@ebony-vinyl/dsh-our-free-model 2.8.0 → 2.8.3

package/src/feed.js

@@ -109,6 +109,11 @@ function parseItem(row, now) {
     && /^https?:\/\//i.test(row.link.url)) {
     link = { url: row.link.url, label: typeof row.link.label === 'string' ? row.link.label.slice(0, 100) : '' }
   }
+  // `holdSeconds` asks the client to keep the modal's close control locked for
+  // a few seconds so the body is actually read (0/absent closes immediately).
+  // The ceiling keeps an owner from writing "hold for a week".
+  const holdSeconds = row.holdSeconds
+  const hold = Number.isInteger(holdSeconds) && holdSeconds >= 0 && holdSeconds <= 30 ? holdSeconds : 0
   return {
     id,
     title,
@@ -118,6 +123,7 @@ function parseItem(row, now) {
     ...expiresAt === undefined ? {} : { expiresAt },
     ...row.pinned === true ? { pinned: true } : {},
     ...link === undefined ? {} : { link },
+    ...(hold > 0 ? { holdSeconds: hold } : {}),
   }
 }
 

package/src/http.js

@@ -420,8 +420,11 @@ function emptyBodyFailure(status, retryAfterMs, imageContent) {
 
 export async function postStreamed({ path, body, session, attributionUserAgent, signal, onData, timeoutMs = 300000 }) {
   // The Messages wire carries the 2.x client's beta header (o2a/headers.js);
-  // the path is the only wire signal this layer sees.
-  const headers = gatewayHeaders({ session: truncateSession(session), stream: true, anthropic: path.includes('/messages') })
+  // the path is the only wire signal this layer sees. The project id derives
+  // from the same canonical session, so one conversation's retries,
+  // continuations and refreshes share one upstream quota bucket (PR #757).
+  const canonical = truncateSession(session)
+  const headers = gatewayHeaders({ session: canonical, project: canonical, stream: true, anthropic: path.includes('/messages') })
   headers['user-agent'] = userAgentWith(attributionUserAgent)
   let response
   try {
@@ -431,6 +434,13 @@ export async function postStreamed({ path, body, session, attributionUserAgent,
     // `TimeoutError`/user Error rather than `AbortError` — testing the name alone
     // reported a cancelled turn as `TRANSPORT`, which is retryable.
     if (signal?.aborted === true || error?.name === 'AbortError') throw new UpstreamError('request aborted', CODE.aborted)
+    // A lane-configuration refusal (a missing Bun, an unusable proxy) is not an
+    // "upstream request failed": the sentence the lane wrote is already the
+    // actionable answer, so it ships unwrapped, with its flag intact for the
+    // surfaces that distinguish "fix your environment" from "upstream broke".
+    if (error?.laneConfig === true) {
+      throw new UpstreamError(String(error?.message ?? error), CODE.transport, { laneConfig: true })
+    }
     throw new UpstreamError(`our-free-model: upstream request failed: ${error?.message ?? error}${transportCause(error)}`, CODE.transport)
   }
 
@@ -625,7 +635,8 @@ export async function readSse(source, onData, signal, timeoutMs = 300000) {
 
 /** Fetch a small JSON document from the gateway with the fingerprint headers. */
 export async function getJson(path, { session, attributionUserAgent, signal, timeoutMs = 15000 } = {}) {
-  const headers = gatewayHeaders({ session: truncateSession(session ?? ''), stream: false, accept: 'application/json' })
+  const canonical = truncateSession(session ?? '')
+  const headers = gatewayHeaders({ session: canonical, project: canonical, stream: false, accept: 'application/json' })
   headers['user-agent'] = userAgentWith(attributionUserAgent)
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)

package/src/kilo.js

@@ -25,8 +25,20 @@ import { egressFetch } from './egress.js'
 const LISTING_TIMEOUT_MS = 15000
 const TURN_TIMEOUT_MS = 300000
 
-/** Overridable for the offline suite and the live probes, like the free lane's base. */
-export const KILO_BASE = (process.env.OUR_FREE_MODEL_KILO_BASE ?? 'https://api.kilo.ai/api/gateway').replace(/\/+$/, '')
+/**
+ * The gateway base, newest first (`ai-gateway.kilo.ai` is what the official
+ * docs publish; the older `api.kilo.ai/api/gateway` path answers the same
+ * catalog and stays as the override/fallback). Overridable for the offline
+ * suite and the live probes, like the free lane's base.
+ */
+export const KILO_BASE = (process.env.OUR_FREE_MODEL_KILO_BASE ?? 'https://ai-gateway.kilo.ai/api/v1').replace(/\/+$/, '')
+
+/** The attribution headers Kilo's own clients send; documented optional, and a
+ *  gateway that ranks by referrer sees the plugin, not a spoofed editor. */
+const KILO_ATTRIBUTION = {
+  'http-referer': 'https://kilo.ai/',
+  'x-title': 'Our Free Model',
+}
 
 /**
  * The lane's transport is `egressFetch`, exactly like the free lane's: an
@@ -37,7 +49,13 @@ function kiloFetch(url, init) {
   return egressFetch(url, init)
 }
 
-/** One listing round: `GET {base}/models`. Returns the parsed JSON document. */
+/** The cached listing document and its validator, for conditional rounds. */
+let listingCache = null
+let listingETag = null
+
+/** One listing round: `GET {base}/models`, conditionally when the gateway
+ *  named a validator last time. Returns the parsed JSON document; a `304`
+ *  answers with the cached one. */
 export async function fetchKiloListing({ signal, timeoutMs = LISTING_TIMEOUT_MS } = {}) {
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)
@@ -46,15 +64,27 @@ export async function fetchKiloListing({ signal, timeoutMs = LISTING_TIMEOUT_MS
   const onCallerAbort = () => { callerAborted = true; controller.abort() }
   signal?.addEventListener('abort', onCallerAbort, { once: true })
   try {
+    const headers = {
+      accept: 'application/json',
+      'user-agent': 'dsh-our-free-model',
+      ...KILO_ATTRIBUTION,
+      ...(listingETag !== null ? { 'if-none-match': listingETag } : {}),
+    }
     const response = await kiloFetch(`${KILO_BASE}/models`, {
-      headers: { accept: 'application/json', 'user-agent': 'dsh-our-free-model' },
+      headers,
       redirect: 'error',
       signal: controller.signal,
     })
+    if (response.status === 304 && listingCache !== null) return listingCache
     const text = await response.text()
     let payload
     try { payload = JSON.parse(text) } catch { payload = { error: { message: text.slice(0, 300) || `HTTP ${response.status}` } } }
     if (!response.ok) throw classifyFailure(response.status, payload)
+    const etag = response.headers.get('etag')
+    if (typeof etag === 'string' && etag !== '') {
+      listingETag = etag
+      listingCache = payload
+    }
     return payload
   } catch (error) {
     if (error instanceof UpstreamError) throw error
@@ -83,7 +113,7 @@ export async function postKiloStreamed({ body, signal, onData, timeoutMs = TURN_
   try {
     response = await kiloFetch(`${KILO_BASE}/chat/completions`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json', accept: 'text/event-stream', 'user-agent': 'dsh-our-free-model' },
+      headers: { 'content-type': 'application/json', accept: 'text/event-stream', 'user-agent': 'dsh-our-free-model', ...KILO_ATTRIBUTION },
       body: bodyText,
       redirect: 'error',
       signal,
@@ -151,9 +181,29 @@ function classifyKilo(status, text, retryAfterMs) {
   let payload
   try { payload = JSON.parse(text) } catch { payload = { error: { message: text.slice(0, 300) || `HTTP ${status}` } } }
   const type = payload?.error_type ?? payload?.error?.code ?? payload?.error?.type
+  const rawMeta = payload?.error?.metadata?.raw ?? payload?.metadata?.raw
+  let message = payload?.error?.message ?? (typeof payload?.message === 'string' ? payload.message : undefined)
+  if (typeof rawMeta === 'string' && rawMeta.trim() !== '') {
+    let rawDetail = ''
+    try {
+      const parsed = JSON.parse(rawMeta)
+      rawDetail = typeof parsed?.error === 'string' ? parsed.error
+        : typeof parsed?.message === 'string' ? parsed.message
+        : typeof parsed?.error?.message === 'string' ? parsed.error.message
+        : ''
+    } catch {
+      rawDetail = rawMeta.slice(0, 200).trim()
+    }
+    const providerName = payload?.error?.metadata?.provider_name ?? payload?.metadata?.provider_name
+    const providerSuffix = typeof providerName === 'string' && providerName !== '' ? ` (${providerName})` : ''
+    if (rawDetail !== '') {
+      message = message ? `${message}: ${rawDetail}${providerSuffix}` : `${rawDetail}${providerSuffix}`
+    }
+  }
   const shaped = {
     error: {
       ...payload?.error,
+      ...(message !== undefined ? { message } : {}),
       ...(type === undefined ? {} : { type: String(type) }),
     },
   }

package/src/magpie-engine.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process'
 import { randomBytes, createHash } from 'node:crypto'
-import { existsSync, readFileSync, createReadStream } from 'node:fs'
-import { mkdir, readFile, writeFile, rename, link, unlink, realpath } from 'node:fs/promises'
+import { existsSync, readFileSync, createReadStream, statSync } from 'node:fs'
+import { mkdir, readFile, writeFile, rename, link, unlink, realpath, rm } from 'node:fs/promises'
 import http from 'node:http'
 import net from 'node:net'
 import path from 'node:path'
@@ -767,7 +767,47 @@ export function createMagpieEngine({ dataDir, logger, binary } = {}) {
       const env = { ...process.env }
       // An inherited Magpie override must never redirect this owned instance.
       for (const key of Object.keys(env)) if (key.toUpperCase().startsWith('MAGPIE_')) delete env[key]
+      // The engine wires every agent it finds under the user's home (ZCode's
+      // provider_config.json, Codex's config.toml, …) to itself when it starts.
+      // This engine's catalog is its own and may be empty, so that startup sync
+      // would rewrite those agents with no models. Give it a home of its own:
+      // it still serves its page, and no file of a real agent is touched. The
+      // Windows folders os.UserConfigDir reads are moved too, for the agents
+      // that keep their settings there (VS Code, Cline, …).
+      const agentHome = path.join(home, 'agent-home')
+      const agentRoaming = path.join(agentHome, 'AppData', 'Roaming')
+      const agentLocal = path.join(agentHome, 'AppData', 'Local')
+      for (const dir of [agentHome, agentRoaming, agentLocal]) {
+        await mkdir(dir, { recursive: true, mode: 0o700 })
+      }
+      // The engine goes straight to -p for a while after Claude Code's
+      // interactive mode failed to start (its claude-tui-broken mark, under
+      // this engine's LOCALAPPDATA). A mark earned by the previous engine
+      // says nothing about this one: after an engine upgrade that carries a
+      // start fix, a stale mark would keep the TUI off for up to a day.
+      // Forget it when the engine's revision changes.
+      const engineRevision = metadata.revision || ''
+      if (engineRevision !== '') {
+        const revisionFile = path.join(home, '.ofm-engine-revision')
+        let previousRevision = ''
+        try { previousRevision = (await readFile(revisionFile, 'utf8')).trim() } catch { /* first boot: no mark to forget either */ }
+        if (previousRevision !== engineRevision) {
+          await rm(path.join(agentLocal, 'magpie', 'claude-tui-broken'), { force: true }).catch(() => {})
+          await writeFile(revisionFile, `${engineRevision}\n`).catch(() => {})
+        }
+      }
+      // Windows folds every ancestor of a session folder into a 260-character
+      // budget; this redirection adds ~40, and claude appends a slug of the
+      // whole project path on top. A long or non-ASCII data home is the class
+      // of failure behind "rename the folder to something short and it works"
+      // — say so up front, with the escape hatch, instead of leaving a bare
+      // mkdir error nobody can act on.
+      if (agentHome.length > 200 || /[^\x20-\x7E]/.test(agentHome)) {
+        logger?.warn?.(`our-free-model: 引擎数据目录较长或含非 ASCII 字符（${agentHome.length} 字符）——Claude 等客户端可能无法新建会话文件夹；如遇到，请把 DSH_HOME 指向一个短的纯英文路径后重启。(engine data home is long or contains non-ASCII characters; if agents cannot create session folders, point DSH_HOME at a short ASCII path and restart)`)
+      }
       Object.assign(env, {
+        HOME: agentHome, USERPROFILE: agentHome,
+        APPDATA: agentRoaming, LOCALAPPDATA: agentLocal,
         XDG_CONFIG_HOME: dirs.config, XDG_CACHE_HOME: dirs.cache,
         XDG_DATA_HOME: dirs.data, XDG_STATE_HOME: dirs.state,
         MAGPIE_ADDR: `127.0.0.1:${gatewayPort}`, MAGPIE_WEB_KEY: webKey,
@@ -929,7 +969,13 @@ export function createMagpieEngine({ dataDir, logger, binary } = {}) {
       if (failure.statusCode === 400) throw engineError('Invalid gateway key request', 400)
       if (failure.statusCode === 413) throw engineError('Gateway key request exceeds limit', 413)
       if (options.signal?.aborted) throw new DOMException('Engine request aborted', 'AbortError')
-      throw engineError('Engine request failed')
+      // The engine's own transport refusals carry the actionable fact (the
+      // refused path, the socket error); a bare "Engine request failed" turns a
+      // diagnosable boot into a support thread. Keep the detail, bounded, and
+      // never from response bodies — those can quote user content.
+      const detail = typeof failure?.message === 'string' && failure.message !== ''
+        ? `: ${failure.message.slice(0, 160)}` : ''
+      throw engineError(`Engine request failed${detail}`)
     }
   }
   const proxy = async (req, res, subpath = '/', options = {}) => {
@@ -1106,3 +1152,27 @@ export function createMagpieEngine({ dataDir, logger, binary } = {}) {
   }
   return { start, status, close, request, proxy, gateway }
 }
+
+/**
+ * A lightweight PATH probe for the agent CLIs the engine connects to (claude
+ * first among them). The engine manages agent installs itself, but its
+ * downloader cannot reach the release host from every network, so the practical
+ * requirement is a pre-installed CLI — warn at boot instead of at the user's
+ * first failed connect. Never resolves shell shims deeper than a PATH entry.
+ */
+export function findAgentCli(command) {
+  const name = String(command ?? '').trim()
+  if (name === '' || name.includes('/') || name.includes('\\')) return undefined
+  const spellings = process.platform === 'win32' ? ['.cmd', '.bat', '.exe', ''] : ['']
+  const dirs = [
+    ...(process.env.PATH ?? '').split(path.delimiter).filter(Boolean),
+    ...(process.platform === 'win32' && process.env.APPDATA ? [path.join(process.env.APPDATA, 'npm')] : []),
+  ]
+  for (const dir of dirs) {
+    for (const spelling of spellings) {
+      const candidate = path.join(dir, `${name}${spelling}`)
+      try { if (statSync(candidate).isFile()) return candidate } catch { /* try the next spelling */ }
+    }
+  }
+  return undefined
+}

package/src/magpie-models.js

@@ -4,14 +4,42 @@ import { deniedModel } from './magpie-policy.js'
 
 const PREFIX = 'subscription:magpie/'
 
+/**
+ * Engine inference rides the host's replaceable `globalThis.fetch` — the same
+ * transport the imported sidecar subscriptions already use — so local proxy
+ * plugins that swap `globalThis.fetch` to re-serialize outgoing bodies can see
+ * engine turns again, as they could before the 2026-10-24 private-transport
+ * quarantine. Startup, health, management and catalog reads keep the private
+ * loopback transport: a broken fetch replacement must never keep the workspace
+ * from becoming ready. An explicit `fetchImpl` (tests, embedded hosts) still
+ * governs both paths, and OFM_ENGINE_PRIVATE_FETCH=1 forces inference back
+ * onto the private transport.
+ */
+function defaultInferenceTransport() {
+  return process.env.OFM_ENGINE_PRIVATE_FETCH === '1' ? loopbackFetch : globalThis.fetch
+}
+
 /** Expose the engine's live catalog through the existing DSH stream adapter. */
-export function createMagpieModels({ engine, stats, logger, onChanged = () => {}, fetchImpl = loopbackFetch }) {
+export function createMagpieModels({ engine, stats, logger, onChanged = () => {}, fetchImpl = loopbackFetch, inferenceFetch, extensionRuntime } = {}) {
   let models = []
   let pending
   let closed = false
   let owner
+  // An explicit fetchImpl governs inference and catalog alike (the historical
+  // contract); otherwise inference is the replaceable transport and only the
+  // catalog read stays private.
+  const catalogFetch = fetchImpl
+  const inferenceTransport = inferenceFetch ?? (fetchImpl !== loopbackFetch ? fetchImpl : defaultInferenceTransport())
   const runtime = createSubscriptionRuntime({
-    stats, logger, fetchImpl,
+    stats, logger,
+    fetchImpl: inferenceTransport,
+    // Enhancement extensions get the same fail-open body seam the harness lane
+    // gives them: one plain-object pass, microseconds, no gateway hop.
+    onPayload: async (payload, meta) => {
+      const source = typeof extensionRuntime === 'function' ? extensionRuntime() : extensionRuntime
+      if (source?.applyRequestHooks === undefined) return payload
+      return source.applyRequestHooks(payload, { ...meta, lane: 'magpie' })
+    },
     subscriptions: {
       list: () => [{
         id: 'magpie', provider: 'magpie', enabled: engine.status().state === 'ready',
@@ -65,7 +93,7 @@ export function createMagpieModels({ engine, stats, logger, onChanged = () => {}
       if (pending) return pending
       pending = (async () => {
         const gateway = engine.gateway()
-        const response = await fetchImpl(`${gateway.url.replace(/\/$/, '')}/v1/models`, {
+        const response = await catalogFetch(`${gateway.url.replace(/\/$/, '')}/v1/models`, {
           headers: { authorization: `Bearer ${gateway.key}` },
           signal: AbortSignal.timeout(15000), redirect: 'error',
         })

package/src/model-test.js

@@ -84,7 +84,9 @@ export function modelAvailability(id, snapshot, listed = false) {
   // Older saved snapshots have only `at`, which retains their previous order.
   const measured = manual && (!probe || manual.at >= (probe.startedAt ?? probe.at)) ? manual : probe
   return {
-    availabilitySource: measured === manual && manual ? 'manual' : listed ? 'listing' : 'probe',
+    availabilitySource: measured === manual && manual ? 'manual'
+      : measured?.source === 'passive' ? 'passive'
+        : listed ? 'listing' : 'probe',
     availability: measured?.state ?? 'unknown',
     detail: measured?.detail ?? '', probedAt: measured?.at ?? 0,
     ttftMs: measured?.ttftMs, latencyMs: measured?.latencyMs,

package/src/o2a.js

@@ -1,8 +1,8 @@
 // src/o2a/version.js
-var O2A_VERSION = "1.4.6";
-var O2A_COMMIT = "58f56676ba1438adb30604b889bf36db2a1542a1";
+var O2A_VERSION = "1.4.7";
+var O2A_COMMIT = "b296a61d0e3ef93b4df58e298be2c4e34e397322";
 var O2A_REFERENCE = "https://github.com/jasonxu114514/opencode2api";
-var V2_CLIENT_VERSION = "2.1.1";
+var V2_CLIENT_VERSION = "2.2.3";
 var CLIENT_UA = `opencode/latest/${V2_CLIENT_VERSION}/cli`;
 var V2_COMPLETION_LIMIT = 32e3;
 var ANONYMOUS_CREDENTIAL = "public";
@@ -98,6 +98,34 @@ function clientToolWireName(name, used) {
     }
   }
 }
+var OFFICIAL_TOOL_ALIASES = Object.freeze({
+  edit: ["edit"],
+  glob: ["glob"],
+  grep: ["grep"],
+  question: ["question", "askuserquestion"],
+  read: ["read", "view"],
+  shell: ["shell", "bash"],
+  skill: ["skill"],
+  subagent: ["subagent", "agent", "task"],
+  webfetch: ["webfetch", "fetch"],
+  websearch: ["websearch"],
+  write: ["write"],
+  patch: ["patch", "applypatch"]
+});
+var FOLDED_OFFICIAL_ALIASES = (() => {
+  const index = /* @__PURE__ */ new Map();
+  for (const [official, spellings] of Object.entries(OFFICIAL_TOOL_ALIASES)) {
+    for (const spelling of spellings) {
+      const folded = foldToolName(spelling);
+      if (!index.has(folded)) index.set(folded, official);
+    }
+  }
+  return index;
+})();
+function officialForClientName(name) {
+  if (typeof name !== "string" || name === "") return null;
+  return FOLDED_OFFICIAL_ALIASES.get(foldToolName(name)) ?? null;
+}
 var ToolRenameMap = class extends Map {
   constructor() {
     super();
@@ -518,6 +546,18 @@ function projectID(project) {
   const sum = crypto3.createHash("sha256").update(`opencode-project\0${project}`).digest();
   return sum.subarray(0, 20).toString("hex");
 }
+function stableProjectID(session) {
+  return projectID(String(session ?? ""));
+}
+function traceHeaders() {
+  const traceId = crypto3.randomBytes(16).toString("hex");
+  const spanId = crypto3.randomBytes(8).toString("hex");
+  const parentId = crypto3.randomBytes(8).toString("hex");
+  return {
+    "traceparent": `00-${traceId}-${spanId}-01`,
+    "b3": `${traceId}-${spanId}-1-${parentId}`
+  };
+}
 function gatewayHeaders({ session, childSession, project, stream, accept, anthropic, userAgent } = {}) {
   const headers = {
     "content-type": "application/json",
@@ -528,9 +568,10 @@ function gatewayHeaders({ session, childSession, project, stream, accept, anthro
     "x-session-id": session,
     "x-opencode-session": session,
     "x-opencode-session-id": childSession ?? session,
-    "x-opencode-project": projectID(project ?? randomProjectID())
+    "x-opencode-project": projectID(project ?? stableProjectID(session)),
+    ...traceHeaders()
   };
-  if (accept) headers["accept"] = accept;
+  if (accept !== null) headers["accept"] = accept ?? "*/*";
   if (anthropic) headers["anthropic-beta"] = "interleaved-thinking-2025-05-14";
   return headers;
 }
@@ -538,16 +579,18 @@ function gatewayHeaders({ session, childSession, project, stream, accept, anthro
 // src/o2a/toolshape.js
 function renameAndCompleteTools(payload, shape, { keep } = {}) {
   if (shape !== "chat" && shape !== "flat" && shape !== "claude") {
-    return { renames: new ToolRenameMap(), injected: [] };
+    return { renames: new ToolRenameMap(), injected: [], known: /* @__PURE__ */ new Set() };
   }
   const renames = new ToolRenameMap();
   const used = /* @__PURE__ */ new Set();
   const keepNames = keep instanceof Set ? keep : /* @__PURE__ */ new Set();
+  const officialUsed = new Set(keepNames);
   let items = Array.isArray(payload.tools) ? [...payload.tools] : [];
   if ((shape === "chat" || shape === "flat") && Array.isArray(payload.functions)) {
     items = items.concat(convertLegacyFunctions(payload.functions, shape, renames, used));
     delete payload.functions;
   }
+  const declaredClientTools = items.filter((item) => renamableToolName(shape, item) !== null).length;
   const shaped = [];
   for (const item of items) {
     const name = renamableToolName(shape, item);
@@ -559,6 +602,13 @@ function renameAndCompleteTools(payload, shape, { keep } = {}) {
       shaped.push(item);
       continue;
     }
+    const official = officialForClientName(name);
+    if (official !== null && officialUsed.has(official) === false && officialToolDefinition(official) !== void 0) {
+      officialUsed.add(official);
+      renames.add(name, official);
+      shaped.push(withToolName(shape, item, official));
+      continue;
+    }
     let wireName = renames.wireOf(name);
     if (wireName === void 0) {
       wireName = clientToolWireName(name, used);
@@ -568,13 +618,158 @@ function renameAndCompleteTools(payload, shape, { keep } = {}) {
   }
   const injected = [];
   for (const name of V2_OFFICIAL_TOOL_ORDER) {
-    if (keepNames.has(name)) continue;
+    if (officialUsed.has(name)) continue;
     shaped.push(officialTool(shape, name));
     injected.push(name);
+    officialUsed.add(name);
   }
   payload.tools = shaped;
   rewriteToolReferences(payload, shape, renames);
-  return { renames, injected };
+  const known = new Set(officialUsed);
+  for (const wire of renames.keys()) known.add(wire);
+  if (declaredClientTools > 0) sanitizeToolHistory(payload, shape, known);
+  dropDanglingToolChoice(payload, shape, known);
+  return { renames, injected, known };
+}
+function sanitizeToolHistory(payload, shape, known) {
+  const fateOf = (name) => {
+    if (typeof name !== "string" || name === "") return { verdict: "drop" };
+    if (known.has(name)) return { verdict: "keep" };
+    const official = officialForClientName(name);
+    if (official !== null && known.has(official)) return { verdict: "rename", official };
+    return { verdict: "drop" };
+  };
+  if (shape === "chat") {
+    const messages2 = Array.isArray(payload.messages) ? payload.messages : null;
+    if (messages2 === null) return;
+    const droppedCalls2 = /* @__PURE__ */ new Set();
+    const droppedFunctions = /* @__PURE__ */ new Set();
+    let changed2 = false;
+    for (let i = 0; i < messages2.length; i += 1) {
+      const message = messages2[i];
+      if (!message || typeof message !== "object") continue;
+      if (Array.isArray(message.tool_calls)) {
+        const kept = [];
+        let touched = false;
+        for (const call of message.tool_calls) {
+          const fate = fateOf(call?.function?.name);
+          if (fate.verdict === "keep") {
+            kept.push(call);
+            continue;
+          }
+          if (fate.verdict === "rename") {
+            const fn = call.function ?? {};
+            kept.push({ ...call, function: { ...fn, name: fate.official } });
+            touched = true;
+            continue;
+          }
+          if (typeof call?.id === "string" && call.id !== "") droppedCalls2.add(call.id);
+          touched = true;
+        }
+        if (touched) {
+          messages2[i] = { ...message, tool_calls: kept };
+          changed2 = true;
+        }
+      }
+      if (message.function_call && typeof message.function_call === "object") {
+        const fate = fateOf(message.function_call.name);
+        if (fate.verdict === "rename") {
+          messages2[i] = { ...message, function_call: { ...message.function_call, name: fate.official } };
+          changed2 = true;
+        } else if (fate.verdict === "drop") {
+          if (typeof message.function_call.name === "string") droppedFunctions.add(message.function_call.name);
+          const { function_call: _dropped, ...rest } = messages2[i];
+          messages2[i] = rest;
+          changed2 = true;
+        }
+      }
+      if (message.role === "tool" && typeof message.tool_call_id === "string" && droppedCalls2.has(message.tool_call_id)) {
+        messages2.splice(i, 1);
+        i -= 1;
+        changed2 = true;
+      }
+      if (message.role === "function" && typeof message.name === "string" && droppedFunctions.has(message.name)) {
+        messages2.splice(i, 1);
+        i -= 1;
+        changed2 = true;
+      }
+    }
+    if (changed2 && messages2.length === 0) payload.messages = [];
+    return;
+  }
+  if (shape === "flat") {
+    const input = Array.isArray(payload.input) ? payload.input : null;
+    if (input === null) return;
+    const droppedCalls2 = /* @__PURE__ */ new Set();
+    let changed2 = false;
+    for (let i = 0; i < input.length; i += 1) {
+      const item = input[i];
+      const type = typeof item?.type === "string" ? item.type : "";
+      if (type === "function_call") {
+        const fate = fateOf(item.name);
+        if (fate.verdict === "rename") {
+          input[i] = { ...item, name: fate.official };
+          changed2 = true;
+        } else if (fate.verdict === "drop") {
+          if (typeof item.call_id === "string" && item.call_id !== "") droppedCalls2.add(item.call_id);
+          input.splice(i, 1);
+          i -= 1;
+          changed2 = true;
+        }
+        continue;
+      }
+      if (type === "function_call_output" && typeof item.call_id === "string" && droppedCalls2.has(item.call_id)) {
+        input.splice(i, 1);
+        i -= 1;
+        changed2 = true;
+      }
+    }
+    if (changed2 && input.length === 0) payload.input = [];
+    return;
+  }
+  const messages = Array.isArray(payload.messages) ? payload.messages : null;
+  if (messages === null) return;
+  const droppedCalls = /* @__PURE__ */ new Set();
+  let changed = false;
+  for (let i = 0; i < messages.length; i += 1) {
+    const message = messages[i];
+    if (!message || typeof message !== "object" || !Array.isArray(message.content)) continue;
+    const kept = [];
+    let touched = false;
+    for (const block of message.content) {
+      if (block?.type === "tool_use") {
+        const fate = fateOf(block.name);
+        if (fate.verdict === "keep") {
+          kept.push(block);
+          continue;
+        }
+        if (fate.verdict === "rename") {
+          kept.push({ ...block, name: fate.official });
+          touched = true;
+          continue;
+        }
+        if (typeof block.id === "string" && block.id !== "") droppedCalls.add(block.id);
+        touched = true;
+        continue;
+      }
+      if (block?.type === "tool_result" && typeof block.tool_use_id === "string" && droppedCalls.has(block.tool_use_id)) {
+        touched = true;
+        continue;
+      }
+      kept.push(block);
+    }
+    if (touched) {
+      messages[i] = kept.length === 0 ? null : { ...message, content: kept };
+      changed = true;
+    }
+  }
+  if (changed) payload.messages = messages.filter((message) => message !== null);
+}
+function dropDanglingToolChoice(payload, shape, known) {
+  const choice = payload?.tool_choice;
+  if (choice === null || typeof choice !== "object") return;
+  const name = shape === "chat" && choice.function && typeof choice.function === "object" ? choice.function.name : choice.name;
+  if (typeof name === "string" && name !== "" && !known.has(name)) delete payload.tool_choice;
 }
 function withToolName(shape, entry, name) {
   if (shape === "chat") {
@@ -720,6 +915,7 @@ export {
   O2A_VERSION,
   OFFICIAL_PROMPT_MARKER,
   OFFICIAL_SKILLS,
+  OFFICIAL_TOOL_ALIASES,
   SESSION_PHASE_MS,
   SESSION_TIMESTAMP_WINDOW_MS,
   TOOL_WIRE_NAME_LIMIT,
@@ -740,6 +936,7 @@ export {
   injectOfficialPrompt,
   isOfficialSessionID,
   officialEnvironment,
+  officialForClientName,
   officialPrompt,
   officialSystemPrompt,
   officialTool,
@@ -752,6 +949,8 @@ export {
   renamableToolName,
   renameAndCompleteTools,
   sessionPhaseMs,
+  stableProjectID,
   textFragments,
+  traceHeaders,
   v2ShellDescription
 };