@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/generated/model-metadata.ts

@@ -47,7 +47,7 @@ const DATA: Record<string, readonly Row[]> = {
   "azure-openai": [["gpt-4.1",1047576,32768,"text,image",0,null,2,8,0.5,0],["gpt-4o",128000,16384,"text,image",0,null,2.5,10,1.25,0],["gpt-4o-mini",128000,16384,"text,image",0,null,0.15,0.6,0.075,0],["o3",200000,100000,"text,image",1,null,2,8,0.5,0],["o3-mini",200000,100000,"text",1,null,1.1,4.4,0.55,0]],
   "cerebras": [["gemma-4-31b",131072,40960,"text,image",1,null,0.99,1.49,0,0],["gpt-oss-120b",131072,40960,"text",1,null,0.35,0.75,0,0],["llama3.1-8b",32000,8000,"text",0,null,0.1,0.1,0,0],["qwen-3-235b-a22b-instruct-2507",131000,32000,"text",0,null,0.6,1.2,0,0],["qwen-3-coder-480b",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.6",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.7",131072,40960,"text",1,null,2.25,2.75,2.25,0]],
   "deepseek": [["deepseek-v4-flash",1048576,384000,"text",1,null,0.14,0.28,0.0028,0],["deepseek-v4-pro",1048576,384000,"text",1,null,0.435,0.87,0.003625,0]],
-  "google": [["deep-research-max-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["deep-research-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["gemini-1.5-flash",1000000,8192,"text,image",0,null,0.075,0.3,0.01875,0],["gemini-1.5-flash-8b",1000000,8192,"text,image",0,null,0.0375,0.15,0.01,0],["gemini-1.5-pro",1000000,8192,"text,image",0,null,1.25,5,0.3125,0],["gemini-2.0-flash",1048576,8192,"text,image",0,null,0.1,0.4,0.025,0],["gemini-2.0-flash-lite",1048576,8192,"text,image",0,null,0.075,0.3,0,0],["gemini-2.5-computer-use-preview-10-2025",131072,65536,"text,image",1,null,1.25,10,0,0],["gemini-2.5-flash",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-2.5-flash-lite",1048576,65536,"text,image",1,null,0.1,0.4,0.01,0],["gemini-2.5-flash-lite-preview-06-17",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-lite-preview-09-2025",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-preview-04-17",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-05-20",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-09-2025",1048576,65536,"text,image",1,null,0.3,2.5,0.075,0],["gemini-2.5-pro",1048576,65536,"text,image",1,null,1.25,10,0.125,0],["gemini-2.5-pro-preview-05-06",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-2.5-pro-preview-06-05",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-3-flash-preview",1048576,65536,"text,image",1,null,0.5,3,0.05,0],["gemini-3-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-flash-lite",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-lite-image",65536,65536,"text,image",1,null,0.25,30,0,0],["gemini-3.1-flash-lite-preview",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-live-preview",131072,65536,"text,image",1,null,0.75,4.5,0,0],["gemini-3.1-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-pro-preview-customtools",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.5-flash",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-3.5-flash-lite",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-3.6-flash",1048576,65536,"text,image",1,null,1.5,7.5,0.15,0],["gemini-3.7-flash",1048576,65536,"text,image",1],["gemini-3.8-flash",1048576,65536,"text,image",1],["gemini-flash-latest",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-flash-lite-latest",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-live-2.5-flash",128000,8000,"text,image",1,null,0.5,2,0,0],["gemini-live-2.5-flash-preview-native-audio",131072,65536,"text",1,null,0.5,2,0,0],["gemini-robotics-er-1.6-preview",131072,65536,"text,image",1,null,1,5,0,0],["gemma-3-27b-it",131072,8192,"text,image",0,null,0,0,0,0],["gemma-4-26b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-26b-a4b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-26b-it",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-E2B-it",131072,8192,"text,image",1,null,0,0,0,0],["gemma-4-E4B-it",131072,8192,"text,image",1,null,0,0,0,0]],
+  "google": [["deep-research-max-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["deep-research-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["gemini-1.5-flash",1000000,8192,"text,image",0,null,0.075,0.3,0.01875,0],["gemini-1.5-flash-8b",1000000,8192,"text,image",0,null,0.0375,0.15,0.01,0],["gemini-1.5-pro",1000000,8192,"text,image",0,null,1.25,5,0.3125,0],["gemini-2.0-flash",1048576,8192,"text,image",0,null,0.1,0.4,0.025,0],["gemini-2.0-flash-lite",1048576,8192,"text,image",0,null,0.075,0.3,0,0],["gemini-2.5-computer-use-preview-10-2025",131072,65536,"text,image",1,null,1.25,10,0,0],["gemini-2.5-flash",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-2.5-flash-lite",1048576,65536,"text,image",1,null,0.1,0.4,0.01,0],["gemini-2.5-flash-lite-preview-06-17",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-lite-preview-09-2025",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-preview-04-17",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-05-20",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-09-2025",1048576,65536,"text,image",1,null,0.3,2.5,0.075,0],["gemini-2.5-pro",1048576,65536,"text,image",1,null,1.25,10,0.125,0],["gemini-2.5-pro-preview-05-06",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-2.5-pro-preview-06-05",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-3-flash-preview",1048576,65536,"text,image",1,null,0.5,3,0.05,0],["gemini-3-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-flash-lite",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-lite-image",65536,65536,"text,image",1,null,0.25,30,0,0],["gemini-3.1-flash-lite-preview",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-live-preview",131072,65536,"text,image",1,null,0.75,4.5,0,0],["gemini-3.1-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-pro-preview-customtools",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.5-flash",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-3.5-flash-lite",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-3.6-flash",1048576,65536,"text,image",1,null,1.5,7.5,0.15,0],["gemini-3.7-flash",1048576,65536,"text,image",1],["gemini-3.8-flash",1048576,65536,"text,image",1],["gemini-4-argon",1048576,65536,"text,image",1],["gemini-flash-latest",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-flash-lite-latest",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-live-2.5-flash",128000,8000,"text,image",1,null,0.5,2,0,0],["gemini-live-2.5-flash-preview-native-audio",131072,65536,"text",1,null,0.5,2,0,0],["gemini-robotics-er-1.6-preview",131072,65536,"text,image",1,null,1,5,0,0],["gemma-3-27b-it",131072,8192,"text,image",0,null,0,0,0,0],["gemma-4-26b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-26b-a4b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-26b-it",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-E2B-it",131072,8192,"text,image",1,null,0,0,0,0],["gemma-4-E4B-it",131072,8192,"text,image",1,null,0,0,0,0]],
   "minimax": [["MiniMax-M2",196608,128000,"text",1,null,0.3,1.2,0,0],["MiniMax-M2.1",204800,131072,"text",1,null,0.3,1.2,0,0],["MiniMax-M2.5",204800,131072,"text",1,null,0.3,1.2,0.03,0.375],["MiniMax-M2.5-highspeed",204800,131072,"text",1,null,0.6,2.4,0.06,0.375],["MiniMax-M2.5-lightning",204800,32000,"text",1,null,0.3,2.4,0,0],["MiniMax-M2.7",204800,131072,"text",1,null,0.3,1.2,0.06,0.375],["MiniMax-M2.7-highspeed",204800,131072,"text",1,null,0.6,2.4,0.06,0.375],["minimax-m3",512000,128000,"text,image",1,null,0.6,2.4,0.12,0],["MiniMax-M3",1000000,128000,"text,image,video",1,null,0.3,1.2,0.06,0],["MiniMax-M3.1-Flash-Preview",1000000,null,"text,image,video",1]],
   "mistral": [["codestral-latest",256000,4096,"text",0,null,0.3,0.9,0,0],["devstral-2512",262144,262144,"text",0,null,0.4,2,0,0],["devstral-latest",262144,262144,"text",0,null,0.4,2,0,0],["devstral-medium-2507",128000,128000,"text",0,null,0.4,2,0,0],["devstral-medium-latest",262144,262144,"text",0,null,0.4,2,0,0],["devstral-small-2505",128000,128000,"text",0,null,0.1,0.3,0,0],["devstral-small-2507",128000,128000,"text",0,null,0.1,0.3,0,0],["labs-devstral-small-2512",256000,256000,"text,image",0,null,0,0,0,0],["magistral-medium-latest",128000,16384,"text",1,null,2,5,0,0],["magistral-small",128000,128000,"text",1,null,0.5,1.5,0,0],["ministral-3b-latest",128000,128000,"text",0,null,0.04,0.04,0,0],["ministral-8b-latest",128000,128000,"text",0,null,0.1,0.1,0,0],["mistral-large-2411",131072,16384,"text",0,null,2,6,0,0],["mistral-large-2512",262144,262144,"text,image",0,null,0.5,1.5,0,0],["mistral-large-latest",262144,262144,"text,image",0,null,0.5,1.5,0,0],["mistral-medium-2505",131072,131072,"text,image",0,null,0.4,2,0,0],["mistral-medium-2508",262144,262144,"text,image",0,null,0.4,2,0,0],["mistral-medium-2604",262144,262144,"text,image",1,null,1.5,7.5,0,0],["mistral-medium-latest",262144,262144,"text,image",1,null,1.5,7.5,0,0],["mistral-nemo",128000,128000,"text",0,null,0.15,0.15,0,0],["mistral-small-2506",128000,16384,"text,image",0,null,0.1,0.3,0,0],["mistral-small-2603",256000,256000,"text,image",1,null,0.15,0.6,0,0],["mistral-small-latest",256000,256000,"text,image",1,null,0.15,0.6,0,0],["open-mistral-7b",8000,8000,"text",0,null,0.25,0.25,0,0],["open-mistral-nemo",128000,128000,"text",0,null,0.15,0.15,0,0],["open-mixtral-8x22b",64000,64000,"text",0,null,2,6,0,0],["open-mixtral-8x7b",32000,32000,"text",0,null,0.7,0.7,0,0],["pixtral-12b",128000,128000,"text,image",0,null,0.15,0.15,0,0],["pixtral-large-latest",128000,128000,"text,image",0,null,2,6,0,0]],
   "moonshot": [["kimi-k2.5",262144,65536,"text,image",1,null,0,0,0,0]],

package/src/integrations/catalog-refresh.ts

@@ -12,7 +12,7 @@ import {
 /** Refresh only previously connected clients; a refused file never blocks its peers. */
 export async function refreshOwnedCatalogIntegrations(
   input: Omit<OwnedIntegrationRefreshInput, "clientId">,
-  clientIds: readonly IntegrationClientId[] = ["pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo"],
+  clientIds: readonly IntegrationClientId[] = ["pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo", "qoder"],
   options: { refreshOnly?: boolean; admit?: () => boolean } = {},
 ): Promise<OwnedIntegrationRefreshOutcome[]> {
   // Client files are shared with the live proxy a sibling instance runs beside; their entries

package/src/integrations/config-io.ts

@@ -7,8 +7,9 @@
  *
  * Design of record: devlog/_fin/260802_client_toggle_api/021 §5-6.
  */
-import { lstatSync, mkdirSync, readFileSync, rmSync, statSync } from "node:fs";
+import { lstatSync, mkdirSync, rmSync, statSync } from "node:fs";
 import type { ConfigFormat } from "../clients/config-export";
+import { readBoundedRegularFileSync } from "../lib/bounded-file-read";
 import { canonicalizeJsonc } from "../lib/jsonc";
 import { MAX_JSON_NESTING } from "./serialize";
 import { atomicWriteFileNoFollow, isMissingPathError } from "../config/atomic-write";
@@ -24,6 +25,10 @@ import type { IntegrationClientId } from "./registry";
  * then overwritten.
  */
 export const PARSE_FAILED = Symbol("parse-failed");
+const MAX_INTEGRATION_CONFIG_FILE_BYTES = 4 * 1024 * 1024;
+
+/** Raised before any target mutation, including pending-marker creation. */
+export class IntegrationWriteSizeError extends Error {}
 
 /**
  * What `JSON.parse` has already discarded by the time we hold the parsed value,
@@ -285,7 +290,7 @@ export function fileIO(): Omit<IntegrationIO, "appendJournal" | "putRecord" | "d
     lstatKind,
     readText: path => {
       try {
-        return { kind: "text", text: readFileSync(path, "utf8") };
+        return { kind: "text", text: readBoundedRegularFileSync(path, MAX_INTEGRATION_CONFIG_FILE_BYTES).toString("utf8") };
       } catch (error) {
         const code = (error as NodeJS.ErrnoException).code;
         return code === "ENOENT" ? { kind: "missing" } : { kind: "failed", ...(code ? { code } : {}) };
@@ -300,6 +305,19 @@ export function fileIO(): Omit<IntegrationIO, "appendJournal" | "putRecord" | "d
       }
     },
     writeText: (path, text) => {
+      /*
+       * One bound on both halves of the seam: a file past this size is one
+       * readText refuses, so writing it would strand the integration against
+       * its own configuration — or, for Cline's pending marker, leave a
+       * transaction recovery could never read back.
+       */
+      const bytes = Buffer.byteLength(text, "utf8");
+      if (bytes > MAX_INTEGRATION_CONFIG_FILE_BYTES) {
+        throw new IntegrationWriteSizeError(
+          `refusing oversized integration write to ${path}: `
+          + `${bytes} bytes is past the ${MAX_INTEGRATION_CONFIG_FILE_BYTES}-byte read bound`,
+        );
+      }
       const kind = lstatKind(path);
       if (kind !== "file" && kind !== "missing") {
         throw new Error(`refusing unsafe integration write target: ${path}`);

package/src/integrations/journal.ts

@@ -16,7 +16,7 @@ import { randomUUID } from "node:crypto";
 import { appendFileSync, existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { atomicWriteFile } from "../config";
-import { ensureDir, fingerprint, integrationsDir, isOwnershipRecord, type OwnershipRecord } from "./ownership";
+import { ensureDir, fingerprint, integrationsDir, isOwnershipRecord, readRecordsStrict, type OwnershipRecord } from "./ownership";
 import { isIntegrationClientId, type IntegrationClientId } from "./registry";
 
 /**
@@ -171,6 +171,20 @@ export function captureSnapshot(
   return { kind: "stored", relPath: join("snapshots", clientId, opId) };
 }
 
+/** Remove only an unused pre-write snapshot; uncertain or committed evidence survives. */
+export function discardUncommittedSnapshot(
+  clientId: IntegrationClientId,
+  opId: string,
+  dir: string = integrationsDir(),
+): void {
+  const target = containedPath(dir, "snapshots", assertSafeComponent(clientId, "clientId"), assertSafeComponent(opId, "opId"));
+  if (findCommittedOperation(opId, dir)
+    || Object.values(readRecordsStrict(dir)).some(record => record?.opId === opId)) {
+    throw new Error("integration snapshot still belongs to a recorded operation");
+  }
+  rmSync(target, { force: true });
+}
+
 /** Commit the row. Pruning is post-commit and can never fail the append. */
 export function appendOperation(entry: JournalEntry, dir: string = integrationsDir()): void {
   ensureDir(journalPath(dir));

package/src/integrations/mutation-plan.ts

@@ -131,6 +131,7 @@ export const DYNAMIC_SEGMENT = "*";
  * paths silently have no declaration.
  */
 const CLIENT_MANAGED_PATHS = {
+  qoder: [["providers", OPENCODE_PROVIDER_ID], ["modelConfigs", "customModels", DYNAMIC_SEGMENT]],
   opencode: [["provider", OPENCODE_PROVIDER_ID], ["providers", OPENCODE_PROVIDER_ID]],
   pi: [["providers", OPENCODE_PROVIDER_ID]],
   omp: [["providers", OPENCODE_PROVIDER_ID]],

package/src/integrations/registry.ts

@@ -17,6 +17,8 @@ import { dirname, join } from "node:path";
 import {
   ClientPathError,
   buildDroidContribution,
+  qoderConfigPath,
+  qoderHomeDir,
   clineConfigPath,
   clineSettingsDir,
   droidConfigPath,
@@ -280,6 +282,11 @@ function xdgConfigHome(env: NodeJS.ProcessEnv, home: string): string {
 }
 
 export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientSpec> = {
+  qoder: {
+    id: "qoder",
+    configPath: qoderConfigPath,
+    detectDir: (env = process.env, home = homedir()) => qoderHomeDir(env, home),
+  },
   opencode: {
     id: "opencode",
     // These take `home` explicitly. The export registry's `destination` reads

package/src/integrations/store.ts

@@ -16,6 +16,7 @@ import {
   captureSnapshot,
   clearPruneFailure,
   countSnapshots,
+  discardUncommittedSnapshot,
   findOperation,
   findCommittedOperation,
   listOperations,
@@ -53,6 +54,7 @@ export interface IntegrationStateStore {
   findOperation(opId: string): JournalEntry | null;
   findCommittedOperation(opId: string): JournalEntry | null;
   captureSnapshot(clientId: IntegrationClientId, opId: string, text: string | null): SnapshotRef;
+  discardUncommittedSnapshot(clientId: IntegrationClientId, opId: string): void;
   readSnapshot(entry: JournalEntry):
     | { kind: "none" }
     | { kind: "stored"; text: string; path: string }
@@ -92,6 +94,7 @@ export function createIntegrationStateStore(root: string = integrationsDir()): I
     findOperation: opId => findOperation(opId, dir),
     findCommittedOperation: opId => findCommittedOperation(opId, dir),
     captureSnapshot: (clientId, opId, text) => captureSnapshot(clientId, opId, text, dir),
+    discardUncommittedSnapshot: (clientId, opId) => discardUncommittedSnapshot(clientId, opId, dir),
     readSnapshot: entry => readSnapshot(entry, dir),
     countSnapshots: clientId => countSnapshots(clientId, dir),
     pruneSnapshots: clientId => pruneSnapshots(clientId, dir),

package/src/integrations/writer.ts

@@ -18,7 +18,7 @@ import { shouldInjectApiAuthHeader } from "../codex/inject";
 import { detachedConfigSnapshot } from "../config/admitted-identity";
 import { copyPlainData } from "../lib/plain-data";
 import type { OcxConfig } from "../types";
-import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
+import { IntegrationWriteSizeError, PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
 import { inspectKiloCandidates } from "./kilo-candidates";
 import {
   fingerprint,
@@ -162,6 +162,15 @@ function commit(args: CommitArgs): WriteOutcome {
     }
   } catch (error) {
     if (transactionStarted) return compensate(args, error, "could not write both Cline files");
+    if (error instanceof IntegrationWriteSizeError && args.snapshotPath) {
+      try {
+        args.store.discardUncommittedSnapshot(clientId, args.entry.opId);
+      } catch (cleanupError) {
+        return refuse(clientId, "write_failed", args.state,
+          `${messageOf(error)}; could not remove the unused backup: ${messageOf(cleanupError)}`, args.snapshotPath);
+      }
+      return refuse(clientId, "write_failed", args.state, messageOf(error));
+    }
     return refuse(clientId, "write_failed", args.state, messageOf(error), args.snapshotPath);
   }
   try {

package/src/lib/advisor-activation.ts

@@ -0,0 +1,16 @@
+/** Host activation seam. Registration is synchronous; optional code loads only on use. */
+import type { OcxConfig } from "../types";
+import { setAdvisorPlanFactory } from "../server/responses/advisor-plan-slot";
+
+export function activateAdvisor(config: OcxConfig): void {
+  if (config.advisor?.enabled !== true || typeof config.advisor.model !== "string" || !config.advisor.model.trim()) {
+    setAdvisorPlanFactory(config, null);
+    return;
+  }
+  setAdvisorPlanFactory(config, async input => {
+    // A later settings write may disable the same live config before this request starts.
+    if (config.advisor?.enabled !== true || !config.advisor.model?.trim()) return null;
+    const { createAdvisorRuntimePlan } = await import("../advisor/runtime");
+    return createAdvisorRuntimePlan(input);
+  });
+}

package/src/lib/background-work.ts

@@ -0,0 +1,65 @@
+/**
+ * Fire-and-forget work the process started and nobody awaits.
+ *
+ * A lazy quota prime or a startup reconcile is deliberately left running behind a
+ * request so the request never waits on it. The work still owns files: the pool
+ * prime holds the native-main claim database open across ACL hardening and a WHAM
+ * read. Whoever later removes the directory those files live in has to wait for the
+ * owner. Without a handle on the work there was nothing to wait for: test teardown
+ * spun a synchronous retry loop, which blocks the very event loop the owner needs to
+ * reach its `finally` and close the file. On Windows every overlap became a 15 s EBUSY.
+ *
+ * Registering costs one Set entry per in-flight task and changes nothing about how
+ * the work runs. Settling is opt-in: test teardown calls it; requests never do.
+ */
+
+interface BackgroundWork {
+  readonly label: string;
+  readonly settled: Promise<void>;
+}
+
+const inFlight = new Set<BackgroundWork>();
+
+/** Record `work` until it settles and return it unchanged. Rejections stay the caller's. */
+export function trackBackgroundWork<T>(label: string, work: Promise<T>): Promise<T> {
+  const entry: BackgroundWork = {
+    label,
+    settled: work.then(() => { inFlight.delete(entry); }, () => { inFlight.delete(entry); }),
+  };
+  inFlight.add(entry);
+  return work;
+}
+
+/** Labels of work still running, for diagnostics. */
+export function pendingBackgroundWork(): string[] {
+  return [...inFlight].map(entry => entry.label);
+}
+
+export interface BackgroundWorkSettlement {
+  readonly settled: boolean;
+  readonly pending: string[];
+}
+
+/**
+ * Wait until no tracked work is in flight, including work started by work that was
+ * already running. A bounded wait reports what is still running instead of throwing,
+ * so the caller decides whether that is fatal.
+ */
+export async function settleBackgroundWork(options: { timeoutMs?: number } = {}): Promise<BackgroundWorkSettlement> {
+  const deadline = options.timeoutMs === undefined ? Infinity : Date.now() + options.timeoutMs;
+  while (inFlight.size > 0) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    const batch = Promise.all([...inFlight].map(entry => entry.settled)).then(() => false);
+    if (remaining === Infinity) {
+      await batch;
+      continue;
+    }
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const expired = new Promise<boolean>(resolve => { timer = setTimeout(() => resolve(true), remaining); });
+    const timedOut = await Promise.race([batch, expired]);
+    clearTimeout(timer);
+    if (timedOut) break;
+  }
+  return { settled: inFlight.size === 0, pending: pendingBackgroundWork() };
+}

package/src/lib/bounded-file-read.ts

@@ -0,0 +1,58 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+
+const MAX_BOUNDED_READ_BYTES = 64 * 1024 * 1024;
+const READ_CHUNK_BYTES = 64 * 1024;
+
+function sameIdentity(
+  left: { dev: bigint; ino: bigint },
+  right: { dev: bigint; ino: bigint },
+): boolean {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+export function readBoundedRegularFileSync(path: string, limit: number): Buffer {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_BOUNDED_READ_BYTES) {
+    throw new RangeError("invalid bounded file read limit");
+  }
+
+  const windows = process.platform === "win32";
+  const flags = constants.O_RDONLY | (windows ? 0 : constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  const entryBefore = windows ? lstatSync(path, { bigint: true }) : undefined;
+  if (entryBefore && (entryBefore.isSymbolicLink() || !entryBefore.isFile())) {
+    throw new Error("not a regular file");
+  }
+  const fd = openSync(path, flags);
+  try {
+    const opened = fstatSync(fd, { bigint: true });
+    if (!opened.isFile() || opened.size > BigInt(limit)) throw new Error("file is not bounded regular data");
+    if (entryBefore && (!sameIdentity(entryBefore, opened) || opened.ino === 0n)) {
+      throw new Error("file entry changed while opening");
+    }
+
+    // Start near the observed size, but keep probing up to limit + 1 if the file grows.
+    let bytes = Buffer.alloc(Number(opened.size) + 1);
+    let length = 0;
+    while (length < limit + 1) {
+      if (length === bytes.length) {
+        const capacity = Math.min(limit + 1, Math.max(bytes.length * 2, bytes.length + READ_CHUNK_BYTES));
+        const next = Buffer.alloc(capacity);
+        bytes.copy(next, 0, 0, length);
+        bytes = next;
+      }
+      const count = readSync(fd, bytes, length, Math.min(READ_CHUNK_BYTES, bytes.length - length), null);
+      if (count === 0) break;
+      length += count;
+    }
+    if (length > limit) throw new Error("file exceeds byte limit");
+
+    if (entryBefore) {
+      const entryAfter = lstatSync(path, { bigint: true });
+      if (entryAfter.isSymbolicLink() || !entryAfter.isFile() || !sameIdentity(opened, entryAfter)) {
+        throw new Error("file entry changed while reading");
+      }
+    }
+    return bytes.subarray(0, length);
+  } finally {
+    closeSync(fd);
+  }
+}

package/src/lib/bun-path-runtime.d.mts

@@ -5,7 +5,16 @@ export interface DesktopCliIo {
 export interface PathBunIo extends DesktopCliIo {
   now?: () => number;
   realpath?: (path: string) => string;
-  stat?: (path: string) => { isFile(): boolean; mode: number };
+  stat?: (path: string) => { isFile(): boolean; mode: number; uid?: number };
+  lstat?: (path: string) => {
+    isFile(): boolean;
+    isDirectory(): boolean;
+    isSymbolicLink(): boolean;
+    mode: number;
+    uid?: number;
+  };
+  readlink?: (path: string) => string;
+  geteuid?: () => number | undefined;
   isRealBunBinary?: (path: string) => boolean;
   spawnSync?: (path: string, args: string[], options: {
     env: NodeJS.ProcessEnv;

package/src/lib/bun-path-runtime.mjs

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { accessSync, constants, lstatSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
 import { performance } from "node:perf_hooks";
@@ -7,6 +7,7 @@ import { isRealBunBinary } from "./bun-binary-validator.mjs";
 
 const STABLE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 const MAX_VERSION_BYTES = 4096;
+const MAX_SYMLINK_EXPANSIONS = 40;
 const IDENTITY_PROBE = "process.stdout.write(String(typeof Bun==='object'&&Bun.version))";
 
 function stableVersion(value) {
@@ -17,6 +18,62 @@ function stableVersion(value) {
   return numbers.every(Number.isSafeInteger) ? numbers : null;
 }
 
+function trustedPosixCandidate(candidate, canonical, io) {
+  const lstat = io.lstat ?? lstatSync;
+  const readlink = io.readlink ?? readlinkSync;
+  const uid = io.geteuid?.() ?? process.geteuid?.();
+  if (!Number.isSafeInteger(uid) || uid < 0) return false;
+
+  const walk = path => {
+    let pending = path.slice(1).split("/");
+    let current = "/";
+    let expansions = 0;
+    while (pending.length) {
+      const [component, ...remaining] = pending;
+      pending = remaining;
+      if (!component || component === ".") continue;
+      if (component === "..") {
+        current = posix.dirname(current);
+        continue;
+      }
+      const entry = posix.join(current, component);
+      const info = lstat(entry);
+      if (!Number.isSafeInteger(info.uid) || (info.uid !== 0 && info.uid !== uid)) return null;
+      if (info.isSymbolicLink()) {
+        if (++expansions > MAX_SYMLINK_EXPANSIONS) return null;
+        const target = readlink(entry);
+        pending = target.startsWith("/")
+          ? [...target.slice(1).split("/"), ...pending]
+          : [
+            ...(current === "/" ? [] : current.slice(1).split("/")),
+            ...target.split("/"),
+            ...pending,
+          ];
+        current = "/";
+        continue;
+      }
+      if (remaining.length || pending.length) {
+        // No writable-ancestor exemption: a shared sticky directory passes its own
+        // ownership check but lets another user replace a child entry between the
+        // ancestry walk and the exec probe, substituting an unvalidated binary.
+        if (!info.isDirectory() || (info.mode & 0o022) !== 0) return null;
+      } else if (!info.isFile() || (info.mode & 0o022) !== 0) {
+        return null;
+      }
+      current = entry;
+    }
+    return current;
+  };
+
+  const resolved = walk(candidate);
+  if (!resolved || (io.realpath ?? realpathSync.native)(resolved) !== canonical) return false;
+  const parent = lstat(posix.dirname(canonical));
+  return parent.isDirectory()
+    && Number.isSafeInteger(parent.uid)
+    && (parent.uid === 0 || parent.uid === uid)
+    && (parent.mode & 0o022) === 0;
+}
+
 /** Discover the first absolute PATH Bun passing version-policy and identity checks. */
 export function findPathBun({
   env = process.env, platform = process.platform, pinnedVersion,
@@ -54,14 +111,16 @@ export function findPathBun({
     if (now() >= end) break;
     if (!directory || !absolute(directory)) continue;
     try {
-      const path = realpath(paths.join(directory, platform === "win32" ? "bun.exe" : "bun"));
+      const candidatePath = paths.join(directory, platform === "win32" ? "bun.exe" : "bun");
+      const path = realpath(candidatePath);
       if (!absolute(path)) continue;
+      if (platform !== "win32" && !trustedPosixCandidate(candidatePath, path, io)) continue;
       const identity = platform === "win32" ? path.toLowerCase() : path;
       if (seen.has(identity)) continue;
       seen.add(identity);
       const file = stat(path);
       if (!file.isFile()) continue;
-      if (platform !== "win32" && ((file.mode & 0o022) || (stat(paths.dirname(path)).mode & 0o022))) continue;
+      if (platform !== "win32" && (file.mode & 0o022)) continue;
       access(path, constants.X_OK);
       if (!validate(path)) continue;
       const version = probe(path, ["--version"]);

package/src/lib/desktop-proxy-route.ts

@@ -0,0 +1,30 @@
+import { configuredOutboundFetch, effectiveProxyFor, noProxyMatches, type ProxyEnvMap, type ProxyCapableRequestInit } from "./proxy-env";
+
+/** Bind both native desktop transports to one explicit route; never fall back after failure. */
+export function desktopProxyFor(url: URL, env: ProxyEnvMap = process.env): string | false {
+  if (noProxyMatches(url, env)) return false;
+  const key = url.protocol === "https:" ? "HTTPS_PROXY" : "HTTP_PROXY";
+  let selected = effectiveProxyFor(url, env);
+  // Unlike an implicit Bun route, this transport explicitly binds HTTP(S) CONNECT.
+  // A malformed scheme-specific setting still refuses instead of falling through.
+  if (!selected && url.protocol === "https:" && !(env[key]?.trim() || env[key.toLowerCase()]?.trim())) {
+    const all = env.ALL_PROXY?.trim() || env.all_proxy?.trim();
+    if (all) {
+      let parsed: URL; try { parsed = new URL(all); } catch { throw new Error("desktop_egress_proxy_invalid"); }
+      if (["http:", "https:"].includes(parsed.protocol)) selected = all;
+    }
+  }
+  if (selected) {
+    const proxy = new URL(selected);
+    if (!["http:", "https:", "socks5:", "socks5h:"].includes(proxy.protocol) || !proxy.hostname
+      || proxy.search || proxy.hash || proxy.pathname !== "" && proxy.pathname !== "/") throw new Error("desktop_egress_proxy_invalid");
+    return selected;
+  }
+  // An explicit but unsupported route must not quietly become direct desktop traffic.
+  if ([env[key], env[key.toLowerCase()], env.ALL_PROXY, env.all_proxy].some(value => value?.trim())) throw new Error("desktop_egress_proxy_invalid");
+  return false;
+}
+export function desktopOutboundFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  const url = new URL(input instanceof Request ? input.url : String(input));
+  return configuredOutboundFetch(input, { ...init, proxy: desktopProxyFor(url) } as ProxyCapableRequestInit);
+}

package/src/lib/desktop-upstream-tunnel.ts

@@ -0,0 +1,107 @@
+import { connect as tcpConnect, isIP, type Socket } from "node:net";
+import { checkServerIdentity, connect as tlsConnect, type TLSSocket } from "node:tls";
+import { desktopProxyFor } from "./desktop-proxy-route";
+import { socks5Credentials, socks5Handshake } from "./socks5-handshake";
+
+// Shares the SOCKS exchange extracted by lcxhh521 in PR #5947 (efdccdbfac3f).
+// Lifecycle here additionally bounds the entire dial and handles close/abort/header limits.
+export interface DesktopTunnelOptions {
+  proxy?: string | false;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  /** Isolated test peers; production always uses verified TLS to chatgpt.com:443. */
+  target?: { host: string; port: number };
+  ca?: string;
+  proxyCa?: string;
+}
+const fail = () => new Error("desktop_upstream_connection_failed");
+class HandshakeReader {
+  private buffer: Buffer<ArrayBufferLike> = Buffer.alloc(0);
+  private failure: Error | null = null;
+  private waiting: { ready: () => boolean; resolve: () => void; reject: (error: Error) => void } | null = null;
+  private onData = (chunk: Buffer) => {
+    if (this.buffer.length + chunk.length > 65536) { this.onFailure(); return; }
+    this.buffer = Buffer.concat([this.buffer, chunk]);
+    if (this.waiting?.ready()) { const current = this.waiting; this.waiting = null; current.resolve(); }
+  };
+  private onFailure = () => { this.failure = fail(); const current = this.waiting; this.waiting = null; current?.reject(this.failure); };
+  constructor(private socket: Socket, private signal: AbortSignal) {
+    socket.on("data", this.onData); socket.once("error", this.onFailure); socket.once("end", this.onFailure); socket.once("close", this.onFailure);
+    signal.addEventListener("abort", this.onFailure, { once: true }); if (signal.aborted) this.onFailure(); socket.resume();
+  }
+  write(bytes: Uint8Array | string): void { if (this.failure) throw this.failure; this.socket.write(bytes); }
+  private async until(ready: () => boolean): Promise<void> {
+    if (this.failure) throw this.failure;
+    if (ready()) return;
+    if (this.waiting) throw fail();
+    await new Promise<void>((resolve, reject) => { this.waiting = { ready, resolve, reject }; });
+  }
+  private take(length: number): Buffer { const out = this.buffer.subarray(0, length); this.buffer = this.buffer.subarray(length); return out; }
+  async readExact(length: number): Promise<Buffer> { await this.until(() => this.buffer.length >= length); return this.take(length); }
+  async readHead(): Promise<string> { await this.until(() => this.buffer.indexOf("\r\n\r\n") >= 0); return this.take(this.buffer.indexOf("\r\n\r\n") + 4).toString("latin1"); }
+  dispose(): void {
+    this.socket.pause(); this.socket.removeListener("data", this.onData); this.socket.removeListener("error", this.onFailure);
+    this.socket.removeListener("end", this.onFailure); this.socket.removeListener("close", this.onFailure);
+    this.signal.removeEventListener("abort", this.onFailure);
+    if (this.buffer.length) this.socket.unshift(this.buffer); this.buffer = Buffer.alloc(0); this.onFailure();
+  }
+}
+function waitConnected(socket: Socket, event: "connect" | "secureConnect", signal: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const dispose = () => { socket.off(event, done); socket.off("error", failure); socket.off("close", failure); signal.removeEventListener("abort", failure); };
+    const done = () => { dispose(); resolve(); };
+    const failure = () => { dispose(); reject(fail()); };
+    socket.once(event, done); socket.once("error", failure); socket.once("close", failure);
+    signal.addEventListener("abort", failure, { once: true }); if (signal.aborted) failure();
+  });
+}
+/** Fixed-destination TLS dial for native desktop upgraded sockets. No logs or direct fallback. */
+export async function dialDesktopUpstream(options: DesktopTunnelOptions = {}): Promise<TLSSocket> {
+  const timeout = options.timeoutMs ?? 10000;
+  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000) throw fail();
+  const cancel = new AbortController(), timer = setTimeout(() => cancel.abort(), timeout);
+  const signal = options.signal ? AbortSignal.any([options.signal, cancel.signal]) : cancel.signal;
+  const sockets = new Set<Socket>();
+  const own = <T extends Socket>(socket: T): T => { sockets.add(socket); socket.on("error", () => {}); return socket; };
+  const destroy = () => { for (const socket of sockets) socket.destroy(); };
+  signal.addEventListener("abort", destroy, { once: true });
+  try {
+    if (signal.aborted) throw fail();
+    const proxy = options.proxy === undefined ? desktopProxyFor(new URL("https://chatgpt.com")) : options.proxy;
+    const target = options.target ?? { host: "chatgpt.com", port: 443 };
+    let raw: Socket;
+    if (proxy === false) {
+      raw = own(tcpConnect(target)); await waitConnected(raw, "connect", signal);
+    } else {
+      const url = new URL(proxy), protocol = url.protocol;
+      if (!["http:", "https:", "socks5:", "socks5h:"].includes(protocol) || !url.hostname || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") throw fail();
+      const host = url.hostname.replace(/^\[|\]$/g, ""), port = Number(url.port) || (protocol === "https:" ? 443 : protocol.startsWith("socks") ? 1080 : 80);
+      raw = own(tcpConnect({ host, port })); await waitConnected(raw, "connect", signal);
+      if (protocol === "https:") {
+        raw = own(tlsConnect({ socket: raw, servername: isIP(host) ? undefined : host, ca: options.proxyCa,
+          rejectUnauthorized: true, checkServerIdentity: (_name, certificate) => checkServerIdentity(host, certificate), ALPNProtocols: ["http/1.1"] }));
+        await waitConnected(raw, "secureConnect", signal);
+      }
+      const reader = new HandshakeReader(raw, signal);
+      try {
+        if (protocol.startsWith("socks")) await socks5Handshake(reader, target, socks5Credentials(url));
+        else {
+          const authority = `${target.host}:${target.port}`;
+          const lines = [`CONNECT ${authority} HTTP/1.1`, `Host: ${authority}`];
+          if (url.username || url.password) lines.push(`Proxy-Authorization: Basic ${Buffer.from(`${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`).toString("base64")}`);
+          reader.write(lines.join("\r\n") + "\r\n\r\n");
+          if (!/^HTTP\/1\.[01] 2\d\d(?: |\r)/.test(await reader.readHead())) throw fail();
+        }
+      } finally { reader.dispose(); }
+    }
+    if (signal.aborted || raw.destroyed) throw fail();
+    const secured = own(tlsConnect({ socket: raw, servername: "chatgpt.com", ca: options.ca, rejectUnauthorized: true, ALPNProtocols: ["http/1.1"] }));
+    // The CONNECT reader paused its stream before handing buffered bytes back. Bun's
+    // TLS-over-TLS path needs the outer TLS stream explicitly resumed for the new handshake.
+    raw.resume();
+    await waitConnected(secured, "secureConnect", signal);
+    if (signal.aborted) throw fail();
+    return secured;
+  } catch { destroy(); throw fail(); }
+  finally { clearTimeout(timer); signal.removeEventListener("abort", destroy); }
+}

package/src/lib/errors.ts

@@ -18,6 +18,13 @@ export const ENCRYPTED_FUNCTION_OUTPUT_REJECTION =
  */
 export const SEND_BUDGET_EXHAUSTED_CODE = "request_send_budget_exhausted";
 export const SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE = "spend_ledger_storage_unavailable";
+/**
+ * Wire code for the undeclared-tool guard's deterministic refusal. Endpoint translators
+ * read it to keep the refusal non-retryable instead of folding it into the transient
+ * upstream-error class. Declared here rather than in the guard module because the shared
+ * envelope formatter decides whether the identity survives serialization.
+ */
+export const UNDECLARED_TOOL_CALL_ERROR_CODE = "undeclared_tool_call";
 
 /** First nonblank string across the canonical upstream error paths, in priority order. */
 export function upstreamErrorMessageFromPayload(payload: unknown): string | undefined {