@bitkyc08/opencodex 2.7.36 → 2.7.37

package/src/server/responses/collaboration.ts

@@ -281,11 +281,29 @@ export function subagentRosterText(models: Array<{ model: string; efforts: strin
 
 
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function isGeneratedDeveloperItem(item: unknown, text: string): boolean {
+  if (!isRecord(item) || item.type !== "message" || item.role !== "developer") return false;
+  if (!Array.isArray(item.content) || item.content.length !== 1) return false;
+  const [part] = item.content;
+  return isRecord(part) && part.type === "input_text" && part.text === text;
+}
+
 export function injectDeveloperMessage(parsed: OcxParsedRequest, text: string): void {
-  parsed.context.messages.push({ role: "developer", content: text, timestamp: Date.now() });
   const raw = parsed._rawBody as { input?: unknown } | undefined;
+  const devItem = { type: "message", role: "developer", content: [{ type: "input_text", text }] };
+  if (raw && Array.isArray(raw.input)) {
+    const replayPrefixLen = Math.min(parsed._replayPrefixLen ?? 0, raw.input.length);
+    if (raw.input.slice(0, replayPrefixLen).some(item => isGeneratedDeveloperItem(item, text))) {
+      return;
+    }
+  }
+
+  parsed.context.messages.push({ role: "developer", content: text, timestamp: Date.now() });
   if (raw && Array.isArray(raw.input)) {
-    const devItem = { type: "message", role: "developer", content: [{ type: "input_text", text }] };
     // compaction_trigger must remain the final input item (codex-rs + ChatGPT backend both
     // validate this). Insert the developer message BEFORE the trigger when present.
     const last = raw.input[raw.input.length - 1];
@@ -297,4 +315,3 @@ export function injectDeveloperMessage(parsed: OcxParsedRequest, text: string):
   }
 }
 
-

package/src/server/responses/core.ts

@@ -49,6 +49,7 @@ import {
   headersForCodexAuthContext,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
+  stripCodexRuntimeProviderFields,
   type CodexAuthContext,
 } from "../../codex/auth-context";
 import {
@@ -89,11 +90,15 @@ import type { AttemptRecoveryKind } from "../../usage/log";
 import {
   consumeForInspection,
   consumeForResponseLogMetadata,
+  createSseInspector,
   markNativePassthroughSseResponse,
   relaySseWithFailedTail,
   relayWithAbort,
   sanitizePassthroughHeaders,
 } from "../relay";
+import { relaySseEagerBounded } from "../relay-eager";
+import { decideEagerRelay } from "../../lib/bun-stream-caps";
+import { cancelBodyOnAbort } from "../../lib/abort";
 import { hasResponsesItemIdRepair, relaySseWithResponsesItemIdRepair } from "../responses-item-id-repair";
 import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/catalog";
 
@@ -147,6 +152,45 @@ export function usesCodexForwardPoolAuth(
     && provider.authMode === "forward" && provider.adapter === "openai-responses";
 }
 
+function normalizeCodexUnsupportedModelDetail(value: string): string {
+  return value.trim().replace(/\s+/gu, " ").toLocaleLowerCase("en-US");
+}
+
+function isAllowListedCodexAccountModel400(
+  status: number,
+  bodyText: string,
+  modelId: string,
+): boolean {
+  if (status !== 400) return false;
+  try {
+    const payload = JSON.parse(bodyText) as unknown;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    const detail = (payload as { detail?: unknown }).detail;
+    if (typeof detail !== "string") return false;
+    const expected = `The '${modelId}' model is not supported when using Codex with a ChatGPT account.`;
+    return normalizeCodexUnsupportedModelDetail(detail)
+      === normalizeCodexUnsupportedModelDetail(expected);
+  } catch {
+    return false;
+  }
+}
+
+async function shouldRetryCodexPoolAccountModel400(
+  response: Response,
+  modelId: string,
+  signal?: AbortSignal,
+): Promise<boolean> {
+  if (response.status !== 400) return false;
+  try {
+    const body = await readBoundedResponseBody(response.clone(), { signal });
+    return body.displaySafe
+      && !body.truncated
+      && isAllowListedCodexAccountModel400(response.status, body.text, modelId);
+  } catch {
+    return false;
+  }
+}
+
 
 
 export function codexForwardTerminalOutcomeRecorder(
@@ -342,6 +386,22 @@ export function buildComboChildHeaders(parentHeaders: HeadersInit): Headers {
   return childHeaders;
 }
 
+const UNREADABLE_ENCRYPTED_AGENT_TASK_MESSAGE =
+  "Routed V2 worker task is encrypted for the native ChatGPT backend and cannot be read by the selected provider. Use plaintext V2 agent-message delivery or select a native ChatGPT model.";
+
+function unreadableEncryptedAgentTaskResponse(): Response {
+  return new Response(
+    JSON.stringify({
+      error: {
+        message: UNREADABLE_ENCRYPTED_AGENT_TASK_MESSAGE,
+        type: "invalid_request_error",
+        code: "unreadable_encrypted_agent_task",
+      },
+    }),
+    { status: 400, headers: { "Content-Type": "application/json" } },
+  );
+}
+
 
 
 export async function handleComboResponses(
@@ -366,9 +426,30 @@ export async function handleComboResponses(
     return formatErrorResponse(404, "invalid_request_error", `Unknown combo: ${comboId}`);
   }
 
+  const unreadableEncryptedAgentTask = hasUnreadableEncryptedAgentTask(
+    (rawBody as { input?: unknown } | undefined)?.input,
+  );
+  const canDecryptUnreadableAgentTask = (target: (typeof combo.targets)[number]): boolean => {
+    const provider = config.providers[target.provider];
+    if (!provider || provider.disabled === true) return false;
+    try {
+      const route = routeModel(config, `${target.provider}/${target.model}`);
+      return isCanonicalOpenAiForwardProvider(route.provider);
+    } catch {
+      return false;
+    }
+  };
+  const payloadEligible = (target: (typeof combo.targets)[number]): boolean =>
+    !unreadableEncryptedAgentTask || canDecryptUnreadableAgentTask(target);
+
+  if (unreadableEncryptedAgentTask && !combo.targets.some(canDecryptUnreadableAgentTask)) {
+    return unreadableEncryptedAgentTaskResponse();
+  }
+
   const initialNow = Date.now();
   let pick = pickComboTarget(config, comboId, {
-    eligible: target => !isComboTargetInCooldown(comboId, target, initialNow),
+    eligible: target => payloadEligible(target)
+      && !isComboTargetInCooldown(comboId, target, initialNow),
   });
   if (!pick) {
     return comboUnavailableResponse(`No available targets for combo: ${comboId}`);
@@ -529,6 +610,7 @@ export async function handleComboResponses(
     pick = advanceComboAfterFailure(config, pick, {
       retryAfter: failure.retryAfter,
       now: Date.now(),
+      eligible: payloadEligible,
     });
   }
   return lastFailure!;
@@ -552,12 +634,12 @@ export async function handleResponses(
   if (comboId && Object.hasOwn(config.combos ?? {}, comboId)) {
     return handleComboResponses(req, body, comboId, config, logCtx, options);
   }
-  const originalBody = body;
-  body = expandPreviousResponseInput(body);
-  const previousResponseInputExpanded = body !== originalBody;
   const unreadableEncryptedAgentTask = hasUnreadableEncryptedAgentTask(
     (body as { input?: unknown } | undefined)?.input,
   );
+  const originalBody = body;
+  body = expandPreviousResponseInput(body);
+  const previousResponseInputExpanded = body !== originalBody;
 
   // Spawn-message compatibility (both directions): agent_message task payloads ride in
   // encrypted_content slots as plaintext. Rewrite them to input_text on the RAW body BEFORE
@@ -580,6 +662,8 @@ export async function handleResponses(
     if (previousResponseInputExpanded) parsed._previousResponseInputExpanded = true;
     parsed._providerContinuation = previousResponseProviderState(parsed.previousResponseId);
     parsed._cursorConversationId = parsed._providerContinuation?.cursor?.conversationId;
+    const clientThreadId = req.headers.get("x-codex-parent-thread-id")?.trim();
+    if (clientThreadId) parsed._clientThreadId = clientThreadId;
   } catch (err) {
     return formatErrorResponse(400, "invalid_request_error", err instanceof Error ? err.message : String(err));
   }
@@ -605,7 +689,10 @@ export async function handleResponses(
       (parsed._rawBody as Record<string, unknown>).reasoning = { effort: "low" };
     }
     (logCtx as unknown as Record<string, unknown>).shadowCallRewrittenFrom = _sciOriginal;
+    // Helpers must not resume/append into the parent thread's Cursor conversation.
+    parsed._cursorIsolateConversation = true;
   }
+  if (parsed._compactionRequest === true) parsed._cursorIsolateConversation = true;
 
   let route;
   try {
@@ -621,11 +708,7 @@ export async function handleResponses(
   // providers cannot. Reject the raw-input classification before adapter construction
   // or provider dispatch so an unreadable worker task cannot trigger a cost storm.
   if (!isCanonicalOpenAiForwardProvider(route.provider) && unreadableEncryptedAgentTask) {
-    return formatErrorResponse(
-      400,
-      "invalid_request_error",
-      "Routed V2 worker task is encrypted for the native ChatGPT backend and cannot be read by the selected provider. Use plaintext V2 agent-message delivery or select a native ChatGPT model.",
-    );
+    return unreadableEncryptedAgentTaskResponse();
   }
 
   // Apply the routed model id upstream: routing may strip a "<provider>/" namespace
@@ -772,6 +855,10 @@ export async function handleResponses(
   }
   route.provider = applyCodexAuthContextToProvider(route.provider, authCtx, route.codexAccountMode);
   logCtx.provider = formatCodexProviderForLog(route.providerName, codexLogAccountId(authCtx), config);
+  // Prefer Codex pool account as the Cursor thread namespace when present. Cursor routes without
+  // codexAccountMode still get a credential-derived scope inside the Cursor adapter.
+  const identityScope = codexLogAccountId(authCtx);
+  if (identityScope) parsed._cursorIdentityScope = identityScope;
 
   // OAuth providers: swap in a fresh access token (auto-refreshed) as the Bearer key, so the
   // existing openai-chat / anthropic adapters authenticate with no change.
@@ -917,7 +1004,7 @@ export async function handleResponses(
         + `(model ${parsed.modelId}); forwarding without it — earlier turns may be missing from this request`,
       );
     }
-    const request = await adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
+    let request = await adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
     const passthroughEstimate = typeof request.usageLog?.inputTokens === "number"
       ? request.usageLog.inputTokens
       : undefined;
@@ -931,6 +1018,20 @@ export async function handleResponses(
     linkAbortSignal(upstream, options.abortSignal);
     const connectMs = config.connectTimeoutMs ?? 200_000;
     let upstreamResponse: Response;
+    const transportFailureResponse = (err: unknown): Response => {
+      upstream.abort();
+      if (options.abortSignal?.aborted) return clientCancelledResponse();
+      const outcome = err instanceof Error && err.name === "TimeoutError" ? "timeout" : "connect_error";
+      if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
+        recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+          threadId: req.headers.get("x-codex-parent-thread-id"),
+        });
+      }
+      const msg = outcome === "timeout"
+        ? `Provider connect timeout after ${connectMs}ms`
+        : `Provider unreachable: ${err instanceof Error ? err.message : String(err)}`;
+      return formatErrorResponse(502, "upstream_error", msg);
+    };
     try {
       // Transient-5xx pre-stream retry (devlog/_plan/260716_claudecode_hardening/010):
       // the ChatGPT backend emits transient 502/520s that an immediate retry absorbs.
@@ -947,18 +1048,80 @@ export async function handleResponses(
         { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
       );
     } catch (err) {
-      upstream.abort();
-      if (options.abortSignal?.aborted) return clientCancelledResponse();
-      const outcome = err instanceof Error && err.name === "TimeoutError" ? "timeout" : "connect_error";
-      if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
-        recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
+      return transportFailureResponse(err);
+    }
+
+    if (
+      usesCodexForwardPoolAuth(authCtx, route.provider)
+      && await shouldRetryCodexPoolAccountModel400(
+        upstreamResponse,
+        route.modelId,
+        options.abortSignal,
+      )
+    ) {
+      const firstAuthCtx = authCtx;
+      let retryAuthCtx: CodexAuthContext | undefined;
+      try {
+        retryAuthCtx = await resolveCodexAuthContext(
+          req.headers,
+          config,
+          "pool",
+          { excludeAccountId: firstAuthCtx.accountId },
+        );
+      } catch (error) {
+        if (
+          !(error instanceof CodexPoolAuthenticationError)
+          && !(error instanceof CodexAuthContextError)
+          && !(error instanceof CodexAccountCooldownError)
+        ) throw error;
+      }
+
+      if (retryAuthCtx?.kind === "pool" || retryAuthCtx?.kind === "main-pool") {
+        recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, 400, {
           threadId: req.headers.get("x-codex-parent-thread-id"),
         });
+
+        const retryHeaders = headersForCodexAuthContext(req.headers, retryAuthCtx);
+        const retryProvider = applyCodexAuthContextToProvider(
+          stripCodexRuntimeProviderFields(route.provider),
+          retryAuthCtx,
+          "pool",
+        );
+        const retryAdapter = resolveAdapter(
+          resolveWireProtocolOverride(route.providerName, route.modelId, retryProvider),
+          config.cacheRetention,
+        );
+        request = await retryAdapter.buildRequest(parsed, { headers: retryHeaders });
+
+        await upstreamResponse.body?.cancel().catch(() => undefined);
+        authCtx = retryAuthCtx;
+        options.onCodexAuthContextResolved?.(retryAuthCtx);
+        selectedForwardHeaders = retryHeaders;
+        route.provider = retryProvider;
+        logCtx.provider = formatCodexProviderForLog(
+          route.providerName,
+          retryAuthCtx.accountId,
+          config,
+        );
+
+        noteAttemptSend(logCtx.activeAttempt, passthroughEstimate);
+        try {
+          upstreamResponse = await fetchWithHeaderTimeout(
+            request.url,
+            {
+              method: request.method,
+              headers: request.headers,
+              body: request.body,
+            },
+            upstream.signal,
+            connectMs,
+            parsed.stream,
+            providerFetch(route.provider),
+          );
+        } catch (err) {
+          return transportFailureResponse(err);
+        }
       }
-      const msg = outcome === "timeout"
-        ? `Provider connect timeout after ${connectMs}ms`
-        : `Provider unreachable: ${err instanceof Error ? err.message : String(err)}`;
-      return formatErrorResponse(502, "upstream_error", msg);
     }
     const headers = sanitizePassthroughHeaders(upstreamResponse.headers);
     const resolvedModel = headers.get("openai-model")?.trim();
@@ -1021,9 +1184,57 @@ export async function handleResponses(
     // async-pull segfault on Windows. Branch[0] goes directly to the Response (Bun
     // native relay, never enters JS Sink.write); branch[1] is consumed in the
     // background for terminal-outcome/quota inspection only.
+    // #314 alternative shape: on win32 (no repair) with a runtime carrying the
+    // Bun#32111 fix — or explicit `streamMode: "eager-relay"` opt-in — the tee
+    // is skipped entirely and relaySseEagerBounded provides a single eager
+    // bounded reader with inline inspection (see src/server/relay-eager.ts and
+    // devlog/_plan/260723_win_mem_safestream/020). Default on the bundled
+    // known-bad runtime remains the tee path below.
     if (upstreamResponse.ok && isEventStream && upstreamResponse.body) {
-      const [nativeBody, inspectBody] = upstreamResponse.body.tee();
       const repairConfig = route.provider.responsesItemIdRepair;
+      const winNoRepair = process.platform === "win32" && !hasResponsesItemIdRepair(repairConfig);
+      const eagerDecision = winNoRepair ? decideEagerRelay(config.streamMode ?? "auto") : null;
+      if (eagerDecision?.useEagerRelay) {
+        const turnAc = new AbortController();
+        linkAbortSignal(upstream, turnAc.signal);
+        registerTurn(turnAc);
+        const reportNativeTerminal = recordTerminalOutcomes
+          ? (status: ResponsesTerminalStatus, httpStatusOverride?: number) => {
+            terminalRecorder?.(status, httpStatusOverride);
+            options.onNativePassthroughTerminal?.(status);
+          }
+          : undefined;
+        const inspector = createSseInspector({
+          onTerminal: reportNativeTerminal,
+          logCtx,
+          onCompletedResponse: rememberPassthroughResponse,
+          onFirstOutput: options.onFirstOutput,
+        });
+        const eagerBody = relaySseEagerBounded(upstreamResponse.body, turnAc, {
+          inspectChunk: chunk => inspector.feed(chunk),
+          finishInspection: () => inspector.finish(),
+          sawTerminal: () => inspector.reported(),
+          onSynthetic: kind => {
+            if (!reportNativeTerminal) return;
+            if (kind === "incomplete") {
+              logCtx.terminalSource = "synthetic";
+              reportNativeTerminal("incomplete");
+            } else {
+              logCtx.transportPhase = "mid_stream";
+              logCtx.terminalSource = "synthetic";
+              reportNativeTerminal("failed", 502);
+            }
+          },
+          onClientCancel: () => options.onNativePassthroughCancel?.(),
+          onDone: () => unregisterTurn(turnAc),
+        });
+        if (!headers.has("content-type")) headers.set("content-type", "text/event-stream");
+        return markNativePassthroughSseResponse(new Response(eagerBody, {
+          status: upstreamResponse.status,
+          headers,
+        }));
+      }
+      const [nativeBody, inspectBody] = upstreamResponse.body.tee();
       const turnAc = new AbortController();
       linkAbortSignal(upstream, turnAc.signal);
       registerTurn(turnAc);
@@ -1102,7 +1313,9 @@ export async function handleResponses(
   if (adapter.runTurn) {
     const runTurnAbort = new AbortController();
     linkAbortSignal(runTurnAbort, options.abortSignal);
-    const queue = createAdapterEventQueue();
+    const queue = createAdapterEventQueue({
+      onBacklogExceeded: () => runTurnAbort.abort(),
+    });
     const runTurn = async (): Promise<void> => {
       try {
         noteAttemptSend(logCtx.activeAttempt, logCtx.usageLogInputTokens);
@@ -1419,6 +1632,8 @@ export async function handleResponses(
     }
   }
 
+  cancelBodyOnAbort(upstreamResponse.body, upstream.signal);
+
   if (parsed.stream) {
     const eventStream = activeAdapter.parseStream(upstreamResponse);
     const { toolNsMap, freeformToolNames, toolSearchToolNames } = buildToolBridgeMaps(parsed);

package/src/server/responses/encrypted-payload.ts

@@ -104,52 +104,131 @@ export function looksLikeBackendCiphertext(payload: string): boolean {
 
 
 
-export const FERNET_TOKEN_RUN = /gAAAA[A-Za-z0-9_-]{60,}={0,2}/g;
+/**
+ * Backend-minted ciphertext runs are Fernet tokens (base64url, version byte 0x80).
+ * Used to carve embedded blobs out of MIXED slots: plugin hooks may prepend
+ * plaintext control metadata to a task body that is already backend-encrypted.
+ */
+const FERNET_TOKEN_CANDIDATE = /g[A-Za-z0-9_-]{97,}={0,2}/g;
+const FERNET_TOKEN_BOUNDARY_CHAR = /[A-Za-z0-9_=-]/;
+
+interface FernetTokenRun {
+  index: number;
+  token: string;
+}
+
+/**
+ * Validate only the key-independent Fernet wire structure. Authenticity cannot be
+ * checked without the backend key, but a real token must still be canonical base64url
+ * containing version(1) + timestamp(8) + IV(16) + AES-CBC ciphertext(16*n) + HMAC(32).
+ * Timestamp freshness is deliberately not enforced: old history can contain valid tokens.
+ */
+function isStructurallyValidFernetToken(token: string): boolean {
+  if (token.length < 100 || token.length % 4 !== 0) return false;
+  if (!/^[A-Za-z0-9_-]+={0,2}$/.test(token)) return false;
+
+  const unpadded = token.replace(/=+$/, "");
+  const paddingLength = token.length - unpadded.length;
+  const expectedPadding = (4 - (unpadded.length % 4)) % 4;
+  if (expectedPadding > 2 || paddingLength !== expectedPadding) return false;
+
+  let decoded: Buffer;
+  try {
+    decoded = Buffer.from(unpadded, "base64url");
+  } catch {
+    return false;
+  }
+  if (decoded.toString("base64url") !== unpadded) return false;
+  if (decoded.length < 73 || decoded[0] !== 0x80) return false;
+
+  const ciphertextLength = decoded.length - 57;
+  return ciphertextLength >= 16 && ciphertextLength % 16 === 0;
+}
+
+/** Maximal, boundary-delimited and structurally valid Fernet runs embedded in a slot. */
+function fernetTokenRuns(payload: string): FernetTokenRun[] {
+  const runs: FernetTokenRun[] = [];
+  for (const match of payload.matchAll(FERNET_TOKEN_CANDIDATE)) {
+    const index = match.index ?? 0;
+    const token = match[0];
+    const before = index > 0 ? payload[index - 1] : undefined;
+    const after = payload[index + token.length];
+    if (before && FERNET_TOKEN_BOUNDARY_CHAR.test(before)) continue;
+    if (after && FERNET_TOKEN_BOUNDARY_CHAR.test(after)) continue;
+    if (!isStructurallyValidFernetToken(token)) continue;
+    runs.push({ index, token });
+  }
+  return runs;
+}
+
+function textWithoutFernetRuns(payload: string, runs: readonly FernetTokenRun[]): string {
+  let last = 0;
+  let text = "";
+  for (const run of runs) {
+    text += `${payload.slice(last, run.index)}\n\n`;
+    last = run.index + run.token.length;
+  }
+  return `${text}${payload.slice(last)}`;
+}
 
 export const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*NEW_TASK[^\n]*\nTask name\s*:[^\n]*\nSender\s*:[^\n]*\nPayload\s*:\s*(?:\n|$)/gi;
 
-export const AGENT_MESSAGE_CONTROL_PREAMBLE = /(?:^|\n)\[CXC-(?:LEAF-GUARD|SKILL-AFFORDANCE)\][\s\S]*?(?=\n{2,}|$)/g;
+// CXC is the compatibility-hook control namespace. Strip only the tagged paragraph:
+// later untagged paragraphs may be genuine task text. Repeated CXC paragraphs are
+// removed independently, and a following routing envelope remains available to the
+// envelope stripper below.
+export const AGENT_MESSAGE_CONTROL_PREAMBLE = /(?:^|\n)\[CXC-[A-Z0-9-]+\][^\n]*(?:\n(?!\n|Message Type\s*:)[^\n]*)*(?=\n{2,}|\nMessage Type\s*:|$)/gi;
 
 export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
   if (!Array.isArray(input)) return false;
 
-  return input.some(item => {
-    if (!item || typeof item !== "object" || (item as { type?: unknown }).type !== "agent_message") {
-      return false;
-    }
+  // codex-rs appends one NEW_TASK agent_message at the current input tail. Historical
+  // agent messages may be adjacent in full-history bodies; they must not poison the
+  // later task. compaction_trigger/additional_tools are trailing metadata rather than
+  // a newer user turn.
+  let index = input.length - 1;
+  while (index >= 0) {
+    const item = input[index];
+    const type = item && typeof item === "object" ? (item as { type?: unknown }).type : undefined;
+    if (type !== "compaction_trigger" && type !== "additional_tools") break;
+    index -= 1;
+  }
+  const item = input[index];
+  if (!item || typeof item !== "object" || (item as { type?: unknown }).type !== "agent_message") {
+    return false;
+  }
 
-    const content = (item as { content?: unknown }).content;
-    if (!Array.isArray(content)) return false;
-
-    let hasFernetTask = false;
-    const readableParts: string[] = [];
-    for (const part of content) {
-      if (!part || typeof part !== "object") continue;
-      const record = part as { type?: unknown; text?: unknown; encrypted_content?: unknown };
-      if (
-        (record.type === "input_text" || record.type === "text" || record.type === "output_text")
-        && typeof record.text === "string"
-      ) {
-        readableParts.push(record.text);
-        continue;
-      }
-      if (record.type !== "encrypted_content" || typeof record.encrypted_content !== "string") {
-        continue;
-      }
+  const content = (item as { content?: unknown }).content;
+  if (!Array.isArray(content)) return false;
 
-      const withoutFernet = record.encrypted_content.replace(FERNET_TOKEN_RUN, "\n\n");
-      if (withoutFernet !== record.encrypted_content) hasFernetTask = true;
-      readableParts.push(withoutFernet);
+  let hasFernetTask = false;
+  const readableParts: string[] = [];
+  for (const part of content) {
+    if (!part || typeof part !== "object") continue;
+    const record = part as { type?: unknown; text?: unknown; encrypted_content?: unknown };
+    if (
+      (record.type === "input_text" || record.type === "text")
+      && typeof record.text === "string"
+    ) {
+      readableParts.push(record.text);
+      continue;
+    }
+    if (record.type !== "encrypted_content" || typeof record.encrypted_content !== "string") {
+      continue;
     }
 
-    if (!hasFernetTask) return false;
-    const readableTask = readableParts
-      .join("\n\n")
-      .replace(AGENT_MESSAGE_ROUTING_ENVELOPE, "\n")
-      .replace(AGENT_MESSAGE_CONTROL_PREAMBLE, "\n")
-      .trim();
-    return readableTask.length === 0;
-  });
+    const runs = fernetTokenRuns(record.encrypted_content);
+    if (runs.length > 0) hasFernetTask = true;
+    readableParts.push(textWithoutFernetRuns(record.encrypted_content, runs));
+  }
+
+  if (!hasFernetTask) return false;
+  const readableTask = readableParts
+    .join("\n\n")
+    .replace(AGENT_MESSAGE_CONTROL_PREAMBLE, "\n")
+    .replace(AGENT_MESSAGE_ROUTING_ENVELOPE, "\n")
+    .trim();
+  return readableTask.length === 0;
 }
 
 
@@ -157,12 +236,11 @@ export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
 export function encryptedSlotParts(payload: string): Array<Record<string, string>> {
   const parts: Array<Record<string, string>> = [];
   let last = 0;
-  for (const match of payload.matchAll(FERNET_TOKEN_RUN)) {
-    const index = match.index ?? 0;
-    const before = payload.slice(last, index);
+  for (const run of fernetTokenRuns(payload)) {
+    const before = payload.slice(last, run.index);
     if (before.trim().length > 0) parts.push({ type: "input_text", text: before });
-    parts.push({ type: "encrypted_content", encrypted_content: match[0] });
-    last = index + match[0].length;
+    parts.push({ type: "encrypted_content", encrypted_content: run.token });
+    last = run.index + run.token.length;
   }
   const rest = payload.slice(last);
   if (rest.trim().length > 0) parts.push({ type: "input_text", text: rest });
@@ -228,4 +306,3 @@ export function sanitizeEncryptedContentInPlace(input: unknown): number {
   return rewritten;
 }
 
-

package/src/server/ws-bridge.ts

@@ -22,6 +22,13 @@ export interface WsData {
   authContext?: CodexAuthContext; // last resolved account decision for observability/registry cleanup
   cancel?: () => void; // cancels the in-flight stream reader/fetch
   turnId?: number; // monotonically increasing per socket; prevents stale frames after replacement turns
+  /** Discriminator: Responses reframing vs transparent live/realtime sideband relay. */
+  kind?: "responses" | "live-sideband";
+  liveUpstream?: WebSocket;
+  liveUpstreamUrl?: string;
+  liveUpstreamHeaders?: Record<string, string>;
+  livePending?: Array<string | Buffer>;
+  liveOpened?: boolean;
 }
 
 export class WsSendDroppedError extends Error {

package/src/types.ts

@@ -5,10 +5,24 @@ export interface OcxParsedRequest {
   stream: boolean;
   options: OcxRequestOptions;
   _rawBody?: unknown;
+  /** Number of leading raw input items restored from local previous_response_id state. */
+  _replayPrefixLen?: number;
   /** True when the proxy expanded a previous_response_id request into a full input replay. */
   _previousResponseInputExpanded?: boolean;
   /** Provider-private stable Cursor conversation id resolved from the Responses previous_response_id chain. */
   _cursorConversationId?: string;
+  /** Stable upstream client thread identity, used only to derive provider-scoped continuation ids. */
+  _clientThreadId?: string;
+  /**
+   * Optional authenticated tenant/operator namespace for Cursor thread→conversation derivation.
+   * When absent (single-operator local proxy), derivation stays local-scoped.
+   */
+  _cursorIdentityScope?: string;
+  /**
+   * True for helper/shadow/compaction turns that must not append into the main Cursor conversation
+   * derived from the parent thread id.
+   */
+  _cursorIsolateConversation?: boolean;
   /** Provider-private continuation metadata resolved from the Responses previous_response_id chain. */
   _providerContinuation?: OcxProviderContinuationState;
   /**
@@ -445,6 +459,15 @@ export interface OcxConfig {
    * Undefined = passthrough (don't modify what the client sends).
    */
   fastMode?: boolean;
+  /**
+   * Windows SSE passthrough stream shape (#314 mitigation).
+   * "auto" (default): eager bounded relay only on runtimes proven to carry the
+   * Bun#32111 fix (none today → legacy tee). "eager-relay": force the new relay
+   * (accepts #32111 crash risk on Bun 1.3.14). "legacy-tee": pin the tee path.
+   * Persisted in config.json because Windows services do not inherit shell env.
+   * See src/lib/bun-stream-caps.ts.
+   */
+  streamMode?: "auto" | "legacy-tee" | "eager-relay";
   /**
    * Custom override for the injected multi-agent guidance body (the text inside the
    * <multi_agent_mode> tags). When set, it replaces the built-in prompt on whichever
@@ -529,6 +552,8 @@ export interface OcxConfig {
   apiKeys?: Array<{ id: string; name: string; key: string; createdAt: string }>;
   /** Auto-start/sync the proxy from the Codex shim before launching Codex. Default true. */
   codexAutoStart?: boolean;
+  /** Restore an installed shim after a stable external Codex update replaces it. Default true. */
+  codexShimAutoRestore?: boolean;
   /**
    * Compatibility mode: temporarily rewrite Codex resume-history metadata while the proxy is active
    * so Codex App can show old OpenAI chats and opencodex-created exec chats under its default