@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/bridge/response-json.ts

@@ -17,7 +17,7 @@ import {
   type OcxErrorPayload,
 } from "../lib/errors";
 import { mayBecomePatchEnvelope, repairFreeformToolInput } from "../responses/apply-patch-envelope";
-import { encodeCompactionSummary } from "../responses/compaction";
+import { encodeCompactionSummary, releaseCompactionCiphertextLease } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
 import { encodeReasoningEnvelope, type ReasoningEnvelope } from "../responses/reasoning-envelope";
@@ -59,21 +59,21 @@ export function buildResponseJSON(
 ): Record<string, unknown> {
   // Default-budget safety net: a caller that omits the budget gets a bounded
   // default (disposed with the call), never the unbounded append path.
-  if (options?.translatorBudget) {
-    const body = buildResponseJSONWithBudget(events, modelId, options);
-    // A buffered turn delivers its whole answer as one body, so nothing calls the per-frame
-    // recorder on the SSE bridge. Without this the attempt would persist adapter events with
-    // zero relayed ones, which is the loss signal -- raised on every non-streaming request.
-    if (options.recordBufferedDelivery !== false) {
-      attemptDeliveryRecorder(options.translatorBudget)?.noteBufferedDelivery(body);
+  const ownsBudget = !options?.translatorBudget;
+  const budget = options?.translatorBudget ?? createTranslatorBudget();
+  try {
+    const body = buildResponseJSONWithBudget(events, modelId, { ...options, translatorBudget: budget });
+    // Buffered delivery has no per-frame recorder; retain its existing one-shot attribution.
+    if (options?.translatorBudget && options.recordBufferedDelivery !== false) {
+      attemptDeliveryRecorder(budget)?.noteBufferedDelivery(body);
     }
     return body;
-  }
-  const budget = createTranslatorBudget();
-  try {
-    return buildResponseJSONWithBudget(events, modelId, { ...options, translatorBudget: budget });
   } finally {
-    budget.dispose();
+    for (const event of events) {
+      releaseTranslatedEvent(event, budget);
+      releaseCompactionCiphertextLease(event, budget);
+    }
+    if (ownsBudget) budget.dispose();
   }
 }
 
@@ -618,7 +618,7 @@ function buildResponseJSONWithBudget(
       type: "compaction", id: `cmp_${uuid()}`,
       encrypted_content: compactionEncryptedContent ?? encodeCompactionSummary(joinChunks(batchCompaction)),
     };
-    pushOutput(item, compactionEncryptedContent ? bytesOf(compactionEncryptedContent) : batchCompaction.bytes);
+    pushOutput(item, compactionEncryptedContent ? 0 : batchCompaction.bytes);
   }
 
   const failure = errorEvent ? adapterFailureFromEvent(errorEvent) : undefined;

package/src/bridge/sse.ts

@@ -22,7 +22,7 @@ import {
   repairFreeformToolInput,
 } from "../responses/apply-patch-envelope";
 import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
-import { encodeCompactionSummary } from "../responses/compaction";
+import { encodeCompactionSummary, releaseCompactionCiphertextLease } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
 import { mayBecomeCodeModeShellInput } from "../responses/code-mode-shell-input";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
@@ -714,6 +714,10 @@ export function bridgeToResponsesSSE(
         firstOutputReported = true;
         try { options?.onFirstOutput?.(); } catch { /* metrics must not break the stream */ }
       };
+      const releaseEvent = (event: AdapterEvent) => {
+        releaseTranslatedEvent(event, budget);
+        releaseCompactionCiphertextLease(event, budget);
+      };
       const it = events[Symbol.asyncIterator]();
       let iteratorStarted = false;
       let iteratorReturned = false;
@@ -734,8 +738,11 @@ export function bridgeToResponsesSSE(
         if (!iteratorStarted) {
           iteratorStarted = true;
           try {
-            void it.next().then(finishReturn, () => {}).catch(() => {});
+            void it.next().then(next => {
+              try { if (!next.done) releaseEvent(next.value); } finally { finishReturn(); }
+            }, finishReturn).catch(() => {});
           } catch {
+            finishReturn();
             /* synchronous iterator start failure is also best-effort */
           }
           return;
@@ -809,6 +816,7 @@ export function bridgeToResponsesSSE(
         while (!terminated && !closed && emittedFrames === emittedAtStart) {
           iteratorStarted = true;
           const next = await it.next();
+          try {
           // A cancel during this await disposes the owned budget; a late event
           // must never be processed or charged against it. Exit step() outright:
           // falling into EOF synthesis would let closeCurrentMessage() charge
@@ -1228,9 +1236,8 @@ export function bridgeToResponsesSSE(
                   encrypted_content: event.compactionEncryptedContent ?? encodeCompactionSummary(joinChunks(compaction)),
                 };
                 emit("response.output_item.done", { output_index: outputIndex, item });
-                retainFinishedItem(item as OutputItem, event.compactionEncryptedContent
-                  ? bytesOf(event.compactionEncryptedContent)
-                  : compaction.bytes);
+                retainFinishedItem(item as OutputItem, event.compactionEncryptedContent ? 0 : compaction.bytes);
+                releaseCompactionCiphertextLease(event, budget);
                 outputIndex++;
               }
               // Recognize every adapter's truncation vocabulary, not just the canonical pair.
@@ -1333,6 +1340,9 @@ export function bridgeToResponsesSSE(
             terminated = true;
             break;
           }
+          } finally {
+            if (!next.done) releaseEvent(next.value);
+          }
         }
       } catch (err) {
         if (isTranslatorBudgetExceededError(err)) {

package/src/chatgpt/app-server-shim/bundle-trust.ts

@@ -1,10 +1,10 @@
 import { spawnSync } from "node:child_process";
 import { lstatSync } from "node:fs";
-import { dirname, relative, sep } from "node:path";
+import { dirname, join, relative, sep } from "node:path";
 
 /**
- * The launcher persistently execs a binary taken from a discovered bundle, so the bundle must be
- * one this user can trust: OpenAI-signed, and not replaceable by another local account. Bundle
+ * Launch and restore execute code from a discovered bundle, so the bundle must be
+ * OpenAI-signed and pass ownership/permission checks along its filesystem path. Bundle
  * identifier alone (what discovery checks) is plain text in Info.plist that anyone can copy.
  */
 export const OPENAI_TEAM_ID = "2DC432GLL2";
@@ -14,17 +14,23 @@ const CODESIGN_TIMEOUT_MS = 30_000;
 
 export interface BundleTrustDeps {
   readonly uid: number;
-  stat(path: string): { uid: number; mode: number; isFile: boolean; isDirectory: boolean; isSymbolicLink: boolean } | null;
+  readonly adminGroupId?: number;
+  stat(path: string): { uid: number; gid?: number; mode: number; isFile: boolean; isDirectory: boolean; isSymbolicLink: boolean } | null;
   codesign(args: readonly string[]): { status: number | null; output: string };
 }
 
 export function defaultBundleTrustDeps(): BundleTrustDeps {
+  const admin = spawnSync("/usr/bin/dscl", [".", "-read", "/Groups/admin", "PrimaryGroupID"], {
+    encoding: "utf8", timeout: 5000,
+  });
+  const adminId = admin.status === 0 ? /^PrimaryGroupID: ([0-9]+)\s*$/.exec(admin.stdout)?.[1] : undefined;
   return {
+    adminGroupId: adminId === undefined ? undefined : Number(adminId),
     uid: typeof process.getuid === "function" ? process.getuid() : -1,
     stat(path) {
       try {
         const s = lstatSync(path);
-        return { uid: s.uid, mode: s.mode, isFile: s.isFile(), isDirectory: s.isDirectory(), isSymbolicLink: s.isSymbolicLink() };
+        return { uid: s.uid, gid: s.gid, mode: s.mode, isFile: s.isFile(), isDirectory: s.isDirectory(), isSymbolicLink: s.isSymbolicLink() };
       } catch {
         return null;
       }
@@ -46,26 +52,50 @@ function ownedSafely(deps: BundleTrustDeps, path: string, kind: "file" | "direct
   return null;
 }
 
+/** Protect the bundle's directory entry all the way to the filesystem root. */
+function untrustedAncestorReason(bundleRoot: string, deps: BundleTrustDeps): string | null {
+  for (let dir = dirname(bundleRoot); ; dir = dirname(dir)) {
+    const s = deps.stat(dir);
+    if (!s || !s.isDirectory || s.isSymbolicLink) return `${dir} is not a regular ancestor directory`;
+    if (s.uid !== 0 && s.uid !== deps.uid) return `${dir} is owned by another user`;
+    // A trusted sticky parent protects the already-checked child from replacement.
+    // Root-owned admin-group install containers are privileged OS-controlled paths;
+    // resolve that group from the local directory service rather than assuming a GID.
+    const sticky = (s.mode & 0o1000) !== 0;
+    const privileged = s.uid === 0 && (s.mode & 0o002) === 0
+      && deps.adminGroupId !== undefined && s.gid === deps.adminGroupId;
+    if ((s.mode & 0o022) !== 0 && !sticky && !privileged) return `${dir} is writable by group or others`;
+    if (dirname(dir) === dir) return null;
+  }
+}
+
 /**
- * Null when the bundle root and the app-server binary inside it may be exec'd by this user;
- * otherwise a short reason. Every directory from the binary up to the bundle root, and the
+ * Null when the bundle root and the selected executable may be run by this user.
+ * Restore omits the app-server binary and validates the app shell instead, so a missing
+ * app-server does not prevent returning to a normal launch. Otherwise returns a short reason.
+ * Every directory from the binary up to the bundle root, and the
  * binary itself, must be owned by root or this user and not group/other-writable, and both the
  * bundle and the binary must pass strict code-signature verification under OpenAI's team ID.
+ * Ancestors above the bundle are also checked for POSIX directory-entry replacement rights.
  */
 export function untrustedChatgptBundleReason(
   bundleRoot: string,
-  binary: string,
+  binary: string | undefined = undefined,
   deps: BundleTrustDeps = defaultBundleTrustDeps(),
 ): string | null {
+  const label = binary === undefined ? "app executable" : "app-server binary";
+  binary ??= join(bundleRoot, "Contents", "MacOS", "ChatGPT");
   const inside = relative(bundleRoot, binary);
-  if (!inside || inside.startsWith("..") || inside.startsWith(sep)) return "the app-server binary is outside the bundle";
+  if (!inside || inside.startsWith("..") || inside.startsWith(sep)) return `the ${label} is outside the bundle`;
   const fileProblem = ownedSafely(deps, binary, "file");
-  if (fileProblem) return `the app-server binary ${fileProblem}`;
+  if (fileProblem) return `the ${label} ${fileProblem}`;
   for (let dir = dirname(binary); ; dir = dirname(dir)) {
     const dirProblem = ownedSafely(deps, dir, "directory");
     if (dirProblem) return `${dir} ${dirProblem}`;
     if (dir === bundleRoot || dirname(dir) === dir) break;
   }
+  const ancestorProblem = untrustedAncestorReason(bundleRoot, deps);
+  if (ancestorProblem) return ancestorProblem;
   for (const target of [bundleRoot, binary]) {
     if (deps.codesign(["--verify", "--strict", target]).status !== 0) return `${target} failed code-signature verification`;
     const details = deps.codesign(["-dv", "--verbose=2", target]);

package/src/chatgpt/app-server-shim/gate-rewrite.ts

@@ -38,7 +38,10 @@ export function unlockRateLimitGate(value: unknown): boolean {
       return { cleared, exhausted, blocked };
     }
     if (!isRecord(node)) return { cleared, exhausted, blocked };
+    // A usage window at 100%, in either spelling the gate fields come in: `usedPercent` in the
+    // app-server's JSON-RPC, `used_percent` in the web usage snapshot.
     if (typeof node.usedPercent === "number" && node.usedPercent >= 100) exhausted = true;
+    if (typeof node.used_percent === "number" && node.used_percent >= 100) exhausted = true;
     if (node.spendControlReached !== undefined && node.spendControlReached !== null && node.spendControlReached !== false) blocked = true;
     if (isRecord(node.spend_control) && node.spend_control.reached === true) blocked = true;
     const reachedType = node.rate_limit_reached_type;

package/src/claude/agents-inject.ts

@@ -15,14 +15,12 @@ import { lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileS
 import { join } from "node:path";
 import type { OcxConfig } from "../types";
 import { renameAtomicFile } from "../lib/windows-atomic-replace";
-import { claudeCodeAlias, claudeCodeNativeAlias } from "./alias";
-import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, withOneMillionMarker } from "./context-windows";
+import { entryParts, SAFE_AGENT_MODEL_ID, withSubagentContextMarker } from "./subagent-model";
+import { stripOneMillionMarker } from "./context-windows";
 import { claudeConfigDir } from "./gateway-cache";
-import { DEFAULT_SUBAGENT_MODELS, hasOwnProvider } from "../config";
+import { DEFAULT_SUBAGENT_MODELS } from "../config";
 import { effectiveBlockedSkillNames, resolveInboundModel } from "./inbound";
 import { AnthropicRequestError } from "./inbound-records";
-import { knownModelIdsForProvider } from "../router";
-import { decodeRoutedModelIdOrThrow } from "../providers/slug-codec";
 import { siblingOfLivePort } from "../codex/sibling-start";
 
 export interface ClaudeAgentDef {
@@ -37,7 +35,7 @@ export interface ClaudeAgentDef {
 const OWNED_PREFIX = "ocx-";
 /** Ownership proof (audit 071 #2): a file without this marker is NEVER touched. */
 const GENERATED_MARKER = "generated-by: opencodex";
-const SAFE_AGENT_MODEL_ID = /^[a-z0-9][a-z0-9._:/@+\[\]~-]*$/i;
+
 
 function sanitizeName(value: string): string {
   const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -59,43 +57,6 @@ function pickerDefaultModel(configDir: string): string | null {
   }
 }
 
-/** Roster entry -> alias + display parts. Entries are bare native slugs or "provider/id".
- * Codex-facing encoded ids (`provider/vendor-model`) decode to the native slash id first
- * so the alias joins the raw-native context-window map (context-windows.ts). */
-
-/**
- * Generated subagent defs cannot rely on the parent's auto-context compaction
- * pairing, so their [1m] marker follows the AUTHORITATIVE window only: mark when
- * the effective window (exact selector, then the canonical [1m] form, then bare)
- * is genuinely >= 1M; strip an inherited unsafe marker back to the bare selector;
- * with no window information, keep the selector as it was. Genuine routed [1m]
- * ids are preserved through the canonical-exact lookup. (#854)
- */
-function withSubagentContextMarker(selector: string, windows: Record<string, number>): string {
-  const bare = stripOneMillionMarker(selector);
-  const wasMarked = selector !== bare;
-  const canonicalExact = wasMarked ? `${bare}[1m]` : selector;
-  const authoritativeWindow = windows[selector] ?? windows[canonicalExact] ?? windows[bare];
-  if (typeof authoritativeWindow === "number" && authoritativeWindow > 0) {
-    return shouldMarkOneMillion(authoritativeWindow, AUTO_CONTEXT_OFF)
-      ? (withOneMillionMarker(selector, windows) ?? selector)
-      : bare;
-  }
-  return wasMarked ? selector : bare;
-}
-function entryParts(entry: string, config: OcxConfig): { alias: string; id: string; provider: string } {
-  const slash = entry.indexOf("/");
-  if (slash > 0) {
-    const provider = entry.slice(0, slash);
-    const prov = hasOwnProvider(config.providers, provider) ? config.providers[provider] : undefined;
-    const id = prov
-      ? decodeRoutedModelIdOrThrow(entry.slice(slash + 1), knownModelIdsForProvider(provider, prov, config))
-      : entry.slice(slash + 1);
-    return { alias: claudeCodeAlias(provider, id), id, provider };
-  }
-  return { alias: claudeCodeNativeAlias(entry), id: entry, provider: "native" };
-}
-
 export function buildClaudeAgentDefs(
   config: OcxConfig,
   windows: Record<string, number>,

package/src/claude/gateway-cache.ts

@@ -73,19 +73,13 @@ export function writeGatewayModelCache(baseUrl: string, models: readonly Gateway
   }
 }
 
-/** Fetch the anthropic-flavor /v1/models from the local proxy and write the cache. */
-export async function refreshGatewayModelCacheFromProxy(
-  port: number,
-  options?: GatewayModelCacheRefreshOptions,
-): Promise<string | null>;
-export async function refreshGatewayModelCacheFromProxy(
-  target: GatewayModelTarget,
-  options?: GatewayModelCacheRefreshOptions,
-): Promise<string | null>;
-export async function refreshGatewayModelCacheFromProxy(
+export interface GatewayModelSnapshot { baseUrl: string; models: GatewayModelRow[] }
+
+/** Acquire fresh exposure independently of whether the local cache is writable. */
+export async function fetchGatewayModels(
   portOrTarget: number | GatewayModelTarget,
   options: GatewayModelCacheRefreshOptions = {},
-): Promise<string | null> {
+): Promise<GatewayModelSnapshot | null> {
   try {
     const headers = new Headers({ "anthropic-version": "2023-06-01" });
     // A wildcard/non-loopback listener requires data-plane admission even for a
@@ -114,14 +108,23 @@ export async function refreshGatewayModelCacheFromProxy(
     const body = await res.json() as { data?: unknown };
     if (!Array.isArray(body.data)) return null;
     const models: GatewayModelRow[] = body.data
-      .filter(m => typeof m.id === "string" && (m.id as string).length > 0)
+      .filter(m => m && typeof m === "object" && typeof m.id === "string" && m.id.length > 0)
       .map(m => ({
         id: m.id as string,
         display_name: typeof m.display_name === "string" ? m.display_name : undefined,
         description: typeof m.description === "string" ? m.description : undefined,
       }));
-    return writeGatewayModelCache(baseUrl, models, options.configDir);
+    return { baseUrl, models };
   } catch {
     return null;
   }
 }
+
+/** Preserve the cache-refresh API used by launchers and profile application. */
+export async function refreshGatewayModelCacheFromProxy(
+  portOrTarget: number | GatewayModelTarget,
+  options: GatewayModelCacheRefreshOptions = {},
+): Promise<string | null> {
+  const snapshot = await fetchGatewayModels(portOrTarget, options);
+  return snapshot ? writeGatewayModelCache(snapshot.baseUrl, snapshot.models, options.configDir) : null;
+}

package/src/claude/inbound-model-options.ts

@@ -1,4 +1,4 @@
-import type { OcxClaudeCodeConfig } from "../types";
+import type { OcxConfig, OcxClaudeCodeConfig } from "../types";
 import { isAnthropicOutputSchema, satisfiesOpenAiStrictSchema } from "../adapters/anthropic-output-schema";
 import { resolveAlias } from "./alias";
 import { stripOneMillionMarker } from "./context-windows";
@@ -153,7 +153,14 @@ export function extractOcxRouteDirective(body: unknown): string | null {
   const text = systemText(body);
   if (!text) return null;
   const match = OCX_ROUTE_RE.exec(text);
-  return match ? match[1]! : null;
+  if (!match) return null;
+  // Explicit gateway selection belongs to this invocation, not the mutable saved
+  // force setting. Bare Claude ids still need the legacy frontmatter fallback.
+  if (isRec(body) && typeof body.model === "string") {
+    const selector = stripOneMillionMarker(body.model);
+    if (resolveAlias(selector) || resolveDesktop3pAlias(selector)) return body.model;
+  }
+  return match[1]!;
 }
 
 /**

package/src/claude/intercept/cli-catalog.ts

@@ -17,6 +17,7 @@ import { join } from "node:path";
 import type { ClaudeFirstPartyDesired } from "../first-party-settings";
 import { classifyInterceptClient } from "./client-class";
 import { BOOTSTRAP_MAX_DECODED_BYTES, injectPickerModels, type PickerModelEntry } from "./picker-bootstrap";
+import { PickerRewriteBudget } from "./picker-budget";
 
 export type CliCatalogKind = "model_selector" | "bootstrap";
 
@@ -60,26 +61,36 @@ export function injectCliBootstrapOptions(bootstrap: unknown, models: readonly P
   if (current !== undefined && current !== null && !Array.isArray(current)) return 0;
   const options = Array.isArray(current) ? current : [];
   const existing = new Set(options.map(option => record(option)?.model));
-  let added = 0;
-  for (const model of models) {
-    if (existing.has(model.id)) continue;
-    options.push({ model: model.id, name: model.name, description: model.description ?? "" });
-    existing.add(model.id);
-    added++;
-  }
-  if (added > 0) body.additional_model_options = options;
-  return added;
+  const additions: Record<string, unknown>[] = [];
+  try {
+    const budget = new PickerRewriteBudget(body);
+    // A missing/null property needs a key and array, plus a possible separator (conservative).
+    if (!Array.isArray(current)) budget.reserveBytes(32);
+    for (const model of models) {
+      if (existing.has(model.id)) continue;
+      const row = { model: model.id, name: model.name, description: model.description ?? "" };
+      budget.reserveRow(row);
+      additions.push(row);
+      existing.add(model.id);
+    }
+  } catch { return 0; } // Fail open without mutating the original options.
+  for (const row of additions) options.push(row);
+  if (additions.length > 0) body.additional_model_options = options;
+  return additions.length;
 }
 
 /** Rewrite a decoded catalog body; `null` when nothing was added or the body is not the expected shape. */
 export function rewriteCliCatalogBody(kind: CliCatalogKind, text: string, models: readonly PickerModelEntry[]): string | null {
-  if (models.length === 0) return null;
-  let parsed: unknown;
-  try { parsed = JSON.parse(text); } catch { return null; }
-  const added = kind === "bootstrap"
-    ? injectCliBootstrapOptions(parsed, models)
-    : injectPickerModels(parsed, models, undefined, { surfaces: CLI_PICKER_SURFACE_IDS, extraStrippedKeys: CLI_EXTRA_STRIPPED_KEYS });
-  return added > 0 ? JSON.stringify(parsed) : null;
+  if (models.length === 0 || Buffer.byteLength(text) > BOOTSTRAP_MAX_DECODED_BYTES) return null;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    const added = kind === "bootstrap"
+      ? injectCliBootstrapOptions(parsed, models)
+      : injectPickerModels(parsed, models, undefined, { surfaces: CLI_PICKER_SURFACE_IDS, extraStrippedKeys: CLI_EXTRA_STRIPPED_KEYS });
+    if (added === 0) return null;
+    const rewritten = JSON.stringify(parsed);
+    return Buffer.byteLength(rewritten) <= BOOTSTRAP_MAX_DECODED_BYTES ? rewritten : null;
+  } catch { return null; }
 }
 
 /** Read at most `cap` bytes; null (and the stream cancelled) once the body would exceed it. */

package/src/claude/intercept/client-hello.ts

@@ -0,0 +1,103 @@
+/**
+ * Reads the ALPN offer from a TLS ClientHello without terminating TLS.
+ *
+ * The picker listener uses it to send a client that offers `h2` to its HTTP/2 server and every
+ * other client to its HTTP/1.1 server. The ClientHello is reassembled from as many plaintext
+ * handshake records as it spans (RFC 8446 5.1 allows any split), within fixed byte and record
+ * limits. This is a routing hint, not validation: parsing stops at the ALPN decision, and the TLS
+ * server that receives the replayed bytes validates the handshake. Anything the parser cannot read
+ * up to that decision returns false, which keeps that client on HTTP/1.1, the behaviour before
+ * HTTP/2 existed here.
+ */
+
+/** Wire bytes the front reads before deciding; a real ClientHello is far smaller. */
+export const CLIENT_HELLO_MAX_BYTES = 64 * 1024;
+/** Handshake records one ClientHello may span. */
+export const CLIENT_HELLO_MAX_RECORDS = 16;
+
+const RECORD_HEADER_BYTES = 5;
+const RECORD_HANDSHAKE = 0x16;
+const MAX_RECORD_PAYLOAD = 16_384;
+const HANDSHAKE_CLIENT_HELLO = 0x01;
+const EXTENSION_ALPN = 0x0010;
+
+/**
+ * Whether the ClientHello at the start of `data` offers `h2` in ALPN. Returns null while more
+ * bytes are needed to decide, and false for anything else (not TLS, malformed, over a limit).
+ */
+export function clientHelloOffersH2(data: Uint8Array): boolean | null {
+  const handshake: Uint8Array[] = [];
+  let handshakeBytes = 0;
+  let at = 0;
+  for (let records = 0; ; records++) {
+    if (handshakeBytes >= 4) {
+      const first = concat(handshake, 4);
+      if (first[0] !== HANDSHAKE_CLIENT_HELLO) return false;
+      const needed = 4 + ((first[1]! << 16) | (first[2]! << 8) | first[3]!);
+      if (needed > CLIENT_HELLO_MAX_BYTES) return false;
+      if (handshakeBytes >= needed) return helloOffersH2(concat(handshake, needed).subarray(4));
+    }
+    if (records >= CLIENT_HELLO_MAX_RECORDS || at >= CLIENT_HELLO_MAX_BYTES) return false;
+    if (data.length < at + RECORD_HEADER_BYTES) return null;
+    if (data[at] !== RECORD_HANDSHAKE || data[at + 1] !== 0x03) return false;
+    const length = (data[at + 3]! << 8) | data[at + 4]!;
+    if (length === 0 || length > MAX_RECORD_PAYLOAD) return false;
+    const end = at + RECORD_HEADER_BYTES + length;
+    if (end > CLIENT_HELLO_MAX_BYTES) return false;
+    if (data.length < end) return null;
+    handshake.push(data.subarray(at + RECORD_HEADER_BYTES, end));
+    handshakeBytes += length;
+    at = end;
+  }
+}
+
+function concat(parts: readonly Uint8Array[], bytes: number): Uint8Array {
+  const out = new Uint8Array(bytes);
+  let offset = 0;
+  for (const part of parts) {
+    if (offset >= bytes) break;
+    const take = part.subarray(0, bytes - offset);
+    out.set(take, offset);
+    offset += take.length;
+  }
+  return out;
+}
+
+function helloOffersH2(hello: Uint8Array): boolean {
+  let at = 2 + 32; // legacy_version, random
+  const skip = (lengthBytes: 1 | 2): boolean => {
+    if (at + lengthBytes > hello.length) return false;
+    const length = lengthBytes === 1 ? hello[at]! : (hello[at]! << 8) | hello[at + 1]!;
+    at += lengthBytes + length;
+    return at <= hello.length;
+  };
+  if (!skip(1) || !skip(2) || !skip(1)) return false; // session id, cipher suites, compression
+  if (at + 2 > hello.length) return false; // no extensions block: no ALPN
+  const extensionsEnd = at + 2 + ((hello[at]! << 8) | hello[at + 1]!);
+  if (extensionsEnd > hello.length) return false;
+  at += 2;
+  // Unknown and GREASE extensions are skipped by their declared length, in any order.
+  while (at + 4 <= extensionsEnd) {
+    const type = (hello[at]! << 8) | hello[at + 1]!;
+    const length = (hello[at + 2]! << 8) | hello[at + 3]!;
+    const body = at + 4;
+    if (body + length > extensionsEnd) return false;
+    if (type === EXTENSION_ALPN) return alpnListOffersH2(hello.subarray(body, body + length));
+    at = body + length;
+  }
+  return false;
+}
+
+function alpnListOffersH2(extension: Uint8Array): boolean {
+  if (extension.length < 2) return false;
+  const end = 2 + ((extension[0]! << 8) | extension[1]!);
+  if (end > extension.length) return false;
+  for (let at = 2; at < end;) {
+    const length = extension[at]!;
+    const name = at + 1;
+    if (length === 0 || name + length > end) return false;
+    if (length === 2 && extension[name] === 0x68 && extension[name + 1] === 0x32) return true; // "h2"
+    at = name + length;
+  }
+  return false;
+}

package/src/claude/intercept/model-bindings.ts

@@ -113,7 +113,7 @@ export function parseInterceptBindingPatch(body: unknown): InterceptBindingPatch
     if (!set || typeof set !== "object" || Array.isArray(set)) return { error: "set must be an object of picker id to route" };
     const entries: Record<string, string> = {};
     for (const [id, route] of Object.entries(set as Record<string, unknown>)) {
-      if (!isInterceptBindingId(id)) return { error: `invalid picker id: ${id} (expected a claude- model id)` };
+      if (!isInterceptBindingId(id)) return { error: "invalid picker id (expected a claude- model id)" };
       if (!isInterceptBindingRoute(route)) return { error: `invalid route for ${id}` };
       entries[id] = route;
     }
@@ -137,7 +137,8 @@ export function applyInterceptBindingPatch(
 ): InterceptBindingPatchResult {
   const next: Record<string, string> = { ...current };
   for (const [id, route] of Object.entries(patch.set ?? {})) {
-    if (!availableRoutes.has(route)) return { ok: false, error: `route is not available: ${route}` };
+    // A rejected route is not echoed: whatever sits in that position may be a misplaced credential.
+    if (!availableRoutes.has(route)) return { ok: false, error: "route is not available (see ocx claude desktop show)" };
     next[id] = route;
   }
   for (const id of patch.remove ?? []) delete next[id];