@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/remote/served-by.ts

@@ -0,0 +1,57 @@
+/**
+ * The served-by response header, the Home instance id it carries, and whether this build sends it.
+ *
+ * Every `GET /v1/models` response the server answers itself names the serving Home in
+ * `x-opencodex-served-by`, and `GET /healthz` publishes the same value as `instanceId`, so a peer
+ * (GOAT's parity check P4) can prove which Home answered without reading logs. A Remote Link Child
+ * never answers `/v1/models` itself: its relay copies the Home's response headers, so the value a
+ * Child returns is the Home's. A Hub-mode client's Codex calls the Hub's data listener directly, so
+ * the Hub stamps its own response.
+ *
+ * The instance id is the install's `homeId` from `src/quota-pool/identity.ts`: a random
+ * `home_<32 hex>` minted once per install, persisted owner-only, and stable across restarts. It is
+ * never a hostname and is not derived from one. Until the identity exists (it is created in the
+ * background after the listener starts) or when its file is unreadable, the header and the
+ * `/healthz` field are omitted; an empty or malformed value is never sent.
+ *
+ * `SERVED_BY_HEADER_EMITTED` tells `/readyz` to advertise `served-by-header`
+ * (`src/remote/features.ts`); `tests/server/readyz-features.test.ts` fails if the advertisement
+ * and live responses disagree.
+ */
+import { readQuotaPoolIdentity } from "../quota-pool/identity";
+
+export const SERVED_BY_HEADER = "x-opencodex-served-by";
+
+/** Whether responses from this build carry {@link SERVED_BY_HEADER}. */
+export const SERVED_BY_HEADER_EMITTED: boolean = true;
+
+const INSTANCE_ID = /^home_[0-9a-f]{32}$/;
+
+/** This Home's opaque instance id, or undefined while the install identity is unavailable. */
+export function homeInstanceId(): string | undefined {
+  let homeId: unknown;
+  try { homeId = readQuotaPoolIdentity()?.homeId; } catch { return undefined; }
+  return typeof homeId === "string" && INSTANCE_ID.test(homeId) ? homeId : undefined;
+}
+
+/** Stamp {@link SERVED_BY_HEADER} with this Home's instance id; leaves the response alone without one. */
+export function withServedBy(response: Response, instanceId = homeInstanceId()): Response {
+  if (!instanceId) return response;
+  try {
+    response.headers.set(SERVED_BY_HEADER, instanceId);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set(SERVED_BY_HEADER, instanceId);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+  }
+}
+
+/**
+ * The server's last step for every answered request: `GET /v1/models` names the serving Home,
+ * whichever branch produced the response. `pathname` is the dispatch path the router matched.
+ */
+export function stampServedBy(method: string, pathname: string, response: Response): Response {
+  if (!response || method !== "GET" || pathname !== "/v1/models") return response;
+  return withServedBy(response);
+}

package/src/responses/audio.ts

@@ -0,0 +1,46 @@
+import type { OcxAudioContent } from "../types";
+
+export type ChatAudioFormat = OcxAudioContent["format"];
+
+const MIME_FORMATS: Readonly<Record<string, ChatAudioFormat>> = {
+  "audio/mp3": "mp3",
+  "audio/mpeg": "mp3",
+  "audio/wav": "wav",
+  "audio/wave": "wav",
+  "audio/x-wav": "wav",
+};
+
+function normalizedFormat(value: unknown): ChatAudioFormat | undefined {
+  if (typeof value !== "string") return undefined;
+  const format = value.trim().toLowerCase();
+  return format === "mp3" || format === "wav" ? format : undefined;
+}
+
+function validBase64(value: string): boolean {
+  return value.length > 0
+    && value.length % 4 === 0
+    && /^[A-Za-z0-9+/]+={0,2}$/.test(value);
+}
+
+/**
+ * Parse the inline audio shape Codex puts in a Responses content block. Chat Completions
+ * needs bare base64 plus `wav`/`mp3`, while Codex supplies an RFC 2397 data URL. A raw
+ * base64 value with an explicit supported format is accepted as well; remote URLs are not.
+ */
+export function audioContentFromRaw(audioUrl: unknown, declaredFormat?: unknown): OcxAudioContent | undefined {
+  if (typeof audioUrl !== "string" || audioUrl.length === 0) return undefined;
+  const dataUrl = /^data:([^;,]+);base64,([\s\S]*)$/.exec(audioUrl);
+  let data: string;
+  let format: ChatAudioFormat | undefined;
+  if (dataUrl) {
+    const declared = normalizedFormat(declaredFormat);
+    const mime = dataUrl[1].trim().toLowerCase();
+    format = MIME_FORMATS[mime] ?? (mime === "application/octet-stream" ? declared : undefined);
+    data = dataUrl[2].replace(/\s+/g, "");
+  } else {
+    format = normalizedFormat(declaredFormat);
+    data = audioUrl.replace(/\s+/g, "");
+  }
+  if (!format || !validBase64(data)) return undefined;
+  return { type: "audio", data, format, text: `[audio: ${format}]` };
+}

package/src/responses/input-media.ts

@@ -1,4 +1,5 @@
 import { isInlineDocumentDataUrl } from "./inline-document";
+import { audioContentFromRaw } from "./audio";
 
 /** Input kinds for which the normalized request has no lossless content carrier. */
 export type UntranslatedInputMedia = "audio" | "file";
@@ -10,23 +11,35 @@ function isRecord(value: unknown): value is RecordValue {
 }
 
 /**
- * Whether the position being scanned has a converter that builds a document part.
+ * Whether the position being scanned has a converter that builds a lossless media part.
  *
- * Only user content does. A tool output, a system or assistant message, and a Chat `developer`
- * message are all flattened to text by their converters, so exempting an attachment there would
- * turn today's explicit refusal into the silent drop this scanner exists to prevent.
+ * User content carries documents and inline audio; developer content carries documents only.
+ * Tool output carries inline audio through the Chat adapter's follow-up user message. System and
+ * assistant content have no lossless translated media carrier, so exempting an attachment there
+ * would turn today's explicit refusal into the silent drop this scanner exists to prevent.
  */
-type CarrierPosition = "user-content" | "flattened";
+type CarrierPosition = "user-content" | "developer-content" | "tool-output" | "flattened";
 
-function mediaKind(value: unknown, position: CarrierPosition): UntranslatedInputMedia | undefined {
+function mediaKind(value: unknown, position: CarrierPosition, allowAudio: boolean): UntranslatedInputMedia | undefined {
   if (!isRecord(value)) return undefined;
-  if (value.type === "input_audio" || value.type === "audio") return "audio";
+  if (value.type === "input_audio" || value.type === "audio") {
+    // A Chat content part has a nested input_audio object, while Codex's Responses
+    // block uses audio_url. Only the latter is carried by the translated Chat adapter; the
+    // Chat-shaped `audio` spelling has no parser path and must never pass the guard.
+    return value.type === "input_audio"
+      && allowAudio
+      && (position === "user-content" || position === "tool-output")
+      && audioContentFromRaw(value.audio_url, value.format)
+      ? undefined
+      : "audio";
+  }
   if (value.type === "input_file" || value.type === "file" || value.type === "document") {
     // A document that carries its own bytes has a lossless carrier in user content, so refusing
     // it there would reject the very request #5212 exists to preserve. A reference with no
     // payload has none anywhere: translated adapters cannot dereference a file_id or a remote
     // source.
-    return position === "user-content" && carriesInlineDocumentBytes(value) ? undefined : "file";
+    return (position === "user-content" || position === "developer-content")
+      && carriesInlineDocumentBytes(value) ? undefined : "file";
   }
   // A file-id-only image is not pixels: translated adapters cannot dereference it.
   if (value.type === "input_image" && typeof value.file_id === "string" && value.file_id.length > 0
@@ -46,10 +59,10 @@ function carriesInlineDocumentBytes(value: RecordValue): boolean {
     && value.source.data.length > 0;
 }
 
-function contentMedia(content: unknown, position: CarrierPosition): UntranslatedInputMedia | undefined {
+function contentMedia(content: unknown, position: CarrierPosition, allowAudio: boolean): UntranslatedInputMedia | undefined {
   if (!Array.isArray(content)) return undefined;
   for (const part of content) {
-    const kind = mediaKind(part, position);
+    const kind = mediaKind(part, position, allowAudio);
     if (kind) return kind;
   }
   return undefined;
@@ -60,20 +73,29 @@ function contentMedia(content: unknown, position: CarrierPosition): Untranslated
  * arguments, schema properties, or arbitrary nested objects. No payload is copied,
  * decoded, fetched or included in the returned value.
  */
-export function untranslatedResponsesInputMedia(body: unknown): UntranslatedInputMedia | undefined {
+export function untranslatedResponsesInputMedia(
+  body: unknown,
+  options: { allowAudio?: boolean } = {},
+): UntranslatedInputMedia | undefined {
   if (!isRecord(body) || !Array.isArray(body.input)) return undefined;
   for (const item of body.input) {
     if (!isRecord(item)) continue;
-    const direct = mediaKind(item, "flattened");
+    const direct = mediaKind(item, "flattened", options.allowAudio === true);
     if (direct) return direct;
     if (item.type === "function_call_output" || item.type === "custom_tool_call_output") {
-      const kind = contentMedia(item.output, "flattened");
+      const kind = contentMedia(item.output, "tool-output", options.allowAudio === true);
       if (kind) return kind;
     } else if (item.type === "message" || item.type === undefined) {
       // `inputContentParts` runs for user and developer messages only; a system message is
       // flattened to text by the parser.
       const role = item.role;
-      const kind = contentMedia(item.content, role === "user" || role === "developer" ? "user-content" : "flattened");
+      const kind = contentMedia(
+        item.content,
+        role === "user" ? "user-content"
+          : role === "developer" ? "developer-content"
+          : "flattened",
+        options.allowAudio === true,
+      );
       if (kind) return kind;
     }
   }
@@ -87,7 +109,7 @@ export function untranslatedChatInputMedia(body: unknown): UntranslatedInputMedi
     if (!isRecord(message)) continue;
     // Only the `user` branch of the Chat projection builds content blocks. `system`,
     // `developer`, `assistant` and `tool` all reduce their content to a string.
-    const kind = contentMedia(message.content, message.role === "user" ? "user-content" : "flattened");
+    const kind = contentMedia(message.content, message.role === "user" ? "user-content" : "flattened", false);
     if (kind) return kind;
   }
   return undefined;

package/src/responses/parser-content.ts

@@ -1,4 +1,5 @@
 import type { OcxContentPart, OcxTextContent } from "../types";
+import { audioContentFromRaw } from "./audio";
 import { inlineDocumentFromDataUrl } from "./inline-document";
 
 export function isObj(v: unknown): v is Record<string, unknown> {
@@ -65,23 +66,15 @@ export function inputContentParts(blocks: unknown): string | OcxContentPart[] {
       const processing = nonEmptyString((block as { processing?: string }).processing);
       if (videoUrl) parts.push({ type: "video", videoUrl, ...(processing ? { processing } : {}) });
     } else if (block.type === "input_audio") {
-      // Upstream Codex sends input_audio with an audio_url (codex-rs
-      // protocol/src/models.rs). The IR has no audio carrier and no adapter consumes
-      // one, so this part used to vanish with no trace at all.
-      //
-      // This records PRESENCE only and is NOT audio support: never the payload, which
-      // is large base64 and would explode the token count, and never the URL, which
-      // can carry a signed token. This parser must stay non-throwing — the native
-      // Responses passthrough also runs through parseRequest before the adapter
-      // forwards _rawBody, so refusing here would regress legitimate raw passthrough.
-      //
-      // No adapter refuses audio at its wire today: by this point the part is already a
-      // text marker, so downstream adapters see text and continue. A typed unsupported-
-      // modality carrier that survives to final adapter dispatch is a separate, recorded
-      // residual — do not describe this branch as a refusal.
       const b = block as { audio_url?: string; format?: string };
-      const format = safeAudioFormat(b.format);
-      if (nonEmptyString(b.audio_url)) {
+      // Keep bytes only when they have a Chat-compatible inline form. Unsupported or
+      // remote references retain a marker for text-only wires; the final adapter guard
+      // refuses them rather than allowing a silent drop.
+      const audio = audioContentFromRaw(b.audio_url, b.format);
+      if (audio) {
+        parts.push(audio);
+      } else if (nonEmptyString(b.audio_url)) {
+        const format = safeAudioFormat(b.format);
         parts.push({ type: "text", text: format ? `[audio: ${format}]` : "[audio]" });
       }
     } else if (block.type === "input_file") {
@@ -104,7 +97,7 @@ export function inputContentParts(blocks: unknown): string | OcxContentPart[] {
       // fabricating a "[file: ...]" marker for an attachment that was never sent.
     }
   }
-  // Collapse to a plain string only for a single TEXT part; images must stay structured.
+  // Collapse to a plain string only for a single TEXT part; media must stay structured.
   if (parts.length === 1 && parts[0].type === "text") return parts[0].text;
   return parts;
 }
@@ -129,15 +122,15 @@ export function outputTextOf(blocks: unknown): OcxTextContent[] {
 }
 
 /**
- * Tool-call output content. Preserves images (e.g. Codex `view_image` returns
- * `input_image` items): returns content parts when any image is present, else a plain joined string.
- * Never inlines an image_url as text (that would explode the token count).
+ * Tool-call output content. Preserves images (e.g. Codex `view_image` returns)
+ * and inline audio: returns content parts when either is present, else a plain joined string.
+ * Never inlines an image_url or audio payload as text (that would explode the token count).
  */
 export function outputToToolResultContent(output: string | unknown[] | undefined): string | OcxContentPart[] {
   if (typeof output === "string") return output;
   if (!Array.isArray(output)) return "";
   const parts: OcxContentPart[] = [];
-  let hasImage = false;
+  let hasMedia = false;
   for (const raw of output) {
     if (!isObj(raw)) continue;
     if (raw.type === "output_text" || raw.type === "text" || raw.type === "input_text") {
@@ -149,15 +142,17 @@ export function outputToToolResultContent(output: string | unknown[] | undefined
       const fileId = nonEmptyString(raw.file_id);
       if (imageUrl) {
         parts.push({ type: "image", imageUrl, ...(typeof raw.detail === "string" ? { detail: normalizeImageDetail(raw.detail) } : {}) });
-        hasImage = true;
+        hasMedia = true;
       } else if (fileId) {
         parts.push({ type: "text", text: `[image: ${fileId}]` });
       }
     } else if (raw.type === "input_audio") {
-      // Same presence-only contract as the user-content branch above: Codex returns
-      // audio in tool output too, and it previously disappeared without trace.
-      const format = safeAudioFormat(raw.format);
-      if (nonEmptyString(raw.audio_url)) {
+      const audio = audioContentFromRaw(raw.audio_url, raw.format);
+      if (audio) {
+        parts.push(audio);
+        hasMedia = true;
+      } else if (nonEmptyString(raw.audio_url)) {
+        const format = safeAudioFormat(raw.format);
         parts.push({ type: "text", text: format ? `[audio: ${format}]` : "[audio]" });
       }
     } else if (raw.type === "encrypted_content") {
@@ -165,7 +160,7 @@ export function outputToToolResultContent(output: string | unknown[] | undefined
       parts.push({ type: "text", text: "[encrypted content omitted]" });
     }
   }
-  if (!hasImage) return parts.map(p => (p.type === "text" ? p.text : "")).join("");
+  if (!hasMedia) return parts.map(p => (p.type === "text" ? p.text : "")).join("");
   return parts;
 }
 

package/src/responses/parser.ts

@@ -329,6 +329,13 @@ export function parseRequest(
         continue;
       }
 
+      if (effectiveType === "configuration_update") {
+        // Codex 0.164 positional reasoning-effort control. It is not a turn, so a translated route
+        // drops it without touching pending reasoning; the native passthrough keeps it verbatim in
+        // _rawBody. Mapping its effort onto the routed request is deliberately not done (#6895).
+        continue;
+      }
+
       if (isCompactionItemType(effectiveType)) {
         // A stored summary from a previous compaction. Decode our ocx1/ocx2 envelopes into plain text so
         // the routed model keeps the compacted context; real OpenAI-encrypted blobs degrade to a note.

package/src/responses/reasoning-envelope.ts

@@ -121,6 +121,18 @@ export function isProviderIssuedThinkingSignature(
   }
 }
 
+/**
+ * Whether a value has the spelling of a signature Anthropic issued. An allow-list on top of
+ * `isProviderIssuedThinkingSignature`: Anthropic's signature is base64, so item ids and the
+ * parser's serialized placeholder never pass. Shared by the adapter, which forwards only such a
+ * signature, and the Chat `reasoning_details` carrier, which accepts and emits only such a one.
+ */
+export function isLikelyRealAnthropicThinkingSignature(signature: string | undefined): signature is string {
+  if (typeof signature !== "string" || signature.length < 16) return false;
+  if (/^(fc|call|msg|rs|resp|reasoning|item|ws|tool|func|function)[-_]/i.test(signature)) return false;
+  return /^[A-Za-z0-9+/_=-]+$/.test(signature);
+}
+
 /** Decode an ocxr1 envelope; returns null for native (OpenAI-encrypted) blobs or garbage. */
 export function decodeReasoningEnvelope(encryptedContent: string, budget?: TranslatorBudget): ReasoningEnvelope | null {
   if (!encryptedContent.startsWith(OCX_REASONING_PREFIX)) return null;

package/src/responses/reasoning-retention.ts

@@ -4,14 +4,21 @@
  * Provider ciphertext and signatures are never included in the portable retained items.
  */
 
+import { Database } from "bun:sqlite";
 import { expandRetainedCompactionInput } from "./retained-compaction";
-import { closeSync, mkdirSync, openSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, closeSync, lstatSync, mkdirSync, openSync, opendirSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { estimateTokens } from "../lib/token-estimate";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
 
 export const DEFAULT_REASONING_RETENTION_PERCENT = 20;
 export const DEFAULT_MAX_REASONING_TOKENS = 100_000;
+/** Compiled-in aggregate ceiling for the on-disk reasoning archive directory. */
+export const DEFAULT_ARCHIVE_MAX_BYTES = 512 * 1024 * 1024;
+export const DEFAULT_ARCHIVE_MAX_FILES = 256;
 
 export interface ReasoningRetentionOptions {
   /** Directory that receives archived reasoning files. */
@@ -24,6 +31,10 @@ export interface ReasoningRetentionOptions {
   maxTokens?: number;
   /** Clock injection for tests. */
   now?: number;
+  /** Aggregate archive byte ceiling. Defaults to 512 MiB; smaller values are a test seam. */
+  archiveMaxBytes?: number;
+  /** Aggregate archive file-count ceiling. Defaults to 256; smaller values are a test seam. */
+  archiveMaxFiles?: number;
 }
 
 export interface ReasoningArchive {
@@ -100,6 +111,183 @@ function retentionTokenCap(value: number | undefined): number {
     : DEFAULT_MAX_REASONING_TOKENS;
 }
 
+/** Aggregate-capacity refusal: the archive directory is at or over its compiled-in ceiling. */
+export class ReasoningArchiveQuotaError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveQuotaError";
+  }
+}
+
+/** The sibling archive lock is held by another cooperating writer. */
+export class ReasoningArchiveBusyError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveBusyError";
+  }
+}
+
+/** Unsafe or uninspectable archive state; the attempt is refused without touching anything. */
+export class ReasoningArchiveError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "ReasoningArchiveError";
+  }
+}
+
+const ARCHIVE_SEPARATOR = "\n\n---\n\n";
+const ARCHIVE_SEPARATOR_BYTES = Buffer.byteLength(ARCHIVE_SEPARATOR, "utf8");
+const ARCHIVE_LOCK_SIDECARS = ["-journal", "-wal", "-shm"] as const;
+
+function archiveCap(value: number | undefined, fallback: number): number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+
+/** lstat that treats a vanished path as absent and refuses anything it cannot classify. */
+function archiveLstat(path: string): ReturnType<typeof lstatSync> | undefined {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw new ReasoningArchiveError(`reasoning archive path is not inspectable: ${path}`, { cause: error });
+  }
+}
+
+function assertRegularArchiveDirectory(archiveDir: string): void {
+  const entry = archiveLstat(archiveDir);
+  if (!entry?.isDirectory() || entry.isSymbolicLink()) {
+    throw new ReasoningArchiveError(`reasoning archive directory is not a regular directory: ${archiveDir}`);
+  }
+}
+
+function assertRegularArchiveLockPath(lockPath: string): void {
+  const entry = archiveLstat(lockPath);
+  if (entry !== undefined && (!entry.isFile() || entry.isSymbolicLink())) {
+    throw new ReasoningArchiveError(`reasoning archive lock path is not a regular file: ${lockPath}`);
+  }
+}
+
+/** Exact UTF-8 byte total of the would-be archive payload, computed before any joined string exists. */
+function archivePayloadBytes(texts: string[]): number {
+  let bytes = texts.length > 0 ? (texts.length - 1) * ARCHIVE_SEPARATOR_BYTES : 0;
+  for (const text of texts) {
+    const next = bytes + Buffer.byteLength(text, "utf8");
+    if (!Number.isSafeInteger(next)) {
+      throw new ReasoningArchiveError("reasoning archive payload byte size is not representable");
+    }
+    bytes = next;
+  }
+  return bytes;
+}
+
+interface ArchiveUsage {
+  files: number;
+  bytes: number;
+}
+
+/**
+ * Non-recursive accounting of every committed, remnant and foreign file. Anything that is not a
+ * plain regular file refuses closed; an entry vanishing mid-scan is already gone and skipped.
+ */
+function scanArchiveUsage(archiveDir: string, maxBytes: number, maxFiles: number): ArchiveUsage {
+  let directory: ReturnType<typeof opendirSync> | undefined;
+  let files = 0;
+  let bytes = 0;
+  let inspected = 0;
+  let failure: ReasoningArchiveError | undefined;
+  try {
+    // One entry per read: a legacy over-capacity directory must not first become an array
+    // or an unbounded read-ahead buffer on this synchronous request path.
+    directory = opendirSync(archiveDir, { bufferSize: 1 });
+    let entry;
+    while ((entry = directory.readSync()) !== null) {
+      inspected += 1;
+      if (!entry.isFile()) {
+        throw new ReasoningArchiveError(`reasoning archive entry is not a regular file: ${entry.name}`);
+      }
+      const stat = archiveLstat(join(archiveDir, entry.name));
+      if (stat === undefined) {
+        if (inspected >= maxFiles) throw new ReasoningArchiveError("reasoning archive scan changed beyond its inspection limit");
+        continue;
+      }
+      if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new ReasoningArchiveError(`reasoning archive entry is not a regular file: ${entry.name}`);
+      }
+      files += 1;
+      bytes += Number(stat.size);
+      if (files >= maxFiles || bytes > maxBytes) break; // refusal is already certain
+      if (inspected >= maxFiles) throw new ReasoningArchiveError("reasoning archive scan changed beyond its inspection limit");
+    }
+  } catch (error) {
+    failure = error instanceof ReasoningArchiveError ? error
+      : new ReasoningArchiveError("reasoning archive directory cannot be scanned", { cause: error });
+  } finally {
+    try { directory?.closeSync(); } catch (error) {
+      failure ??= new ReasoningArchiveError("reasoning archive directory could not be closed", { cause: error });
+    }
+  }
+  if (failure !== undefined) throw failure;
+  return { files, bytes };
+}
+
+function isSqliteBusy(error: unknown): boolean {
+  const code = error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : "";
+  const message = error instanceof Error ? error.message : "";
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
+}
+
+/**
+ * Serialize usage scan, exclusive create, write and close for one physical archive directory
+ * across cooperating processes. The sibling SQLite write transaction is the lock: the OS
+ * releases it on process exit, so no stale-owner reclamation is needed. busy_timeout=0 keeps
+ * the synchronous request path fail-fast instead of freezing the event loop.
+ */
+function withArchiveQuotaLockSync<T>(archiveDir: string, fn: () => T): T {
+  const normalized = archiveDir.replace(/[/\\]+$/, "");
+  const base = basename(normalized);
+  if (!base || base === "." || base === "..") {
+    throw new ReasoningArchiveError(`reasoning archive directory is not a usable path: ${archiveDir}`);
+  }
+  const parent = dirname(normalized);
+  assertNotRealHomeUnderTest(parent);
+  const lockPath = `${normalized}.lock`;
+  // The lock lives beside the archive inside the config home; foreign parents need no manifest entry.
+  if (parent === getConfigDir()) {
+    recordOwnedConfigPath(parent, lockPath);
+    for (const suffix of ARCHIVE_LOCK_SIDECARS) recordOwnedConfigPath(parent, `${lockPath}${suffix}`);
+  }
+  assertRegularArchiveLockPath(lockPath);
+  let database: Database;
+  try {
+    database = new Database(lockPath, { create: true });
+  } catch (error) {
+    throw new ReasoningArchiveError(`reasoning archive lock could not be opened: ${lockPath}`, { cause: error });
+  }
+  try {
+    try { chmodSync(lockPath, 0o600); } catch { /* platform may ignore chmod */ }
+    assertRegularArchiveLockPath(lockPath);
+    database.exec("PRAGMA locking_mode = NORMAL; PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+  } catch (error) {
+    try { database.close(); } catch { /* acquisition already failed */ }
+    if (error instanceof ReasoningArchiveError) throw error;
+    if (isSqliteBusy(error)) {
+      throw new ReasoningArchiveBusyError(
+        `reasoning archive lock is held by another writer: ${lockPath}`,
+        { cause: error },
+      );
+    }
+    throw new ReasoningArchiveError(`reasoning archive lock could not be acquired: ${lockPath}`, { cause: error });
+  }
+  try {
+    return fn();
+  } finally {
+    try { database.exec("ROLLBACK"); } catch { /* close below still releases the OS lock */ }
+    try { database.close(); } catch { /* the OS lock is released with the handle */ }
+  }
+}
+
 /** Separate reasoning locally before dispatch; unknown windows enforce the absolute cap. */
 export function applyReasoningRetention(
   input: unknown,
@@ -130,17 +318,36 @@ export function applyReasoningRetention(
       content: [{ type: "input_text", text }] })),
   };
 
-  mkdirSync(options.archiveDir, { recursive: true, mode: 0o700 });
+  const archiveBytes = archiveCap(options.archiveMaxBytes, DEFAULT_ARCHIVE_MAX_BYTES);
+  const archiveFiles = archiveCap(options.archiveMaxFiles, DEFAULT_ARCHIVE_MAX_FILES);
+  const incomingBytes = archivePayloadBytes(texts);
   const stamp = new Date(options.now ?? Date.now()).toISOString().replace(/[:.]/g, "-");
   const path = join(options.archiveDir, "reasoning-" + stamp + "-" + Math.random().toString(36).slice(2, 8) + ".md");
-  // Only a successful exclusive open grants ownership; an occupied path is never removed.
-  const fd = openSync(path, "wx", 0o600);
-  let failure: unknown;
-  try { writeFileSync(fd, texts.join("\n\n---\n\n"), "utf-8"); } catch (error) { failure = error; }
-  try { closeSync(fd); } catch (error) { failure ??= error; }
-  if (failure !== undefined) {
-    try { rmSync(path); } catch { /* preserve the original I/O error; cleanup is best-effort */ }
-    throw failure;
+  try {
+    mkdirSync(options.archiveDir, { recursive: true, mode: 0o700 });
+    assertRegularArchiveDirectory(options.archiveDir);
+    withArchiveQuotaLockSync(options.archiveDir, () => {
+      assertRegularArchiveDirectory(options.archiveDir);
+      const usage = scanArchiveUsage(options.archiveDir, archiveBytes, archiveFiles);
+      if (usage.files >= archiveFiles || incomingBytes > archiveBytes - usage.bytes) {
+        throw new ReasoningArchiveQuotaError(
+          `reasoning archive is at capacity: ${usage.files} file(s), ${usage.bytes} byte(s) under ${options.archiveDir}; delete older archives to archive more`,
+        );
+      }
+      // Only a successful exclusive open grants ownership; an occupied path is never removed.
+      const fd = openSync(path, "wx", 0o600);
+      let failure: unknown;
+      try { writeFileSync(fd, texts.join(ARCHIVE_SEPARATOR), "utf-8"); } catch (error) { failure = error; }
+      try { closeSync(fd); } catch (error) { failure ??= error; }
+      if (failure !== undefined) {
+        try { rmSync(path); } catch { /* preserve the original I/O error; cleanup is best-effort */ }
+        throw failure;
+      }
+    });
+  } catch (error) {
+    if (error instanceof ReasoningArchiveQuotaError || error instanceof ReasoningArchiveBusyError
+      || error instanceof ReasoningArchiveError) throw error;
+    throw new ReasoningArchiveError("reasoning archive could not be written", { cause: error });
   }
 
   const limitDescription = windowKnown

package/src/responses/schema.ts

@@ -27,10 +27,9 @@ const inputFileBlockSchema = z.object({
   file_data: z.string().optional(),
 });
 // codex-rs protocol/src/models.rs sends audio as input_audio with an audio_url, in
-// both user content and tool output. Accepting the block keeps a legitimate audio turn
-// out of the malformed-item catch-all. The translated IR records only its PRESENCE —
-// there is no audio carrier and no adapter-level refusal; a typed unsupported-modality
-// signal reaching final adapter dispatch remains a recorded residual.
+// both user content and tool output. The translated IR preserves supported inline
+// WAV/MP3 bytes and the Chat adapter sends them as input_audio; other wires and
+// unsupported formats are refused at the final translated-adapter boundary.
 const inputAudioBlockSchema = z.object({
   type: z.literal("input_audio"),
   audio_url: z.string().min(1),

package/src/responses/web-search-replay.ts

@@ -91,9 +91,18 @@ export function rewriteReplayedWebSearchCells(input: readonly unknown[]): Rewrit
   if (!input.some(item => isObj(item) && item.type === "web_search_call")) return undefined;
   // A synthetic call id must not collide with any client call id, nor with another cell's.
   const taken = new Set(input.flatMap(item => isObj(item) && typeof item.call_id === "string" ? [item.call_id] : []));
+  // First suffix each base has not settled yet; taken stays the collision check on every candidate,
+  // so seeded ids and ids handed out under another base still block the smallest free suffix.
+  const nextSuffix = new Map<string, number>();
   const allocate = (base: string): string => {
-    let id = base;
-    for (let n = 1; taken.has(id); n++) id = `${base}_${n}`;
+    if (!taken.has(base)) {
+      taken.add(base);
+      return base;
+    }
+    let n = nextSuffix.get(base) ?? 1;
+    let id = `${base}_${n}`;
+    while (taken.has(id)) id = `${base}_${++n}`;
+    nextSuffix.set(base, n + 1);
     taken.add(id);
     return id;
   };