@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/claude/inbound.ts

@@ -281,7 +281,7 @@ function userMessageToItems(content: unknown, input: Rec[], elide: SkillElisionC
   pushUserMessage(input, pending);
 }
 
-function assistantMessageToItems(content: unknown, input: Rec[], budget: TranslatorBudget): void {
+function assistantMessageToItems(content: unknown, input: Rec[], budget: TranslatorBudget, requestedModel: string, nativeReasoningReplay: Map<string, string>): void {
   if (typeof content === "string") {
     if (content.length > 0) input.push({ type: "message", role: "assistant", content: [{ type: "output_text", text: content }] });
     return;
@@ -314,6 +314,24 @@ function assistantMessageToItems(content: unknown, input: Rec[], budget: Transla
           const owned = decodeReasoningEnvelope(signature, budget);
           if (!owned) throw new AnthropicRequestError("malformed ocxr1 reasoning signature");
           if (Object.hasOwn(owned, "sig")) throw new AnthropicRequestError("OpenCodex reasoning continuity cannot be replayed as an Anthropic signature");
+          if (owned.nat) {
+            // The provider's own blob goes back only to the model that minted it; any other
+            // model gets the visible text alone, as before this envelope field existed.
+            const nat = owned.nat.model === requestedModel ? owned.nat : undefined;
+            if (nat) {
+              const previous = nativeReasoningReplay.get(nat.enc);
+              nativeReasoningReplay.set(nat.enc, previous === undefined || previous === nat.tag ? nat.tag : "");
+            }
+            if (nat) budget.chargeRetained(2 * nat.enc.length, { kind: "reasoning" });
+            if (thinking.length === 0 && !nat) break;
+            input.push({
+              type: "reasoning",
+              id: nat?.id ?? `rs_${crypto.randomUUID().replace(/-/g, "")}`,
+              summary: thinking.length > 0 ? [{ type: "summary_text", text: thinking }] : [],
+              ...(nat ? { encrypted_content: nat.enc } : {}),
+            });
+            break;
+          }
         }
         const encrypted = signature.length === 0 ? undefined : signature.startsWith(OCX_REASONING_PREFIX) ? signature : encodeReasoningEnvelope({ sig: signature }, budget);
         if (encrypted) budget.chargeRetained(2 * encrypted.length, { kind: "reasoning" });
@@ -355,6 +373,7 @@ export type ClaudeCacheKeySource = "metadata" | "system" | null;
 export interface ClaudeInboundTranslation {
   body: Rec;
   cacheKeySource: ClaudeCacheKeySource;
+  nativeReasoningReplay: ReadonlyMap<string, string>;
 }
 
 /**
@@ -400,6 +419,7 @@ function translateAnthropicRequest(
   }
 
   const input: Rec[] = [];
+  const nativeReasoningReplay = new Map<string, string>();
   const systemParts: string[] = [];
   const topLevelSystem = systemToInstructions(raw.system);
   if (topLevelSystem !== undefined) systemParts.push(topLevelSystem);
@@ -411,7 +431,7 @@ function translateAnthropicRequest(
   for (const msg of raw.messages) {
     if (!isRec(msg)) throw new AnthropicRequestError("each message must be an object");
     if (msg.role === "user") userMessageToItems(msg.content, input, elide);
-    else if (msg.role === "assistant") assistantMessageToItems(msg.content, input, budget);
+    else if (msg.role === "assistant") assistantMessageToItems(msg.content, input, budget, raw.model, nativeReasoningReplay);
     else if (msg.role === "system") {
       const text = systemMessageText(msg.content);
       // Keep it where the client put it. `developer` is first-class in the Responses
@@ -531,7 +551,61 @@ function translateAnthropicRequest(
       reasoning.effort = effortForThinkingBudget(thinking.budget_tokens);
     }
     body.reasoning = reasoning;
+    // store:false returns a provider's encrypted reasoning only on request. The outbound
+    // envelope (`nat`) carries it to the client so the next turn can hand it back.
+    body.include = ["reasoning.encrypted_content"];
   }
 
-  return { body, cacheKeySource };
+  return { body, cacheKeySource, nativeReasoningReplay };
+}
+
+/**
+ * Remove proxy-owned native blobs before sending a Messages body to native Anthropic.
+ *
+ * Every decode, and every re-encode on top of it, is reserved against the request's translator
+ * budget first (eight bytes per code unit, as `decodeReasoningEnvelope` does), and every new
+ * signature is charged as a retained copy, so a body of near-limit envelopes cannot allocate past the per-turn bound.
+ * Throws TranslatorBudgetExceededError when it would; callers answer 413.
+ */
+export function nativeAnthropicProjection(body: Rec, budget: TranslatorBudget): Rec {
+  if (!Array.isArray(body.messages)) return body;
+  let changed = false;
+  const messages = body.messages.flatMap(message => {
+    if (!isRec(message) || message.role !== "assistant" || !Array.isArray(message.content)) return [message];
+    let localChanged = false;
+    const content = message.content.flatMap(block => {
+      if (!isRec(block) || block.type !== "thinking" || typeof block.signature !== "string"
+        || !block.signature.startsWith(OCX_REASONING_PREFIX)) return [block];
+      // The decoded object stays alive while it is re-encoded, so its reservation is held until
+      // the new signature exists; the encode copies get their own reservation on top of it.
+      const decodeReservation = budget.reserveTransient(8 * block.signature.length, { kind: "reasoning" });
+      try {
+        let decoded: unknown;
+        try { decoded = JSON.parse(Buffer.from(block.signature.slice(OCX_REASONING_PREFIX.length), "base64").toString("utf8")); }
+        catch { decoded = undefined; }
+        if (!isRec(decoded)) { localChanged = true; return []; }
+        if (!Object.hasOwn(decoded, "nat")) return [block];
+        localChanged = true;
+        const { nat: _nat, ...rest } = decoded;
+        if (!rest.sig && !rest.red && !rest.krc && !(typeof rest.txt === "string" && rest.txt.length > 0)) return [];
+        // The re-encoded envelope is never larger than the decoded one (a field was removed), so a
+        // decode-sized reservation bounds the stringify, buffer and base64 copies before they exist.
+        const encodeReservation = budget.reserveTransient(8 * block.signature.length, { kind: "reasoning" });
+        let signature: string;
+        try {
+          signature = OCX_REASONING_PREFIX + Buffer.from(JSON.stringify(rest), "utf8").toString("base64");
+        } finally {
+          encodeReservation.release();
+        }
+        budget.chargeRetained(2 * signature.length, { kind: "reasoning" });
+        return [{ ...block, signature }];
+      } finally {
+        decodeReservation.release();
+      }
+    });
+    if (!localChanged) return [message];
+    changed = true;
+    return content.length ? [{ ...message, content }] : [];
+  });
+  return changed ? { ...body, messages } : body;
 }

package/src/claude/intercept/cli-catalog.ts

@@ -14,6 +14,7 @@
  */
 import { readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
+import { assertNotRealClaudeConfigUnderTest } from "../../lib/test-home-guard";
 import type { ClaudeFirstPartyDesired } from "../first-party-settings";
 import { classifyInterceptClient } from "./client-class";
 import { BOOTSTRAP_MAX_DECODED_BYTES, injectPickerModels, type PickerModelEntry } from "./picker-bootstrap";
@@ -150,6 +151,8 @@ export async function rewriteCliCatalogResponse(
  */
 export function invalidateClaudeCodeServedCatalog(claudeDir: string): number {
   const dir = join(claudeDir, "cache", "model-catalog");
+  // Outside the catch below: an armed test process must not prune the real Claude cache (#6775).
+  assertNotRealClaudeConfigUnderTest(claudeDir, dir);
   let names: string[];
   try { names = readdirSync(dir); } catch { return 0; } // no-excuse-ok: catch -- no cache directory means nothing to drop.
   let removed = 0;

package/src/claude/intercept/picker-ca-persistence.ts

@@ -1,5 +1,5 @@
 import { X509Certificate } from "node:crypto";
-import { constants, closeSync, fstatSync, lstatSync, openSync, readSync, realpathSync, rmSync, writeFileSync, type Stats } from "node:fs";
+import { constants, closeSync, fstatSync, lstatSync, openSync, readSync, realpathSync, rmSync, writeFileSync, type BigIntStats } from "node:fs";
 import { join } from "node:path";
 import {
   decodePickerCaCredential, openPickerCaCredential, pickerCaConfigId, readPickerCaCredential,
@@ -21,18 +21,19 @@ export function canonicalPickerConfigDir(configDir: string): string {
 
 /** Public records still cannot follow symlinks or accept oversized/malformed recovery data. */
 function readState(path: string, configId: string, initialization: boolean): Initialization | AuthorityMetadata | null {
-  let expected: Stats;
-  try { expected = lstatSync(path); }
+  // BigInt stats: a Windows file ID exceeds 2^53, so Number ino loses low bits and two files can compare equal.
+  let expected: BigIntStats;
+  try { expected = lstatSync(path, { bigint: true }); }
   catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw new Error("picker_ca_metadata_unsafe"); }
   if (expected.isSymbolicLink()) throw new Error("picker_ca_metadata_unsafe");
   let fd: number;
   try { fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); }
   catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw new Error("picker_ca_metadata_unsafe"); }
   try {
-    const stat = fstatSync(fd);
+    const stat = fstatSync(fd, { bigint: true });
     if (stat.dev !== expected.dev || stat.ino !== expected.ino) throw new Error("picker_ca_metadata_unsafe");
-    if (!stat.isFile() || stat.nlink !== 1 || stat.size > MAX_PUBLIC_STATE_BYTES
-      || (process.platform !== "win32" && stat.uid !== process.getuid!())) throw new Error();
+    if (!stat.isFile() || stat.nlink !== 1n || stat.size > BigInt(MAX_PUBLIC_STATE_BYTES)
+      || (process.platform !== "win32" && stat.uid !== BigInt(process.getuid!()))) throw new Error();
     const bytes = Buffer.alloc(MAX_PUBLIC_STATE_BYTES + 1);
     let used = 0;
     while (used < bytes.length) {

package/src/claude/intercept/picker-models.ts

@@ -7,7 +7,8 @@ import { dirname } from "node:path";
 import { nativeOpenAiContextWindow, type NativeContextLimitsInput } from "../../codex/catalog";
 import type { OcxClaudeDesktopProfile } from "../../types";
 import { aliasForRoute, claudeCodeNativeAlias } from "../alias";
-import { AUTO_CONTEXT_OFF, stripOneMillionMarker, withOneMillionMarker } from "../context-windows";
+import { AUTO_CONTEXT_OFF, stripOneMillionMarker, UNPAIRED_AUTO_CONTEXT, withOneMillionMarker, type AutoContextMode } from "../context-windows";
+import { isAnthropicClaudeRoute } from "../long-context";
 import { activeDesktop3pAlias, displayModelId, resolveDesktop3pAlias, type Desktop3pRoutedModel } from "../desktop-3p";
 import { reconcileDesktopProfile, renderDesktopProfile, type DesktopProfileModel } from "../desktop-profile";
 import type { PickerModelEntry } from "./picker-bootstrap";
@@ -17,6 +18,8 @@ export interface PickerRouteInput {
   routedModels: Desktop3pRoutedModel[];
   profile?: OcxClaudeDesktopProfile;
   nativeContextCap?: NativeContextLimitsInput;
+  /** resolveAutoContext(config.claudeCode); only its contextAccounting "200k" opt-in matters here. */
+  auto?: AutoContextMode;
 }
 
 /** Candidate routes in the gateway profile's order and with its labels. */
@@ -46,9 +49,14 @@ function splitRoute(route: string): { provider: string; id: string } {
   return { provider: route.slice(0, slash), id: route.slice(slash + 1) };
 }
 
-/** Desktop runners do not inherit the proxy's compaction env: mark only real >=1M windows. */
-function pickerSelector(alias: string, contextWindow: number | undefined): string {
-  return withOneMillionMarker(alias, contextWindow === undefined ? {} : { [alias]: contextWindow }, AUTO_CONTEXT_OFF)!;
+/**
+ * Desktop runners do not inherit the proxy's compaction env, so a long window (>= the default
+ * compact window) is marked on the strength of the `prompt is too long` recovery instead
+ * (devlog/_plan/261009_claude_1m_default/020). Real Anthropic models need a genuine 1M.
+ */
+function pickerSelector(alias: string, contextWindow: number | undefined, provider: string, id: string, auto?: AutoContextMode): string {
+  const mode = auto?.accounting200k ? auto : isAnthropicClaudeRoute(provider, id) ? AUTO_CONTEXT_OFF : UNPAIRED_AUTO_CONTEXT;
+  return withOneMillionMarker(alias, contextWindow === undefined ? {} : { [alias]: contextWindow }, mode)!;
 }
 
 export function buildPickerModels(input: PickerRouteInput): PickerModelEntry[] {
@@ -61,7 +69,7 @@ export function buildPickerModels(input: PickerRouteInput): PickerModelEntry[] {
     const alias = provider === "native" ? claudeCodeNativeAlias(id) : aliasForRoute(provider, id);
     if (!alias || seen.has(alias)) continue;
     seen.add(alias);
-    out.push({ id: pickerSelector(alias, model.contextWindow), name: model.label,
+    out.push({ id: pickerSelector(alias, model.contextWindow, provider, id, input.auto), name: model.label,
       ...(model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow }) });
   }
   return out;
@@ -81,7 +89,7 @@ export function buildCliPickerModels(input: PickerRouteInput): PickerModelEntry[
     const alias = activeDesktop3pAlias(provider, id);
     if (seen.has(alias) || resolveDesktop3pAlias(alias) !== model.route) continue;
     seen.add(alias);
-    out.push({ id: pickerSelector(alias, model.contextWindow), name: model.label,
+    out.push({ id: pickerSelector(alias, model.contextWindow, provider, id, input.auto), name: model.label,
       description: `opencodex · ${model.route}`, route: model.route,
       ...(model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow }) });
   }

package/src/claude/intercept/settings.ts

@@ -1,6 +1,7 @@
 import { mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { atomicWriteFile } from "../../config/atomic-write";
+import { assertNotRealClaudeConfigUnderTest } from "../../lib/test-home-guard";
 import { claudeConfigDir } from "../auth-detect";
 import { invalidateClaudeCodeServedCatalog } from "./cli-catalog";
 
@@ -112,6 +113,8 @@ export function inspectClaudeInterceptSettings(
 }
 
 function writeSettings(path: string, doc: SettingsDoc): void {
+  // An armed test process must not rewrite the real Claude settings.json (#6775).
+  assertNotRealClaudeConfigUnderTest(dirname(path), path);
   mkdirSync(dirname(path), { recursive: true });
   // The managed env embeds the proxy token, so the file must stay owner-only:
   // atomicWriteFile applies the real NTFS ACL on Windows where chmod is a no-op.

package/src/claude/long-context.ts

@@ -0,0 +1,66 @@
+/**
+ * Long-context thresholds shared by every Claude surface
+ * (devlog/_plan/261009_claude_1m_default/020_long_context_eligibility.md).
+ *
+ * A leaf module: desktop-3p.ts and desktop-profile.ts need the predicate, and context-windows.ts
+ * already imports desktop-3p.ts, so the predicate cannot live there.
+ */
+import { isAnthropicInstanceId } from "../providers/anthropic-instance-id";
+
+export const ONE_MILLION = 1_000_000;
+
+/** A window at or below this is Claude Code's own default accounting; widening it gains nothing. */
+export const AUTO_CONTEXT_FLOOR = 200_000;
+
+/**
+ * Auto-context defaults (devlog 260712 020, user-approved).
+ *
+ * The compact window is the token count at which Claude Code starts compacting, and it is
+ * also the floor `shouldMarkOneMillion` uses — a model may only carry the marker if it can
+ * host this window. 350,000 was chosen when the widest native row advertised 372,000.
+ *
+ * It now matches the auto-compaction limit the Codex catalog ships for the same models
+ * (`nativeAutoCompactLimit`: 829,800 against the 922,000 native window). Leaving the two
+ * apart meant one model compacting at 350k under Claude Code and at 829,800 under Codex.
+ * The value stays clear of the measured 922,000 ceiling by ~92k, so compaction still has
+ * room to run before the upstream refuses.
+ */
+export const AUTO_COMPACT_WINDOW_DEFAULT = 829_800;
+
+/**
+ * Whether a window earns the 1M selection on a surface whose Claude Code runner may not inherit
+ * CLAUDE_CODE_AUTO_COMPACT_WINDOW (Desktop pickers, discovery, Desktop 3P, generated subagents).
+ * A window >= 1M always does. A smaller one does when it can host the default compact window, so
+ * a runner that has the variable compacts in time, and one that lacks it overflows into the
+ * `prompt is too long` envelope (anthropicErrorBody) and compacts reactively. The floor is fixed
+ * on purpose: a custom compact window must not re-admit a 372k route (#854).
+ */
+export function isLongContextWindow(window: number | undefined): boolean {
+  if (typeof window !== "number" || window <= 0) return false;
+  return window >= ONE_MILLION || (window > AUTO_CONTEXT_FLOOR && window >= AUTO_COMPACT_WINDOW_DEFAULT);
+}
+
+/**
+ * A Claude model on an Anthropic-named route. Claude windows are 200k or a genuine 1M and a bare
+ * id rides the native passthrough, so the long-window rule never widens one: a Claude row listed
+ * under 1M is a capped one, and on a runner without the compaction env it keeps the 200k
+ * accounting it had before long windows were widened. Keyed on the model id as well, so a
+ * configured gateway that only shares the name `anthropic2` and serves other models keeps the
+ * long-window rule. A custom `anthropic2` gateway serving Claude below 1M is treated like a pool
+ * row on these surfaces, which is the pre-existing (unwidened) behavior.
+ */
+export function isAnthropicClaudeRoute(provider: string, modelId: string): boolean {
+  return isAnthropicInstanceId(provider) && modelId.startsWith("claude-");
+}
+
+/** Desktop 3P / picker / discovery / dashboard 1M eligibility for one provider route. */
+export function claudeSurfaceSupportsOneMillion(provider: string, modelId: string, window: number | undefined): boolean {
+  if (isAnthropicClaudeRoute(provider, modelId)) return typeof window === "number" && window >= ONE_MILLION;
+  return isLongContextWindow(window);
+}
+
+/** Same, for a `provider/id` route string. */
+export function routeSupportsOneMillion(route: string, window: number | undefined): boolean {
+  const slash = route.indexOf("/");
+  return claudeSurfaceSupportsOneMillion(route.slice(0, slash), route.slice(slash + 1), window);
+}

package/src/claude/model-info.ts

@@ -19,7 +19,8 @@ import { orderForModelPicker, catalogModelEfforts, nativeEffortClamp, nativeOpen
 import { claudeCodeAlias, claudeCodeNativeAlias } from "./alias";
 import { cursorFastIdFor } from "../adapters/cursor/catalog";
 import { desktop3pAlias } from "./desktop-3p";
-import { AUTO_CONTEXT_OFF, type AutoContextMode } from "./context-windows";
+import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, UNPAIRED_AUTO_CONTEXT, type AutoContextMode } from "./context-windows";
+import { isAnthropicClaudeRoute } from "./long-context";
 
 const MODEL_INFO_CREATED_AT = "2026-01-01T00:00:00Z";
 const ANTHROPIC_EFFORT_RUNGS = new Set(["low", "medium", "high", "xhigh", "max"]);
@@ -144,23 +145,25 @@ export function buildAnthropicModelInfos(
         : aliasForRoute(m.provider, m.id);
     }),
   ]);
-  // [1m] picker variant (devlog 260712 B1): Claude Code accounts exactly 1M for ids
-  // carrying the marker (2.1.207 binary: /\[1m\]/i → 1e6, compaction preserved), so
-  // ONLY models with an authoritative >=1M window get a second selectable row —
-  // the auto-context widening that let a 372K route carry the marker (and be
-  // over-filled) is the #854 defect and does not come back. Guards (audit R1#11):
-  // same dedupe set, never double-suffix.
+  // [1m] picker variant (devlog 260712 B1; widened in devlog/_plan/261009_claude_1m_default/020):
+  // Claude Code accounts exactly 1M for ids carrying the marker (2.1.207 binary: /\[1m\]/i -> 1e6,
+  // compaction preserved). A discovery client may lack CLAUDE_CODE_AUTO_COMPACT_WINDOW, so the
+  // rule is the fixed unpaired one (long-context.ts), not the configurable launch compact window:
+  // a custom 350k window must not re-admit a 372k route (#854). The server's auto mode only turns
+  // widening off (autoContext: false / maxContextTokens), falling back to >= 1M. Base and Fast
+  // rows stay unmarked: this list is a choice list. Guards (audit R1#11): same dedupe set, never
+  // double-suffix.
+  const variantMode = auto.enabled ? UNPAIRED_AUTO_CONTEXT : AUTO_CONTEXT_OFF;
   const push1mVariant = (
     base: AnthropicModelInfo,
     contextWindow: number | undefined,
     maxInputTokens?: number,
     selectorId?: string,
+    mode: AutoContextMode = variantMode,
   ) => {
-    // The [1m] marker makes Claude Code account 1e6 tokens for the row, so it
-    // may only name models whose AUTHORITATIVE effective window is >= 1M —
-    // never the auto-context widening, which would mark a 372K route and have
-    // Claude Code over-fill it (the #854 defect).
-    if (contextWindow === undefined || contextWindow < ONE_MILLION) return;
+    // A window >= 1M always earns the row; a long window earns it under the unpaired rule,
+    // because an overflow is answered as `prompt is too long`, which Claude Code compacts on.
+    if (!shouldMarkOneMillion(contextWindow, mode)) return;
     if (base.id.includes("[1m]")) return;
     const id = selectorId ?? `${base.id}[1m]`;
     if (seen.has(id)) return;
@@ -170,9 +173,9 @@ export function buildAnthropicModelInfos(
     // (measured — see devlog/_plan/260817_native_gpt56_1m_context/001_measurement_evidence.md).
     // Advertising the flat 1e6 there would invite mid-session context_length_exceeded, so the
     // variant reports whichever of the two is smaller.
-    const advertised = typeof maxInputTokens === "number" && maxInputTokens > 0
-      ? Math.min(ONE_MILLION, maxInputTokens)
-      : ONE_MILLION;
+    // A long window under 1M must not be advertised as 1e6 input either.
+    const ceiling = typeof maxInputTokens === "number" && maxInputTokens > 0 ? maxInputTokens : contextWindow;
+    const advertised = typeof ceiling === "number" && ceiling > 0 ? Math.min(ONE_MILLION, ceiling) : ONE_MILLION;
     out.push({ ...base, id, display_name: `${base.display_name} · 1M`, max_input_tokens: advertised });
   };
   /**
@@ -251,7 +254,7 @@ export function buildAnthropicModelInfos(
       && listedModelId.startsWith("claude-fable-")
       ? `${claudeCodeNativeAlias(listedModelId)}[1m]`
       : undefined;
-    push1mVariant(info, m.contextWindow, routedMaxInput, oneMillionSelector);
+    push1mVariant(info, m.contextWindow, routedMaxInput, oneMillionSelector, isAnthropicClaudeRoute(m.provider, m.id) ? AUTO_CONTEXT_OFF : variantMode);
     // The whole model is passed, not a (provider, id) pair: a combo row lives in its own
     // namespace with no config.providers entry, so the caller classifies it from the
     // aggregated supportsServiceTier the row already carries.

package/src/claude/outbound.ts

@@ -20,7 +20,7 @@ import {
   type TranslatorBudget,
 } from "../lib/translator-budget";
 import { sseFieldOffset, sseFieldValue } from "../lib/sse-decoder";
-import { decodeReasoningEnvelope, encodeReasoningEnvelope } from "../responses/reasoning-envelope";
+import { decodeReasoningEnvelope, encodeReasoningEnvelope, OCX_REASONING_PREFIX } from "../responses/reasoning-envelope";
 
 type Rec = Record<string, unknown>;
 
@@ -70,8 +70,67 @@ export function anthropicErrorType(status: number): string {
   }
 }
 
+/**
+ * Claude Code compacts reactively only when an oversized-prompt refusal is worded the way the
+ * Anthropic API words it: it looks for `prompt is too long` (or `input is too long for requested
+ * model`) in the message and reads `prompt is too long: <actual> tokens > <limit> maximum` for the
+ * gap (2.1.288 binary). Routed providers word the same refusal differently, so a
+ * context_length_exceeded envelope is rewritten into that form. Counts are carried over only when
+ * the upstream states both of them; otherwise the original text is prefixed and no number is
+ * guessed. Without this the client ends the turn on a fatal error instead of compacting
+ * (devlog/_plan/261009_claude_1m_default/010).
+ */
+const CLAUDE_PROMPT_TOO_LONG_RE = /prompt is too long|input is too long for requested model/i;
+const STATED_CONTEXT_COUNTS_RE = /maximum context length is (\d+) tokens[\s\S]*?(?:resulted in|you requested) (\d+) tokens/i;
+
+export function claudePromptTooLongMessage(message: string): string {
+  if (CLAUDE_PROMPT_TOO_LONG_RE.test(message)) return message;
+  const counts = STATED_CONTEXT_COUNTS_RE.exec(message);
+  if (counts) return `prompt is too long: ${counts[2]} tokens > ${counts[1]} maximum`;
+  return `prompt is too long: ${message}`;
+}
+
+/** Provider wordings of an oversized-input refusal, for lanes that relay a provider's own error text. */
+const CONTEXT_OVERFLOW_TEXT_RE = /prompt is too long|input is too long|context window|context length|maximum context|too many tokens|model token limit/i;
+
+export function isContextOverflowText(message: string): boolean {
+  return CONTEXT_OVERFLOW_TEXT_RE.test(message);
+}
+
+/**
+ * SSE payload rewrite for the native Messages lane: an `error` event that refuses an oversized
+ * input gets the Anthropic wording; every other payload passes through byte-identical. The type
+ * gate keeps a rate limit that happens to mention the context window untouched.
+ */
+export function claudeOverflowSsePayload(payload: string): string {
+  if (!payload.includes("\"error\"")) return payload;
+  let parsed: unknown;
+  try { parsed = JSON.parse(payload); } catch { return payload; }
+  if (!isRec(parsed) || parsed.type !== "error" || !isRec(parsed.error)) return payload;
+  const error = parsed.error;
+  const message = typeof error.message === "string" ? error.message : "";
+  const sized = error.type === "invalid_request_error" || error.type === "request_too_large";
+  if (!sized || isThroughputLimitText(message)) return payload;
+  if (!(error.code === "context_length_exceeded" || isContextOverflowText(message))) return payload;
+  const next = claudePromptTooLongMessage(message);
+  return next === message ? payload : JSON.stringify({ ...parsed, error: { ...error, message: next } });
+}
+
+/**
+ * A throughput limit that the shared classifier files under context_length_exceeded (its "too many
+ * tokens" match also catches "too many tokens per minute"). Worded as an overflow it would make
+ * Claude Code compact a conversation that only needs to wait, so it keeps its own text.
+ */
+const THROUGHPUT_LIMIT_TEXT_RE = /\bper (?:second|minute|hour|day)\b|\brate limit|\bquota\b|\btpm\b/i;
+
+export function isThroughputLimitText(message: string): boolean {
+  return THROUGHPUT_LIMIT_TEXT_RE.test(message);
+}
+
 export function anthropicErrorBody(status: number, message: string, type?: string, code?: string): Rec {
-  return { type: "error", error: { type: type ?? anthropicErrorType(status), message, ...(code ? { code } : {}) } };
+  const overflow = code === "context_length_exceeded" && !isThroughputLimitText(message);
+  const text = overflow ? claudePromptTooLongMessage(message) : message;
+  return { type: "error", error: { type: type ?? anthropicErrorType(status), message: text, ...(code ? { code } : {}) } };
 }
 
 export function anthropicErrorResponse(status: number, message: string, type?: string, code?: string): Response {
@@ -280,6 +339,13 @@ interface OpenBlock {
   thinkingBuf?: string;
   thinkingBufBytes?: number;
   reasoningSig?: string;
+  /** The provider's own encrypted reasoning for this item; signed into the block on close. */
+  reasoningNative?: { enc: string; id?: string };
+}
+
+/** A provider-minted (not ocxr1) `encrypted_content`, or `""`. */
+function nativeEncryptedReasoning(encrypted: string): string {
+  return encrypted.length > 0 && !encrypted.startsWith(OCX_REASONING_PREFIX) ? encrypted : "";
 }
 
 /** Streaming: Responses SSE bytes -> Anthropic Messages SSE bytes. */
@@ -294,6 +360,7 @@ export function responsesSseToAnthropicSse(
      * upstream sent no confirmed usage before the first frame. See `messageSnapshot` (#4857).
      */
     inputTokenFloor?: number;
+    nativeReasoningTagFor?: (blob: string) => string | undefined;
   },
 ): ReadableStream<Uint8Array> {
   const translatorBudget = opts.translatorBudget;
@@ -382,6 +449,13 @@ export function responsesSseToAnthropicSse(
           open.webSearchArgsEmitted = true;
         }
         if (open.kind === "thinking") {
+          const native = open.reasoningNative;
+          const tag = native && opts.nativeReasoningTagFor?.(native.enc);
+          if (!open.thinkingBuf && !open.reasoningSig && !tag) {
+            releaseThinkingBuffer(open);
+            open = null;
+            return;
+          }
           // Delay the index and all thinking frames until closure so a matching
           // done envelope can put its redacted blocks first. The existing buffer
           // remains charged through signature emission, including queued frames.
@@ -396,7 +470,10 @@ export function responsesSseToAnthropicSse(
               delta: { type: "thinking_delta", thinking: open.thinkingBuf },
             });
           }
-          const signature = open.reasoningSig ?? encodeReasoningEnvelope({ txt: open.thinkingBuf ?? "" }, translatorBudget);
+          const signature = open.reasoningSig ?? encodeReasoningEnvelope({
+            txt: open.thinkingBuf ?? "",
+            ...(tag ? { nat: { ...native, model, tag } } : {}),
+          }, translatorBudget);
           emit("content_block_delta", {
             type: "content_block_delta", index: open.index,
             delta: { type: "signature_delta", signature },
@@ -684,11 +761,15 @@ export function responsesSseToAnthropicSse(
                 emit("content_block_start", { type: "content_block_start", index: idx, content_block: { type: "redacted_thinking", data } });
                 emit("content_block_stop", { type: "content_block_stop", index: idx });
               }
-              if (env?.sig && open?.kind !== "thinking") {
+              // A provider's own blob is the only copy of its reasoning the client can hold, so
+              // it gets a thinking block even when no summary text arrived.
+              const native = nativeEncryptedReasoning(encrypted);
+              if ((env?.sig || native) && open?.kind !== "thinking") {
                 ensureBlock("thinking");
               }
               if (open?.kind === "thinking") {
                 if (env?.sig) open.reasoningSig = env.sig;
+                if (native) open.reasoningNative = typeof item.id === "string" && item.id.length > 0 ? { enc: native, id: item.id } : { enc: native };
                 closeOpenBlock();
               }
             }
@@ -881,7 +962,7 @@ export function responsesSseToAnthropicSse(
 }
 
 /** Non-streaming: /v1/responses JSON -> Anthropic message JSON. */
-export function responsesJsonToAnthropicMessage(json: unknown, model: string, translatorBudget?: TranslatorBudget): Rec {
+export function responsesJsonToAnthropicMessage(json: unknown, model: string, translatorBudget?: TranslatorBudget, nativeReasoningTagFor?: (blob: string) => string | undefined): Rec {
   const body = isRec(json) ? json : {};
   const output = Array.isArray(body.output) ? body.output : [];
   const content: Rec[] = [];
@@ -917,10 +998,14 @@ export function responsesJsonToAnthropicMessage(json: unknown, model: string, tr
         // Legacy combined envelopes place redacted blocks before the signed block,
         // matching the Anthropic adapter. New bridge output uses separate items.
         for (const data of env?.red ?? []) content.push({ type: "redacted_thinking", data });
-        // env.txt may be locally hidden text. Do not expose it here or manufacture
-        // a new signed continuity carrier; hidden-summary replay remains limited.
-        if (parts.length > 0 || env?.sig) {
-          content.push({ type: "thinking", thinking: parts.join("\n\n"), signature: env?.sig ?? encodeReasoningEnvelope({ txt: parts.join("\n\n") }, translatorBudget) });
+        // env.txt may be locally hidden text. Do not expose it here. A provider's own blob is
+        // carried in the envelope so the next request can hand it back (see inbound.ts).
+        const native = nativeEncryptedReasoning(encrypted);
+        const tag = native && nativeReasoningTagFor?.(native);
+        if (parts.length > 0 || env?.sig || tag) {
+          const text = parts.join("\n\n");
+          const nat = tag ? { enc: native, model, tag, ...(typeof raw.id === "string" && raw.id.length > 0 ? { id: raw.id } : {}) } : undefined;
+          content.push({ type: "thinking", thinking: text, signature: env?.sig ?? encodeReasoningEnvelope({ txt: text, ...(nat ? { nat } : {}) }, translatorBudget) });
         }
         break;
       }

package/src/claude/subagent-model.ts

@@ -1,6 +1,7 @@
 import type { OcxConfig } from "../types";
 import { claudeCodeAlias, claudeCodeNativeAlias, resolveAlias } from "./alias";
-import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, withOneMillionMarker } from "./context-windows";
+import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, UNPAIRED_AUTO_CONTEXT, withOneMillionMarker, type AutoContextMode } from "./context-windows";
+import { isAnthropicClaudeRoute } from "./long-context";
 import { hasOwnProvider } from "../config";
 import { knownModelIdsForProvider } from "../router";
 import { decodeRoutedModelIdOrThrow } from "../providers/slug-codec";
@@ -14,20 +15,43 @@ export { SAFE_AGENT_MODEL_ID } from "../config/subagent-models";
 
 /**
  * Generated subagent defs cannot rely on the parent's auto-context compaction
- * pairing, so their [1m] marker follows the AUTHORITATIVE window only: mark when
- * the effective window (exact selector, then the canonical [1m] form, then bare)
- * is genuinely >= 1M; strip an inherited unsafe marker back to the bare selector;
- * with no window information, keep the selector as it was. Genuine routed [1m]
- * ids are preserved through the canonical-exact lookup. (#854)
+ * pairing, so their [1m] marker follows the unpaired long-context rule
+ * (long-context.ts): mark when the effective window (exact selector, then the
+ * canonical [1m] form, then bare) is >= 1M or can host the default compact window,
+ * whose overflow Claude Code compacts on as `prompt is too long`; strip an inherited
+ * marker the window cannot carry; with no window information, keep the selector as it
+ * was. Genuine routed [1m] ids are preserved through the canonical-exact lookup.
+ * (#854; devlog/_plan/261009_claude_1m_default/020)
  */
-export function withSubagentContextMarker(selector: string, windows: Record<string, number>): string {
+/**
+ * The marking mode a subagent selector gets: real Anthropic models (a bare `claude-*` passthrough
+ * id, or a Claude row on either Anthropic pool) need a genuine 1M; everything else follows the
+ * unpaired long-context rule. Connected launches read windows from the published catalog, which
+ * does not drop capped Anthropic rows, so this cannot rely on the window map alone.
+ */
+function subagentSelectorMode(bare: string): AutoContextMode {
+  const route = resolveAlias(bare) ?? resolveDesktop3pAlias(bare) ?? bare;
+  const slash = route.indexOf("/");
+  const anthropic = slash < 0
+    ? route.startsWith("claude-")
+    : isAnthropicClaudeRoute(route.slice(0, slash), route.slice(slash + 1));
+  return anthropic ? AUTO_CONTEXT_OFF : UNPAIRED_AUTO_CONTEXT;
+}
+
+/**
+ * `accounting200k` (claudeCode.contextAccounting "200k") stops automatic marking only: an unmarked
+ * selector stays bare, while an explicit [1m] still follows its selector's safety rule.
+ */
+export function withSubagentContextMarker(selector: string, windows: Record<string, number>, accounting200k = false): string {
   const bare = stripOneMillionMarker(selector);
   const wasMarked = selector !== bare;
   const canonicalExact = wasMarked ? `${bare}[1m]` : selector;
   const authoritativeWindow = windows[selector] ?? windows[canonicalExact] ?? windows[bare];
   if (typeof authoritativeWindow === "number" && authoritativeWindow > 0) {
-    return shouldMarkOneMillion(authoritativeWindow, AUTO_CONTEXT_OFF)
-      ? (withOneMillionMarker(selector, windows) ?? selector)
+    if (accounting200k && !wasMarked) return bare;
+    const mode = subagentSelectorMode(bare);
+    return shouldMarkOneMillion(authoritativeWindow, mode)
+      ? (withOneMillionMarker(selector, windows, mode) ?? selector)
       : bare;
   }
   return wasMarked ? selector : bare;
@@ -56,6 +80,11 @@ function selectorIdentity(selector: string): string {
   return fullSelectorIdentity(stripOneMillionMarker(selector));
 }
 
+/** Whether the config opted into 200k accounting (shared by roster, self and force markers). */
+export function accountsAt200k(config: OcxConfig): boolean {
+  return config.claudeCode?.contextAccounting === "200k";
+}
+
 /** Resolve only currently exposed entries; retained roster rows are not exposure proof. */
 export function resolveSubagentForceModel(config: OcxConfig, windows: Record<string, number>, available: SubagentForceExposure): string | null {
   const entry = config.claudeCode?.subagentModelForce;
@@ -77,8 +106,8 @@ export function resolveSubagentForceModel(config: OcxConfig, windows: Record<str
     const window = windows[parts.alias] ?? windows[`${bare}[1m]`] ?? windows[bare];
     // Identity admission must not let an appended context promise ride on an
     // ordinary exposed model. Exact catalog ids such as kimi/k3[1m] remain literal.
-    if (requestedMarker && !exactMarkedExposure && !(typeof window === "number" && Number.isFinite(window) && window >= 1_000_000)) return null;
-    const marked = exactMarkedExposure ? parts.alias : withSubagentContextMarker(parts.alias, windows);
+    if (requestedMarker && !exactMarkedExposure && !(typeof window === "number" && Number.isFinite(window) && shouldMarkOneMillion(window, subagentSelectorMode(bare)))) return null;
+    const marked = exactMarkedExposure ? parts.alias : withSubagentContextMarker(parts.alias, windows, accountsAt200k(config));
     // Bare Anthropic names are indistinguishable from the old CLI's fallback.
     // Encode only the force selector; handlers restore native identity before
     // their existing credential/model-map checks. Roster generation is unchanged.