npm - @bitkyc08/opencodex - Versions diffs - 2.7.43 → 2.8.2-preview.20260731 - Mend

@bitkyc08/opencodex 2.7.43 → 2.8.2-preview.20260731

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (82) hide show

package/bin/ocx.mjs +34 -8
package/gui/dist/assets/index-BHsKRFh9.css +1 -0
package/gui/dist/assets/index-GC0Vlu1Z.js +67 -0
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/src/adapters/anthropic.ts +42 -7
package/src/adapters/cursor/discovery.ts +4 -1
package/src/adapters/cursor/effort-map.ts +3 -0
package/src/adapters/kiro.ts +15 -1
package/src/adapters/openai-chat.ts +55 -4
package/src/claude/alias.ts +94 -14
package/src/claude/outbound.ts +6 -3
package/src/cli/catalog-prewarm.ts +24 -0
package/src/cli/claude-desktop.ts +2 -2
package/src/cli/claude.ts +32 -7
package/src/cli/doctor.ts +48 -1
package/src/cli/index.ts +5 -0
package/src/cli/init.ts +129 -102
package/src/cli/interactive-confirm.ts +5 -1
package/src/cli/star-prompt.ts +26 -4
package/src/cli/v2.ts +10 -1
package/src/codex/account-store.ts +2 -0
package/src/codex/catalog/bundled.ts +9 -2
package/src/codex/catalog/metadata.ts +6 -0
package/src/codex/catalog/parsing.ts +26 -1
package/src/codex/catalog/provider-fetch.ts +240 -82
package/src/codex/catalog/sync.ts +27 -5
package/src/codex/catalog.ts +3 -3
package/src/codex/features.ts +524 -5
package/src/codex/quota.ts +77 -2
package/src/codex/runtime.ts +10 -1
package/src/config.ts +8 -0
package/src/generated/jawcode-model-metadata.ts +12 -12
package/src/github/star-state.ts +191 -0
package/src/lib/bun-binary-validator.d.mts +3 -0
package/src/lib/bun-binary-validator.mjs +18 -0
package/src/lib/bun-runtime.ts +6 -20
package/src/lib/destination-policy.ts +21 -3
package/src/lib/provider-outbound.ts +8 -2
package/src/lib/shadow-call.ts +30 -0
package/src/lib/test-home-guard.ts +90 -0
package/src/lib/win-exec.ts +12 -2
package/src/lib/winsw.ts +6 -0
package/src/oauth/index.ts +29 -5
package/src/oauth/key-providers.ts +21 -2
package/src/oauth/kiro-credentials.ts +129 -9
package/src/oauth/kiro.ts +15 -3
package/src/oauth/login-cli.ts +1 -1
package/src/oauth/store.ts +2 -0
package/src/providers/derive.ts +2 -2
package/src/providers/free-directory.ts +4 -1
package/src/providers/model-discovery.ts +356 -0
package/src/providers/registry.ts +114 -0
package/src/router.ts +5 -3
package/src/server/auth-cors.ts +4 -2
package/src/server/index.ts +3 -3
package/src/server/live.ts +75 -25
package/src/server/management/agent-settings-routes.ts +82 -8
package/src/server/management/config-routes.ts +24 -7
package/src/server/management/context.ts +11 -1
package/src/server/management/model-routes.ts +61 -14
package/src/server/management/provider-routes.ts +44 -9
package/src/server/management/shared.ts +18 -5
package/src/server/management/sidebar-routes.ts +39 -0
package/src/server/management-api.ts +3 -1
package/src/server/proxy-liveness.ts +9 -2
package/src/server/responses/core.ts +31 -20
package/src/server/responses/upstream-error.ts +48 -0
package/src/server/startup-action-control.ts +30 -14
package/src/service.ts +395 -31
package/src/storage/policy-job.ts +26 -5
package/src/storage/restore-job.ts +16 -5
package/src/storage/worker-lifecycle.ts +81 -0
package/src/tray/windows.ts +86 -13
package/src/types.ts +16 -0
package/src/update/badge.ts +72 -0
package/src/update/job.ts +8 -4
package/src/usage/expected-prices.ts +6 -5
package/src/usage/log.ts +8 -0
package/src/web-search/loop.ts +57 -16
package/gui/dist/assets/index-Czw-jpTU.css +0 -1
package/gui/dist/assets/index-cmds12BG.js +0 -67

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-cmds12BG.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-Czw-jpTU.css">
+    <script type="module" crossorigin src="/assets/index-GC0Vlu1Z.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BHsKRFh9.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.43",
+  "version": "2.8.2-preview.20260731",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/anthropic.ts CHANGED Viewed

@@ -250,6 +250,40 @@ function usesNativeAnthropicEndpoint(provider: OcxProviderConfig): boolean {
   }
 }
+/** Normalize provider baseUrl paths ending in `/`, `/v1`, or `/v1/messages` to `{origin}/v1/messages`. */
+export function anthropicMessagesUrl(baseUrl: string): string {
+  try {
+    new URL(baseUrl);
+  } catch {
+    throw new Error(`anthropic provider has malformed baseUrl: ${baseUrl}`);
+  }
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  const root = trimmed.replace(/\/v1\/messages\/?$/i, "").replace(/\/v1\/?$/i, "").replace(/\/+$/, "");
+  return `${root}/v1/messages`;
+}
+function synthesizeToolUseId(): string {
+  return `toolu_${crypto.randomUUID().replace(/-/g, "").slice(0, 24)}`;
+}
+function toolUseArguments(input: unknown): string {
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (!trimmed) return "{}";
+    try {
+      JSON.parse(trimmed);
+      return trimmed;
+    } catch {
+      // A tool call's arguments must be a JSON object. Re-encoding an unparseable string as a
+      // JSON *string* is the double-encoding #765 reports: the caller then receives
+      // `"get weather"` where an object was required and the tool call is unusable either way.
+      // An empty object at least fails in the tool's own argument validation.
+      return "{}";
+    }
+  }
+  return JSON.stringify(input ?? {});
+}
 function anthropicKeyUsesBearer(provider: OcxProviderConfig): boolean {
   return provider.apiKeyTransport === "bearer";
 }
@@ -680,8 +714,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
         else if (typeof tc === "object" && "name" in tc) body.tool_choice = { type: "tool", name: toolNames.toWire(resolveToolChoiceWireName(parsed.context.tools, tc.name)) };
       }
-      const base = provider.baseUrl.replace(/\/v1\/?$/, "");
-      const url = `${base}/v1/messages`;
+      const url = anthropicMessagesUrl(provider.baseUrl);
       const unresolvedPlaceholder = url.match(/\{[^}]*\}/)?.[0];
       if (unresolvedPlaceholder) {
         throw new Error(`anthropic baseUrl contains unresolved ${unresolvedPlaceholder}`);
@@ -773,7 +806,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
                 if (!block) break;
                 currentBlockType = block.type;
                 if (block.type === "tool_use") {
-                  currentToolCallId = block.id ?? "";
+                  currentToolCallId = block.id ?? synthesizeToolUseId();
                   currentToolCallName = toolNames.fromWire(block.name ?? "");
                   yield { type: "tool_call_start", id: currentToolCallId, name: currentToolCallName };
                 }
@@ -799,7 +832,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
                   // Arrives once, just before the thinking block's content_block_stop; block-scoped
                   // so a stray signature on a non-thinking block can never be captured.
                   yield { type: "thinking_signature", signature: delta.signature };
-                } else if (delta.type === "input_json_delta" && typeof delta.partial_json === "string") {
+                } else if (delta.type === "input_json_delta" && typeof delta.partial_json === "string" && currentBlockType === "tool_use") {
                   yield { type: "tool_call_delta", arguments: delta.partial_json };
                 }
                 break;
@@ -831,12 +864,13 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
         }
       }
       if (!emittedDone) {
+        // Fail closed on transport EOF. Compatible providers may omit message_stop after message_delta.stop_reason.
         if (pendingStopReason !== undefined) {
           const stopReason = pendingStopReason === "max_tokens"
             ? "max_tokens"
             : pendingStopReason === "refusal" || pendingStopReason === "content_filter"
               ? "content_filter"
-              : undefined;
+              : pendingStopReason;
           emittedDone = true;
           yield {
             type: "done",
@@ -867,8 +901,9 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
           } else if (block.type === "redacted_thinking" && typeof block.data === "string") {
             events.push({ type: "redacted_thinking", data: block.data });
           } else if (block.type === "tool_use") {
-            events.push({ type: "tool_call_start", id: block.id ?? "", name: toolNames.fromWire(block.name ?? "") });
-            events.push({ type: "tool_call_delta", arguments: JSON.stringify(block.input ?? {}) });
+            const id = block.id ?? synthesizeToolUseId();
+            events.push({ type: "tool_call_start", id, name: toolNames.fromWire(block.name ?? "") });
+            events.push({ type: "tool_call_delta", arguments: toolUseArguments(block.input) });
             events.push({ type: "tool_call_end" });
           }
         }

package/src/adapters/cursor/discovery.ts CHANGED Viewed

@@ -167,7 +167,7 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   // the request builder appends the per-model suffix (see effort-map.ts) and reasoning models
   // advertise effort so Codex exposes the tier picker. `supportsReasoningEffort` tracks whether the
   // model has *selectable effort tiers* (CURSOR_MODEL_EFFORT_TIERS), NOT merely whether it reasons:
-  // gemini/grok/kimi/gpt-5-mini are reasoning models in the SOT but are sent bare (no tier picker).
+  // gemini/grok/kimi-k2.7/gpt-5-mini are reasoning models in the SOT but are sent bare (no tier picker).
   ...CURSOR_ROUTER_MODEL_IDS.map(id => ({ id, contextWindow: CONTEXT_200K, supportsReasoningEffort: false })),
   { id: "claude-sonnet-5", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
@@ -224,6 +224,9 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   // take PR #73's supportsReasoningEffort for glm-5.2 (its effort-map tiers landed with the PR).
   { id: "glm-5.2", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
   { id: "kimi-k2.7-code", contextWindow: CONTEXT_262K },
+  // kimi-k3: cursor.com/docs/models/kimi-k3; account-verified via GetUsableModels (2026-07-28) —
+  // ships only as effort-suffixed kimi-k3-{low,high,max}, so the tier picker is exposed.
+  { id: "kimi-k3", contextWindow: CONTEXT_262K, supportsReasoningEffort: true },
   { id: "grok-4.5", contextWindow: 500_000, supportsReasoningEffort: true },
   { id: "grok-4.5-fast", contextWindow: 500_000, supportsReasoningEffort: true },

package/src/adapters/cursor/effort-map.ts CHANGED Viewed

@@ -27,6 +27,9 @@ const CURSOR_MODEL_EFFORT_TIERS: Record<string, readonly string[]> = {
   "claude-opus-5": ["low", "medium", "high", "xhigh", "max"],
   "claude-sonnet-5": ["low", "medium", "high", "xhigh", "max"],
   "glm-5.2": ["high", "max"],
+  // GetUsableModels (2026-07-28) lists kimi-k3 only as effort-suffixed kimi-k3-{low,high,max};
+  // the bare id returns not_found. Tiers mirror the native Kimi provider's K3 ladder.
+  "kimi-k3": ["low", "high", "max"],
   // GetUsableModels (2026-07-09) lists grok-4.5-{medium,high,xhigh} and grok-4.5-fast-{medium,high,xhigh};
   // the bare "grok-4.5-fast" id was removed upstream and now returns not_found.
   "grok-4.5": ["medium", "high", "xhigh"],

package/src/adapters/kiro.ts CHANGED Viewed

@@ -498,7 +498,11 @@ export function buildKiroPayload(
       if (!priorCalls.has(toolUseId)) {
         throw new Error(`Kiro history contains an orphaned tool result for call ${JSON.stringify(tr.toolCallId)}`);
       }
-      pushUser(KIRO_TOOL_RESULT_CARRIER_MESSAGE, images, [{
+      // Carrier text is a placeholder for an OTHERWISE EMPTY tool-result turn, not a prefix.
+      // Passing it here would push proxy filler AHEAD of a human instruction that Claude Code
+      // sends in the same turn (mid-turn steering / queued_command, issue #543), burying the
+      // newest user intent behind boilerplate. Backfill below only when nothing else speaks.
+      pushUser("", images, [{
         content: [{ text: resultText }],
         status: tr.isError ? "error" : "success",
         toolUseId,
@@ -518,6 +522,16 @@ export function buildKiroPayload(
     });
   }
+  // Give tool-result turns a carrier sentence ONLY when they carry no other text. This runs
+  // before the pop below so the current turn is covered too: skipping it there would ship an
+  // empty current content, which validateKiroConversationState accepts (tool results count as
+  // payload) and would therefore fail silently.
+  for (const turn of turns) {
+    if (turn.kind === "user" && !turn.content.trim() && turn.toolResults.length > 0) {
+      turn.content = KIRO_TOOL_RESULT_CARRIER_MESSAGE;
+    }
+  }
   const currentTurn = turns.pop();
   if (!currentTurn || currentTurn.kind !== "user") throw new Error("Kiro request must end with a user turn");
   const toEntry = (turn: KiroTurn): KiroHistoryEntry => turn.kind === "assistant"

package/src/adapters/openai-chat.ts CHANGED Viewed

@@ -206,10 +206,10 @@ function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderCon
           }));
           // "" instead of null: strict validators (xAI: "Each message must have at least one
           // content element", langchain#34140) reject content-less assistant history entries.
-          if (!chatMsg.content) chatMsg.content = "";
+          if (!chatMsg.content) chatMsg.content = emptyAssistantContent(provider);
         }
         if (chatMsg.reasoning_content !== undefined && chatMsg.content === undefined && chatMsg.tool_calls === undefined) {
-          chatMsg.content = "";
+          chatMsg.content = emptyAssistantContent(provider);
         }
         out.push(chatMsg);
         pendingToolCalls = wireToolCalls.map(({ tc, id }) => ({ id, name: namespacedToolName(tc.namespace, tc.name) }));
@@ -238,7 +238,7 @@ function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderCon
           const name = safeToolName(msg.toolName);
           out.push({
             role: "assistant",
-            content: "",
+            content: emptyAssistantContent(provider),
             tool_calls: [{
               id: toolCallId,
               type: "function",
@@ -372,6 +372,43 @@ function isKimiSchemaTarget(provider: OcxProviderConfig): boolean {
   }
 }
+// Volcengine Ark regional endpoints. Ark validates an assistant message's text field as a
+// REQUIRED parameter and treats "" as absent, so a tool-call-only assistant in history 400s with
+// `MissingParameter: input.content.text` (#796). Every other OpenAI-compatible provider accepts
+// "", and xAI actively requires it ("Each message must have at least one content element"), so
+// the two contracts are in direct conflict and this cannot be a global change.
+const VOLCENGINE_ARK_HOSTNAMES = new Set([
+  "ark.cn-beijing.volces.com",
+  "ark.ap-southeast.volces.com",
+]);
+function isVolcengineArkTarget(provider: OcxProviderConfig): boolean {
+  try {
+    return VOLCENGINE_ARK_HOSTNAMES.has(new URL(provider.baseUrl).hostname);
+  } catch {
+    return false;
+  }
+}
+/**
+ * Placeholder content for an assistant history entry carrying only tool calls or reasoning.
+ *
+ * UNVERIFIED HYPOTHESIS for Ark. The reported error names `input.content.text`, a nested path,
+ * which suggests Ark wants the structured content form `[{type:"text",text:""}]` rather than a
+ * bare string — no string value, `""` or `" "`, exposes a `content.text` path at all. But Ark's
+ * published examples only show array content for MULTIMODAL USER input, never for an assistant
+ * history entry, so this shape is inferred from the error message and not confirmed by the docs
+ * or by a live request. The empty inner text at least adds no tokens either way.
+ *
+ * Confirm against a real Ark endpoint before relying on this; #796 records what is still missing.
+ *
+ * Every other provider keeps the bare `""`, which xAI's validator specifically requires ("Each
+ * message must have at least one content element"), so this cannot be applied globally.
+ */
+function emptyAssistantContent(provider: OcxProviderConfig): string | { type: "text"; text: string }[] {
+  return isVolcengineArkTarget(provider) ? [{ type: "text", text: "" }] : "";
+}
 /**
  * Kimi requires function.parameters.type to be exactly "object" at the root.
  * Codex tools with oneOf/anyOf schemas omit the root type, causing 400 errors.
@@ -800,12 +837,26 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         if (buffer.length > 0) {
           if ((yield* handleDataLine(buffer)) === "terminate") return;
         }
-        yield* flushToolCalls();
         // Reader EOF. A graceful close shows at least one terminal signal: `[DONE]` (returns above),
         // a non-null finish_reason (sawFinish), or a trailing usage chunk (providers emit usage only
         // at end-of-generation). If NONE of those were seen, the stream was cut mid-flight — fail
         // closed so the bridge emits a classified response.failed rather than a silent truncation.
+        //
+        // Checked BEFORE flushToolCalls(), because that helper emits tool_call_end and there is no
+        // taking it back: a half-assembled argument string would reach the client as a completed
+        // call. Tool calls are buffered here (unlike the Anthropic adapter, which forwards
+        // fragments live), so this adapter can still decide.
         const sawFinish = finishReason !== undefined;
+        if (!sawFinish && pendingToolCalls.length > 0) {
+          debugProviderDiagnostic("openai-chat", "stream-truncated", {
+            finishReason: null,
+            hadUsage: pendingUsage !== undefined,
+            pendingToolCalls: pendingToolCalls.length,
+          });
+          yield { type: "error", message: "upstream stream ended mid tool call without a terminal signal — possible truncation" };
+          return;
+        }
+        yield* flushToolCalls();
         if (!sawFinish && pendingUsage === undefined) {
           debugProviderDiagnostic("openai-chat", "stream-truncated", {
             finishReason: finishReason ?? null,

package/src/claude/alias.ts CHANGED Viewed

@@ -7,9 +7,19 @@
  * deterministic, reversible, and STABLE across releases (picker selections
  * persist to Claude Code's settings.json `model` field).
  *
+ * Versioned prefixes:
+ *  - `claude-ocx-` (v1) — legacy / plain model ids with no `/` or `~`. Decode
+ *    is literal (no escape expansion), so a persisted model id that literally
+ *    contained the two-char sequences `~s` / `~t` keeps resolving.
+ *  - `claude-ocx2-` (v2) — used whenever the model id needs escape encoding
+ *    (`/` → `~s`, `~` → `~t`). Decode expands those escapes. New slash/tilde
+ *    models always mint v2 so they cannot collide with v1 literals.
+ *
  * Reversibility rules:
  *  - providers containing `--` or `/` are not aliased (split boundary safety);
- *  - model ids containing `/` are not aliased (would be ambiguous on resolve);
+ *  - model ids MAY contain `/` or `~` — minted under the v2 prefix with escapes
+ *    (e.g. openrouter `anthropic/claude-opus-4-8` →
+ *    `claude-ocx2-openrouter--anthropic~sclaude-opus-4-8`);
  *  - model ids MAY contain `--` (resolve splits on the FIRST `--` only);
  *  - native OpenAI slugs use the pseudo-provider `native` and resolve back to
  *    the bare slug; a real provider named "native" is therefore never aliased.
@@ -17,20 +27,82 @@
 import { desktop3pAlias } from "./desktop-3p";
-export const CLAUDE_ALIAS_PREFIX = "claude-ocx-";
+/** Legacy / plain readable prefix (literal model portion on decode). */
+export const CLAUDE_ALIAS_PREFIX_V1 = "claude-ocx-";
+/** Escape-encoded readable prefix (`~s`/`~t` expanded on decode). */
+export const CLAUDE_ALIAS_PREFIX_V2 = "claude-ocx2-";
+/**
+ * Current write prefix for plain (unescaped) model ids.
+ * Escape-needing models mint {@link CLAUDE_ALIAS_PREFIX_V2} instead.
+ */
+export const CLAUDE_ALIAS_PREFIX = CLAUDE_ALIAS_PREFIX_V1;
+/** Encoded `/` inside the model portion of a v2 Claude Code alias. */
+const CLAUDE_ALIAS_SLASH_ENC = "~s";
+/** Encoded literal `~` inside the model portion of a v2 Claude Code alias. */
+const CLAUDE_ALIAS_TILDE_ENC = "~t";
 const NATIVE_PSEUDO_PROVIDER = "native";
+function modelNeedsEscapeEncoding(modelId: string): boolean {
+  return modelId.includes("/") || modelId.includes("~");
+}
+function encodeModelId(modelId: string): string {
+  // Escape literal tildes first so slash encoding cannot create ambiguity.
+  return modelId
+    .replaceAll("~", CLAUDE_ALIAS_TILDE_ENC)
+    .replaceAll("/", CLAUDE_ALIAS_SLASH_ENC);
+}
+function decodeEscapedModelId(encoded: string): string {
+  let out = "";
+  for (let i = 0; i < encoded.length; i++) {
+    if (encoded[i] === "~" && i + 1 < encoded.length) {
+      const next = encoded[i + 1];
+      if (next === "s") {
+        out += "/";
+        i += 1;
+        continue;
+      }
+      if (next === "t") {
+        out += "~";
+        i += 1;
+        continue;
+      }
+    }
+    out += encoded[i];
+  }
+  return out;
+}
+function splitAlias(id: string, prefix: string): { provider: string; model: string } | null {
+  const rest = id.slice(prefix.length);
+  const sep = rest.indexOf("--");
+  if (sep <= 0) return null;
+  const provider = rest.slice(0, sep);
+  const model = rest.slice(sep + 2);
+  if (!provider || !model) return null;
+  return { provider, model };
+}
 /** Alias for a routed "<provider>/<model>" pair; null when not representable. */
 export function aliasForRoute(provider: string, modelId: string): string | null {
   if (!provider || provider.includes("--") || provider.includes("/") || provider === NATIVE_PSEUDO_PROVIDER) return null;
-  if (!modelId || modelId.includes("/")) return null;
-  return `${CLAUDE_ALIAS_PREFIX}${provider}--${modelId}`;
+  if (!modelId) return null;
+  if (modelNeedsEscapeEncoding(modelId)) {
+    return `${CLAUDE_ALIAS_PREFIX_V2}${provider}--${encodeModelId(modelId)}`;
+  }
+  return `${CLAUDE_ALIAS_PREFIX_V1}${provider}--${modelId}`;
 }
 /** Alias for a native OpenAI slug (bare model id, no provider namespace). */
 export function aliasForNative(slug: string): string | null {
+  // Reject "/" — native ids are bare slugs. Literal `~` is fine via v2 + ~t.
   if (!slug || slug.includes("/") || slug.includes("--")) return null;
-  return `${CLAUDE_ALIAS_PREFIX}${NATIVE_PSEUDO_PROVIDER}--${slug}`;
+  if (modelNeedsEscapeEncoding(slug)) {
+    return `${CLAUDE_ALIAS_PREFIX_V2}${NATIVE_PSEUDO_PROVIDER}--${encodeModelId(slug)}`;
+  }
+  return `${CLAUDE_ALIAS_PREFIX_V1}${NATIVE_PSEUDO_PROVIDER}--${slug}`;
 }
 /**
@@ -38,20 +110,28 @@ export function aliasForNative(slug: string): string | null {
  * routed -> "<provider>/<model>", native -> bare slug. Null when not an alias.
  */
 export function resolveAlias(id: string): string | null {
-  if (!id.startsWith(CLAUDE_ALIAS_PREFIX)) return null;
-  const rest = id.slice(CLAUDE_ALIAS_PREFIX.length);
-  const sep = rest.indexOf("--");
-  if (sep <= 0) return null;
-  const provider = rest.slice(0, sep);
-  const model = rest.slice(sep + 2);
-  if (!model) return null;
-  return provider === NATIVE_PSEUDO_PROVIDER ? model : `${provider}/${model}`;
+  // Check v2 before v1 for clarity (prefixes are disjoint: ocx2 vs ocx-).
+  if (id.startsWith(CLAUDE_ALIAS_PREFIX_V2)) {
+    const parts = splitAlias(id, CLAUDE_ALIAS_PREFIX_V2);
+    if (!parts) return null;
+    const model = decodeEscapedModelId(parts.model);
+    if (!model) return null;
+    return parts.provider === NATIVE_PSEUDO_PROVIDER ? model : `${parts.provider}/${model}`;
+  }
+  if (id.startsWith(CLAUDE_ALIAS_PREFIX_V1)) {
+    const parts = splitAlias(id, CLAUDE_ALIAS_PREFIX_V1);
+    if (!parts) return null;
+    // Literal decode — preserves pre-escape aliases whose model id contained
+    // the two-char sequences ~s / ~t.
+    return parts.provider === NATIVE_PSEUDO_PROVIDER ? parts.model : `${parts.provider}/${parts.model}`;
+  }
+  return null;
 }
 /**
  * Claude Code (CLI) surface alias — devlog 050 + audit 051 #2.
  *
- * The readable `claude-ocx-*` form when representable; otherwise the desktop-3p
+ * The readable `claude-ocx*` form when representable; otherwise the desktop-3p
  * hash so the model still appears in discovery (collisions follow the same
  * first-wins policy as the desktop registry — audit 051 #1). Real Anthropic
  * models pass through unchanged (they must keep hitting the sk-ant passthrough).

package/src/claude/outbound.ts CHANGED Viewed

@@ -453,12 +453,15 @@ export function responsesSseToAnthropicSse(
                 if (line.startsWith("event: ")) eventName = line.slice(7).trim();
                 else if (line.startsWith("data: ")) dataLine += line.slice(6);
               }
-              if (!eventName || !dataLine) continue;
+              if (!dataLine) continue;
               let data: unknown;
               try { data = JSON.parse(dataLine); } catch { continue; }
               if (!isRec(data)) continue;
-              if (terminated) continue;
-              handleFrame(eventName, data);
+              // Responses-compatible gateways may omit the optional SSE event field
+              // while retaining the event name in the JSON payload's required type.
+              const resolvedEventName = eventName || (typeof data.type === "string" ? data.type : "");
+              if (!resolvedEventName || terminated) continue;
+              handleFrame(resolvedEventName, data);
             }
           }
           // EOF without a terminal frame is a TRUNCATION, not success (devlog 100:

package/src/cli/catalog-prewarm.ts ADDED Viewed

@@ -0,0 +1,24 @@
+import type { OcxConfig } from "../types";
+type GatherRoutedModels = (config: OcxConfig) => Promise<unknown>;
+export type CatalogPrewarmDeps = {
+  loadConfig?: () => OcxConfig;
+  importCatalog?: () => Promise<{ gatherRoutedModels: GatherRoutedModels }>;
+};
+/**
+ * After the listen port is bound, kick off live provider discovery so the first
+ * GUI /v1/models and syncModelsToCodex share one gather flight instead of racing
+ * duplicate upstream /models fetches.
+ */
+export function scheduleCatalogPrewarm(deps: CatalogPrewarmDeps = {}): void {
+  void Promise.resolve()
+    .then(async () => {
+      const load = deps.loadConfig ?? (await import("../config")).loadConfig;
+      const { gatherRoutedModels } = await (deps.importCatalog?.() ?? import("../codex/catalog"));
+      return gatherRoutedModels(load());
+    })
+    .catch(() => {});
+}

package/src/cli/claude-desktop.ts CHANGED Viewed

@@ -10,7 +10,7 @@ import {
   type DesktopProfile,
 } from "../claude/desktop-profile";
 import { writeDesktop3pConfig, type Desktop3pConfigMode, parseDesktop3pModeArgs } from "../claude/desktop-3p";
-import { filterCatalogVisibleModels, visibleNativeSlugs } from "../codex/catalog";
+import { filterCatalogVisibleModels, desktopVisibleNativeSlugs } from "../codex/catalog";
 import { buildClaudeDesktopState, fetchAllModels } from "../server/management-api";
 import { findLiveProxy } from "../server/proxy-liveness";
@@ -42,7 +42,7 @@ async function applyProfile(profile: DesktopProfile, mode: Desktop3pConfigMode):
   }));
   const result = writeDesktop3pConfig(
     live?.port ?? config.port ?? 10100,
-    [...visibleNativeSlugs(config)],
+    [...desktopVisibleNativeSlugs(config)],
     routed,
     config.apiKeys?.[0]?.key,
     mode,

package/src/cli/claude.ts CHANGED Viewed

@@ -48,6 +48,27 @@ export function buildClaudeEnv(
   // leaving the child with no token at all (audit R2-1). It is opencodex state, never
   // user auth, so dropping it unconditionally is safe.
   if (env.ANTHROPIC_AUTH_TOKEN === PROXY_MARKER) delete env.ANTHROPIC_AUTH_TOKEN;
+  // Step 1b — drop Anthropic credentials that the bundled Bun runtime synthesized from a
+  // project `.env`/`.env.local` (issue #701). Claude Code disables claude.ai connectors the
+  // moment either token slot is populated, so an ambient project file silently moved a
+  // subscriber onto API billing while their OAuth login stayed healthy. The npm launcher
+  // runs under Node, which does NOT auto-load dotenv, so it records the slots that existed
+  // before Bun started; anything populated now but absent then came from the working
+  // directory, not from the user. A genuine shell export is still honored, which keeps
+  // auto-mode API-key auth working. An ABSENT marker means provenance is unknowable
+  // (a direct `bun src/cli/index.ts` run, a test, or an older launcher), and then we
+  // change nothing rather than guess — an EMPTY marker is different: the launcher ran
+  // and saw no pre-existing slots.
+  const preBunSlots = base.OCX_PRE_BUN_ANTHROPIC_ENV;
+  if (preBunSlots !== undefined) {
+    const exported = new Set(preBunSlots.split(",").filter(name => name.length > 0));
+    for (const name of ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"] as const) {
+      const value = env[name];
+      if (value !== undefined && value !== "" && !exported.has(name)) delete env[name];
+    }
+  }
+  // Never forward the seam itself to Claude Code.
+  delete env.OCX_PRE_BUN_ANTHROPIC_ENV;
   const setDefault = (name: string, value: string | undefined) => {
     if (value === undefined || value.length === 0) return;
     if (env[name] !== undefined && env[name] !== "") return; // user wins
@@ -76,15 +97,19 @@ export function buildClaudeEnv(
   if ((config.apiKeys?.length ?? 0) > 0) {
     setDefault("ANTHROPIC_AUTH_TOKEN", config.apiKeys![0].key);
   }
-  // Detection reads the SAME base env this launch will use, so the resolver and the
-  // spawned process cannot disagree. Injected deps are spread FIRST and `env` bound
-  // LAST, and the injection type excludes `env`, so a test fake cannot break that.
-  // `ownTokens` is bound last for the same reason: it is config-derived, and a fake
-  // that replaced it could make our own admission key look like user auth.
+  // Detection reads the SANITIZED launch env — the exact object spawned below — so the
+  // resolver and the spawned process cannot disagree. It deliberately does NOT read the
+  // raw base: the provenance strip above already removed dotenv-only credentials, and
+  // letting a value the child never receives decide the marker left an auto-mode user
+  // with neither the credential NOR the proxy marker (#701 audit round 2). Injected deps
+  // are spread FIRST and `env` bound LAST, and the injection type excludes `env`, so a
+  // test fake cannot break that. `ownTokens` is bound last for the same reason: it is
+  // config-derived, and a fake that replaced it could make our own admission key look
+  // like user auth.
   const resolved = resolveClaudeAuthMode(config, detectClaudeAuth({
-    ...defaultAuthDetectDeps(base as NodeJS.ProcessEnv),
+    ...defaultAuthDetectDeps(env as NodeJS.ProcessEnv),
     ...(deps.authDetect ?? {}),
-    env: () => base as NodeJS.ProcessEnv,
+    env: () => env as NodeJS.ProcessEnv,
     ownTokens: ownAdmissionTokens(config),
   }));
   if (!env.ANTHROPIC_AUTH_TOKEN && resolved.markerMode === "proxy") {

package/src/cli/doctor.ts CHANGED Viewed

@@ -307,13 +307,47 @@ export type ConfiguredProxyDiagnostic = {
   detail: string;
 };
-function envReferenceName(value: string): string | null {
+export function envReferenceName(value: string): string | null {
   const braced = value.match(/^\$\{(\w+)\}$/);
   if (braced) return braced[1]!;
   const bare = value.match(/^\$(\w+)$/);
   return bare ? bare[1]! : null;
 }
+export type ProviderApiKeyDiagnostic = {
+  provider: string;
+  envName: string;
+  detail: string;
+};
+/** Warn when a key-auth provider's apiKey env reference resolves empty in this process. */
+export function collectProviderApiKeyDiagnostics(
+  providers: Record<string, { authMode?: string; apiKey?: string }> = readConfigDiagnostics().config.providers ?? {},
+  env: EnvMap = process.env,
+): ProviderApiKeyDiagnostic[] {
+  const resolveInEnv = (value: string): string | undefined => {
+    const name = envReferenceName(value);
+    if (!name) return value;
+    return env[name];
+  };
+  const rows: ProviderApiKeyDiagnostic[] = [];
+  for (const [provider, config] of Object.entries(providers)) {
+    if (config.authMode !== "key") continue;
+    const raw = typeof config.apiKey === "string" ? config.apiKey.trim() : "";
+    if (!raw) continue;
+    const envName = envReferenceName(raw);
+    if (!envName) continue;
+    const resolved = resolveInEnv(raw);
+    if (resolved?.trim()) continue;
+    rows.push({
+      provider,
+      envName,
+      detail: `provider ${provider}: env reference ${envName} is unset or empty in this process`,
+    });
+  }
+  return rows;
+}
 export function collectConfiguredProxy(): ConfiguredProxyDiagnostic {
   const diagnostics = readConfigDiagnostics();
   const rawProxy = typeof diagnostics.config.proxy === "string" ? diagnostics.config.proxy.trim() : "";
@@ -742,6 +776,16 @@ export async function runDoctor(args: string[] = []): Promise<void> {
   console.log("\nConfigured proxy (value hidden)");
   console.log(`  ${configuredProxy.present ? "set    " : "unset  "} ${configuredProxy.key} (${configuredProxy.source}; ${configuredProxy.detail})`);
+  const providerApiKeys = collectProviderApiKeyDiagnostics(doctorConfig.providers);
+  console.log("\nProvider API keys (value hidden)");
+  if (providerApiKeys.length === 0) {
+    console.log("  ok     no empty env-referenced provider keys detected in this process");
+  } else {
+    for (const row of providerApiKeys) {
+      console.log(`  !!     ${row.detail}`);
+    }
+  }
   console.log("\nRunning proxy process proxy env (presence only)");
   if (runningProxyEnv.status === "not_running") {
     console.log("  --     no running ocx proxy process found");
@@ -825,6 +869,9 @@ export async function runDoctor(args: string[] = []): Promise<void> {
     serviceViable: startup.serviceViable,
   });
   if (proxyDown) hints.push(proxyDown);
+  for (const row of providerApiKeys) {
+    hints.push(`${row.detail}. Set ${row.envName} in the shell that starts the proxy, or store a literal key in config (value hidden here).`);
+  }
   const anyDrvfs = paths.some(p => detectFsType(p.path, mounts).isDrvfs || detectFsType(p.path, mounts).isMntDrive);
   const noProxy = currentProxyEnv.every(p => !p.present) && !configuredProxy.present;
   if (!startup.rebootSafe) {

package/src/cli/index.ts CHANGED Viewed

@@ -38,6 +38,7 @@ import { startTokenGuardian } from "../oauth/token-guardian";
 import { startHistoryMigrationGuardian } from "../codex/history-migration-guardian";
 import { maybeAutoRestoreCodexShim } from "./codex-shim-autorestore";
 import { maybeShowStarPrompt } from "./star-prompt";
+import { scheduleCatalogPrewarm } from "./catalog-prewarm";
 import { maybeShowUpdatePrompt } from "../update/notify";
 import { syncModelsToCodex } from "../codex/sync";
 import { normalizeUpdateChannel, runGuiUpdateWorker } from "../update/job";
@@ -190,6 +191,10 @@ async function handleStart(options: { block?: boolean } = {}) {
   for (let attempt = 0; ; attempt++) {
     try {
       server = startServer(port);
+      // Prewarm the live provider model cache as soon as the port is bound so the
+      // first GUI /v1/models (and syncModelsToCodex below) share one discovery flight
+      // instead of racing duplicate upstream /models fetches.
+      scheduleCatalogPrewarm();
       break;
     } catch (err) {
       if (!isAddrInUse(err) || attempt >= 2) throw err;