@bitkyc08/opencodex 2.7.21 → 2.7.22

package/src/oauth/store.ts

@@ -15,8 +15,8 @@
  *   same human on every re-login. Cursor login extracts JWT `sub` as accountId so multiauth
  *   can append distinct accounts.
  */
-import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, chmodSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
 import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
@@ -26,12 +26,21 @@ type AuthStore = Record<string, ProviderAccountSet>;
 /** Providers whose account set is pinned to a single slot (see module doc). */
 const SINGLE_SLOT_PROVIDERS = new Set(["chatgpt"]);
 
-function authPath(): string {
+export function getAuthStorePath(): string {
   return join(getConfigDir(), "auth.json");
 }
+export function getAuthStoreLockPath(): string { return join(getConfigDir(), "auth.store.lock"); }
+export function getAuthRefreshIntentLockPath(provider: string, accountId: string): string {
+  const safeProvider = provider.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const accountHash = createHash("sha256").update(accountId).digest("hex").slice(0, 24);
+  return join(getConfigDir(), `auth.refresh.${safeProvider}.${accountHash}.lock`);
+}
+export function credentialGeneration(cred: OAuthCredentials): string {
+  return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires])).digest("hex");
+}
 
 function loadAuthStoreInternal(): { store: AuthStore; hadLegacy: boolean } {
-  const path = authPath();
+  const path = getAuthStorePath();
   hardenConfigDir();
   hardenExistingSecret(path);
   if (!existsSync(path)) return { store: {}, hadLegacy: false };
@@ -55,8 +64,24 @@ function persist(store: AuthStore): void {
     try { chmodSync(dir, 0o700); } catch { /* best-effort on existing dir */ }
   }
   hardenConfigDir();
-  atomicWriteFile(authPath(), JSON.stringify(store, null, 2) + "\n");
+  atomicWriteFile(getAuthStorePath(), JSON.stringify(store, null, 2) + "\n");
+}
+
+export class OAuthFileLockError extends Error { readonly code = "OAUTH_FILE_LOCK_UNAVAILABLE"; constructor(message: string, options?: { cause?: unknown }) { super(message, options); this.name = "OAuthFileLockError"; } }
+interface LockSnapshot { bytes: string; dev: number; ino: number; mtimeMs: number; size: number }
+export interface OAuthFileLockOptions { path: string; waitTimeoutMs?: number; staleAfterMs?: number; pollMinMs?: number; pollMaxMs?: number; sleep?: (ms: number) => Promise<void>; now?: () => number; random?: () => number; beforeStaleUnlink?: () => void; beforeReleaseUnlink?: () => void; beforeFailedCreateUnlink?: () => void; writeMetadata?: (fd: number, bytes: string) => void }
+export interface OAuthFileLockGuard { readonly ownerId: string; release(): void }
+function errorCode(error: unknown): string | undefined { return error && typeof error === "object" && "code" in error ? String((error as { code?: unknown }).code) : undefined; }
+function snapshot(path: string): LockSnapshot { const bytes = readFileSync(path, "utf8"); const s = statSync(path); return { bytes, dev:s.dev, ino:s.ino, mtimeMs:s.mtimeMs, size:s.size }; }
+function sameSnapshot(a: LockSnapshot,b: LockSnapshot): boolean { return a.bytes===b.bytes&&a.dev===b.dev&&a.ino===b.ino&&a.mtimeMs===b.mtimeMs&&a.size===b.size; }
+function sameFd(a: LockSnapshot,b: ReturnType<typeof fstatSync>): boolean { return a.dev===b.dev&&a.ino===b.ino&&a.mtimeMs===b.mtimeMs&&a.size===b.size; }
+export function createOAuthFileLock(options: OAuthFileLockOptions): { acquire(): Promise<OAuthFileLockGuard> } {
+ const wait=options.waitTimeoutMs??5000, stale=options.staleAfterMs??120000, min=options.pollMinMs??25,max=options.pollMaxMs??100,sleep=options.sleep??(ms=>Bun.sleep(ms)),now=options.now??Date.now,random=options.random??Math.random,write=options.writeMetadata??((fd,b)=>writeFileSync(fd,b,"utf8"));
+ if(wait<0||stale<=0||min<0||max<min) throw new OAuthFileLockError("Invalid OAuth file-lock timing options");
+ return { async acquire() { hardenConfigDir(); if(!existsSync(getConfigDir())) mkdirSync(getConfigDir(),{recursive:true,mode:0o700}); const ownerId=randomUUID(),started=now(); for(;;){ let fd:number|undefined; try { fd=openSync(options.path,"wx",0o600); const bytes=`${JSON.stringify({version:1,ownerId,pid:process.pid,createdAt:now()})}\n`; write(fd,bytes); const fs=fstatSync(fd); closeSync(fd); fd=undefined; const owned=snapshot(options.path); if(owned.bytes!==bytes||!sameFd(owned,fs)) throw new OAuthFileLockError("OAuth lock changed during creation"); let released=false; return {ownerId,release(){if(released)return;released=true;try{const a=snapshot(options.path);if(!sameSnapshot(owned,a))return;options.beforeReleaseUnlink?.();const b=snapshot(options.path);if(sameSnapshot(owned,b))unlinkSync(options.path);}catch(e){if(errorCode(e)!=="ENOENT")console.warn(`[oauth] lock release failed: ${e instanceof Error?e.message:String(e)}`);}}}; } catch(e) { if(fd!==undefined){let fs;try{fs=fstatSync(fd);}catch{}try{closeSync(fd);}catch{}if(fs)try{const a=snapshot(options.path);if(sameFd(a,fs)){options.beforeFailedCreateUnlink?.();const b=snapshot(options.path);if(sameSnapshot(a,b)&&sameFd(b,fs))unlinkSync(options.path);}}catch{}} if(errorCode(e)!=="EEXIST")throw e instanceof OAuthFileLockError?e:new OAuthFileLockError("Could not create OAuth file lock",{cause:e}); }
+ try{const a=snapshot(options.path);let created=a.mtimeMs;try{const p=JSON.parse(a.bytes);if(typeof p.createdAt==="number")created=Math.max(created,p.createdAt);}catch{}if(now()-created>stale){options.beforeStaleUnlink?.();const b=snapshot(options.path);if(sameSnapshot(a,b))unlinkSync(options.path);continue;}}catch(e){if(errorCode(e)==="ENOENT")continue;throw new OAuthFileLockError("Could not inspect OAuth file lock",{cause:e});} const elapsed=now()-started;if(elapsed>=wait)throw new OAuthFileLockError(`Timed out after ${wait}ms waiting for OAuth file lock`);await sleep(Math.min(wait-elapsed,min+Math.floor(random()*(max-min+1)))); } } };
 }
+export function createOAuthRefreshIntentLock(provider:string,accountId:string,overrides:Partial<OAuthFileLockOptions>={}) { return createOAuthFileLock({path:getAuthRefreshIntentLockPath(provider,accountId),staleAfterMs:120000,...overrides}); }
 
 /**
  * One-time downgrade safety net: the first time we persist the NEW shape over a file that
@@ -65,7 +90,7 @@ function persist(store: AuthStore): void {
  * store, destroying refresh tokens; the backup makes that recoverable.
  */
 function backupLegacyOnce(): void {
-  const path = authPath();
+  const path = getAuthStorePath();
   const backup = `${path}.pre-multiauth`;
   if (!existsSync(path) || existsSync(backup)) return;
   try {
@@ -155,23 +180,15 @@ function normalizeAuthStore(raw: unknown): { store: AuthStore; hadLegacy: boolea
  * a guardian refresh persisting a non-active account cannot roll back a concurrent
  * active-account switch (lost update). Cross-process races are accepted (single proxy).
  */
-let writeQueue: Promise<unknown> = Promise.resolve();
-function enqueueWrite<T>(fn: () => T): T {
-  // Synchronous mutations: chain onto the queue for ordering, but run eagerly since all
-  // current callers are sync. The queue exists so future async mutators serialize too.
-  const result = fn();
-  writeQueue = writeQueue.then(() => result);
-  return result;
-}
-
-function mutateStore<T>(fn: (store: AuthStore) => T): T {
-  return enqueueWrite(() => {
+let mutationTail: Promise<void> = Promise.resolve();
+function serializeMutation<T>(work:()=>Promise<T>):Promise<T>{const result=mutationTail.then(work,work);mutationTail=result.then(()=>undefined,()=>undefined);return result;}
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
-    const result = fn(store);
+    const result = await fn(store);
     persist(store);
     return result;
-  });
+  }finally{guard.release();}});
 }
 
 /** The ACTIVE account's credential for a provider (what requests should use). */
@@ -187,10 +204,10 @@ export function getCredential(provider: string): OAuthCredentials | null {
  * (rotating refresh tokens would fabricate duplicates) and single-slot providers replace the
  * active slot / whole set instead.
  */
-export function saveCredential(provider: string, cred: OAuthCredentials): void {
+export async function saveCredential(provider: string, cred: OAuthCredentials): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
-  mutateStore(store => {
+  await mutateStore(store => {
     const set = store[provider];
     const identity = safe.accountId ?? safe.email;
     if (!set || SINGLE_SLOT_PROVIDERS.has(provider)) {
@@ -225,8 +242,8 @@ export function saveCredential(provider: string, cred: OAuthCredentials): void {
 }
 
 /** Remove the ACTIVE account; remaining accounts promote the first one. */
-export function removeCredential(provider: string): void {
-  mutateStore(store => {
+export async function removeCredential(provider: string): Promise<void> {
+  await mutateStore(store => {
     const set = store[provider];
     if (!set) return;
     set.accounts = set.accounts.filter(a => a.id !== set.activeAccountId);
@@ -255,10 +272,10 @@ export function getAccountCredential(provider: string, accountId: string): OAuth
 }
 
 /** Persist a refreshed credential for a SPECIFIC account without touching activeAccountId. */
-export function saveAccountCredential(provider: string, accountId: string, cred: OAuthCredentials): void {
+export async function saveAccountCredential(provider: string, accountId: string, cred: OAuthCredentials): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
-  mutateStore(store => {
+  await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
     account.credential = safe;
@@ -266,8 +283,8 @@ export function saveAccountCredential(provider: string, accountId: string, cred:
   });
 }
 
-export function setActiveAccount(provider: string, accountId: string): boolean {
-  return mutateStore(store => {
+export async function setActiveAccount(provider: string, accountId: string): Promise<boolean> {
+  return await mutateStore(store => {
     const set = store[provider];
     if (!set || !set.accounts.some(a => a.id === accountId)) return false;
     set.activeAccountId = accountId;
@@ -276,8 +293,8 @@ export function setActiveAccount(provider: string, accountId: string): boolean {
 }
 
 /** Remove one account by id; active removal promotes the first remaining account. */
-export function removeAccount(provider: string, accountId: string): boolean {
-  return mutateStore(store => {
+export async function removeAccount(provider: string, accountId: string): Promise<boolean> {
+  return await mutateStore(store => {
     const set = store[provider];
     if (!set) return false;
     const before = set.accounts.length;
@@ -292,11 +309,14 @@ export function removeAccount(provider: string, accountId: string): boolean {
   });
 }
 
-export function markAccountNeedsReauth(provider: string, accountId: string, needsReauth: boolean): void {
-  mutateStore(store => {
+export async function markAccountNeedsReauth(provider: string, accountId: string, needsReauth: boolean): Promise<void> {
+  await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
     if (needsReauth) account.needsReauth = true;
     else delete account.needsReauth;
   });
 }
+
+export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};account.credential=safe;delete account.needsReauth;return{superseded:false};});}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string):Promise<boolean>{return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||credentialGeneration(account.credential)!==generation)return false;account.needsReauth=true;return true;});}

package/src/oauth/xai.ts

@@ -12,6 +12,9 @@ const XAI_OAUTH_CALLBACK_PATH = "/callback";
 const XAI_OAUTH_REFRESH_SKEW_MS = 2 * 60 * 1000;
 const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
 
+export const XAI_LOCAL_CLI_DETACH_WARNING =
+  "[oauth:xai] Grok CLI credential was stale; refreshed into OpenCodex ownership. Grok CLI may require login again.";
+
 interface XaiDiscovery {
   authorizationEndpoint: string;
   tokenEndpoint: string;
@@ -22,7 +25,7 @@ interface XaiDiscoveryPayload {
   token_endpoint?: unknown;
 }
 
-interface XaiTokenPayload {
+export interface XaiTokenPayload {
   access_token?: unknown;
   refresh_token?: unknown;
   expires_in?: unknown;
@@ -89,12 +92,18 @@ function getTokenIdentity(accessToken: string, idToken: string | undefined): { a
   return { accountId, email };
 }
 
-async function postXaiToken(
+export class XaiTokenRequestError extends Error { constructor(public readonly status?:number,public readonly oauthError?:string,message="xAI token request failed",options?:{cause?:unknown}){super(message,options);this.name="XaiTokenRequestError";} }
+export interface XaiTokenRetryDeps { sleep?:(ms:number)=>Promise<void>; random?:()=>number }
+function isAbortError(error:unknown):boolean{return error instanceof DOMException&&error.name==="AbortError";}
+function retryDelay(attempt:number,retryAfter:string|null,random:()=>number):number{const base=attempt===1?100:250,j=Math.round(base*(.75+random()*.5)),seconds=retryAfter!==null&&/^\d+$/.test(retryAfter)?Number(retryAfter):0;return Math.min(2000,Math.max(j,seconds*1000));}
+async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined,detail="";try{const body=await response.json() as {error?:unknown;error_description?:unknown};if(typeof body.error==="string")oauthError=body.error;if(typeof body.error_description==="string")detail=body.error_description;}catch{}const suffix=detail?`: ${detail}`:oauthError?`: ${oauthError}`:"";return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}${suffix}`);}
+export async function postXaiToken(
   tokenEndpoint: string,
   body: Record<string, string>,
-  signal?: AbortSignal,
+  signal?: AbortSignal, deps:XaiTokenRetryDeps={},
 ): Promise<XaiTokenPayload> {
-  const response = await fetch(tokenEndpoint, {
+ const sleep=deps.sleep??(ms=>Bun.sleep(ms)),random=deps.random??Math.random;let last:unknown;
+ for(let attempt=1;attempt<=3;attempt++){let response:Response;try{response=await fetch(tokenEndpoint, {
     method: "POST",
     headers: {
       Accept: "application/json",
@@ -102,11 +111,7 @@ async function postXaiToken(
     },
     body: new URLSearchParams(body).toString(),
     signal: requestSignal(signal),
-  });
-  if (!response.ok) {
-    throw new Error(`xAI token request failed: ${response.status} ${await response.text()}`);
-  }
-  return (await response.json()) as XaiTokenPayload;
+  });}catch(error){if(isAbortError(error)&&signal?.aborted)throw error;last=error;if(attempt===3)throw new XaiTokenRequestError(undefined,undefined,"xAI token request failed: network error",{cause:error});await sleep(retryDelay(attempt,null,random));continue;}if(response.ok)return await response.json() as XaiTokenPayload;const error=await readTokenError(response);last=error;if(!(response.status===429||response.status>=500)||attempt===3)throw error;await sleep(retryDelay(attempt,response.headers.get("retry-after"),random));}throw last;
 }
 
 function credentialsFromTokenPayload(payload: XaiTokenPayload, refreshFallback = ""): OAuthCredentials {
@@ -200,7 +205,9 @@ export async function loginXai(
       ctrl.onProgress?.("Found Grok CLI token, importing automatically");
       if (local.expires >= Date.now() + 60_000) return local;
       try {
-        return { ...(await refreshXaiToken(local.refresh, ctrl.signal)), source: "local-cli" };
+        const fresh = await refreshXaiToken(local.refresh, ctrl.signal);
+        ctrl.onProgress?.(XAI_LOCAL_CLI_DETACH_WARNING);
+        return { ...fresh, source: "oauth" };
       } catch (error) {
         if (importLocal === "only") {
           throw new Error(

package/src/providers/quota.ts

@@ -17,8 +17,6 @@ export interface ProviderQuotaWindow {
 }
 
 export interface ProviderQuota {
-  fiveHourPercent?: number;
-  fiveHourResetAt?: number;
   weeklyPercent?: number;
   weeklyResetAt?: number;
   monthlyPercent?: number;
@@ -58,8 +56,7 @@ function cacheKey(config: OcxConfig): string {
 
 function hasQuotaRows(quota: ProviderQuota | null | undefined): quota is ProviderQuota {
   if (!quota) return false;
-  return typeof quota.fiveHourPercent === "number"
-    || typeof quota.weeklyPercent === "number"
+  return typeof quota.weeklyPercent === "number"
     || typeof quota.monthlyPercent === "number"
     || !!quota.customWindows?.some(window => typeof window.percent === "number");
 }
@@ -188,11 +185,10 @@ async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaRepor
   const opus = parseClaudeBucket(body.seven_day_opus);
   const sonnet = parseClaudeBucket(body.seven_day_sonnet);
   const customWindows: ProviderQuotaWindow[] = [];
+  if (fiveHour?.percent !== undefined) customWindows.push({ label: "5h", percent: fiveHour.percent, ...(fiveHour.resetAt !== undefined ? { resetAt: fiveHour.resetAt } : {}) });
   if (opus?.percent !== undefined) customWindows.push({ label: "Opus", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
   if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
   const quota: ProviderQuota = {
-    ...(fiveHour?.percent !== undefined ? { fiveHourPercent: fiveHour.percent } : {}),
-    ...(fiveHour?.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
     ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
     ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
     ...(customWindows.length > 0 ? { customWindows } : {}),

package/src/providers/xai-transport.ts

@@ -1,48 +1,79 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
 
-/**
- * xAI account OAuth and xAI API keys share a bearer shape but not a billing
- * transport. OAuth represents the Grok CLI subscription entitlement, while a
- * key represents the API team. Keep the saved provider preset compatible with
- * the dashboard's "Use an API key instead" switch and resolve the transport at
- * request time.
- */
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
-/** Minimum-compatible official Grok CLI wire version verified with the proxy. */
-export const XAI_GROK_CLIENT_VERSION = "0.2.93";
+export const XAI_GROK_COMPATIBILITY = {
+  version: "0.2.93",
+  userAgent: "opencodex-grok/0.2.93",
+  headers: {
+    clientIdentifier: "x-grok-client-identifier",
+    clientVersion: "x-grok-client-version",
+    tokenAuth: "x-xai-token-auth",
+    authenticateResponse: "x-authenticateresponse",
+    conversationId: "x-grok-conv-id",
+    requestId: "x-grok-req-id",
+    sessionId: "x-grok-session-id",
+    userAgent: "User-Agent",
+  },
+} as const;
 
-const XAI_GROK_CLI_HEADERS: Readonly<Record<string, string>> = {
-  "x-grok-client-identifier": "opencodex",
-  "x-grok-client-version": XAI_GROK_CLIENT_VERSION,
-  "x-xai-token-auth": "xai-grok-cli",
+export const XAI_GROK_CLIENT_VERSION = XAI_GROK_COMPATIBILITY.version;
+export const XAI_CONV_ID_HEADER = XAI_GROK_COMPATIBILITY.headers.conversationId;
+
+export type OcxProviderTransport = OcxProviderConfig & {
+  /** Request executor used only at runtime; never persisted. */
+  fetch?: typeof globalThis.fetch;
 };
 
-/**
- * Sticky-routing hint for xAI's automatic prefix cache. xAI routes requests
- * carrying the same `x-grok-conv-id` to the same server, which is where the
- * prompt cache lives (docs.x.ai prompt-caching best-practices; verified
- * 2026-07-13, devlog/_plan/260713_grok_caching). Codex clients send a stable
- * per-conversation `prompt_cache_key`; hash it so the raw session id never
- * leaves the proxy.
- */
-export const XAI_CONV_ID_HEADER = "x-grok-conv-id";
+const XAI_GROK_CLI_HEADERS: Readonly<Record<string, string>> = {
+  [XAI_GROK_COMPATIBILITY.headers.clientIdentifier]: "opencodex",
+  [XAI_GROK_COMPATIBILITY.headers.clientVersion]: XAI_GROK_CLIENT_VERSION,
+  [XAI_GROK_COMPATIBILITY.headers.tokenAuth]: "xai-grok-cli",
+  [XAI_GROK_COMPATIBILITY.headers.authenticateResponse]: "authenticate-response",
+};
 
-function hasHeaderCaseInsensitive(headers: Record<string, string> | undefined, name: string): boolean {
-  if (!headers) return false;
+function hasHeaderCaseInsensitive(
+  headers: Record<string, string> | undefined,
+  name: string,
+): boolean {
   const target = name.toLowerCase();
-  return Object.keys(headers).some(key => key.toLowerCase() === target);
+  return Object.keys(headers ?? {}).some(key => key.toLowerCase() === target);
+}
+
+function withoutUserOverridden(
+  defaults: Readonly<Record<string, string>>,
+  userHeaders: Record<string, string> | undefined,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(defaults).filter(([name]) => !hasHeaderCaseInsensitive(userHeaders, name)),
+  );
 }
 
-/** Drop default entries the user already overrides under any header-name casing. */
-function withoutUserOverridden(defaults: Readonly<Record<string, string>>, userHeaders: Record<string, string> | undefined): Record<string, string> {
-  if (!userHeaders) return { ...defaults };
-  const out: Record<string, string> = {};
-  for (const [key, value] of Object.entries(defaults)) {
-    if (!hasHeaderCaseInsensitive(userHeaders, key)) out[key] = value;
+function withGeneratedRequestId(
+  init: RequestInit | undefined,
+  configuredRequestId: string | undefined,
+  stableHeaders: Readonly<Record<string, string>>,
+): RequestInit {
+  const headers = new Headers(init?.headers);
+  for (const [name, value] of Object.entries(stableHeaders)) {
+    if (!headers.has(name)) headers.set(name, value);
   }
-  return out;
+  if (!headers.has(XAI_GROK_COMPATIBILITY.headers.requestId)) {
+    headers.set(
+      XAI_GROK_COMPATIBILITY.headers.requestId,
+      configuredRequestId ?? randomUUID(),
+    );
+  }
+  return { ...init, headers };
+}
+
+function findHeaderCaseInsensitive(
+  headers: Record<string, string> | undefined,
+  name: string,
+): string | undefined {
+  const target = name.toLowerCase();
+  return Object.entries(headers ?? {}).find(([key]) => key.toLowerCase() === target)?.[1];
 }
 
 export function deriveXaiConvId(promptCacheKey: string): string {
@@ -50,40 +81,56 @@ export function deriveXaiConvId(promptCacheKey: string): string {
 }
 
 /**
- * Resolve the effective xAI transport without mutating persisted config.
- * User-provided headers are preserved and may advance the compatibility
- * version without waiting for an opencodex release.
- *
- * `promptCacheKey` (the client's stable conversation key) additionally pins
- * cache-affinity routing via `x-grok-conv-id` in BOTH auth modes. Blank or
- * whitespace-only keys are ignored so unrelated requests can never collapse
- * onto one shared conv id, and any user-configured header (any case) wins.
+ * Resolve xAI's runtime transport without mutating persisted config. Conversation/session
+ * affinity is stable for this resolved transport; request identity is generated per fetch.
+ * Agent, deployment, model-override, turn, mode, and user identity headers are intentionally
+ * omitted because opencodex has no truthful values for the official fields.
  */
 export function resolveProviderTransport(
   providerName: string,
-  provider: OcxProviderConfig,
+  provider: OcxProviderTransport,
   promptCacheKey?: string,
-): OcxProviderConfig {
+): OcxProviderTransport {
   if (providerName !== "xai") return provider;
+
   const cacheKey = promptCacheKey?.trim();
-  const convIdHeaders: Record<string, string> =
-    cacheKey && !hasHeaderCaseInsensitive(provider.headers, XAI_CONV_ID_HEADER)
-      ? { [XAI_CONV_ID_HEADER]: deriveXaiConvId(cacheKey) }
-      : {};
-  if (provider.authMode !== "oauth") {
-    if (Object.keys(convIdHeaders).length === 0) return provider;
-    return {
-      ...provider,
-      headers: { ...convIdHeaders, ...(provider.headers ?? {}) },
-    };
-  }
+  const affinity = cacheKey ? deriveXaiConvId(cacheKey) : undefined;
+  const stableDefaults: Record<string, string> = {
+    [XAI_GROK_COMPATIBILITY.headers.userAgent]: XAI_GROK_COMPATIBILITY.userAgent,
+    ...(affinity
+      ? {
+          [XAI_GROK_COMPATIBILITY.headers.conversationId]: affinity,
+          [XAI_GROK_COMPATIBILITY.headers.sessionId]: affinity,
+        }
+      : {}),
+    ...(provider.authMode === "oauth" ? XAI_GROK_CLI_HEADERS : {}),
+  };
+  const stableHeaders = {
+    ...withoutUserOverridden(stableDefaults, provider.headers),
+    ...(provider.headers ?? {}),
+  };
+  // Keep API-key provider metadata compatible with key-pool rotation; session/UA defaults
+  // remain transport-scoped and are applied by the wrapper immediately below.
+  const headers = provider.authMode === "oauth"
+    ? stableHeaders
+    : {
+        ...(affinity && !hasHeaderCaseInsensitive(provider.headers, XAI_GROK_COMPATIBILITY.headers.conversationId)
+          ? { [XAI_GROK_COMPATIBILITY.headers.conversationId]: affinity }
+          : {}),
+        ...(provider.headers ?? {}),
+      };
+  const configuredRequestId = findHeaderCaseInsensitive(
+    provider.headers,
+    XAI_GROK_COMPATIBILITY.headers.requestId,
+  );
+  const baseFetch = provider.fetch ?? globalThis.fetch;
+  const attemptFetch = ((input, init) =>
+    baseFetch(input, withGeneratedRequestId(init, configuredRequestId, stableHeaders))) as typeof globalThis.fetch;
+
   return {
     ...provider,
-    baseUrl: XAI_GROK_CLI_BASE_URL,
-    headers: {
-      ...withoutUserOverridden(XAI_GROK_CLI_HEADERS, provider.headers),
-      ...convIdHeaders,
-      ...(provider.headers ?? {}),
-    },
+    ...(provider.authMode === "oauth" ? { baseUrl: XAI_GROK_CLI_BASE_URL } : {}),
+    headers,
+    fetch: attemptFetch,
   };
 }

package/src/responses/parser.ts

@@ -228,6 +228,20 @@ export function parseRequest(body: unknown): OcxParsedRequest {
   const now = Date.now();
   const messages: OcxMessage[] = [];
   const systemPrompt: string[] = [];
+  // Responses reasoning siblings belong to the following assistant, including across call items.
+  // Keep them off the message list until that assistant arrives; turn boundaries clear the array.
+  const pendingReasoning: Array<{ part: OcxThinkingContent; envelopeSigned: boolean }> = [];
+  // Assistant placeholder that first folds any pending reasoning into the same turn (official
+  // grok-build preserves reasoning across call items; Anthropic replay requires thinking to
+  // precede tool_use inside one assistant message).
+  const assistantHolderWithReasoning = (): OcxAssistantMessage => {
+    const holder = ensureAssistantPlaceholder(messages, data.model, now);
+    if (pendingReasoning.length > 0) {
+      holder.content.push(...pendingReasoning.map(entry => entry.part));
+      pendingReasoning.length = 0;
+    }
+    return holder;
+  };
   // Tool specs surfaced by a prior tool_search (deferred tools, e.g. subagents). Codex does not
   // re-list these in `tools`, but chat models can only call listed tools — so we re-inject them.
   const loadedToolSpecs: unknown[] = [];
@@ -270,6 +284,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // is dropped silently. It must NOT flag _compactionRequest.
         const encrypted = (item as { encrypted_content?: unknown }).encrypted_content;
         if (effectiveType === "context_compaction" && typeof encrypted !== "string") continue;
+        pendingReasoning.length = 0;
         messages.push({
           role: "user",
           content: compactionItemToText(typeof encrypted === "string" ? encrypted : undefined),
@@ -297,6 +312,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // An agent_message is external input delivered to the parent agent.
         // Preserve it as a user-role turn so signed Anthropic thinking blocks
         // on either side are never merged into one modified assistant response.
+        pendingReasoning.length = 0;
         messages.push({
           role: "user",
           content: hasContent ? content : "(sub-agent message received)",
@@ -310,6 +326,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         const msg = item as { role?: string; content?: unknown };
         switch (msg.role) {
           case "system": {
+            pendingReasoning.length = 0;
             const text = inputContentParts(msg.content as unknown[] | string | undefined);
             const flat = typeof text === "string" ? text : text.map(p => (p.type === "text" ? p.text : "")).join("");
             if (flat.length > 0) systemPrompt.push(flat);
@@ -317,13 +334,22 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           }
           case "user":
           case "developer": {
+            pendingReasoning.length = 0;
             const content = inputContentParts(msg.content as unknown[] | string | undefined);
             messages.push({ role: msg.role, content, timestamp: now });
             break;
           }
           case "assistant": {
             const parts = outputTextOf(msg.content as unknown[] | string | undefined);
-            messages.push({ role: "assistant", content: parts, model: data.model, timestamp: now });
+            messages.push({
+              role: "assistant",
+              content: pendingReasoning.length > 0
+                ? [...pendingReasoning.map(entry => entry.part), ...parts]
+                : parts,
+              model: data.model,
+              timestamp: now,
+            });
+            pendingReasoning.length = 0;
             break;
           }
         }
@@ -334,20 +360,33 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         const reasoning = item as { id?: string; summary?: { text: string }[]; content?: { text: string }[]; encrypted_content?: string };
         const fromSummary = (reasoning.summary ?? []).map(c => c.text).join("");
         const text = fromSummary || (reasoning.content ?? []).map(c => c.text).join("");
-        // ocxr1 envelope: the REAL Anthropic signature (+ redacted blocks, + hidden signed text)
-        // captured by the bridge. Native OpenAI-encrypted blobs decode to null and keep today's
-        // placeholder signature (which the anthropic adapter correctly rejects on replay).
         const envelope = typeof reasoning.encrypted_content === "string"
           ? decodeReasoningEnvelope(reasoning.encrypted_content)
           : null;
-        const thinking: OcxThinkingContent = {
-          type: "thinking",
-          thinking: envelope?.txt || text,
-          signature: envelope?.sig ?? JSON.stringify(reasoning),
-          ...(envelope?.red ? { redacted: envelope.red } : {}),
-          ...(reasoning.id ? { itemId: reasoning.id } : {}),
-        };
-        ensureAssistantPlaceholder(messages, data.model, now).content.push(thinking);
+        const thinkingText = envelope?.txt || text;
+
+        // Native/non-ocxr1 encrypted-only reasoning is opaque here. Do not create a detached
+        // assistant turn or invent replayable plaintext/signatures from the encrypted payload.
+        if (thinkingText.length > 0) {
+          const part: OcxThinkingContent = {
+            type: "thinking",
+            thinking: thinkingText,
+            signature: envelope?.sig ?? JSON.stringify(reasoning),
+            ...(envelope?.red ? { redacted: envelope.red } : {}),
+            ...(reasoning.id ? { itemId: reasoning.id } : {}),
+          };
+          const envelopeSigned = typeof envelope?.sig === "string";
+          const previous = pendingReasoning[pendingReasoning.length - 1];
+
+          if (!envelopeSigned && previous && !previous.envelopeSigned) {
+            previous.part = {
+              ...part,
+              thinking: `${previous.part.thinking}\n${part.thinking}`,
+            };
+          } else {
+            pendingReasoning.push({ part, envelopeSigned });
+          }
+        }
         continue;
       }
 
@@ -370,7 +409,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           ...(call.id ? { thoughtSignature: call.id } : {}),
           ...(call.namespace ? { namespace: call.namespace } : {}),
         };
-        ensureAssistantPlaceholder(messages, data.model, now).content.push(toolCall);
+        assistantHolderWithReasoning().content.push(toolCall);
         continue;
       }
 
@@ -382,7 +421,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           customWireName: call.name,
           ...(call.id ? { thoughtSignature: call.id } : {}),
         };
-        ensureAssistantPlaceholder(messages, data.model, now).content.push(toolCall);
+        assistantHolderWithReasoning().content.push(toolCall);
         continue;
       }
 
@@ -393,7 +432,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         const callId = call.call_id ?? call.id;
         if (callId) {
           const command = Array.isArray(call.action?.command) ? call.action.command : [];
-          ensureAssistantPlaceholder(messages, data.model, now).content.push({
+          assistantHolderWithReasoning().content.push({
             type: "toolCall", id: callId, name: "shell",
             arguments: command.length > 0 ? { command } : {},
           });
@@ -406,7 +445,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // knows the search already ran (prevents re-search loops); there is no output to pair.
         const call = item as { action?: { type?: string; query?: string } };
         const query = typeof call.action?.query === "string" ? call.action.query : "";
-        ensureAssistantPlaceholder(messages, data.model, now).content.push({
+        assistantHolderWithReasoning().content.push({
           type: "text", text: query ? `[web search performed: ${query}]` : "[web search performed]",
         });
         continue;
@@ -417,7 +456,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // history stays complete (otherwise the model re-issues tool_search forever).
         const call = item as { id?: string; call_id?: string; arguments?: unknown };
         const callId = call.call_id ?? call.id ?? "";
-        ensureAssistantPlaceholder(messages, data.model, now).content.push({
+        assistantHolderWithReasoning().content.push({
           type: "toolCall", id: callId, name: "tool_search",
           arguments: isObj(call.arguments) ? call.arguments : {},
         });
@@ -425,6 +464,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
       }
 
       if (effectiveType === "tool_search_output") {
+        pendingReasoning.length = 0;
         // Pair the tool_search call with its result so the model sees what was loaded.
         const out = item as { call_id?: string; status?: string; tools?: unknown[] };
         const specs = Array.isArray(out.tools) ? (out.tools as Record<string, unknown>[]) : [];
@@ -455,6 +495,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
       }
 
       if (effectiveType === "function_call_output") {
+        pendingReasoning.length = 0;
         const output = item as { call_id: string; output?: string | unknown[] };
         const toolInfo = findToolById(messages, output.call_id);
         messages.push({
@@ -466,6 +507,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
       }
 
       if (effectiveType === "custom_tool_call_output") {
+        pendingReasoning.length = 0;
         const output = item as { call_id: string; output: string | unknown[] };
         const toolInfo = findToolById(messages, output.call_id);
         messages.push({