@bitkyc08/opencodex 2.7.17 → 2.7.19

package/src/providers/registry.ts

@@ -23,6 +23,8 @@ export interface ProviderRegistryEntry {
   allowPrivateNetworkByDefault?: boolean;
   keyOptional?: boolean;
   allowBaseUrlOverride?: boolean;
+  /** Static headers merged into every upstream request for this provider. */
+  staticHeaders?: Record<string, string>;
   modelSuffixBracketStrip?: boolean;
   featured?: boolean;
   dashboardPreset?: boolean;
@@ -66,7 +68,7 @@ export type ProviderConfigSeed = Pick<
   | "reasoningEfforts" | "modelReasoningEfforts" | "reasoningEffortMap" | "modelReasoningEffortMap"
   | "noVisionModels" | "noReasoningModels" | "noTemperatureModels" | "noTopPModels" | "noPenaltyModels"
   | "autoToolChoiceOnlyModels" | "preserveReasoningContentModels" | "thinkingToggleModels" | "thinkingBudgetModels" | "escapeBuiltinToolNames"
-  | "googleMode" | "project" | "location"
+  | "googleMode" | "project" | "location" | "headers"
 >;
 
 // Shared between the OAuth (Claude account) and API-key Anthropic entries so both expose the
@@ -133,6 +135,7 @@ const THINKING_BUDGET_MODELS = [
 ];
 const OPENCODE_GO_THINKING_BUDGET_MODELS = ["qwen3.5-plus", "qwen3.6-plus", "qwen3.7-max", "qwen3.7-plus"];
 const DEEPSEEK_THINKING_MODELS = ["deepseek-v4-pro", "deepseek-v4-flash"];
+const OPENCODE_FREE_DEEPSEEK_MODELS = ["deepseek-v4-flash-free"];
 // "max" is advertised too: the wire map routes xhigh->max and max->max, so the picker
 // should surface the max tier instead of hiding it behind xhigh.
 const DEEPSEEK_THINKING_EFFORTS = ["high", "xhigh", "max"];
@@ -153,6 +156,17 @@ const KIMI_AUTO_TOOL_CHOICE_ONLY_MODELS = ["kimi-k2.7-code", "kimi-k2.7-code-hig
 const KIMI_API_MODEL_CONTEXT_WINDOWS: Record<string, number> = Object.fromEntries(
   KIMI_API_MODELS.map(id => [id, 262_144]),
 );
+
+// 260715 NVIDIA NIM kimi family (issue #126): documented served ids on integrate
+// chat/completions per docs.api.nvidia.com/nim/reference/llm-apis; live /v1/models
+// currently lists only kimi-k2.6 but the list is dynamic, so carry the documented family.
+const NVIDIA_NIM_KIMI_THINKING_MODELS = [
+  "moonshotai/kimi-k2.6", "moonshotai/kimi-k2.5", "moonshotai/kimi-k2-thinking",
+];
+const NVIDIA_NIM_KIMI_MODELS = [
+  ...NVIDIA_NIM_KIMI_THINKING_MODELS,
+  "moonshotai/kimi-k2-instruct", "moonshotai/kimi-k2-instruct-0905",
+];
 const KIMI_CODING_MODEL_CONTEXT_WINDOWS: Record<string, number> = Object.fromEntries(
   KIMI_CODING_MODELS.map(id => [id, 262_144]),
 );
@@ -202,7 +216,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     authKind: "oauth",
     featured: false,
     dashboardPreset: true,
-    note: "Experimental Cursor bridge. Live transport and live model discovery are enabled after a standalone PKCE browser login via 'ocx login cursor'; native read/write/delete/shell/fetch execution defaults to codex-sandbox mode (auto-enabled when the request declares Codex danger-full-access sandbox); override with \"nativeLocalExec\": \"on\" (always) or \"codex-sandbox\" (only for requests declaring the Codex danger-full-access sandbox; the declaration is caller-controlled prose the proxy cannot verify, and the auth-free loopback bind admits any process on this host, including other local users — enable only where every data-plane client is trusted) — legacy \"unsafeAllowNativeLocalExec\": true still means \"on\" — on providers.cursor in ~/.opencodex/config.json (dashboard: Providers → Cursor → Edit JSON) for a trusted local experiment.",
+    note: "Experimental Cursor bridge. Live transport and live model discovery are enabled after a standalone PKCE browser login via 'ocx login cursor'; native read/write/delete/shell/fetch execution defaults to codex-sandbox mode (auto-enabled when the request declares Codex danger-full-access sandbox); override with \"nativeLocalExec\": \"on\" (always), \"off\" (never), or \"codex-sandbox\" (only for requests declaring the Codex danger-full-access sandbox; the declaration is caller-controlled prose the proxy cannot verify, and the auth-free loopback bind admits any process on this host, including other local users — enable only where every data-plane client is trusted) — legacy \"unsafeAllowNativeLocalExec\": true still means \"on\" — on providers.cursor in ~/.opencodex/config.json (dashboard: Providers → Cursor → Edit JSON) for a trusted local experiment.",
     models: cursorModelIds(CURSOR_STATIC_MODELS),
     liveModels: true,
     defaultModel: "auto",
@@ -497,7 +511,21 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     preserveReasoningContentModels: KIMI_API_MODELS,
   },
   { id: "huggingface", label: "Hugging Face", baseUrl: "https://router.huggingface.co/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://huggingface.co/settings/tokens" },
-  { id: "nvidia", label: "NVIDIA NIM", baseUrl: "https://integrate.api.nvidia.com/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://build.nvidia.com" },
+  // 260715 NIM hardening (issue #126, devlog/_plan/260715_issue126_nim_kimi):
+  // - NIM kimi rejects `parallel_tool_calls: true` with 400 "This model only supports single
+  //   tool-calls at once!" (openclaw#37048). NVIDIA's own function-calling docs default the
+  //   Boolean to false, so provider-wide `false` is the documented-safe wire value.
+  // - `reasoning_effort` is not portable on NIM (models use chat_template_kwargs); the kimi
+  //   family is live-discovered with no capability metadata, so Codex would otherwise send
+  //   reasoning_effort=medium. Exact-id lists per modelInList semantics; gpt-oss on NIM keeps
+  //   its working reasoning_effort. Future kimi ids must be appended individually.
+  {
+    id: "nvidia", label: "NVIDIA NIM", baseUrl: "https://integrate.api.nvidia.com/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://build.nvidia.com",
+    parallelToolCalls: false,
+    noReasoningModels: NVIDIA_NIM_KIMI_MODELS,
+    modelReasoningEfforts: Object.fromEntries(NVIDIA_NIM_KIMI_MODELS.map(id => [id, []])),
+    preserveReasoningContentModels: NVIDIA_NIM_KIMI_THINKING_MODELS,
+  },
   { id: "venice", label: "Venice", baseUrl: "https://api.venice.ai/api/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://venice.ai/settings/api" },
   // 260710 GLM-5.2 context and path-specific ids: Tier-2 evidence in
   // devlog/_plan/260710_provider_hardening/002_research_cn.md.
@@ -583,8 +611,41 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   },
   { id: "opencode-zen", label: "opencode zen", baseUrl: "https://opencode.ai/zen/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://opencode.ai/auth" },
   { id: "vercel-ai-gateway", label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://vercel.com/dashboard" },
+  {
+    id: "opencode-free",
+    label: "OpenCode Free",
+    adapter: "openai-chat",
+    baseUrl: "https://opencode.ai/zen/v1",
+    authKind: "key",
+    keyOptional: true,
+    featured: true,
+    liveModels: true,
+    note: "No key needed — public desktop tier. OpenCode currently advertises about 200 Big Pickle/free-model requests per 5 hours. Free models are discovered live from Zen. Data use: per OpenCode's Zen docs (https://opencode.ai/docs/zen/), prompts sent to free models may be retained and used for training/improvement — do not send confidential material through this provider.",
+    dashboardUrl: "https://opencode.ai",
+    staticHeaders: {
+      "x-opencode-client": "desktop",
+    },
+    modelReasoningEfforts: Object.fromEntries(OPENCODE_FREE_DEEPSEEK_MODELS.map(id => [id, DEEPSEEK_THINKING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(OPENCODE_FREE_DEEPSEEK_MODELS.map(id => [id, DEEPSEEK_THINKING_REASONING_MAP])),
+    preserveReasoningContentModels: OPENCODE_FREE_DEEPSEEK_MODELS,
+    noVisionModels: OPENCODE_FREE_DEEPSEEK_MODELS,
+  },
   { id: "xiaomi", label: "Xiaomi MiMo", baseUrl: "https://api.xiaomimimo.com/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://xiaomimimo.com", defaultModel: "mimo-v2.5-pro" },
   { id: "kilo", label: "Kilo", baseUrl: "https://api.kilo.ai/api/gateway", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://kilo.ai" },
+  {
+    id: "mimo-free",
+    label: "MiMo Free",
+    adapter: "mimo-free",
+    baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat",
+    authKind: "key",
+    keyOptional: true,
+    featured: true,
+    liveModels: true,
+    dashboardUrl: "https://xiaomimimo.com",
+    defaultModel: "mimo-auto",
+    models: ["mimo-auto"],
+    note: "No key needed — uses Xiaomi MiMo's free public tier (limited-time offer). A JWT is bootstrapped automatically with an anonymous random client id stored locally. The endpoint contract mirrors the official MiMoCode client and is not publicly documented — Xiaomi may change or restrict it at any time. Prompts may be processed/retained by Xiaomi; do not send confidential material.",
+  },
   { id: "cloudflare-ai-gateway", label: "Cloudflare AI Gateway", baseUrl: "https://gateway.ai.cloudflare.com/v1/{account-id}/{gateway}/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway" },
   // FREEZE 2026-07-10: /models is auth-gated, so ids remain unverified. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
   { id: "github-copilot", label: "GitHub Copilot", baseUrl: "https://api.githubcopilot.com", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://github.com/settings/copilot" },

package/src/server/adapter-resolve.ts

@@ -3,6 +3,7 @@ import { createAzureAdapter } from "../adapters/azure";
 import { createCursorAdapter } from "../adapters/cursor";
 import { createGoogleAdapter } from "../adapters/google";
 import { createKiroAdapter } from "../adapters/kiro";
+import { createMimoFreeAdapter } from "../adapters/mimo-free";
 import { createOpenAIChatAdapter } from "../adapters/openai-chat";
 import { createResponsesPassthroughAdapter } from "../adapters/openai-responses";
 import type { OcxProviderConfig } from "../types";
@@ -40,6 +41,8 @@ export function resolveAdapter(providerConfig: OcxProviderConfig, cacheRetention
       return createAzureAdapter(providerConfig);
     case "cursor":
       return createCursorAdapter(providerConfig);
+    case "mimo-free":
+      return createMimoFreeAdapter(providerConfig);
     default:
       throw new Error(`Unknown adapter: ${providerConfig.adapter}`);
   }

package/src/server/auth-cors.ts

@@ -6,6 +6,7 @@ import {
   providerHeadersConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
+import { getProviderRegistryEntry } from "../providers/registry";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 let _corsOrigin = "http://localhost:10100";
@@ -210,6 +211,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "disabled",
       "allowPrivateNetwork",
       "authMode",
+      "keyOptional",
       "liveModels",
       "models",
       "contextWindow",
@@ -227,6 +229,8 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
+    const registryNote = getProviderRegistryEntry(name)?.note;
+    if (typeof registryNote === "string" && registryNote.trim()) dto.note = registryNote;
     providers[name] = dto;
   }
   return {

package/src/server/claude-messages.ts

@@ -7,6 +7,8 @@
  * unchanged. The Responses output (SSE or JSON) is converted back to Anthropic shape.
  */
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import { enforceAnthropicImageLimits } from "../adapters/anthropic-image-guard";
+import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
 import { AnthropicRequestError, anthropicToResponsesTranslation, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
@@ -187,6 +189,15 @@ async function anthropicNativePassthrough(
 
   const base = (config.claudeCode?.anthropicBaseUrl ?? "https://api.anthropic.com").replace(/\/$/, "");
   const search = new URL(req.url).search;
+  // Native passthrough bypasses the anthropic adapter, so the generous image pipeline
+  // (devlog/260714_image_normalization_pipeline/040) must run here: tier-normalize then
+  // guard the already-Anthropic-wire messages before serialization. Applies to
+  // count_tokens too — counts must match what the real send will contain, and the 32MB
+  // body cap applies to it equally. Non-message bodies pass through untouched.
+  if (Array.isArray(body.messages)) {
+    await normalizeAnthropicImages(body.messages);
+    enforceAnthropicImageLimits(body.messages);
+  }
   const headers = new Headers();
   req.headers.forEach((value, name) => {
     if (!PASSTHROUGH_STRIP_HEADERS.has(name.toLowerCase())) headers.set(name, value);

package/src/server/image-retry.ts

@@ -0,0 +1,42 @@
+/**
+ * Upstream-413 tightened-retry gate (devlog/260714_image_normalization_pipeline/030).
+ *
+ * When Anthropic still rejects a normalized request with 413 request_too_large (budget
+ * estimate missed: giant text share, tool schemas, ...), the proxy rebuilds the SAME
+ * request with `imageTierBias: 1` — every image one ladder position lower — and retries
+ * exactly once. The decision logic lives here so it is unit-testable; the fetch loop in
+ * responses.ts consumes it.
+ */
+
+import type { OcxParsedRequest } from "../types";
+
+/** True when the parsed request carries at least one inline (data-URL) image. */
+export function parsedHasInlineImage(parsed: OcxParsedRequest): boolean {
+  const messages = (parsed as { context?: { messages?: unknown[] } }).context?.messages ?? [];
+  for (const message of messages) {
+    const content = (message as { content?: unknown }).content;
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      const imageUrl = (part as { imageUrl?: unknown })?.imageUrl;
+      if (typeof imageUrl === "string" && imageUrl.startsWith("data:")) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * One tier-biased rebuild per request (spiral guard), only for the anthropic adapter
+ * (others ignore imageTierBias — an identical retry would just duplicate cost), and only
+ * when the request actually carries inline images the bias can shrink.
+ */
+export function shouldAttemptImageTierRetry(args: {
+  status: number;
+  adapterName: string;
+  parsed: OcxParsedRequest;
+  alreadyAttempted: boolean;
+}): boolean {
+  return args.status === 413
+    && !args.alreadyAttempted
+    && args.adapterName === "anthropic"
+    && parsedHasInlineImage(args.parsed);
+}

package/src/server/management-api.ts

@@ -16,6 +16,7 @@ import {
   isOAuthProvider,
   listOAuthProviders,
   startLoginFlow,
+  submitManualLoginCode,
   upsertOAuthProvider,
 } from "../oauth";
 import { removeCredential } from "../oauth/store";
@@ -28,6 +29,7 @@ import { readUsageEntries } from "../usage/log";
 import { getUsageDebugLogEntries } from "../usage/debug";
 import { parseRange, summarizeUsage } from "../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../codex/auth-context";
+import { getProviderRegistryEntry } from "../providers/registry";
 import { getDebugLogEntries } from "../lib/debug-log-buffer";
 import { getInjectionDebugLogEntries } from "../lib/injection-debug-log";
 import {
@@ -273,6 +275,33 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     });
   }
 
+  if (url.pathname === "/api/shadow-call-settings" && req.method === "GET") {
+    const sci = config.shadowCallIntercept ?? {};
+    return jsonResponse({ enabled: sci.enabled === true, model: sci.model ?? "" });
+  }
+
+  if (url.pathname === "/api/shadow-call-settings" && req.method === "PUT") {
+    let raw: unknown;
+    try { raw = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(raw)) return jsonResponse({ error: "body must be a JSON object" }, 400);
+    const body = raw as { enabled?: unknown; model?: unknown };
+    if (body.enabled !== undefined && typeof body.enabled !== "boolean") {
+      return jsonResponse({ error: "enabled must be a boolean" }, 400);
+    }
+    if (body.model !== undefined && typeof body.model !== "string") {
+      return jsonResponse({ error: "model must be a string" }, 400);
+    }
+    config.shadowCallIntercept = { ...config.shadowCallIntercept };
+    if (typeof body.enabled === "boolean") config.shadowCallIntercept.enabled = body.enabled;
+    if (typeof body.model === "string") {
+      if (body.model === "") delete config.shadowCallIntercept.model;
+      else config.shadowCallIntercept.model = body.model;
+    }
+    saveConfig(config);
+    const sci = config.shadowCallIntercept;
+    return jsonResponse({ ok: true, enabled: sci.enabled === true, model: sci.model ?? "" });
+  }
+
   if (url.pathname === "/api/logs" && req.method === "GET") {
     return jsonResponse(filterRequestLogs(getRequestLogEntries(), url.searchParams));
   }
@@ -403,7 +432,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     // let the (possibly new) apiKey join the pool as the active entry.
     const existingPool = config.providers[name]?.apiKeyPool;
     if (existingPool && !prov.apiKeyPool) prov.apiKeyPool = existingPool;
-    config.providers[name] = prov;
+    config.providers[name] = stripRegistryOnlyStaticHeaders(name, prov);
     if (body.setDefault) config.defaultProvider = name;
     save(config);
     if (prov.apiKey && prov.apiKeyPool) {
@@ -1016,6 +1045,21 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     }
   }
 
+  // Manual fallback for browser OAuth: paste the final redirect URL (or authorization code)
+  // when the browser cannot reach the loopback callback (remote/SSH/blocked localhost).
+  if (url.pathname === "/api/oauth/login/code" && req.method === "POST") {
+    const body = await req.json().catch(() => ({})) as { provider?: string; input?: string; code?: string };
+    const provider = (body.provider ?? "").trim().toLowerCase();
+    if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    const input = typeof body.input === "string" ? body.input : typeof body.code === "string" ? body.code : "";
+    // Authorization responses are measured in hundreds of bytes; never accept the
+    // generic management-body allowance here.
+    if (input.length > 4096) return jsonResponse({ error: "input too long" }, 400);
+    const result = submitManualLoginCode(provider, input);
+    if (!result.ok) return jsonResponse({ error: result.error }, 409);
+    return jsonResponse({ ok: true });
+  }
+
   if (url.pathname === "/api/oauth/status" && req.method === "GET") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     return jsonResponse(getLoginStatus(provider));
@@ -1180,3 +1224,15 @@ export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]>
   const { gatherRoutedModels } = await import("../codex/catalog");
   return gatherRoutedModels(config);
 }
+
+function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProviderConfig): OcxProviderConfig {
+  const entry = getProviderRegistryEntry(name);
+  if (!entry?.staticHeaders || !provider.headers) return provider;
+  const headerEntries = Object.entries(provider.headers);
+  const staticEntries = Object.entries(entry.staticHeaders);
+  if (headerEntries.length !== staticEntries.length) return provider;
+  const matchesRegistryStaticHeaders = staticEntries.every(([key, value]) => provider.headers?.[key] === value);
+  if (!matchesRegistryStaticHeaders) return provider;
+  const { headers: _headers, ...rest } = provider;
+  return rest;
+}

package/src/server/relay.ts

@@ -212,10 +212,14 @@ export function responseWithDeferredRequestLog(
     return response;
   }
   if (!response.body || !contentType.includes("text/event-stream")) {
-    if (response.body && contentType.includes("application/json")) {
+    if (response.body && (contentType.includes("application/json") || response.status >= 400)) {
       const finalizeJsonLog = async () => {
         const text = await response.text();
-        inspectResponseLogJson(logCtx, text);
+        // Non-JSON error bodies: inspect/log only a bounded prefix (the stored
+        // upstreamError is 500 chars anyway); the FULL text is still forwarded to the
+        // client below, unchanged. JSON bodies keep full inspection (usage parsing).
+        const isJson = contentType.includes("application/json");
+        inspectResponseLogJson(logCtx, isJson ? text : text.slice(0, 8192));
         addFinalRequestLog(requestId, start, logCtx, response.status, { closeReason: "non_stream" }, addLog);
         return text;
       };

package/src/server/request-log.ts

@@ -294,7 +294,10 @@ function captureUpstreamError(logCtx: RequestLogContext, text: string | null): v
       logCtx.upstreamError = redactSecretString(incompleteReasonLabel(reason.trim())).slice(0, 500);
     }
   } catch {
-    /* not JSON; nothing to capture */
+    const trimmed = text.trim();
+    if (trimmed) {
+      logCtx.upstreamError = redactSecretString(trimmed).slice(0, 500);
+    }
   }
 }
 

package/src/server/responses.ts

@@ -41,6 +41,7 @@ import { isUsageDebugEnabled } from "../usage/debug";
 import { readJsonRequestBody, DecompressedBodyTooLargeError, UnsupportedContentEncodingError } from "./request-decompress";
 import { resolveAdapter, resolveWireProtocolOverride } from "./adapter-resolve";
 import { hasKeyPoolFailover, rotateProviderTransportOn429 } from "../providers/key-failover";
+import { shouldAttemptImageTierRetry } from "./image-retry";
 import { resolveProviderTransport } from "../providers/xai-transport";
 import type { WsData } from "./ws-bridge";
 import { registerTurn, trackStreamLifetime, unregisterTurn } from "./lifecycle";
@@ -466,6 +467,22 @@ export async function handleResponses(
   logCtx.configuredServiceTier = readConfiguredCodexServiceTier();
   logCtx.configuredSpeedLabel = requestLogSpeedLabel(logCtx.configuredServiceTier);
 
+  // Shadow call intercept: rewrite Codex Desktop's hard-coded gpt-5.4-mini helper calls
+  const _sci = config.shadowCallIntercept;
+  if (_sci?.enabled && _sci.model && parsed.modelId.startsWith("gpt-5.4-mini")) {
+    const _sciOriginal = parsed.modelId;
+    parsed.modelId = _sci.model;
+    if (parsed._rawBody && typeof parsed._rawBody === "object") {
+      (parsed._rawBody as { model?: string }).model = _sci.model;
+    }
+    // Force effort to low for shadow/helper calls (matching upstream behavior)
+    parsed.options.reasoning = "low";
+    if (parsed._rawBody && typeof parsed._rawBody === "object") {
+      (parsed._rawBody as Record<string, unknown>).reasoning = { effort: "low" };
+    }
+    (logCtx as unknown as Record<string, unknown>).shadowCallRewrittenFrom = _sciOriginal;
+  }
+
   let route;
   try {
     route = routeModel(config, parsed.modelId);
@@ -941,29 +958,22 @@ export async function handleResponses(
   }
 
   if (!upstreamResponse.ok) {
-    // Multi-key 429 failover: rotate to the next pool key (cooldown-aware) and retry the SAME
-    // request once per remaining key. OAuth/forward providers and single-key pools return null
-    // immediately, so this stays a no-op for them (src/providers/key-failover.ts).
-    while (upstreamResponse.status === 429 && hasKeyPoolFailover(route.provider)) {
-      const rotated = rotateProviderTransportOn429(config, route.providerName, {
-        retryAfter: upstreamResponse.headers.get("retry-after"),
-        now: Date.now(),
-        attemptedKey: route.provider.apiKey,
-        promptCacheKey: parsed.options.promptCacheKey,
+    // Recovery loop: multi-key 429 failover + at most ONE anthropic 413 tightened retry
+    // (devlog/260714_image_normalization_pipeline/030). One mutable activeAdapter serves
+    // both paths so a 429→413 sequence never rebuilds against a stale pre-rotation
+    // adapter, and imageTierBias — once armed — rides EVERY subsequent rebuild so a
+    // 413→429 rotation cannot silently undo the tightening.
+    let activeAdapter = adapter;
+    let imageTierBias = 0;
+    let imageRetryAttempted = false;
+    const rebuildAndRefetch = async (): Promise<Response | { failed: Response }> => {
+      const retryRequest = await activeAdapter.buildRequest(parsed, {
+        headers: selectedForwardHeaders,
+        ...(imageTierBias > 0 ? { imageTierBias } : {}),
       });
-      if (!rotated) break;
-      // Release the failed response's socket before retrying; unread bodies otherwise linger
-      // until runtime cleanup (one per rotated key under a rate-limit storm).
-      try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
-      route.provider = rotated;
-      const retryAdapter = resolveAdapter(
-        resolveWireProtocolOverride(route.providerName, route.modelId, route.provider),
-        config.cacheRetention,
-      );
-      const retryRequest = await retryAdapter.buildRequest(parsed, { headers: selectedForwardHeaders });
       try {
-        upstreamResponse = retryAdapter.fetchResponse
-          ? await retryAdapter.fetchResponse(retryRequest, { abortSignal: upstream.signal, timeoutMs: connectMs, stream: parsed.stream })
+        return activeAdapter.fetchResponse
+          ? await activeAdapter.fetchResponse(retryRequest, { abortSignal: upstream.signal, timeoutMs: connectMs, stream: parsed.stream })
           : await fetchWithHeaderTimeout(retryRequest.url, {
               method: retryRequest.method, headers: retryRequest.headers, body: retryRequest.body,
             }, upstream.signal, connectMs, parsed.stream);
@@ -973,8 +983,50 @@ export async function handleResponses(
         const msg = err instanceof Error && err.name === "TimeoutError"
           ? `Provider connect timeout after ${connectMs}ms`
           : `Provider unreachable: ${err instanceof Error ? err.message : String(err)}`;
-        return formatErrorResponse(502, "upstream_error", msg);
+        return { failed: formatErrorResponse(502, "upstream_error", msg) };
+      }
+    };
+    recovery: for (;;) {
+      // Multi-key 429 failover: rotate to the next pool key (cooldown-aware) and retry the
+      // SAME request once per remaining key. OAuth/forward providers and single-key pools
+      // return null immediately, so this stays a no-op for them (src/providers/key-failover.ts).
+      while (upstreamResponse.status === 429 && hasKeyPoolFailover(route.provider)) {
+        const rotated = rotateProviderTransportOn429(config, route.providerName, {
+          retryAfter: upstreamResponse.headers.get("retry-after"),
+          now: Date.now(),
+          attemptedKey: route.provider.apiKey,
+          promptCacheKey: parsed.options.promptCacheKey,
+        });
+        if (!rotated) break;
+        // Release the failed response's socket before retrying; unread bodies otherwise linger
+        // until runtime cleanup (one per rotated key under a rate-limit storm).
+        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+        route.provider = rotated;
+        activeAdapter = resolveAdapter(
+          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider),
+          config.cacheRetention,
+        );
+        const result = await rebuildAndRefetch();
+        if ("failed" in result) return result.failed;
+        upstreamResponse = result;
+      }
+      // Anthropic 413 request_too_large: rebuild once with every image one tier lower
+      // (spiral guard: single attempt). The biased response re-enters the 429 check above.
+      if (shouldAttemptImageTierRetry({
+        status: upstreamResponse.status,
+        adapterName: activeAdapter.name,
+        parsed,
+        alreadyAttempted: imageRetryAttempted,
+      })) {
+        imageRetryAttempted = true;
+        imageTierBias = 1;
+        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+        const result = await rebuildAndRefetch();
+        if ("failed" in result) return result.failed;
+        upstreamResponse = result;
+        continue recovery;
       }
+      break;
     }
     if (!upstreamResponse.ok) {
       const errorText = await upstreamResponse.text().catch(() => "unknown error");

package/src/server/system-env.ts

@@ -25,13 +25,15 @@ function writeShellEnvFile(port: number, config: OcxConfig, modelEnv: Record<str
     `export ANTHROPIC_BASE_URL=${shellValue(`http://127.0.0.1:${port}`)}`,
     `export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=${shellValue("1")}`,
   ];
-  if (config.apiKeys?.length) {
-    lines.push(`export ANTHROPIC_AUTH_TOKEN=${shellValue(config.apiKeys[0].key)}`);
-  }
   // New lever keys are CONDITIONAL exports (audit 139 R2#1): a value the user already
   // exported in their shell wins even though launchctl knows nothing about it.
   const conditional = (name: string, value: string) =>
     `[ -z "\${${name}+x}" ] && export ${name}=${shellValue(value)}`;
+  if (config.apiKeys?.length) {
+    lines.push(`export ANTHROPIC_AUTH_TOKEN=${shellValue(config.apiKeys[0].key)}`);
+  } else if (config.claudeCode?.authMode === "proxy") {
+    lines.push(conditional("ANTHROPIC_AUTH_TOKEN", "opencodex-proxy"));
+  }
   // Model slots (default + tiers + legacy small-fast) with [1m] applied (devlog 260712 B2).
   if (modelEnv.ANTHROPIC_MODEL) {
     lines.push(`export ANTHROPIC_MODEL=${shellValue(modelEnv.ANTHROPIC_MODEL)}`);
@@ -238,6 +240,8 @@ export async function injectSystemEnv(port: number, config: OcxConfig): Promise<
     inject("CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY", "1");
     if (config.apiKeys?.length) {
       inject("ANTHROPIC_AUTH_TOKEN", config.apiKeys[0].key);
+    } else if (config.claudeCode?.authMode === "proxy" && launchctlGetenv("ANTHROPIC_AUTH_TOKEN") === undefined) {
+      inject("ANTHROPIC_AUTH_TOKEN", "opencodex-proxy");
     }
     // Lever keys (devlog 136 B6): user-wins — skip any key the user already set in the
     // launchd domain, and track ONLY the keys we actually injected so revert cannot

package/src/types.ts

@@ -270,6 +270,12 @@ export interface OcxClaudeCodeConfig {
    * on stop/shutdown. Default: false (opt-in). macOS only.
    */
   systemEnv?: boolean;
+  /**
+   * Auth mode for Claude Code inbound requests. "proxy" injects a dummy
+   * ANTHROPIC_AUTH_TOKEN so Claude Code routes through the proxy without a
+   * real Anthropic key. Default: undefined (no token injection).
+   */
+  authMode?: "proxy";
   /**
    * Context-window override for Claude Code/Desktop clients (devlog 136 B6):
    * injected as CLAUDE_CODE_MAX_CONTEXT_TOKENS + DISABLE_COMPACT=1 (the official
@@ -379,6 +385,17 @@ export interface OcxConfig {
    * are omitted from the bare /v1/models list.
    */
   disabledModels?: string[];
+  /**
+   * Shadow call intercept: redirect Codex Desktop's hard-coded gpt-5.4-mini helper calls
+   * (title generation, commit messages, skill orchestration) to a user-chosen model.
+   * Opt-in; disabled by default. When enabled, effort is forced to low.
+   */
+  shadowCallIntercept?: {
+    /** When true, all gpt-5.4-mini* requests are rewritten to the configured model. */
+    enabled?: boolean;
+    /** Replacement model id (e.g. "gpt-5.5"). */
+    model?: string;
+  };
   /**
    * 3-state multi-agent surface override:
    * - "v1": force ALL models to v1 surface (override upstream pins)
@@ -668,10 +685,11 @@ export interface OcxProviderConfig {
   unsafeAllowNativeLocalExec?: boolean;
   /**
    * Cursor adapter only: native local exec policy mode (exec-policy.ts).
-   * "off" (default) rejects all server-driven local exec; "on" always allows
-   * (same as legacy unsafeAllowNativeLocalExec:true); "codex-sandbox" allows only
-   * when the request's instructions/developer text declares the Codex
-   * danger-full-access sandbox. NOTE: the declaration is CALLER-CONTROLLED prose —
+   * "codex-sandbox" (default) allows server-driven local exec only when the
+   * request's instructions/developer text declares the Codex danger-full-access
+   * sandbox (approves the normal full-access flow, denies undeclared requests);
+   * "off" rejects all server-driven local exec; "on" always allows (same as legacy
+   * unsafeAllowNativeLocalExec:true). NOTE: the declaration is CALLER-CONTROLLED prose —
    * the proxy cannot verify it. Enable "codex-sandbox" only where every client
    * that can reach the data plane is trusted: the default loopback bind admits
    * ANY process on this host without auth (including other local users on

package/src/web-search/index.ts

@@ -97,13 +97,16 @@ export function findAnthropicSidecarProvider(config: OcxConfig): AnthropicSideca
   return undefined;
 }
 
-/** Precedence (audit F4/F7): explicit config wins; unset resolves to anthropic when a usable credential exists, else openai. */
+/**
+ * Precedence: explicit config wins; unset defaults to "openai" (ChatGPT forward path). The
+ * anthropic backend (web_search_20250305) is only used when explicitly configured — auto-selecting
+ * it from credential availability caused the sidecar to send incompatible models (e.g. gpt-5.6-luna)
+ * to the Anthropic API.
+ */
 export function resolveSidecarBackend(
   explicit: "openai" | "anthropic" | undefined,
-  anthropicSidecar: AnthropicSidecarProvider | undefined,
 ): "openai" | "anthropic" {
-  if (explicit === "anthropic" || explicit === "openai") return explicit;
-  return anthropicSidecar ? "anthropic" : "openai";
+  return explicit === "anthropic" ? "anthropic" : "openai";
 }
 
 export interface SidecarPlan {
@@ -145,7 +148,7 @@ export function planWebSearch(
   // Same `?? 200_000` default the server applies when threading connectTimeoutMs into the loop.
   const connectTimeoutMs = config.connectTimeoutMs ?? 200_000;
   const anthropicSidecar = findAnthropicSidecarProvider(config);
-  const backend = resolveSidecarBackend(cfg.backend, anthropicSidecar);
+  const backend = resolveSidecarBackend(cfg.backend);
   const maxSearches = cfg.maxSearchesPerTurn ?? DEFAULT_MAX_SEARCHES;
   const stallTimeoutSec = webSearchStallTimeoutSec(
     config.stallTimeoutSec,