@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/adapters/claude-cli/usage-admission.ts

@@ -0,0 +1,230 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { getConfigDir } from "../../config/paths";
+import { isTestHomeGuardArmed } from "../../lib/test-home-guard";
+import { detectClaudeCodeTokenAsync } from "../../oauth/local-token-detect";
+import { readAnthropicUsageQuota } from "../../providers/claude-cli-usage";
+import type { ProviderQuota } from "../../providers/quota-types";
+
+export type ClaudeAdmission = {
+  state: "available" | "exhausted" | "unknown";
+  checkedAt: number;
+  resetAt?: number;
+  message?: string;
+};
+type Snapshot = { identity: string; checkedAt: number; quota?: ProviderQuota; refusalUntil?: number };
+type Identity = { key: string; access: string };
+export type AdmissionDeps = {
+  now?: () => number;
+  /** Resolve the signed-in account. `fresh` bypasses the short in-memory identity cache. */
+  identity?: (fresh?: boolean) => Identity | null | Promise<Identity | null>;
+  probe?: (token: string) => Promise<ProviderQuota | null>;
+  statePath?: string;
+};
+const CACHE_MS = 60_000;
+const inflight = new Map<string, Promise<Snapshot | null>>();
+const memory = new Map<string, Snapshot>();
+let identityCache: { scope: string; at: number; value: Promise<Identity | null> } | undefined;
+
+const nonEmpty = (value: unknown): value is string => typeof value === "string" && value.trim().length > 0;
+
+async function readLocalIdentity(): Promise<Identity | null> {
+  // A test process never reads the operator's real sign-in or spends it on a usage probe;
+  // tests that exercise admission inject `deps.identity`.
+  if (isTestHomeGuardArmed()) return null;
+  const credential = await detectClaudeCodeTokenAsync();
+  if (!credential || !nonEmpty(credential.access)) return null;
+  let account: unknown;
+  try {
+    const configDir = process.env.CLAUDE_CONFIG_DIR?.trim();
+    const configFile = configDir ? join(configDir, ".claude.json") : join(homedir(), ".claude.json");
+    account = JSON.parse(readFileSync(configFile, "utf8"))?.oauthAccount?.accountUuid;
+  } catch { /* Token fingerprint is the fallback when CLI has no account metadata. */ }
+  const seed = nonEmpty(account) ? account : nonEmpty(credential.refresh) ? credential.refresh : undefined;
+  if (!seed) return null;
+  return { key: createHash("sha256").update(seed).digest("hex"), access: credential.access };
+}
+
+/**
+ * The signed-in Claude Code account, read through the CLI's own secure storage. Cached briefly so
+ * a burst of turns costs one Keychain lookup; an account switch is noticed within the cache window.
+ */
+function localIdentity(fresh = false): Promise<Identity | null> {
+  const scope = process.env.CLAUDE_CONFIG_DIR?.trim() ?? "";
+  const now = Date.now();
+  if (!fresh && identityCache && identityCache.scope === scope && now - identityCache.at < CACHE_MS) return identityCache.value;
+  const value = readLocalIdentity().catch(() => null);
+  identityCache = { scope, at: now, value };
+  return value;
+}
+async function resolveIdentity(deps: AdmissionDeps, fresh = false): Promise<Identity | null> {
+  try { return await (deps.identity ?? localIdentity)(fresh); } catch { return null; }
+}
+function statePath(deps: AdmissionDeps): string {
+  return deps.statePath ?? join(getConfigDir(), "claude-usage-admission.json");
+}
+function load(path: string): Snapshot | undefined {
+  try {
+    const saved = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof saved.identity !== "string" || !Number.isFinite(saved.checkedAt)) return;
+    if (saved.refusalUntil !== undefined && !finite(saved.refusalUntil)) return;
+    if (saved.quota !== undefined) {
+      const q = saved.quota;
+      if (!q || typeof q !== "object" || !finite(q.updatedAt)) return;
+      for (const field of ["fiveHourPercent", "fiveHourResetAt", "weeklyPercent", "weeklyResetAt"])
+        if (q[field] !== undefined && !finite(q[field])) return;
+      if (q.customWindows !== undefined && (!Array.isArray(q.customWindows) || !q.customWindows.every((w: unknown) => {
+        if (!w || typeof w !== "object") return false;
+        const row = w as Record<string, unknown>;
+        return typeof row.label === "string" && finite(row.percent) && (row.resetAt === undefined || finite(row.resetAt));
+      }))) return;
+    }
+    return saved;
+  } catch { /* Missing or malformed cache is unknown, never proof of capacity. */ }
+  return undefined;
+}
+function save(path: string, snapshot: Snapshot): void {
+  memory.set(path, snapshot);
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = `${path}.${process.pid}.tmp`;
+    writeFileSync(temp, JSON.stringify(snapshot) + "\n", { mode: 0o600 });
+    renameSync(temp, path);
+  } catch { /* Memory still suppresses launches; no secrets or upstream text are persisted. */ }
+}
+function finite(value: unknown): value is number { return typeof value === "number" && Number.isFinite(value); }
+/** Windows that gate this model: the plan windows plus custom windows in scope for its family. */
+function applicableWindows(quota: ProviderQuota | undefined, model: string): { percent?: number; resetAt?: number }[] {
+  const family = /opus|sonnet|fable|haiku/i.exec(model)?.[0]?.toLowerCase();
+  return [
+    { percent: quota?.fiveHourPercent, resetAt: quota?.fiveHourResetAt },
+    { percent: quota?.weeklyPercent, resetAt: quota?.weeklyResetAt },
+    ...(quota?.customWindows ?? []).filter(w => w.scope !== "model" || !family || w.label.toLowerCase() === family),
+  ];
+}
+/** A reset time in the proxy host's own time zone (or the given one), with the zone named. */
+export function formatClaudeReset(resetAt: number, timeZone?: string): string {
+  return new Intl.DateTimeFormat("en-US", {
+    ...(timeZone ? { timeZone } : {}), month: "short", day: "numeric", hour: "numeric", minute: "2-digit", timeZoneName: "short",
+  }).format(resetAt);
+}
+function full(w: { percent?: number }): boolean { return finite(w.percent) && w.percent >= 100; }
+function admission(snapshot: Snapshot, model: string, now: number): ClaudeAdmission {
+  const quota = snapshot.quota;
+  const exhausted = applicableWindows(quota, model).filter(w => full(w) && (!finite(w.resetAt) || w.resetAt > now));
+  if (finite(snapshot.refusalUntil) && snapshot.refusalUntil > now) exhausted.push({ percent: 100, resetAt: snapshot.refusalUntil });
+  if (exhausted.length) {
+    const resets = exhausted.map(w => w.resetAt).filter(finite);
+    // Unknown reset windows require another read after the short cache, not an invented reset date.
+    const resetAt = resets.length === exhausted.length ? Math.max(...resets) : Math.max(snapshot.checkedAt + CACHE_MS, ...resets);
+    return { state: "exhausted", checkedAt: snapshot.checkedAt, resetAt, message: `Claude subscription limits are exhausted. Claude launches are paused until ${formatClaudeReset(resetAt)}, then usage will be checked again.` };
+  }
+  return { state: quota ? "available" : "unknown", checkedAt: snapshot.checkedAt };
+}
+
+/**
+ * Read-only quota preflight for a `claude-cli` launch. Fails open: any local or upstream failure
+ * reports `unknown`, which admits the turn and lets the CLI report its own limit.
+ */
+export async function checkClaudeUsageAdmission(model = "", deps: AdmissionDeps = {}): Promise<ClaudeAdmission> {
+  const now = (deps.now ?? Date.now)();
+  try {
+    return await checkAdmission(model, deps, now);
+  } catch {
+    return { state: "unknown", checkedAt: now };
+  }
+}
+
+async function checkAdmission(model: string, deps: AdmissionDeps, now: number): Promise<ClaudeAdmission> {
+  const identity = await resolveIdentity(deps);
+  if (!identity) return { state: "unknown", checkedAt: now };
+  const path = statePath(deps);
+  const disk = load(path);
+  const local = memory.get(path);
+  const cached = [disk, local].filter((s): s is Snapshot => s?.identity === identity.key).sort((a, b) => b.checkedAt - a.checkedAt || (b.refusalUntil ?? 0) - (a.refusalUntil ?? 0))[0];
+  if (cached) {
+    const status = admission(cached, model, now);
+    if (status.state === "exhausted" && status.resetAt! > now) return status;
+    // Same windows and threshold as admission(): only a full window in scope for this model forces a re-read.
+    const expiredReset = [cached.refusalUntil, ...applicableWindows(cached.quota, model).filter(full).map(w => w.resetAt)]
+      .some(reset => finite(reset) && reset <= now);
+    if (!expiredReset && now >= cached.checkedAt && now - cached.checkedAt < CACHE_MS) return status;
+  }
+  const requestKey = `${path}:${identity.key}`;
+  let probe = inflight.get(requestKey);
+  if (!probe) {
+    probe = (async () => {
+      let quota: ProviderQuota | null = null;
+      try { quota = await (deps.probe ?? readAnthropicUsageQuota)(identity.access); } catch { /* Unavailable is unknown. */ }
+      // A login change during the probe makes this answer belong to no current account: neither
+      // persist it nor admit or refuse with it.
+      if ((await resolveIdentity(deps, true))?.key !== identity.key) return null;
+      // Merge the newest refusal at commit time. Nothing awaits between this read and the write,
+      // so a refusal the CLI reported while the probe was in flight is never overwritten.
+      const at = (deps.now ?? Date.now)();
+      const refusals = [load(path), memory.get(path)]
+        .filter((s): s is Snapshot => s?.identity === identity.key)
+        .map(s => s.refusalUntil)
+        .filter((until): until is number => finite(until) && until > at);
+      const refusalUntil = refusals.length ? Math.max(...refusals) : undefined;
+      const snapshot: Snapshot = { identity: identity.key, checkedAt: at, ...(quota ? { quota } : {}), ...(refusalUntil ? { refusalUntil } : {}) };
+      save(path, snapshot);
+      return snapshot;
+    })().finally(() => inflight.delete(requestKey));
+    inflight.set(requestKey, probe);
+  }
+  const snapshot = await probe;
+  if (!snapshot) return { state: "unknown", checkedAt: (deps.now ?? Date.now)() };
+  return admission(snapshot, model, (deps.now ?? Date.now)());
+}
+
+let preflightOverride: ((model: string) => Promise<ClaudeAdmission>) | undefined;
+/** Test seam for the pre-dispatch check in the Responses executor; call with no argument to restore. */
+export function setClaudeUsagePreflightForTests(fn?: (model: string) => Promise<ClaudeAdmission>): void { preflightOverride = fn; }
+/** The pre-dispatch check the Responses executor runs before a claude-cli turn. */
+export function claudeUsagePreflight(model: string): Promise<ClaudeAdmission> {
+  return (preflightOverride ?? checkClaudeUsageAdmission)(model);
+}
+
+/** Parse Claude's explicit next-clock reset, including its IANA timezone. */
+export function parseClaudeReset(message: string, now = Date.now()): number | undefined {
+  if (!/hit.*limit|usage limit|rate limit/i.test(message)) return;
+  // Claude prints "resets 3pm (Europe/Paris)" or "resets 3:30pm (...)"; minutes are optional.
+  const match = /resets?\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(([^)]+)\)/i.exec(message);
+  if (!match) return;
+  const hour = Number(match[1]); const minute = Number(match[2] ?? 0);
+  if (hour < 1 || hour > 12 || minute > 59) return;
+  const hours = hour % 12 + (match[3]!.toLowerCase() === "pm" ? 12 : 0);
+  try {
+    const formatter = new Intl.DateTimeFormat("en-US", { timeZone: match[4], year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", second: "2-digit", hourCycle: "h23" });
+    const parts = (time: number) => Object.fromEntries(formatter.formatToParts(time).filter(p => p.type !== "literal").map(p => [p.type, Number(p.value)]));
+    const date = parts(now);
+    for (let day = 0; day < 2; day++) {
+      const target = Date.UTC(date.year!, date.month! - 1, date.day! + day, hours, minute);
+      let epoch = target;
+      for (let i = 0; i < 3; i++) {
+        const p = parts(epoch);
+        epoch += target - Date.UTC(p.year!, p.month! - 1, p.day!, p.hour!, p.minute!, p.second!);
+      }
+      if (epoch > now && epoch - now <= 26 * 60 * 60_000) return epoch;
+    }
+  } catch { /* An invalid or unsupported timezone never establishes a cooldown. */ }
+}
+
+/**
+ * Remember a limit the CLI itself reported ("You've hit your limit · resets 3pm (Europe/Paris)")
+ * so later launches are refused locally until that reset. Only a parsed reset records anything.
+ */
+export async function recordClaudeUsageRefusal(message: string, deps: AdmissionDeps = {}): Promise<void> {
+  const now = (deps.now ?? Date.now)();
+  const until = parseClaudeReset(message, now);
+  if (!until) return;
+  const identity = await resolveIdentity(deps);
+  if (!identity) return;
+  const path = statePath(deps);
+  const old = load(path);
+  const same = old?.identity === identity.key ? old : undefined;
+  save(path, { identity: identity.key, checkedAt: now, ...(same?.quota ? { quota: same.quota } : {}), refusalUntil: Math.max(until, same?.refusalUntil ?? 0) });
+}

package/src/adapters/coding-agent/protocol.ts

@@ -725,7 +725,7 @@ function imagePart(imageUrl: string): WireContentPart | undefined {
   return undefined;
 }
 
-function formatMessageForHistory(message: OcxMessage, vendorNameByWire?: ReadonlyMap<string, string>): string {
+export function formatMessageForHistory(message: OcxMessage, vendorNameByWire?: ReadonlyMap<string, string>): string {
   if (message.role === "user") {
     const text = typeof message.content === "string"
       ? message.content

package/src/adapters/coding-agent/turn.ts

@@ -133,6 +133,8 @@ export interface CodingAgentTurnInput {
   toolBridge?: CodingAgentToolBridgeInput;
   /** Vendor semantics and recovery permission stay with the adapter. */
   classifyFailure?: (failure: CodingAgentFailure) => Extract<AdapterEvent, { type: "error" }>;
+  /** Family-specific replay projection; other coding-agent providers keep their existing layout. */
+  conversationInput?: typeof buildConversationInput;
   deps: CodingAgentDeps;
 }
 
@@ -146,6 +148,9 @@ export interface CodingAgentToolBridgeInput {
   tools: ReadonlyArray<{ name: string; description: string; inputSchema: Record<string, unknown> }>;
   /** CLI-emitted tool name (`mcp__<server>__<tool>`) to the request's wire tool name. */
   emittedNameMap: Map<string, string>;
+  /** Claude replay may emit an exact selected wire name instead of its MCP transport name.
+   * These aliases are output-only: they never enter the CLI's --allowedTools list. */
+  acceptWireToolNames?: boolean;
   /** Tool_use blocks accepted in one assistant message. */
   maxTurnToolCalls: number;
   /** Render prior tool calls with the CLI-emitted names. Off by default so CodeBuddy history is unchanged. */
@@ -237,6 +242,9 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   }
 
   const toolBridge = input.toolBridge;
+  const wireToolNames = toolBridge?.acceptWireToolNames
+    ? new Set(toolBridge.emittedNameMap.values())
+    : undefined;
   const writeToolBridgeFile = deps.writeToolBridgeFile ?? writeFile;
   let toolBridgeDir: string | undefined;
   let toolBridgeMcpConfigPath: string | undefined;
@@ -304,12 +312,19 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   let producer: { close(): void } | undefined;
   let permit: SingleUseDispatchPermit | undefined;
   try {
+  if (incoming.abortSignal?.aborted) {
+    emit({ type: "error", message: "Coding-agent turn was aborted before start.", retryable: false });
+    return;
+  }
   producer = incoming.sendBudget?.beginSpendProducer?.();
   const decision = incoming.sendBudget?.reserveDispatch({
     sendClass: "initial", targetKey: `${provider.adapter}|${profile.canonicalBaseUrl}|${parsed.modelId}`,
   });
   if (decision && !decision.allowed) throw new SendBudgetExhaustedError();
   permit = decision?.allowed ? decision.permit : undefined;
+  // Setup above awaits private catalog writes. Fence the actual CLI dispatch, outside
+  // spawn-error mapping so the selection owner can rebuild a refused turn.
+  incoming.beforePhysicalSend?.();
   if (permit && !permit.use()) throw new SendBudgetExhaustedError();
   incoming.onPhysicalSend?.({ ordinal: 1 });
   let child: ChildProcess;
@@ -451,7 +466,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
       const vendorNameByWire = toolBridge?.projectHistoryToolNames
         ? new Map([...toolBridge.emittedNameMap].map(([emitted, wire]) => [wire, emitted]))
         : undefined;
-      for (const line of buildConversationInput(parsed, { maxHistoryChars: historyCharLimit, vendorNameByWire })) stdin.write(`${line}\n`);
+      for (const line of (input.conversationInput ?? buildConversationInput)(parsed, { maxHistoryChars: historyCharLimit, vendorNameByWire })) stdin.write(`${line}\n`);
       stdin.end();
     }
     const stdout = child.stdout;
@@ -549,7 +564,8 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
             break;
           }
           if (toolBridge && event.type === "tool_call_start") {
-            const wireName = toolBridge.emittedNameMap.get(event.name);
+            const wireName = toolBridge.emittedNameMap.get(event.name)
+              ?? (wireToolNames?.has(event.name) ? event.name : undefined);
             if (wireName === undefined) {
               emitOnce({
                 type: "error",

package/src/adapters/dsh-account.ts

@@ -0,0 +1,97 @@
+import type { IncomingMeta, ProviderAdapter } from "./base";
+import { createAnthropicAdapter } from "./anthropic";
+import type { AdapterFactoryContext } from "./registry";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { resolveDshAccountMessagesUrl } from "../providers/dsh-account-destination";
+
+export { DSH_ACCOUNT_DEFAULT_MESSAGES_URL, resolveDshAccountMessagesUrl } from "../providers/dsh-account-destination";
+
+export const DSH_ACCOUNT_RESERVED_HEADERS = new Set([
+  "x-dsh-auth-token",
+  "anthropic-version",
+  "authorization",
+  "x-api-key",
+  "host",
+]);
+
+export function createDshAccountAdapter(
+  provider: OcxProviderConfig,
+  _context?: AdapterFactoryContext,
+): ProviderAdapter {
+  // Use key authMode internally so that createAnthropicAdapter doesn't inject Claude Code headers/prompt.
+  const baseAdapter = createAnthropicAdapter({
+    ...provider,
+    authMode: "key",
+  }, "none");
+
+  return {
+    ...baseAdapter,
+    name: "dsh-account",
+
+    formatErrorBody(status: number, headers: Headers, payloadText: string): string {
+      if (status === 401) {
+        return "DeepSeek Harness account authentication failed (401 / ACCOUNT_TOKEN_INVALID). Please sign in to DeepSeek Harness Desktop and re-import.";
+      }
+      return baseAdapter.formatErrorBody?.(status, headers, payloadText) ?? payloadText;
+    },
+
+    async buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta) {
+      const token = provider.apiKey?.trim();
+      if (!token) {
+        throw new Error("DeepSeek Harness account token missing — import your account in Providers > DeepSeek Account (DSH)");
+      }
+
+      // Fail-closed if custom provider configuration attempts to set any reserved header
+      if (provider.headers) {
+        for (const key of Object.keys(provider.headers)) {
+          if (DSH_ACCOUNT_RESERVED_HEADERS.has(key.toLowerCase())) {
+            throw new Error(`Reserved header "${key}" cannot be overridden in dsh-account provider configuration`);
+          }
+        }
+      }
+
+      const req = await baseAdapter.buildRequest(parsed, incoming);
+      const url = resolveDshAccountMessagesUrl(provider.baseUrl);
+
+      const headers: Record<string, string> = { ...req.headers };
+
+      // Apply custom provider headers strictly before authoritative authentication headers
+      if (provider.headers) {
+        for (const [key, value] of Object.entries(provider.headers)) {
+          if (!DSH_ACCOUNT_RESERVED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+            headers[key] = value;
+          }
+        }
+      }
+
+      // Authoritative cleanup: strip any API key or Claude headers
+      for (const key of Object.keys(headers)) {
+        const lower = key.toLowerCase();
+        if (
+          lower === "authorization"
+          || lower === "x-api-key"
+          || lower === "x-dsh-auth-token"
+          || lower === "anthropic-version"
+          || lower === "anthropic-beta"
+          || lower === "x-claude-code-session-id"
+          || lower === "x-client-request-id"
+        ) {
+          delete headers[key];
+        }
+      }
+
+      // Set authoritative DeepSeek Harness Account headers strictly at the end
+      headers["x-dsh-auth-token"] = token;
+      headers["anthropic-version"] = "2023-06-01";
+      if (!headers["Content-Type"]) headers["Content-Type"] = "application/json";
+      if (!headers["Accept"]) headers["Accept"] = parsed.stream ? "text/event-stream" : "application/json";
+
+      return {
+        ...req,
+        url,
+        headers,
+        redirect: "manual",
+      };
+    },
+  };
+}

package/src/adapters/google.ts

@@ -1,6 +1,8 @@
+import { openCodeZenGeminiEndpoint } from "../types/opencode-zen";
 import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
 import { debugDroppedFrame, debugProviderDiagnosticLazy } from "../lib/debug";
 import { createToolCallIdAllocator } from "./tool-call-id";
+import { openCodeGoGeminiEndpoint } from "../types/opencode-go";
 import { createImageBudget, materializeInlineImage, MAX_ENCODED_BYTES_PER_IMAGE, artifactHttpUrl } from "../images/artifacts";
 import type {
   AdapterEvent,
@@ -17,7 +19,7 @@ import type {
 import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../types";
 import type { OcxTool } from "../types";
 import { contentPartsToText, parseDataUrl } from "./image";
-import { getVertexAccessToken } from "../lib/gcp-adc";
+import { GCP_CREDENTIAL_MARKER_PREFIX, gcpCredentialMarkerAccount, getVertexAccessToken } from "../lib/gcp-adc";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
 import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
 import { isVertexTruncatedTurn, vertexTruncationErrorEvent } from "./google-truncation";
@@ -174,7 +176,15 @@ function resolveDirectGeminiWireModelId(modelId: string, applyRenames: boolean):
 
 /** Vertex API key: provider.apiKey if it looks real (not a sentinel), else GOOGLE_CLOUD_API_KEY env. */
 function resolveVertexApiKey(optKey?: string): string | undefined {
-  const realKey = optKey && !optKey.startsWith("<") && optKey !== "N/A" ? optKey : undefined;
+  // A `gcp-sa:` marker is the keychain-backed credential reference (see gcp-adc): it is not
+  // API-key material, so it must not be sent as x-goog-api-key — the ADC branch below handles it.
+  // AND the marker means the operator named one credential explicitly: the GOOGLE_CLOUD_API_KEY
+  // env fallback must NOT fire (it would silently route this provider's inference through the
+  // ambient env key instead of the configured service account).
+  if (optKey && optKey.startsWith(GCP_CREDENTIAL_MARKER_PREFIX)) return undefined;
+  const realKey = optKey && !optKey.startsWith("<") && optKey !== "N/A"
+    ? optKey
+    : undefined;
   return realKey || process.env.GOOGLE_CLOUD_API_KEY;
 }
 
@@ -864,6 +874,7 @@ function invalidGoogleShapeEvent(
   };
 }
 
+/** Build Gemini transport and response parsing for AI Studio, Vertex, Cloud Code Assist or Go. */
 export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapter {
   const toolSchemaPolicy = provider.googleToolSchemaPolicy ?? "compatible";
   const toolSchemaProfile = {
@@ -945,6 +956,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         }
       : {}),
 
+    /** Compile an admitted request into the selected Gemini endpoint, body and authentication. */
     async buildRequest(parsed: OcxParsedRequest) {
       // Structured-output admission runs FIRST, before messagesToGeminiFormat writes
       // lastInjectedCallIds/lastReasoningReplayScope: a refused request must not leave
@@ -983,7 +995,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
             mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning),
             provider.baseUrl,
           ).wireModelId
-        : provider.googleMode === "vertex"
+        : provider.googleMode === "vertex" || openCodeZenGeminiEndpoint(provider, parsed.modelId) !== undefined
           ? parsed.modelId
           : resolveDirectGeminiWireModelId(parsed.modelId, provider.directGeminiWireRenames !== false);
       returnsThoughtSummaries = provider.googleMode === "cloud-code-assist"
@@ -1197,16 +1209,31 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         if (locationError) throw new Error(locationError);
         const host = location === "global" ? "aiplatform.googleapis.com" : `${location}-aiplatform.googleapis.com`;
         const url = `https://${host}/v1/projects/${project}/locations/${location}/publishers/google/models/${parsed.modelId}:${method}${streamParam}`;
-        const token = await getVertexAccessToken();
+        // The marker account travels per-request as an argument (never process-global state): a
+        // module-level "active marker" written at routing time would race across concurrent
+        // requests for different providers and could resolve one call with another's credential.
+        const markerAccount = gcpCredentialMarkerAccount(provider.apiKey);
+        const token = await getVertexAccessToken({ markerAccount });
         headers["Authorization"] = `Bearer ${token}`;
         return { url, method: "POST", headers, body: JSON.stringify(compiled.body) };
       }
 
-      // ai-studio (default): Generative Language API + x-goog-api-key.
-      const url = `${provider.baseUrl}/v1beta/models/${routedModelId}:${method}${streamParam}`;
+      // Go and Zen use separate guarded Gemini endpoints; AI Studio retains /v1beta.
+      const goEndpoint = openCodeGoGeminiEndpoint(provider, routedModelId);
+      const zenEndpoint = openCodeZenGeminiEndpoint(provider, routedModelId);
+      const endpoint = goEndpoint ?? zenEndpoint ?? `${provider.baseUrl}/v1beta/models/${routedModelId}`;
+      const url = `${endpoint}:${method}${streamParam}`;
       const apiKey = provider.apiKey?.trim();
-      if (!apiKey) throw new Error("google (AI Studio) requires a non-empty API key");
-      headers["x-goog-api-key"] = apiKey;
+      if (!apiKey) throw new Error(`${goEndpoint ? "OpenCode Go" : zenEndpoint ? "OpenCode Zen" : "google (AI Studio)"} requires a non-empty API key`);
+      if (goEndpoint) {
+        // Console inference documents Bearer auth. Send only the selected Go key.
+        for (const name of Object.keys(headers)) {
+          if (["authorization", "x-goog-api-key", "x-api-key"].includes(name.toLowerCase())) delete headers[name];
+        }
+        headers["Authorization"] = `Bearer ${apiKey}`;
+      } else {
+        headers["x-goog-api-key"] = apiKey;
+      }
 
       const compiled = compileGoogleWireBody(body, toolSchemaProfile, toolSchemaPolicy);
       reportToolSchemaLoss(compiled.toolSchemaLossReport);

package/src/adapters/openai-chat/messages.ts

@@ -7,6 +7,7 @@ import { EMPTY_TOOL_OUTPUT_ANNOTATION, isWhitespaceOnlyTextPartArray } from "../
 import { identifyRoutedModel } from "../identity";
 import { buildNonOpenAIToolCatalogNudgeForTools, shouldInjectNonOpenAIToolCatalogNudge } from "../tool-catalog-nudge";
 import { peekReasoningForCall } from "../../responses/reasoning-replay-cache";
+import { chatReasoningReplayPolicy } from "./reasoning-replay";
 import type { ClaudeThinkingProjection } from "../../lib/claude-request-projection";
 import { inlineDocumentDataUrl } from "../../responses/inline-document";
 import type { OcxAssistantMessage, OcxContentPart, OcxParsedRequest, OcxProviderConfig, OcxTextContent, OcxThinkingContent, OcxToolCall } from "../../types";
@@ -75,7 +76,7 @@ export function openAIChatSerializesThinking(
   modelId: string,
 ): ClaudeThinkingProjection {
   return {
-    text: modelInList(provider.preserveReasoningContentModels, modelId),
+    text: chatReasoningReplayPolicy(provider, modelId).preserve,
     // The wire has no `signature` field — base64 replay tokens are Anthropic-wire-only.
     signature: false,
     // A `redacted_thinking` block is opaque provider data with no Chat representation: the
@@ -267,7 +268,7 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
           // recorded under every call id — join unique texts only.
           if (cached.length > 0) {
             reasoningContent = [...new Set(cached)].join("\n");
-          } else if (modelInList(provider.requiresReasoningPlaceholderModels ?? provider.preserveReasoningContentModels, parsed.modelId)) {
+          } else if (chatReasoningReplayPolicy(provider, parsed.modelId).placeholder) {
             // Fallback (extends #950 and #1193; fixes #5421): the replay cache is
             // bounded (64 entries / 256 KiB / 1 h TTL) and always misses on
             // long sessions, and some thinking/tool rounds carry no recorded
@@ -354,7 +355,7 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
           const orphanReasoning =
             cachedReasoning
             || (wireSerializesThinking
-              && modelInList(provider.requiresReasoningPlaceholderModels ?? provider.preserveReasoningContentModels, parsed.modelId)
+              && chatReasoningReplayPolicy(provider, parsed.modelId).placeholder
               ? " "
               : undefined);
           const orphanReasoningFields: Record<string, unknown> = !orphanReasoning

package/src/adapters/openai-chat/passthrough.ts

@@ -14,6 +14,8 @@ import { modelRecordValue } from "../../reasoning-effort";
 import { modelInList, type OcxProviderConfig } from "../../types";
 import { chatParallelToolCallsWireValue } from "./parallel-tool-calls";
 import { applyExplicitChatReasoningWirePolicy } from "./reasoning-wire";
+import { replayNativeChatReasoning } from "./reasoning-replay";
+import type { OcxReasoningReplayScopeRef } from "../../types";
 
 const CHAT_PASSTHROUGH_FIELDS = [
   "audio",
@@ -55,17 +57,19 @@ export function buildOpenAIChatPassthroughRequest(
   fastPolicy: ResolvedFastPolicy = fastPolicyForModel(provider, modelId, undefined, "chat"),
   fastMode?: boolean,
   providerName?: string,
+  replayScope?: OcxReasoningReplayScopeRef,
 ): AdapterRequest {
   const { url, headers, hasCredential } = openAIChatTransport(provider);
 
   const body: Record<string, unknown> = {
     model: provider.modelSuffixBracketStrip ? stripBracketedModelSuffix(modelId) : modelId,
-    // The caller's messages are forwarded as they arrived, with one exception: an operator who
+    // The caller's messages retain their wire shape. An operator who
     // recorded that this destination rejects the `developer` role gets that role converted in
     // place. Verbatim was not neutral there — it sent the role anyway and the turn failed
     // upstream with a 400 before the model saw it. An unrecorded destination is still verbatim,
     // and the conversion changes the role of those messages and nothing else, so the position
-    // of every message and every other field survive unchanged.
+    // of every message and every other field survive unchanged. Missing thinking history is
+    // repaired below using the same preserve policy as the translated Chat builder.
     messages: applyExplicitChatDeveloperRole(
       frameAgentRouterMessages(provider.baseUrl, rawBody.messages),
       provider,
@@ -75,6 +79,8 @@ export function buildOpenAIChatPassthroughRequest(
   for (const field of CHAT_PASSTHROUGH_FIELDS) {
     if (rawBody[field] !== undefined) body[field] = rawBody[field];
   }
+  body.messages = replayNativeChatReasoning(body.messages, provider, modelId, replayScope,
+    Array.isArray(rawBody.tools) && rawBody.tools.length > 0);
   if (protectGlmSummaryBudget(body, provider.baseUrl, body.reasoning_effort)) body.reasoning_effort = "low";
   const rawEfforts = modelRecordValue(provider.modelReasoningEfforts, modelId) ?? provider.reasoningEfforts;
   const reasoningDisabled = modelInList(provider.noReasoningModels, modelId) || rawEfforts?.length === 0;

package/src/adapters/openai-chat/reasoning-replay.ts

@@ -0,0 +1,52 @@
+import { modelInList, type OcxProviderConfig, type OcxReasoningReplayScopeRef } from "../../types";
+import { peekReasoningForCall } from "../../responses/reasoning-replay-cache";
+
+type Rec = Record<string, unknown>;
+export const isChatRecord = (value: unknown): value is Rec =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+
+const isDeepSeekThinkingModel = (modelId: string): boolean =>
+  /(?:^|\/)deepseek-(?:v\d+(?:\.\d+)*-(?:flash|pro)|flash|pro)(?:$|[-_:])/i.test(modelId);
+
+/** DeepSeek thinking tool replay is a model contract, independent of the gateway's name. */
+export function chatReasoningReplayPolicy(provider: OcxProviderConfig, modelId: string): {
+  preserve: boolean; placeholder: boolean;
+} {
+  // Match whole model-family tokens, including dotted versions, namespace and deployment suffixes.
+  // Legacy chat/reasoner and distilled R1 models do not share the thinking tool-call contract.
+  const preserve = provider.preserveReasoningContentModels === undefined
+    ? isDeepSeekThinkingModel(modelId)
+    : modelInList(provider.preserveReasoningContentModels, modelId);
+  return {
+    preserve,
+    placeholder: preserve && (provider.requiresReasoningPlaceholderModels === undefined
+      ? true
+      : modelInList(provider.requiresReasoningPlaceholderModels, modelId)),
+  };
+}
+
+/** Repair missing native history without mutating caller bodies used by retries/combo siblings. */
+export function replayNativeChatReasoning(
+  messages: unknown,
+  provider: OcxProviderConfig,
+  modelId: string,
+  scope?: OcxReasoningReplayScopeRef,
+  hasTools = false,
+): unknown {
+  const policy = chatReasoningReplayPolicy(provider, modelId);
+  if (!policy.preserve || !Array.isArray(messages)
+      || modelInList(provider.reasoningDetailsModels, modelId)) return messages;
+  return messages.map(message => {
+    if (!isChatRecord(message) || message.role !== "assistant"
+        || (typeof message.reasoning_content === "string" && message.reasoning_content.length > 0)) return message;
+    const calls = Array.isArray(message.tool_calls) ? message.tool_calls : [];
+    // DeepSeek's tools contract covers all prior assistant turns, even plain answers.
+    // Those turns have no call id for original replay; only the configured fallback applies.
+    if (calls.length === 0 && !(hasTools && isDeepSeekThinkingModel(modelId))) return message;
+    const cached = calls.filter(isChatRecord)
+      .map(tool => typeof tool.id === "string" ? peekReasoningForCall(tool.id, scope) : undefined)
+      .filter((text): text is string => typeof text === "string" && text.length > 0);
+    const reasoning = cached.length > 0 ? [...new Set(cached)].join("\n") : policy.placeholder ? " " : undefined;
+    return reasoning === undefined ? message : { ...message, reasoning_content: reasoning };
+  });
+}