@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/adapters/coding-agent/tool-catalog.ts

@@ -0,0 +1,75 @@
+import { namespacedToolName, requiresToolCall, toolChoiceToolPredicate, type OcxParsedRequest } from "../../types";
+import { stripResponsesOnlyEncryptedMarker } from "../responses-tool-schema";
+
+// The selected catalog also supplies one comma-joined --allowed-tools argv value.
+// Bound that full argument separately from individual names for Windows process creation.
+export const CODING_AGENT_TOOL_LIMITS = Object.freeze({
+  maxTools: 128,
+  maxNameBytes: 512,
+  maxAllowedToolsArgBytes: 8 * 1024,
+  maxToolBytes: 256 * 1024,
+  maxCatalogBytes: 2 * 1024 * 1024,
+});
+
+const encoder = new TextEncoder();
+const INVALID_NAME_PART = /[,\s\u0000-\u001f\u007f-\u009f]/u;
+
+export class CodingAgentToolCatalogError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "CodingAgentToolCatalogError";
+  }
+}
+
+export function isValidCodingAgentToolNamePart(value: unknown): value is string {
+  if (typeof value !== "string" || !value || INVALID_NAME_PART.test(value)) return false;
+  // TextEncoder replaces lone surrogates, which would change tool identity on the MCP wire.
+  for (let i = 0; i < value.length; i++) {
+    const unit = value.charCodeAt(i);
+    if (unit >= 0xd800 && unit <= 0xdbff) {
+      const next = value.charCodeAt(++i);
+      if (!(next >= 0xdc00 && next <= 0xdfff)) return false;
+    } else if (unit >= 0xdc00 && unit <= 0xdfff) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/** One client-owned catalog; the CLI spelling is only a projection of its wire names. */
+export function buildCodingAgentToolCatalog(parsed: OcxParsedRequest, serverName: string) {
+  const declared = parsed.context.tools ?? [];
+  const selected = declared.filter(toolChoiceToolPredicate(parsed.options.toolChoice, declared));
+  if (selected.length > CODING_AGENT_TOOL_LIMITS.maxTools) throw new CodingAgentToolCatalogError("tool catalog exceeds tool count limit");
+  const requireToolCall = requiresToolCall(parsed.options.toolChoice);
+  const emittedNameMap = new Map<string, string>();
+  // JSON array brackets and commas count too; avoid serializing the whole catalog twice.
+  let catalogBytes = 2;
+  let allowedToolsArgBytes = 0;
+  const tools = selected.map((tool, index) => {
+    if (!tool || !isValidCodingAgentToolNamePart(tool.name) || (tool.namespace !== undefined && !isValidCodingAgentToolNamePart(tool.namespace))) {
+      throw new CodingAgentToolCatalogError("invalid tool name or namespace");
+    }
+    const wireName = namespacedToolName(tool.namespace, tool.name);
+    if (encoder.encode(wireName).byteLength > CODING_AGENT_TOOL_LIMITS.maxNameBytes) {
+      throw new CodingAgentToolCatalogError("tool name exceeds byte limit");
+    }
+    const definition = {
+      name: wireName,
+      description: tool.description || `Tool: ${wireName}`,
+      inputSchema: stripResponsesOnlyEncryptedMarker(tool.parameters) as Record<string, unknown>,
+    };
+    const bytes = encoder.encode(JSON.stringify(definition)).byteLength;
+    if (bytes > CODING_AGENT_TOOL_LIMITS.maxToolBytes) throw new CodingAgentToolCatalogError("tool definition exceeds byte limit");
+    catalogBytes += bytes + (index ? 1 : 0);
+    if (catalogBytes > CODING_AGENT_TOOL_LIMITS.maxCatalogBytes) throw new CodingAgentToolCatalogError("tool catalog exceeds byte limit");
+    const emittedName = `mcp__${serverName}__${wireName}`;
+    allowedToolsArgBytes += encoder.encode(emittedName).byteLength + (index ? 1 : 0);
+    if (allowedToolsArgBytes > CODING_AGENT_TOOL_LIMITS.maxAllowedToolsArgBytes) {
+      throw new CodingAgentToolCatalogError("allowed-tools argument exceeds byte limit");
+    }
+    emittedNameMap.set(emittedName, wireName);
+    return definition;
+  });
+  return { tools, emittedNameMap, requireToolCall };
+}

package/src/adapters/coding-agent/turn.ts

@@ -4,6 +4,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../types";
 import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
+import { SendBudgetExhaustedError } from "../../lib/upstream-retry";
+import type { SingleUseDispatchPermit } from "../../lib/request-execution-budget";
 import { commandInvocation } from "../../lib/win-exec";
 import { isStandaloneBinary } from "../../lib/standalone";
 import { modelRecordValue } from "../../reasoning-effort";
@@ -43,6 +45,9 @@ export interface CodingAgentDeps {
   killWindowsProcessTree?: KillWindowsProcessTreeFn;
   /** Test seam for a catalog/config write failure after private bridge-directory creation. */
   writeToolBridgeFile?: typeof writeFile;
+  /** Injectable timer primitives for deterministic tests without sleeping. */
+  setTimeout?: typeof setTimeout;
+  clearTimeout?: typeof clearTimeout;
 }
 
 const DEFAULT_TIMEOUT_MS = 300_000;
@@ -113,28 +118,35 @@ export interface CodingAgentTurnInput {
   /** Family-specific scoped env builder (credential + region switch on top of baseScopedEnv). */
   buildEnv: (profile: CodingAgentProviderProfile, apiKey: string) => Record<string, string>;
   /**
-   * Opt-in capture-only tool bridge. When present with a non-empty catalog, the turn writes a
-   * validated catalog plus an MCP config to a private temp dir, passes `--mcp-config` (with exact
-   * `--allowedTools`) alongside the family's tools-disabled args, translates captured tool_use
-   * names back to request wire names, and terminates the process tree at `message_stop` because
-   * the capture-only MCP handler intentionally never answers. Execution stays with the client.
+   * Opt-in isolated MCP catalog. The turn writes a catalog and MCP config to a private temp dir,
+   * advertises only the selected names, and returns structured CLI tool intent to the client.
+   * The MCP handler never executes the client tool.
    */
   toolBridge?: CodingAgentToolBridgeInput;
   deps: CodingAgentDeps;
 }
 
-/** Opt-in capture-only tool bridge for one coding-agent CLI turn. */
+/** Opt-in isolated tool catalog for one coding-agent CLI turn. */
 export interface CodingAgentToolBridgeInput {
   /** MCP server name advertised to the CLI; tool_use blocks render it as `mcp__<name>__<tool>`. */
   serverName: string;
-  /** Absolute path of the capture-only MCP server module, run with the serving runtime. */
+  /** Absolute path of the MCP server module, run with the serving runtime. */
   serverModulePath: string;
   /** Validated tool catalog advertised over ListTools; the server never executes a call. */
   tools: ReadonlyArray<{ name: string; description: string; inputSchema: Record<string, unknown> }>;
   /** CLI-emitted tool name (`mcp__<server>__<tool>`) to the request's wire tool name. */
   emittedNameMap: Map<string, string>;
-  /** Captured tool_use blocks accepted in one assistant message. */
+  /** Tool_use blocks accepted in one assistant message. */
   maxTurnToolCalls: number;
+  /** Render prior tool calls with the CLI-emitted names. Off by default so CodeBuddy history is unchanged. */
+  projectHistoryToolNames?: boolean;
+  /** Finish the turn when a complete assistant frame supplies structured tool_use blocks. */
+  completeAssistantToolUse?: boolean;
+  /** Authoritative tool-turn stop signal; existing coding-agent bridges default to message_stop. */
+  toolTurnCompletionSignal?: "message_stop" | "assistant_tool_use_stop";
+  /** Family-specific CLI flag spelling and compiled MCP helper entrypoint. */
+  allowedToolsFlag?: string;
+  standaloneEntrypoint?: string;
   /**
    * The request's `tool_choice` requires a tool call (`required`, or a named selection).
    * The nested CLI has no documented force-tool flag, so this is enforced locally: a
@@ -164,6 +176,8 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   const killGraceMs = deps.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
   const reapTimeoutMs = deps.reapTimeoutMs ?? (killGraceMs * 2 + 250);
   const platform = deps.platform ?? process.platform;
+  const setTimeoutFn = deps.setTimeout ?? setTimeout;
+  const clearTimeoutFn = deps.clearTimeout ?? clearTimeout;
 
   if (incoming.abortSignal?.aborted) {
     emit({ type: "error", message: "Coding-agent turn was aborted before start." });
@@ -240,7 +254,11 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
             [toolBridge.serverName]: {
               type: "stdio",
               command: process.execPath,
-              args: codeBuddyMcpInvocation(toolBridge.serverModulePath, catalogPath),
+              args: toolBridge.standaloneEntrypoint
+                ? (isStandaloneBinary()
+                  ? [toolBridge.standaloneEntrypoint, catalogPath]
+                  : [toolBridge.serverModulePath, catalogPath])
+                : codeBuddyMcpInvocation(toolBridge.serverModulePath, catalogPath),
               defer_loading: false,
               alwaysLoad: true,
             },
@@ -265,12 +283,25 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   const args = buildArgs(profile, parsed, provider);
   if (toolBridge && toolBridgeMcpConfigPath) {
     // Exact names close the wildcard domain; --strict-mcp-config (family args) keeps user
-    // servers out, so the capture server is the only capability this turn can reach.
-    args.push("--allowedTools", [...toolBridge.emittedNameMap.keys()].join(","), "--mcp-config", toolBridgeMcpConfigPath);
+    // servers out, so this isolated server is the only capability this turn can reach.
+    args.push(toolBridge.allowedToolsFlag ?? "--allowedTools", [...toolBridge.emittedNameMap.keys()].join(","), "--mcp-config", toolBridgeMcpConfigPath);
   }
   const env = buildEnv(profile, apiKey);
   const invocation = commandInvocation(binary, args, platform, { env });
 
+  // An opaque CLI invocation is one send. Its internal retries are not observable here;
+  // terminal usage still settles the complete amount, including usage above the estimate.
+  let producer: { close(): void } | undefined;
+  let permit: SingleUseDispatchPermit | undefined;
+  try {
+  producer = incoming.sendBudget?.beginSpendProducer?.();
+  const decision = incoming.sendBudget?.reserveDispatch({
+    sendClass: "initial", targetKey: `${provider.adapter}|${profile.canonicalBaseUrl}|${parsed.modelId}`,
+  });
+  if (decision && !decision.allowed) throw new SendBudgetExhaustedError();
+  permit = decision?.allowed ? decision.permit : undefined;
+  if (permit && !permit.use()) throw new SendBudgetExhaustedError();
+  incoming.onPhysicalSend?.({ ordinal: 1 });
   let child: ChildProcess;
   try {
     child = spawnFn(invocation.file, invocation.args, {
@@ -288,9 +319,6 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
       code: "cli_spawn_failed",
       retryable: false,
     });
-    // A synchronous spawn() throw skips the event-loop `finally` below, so the private
-    // bridge dir would leak unless it is removed here as well.
-    if (toolBridgeDir) await rm(toolBridgeDir, { recursive: true, force: true }).catch(() => undefined);
     return;
   }
 
@@ -339,7 +367,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
     // mcp-server.ts exits on stdin EOF, so this ladder reaps the whole tree without knowing
     // the grandchild pid.
     try { child.kill("SIGTERM"); } catch { /* already gone */ }
-    killTimer = setTimeout(() => {
+    killTimer = setTimeoutFn(() => {
       try { child.kill("SIGKILL"); } catch { /* already gone */ }
     }, killGraceMs);
   };
@@ -352,7 +380,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
     stopStream();
   };
   incoming.abortSignal?.addEventListener("abort", onAbort, { once: true });
-  const timeoutTimer = setTimeout(() => {
+  const timeoutTimer = setTimeoutFn(() => {
     kill();
     stopStream();
     emitOnce({ type: "error", message: `${profile.label} turn timed out.`, status: 504, errorType: "upstream_error", code: "timeout", retryable: true });
@@ -364,7 +392,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   });
 
   const cleanup = (): void => {
-    clearTimeout(timeoutTimer);
+    clearTimeoutFn(timeoutTimer);
     incoming.abortSignal?.removeEventListener("abort", onAbort);
     try { child.stdin?.destroy(); } catch { /* ignore */ }
     // Termination is owned by the reap step below, not here: killing in cleanup would set
@@ -374,9 +402,10 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   let streamProtocolError: string | undefined;
   let streamProtocolCode: string | undefined;
   let turnError: string | undefined;
+  let failClosed = false;
   // A successful result frame that arrived after every captured tool call completed but
-  // before message_stop. The bridge contract still ends the leg with the synthesized
-  // done(tool_use) at message_stop, so the result-derived done(stop) is deferred and its
+  // before an authoritative tool-turn stop. The bridge contract still ends the leg with
+  // synthesized done(tool_use) at that stop, so result-derived done(stop) is deferred and its
   // usage (authoritative vendor accounting) is folded into the synthesis. Set inside the
   // stream loop; read by the synthesis and the stream-end error selection below.
   let deferredResultDone: Extract<AdapterEvent, { type: "done" }> | undefined;
@@ -389,7 +418,13 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
     maxToolBlockStarts: toolBridge?.maxTurnToolCalls,
     strictToolBlockCapture: Boolean(toolBridge),
     partialToolCallIds: toolBridge ? new Set<string>() : undefined,
+    completeAssistantToolUse: toolBridge?.completeAssistantToolUse,
+    toolBridgeNames: toolBridge?.completeAssistantToolUse ? toolBridge.emittedNameMap : undefined,
   };
+  const toolTurnCompletionSignal = toolBridge?.toolTurnCompletionSignal ?? "message_stop";
+  const sawSelectedToolTurnStop = (): boolean => toolTurnCompletionSignal === "assistant_tool_use_stop"
+    ? state.sawAssistantToolUseStop === true
+    : state.sawMessageStop === true;
 
   try {
     // Write the replayed conversation, then close stdin so a single-shot turn can complete.
@@ -403,14 +438,16 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
       const historyCharLimit = projectedHistoryCharLimit(
         modelRecordValue(provider.modelContextWindows, parsed.modelId) ?? provider.contextWindow,
       );
-      for (const line of buildConversationInput(parsed, { maxHistoryChars: historyCharLimit })) stdin.write(`${line}\n`);
+      const vendorNameByWire = toolBridge?.projectHistoryToolNames
+        ? new Map([...toolBridge.emittedNameMap].map(([emitted, wire]) => [wire, emitted]))
+        : undefined;
+      for (const line of buildConversationInput(parsed, { maxHistoryChars: historyCharLimit, vendorNameByWire })) stdin.write(`${line}\n`);
       stdin.end();
     }
     const stdout = child.stdout;
     if (!stdout) throw new CodingAgentProtocolError(`${profile.label} CLI produced no stdout stream`);
     try {
       let initValidated = false;
-      let failClosed = false;
       for await (const message of readJsonLines(stdout)) {
         if (incoming.abortSignal?.aborted) break;
         if (toolBridge) {
@@ -432,13 +469,19 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
             ? message.event as Record<string, unknown>
             : undefined;
           const rawBlock = rawEvent?.content_block;
+          const assistantMessage = toolBridge.completeAssistantToolUse && message.type === "assistant"
+            && message.message !== null && typeof message.message === "object"
+            ? message.message as Record<string, unknown> : undefined;
+          const completeToolUse = Array.isArray(assistantMessage?.content) && assistantMessage.content.some(block =>
+            block !== null && typeof block === "object" && (block as Record<string, unknown>).type === "tool_use",
+          );
           if (
             !initValidated
-            && rawEvent?.type === "content_block_start"
-            && rawBlock !== null
-            && typeof rawBlock === "object"
-            && !Array.isArray(rawBlock)
-            && (rawBlock as Record<string, unknown>).type === "tool_use"
+            && (completeToolUse || (rawEvent?.type === "content_block_start"
+              && rawBlock !== null
+              && typeof rawBlock === "object"
+              && !Array.isArray(rawBlock)
+              && (rawBlock as Record<string, unknown>).type === "tool_use"))
           ) {
             emitOnce({
               type: "error",
@@ -522,7 +565,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
             // other bridge contract violations use.
             emitOnce({
               type: "error",
-              message: "CodeBuddy finished without calling the required tool.",
+              message: "Coding-agent CLI finished without calling the required tool.",
               status: 502,
               errorType: "upstream_error",
               code: "tool_call_required",
@@ -567,9 +610,9 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
             // Every captured call completed and the CLI settled with a successful result before
             // message_stop (instead of parking on the never-answering capture server). Emitting
             // this done(stop) now would end the turn as a text completion and skip the
-            // synthesized done(tool_use) the client contract expects. Defer it: message_stop
-            // synthesis emits the terminal event with this frame's usage, and a stream that
-            // ends without message_stop fails closed with protocol_error below.
+            // synthesized done(tool_use) the client contract expects. Defer it: an authoritative
+            // tool-turn stop synthesizes the terminal event with this frame's usage, and a stream
+            // that ends without a stop fails closed with protocol_error below.
             deferredResultDone = event;
             continue;
           }
@@ -578,10 +621,11 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
             : event);
         }
         if (failClosed) break;
+        const sawToolTurnStop = sawSelectedToolTurnStop();
         if (
           toolBridge
           && !terminalEmitted
-          && state.sawMessageStop
+          && sawToolTurnStop
           && (state.toolBlockStarts ?? 0) > 0
           && (state.completedToolCalls ?? 0) !== (state.toolBlockStarts ?? 0)
         ) {
@@ -596,9 +640,16 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
           kill();
           break;
         }
-        if (toolBridge && !terminalEmitted && state.sawMessageStop && (state.completedToolCalls ?? 0) > 0) {
-          // The raw-start gate above already refused any call opened before the handshake.
-          // The capture-only MCP handler never answers, so the CLI parks after message_stop.
+        if (toolBridge && !terminalEmitted && sawToolTurnStop && (state.toolBlockStarts ?? 0) > 0
+          && (state.completedToolCalls ?? 0) === (state.toolBlockStarts ?? 0)) {
+          if (!initValidated) {
+            emitOnce({ type: "error", message: "Coding-agent CLI ended before the tool bridge init handshake completed.",
+              status: 502, errorType: "upstream_error", code: "tool_bridge_init_missing", retryable: false });
+            kill();
+            break;
+          }
+          // Both partial and complete tool calls require the validated handshake.
+          // The capture-only MCP handler never answers, so the CLI parks after the tool-turn stop.
           // The completed tool_use blocks are this turn's structured output: end the leg here
           // and terminate the tree; the client executes, and the next request continues.
           // Pre-result usage snapshots keep this terminated leg accountable: no result frame
@@ -626,24 +677,21 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   } finally {
     releaseOpenToolBlocks(state);
     cleanup();
-    if (toolBridgeDir) {
-      await rm(toolBridgeDir, { recursive: true, force: true }).catch(() => undefined);
-    }
   }
 
   // Reap the process so no zombie is left behind (§三十): wait for the real `close`, and
   // force-terminate only if it lingers past the grace window after the stream ended.
-  const graceTimer = setTimeout(() => { kill(); }, killGraceMs);
+  const graceTimer = setTimeoutFn(() => { kill(); }, killGraceMs);
   let reapTimer: ReturnType<typeof setTimeout> | undefined;
   await Promise.race([
     processLifecycle,
     new Promise<void>(resolve => {
-      reapTimer = setTimeout(resolve, reapTimeoutMs);
+      reapTimer = setTimeoutFn(resolve, reapTimeoutMs);
     }),
   ]);
-  clearTimeout(graceTimer);
-  if (reapTimer) clearTimeout(reapTimer);
-  if (killTimer) clearTimeout(killTimer);
+  clearTimeoutFn(graceTimer);
+  if (reapTimer) clearTimeoutFn(reapTimer);
+  if (killTimer) clearTimeoutFn(killTimer);
 
   if (!terminalEmitted) {
     const stderr = redactSecrets(boundedStderr(stderrChunks), profile.tokenEnv, apiKey);
@@ -686,10 +734,10 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
         code: "process_exit_error",
         retryable: false,
       });
-    } else if (toolBridge && deferredResultDone !== undefined && !state.sawMessageStop) {
+    } else if (toolBridge && deferredResultDone !== undefined && !sawSelectedToolTurnStop()) {
       emitOnce({
         type: "error",
-        message: `${profile.label} CLI delivered a terminal result before message_stop on a tool-bridge turn.`,
+        message: `${profile.label} CLI delivered a terminal result before the authoritative tool-turn stop on a tool-bridge turn.`,
         status: 502,
         errorType: "upstream_error",
         code: "protocol_error",
@@ -709,6 +757,15 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
       });
     }
   }
+  } finally {
+    try { permit?.release(); }
+    finally {
+      try { producer?.close(); }
+      finally {
+        if (toolBridgeDir) await rm(toolBridgeDir, { recursive: true, force: true }).catch(() => undefined);
+      }
+    }
+  }
 }
 
 function boundedStderr(chunks: string[]): string {

package/src/adapters/cursor/catalog.ts

@@ -140,6 +140,14 @@ export const CURSOR_CAPABILITIES: Record<string, CursorCapability> = {
       thinking: { levels: FULL, order: T },
     },
   },
+  // 261008 Haiku 5.5: cursor.com/docs/models/claude-haiku-5-5, 1M and low..max.
+  // Preemptive regular-only shape until GetUsableModels confirms a thinking variant.
+  "claude-haiku-5-5": {
+    displayName: "Claude Haiku 5.5",
+    window: CONTEXT_1M,
+    defaultVariant: "regular",
+    variants: { regular: { levels: FULL } },
+  },
   // 260929 Claude Sonnet 5.5: cursor.com/docs/models/claude-sonnet-5-5 lists it (1M max context),
   // but the live GetUsableModels roster does not yet. Shaped like Opus 5.5 (flat effort ids, no
   // thinking variant); re-shape from the roster once it appears.

package/src/adapters/cursor/effort-map.ts

@@ -41,6 +41,8 @@ const CURSOR_MODEL_EFFORT_TIERS: Record<string, readonly string[]> = {
   "claude-opus-5-5-fast": ["low", "medium", "high", "xhigh", "max"],
   // 260929 preemptive Sonnet 5.5: Anthropic documents low..max; flat ids like Opus 5.5 until the
   // live GetUsableModels roster lists the model.
+  // 261008 preemptive Haiku 5.5: flat regular low..max ids, per Cursor docs.
+  "claude-haiku-5-5": ["low", "medium", "high", "xhigh", "max"],
   "claude-sonnet-5-5": ["low", "medium", "high", "xhigh", "max"],
   "claude-sonnet-5": ["low", "medium", "high", "xhigh", "max"],
   "glm-5.2": ["high", "max"],

package/src/adapters/devin/live-models.ts

@@ -73,6 +73,8 @@ export const DEVIN_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "claude-fable-5-1": 1_000_000,
   // 260929 preemptive: Claude Sonnet 5.5 (1M per Anthropic) seeded before Devin's live catalog lists it.
   "claude-sonnet-5-5": 1_000_000,
+  // 261008 preemptive: Haiku 5.5 (1M per Anthropic), ahead of Devin live discovery.
+  "claude-haiku-5-5": 1_000_000,
   "claude-sonnet-5": 1_000_000,
   "glm-5-2": 200_000,
   "glm-5-3": 1_048_576,

package/src/adapters/kiro-retry.ts

@@ -183,12 +183,12 @@ async function fetchWithResetRecovery(
         sendClass: "transient", targetKey: destination, rebasedTarget: destinationRebased,
       });
       destinationRebased = false;
-      if (decision && (!decision.allowed || !decision.permit.use())) {
+      if (decision && !decision.allowed) {
         throw new SendBudgetExhaustedError(destination);
       }
       // Reported after admission and before dispatch, so a refused send is never counted and an
       // admitted one is counted exactly once whichever way the fetch below settles.
-      notePhysicalSend(attempt > 0);
+      const permit = decision?.allowed ? decision.permit : undefined;
       const requestUrl = request.url;
       try {
         const headers = new Headers(request.headers);
@@ -201,7 +201,12 @@ async function fetchWithResetRecovery(
           ...(recovered ? { keepalive: false } : {}),
         }, timeoutMs, ctx.abortSignal, ctx.stream, (async (input, init) => {
           try {
-            return await (executor.unpacedFetch ?? executor)(input, init);
+            const run = async (): Promise<Response> => {
+              if (permit && !permit.use()) throw new SendBudgetExhaustedError(destination);
+              notePhysicalSend(attempt > 0);
+              return (executor.unpacedFetch ?? executor)(input, init);
+            };
+            return await (permit?.execute ? permit.execute(run) : run());
           } catch (error) {
             if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
             const signal = init?.signal;
@@ -224,7 +229,7 @@ async function fetchWithResetRecovery(
           baseDelayMs: RESET_RETRY_BASE_MS,
           maxDelayMs: RESET_RETRY_MAX_MS,
         }), ctx.abortSignal);
-      }
+      } finally { permit?.release(); }
     } finally {
       releaseProviderRequestSlot(slot);
     }

package/src/adapters/openai-chat/messages.ts

@@ -142,11 +142,12 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
   };
 
   const nativeOpenAI = isNativeOpenAIChatTarget(provider);
-  // Qwen3.8-27B's pinned chat template rejects non-leading system and every developer role;
-  // a later user is rendered in place. Keep this exception specific to that template family.
-  // Gateways serve it under namespaced ids (LiteLLM's openai/Qwen3.8-27B, #6674), so any number
-  // of leading path segments is accepted; the final segment still has to name the checkpoint.
-  const qwen38LeadingSystemTemplate = !nativeOpenAI && /^(?:[^/]+\/)*(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?)$/i.test(parsed.modelId);
+  // Two pinned chat templates reject non-leading system and every developer role while a
+  // later user renders in place: Qwen3.8-27B and the OrcaSAQ-2-Cyber-27B GGUF family.
+  // Gateways serve them under namespaced ids (LiteLLM's openai/Qwen3.8-27B, #6674), so any
+  // number of leading path segments is accepted; the final segment names the checkpoint.
+  // Orca's GGUF marker must precede any colon quant tag; other Orca variants are unchanged.
+  const leadingSystemTemplate = !nativeOpenAI && /^(?:[^/]+\/)*(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?|OrcaSAQ-2-Cyber-27B(?=[^:/\s]*GGUF)[^:/\s]*(?::[\w-]+)?)$/i.test(parsed.modelId);
   // Which role a developer message carries, and why the unrecorded state folds, is stated once
   // in ./developer-role.ts and read from there by the native passthrough as well. Either way the
   // message keeps the slot it arrived in — only the role changes, never the position.
@@ -196,7 +197,7 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
           // message instead is rejected by some upstreams. Native OpenAI keeps its existing
           // empty-developer wire, which is a separate question from placement.
           if (!nativeOpenAI && text.length === 0) break;
-          chatMsg = { role: qwen38LeadingSystemTemplate ? "user" : developerWireRole, content: text };
+          chatMsg = { role: leadingSystemTemplate ? "user" : developerWireRole, content: text };
         } else if (typeof msg.content === "string") {
           chatMsg = { role: "user", content: msg.content };
         } else if (!hasStructured) {

package/src/adapters/physical-send.ts

@@ -36,11 +36,14 @@ export function createAdapterPhysicalSend(ctx: AdapterFetchContext = {}, fallbac
     const physicalExecutor = (async (input, init) => {
       if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
       if (init?.signal?.aborted) throw abortError(init.signal);
-      if (dispatched || (permit && !permit.use())) throw new SendBudgetExhaustedError(options.url);
-      dispatched = true;
-      ordinal += 1;
-      ctx.onPhysicalSend?.({ ordinal, ...(options.recovery ? { recovery: options.recovery } : {}) });
-      return (executor.unpacedFetch ?? executor)(input, init);
+      const run = async (): Promise<Response> => {
+        if (dispatched || (permit && !permit.use())) throw new SendBudgetExhaustedError(options.url);
+        dispatched = true;
+        ordinal += 1;
+        ctx.onPhysicalSend?.({ ordinal, ...(options.recovery ? { recovery: options.recovery } : {}) });
+        return (executor.unpacedFetch ?? executor)(input, init);
+      };
+      return permit?.execute ? permit.execute(run) : run();
     }) as typeof globalThis.fetch;
     let slot: ProviderRequestSlot | undefined;
     try {

package/src/adapters/qoder/adapter.ts

@@ -1,20 +1,25 @@
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../types";
+import { fileURLToPath } from "node:url";
 import type { AdapterRequest, ProviderAdapter } from "../base";
 import { mapReasoningEffort } from "../../reasoning-effort";
-import { buildSystemPrompt } from "../coding-agent/protocol";
-import { baseScopedEnv, runCodingAgentTurn, type CodingAgentDeps } from "../coding-agent/turn";
+import { buildSystemPrompt, MAX_TOOL_BLOCK_STARTS } from "../coding-agent/protocol";
+import { buildCodingAgentToolCatalog, CodingAgentToolCatalogError } from "../coding-agent/tool-catalog";
+import { baseScopedEnv, runCodingAgentTurn, type CodingAgentDeps, type CodingAgentToolBridgeInput } from "../coding-agent/turn";
 import { QODER_PROFILES, type QoderProfile } from "./profiles";
 import { QoderScaffoldFilter, QODER_SCAFFOLD_ERROR_CODE, qoderScaffoldErrorMessage } from "./scaffold-guard";
 
 export type QoderAdapterDeps = CodingAgentDeps;
 
+const QODER_MCP_SERVER_NAME = "opencodex";
+const QODER_MCP_SERVER_PATH = fileURLToPath(new URL("../coding-agent/mcp-server.ts", import.meta.url));
+
 export function buildQoderChildEnv(profile: QoderProfile, apiKey: string, systemPrompt?: string): Record<string, string> {
   const promptEnv = profile.region === "cn" ? "QODERCN_APPEND_SYSTEM_PROMPT" : "QODER_APPEND_SYSTEM_PROMPT";
   return { ...baseScopedEnv(), NO_COLOR: "1", [profile.tokenEnv]: apiKey,
     ...(systemPrompt ? { [promptEnv]: systemPrompt } : {}) };
 }
 
-/** Single-shot, tools-disabled Qoder CLI invocation; Codex remains the tool owner. */
+/** Disable Qoder's built-in tools; only a request-scoped MCP catalog can be exposed. */
 export function buildQoderArgs(parsed: OcxParsedRequest, provider: OcxProviderConfig): string[] {
   const args = [
     "-p",
@@ -35,8 +40,8 @@ export function buildQoderArgs(parsed: OcxParsedRequest, provider: OcxProviderCo
 /**
  * Wrap the turn's outbound channel with the scaffolding guard (#4190).
  *
- * The vendor CLI can put its own agent layer into the text channel despite being launched
- * with tools and MCP disabled, and the shared stream-json parser forwards a text delta
+ * The vendor CLI can put its own agent layer into the text channel despite built-in tools
+ * being disabled, and the shared stream-json parser forwards a text delta
  * without inspecting it. This is the last point that is still qoder-specific, so the guard
  * sits here rather than in the parser every coding-agent CLI shares.
  *
@@ -123,7 +128,36 @@ export function createQoderAdapter(provider: OcxProviderConfig, deps: QoderAdapt
         });
         return;
       }
-      // Qoder documents QODER_APPEND_SYSTEM_PROMPT for scoped child configuration.
+      let catalog: ReturnType<typeof buildCodingAgentToolCatalog>;
+      try {
+        catalog = buildCodingAgentToolCatalog(parsed, QODER_MCP_SERVER_NAME);
+      } catch (error) {
+        if (!(error instanceof CodingAgentToolCatalogError)) throw error;
+        emit({
+          type: "error",
+          message: "Invalid Qoder tool catalog.",
+          status: 400,
+          errorType: "invalid_request_error",
+          code: "tool_catalog_invalid",
+          retryable: false,
+        });
+        return;
+      }
+      const toolBridge: CodingAgentToolBridgeInput | undefined = catalog.tools.length > 0 || catalog.requireToolCall
+        ? {
+            serverName: QODER_MCP_SERVER_NAME,
+            serverModulePath: QODER_MCP_SERVER_PATH,
+            tools: catalog.tools,
+            emittedNameMap: catalog.emittedNameMap,
+            maxTurnToolCalls: MAX_TOOL_BLOCK_STARTS,
+            projectHistoryToolNames: true,
+            completeAssistantToolUse: true,
+            toolTurnCompletionSignal: "assistant_tool_use_stop",
+            allowedToolsFlag: "--allowed-tools",
+            standaloneEntrypoint: "__qoder-mcp",
+            requireToolCall: catalog.requireToolCall,
+          }
+        : undefined;
       // Keep the folded prompt out of argv and never inherit an ambient vendor prompt.
       const system = buildSystemPrompt(parsed);
       await runCodingAgentTurn({
@@ -135,6 +169,7 @@ export function createQoderAdapter(provider: OcxProviderConfig, deps: QoderAdapt
           buildArgs: (_profile, req, prov) => buildQoderArgs(req, prov),
           buildEnv: (profile, apiKey) => buildQoderChildEnv(profile as QoderProfile, apiKey, system),
           deps,
+          ...(toolBridge ? { toolBridge } : {}),
       });
     },
   };

package/src/adapters/qoder/scaffold-guard.ts

@@ -1,9 +1,8 @@
 /**
  * Vendor-scaffolding guard for the qoder route (#4190).
  *
- * The qoder route is contractually a text and reasoning surface: the CLI is spawned with
- * `--tools "" --strict-mcp-config --setting-sources ""`, and Codex keeps tool ownership.
- * The vendor CLI does not always honour that. It has been observed emitting its own agent
+ * Even with built-in tools disabled and strict MCP isolation, Codex keeps tool execution
+ * ownership. The vendor CLI does not always honour that. It has been observed emitting its own agent
  * layer into the assistant text channel — an MCP lazy-loading `<system-reminder>` block
  * listing the local machine's configured MCP servers, and framework tool-call markup with a
  * mismatched closer. Both reached the client verbatim, because the shared stream-json parser