  return redactSecretString(detail).slice(0, 400);
+}
+
+function extractErrorDetail(parsed: unknown): string | undefined {
+  if (typeof parsed === "string") return parsed.trim() || undefined;
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+  const obj = parsed as Record<string, unknown>;
+  // OpenAI shape: { error: { message } } or { error: "..." }
+  const err = obj.error;
+  if (typeof err === "string" && err.trim()) return err.trim();
+  if (err !== null && typeof err === "object" && !Array.isArray(err)) {
+    const msg = (err as Record<string, unknown>).message;
+    if (typeof msg === "string" && msg.trim()) return msg.trim();
+  }
+  // FastAPI/pydantic shape (NVIDIA NIM): { detail: "..." } or { detail: [{ msg, loc }, ...] }
+  const det = obj.detail;
+  if (typeof det === "string" && det.trim()) return det.trim();
+  if (Array.isArray(det)) {
+    const msgs = det
+      .map(item => (item !== null && typeof item === "object" && typeof (item as Record<string, unknown>).msg === "string"
+        ? ((item as Record<string, unknown>).msg as string).trim()
+        : ""))
+      .filter(m => m.length > 0);
+    if (msgs.length > 0) return msgs.join("; ");
+  }
+  // Generic fallbacks: { message } / RFC7807 { title }
+  if (typeof obj.message === "string" && obj.message.trim()) return obj.message.trim();
+  if (typeof obj.title === "string" && obj.title.trim()) return obj.title.trim();
+  return undefined;
+}
+
 function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderConfig): unknown[] {
   const out: unknown[] = [];
   const { context, options } = parsed;
@@ -125,7 +172,49 @@ function safeToolName(name: string | undefined): string {
   return sanitized;
 }
 
-function toolsToChatFormat(parsed: OcxParsedRequest): unknown[] | undefined {
+const XAI_SCHEMA_BASE_URLS = new Set(["api.x.ai", "cli-chat-proxy.grok.com"]);
+
+function isXaiSchemaTarget(provider: OcxProviderConfig): boolean {
+  try {
+    return XAI_SCHEMA_BASE_URLS.has(new URL(provider.baseUrl).hostname);
+  } catch {
+    return false;
+  }
+}
+
+function expandXaiRootObjectSchemas(schema: unknown): Record<string, unknown>[] | undefined {
+  if (!schema || typeof schema !== "object" || Array.isArray(schema)) return undefined;
+  const obj = schema as Record<string, unknown>;
+  const compositionKey = ["oneOf", "anyOf"].find(key => Array.isArray(obj[key]));
+  if (!compositionKey) {
+    if (obj.type !== undefined && obj.type !== "object") return undefined;
+    return [{ ...obj, type: "object" }];
+  }
+
+  const siblings = Object.fromEntries(Object.entries(obj).filter(([key]) => key !== compositionKey));
+  const branches = obj[compositionKey];
+  if (!Array.isArray(branches)) return undefined;
+  const expanded: Record<string, unknown>[] = [];
+  for (const branch of branches) {
+    const variants = expandXaiRootObjectSchemas(branch);
+    if (!variants) return undefined;
+    for (const variant of variants) expanded.push({ ...siblings, ...variant });
+  }
+  return expanded.length > 0 ? expanded : undefined;
+}
+
+function normalizeXaiToolParameters(parameters: unknown): Record<string, unknown> | undefined {
+  const variants = expandXaiRootObjectSchemas(parameters);
+  if (!variants) return undefined;
+  if (variants.length === 1) return variants[0];
+  const root = parameters && typeof parameters === "object" && !Array.isArray(parameters)
+    ? parameters as Record<string, unknown>
+    : {};
+  const metadata = Object.fromEntries(Object.entries(root).filter(([key]) => key !== "oneOf" && key !== "anyOf" && key !== "type"));
+  return { ...metadata, oneOf: variants };
+}
+
+function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderConfig): unknown[] | undefined {
   if (!parsed.context.tools || parsed.context.tools.length === 0) return undefined;
   const allowed = isAllowedToolChoice(parsed.options.toolChoice)
     ? new Set(parsed.options.toolChoice.allowedTools)
@@ -134,15 +223,21 @@ function toolsToChatFormat(parsed: OcxParsedRequest): unknown[] | undefined {
     ? parsed.context.tools.filter(t => toolAllowedByChoice(t, allowed))
     : parsed.context.tools;
   if (tools.length === 0) return undefined;
-  return tools.map(t => ({
+  const xaiTarget = isXaiSchemaTarget(provider);
+  const formatted = tools.flatMap(t => {
+    const parameters = xaiTarget ? normalizeXaiToolParameters(t.parameters) : t.parameters;
+    if (parameters === undefined) return [];
+    return [{
     type: "function",
     function: {
       name: namespacedToolName(t.namespace, t.name),
       description: t.description,
-      parameters: t.parameters,
+      parameters,
       ...(t.strict !== undefined ? { strict: t.strict } : {}),
     },
-  }));
+    }];
+  });
+  return formatted.length > 0 ? formatted : undefined;
 }
 
 function toolChoiceToChatFormat(tc: OcxParsedRequest["options"]["toolChoice"], tools: OcxParsedRequest["context"]["tools"]): unknown {
@@ -183,6 +278,8 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
   return {
     name: "openai-chat",
 
+    formatErrorBody: formatOpenAIChatErrorBody,
+
     buildRequest(parsed: OcxParsedRequest) {
       const hasCredential = typeof provider.apiKey === "string" && provider.apiKey.trim().length > 0;
       if ((provider.authMode === "key" || provider.authMode === "oauth") && !provider.keyOptional && !hasCredential) {
@@ -190,7 +287,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       }
 
       const messages = messagesToChatFormat(parsed, provider);
-      const tools = toolsToChatFormat(parsed);
+      const tools = toolsToChatFormat(parsed, provider);
       const toolChoice = toolChoiceToChatFormat(parsed.options.toolChoice, parsed.context.tools);
 
       const body: Record<string, unknown> = {

package/src/adapters/openai-responses.ts

@@ -52,6 +52,55 @@ function sanitizeReasoningInputContent(body: unknown): unknown {
   return changed ? { ...raw, input } : body;
 }
 
+function stripInvalidItemIds(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+
+  const validPrefixes: Record<string, string> = {
+    message: "msg_",
+    reasoning: "rs_",
+    function_call: "fc_",
+    custom_tool_call: "ctc_",
+    tool_search_call: "tsc_",
+    web_search_call: "ws_",
+  };
+  let changed = false;
+  const input = body.input.map(item => {
+    if (!isPlainObject(item) || typeof item.type !== "string") return item;
+    const validPrefix = validPrefixes[item.type];
+    if (!validPrefix) return item;
+    if (typeof item.id === "string" && item.id.startsWith(validPrefix)) return item;
+    if (!("id" in item)) return item;
+    changed = true;
+    const next = { ...item };
+    delete next.id;
+    return next;
+  });
+
+  return changed ? { ...body, input } : body;
+}
+
+/**
+ * When `store` is false, the upstream API does not persist response items. Any item ID
+ * forwarded in `input` is then interpreted as a reference to a stored item that does not
+ * exist, producing a 404. Strip all item IDs in this case — `call_id` pairing is unaffected.
+ * Matches codex-rs behavior (core/src/client.rs:918-925).
+ */
+function stripItemIdsWhenUnstored(body: unknown): unknown {
+  if (!isPlainObject(body) || body.store !== false) return body;
+  if (!Array.isArray(body.input)) return body;
+
+  let changed = false;
+  const input = body.input.map(item => {
+    if (!isPlainObject(item) || !("id" in item)) return item;
+    changed = true;
+    const next = { ...item };
+    delete next.id;
+    return next;
+  });
+
+  return changed ? { ...body, input } : body;
+}
+
 /**
  * Replace proxy-minted compaction items (`encrypted_content` starting with `ocx1:`) with plain
  * user messages before forwarding to the ChatGPT backend. Our envelope is transparent base64, not
@@ -87,9 +136,135 @@ function scrubOcxCompactionItems(body: unknown): unknown {
  * Extend this when another native slug rejects a hosted tool (e.g. `code_interpreter`).
  */
 const UNSUPPORTED_HOSTED_TOOLS: ReadonlyArray<{ match: (model: string) => boolean; tools: ReadonlySet<string> }> = [
-  { match: model => model.includes("codex-spark"), tools: new Set(["image_generation"]) },
+  { match: model => model.includes("codex-spark"), tools: new Set(["image_generation", "tool_search"]) },
 ];
 
+/**
+ * Strip unsupported `reasoning` sub-parameters for native slugs that reject them (e.g. Spark).
+ * codex-rs injects `reasoning.context` and `reasoning.summary` based on catalog flags; Spark's
+ * backend rejects both. The catalog fix prevents `use_responses_lite` from being set, but this
+ * is a defense-in-depth guard so stale on-disk catalogs don't break until the user runs `ocx sync`.
+ */
+function stripUnsupportedReasoningParams(body: unknown): unknown {
+  if (!isPlainObject(body)) return body;
+  const model = typeof body.model === "string" ? body.model : "";
+  if (!model.includes("codex-spark")) return body;
+  if (!isPlainObject(body.reasoning)) return body;
+  const reasoning = body.reasoning as Record<string, unknown>;
+  // Spark supports reasoning.effort but rejects context, summary, and generate_summary.
+  const { context: _ctx, summary: _sum, generate_summary: _gs, ...rest } = reasoning;
+  if (_ctx === undefined && _sum === undefined && _gs === undefined) return body;
+  return { ...body, reasoning: Object.keys(rest).length > 0 ? rest : undefined };
+}
+
+/**
+ * Comprehensive Spark compatibility layer. codex-rs emits five tool types (function,
+ * namespace, tool_search, web_search, custom) plus extensions (defer_loading,
+ * parallel_tool_calls, tool_search_call/output items). Spark's serving path only
+ * supports flat function tools and hosted web_search. This function:
+ * - Flattens namespace tools → promotes inner functions to top level
+ * - Drops unsupported tool types (tool_search, custom)
+ * - Strips defer_loading from function tools
+ * - Strips namespace from input items
+ * - Drops tool_search_call/tool_search_output input items
+ * - Sets parallel_tool_calls to false
+ */
+function stripSparkCompatibility(body: unknown): unknown {
+  if (!isPlainObject(body)) return body;
+  const model = typeof body.model === "string" ? body.model : "";
+  if (!model.includes("codex-spark")) return body;
+
+  let changed = false;
+
+  const SPARK_SAFE_TOOL_TYPES = new Set(["function", "web_search", "web_search_preview"]);
+
+  let tools = body.tools;
+  if (Array.isArray(tools)) {
+    const flattened: unknown[] = [];
+    for (const t of tools) {
+      if (isPlainObject(t) && t.type === "namespace") {
+        changed = true;
+        if (Array.isArray(t.tools)) {
+          for (const inner of t.tools) flattened.push(inner);
+        }
+      } else if (isPlainObject(t) && typeof t.type === "string" && !SPARK_SAFE_TOOL_TYPES.has(t.type)) {
+        changed = true;
+      } else {
+        flattened.push(t);
+      }
+    }
+    // Strip defer_loading from promoted/remaining function tools.
+    tools = flattened.map(t => {
+      if (isPlainObject(t) && t.type === "function" && "defer_loading" in t) {
+        const { defer_loading: _, ...rest } = t;
+        changed = true;
+        return rest;
+      }
+      return t;
+    });
+  }
+
+  // Clean input items: strip namespace, drop tool_search_call/tool_search_output.
+  const SPARK_UNSUPPORTED_INPUT_TYPES = new Set([
+    "tool_search_call", "tool_search_output",
+    "custom_tool_call", "custom_tool_call_output",
+  ]);
+  let input = body.input;
+  if (Array.isArray(input)) {
+    const cleaned: unknown[] = [];
+    for (const item of input) {
+      if (isPlainObject(item) && typeof item.type === "string" && SPARK_UNSUPPORTED_INPUT_TYPES.has(item.type)) {
+        changed = true;
+        continue;
+      }
+      // Process additional_tools items: filter their inner tools array the same way.
+      if (isPlainObject(item) && item.type === "additional_tools" && Array.isArray(item.tools)) {
+        const innerTools = item.tools as unknown[];
+        const filteredInner: unknown[] = [];
+        for (const t of innerTools) {
+          if (isPlainObject(t) && t.type === "namespace") {
+            changed = true;
+            if (Array.isArray(t.tools)) {
+              for (const fn of t.tools) filteredInner.push(fn);
+            }
+          } else if (isPlainObject(t) && typeof t.type === "string" && !SPARK_SAFE_TOOL_TYPES.has(t.type)) {
+            changed = true; // drop custom, tool_search, etc.
+          } else {
+            filteredInner.push(t);
+          }
+        }
+        // Strip defer_loading from remaining function tools.
+        const cleanedInner = filteredInner.map(t => {
+          if (isPlainObject(t) && t.type === "function" && "defer_loading" in t) {
+            const { defer_loading: _, ...rest } = t;
+            changed = true;
+            return rest;
+          }
+          return t;
+        });
+        cleaned.push({ ...item, tools: cleanedInner });
+        continue;
+      }
+      if (isPlainObject(item) && "namespace" in item) {
+        const { namespace: _, ...rest } = item;
+        changed = true;
+        cleaned.push(rest);
+      } else {
+        cleaned.push(item);
+      }
+    }
+    if (changed) input = cleaned;
+  }
+
+  // Force parallel_tool_calls off for Spark.
+  const extraOverrides: Record<string, unknown> = {};
+  if (body.parallel_tool_calls === true) { extraOverrides.parallel_tool_calls = false; changed = true; }
+
+  return changed
+    ? { ...body, ...(tools !== body.tools ? { tools } : {}), ...(input !== body.input ? { input } : {}), ...extraOverrides }
+    : body;
+}
+
 function isPlainObject(v: unknown): v is Record<string, unknown> {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
@@ -282,7 +457,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         url,
         method: "POST",
         headers,
-        body: JSON.stringify(stripUnsupportedHostedTools(sanitizeReasoningInputContent(scrubOcxCompactionItems(outBody)))),
+        body: JSON.stringify(stripSparkCompatibility(stripUnsupportedReasoningParams(stripItemIdsWhenUnstored(stripInvalidItemIds(stripUnsupportedHostedTools(sanitizeReasoningInputContent(scrubOcxCompactionItems(outBody)))))))),
       };
     },