@bitkyc08/opencodex 2.89.0 → 2.90.0

package/src/adapters/openai-chat/serialized-tool-call-markup.ts

@@ -0,0 +1,108 @@
+const OPEN_TAG = "<tool_call>";
+const FUNCTION_TAG = "<function=";
+// MiMo gateways append an opaque hexadecimal identity to both delimiters.
+export const TAG_SUFFIX = "(?:_[a-fA-F0-9]{1,64})?";
+export const MAX_TAG_LENGTH = "</tool_call_".length + 64 + 1;
+const OPENING = new RegExp(`^<tool_call${TAG_SUFFIX}>`);
+const OPEN_PREFIX = /^<tool_call(?:_[a-fA-F0-9]{0,64})?$/;
+
+export interface TextContext {
+  fence: string | null;
+  lineStart: boolean;
+  inlineTicks?: number;
+  literalLine?: boolean;
+}
+
+/** Splits safe visible text from a possible control block while carrying Markdown context across chunks. */
+export function splitAtPossibleSerializedToolCall(
+  text: string,
+  initialContext: TextContext = { fence: null, lineStart: true },
+  final = false,
+  allowMidLineBare = false,
+): {
+  emit: string;
+  defer: string;
+  hasOpenTag: boolean;
+  context: TextContext;
+} {
+  const context = { ...initialContext };
+  const split = (at: number, hasOpenTag = false) => ({
+    emit: text.slice(0, at), defer: text.slice(at), hasOpenTag, context,
+  });
+  for (let index = 0; index < text.length; index++) {
+    if (context.lineStart) {
+      const rest = text.slice(index);
+      const fence = /^ {0,3}(`{3,}|~{3,})([^\n]*)/.exec(rest);
+      if (!context.inlineTicks && fence && (!context.fence || (fence[1]![0] === context.fence[0]
+          && fence[1]!.length >= context.fence.length && /^[ \t\r]*$/.test(fence[2]!)))) {
+        if (!final && !rest.includes("\n")) return split(index);
+        context.fence = context.fence ? null : fence[1]!;
+        index += fence[0].length - 1;
+        context.lineStart = false;
+        continue;
+      }
+      if (!final && /^ {0,3}(`*|~*)$/.test(rest)) return split(index);
+      context.literalLine = /[ \t>]/.test(text[index]!);
+    }
+    // Plain wrappers retain their bare-line rule. Nonced wrappers also occur after prose;
+    // quotes, indentation and Markdown code remain literal, even beside a matching call.
+    if (!context.fence && !context.inlineTicks && !context.literalLine && text[index] === "<") {
+      const rest = text.slice(index);
+      const opening = OPENING.exec(rest)?.[0];
+      if (opening && (context.lineStart || opening !== OPEN_TAG || allowMidLineBare)) {
+        const header = rest.slice(opening.length).trimStart();
+        if (/^<function=[^>\r\n]+>/.test(header)) return split(index, true);
+        if (!final && (FUNCTION_TAG.startsWith(header)
+            || (header.startsWith(FUNCTION_TAG) && !/[>\r\n]/.test(header.slice(FUNCTION_TAG.length))))) {
+          return split(index);
+        }
+      } else if (!final && (OPEN_TAG.startsWith(rest) || OPEN_PREFIX.test(rest))) return split(index);
+    }
+    if (!context.fence && text[index] === "`") {
+      let end = index + 1;
+      while (text[end] === "`") end++;
+      if (!final && end === text.length) return split(index);
+      const ticks = end - index;
+      if (!context.inlineTicks) context.inlineTicks = ticks;
+      else if (context.inlineTicks === ticks) context.inlineTicks = undefined;
+      index = end - 1;
+    }
+    context.lineStart = text[index] === "\n";
+  }
+  return split(text.length);
+}
+
+/**
+ * The line, fence and inline-code state after `text`. Serialized blocks are neutralised first so
+ * the scan runs through the whole text instead of stopping at the first opening tag; a block ends
+ * mid-line, which is exactly what the neutral spelling reports too.
+ */
+export function contextAfter(text: string, context: TextContext): TextContext {
+  if (text.length === 0) return context;
+  return splitAtPossibleSerializedToolCall(text.replace(new RegExp(`<tool_call${TAG_SUFFIX}>`, "g"), "<tool-call>"), context, true).context;
+}
+
+/**
+ * A deferred header/fence can itself be long. While its unresolved portion only grows, a
+ * chunk-local check suffices; the first resolving character goes back through the full splitter.
+ * Each unbounded phase is scanned once on entry and once on exit, preserving its Markdown rules.
+ */
+export function deferredContinuationBreak(text: string, context: TextContext): RegExp | undefined {
+  const opening = OPENING.exec(text)?.[0];
+  if (opening) {
+    const header = text.slice(opening.length);
+    if (/^\s*$/.test(header)) return /\S/;
+    if (/^\s*<function=[^>\r\n]*$/.test(header)) return /[>\r\n]/;
+  }
+  if (!context.inlineTicks && context.lineStart) {
+    const fence = /^ {0,3}(`{3,}|~{3,})([^\n]*)$/.exec(text);
+    if (fence) {
+      if (!context.fence) return /\n/;
+      // Closing-fence ticks may grow only before its optional whitespace suffix.
+      if (!fence[2]) return fence[1]![0] === "`" ? /[^`]/ : /[^~]/;
+      return /[^ \t\r]/;
+    }
+  }
+  if (/^`+$/.test(text)) return /[^`]/;
+  return undefined;
+}

package/src/adapters/openai-chat/standalone-bare-tool-calls.ts

@@ -0,0 +1,136 @@
+import { TRANSLATOR_MAX_CALL_ARGUMENT_BYTES, type TranslatorBudget } from "../../lib/translator-budget";
+import { jsonUtf8Bytes } from "../../lib/json-byte-size";
+import type { AdapterEvent } from "../../types";
+import {
+  hasNestedSerializedToolCallHeader, MAX_STANDALONE_CANDIDATES, recoverStandaloneBareBlocks, reconcileSerializedToolCallEvents, scanSerializedToolCalls, SerializedToolCallContentBuffer,
+  type FreeformToolIdentity, type StructuredToolCallReference,
+} from "./serialized-tool-call-content";
+
+const MAX_CANDIDATE_BYTES = 4 * 1024 * 1024;
+type BareCall = Pick<ReturnType<typeof recoverStandaloneBareBlocks>[number], "name" | "input">;
+const isMiMo = (model: string | undefined) => /(?:^|[/-])mimo-v2(?:\.|$)/i.test(model ?? "");
+const argumentsFor = (call: BareCall) => JSON.stringify({ input: call.input });
+function* callEvents(call: BareCall, id: string, restore: (name: string) => string): Generator<AdapterEvent> {
+  yield { type: "tool_call_start", id, name: restore(call.name) };
+  yield { type: "tool_call_delta", arguments: argumentsFor(call) };
+  yield { type: "tool_call_end" };
+}
+
+/** An explicitly separate policy for bare blocks with NO structured calls, never identified wrappers. */
+export class StandaloneBareToolCallBuffer extends SerializedToolCallContentBuffer {
+  private candidates: BareCall[] = [];
+  private candidateBytes = 0;
+  private disabled = false;
+  private readonly eligible: boolean;
+
+  constructor(
+    private readonly recoveryBudget: TranslatorBudget,
+    model: string | undefined,
+    private readonly freeformTools: ReadonlyMap<string, FreeformToolIdentity>,
+  ) {
+    super(recoveryBudget, isMiMo(model) && freeformTools.size > 0);
+    this.eligible = isMiMo(model) && freeformTools.size > 0;
+  }
+
+  /** Retain candidate inputs only, with aggregate and per-call limits; overflow disables the batch. */
+  private remember(calls: BareCall[]): void {
+    if (this.disabled || calls.length === 0) return;
+    const sizes = calls.map(call => jsonUtf8Bytes({ name: call.name, input: call.input }));
+    const bytes = sizes.reduce((sum, size) => sum + size, 0);
+    if (sizes.some(size => size > TRANSLATOR_MAX_CALL_ARGUMENT_BYTES)
+        || this.candidateBytes + bytes > MAX_CANDIDATE_BYTES || this.candidates.length + calls.length > MAX_STANDALONE_CANDIDATES) {
+      this.clearCandidates();
+      this.disabled = true;
+      return;
+    }
+    const retained = this.recoveryBudget.reserveTransient(bytes, { kind: "live_transient" });
+    try {
+      const temporary = this.recoveryBudget.reserveTransient(bytes, { kind: "live_transient" });
+      try {
+        // Detach small inputs from a large released answer's backing string.
+        const copies = calls.map(({ name, input }) => JSON.parse(JSON.stringify({ name, input })) as BareCall);
+        this.candidates.push(...copies);
+        this.candidateBytes += bytes;
+        retained.commitRetained();
+      } finally { temporary.release(); }
+    } catch (error) {
+      retained.release();
+      throw error;
+    }
+  }
+
+  protected override releaseBounded(): AdapterEvent[] {
+    if (!this.eligible || this.disabled) return super.releaseBounded();
+    const text = this.current();
+    const scan = scanSerializedToolCalls(text, this.context, true);
+    if (scan.overflow || scan.incomplete || scan.calls.some(call => hasNestedSerializedToolCallHeader(call.body))) {
+      // We cannot safely recognize a later inner block after losing its unresolved outer body.
+      this.clearCandidates();
+      this.disabled = true;
+      return super.releaseBounded();
+    }
+    this.remember(recoverStandaloneBareBlocks(text, this.freeformTools, this.context));
+    return super.releaseBounded();
+  }
+
+  *recoverStandalone(noStructuredCalls: boolean, nextId: () => string, restore: (name: string) => string): Generator<AdapterEvent> {
+    if (!noStructuredCalls) {
+      this.clearCandidates();
+      this.disabled = true;
+      return;
+    }
+    if (!this.eligible || this.disabled) return;
+    if (scanSerializedToolCalls(this.current(), this.context, true).overflow) {
+      this.clearCandidates();
+      this.disabled = true;
+      return;
+    }
+    const held = recoverStandaloneBareBlocks(this.current(), this.freeformTools, this.context);
+    this.remember(held);
+    // The first terminal flush is the only recovery decision; content after it cannot authorize a call.
+    if (this.disabled || this.candidates.length === 0) { this.disabled = true; return; }
+    yield* this.drainRanges(held);
+    for (const call of this.candidates) yield* callEvents(call, nextId(), restore);
+    this.clearCandidates();
+    this.disabled = true;
+  }
+
+  private clearCandidates(): void {
+    this.recoveryBudget.releaseRetained(this.candidateBytes, { kind: "live_transient" });
+    this.candidateBytes = 0;
+    this.candidates = [];
+  }
+
+  override dispose(): void {
+    this.clearCandidates();
+    super.dispose();
+  }
+}
+
+/** Buffered counterpart; the existing structured-call/identified-wrapper reconciler owns its path. */
+export function reconcileStandaloneBareToolCallEvents(
+  events: AdapterEvent[], start: number, end: number,
+  structuredCalls: readonly StructuredToolCallReference[], budget: TranslatorBudget,
+  model: string | undefined, freeformTools: ReadonlyMap<string, FreeformToolIdentity>, restore: (name: string) => string,
+): void {
+  if (structuredCalls.length > 0 || !isMiMo(model) || freeformTools.size === 0) {
+    reconcileSerializedToolCallEvents(events, start, end, structuredCalls, budget);
+    return;
+  }
+  const buffer = new StandaloneBareToolCallBuffer(budget, model, freeformTools);
+  const reconciled: AdapterEvent[] = [];
+  try {
+    for (const event of events.slice(start, end)) {
+      if (event.type !== "text_delta") reconciled.push(...buffer.hold(event).filter(held => held.type !== "heartbeat"));
+      else {
+        const text = buffer.ingest(event.text);
+        if (text) reconciled.push({ type: "text_delta", text });
+      }
+    }
+    let sequence = 0;
+    reconciled.push(...buffer.recoverStandalone(true, () => `call_${++sequence}`, restore), ...buffer.drain([]));
+  } finally {
+    buffer.dispose();
+  }
+  events.splice(start, end - start, ...reconciled);
+}

package/src/adapters/openai-chat.ts

@@ -47,7 +47,8 @@ import { messagesToChatFormat } from "./openai-chat/messages";
 import { withOpenAIChatToolNames } from "./openai-chat/tool-name-registry";
 import { openAIChatTransport, stripBracketedModelSuffix } from "./openai-chat/wire";
 import { toolChoiceToChatFormat, toolsToChatFormatForProvider } from "./openai-chat/tool-schema";
-import { freeformToolsByWireName, type FreeformToolIdentity, reconcileSerializedToolCallEvents, reconcileStructuredToolCall, reconcileStructuredToolCalls, SerializedToolCallContentBuffer } from "./openai-chat/serialized-tool-call-content";
+import { freeformToolsByWireName, type FreeformToolIdentity, reconcileStructuredToolCall, reconcileStructuredToolCalls } from "./openai-chat/serialized-tool-call-content";
+import { StandaloneBareToolCallBuffer, reconcileStandaloneBareToolCallEvents } from "./openai-chat/standalone-bare-tool-calls";
 
 export { stripBracketedModelSuffix } from "./openai-chat/wire";
 export { buildOpenAIChatPassthroughRequest } from "./openai-chat/passthrough";
@@ -300,7 +301,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         sawArgumentsString: boolean;
       }
       const pendingToolCalls: PendingToolCall[] = [];
-      const toolCallContent = new SerializedToolCallContentBuffer(budget);
+      const toolCallContent = new StandaloneBareToolCallBuffer(budget, lastRequestedModelId, freeformTools);
       const heldText = (): AdapterEvent[] => toolCallContent.drain([]);
       let toolCallSeq = 0;
       const closeToolCalls = (): PendingToolCall[] => {
@@ -322,7 +323,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       // Returns "terminate" when a pending call cannot be dispatched, so every flush site
       // stops the turn instead of emitting an unusable call. `closeToolCalls()` runs first,
       // so budget reservations are released for every pending call even on the early return.
-      const flushToolCalls = function* (): Generator<AdapterEvent, "continue" | "terminate"> {
+      const flushToolCalls = function* (terminal = true): Generator<AdapterEvent, "continue" | "terminate"> {
         const calls = closeToolCalls();
         for (const call of calls) {
           // Ingest already proved `name` is a string; the typeof guard keeps this branch
@@ -335,9 +336,9 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
             return yield* terminateWithError(unnamedToolCallEvent(pendingUsage));
           }
         }
-        // Held markup is released only now, as one batch per response: the doubled-input repair needs every call.
         const references = reconcileStructuredToolCalls(calls.map(call => ({ wireName: call.name, restoredName: toolNames.restore(call.name), argumentsText: call.args, freeformTool: freeformTools.get(call.name) })), toolCallContent.current(), !toolCallContent.releasedAnswerText && /(?:^|[/-])mimo-v2(?:\.|$)/i.test(lastRequestedModelId ?? ""));
         calls.forEach((call, index) => { call.args = references[index]!.argumentsText; });
+        yield* toolCallContent.recoverStandalone(calls.length === 0 && terminal, () => `call_${++toolCallSeq}`, name => toolNames.restore(name));
         yield* toolCallContent.drain(references);
         for (const call of calls) {
           if (!call.id) call.id = `call_${++toolCallSeq}`;
@@ -657,7 +658,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
           yield* terminateWithError({ type: "error", message: "upstream stream ended without a terminal signal ([DONE] or finish_reason) — possible truncation" });
           return;
         }
-        if ((yield* flushToolCalls()) === "terminate") return;
+        if ((yield* flushToolCalls(sawFinish)) === "terminate") return; // A cut stream never synthesizes a bare call.
         const stopReason = stopReasonFor(finishReason);
         yield { type: "done", usage: pendingUsage, ...(stopReason ? { stopReason } : {}) };
       } catch (error) {
@@ -804,7 +805,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         }
         const references = reconcileStructuredToolCalls(structuredCalls, answerText, /(?:^|[/-])mimo-v2(?:\.|$)/i.test(lastRequestedModelId ?? ""));
         structuredCalls.forEach((call, index) => { call.delta.arguments = references[index]!.argumentsText; });
-        reconcileSerializedToolCallEvents(events, contentStart, contentEnd, references, budget);
+        reconcileStandaloneBareToolCallEvents(events, contentStart, contentEnd, references, budget, lastRequestedModelId, freeformTools, name => toolNames.restore(name));
         const stopReason = stopReasonFor(choice.finish_reason);
         events.push({
           type: "done",

package/src/adapters/openai-responses/opengateway-input.ts

@@ -0,0 +1,139 @@
+import { isPlainObject } from "./internal";
+import { normalizeResponsesToolResultAdjacency } from "./tool-output-recovery";
+
+export class OpenGatewayInputCompatibilityError extends Error {
+  constructor() {
+    super("OpenGateway cannot preserve this tool result; use text or valid input_image parts with a call_id.");
+    this.name = "OpenGatewayInputCompatibilityError";
+  }
+}
+
+const TOOL_ROUND_TYPES = new Set([
+  "function_call",
+  "function_call_output",
+  "custom_tool_call",
+  "custom_tool_call_output",
+  "local_shell_call",
+  "local_shell_call_output",
+]);
+
+function normalizeImageDetail(part: unknown): unknown {
+  return isPlainObject(part) && part.type === "input_image" && part.detail === "original"
+    ? { ...part, detail: "high" }
+    : part;
+}
+
+function isToolRound(item: unknown): boolean {
+  return isPlainObject(item) && typeof item.type === "string" && TOOL_ROUND_TYPES.has(item.type);
+}
+
+function pairedCallId(item: Record<string, unknown>): string | undefined {
+  return typeof item.call_id === "string" && item.call_id.length > 0 ? item.call_id : undefined;
+}
+
+type ProjectedInput = { readonly changed: boolean; readonly input: unknown[] };
+
+function projectOpenGatewayInput(input: readonly unknown[]): ProjectedInput {
+  let changed = false;
+  const projected: unknown[] = [];
+  const pendingImages: unknown[] = [];
+  const flushImages = (): void => {
+    if (pendingImages.length === 0) return;
+    projected.push(...pendingImages);
+    pendingImages.length = 0;
+  };
+  for (const item of input) {
+    if (!isToolRound(item)) flushImages();
+    if (!isPlainObject(item)) {
+      projected.push(item);
+      continue;
+    }
+    if (item.type === "function_call_output" && Array.isArray(item.output)) {
+      const callId = pairedCallId(item);
+      const content: Record<string, unknown>[] = [];
+      const text: string[] = [];
+      let supported = callId !== undefined;
+      let hasImage = false;
+      if (supported) {
+        for (const part of item.output) {
+          if (!isPlainObject(part)) {
+            supported = false;
+            break;
+          }
+          switch (part.type) {
+            case "text":
+            case "input_text":
+            case "output_text":
+              if (typeof part.text !== "string") {
+                supported = false;
+                break;
+              }
+              text.push(part.text);
+              content.push({ type: "input_text", text: part.text });
+              break;
+            case "input_image":
+              if (!((typeof part.image_url === "string" && part.image_url.length > 0)
+                || (typeof part.file_id === "string" && part.file_id.length > 0))
+                || (part.image_url !== undefined && typeof part.image_url !== "string")
+                || (part.file_id !== undefined && typeof part.file_id !== "string")
+                || (part.detail !== undefined && (typeof part.detail !== "string"
+                  || !["auto", "low", "high", "original"].includes(part.detail)))) {
+                supported = false;
+                break;
+              }
+              content.push({ ...part, ...(part.detail === "original" ? { detail: "high" } : {}) });
+              hasImage = true;
+              break;
+            default:
+              supported = false;
+          }
+          if (!supported) break;
+        }
+      }
+      if (supported && callId !== undefined) {
+        changed = true;
+        const marker = `[tool output for ${callId}]`;
+        projected.push({
+          ...item,
+          output: text.length > 0 ? text.join("\n") : hasImage ? marker : "",
+        });
+        if (hasImage) {
+          pendingImages.push({
+            type: "message",
+            role: "user",
+            content: [{ type: "input_text", text: marker }, ...content],
+          });
+        }
+        continue;
+      }
+      throw new OpenGatewayInputCompatibilityError();
+    }
+    if (Array.isArray(item.content)) {
+      const originalContent = item.content;
+      const content = originalContent.map(normalizeImageDetail);
+      if (content.some((part, index) => part !== originalContent[index])) {
+        changed = true;
+        projected.push({ ...item, content });
+        continue;
+      }
+    }
+    projected.push(item);
+  }
+  flushImages();
+  return { changed, input: projected };
+}
+
+/** OpenGateway requires string tool results and auto/low/high image detail. */
+export function normalizeOpenGatewayResponsesInput(body: unknown, url: string): unknown {
+  // Same exact-URL boundary as completion recovery; a query-routed variant is a different destination.
+  if (url !== "https://apis.opengateway.ai/v1/responses" || !isPlainObject(body) || !Array.isArray(body.input)) return body;
+
+  const direct = projectOpenGatewayInput(body.input);
+  if (!direct.changed) return body;
+  const aligned = normalizeResponsesToolResultAdjacency(body);
+  if (!isPlainObject(aligned) || !Array.isArray(aligned.input) || aligned === body) {
+    return { ...body, input: direct.input };
+  }
+  const paired = projectOpenGatewayInput(aligned.input);
+  return { ...aligned, input: paired.changed ? paired.input : direct.input };
+}

package/src/adapters/openai-responses/passthrough.ts

@@ -55,6 +55,7 @@ import { observeOutbound } from "../../usage/cache-diagnostic";
 import { normalizeMuseToolChoice } from "./muse-tool-choice";
 import { declaresHostedWebSearch, projectHostedSearchHistory, renderCompactionSearchHistoryItems } from "./compaction-search-history";
 import { stripKimiEmptyAssistantMessages } from "./empty-assistant";
+import { normalizeOpenGatewayResponsesInput } from "./opengateway-input";
 
 /**
  * Identifies DeepSeek's strict Responses replay contract: tool-bearing continuations need
@@ -508,11 +509,13 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
           || !declaresHostedWebSearch(finalBody))) {
         finalBody = projectHostedSearchHistory(finalBody);
       }
+      finalBody = normalizeOpenGatewayResponsesInput(finalBody, url);
       observeOutbound(parsed._rawBody, finalBody, headers);
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         validateFinalCustomToolCompatibility(finalBody, provider.supportsResponsesCustomTools);
       }
-      const body = JSON.stringify(applyGithubCopilotContextTier(finalBody, provider, parsed.modelId, incoming.providerName));
+      const wireBody = applyGithubCopilotContextTier(finalBody, provider, parsed.modelId, incoming.providerName);
+      const body = JSON.stringify(wireBody);
       const releaseBodyObservation = translatorBudget.observeExternallyCapped(
         "passthrough_serialization",
         Buffer.byteLength(body, "utf8"),
@@ -522,6 +525,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         method: "POST",
         headers,
         body,
+        ...(isPlainObject(wireBody) && typeof wireBody.model === "string" ? { outboundModelId: wireBody.model } : {}),
         releaseBodyObservation,
         ...(convertedRoutedCustomToolNames ? { convertedRoutedCustomToolNames } : {}),
         ...(routedCustomToolRepairNames ? { routedCustomToolRepairNames } : {}),

package/src/adapters/openai-responses/transport.ts

@@ -23,6 +23,18 @@ export function copyResponsesClientMetadata(target: Headers, incoming: Headers,
   }
 }
 
+/**
+ * Strip trailing slashes with a linear scan rather than a regex.
+ *
+ * `/\/+$/` retries candidate end positions when a long slash run is not at the end of the
+ * string; the scan walks each character once and produces the same result on every input.
+ */
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) end -= 1;
+  return end === value.length ? value : value.slice(0, end);
+}
+
 /** Shared Responses URL/auth/header construction; capabilities never grant auth authority. */
 export function buildResponsesTransport(provider: OcxProviderConfig, incoming: Pick<IncomingMeta, "headers">): {
   url: string; headers: Record<string, string>;
@@ -31,7 +43,7 @@ export function buildResponsesTransport(provider: OcxProviderConfig, incoming: P
   let url: string;
   if (provider.authMode === "forward") {
     const mayForwardCallerCredentials = isCanonicalOpenAiForwardProvider(provider);
-    const baseUrl = mayForwardCallerCredentials ? CODEX_FORWARD_BASE_URL : provider.baseUrl.replace(/\/+$/, "");
+    const baseUrl = mayForwardCallerCredentials ? CODEX_FORWARD_BASE_URL : stripTrailingSlashes(provider.baseUrl);
     url = `${baseUrl}/responses`;
     if (provider.headers) Object.assign(headers, provider.headers);
     const runtimeProvider = provider as {

package/src/claude/desktop-3p-library.ts

@@ -1,4 +1,4 @@
-import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, type BigIntStats } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, type BigIntStats } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { claudeDesktopConfigLibraryDir, resolveConfigLibraryDir } from "./desktop-3p-paths";
@@ -44,6 +44,20 @@ export interface Desktop3pMetadata {
 
 export const DESKTOP_PICKER_ENTRY_NAME = "opencodex-picker";
 
+export const MAX_DESKTOP_PROFILE_FILE_BYTES = 4 * 1024 * 1024;
+
+export function assertDesktopLibraryTextSize(text: string): void {
+  if (Buffer.byteLength(text, "utf8") > MAX_DESKTOP_PROFILE_FILE_BYTES) {
+    throw new Error("desktop_config_too_large");
+  }
+}
+
+export function serializeDesktopLibraryJson(value: unknown): string {
+  const text = JSON.stringify(value, null, 2) + "\n";
+  assertDesktopLibraryTextSize(text);
+  return text;
+}
+
 /** A path that no longer names the observed file was swapped; a same-path failure keeps its own errno. */
 function pathStillNamesExpectedFile(path: string, expected: BigIntStats): boolean {
   try {
@@ -54,7 +68,13 @@ function pathStillNamesExpectedFile(path: string, expected: BigIntStats): boolea
 }
 
 /** Read regular config files only; a path swap must not turn an observation into a FIFO wait. */
-export function readDesktopLibraryBytes(path: string): Buffer {
+export function readDesktopLibraryBytes(
+  path: string,
+  maxBytes: number = MAX_DESKTOP_PROFILE_FILE_BYTES,
+): Buffer {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_DESKTOP_PROFILE_FILE_BYTES) {
+    throw new RangeError("invalid Desktop library read limit");
+  }
   const expected = lstatSync(path, { bigint: true });
   if (!expected.isFile()) throw new Error("desktop_config_not_regular");
   // POSIX open of a FIFO can itself block, before fstat is possible. Windows has no POSIX
@@ -73,7 +93,27 @@ export function readDesktopLibraryBytes(path: string): Buffer {
     const opened = fstatSync(fd, { bigint: true });
     if (!opened.isFile() || opened.dev !== expected.dev || opened.ino !== expected.ino
       || opened.ctimeNs !== expected.ctimeNs) throw new Error("desktop_config_not_regular");
-    return readFileSync(fd);
+    if (opened.size > BigInt(maxBytes)) throw new Error("desktop_config_too_large");
+    // Allocate for the observed size plus one sentinel byte, not the full cap: callers scan many
+    // small profiles, and the cap would zero-fill megabytes per read. A file that fills the
+    // buffer grew after validation — keep reading within the bound so it classifies as
+    // desktop_config_too_large rather than silently truncating.
+    let bytes = Buffer.alloc(Number(opened.size) + 1);
+    let length = 0;
+    for (;;) {
+      const count = readSync(fd, bytes, length, Math.min(64 * 1024, bytes.length - length), null);
+      if (count === 0) break;
+      length += count;
+      if (length > maxBytes) throw new Error("desktop_config_too_large");
+      if (length === bytes.length && bytes.length <= maxBytes) {
+        const grown = Buffer.alloc(Math.min(maxBytes + 1, bytes.length * 2));
+        bytes.copy(grown, 0, 0, length);
+        bytes = grown;
+      }
+    }
+    if (length > maxBytes) throw new Error("desktop_config_too_large");
+    if (!pathStillNamesExpectedFile(path, opened)) throw new Error("desktop_config_not_regular");
+    return bytes.subarray(0, length);
   } finally {
     closeSync(fd);
   }

package/src/claude/desktop-3p.ts

@@ -6,7 +6,7 @@ import { canonicalDirectory } from "./desktop-remote-store-io";
 import {
   resolveDesktop3pConfigLibraryPath, parseMetadata, SAFE_DESKTOP_PROFILE_ID, isRecord,
   isOwnedDesktopEntry, isOwnedDesktopGatewayEntry, profilePath, readDesktopProfileSnapshot, readDesktopLibraryText, readDesktopLibraryBytes,
-  readOptionalDesktopLibraryBytes,
+  readOptionalDesktopLibraryBytes, assertDesktopLibraryTextSize, serializeDesktopLibraryJson,
   type Desktop3pConfigLibraryOptions, type Desktop3pMetadata, type Desktop3pMetadataEntry,
 } from "./desktop-3p-library";
 export { resolveDesktop3pConfigLibraryPath, type Desktop3pConfigLibraryOptions } from "./desktop-3p-library";
@@ -642,13 +642,24 @@ function removeDesktop3pStandardPivotLocal(
     if (targetIds.length === 0) return { ok: true, changed: false, kind: "noop", libraryPath: inspected.libraryPath };
 
     let metadataAfterPivot = metadata;
+    let standardPath: string | undefined;
+    let pivotMetadataJson: string | undefined;
     if (selectedOwnedGatewayActive) {
       const standardId = randomUUID();
-      const standardPath = profilePath(inspected.libraryPath, standardId);
-      atomicWriteFile(standardPath, "{}\n");
+      standardPath = profilePath(inspected.libraryPath, standardId);
       const standardEntry: Desktop3pMetadataEntry = { id: standardId, name: "opencodex-standard" };
       metadataAfterPivot = { ...metadata, appliedId: standardId, entries: [...metadata.entries, standardEntry] };
-      atomicWriteFile(metadataPath, JSON.stringify(metadataAfterPivot, null, 2) + "\n");
+      pivotMetadataJson = serializeDesktopLibraryJson(metadataAfterPivot);
+    }
+    // Bound the final metadata before any unlink so a size refusal cannot strand
+    // a row pointing at an already-deleted profile.
+    const removalMetadataJson = serializeDesktopLibraryJson({
+      ...metadataAfterPivot,
+      entries: metadataAfterPivot.entries.filter(entry => !targetIds.includes(entry.id)),
+    });
+    if (standardPath !== undefined && pivotMetadataJson !== undefined) {
+      atomicWriteFile(standardPath, "{}\n");
+      atomicWriteFile(metadataPath, pivotMetadataJson);
     }
 
     const residualPaths: string[] = [];
@@ -674,10 +685,7 @@ function removeDesktop3pStandardPivotLocal(
     }
     // Do not leave a metadata row pointing at a deleted profile. For a foreign
     // selection this only removes proven opencodex residues; appliedId is kept.
-    atomicWriteFile(
-      metadataPath,
-      JSON.stringify({ ...metadataAfterPivot, entries: metadataAfterPivot.entries.filter(entry => !targetIds.includes(entry.id)) }, null, 2) + "\n",
-    );
+    atomicWriteFile(metadataPath, removalMetadataJson);
     return { ok: true, changed: true, kind: "removed", libraryPath: inspected.libraryPath };
   } catch (error) {
     return { ok: false, changed: false, kind: "write_failed", libraryPath: inspected.libraryPath, reason: desktopMutationFailureReason(error) };
@@ -831,7 +839,7 @@ function writeDesktop3pConfigWithGenerator(
 
     const generated = generate();
     const previous = readDesktopProfileSnapshot(configPath);
-    const configJson = JSON.stringify({ ...previous.foreign, ...generated }, null, 2) + "\n";
+    const configJson = serializeDesktopLibraryJson({ ...previous.foreign, ...generated });
     const fingerprint = createHash("sha256").update(configJson).digest("hex").slice(0, 16);
     if (refreshOnly) {
       atomicWriteFileNoFollow(configPath, configJson, undefined, {
@@ -849,9 +857,10 @@ function writeDesktop3pConfigWithGenerator(
       });
       return { written: true, path: configPath, fingerprint };
     }
+    const metadataJson = serializeDesktopLibraryJson({ ...metadata, appliedId: id, entries });
     atomicReplaceDesktopConfig(configPath, configJson, previous.bytes);
     try {
-      atomicWriteFile(metadataPath, JSON.stringify({ ...metadata, appliedId: id, entries }, null, 2) + "\n");
+      atomicWriteFile(metadataPath, metadataJson);
     } catch (metaError) {
       // Roll back from the verified bytes in memory: reopening the backup could meet a swapped
       // entry and leave the new profile beside the old metadata. A profile this call created is
@@ -895,6 +904,7 @@ export function atomicReplaceDesktopConfig(
   previous: Buffer | undefined,
   writer: typeof atomicWriteFileNoFollow = atomicWriteFileNoFollow,
 ): { backupPath?: string } {
+  assertDesktopLibraryTextSize(content);
   const validateBeforeRename = () => assertDesktopProfileUnchanged(path, previous);
   validateBeforeRename();
   const backupPath = `${path}.bak`;