@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/adapters/dsh-account.ts

@@ -0,0 +1,97 @@
+import type { IncomingMeta, ProviderAdapter } from "./base";
+import { createAnthropicAdapter } from "./anthropic";
+import type { AdapterFactoryContext } from "./registry";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { resolveDshAccountMessagesUrl } from "../providers/dsh-account-destination";
+
+export { DSH_ACCOUNT_DEFAULT_MESSAGES_URL, resolveDshAccountMessagesUrl } from "../providers/dsh-account-destination";
+
+export const DSH_ACCOUNT_RESERVED_HEADERS = new Set([
+  "x-dsh-auth-token",
+  "anthropic-version",
+  "authorization",
+  "x-api-key",
+  "host",
+]);
+
+export function createDshAccountAdapter(
+  provider: OcxProviderConfig,
+  _context?: AdapterFactoryContext,
+): ProviderAdapter {
+  // Use key authMode internally so that createAnthropicAdapter doesn't inject Claude Code headers/prompt.
+  const baseAdapter = createAnthropicAdapter({
+    ...provider,
+    authMode: "key",
+  }, "none");
+
+  return {
+    ...baseAdapter,
+    name: "dsh-account",
+
+    formatErrorBody(status: number, headers: Headers, payloadText: string): string {
+      if (status === 401) {
+        return "DeepSeek Harness account authentication failed (401 / ACCOUNT_TOKEN_INVALID). Please sign in to DeepSeek Harness Desktop and re-import.";
+      }
+      return baseAdapter.formatErrorBody?.(status, headers, payloadText) ?? payloadText;
+    },
+
+    async buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta) {
+      const token = provider.apiKey?.trim();
+      if (!token) {
+        throw new Error("DeepSeek Harness account token missing — import your account in Providers > DeepSeek Account (DSH)");
+      }
+
+      // Fail-closed if custom provider configuration attempts to set any reserved header
+      if (provider.headers) {
+        for (const key of Object.keys(provider.headers)) {
+          if (DSH_ACCOUNT_RESERVED_HEADERS.has(key.toLowerCase())) {
+            throw new Error(`Reserved header "${key}" cannot be overridden in dsh-account provider configuration`);
+          }
+        }
+      }
+
+      const req = await baseAdapter.buildRequest(parsed, incoming);
+      const url = resolveDshAccountMessagesUrl(provider.baseUrl);
+
+      const headers: Record<string, string> = { ...req.headers };
+
+      // Apply custom provider headers strictly before authoritative authentication headers
+      if (provider.headers) {
+        for (const [key, value] of Object.entries(provider.headers)) {
+          if (!DSH_ACCOUNT_RESERVED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+            headers[key] = value;
+          }
+        }
+      }
+
+      // Authoritative cleanup: strip any API key or Claude headers
+      for (const key of Object.keys(headers)) {
+        const lower = key.toLowerCase();
+        if (
+          lower === "authorization"
+          || lower === "x-api-key"
+          || lower === "x-dsh-auth-token"
+          || lower === "anthropic-version"
+          || lower === "anthropic-beta"
+          || lower === "x-claude-code-session-id"
+          || lower === "x-client-request-id"
+        ) {
+          delete headers[key];
+        }
+      }
+
+      // Set authoritative DeepSeek Harness Account headers strictly at the end
+      headers["x-dsh-auth-token"] = token;
+      headers["anthropic-version"] = "2023-06-01";
+      if (!headers["Content-Type"]) headers["Content-Type"] = "application/json";
+      if (!headers["Accept"]) headers["Accept"] = parsed.stream ? "text/event-stream" : "application/json";
+
+      return {
+        ...req,
+        url,
+        headers,
+        redirect: "manual",
+      };
+    },
+  };
+}

package/src/adapters/google-progress-history.ts

@@ -0,0 +1,53 @@
+/**
+ * Gemini progress-text history trimming.
+ *
+ * Gemini models, observed on Gemini 4 Argon over Cloud Code Assist, sometimes skip their thinking
+ * channel on a tool-calling turn and plan in the visible text instead. The provider sends that
+ * planning as an ordinary text part without a thought marker, for example a progress line in the
+ * user's language followed by "Let's read google.ts 580-1700 first." Once one turn like that is
+ * replayed as history, the model copies the pattern on the turns that follow, so the leak grows
+ * through the rest of the session. Replaying the same 300K-token request with the leaked tails
+ * removed from the history stopped the leak, while stronger system-prompt wording did not.
+ *
+ * The fix is on the history side only. Text that precedes the tool call of a replayed model turn is
+ * intermediate progress, and the Google brevity instruction already asks for a single short line
+ * there, so it is replayed as its lead sentence. A turn Codex marks `final_answer` and text after a
+ * tool call are replayed whole. Visible output is never rewritten, final
+ * answers (turns without tool calls) are replayed in full, and the split is punctuation-based so
+ * it works the same in every language without matching any wording.
+ */
+
+/**
+ * Sentence end: ASCII terminal punctuation followed by whitespace or the end (so "google.ts" and
+ * "3.5" are not boundaries), a script's own sentence terminator (CJK 。！？, Devanagari
+ * ।॥, Arabic ۔؟, Armenian ։, Ethiopic ።, Myanmar ။), or a line break. Closing quotes, brackets and
+ * Markdown emphasis right after the punctuation belong to the sentence.
+ */
+const SENTENCE_END = /[.!?]["'\u201D\u2019)\]*_`]*(?=\s|$)|[\u3002\uFF01\uFF1F\u0964\u0965\u06D4\u061F\u0589\u1362\u104B]["'\u201D\u2019\u300D\u300F)\]*_`]*|\n/g;
+
+/** A boundary that only closes a leading list marker ("1.", "a.") or a common abbreviation ("e.g."). */
+const NOT_A_SENTENCE = /^(?:\d{1,3}|[a-z])\.$|(?:^|\s)(?:e\.g|i\.e|etc|vs)\.$/i;
+
+/** Whether replayed progress text for this model is trimmed to its lead sentence. */
+export function trimsGeminiProgressHistory(modelId: string): boolean {
+  return /gemini/i.test(modelId);
+}
+
+/**
+ * The lead sentence of a replayed progress text, or undefined when nothing usable remains.
+ * Text without a sentence boundary is already a single sentence and is returned whole.
+ */
+export function geminiProgressLead(text: string): string | undefined {
+  const trimmed = text.trim();
+  if (trimmed.length === 0) return undefined;
+  SENTENCE_END.lastIndex = 0;
+  let end = trimmed.length;
+  for (let match = SENTENCE_END.exec(trimmed); match; match = SENTENCE_END.exec(trimmed)) {
+    const boundary = match.index + match[0].length;
+    if (!NOT_A_SENTENCE.test(trimmed.slice(0, boundary).trim())) { end = boundary; break; }
+  }
+  const lead = trimmed.slice(0, end).trim();
+  // A code-fence opener is not a sentence; replaying it alone would leave an unclosed fence.
+  if (lead.length === 0 || lead.startsWith("```")) return undefined;
+  return lead;
+}

package/src/adapters/google.ts

@@ -1,6 +1,8 @@
+import { openCodeZenGeminiEndpoint } from "../types/opencode-zen";
 import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
 import { debugDroppedFrame, debugProviderDiagnosticLazy } from "../lib/debug";
 import { createToolCallIdAllocator } from "./tool-call-id";
+import { openCodeGoGeminiEndpoint } from "../types/opencode-go";
 import { createImageBudget, materializeInlineImage, MAX_ENCODED_BYTES_PER_IMAGE, artifactHttpUrl } from "../images/artifacts";
 import type {
   AdapterEvent,
@@ -17,7 +19,7 @@ import type {
 import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../types";
 import type { OcxTool } from "../types";
 import { contentPartsToText, parseDataUrl } from "./image";
-import { getVertexAccessToken } from "../lib/gcp-adc";
+import { GCP_CREDENTIAL_MARKER_PREFIX, gcpCredentialMarkerAccount, getVertexAccessToken } from "../lib/gcp-adc";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
 import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
 import { isVertexTruncatedTurn, vertexTruncationErrorEvent } from "./google-truncation";
@@ -42,6 +44,7 @@ import {
   type TranslatorBudget,
 } from "../lib/translator-budget";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
+import { geminiProgressLead, trimsGeminiProgressHistory } from "./google-progress-history";
 import { configuredReasoningEfforts, mapReasoningEffort } from "../reasoning-effort";
 
 // Google-family models (Gemini/Vertex/Antigravity) tend to emit long running commentary between
@@ -174,7 +177,15 @@ function resolveDirectGeminiWireModelId(modelId: string, applyRenames: boolean):
 
 /** Vertex API key: provider.apiKey if it looks real (not a sentinel), else GOOGLE_CLOUD_API_KEY env. */
 function resolveVertexApiKey(optKey?: string): string | undefined {
-  const realKey = optKey && !optKey.startsWith("<") && optKey !== "N/A" ? optKey : undefined;
+  // A `gcp-sa:` marker is the keychain-backed credential reference (see gcp-adc): it is not
+  // API-key material, so it must not be sent as x-goog-api-key — the ADC branch below handles it.
+  // AND the marker means the operator named one credential explicitly: the GOOGLE_CLOUD_API_KEY
+  // env fallback must NOT fire (it would silently route this provider's inference through the
+  // ambient env key instead of the configured service account).
+  if (optKey && optKey.startsWith(GCP_CREDENTIAL_MARKER_PREFIX)) return undefined;
+  const realKey = optKey && !optKey.startsWith("<") && optKey !== "N/A"
+    ? optKey
+    : undefined;
   return realKey || process.env.GOOGLE_CLOUD_API_KEY;
 }
 
@@ -456,11 +467,26 @@ function messagesToGeminiFormat(
         const aMsg = msg as OcxAssistantMessage;
         const parts: unknown[] = [];
         const toolCalls: Array<{ wireCallId: string; wireName: string }> = [];
+        // Progress text before a Gemini tool call replays as its lead sentence, so planning the
+        // model leaked into visible text is not copied forward (google-progress-history.ts).
+        const trimProgress = trimsGeminiProgressHistory(identityModelId)
+          && aMsg.phase !== "final_answer"
+          && aMsg.content.some(part => part.type === "toolCall");
+        let progressLeadKept = false;
+        let afterToolCall = false;
         for (const p of aMsg.content) {
           if (p.type === "text") {
-            const textPart = geminiTextPart((p as OcxTextContent).text);
+            let text: unknown = (p as OcxTextContent).text;
+            if (trimProgress && !afterToolCall) {
+              if (progressLeadKept || typeof text !== "string") continue;
+              text = geminiProgressLead(text);
+              if (text === undefined) continue;
+              progressLeadKept = true;
+            }
+            const textPart = geminiTextPart(text);
             if (textPart) parts.push(textPart);
           } else if (p.type === "toolCall") {
+            afterToolCall = true;
             const tc = p as OcxToolCall;
             // Preserve the thought signature on the function-call part so Antigravity/Gemini-3
             // reasoning continuity survives history-driven (stateless) turns, not just same-process
@@ -864,6 +890,7 @@ function invalidGoogleShapeEvent(
   };
 }
 
+/** Build Gemini transport and response parsing for AI Studio, Vertex, Cloud Code Assist or Go. */
 export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapter {
   const toolSchemaPolicy = provider.googleToolSchemaPolicy ?? "compatible";
   const toolSchemaProfile = {
@@ -945,6 +972,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         }
       : {}),
 
+    /** Compile an admitted request into the selected Gemini endpoint, body and authentication. */
     async buildRequest(parsed: OcxParsedRequest) {
       // Structured-output admission runs FIRST, before messagesToGeminiFormat writes
       // lastInjectedCallIds/lastReasoningReplayScope: a refused request must not leave
@@ -983,7 +1011,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
             mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning),
             provider.baseUrl,
           ).wireModelId
-        : provider.googleMode === "vertex"
+        : provider.googleMode === "vertex" || openCodeZenGeminiEndpoint(provider, parsed.modelId) !== undefined
           ? parsed.modelId
           : resolveDirectGeminiWireModelId(parsed.modelId, provider.directGeminiWireRenames !== false);
       returnsThoughtSummaries = provider.googleMode === "cloud-code-assist"
@@ -1197,16 +1225,31 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         if (locationError) throw new Error(locationError);
         const host = location === "global" ? "aiplatform.googleapis.com" : `${location}-aiplatform.googleapis.com`;
         const url = `https://${host}/v1/projects/${project}/locations/${location}/publishers/google/models/${parsed.modelId}:${method}${streamParam}`;
-        const token = await getVertexAccessToken();
+        // The marker account travels per-request as an argument (never process-global state): a
+        // module-level "active marker" written at routing time would race across concurrent
+        // requests for different providers and could resolve one call with another's credential.
+        const markerAccount = gcpCredentialMarkerAccount(provider.apiKey);
+        const token = await getVertexAccessToken({ markerAccount });
         headers["Authorization"] = `Bearer ${token}`;
         return { url, method: "POST", headers, body: JSON.stringify(compiled.body) };
       }
 
-      // ai-studio (default): Generative Language API + x-goog-api-key.
-      const url = `${provider.baseUrl}/v1beta/models/${routedModelId}:${method}${streamParam}`;
+      // Go and Zen use separate guarded Gemini endpoints; AI Studio retains /v1beta.
+      const goEndpoint = openCodeGoGeminiEndpoint(provider, routedModelId);
+      const zenEndpoint = openCodeZenGeminiEndpoint(provider, routedModelId);
+      const endpoint = goEndpoint ?? zenEndpoint ?? `${provider.baseUrl}/v1beta/models/${routedModelId}`;
+      const url = `${endpoint}:${method}${streamParam}`;
       const apiKey = provider.apiKey?.trim();
-      if (!apiKey) throw new Error("google (AI Studio) requires a non-empty API key");
-      headers["x-goog-api-key"] = apiKey;
+      if (!apiKey) throw new Error(`${goEndpoint ? "OpenCode Go" : zenEndpoint ? "OpenCode Zen" : "google (AI Studio)"} requires a non-empty API key`);
+      if (goEndpoint) {
+        // Console inference documents Bearer auth. Send only the selected Go key.
+        for (const name of Object.keys(headers)) {
+          if (["authorization", "x-goog-api-key", "x-api-key"].includes(name.toLowerCase())) delete headers[name];
+        }
+        headers["Authorization"] = `Bearer ${apiKey}`;
+      } else {
+        headers["x-goog-api-key"] = apiKey;
+      }
 
       const compiled = compileGoogleWireBody(body, toolSchemaProfile, toolSchemaPolicy);
       reportToolSchemaLoss(compiled.toolSchemaLossReport);

package/src/adapters/openai-chat/messages.ts

@@ -7,6 +7,7 @@ import { EMPTY_TOOL_OUTPUT_ANNOTATION, isWhitespaceOnlyTextPartArray } from "../
 import { identifyRoutedModel } from "../identity";
 import { buildNonOpenAIToolCatalogNudgeForTools, shouldInjectNonOpenAIToolCatalogNudge } from "../tool-catalog-nudge";
 import { peekReasoningForCall } from "../../responses/reasoning-replay-cache";
+import { chatReasoningReplayPolicy } from "./reasoning-replay";
 import type { ClaudeThinkingProjection } from "../../lib/claude-request-projection";
 import { inlineDocumentDataUrl } from "../../responses/inline-document";
 import type { OcxAssistantMessage, OcxContentPart, OcxParsedRequest, OcxProviderConfig, OcxTextContent, OcxThinkingContent, OcxToolCall } from "../../types";
@@ -75,7 +76,7 @@ export function openAIChatSerializesThinking(
   modelId: string,
 ): ClaudeThinkingProjection {
   return {
-    text: modelInList(provider.preserveReasoningContentModels, modelId),
+    text: chatReasoningReplayPolicy(provider, modelId).preserve,
     // The wire has no `signature` field — base64 replay tokens are Anthropic-wire-only.
     signature: false,
     // A `redacted_thinking` block is opaque provider data with no Chat representation: the
@@ -267,7 +268,7 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
           // recorded under every call id — join unique texts only.
           if (cached.length > 0) {
             reasoningContent = [...new Set(cached)].join("\n");
-          } else if (modelInList(provider.requiresReasoningPlaceholderModels ?? provider.preserveReasoningContentModels, parsed.modelId)) {
+          } else if (chatReasoningReplayPolicy(provider, parsed.modelId).placeholder) {
             // Fallback (extends #950 and #1193; fixes #5421): the replay cache is
             // bounded (64 entries / 256 KiB / 1 h TTL) and always misses on
             // long sessions, and some thinking/tool rounds carry no recorded
@@ -354,7 +355,7 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
           const orphanReasoning =
             cachedReasoning
             || (wireSerializesThinking
-              && modelInList(provider.requiresReasoningPlaceholderModels ?? provider.preserveReasoningContentModels, parsed.modelId)
+              && chatReasoningReplayPolicy(provider, parsed.modelId).placeholder
               ? " "
               : undefined);
           const orphanReasoningFields: Record<string, unknown> = !orphanReasoning

package/src/adapters/openai-chat/passthrough.ts

@@ -14,6 +14,8 @@ import { modelRecordValue } from "../../reasoning-effort";
 import { modelInList, type OcxProviderConfig } from "../../types";
 import { chatParallelToolCallsWireValue } from "./parallel-tool-calls";
 import { applyExplicitChatReasoningWirePolicy } from "./reasoning-wire";
+import { replayNativeChatReasoning } from "./reasoning-replay";
+import type { OcxReasoningReplayScopeRef } from "../../types";
 
 const CHAT_PASSTHROUGH_FIELDS = [
   "audio",
@@ -55,17 +57,19 @@ export function buildOpenAIChatPassthroughRequest(
   fastPolicy: ResolvedFastPolicy = fastPolicyForModel(provider, modelId, undefined, "chat"),
   fastMode?: boolean,
   providerName?: string,
+  replayScope?: OcxReasoningReplayScopeRef,
 ): AdapterRequest {
   const { url, headers, hasCredential } = openAIChatTransport(provider);
 
   const body: Record<string, unknown> = {
     model: provider.modelSuffixBracketStrip ? stripBracketedModelSuffix(modelId) : modelId,
-    // The caller's messages are forwarded as they arrived, with one exception: an operator who
+    // The caller's messages retain their wire shape. An operator who
     // recorded that this destination rejects the `developer` role gets that role converted in
     // place. Verbatim was not neutral there — it sent the role anyway and the turn failed
     // upstream with a 400 before the model saw it. An unrecorded destination is still verbatim,
     // and the conversion changes the role of those messages and nothing else, so the position
-    // of every message and every other field survive unchanged.
+    // of every message and every other field survive unchanged. Missing thinking history is
+    // repaired below using the same preserve policy as the translated Chat builder.
     messages: applyExplicitChatDeveloperRole(
       frameAgentRouterMessages(provider.baseUrl, rawBody.messages),
       provider,
@@ -75,6 +79,8 @@ export function buildOpenAIChatPassthroughRequest(
   for (const field of CHAT_PASSTHROUGH_FIELDS) {
     if (rawBody[field] !== undefined) body[field] = rawBody[field];
   }
+  body.messages = replayNativeChatReasoning(body.messages, provider, modelId, replayScope,
+    Array.isArray(rawBody.tools) && rawBody.tools.length > 0);
   if (protectGlmSummaryBudget(body, provider.baseUrl, body.reasoning_effort)) body.reasoning_effort = "low";
   const rawEfforts = modelRecordValue(provider.modelReasoningEfforts, modelId) ?? provider.reasoningEfforts;
   const reasoningDisabled = modelInList(provider.noReasoningModels, modelId) || rawEfforts?.length === 0;

package/src/adapters/openai-chat/reasoning-replay.ts

@@ -0,0 +1,52 @@
+import { modelInList, type OcxProviderConfig, type OcxReasoningReplayScopeRef } from "../../types";
+import { peekReasoningForCall } from "../../responses/reasoning-replay-cache";
+
+type Rec = Record<string, unknown>;
+export const isChatRecord = (value: unknown): value is Rec =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+
+const isDeepSeekThinkingModel = (modelId: string): boolean =>
+  /(?:^|\/)deepseek-(?:v\d+(?:\.\d+)*-(?:flash|pro)|flash|pro)(?:$|[-_:])/i.test(modelId);
+
+/** DeepSeek thinking tool replay is a model contract, independent of the gateway's name. */
+export function chatReasoningReplayPolicy(provider: OcxProviderConfig, modelId: string): {
+  preserve: boolean; placeholder: boolean;
+} {
+  // Match whole model-family tokens, including dotted versions, namespace and deployment suffixes.
+  // Legacy chat/reasoner and distilled R1 models do not share the thinking tool-call contract.
+  const preserve = provider.preserveReasoningContentModels === undefined
+    ? isDeepSeekThinkingModel(modelId)
+    : modelInList(provider.preserveReasoningContentModels, modelId);
+  return {
+    preserve,
+    placeholder: preserve && (provider.requiresReasoningPlaceholderModels === undefined
+      ? true
+      : modelInList(provider.requiresReasoningPlaceholderModels, modelId)),
+  };
+}
+
+/** Repair missing native history without mutating caller bodies used by retries/combo siblings. */
+export function replayNativeChatReasoning(
+  messages: unknown,
+  provider: OcxProviderConfig,
+  modelId: string,
+  scope?: OcxReasoningReplayScopeRef,
+  hasTools = false,
+): unknown {
+  const policy = chatReasoningReplayPolicy(provider, modelId);
+  if (!policy.preserve || !Array.isArray(messages)
+      || modelInList(provider.reasoningDetailsModels, modelId)) return messages;
+  return messages.map(message => {
+    if (!isChatRecord(message) || message.role !== "assistant"
+        || (typeof message.reasoning_content === "string" && message.reasoning_content.length > 0)) return message;
+    const calls = Array.isArray(message.tool_calls) ? message.tool_calls : [];
+    // DeepSeek's tools contract covers all prior assistant turns, even plain answers.
+    // Those turns have no call id for original replay; only the configured fallback applies.
+    if (calls.length === 0 && !(hasTools && isDeepSeekThinkingModel(modelId))) return message;
+    const cached = calls.filter(isChatRecord)
+      .map(tool => typeof tool.id === "string" ? peekReasoningForCall(tool.id, scope) : undefined)
+      .filter((text): text is string => typeof text === "string" && text.length > 0);
+    const reasoning = cached.length > 0 ? [...new Set(cached)].join("\n") : policy.placeholder ? " " : undefined;
+    return reasoning === undefined ? message : { ...message, reasoning_content: reasoning };
+  });
+}

package/src/adapters/openai-responses/compaction-search-history.ts

@@ -5,7 +5,7 @@ export const MAX_SEARCH_NOTE_FIELD_CHARS = 2048;
 /** Most `queries` or `sources` entries copied from one hosted call. */
 export const MAX_SEARCH_NOTE_LIST_ENTRIES = 20;
 /**
- * Serialized bytes all notes of one summary request may use, the omission note included. Request
+ * Serialized bytes all projected notes of one request may use, the omission note included. Request
  * body limits are off by default, so the projection carries its own bound.
  */
 export const MAX_PROJECTED_SEARCH_NOTE_BYTES = 65_536;
@@ -49,14 +49,19 @@ function noteBytes(note: unknown): number {
 }
 
 function omissionNote(count: number): Record<string, unknown> {
-  return referenceNote(`${count} further hosted web search actions omitted from this summary request.`);
+  return referenceNote(`${count} further hosted web search actions omitted from this request.`);
 }
 
-/** Request-local projection of one hosted call for a summarizer with no hosted tool declarations. */
+/** Request-local metadata projection for native Codex replay and portable summaries. */
 export function renderCompactionSearchHistory(item: unknown): unknown {
   if (!isPlainObject(item) || item.type !== "web_search_call") return item;
   // Allowlist action metadata, not opaque state, IDs, or unknown provider fields.
   const metadata: Record<string, unknown> = stringFields(item, ["status"]);
+  if (Array.isArray(item.sources)) {
+    metadata.sources = firstEntries(item.sources, source => isPlainObject(source) && typeof source.url === "string"
+      ? stringFields(source, ["type", "url", "title"])
+      : undefined);
+  }
   if (isPlainObject(item.action)) {
     const action: Record<string, unknown> = stringFields(item.action, ["type", "query", "url", "pattern"]);
     if (Array.isArray(item.action.queries)) {
@@ -73,13 +78,15 @@ export function renderCompactionSearchHistory(item: unknown): unknown {
 }
 
 /**
- * Project every hosted call in a summary request's input, in place order, within
+ * Project every hosted call in the selected input, in place order, within
  * MAX_PROJECTED_SEARCH_NOTE_BYTES. Once the next note would cross the budget less the reserved
  * omission note, that call and every later hosted call are dropped, and one omission note stands at
  * the first dropped position. Items other than hosted calls pass through untouched.
  */
-export function renderCompactionSearchHistoryItems(items: readonly unknown[]): unknown[] {
-  const hostedCount = items.filter(item => isPlainObject(item) && item.type === "web_search_call").length;
+export function renderCompactionSearchHistoryItems(items: readonly unknown[], referencedHostedIds?: ReadonlySet<string>): unknown[] {
+  const shouldProject = (item: unknown) => isPlainObject(item) && item.type === "web_search_call"
+    && !(typeof item.id === "string" && referencedHostedIds?.has(item.id));
+  const hostedCount = items.filter(shouldProject).length;
   if (hostedCount === 0) return [...items];
   const reserve = noteBytes(omissionNote(hostedCount));
   const out: unknown[] = [];
@@ -87,7 +94,7 @@ export function renderCompactionSearchHistoryItems(items: readonly unknown[]): u
   let omitted = 0;
   let omissionIndex = -1;
   for (const item of items) {
-    if (!isPlainObject(item) || item.type !== "web_search_call") {
+    if (!shouldProject(item)) {
       out.push(item);
       continue;
     }