@bitkyc08/opencodex 2.7.4 → 2.7.6

package/README.ko.md

@@ -179,6 +179,7 @@ opencodex는 두 가지 동작을 분리해서 유지합니다:
 - **알맞은 모델에 위임.** 대시보드나 config에서 최대 5개의 라우팅/네이티브 모델을 Codex 서브에이전트 선택기에 노출해, 복잡한 작업은 reasoning 모델로, 빠른 작업은 저렴한 모델로 보낼 수 있습니다. v2 멀티에이전트 표면(GPT-5.6 Sol/Terra)에서는 프록시가 간결한 위임 가이드를 주입합니다. 선호 서브에이전트 모델·effort(`injectionModel` / `injectionEffort`), 노출된 모델 로스터와 각 모델이 지원하는 effort 사다리, 그리고 크로스모델 `spawn_agent` 호출이 실제로 먹히게 하는 `fork_turns` 규칙까지. 문구를 직접 쓰고 싶다면 `injectionPrompt`에 `{{model}}` / `{{effort}}` / `{{roster}}` 플레이스홀더를 넣으면 됩니다.
 - **프리뷰 게이트된 OpenAI rollout에 대비.** GPT-5.6 Sol/Terra/Luna 항목은 upstream 스펙 그대로(Sol/Terra는 `ultra`까지, Luna는 `max`까지; 372k usable context) ChatGPT passthrough, OpenAI API key, OpenRouter route에 준비되어 있습니다.
 - **어떤 모델에도 초능력을.** OpenAI가 아닌 모델도 ChatGPT 로그인 위에서 도는 `gpt-5.4-mini` sidecar로 실제 웹 검색과 이미지 이해를 사용합니다.
+- **이미지를 네이티브로 생성.** Codex의 독립형 `image_gen` 도구는 생성할 때 `POST /v1/images/generations`, 편집할 때 `POST /v1/images/edits`를 사용합니다. Responses의 hosted `image_generation` 도구와는 별개입니다.
 - **무슨 일이 일어나는지 보이게.** 웹 대시보드가 프로바이더, OAuth 상태, 모델 선택, upstream이 보고한 cached/cache-write 토큰 수를 포함한 실시간 요청 로그를 보여줍니다 — 왜 요청이 실패했는지 더는 추측하지 않아도 됩니다.
 - **백그라운드 실행.** 시스템 서비스(launchd / systemd / Task Scheduler)로 설치하면 부팅 시 자동 시작되어 신경 쓸 필요가 없습니다.
 - **깔끔한 종료, 잔여물 제로.** `ocx stop`(또는 대시보드의 Stop 버튼)은 프록시를 종료하고, 설치된 백그라운드 서비스를 멈추며, Codex를 원래 설정으로 복원합니다. 이후 `codex`는 잔여 설정이나 좀비 프로세스 없이 이전과 똑같이 동작합니다.
@@ -321,7 +322,8 @@ WebSocket 전송은 기본적으로 꺼져 있습니다. Codex가 HTTP/SSE 대
 ### 원격 접근
 
 기본적으로 opencodex는 `127.0.0.1`(루프백)에 바인딩되며 별도 인증이 필요 없습니다.
-`"hostname": "0.0.0.0"`으로 LAN에 노출할 경우, opencodex는 관리 API(`/api/*`)와 데이터 플레인(`/v1/responses`) 모두에 bearer 토큰을 요구합니다:
+`"hostname": "0.0.0.0"`으로 LAN에 노출할 경우, opencodex는 관리 API(`/api/*`)와 데이터 플레인
+(`/v1/responses`, `/v1/images/generations`, `/v1/images/edits`) 모두에 bearer 토큰을 요구합니다:
 
 ```bash
 export OPENCODEX_API_AUTH_TOKEN="your-secret-token"
@@ -372,8 +374,9 @@ bun x tsc --noEmit   # 타입 체크
 ```
 
 `bun run dev`는 호환성을 위해 `bun run dev:proxy`의 별칭으로 남아 있습니다. 소스 체크아웃에서 프록시
-API는 `/healthz`, `/v1/responses`, `/api/*`를 노출하며, `GET /`는 `bun run build:gui`가 `gui/dist`를
-생성한 뒤에만 패키징된 대시보드를 서빙합니다. 대시보드를 수정할 때는 프론트엔드를 별도로 실행하세요:
+API는 `/healthz`, `/v1/responses`, `POST /v1/images/generations`, `POST /v1/images/edits`, `/api/*`를
+노출하며, `GET /`는 `bun run build:gui`가 `gui/dist`를 생성한 뒤에만 패키징된 대시보드를 서빙합니다.
+대시보드를 수정할 때는 프론트엔드를 별도로 실행하세요:
 
 ```bash
 bun run dev:gui

package/README.md

@@ -184,6 +184,7 @@ next Codex session. opencodex keeps two separate behaviors:
 - **Delegate to the right model.** Feature up to five routed or native models in Codex's subagent picker from the dashboard or config — route complex tasks to a reasoning model, fast tasks to a cheap one. On the v2 multi-agent surface (GPT-5.6 Sol/Terra) the proxy injects compact delegation guidance: a preferred sub-agent model and effort (`injectionModel` / `injectionEffort`), the featured-model roster with the effort ladder each supports, and the `fork_turns` rules that make cross-model `spawn_agent` calls actually stick. Want your own wording? Set `injectionPrompt` with `{{model}}` / `{{effort}}` / `{{roster}}` placeholders.
 - **Prepare for preview-gated OpenAI rollouts.** GPT-5.6 Sol/Terra/Luna entries ship with the exact upstream spec (Sol/Terra reach `ultra`, Luna caps at `max`; 372k usable context) for ChatGPT passthrough, OpenAI API key, and OpenRouter routes when upstream access is available.
 - **Give any model superpowers.** Non-OpenAI models get real web search and image understanding via a `gpt-5.4-mini` sidecar over your ChatGPT login.
+- **Generate images natively.** Codex's standalone `image_gen` tool uses `POST /v1/images/generations` for generation and `POST /v1/images/edits` for edits; it is separate from the hosted Responses `image_generation` tool.
 - **See what's happening.** The web dashboard shows providers, OAuth status, model selection, and a live request log, including cached/cache-write token counts when upstream reports them — no more guessing why a request failed.
 - **Runs in the background.** Install as a system service (launchd / systemd / Task Scheduler) and forget about it. The proxy starts on boot and stays out of your way.
 - **Clean exit, zero residue.** `ocx stop` (or the dashboard's Stop button) shuts down the proxy, stops the background service if one is installed, and restores Codex to its original configuration. Plain `codex` works exactly as it did before — no leftover config, no orphaned processes.
@@ -341,7 +342,8 @@ WebSocket transport is off by default. Set `"websockets": true` only if you want
 
 By default opencodex binds to `127.0.0.1` (loopback) and requires no extra authentication.
 If you set `"hostname": "0.0.0.0"` to expose the proxy on the LAN, opencodex requires a bearer token
-to protect both the management API (`/api/*`) and the data-plane (`/v1/responses`):
+to protect both the management API (`/api/*`) and the data-plane (`/v1/responses`,
+`/v1/images/generations`, and `/v1/images/edits`):
 
 ```bash
 export OPENCODEX_API_AUTH_TOKEN="your-secret-token"
@@ -392,9 +394,9 @@ bun x tsc --noEmit   # typecheck
 ```
 
 `bun run dev` remains an alias for `bun run dev:proxy` for compatibility. In a source checkout,
-the proxy API exposes `/healthz`, `/v1/responses`, and `/api/*`; `GET /` serves the packaged
-dashboard only after `bun run build:gui` has produced `gui/dist`. While hacking on the dashboard,
-run the frontend separately:
+the proxy API exposes `/healthz`, `/v1/responses`, `POST /v1/images/generations`,
+`POST /v1/images/edits`, and `/api/*`; `GET /` serves the packaged dashboard only after
+`bun run build:gui` has produced `gui/dist`. While hacking on the dashboard, run the frontend separately:
 
 ```bash
 bun run dev:gui

package/README.zh-CN.md

@@ -102,6 +102,7 @@ npm install -g @bitkyc08/opencodex   # 不要加 --ignore-scripts、--omit=optio
 - **委派给合适的模型。** 在仪表盘或 config 中把最多 5 个路由/原生模型放进 Codex 的 subagent 选择器 —— 复杂任务交给 reasoning 模型，快速任务交给便宜模型。在 v2 多智能体表面（GPT-5.6 Sol/Terra）上，代理会注入精简的委派指引：首选子智能体模型与 effort（`injectionModel` / `injectionEffort`）、featured 模型清单及各自支持的 effort 阶梯，以及让跨模型 `spawn_agent` 调用真正生效的 `fork_turns` 规则。想自定义文案，可在 `injectionPrompt` 中使用 `{{model}}` / `{{effort}}` / `{{roster}}` 占位符。
 - **为 preview-gated OpenAI rollout 做好准备。** GPT-5.6 Sol/Terra/Luna 条目采用与 upstream 完全一致的规格（Sol/Terra 到 `ultra`，Luna 到 `max`；372k 可用上下文），覆盖 ChatGPT passthrough、OpenAI API key 和 OpenRouter 路由。
 - **给任意模型超能力。** 非 OpenAI 模型也能通过你的 ChatGPT 登录上运行的 `gpt-5.4-mini` sidecar 获得真正的网页搜索和图片理解。
+- **原生生成图片。** Codex 的独立 `image_gen` 工具通过 `POST /v1/images/generations` 生成图片、通过 `POST /v1/images/edits` 编辑图片；它独立于 hosted Responses 的 `image_generation` 工具。
 - **看清正在发生什么。** Web 仪表盘展示 provider、OAuth 状态、模型选择和实时请求日志；当上游返回时，也会包含 cached/cache-write token 计数 —— 不必再猜测请求为何失败。
 - **后台运行。** 安装为系统服务（launchd / systemd / Task Scheduler）后开机自启，无需操心。
 - **干净退出，零残留。** `ocx stop`（或仪表盘的 Stop 按钮）会关闭代理、停止已安装的后台服务，并将 Codex 恢复为原始配置。之后 `codex` 就像从未安装过 opencodex 一样工作 —— 无残留配置，无僵尸进程。
@@ -303,7 +304,7 @@ WebSocket 传输默认关闭。只有当你希望 Codex 使用 Responses WebSock
 
 默认情况下 opencodex 绑定到 `127.0.0.1`（回环）且无需额外认证。
 如果你设置 `"hostname": "0.0.0.0"` 把代理暴露到局域网，opencodex 会要求一个 bearer token 来同时保护管理
-API（`/api/*`）和数据平面（`/v1/responses`）：
+API（`/api/*`）和数据平面（`/v1/responses`、`/v1/images/generations`、`/v1/images/edits`）：
 
 ```bash
 export OPENCODEX_API_AUTH_TOKEN="your-secret-token"
@@ -350,8 +351,8 @@ bun x tsc --noEmit   # 类型检查
 ```
 
 `bun run dev` 作为 `bun run dev:proxy` 的别名保留以兼容旧用法。在源码检出中，代理 API 暴露 `/healthz`、
-`/v1/responses`、`/api/*`；只有在 `bun run build:gui` 生成 `gui/dist` 之后，`GET /` 才会提供打包后的仪表盘。
-开发前端时请单独运行：
+`/v1/responses`、`POST /v1/images/generations`、`POST /v1/images/edits`、`/api/*`；只有在
+`bun run build:gui` 生成 `gui/dist` 之后，`GET /` 才会提供打包后的仪表盘。开发前端时请单独运行：
 
 ```bash
 bun run dev:gui

package/gui/dist/assets/{index-66dPs6l_.js → index-mEjIne-M.js}

@@ -37,4 +37,4 @@ v2: 多线程代理（spawn_agent）。所有模型使用 v2 协作界面。
   -d '{
     "model": "gpt-5.4",
     "input": "Hello, world!"
-  }'`})]})]})}var Ft=`opencodex-api-token`,It=!1,Lt=null;function Rt(e){try{let t=e instanceof Request?e.url:String(e);return new URL(t,window.location.href).pathname}catch{return null}}function zt(e){let t=Rt(e);return!!t&&(t.startsWith(`/api/`)||t.startsWith(`/v1/`))}function Bt(){try{return sessionStorage.getItem(Ft)?.trim()||null}catch{return null}}function Vt(e){try{sessionStorage.setItem(Ft,e)}catch{}}function Ht(){try{sessionStorage.removeItem(Ft)}catch{}}function Ut(e,t,n){let r=new Headers(t?.headers??(e instanceof Request?e.headers:void 0));return r.set(`X-OpenCodex-API-Key`,n),e instanceof Request?[new Request(e,{headers:r}),t?{...t,headers:r}:void 0]:[e,{...t,headers:r}]}async function Wt(){return Lt||(Lt=Promise.resolve().then(()=>window.prompt(`OpenCodex API token`)?.trim()||null).finally(()=>{Lt=null}),Lt)}function Gt(){if(It)return;It=!0;let e=window.fetch.bind(window);window.fetch=async(t,n)=>{if(!zt(t))return e(t,n);let r=Bt(),[i,a]=r?Ut(t,n,r):[t,n],o=await e(i,a);if(o.status!==401)return o;r&&Ht();let s=await Wt();if(!s)return o;Vt(s);let[c,l]=Ut(t,n,s),u=await e(c,l);return u.status===401&&Ht(),u}}Gt();var Kt=new Set([`dashboard`,`providers`,`models`,`subagents`,`logs`,`debug`,`usage`,`codex-auth`,`api`]);function qt(){let e=location.hash.replace(/^#\/?/,``);return Kt.has(e)?e:`dashboard`}var Jt=``,Yt=`ocx-theme`,Xt=[{id:`dashboard`,tkey:`nav.dashboard`,Icon:w},{id:`providers`,tkey:`nav.providers`,Icon:T},{id:`models`,tkey:`nav.models`,Icon:E},{id:`subagents`,tkey:`nav.subagents`,Icon:ee},{id:`logs`,tkey:`nav.logs`,Icon:D},{id:`debug`,tkey:`nav.debug`,Icon:te},{id:`usage`,tkey:`nav.usage`,Icon:ne},{id:`codex-auth`,tkey:`nav.codexAuth`,Icon:L},{id:`api`,tkey:`nav.api`,Icon:me}],Zt={light:de,dark:fe,system:pe},Qt={light:`theme.light`,dark:`theme.dark`,system:`theme.system`};function $t(e){if(!e||typeof e!=`object`||!(`version`in e))return null;let t=e.version;return typeof t==`string`&&t.length>0?t:null}function en(){let e=localStorage.getItem(Yt);return e===`light`||e===`dark`?e:`system`}function tn(){let[e,t]=(0,_.useState)(qt),n=e=>{location.hash=e,t(e)},[r,i]=(0,_.useState)(en),[a,o]=(0,_.useState)(null),{locale:s,setLocale:c}=Ce(),l=we();(0,_.useEffect)(()=>{let e=()=>t(qt());return window.addEventListener(`hashchange`,e),()=>window.removeEventListener(`hashchange`,e)},[]),(0,_.useEffect)(()=>{let e=document.documentElement;r===`system`?(e.removeAttribute(`data-theme`),localStorage.removeItem(Yt)):(e.setAttribute(`data-theme`,r),localStorage.setItem(Yt,r))},[r]),(0,_.useEffect)(()=>{let e=!1,t=async()=>{try{let t=await fetch(`${Jt}/healthz`);if(!t.ok)return;let n=$t(await t.json());!e&&n&&o(n)}catch{}};t();let n=setInterval(t,3e4);return()=>{e=!0,clearInterval(n)}},[]);let u=()=>i(e=>e===`light`?`dark`:e===`dark`?`system`:`light`),d=Zt[r],f=a??`2.7.4`,[p,m]=(0,_.useState)(!1);return(0,S.jsxs)(`div`,{className:`app`,children:[(0,S.jsxs)(`aside`,{className:`sidebar`,children:[(0,S.jsxs)(`div`,{className:`brand`,children:[(0,S.jsx)(`span`,{className:`brand-logo`,role:`img`,"aria-label":`opencodex logo`}),(0,S.jsx)(`span`,{className:`name`,children:`opencodex`}),(0,S.jsxs)(`span`,{className:`ver`,children:[`v`,f]})]}),(0,S.jsx)(`nav`,{children:Xt.map(({id:t,tkey:r,Icon:i})=>(0,S.jsxs)(`button`,{className:`nav-item${e===t?` active`:``}`,"data-page":t,onClick:()=>n(t),"aria-current":e===t?`page`:void 0,children:[(0,S.jsx)(i,{}),` `,l(r)]},t))}),(0,S.jsxs)(`div`,{className:`sidebar-foot`,children:[(0,S.jsxs)(`div`,{className:`lang-toggle`,children:[(0,S.jsx)(me,{"aria-hidden":!0}),(0,S.jsx)(Ae,{value:s,options:_e.map(e=>({value:e.code,label:e.name})),onChange:e=>c(e),label:l(`lang.label`),placement:`right`,style:{flex:1,minWidth:0,width:`100%`}})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle`,onClick:u,"aria-label":`${l(`theme.label`)}: ${l(Qt[r])}`,title:`${l(`theme.label`)}: ${l(Qt[r])}`,children:[(0,S.jsx)(d,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(Qt[r])})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle stop-toggle`,onClick:async()=>{if(confirm(l(`dash.stopConfirm`))){m(!0);try{await fetch(`${Jt}/api/stop`,{method:`POST`})}catch{}}},disabled:p,"aria-label":l(`dash.stop`),title:l(`dash.stop`),children:[(0,S.jsx)(I,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(p?`dash.stopping`:`dash.stop`)})]}),(0,S.jsxs)(`a`,{className:`sidebar-link`,href:`https://github.com/lidge-jun/opencodex`,target:`_blank`,rel:`noreferrer`,children:[(0,S.jsx)(F,{}),` `,l(`common.github`)]})]})]}),(0,S.jsx)(`main`,{className:`main`,children:(0,S.jsxs)(`div`,{className:`main-inner`,children:[e===`dashboard`&&(0,S.jsx)(He,{apiBase:Jt}),e===`providers`&&(0,S.jsx)(nt,{apiBase:Jt}),e===`models`&&(0,S.jsx)(ct,{apiBase:Jt}),e===`subagents`&&(0,S.jsx)(lt,{apiBase:Jt}),e===`logs`&&(0,S.jsx)(yt,{apiBase:Jt}),e===`debug`&&(0,S.jsx)(bt,{apiBase:Jt}),e===`usage`&&(0,S.jsx)(Dt,{apiBase:Jt}),e===`codex-auth`&&(0,S.jsx)(kt,{apiBase:Jt}),e===`api`&&(0,S.jsx)(Pt,{apiBase:Jt})]})})]})}v.createRoot(document.getElementById(`root`)).render((0,S.jsx)(_.StrictMode,{children:(0,S.jsx)(Se,{children:(0,S.jsx)(tn,{})})}));
+  }'`})]})]})}var Ft=`opencodex-api-token`,It=!1,Lt=null;function Rt(e){try{let t=e instanceof Request?e.url:String(e);return new URL(t,window.location.href).pathname}catch{return null}}function zt(e){let t=Rt(e);return!!t&&(t.startsWith(`/api/`)||t.startsWith(`/v1/`))}function Bt(){try{return sessionStorage.getItem(Ft)?.trim()||null}catch{return null}}function Vt(e){try{sessionStorage.setItem(Ft,e)}catch{}}function Ht(){try{sessionStorage.removeItem(Ft)}catch{}}function Ut(e,t,n){let r=new Headers(t?.headers??(e instanceof Request?e.headers:void 0));return r.set(`X-OpenCodex-API-Key`,n),e instanceof Request?[new Request(e,{headers:r}),t?{...t,headers:r}:void 0]:[e,{...t,headers:r}]}async function Wt(){return Lt||(Lt=Promise.resolve().then(()=>window.prompt(`OpenCodex API token`)?.trim()||null).finally(()=>{Lt=null}),Lt)}function Gt(){if(It)return;It=!0;let e=window.fetch.bind(window);window.fetch=async(t,n)=>{if(!zt(t))return e(t,n);let r=Bt(),[i,a]=r?Ut(t,n,r):[t,n],o=await e(i,a);if(o.status!==401)return o;r&&Ht();let s=await Wt();if(!s)return o;Vt(s);let[c,l]=Ut(t,n,s),u=await e(c,l);return u.status===401&&Ht(),u}}Gt();var Kt=new Set([`dashboard`,`providers`,`models`,`subagents`,`logs`,`debug`,`usage`,`codex-auth`,`api`]);function qt(){let e=location.hash.replace(/^#\/?/,``);return Kt.has(e)?e:`dashboard`}var Jt=``,Yt=`ocx-theme`,Xt=[{id:`dashboard`,tkey:`nav.dashboard`,Icon:w},{id:`providers`,tkey:`nav.providers`,Icon:T},{id:`models`,tkey:`nav.models`,Icon:E},{id:`subagents`,tkey:`nav.subagents`,Icon:ee},{id:`logs`,tkey:`nav.logs`,Icon:D},{id:`debug`,tkey:`nav.debug`,Icon:te},{id:`usage`,tkey:`nav.usage`,Icon:ne},{id:`codex-auth`,tkey:`nav.codexAuth`,Icon:L},{id:`api`,tkey:`nav.api`,Icon:me}],Zt={light:de,dark:fe,system:pe},Qt={light:`theme.light`,dark:`theme.dark`,system:`theme.system`};function $t(e){if(!e||typeof e!=`object`||!(`version`in e))return null;let t=e.version;return typeof t==`string`&&t.length>0?t:null}function en(){let e=localStorage.getItem(Yt);return e===`light`||e===`dark`?e:`system`}function tn(){let[e,t]=(0,_.useState)(qt),n=e=>{location.hash=e,t(e)},[r,i]=(0,_.useState)(en),[a,o]=(0,_.useState)(null),{locale:s,setLocale:c}=Ce(),l=we();(0,_.useEffect)(()=>{let e=()=>t(qt());return window.addEventListener(`hashchange`,e),()=>window.removeEventListener(`hashchange`,e)},[]),(0,_.useEffect)(()=>{let e=document.documentElement;r===`system`?(e.removeAttribute(`data-theme`),localStorage.removeItem(Yt)):(e.setAttribute(`data-theme`,r),localStorage.setItem(Yt,r))},[r]),(0,_.useEffect)(()=>{let e=!1,t=async()=>{try{let t=await fetch(`${Jt}/healthz`);if(!t.ok)return;let n=$t(await t.json());!e&&n&&o(n)}catch{}};t();let n=setInterval(t,3e4);return()=>{e=!0,clearInterval(n)}},[]);let u=()=>i(e=>e===`light`?`dark`:e===`dark`?`system`:`light`),d=Zt[r],f=a??`2.7.6`,[p,m]=(0,_.useState)(!1);return(0,S.jsxs)(`div`,{className:`app`,children:[(0,S.jsxs)(`aside`,{className:`sidebar`,children:[(0,S.jsxs)(`div`,{className:`brand`,children:[(0,S.jsx)(`span`,{className:`brand-logo`,role:`img`,"aria-label":`opencodex logo`}),(0,S.jsx)(`span`,{className:`name`,children:`opencodex`}),(0,S.jsxs)(`span`,{className:`ver`,children:[`v`,f]})]}),(0,S.jsx)(`nav`,{children:Xt.map(({id:t,tkey:r,Icon:i})=>(0,S.jsxs)(`button`,{className:`nav-item${e===t?` active`:``}`,"data-page":t,onClick:()=>n(t),"aria-current":e===t?`page`:void 0,children:[(0,S.jsx)(i,{}),` `,l(r)]},t))}),(0,S.jsxs)(`div`,{className:`sidebar-foot`,children:[(0,S.jsxs)(`div`,{className:`lang-toggle`,children:[(0,S.jsx)(me,{"aria-hidden":!0}),(0,S.jsx)(Ae,{value:s,options:_e.map(e=>({value:e.code,label:e.name})),onChange:e=>c(e),label:l(`lang.label`),placement:`right`,style:{flex:1,minWidth:0,width:`100%`}})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle`,onClick:u,"aria-label":`${l(`theme.label`)}: ${l(Qt[r])}`,title:`${l(`theme.label`)}: ${l(Qt[r])}`,children:[(0,S.jsx)(d,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(Qt[r])})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle stop-toggle`,onClick:async()=>{if(confirm(l(`dash.stopConfirm`))){m(!0);try{await fetch(`${Jt}/api/stop`,{method:`POST`})}catch{}}},disabled:p,"aria-label":l(`dash.stop`),title:l(`dash.stop`),children:[(0,S.jsx)(I,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(p?`dash.stopping`:`dash.stop`)})]}),(0,S.jsxs)(`a`,{className:`sidebar-link`,href:`https://github.com/lidge-jun/opencodex`,target:`_blank`,rel:`noreferrer`,children:[(0,S.jsx)(F,{}),` `,l(`common.github`)]})]})]}),(0,S.jsx)(`main`,{className:`main`,children:(0,S.jsxs)(`div`,{className:`main-inner`,children:[e===`dashboard`&&(0,S.jsx)(He,{apiBase:Jt}),e===`providers`&&(0,S.jsx)(nt,{apiBase:Jt}),e===`models`&&(0,S.jsx)(ct,{apiBase:Jt}),e===`subagents`&&(0,S.jsx)(lt,{apiBase:Jt}),e===`logs`&&(0,S.jsx)(yt,{apiBase:Jt}),e===`debug`&&(0,S.jsx)(bt,{apiBase:Jt}),e===`usage`&&(0,S.jsx)(Dt,{apiBase:Jt}),e===`codex-auth`&&(0,S.jsx)(kt,{apiBase:Jt}),e===`api`&&(0,S.jsx)(Pt,{apiBase:Jt})]})})]})}v.createRoot(document.getElementById(`root`)).render((0,S.jsx)(_.StrictMode,{children:(0,S.jsx)(Se,{children:(0,S.jsx)(tn,{})})}));

package/gui/dist/index.html

@@ -16,7 +16,7 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-66dPs6l_.js"></script>
+    <script type="module" crossorigin src="/assets/index-mEjIne-M.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-D7o1qwy-.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.4",
+  "version": "2.7.6",
   "description": "Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/anthropic.ts

@@ -487,9 +487,37 @@ function toolsToAnthropicFormat(parsed: OcxParsedRequest, toolNames: { toWire: (
   return converted;
 }
 
+// Codex multi-agent v2 stamps a Responses-only `encrypted: true` marker on
+// collaboration tool schemas (openai/codex 5f4d06ef; issue #85). It is an
+// annotation for the ChatGPT backend only. Anthropic input_schema is strict
+// JSON Schema; strip the marker defensively everywhere it can appear as a
+// schema keyword, while preserving properties literally named "encrypted".
+const ENCRYPTED_MARKER_NAME_BAG_KEYS = new Set(["properties", "patternProperties", "$defs", "definitions"]);
+const ENCRYPTED_MARKER_LITERAL_VALUE_KEYS = new Set(["const", "default", "enum", "examples"]);
+
+function stripEncryptedMarker(node: unknown, inNameBag = false): unknown {
+  if (Array.isArray(node)) return node.map(item => stripEncryptedMarker(item));
+  if (!node || typeof node !== "object") return node;
+
+  const out: Record<string, unknown> = {};
+
+  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
+    if (inNameBag) {
+      out[key] = stripEncryptedMarker(value);
+    } else if (key !== "encrypted") {
+      out[key] = ENCRYPTED_MARKER_LITERAL_VALUE_KEYS.has(key)
+        ? value
+        : stripEncryptedMarker(value, ENCRYPTED_MARKER_NAME_BAG_KEYS.has(key));
+    }
+  }
+
+  return out;
+}
+
 function normalizeAnthropicInputSchema(schema: unknown): Record<string, unknown> {
-  const obj = schema && typeof schema === "object" && !Array.isArray(schema)
-    ? schema as Record<string, unknown>
+  const stripped = stripEncryptedMarker(schema);
+  const obj = stripped && typeof stripped === "object" && !Array.isArray(stripped)
+    ? stripped as Record<string, unknown>
     : {};
   // Anthropic rejects root-level missing type and oneOf/anyOf/allOf in input_schema.
   // Normalize the root only: ensure type:"object" + properties, flatten root composition

package/src/adapters/base.ts

@@ -9,6 +9,12 @@ export interface IncomingMeta {
 export interface ProviderAdapter {
   name: string;
 
+  /**
+   * Convert an already-read provider HTTP error into client-safe text. This hook must be pure and
+   * return fully redacted output: callers may pass untrusted provider headers and payload text.
+   */
+  formatErrorBody?(status: number, headers: Headers, payloadText: string): string;
+
   /**
    * Build the upstream request. May be async: adapters that resolve a short-lived credential
    * (e.g. Vertex AI ADC token) return a Promise. Sync adapters return the object directly; callers
@@ -39,6 +45,10 @@ export interface AdapterRequest {
 }
 
 export interface AdapterFetchContext {
+  /** Remains attached to the returned response body after the response headers arrive. */
   abortSignal?: AbortSignal;
+  /** Deadline for receiving response headers on each attempt, not for consuming the response body. */
   timeoutMs?: number;
+  /** Return final non-2xx responses untouched so the caller can own the error-body read. */
+  returnRawErrors?: boolean;
 }

package/src/adapters/google-http.ts

@@ -1,5 +1,7 @@
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { isQuotaExhaustedBody, retryableGoogleStatus, safeGoogleHttpErrorMessage } from "./google-errors";
+import { clearableDeadline } from "../lib/abort";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 import { abortError, sleepWithAbort } from "../lib/upstream-retry";
 
 const GOOGLE_RETRY_ATTEMPTS = 3;
@@ -23,14 +25,28 @@ function retryDelayMs(attempt: number, headers?: Headers): number {
   return Math.floor(exp * (0.8 + Math.random() * 0.4));
 }
 
-function signalWithAttemptTimeout(parent: AbortSignal | undefined, timeoutMs: number): AbortSignal {
-  const timeout = AbortSignal.timeout(timeoutMs);
-  return parent ? AbortSignal.any([parent, timeout]) : timeout;
+function cancelResponseBodyBestEffort(res: Response): void {
+  try {
+    const cancellation = res.body?.cancel();
+    if (cancellation) void cancellation.catch(() => {});
+  } catch {
+    // Cancellation is cleanup only; retries must not wait for or fail because of it.
+  }
 }
 
-async function normalizeFinalGoogleError(label: string, res: Response): Promise<Response> {
+async function boundedBodyText(res: Response, signal?: AbortSignal): Promise<string> {
+  try {
+    const body = await readBoundedResponseBody(res, { signal });
+    return body.displaySafe ? body.text : "";
+  } catch (error) {
+    if (signal?.aborted) throw error;
+    return "";
+  }
+}
+
+async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
   if (res.ok) return res;
-  const payloadText = await res.clone().text().catch(() => "");
+  const payloadText = await boundedBodyText(res, signal);
   const headers = new Headers(res.headers);
   headers.delete("content-encoding");
   headers.delete("content-length");
@@ -51,17 +67,25 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
   for (let attempt = 0; attempt < GOOGLE_RETRY_ATTEMPTS; attempt++) {
     if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
     try {
-      const res = await fetch(request.url, {
-        method: request.method, headers: request.headers, body: request.body,
-        signal: signalWithAttemptTimeout(ctx.abortSignal, timeoutMs),
-      });
+      const attemptTimeout = clearableDeadline(timeoutMs, ctx.abortSignal);
+      let res: Response;
+      try {
+        res = await fetch(request.url, {
+          method: request.method, headers: request.headers, body: request.body,
+          signal: attemptTimeout.signal,
+        });
+      } finally {
+        // Only the header timer is cleared. The composed signal still contains the parent, so a
+        // caller abort after headers continue to cancel consumption of the returned response body.
+        attemptTimeout.clear();
+      }
       if (!retryableGoogleStatus(res.status) || attempt === GOOGLE_RETRY_ATTEMPTS - 1) {
-        return normalizeFinalGoogleError(label, res);
+        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
       }
       // A 429 may be a transient rate limit (retry) or hard quota exhaustion (do NOT retry —
       // it won't recover for hours and burns retries). Peek the body to tell them apart.
-      if (res.status === 429) {
-        const peek = await res.clone().text().catch(() => "");
+      if (res.status === 429 && !ctx.returnRawErrors) {
+        const peek = await boundedBodyText(res, ctx.abortSignal);
         if (isQuotaExhaustedBody(peek)) {
           const headers = new Headers(res.headers);
           headers.delete("content-encoding");
@@ -71,7 +95,7 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
           });
         }
       }
-      await res.body?.cancel().catch(() => {});
+      cancelResponseBodyBestEffort(res);
       await sleepWithAbort(retryDelayMs(attempt, res.headers), ctx.abortSignal);
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;

package/src/adapters/google-tool-schema.ts

@@ -4,11 +4,16 @@ type Schema = Record<string, unknown>;
 // emits full JSON-Schema (draft 2020-12) tool definitions, so passing them through verbatim makes
 // CCA reject the whole request with "Request contains an invalid argument" / "Unknown name ...".
 // Every keyword below was confirmed live against the Antigravity backend to trigger a 400.
+// `encrypted` is Codex's Responses-only marker (openai/codex 5f4d06ef, PR #26210) stamped on v2
+// collaboration tool schemas (spawn_agent/send_message/followup_task `message`); CCA rejects it
+// with 400 "Unknown name \"encrypted\"" (issue #85). It is an annotation for the ChatGPT backend
+// only, so dropping it never changes tool behavior.
 const DROPPED_SCHEMA_KEYS = new Set([
   "$schema", "$id", "$comment", "$ref", "$defs", "definitions",
   "examples", "patternProperties", "if", "then", "else",
   "uniqueItems", "additionalItems", "unevaluatedProperties", "unevaluatedItems",
   "dependentRequired", "dependentSchemas", "propertyNames", "contains",
+  "encrypted",
 ]);
 
 const MAX_DEREF_DEPTH = 64;

package/src/adapters/google.ts

@@ -15,6 +15,7 @@ import { isAllowedToolChoice, namespacedToolName, toolAllowedByChoice } from "..
 import { contentPartsToText, parseDataUrl } from "./image";
 import { getVertexAccessToken } from "../lib/gcp-adc";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
+import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
 import { isVertexTruncationReason, vertexTruncationErrorMessage } from "./google-truncation";
 import { ANTIGRAVITY_REQUEST_UA, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
 import { sanitizeGeminiToolParameters } from "./google-tool-schema";
@@ -206,6 +207,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       ? {
           fetchResponse: (request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response> =>
             (provider.googleMode === "cloud-code-assist" ? fetchAntigravityWithRetry : fetchVertexWithRetry)(request, ctx),
+          formatErrorBody: (status: number, _headers: Headers, payloadText: string): string =>
+            (provider.googleMode === "cloud-code-assist" ? safeAntigravityHttpErrorMessage : safeVertexHttpErrorMessage)(status, payloadText),
         }
       : {}),
 

package/src/adapters/kiro-retry.ts

@@ -1,5 +1,7 @@
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { safeKiroHttpErrorMessage } from "./kiro-errors";
+import { clearableDeadline } from "../lib/abort";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 import { abortError, isConnectionResetError, sleepWithAbort } from "../lib/upstream-retry";
 
 const KIRO_RETRY_ATTEMPTS = 3;
@@ -27,18 +29,28 @@ function retryDelayMs(attempt: number, headers?: Headers): number {
   return Math.floor(exp * (0.8 + Math.random() * 0.4));
 }
 
-function signalWithAttemptTimeout(parent: AbortSignal | undefined, timeoutMs: number): AbortSignal {
-  const timeout = AbortSignal.timeout(timeoutMs);
-  return parent ? AbortSignal.any([parent, timeout]) : timeout;
+function cancelResponseBodyBestEffort(res: Response): void {
+  try {
+    const cancellation = res.body?.cancel();
+    if (cancellation) void cancellation.catch(() => {});
+  } catch {
+    // Cancellation is cleanup only; retries must not wait for or fail because of it.
+  }
 }
 
 function retryableKiroFetchError(err: unknown): boolean {
   return isConnectionResetError(err) || (err instanceof Error && err.name === "TimeoutError");
 }
 
-async function normalizeFinalKiroHttpError(res: Response): Promise<Response> {
+async function normalizeFinalKiroHttpError(res: Response, signal?: AbortSignal): Promise<Response> {
   if (res.ok) return res;
-  const payloadText = await res.clone().text().catch(() => "");
+  let payloadText = "";
+  try {
+    const body = await readBoundedResponseBody(res, { signal });
+    if (body.displaySafe) payloadText = body.text;
+  } catch (error) {
+    if (signal?.aborted) throw error;
+  }
   const headers = new Headers(res.headers);
   headers.delete("content-encoding");
   headers.delete("content-length");
@@ -55,14 +67,22 @@ export async function fetchKiroWithRetry(request: AdapterRequest, ctx: AdapterFe
   for (let attempt = 0; attempt < KIRO_RETRY_ATTEMPTS; attempt++) {
     if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
     try {
-      const res = await fetch(request.url, {
-        method: request.method,
-        headers: request.headers,
-        body: request.body,
-        signal: signalWithAttemptTimeout(ctx.abortSignal, timeoutMs),
-      });
-      if (!retryableKiroStatus(res.status) || attempt === KIRO_RETRY_ATTEMPTS - 1) return normalizeFinalKiroHttpError(res);
-      await res.body?.cancel().catch(() => {});
+      const attemptTimeout = clearableDeadline(timeoutMs, ctx.abortSignal);
+      let res: Response;
+      try {
+        res = await fetch(request.url, {
+          method: request.method,
+          headers: request.headers,
+          body: request.body,
+          signal: attemptTimeout.signal,
+        });
+      } finally {
+        attemptTimeout.clear();
+      }
+      if (!retryableKiroStatus(res.status) || attempt === KIRO_RETRY_ATTEMPTS - 1) {
+        return ctx.returnRawErrors ? res : normalizeFinalKiroHttpError(res, ctx.abortSignal);
+      }
+      cancelResponseBodyBestEffort(res);
       await sleepWithAbort(retryDelayMs(attempt, res.headers), ctx.abortSignal);
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;

package/src/adapters/kiro-tools.ts

@@ -41,6 +41,10 @@ const KIRO_REJECTED_SCHEMA_KEYS = new Set([
   "contains",
   "unevaluatedProperties",
   "unevaluatedItems",
+  // Codex's Responses-only `encrypted: true` marker (openai/codex 5f4d06ef) stamped on v2
+  // collaboration tool schemas. Kiro/Bedrock validators reject a narrower, undocumented schema
+  // subset (issue #85 class); the marker is a ChatGPT-backend annotation with no meaning here.
+  "encrypted",
 ]);
 
 // Keys whose values are maps of *property/definition name -> schema* (not schema keywords). Their

package/src/adapters/kiro.ts

@@ -5,7 +5,7 @@ import { resolveKiroApiRegion, resolveKiroProfileArn } from "../oauth/kiro";
 import { KIRO_MODEL_CONTEXT_WINDOWS, normalizeKiroModelId } from "../providers/kiro-models";
 import { modelRecordValue } from "../reasoning-effort";
 import { parseKiroEvent } from "./kiro-events";
-import { safeKiroErrorMessage } from "./kiro-errors";
+import { safeKiroErrorMessage, safeKiroHttpErrorMessage } from "./kiro-errors";
 import { appendFallbackText, toolCallFallbackText, toolResultFallbackText } from "./kiro-tool-fallback";
 import { KiroThinkingParser } from "./kiro-thinking";
 import { isCompleteKiroToolInput, kiroTruncationErrorMessage } from "./kiro-truncation";
@@ -552,6 +552,10 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       return fetchKiroWithRetry(request, ctx);
     },
 
+    formatErrorBody(status: number, headers: Headers, payloadText: string): string {
+      return safeKiroHttpErrorMessage(status, headers, payloadText);
+    },
+
     // Non-streaming path used by the web-search sidecar loop (loop.ts runs each iteration
     // non-streamed so it can inspect tool calls). CW only ever event-streams, so we drain the
     // same decoder into an array. Without this, any Codex request that includes the web_search

package/src/codex/catalog.ts

@@ -303,6 +303,20 @@ type RawEntry = Record<string, unknown>;
 type RawCatalog = { models?: RawEntry[]; [k: string]: unknown };
 const JAWCODE_CATALOG_AUGMENT_PROVIDERS = new Set(["opencode-go"]);
 
+/**
+ * Exact provider/model pairs whose discovery endpoint advertises them but whose inference backend
+ * rejects them. Apply this after live/static/metadata sources converge so no source can resurrect
+ * an uncallable picker row. Remove an entry once authenticated inference proves it usable again.
+ */
+const ROUTED_MODEL_COMPATIBILITY_EXCLUSIONS = new Set([
+  // Issue #82: Zen Go /models advertises HY3, but Console Go rejects it as outside the lite list.
+  "opencode-go/hy3-preview",
+]);
+
+function isRoutedModelCompatibilityExcluded(slug: string): boolean {
+  return ROUTED_MODEL_COMPATIBILITY_EXCLUSIONS.has(slug);
+}
+
 /**
  * Image/video GENERATION model families. opencodex routes chat/coding models into Codex; media-
  * generation models (Grok image/video, DALL·E, Imagen, Sora, Veo, …) are useless to a coding agent
@@ -328,6 +342,7 @@ export function isMediaGenerationModelId(id: string): boolean {
 }
 
 function shouldExposeRoutedModel(model: CatalogModel): boolean {
+  if (isRoutedModelCompatibilityExcluded(`${model.provider}/${model.id}`)) return false;
   if (model.provider === "cursor" && model.id === "gemini-3-pro-image-preview") return true;
   return !isMediaGenerationModelId(model.id);
 }
@@ -1027,6 +1042,27 @@ function applyConfigHintsToCachedModels(name: string, prov: OcxProviderConfig, m
   return models.map(model => applyProviderConfigHints(name, prov, model, contextCap));
 }
 
+/**
+ * TRUE when `liveId` is a dated release of the configured alias `configuredId`:
+ * `<configuredId>-YYYYMMDD` (Anthropic's convention for superseded-but-callable models).
+ */
+export function isDatedVariantId(liveId: string, configuredId: string): boolean {
+  if (!liveId.startsWith(`${configuredId}-`)) return false;
+  return /^\d{8}$/.test(liveId.slice(configuredId.length + 1));
+}
+
+// Same-signature dedupe: Codex polls /v1/models frequently, and an unchanged drop list
+// repeated on every poll is pure noise. Warn once per provider until the id set changes.
+const lastDropWarnSignature = new Map<string, string>();
+function warnDroppedConfiguredIdsOnce(name: string, droppedConfiguredIds: string[]): void {
+  const signature = [...droppedConfiguredIds].sort().join(",");
+  if (lastDropWarnSignature.get(name) === signature) return;
+  lastDropWarnSignature.set(name, signature);
+  console.warn(
+    `[opencodex] Provider model discovery for "${name}" omitted configured model ids; dropping them from the authoritative live catalog: ${droppedConfiguredIds.join(", ")}.`,
+  );
+}
+
 function isGlm52ModelId(id: string): boolean {
   const normalized = id.toLowerCase();
   return normalized === "glm-5.2" || normalized === "glm-5.2[1m]";
@@ -1133,15 +1169,28 @@ async function fetchProviderModels(name: string, prov: OcxProviderConfig, ttlMs:
       ...catalogHintsFromModelsApiItem(name, m),
     }, contextCap));
     const liveIds = new Set(live.map(m => m.id));
-    const droppedConfiguredIds = configured.filter(m => !liveIds.has(m.id)).map(m => m.id);
+    // Dated-release aliases (Anthropic pattern): older models may appear in the live catalog
+    // ONLY under their dated id (claude-haiku-4-5-20251001) while the config names the
+    // API-valid alias (claude-haiku-4-5). Such aliases are real, callable models — keep them
+    // in the authoritative catalog (alias id, hints from the dated live entry) instead of
+    // dropping them and warning on every poll.
+    const droppedConfiguredIds: string[] = [];
+    for (const m of configured) {
+      if (liveIds.has(m.id)) continue;
+      const dated = live.find(l => isDatedVariantId(l.id, m.id));
+      if (dated) {
+        // Reapply config hints so alias-keyed overrides (modelContextWindows etc.) win.
+        live.push(applyProviderConfigHints(name, prov, { ...dated, id: m.id }, contextCap));
+      } else {
+        droppedConfiguredIds.push(m.id);
+      }
+    }
     if (live.length === 0) {
       console.warn(
         `[opencodex] Provider model discovery for "${name}" returned an authoritative empty catalog; ${droppedConfiguredIds.length > 0 ? `dropping configured model ids: ${droppedConfiguredIds.join(", ")}` : "no models will be exposed"}.`,
       );
     } else if (droppedConfiguredIds.length > 0) {
-      console.warn(
-        `[opencodex] Provider model discovery for "${name}" omitted configured model ids; dropping them from the authoritative live catalog: ${droppedConfiguredIds.join(", ")}.`,
-      );
+      warnDroppedConfiguredIdsOnce(name, droppedConfiguredIds);
     }
     setCached(name, live);
     return live;
@@ -1329,9 +1378,10 @@ export function mergeCatalogEntriesForSync(
   }
 
   let finalRoutedEntries = routedEntries;
-  if (routedEntries.length === 0 && catalogModels.some(m => typeof m.slug === "string" && (m.slug as string).includes("/"))) {
+  const preservingExistingRouted = routedEntries.length === 0
+    && catalogModels.some(m => typeof m.slug === "string" && (m.slug as string).includes("/"));
+  if (preservingExistingRouted) {
     finalRoutedEntries = catalogModels.filter(m => typeof m.slug === "string" && (m.slug as string).includes("/"));
-    console.warn(`[opencodex] catalog sync: routed model fetch returned empty; preserving ${finalRoutedEntries.length} existing routed entr${finalRoutedEntries.length === 1 ? "y" : "ies"} on disk.`);
   } else {
     const freshSlugs = new Set(routedEntries.flatMap(entry => typeof entry.slug === "string" ? [entry.slug] : []));
     const preservedForeignRouted = catalogModels.filter(m => {
@@ -1341,6 +1391,14 @@ export function mergeCatalogEntriesForSync(
     });
     finalRoutedEntries = [...routedEntries, ...preservedForeignRouted];
   }
+  // Reapply final catalog policy to rows preserved from disk. Those rows bypass
+  // gatherRoutedModels, so filtering only the freshly gathered list can resurrect an excluded id.
+  finalRoutedEntries = finalRoutedEntries.filter(entry =>
+    typeof entry.slug !== "string" || !isRoutedModelCompatibilityExcluded(entry.slug)
+  );
+  if (preservingExistingRouted) {
+    console.warn(`[opencodex] catalog sync: routed model fetch returned empty; preserving ${finalRoutedEntries.length} existing routed entr${finalRoutedEntries.length === 1 ? "y" : "ies"} on disk.`);
+  }
 
   const mergedEntries = [...native, ...finalRoutedEntries].map(m => {
     const normalized = normalizeServiceTiers(m);

package/src/lib/abort.ts

@@ -3,6 +3,46 @@ export interface LinkedAbortSignal {
   cleanup: () => void;
 }
 
+export interface ClearableDeadline {
+  /** Parent-linked signal passed to fetch; remains parent-linked after clear(). */
+  signal: AbortSignal;
+  /** Stable reason object used when this deadline wins the abort race. */
+  timeoutReason: DOMException;
+  /** True only when this deadline, rather than the parent, fired first. */
+  didExpire: () => boolean;
+  /** Clear only the timer. Never aborts the deadline controller or detaches the parent. */
+  clear: () => void;
+}
+
+/**
+ * Response-header deadline whose timer can be cleared without severing body-lifetime cancellation.
+ *
+ * `signalWithTimeout().cleanup()` intentionally removes its parent listener and is therefore suited
+ * to operations that are completely finished at cleanup. A fetch response body is different: once
+ * headers arrive the deadline ends, but the original parent/client signal must remain attached to
+ * the body. `AbortSignal.any()` supplies that direct lifetime link while `clear()` owns only the
+ * timer.
+ */
+export function clearableDeadline(timeoutMs: number, parent?: AbortSignal): ClearableDeadline {
+  const deadline = new AbortController();
+  const timeoutReason = new DOMException("Timeout elapsed", "TimeoutError");
+  let timer: ReturnType<typeof setTimeout> | undefined = setTimeout(() => {
+    timer = undefined;
+    if (!deadline.signal.aborted) deadline.abort(timeoutReason);
+  }, timeoutMs);
+  const signal = parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal;
+
+  return {
+    signal,
+    timeoutReason,
+    didExpire: () => signal.aborted && signal.reason === timeoutReason,
+    clear: () => {
+      if (timer !== undefined) clearTimeout(timer);
+      timer = undefined;
+    },
+  };
+}
+
 export function signalWithTimeout(timeoutMs: number, parent?: AbortSignal): LinkedAbortSignal {
   const controller = new AbortController();
   const timeout = setTimeout(() => {