@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/server/responses-custom-tool-repair.ts

@@ -13,6 +13,7 @@ import {
 } from "../responses/custom-tool-compat";
 import {
   replaceSseDataPayload,
+  splitSseBlock,
   sseDataPayload,
   type SseBlockRewrite,
 } from "./sse-payload-rewrite";
@@ -22,8 +23,7 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 }
 
 function replaceSseEventName(block: string, type: string): string {
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
-  const lines = block.split(/\r?\n/);
+  const { newline, lines } = splitSseBlock(block);
   let replaced = false;
   const next = lines.map(line => {
     if (!replaced && line.startsWith("event:")) {

package/src/server/responses-hosted-image-display.ts

@@ -2,6 +2,8 @@ import { mkdirSync, writeFileSync, unlinkSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { join, posix } from "node:path";
 import { getConfigDir } from "../config";
+import { jsonUtf8Bytes } from "../lib/json-byte-size";
+import { TRANSLATOR_MAX_TURN_BYTES } from "../lib/translator-budget";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import {
   chargeImageBudget, createImageBudget, decodeValidatedImageBase64,
@@ -12,6 +14,16 @@ import { sseDataPayload, replaceSseDataPayload, type SseBlockRewrite } from "./s
 type Row = Record<string, any>;
 const object = (v: unknown): v is Row => !!v && typeof v === "object" && !Array.isArray(v);
 const originators = new Set(["codex_cli_rs", "Codex Desktop", "codex_app", "codex_work_desktop"]);
+const MAX_DISPLAY_ITEMS = 128;
+const MAX_ITEM_METADATA_BYTES = 64 * 1024;
+const MAX_RETAINED_METADATA_BYTES = 1024 * 1024;
+const displayKey = (item: Row, index: number) => typeof item.id === "string" ? "id:" + item.id : "index:" + index;
+
+function displayBytes(value: unknown, limit: number): number {
+  try { return jsonUtf8Bytes(value, limit); }
+  catch { throw new RangeError("hosted image result exceeds local display limits"); }
+}
+
 const generatedName = /^img-codex-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\.(png|jpg|webp|gif)$/;
 
 /** One spelling per local path: file URL or plain, either separator, dot segments, folded case. */
@@ -71,13 +83,20 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
   const states = new Map<string, { message: Row; added: boolean; done: boolean }>();
   let extraSequence = 0;
   let wroteArtifact = false;
+  let retainedMetadataBytes = 0;
 
   function stateFor(item: Row, index: number) {
-    const key = typeof item.id === "string" ? item.id : "index:" + index;
+    // Validate every occurrence, including repeats whose state is already complete.
+    const metadataBytes = displayBytes({ id: item.id,
+      metadata: item.internal_chat_message_metadata_passthrough }, MAX_ITEM_METADATA_BYTES);
+    const key = displayKey(item, index);
     let state = states.get(key);
     if (state) return state;
-    // Bound metadata independently of the existing 100 MiB decoded-image budget.
-    if (states.size >= 128) throw new RangeError("hosted image result count exceeds local display limit");
+    if (states.size >= MAX_DISPLAY_ITEMS) throw new RangeError("hosted image result count exceeds local display limit");
+    if (metadataBytes > MAX_RETAINED_METADATA_BYTES - retainedMetadataBytes) {
+      throw new RangeError("hosted image result exceeds local display limits");
+    }
+    retainedMetadataBytes += metadataBytes;
     const id = "msg_ocx_img_" + createHash("sha256").update(key).digest("hex").slice(0, 32);
     state = { added: false, done: false, message: {
       // Persist image results outside the client's collapsible progress messages.
@@ -147,15 +166,51 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
     return events;
   }
 
-  function snapshot(response: Row, terminal: boolean, events?: Row[]): Row {
+  function projectedMessage(message: Row): Row {
+    if (message.status !== "in_progress") return message;
+    // Longest possible local filename and JSON text size, without decoding or writing an image.
+    const pathText = "![Generated image](<" + join(getArtifactsDir(), "img-codex-" + "0".repeat(36) + ".webp") + ">)";
+    const fallback = "The completed image result has no supported image data for local display.";
+    const text = displayBytes(pathText, TRANSLATOR_MAX_TURN_BYTES) > displayBytes(fallback, TRANSLATOR_MAX_TURN_BYTES)
+      ? pathText : fallback;
+    return { ...message, status: "incomplete", content: [{ type: "output_text", text, annotations: [] }] };
+  }
+
+  function lifecycleBytes(message: Row): number {
+    // At most two item copies and four text copies, plus fixed event fields, ids and numeric indices.
+    return 2 * displayBytes(message, TRANSLATOR_MAX_TURN_BYTES)
+      + 4 * displayBytes(message.content[0].text, TRANSLATOR_MAX_TURN_BYTES) + 2048;
+  }
+
+  function snapshot(response: Row, terminal: boolean, events?: Row[], envelope?: Row): Row {
     if (!Array.isArray(response.output)) return response;
-    // Reject oversized snapshots before saving artifacts that cannot be delivered.
-    const keys = new Set(states.keys());
+    // Preflight the complete snapshot before any artifact writes or expanded serialization.
+    const keys = new Set<string>();
+    const ids = new Set<string>();
     for (const [index, item] of response.output.entries()) {
       if (!object(item) || item.type !== "image_generation_call") continue;
-      keys.add(typeof item.id === "string" ? item.id : "index:" + index);
-      if (keys.size > 128) throw new RangeError("hosted image result count exceeds local display limit");
+      const key = displayKey(item, index);
+      if (keys.has(key)) throw new RangeError("duplicate hosted image identity in local display snapshot");
+      keys.add(key);
+      if (typeof item.id === "string") ids.add(item.id);
+      stateFor(item, index);
+    }
+    if (keys.size === 0) return response;
+    const seen = new Set<string>();
+    for (const item of response.output) {
+      if (!object(item) || !ids.has(item.id)) continue;
+      if (seen.has(item.id)) throw new RangeError("conflicting hosted image identity in local display snapshot");
+      seen.add(item.id);
     }
+    let extraBytes = 32; // Sequence-number growth on a rewritten SSE envelope.
+    const preview = { ...response, output: response.output.map((item: unknown, index: number) => {
+      if (!object(item) || item.type !== "image_generation_call") return item;
+      const state = stateFor(item, index);
+      const message = terminal ? projectedMessage(state.message) : state.message;
+      if (events && terminal && !state.done) extraBytes += lifecycleBytes(message);
+      return message;
+    }) };
+    displayBytes(envelope ? { ...envelope, response: preview } : preview, TRANSLATOR_MAX_TURN_BYTES - extraBytes);
     let changed = false;
     const output = response.output.map((item: unknown, index: number) => {
       if (!object(item) || item.type !== "image_generation_call") return item;
@@ -182,9 +237,14 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
       && (hasIndex || typeof event.item.id === "string")) {
       if (event.type === "response.output_item.added") {
         const state = stateFor(event.item, index);
+        if (!state.added) displayBytes({ ...event, item: state.message }, TRANSLATOR_MAX_TURN_BYTES - 32);
         result = state.added ? [] : [{ ...event, item: state.message }];
         state.added = true;
       } else if (event.type === "response.output_item.done") {
+        const state = stateFor(event.item, index);
+        if (!state.done && lifecycleBytes(projectedMessage(state.message)) > TRANSLATOR_MAX_TURN_BYTES) {
+          throw new RangeError("hosted image result exceeds local display limits");
+        }
         result = doneEvents(event.item, index);
       }
     } else if (typeof event.type === "string" && event.type.startsWith("response.image_generation_call.")) {
@@ -193,7 +253,7 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
     } else if (object(event.response)) {
       const terminal = ["response.completed", "response.incomplete", "response.failed"].includes(event.type);
       const injected: Row[] = [];
-      const response = snapshot(event.response, terminal, injected);
+      const response = snapshot(event.response, terminal, injected, event);
       if (response !== event.response) result = [...injected, { ...event, response }];
     }
     const sequence = Number.isSafeInteger(event.sequence_number) ? event.sequence_number + extraSequence : undefined;
@@ -216,6 +276,7 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
   };
   rewrite.dispose = () => {
     states.clear();
+    retainedMetadataBytes = 0;
     if (wroteArtifact) {
       wroteArtifact = false;
       pruneArtifacts();

package/src/server/responses-terminal-repair.ts

@@ -91,6 +91,7 @@ export function relayResponsesSseWithTerminalRepair(
   let maxSequence = -1;
   let buffer = "";
   let bufferBytes = 0;
+  let pendingLineFeed = false;
   let timer: unknown;
   let timerGeneration = 0;
   let realTerminalSeen = false;
@@ -284,6 +285,7 @@ export function relayResponsesSseWithTerminalRepair(
     let emitted = false;
     while ((next = nextSseBlock(buffer))) {
       replaceBuffer(next.rest);
+      pendingLineFeed = next.delimiter.endsWith("\r") && buffer.length === 0;
       const kind = inspectPayload(sseDataPayload(next.block));
       if (kind === "done" && !realTerminalSeen) {
         emitSynthetic(completeCandidate() ? "completed" : "incomplete", controller);
@@ -327,9 +329,20 @@ export function relayResponsesSseWithTerminalRepair(
           controller.close();
           return;
         }
-        appendBuffer(decoder.decode(value, { stream: true }));
+        let fragment = decoder.decode(value, { stream: true });
+        let continuedDelimiter = false;
+        if (pendingLineFeed && fragment.length > 0) {
+          pendingLineFeed = false;
+          if (fragment.startsWith("\n")) {
+            // This byte completes an already-forwarded CR delimiter, not a new EOF suffix.
+            controller.enqueue(encoder.encode("\n"));
+            fragment = fragment.slice(1);
+            continuedDelimiter = true;
+          }
+        }
+        appendBuffer(fragment);
         const result = emitBlocks(controller);
-        if (result.closed || result.emitted) return;
+        if (result.closed || result.emitted || continuedDelimiter) return;
       }
     } catch (error) {
       if (disposed) return;

package/src/server/sse-frame-buffer.ts

@@ -1,13 +1,14 @@
 import { isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
+import { sseDataPayload } from "./sse-payload-rewrite";
 
 export const MAX_CLIENT_SSE_FRAME_BYTES = 4 * 1024 * 1024;
 
 export const EMPTY_BYTES = new Uint8Array(0);
 
-const LF_LF = Uint8Array.of(10, 10);
-const LF_CR_LF = Uint8Array.of(10, 13, 10);
-const CR_LF_LF = Uint8Array.of(13, 10, 10);
-const CR_LF_CR_LF = Uint8Array.of(13, 10, 13, 10);
+// Intern every legal pair; a split CRLF may leave a framing-only LF continuation.
+const DELIMITERS = new Map([
+  "\n", "\n\n", "\n\r", "\n\r\n", "\r\r", "\r\r\n", "\r\n\n", "\r\n\r", "\r\n\r\n",
+].map(text => [text, Uint8Array.from(text, char => char.charCodeAt(0))]));
 
 export class SseFrameTooLargeError extends Error {
   readonly maxBytes: number;
@@ -32,6 +33,8 @@ export class SseFrameCountLimitError extends Error {
 export type BoundedSseFrame = {
   block: Uint8Array;
   delimiter: Uint8Array;
+  /** A late LF extending a previously returned CR; no new event. */
+  continuation?: true;
 };
 
 /**
@@ -40,29 +43,22 @@ export type BoundedSseFrame = {
  * Returns the delimiter length in bytes, `0` when `index` does not start a
  * delimiter, and `undefined` when more bytes are required to decide.
  */
-function delimiterLengthAt(
+export function sseDelimiterLengthAt(
   index: number,
   length: number,
   byteAt: (index: number) => number,
 ): number | undefined {
   const first = byteAt(index);
-  if (first === 10) {
-    if (index + 1 >= length) return undefined;
-    const second = byteAt(index + 1);
-    if (second === 10) return 2;
-    if (second !== 13) return 0;
-    if (index + 2 >= length) return undefined;
-    return byteAt(index + 2) === 10 ? 3 : 0;
-  }
-  if (first !== 13) return 0;
-  if (index + 1 >= length) return undefined;
-  if (byteAt(index + 1) !== 10) return 0;
-  if (index + 2 >= length) return undefined;
-  const third = byteAt(index + 2);
-  if (third === 10) return 3;
-  if (third !== 13) return 0;
-  if (index + 3 >= length) return undefined;
-  return byteAt(index + 3) === 10 ? 4 : 0;
+  if (first !== 10 && first !== 13) return 0;
+  let next = index + 1;
+  if (next >= length) return undefined;
+  if (first === 13 && byteAt(next) === 10) next += 1;
+  if (next >= length) return undefined;
+  const second = byteAt(next);
+  if (second !== 10 && second !== 13) return 0;
+  next += 1;
+  if (second === 13 && next < length && byteAt(next) === 10) next += 1;
+  return next - index;
 }
 
 function delimiterBytesAt(
@@ -70,9 +66,9 @@ function delimiterBytesAt(
   delimiterLength: number,
   byteAt: (index: number) => number,
 ): Uint8Array {
-  if (delimiterLength === 2) return LF_LF;
-  if (delimiterLength === 4) return CR_LF_CR_LF;
-  return byteAt(index) === 10 ? LF_CR_LF : CR_LF_LF;
+  let text = "";
+  for (let offset = 0; offset < delimiterLength; offset++) text += String.fromCharCode(byteAt(index + offset));
+  return DELIMITERS.get(text)!;
 }
 
 function copyRange(
@@ -100,14 +96,8 @@ function copyRange(
  * cost on ordinary framing.
  */
 function isResponsesTerminalFrame(block: Uint8Array): boolean {
-  const data: string[] = [];
-  for (const line of new TextDecoder().decode(block).split(/\r?\n/)) {
-    if (!line.startsWith("data:")) continue;
-    const value = line.slice(5);
-    data.push(value.startsWith(" ") ? value.slice(1) : value);
-  }
-  if (data.length === 0) return false;
-  const payload = data.join("\n");
+  const payload = sseDataPayload(new TextDecoder().decode(block));
+  if (payload === null) return false;
   if (payload === "[DONE]") return false;
   try {
     const parsed = JSON.parse(payload) as {
@@ -161,6 +151,7 @@ export class BoundedSseFrameBuffer {
   private candidate: Uint8Array = EMPTY_BYTES;
   private candidateBytes = 0;
   private disposed = false;
+  private pendingLineFeed = false;
 
   constructor(maxFrameBytes = MAX_CLIENT_SSE_FRAME_BYTES) {
     if (!Number.isSafeInteger(maxFrameBytes) || maxFrameBytes <= 0) {
@@ -177,6 +168,7 @@ export class BoundedSseFrameBuffer {
     this.delimiterTail = EMPTY_BYTES;
     this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
+    this.pendingLineFeed = false;
   }
 
   private ensureCapacity(requiredBytes: number): void {
@@ -226,6 +218,7 @@ export class BoundedSseFrameBuffer {
     if (chunk.byteLength === 0) return [];
 
     const frames: BoundedSseFrame[] = [];
+    let completedFrames = 0;
     const previousTail = this.delimiterTail;
     this.delimiterTail = EMPTY_BYTES;
     const tailLength = previousTail.byteLength;
@@ -245,12 +238,19 @@ export class BoundedSseFrameBuffer {
 
     try {
       let index = 0;
-      let retainedThrough = 0;
+      if (this.pendingLineFeed && byteAt(0) === 10) {
+        // The prior event was already dispatched on CR. Preserve its later LF without
+        // charging it to the next event or letting it pair with another line ending.
+        frames.push({ block: EMPTY_BYTES, delimiter: DELIMITERS.get("\n")!, continuation: true });
+        index = 1;
+      }
+      this.pendingLineFeed = false;
+      let retainedThrough = index;
       while (index < totalLength) {
-        const delimiterLength = delimiterLengthAt(index, totalLength, byteAt);
+        const delimiterLength = sseDelimiterLengthAt(index, totalLength, byteAt);
         if (delimiterLength === undefined) break;
         if (delimiterLength > 0) {
-          if (frames.length >= this.maxFramesPerFeed) {
+          if (completedFrames >= this.maxFramesPerFeed) {
             this.clear();
             this.disposed = true;
             throw new SseFrameCountLimitError(this.maxFramesPerFeed);
@@ -259,7 +259,9 @@ export class BoundedSseFrameBuffer {
           const block = this.takeCandidate();
           const delimiter = delimiterBytesAt(index, delimiterLength, byteAt);
           frames.push({ block, delimiter });
+          completedFrames += 1;
           index += delimiterLength;
+          this.pendingLineFeed = index === totalLength && byteAt(index - 1) === 13;
           retainedThrough = index;
           continue;
         }

package/src/server/sse-payload-rewrite.ts

@@ -65,7 +65,8 @@ export function composeSseBlockRewrites(...rewrites: SseBlockRewrite[]): SseBloc
 
 /** Split one complete SSE event block while retaining its original blank-line delimiter. */
 export function nextSseBlock(buffer: string): { block: string; delimiter: string; rest: string } | null {
-  const match = buffer.match(/\r?\n\r?\n/);
+  // The negative lookahead prevents backtracking from splitting one CRLF into two endings.
+  const match = buffer.match(/(?:\r\n|\r(?!\n)|\n){2}/);
   if (!match || match.index === undefined) return null;
   return {
     block: buffer.slice(0, match.index),
@@ -87,6 +88,7 @@ export function createSseBlockBuffer(
   append(fragment: string): void;
   next(): { block: string; delimiter: string } | null;
   tail(): string;
+  isEmpty(): boolean;
   compact(): void;
   clear(): void;
 } {
@@ -95,6 +97,7 @@ export function createSseBlockBuffer(
   let offset = 0;
   let scanOffset = 0;
   let bufferBytes = 0;
+  const delimiterPattern = /(?:\r\n|\r(?!\n)|\n){2}/g;
 
   const compact = (): void => {
     if (offset === 0) return;
@@ -128,43 +131,33 @@ export function createSseBlockBuffer(
       }
     },
     next() {
-      for (;;) {
-        const newline = buffer.indexOf("\n", scanOffset);
-        if (newline < 0) {
-          scanOffset = buffer.length;
-          return null;
-        }
-        let end = newline + 1;
-        if (buffer[end] === "\r") end += 1;
-        if (end === buffer.length) {
-          // Keep the candidate first newline until its possible blank-line delimiter arrives.
-          scanOffset = newline;
-          return null;
-        }
-        if (buffer[end] !== "\n") {
-          scanOffset = newline + 1;
-          continue;
-        }
-        end += 1;
-        const start = newline > offset && buffer[newline - 1] === "\r" ? newline - 1 : newline;
-        const block = buffer.slice(offset, start);
-        const delimiter = buffer.slice(start, end);
-        const nextBytes = bufferBytes - Buffer.byteLength(block, "utf8") - delimiter.length;
-        const reservation = budget.reserveTransient(nextBytes, scope);
-        reservation.commitRetained();
-        budget.releaseRetained(bufferBytes, scope);
-        bufferBytes = nextBytes;
-        offset = end;
-        scanOffset = end;
-        if (offset === buffer.length) {
-          buffer = "";
-          offset = 0;
-          scanOffset = 0;
-        }
-        return { block, delimiter };
+      delimiterPattern.lastIndex = scanOffset;
+      const match = delimiterPattern.exec(buffer);
+      if (!match) {
+        // A delimiter is at most four code units. Revisit only its possible split prefix.
+        scanOffset = Math.max(offset, buffer.length - 3);
+        return null;
       }
+      const start = match.index;
+      const end = start + match[0].length;
+      const block = buffer.slice(offset, start);
+      const delimiter = buffer.slice(start, end);
+      const nextBytes = bufferBytes - Buffer.byteLength(block, "utf8") - delimiter.length;
+      const reservation = budget.reserveTransient(nextBytes, scope);
+      reservation.commitRetained();
+      budget.releaseRetained(bufferBytes, scope);
+      bufferBytes = nextBytes;
+      offset = end;
+      scanOffset = end;
+      if (offset === buffer.length) {
+        buffer = "";
+        offset = 0;
+        scanOffset = 0;
+      }
+      return { block, delimiter };
     },
     tail: () => buffer.slice(offset),
+    isEmpty: () => offset === buffer.length,
     compact,
     clear() {
       budget.releaseRetained(bufferBytes, scope);
@@ -184,11 +177,11 @@ export function sseDataPayload(block: string): string | null {
   const len = block.length;
 
   while (lineStart < len) {
-    const nextNewline = block.indexOf("\n", lineStart);
-    let lineEnd = nextNewline === -1 ? len : nextNewline;
-    const nextStart = nextNewline === -1 ? len : nextNewline + 1;
-    if (lineEnd > lineStart && block.charCodeAt(lineEnd - 1) === 13) {
-      lineEnd -= 1;
+    let lineEnd = lineStart;
+    while (lineEnd < len && block.charCodeAt(lineEnd) !== 13 && block.charCodeAt(lineEnd) !== 10) lineEnd += 1;
+    let nextStart = lineEnd;
+    if (nextStart < len) {
+      nextStart += block.charCodeAt(lineEnd) === 13 && block.charCodeAt(lineEnd + 1) === 10 ? 2 : 1;
     }
 
     const lineLen = lineEnd - lineStart;
@@ -218,10 +211,19 @@ export function sseDataPayload(block: string): string | null {
   return found ? result : null;
 }
 
+/** Shared line rules for field-mutating repairs; identity paths keep the original block. */
+export function sseLineEnding(block: string): "\r\n" | "\r" | "\n" {
+  return block.match(/\r\n|\r|\n/)?.[0] as "\r\n" | "\r" | "\n" ?? "\n";
+}
+
+export function splitSseBlock(block: string): { newline: string; lines: string[] } {
+  return { newline: sseLineEnding(block), lines: block.split(/\r\n|\r|\n/) };
+}
+
 /** Replace an SSE event's data field while preserving non-data fields and newline style. */
 export function replaceSseDataPayload(block: string, payload: string): string {
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
-  const lines = block.split(/\r?\n/);
+  if (sseDataPayload(block) === payload) return block;
+  const { newline, lines } = splitSseBlock(block);
   const rewritten: string[] = [];
   let replaced = false;
   for (const line of lines) {
@@ -230,7 +232,7 @@ export function replaceSseDataPayload(block: string, payload: string): string {
       continue;
     }
     if (!replaced) {
-      rewritten.push(...payload.split(/\r?\n/).map(line => `data: ${line}`));
+      rewritten.push(...payload.split(/\r\n|\r|\n/).map(line => `data: ${line}`));
       replaced = true;
     }
   }
@@ -278,6 +280,8 @@ export function relaySseWithBlockRewrite(
   // Relays have several independent teardown paths; disposal is exactly once.
   let disposed = false;
   let cancelled = false;
+  let pendingLineFeed = false;
+  let pendingLineFeedVisible = false;
   const disposeRewrite = (): void => {
     if (disposed) return;
     disposed = true;
@@ -308,10 +312,18 @@ export function relaySseWithBlockRewrite(
     let emitted = 0;
     let next: { block: string; delimiter: string } | null;
     while (!cancelled && (next = buffer.next())) {
-      const outBlocks = rewrite(next.block);
+      const { block, delimiter } = next;
+      // A CR followed by buffered text is already settled; only an end-of-buffer CR
+      // can still receive the LF that extends its delimiter in the next fragment.
+      pendingLineFeed = delimiter.endsWith("\r") && buffer.isEmpty();
+      const outBlocks = rewrite(block);
+      pendingLineFeedVisible = outBlocks.length > 0;
       if (cancelled) return emitted;
-      for (const outBlock of outBlocks) {
-        enqueueText(controller, outBlock + next.delimiter);
+      for (let index = 0; index < outBlocks.length; index++) {
+        // Synthetic earlier blocks need a settled delimiter; only the final one can
+        // inherit an upstream LF in a later chunk. Completing CR as CRLF is equivalent.
+        const settled = index < outBlocks.length - 1 && delimiter.endsWith("\r") ? delimiter + "\n" : delimiter;
+        enqueueText(controller, outBlocks[index]! + settled);
         emitted += 1;
       }
     }
@@ -332,6 +344,23 @@ export function relaySseWithBlockRewrite(
     return emitted;
   };
 
+  const appendFragment = (controller: ReadableStreamDefaultController<Uint8Array>, fragment: string): number => {
+    let continuation = false;
+    if (pendingLineFeed && fragment.length > 0) {
+      continuation = fragment.startsWith("\n");
+      pendingLineFeed = false;
+      if (continuation) fragment = fragment.slice(1);
+    }
+    // Consume a late LF before scanning, so it cannot pair with a new LF to create
+    // a phantom empty callback. Any following line ending stays in the input buffer.
+    buffer.append(fragment);
+    if (continuation && pendingLineFeedVisible) {
+      enqueueText(controller, "\n");
+      return 1;
+    }
+    return 0;
+  };
+
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
@@ -346,7 +375,7 @@ export function relaySseWithBlockRewrite(
           // after its disposal (#893 review).
           if (cancelled) return;
           if (done) {
-            buffer.append(decoder.decode());
+            appendFragment(controller, decoder.decode());
             emitProcessedBlocks(controller, true);
             if (cancelled) return;
             buffer.clear();
@@ -354,8 +383,8 @@ export function relaySseWithBlockRewrite(
             controller.close();
             return;
           }
-          buffer.append(decoder.decode(value, { stream: true }));
-          const emitted = emitProcessedBlocks(controller);
+          const continuation = appendFragment(controller, decoder.decode(value, { stream: true }));
+          const emitted = continuation + emitProcessedBlocks(controller);
           if (cancelled || emitted > 0) return;
         }
       } catch (error) {

package/src/server/ws-bridge.ts

@@ -8,6 +8,7 @@ import type { ResponsesTerminalStatus } from "../bridge";
 import type { DataPlaneAdmission } from "./auth-cors";
 import type { AdmissionLease, AdmissionReservation } from "../lib/admission";
 import { BoundedSseFrameBuffer } from "./sse-frame-buffer";
+import { sseDataPayload as parseSseBlock } from "./sse-payload-rewrite";
 import { safeResponseHeaders } from "./safe-response-headers";
 import type { AudioSocketTarget } from "./audio-dictation";
 
@@ -183,17 +184,6 @@ export function buildWsErrorFrame(
   };
 }
 
-function parseSseBlock(block: string): string | null {
-  const data: string[] = [];
-  for (const line of block.split(/\r?\n/)) {
-    if (line.startsWith("data:")) {
-      const value = line.slice(5);
-      data.push(value.startsWith(" ") ? value.slice(1) : value);
-    }
-  }
-  return data.length > 0 ? data.join("\n") : null;
-}
-
 function payloadType(payload: string): string | null {
   try {
     const json = JSON.parse(payload) as { type?: unknown };

package/src/service/windows-taskxml.ts

@@ -154,7 +154,6 @@ export function buildWindowsServiceScript(
     '    if exist "%OCX_PKG_DIR%" rmdir /s /q "%OCX_PKG_DIR%" 2>nul',
     '    move "%OCX_PKG_DIR%\\..\\%%B\\opencodex" "%OCX_PKG_DIR%" >nul 2>&1',
     '    if exist "%OCX_PKG_DIR%\\package.json" (',
-    '      set "OCX_RESTORED_BACKUP=%%B"',
     "      goto backup_restored",
     "    )",
     "  )",
@@ -162,7 +161,7 @@ export function buildWindowsServiceScript(
     '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] no restorable backup found',
     "goto :eof",
     ":backup_restored",
-    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from %OCX_RESTORED_BACKUP%',
+    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from transactional-update backup',
     "goto :eof",
   ].filter((line): line is string => Boolean(line));
   return `${lines.join("\r\n")}\r\n`;

package/src/service-manager-probe.ts

@@ -29,6 +29,7 @@ import {
 import { decodeWindowsTextBytes } from "./lib/windows-text";
 import { WINSW_SERVICE_ID } from "./lib/winsw";
 import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV } from "./lib/bun-runtime";
+import { REAL_BUN_MIN_BYTES } from "./lib/bun-binary-validator.mjs";
 import { WINDOWS_WRAPPER_PROTOCOL_ENV, WINDOWS_WRAPPER_STAY_OUT_EXIT_CODE } from "./service/windows-wrapper-exit";
 import { buildWindowsServiceScript, windowsTaskActionMatches } from "./service/windows-taskxml";
 import { inspectServiceStateEvidence, serviceStatePathsForOpenCodexHome } from "./service/state";
@@ -613,8 +614,41 @@ function matchesGeneratedStandaloneControlFlow(body: string, port: number): bool
     scriptLines.filter((line, index) => index >= end || line === 'set "ERRORLEVEL="' || !line.startsWith('set "'));
   const actualFlow = withoutPrefixSets(lines, boundary);
   const generatedFlow = withoutPrefixSets(expected, expectedBoundary);
-  return actualFlow.length === generatedFlow.length
-    && actualFlow.every((line, index) => line === generatedFlow[index]);
+  // Read-only recognition of the exact previous generator output keeps installed
+  // standalone services identifiable across the backup-log hardening update.
+  // Never emit or execute this legacy variant; every other control line still matches.
+  const legacyFlow = generatedFlow.flatMap(line => {
+    if (line === "      goto backup_restored") return ['      set "OCX_RESTORED_BACKUP=%%B"', line];
+    if (line === '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from transactional-update backup') {
+      return ['>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from %OCX_RESTORED_BACKUP%'];
+    }
+    return [line];
+  });
+  // Also recognize the exact pre-placeholder version, not a partial size-gate
+  // hybrid. Only remove these complete known blocks from trusted generator output.
+  const beforePlaceholderGate = (flow: string[]): string[] | null => {
+    const blocks = [
+      ['set "OCX_BUN_BYTES="', 'for %%F in ("%OCX_BUN%") do set "OCX_BUN_BYTES=%%~zF"',
+        'if not defined OCX_BUN_BYTES goto bun_not_ready', `if %OCX_BUN_BYTES% LSS ${REAL_BUN_MIN_BYTES} goto bun_not_ready`],
+      [":bun_not_ready",
+        '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] bundled Bun is not ready (%OCX_BUN_BYTES% bytes, npm placeholder or mid-install); waiting for its postinstall, retrying in 5s - if this persists, reinstall opencodex with bun scripts allowed',
+        "ping -n 6 127.0.0.1 >nul", "goto loop"],
+    ];
+    let earlier = flow;
+    for (const block of blocks) {
+      const at = earlier.indexOf(block[0]!);
+      if (at < 0 || !block.every((line, offset) => earlier[at + offset] === line)) return null;
+      earlier = [...earlier.slice(0, at), ...earlier.slice(at + block.length)];
+    }
+    return earlier;
+  };
+  const recognized = [generatedFlow, legacyFlow];
+  for (const flow of [...recognized]) {
+    const earlier = beforePlaceholderGate(flow);
+    if (earlier) recognized.push(earlier);
+  }
+  return recognized.some(expectedFlow => actualFlow.length === expectedFlow.length
+    && actualFlow.every((line, index) => line === expectedFlow[index]));
 }
 
 /** Validate the generated launch shape before interpreting omitted optional homes. */