@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/claude/desktop-picker-profile.ts

@@ -16,6 +16,7 @@ import {
   isOwnedDesktopGatewayEntry,
   parseMetadata,
   profilePath,
+  readDesktopLibraryText,
   resolveDesktop3pConfigLibraryPath,
   SAFE_DESKTOP_PROFILE_ID,
   type Desktop3pConfigLibraryOptions,
@@ -73,6 +74,12 @@ function readFileSnapshot(path: string): { exists: boolean; content?: string } {
   return existsSync(path) ? { exists: true, content: readFileSync(path, "utf8") } : { exists: false };
 }
 
+// Desktop library paths go through the verified regular-file reader: a swapped FIFO or symlink
+// must surface as a refusal, never as a blocking open. Our own picker state file keeps the plain read.
+function readLibrarySnapshot(path: string): { exists: boolean; content?: string } {
+  return existsSync(path) ? { exists: true, content: readDesktopLibraryText(path) } : { exists: false };
+}
+
 function restoreFile(path: string, snapshot: { exists: boolean; content?: string }): void {
   if (snapshot.exists) {
     rollbackAtomicWriteFile(path, snapshot.content ?? "");
@@ -98,7 +105,7 @@ function pickerEntry(metadata: Desktop3pMetadata): Desktop3pMetadataEntry | unde
 }
 
 function profileObject(path: string): Record<string, unknown> {
-  const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+  const parsed = JSON.parse(readDesktopLibraryText(path)) as unknown;
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("picker_profile_unreadable");
   }
@@ -175,10 +182,10 @@ function applyDesktopPickerProfileLocked(options: { proxyPort: number } & Deskto
     const alreadySelected = selectedId === entryId;
     const priorState = readPickerState(previousStatePath);
     const previousAppliedId = alreadySelected ? priorState?.previousAppliedId ?? null : selectedId;
-    const oldMeta = readFileSnapshot(metaPath);
-    const oldProfile = readFileSnapshot(profile);
+    const oldMeta = readLibrarySnapshot(metaPath);
+    const oldProfile = readLibrarySnapshot(profile);
     const backupPath = `${profile}.bak`;
-    const oldBackup = readFileSnapshot(backupPath);
+    const oldBackup = readLibrarySnapshot(backupPath);
     const oldState = readFileSnapshot(previousStatePath);
     const changed = !alreadySelected || !oldProfile.exists || oldProfile.content !== target;
     if (!changed) return { ok: true, changed: false, path: profile };

package/src/claude/desktop-picker.ts

@@ -23,6 +23,7 @@ import {
   type DesktopPickerProfileOptions,
 } from "./desktop-picker-profile";
 import { resolveClaudeDesktopMode, observeClaudeDesktopMode } from "./desktop-first-party";
+import { supportsDesktopPicker } from "./desktop-picker-platform";
 
 /** Desktop no longer selects the picker profile, so removing the CA's trust cannot strand it. */
 function profileReleased(profile: DesktopPickerProfileInspection): boolean {
@@ -77,6 +78,8 @@ export interface DesktopPickerControllerDeps {
   persistPreference: (value: boolean) => boolean;
   /** Bound picker CONNECT proxy port (Desktop's egress), or null when it is not running. */
   proxyPort: () => number | null;
+  /** Bind a dormant relay on explicit enable, under the controller's mutation lock. */
+  ensureProxy?: () => Promise<void>;
   configDir: string;
   persistentAuthority?: { store?: PickerCaStore };
   security?: SecurityRunner;
@@ -91,7 +94,7 @@ function profileOptions(deps: DesktopPickerControllerDeps): DesktopPickerProfile
 }
 
 function statusReasonForConfig(config: OcxConfig, platform: NodeJS.Platform, proxyBound: boolean): DesktopPickerReason {
-  if (platform !== "darwin") return "unsupported_platform";
+  if (!supportsDesktopPicker(platform)) return "unsupported_platform";
   if (resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) !== "first-party") return "not_first_party";
   if (!claudeDesktopIntegrationEnabled(config)) return "integration_off";
   if (config.claudeCode?.intercept?.picker === false) return "disabled";
@@ -101,11 +104,11 @@ function statusReasonForConfig(config: OcxConfig, platform: NodeJS.Platform, pro
 
 function emptyStatus(config: OcxConfig, platform: NodeJS.Platform, reason: DesktopPickerReason): DesktopPickerStatus {
   return {
-    desired: platform === "darwin"
+    desired: supportsDesktopPicker(platform)
       && claudeDesktopIntegrationEnabled(config)
       && resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) === "first-party"
       && config.claudeCode?.intercept?.picker !== false,
-    supported: platform === "darwin",
+    supported: supportsDesktopPicker(platform),
     trust: "unknown",
     profile: "absent",
     listenerReady: false,
@@ -142,7 +145,7 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
     const trust = trustOverride ?? runtime.trust;
     const effective = runtime.effective && profileCurrent && trust === "trusted";
     let reason: DesktopPickerReason;
-    if (platform !== "darwin") reason = "unsupported_platform";
+    if (!supportsDesktopPicker(platform)) reason = "unsupported_platform";
     else if (!runtime.desired) reason = statusReasonForConfig(deps.readConfig(), platform, deps.proxyPort() !== null);
     else if (deps.proxyPort() === null) reason = "proxy_unavailable";
     else if (trust !== "trusted") reason = "trust_pending";
@@ -178,7 +181,7 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
 
   async function untrustCurrentCa(): Promise<boolean> {
     const caPath = pickerCaCertPath(deps.configDir);
-    if (platform !== "darwin" || !existsSync(caPath)) return true;
+    if (!supportsDesktopPicker(platform) || !existsSync(caPath)) return true;
     try {
       const sha1 = pickerCaFingerprints(readFileSync(caPath, "utf8")).sha1;
       return (await untrustPickerCa(caPath, sha1, deps.security, platform)).ok;
@@ -207,11 +210,11 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
       return withTrustFailure({ ...runtimeStatus(observedTrust), reason }, trustFailed);
     };
     const check = (config: OcxConfig, includePreference: boolean): DesktopPickerReason | null => {
-      if (platform !== "darwin") return "unsupported_platform";
+      if (!supportsDesktopPicker(platform)) return "unsupported_platform";
       if (resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) !== "first-party") return "mode_not_committed";
       if (!claudeDesktopIntegrationEnabled(config)) return "integration_off";
       if (includePreference && config.claudeCode?.intercept?.picker === false) return "disabled";
-      if (deps.proxyPort() === null) return "proxy_unavailable";
+      if (deps.proxyPort() === null && !deps.ensureProxy) return "proxy_unavailable";
       return null;
     };
 
@@ -224,6 +227,10 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
     }
     const second = check(deps.readConfig(), true);
     if (second) return refuse(second);
+    if (deps.proxyPort() === null) {
+      try { await deps.ensureProxy?.(); } catch { return refuse("proxy_unavailable"); }
+    }
+    if (deps.proxyPort() === null) return refuse("proxy_unavailable");
 
     let caPath: string;
     let caSha1: string;
@@ -336,7 +343,7 @@ export async function removeDesktopPickerArtifacts(options: { configDir?: string
     return { ok: false, residual };
   }
   const caPath = pickerCaCertPath(configDir);
-  if (platform === "darwin" && existsSync(caPath)) {
+  if (supportsDesktopPicker(platform) && existsSync(caPath)) {
     try {
       const sha1 = pickerCaFingerprints(readFileSync(caPath, "utf8")).sha1;
       if (!(await untrustPickerCa(caPath, sha1, options.security, platform)).ok) residual.push("trust");

package/src/claude/desktop-profile.ts

@@ -33,7 +33,9 @@ export interface RenderedDesktopModel extends DesktopProfileModel {
 // renderDesktopProfile() converts it to a letter-first wire id because current
 // Claude Desktop strips terminal dates before comparing model identities.
 const DATE_ALIAS = /^claude-opus-4-8-(202[6-9]\d{4}|203[0-5]\d{4})$/;
-const PROFILE_WIRE_PREFIX = "claude-opus-4-8-";
+// Desktop 2.31226's effort fallback recognizes fable prefixes, while Opus
+// requires an exact canonical id. Keep the suffix so set_model stays distinct.
+const PROFILE_WIRE_PREFIX = "claude-fable-5-";
 const LEGACY_YEAR = 2026;
 const LEGACY_DAY_COUNT = 365;
 const ALIAS_FIRST_YEAR = 2026;
@@ -144,6 +146,13 @@ export function desktopProfileWireAlias(alias: string): string {
   return `${PROFILE_WIRE_PREFIX}p${slot.toString(36).padStart(3, "0")}`;
 }
 
+/** Decode-only profile namespace emitted before the Desktop effort compatibility fix. */
+export function legacyDesktopProfileWireAlias(alias: string): string {
+  return validDateAlias(alias)
+    ? desktopProfileWireAlias(alias).replace(PROFILE_WIRE_PREFIX, "claude-opus-4-8-")
+    : alias;
+}
+
 export function parseDesktopProfile(value: unknown): DesktopProfile {
   if (!isPlainObject(value)) throw new DesktopProfileError("must be an object");
   // `appliedFingerprint`/`appliedAt` are written back by the apply route once a profile

package/src/claude/desktop-remote-store-io.ts

@@ -1,8 +1,8 @@
-import { chmodSync, lstatSync, mkdirSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
+import { chmodSync, lstatSync, mkdirSync, realpathSync, unlinkSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { atomicWriteFile, getConfigDir } from "../config";
 import { hardenSecretDir } from "../lib/windows-secret-acl";
-import { isRecord, resolveDesktop3pConfigLibraryPath, SAFE_DESKTOP_PROFILE_ID, type Desktop3pMetadata } from "./desktop-3p-library";
+import { isRecord, readDesktopLibraryBytes, resolveDesktop3pConfigLibraryPath, SAFE_DESKTOP_PROFILE_ID, type Desktop3pMetadata } from "./desktop-3p-library";
 import { DesktopStoreError, digest } from "./desktop-remote-store-state";
 
 export const MAX_DESKTOP_METADATA_ENTRIES = 256;
@@ -43,7 +43,9 @@ export class StoreIO {
     this.seenSizes.set(path, Math.max(counted, stat.size));
     if (this.bytes > 8 * 1024 * 1024) throw new DesktopStoreError("unsafe");
     try {
-      const bytes = readFileSync(path);
+      // The shared verified regular-file read keeps a swapped FIFO from parking this
+      // open before the post-read identity recheck below can run.
+      const bytes = readDesktopLibraryBytes(path);
       if (bytes.byteLength > maxBytes || identity(lstatSync(path)) !== identity(stat)) throw new DesktopStoreError("conflict");
       const value: unknown = JSON.parse(bytes.toString("utf8"));
       if (!isRecord(value)) throw new DesktopStoreError("unsafe");

package/src/claude/desktop-system-proxy.ts

@@ -1,4 +1,6 @@
 import type { OcxConfig } from "../types";
+import { connect } from "node:net";
+import { directLocalHttpFetch } from "../server/direct-local-http";
 import {
   readWindowsProxyBypassRegistry,
   readWindowsSystemProxy,
@@ -8,6 +10,7 @@ import {
 } from "../lib/windows-system-proxy";
 import { inspectDesktopFirstParty, observeClaudeDesktopMode } from "./desktop-first-party";
 import { desktopFirstPartyDesired } from "./first-party-settings";
+import { inspectDesktopPickerProfile, type DesktopPickerProfileInspection } from "./desktop-picker-profile";
 
 /**
  * Whether the Windows system proxy silently bypasses Desktop first-party mode.
@@ -17,7 +20,8 @@ import { desktopFirstPartyDesired } from "./first-party-settings";
  * as `HTTPS_PROXY`/`HTTP_PROXY`. That inherited value takes precedence over the `env` block
  * OpenCodex writes into the user's `~/.claude/settings.json` (only Claude Code managed settings
  * override it), so Code-tab traffic goes to the system proxy and never reaches the intercept.
- * Routed subagent models then fail, and nothing else reports why. A system proxy such as Clash or
+ * A selected picker profile with an available fixed egress relay takes precedence instead.
+ * Otherwise routed subagent models fail. A system proxy such as Clash or
  * v2rayN, with no bypass for the API host, is the common case.
  *
  * Observe-only: this reads the registry and never changes it. A PAC script and WPAD automatic
@@ -123,6 +127,39 @@ export interface DesktopSystemProxyDeps {
   firstPartyState?: () => DesktopFirstPartySettingsState;
   readSystemProxy?: () => WindowsSystemProxyResult;
   readBypass?: () => WindowsProxyBypassValues | null;
+  inspectPickerProfile?: () => DesktopPickerProfileInspection;
+  pickerRelayAvailable?: (proxyUrl: string) => boolean | Promise<boolean>;
+}
+
+/** Observe the selected endpoint even in a separate doctor process or a blind-only recovery relay. */
+async function livePickerRelayAvailable(proxyUrl: string): Promise<boolean> {
+  const port = /^http:\/\/127\.0\.0\.1:([1-9][0-9]{0,4})$/.exec(proxyUrl)?.[1];
+  if (!port || Number(port) > 65535) return false;
+  try {
+    // A listening TCP socket alone is not evidence of an OpenCodex CONNECT relay.
+    const response = await directLocalHttpFetch(proxyUrl, { signal: AbortSignal.timeout(1_000) });
+    if (response.status !== 405 || response.headers.get("allow") !== "CONNECT"
+      || !(await response.text()).startsWith("OpenCodex Claude intercept proxy accepts only CONNECT tunnels.")) return false;
+    // The main intercept proxy has the same HTTP response but requires credentials the Desktop
+    // profile cannot send. A loopback CONNECT is denied before dialing or choosing any tunnel;
+    // 403 proves unauthenticated admission, whereas the credential-bearing proxy returns 407.
+    return await new Promise<boolean>(resolve => {
+      const socket = connect({ host: "127.0.0.1", port: Number(port) });
+      const finish = (available: boolean) => { clearTimeout(timer); socket.destroy(); resolve(available); };
+      const timer = setTimeout(() => finish(false), 1_000);
+      let head = "";
+      socket.once("error", () => finish(false));
+      socket.once("close", () => finish(false));
+      socket.once("connect", () => socket.write("CONNECT 127.0.0.1:1 HTTP/1.1\r\nHost: 127.0.0.1:1\r\n\r\n"));
+      socket.on("data", bytes => {
+        head += bytes.toString("latin1");
+        if (head.includes("\r\n\r\n")) finish(/^HTTP\/1\.[01] 403 Forbidden\r\n/.test(head));
+        else if (head.length > 8 * 1024) finish(false);
+      });
+    });
+  } catch { // no-excuse-ok: catch -- failed relay probes retain the registry diagnostic.
+    return false;
+  }
 }
 
 function liveFirstPartyState(
@@ -137,15 +174,24 @@ function liveFirstPartyState(
   }
 }
 
-/** Reads the live state. Registry reads run only on Windows with a Desktop first-party env. */
-export function collectDesktopSystemProxy(
+/** Registry reads run only on Windows with a Desktop first-party env and no verified picker relay. */
+export async function collectDesktopSystemProxy(
   config: Pick<OcxConfig, "claudeCode" | "clientIntegrations" | "port" | "runtimeRole">,
   deps: DesktopSystemProxyDeps = {},
-): DesktopSystemProxyAssessment {
+): Promise<DesktopSystemProxyAssessment> {
   const platform = deps.platform ?? process.platform;
   if (platform !== "win32") return { kind: "not-applicable" };
   const firstParty = (deps.firstPartyState ?? (() => liveFirstPartyState(config)))();
   if (firstParty === "off") return { kind: "not-applicable" };
+  if (firstParty === "applied" && config.claudeCode?.intercept?.picker !== false) {
+    try {
+      const profile = (deps.inspectPickerProfile ?? (() => inspectDesktopPickerProfile({ platform })))();
+      if (profile.kind === "applied" && await (deps.pickerRelayAvailable ?? livePickerRelayAvailable)(profile.proxyUrl)) {
+        return { kind: "not-applicable" };
+      }
+    } catch { // no-excuse-ok: catch -- missing profile/relay evidence must not hide a registry conflict.
+    }
+  }
   return assessDesktopSystemProxy({
     platform,
     firstParty,

package/src/claude/inbound-content-options.ts

@@ -76,6 +76,17 @@ export function toolsToResponses(tools: unknown): Rec[] | undefined {
   return out.length > 0 ? out : undefined;
 }
 
+/**
+ * The caller's typed Anthropic web tools (`web_search_*`, `web_fetch_*`), as declared. The
+ * Responses body has no slot for them — web_search becomes the hosted sidecar tool above and
+ * web_fetch is dropped — so an Anthropic destination receives them out of body, unchanged.
+ */
+export function declaredAnthropicServerTools(raw: unknown): Rec[] | undefined {
+  if (!isRec(raw) || !Array.isArray(raw.tools)) return undefined;
+  const tools = raw.tools.filter((t): t is Rec => isRec(t) && typeof t.type === "string" && /^web_(search|fetch)_\d+$/.test(t.type));
+  return tools.length > 0 ? tools : undefined;
+}
+
 export function toolChoiceToResponses(choice: unknown, body: Rec): void {
   if (!isRec(choice)) return;
   if (choice.disable_parallel_tool_use === true) body.parallel_tool_calls = false;

package/src/claude/inbound.ts

@@ -24,7 +24,12 @@ import { createTranslatorBudget, type TranslatorBudget } from "../lib/translator
 
 
 
-function imageBlockToInputImage(block: Rec): Rec | null {
+/**
+ * The reference an Anthropic image block carries, as the Responses `image_url` string the bridge
+ * builds from it, or `null` for a source this route does not read. A file-backed source refuses.
+ * Shared with the direct Messages decoder (`src/protocols/codecs/messages-ir.ts`).
+ */
+export function anthropicImageBlockUrl(block: Rec): string | null {
   const source = block.source;
   if (!isRec(source)) return null;
   if (source.type === "file") {
@@ -34,20 +39,25 @@ function imageBlockToInputImage(block: Rec): Rec | null {
   }
   if (source.type === "base64" && typeof source.data === "string") {
     const media = typeof source.media_type === "string" ? source.media_type : "image/png";
-    return { type: "input_image", image_url: `data:${media};base64,${source.data}` };
+    return `data:${media};base64,${source.data}`;
   }
   if (source.type === "url" && typeof source.url === "string") {
-    return { type: "input_image", image_url: source.url };
+    return source.url;
   }
   return null;
 }
 
-function documentTitle(block: Rec): string | undefined {
+function imageBlockToInputImage(block: Rec): Rec | null {
+  const url = anthropicImageBlockUrl(block);
+  return url === null ? null : { type: "input_image", image_url: url };
+}
+
+export function documentTitle(block: Rec): string | undefined {
   return typeof block.title === "string" && block.title.length > 0 ? block.title : undefined;
 }
 
-/** An Anthropic base64 document as the Responses `input_file` block that carries its bytes. */
-function documentBlockToInputFile(block: Rec): Rec | null {
+/** A base64 document's bytes as a `data:` URL plus its title, or `null` for any other source. */
+export function anthropicDocumentData(block: Rec): { fileData: string; title?: string } | null {
   const source = block.source;
   if (!isRec(source) || source.type !== "base64") return null;
   const mediaType = typeof source.media_type === "string" && source.media_type.length > 0
@@ -55,10 +65,17 @@ function documentBlockToInputFile(block: Rec): Rec | null {
     : "application/octet-stream";
   if (typeof source.data !== "string" || source.data.length === 0) return null;
   const title = documentTitle(block);
+  return { fileData: `data:${mediaType};base64,${source.data}`, ...(title !== undefined ? { title } : {}) };
+}
+
+/** An Anthropic base64 document as the Responses `input_file` block that carries its bytes. */
+function documentBlockToInputFile(block: Rec): Rec | null {
+  const document = anthropicDocumentData(block);
+  if (!document) return null;
   return {
     type: "input_file",
-    file_data: `data:${mediaType};base64,${source.data}`,
-    ...(title !== undefined ? { filename: title } : {}),
+    file_data: document.fileData,
+    ...(document.title !== undefined ? { filename: document.title } : {}),
   };
 }
 
@@ -145,7 +162,7 @@ const NO_ELISION: SkillElisionContext = { callIds: new Set(), names: [] };
  * `Base directory for this skill: <dir>/<skill-name>`. Stub that block when the
  * directory basename matches a blocked skill.
  */
-function maybeElideSkillText(text: string, names: readonly string[]): string {
+export function maybeElideSkillText(text: string, names: readonly string[]): string {
   if (names.length === 0 || text.length < SKILL_ELISION_MIN_CHARS) return text;
   if (!text.startsWith(SKILL_TEXT_MARKER)) return text;
   const pathStart = SKILL_TEXT_MARKER.length;
@@ -162,14 +179,14 @@ function maybeElideSkillText(text: string, names: readonly string[]): string {
     + "(claudeCode.blockedSkills). The skill is loaded; answer from general knowledge instead of citing the bundle.";
 }
 
-function skillElisionStub(callId: string): string {
+export function skillElisionStub(callId: string): string {
   return "[opencodex] Skill document bundle elided for routed models (claudeCode.blockedSkills). "
     + `The skill loaded, but its reference documents were removed to save context (call ${callId}). `
     + "Answer from general knowledge instead of citing the bundle.";
 }
 
 /** Collect Skill-tool call ids whose input names a blocked skill. */
-function blockedSkillCallIds(messages: readonly unknown[], blocked: readonly string[]): Set<string> {
+export function blockedSkillCallIds(messages: readonly unknown[], blocked: readonly string[]): Set<string> {
   const ids = new Set<string>();
   if (blocked.length === 0) return ids;
   const needles = blocked.map(name => name.toLowerCase()).filter(name => name.length > 0);
@@ -222,7 +239,7 @@ export function anthropicBodyElidesBlockedSkill(body: unknown, cc?: Pick<OcxClau
  * prefix and rotating the Desktop `prompt_cache_key` fallback below on every turn
  * (#4148).
  */
-function systemMessageText(content: unknown): string {
+export function systemMessageText(content: unknown): string {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";
   const parts: string[] = [];
@@ -370,6 +387,39 @@ function canonicalJson(value: unknown): string {
 /** Provenance of the generated prompt_cache_key (never serialized into the wire body). */
 export type ClaudeCacheKeySource = "metadata" | "system" | null;
 
+/**
+ * The translated lane places its own prompt-cache breakpoints, so the caller's are dropped;
+ * their TTL is the one thing worth keeping. When every caller breakpoint asks for `ttl: "1h"`
+ * (Claude Code on a subscription marks them so) this maps to `cacheRetention: "long"`. A mixed
+ * caller (1h prefix, 5m tail) stays on the default: "long" also makes the moving per-turn
+ * breakpoint 1h, which bills writes the caller asked to keep at the 5m rate at the 1h rate.
+ * Read out of body: the Responses body has no field for it.
+ */
+export function callerCacheRetention(raw: unknown): "long" | undefined {
+  if (!isRec(raw)) return undefined;
+  // Top-level automatic caching is a breakpoint too, and content blocks nest (tool_result,
+  // search_result, document sources), so every block container is walked. Tool inputs and
+  // schemas are caller data, not blocks: a `cache_control` key there is not a breakpoint.
+  const ttls: unknown[] = [];
+  const visit = (node: unknown, depth: number): void => {
+    if (depth > 16) return;
+    if (Array.isArray(node)) { for (const item of node) visit(item, depth + 1); return; }
+    if (!isRec(node)) return;
+    if (isRec(node.cache_control)) ttls.push(node.cache_control.ttl);
+    for (const [key, value] of Object.entries(node)) {
+      if (key !== "cache_control" && key !== "input" && key !== "input_schema"
+        && (Array.isArray(value) || isRec(value))) visit(value, depth + 1);
+    }
+  };
+  if (isRec(raw.cache_control)) ttls.push(raw.cache_control.ttl);
+  visit(raw.system, 0);
+  visit(raw.tools, 0);
+  visit(raw.messages, 0);
+  return ttls.length > 0 && ttls.every(ttl => ttl === "1h")
+    ? "long"
+    : undefined;
+}
+
 export interface ClaudeInboundTranslation {
   body: Rec;
   cacheKeySource: ClaudeCacheKeySource;
@@ -410,19 +460,10 @@ function translateAnthropicRequest(
   cc: OcxClaudeCodeConfig | undefined,
   budget: TranslatorBudget,
 ): ClaudeInboundTranslation {
-  if (!isRec(raw)) throw new AnthropicRequestError("request body must be a JSON object");
-  if (typeof raw.model !== "string" || raw.model.length === 0) {
-    throw new AnthropicRequestError("model is required");
-  }
-  if (!Array.isArray(raw.messages) || raw.messages.length === 0) {
-    throw new AnthropicRequestError("messages must be a non-empty array");
-  }
+  assertAnthropicRequestShape(raw);
 
   const input: Rec[] = [];
   const nativeReasoningReplay = new Map<string, string>();
-  const systemParts: string[] = [];
-  const topLevelSystem = systemToInstructions(raw.system);
-  if (topLevelSystem !== undefined) systemParts.push(topLevelSystem);
   const blockedNames = effectiveBlockedSkillNames(cc);
   const elide: SkillElisionContext = {
     callIds: blockedSkillCallIds(raw.messages, blockedNames),
@@ -451,36 +492,99 @@ function translateAnthropicRequest(
     stream: raw.stream === true,
   };
 
+  const system = anthropicSystemLayout(raw.system, cc);
+  if (system.instructions !== undefined) body.instructions = system.instructions;
+  if (system.dynamicNotice !== undefined) {
+    input.push({
+      type: "message",
+      role: "user",
+      content: [{ type: "input_text", text: system.dynamicNotice }],
+    });
+  }
+
+  const tools = toolsToResponses(raw.tools);
+  if (tools) body.tools = tools;
+  const cacheKeySource = applyAnthropicSettings(raw, body, system.cacheSystem, tools);
+  return { body, cacheKeySource, nativeReasoningReplay };
+}
+
+function assertAnthropicRequestShape(raw: unknown): asserts raw is Rec & { model: string; messages: unknown[] } {
+  if (!isRec(raw)) throw new AnthropicRequestError("request body must be a JSON object");
+  if (typeof raw.model !== "string" || raw.model.length === 0) {
+    throw new AnthropicRequestError("model is required");
+  }
+  if (!Array.isArray(raw.messages) || raw.messages.length === 0) {
+    throw new AnthropicRequestError("messages must be a non-empty array");
+  }
+}
+
+/** Where the top-level `system` lands on the bridge body, and what the cache-cohort key hashes. */
+export interface AnthropicSystemLayout {
+  /** The Responses `instructions`, when there are any. */
+  instructions?: string;
+  /** A dynamic notice `stabilizePromptCache` moved out of the system text into a trailing user turn. */
+  dynamicNotice?: string;
+  cacheSystem: string | string[];
+}
+
+/** The system text placement `claudeCode.stabilizePromptCache` decides; shared with the direct decoder. */
+export function anthropicSystemLayout(system: unknown, cc: OcxClaudeCodeConfig | undefined): AnthropicSystemLayout {
+  const systemParts: string[] = [];
+  const topLevelSystem = systemToInstructions(system);
+  if (topLevelSystem !== undefined) systemParts.push(topLevelSystem);
   const joinedSystem = systemParts.length > 0 ? systemParts.join("\n\n") : "";
   const stabilizePromptCache = cc?.stabilizePromptCache === true;
   // Desktop fallback hashes raw systemParts unless the caller opted into
   // harness cleanup. Opt-in then hashes the same string as body.instructions.
-  let cacheSystem: string | string[] = systemParts;
-  if (joinedSystem) {
-    if (stabilizePromptCache) {
-      // Claude Code appends growing <total_tokens>N tokens left</total_tokens>
-      // footers (and occasional TaskCreate nudges) into system text. That churn
-      // breaks Muse/Go prefix cache on the Responses instructions prefix even
-      // when tools stay stable. Relocation is caller-opted, not inferred from
-      // a matching suffix or metadata.user_id.
-      const stabilized = stabilizeClaudeInstructionsForPromptCache(joinedSystem);
-      if (stabilized.instructions) body.instructions = stabilized.instructions;
-      // Token footers are dropped; append nothing if no other notice remains.
-      if (stabilized.dynamicNotice) {
-        input.push({
-          type: "message",
-          role: "user",
-          content: [{ type: "input_text", text: stabilized.dynamicNotice }],
-        });
-      }
-      cacheSystem = stabilized.instructions;
-    } else {
-      body.instructions = joinedSystem;
-    }
-  }
+  if (!joinedSystem) return { cacheSystem: systemParts };
+  if (!stabilizePromptCache) return { instructions: joinedSystem, cacheSystem: systemParts };
+  // Claude Code appends growing <total_tokens>N tokens left</total_tokens>
+  // footers (and occasional TaskCreate nudges) into system text. That churn
+  // breaks Muse/Go prefix cache on the Responses instructions prefix even
+  // when tools stay stable. Relocation is caller-opted, not inferred from
+  // a matching suffix or metadata.user_id.
+  const stabilized = stabilizeClaudeInstructionsForPromptCache(joinedSystem);
+  return {
+    ...(stabilized.instructions ? { instructions: stabilized.instructions } : {}),
+    // Token footers are dropped; append nothing if no other notice remains.
+    ...(stabilized.dynamicNotice ? { dynamicNotice: stabilized.dynamicNotice } : {}),
+    cacheSystem: stabilized.instructions,
+  };
+}
 
-  const tools = toolsToResponses(raw.tools);
-  if (tools) body.tools = tools;
+/**
+ * The request settings of a Messages body as a Responses body with no conversation: `input` is
+ * empty and there are no `instructions` or `tools`, but the prompt-cache key is still derived
+ * from the system text and translated tool catalog exactly as the bridge derives it. The
+ * Antigravity direct lane hands this to the Responses core while the conversation is decoded
+ * straight into the IR (`src/protocols/codecs/messages-ir.ts`); both bodies are completed by
+ * `applyAnthropicSettings`. It validates the same request shape, but a conversation error the
+ * bridge would report first is not looked for here: a caller that gets a throw must translate
+ * the full body to learn the bridge's answer.
+ */
+export function anthropicSettingsTranslation(
+  raw: unknown,
+  cc?: OcxClaudeCodeConfig,
+): { body: Rec; cacheKeySource: ClaudeCacheKeySource } {
+  assertAnthropicRequestShape(raw);
+  const body: Rec = {
+    model: resolveInboundModel(raw.model, cc),
+    input: [],
+    store: false,
+    stream: raw.stream === true,
+  };
+  const system = anthropicSystemLayout(raw.system, cc);
+  const cacheKeySource = applyAnthropicSettings(raw, body, system.cacheSystem, toolsToResponses(raw.tools));
+  return { body, cacheKeySource };
+}
+
+/** Everything after the conversation and tool catalog: choice, limits, format, cache key, reasoning. */
+function applyAnthropicSettings(
+  raw: Rec,
+  body: Rec,
+  cacheSystem: string | string[],
+  tools: Rec[] | undefined,
+): ClaudeCacheKeySource {
   toolChoiceToResponses(raw.tool_choice, body);
 
   if (typeof raw.max_tokens === "number") body.max_output_tokens = raw.max_tokens;
@@ -505,7 +609,7 @@ function translateAnthropicRequest(
     // per-session key with a bounded length/charset.
     body.prompt_cache_key = userIdHash.slice(0, 32);
     cacheKeySource = "metadata";
-  } else if (systemParts.length > 0) {
+  } else if (typeof cacheSystem === "string" || cacheSystem.length > 0) {
     // Claude Desktop sends no metadata.user_id (H1, devlog 130): without any key the
     // ChatGPT/OpenAI backends reported cached_tokens:0 on every turn. Fall back to a
     // cache-cohort hash (devlog 260712 B4 + Pro review 012): fingerprint what the
@@ -526,7 +630,7 @@ function translateAnthropicRequest(
         version: 2,
         model: body.model,
         system: cacheSystem,
-        tools: Array.isArray(body.tools) ? body.tools : [],
+        tools: tools ?? [],
       }))
       .digest("hex").slice(0, 32);
     cacheKeySource = "system";
@@ -556,7 +660,7 @@ function translateAnthropicRequest(
     body.include = ["reasoning.encrypted_content"];
   }
 
-  return { body, cacheKeySource, nativeReasoningReplay };
+  return cacheKeySource;
 }
 
 /**

package/src/claude/intercept/local-ca.ts

@@ -197,7 +197,9 @@ export interface AuthorityOptions {
   permittedDnsNames?: readonly string[];
   /** With permittedDnsNames: also exclude every IP address (default true). */
   excludeAllIpAddresses?: boolean;
- }
+  /** Restrict this authority to TLS server authentication; legacy callers keep their existing scope. */
+  serverAuthOnly?: boolean;
+}
 
 export function createCertificateAuthority(options: AuthorityOptions): LocalInterceptCa {
   const validityDays = options.validityDays ?? CA_VALIDITY_DAYS;
@@ -217,6 +219,7 @@ export function createCertificateAuthority(options: AuthorityOptions): LocalInte
       // keyCertSign | cRLSign
       extension(OID.keyUsage, true, bitString(Uint8Array.of(0x06), 1)),
       extension(OID.subjectKeyIdentifier, false, octetString(keyIdentifier(publicKey))),
+      ...(options.serverAuthOnly ? [extension(OID.extendedKeyUsage, true, sequence(objectIdentifier(OID.serverAuth)))] : []),
       ...(options.permittedDnsNames?.length
         ? [extension(OID.nameConstraints, true, nameConstraints(options.permittedDnsNames, options.excludeAllIpAddresses !== false))]
         : []),
@@ -234,6 +237,10 @@ export function createLocalInterceptCa(): LocalInterceptCa {
   return createCertificateAuthority({ commonName: CLAUDE_INTERCEPT_CA_COMMON_NAME });
 }
 
+export function isServerAuthOnlyCertificate(certificate: X509Certificate): boolean {
+  return certificate.keyUsage?.length === 1 && certificate.keyUsage[0] === OID.serverAuth;
+}
+
 /**
  * Test hook for trust-boundary suites: mint a self-signed authority carrying an arbitrary list of
  * DER-encoded Extension items so adversarial profiles still bear a valid signature. Production

package/src/claude/intercept/picker-ca-startup.ts

@@ -2,12 +2,13 @@ import { ensurePickerCa, type PickerCa } from "./picker-ca";
 import { drainPendingPickerCaUntrust } from "./picker-ca-cleanup";
 import type { PickerCaStore } from "./picker-ca-store";
 import type { SecurityRunner } from "./picker-trust";
+import { supportsDesktopPicker } from "../desktop-picker-platform";
 
 /** Internal activation seam: finish legacy cleanup before a persistent issuer is usable. */
 export async function preparePersistentPickerAuthority(options: {
   configDir: string; store?: PickerCaStore; security?: SecurityRunner; platform: NodeJS.Platform;
 }): Promise<PickerCa> {
-  if (options.platform !== "darwin") throw new Error("picker_ca_unsupported_platform");
+  if (!supportsDesktopPicker(options.platform)) throw new Error("picker_ca_unsupported_platform");
   const drain = () => drainPendingPickerCaUntrust(options.configDir, options.security, options.platform);
   if (!await drain()) throw new Error("picker_ca_pending_untrust");
   const ca = ensurePickerCa(options.configDir, { rotation: "startup", persistent: true, store: options.store });