@bitkyc08/opencodex 2.78.0 → 2.80.0

package/src/adapters/cursor/tool-guidance.ts

@@ -1,6 +1,7 @@
 import type { OcxRequestOptions, OcxTool } from "../../types";
+import { CURSOR_TOOL_CALL_CONTINUATION, cursorUsesPlainToolWording } from "./tool-wording";
 import { CODE_MODE_HOST_CONTRACT_SENTENCE, CODE_MODE_RESULT_ECHO_SENTENCE } from "../exec-tool-result-normalize";
-import { CODEX_SHELL_BRIDGE_TOOL_NAMES, CODEX_TOOL_SEARCH_TOOL, CODEX_UNIFIED_EXEC_TOOL, clientSemanticToolNameFromCursorWire, cursorRequestAdvertisesApplyPatch, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolAllowedByChoice, cursorToolWireName, isCodexShellBridgeToolName, isCursorExecutionPathTool, isCursorStructuredEditToolName } from "./tool-naming";
+import { CODEX_SHELL_BRIDGE_TOOL_NAMES, CODEX_TOOL_SEARCH_TOOL, CODEX_UNIFIED_EXEC_TOOL, clientSemanticToolNameFromCursorWire, cursorRequestAdvertisesApplyPatch, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolAllowedByChoice, cursorToolWireName, isBareCodexShellBridgeTool, isClaudeClientBareToolName, isCodexShellBridgeToolName, isCursorExecutionPathTool, isCursorStructuredEditToolName } from "./tool-naming";
 
 export const CURSOR_SHELL_ALIAS_SYSTEM_NOTE =
   'Shell commands use the Codex shell bridge tool shown in this turn\'s catalog (`shell_command` or `exec_command`) with JSON arguments like {"cmd":"..."}. The long `mcp_opencodex-responses_*` display name is the same tool. Prefer it over Cursor-native Shell.';
@@ -129,7 +130,15 @@ function advertisedCoversNeighbor(wireNames: readonly string[], neighbor: (typeo
   return NEIGHBOR_AGENT_TOOL_ALIASES[neighbor].some(alias => advertised.has(alias.toLowerCase()));
 }
 
-function unavailableNeighborAgentToolNames(wireNames: readonly string[]): string[] {
+function unavailableNeighborAgentToolNames(
+  wireNames: readonly string[],
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
+): string[] {
+  if (
+    catalog
+    && !catalog.some(isBareCodexShellBridgeTool)
+    && catalog.some(tool => !tool.namespace && isClaudeClientBareToolName(tool.name))
+  ) return [];
   return NEIGHBOR_AGENT_TOOL_NAMES.filter(name => !advertisedCoversNeighbor(wireNames, name));
 }
 
@@ -144,12 +153,14 @@ function discoveryToolLabel(wireNames: readonly string[]): string | undefined {
 export function buildCursorToolGuidanceSystemNote(
   tools: readonly Pick<OcxTool, "namespace" | "name" | "freeform">[] | undefined,
   toolChoice?: OcxRequestOptions["toolChoice"],
+  modelId?: string,
 ): string | undefined {
   if (!tools?.length) return undefined;
+  const plainToolWording = cursorUsesPlainToolWording(modelId);
   const wireNames = [...new Set(
     tools
       .filter(tool => cursorToolAllowedByChoice(tool, toolChoice, tools))
-      .map(tool => cursorToolWireName(tool)),
+      .map(tool => cursorToolWireName(tool, tools)),
   )];
   if (wireNames.length === 0) return undefined;
 
@@ -170,7 +181,7 @@ export function buildCursorToolGuidanceSystemNote(
     ?.filter(tool => !tool.namespace && isCursorStructuredEditToolName(tool.name))
     .map(tool => tool.name) ?? [];
   const discoveryTools = discoveryToolLabel(wireNames);
-  const unavailableNeighborNames = unavailableNeighborAgentToolNames(wireNames);
+  const unavailableNeighborNames = unavailableNeighborAgentToolNames(wireNames, tools);
   // Host-shell-neutral: the Codex client executes bridge commands, and may differ from
   // the OpenCodex proxy OS (LAN/SSH remote-proxy). Always cover PowerShell 5.1 pitfalls.
   const hostShellNote = hasBareExec
@@ -179,6 +190,9 @@ export function buildCursorToolGuidanceSystemNote(
   const notes = [
     `Cursor tool calls: available tool names are exactly ${listedNames}.`,
     "Use the current tool catalog as ground truth and call only those exact names with their listed argument keys.",
+    plainToolWording && !codeMode && !hasBareExec
+      ? "Cursor-native Read/Glob/Grep/LS/Shell/Write/Fetch are not available in this request. Use the listed tool that fits the operation."
+      : undefined,
     unavailableNeighborNames.length > 0
       ? `This turn does not expose neighboring-agent tool names ${quotedNames(unavailableNeighborNames)}; do not call or suggest them unless the catalog lists them.`
       : undefined,
@@ -191,18 +205,24 @@ export function buildCursorToolGuidanceSystemNote(
       ? CODE_MODE_RESULT_ECHO_SENTENCE + " There is no `require`, no `module`, and no filesystem or network globals; reach the host only through the nested helpers. " + CODE_MODE_HOST_CONTRACT_SENTENCE
       : undefined,
     codeMode
-      ? "NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
+      ? plainToolWording
+        ? "Cursor-native Shell, Read, Grep, List, and Write are not available in this request. The exec code cell and its nested helpers provide the execution path; separately listed tools remain callable at the top level."
+        : "NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
       : undefined,
     hasBareExec
       ? `${shellBridgeLabel} is the Codex Responses shell bridge for this turn, exposed through Cursor's tool protocol; it is not an external MCP server tool. \`shell_command\` and \`exec_command\` are aliases of the same bridge.`
       : undefined,
     hasBareExec
-      ? "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
+      ? plainToolWording
+        ? "Your tool list may display the same shell bridge under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; call the name listed in the catalog."
+        : "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
       : undefined,
     hasBareExec
-      ? `NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
+      ? plainToolWording
+        ? `Cursor-native Shell, Read, Grep, List, and Write are not available in this request. ${shellBridgeLabel} provides shell execution through the Codex client host.`
+        : `NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
       : undefined,
-    hasBareExec
+    hasBareExec && !plainToolWording
       ? "Tool-selection commentary is forbidden: for any shell, read, grep, list, or file operation, your FIRST visible action is the bridge call itself — never a sentence about which tool you will use, which tool was redirected, or switching surfaces. Words like 차단/전환/blocked/switching must not appear in your output for tool-routing reasons."
       : undefined,
     hostShellNote,
@@ -233,5 +253,6 @@ export function buildCursorToolGuidanceSystemNote(
       ? `For every file read, directory listing, grep, or shell operation use ${shellBridgeLabel} directly with host-shell-safe commands (POSIX: \`cat\`/\`ls\`/\`rg\`; Windows PowerShell: \`Get-Content\`/\`Get-ChildItem\`/\`Select-String\`). For file edits, use ${structuredEditNames.length > 0 ? `the structured edit tools (${quotedNames(structuredEditNames)}) or ` : ""}\`apply_patch\` when available.`
       : undefined,
   ].filter((note): note is string => typeof note === "string");
+  if (plainToolWording) notes.push(CURSOR_TOOL_CALL_CONTINUATION);
   return notes.join(" ");
 }

package/src/adapters/cursor/tool-naming.ts

@@ -67,11 +67,11 @@ function cursorToolChoiceMatches(
     if (catalogHasBareCodexShellBridge(catalog)) {
       return isBareCodexShellBridgeTool(tool);
     }
-    return tool.name === choiceName || cursorToolWireName(tool) === choiceName;
+    return tool.name === choiceName || cursorToolWireName(tool, catalog) === choiceName;
   }
   if (tool.name === choiceName) return true;
   if (cursorToolChoiceAliases(tool).includes(choiceName)) return true;
-  return cursorToolWireName(tool) === choiceName
+  return cursorToolWireName(tool, catalog) === choiceName
     && !catalog.some(candidate => candidate.name === choiceName);
 }
 
@@ -178,16 +178,49 @@ const CURSOR_PROXY_OWNED_BARE_TOOL_NAMES = new Set([
   CODEX_TOOL_SEARCH_TOOL,
 ]);
 
+export const CLAUDE_CLIENT_BARE_TOOL_NAMES = new Set([
+  "Bash",
+  "Read",
+  "Write",
+  "Edit",
+  "Grep",
+  "Glob",
+  "Task",
+  "GetDynamicTools",
+  "EnterMode",
+  "ExitMode",
+  "Todo",
+  "AddTodo",
+  "UpdateTodo",
+  "ViewTodo",
+  "WebSearch",
+  "FetchUrl",
+  "KillProcess",
+  "ListProcesses",
+  "ViewProcessOutput",
+]);
+
+export function isClaudeClientBareToolName(name: string): boolean {
+  return CLAUDE_CLIENT_BARE_TOOL_NAMES.has(name);
+}
+
 /** Avoid collisions with Cursor's private bare-tool namespace. */
-function isCursorBareClientToolWireAliased(
+export function isCursorBareClientToolWireAliased(
   tool: Pick<OcxTool, "namespace" | "name">,
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
 ): boolean {
-  return !tool.namespace
-    && !CURSOR_PROXY_OWNED_BARE_TOOL_NAMES.has(tool.name);
+  if (tool.namespace || CURSOR_PROXY_OWNED_BARE_TOOL_NAMES.has(tool.name)) return false;
+  if (isClaudeClientBareToolName(tool.name)) {
+    return catalog ? catalogHasBareCodexShellBridge(catalog) : false;
+  }
+  return true;
 }
 
-export function cursorToolWireName(tool: Pick<OcxTool, "namespace" | "name">): string {
-  if (isCursorBareClientToolWireAliased(tool)) {
+export function cursorToolWireName(
+  tool: Pick<OcxTool, "namespace" | "name">,
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
+): string {
+  if (isCursorBareClientToolWireAliased(tool, catalog)) {
     return `${CURSOR_CLIENT_TOOL_WIRE_PREFIX}${tool.name}`;
   }
   return namespacedToolName(tool.namespace, tool.name);

package/src/adapters/cursor/tool-wording.ts

@@ -0,0 +1,46 @@
+import type { OcxTool } from "../../types";
+import type { McpToolDefinition } from "./gen/agent_pb";
+import { CODE_MODE_RESULT_ECHO_SENTENCE } from "../exec-tool-result-normalize";
+import { OCX_RESPONSES_TOOL_PROVIDER, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolWireName } from "./tool-naming";
+
+/** Cursor may expose Claude with version-first, family-first, or effort-suffixed ids. */
+export function cursorUsesPlainToolWording(modelId?: string): boolean {
+  return /^(?:cursor\/)?claude-/i.test(modelId?.trim() ?? "");
+}
+
+export const CURSOR_TOOL_CALL_CONTINUATION = "Continue the task with that tool call.";
+const CURSOR_NO_CLIENT_TOOLS = "Cursor-native filesystem, shell, and fetch tools are not available through this execution channel. No client tools are available in this request. Answer without tools using the information already provided, or report that the requested operation cannot be completed without tools.";
+
+/** Factual catalog wording; legacy model wording is owned by native-exec.ts unchanged. */
+export function cursorPlainNativeExecRedirectHint(
+  tools: readonly Pick<OcxTool, "namespace" | "name" | "freeform">[] | undefined,
+  mcpToolDefs: readonly Pick<McpToolDefinition, "name" | "providerIdentifier">[],
+): string | undefined {
+  const clientTools = tools ?? [];
+  const names = [...new Set([
+    ...clientTools.map(tool => cursorToolWireName(tool, clientTools)),
+    ...mcpToolDefs.map(def => `mcp_${def.providerIdentifier}_${def.name}`),
+  ])];
+  if (names.length === 0) return CURSOR_NO_CLIENT_TOOLS;
+  const shown = names.slice(0, 16).map(name => `\`${name}\``).join(", ");
+  const more = names.length > 16 ? ` (+${names.length - 16} more)` : "";
+  const catalog = `Available tools in this request's catalog: ${shown}${more}. `
+    + `The harness displays a \`${OCX_RESPONSES_TOOL_PROVIDER}\` entry as \`mcp_${OCX_RESPONSES_TOOL_PROVIDER}_<name>\`; that is the same tool. `
+    + "Cursor-native Read/Glob/Grep/LS/Shell/Write/Fetch are not available in this request. ";
+  if (!cursorRequestHasShellAlias(clientTools) && cursorRequestUsesCodeMode(clientTools)) {
+    return catalog + "`exec` takes a JavaScript body evaluated in a V8 isolate, not a shell command. Shell, file, search, and fetch are nested helpers called inside it as `await tools.<name>(...)`, for example `text(await tools.exec_command({cmd: \"ls\"}))`. "
+      + "`shell_command` and `exec_command` are nested helpers, not top-level tools here. Every other listed tool remains callable at the top level. "
+      + CODE_MODE_RESULT_ECHO_SENTENCE + " " + CURSOR_TOOL_CALL_CONTINUATION;
+  }
+  const operation = cursorRequestHasExecutionPath(clientTools)
+    ? "Use the listed execution tool with its advertised argument schema and the Codex client host's shell syntax; use a listed edit tool for file edits. "
+    : "Use the listed tool that fits the operation: a file, search, or fetch tool when provided, or a listed worker-agent delegation tool. ";
+  return catalog + operation + CURSOR_TOOL_CALL_CONTINUATION;
+}
+
+/** Fallback uses advertised dispatcher definitions, never assumed shell/edit tools. */
+export function cursorPlainNativeExecFallback(
+  toolDefs: readonly Pick<McpToolDefinition, "name" | "providerIdentifier">[] = [],
+): string {
+  return cursorPlainNativeExecRedirectHint([], toolDefs)!;
+}

package/src/adapters/cursor.ts

@@ -65,6 +65,7 @@ import {
   type CursorTransportFactory,
 } from "./cursor/transport";
 import { cursorLiveRosterScope } from "./cursor/catalog";
+import { cursorUsesPlainToolWording } from "./cursor/tool-wording";
 
 export const CURSOR_API_URL = "https://api2.cursor.sh";
 
@@ -313,8 +314,10 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
           const armMidstreamEcho = cursorNeedsExternalToolContinuation(activeRequest.modelId) && replaysToolResult;
           const midstreamObserver = armMidstreamEcho ? new CursorMidstreamEchoObserver() : undefined;
           const midstreamFilter = armMidstreamEcho ? new ToolEnvelopeEchoFilter() : undefined;
+          // Claude's factual redirects allow truthful routing prose; it is not a failure claim.
           const armRoutingCommentarySniffer =
             isCursorExternalWireModel(activeRequest.modelId)
+            && !cursorUsesPlainToolWording(activeRequest.modelId)
             && (
               cursorRequestUsesCodeMode(activeRequest.tools, activeRequest.toolChoice)
               || cursorRequestHasShellAlias(activeRequest.tools)

package/src/adapters/devin.ts

@@ -523,10 +523,45 @@ export function mapOcxMessagesToDevin(
     .join("\n\n");
   if (system) items.push({ role: "system", content: system });
 
+  let previousToolResult: ChatHistoryItem | undefined;
+  let textChunks: string[] | undefined;
+  const flushText = () => {
+    if (previousToolResult && textChunks) previousToolResult.content = textChunks.join("\n\n");
+    textChunks = undefined;
+  };
   for (const message of parsed.context.messages) {
+    // Original-message adjacency matters even when an intervening message maps to nothing.
+    if (message.role !== "toolResult") {
+      flushText();
+      previousToolResult = undefined;
+    }
     const mapped = mapOneMessage(message, parsed.modelId, options);
-    if (mapped) items.push(mapped);
+    if (!mapped) continue;
+    if (mapped.role === "tool") {
+      if (previousToolResult && previousToolResult.tool_call_id === mapped.tool_call_id) {
+        const previous = previousToolResult;
+        if (textChunks && typeof mapped.content === "string") {
+          textChunks.push(mapped.content);
+        } else {
+          flushText();
+          // mapOneMessage owns these wire arrays; append without recopying their prefix.
+          const parts: ContentPart[] = typeof previous.content === "string"
+            ? [{ type: "text", text: previous.content }] : previous.content;
+          parts.push({ type: "text", text: "\n\n" });
+          if (typeof mapped.content === "string") parts.push({ type: "text", text: mapped.content });
+          else for (const part of mapped.content) parts.push(part);
+          previous.content = parts;
+        }
+        if (mapped.is_error) previous.is_error = true;
+        continue;
+      }
+      flushText();
+      previousToolResult = mapped;
+      textChunks = typeof mapped.content === "string" ? [mapped.content] : undefined;
+    }
+    items.push(mapped);
   }
+  flushText();
   return items;
 }
 
@@ -774,7 +809,7 @@ export function createDevinAdapter(
         // An admitted HTTP turn owns globally shared capacity until this call
         // emits. Without an explicit wait allowance, preserve the typed reset
         // delay in generated diagnostic wording and return immediately.
-        const signedMessages = mapOcxMessagesToDevin(parsed);
+        const signedMessages = messages; // Reuse the history already mapped above.
         // A Claude signature is replayed because it is what carries the reasoning into this
         // turn, but Cognition streams Claude's thinking as a summary the signature does not
         // cover, and some replays are refused with invalid_argument before any output. That

package/src/adapters/openai-chat/messages.ts

@@ -144,7 +144,9 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
   const nativeOpenAI = isNativeOpenAIChatTarget(provider);
   // Qwen3.8-27B's pinned chat template rejects non-leading system and every developer role;
   // a later user is rendered in place. Keep this exception specific to that template family.
-  const qwen38LeadingSystemTemplate = !nativeOpenAI && /^(?:Qwen\/)?(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?)$/i.test(parsed.modelId);
+  // Gateways serve it under namespaced ids (LiteLLM's openai/Qwen3.8-27B, #6674), so any number
+  // of leading path segments is accepted; the final segment still has to name the checkpoint.
+  const qwen38LeadingSystemTemplate = !nativeOpenAI && /^(?:[^/]+\/)*(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?)$/i.test(parsed.modelId);
   // Which role a developer message carries, and why the unrecorded state folds, is stated once
   // in ./developer-role.ts and read from there by the native passthrough as well. Either way the
   // message keeps the slot it arrived in — only the role changes, never the position.

package/src/claude/desktop-picker.ts

@@ -10,6 +10,8 @@ import { getConfigDir } from "../config/paths";
 import { readFileSync, existsSync } from "node:fs";
 import { acceptsPickerAuthority, pickerCaCertPath, pickerCaFingerprints, ensurePickerCa, issuePickerLeaf, pickerLeafCertPath, publishedPickerCaSha256 } from "./intercept/picker-ca";
 import { inspectPickerTrust, trustPickerCa, untrustPickerCa } from "./intercept/picker-trust";
+import { preparePersistentPickerAuthority } from "./intercept/picker-ca-startup";
+import type { PickerCaStore } from "./intercept/picker-ca-store";
 import type { PickerRuntime } from "./intercept/picker-runtime";
 import type { PickerTrustState, SecurityRunner } from "./intercept/picker-trust";
 import {
@@ -52,6 +54,8 @@ export interface DesktopPickerEnableOptions {
   persist: boolean;
   context: "cli-trusted" | "server";
   callerAddedTrust?: boolean;
+  /** Normal restart only inspects trust; explicit enable keeps the consent flow. */
+  allowTrustPrompt?: boolean;
 }
 
 export interface DesktopPickerOps {
@@ -74,6 +78,7 @@ export interface DesktopPickerControllerDeps {
   /** Bound picker CONNECT proxy port (Desktop's egress), or null when it is not running. */
   proxyPort: () => number | null;
   configDir: string;
+  persistentAuthority?: { store?: PickerCaStore };
   security?: SecurityRunner;
   platform?: NodeJS.Platform;
   applyProfile?: typeof applyDesktopPickerProfile;
@@ -185,13 +190,8 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
     // An already selected owned profile proves that another successful enable still relies on
     // this CA. Keep its trust even when the current request is refused.
     if (inspect().kind === "applied") return true;
-    try {
-      const ca = ensurePickerCa(deps.configDir);
-      const result = await untrustPickerCa(
-        pickerCaCertPath(deps.configDir), pickerCaFingerprints(ca.certPem).sha1, deps.security, platform,
-      );
-      return result.ok;
-    } catch { return false; }
+    // Compensation needs only the published public root, never a signing identity.
+    return untrustCurrentCa();
   }
 
   function withTrustFailure(status: DesktopPickerStatus, trustFailed: boolean): DesktopPickerStatus {
@@ -228,7 +228,9 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
     let caPath: string;
     let caSha1: string;
     try {
-      const ca = ensurePickerCa(deps.configDir);
+      const ca = deps.persistentAuthority
+        ? await preparePersistentPickerAuthority({ configDir: deps.configDir, store: deps.persistentAuthority.store, security: deps.security, platform })
+        : ensurePickerCa(deps.configDir);
       // The CLI path gates trust on the same profile check; a published root whose bytes do not
       // match the profile this process mints must not reach the keychain through the server
       // path either, even when a live peer published it.
@@ -238,7 +240,7 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
       caSha1 = pickerCaFingerprints(ca.certPem).sha1;
       let trust = await inspectPickerTrust(pickerLeafCertPath(deps.configDir), caSha1, deps.security, platform);
       observedTrust = trust;
-      if (trust !== "trusted" && options.context === "server") {
+      if (trust !== "trusted" && options.context === "server" && options.allowTrustPrompt !== false) {
         const added = await trustPickerCa(caPath, deps.security, platform, { pem: ca.certPem });
         trustedByAttempt = added.ok;
         trust = await inspectPickerTrust(pickerLeafCertPath(deps.configDir), caSha1, deps.security, platform);

package/src/claude/inbound-content-options.ts

@@ -1,12 +1,39 @@
 import { isClaudeWebSearchToolName } from "./outbound";
 import { AnthropicRequestError, isRec, type Rec } from "./inbound-records";
 
+/**
+ * Claude Code opens its system prompt with a per-request billing line
+ * (`x-anthropic-billing-header: cc_version=…; cc_entrypoint=…; cch=…;`) whose `cch` value
+ * changes on every request. Anthropic excludes it from caching; a translated Responses
+ * destination does not, so the first bytes of `instructions` — and the system-derived
+ * fallback `prompt_cache_key` — rotated every turn and prefix caching never hit (#6627).
+ * Native Anthropic passthrough never reaches this translation and keeps the line.
+ *
+ * Anchored at the prompt start without the multiline flag, like the Antigravity strip in
+ * `src/adapters/google.ts`, so a mention later in the prompt is never touched.
+ */
+function stripClaudeBillingHeader(text: string): string {
+  return text.replace(/^x-anthropic-billing-header:[^\n]*\n*/, "");
+}
+
 export function systemToInstructions(system: unknown): string | undefined {
-  if (typeof system === "string") return system.length > 0 ? system : undefined;
+  if (typeof system === "string") {
+    const text = stripClaudeBillingHeader(system);
+    return text.length > 0 ? text : undefined;
+  }
   if (Array.isArray(system)) {
     const parts: string[] = [];
+    let first = true;
     for (const block of system) {
-      if (isRec(block) && block.type === "text" && typeof block.text === "string") parts.push(block.text);
+      if (!isRec(block) || block.type !== "text" || typeof block.text !== "string") continue;
+      if (first) {
+        first = false;
+        // Only the first text block can carry the billing line; drop it if nothing else remains.
+        const text = stripClaudeBillingHeader(block.text);
+        if (text.length > 0) parts.push(text);
+        continue;
+      }
+      parts.push(block.text);
     }
     return parts.length > 0 ? parts.join("\n\n") : undefined;
   }

package/src/claude/inbound.ts

@@ -72,6 +72,15 @@ function toolResultOutput(block: Rec): string | Rec[] {
       if (!isRec(item)) continue;
       if (item.type === "text" && typeof item.text === "string") {
         out.push({ type: "input_text", text: item.text });
+      } else if (item.type === "tool_reference" && typeof item.tool_name === "string" && item.tool_name.length > 0) {
+        // Responses has no tool_reference result carrier. Preserve ToolSearch's loaded-name
+        // evidence as result text so a reference-only reply does not become empty (#6647).
+        // This describes client output; it must not create tools or widen authorization.
+        // Text-only tool output is later joined without separators, so the marker carries its
+        // own line breaks to keep each loaded name distinct from its neighbours.
+        const prev = out[out.length - 1];
+        const lead = prev?.type === "input_text" && typeof prev.text === "string" && !prev.text.endsWith("\n") ? "\n" : "";
+        out.push({ type: "input_text", text: `${lead}Tool loaded: ${item.tool_name}\n` });
       } else if (item.type === "image") {
         const img = imageBlockToInputImage(item);
         if (img) out.push(img);