@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/adapters/openai-responses/request-strips.ts

@@ -191,12 +191,18 @@ export function stripRejectedSamplingParams(
 }
 
 /**
- * When `store` is false, the upstream API does not persist response items. Any item ID
+ * When `store: false`, the upstream cannot retrieve stored turns by ID. An ID
  * forwarded in `input` is then interpreted as a reference to a stored item that does not
- * exist, producing a 404. Strip all item IDs in this case — `call_id` pairing is unaffected.
+ * exist, producing a 404. Strip all item IDs in this case unless `preserveIds` is true
+ * — `call_id` pairing is unaffected. Also repairs missing or broken xAI custom_tool_call IDs
+ * when `requireCustomCallIds` is true, regardless of `preserveIds`.
  * Matches codex-rs behavior (core/src/client.rs:918-925).
  */
-export function stripItemIdsWhenUnstored(body: unknown, requireCustomCallIds = false): unknown {
+export function stripItemIdsWhenUnstored(
+  body: unknown,
+  requireCustomCallIds = false,
+  preserveIds = false,
+): unknown {
   const repairCustomCallIds = requireCustomCallIds === true;
   if (!isPlainObject(body) || (body.store !== false && !repairCustomCallIds)) return body;
   if (!Array.isArray(body.input)) return body;
@@ -226,7 +232,7 @@ export function stripItemIdsWhenUnstored(body: unknown, requireCustomCallIds = f
         return item;
       }
     }
-    if (body.store !== false || !("id" in item)) return item;
+    if (preserveIds || body.store !== false || !("id" in item)) return item;
     changed = true;
     const next = { ...item };
     delete next.id;

package/src/adapters/zed.ts

@@ -5,7 +5,8 @@ import { createGoogleAdapter } from "./google";
 import { createOpenAIChatAdapter } from "./openai-chat";
 import { createResponsesPassthroughAdapter } from "./openai-responses";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../types";
-import { createTranslatorBudget, type TranslatorBudget } from "../lib/translator-budget";
+import { createTranslatorBudget, releaseTranslatedEvent, retainTranslatedEvent, type TranslatorBudget } from "../lib/translator-budget";
+import { releaseCompactionCiphertextLease } from "../responses/compaction";
 import { redactSecretString } from "../lib/redact";
 import {
   normalizeZedProvider,
@@ -365,12 +366,33 @@ export function createZedAdapter(provider: OcxProviderConfig): ProviderAdapter {
         status: response.status,
         headers: { "Content-Type": "text/event-stream" },
       });
-      yield* delegate.adapter.parseStream(translated, budget);
+      try {
+        yield* delegate.adapter.parseStream(translated, budget);
+      } finally {
+        // Some delegates only unlock their reader when a collector stops early.
+        try { await translated.body?.cancel(); } catch { /* already closed/errored */ }
+      }
     },
     async parseResponse(response: Response, budget: TranslatorBudget): Promise<AdapterEvent[]> {
       const events: AdapterEvent[] = [];
-      for await (const event of adapter.parseStream(response, budget)) events.push(event);
-      return events;
+      try {
+        for await (const event of adapter.parseStream(response, budget)) {
+          try {
+            retainTranslatedEvent(event, budget, events.at(-1));
+          } catch (error) {
+            releaseCompactionCiphertextLease(event, budget);
+            throw error;
+          }
+          events.push(event);
+        }
+        return events;
+      } catch (error) {
+        for (const event of events) {
+          releaseTranslatedEvent(event, budget);
+          releaseCompactionCiphertextLease(event, budget);
+        }
+        throw error;
+      }
     },
   };
   return adapter;

package/src/bridge/response-json.ts

@@ -17,7 +17,7 @@ import {
   type OcxErrorPayload,
 } from "../lib/errors";
 import { mayBecomePatchEnvelope, repairFreeformToolInput } from "../responses/apply-patch-envelope";
-import { encodeCompactionSummary } from "../responses/compaction";
+import { encodeCompactionSummary, releaseCompactionCiphertextLease } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
 import { encodeReasoningEnvelope, type ReasoningEnvelope } from "../responses/reasoning-envelope";
@@ -59,21 +59,21 @@ export function buildResponseJSON(
 ): Record<string, unknown> {
   // Default-budget safety net: a caller that omits the budget gets a bounded
   // default (disposed with the call), never the unbounded append path.
-  if (options?.translatorBudget) {
-    const body = buildResponseJSONWithBudget(events, modelId, options);
-    // A buffered turn delivers its whole answer as one body, so nothing calls the per-frame
-    // recorder on the SSE bridge. Without this the attempt would persist adapter events with
-    // zero relayed ones, which is the loss signal -- raised on every non-streaming request.
-    if (options.recordBufferedDelivery !== false) {
-      attemptDeliveryRecorder(options.translatorBudget)?.noteBufferedDelivery(body);
+  const ownsBudget = !options?.translatorBudget;
+  const budget = options?.translatorBudget ?? createTranslatorBudget();
+  try {
+    const body = buildResponseJSONWithBudget(events, modelId, { ...options, translatorBudget: budget });
+    // Buffered delivery has no per-frame recorder; retain its existing one-shot attribution.
+    if (options?.translatorBudget && options.recordBufferedDelivery !== false) {
+      attemptDeliveryRecorder(budget)?.noteBufferedDelivery(body);
     }
     return body;
-  }
-  const budget = createTranslatorBudget();
-  try {
-    return buildResponseJSONWithBudget(events, modelId, { ...options, translatorBudget: budget });
   } finally {
-    budget.dispose();
+    for (const event of events) {
+      releaseTranslatedEvent(event, budget);
+      releaseCompactionCiphertextLease(event, budget);
+    }
+    if (ownsBudget) budget.dispose();
   }
 }
 
@@ -618,7 +618,7 @@ function buildResponseJSONWithBudget(
       type: "compaction", id: `cmp_${uuid()}`,
       encrypted_content: compactionEncryptedContent ?? encodeCompactionSummary(joinChunks(batchCompaction)),
     };
-    pushOutput(item, compactionEncryptedContent ? bytesOf(compactionEncryptedContent) : batchCompaction.bytes);
+    pushOutput(item, compactionEncryptedContent ? 0 : batchCompaction.bytes);
   }
 
   const failure = errorEvent ? adapterFailureFromEvent(errorEvent) : undefined;

package/src/bridge/sse.ts

@@ -22,7 +22,7 @@ import {
   repairFreeformToolInput,
 } from "../responses/apply-patch-envelope";
 import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
-import { encodeCompactionSummary } from "../responses/compaction";
+import { encodeCompactionSummary, releaseCompactionCiphertextLease } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
 import { mayBecomeCodeModeShellInput } from "../responses/code-mode-shell-input";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
@@ -714,6 +714,10 @@ export function bridgeToResponsesSSE(
         firstOutputReported = true;
         try { options?.onFirstOutput?.(); } catch { /* metrics must not break the stream */ }
       };
+      const releaseEvent = (event: AdapterEvent) => {
+        releaseTranslatedEvent(event, budget);
+        releaseCompactionCiphertextLease(event, budget);
+      };
       const it = events[Symbol.asyncIterator]();
       let iteratorStarted = false;
       let iteratorReturned = false;
@@ -734,8 +738,11 @@ export function bridgeToResponsesSSE(
         if (!iteratorStarted) {
           iteratorStarted = true;
           try {
-            void it.next().then(finishReturn, () => {}).catch(() => {});
+            void it.next().then(next => {
+              try { if (!next.done) releaseEvent(next.value); } finally { finishReturn(); }
+            }, finishReturn).catch(() => {});
           } catch {
+            finishReturn();
             /* synchronous iterator start failure is also best-effort */
           }
           return;
@@ -809,6 +816,7 @@ export function bridgeToResponsesSSE(
         while (!terminated && !closed && emittedFrames === emittedAtStart) {
           iteratorStarted = true;
           const next = await it.next();
+          try {
           // A cancel during this await disposes the owned budget; a late event
           // must never be processed or charged against it. Exit step() outright:
           // falling into EOF synthesis would let closeCurrentMessage() charge
@@ -1228,9 +1236,8 @@ export function bridgeToResponsesSSE(
                   encrypted_content: event.compactionEncryptedContent ?? encodeCompactionSummary(joinChunks(compaction)),
                 };
                 emit("response.output_item.done", { output_index: outputIndex, item });
-                retainFinishedItem(item as OutputItem, event.compactionEncryptedContent
-                  ? bytesOf(event.compactionEncryptedContent)
-                  : compaction.bytes);
+                retainFinishedItem(item as OutputItem, event.compactionEncryptedContent ? 0 : compaction.bytes);
+                releaseCompactionCiphertextLease(event, budget);
                 outputIndex++;
               }
               // Recognize every adapter's truncation vocabulary, not just the canonical pair.
@@ -1333,6 +1340,9 @@ export function bridgeToResponsesSSE(
             terminated = true;
             break;
           }
+          } finally {
+            if (!next.done) releaseEvent(next.value);
+          }
         }
       } catch (err) {
         if (isTranslatorBudgetExceededError(err)) {

package/src/chatgpt/app-server-shim/bundle-trust.ts

@@ -1,10 +1,10 @@
 import { spawnSync } from "node:child_process";
 import { lstatSync } from "node:fs";
-import { dirname, relative, sep } from "node:path";
+import { dirname, join, relative, sep } from "node:path";
 
 /**
- * The launcher persistently execs a binary taken from a discovered bundle, so the bundle must be
- * one this user can trust: OpenAI-signed, and not replaceable by another local account. Bundle
+ * Launch and restore execute code from a discovered bundle, so the bundle must be
+ * OpenAI-signed and pass ownership/permission checks along its filesystem path. Bundle
  * identifier alone (what discovery checks) is plain text in Info.plist that anyone can copy.
  */
 export const OPENAI_TEAM_ID = "2DC432GLL2";
@@ -14,17 +14,23 @@ const CODESIGN_TIMEOUT_MS = 30_000;
 
 export interface BundleTrustDeps {
   readonly uid: number;
-  stat(path: string): { uid: number; mode: number; isFile: boolean; isDirectory: boolean; isSymbolicLink: boolean } | null;
+  readonly adminGroupId?: number;
+  stat(path: string): { uid: number; gid?: number; mode: number; isFile: boolean; isDirectory: boolean; isSymbolicLink: boolean } | null;
   codesign(args: readonly string[]): { status: number | null; output: string };
 }
 
 export function defaultBundleTrustDeps(): BundleTrustDeps {
+  const admin = spawnSync("/usr/bin/dscl", [".", "-read", "/Groups/admin", "PrimaryGroupID"], {
+    encoding: "utf8", timeout: 5000,
+  });
+  const adminId = admin.status === 0 ? /^PrimaryGroupID: ([0-9]+)\s*$/.exec(admin.stdout)?.[1] : undefined;
   return {
+    adminGroupId: adminId === undefined ? undefined : Number(adminId),
     uid: typeof process.getuid === "function" ? process.getuid() : -1,
     stat(path) {
       try {
         const s = lstatSync(path);
-        return { uid: s.uid, mode: s.mode, isFile: s.isFile(), isDirectory: s.isDirectory(), isSymbolicLink: s.isSymbolicLink() };
+        return { uid: s.uid, gid: s.gid, mode: s.mode, isFile: s.isFile(), isDirectory: s.isDirectory(), isSymbolicLink: s.isSymbolicLink() };
       } catch {
         return null;
       }
@@ -46,26 +52,50 @@ function ownedSafely(deps: BundleTrustDeps, path: string, kind: "file" | "direct
   return null;
 }
 
+/** Protect the bundle's directory entry all the way to the filesystem root. */
+function untrustedAncestorReason(bundleRoot: string, deps: BundleTrustDeps): string | null {
+  for (let dir = dirname(bundleRoot); ; dir = dirname(dir)) {
+    const s = deps.stat(dir);
+    if (!s || !s.isDirectory || s.isSymbolicLink) return `${dir} is not a regular ancestor directory`;
+    if (s.uid !== 0 && s.uid !== deps.uid) return `${dir} is owned by another user`;
+    // A trusted sticky parent protects the already-checked child from replacement.
+    // Root-owned admin-group install containers are privileged OS-controlled paths;
+    // resolve that group from the local directory service rather than assuming a GID.
+    const sticky = (s.mode & 0o1000) !== 0;
+    const privileged = s.uid === 0 && (s.mode & 0o002) === 0
+      && deps.adminGroupId !== undefined && s.gid === deps.adminGroupId;
+    if ((s.mode & 0o022) !== 0 && !sticky && !privileged) return `${dir} is writable by group or others`;
+    if (dirname(dir) === dir) return null;
+  }
+}
+
 /**
- * Null when the bundle root and the app-server binary inside it may be exec'd by this user;
- * otherwise a short reason. Every directory from the binary up to the bundle root, and the
+ * Null when the bundle root and the selected executable may be run by this user.
+ * Restore omits the app-server binary and validates the app shell instead, so a missing
+ * app-server does not prevent returning to a normal launch. Otherwise returns a short reason.
+ * Every directory from the binary up to the bundle root, and the
  * binary itself, must be owned by root or this user and not group/other-writable, and both the
  * bundle and the binary must pass strict code-signature verification under OpenAI's team ID.
+ * Ancestors above the bundle are also checked for POSIX directory-entry replacement rights.
  */
 export function untrustedChatgptBundleReason(
   bundleRoot: string,
-  binary: string,
+  binary: string | undefined = undefined,
   deps: BundleTrustDeps = defaultBundleTrustDeps(),
 ): string | null {
+  const label = binary === undefined ? "app executable" : "app-server binary";
+  binary ??= join(bundleRoot, "Contents", "MacOS", "ChatGPT");
   const inside = relative(bundleRoot, binary);
-  if (!inside || inside.startsWith("..") || inside.startsWith(sep)) return "the app-server binary is outside the bundle";
+  if (!inside || inside.startsWith("..") || inside.startsWith(sep)) return `the ${label} is outside the bundle`;
   const fileProblem = ownedSafely(deps, binary, "file");
-  if (fileProblem) return `the app-server binary ${fileProblem}`;
+  if (fileProblem) return `the ${label} ${fileProblem}`;
   for (let dir = dirname(binary); ; dir = dirname(dir)) {
     const dirProblem = ownedSafely(deps, dir, "directory");
     if (dirProblem) return `${dir} ${dirProblem}`;
     if (dir === bundleRoot || dirname(dir) === dir) break;
   }
+  const ancestorProblem = untrustedAncestorReason(bundleRoot, deps);
+  if (ancestorProblem) return ancestorProblem;
   for (const target of [bundleRoot, binary]) {
     if (deps.codesign(["--verify", "--strict", target]).status !== 0) return `${target} failed code-signature verification`;
     const details = deps.codesign(["-dv", "--verbose=2", target]);

package/src/chatgpt/app-server-shim/gate-rewrite.ts

@@ -38,7 +38,10 @@ export function unlockRateLimitGate(value: unknown): boolean {
       return { cleared, exhausted, blocked };
     }
     if (!isRecord(node)) return { cleared, exhausted, blocked };
+    // A usage window at 100%, in either spelling the gate fields come in: `usedPercent` in the
+    // app-server's JSON-RPC, `used_percent` in the web usage snapshot.
     if (typeof node.usedPercent === "number" && node.usedPercent >= 100) exhausted = true;
+    if (typeof node.used_percent === "number" && node.used_percent >= 100) exhausted = true;
     if (node.spendControlReached !== undefined && node.spendControlReached !== null && node.spendControlReached !== false) blocked = true;
     if (isRecord(node.spend_control) && node.spend_control.reached === true) blocked = true;
     const reachedType = node.rate_limit_reached_type;

package/src/claude/agents-inject.ts

@@ -15,14 +15,12 @@ import { lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileS
 import { join } from "node:path";
 import type { OcxConfig } from "../types";
 import { renameAtomicFile } from "../lib/windows-atomic-replace";
-import { claudeCodeAlias, claudeCodeNativeAlias } from "./alias";
-import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, withOneMillionMarker } from "./context-windows";
+import { entryParts, SAFE_AGENT_MODEL_ID, withSubagentContextMarker } from "./subagent-model";
+import { stripOneMillionMarker } from "./context-windows";
 import { claudeConfigDir } from "./gateway-cache";
-import { DEFAULT_SUBAGENT_MODELS, hasOwnProvider } from "../config";
+import { DEFAULT_SUBAGENT_MODELS } from "../config";
 import { effectiveBlockedSkillNames, resolveInboundModel } from "./inbound";
 import { AnthropicRequestError } from "./inbound-records";
-import { knownModelIdsForProvider } from "../router";
-import { decodeRoutedModelIdOrThrow } from "../providers/slug-codec";
 import { siblingOfLivePort } from "../codex/sibling-start";
 
 export interface ClaudeAgentDef {
@@ -37,7 +35,7 @@ export interface ClaudeAgentDef {
 const OWNED_PREFIX = "ocx-";
 /** Ownership proof (audit 071 #2): a file without this marker is NEVER touched. */
 const GENERATED_MARKER = "generated-by: opencodex";
-const SAFE_AGENT_MODEL_ID = /^[a-z0-9][a-z0-9._:/@+\[\]~-]*$/i;
+
 
 function sanitizeName(value: string): string {
   const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -59,43 +57,6 @@ function pickerDefaultModel(configDir: string): string | null {
   }
 }
 
-/** Roster entry -> alias + display parts. Entries are bare native slugs or "provider/id".
- * Codex-facing encoded ids (`provider/vendor-model`) decode to the native slash id first
- * so the alias joins the raw-native context-window map (context-windows.ts). */
-
-/**
- * Generated subagent defs cannot rely on the parent's auto-context compaction
- * pairing, so their [1m] marker follows the AUTHORITATIVE window only: mark when
- * the effective window (exact selector, then the canonical [1m] form, then bare)
- * is genuinely >= 1M; strip an inherited unsafe marker back to the bare selector;
- * with no window information, keep the selector as it was. Genuine routed [1m]
- * ids are preserved through the canonical-exact lookup. (#854)
- */
-function withSubagentContextMarker(selector: string, windows: Record<string, number>): string {
-  const bare = stripOneMillionMarker(selector);
-  const wasMarked = selector !== bare;
-  const canonicalExact = wasMarked ? `${bare}[1m]` : selector;
-  const authoritativeWindow = windows[selector] ?? windows[canonicalExact] ?? windows[bare];
-  if (typeof authoritativeWindow === "number" && authoritativeWindow > 0) {
-    return shouldMarkOneMillion(authoritativeWindow, AUTO_CONTEXT_OFF)
-      ? (withOneMillionMarker(selector, windows) ?? selector)
-      : bare;
-  }
-  return wasMarked ? selector : bare;
-}
-function entryParts(entry: string, config: OcxConfig): { alias: string; id: string; provider: string } {
-  const slash = entry.indexOf("/");
-  if (slash > 0) {
-    const provider = entry.slice(0, slash);
-    const prov = hasOwnProvider(config.providers, provider) ? config.providers[provider] : undefined;
-    const id = prov
-      ? decodeRoutedModelIdOrThrow(entry.slice(slash + 1), knownModelIdsForProvider(provider, prov, config))
-      : entry.slice(slash + 1);
-    return { alias: claudeCodeAlias(provider, id), id, provider };
-  }
-  return { alias: claudeCodeNativeAlias(entry), id: entry, provider: "native" };
-}
-
 export function buildClaudeAgentDefs(
   config: OcxConfig,
   windows: Record<string, number>,

package/src/claude/gateway-cache.ts

@@ -73,19 +73,13 @@ export function writeGatewayModelCache(baseUrl: string, models: readonly Gateway
   }
 }
 
-/** Fetch the anthropic-flavor /v1/models from the local proxy and write the cache. */
-export async function refreshGatewayModelCacheFromProxy(
-  port: number,
-  options?: GatewayModelCacheRefreshOptions,
-): Promise<string | null>;
-export async function refreshGatewayModelCacheFromProxy(
-  target: GatewayModelTarget,
-  options?: GatewayModelCacheRefreshOptions,
-): Promise<string | null>;
-export async function refreshGatewayModelCacheFromProxy(
+export interface GatewayModelSnapshot { baseUrl: string; models: GatewayModelRow[] }
+
+/** Acquire fresh exposure independently of whether the local cache is writable. */
+export async function fetchGatewayModels(
   portOrTarget: number | GatewayModelTarget,
   options: GatewayModelCacheRefreshOptions = {},
-): Promise<string | null> {
+): Promise<GatewayModelSnapshot | null> {
   try {
     const headers = new Headers({ "anthropic-version": "2023-06-01" });
     // A wildcard/non-loopback listener requires data-plane admission even for a
@@ -114,14 +108,23 @@ export async function refreshGatewayModelCacheFromProxy(
     const body = await res.json() as { data?: unknown };
     if (!Array.isArray(body.data)) return null;
     const models: GatewayModelRow[] = body.data
-      .filter(m => typeof m.id === "string" && (m.id as string).length > 0)
+      .filter(m => m && typeof m === "object" && typeof m.id === "string" && m.id.length > 0)
       .map(m => ({
         id: m.id as string,
         display_name: typeof m.display_name === "string" ? m.display_name : undefined,
         description: typeof m.description === "string" ? m.description : undefined,
       }));
-    return writeGatewayModelCache(baseUrl, models, options.configDir);
+    return { baseUrl, models };
   } catch {
     return null;
   }
 }
+
+/** Preserve the cache-refresh API used by launchers and profile application. */
+export async function refreshGatewayModelCacheFromProxy(
+  portOrTarget: number | GatewayModelTarget,
+  options: GatewayModelCacheRefreshOptions = {},
+): Promise<string | null> {
+  const snapshot = await fetchGatewayModels(portOrTarget, options);
+  return snapshot ? writeGatewayModelCache(snapshot.baseUrl, snapshot.models, options.configDir) : null;
+}

package/src/claude/inbound-model-options.ts

@@ -1,4 +1,4 @@
-import type { OcxClaudeCodeConfig } from "../types";
+import type { OcxConfig, OcxClaudeCodeConfig } from "../types";
 import { isAnthropicOutputSchema, satisfiesOpenAiStrictSchema } from "../adapters/anthropic-output-schema";
 import { resolveAlias } from "./alias";
 import { stripOneMillionMarker } from "./context-windows";
@@ -153,7 +153,14 @@ export function extractOcxRouteDirective(body: unknown): string | null {
   const text = systemText(body);
   if (!text) return null;
   const match = OCX_ROUTE_RE.exec(text);
-  return match ? match[1]! : null;
+  if (!match) return null;
+  // Explicit gateway selection belongs to this invocation, not the mutable saved
+  // force setting. Bare Claude ids still need the legacy frontmatter fallback.
+  if (isRec(body) && typeof body.model === "string") {
+    const selector = stripOneMillionMarker(body.model);
+    if (resolveAlias(selector) || resolveDesktop3pAlias(selector)) return body.model;
+  }
+  return match[1]!;
 }
 
 /**

package/src/claude/intercept/cli-catalog.ts

@@ -17,6 +17,7 @@ import { join } from "node:path";
 import type { ClaudeFirstPartyDesired } from "../first-party-settings";
 import { classifyInterceptClient } from "./client-class";
 import { BOOTSTRAP_MAX_DECODED_BYTES, injectPickerModels, type PickerModelEntry } from "./picker-bootstrap";
+import { PickerRewriteBudget } from "./picker-budget";
 
 export type CliCatalogKind = "model_selector" | "bootstrap";
 
@@ -60,26 +61,36 @@ export function injectCliBootstrapOptions(bootstrap: unknown, models: readonly P
   if (current !== undefined && current !== null && !Array.isArray(current)) return 0;
   const options = Array.isArray(current) ? current : [];
   const existing = new Set(options.map(option => record(option)?.model));
-  let added = 0;
-  for (const model of models) {
-    if (existing.has(model.id)) continue;
-    options.push({ model: model.id, name: model.name, description: model.description ?? "" });
-    existing.add(model.id);
-    added++;
-  }
-  if (added > 0) body.additional_model_options = options;
-  return added;
+  const additions: Record<string, unknown>[] = [];
+  try {
+    const budget = new PickerRewriteBudget(body);
+    // A missing/null property needs a key and array, plus a possible separator (conservative).
+    if (!Array.isArray(current)) budget.reserveBytes(32);
+    for (const model of models) {
+      if (existing.has(model.id)) continue;
+      const row = { model: model.id, name: model.name, description: model.description ?? "" };
+      budget.reserveRow(row);
+      additions.push(row);
+      existing.add(model.id);
+    }
+  } catch { return 0; } // Fail open without mutating the original options.
+  for (const row of additions) options.push(row);
+  if (additions.length > 0) body.additional_model_options = options;
+  return additions.length;
 }
 
 /** Rewrite a decoded catalog body; `null` when nothing was added or the body is not the expected shape. */
 export function rewriteCliCatalogBody(kind: CliCatalogKind, text: string, models: readonly PickerModelEntry[]): string | null {
-  if (models.length === 0) return null;
-  let parsed: unknown;
-  try { parsed = JSON.parse(text); } catch { return null; }
-  const added = kind === "bootstrap"
-    ? injectCliBootstrapOptions(parsed, models)
-    : injectPickerModels(parsed, models, undefined, { surfaces: CLI_PICKER_SURFACE_IDS, extraStrippedKeys: CLI_EXTRA_STRIPPED_KEYS });
-  return added > 0 ? JSON.stringify(parsed) : null;
+  if (models.length === 0 || Buffer.byteLength(text) > BOOTSTRAP_MAX_DECODED_BYTES) return null;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    const added = kind === "bootstrap"
+      ? injectCliBootstrapOptions(parsed, models)
+      : injectPickerModels(parsed, models, undefined, { surfaces: CLI_PICKER_SURFACE_IDS, extraStrippedKeys: CLI_EXTRA_STRIPPED_KEYS });
+    if (added === 0) return null;
+    const rewritten = JSON.stringify(parsed);
+    return Buffer.byteLength(rewritten) <= BOOTSTRAP_MAX_DECODED_BYTES ? rewritten : null;
+  } catch { return null; }
 }
 
 /** Read at most `cap` bytes; null (and the stream cancelled) once the body would exceed it. */

package/src/claude/intercept/picker-bootstrap.ts

@@ -3,6 +3,7 @@
  * A failed or inapplicable transform leaves the upstream bytes untouched.
  */
 import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+import { PICKER_MAX_OUTPUT_BYTES, PickerRewriteBudget, pickerRowBytes } from "./picker-budget";
 
 /** One opencodex model offered in Desktop's Code-tab picker. */
 export interface PickerModelEntry {
@@ -16,7 +17,7 @@ export interface PickerModelEntry {
 }
 
 export const BOOTSTRAP_MAX_ENCODED_BYTES = 4 * 1024 * 1024;
-export const BOOTSTRAP_MAX_DECODED_BYTES = 16 * 1024 * 1024;
+export const BOOTSTRAP_MAX_DECODED_BYTES = PICKER_MAX_OUTPUT_BYTES;
 const BOOTSTRAP_PATH = /^\/(?:edge-api|api)\/bootstrap(?:\/[A-Za-z0-9-]+\/app_start)?\/?$/;
 const REWRITE_REMOVED_HEADERS = new Set([
   "content-encoding", "content-length", "etag", "digest", "content-md5", "transfer-encoding",
@@ -56,11 +57,14 @@ export interface PickerInjectionOptions {
   extraStrippedKeys?: readonly string[];
 }
 
-function injectIntoSurface(
+interface SurfaceInjection { entries: unknown[]; additions: Record<string, unknown>[] }
+
+function planSurfaceInjection(
   surface: Record<string, unknown>,
   models: readonly PickerModelEntry[],
   stripped: readonly string[],
-): number | string {
+  budget: PickerRewriteBudget,
+): SurfaceInjection | string {
   if (!Array.isArray(surface.models)) return "no_models";
   const entries = surface.models as unknown[];
   const template = entries.map(record).find(entry =>
@@ -68,24 +72,28 @@ function injectIntoSurface(
     && !entry.disabled && !entry.disabled_reason && entry.section !== "deprecated");
   if (!template) return `no_template(models=${entries.length})`;
   const existing = new Set(entries.map(record).map(entry => entry?.id));
-  let added = 0;
+  // Strip by shallow projection before measuring or cloning retained metadata. Native rows stay intact.
+  const retained = { ...template };
+  for (const key of Object.keys(retained)) {
+    if (stripped.includes(key) || /version/i.test(key)
+      || ["id", "name", "section", "context_window"].includes(key)) delete retained[key];
+  }
+  pickerRowBytes(retained);
+  const additions: Record<string, unknown>[] = [];
   for (const model of models) {
     if (existing.has(model.id)) continue;
-    const copy = structuredClone(template);
+    const copy = { ...retained };
     copy.id = model.id;
     copy.name = model.name;
     copy.section = "main";
     if (model.contextWindow === undefined) delete copy.context_window;
     else copy.context_window = model.contextWindow;
-    for (const key of Object.keys(copy)) {
-      if (stripped.includes(key) || /version/i.test(key)) delete copy[key];
-    }
     if (model.description !== undefined) copy.description = model.description;
-    entries.push(copy);
+    budget.reserveRow(copy);
+    additions.push(copy);
     existing.add(model.id);
-    added++;
   }
-  return added;
+  return { entries, additions };
 }
 
 export function injectPickerModels(
@@ -110,10 +118,21 @@ export function injectPickerModels(
   }
   let added = 0;
   const skipped: string[] = [];
-  for (const surface of targets) {
-    const result = injectIntoSurface(surface, models, stripped);
-    if (typeof result === "number") added += result;
-    else skipped.push(`${String(surface.id)}:${result}`);
+  try {
+    const budget = new PickerRewriteBudget(bootstrap);
+    const plans: SurfaceInjection[] = [];
+    for (const surface of targets) {
+      const result = planSurfaceInjection(surface, models, stripped, budget);
+      if (typeof result === "string") skipped.push(`${String(surface.id)}:${result}`);
+      else { plans.push(result); added += result.additions.length; }
+    }
+    // All surfaces must fit before any deep clone or mutation; a refusal cannot publish a partial list.
+    const copies = plans.map(plan => plan.additions.map(row => structuredClone(row)));
+    for (let i = 0; i < plans.length; i++) {
+      for (const row of copies[i]!) plans[i]!.entries.push(row);
+    }
+  } catch {
+    return unchanged("rewrite_limit");
   }
   if (added === 0) return unchanged(skipped.length > 0 ? skipped.join(";") : models.length === 0 ? "no_routes" : "all_present");
   explain?.({ kind: "rewritten", added });
@@ -142,7 +161,9 @@ export function rewriteBootstrapBody(
     if (decoded.length > BOOTSTRAP_MAX_DECODED_BYTES) return unchanged("decoded_cap");
     const parsed: unknown = JSON.parse(decoded.toString("utf8"));
     if (injectPickerModels(parsed, models, explain) === 0) return null;
-    return Buffer.from(JSON.stringify(parsed), "utf8");
+    const text = JSON.stringify(parsed);
+    if (Buffer.byteLength(text) > BOOTSTRAP_MAX_DECODED_BYTES) return unchanged("rewrite_limit");
+    return Buffer.from(text, "utf8");
   } catch {
     return unchanged("decode_or_parse_failed");
   }