@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/adapters/openai-responses/passthrough.ts

@@ -1,4 +1,6 @@
+import { truncationReasonFor } from "../../responses/truncated-stop-reason";
 import { normalizeRoutedAgentMessages } from "../routed-agent-messages";
+import { frameCompactionHistory } from "../../responses/compaction-history-framing";
 import { nameRoutedIdentity, repairIdentityInResponsesBody, stripRoutedIdentity } from "../identity";
 import { stripBracketedModelSuffix } from "../openai-chat";
 import { normalizeOpenCodeGoAdditionalTools } from "../opencode-go-additional-tools";
@@ -7,7 +9,7 @@ import { applyGithubCopilotContextTier } from "../../providers/github-copilot-co
 import { Buffer } from "node:buffer";
 import type { IncomingMeta, ProviderAdapter } from "../base";
 import { namespacedToolName, type AdapterEvent, type OcxParsedRequest, type OcxProviderConfig, type OcxUsage, type TierDecision } from "../../types";
-import { applyCodexRoutingHint, CODEX_RESPONSES_LITE_HEADER, CODEX_ROUTING_HINT_HEADER } from "../../codex/forward-transport-headers";
+import { applyCodexRoutingHint, CODEX_RESPONSES_LITE_HEADER, CODEX_RESPONSES_LITE_METADATA_KEY, CODEX_ROUTING_HINT_HEADER } from "../../codex/forward-transport-headers";
 import { COMPACT_PROMPT, compactionItemToText, decodeCompactionSummary, isCompactionItemType, transferCompactionCiphertextLease } from "../../responses/compaction";
 import { decodeServerSentEvents } from "../../lib/sse-decoder";
 import {
@@ -15,6 +17,7 @@ import {
   destinationDecodesNativeCompactionBlob,
   isCanonicalOpenAiForwardProvider,
   isOpenAiOperatedResponsesDestination,
+  supportsNativeResponsesCompactionTrigger,
 } from "../../providers/openai-tiers";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { rewriteRoutedCustomToolsForUpstream, validateFinalCustomToolCompatibility } from "../../responses/custom-tool-compat";
@@ -23,7 +26,8 @@ import { rewriteRoutedNamespaceToolsForUpstream } from "../../responses/namespac
 import { repairLegacyDottedToolCallNames } from "../../responses/legacy-dotted-tool-name-repair";
 import { preparePlaintextV2AgentMessages } from "../../responses/plaintext-v2-agent-messages";
 import { isMetaAiResponsesDestination, rewriteMuseToolNamesForUpstream } from "../../responses/muse-tool-name-alias";
-import { openaiResponsesUrl } from "../openai-responses-url";
+import { buildResponsesTransport } from "./transport";
+export { FORWARD_HEADERS } from "./transport";
 import { normalizeResponsesCodeMode } from "../responses-code-mode";
 import { injectXaiResponsesXSearch, normalizeXaiResponsesWebSearch } from "../xai-web-search";
 import {
@@ -36,7 +40,7 @@ import {
   emittedFastWire,
 } from "../../providers/fastwire";
 import { dropResponsesReasoningInputItems, mapRoutedResponsesReasoningEffort, normalizeConfiguredReasoningSummaryDelivery, sanitizeReasoningInputContent, stripDisabledReasoningSummaries, stripDisabledVerbosity, stripNoneReasoningSummary, stripUnsupportedReasoningSummaryDelivery } from "./reasoning";
-import { scrubOcxCompactionItems, stripCanonicalOnlyToolFields, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough, stripInvalidItemIds, stripItemIdsWhenUnstored, stripRejectedSamplingParams } from "./request-strips";
+import { scrubOcxCompactionItems, stripCanonicalOnlyToolFields, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough, stripInvalidItemIds, stripItemIdsWhenUnstored, stripProviderInputItemMetadata, stripRejectedSamplingParams } from "./request-strips";
 import { notePlaintextReasoningDropped } from "./plaintext-reasoning-notice";
 import { stripCanonicalForwardPromptCacheOptions, stripDeprecatedPromptCacheRetention } from "./prompt-cache";
 import { isPlainObject } from "./internal";
@@ -47,7 +51,7 @@ import { applyTierDecisionToResponsesBody, normalizeCanonicalForwardContinuation
 import { normalizeImageGenClientTools, preferConfiguredHostedTools } from "./image-gen";
 import { stripMuseSparkUnsupportedWebSearchFields, stripOpenAiOnlyWebSearchFields } from "./web-search";
 import { observeOutbound } from "../../usage/cache-diagnostic";
-import { normalizeForwardedClientHeaderName } from "../../lib/provider-client-headers";
+
 import { normalizeMuseToolChoice } from "./muse-tool-choice";
 import { renderCompactionSearchHistoryItems } from "./compaction-search-history";
 import { stripKimiEmptyAssistantMessages } from "./empty-assistant";
@@ -65,55 +69,6 @@ export function requiresPlaintextReasoningReplay(provider: OcxProviderConfig): b
     && provider.requiresAdjacentResponsesToolResults === true;
 }
 
-// Headers relayed verbatim from the caller in OAuth-passthrough ("forward") mode.
-// Exported so the web-search sidecar reuses the exact same forwarded-auth set for its ChatGPT call.
-export const FORWARD_HEADERS = [
-  "authorization",
-  "chatgpt-account-id",
-  "openai-beta",
-  "originator",
-  "session_id",
-  "session-id",
-  "thread-id",
-  "x-client-request-id",
-  "x-codex-beta-features",
-  "x-codex-installation-id",
-  "x-codex-parent-thread-id",
-  "x-codex-turn-metadata",
-  "x-codex-turn-state",
-  "x-codex-window-id",
-  "x-oai-attestation",
-  "x-openai-subagent",
-  "x-responsesapi-include-timing-metrics",
-  CODEX_RESPONSES_LITE_HEADER,
-];
-
-/** Preserve the caller fingerprint unless the provider explicitly owns that header. */
-function applyCallerUserAgentFallback(
-  headers: Record<string, string>,
-  incoming: IncomingMeta,
-): void {
-  if (Object.keys(headers).some(name => name.toLowerCase() === "user-agent")) return;
-  const userAgent = incoming.headers.get("user-agent");
-  if (userAgent) headers["User-Agent"] = userAgent;
-}
-
-/** Copy only explicitly opted-in caller metadata; provider-owned headers remain authoritative. */
-function applyConfiguredClientHeaderForwarding(
-  headers: Record<string, string>,
-  incoming: IncomingMeta,
-  provider: OcxProviderConfig,
-): void {
-  if (!Array.isArray(provider.forwardClientHeaders)) return;
-  for (const rawName of provider.forwardClientHeaders.slice(0, 64)) {
-    const name = normalizeForwardedClientHeaderName(rawName);
-    if (name === null) continue;
-    if (Object.keys(headers).some(existing => existing.toLowerCase() === name)) continue;
-    const value = incoming.headers.get(name);
-    if (value) headers[name] = value;
-  }
-}
-
 /** Replace every `input_image` part under a routed-compaction body with a short marker. */
 function stripInputImagesDeep(value: unknown): unknown {
   if (Array.isArray(value)) return value.map(stripInputImagesDeep);
@@ -126,10 +81,20 @@ function stripInputImagesDeep(value: unknown): unknown {
   return out;
 }
 
+function codexResponsesLiteSelected(headers: Record<string, string>, body: unknown): boolean {
+  const lite = new Headers(headers).get(CODEX_RESPONSES_LITE_HEADER);
+  if (lite === "true" || lite === "false") return lite === "true";
+  // Match existing canonical WS preparation: explicit HTTP intent wins, otherwise native
+  // string-map frame metadata survives. This reads intent without rewriting the transport.
+  if (!isPlainObject(body) || !isPlainObject(body.client_metadata)) return false;
+  return Object.values(body.client_metadata).every(value => typeof value === "string")
+    && body.client_metadata[CODEX_RESPONSES_LITE_METADATA_KEY] === "true";
+}
+
 /**
- * Rewrite a compaction turn for an upstream that does not speak Codex's private
- * `compaction_trigger` item: drop the trigger and the whole tool surface, and ask
- * for the handoff summary in plain terms instead (#422).
+ * Rewrite a compaction turn without native v2 capability, or a forced portable
+ * handoff: drop the trigger and the whole tool surface, and ask for the handoff
+ * summary in plain terms instead (#422). Native v1 capability is independent.
  *
  * The adapter builds from `parsed._rawBody`, so the summarizer prompt that
  * handleResponses() pushed onto `parsed.context` never reaches the wire — it has to
@@ -225,61 +190,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
 
     buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta) {
       const translatorBudget = incoming.translatorBudget;
-      const headers: Record<string, string> = { "Content-Type": "application/json" };
-      let url: string;
-
-      if (provider.authMode === "forward") {
-        const mayForwardCallerCredentials = isCanonicalOpenAiForwardProvider(provider);
-        // OAuth passthrough: ChatGPT backend path is `${baseUrl}/responses` (no /v1).
-        const baseUrl = mayForwardCallerCredentials
-          ? CODEX_FORWARD_BASE_URL
-          : provider.baseUrl.replace(/\/+$/, "");
-        url = `${baseUrl}/responses`;
-        if (provider.headers) Object.assign(headers, provider.headers); // static headers first…
-        const runtimeProvider = provider as {
-          _codexAccountOverride?: { accessToken: string; chatgptAccountId: string };
-          _codexAccountRequired?: boolean;
-        };
-        if (
-          mayForwardCallerCredentials
-          && runtimeProvider._codexAccountRequired
-          && !runtimeProvider._codexAccountOverride
-        ) {
-          throw new Error("Codex pool account auth is required but unavailable");
-        }
-        if (mayForwardCallerCredentials) {
-          for (const h of FORWARD_HEADERS) {
-            const v = incoming?.headers.get(h);
-            if (v) {
-              if (h === CODEX_RESPONSES_LITE_HEADER) {
-                for (const name of Object.keys(headers)) {
-                  if (name.toLowerCase() === h) delete headers[name];
-                }
-              }
-              headers[h] = v; // …so genuine forwarded fields win.
-            }
-          }
-        }
-        const override = runtimeProvider._codexAccountOverride;
-        if (override && mayForwardCallerCredentials) {
-          headers["authorization"] = `Bearer ${override.accessToken}`;
-          headers["chatgpt-account-id"] = override.chatgptAccountId;
-        }
-      } else {
-        if (provider.responsesPath === undefined) {
-          url = openaiResponsesUrl(provider.baseUrl);
-        } else {
-          const base = provider.baseUrl.replace(/\/$/, "");
-          url = `${base}${provider.responsesPath}`;
-        }
-        if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
-        if (provider.headers) Object.assign(headers, provider.headers);
-      }
-      // Some Responses-compatible gateways select their Codex compatibility path from the real
-      // client fingerprint. Additional caller metadata is opt-in; static provider headers remain
-      // authoritative in either auth mode.
-      applyConfiguredClientHeaderForwarding(headers, incoming, provider);
-      applyCallerUserAgentFallback(headers, incoming);
+      const { url, headers } = buildResponsesTransport(provider, incoming);
 
       const forward = provider.authMode === "forward";
       let convertedRoutedCustomToolNames: Set<string> | undefined;
@@ -398,22 +309,27 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       // canonical-destination split below, because the reported failure was a side chat on a plain
       // OpenAI model inheriting history a routed provider had damaged.
       outBody = repairLegacyDottedToolCallNames(outBody);
+      // Shared HTTP/WS outbound projection, including concrete combo/fallback destinations.
+      if (isOpenAiOperatedResponsesDestination(provider)) {
+        outBody = stripProviderInputItemMetadata(outBody);
+      }
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         if (provider.preserveResponsesMessageMetadata !== true) {
           outBody = stripInternalChatMessageMetadataPassthrough(outBody);
         }
         // The same class of private field, one level up, but keyed on the DESTINATION rather than
         // on the canonical surface alone. `src/server/responses/compact.ts` spreads the caller's
-        // raw body into the native `/responses/compact` request without passing through this
-        // adapter, and that endpoint is offered only to OpenAI-operated destinations
-        // (supportsNativeResponsesCompactEndpoint). Stripping on the canonical predicate here
-        // would make the two paths disagree for `openai-apikey`; stripping on the destination
-        // keeps every OpenAI-operated route byte-identical and removes the field exactly where it
-        // is known to break, which is a gateway this proxy does not operate.
+        // raw body into native `/responses/compact` without this adapter, and applies the same
+        // destination boundary for opted-in custom gateways. Native endpoint capability does not
+        // grant OpenAI-private fields. Stripping on the canonical predicate here would make the
+        // two paths disagree for `openai-apikey`; stripping on the destination keeps every
+        // OpenAI-operated route byte-identical and removes the field exactly where it is known
+        // to break, which is a gateway this proxy does not operate.
         //
         // Placed before the routed compaction body is built and before serialization, so the HTTP,
         // routed-compaction and WebSocket outbounds are all covered by this one call.
         if (!isOpenAiOperatedResponsesDestination(provider)) {
+          if (parsed._compactionRequest !== true && isPlainObject(outBody)) outBody = frameCompactionHistory(outBody);
           outBody = stripCanonicalOnlyTopLevelFields(outBody);
         }
         outBody = promoteClientLoadedTools(outBody);
@@ -466,13 +382,13 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       if (!forward) {
         outBody = normalizeOpenCodeGoAdditionalTools(outBody, url, parsed._replayPrefixLen);
       }
-      // Same predicate as the routedCompaction gate in handleResponses(): an authMode check would
-      // let a noncanonical custom forward provider skip this rewrite while the server still routes
-      // it as a summarizer turn (#422). The compaction body build removes the tool surface and must
+      // Same native-v2/portable predicate as the routedCompaction gate in handleResponses():
+      // neither forward auth nor native v1 endpoint support implies trigger support. The
+      // compaction body build removes the tool surface and must
       // therefore be the last routed transform that may depend on those declarations. Structural
       // sanitizers below can still run after it.
       outBody = normalizeResponsesCodeMode(outBody, parsed, provider);
-      if (parsed._compactionRequest === true && (!isCanonicalOpenAiForwardProvider(provider) || parsed._portableCompaction === true)) {
+      if (parsed._compactionRequest === true && (!supportsNativeResponsesCompactionTrigger(provider) || parsed._portableCompaction === true)) {
         outBody = buildRoutedCompactionBody(outBody, new Headers(headers).get(CODEX_RESPONSES_LITE_HEADER) === "true");
       }
       // Run after routed compaction so nested input_image parts are replaced before a malformed
@@ -488,6 +404,8 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         }
       }
       const threadServingIdentityChanged = parsed._stripReasoningEncryptedContent === true;
+      const stripNativeCompaction = parsed._stripNativeCompactionEncryptedContent === true
+        || threadServingIdentityChanged;
       // Providers with the strict plaintext tool-continuation contract cannot consume any
       // encrypted reasoning blob, including one whose provenance is unknown. Combo routing
       // separately refuses a proven cross-route replay when no plaintext exists; this final
@@ -500,7 +418,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
                 scrubOcxCompactionItems(
                   outBody,
                   destinationDecodesNativeCompactionBlob(provider),
-                  threadServingIdentityChanged,
+                  stripNativeCompaction,
                   parsed._compactionRequest !== true,
                 ),
                 {
@@ -574,6 +492,17 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       // here, on the serialized body, not on the parsed selector. One place covers both the
       // HTTP and the WebSocket outbound, because the WS path transports this same request
       // instead of rebuilding it.
+      // Opt-in Codex Lite history policy: replay remaining hosted actions as untrusted metadata,
+      // after bridge restoration/tool validation. Tool declarations and other input stay intact.
+      if (provider.projectResponsesLiteHostedSearchHistory === true && url === `${CODEX_FORWARD_BASE_URL}/responses`
+        && !parsed._compactionRequest && !parsed._portableCompaction
+        && codexResponsesLiteSelected(headers, finalBody)
+        && isPlainObject(finalBody) && Array.isArray(finalBody.input)
+        && finalBody.input.some(item => isPlainObject(item) && item.type === "web_search_call")) {
+        const referencedIds = new Set(finalBody.input.flatMap(item => isPlainObject(item)
+          && item.type === "item_reference" && typeof item.id === "string" ? [item.id] : []));
+        finalBody = { ...finalBody, input: renderCompactionSearchHistoryItems(finalBody.input, referencedIds) };
+      }
       observeOutbound(parsed._rawBody, finalBody, headers);
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         validateFinalCustomToolCompatibility(finalBody, provider.supportsResponsesCustomTools);
@@ -656,9 +585,11 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
             case "error":
               yield { type: "error", message: responsesErrorMessage(payload.response ?? payload) };
               return;
-            case "response.incomplete":
-              yield { type: "incomplete", reason: responsesErrorMessage(payload.response ?? payload) };
+            case "response.incomplete": {
+              const reason = responsesErrorMessage(payload.response ?? payload);
+              yield { type: "incomplete", reason: truncationReasonFor(reason) ?? reason };
               return;
+            }
             case "response.completed":
               {
                 completedSeen = true;
@@ -751,7 +682,8 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         return [{ type: "error", message: responsesErrorMessage(payload) }];
       }
       if (payload.status === "incomplete") {
-        return [{ type: "incomplete", reason: responsesErrorMessage(payload) }];
+        const reason = responsesErrorMessage(payload);
+        return [{ type: "incomplete", reason: truncationReasonFor(reason) ?? reason }];
       }
       const usage = usageFromResponsesPayload(payload);
       const output = Array.isArray(payload.output) ? payload.output : [];

package/src/adapters/openai-responses/request-strips.ts

@@ -1,3 +1,4 @@
+import { expandRetainedCompactionInput } from "../../responses/retained-compaction";
 import { createHash } from "node:crypto";
 import { COMPACT_PROMPT, appendCheckpointContinuationNote, compactionItemToText, decodeCompactionSummary, isCompactionItemType } from "../../responses/compaction";
 import { debugProviderDiagnostic } from "../../lib/debug";
@@ -6,6 +7,26 @@ import { isPlainObject } from "./internal";
 import { activateDeferredTool } from "./tool-schema";
 import { stripOpenAiOnlyWebSearchFields } from "./web-search";
 
+/**
+ * Provider-opaque replay metadata is client history, not an OpenAI input-item field (#7111).
+ * The caller gates this on OpenAI-operated destinations; arbitrary gateways may accept it.
+ * Strip only the known extension, never an item-field allowlist that can erase newer wire fields
+ * or nested tool data. Copy on write so a later Google route can still replay its signature.
+ */
+export function stripProviderInputItemMetadata(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+  let input: unknown[] | undefined;
+  for (let index = 0; index < body.input.length; index += 1) {
+    const item = body.input[index];
+    if (!isPlainObject(item) || !Object.hasOwn(item, "extra_content")) continue;
+    const next = { ...item };
+    delete next.extra_content;
+    input ??= [...body.input];
+    input[index] = next;
+  }
+  return input ? { ...body, input } : body;
+}
+
 export function stripInvalidItemIds(body: unknown): unknown {
   if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
 
@@ -246,7 +267,7 @@ export function stripItemIdsWhenUnstored(
  * Normalize replayed compaction items for the destination backend.
  *
  * A compaction item carries an `encrypted_content` blob the client replays verbatim on every later
- * turn, and only the backend that minted it can decode it. Proxy-minted `ocx1:` envelopes are
+ * turn, and only the backend that minted it can decode it. Proxy-minted `ocx1:` and structured `ocx2:` envelopes are
  * transparent base64 rather than encryption, so no upstream can read them and they always become
  * plain user messages. Native blobs have multiple possible minters, so a destination's ability to
  * decode its own blobs does not make a blob from a previous serving identity portable. On a known
@@ -264,9 +285,10 @@ export function scrubOcxCompactionItems(
 ): unknown {
   if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
 
-  let changed = false;
+  const expanded = expandRetainedCompactionInput(body.input) as unknown[];
+  let changed = expanded !== body.input;
   let decodedCheckpoint = false;
-  const input = body.input.map(item => {
+  const input = expanded.map(item => {
     if (!isPlainObject(item) || !isCompactionItemType(item.type)) return item;
     const encrypted = typeof item.encrypted_content === "string" ? item.encrypted_content : undefined;
     if (encrypted === undefined) return item;

package/src/adapters/openai-responses/transport.ts

@@ -0,0 +1,81 @@
+import type { IncomingMeta } from "../base";
+import type { OcxProviderConfig } from "../../types";
+import { CODEX_RESPONSES_LITE_HEADER } from "../../codex/forward-transport-headers";
+import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers-destination";
+import { normalizeForwardedClientHeaderName } from "../../lib/provider-client-headers";
+import { openaiResponsesUrl } from "../openai-responses-url";
+
+// Caller credentials are forwarded only to the canonical Codex destination, never by capability.
+export const FORWARD_HEADERS = [
+  "authorization", "chatgpt-account-id", "openai-beta", "originator", "session_id", "session-id",
+  "thread-id", "x-client-request-id", "x-codex-beta-features", "x-codex-installation-id",
+  "x-codex-parent-thread-id", "x-codex-turn-metadata", "x-codex-turn-state", "x-codex-window-id",
+  "x-oai-attestation", "x-openai-subagent", "x-responsesapi-include-timing-metrics", CODEX_RESPONSES_LITE_HEADER,
+];
+
+/** Carry permitted client metadata across an internal compact handoff, never credentials. */
+export function copyResponsesClientMetadata(target: Headers, incoming: Headers, provider: OcxProviderConfig): void {
+  const configured = Array.isArray(provider.forwardClientHeaders) ? provider.forwardClientHeaders.slice(0, 64) : [];
+  for (const rawName of ["user-agent", ...configured]) {
+    const name = normalizeForwardedClientHeaderName(rawName);
+    const value = name === null ? null : incoming.get(name);
+    if (name !== null && value && !target.has(name)) target.set(name, value);
+  }
+}
+
+/** Shared Responses URL/auth/header construction; capabilities never grant auth authority. */
+export function buildResponsesTransport(provider: OcxProviderConfig, incoming: Pick<IncomingMeta, "headers">): {
+  url: string; headers: Record<string, string>;
+} {
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  let url: string;
+  if (provider.authMode === "forward") {
+    const mayForwardCallerCredentials = isCanonicalOpenAiForwardProvider(provider);
+    const baseUrl = mayForwardCallerCredentials ? CODEX_FORWARD_BASE_URL : provider.baseUrl.replace(/\/+$/, "");
+    url = `${baseUrl}/responses`;
+    if (provider.headers) Object.assign(headers, provider.headers);
+    const runtimeProvider = provider as {
+      _codexAccountOverride?: { accessToken: string; chatgptAccountId: string };
+      _codexAccountRequired?: boolean;
+    };
+    if (mayForwardCallerCredentials && runtimeProvider._codexAccountRequired && !runtimeProvider._codexAccountOverride) {
+      throw new Error("Codex pool account auth is required but unavailable");
+    }
+    if (mayForwardCallerCredentials) {
+      for (const name of FORWARD_HEADERS) {
+        const value = incoming.headers.get(name);
+        if (!value) continue;
+        if (name === CODEX_RESPONSES_LITE_HEADER) {
+          for (const existing of Object.keys(headers)) {
+            if (existing.toLowerCase() === name) delete headers[existing];
+          }
+        }
+        headers[name] = value;
+      }
+    }
+    const override = runtimeProvider._codexAccountOverride;
+    if (override && mayForwardCallerCredentials) {
+      headers.authorization = `Bearer ${override.accessToken}`;
+      headers["chatgpt-account-id"] = override.chatgptAccountId;
+    }
+  } else {
+    url = provider.responsesPath === undefined
+      ? openaiResponsesUrl(provider.baseUrl)
+      : `${provider.baseUrl.replace(/\/$/, "")}${provider.responsesPath}`;
+    if (provider.apiKey) headers.Authorization = `Bearer ${provider.apiKey}`;
+    if (provider.headers) Object.assign(headers, provider.headers);
+  }
+  if (Array.isArray(provider.forwardClientHeaders)) {
+    for (const rawName of provider.forwardClientHeaders.slice(0, 64)) {
+      const name = normalizeForwardedClientHeaderName(rawName);
+      if (name === null || Object.keys(headers).some(existing => existing.toLowerCase() === name)) continue;
+      const value = incoming.headers.get(name);
+      if (value) headers[name] = value;
+    }
+  }
+  if (!Object.keys(headers).some(name => name.toLowerCase() === "user-agent")) {
+    const userAgent = incoming.headers.get("user-agent");
+    if (userAgent) headers["User-Agent"] = userAgent;
+  }
+  return { url, headers };
+}

package/src/adapters/qoder/adapter.ts

@@ -52,8 +52,10 @@ const QODER_MCP_SERVER_NAME = "opencodex";
 const QODER_MCP_SERVER_PATH = fileURLToPath(new URL("../coding-agent/mcp-server.ts", import.meta.url));
 
 export function buildQoderChildEnv(profile: QoderProfile, apiKey: string, systemPrompt?: string): Record<string, string> {
-  const promptEnv = profile.region === "cn" ? "QODERCN_APPEND_SYSTEM_PROMPT" : "QODER_APPEND_SYSTEM_PROMPT";
-  return { ...baseScopedEnv(), NO_COLOR: "1", [profile.tokenEnv]: apiKey,
+  // Each build reads its own brand prefix with no fallback: qodercn ignores QODER_EXPOSE_TOKEN_USAGE.
+  const envPrefix = profile.region === "cn" ? "QODERCN_" : "QODER_";
+  const promptEnv = `${envPrefix}APPEND_SYSTEM_PROMPT`;
+  return { ...baseScopedEnv(), NO_COLOR: "1", [`${envPrefix}EXPOSE_TOKEN_USAGE`]: "true", [profile.tokenEnv]: apiKey,
     ...(systemPrompt ? { [promptEnv]: systemPrompt } : {}) };
 }
 

package/src/adapters/registry.ts

@@ -1,4 +1,5 @@
 import { createAnthropicAdapter } from "./anthropic";
+import { createDshAccountAdapter } from "./dsh-account";
 import { createAzureAdapter } from "./azure";
 import type { ProviderAdapter } from "./base";
 import { createClaudeCliAdapter } from "./claude-cli/adapter";
@@ -154,6 +155,10 @@ export const ADAPTER_REGISTRY = {
     contractParent: "codebuddy",
     create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createClaudeCliAdapter(provider),
   },
+  "dsh-account": {
+    contractParent: "anthropic",
+    create: (provider: OcxProviderConfig, context: AdapterFactoryContext) => createDshAccountAdapter(provider, context),
+  },
 } as const satisfies Record<string, AdapterDefinition>;
 
 export type AdapterId = keyof typeof ADAPTER_REGISTRY;

package/src/adapters/zed.ts

@@ -53,7 +53,9 @@ function delegateProvider(provider: OcxProviderConfig, zedProvider: ZedProvider)
     return { ...common, adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", googleMode: "ai-studio" };
   }
   if (zedProvider === "open_ai") {
-    return { ...common, adapter: "openai-responses", baseUrl: "https://api.openai.com/v1" };
+    // The builder targets Zed's /completions envelope. Keep its destination set to Zed as well,
+    // so OpenAI-private Responses fields are stripped instead of being sent through to Zed.
+    return { ...common, adapter: "openai-responses", baseUrl: provider.baseUrl };
   }
   return { ...common, adapter: "openai-chat", baseUrl: "https://api.x.ai/v1" };
 }
@@ -300,6 +302,29 @@ export function createZedAdapter(provider: OcxProviderConfig): ProviderAdapter {
       }
     }
     if (!isRecord(providerRequest)) throw new Error("Zed delegate produced a non-object request body");
+    if (zedProvider === "open_ai" && Array.isArray(providerRequest.input)) {
+      // Zed's OpenAI Responses parser accepts user/assistant/system/tool roles but rejects
+      // OpenAI's newer developer role. System is the closest supported role for instructions.
+      providerRequest.input = providerRequest.input.map(item =>
+        isRecord(item) && item.type === "message" && item.role === "developer"
+          ? { ...item, role: "system" }
+          : item,
+      );
+    }
+    if (zedProvider === "open_ai" && Array.isArray(providerRequest.tools)) {
+      // Zed's Responses decoder supports function/custom tools, not Codex's built-in web_search.
+      const supported = (tool: unknown) => isRecord(tool) && (tool.type === "function" || tool.type === "custom");
+      const tools = providerRequest.tools.filter(supported);
+      providerRequest.tools = tools;
+      const choice = providerRequest.tool_choice;
+      if (isRecord(choice) && choice.type === "allowed_tools" && Array.isArray(choice.tools)) {
+        const allowed = choice.tools.filter(supported);
+        providerRequest.tool_choice = allowed.length ? { ...choice, tools: allowed } : "none";
+      } else if ((isRecord(choice) && !supported(choice)) || (choice === "required" && tools.length === 0)) {
+        // Match the shared hosted-tool policy when no supported selection remains.
+        providerRequest.tool_choice = "none";
+      }
+    }
     delegate = { provider: zedProvider, adapter: selected };
     const requestUrl = `${provider.baseUrl.replace(/\/+$/, "")}/completions`;
     return {

package/src/advisor/activity.ts

@@ -0,0 +1,55 @@
+import type { OcxConfig } from "../types";
+import { sanitizeLogMetadataString } from "../lib/redact";
+
+export type AdvisorTrigger = "manual" | "preflight" | "repair_failure";
+export interface AdvisorActivity {
+  id: string;
+  startedAt: number;
+  trigger: AdvisorTrigger;
+  workerModel: string;
+  advisorModel: string;
+  requestedEffort: string;
+  /** Adapter serialization evidence, not a claim about the provider's hidden reasoning. */
+  effectiveEffort: string | null;
+  status: "running" | "ok" | "failed" | "cancelled" | "blocked";
+  durationMs: number | null;
+  usage?: { inputTokens?: number; outputTokens?: number; totalTokens?: number };
+  blockReason?: "consent" | "settings" | "budget" | "limit" | "duplicate";
+}
+
+/** Metadata only. No prompts, advice, commands, task/thread ids, errors, or hidden reasoning. */
+export function createAdvisorActivityStore() {
+  const entries: AdvisorActivity[] = [];
+  const retain = (now: number) => {
+    while (entries.length && (entries.length > 100 || entries[0]!.startedAt < now - 86_400_000)) entries.shift();
+  };
+  return {
+    start(input: Pick<AdvisorActivity, "trigger" | "workerModel" | "advisorModel" | "requestedEffort">, now = Date.now()) {
+      const entry: AdvisorActivity = {
+        id: crypto.randomUUID(), startedAt: now, ...input,
+        workerModel: sanitizeLogMetadataString(input.workerModel, 200) ?? "unknown",
+        advisorModel: sanitizeLogMetadataString(input.advisorModel, 200) ?? "unknown",
+        effectiveEffort: null, status: "running", durationMs: null,
+      };
+      entries.push(entry);
+      retain(now);
+      return entry.id;
+    },
+    finish(id: string, outcome: Pick<AdvisorActivity, "status" | "durationMs"> & Partial<Pick<AdvisorActivity, "usage" | "effectiveEffort" | "blockReason">>) {
+      const entry = entries.find(item => item.id === id);
+      if (entry) Object.assign(entry, outcome);
+    },
+    snapshot(now = Date.now()): AdvisorActivity[] {
+      retain(now);
+      return entries.toReversed().map(entry => ({ ...entry, ...(entry.usage ? { usage: { ...entry.usage } } : {}) }));
+    },
+  };
+}
+
+export type AdvisorActivityStore = ReturnType<typeof createAdvisorActivityStore>;
+const stores = new WeakMap<Pick<OcxConfig, "advisor">, AdvisorActivityStore>();
+export function advisorActivityStore(config: Pick<OcxConfig, "advisor">): AdvisorActivityStore {
+  let store = stores.get(config);
+  if (!store) { store = createAdvisorActivityStore(); stores.set(config, store); }
+  return store;
+}

package/src/advisor/budget.ts

@@ -0,0 +1,62 @@
+import { Database } from "bun:sqlite";
+import { chmodSync, closeSync, lstatSync, mkdirSync, openSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
+import { hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+
+export type AdvisorBudgetReservation = { ok: true; used: number } | { ok: false; reason: "exhausted" | "unavailable" };
+export interface AdvisorTaskBudget {
+  reserve(task: string, limit: number, now: number): AdvisorBudgetReservation;
+}
+
+/**
+ * Reserve BEFORE dispatch. Failed/disconnected calls may still cost money, so reservations
+ * are never refunded. Only SHA-256 task digests, counts and expiry times reach disk. Opening
+ * lazily and closing before returning also keeps disabled installs and shutdown timer-free.
+ */
+export function createAdvisorTaskBudget(path?: string): AdvisorTaskBudget {
+  return {
+    reserve(task, limit, now) {
+      let db: Database | undefined;
+      try {
+        const key = new Bun.CryptoHasher("sha256").update(`advisor-budget\0${task}`).digest("hex");
+        const file = path ?? join(getConfigDir(), "advisor-budget.sqlite");
+        const dir = dirname(file);
+        assertNotRealHomeUnderTest(dir);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (!lstatSync(dir).isDirectory() || lstatSync(dir).isSymbolicLink()) throw new Error("invalid directory");
+        hardenSecretDir(dir, { required: true });
+        if (!path) {
+          recordOwnedConfigPath(dir, file);
+          recordOwnedConfigPath(dir, `${file}-journal`);
+        }
+        try { closeSync(openSync(file, "wx", 0o600)); }
+        catch (error) { if ((error as { code?: string }).code !== "EEXIST") throw error; }
+        const stat = lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new Error("invalid file");
+        if (process.platform !== "win32") chmodSync(file, 0o600);
+        hardenSecretPath(file, { required: true });
+        db = new Database(file);
+        db.exec("PRAGMA busy_timeout = 0; CREATE TABLE IF NOT EXISTS tasks (task TEXT PRIMARY KEY, used INTEGER NOT NULL, expires INTEGER NOT NULL)");
+        const connection = db;
+        return connection.transaction((): AdvisorBudgetReservation => {
+          connection.query("DELETE FROM tasks WHERE expires <= ?").run(now);
+          const current = connection.query<{ used: number }, [string]>("SELECT used FROM tasks WHERE task = ?").get(key);
+          if (current && current.used >= limit) return { ok: false, reason: "exhausted" };
+          // Never evict a live task to make room: that would reset its spending limit.
+          if (!current && connection.query<{ n: number }, []>("SELECT count(*) AS n FROM tasks").get()!.n >= 512) {
+            return { ok: false, reason: "unavailable" };
+          }
+          connection.query("INSERT INTO tasks VALUES (?, 1, ?) ON CONFLICT(task) DO UPDATE SET used = used + 1")
+            .run(key, now + 86_400_000);
+          return { ok: true, used: (current?.used ?? 0) + 1 };
+        }).immediate();
+      } catch {
+        // An unavailable/corrupt/locked budget blocks the expert call, never the worker.
+        return { ok: false, reason: "unavailable" };
+      } finally { try { db?.close(); } catch { /* reservation outcome is authoritative */ } }
+    },
+  };
+}