@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/claude/desktop-3p-library.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, type BigIntStats } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { claudeDesktopConfigLibraryDir, resolveConfigLibraryDir } from "./desktop-3p-paths";
@@ -44,9 +44,49 @@ export interface Desktop3pMetadata {
 
 export const DESKTOP_PICKER_ENTRY_NAME = "opencodex-picker";
 
+/** A path that no longer names the observed file was swapped; a same-path failure keeps its own errno. */
+function pathStillNamesExpectedFile(path: string, expected: BigIntStats): boolean {
+  try {
+    const now = lstatSync(path, { bigint: true });
+    return now.isFile() && now.dev === expected.dev && now.ino === expected.ino
+      && now.ctimeNs === expected.ctimeNs;
+  } catch { return false; }
+}
+
+/** Read regular config files only; a path swap must not turn an observation into a FIFO wait. */
+export function readDesktopLibraryBytes(path: string): Buffer {
+  const expected = lstatSync(path, { bigint: true });
+  if (!expected.isFile()) throw new Error("desktop_config_not_regular");
+  // POSIX open of a FIFO can itself block, before fstat is possible. Windows has no POSIX
+  // FIFO entry; retain descriptor identity validation there without unsupported open flags.
+  const flags = constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  let fd: number;
+  try {
+    fd = openSync(path, flags);
+  } catch (error) {
+    // A swap can fail at open — ELOOP on a symlink, ENXIO on a socket — before fstat can
+    // classify it. Re-observing the path reports every swap as the documented refusal.
+    if (pathStillNamesExpectedFile(path, expected)) throw error;
+    throw new Error("desktop_config_not_regular");
+  }
+  try {
+    const opened = fstatSync(fd, { bigint: true });
+    if (!opened.isFile() || opened.dev !== expected.dev || opened.ino !== expected.ino
+      || opened.ctimeNs !== expected.ctimeNs) throw new Error("desktop_config_not_regular");
+    return readFileSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Text decoding stays identical to node:fs readFileSync(path, "utf8"). */
+export function readDesktopLibraryText(path: string): string {
+  return readDesktopLibraryBytes(path).toString("utf8");
+}
+
 export function parseMetadata(path: string): Desktop3pMetadata {
   if (!existsSync(path)) return { entries: [] };
-  const parsed = JSON.parse(readFileSync(path, "utf8")) as Partial<Desktop3pMetadata>;
+  const parsed = JSON.parse(readDesktopLibraryText(path)) as Partial<Desktop3pMetadata>;
   if (!Array.isArray(parsed.entries)) throw new Error("Claude Desktop 3P _meta.json has no entries array");
   return { ...parsed, entries: parsed.entries };
 }
@@ -82,7 +122,7 @@ export const OPENCODEX_DESKTOP_PROFILE_KEYS = new Set([
 
 export function readDesktopProfileForeignKeys(path: string): Record<string, unknown> {
   if (!existsSync(path)) return {};
-  const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+  const parsed = JSON.parse(readDesktopLibraryText(path)) as unknown;
   if (!isRecord(parsed)) throw new Error("Claude Desktop 3P profile is not a JSON object");
   return Object.fromEntries(
     Object.entries(parsed).filter(([key]) => !OPENCODEX_DESKTOP_PROFILE_KEYS.has(key)),

package/src/claude/desktop-3p.ts

@@ -5,12 +5,12 @@ import { applyRemoteDesktopStore, inspectRemoteDesktopCleanup, restoreRemoteDesk
 import { canonicalDirectory } from "./desktop-remote-store-io";
 import {
   resolveDesktop3pConfigLibraryPath, parseMetadata, SAFE_DESKTOP_PROFILE_ID, isRecord,
-  isOwnedDesktopEntry, isOwnedDesktopGatewayEntry, profilePath, readDesktopProfileForeignKeys,
+  isOwnedDesktopEntry, isOwnedDesktopGatewayEntry, profilePath, readDesktopProfileForeignKeys, readDesktopLibraryText, readDesktopLibraryBytes,
   type Desktop3pConfigLibraryOptions, type Desktop3pMetadata, type Desktop3pMetadataEntry,
 } from "./desktop-3p-library";
 export { resolveDesktop3pConfigLibraryPath, type Desktop3pConfigLibraryOptions } from "./desktop-3p-library";
 import { createHash, randomUUID } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, lstatSync, unlinkSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, lstatSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { atomicWriteFile, readConfigDiagnostics, withConfigMutationLockSync } from "../config";
 import { atomicWriteFileNoFollow } from "../config/atomic-write";
@@ -20,6 +20,7 @@ import {
   reconcileDesktopProfile,
   renderDesktopProfile,
   validDateAlias,
+  legacyDesktopProfileWireAlias,
   type DesktopProfileModel,
 } from "./desktop-profile";
 import { nativeOpenAiContextWindow, type NativeContextLimitsInput } from "../codex/catalog";
@@ -223,7 +224,7 @@ function collectDesktop3pModels(
         ...(model.supports1m ? { supports1m: true, prefer1m: true } : {}),
       });
     }
-    // Hash aliases from both pre-profile generations are compatibility-only and can
+    // Previous profile IDs and both hash generations are compatibility-only and can
     // collide. Bind them in stable route order so changing a family default or
     // rendered ordering can never silently rebind an old Desktop id.
     for (const model of [...rendered].sort((a, b) => a.route.localeCompare(b.route))) {
@@ -231,7 +232,8 @@ function collectDesktop3pModels(
       const providerEnd = model.route.indexOf("/");
       const provider = model.route.slice(0, providerEnd);
       const id = model.route.slice(providerEnd + 1);
-      for (const legacy of [desktop3pAlias(provider, id), legacyDesktop3pAlias(provider, id)]) {
+      const storedAlias = reconciled.assignments[model.route]!.alias;
+      for (const legacy of [legacyDesktopProfileWireAlias(storedAlias), desktop3pAlias(provider, id), legacyDesktop3pAlias(provider, id)]) {
         if (realAnthropicIds.has(legacy)) {
           console.warn(`[opencodex] Claude Desktop legacy alias ${legacy} for ${model.route} conflicts with a real Anthropic model; ignoring the alias`);
           continue;
@@ -360,6 +362,11 @@ export function isKnownDesktop3pModelId(id: string): boolean {
   return desktop3pRegistry.has(id) || desktop3pRealAnthropicIds.has(id);
 }
 
+/** Real catalog IDs retain identity even when their spelling resembles an alias. */
+export function isRealDesktop3pModelId(id: string): boolean {
+  return desktop3pRealAnthropicIds.has(id);
+}
+
 /** Only missing IDs in the emitted Desktop namespaces are managed-alias errors. */
 export function isUnresolvedDesktop3pAlias(id: string): boolean {
   if (isKnownDesktop3pModelId(id)) return false;
@@ -369,7 +376,7 @@ export function isUnresolvedDesktop3pAlias(id: string): boolean {
   if (isKnownDesktop3pModelId(base)) return false;
   return validDateAlias(base)
     || /^claude-opus-4-(?:8-)?[a-z][a-z0-9]{2}$/.test(base)
-    || /^claude-opus-4-8-p[0-9a-z]{3}$/.test(base);
+    || /^claude-(?:opus-4-8|fable-5)-p[0-9a-z]{3}$/.test(base);
 }
 
 /** Alias selected by the installed profile registry, falling back to the legacy hash shape. */
@@ -377,6 +384,13 @@ export function activeDesktop3pAlias(provider: string, modelId: string): string
   return desktop3pAliasesByRoute.get(`${provider}/${modelId}`) ?? desktop3pAlias(provider, modelId);
 }
 
+/** Discovery cannot offer a skipped alias or one owned by a different route. */
+export function resolvableDesktop3pAlias(provider: string, modelId: string): string | undefined {
+  if (provider === "anthropic" && modelId.startsWith("claude-")) return modelId;
+  const alias = activeDesktop3pAlias(provider, modelId);
+  return resolveDesktop3pAlias(alias) === `${provider}/${modelId}` ? alias : undefined;
+}
+
 /**
  * Generate the complete Claude Desktop 3P gateway config.
  *
@@ -476,7 +490,7 @@ export function inspectDesktop3pConfigLibrary(
   let profile: Record<string, unknown>;
   let fingerprint: string;
   try {
-    const source = readFileSync(selectedProfilePath, "utf8");
+    const source = readDesktopLibraryText(selectedProfilePath);
     const parsed = JSON.parse(source) as unknown;
     if (!isRecord(parsed)) return { kind: "broken", libraryPath, selectedProfilePath, appliedId, residualPaths, ownedProfileActive };
     profile = parsed;
@@ -709,7 +723,7 @@ export function writeDesktop3pConfig(
         const metadata = parseMetadata(join(inspected.libraryPath, "_meta.json"));
         if (!isOwnedDesktopGatewayEntry(metadata.entries.find(entry => entry.id === inspected.appliedId))) return refused;
         try {
-          const selected = JSON.parse(readFileSync(inspected.selectedProfilePath, "utf8")) as Record<string, unknown>;
+          const selected = JSON.parse(readDesktopLibraryText(inspected.selectedProfilePath)) as Record<string, unknown>;
           mode = selected.modelDiscoveryEnabled !== true ? "static"
             : Array.isArray(selected.inferenceModels) ? "hybrid" : "discovery";
         } catch { return refused; }
@@ -825,7 +839,7 @@ function writeDesktop3pConfigWithGenerator(
             const freshMetadata = parseMetadata(metadataPath);
             if (freshMetadata.appliedId !== refreshOnly.requiredId
               || !isOwnedDesktopGatewayEntry(freshMetadata.entries.find(entry => entry.id === refreshOnly.requiredId))
-              || createHash("sha256").update(readFileSync(configPath)).digest("hex").slice(0, 16) !== refreshOnly.expectedFingerprint) {
+              || createHash("sha256").update(readDesktopLibraryBytes(configPath)).digest("hex").slice(0, 16) !== refreshOnly.expectedFingerprint) {
               throw new Error();
             }
           } catch { throw new Error("desktop_refresh_only_skipped"); }

package/src/claude/desktop-picker-profile.ts

@@ -16,6 +16,7 @@ import {
   isOwnedDesktopGatewayEntry,
   parseMetadata,
   profilePath,
+  readDesktopLibraryText,
   resolveDesktop3pConfigLibraryPath,
   SAFE_DESKTOP_PROFILE_ID,
   type Desktop3pConfigLibraryOptions,
@@ -73,6 +74,12 @@ function readFileSnapshot(path: string): { exists: boolean; content?: string } {
   return existsSync(path) ? { exists: true, content: readFileSync(path, "utf8") } : { exists: false };
 }
 
+// Desktop library paths go through the verified regular-file reader: a swapped FIFO or symlink
+// must surface as a refusal, never as a blocking open. Our own picker state file keeps the plain read.
+function readLibrarySnapshot(path: string): { exists: boolean; content?: string } {
+  return existsSync(path) ? { exists: true, content: readDesktopLibraryText(path) } : { exists: false };
+}
+
 function restoreFile(path: string, snapshot: { exists: boolean; content?: string }): void {
   if (snapshot.exists) {
     rollbackAtomicWriteFile(path, snapshot.content ?? "");
@@ -98,7 +105,7 @@ function pickerEntry(metadata: Desktop3pMetadata): Desktop3pMetadataEntry | unde
 }
 
 function profileObject(path: string): Record<string, unknown> {
-  const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+  const parsed = JSON.parse(readDesktopLibraryText(path)) as unknown;
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("picker_profile_unreadable");
   }
@@ -175,10 +182,10 @@ function applyDesktopPickerProfileLocked(options: { proxyPort: number } & Deskto
     const alreadySelected = selectedId === entryId;
     const priorState = readPickerState(previousStatePath);
     const previousAppliedId = alreadySelected ? priorState?.previousAppliedId ?? null : selectedId;
-    const oldMeta = readFileSnapshot(metaPath);
-    const oldProfile = readFileSnapshot(profile);
+    const oldMeta = readLibrarySnapshot(metaPath);
+    const oldProfile = readLibrarySnapshot(profile);
     const backupPath = `${profile}.bak`;
-    const oldBackup = readFileSnapshot(backupPath);
+    const oldBackup = readLibrarySnapshot(backupPath);
     const oldState = readFileSnapshot(previousStatePath);
     const changed = !alreadySelected || !oldProfile.exists || oldProfile.content !== target;
     if (!changed) return { ok: true, changed: false, path: profile };

package/src/claude/desktop-profile.ts

@@ -33,7 +33,9 @@ export interface RenderedDesktopModel extends DesktopProfileModel {
 // renderDesktopProfile() converts it to a letter-first wire id because current
 // Claude Desktop strips terminal dates before comparing model identities.
 const DATE_ALIAS = /^claude-opus-4-8-(202[6-9]\d{4}|203[0-5]\d{4})$/;
-const PROFILE_WIRE_PREFIX = "claude-opus-4-8-";
+// Desktop 2.31226's effort fallback recognizes fable prefixes, while Opus
+// requires an exact canonical id. Keep the suffix so set_model stays distinct.
+const PROFILE_WIRE_PREFIX = "claude-fable-5-";
 const LEGACY_YEAR = 2026;
 const LEGACY_DAY_COUNT = 365;
 const ALIAS_FIRST_YEAR = 2026;
@@ -144,6 +146,13 @@ export function desktopProfileWireAlias(alias: string): string {
   return `${PROFILE_WIRE_PREFIX}p${slot.toString(36).padStart(3, "0")}`;
 }
 
+/** Decode-only profile namespace emitted before the Desktop effort compatibility fix. */
+export function legacyDesktopProfileWireAlias(alias: string): string {
+  return validDateAlias(alias)
+    ? desktopProfileWireAlias(alias).replace(PROFILE_WIRE_PREFIX, "claude-opus-4-8-")
+    : alias;
+}
+
 export function parseDesktopProfile(value: unknown): DesktopProfile {
   if (!isPlainObject(value)) throw new DesktopProfileError("must be an object");
   // `appliedFingerprint`/`appliedAt` are written back by the apply route once a profile

package/src/claude/desktop-remote-store-io.ts

@@ -1,8 +1,8 @@
-import { chmodSync, lstatSync, mkdirSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
+import { chmodSync, lstatSync, mkdirSync, realpathSync, unlinkSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { atomicWriteFile, getConfigDir } from "../config";
 import { hardenSecretDir } from "../lib/windows-secret-acl";
-import { isRecord, resolveDesktop3pConfigLibraryPath, SAFE_DESKTOP_PROFILE_ID, type Desktop3pMetadata } from "./desktop-3p-library";
+import { isRecord, readDesktopLibraryBytes, resolveDesktop3pConfigLibraryPath, SAFE_DESKTOP_PROFILE_ID, type Desktop3pMetadata } from "./desktop-3p-library";
 import { DesktopStoreError, digest } from "./desktop-remote-store-state";
 
 export const MAX_DESKTOP_METADATA_ENTRIES = 256;
@@ -43,7 +43,9 @@ export class StoreIO {
     this.seenSizes.set(path, Math.max(counted, stat.size));
     if (this.bytes > 8 * 1024 * 1024) throw new DesktopStoreError("unsafe");
     try {
-      const bytes = readFileSync(path);
+      // The shared verified regular-file read keeps a swapped FIFO from parking this
+      // open before the post-read identity recheck below can run.
+      const bytes = readDesktopLibraryBytes(path);
       if (bytes.byteLength > maxBytes || identity(lstatSync(path)) !== identity(stat)) throw new DesktopStoreError("conflict");
       const value: unknown = JSON.parse(bytes.toString("utf8"));
       if (!isRecord(value)) throw new DesktopStoreError("unsafe");

package/src/claude/inbound.ts

@@ -24,7 +24,12 @@ import { createTranslatorBudget, type TranslatorBudget } from "../lib/translator
 
 
 
-function imageBlockToInputImage(block: Rec): Rec | null {
+/**
+ * The reference an Anthropic image block carries, as the Responses `image_url` string the bridge
+ * builds from it, or `null` for a source this route does not read. A file-backed source refuses.
+ * Shared with the direct Messages decoder (`src/protocols/codecs/messages-ir.ts`).
+ */
+export function anthropicImageBlockUrl(block: Rec): string | null {
   const source = block.source;
   if (!isRec(source)) return null;
   if (source.type === "file") {
@@ -34,20 +39,25 @@ function imageBlockToInputImage(block: Rec): Rec | null {
   }
   if (source.type === "base64" && typeof source.data === "string") {
     const media = typeof source.media_type === "string" ? source.media_type : "image/png";
-    return { type: "input_image", image_url: `data:${media};base64,${source.data}` };
+    return `data:${media};base64,${source.data}`;
   }
   if (source.type === "url" && typeof source.url === "string") {
-    return { type: "input_image", image_url: source.url };
+    return source.url;
   }
   return null;
 }
 
-function documentTitle(block: Rec): string | undefined {
+function imageBlockToInputImage(block: Rec): Rec | null {
+  const url = anthropicImageBlockUrl(block);
+  return url === null ? null : { type: "input_image", image_url: url };
+}
+
+export function documentTitle(block: Rec): string | undefined {
   return typeof block.title === "string" && block.title.length > 0 ? block.title : undefined;
 }
 
-/** An Anthropic base64 document as the Responses `input_file` block that carries its bytes. */
-function documentBlockToInputFile(block: Rec): Rec | null {
+/** A base64 document's bytes as a `data:` URL plus its title, or `null` for any other source. */
+export function anthropicDocumentData(block: Rec): { fileData: string; title?: string } | null {
   const source = block.source;
   if (!isRec(source) || source.type !== "base64") return null;
   const mediaType = typeof source.media_type === "string" && source.media_type.length > 0
@@ -55,10 +65,17 @@ function documentBlockToInputFile(block: Rec): Rec | null {
     : "application/octet-stream";
   if (typeof source.data !== "string" || source.data.length === 0) return null;
   const title = documentTitle(block);
+  return { fileData: `data:${mediaType};base64,${source.data}`, ...(title !== undefined ? { title } : {}) };
+}
+
+/** An Anthropic base64 document as the Responses `input_file` block that carries its bytes. */
+function documentBlockToInputFile(block: Rec): Rec | null {
+  const document = anthropicDocumentData(block);
+  if (!document) return null;
   return {
     type: "input_file",
-    file_data: `data:${mediaType};base64,${source.data}`,
-    ...(title !== undefined ? { filename: title } : {}),
+    file_data: document.fileData,
+    ...(document.title !== undefined ? { filename: document.title } : {}),
   };
 }
 
@@ -145,7 +162,7 @@ const NO_ELISION: SkillElisionContext = { callIds: new Set(), names: [] };
  * `Base directory for this skill: <dir>/<skill-name>`. Stub that block when the
  * directory basename matches a blocked skill.
  */
-function maybeElideSkillText(text: string, names: readonly string[]): string {
+export function maybeElideSkillText(text: string, names: readonly string[]): string {
   if (names.length === 0 || text.length < SKILL_ELISION_MIN_CHARS) return text;
   if (!text.startsWith(SKILL_TEXT_MARKER)) return text;
   const pathStart = SKILL_TEXT_MARKER.length;
@@ -162,14 +179,14 @@ function maybeElideSkillText(text: string, names: readonly string[]): string {
     + "(claudeCode.blockedSkills). The skill is loaded; answer from general knowledge instead of citing the bundle.";
 }
 
-function skillElisionStub(callId: string): string {
+export function skillElisionStub(callId: string): string {
   return "[opencodex] Skill document bundle elided for routed models (claudeCode.blockedSkills). "
     + `The skill loaded, but its reference documents were removed to save context (call ${callId}). `
     + "Answer from general knowledge instead of citing the bundle.";
 }
 
 /** Collect Skill-tool call ids whose input names a blocked skill. */
-function blockedSkillCallIds(messages: readonly unknown[], blocked: readonly string[]): Set<string> {
+export function blockedSkillCallIds(messages: readonly unknown[], blocked: readonly string[]): Set<string> {
   const ids = new Set<string>();
   if (blocked.length === 0) return ids;
   const needles = blocked.map(name => name.toLowerCase()).filter(name => name.length > 0);
@@ -222,7 +239,7 @@ export function anthropicBodyElidesBlockedSkill(body: unknown, cc?: Pick<OcxClau
  * prefix and rotating the Desktop `prompt_cache_key` fallback below on every turn
  * (#4148).
  */
-function systemMessageText(content: unknown): string {
+export function systemMessageText(content: unknown): string {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";
   const parts: string[] = [];
@@ -410,19 +427,10 @@ function translateAnthropicRequest(
   cc: OcxClaudeCodeConfig | undefined,
   budget: TranslatorBudget,
 ): ClaudeInboundTranslation {
-  if (!isRec(raw)) throw new AnthropicRequestError("request body must be a JSON object");
-  if (typeof raw.model !== "string" || raw.model.length === 0) {
-    throw new AnthropicRequestError("model is required");
-  }
-  if (!Array.isArray(raw.messages) || raw.messages.length === 0) {
-    throw new AnthropicRequestError("messages must be a non-empty array");
-  }
+  assertAnthropicRequestShape(raw);
 
   const input: Rec[] = [];
   const nativeReasoningReplay = new Map<string, string>();
-  const systemParts: string[] = [];
-  const topLevelSystem = systemToInstructions(raw.system);
-  if (topLevelSystem !== undefined) systemParts.push(topLevelSystem);
   const blockedNames = effectiveBlockedSkillNames(cc);
   const elide: SkillElisionContext = {
     callIds: blockedSkillCallIds(raw.messages, blockedNames),
@@ -451,36 +459,99 @@ function translateAnthropicRequest(
     stream: raw.stream === true,
   };
 
+  const system = anthropicSystemLayout(raw.system, cc);
+  if (system.instructions !== undefined) body.instructions = system.instructions;
+  if (system.dynamicNotice !== undefined) {
+    input.push({
+      type: "message",
+      role: "user",
+      content: [{ type: "input_text", text: system.dynamicNotice }],
+    });
+  }
+
+  const tools = toolsToResponses(raw.tools);
+  if (tools) body.tools = tools;
+  const cacheKeySource = applyAnthropicSettings(raw, body, system.cacheSystem, tools);
+  return { body, cacheKeySource, nativeReasoningReplay };
+}
+
+function assertAnthropicRequestShape(raw: unknown): asserts raw is Rec & { model: string; messages: unknown[] } {
+  if (!isRec(raw)) throw new AnthropicRequestError("request body must be a JSON object");
+  if (typeof raw.model !== "string" || raw.model.length === 0) {
+    throw new AnthropicRequestError("model is required");
+  }
+  if (!Array.isArray(raw.messages) || raw.messages.length === 0) {
+    throw new AnthropicRequestError("messages must be a non-empty array");
+  }
+}
+
+/** Where the top-level `system` lands on the bridge body, and what the cache-cohort key hashes. */
+export interface AnthropicSystemLayout {
+  /** The Responses `instructions`, when there are any. */
+  instructions?: string;
+  /** A dynamic notice `stabilizePromptCache` moved out of the system text into a trailing user turn. */
+  dynamicNotice?: string;
+  cacheSystem: string | string[];
+}
+
+/** The system text placement `claudeCode.stabilizePromptCache` decides; shared with the direct decoder. */
+export function anthropicSystemLayout(system: unknown, cc: OcxClaudeCodeConfig | undefined): AnthropicSystemLayout {
+  const systemParts: string[] = [];
+  const topLevelSystem = systemToInstructions(system);
+  if (topLevelSystem !== undefined) systemParts.push(topLevelSystem);
   const joinedSystem = systemParts.length > 0 ? systemParts.join("\n\n") : "";
   const stabilizePromptCache = cc?.stabilizePromptCache === true;
   // Desktop fallback hashes raw systemParts unless the caller opted into
   // harness cleanup. Opt-in then hashes the same string as body.instructions.
-  let cacheSystem: string | string[] = systemParts;
-  if (joinedSystem) {
-    if (stabilizePromptCache) {
-      // Claude Code appends growing <total_tokens>N tokens left</total_tokens>
-      // footers (and occasional TaskCreate nudges) into system text. That churn
-      // breaks Muse/Go prefix cache on the Responses instructions prefix even
-      // when tools stay stable. Relocation is caller-opted, not inferred from
-      // a matching suffix or metadata.user_id.
-      const stabilized = stabilizeClaudeInstructionsForPromptCache(joinedSystem);
-      if (stabilized.instructions) body.instructions = stabilized.instructions;
-      // Token footers are dropped; append nothing if no other notice remains.
-      if (stabilized.dynamicNotice) {
-        input.push({
-          type: "message",
-          role: "user",
-          content: [{ type: "input_text", text: stabilized.dynamicNotice }],
-        });
-      }
-      cacheSystem = stabilized.instructions;
-    } else {
-      body.instructions = joinedSystem;
-    }
-  }
+  if (!joinedSystem) return { cacheSystem: systemParts };
+  if (!stabilizePromptCache) return { instructions: joinedSystem, cacheSystem: systemParts };
+  // Claude Code appends growing <total_tokens>N tokens left</total_tokens>
+  // footers (and occasional TaskCreate nudges) into system text. That churn
+  // breaks Muse/Go prefix cache on the Responses instructions prefix even
+  // when tools stay stable. Relocation is caller-opted, not inferred from
+  // a matching suffix or metadata.user_id.
+  const stabilized = stabilizeClaudeInstructionsForPromptCache(joinedSystem);
+  return {
+    ...(stabilized.instructions ? { instructions: stabilized.instructions } : {}),
+    // Token footers are dropped; append nothing if no other notice remains.
+    ...(stabilized.dynamicNotice ? { dynamicNotice: stabilized.dynamicNotice } : {}),
+    cacheSystem: stabilized.instructions,
+  };
+}
 
-  const tools = toolsToResponses(raw.tools);
-  if (tools) body.tools = tools;
+/**
+ * The request settings of a Messages body as a Responses body with no conversation: `input` is
+ * empty and there are no `instructions` or `tools`, but the prompt-cache key is still derived
+ * from the system text and translated tool catalog exactly as the bridge derives it. The
+ * Antigravity direct lane hands this to the Responses core while the conversation is decoded
+ * straight into the IR (`src/protocols/codecs/messages-ir.ts`); both bodies are completed by
+ * `applyAnthropicSettings`. It validates the same request shape, but a conversation error the
+ * bridge would report first is not looked for here: a caller that gets a throw must translate
+ * the full body to learn the bridge's answer.
+ */
+export function anthropicSettingsTranslation(
+  raw: unknown,
+  cc?: OcxClaudeCodeConfig,
+): { body: Rec; cacheKeySource: ClaudeCacheKeySource } {
+  assertAnthropicRequestShape(raw);
+  const body: Rec = {
+    model: resolveInboundModel(raw.model, cc),
+    input: [],
+    store: false,
+    stream: raw.stream === true,
+  };
+  const system = anthropicSystemLayout(raw.system, cc);
+  const cacheKeySource = applyAnthropicSettings(raw, body, system.cacheSystem, toolsToResponses(raw.tools));
+  return { body, cacheKeySource };
+}
+
+/** Everything after the conversation and tool catalog: choice, limits, format, cache key, reasoning. */
+function applyAnthropicSettings(
+  raw: Rec,
+  body: Rec,
+  cacheSystem: string | string[],
+  tools: Rec[] | undefined,
+): ClaudeCacheKeySource {
   toolChoiceToResponses(raw.tool_choice, body);
 
   if (typeof raw.max_tokens === "number") body.max_output_tokens = raw.max_tokens;
@@ -505,7 +576,7 @@ function translateAnthropicRequest(
     // per-session key with a bounded length/charset.
     body.prompt_cache_key = userIdHash.slice(0, 32);
     cacheKeySource = "metadata";
-  } else if (systemParts.length > 0) {
+  } else if (typeof cacheSystem === "string" || cacheSystem.length > 0) {
     // Claude Desktop sends no metadata.user_id (H1, devlog 130): without any key the
     // ChatGPT/OpenAI backends reported cached_tokens:0 on every turn. Fall back to a
     // cache-cohort hash (devlog 260712 B4 + Pro review 012): fingerprint what the
@@ -526,7 +597,7 @@ function translateAnthropicRequest(
         version: 2,
         model: body.model,
         system: cacheSystem,
-        tools: Array.isArray(body.tools) ? body.tools : [],
+        tools: tools ?? [],
       }))
       .digest("hex").slice(0, 32);
     cacheKeySource = "system";
@@ -556,7 +627,7 @@ function translateAnthropicRequest(
     body.include = ["reasoning.encrypted_content"];
   }
 
-  return { body, cacheKeySource, nativeReasoningReplay };
+  return cacheKeySource;
 }
 
 /**

package/src/claude/intercept/local-ca.ts

@@ -197,7 +197,9 @@ export interface AuthorityOptions {
   permittedDnsNames?: readonly string[];
   /** With permittedDnsNames: also exclude every IP address (default true). */
   excludeAllIpAddresses?: boolean;
- }
+  /** Restrict this authority to TLS server authentication; legacy callers keep their existing scope. */
+  serverAuthOnly?: boolean;
+}
 
 export function createCertificateAuthority(options: AuthorityOptions): LocalInterceptCa {
   const validityDays = options.validityDays ?? CA_VALIDITY_DAYS;
@@ -217,6 +219,7 @@ export function createCertificateAuthority(options: AuthorityOptions): LocalInte
       // keyCertSign | cRLSign
       extension(OID.keyUsage, true, bitString(Uint8Array.of(0x06), 1)),
       extension(OID.subjectKeyIdentifier, false, octetString(keyIdentifier(publicKey))),
+      ...(options.serverAuthOnly ? [extension(OID.extendedKeyUsage, true, sequence(objectIdentifier(OID.serverAuth)))] : []),
       ...(options.permittedDnsNames?.length
         ? [extension(OID.nameConstraints, true, nameConstraints(options.permittedDnsNames, options.excludeAllIpAddresses !== false))]
         : []),
@@ -234,6 +237,10 @@ export function createLocalInterceptCa(): LocalInterceptCa {
   return createCertificateAuthority({ commonName: CLAUDE_INTERCEPT_CA_COMMON_NAME });
 }
 
+export function isServerAuthOnlyCertificate(certificate: X509Certificate): boolean {
+  return certificate.keyUsage?.length === 1 && certificate.keyUsage[0] === OID.serverAuth;
+}
+
 /**
  * Test hook for trust-boundary suites: mint a self-signed authority carrying an arbitrary list of
  * DER-encoded Extension items so adversarial profiles still bear a valid signature. Production