@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/adapters/zed.ts

@@ -0,0 +1,377 @@
+import { randomUUID } from "node:crypto";
+import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "./base";
+import { createAnthropicAdapter } from "./anthropic";
+import { createGoogleAdapter } from "./google";
+import { createOpenAIChatAdapter } from "./openai-chat";
+import { createResponsesPassthroughAdapter } from "./openai-responses";
+import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../types";
+import { createTranslatorBudget, type TranslatorBudget } from "../lib/translator-budget";
+import { redactSecretString } from "../lib/redact";
+import {
+  normalizeZedProvider,
+  resolveZedModels,
+  scrubZedCredentials,
+  zedLlmFetch,
+  ZED_HEADERS,
+  type ZedCredentials,
+} from "../providers/zed";
+
+export type ZedProvider = "anthropic" | "open_ai" | "google" | "x_ai";
+
+interface ZedDelegate {
+  provider: ZedProvider;
+  adapter: ProviderAdapter;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function zedCredentials(provider: OcxProviderConfig, parsed: OcxParsedRequest): ZedCredentials {
+  const accessToken = provider.apiKey?.trim();
+  const userId = parsed._zedAuthContext?.userId?.trim();
+  if (!accessToken) throw new Error("Zed access token missing — run ocx login zed");
+  if (!userId) throw new Error("Zed account identity missing — run ocx login zed again");
+  return { userId, accessToken };
+}
+
+function delegateProvider(provider: OcxProviderConfig, zedProvider: ZedProvider): OcxProviderConfig {
+  const common: OcxProviderConfig = {
+    ...provider,
+    authMode: "key",
+    apiKey: "zed-delegate-placeholder",
+    models: undefined,
+    liveModels: false,
+  };
+  if (zedProvider === "anthropic") {
+    return { ...common, adapter: "anthropic", baseUrl: "https://api.anthropic.com" };
+  }
+  if (zedProvider === "google") {
+    return { ...common, adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", googleMode: "ai-studio" };
+  }
+  if (zedProvider === "open_ai") {
+    return { ...common, adapter: "openai-responses", baseUrl: "https://api.openai.com/v1" };
+  }
+  return { ...common, adapter: "openai-chat", baseUrl: "https://api.x.ai/v1" };
+}
+
+function forceStreaming(parsed: OcxParsedRequest): OcxParsedRequest {
+  const rawBody = isRecord(parsed._rawBody) ? { ...parsed._rawBody, stream: true } : parsed._rawBody;
+  return { ...parsed, stream: true, _rawBody: rawBody };
+}
+
+function providerFromCatalog(catalog: Awaited<ReturnType<typeof resolveZedModels>> | undefined, model: string): ZedProvider {
+  const raw = catalog?.rawById.get(model);
+  return normalizeZedProvider(raw?.provider, model);
+}
+
+function nativeErrorPayload(provider: ZedProvider, message: string): Record<string, unknown> {
+  if (provider === "anthropic") {
+    return { type: "error", error: { type: "api_error", message } };
+  }
+  if (provider === "open_ai") {
+    return { type: "error", error: { message } };
+  }
+  return { error: { message } };
+}
+
+function nativeTerminalPayload(provider: ZedProvider): Record<string, unknown> {
+  if (provider === "anthropic") return { type: "message_stop" };
+  if (provider === "google") return { candidates: [{ finishReason: "STOP" }] };
+  if (provider === "open_ai") return { type: "response.completed", response: { output: [] } };
+  return { choices: [{ delta: {}, finish_reason: "stop" }] };
+}
+
+function normalizedStatus(value: unknown): { type: string; message?: string } | undefined {
+  if (typeof value === "string") return { type: value };
+  if (!isRecord(value)) return undefined;
+  if (typeof value.type === "string") {
+    return {
+      type: value.type,
+      ...(typeof value.message === "string" ? { message: value.message } : {}),
+    };
+  }
+  const first = Object.entries(value)[0];
+  if (!first) return undefined;
+  const [type, body] = first;
+  if (isRecord(body)) {
+    return { type, ...(typeof body.message === "string" ? { message: body.message } : {}) };
+  }
+  return { type };
+}
+
+/** One Zed frame larger than this without a newline is treated as a broken stream, not buffered forever. */
+const MAX_ZED_FRAME_CHARS = 1024 * 1024;
+
+/** Whether a delegated native event is itself that protocol's terminal event. */
+function isNativeTerminalEvent(event: Record<string, unknown>): boolean {
+  if (event.type === "message_stop") return true;
+  if (event.type === "response.completed" || event.type === "response.incomplete" || event.type === "response.failed") return true;
+  if (Array.isArray(event.choices) && event.choices.some(choice => isRecord(choice) && choice.finish_reason != null)) return true;
+  return Array.isArray(event.candidates) && event.candidates.some(candidate => isRecord(candidate) && candidate.finishReason != null);
+}
+
+/**
+ * Translate Zed's NDJSON/SSE completion frames into the delegated provider's native SSE.
+ *
+ * The request declares support for the stream-ended status, so a well-formed response ends with
+ * an explicit terminal status (or `[DONE]`). The stream fails closed instead of synthesizing a
+ * success when that guarantee is broken: a malformed or non-object frame, a frame over
+ * `MAX_ZED_FRAME_CHARS`, a partial trailing frame, or an EOF with neither a terminal status nor a
+ * native terminal event becomes the provider-native error. Nothing is forwarded after a terminal
+ * status or `[DONE]`; frames after a native terminal event still pass, because some wires (Chat
+ * with usage) send a usage chunk after `finish_reason`. Upstream failure text goes through
+ * `scrub`, which removes this account's token and user id.
+ */
+export function zedEventStream(
+  body: ReadableStream<Uint8Array>,
+  provider: ZedProvider,
+  scrub: (text: string) => string = redactSecretString,
+): ReadableStream<Uint8Array> {
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  let buffer = "";
+  let finished = false;
+  let sawNativeTerminal = false;
+  const output = new TransformStream<Uint8Array, Uint8Array>({
+    transform(chunk, controller) {
+      if (finished) return;
+      buffer += decoder.decode(chunk, { stream: true });
+      let start = 0;
+      let newline = buffer.indexOf("\n", start);
+      while (newline >= 0 && !finished) {
+        processLine(buffer.slice(start, newline), controller);
+        start = newline + 1;
+        newline = buffer.indexOf("\n", start);
+      }
+      buffer = finished ? "" : buffer.slice(start);
+      if (!finished && buffer.length > MAX_ZED_FRAME_CHARS) {
+        buffer = "";
+        fail(controller, "Zed stream frame exceeded the size limit");
+      }
+    },
+    flush(controller) {
+      if (finished) return;
+      buffer += decoder.decode();
+      if (buffer.trim()) {
+        buffer = "";
+        fail(controller, "Zed stream ended inside a partial frame");
+        return;
+      }
+      if (sawNativeTerminal) emit(controller, nativeTerminalPayload(provider));
+      else fail(controller, "Zed stream ended before completion");
+    },
+  });
+
+  function emit(controller: TransformStreamDefaultController<Uint8Array>, payload: Record<string, unknown>): void {
+    controller.enqueue(encoder.encode(`data: ${JSON.stringify(payload)}\n\n`));
+  }
+
+  function fail(controller: TransformStreamDefaultController<Uint8Array>, message: string): void {
+    emit(controller, nativeErrorPayload(provider, message));
+    finished = true;
+  }
+
+  function processLine(line: string, controller: TransformStreamDefaultController<Uint8Array>): void {
+    let text = line.replace(/\r$/, "").trim();
+    if (!text) return;
+    if (text.startsWith("data:")) text = text.slice(5).trimStart();
+    if (!text || text.startsWith(":") || text.startsWith("event:")) return;
+    if (text === "[DONE]") {
+      emit(controller, nativeTerminalPayload(provider));
+      finished = true;
+      return;
+    }
+    let parsed: unknown;
+    try { parsed = JSON.parse(text) as unknown; } catch {
+      fail(controller, "Zed stream sent a malformed frame");
+      return;
+    }
+    if (!isRecord(parsed)) {
+      fail(controller, "Zed stream sent a malformed frame");
+      return;
+    }
+    if (Object.hasOwn(parsed, "status")) {
+      const status = normalizedStatus(parsed.status);
+      if (status?.type === "failed" || status?.type === "error") {
+        fail(controller, status.message ? scrub(status.message) : "Zed request failed");
+      } else if (status?.type === "stream_ended" || status?.type === "completed") {
+        emit(controller, nativeTerminalPayload(provider));
+        finished = true;
+      }
+      return;
+    }
+    const event = Object.hasOwn(parsed, "event") ? parsed.event : parsed;
+    if (!isRecord(event)) {
+      fail(controller, "Zed stream sent a malformed frame");
+      return;
+    }
+    if (isNativeTerminalEvent(event)) sawNativeTerminal = true;
+    emit(controller, event);
+  }
+
+  return body.pipeThrough(output);
+}
+
+function createDelegate(provider: OcxProviderConfig, zedProvider: ZedProvider): ProviderAdapter {
+  const config = delegateProvider(provider, zedProvider);
+  if (zedProvider === "anthropic") return createAnthropicAdapter(config);
+  if (zedProvider === "google") return createGoogleAdapter(config);
+  if (zedProvider === "open_ai") return createResponsesPassthroughAdapter(config);
+  return createOpenAIChatAdapter(config);
+}
+
+export function createZedAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  let delegate: ZedDelegate | undefined;
+  let credentials: ZedCredentials | undefined;
+
+  const buildRequest = async (parsed: OcxParsedRequest, incoming?: IncomingMeta): Promise<AdapterRequest> => {
+    credentials = zedCredentials(provider, parsed);
+    const threadId = parsed._clientThreadId ?? parsed._codexOwnThreadId ?? parsed.previousResponseId ?? randomUUID();
+    const promptId = randomUUID();
+    let catalog: Awaited<ReturnType<typeof resolveZedModels>> | undefined;
+    try {
+      const catalogTimeout = AbortSignal.timeout(8_000);
+      const catalogSignal = incoming?.abortSignal ? AbortSignal.any([incoming.abortSignal, catalogTimeout]) : catalogTimeout;
+      catalog = await resolveZedModels(
+        credentials,
+        { signal: catalogSignal, ...(incoming?.providerFetch ? { fetchFn: incoming.providerFetch } : {}) },
+      );
+    } catch {
+      /* Model inference fallback below; a transient catalog outage must not block passthrough. */
+    }
+    const zedProvider = providerFromCatalog(catalog, parsed.modelId);
+    const selected = createDelegate(provider, zedProvider);
+    const safeIncoming: IncomingMeta = {
+     headers: incoming?.headers ?? new Headers(),
+     translatorBudget: incoming?.translatorBudget ?? createTranslatorBudget(),
+     ...(incoming?.providerFetch ? { providerFetch: incoming.providerFetch } : {}),
+     ...(incoming?.abortSignal ? { abortSignal: incoming.abortSignal } : {}),
+    };
+    const built = await selected.buildRequest(forceStreaming(parsed), safeIncoming);
+    let providerRequest: unknown;
+    try { providerRequest = JSON.parse(built.body) as unknown; } catch { throw new Error("Zed delegate produced an invalid request body"); }
+    if (zedProvider === "google" && isRecord(providerRequest)) delete providerRequest.safetySettings;
+    if (zedProvider === "anthropic" && isRecord(providerRequest) && Array.isArray(providerRequest.messages)) {
+      providerRequest.messages = providerRequest.messages.map((m: unknown) => {
+        if (isRecord(m) && typeof m.content === "string") {
+          return { ...m, content: [{ type: "text", text: m.content }] };
+        }
+        return m;
+      });
+    }
+    if (zedProvider === "open_ai" && isRecord(providerRequest)) {
+      if (typeof providerRequest.input === "string") {
+        providerRequest.input = [
+          {
+            type: "message",
+            role: "user",
+            content: [{ type: "input_text", text: providerRequest.input }],
+          },
+        ];
+      } else if (Array.isArray(providerRequest.input)) {
+        providerRequest.input = providerRequest.input.map((item: unknown) => {
+          if (isRecord(item)) {
+            const role = typeof item.role === "string" ? item.role : "user";
+            const type = typeof item.type === "string" ? item.type : "message";
+            if (typeof item.content === "string") {
+              return { ...item, type, role, content: [{ type: "input_text", text: item.content }] };
+            }
+            if (Array.isArray(item.content)) {
+              return {
+                ...item,
+                type,
+                role,
+                content: item.content.map((c: unknown) => {
+                  if (isRecord(c) && c.type === "text") {
+                    return { ...c, type: "input_text" };
+                  }
+                  return c;
+                }),
+              };
+            }
+            return { ...item, type, role };
+          }
+          return item;
+        });
+      }
+    }
+    if (!isRecord(providerRequest)) throw new Error("Zed delegate produced a non-object request body");
+    delegate = { provider: zedProvider, adapter: selected };
+    const requestUrl = `${provider.baseUrl.replace(/\/+$/, "")}/completions`;
+    return {
+      url: requestUrl,
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/x-ndjson, text/event-stream, */*",
+        "User-Agent": "OpenCodex/zed",
+        "x-zed-version": "0.200.0",
+        [ZED_HEADERS.clientSupportsStatus]: "true",
+        [ZED_HEADERS.clientSupportsStreamEnded]: "true",
+      },
+      body: JSON.stringify({
+        thread_id: threadId,
+        prompt_id: promptId,
+        provider: zedProvider,
+        model: parsed.modelId,
+        provider_request: providerRequest,
+      }),
+      ...(built.tierLog ? { tierLog: built.tierLog } : {}),
+    };
+  };
+
+  const adapter: ProviderAdapter = {
+    name: "zed",
+    formatErrorBody(status, _headers, payloadText) {
+      let payload: unknown;
+      try { payload = JSON.parse(payloadText) as unknown; } catch { payload = undefined; }
+      const record = isRecord(payload) ? payload : undefined;
+      const error = isRecord(record?.error) ? record.error : undefined;
+      const code = typeof record?.code === "string" ? record.code : typeof error?.code === "string" ? error.code : "";
+      const message = typeof record?.message === "string" ? record.message
+        : typeof error?.message === "string" ? error.message
+          : "Zed upstream request failed";
+      const scrub = (text: string) => credentials ? scrubZedCredentials(text, credentials) : redactSecretString(text);
+      return `Zed${code ? ` ${scrub(code)}` : ""}: ${scrub(message)} (HTTP ${status})`;
+    },
+    buildRequest,
+    async fetchResponse(request, ctx) {
+      if (!credentials) throw new Error("Zed request credentials were not initialized");
+      const fetchFn = ctx?.executor ?? globalThis.fetch;
+      return zedLlmFetch(credentials, "/completions", {
+        fetchFn,
+        signal: ctx?.abortSignal,
+        baseUrl: provider.baseUrl,
+        fetchInit: {
+          method: request.method,
+          headers: request.headers,
+          body: request.body,
+        },
+      });
+    },
+    async *parseStream(response: Response, budget: TranslatorBudget): AsyncGenerator<AdapterEvent> {
+      if (!response.body) {
+        yield { type: "error", message: "Zed response had no body" };
+        return;
+      }
+      if (!delegate) {
+        yield { type: "error", message: "Zed response arrived before request translation" };
+        return;
+      }
+      const requestCredentials = credentials;
+      const scrub = (text: string) => requestCredentials ? scrubZedCredentials(text, requestCredentials) : redactSecretString(text);
+      const translated = new Response(zedEventStream(response.body, delegate.provider, scrub), {
+        status: response.status,
+        headers: { "Content-Type": "text/event-stream" },
+      });
+      yield* delegate.adapter.parseStream(translated, budget);
+    },
+    async parseResponse(response: Response, budget: TranslatorBudget): Promise<AdapterEvent[]> {
+      const events: AdapterEvent[] = [];
+      for await (const event of adapter.parseStream(response, budget)) events.push(event);
+      return events;
+    },
+  };
+  return adapter;
+}

package/src/bridge/sse.ts

@@ -88,7 +88,7 @@ export function bridgeToResponsesSSE(
      * response.completed — codex-rs collect_compaction_output requires exactly one.
      */
     compaction?: boolean;
-    /** One-shot: first non-empty text/thinking/raw-reasoning delta observed (WP4 TTFT). */
+    /** One-shot: first non-empty text/thinking/raw-reasoning/tool-input delta observed. */
     onFirstOutput?: () => void;
     onTerminal?: (status: ResponsesTerminalStatus) => void;
     onCompletedResponse?: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => void;
@@ -707,7 +707,9 @@ export function bridgeToResponsesSSE(
             ? event.thinking.length > 0
             : event.type === "reasoning_raw_delta"
               ? event.text.length > 0
-              : false;
+              : event.type === "tool_call_delta"
+                ? event.arguments.length > 0
+                : false;
         if (!nonEmpty) return;
         firstOutputReported = true;
         try { options?.onFirstOutput?.(); } catch { /* metrics must not break the stream */ }

package/src/chatgpt/app-server-shim/app-server-rewrite.ts

@@ -0,0 +1,45 @@
+import { unlockRateLimitGate } from "./gate-rewrite";
+
+/**
+ * Line-level rewrite for the app-server's JSON-RPC output.
+ *
+ * Only the two messages that carry the composer's gate are rewritten: the
+ * `account/rateLimits/updated` notification and a result whose top level holds the rate-limit
+ * snapshot (the `account/rateLimits/read` response). Every other message is left alone, including
+ * thread items and tool results that happen to nest a `rate_limit` object. Lines that do not
+ * mention the snapshot fields are not even parsed, so the hot path costs two substring checks and
+ * the bytes stay identical.
+ */
+const RATE_LIMITS_UPDATED = "account/rateLimits/updated";
+const RATE_LIMIT_RESULT_FIELDS = ["rateLimits", "rateLimitsByLimitId", "ordinaryUsageAllowed"];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** The part of a message the gate rewrite may touch, or null when the message carries no gate. */
+function gatePayload(message: unknown): Record<string, unknown> | null {
+  if (!isRecord(message)) return null;
+  if (message.method === RATE_LIMITS_UPDATED) return isRecord(message.params) ? message.params : null;
+  if ("method" in message) return null;
+  const result = message.result;
+  return isRecord(result) && RATE_LIMIT_RESULT_FIELDS.some(field => field in result) ? result : null;
+}
+
+/**
+ * Returns the rewritten line, or null when the line is not a gate-bearing JSON-RPC message or the
+ * rewrite has nothing to change. Parse failures also return null: the rewrite owns removal of
+ * known-shaped locks, not validation.
+ */
+export function rewriteAppServerLine(line: string): string | null {
+  if (!line.includes("rateLimit") && !line.includes("ordinaryUsageAllowed")) return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  const payload = gatePayload(parsed);
+  if (payload === null) return null;
+  return unlockRateLimitGate(payload) ? JSON.stringify(parsed) : null;
+}

package/src/chatgpt/app-server-shim/bundle-trust.ts

@@ -0,0 +1,77 @@
+import { spawnSync } from "node:child_process";
+import { lstatSync } from "node:fs";
+import { dirname, relative, sep } from "node:path";
+
+/**
+ * The launcher persistently execs a binary taken from a discovered bundle, so the bundle must be
+ * one this user can trust: OpenAI-signed, and not replaceable by another local account. Bundle
+ * identifier alone (what discovery checks) is plain text in Info.plist that anyone can copy.
+ */
+export const OPENAI_TEAM_ID = "2DC432GLL2";
+
+const CODESIGN = "/usr/bin/codesign";
+const CODESIGN_TIMEOUT_MS = 30_000;
+
+export interface BundleTrustDeps {
+  readonly uid: number;
+  stat(path: string): { uid: number; mode: number; isFile: boolean; isDirectory: boolean; isSymbolicLink: boolean } | null;
+  codesign(args: readonly string[]): { status: number | null; output: string };
+}
+
+export function defaultBundleTrustDeps(): BundleTrustDeps {
+  return {
+    uid: typeof process.getuid === "function" ? process.getuid() : -1,
+    stat(path) {
+      try {
+        const s = lstatSync(path);
+        return { uid: s.uid, mode: s.mode, isFile: s.isFile(), isDirectory: s.isDirectory(), isSymbolicLink: s.isSymbolicLink() };
+      } catch {
+        return null;
+      }
+    },
+    codesign(args) {
+      const result = spawnSync(CODESIGN, [...args], { encoding: "utf8", timeout: CODESIGN_TIMEOUT_MS });
+      return { status: result.status, output: `${result.stdout ?? ""}${result.stderr ?? ""}` };
+    },
+  };
+}
+
+function ownedSafely(deps: BundleTrustDeps, path: string, kind: "file" | "directory"): string | null {
+  const s = deps.stat(path);
+  if (!s) return "is missing";
+  if (s.isSymbolicLink) return "is a symbolic link";
+  if (kind === "file" ? !s.isFile : !s.isDirectory) return `is not a ${kind}`;
+  if (s.uid !== 0 && s.uid !== deps.uid) return "is owned by another user";
+  if ((s.mode & 0o022) !== 0) return "is writable by group or others";
+  return null;
+}
+
+/**
+ * Null when the bundle root and the app-server binary inside it may be exec'd by this user;
+ * otherwise a short reason. Every directory from the binary up to the bundle root, and the
+ * binary itself, must be owned by root or this user and not group/other-writable, and both the
+ * bundle and the binary must pass strict code-signature verification under OpenAI's team ID.
+ */
+export function untrustedChatgptBundleReason(
+  bundleRoot: string,
+  binary: string,
+  deps: BundleTrustDeps = defaultBundleTrustDeps(),
+): string | null {
+  const inside = relative(bundleRoot, binary);
+  if (!inside || inside.startsWith("..") || inside.startsWith(sep)) return "the app-server binary is outside the bundle";
+  const fileProblem = ownedSafely(deps, binary, "file");
+  if (fileProblem) return `the app-server binary ${fileProblem}`;
+  for (let dir = dirname(binary); ; dir = dirname(dir)) {
+    const dirProblem = ownedSafely(deps, dir, "directory");
+    if (dirProblem) return `${dir} ${dirProblem}`;
+    if (dir === bundleRoot || dirname(dir) === dir) break;
+  }
+  for (const target of [bundleRoot, binary]) {
+    if (deps.codesign(["--verify", "--strict", target]).status !== 0) return `${target} failed code-signature verification`;
+    const details = deps.codesign(["-dv", "--verbose=2", target]);
+    if (details.status !== 0 || !new RegExp(`^TeamIdentifier=${OPENAI_TEAM_ID}$`, "m").test(details.output)) {
+      return `${target} is not signed by OpenAI (team ${OPENAI_TEAM_ID})`;
+    }
+  }
+  return null;
+}

package/src/chatgpt/app-server-shim/filter.ts

@@ -0,0 +1,157 @@
+import { rewriteAppServerLine } from "./app-server-rewrite";
+
+/** Byte-preserving stdout filter; unexpected rewrite machinery failures disable filtering. */
+const NEWLINE = 0x0a;
+/**
+ * Gate messages are a few kilobytes. A line longer than this is passed through raw instead of
+ * being buffered, so a runaway line without a newline cannot grow the filter's memory unbounded.
+ */
+export const MAX_FILTERED_LINE_BYTES = 8 * 1024 * 1024;
+
+function concatParts(parts: readonly Uint8Array[], length: number): Uint8Array {
+  if (parts.length === 1) return parts[0]!;
+  const out = new Uint8Array(length);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+
+/**
+ * Splits a byte stream into lines and rewrites the ones that need it. Returns the bytes to write
+ * for each chunk; a partial trailing line is held back until its newline arrives (or `flush`).
+ * The held-back pieces are kept as a list and joined once when the line ends, so a long line
+ * spread over many pipe chunks costs linear copying rather than recopying its prefix per chunk.
+ * A line over `maxLineBytes` is emitted raw as it arrives and never parsed.
+ */
+export function createRpcLineFilter(
+  rewrite: (line: string) => string | null = rewriteAppServerLine,
+  maxLineBytes = MAX_FILTERED_LINE_BYTES,
+): { push(chunk: Uint8Array): Uint8Array[]; flush(): Uint8Array[] } {
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  let pending: Uint8Array[] = [];
+  let pendingLength = 0;
+  let passthrough = false;
+  // Inside an oversized line: bytes pass through raw until its newline.
+  let skippingLine = false;
+
+  // `line` excludes the newline, `whole` includes it when there is one. An untouched line is
+  // returned as the very bytes that arrived; only a rewritten one is re-encoded.
+  const emit = (line: Uint8Array, whole: Uint8Array, terminated: boolean): Uint8Array => {
+    let rewritten: string | null;
+    try {
+      rewritten = rewrite(decoder.decode(line));
+    } catch {
+      return whole;
+    }
+    if (rewritten === null) return whole;
+    const body = encoder.encode(rewritten);
+    if (!terminated) return body;
+    const out = new Uint8Array(body.length + 1);
+    out.set(body, 0);
+    out[body.length] = NEWLINE;
+    return out;
+  };
+
+  return {
+    push(chunk) {
+      if (passthrough) return [chunk];
+      const previous = pending;
+      const previousLength = pendingLength;
+      try {
+        const out: Uint8Array[] = [];
+        let start = 0;
+        if (skippingLine) {
+          const end = chunk.indexOf(NEWLINE);
+          if (end === -1) return [chunk];
+          out.push(chunk.subarray(0, end + 1));
+          skippingLine = false;
+          start = end + 1;
+        }
+        let held = previous;
+        let heldLength = previousLength;
+        for (let i = chunk.indexOf(NEWLINE, start); i !== -1; i = chunk.indexOf(NEWLINE, start)) {
+          const tail = chunk.subarray(start, i + 1);
+          if (heldLength + tail.length - 1 > maxLineBytes) {
+            // A complete line over the cap is passed through as it arrived, never joined or parsed.
+            out.push(...held, tail);
+          } else {
+            const whole = heldLength === 0 ? tail : concatParts([...held, tail], heldLength + tail.length);
+            out.push(emit(whole.subarray(0, whole.length - 1), whole, true));
+          }
+          held = [];
+          heldLength = 0;
+          start = i + 1;
+        }
+        if (start < chunk.length) {
+          const rest = chunk.slice(start);
+          if (heldLength + rest.length > maxLineBytes) {
+            // Too long to be a gate message: release what is held and stream the rest raw.
+            out.push(...held, rest);
+            held = [];
+            heldLength = 0;
+            skippingLine = true;
+          } else {
+            // Appending in place is safe: nothing after this point can throw back to `previous`.
+            held.push(rest);
+            heldLength += rest.length;
+          }
+        }
+        pending = held;
+        pendingLength = heldLength;
+        return out;
+      } catch {
+        pending = [];
+        pendingLength = 0;
+        passthrough = true;
+        return [...previous, chunk];
+      }
+    },
+    flush() {
+      if (pendingLength === 0) return [];
+      const parts = pending;
+      const last = concatParts(parts, pendingLength);
+      pending = [];
+      pendingLength = 0;
+      if (passthrough) return parts;
+      try { return [emit(last, last, false)]; } catch { return [last]; }
+    },
+  };
+}
+
+/** Copy `input` to `write`, rewriting gate lines on the way. Resolves when `input` ends. */
+export async function runStdoutFilter(
+  input: AsyncIterable<Uint8Array>,
+  write: (bytes: Uint8Array) => Promise<unknown> | unknown,
+  rewrite?: (line: string) => string | null,
+): Promise<void> {
+  let filter: ReturnType<typeof createRpcLineFilter> | undefined;
+  try { filter = createRpcLineFilter(rewrite); } catch { /* Raw passthrough if setup fails. */ }
+  for await (const chunk of input) {
+    for (const out of filter ? filter.push(chunk) : [chunk]) await write(out);
+  }
+  for (const out of filter?.flush() ?? []) await write(out);
+}
+
+/** Hidden CLI entry; the self-test emits no stdout so the launcher can probe it safely. */
+export async function runChatgptAppServerFilter({ selfTest = false }: { selfTest?: boolean } = {}): Promise<number> {
+  if (selfTest) {
+    try {
+      const fixture = JSON.stringify({ id: 1, result: {
+        ordinaryUsageAllowed: false,
+        rateLimits: { rateLimitReachedType: "rate_limit_reached", primary: { usedPercent: 100 } },
+      } });
+      const rewritten = rewriteAppServerLine(fixture);
+      if (!rewritten) return 1;
+      const result = JSON.parse(rewritten).result;
+      return result.ordinaryUsageAllowed === true
+        && result.rateLimits.rateLimitReachedType === null
+        && result.rateLimits.primary.usedPercent === 100 ? 0 : 1;
+    } catch { return 1; }
+  }
+  await runStdoutFilter(Bun.stdin.stream(), bytes => Bun.write(Bun.stdout, bytes));
+  return 0;
+}