@bitkyc08/opencodex 2.89.0 → 2.90.0

package/src/providers/quota.ts

@@ -1,6 +1,7 @@
 import { listCodexAuthAccountsSnapshot } from "../codex/auth-api";
 import { isAnthropicInstanceId, configuredAnthropicInstance } from "./anthropic-instance";
 import { fetchAnthropicAccountQuota } from "./quota/anthropic-account-quota";
+import { thrownQuotaFailure } from "./quota/failure-codes";
 import { resolveEnvValue } from "../config";
 import { getAccountCredential, getAccountSet } from "../oauth/store";
 import { apiKeyPoolEntryId } from "./api-keys";
@@ -515,7 +516,10 @@ async function fetchAccountQuota(
       }
       return entry;
     } catch (error) {
-      if (provider === "google-antigravity") quotaFailure = "account_unavailable";
+      // The probe itself reports HTTP and transport failures as results; what throws here is the
+      // credential side (missing/paused account, failed refresh, no project). A refresh that hit
+      // its deadline is a timeout to retry, not an account the operator must re-sign.
+      if (provider === "google-antigravity") quotaFailure = thrownQuotaFailure(error) === "timeout" ? "timeout" : "account_unavailable";
       return unavailable();
     }
   })().finally(() => {

package/src/providers/registry/entries-extended.ts

@@ -1020,7 +1020,12 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     },
   },
   // FREEZE 2026-07-10: codestral-latest is unconfirmed behind auth. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
-  { id: "mistral", label: "Mistral", baseUrl: "https://api.mistral.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://console.mistral.ai/api-keys", defaultModel: "codestral-latest" },
+  {
+    id: "mistral", label: "Mistral", baseUrl: "https://api.mistral.ai/v1", adapter: "openai-chat", authKind: "key",
+    dashboardUrl: "https://console.mistral.ai/api-keys", defaultModel: "codestral-latest", promptCacheKey: true,
+    // Native text-only input enrolls this model in the existing vision sidecar.
+    modelInputModalities: { "zai-glm-5-3": ["text"] },
+  },
   {
     id: "minimax", label: "MiniMax — Coding Plan", baseUrl: "https://api.minimax.io/v1", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://platform.minimax.io", defaultModel: "MiniMax-M3", models: MINIMAX_MODELS,

package/src/providers/routed-config.ts

@@ -134,7 +134,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const repairLegacyMimoFreeAuth = providerName === "mimo-free"
     && staticModelCatalog
     && (provider.authMode === undefined || provider.authMode === "local");
-  const explicitKeyOverride = providerUsesKeyAuthOverride(registryEntry, provider, resolvedApiKey);
+  const explicitKeyOverride = providerUsesKeyAuthOverride(registryEntry, provider);
   const canonicalAuthMode = explicitKeyOverride
     ? "key"
     : repairLegacyMimoFreeAuth

package/src/providers/xai-transport.ts

@@ -3,6 +3,7 @@ import type { OcxProviderConfig } from "../types";
 import { isEgressTransparentExecutor, markEgressTransparentExecutor } from "../lib/provider-egress";
 import { configuredOutboundFetch } from "../lib/proxy-env";
 import { resolveGithubCopilotTransport } from "./github-copilot-transport";
+import { resolveMistralTransport } from "./mistral-transport";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
@@ -121,7 +122,7 @@ export function resolveProviderTransport(
   if (providerName === "github-copilot") {
     return resolveGithubCopilotTransport(provider, apiBaseUrl);
   }
-  if (providerName !== "xai") return provider;
+  if (providerName !== "xai") return resolveMistralTransport(provider);
 
   const cacheKey = promptCacheKey?.trim();
   const affinity = cacheKey ? deriveXaiConvId(cacheKey) : undefined;

package/src/responses/audio.ts

@@ -0,0 +1,46 @@
+import type { OcxAudioContent } from "../types";
+
+export type ChatAudioFormat = OcxAudioContent["format"];
+
+const MIME_FORMATS: Readonly<Record<string, ChatAudioFormat>> = {
+  "audio/mp3": "mp3",
+  "audio/mpeg": "mp3",
+  "audio/wav": "wav",
+  "audio/wave": "wav",
+  "audio/x-wav": "wav",
+};
+
+function normalizedFormat(value: unknown): ChatAudioFormat | undefined {
+  if (typeof value !== "string") return undefined;
+  const format = value.trim().toLowerCase();
+  return format === "mp3" || format === "wav" ? format : undefined;
+}
+
+function validBase64(value: string): boolean {
+  return value.length > 0
+    && value.length % 4 === 0
+    && /^[A-Za-z0-9+/]+={0,2}$/.test(value);
+}
+
+/**
+ * Parse the inline audio shape Codex puts in a Responses content block. Chat Completions
+ * needs bare base64 plus `wav`/`mp3`, while Codex supplies an RFC 2397 data URL. A raw
+ * base64 value with an explicit supported format is accepted as well; remote URLs are not.
+ */
+export function audioContentFromRaw(audioUrl: unknown, declaredFormat?: unknown): OcxAudioContent | undefined {
+  if (typeof audioUrl !== "string" || audioUrl.length === 0) return undefined;
+  const dataUrl = /^data:([^;,]+);base64,([\s\S]*)$/.exec(audioUrl);
+  let data: string;
+  let format: ChatAudioFormat | undefined;
+  if (dataUrl) {
+    const declared = normalizedFormat(declaredFormat);
+    const mime = dataUrl[1].trim().toLowerCase();
+    format = MIME_FORMATS[mime] ?? (mime === "application/octet-stream" ? declared : undefined);
+    data = dataUrl[2].replace(/\s+/g, "");
+  } else {
+    format = normalizedFormat(declaredFormat);
+    data = audioUrl.replace(/\s+/g, "");
+  }
+  if (!format || !validBase64(data)) return undefined;
+  return { type: "audio", data, format, text: `[audio: ${format}]` };
+}

package/src/responses/input-media.ts

@@ -1,4 +1,5 @@
 import { isInlineDocumentDataUrl } from "./inline-document";
+import { audioContentFromRaw } from "./audio";
 
 /** Input kinds for which the normalized request has no lossless content carrier. */
 export type UntranslatedInputMedia = "audio" | "file";
@@ -10,23 +11,35 @@ function isRecord(value: unknown): value is RecordValue {
 }
 
 /**
- * Whether the position being scanned has a converter that builds a document part.
+ * Whether the position being scanned has a converter that builds a lossless media part.
  *
- * Only user content does. A tool output, a system or assistant message, and a Chat `developer`
- * message are all flattened to text by their converters, so exempting an attachment there would
- * turn today's explicit refusal into the silent drop this scanner exists to prevent.
+ * User content carries documents and inline audio; developer content carries documents only.
+ * Tool output carries inline audio through the Chat adapter's follow-up user message. System and
+ * assistant content have no lossless translated media carrier, so exempting an attachment there
+ * would turn today's explicit refusal into the silent drop this scanner exists to prevent.
  */
-type CarrierPosition = "user-content" | "flattened";
+type CarrierPosition = "user-content" | "developer-content" | "tool-output" | "flattened";
 
-function mediaKind(value: unknown, position: CarrierPosition): UntranslatedInputMedia | undefined {
+function mediaKind(value: unknown, position: CarrierPosition, allowAudio: boolean): UntranslatedInputMedia | undefined {
   if (!isRecord(value)) return undefined;
-  if (value.type === "input_audio" || value.type === "audio") return "audio";
+  if (value.type === "input_audio" || value.type === "audio") {
+    // A Chat content part has a nested input_audio object, while Codex's Responses
+    // block uses audio_url. Only the latter is carried by the translated Chat adapter; the
+    // Chat-shaped `audio` spelling has no parser path and must never pass the guard.
+    return value.type === "input_audio"
+      && allowAudio
+      && (position === "user-content" || position === "tool-output")
+      && audioContentFromRaw(value.audio_url, value.format)
+      ? undefined
+      : "audio";
+  }
   if (value.type === "input_file" || value.type === "file" || value.type === "document") {
     // A document that carries its own bytes has a lossless carrier in user content, so refusing
     // it there would reject the very request #5212 exists to preserve. A reference with no
     // payload has none anywhere: translated adapters cannot dereference a file_id or a remote
     // source.
-    return position === "user-content" && carriesInlineDocumentBytes(value) ? undefined : "file";
+    return (position === "user-content" || position === "developer-content")
+      && carriesInlineDocumentBytes(value) ? undefined : "file";
   }
   // A file-id-only image is not pixels: translated adapters cannot dereference it.
   if (value.type === "input_image" && typeof value.file_id === "string" && value.file_id.length > 0
@@ -46,10 +59,10 @@ function carriesInlineDocumentBytes(value: RecordValue): boolean {
     && value.source.data.length > 0;
 }
 
-function contentMedia(content: unknown, position: CarrierPosition): UntranslatedInputMedia | undefined {
+function contentMedia(content: unknown, position: CarrierPosition, allowAudio: boolean): UntranslatedInputMedia | undefined {
   if (!Array.isArray(content)) return undefined;
   for (const part of content) {
-    const kind = mediaKind(part, position);
+    const kind = mediaKind(part, position, allowAudio);
     if (kind) return kind;
   }
   return undefined;
@@ -60,20 +73,29 @@ function contentMedia(content: unknown, position: CarrierPosition): Untranslated
  * arguments, schema properties, or arbitrary nested objects. No payload is copied,
  * decoded, fetched or included in the returned value.
  */
-export function untranslatedResponsesInputMedia(body: unknown): UntranslatedInputMedia | undefined {
+export function untranslatedResponsesInputMedia(
+  body: unknown,
+  options: { allowAudio?: boolean } = {},
+): UntranslatedInputMedia | undefined {
   if (!isRecord(body) || !Array.isArray(body.input)) return undefined;
   for (const item of body.input) {
     if (!isRecord(item)) continue;
-    const direct = mediaKind(item, "flattened");
+    const direct = mediaKind(item, "flattened", options.allowAudio === true);
     if (direct) return direct;
     if (item.type === "function_call_output" || item.type === "custom_tool_call_output") {
-      const kind = contentMedia(item.output, "flattened");
+      const kind = contentMedia(item.output, "tool-output", options.allowAudio === true);
       if (kind) return kind;
     } else if (item.type === "message" || item.type === undefined) {
       // `inputContentParts` runs for user and developer messages only; a system message is
       // flattened to text by the parser.
       const role = item.role;
-      const kind = contentMedia(item.content, role === "user" || role === "developer" ? "user-content" : "flattened");
+      const kind = contentMedia(
+        item.content,
+        role === "user" ? "user-content"
+          : role === "developer" ? "developer-content"
+          : "flattened",
+        options.allowAudio === true,
+      );
       if (kind) return kind;
     }
   }
@@ -87,7 +109,7 @@ export function untranslatedChatInputMedia(body: unknown): UntranslatedInputMedi
     if (!isRecord(message)) continue;
     // Only the `user` branch of the Chat projection builds content blocks. `system`,
     // `developer`, `assistant` and `tool` all reduce their content to a string.
-    const kind = contentMedia(message.content, message.role === "user" ? "user-content" : "flattened");
+    const kind = contentMedia(message.content, message.role === "user" ? "user-content" : "flattened", false);
     if (kind) return kind;
   }
   return undefined;

package/src/responses/parser-content.ts

@@ -1,4 +1,5 @@
 import type { OcxContentPart, OcxTextContent } from "../types";
+import { audioContentFromRaw } from "./audio";
 import { inlineDocumentFromDataUrl } from "./inline-document";
 
 export function isObj(v: unknown): v is Record<string, unknown> {
@@ -65,23 +66,15 @@ export function inputContentParts(blocks: unknown): string | OcxContentPart[] {
       const processing = nonEmptyString((block as { processing?: string }).processing);
       if (videoUrl) parts.push({ type: "video", videoUrl, ...(processing ? { processing } : {}) });
     } else if (block.type === "input_audio") {
-      // Upstream Codex sends input_audio with an audio_url (codex-rs
-      // protocol/src/models.rs). The IR has no audio carrier and no adapter consumes
-      // one, so this part used to vanish with no trace at all.
-      //
-      // This records PRESENCE only and is NOT audio support: never the payload, which
-      // is large base64 and would explode the token count, and never the URL, which
-      // can carry a signed token. This parser must stay non-throwing — the native
-      // Responses passthrough also runs through parseRequest before the adapter
-      // forwards _rawBody, so refusing here would regress legitimate raw passthrough.
-      //
-      // No adapter refuses audio at its wire today: by this point the part is already a
-      // text marker, so downstream adapters see text and continue. A typed unsupported-
-      // modality carrier that survives to final adapter dispatch is a separate, recorded
-      // residual — do not describe this branch as a refusal.
       const b = block as { audio_url?: string; format?: string };
-      const format = safeAudioFormat(b.format);
-      if (nonEmptyString(b.audio_url)) {
+      // Keep bytes only when they have a Chat-compatible inline form. Unsupported or
+      // remote references retain a marker for text-only wires; the final adapter guard
+      // refuses them rather than allowing a silent drop.
+      const audio = audioContentFromRaw(b.audio_url, b.format);
+      if (audio) {
+        parts.push(audio);
+      } else if (nonEmptyString(b.audio_url)) {
+        const format = safeAudioFormat(b.format);
         parts.push({ type: "text", text: format ? `[audio: ${format}]` : "[audio]" });
       }
     } else if (block.type === "input_file") {
@@ -104,7 +97,7 @@ export function inputContentParts(blocks: unknown): string | OcxContentPart[] {
       // fabricating a "[file: ...]" marker for an attachment that was never sent.
     }
   }
-  // Collapse to a plain string only for a single TEXT part; images must stay structured.
+  // Collapse to a plain string only for a single TEXT part; media must stay structured.
   if (parts.length === 1 && parts[0].type === "text") return parts[0].text;
   return parts;
 }
@@ -129,15 +122,15 @@ export function outputTextOf(blocks: unknown): OcxTextContent[] {
 }
 
 /**
- * Tool-call output content. Preserves images (e.g. Codex `view_image` returns
- * `input_image` items): returns content parts when any image is present, else a plain joined string.
- * Never inlines an image_url as text (that would explode the token count).
+ * Tool-call output content. Preserves images (e.g. Codex `view_image` returns)
+ * and inline audio: returns content parts when either is present, else a plain joined string.
+ * Never inlines an image_url or audio payload as text (that would explode the token count).
  */
 export function outputToToolResultContent(output: string | unknown[] | undefined): string | OcxContentPart[] {
   if (typeof output === "string") return output;
   if (!Array.isArray(output)) return "";
   const parts: OcxContentPart[] = [];
-  let hasImage = false;
+  let hasMedia = false;
   for (const raw of output) {
     if (!isObj(raw)) continue;
     if (raw.type === "output_text" || raw.type === "text" || raw.type === "input_text") {
@@ -149,15 +142,17 @@ export function outputToToolResultContent(output: string | unknown[] | undefined
       const fileId = nonEmptyString(raw.file_id);
       if (imageUrl) {
         parts.push({ type: "image", imageUrl, ...(typeof raw.detail === "string" ? { detail: normalizeImageDetail(raw.detail) } : {}) });
-        hasImage = true;
+        hasMedia = true;
       } else if (fileId) {
         parts.push({ type: "text", text: `[image: ${fileId}]` });
       }
     } else if (raw.type === "input_audio") {
-      // Same presence-only contract as the user-content branch above: Codex returns
-      // audio in tool output too, and it previously disappeared without trace.
-      const format = safeAudioFormat(raw.format);
-      if (nonEmptyString(raw.audio_url)) {
+      const audio = audioContentFromRaw(raw.audio_url, raw.format);
+      if (audio) {
+        parts.push(audio);
+        hasMedia = true;
+      } else if (nonEmptyString(raw.audio_url)) {
+        const format = safeAudioFormat(raw.format);
         parts.push({ type: "text", text: format ? `[audio: ${format}]` : "[audio]" });
       }
     } else if (raw.type === "encrypted_content") {
@@ -165,7 +160,7 @@ export function outputToToolResultContent(output: string | unknown[] | undefined
       parts.push({ type: "text", text: "[encrypted content omitted]" });
     }
   }
-  if (!hasImage) return parts.map(p => (p.type === "text" ? p.text : "")).join("");
+  if (!hasMedia) return parts.map(p => (p.type === "text" ? p.text : "")).join("");
   return parts;
 }
 

package/src/responses/reasoning-retention.ts

@@ -4,14 +4,21 @@
  * Provider ciphertext and signatures are never included in the portable retained items.
  */
 
+import { Database } from "bun:sqlite";
 import { expandRetainedCompactionInput } from "./retained-compaction";
-import { closeSync, mkdirSync, openSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, closeSync, lstatSync, mkdirSync, openSync, opendirSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { estimateTokens } from "../lib/token-estimate";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
 
 export const DEFAULT_REASONING_RETENTION_PERCENT = 20;
 export const DEFAULT_MAX_REASONING_TOKENS = 100_000;
+/** Compiled-in aggregate ceiling for the on-disk reasoning archive directory. */
+export const DEFAULT_ARCHIVE_MAX_BYTES = 512 * 1024 * 1024;
+export const DEFAULT_ARCHIVE_MAX_FILES = 256;
 
 export interface ReasoningRetentionOptions {
   /** Directory that receives archived reasoning files. */
@@ -24,6 +31,10 @@ export interface ReasoningRetentionOptions {
   maxTokens?: number;
   /** Clock injection for tests. */
   now?: number;
+  /** Aggregate archive byte ceiling. Defaults to 512 MiB; smaller values are a test seam. */
+  archiveMaxBytes?: number;
+  /** Aggregate archive file-count ceiling. Defaults to 256; smaller values are a test seam. */
+  archiveMaxFiles?: number;
 }
 
 export interface ReasoningArchive {
@@ -100,6 +111,183 @@ function retentionTokenCap(value: number | undefined): number {
     : DEFAULT_MAX_REASONING_TOKENS;
 }
 
+/** Aggregate-capacity refusal: the archive directory is at or over its compiled-in ceiling. */
+export class ReasoningArchiveQuotaError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveQuotaError";
+  }
+}
+
+/** The sibling archive lock is held by another cooperating writer. */
+export class ReasoningArchiveBusyError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveBusyError";
+  }
+}
+
+/** Unsafe or uninspectable archive state; the attempt is refused without touching anything. */
+export class ReasoningArchiveError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveError";
+  }
+}
+
+const ARCHIVE_SEPARATOR = "\n\n---\n\n";
+const ARCHIVE_SEPARATOR_BYTES = Buffer.byteLength(ARCHIVE_SEPARATOR, "utf8");
+const ARCHIVE_LOCK_SIDECARS = ["-journal", "-wal", "-shm"] as const;
+
+function archiveCap(value: number | undefined, fallback: number): number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+
+/** lstat that treats a vanished path as absent and refuses anything it cannot classify. */
+function archiveLstat(path: string): ReturnType<typeof lstatSync> | undefined {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw new ReasoningArchiveError(`reasoning archive path is not inspectable: ${path}`, { cause: error });
+  }
+}
+
+function assertRegularArchiveDirectory(archiveDir: string): void {
+  const entry = archiveLstat(archiveDir);
+  if (!entry?.isDirectory() || entry.isSymbolicLink()) {
+    throw new ReasoningArchiveError(`reasoning archive directory is not a regular directory: ${archiveDir}`);
+  }
+}
+
+function assertRegularArchiveLockPath(lockPath: string): void {
+  const entry = archiveLstat(lockPath);
+  if (entry !== undefined && (!entry.isFile() || entry.isSymbolicLink())) {
+    throw new ReasoningArchiveError(`reasoning archive lock path is not a regular file: ${lockPath}`);
+  }
+}
+
+/** Exact UTF-8 byte total of the would-be archive payload, computed before any joined string exists. */
+function archivePayloadBytes(texts: string[]): number {
+  let bytes = texts.length > 0 ? (texts.length - 1) * ARCHIVE_SEPARATOR_BYTES : 0;
+  for (const text of texts) {
+    const next = bytes + Buffer.byteLength(text, "utf8");
+    if (!Number.isSafeInteger(next)) {
+      throw new ReasoningArchiveError("reasoning archive payload byte size is not representable");
+    }
+    bytes = next;
+  }
+  return bytes;
+}
+
+interface ArchiveUsage {
+  files: number;
+  bytes: number;
+}
+
+/**
+ * Non-recursive accounting of every committed, remnant and foreign file. Anything that is not a
+ * plain regular file refuses closed; an entry vanishing mid-scan is already gone and skipped.
+ */
+function scanArchiveUsage(archiveDir: string, maxBytes: number, maxFiles: number): ArchiveUsage {
+  let directory: ReturnType<typeof opendirSync> | undefined;
+  let files = 0;
+  let bytes = 0;
+  let inspected = 0;
+  let failure: ReasoningArchiveError | undefined;
+  try {
+    // One entry per read: a legacy over-capacity directory must not first become an array
+    // or an unbounded read-ahead buffer on this synchronous request path.
+    directory = opendirSync(archiveDir, { bufferSize: 1 });
+    let entry;
+    while ((entry = directory.readSync()) !== null) {
+      inspected += 1;
+      if (!entry.isFile()) {
+        throw new ReasoningArchiveError(`reasoning archive entry is not a regular file: ${entry.name}`);
+      }
+      const stat = archiveLstat(join(archiveDir, entry.name));
+      if (stat === undefined) {
+        if (inspected >= maxFiles) throw new ReasoningArchiveError("reasoning archive scan changed beyond its inspection limit");
+        continue;
+      }
+      if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new ReasoningArchiveError(`reasoning archive entry is not a regular file: ${entry.name}`);
+      }
+      files += 1;
+      bytes += Number(stat.size);
+      if (files >= maxFiles || bytes > maxBytes) break; // refusal is already certain
+      if (inspected >= maxFiles) throw new ReasoningArchiveError("reasoning archive scan changed beyond its inspection limit");
+    }
+  } catch (error) {
+    failure = error instanceof ReasoningArchiveError ? error
+      : new ReasoningArchiveError("reasoning archive directory cannot be scanned", { cause: error });
+  } finally {
+    try { directory?.closeSync(); } catch (error) {
+      failure ??= new ReasoningArchiveError("reasoning archive directory could not be closed", { cause: error });
+    }
+  }
+  if (failure !== undefined) throw failure;
+  return { files, bytes };
+}
+
+function isSqliteBusy(error: unknown): boolean {
+  const code = error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : "";
+  const message = error instanceof Error ? error.message : "";
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
+}
+
+/**
+ * Serialize usage scan, exclusive create, write and close for one physical archive directory
+ * across cooperating processes. The sibling SQLite write transaction is the lock: the OS
+ * releases it on process exit, so no stale-owner reclamation is needed. busy_timeout=0 keeps
+ * the synchronous request path fail-fast instead of freezing the event loop.
+ */
+function withArchiveQuotaLockSync<T>(archiveDir: string, fn: () => T): T {
+  const normalized = archiveDir.replace(/[/\\]+$/, "");
+  const base = basename(normalized);
+  if (!base || base === "." || base === "..") {
+    throw new ReasoningArchiveError(`reasoning archive directory is not a usable path: ${archiveDir}`);
+  }
+  const parent = dirname(normalized);
+  assertNotRealHomeUnderTest(parent);
+  const lockPath = `${normalized}.lock`;
+  // The lock lives beside the archive inside the config home; foreign parents need no manifest entry.
+  if (parent === getConfigDir()) {
+    recordOwnedConfigPath(parent, lockPath);
+    for (const suffix of ARCHIVE_LOCK_SIDECARS) recordOwnedConfigPath(parent, `${lockPath}${suffix}`);
+  }
+  assertRegularArchiveLockPath(lockPath);
+  let database: Database;
+  try {
+    database = new Database(lockPath, { create: true });
+  } catch (error) {
+    throw new ReasoningArchiveError(`reasoning archive lock could not be opened: ${lockPath}`, { cause: error });
+  }
+  try {
+    try { chmodSync(lockPath, 0o600); } catch { /* platform may ignore chmod */ }
+    assertRegularArchiveLockPath(lockPath);
+    database.exec("PRAGMA locking_mode = NORMAL; PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+  } catch (error) {
+    try { database.close(); } catch { /* acquisition already failed */ }
+    if (error instanceof ReasoningArchiveError) throw error;
+    if (isSqliteBusy(error)) {
+      throw new ReasoningArchiveBusyError(
+        `reasoning archive lock is held by another writer: ${lockPath}`,
+        { cause: error },
+      );
+    }
+    throw new ReasoningArchiveError(`reasoning archive lock could not be acquired: ${lockPath}`, { cause: error });
+  }
+  try {
+    return fn();
+  } finally {
+    try { database.exec("ROLLBACK"); } catch { /* close below still releases the OS lock */ }
+    try { database.close(); } catch { /* the OS lock is released with the handle */ }
+  }
+}
+
 /** Separate reasoning locally before dispatch; unknown windows enforce the absolute cap. */
 export function applyReasoningRetention(
   input: unknown,
@@ -130,17 +318,36 @@ export function applyReasoningRetention(
       content: [{ type: "input_text", text }] })),
   };
 
-  mkdirSync(options.archiveDir, { recursive: true, mode: 0o700 });
+  const archiveBytes = archiveCap(options.archiveMaxBytes, DEFAULT_ARCHIVE_MAX_BYTES);
+  const archiveFiles = archiveCap(options.archiveMaxFiles, DEFAULT_ARCHIVE_MAX_FILES);
+  const incomingBytes = archivePayloadBytes(texts);
   const stamp = new Date(options.now ?? Date.now()).toISOString().replace(/[:.]/g, "-");
   const path = join(options.archiveDir, "reasoning-" + stamp + "-" + Math.random().toString(36).slice(2, 8) + ".md");
-  // Only a successful exclusive open grants ownership; an occupied path is never removed.
-  const fd = openSync(path, "wx", 0o600);
-  let failure: unknown;
-  try { writeFileSync(fd, texts.join("\n\n---\n\n"), "utf-8"); } catch (error) { failure = error; }
-  try { closeSync(fd); } catch (error) { failure ??= error; }
-  if (failure !== undefined) {
-    try { rmSync(path); } catch { /* preserve the original I/O error; cleanup is best-effort */ }
-    throw failure;
+  try {
+    mkdirSync(options.archiveDir, { recursive: true, mode: 0o700 });
+    assertRegularArchiveDirectory(options.archiveDir);
+    withArchiveQuotaLockSync(options.archiveDir, () => {
+      assertRegularArchiveDirectory(options.archiveDir);
+      const usage = scanArchiveUsage(options.archiveDir, archiveBytes, archiveFiles);
+      if (usage.files >= archiveFiles || incomingBytes > archiveBytes - usage.bytes) {
+        throw new ReasoningArchiveQuotaError(
+          `reasoning archive is at capacity: ${usage.files} file(s), ${usage.bytes} byte(s) under ${options.archiveDir}; delete older archives to archive more`,
+        );
+      }
+      // Only a successful exclusive open grants ownership; an occupied path is never removed.
+      const fd = openSync(path, "wx", 0o600);
+      let failure: unknown;
+      try { writeFileSync(fd, texts.join(ARCHIVE_SEPARATOR), "utf-8"); } catch (error) { failure = error; }
+      try { closeSync(fd); } catch (error) { failure ??= error; }
+      if (failure !== undefined) {
+        try { rmSync(path); } catch { /* preserve the original I/O error; cleanup is best-effort */ }
+        throw failure;
+      }
+    });
+  } catch (error) {
+    if (error instanceof ReasoningArchiveQuotaError || error instanceof ReasoningArchiveBusyError
+      || error instanceof ReasoningArchiveError) throw error;
+    throw new ReasoningArchiveError("reasoning archive could not be written", { cause: error });
   }
 
   const limitDescription = windowKnown

package/src/responses/schema.ts

@@ -27,10 +27,9 @@ const inputFileBlockSchema = z.object({
   file_data: z.string().optional(),
 });
 // codex-rs protocol/src/models.rs sends audio as input_audio with an audio_url, in
-// both user content and tool output. Accepting the block keeps a legitimate audio turn
-// out of the malformed-item catch-all. The translated IR records only its PRESENCE —
-// there is no audio carrier and no adapter-level refusal; a typed unsupported-modality
-// signal reaching final adapter dispatch remains a recorded residual.
+// both user content and tool output. The translated IR preserves supported inline
+// WAV/MP3 bytes and the Chat adapter sends them as input_audio; other wires and
+// unsupported formats are refused at the final translated-adapter boundary.
 const inputAudioBlockSchema = z.object({
   type: z.literal("input_audio"),
   audio_url: z.string().min(1),

package/src/responses/web-search-replay.ts

@@ -91,9 +91,18 @@ export function rewriteReplayedWebSearchCells(input: readonly unknown[]): Rewrit
   if (!input.some(item => isObj(item) && item.type === "web_search_call")) return undefined;
   // A synthetic call id must not collide with any client call id, nor with another cell's.
   const taken = new Set(input.flatMap(item => isObj(item) && typeof item.call_id === "string" ? [item.call_id] : []));
+  // First suffix each base has not settled yet; taken stays the collision check on every candidate,
+  // so seeded ids and ids handed out under another base still block the smallest free suffix.
+  const nextSuffix = new Map<string, number>();
   const allocate = (base: string): string => {
-    let id = base;
-    for (let n = 1; taken.has(id); n++) id = `${base}_${n}`;
+    if (!taken.has(base)) {
+      taken.add(base);
+      return base;
+    }
+    let n = nextSuffix.get(base) ?? 1;
+    let id = `${base}_${n}`;
+    while (taken.has(id)) id = `${base}_${++n}`;
+    nextSuffix.set(base, n + 1);
     taken.add(id);
     return id;
   };