@gajae-code/ai 0.12.7 → 0.12.10

package/src/model-pricing.ts

@@ -0,0 +1,68 @@
+import type { Api, LongContextPricing, Model, ModelCost } from "./types";
+
+interface TieredPricing {
+	cost: ModelCost;
+	longContextPricing: LongContextPricing;
+}
+
+const LONG_CONTEXT_THRESHOLD = 272_000;
+
+const GPT_5_6_SOL_PRICING: TieredPricing = {
+	cost: { input: 5, output: 30, cacheRead: 0.5, cacheWrite: 6.25 },
+	longContextPricing: {
+		threshold: LONG_CONTEXT_THRESHOLD,
+		cost: { input: 10, output: 45, cacheRead: 1, cacheWrite: 12.5 },
+	},
+};
+
+// OpenAI Standard pricing: https://developers.openai.com/api/docs/pricing
+const OPENAI_GPT_5_6_PRICING: ReadonlyMap<string, TieredPricing> = new Map([
+	["gpt-5.6", GPT_5_6_SOL_PRICING],
+	["gpt-5.6-sol", GPT_5_6_SOL_PRICING],
+	[
+		"gpt-5.6-terra",
+		{
+			cost: { input: 2, output: 12, cacheRead: 0.2, cacheWrite: 2.5 },
+			longContextPricing: {
+				threshold: LONG_CONTEXT_THRESHOLD,
+				cost: { input: 4, output: 18, cacheRead: 0.4, cacheWrite: 5 },
+			},
+		},
+	],
+	[
+		"gpt-5.6-luna",
+		{
+			cost: { input: 0.2, output: 1.2, cacheRead: 0.02, cacheWrite: 0.25 },
+			longContextPricing: {
+				threshold: LONG_CONTEXT_THRESHOLD,
+				cost: { input: 0.4, output: 1.8, cacheRead: 0.04, cacheWrite: 0.5 },
+			},
+		},
+	],
+]);
+
+export function getOpenAIModelCost<TApi extends Api>(model: Model<TApi>, inputTokens: number): ModelCost | undefined {
+	if (model.provider !== "openai" && model.provider !== "openai-codex") {
+		return undefined;
+	}
+	const pricing = OPENAI_GPT_5_6_PRICING.get(model.id);
+	if (!pricing) {
+		return undefined;
+	}
+	return inputTokens > pricing.longContextPricing.threshold ? pricing.longContextPricing.cost : pricing.cost;
+}
+
+export function applyOpenAIModelPricing<TApi extends Api>(model: Model<TApi>): void {
+	if (model.provider !== "openai" && model.provider !== "openai-codex") {
+		return;
+	}
+	const pricing = OPENAI_GPT_5_6_PRICING.get(model.id);
+	if (!pricing) {
+		return;
+	}
+	model.cost = { ...pricing.cost };
+	model.longContextPricing = {
+		threshold: pricing.longContextPricing.threshold,
+		cost: { ...pricing.longContextPricing.cost },
+	};
+}

package/src/model-thinking.ts

@@ -1,4 +1,5 @@
 import { CODEX_GPT_5_6_CONTEXT_CAP, isCodexGpt56Tier, isCodexProductTransport } from "./context-cap-policy";
+import { applyOpenAIModelPricing } from "./model-pricing";
 import { resolveOpenAICompat } from "./providers/openai-completions-compat";
 import type { Api, Model as ApiModel, ThinkingConfig } from "./types";
 import { isClaudeForcedToolChoiceIncapableModelId } from "./utils/tool-choice-capability";
@@ -51,6 +52,7 @@ const GPT_5_2_PLUS_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effo
 const GPT_5_6_PLUS_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effort.High, Effort.XHigh, Effort.Max];
 const GPT_5_5_DEFAULT_EFFORT = Effort.XHigh;
 const KIMI_K3_EFFORTS: readonly Effort[] = [Effort.Low, Effort.High, Effort.Max];
+const DEEPSEEK_V4_FLASH_0731_EFFORTS: readonly Effort[] = [Effort.Low, Effort.High, Effort.Max];
 
 const GPT_5_1_CODEX_MINI_EFFORTS: readonly Effort[] = [Effort.Medium, Effort.High];
 const CLOUDFLARE_AI_GATEWAY_BASE_URL = "https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/anthropic";
@@ -198,7 +200,12 @@ export function refreshModelThinking<TApi extends Api>(model: ApiModel<TApi>): A
  */
 export function applyGeneratedModelPolicies(models: ApiModel<Api>[]): void {
 	for (let index = 0; index < models.length; index++) {
-		const model = refreshModelThinking(models[index]!);
+		const source = models[index]!;
+		if (source.provider === "alibaba-token-plan" && source.id === "deepseek-v4-flash-0731") {
+			source.reasoning = true;
+			source.name = "DeepSeek V4 Flash 0731";
+		}
+		const model = refreshModelThinking(source);
 		applyGeneratedModelPolicy(model);
 		models[index] = model;
 	}
@@ -377,6 +384,7 @@ function anthropicModelHasRealXHighEffort<TApi extends Api>(model: ApiModel<TApi
 }
 
 function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
+	applyOpenAIModelPricing(model);
 	const copilotLimits = model.provider === "github-copilot" ? COPILOT_GENERATED_LIMITS[model.id] : undefined;
 	if (copilotLimits) {
 		model.contextWindow = copilotLimits.contextWindow;
@@ -437,6 +445,17 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 	if (model.provider === "zai" && model.id === "glm-5.2") {
 		model.contextWindow = 1_000_000;
 	}
+	if (model.provider === "alibaba-token-plan" && model.id === "deepseek-v4-flash-0731") {
+		model.contextWindow = 1_000_000;
+		model.maxTokens = 384_000;
+		model.compat = {
+			...(model.compat ?? {}),
+			supportsDeveloperRole: false,
+			supportsReasoningEffort: true,
+			reasoningContentField: "reasoning_content",
+			requiresReasoningContentForToolCalls: true,
+		};
+	}
 	// MiniMax-M3: MiniMax exposes a 1M context tier, but usage beyond 512K is
 	// billed separately. Keep bundled/default metadata at the billing-safe 512K
 	// unless an explicit paid-tier contract is added.
@@ -617,6 +636,9 @@ function inferSupportedEfforts<TApi extends Api>(parsedModel: ParsedModel, model
 	if (model.provider === "kimi-code" && model.id === "k3") {
 		return KIMI_K3_EFFORTS;
 	}
+	if (model.provider === "alibaba-token-plan" && model.id === "deepseek-v4-flash-0731") {
+		return DEEPSEEK_V4_FLASH_0731_EFFORTS;
+	}
 	switch (parsedModel.family) {
 		case "openai":
 			return inferOpenAISupportedEfforts(parsedModel);

package/src/models.json

@@ -1,5 +1,40 @@
 {
 	"alibaba-token-plan": {
+		"deepseek-v4-flash-0731": {
+			"id": "deepseek-v4-flash-0731",
+			"name": "DeepSeek V4 Flash 0731",
+			"api": "openai-completions",
+			"provider": "alibaba-token-plan",
+			"baseUrl": "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1",
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0,
+				"output": 0,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 384000,
+			"compat": {
+				"supportsDeveloperRole": false,
+				"supportsReasoningEffort": true,
+				"reasoningContentField": "reasoning_content",
+				"requiresReasoningContentForToolCalls": true
+			},
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "low",
+				"maxLevel": "max",
+				"levels": [
+					"low",
+					"high",
+					"max"
+				]
+			}
+		},
 		"deepseek-v4-pro": {
 			"id": "deepseek-v4-pro",
 			"name": "DeepSeek V4 Pro",
@@ -58436,7 +58471,16 @@
 				"minLevel": "low",
 				"maxLevel": "max"
 			},
-			"applyPatchToolType": "freeform"
+			"applyPatchToolType": "freeform",
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 10,
+					"output": 45,
+					"cacheRead": 1,
+					"cacheWrite": 12.5
+				}
+			}
 		},
 		"gpt-5.6-luna": {
 			"id": "gpt-5.6-luna",
@@ -58450,10 +58494,10 @@
 				"image"
 			],
 			"cost": {
-				"input": 1,
-				"output": 6,
-				"cacheRead": 0.1,
-				"cacheWrite": 1.25
+				"input": 0.2,
+				"output": 1.2,
+				"cacheRead": 0.02,
+				"cacheWrite": 0.25
 			},
 			"contextWindow": 1050000,
 			"maxTokens": 128000,
@@ -58462,7 +58506,16 @@
 				"minLevel": "low",
 				"maxLevel": "max"
 			},
-			"applyPatchToolType": "freeform"
+			"applyPatchToolType": "freeform",
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 0.4,
+					"output": 1.8,
+					"cacheRead": 0.04,
+					"cacheWrite": 0.5
+				}
+			}
 		},
 		"gpt-5.6-sol": {
 			"id": "gpt-5.6-sol",
@@ -58488,7 +58541,16 @@
 				"minLevel": "low",
 				"maxLevel": "max"
 			},
-			"applyPatchToolType": "freeform"
+			"applyPatchToolType": "freeform",
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 10,
+					"output": 45,
+					"cacheRead": 1,
+					"cacheWrite": 12.5
+				}
+			}
 		},
 		"gpt-5.6-terra": {
 			"id": "gpt-5.6-terra",
@@ -58502,10 +58564,10 @@
 				"image"
 			],
 			"cost": {
-				"input": 2.5,
-				"output": 15,
-				"cacheRead": 0.25,
-				"cacheWrite": 3.125
+				"input": 2,
+				"output": 12,
+				"cacheRead": 0.2,
+				"cacheWrite": 2.5
 			},
 			"contextWindow": 1050000,
 			"maxTokens": 128000,
@@ -58514,7 +58576,16 @@
 				"minLevel": "low",
 				"maxLevel": "max"
 			},
-			"applyPatchToolType": "freeform"
+			"applyPatchToolType": "freeform",
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 4,
+					"output": 18,
+					"cacheRead": 0.4,
+					"cacheWrite": 5
+				}
+			}
 		},
 		"gpt-image-2": {
 			"id": "gpt-image-2",
@@ -59224,10 +59295,10 @@
 				"image"
 			],
 			"cost": {
-				"input": 1,
-				"output": 6,
-				"cacheRead": 0.1,
-				"cacheWrite": 1.25
+				"input": 0.2,
+				"output": 1.2,
+				"cacheRead": 0.02,
+				"cacheWrite": 0.25
 			},
 			"contextWindow": 272000,
 			"maxTokens": 128000,
@@ -59238,7 +59309,16 @@
 				"minLevel": "low",
 				"maxLevel": "max"
 			},
-			"applyPatchToolType": "freeform"
+			"applyPatchToolType": "freeform",
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 0.4,
+					"output": 1.8,
+					"cacheRead": 0.04,
+					"cacheWrite": 0.5
+				}
+			}
 		},
 		"gpt-5.6-sol": {
 			"id": "gpt-5.6-sol",
@@ -59266,7 +59346,16 @@
 				"minLevel": "low",
 				"maxLevel": "max"
 			},
-			"applyPatchToolType": "freeform"
+			"applyPatchToolType": "freeform",
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 10,
+					"output": 45,
+					"cacheRead": 1,
+					"cacheWrite": 12.5
+				}
+			}
 		},
 		"gpt-5.6-terra": {
 			"id": "gpt-5.6-terra",
@@ -59280,10 +59369,10 @@
 				"image"
 			],
 			"cost": {
-				"input": 2.5,
-				"output": 15,
-				"cacheRead": 0.25,
-				"cacheWrite": 3.125
+				"input": 2,
+				"output": 12,
+				"cacheRead": 0.2,
+				"cacheWrite": 2.5
 			},
 			"contextWindow": 272000,
 			"maxTokens": 128000,
@@ -59294,7 +59383,16 @@
 				"minLevel": "low",
 				"maxLevel": "max"
 			},
-			"applyPatchToolType": "freeform"
+			"applyPatchToolType": "freeform",
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 4,
+					"output": 18,
+					"cacheRead": 0.4,
+					"cacheWrite": 5
+				}
+			}
 		},
 		"gpt-image-2": {
 			"id": "gpt-image-2",
@@ -85511,4 +85609,4 @@
 			}
 		}
 	}
-}
+}

package/src/models.ts

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { getOpenAIModelCost } from "./model-pricing";
 import { isRetiredModelKey } from "./model-retirements";
 import { applyGeneratedModelPolicies, enrichModelThinking } from "./model-thinking";
 // `with { type: "file" }` is embedded by `bun build --compile` and resolves to
@@ -92,10 +93,12 @@ export function getBundledModels(provider: GeneratedProvider): Model<Api>[] {
 }
 
 export function calculateCost<TApi extends Api>(model: Model<TApi>, usage: Usage): Usage["cost"] {
-	usage.cost.input = (model.cost.input / 1000000) * usage.input;
-	usage.cost.output = (model.cost.output / 1000000) * usage.output;
-	usage.cost.cacheRead = (model.cost.cacheRead / 1000000) * usage.cacheRead;
-	usage.cost.cacheWrite = (model.cost.cacheWrite / 1000000) * usage.cacheWrite;
+	const inputTokens = usage.input + usage.cacheRead + usage.cacheWrite;
+	const pricing = getOpenAIModelCost(model, inputTokens) ?? model.cost;
+	usage.cost.input = (pricing.input / 1000000) * usage.input;
+	usage.cost.output = (pricing.output / 1000000) * usage.output;
+	usage.cost.cacheRead = (pricing.cacheRead / 1000000) * usage.cacheRead;
+	usage.cost.cacheWrite = (pricing.cacheWrite / 1000000) * usage.cacheWrite;
 	usage.cost.total = usage.cost.input + usage.cost.output + usage.cost.cacheRead + usage.cost.cacheWrite;
 	return usage.cost;
 }

package/src/prompts/composer-bash-policy-recovery.md

@@ -0,0 +1 @@
+A Composer bash policy block interrupted a shell attempt. This is not a terminal condition: continue the same task now. Do not retry repository file I/O in bash. Use the dedicated find, search, read, and edit tools for repository work, then continue with the next safe step.

package/src/prompts/cursor-composer-bash-policy-recovery.md

@@ -0,0 +1 @@
+A Composer bash policy block interrupted a shell attempt. This is not a terminal condition: continue the same task now. Do not retry repository file I/O in shell. Use Cursor-native read for files or directories, grep for search or globs, write for changes, and delete only when deletion is required; then continue with the next safe step.

package/src/prompts/cursor-composer-edit-discipline.md

@@ -0,0 +1,7 @@
+File-editing discipline for this Cursor Composer harness (this OVERRIDES contrary habits from your training):
+
+- Inspect repository files ONLY with Cursor-native read and grep: use read for file bodies or directories, and grep for content search or glob discovery. NEVER inspect repository files through shell commands (ls, find, fd, cat, sed, awk, grep, rg, head, tail, less, more) or scripts.
+- Modify files ONLY with Cursor-native write, or delete only when deletion is required. NEVER mutate files through shell redirection, tee, sed -i, perl -pi, inline python/node/bun scripts, or other out-of-band writes.
+- Re-read a file after any write before relying on its contents again. Do not fabricate line anchors, paths, tool names, or tool-call arguments.
+- Tool-call arguments must be the exact schema object requested by the native tool. Do not include Markdown, commentary, analysis text, or invented fields inside tool arguments.
+- Use shell only for terminal operations such as tests, builds, package scripts, and git commands. A shell command string must contain only the command itself; NEVER interleave reasoning or commentary into command strings or heredocs.

package/src/provider-models/descriptors.ts

@@ -48,7 +48,12 @@ import {
 	xiaomiModelManagerOptions,
 	zenmuxModelManagerOptions,
 } from "./openai-compat";
-import { cursorModelManagerOptions, glmZcodeModelManagerOptions, zaiModelManagerOptions } from "./special";
+import {
+	cursorModelManagerOptions,
+	glmZcodeModelManagerOptions,
+	openCodexModelManagerOptions,
+	zaiModelManagerOptions,
+} from "./special";
 
 /** Catalog discovery configuration for providers that support endpoint-based model listing. */
 export interface CatalogDiscoveryConfig {
@@ -139,6 +144,7 @@ export const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[] = [
 		catalog("Alibaba Token Plan", ["ALIBABA_TOKEN_PLAN_API_KEY"], { oauthProvider: "alibaba-token-plan" }),
 	),
 	descriptor("openai", "gpt-5.4", config => openaiModelManagerOptions(config)),
+	descriptor("opencodex", "gpt-5.4", () => openCodexModelManagerOptions(), { allowUnauthenticated: true }),
 	descriptor("groq", "openai/gpt-oss-120b", config => groqModelManagerOptions(config)),
 	catalogDescriptor(
 		"huggingface",

package/src/provider-models/special.ts

@@ -1,6 +1,14 @@
 import { once } from "@gajae-code/utils";
 import type { ModelManagerOptions } from "../model-manager";
+import { fetchOpenCodexModels, OPENCODEX_MODEL_CACHE_TTL_MS } from "../providers/openai-opencodex-responses";
 import { fetchCodexModels } from "../utils/discovery/codex";
+export function openCodexModelManagerOptions(): ModelManagerOptions<"openai-responses"> {
+	return {
+		providerId: "opencodex",
+		cacheTtlMs: OPENCODEX_MODEL_CACHE_TTL_MS,
+		fetchDynamicModels: fetchOpenCodexModels,
+	};
+}
 
 // ---------------------------------------------------------------------------
 // OpenAI code provider

package/src/providers/composer-discipline.ts

@@ -1,3 +1,9 @@
+import composerBashPolicyRecoveryPrompt from "../prompts/composer-bash-policy-recovery.md" with { type: "text" };
+import cursorComposerBashPolicyRecoveryPrompt from "../prompts/cursor-composer-bash-policy-recovery.md" with {
+	type: "text",
+};
+import cursorComposerEditDisciplinePrompt from "../prompts/cursor-composer-edit-discipline.md" with { type: "text" };
+
 /**
  * Anchor/edit discipline for composer-harness models (xai grok-composer-*,
  * cursor composer-*).
@@ -30,6 +36,47 @@ export function isComposerHarnessModel(modelId: string): boolean {
 	return COMPOSER_MODEL_ID_PATTERN.test(modelId);
 }
 
+/** Stable text contract for a local shell rejection caused by Composer file-I/O discipline. */
+export const COMPOSER_BASH_POLICY_ERROR_PREFIX = "Composer bash policy blocked repository file I/O.";
+export const COMPOSER_BASH_POLICY_ERROR_CODE = "composer-bash-policy:repository-file-io";
+
+export type ComposerBashPolicyToolSurface = "generic" | "cursor";
+
+/**
+ * Format the model-visible policy rejection with a stable marker and the tool
+ * vocabulary the model actually receives on this provider surface.
+ */
+export function formatComposerBashPolicyError(surface: ComposerBashPolicyToolSurface = "generic"): string {
+	const recovery =
+		surface === "cursor"
+			? "Continue the same task with Cursor-native read, grep, write, or delete tools; do not retry repository file I/O through shell."
+			: "Continue the same task with find, search, read, and edit tools; do not retry repository file I/O through bash.";
+	return `${COMPOSER_BASH_POLICY_ERROR_PREFIX} [${COMPOSER_BASH_POLICY_ERROR_CODE}] Recovery required: ${recovery}`;
+}
+
+/**
+ * Matches both the structured current error and the original prefix so a
+ * resumed session can recover after an upgrade without string-version skew.
+ */
+export function isComposerBashPolicyBlockedError(text: string): boolean {
+	return text.includes(COMPOSER_BASH_POLICY_ERROR_PREFIX);
+}
+
+/**
+ * Matches only errors emitted directly by the current policy implementation.
+ * Live recovery must use this strict form so failed shell output that merely
+ * quotes a policy error cannot masquerade as the policy gate itself.
+ */
+export function isCurrentComposerBashPolicyBlockedError(text: string): boolean {
+	return text === formatComposerBashPolicyError("generic") || text === formatComposerBashPolicyError("cursor");
+}
+
+/** One bounded, tool-enabled retry instruction for generic Composer agent loops. */
+export const COMPOSER_BASH_POLICY_RECOVERY_PROMPT = composerBashPolicyRecoveryPrompt;
+
+/** One bounded, tool-enabled retry instruction for Cursor's native remote tool surface. */
+export const CURSOR_COMPOSER_BASH_POLICY_RECOVERY_PROMPT = cursorComposerBashPolicyRecoveryPrompt;
+
 export const COMPOSER_EDIT_DISCIPLINE_PROMPT = `File-editing discipline for this Composer harness (this OVERRIDES contrary habits from your training):
 
 - Discover file names ONLY with the find tool; search file contents ONLY with the search tool; read file bodies or line ranges ONLY with the read tool. NEVER inspect repository files through shell commands (ls, find, fd, cat, sed, awk, grep, rg, head, tail, less, more) or scripts — that output carries no hashline anchors and bypasses the agent's safety limits.
@@ -39,3 +86,10 @@ export const COMPOSER_EDIT_DISCIPLINE_PROMPT = `File-editing discipline for this
 - If an edit is rejected with "anchors do not match", the rejection message prints the current lines WITH fresh anchors. Retry using exactly those printed anchors.
 - Tool-call arguments must be the exact JSON/schema object requested by the tool. Do not include Markdown, commentary, analysis text, or invented fields inside tool arguments.
 - Use bash only for terminal operations such as tests, builds, package scripts, and git commands. A shell command string must contain only the command itself; NEVER interleave reasoning or commentary into command strings or heredocs.`;
+
+/**
+ * Cursor executes a different native tool vocabulary from the generic agent
+ * loop. Keep this prompt separate so Composer is never told to call `edit`,
+ * `find`, or `search` when those names are unavailable remotely.
+ */
+export const CURSOR_COMPOSER_EDIT_DISCIPLINE_PROMPT = cursorComposerEditDisciplinePrompt;

package/src/providers/cursor.ts

@@ -30,7 +30,7 @@ import { AssistantMessageEventStream } from "../utils/event-stream";
 import { parseStreamingJson } from "../utils/json-parse";
 import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
 import { flattenToolRootCombinators, toolWireSchema } from "../utils/schema";
-import { COMPOSER_EDIT_DISCIPLINE_PROMPT, isComposerHarnessModel } from "./composer-discipline";
+import { CURSOR_COMPOSER_EDIT_DISCIPLINE_PROMPT, isComposerHarnessModel } from "./composer-discipline";
 import { CURSOR_CLIENT_VERSION } from "./cursor/client-version";
 import type { McpToolDefinition } from "./cursor/gen/agent_pb";
 import {
@@ -2329,7 +2329,7 @@ export function buildCursorSystemPromptJsons(systemPrompt: readonly string[] | u
 	// Composer-harness models need anchor/edit discipline pinned ahead of any
 	// host/default prompt (see composer-discipline.ts for the observed failure modes).
 	if (modelId !== undefined && isComposerHarnessModel(modelId)) {
-		jsons.unshift(JSON.stringify({ role: "system", content: COMPOSER_EDIT_DISCIPLINE_PROMPT }));
+		jsons.unshift(JSON.stringify({ role: "system", content: CURSOR_COMPOSER_EDIT_DISCIPLINE_PROMPT }));
 	}
 	return jsons;
 }

package/src/providers/openai-codex/response-handler.ts

@@ -19,6 +19,9 @@ export type CodexErrorInfo = {
 	rateLimits?: CodexRateLimits;
 	raw?: string;
 };
+// Matches the gate's bare rejection body ("Request blocked." / "Request
+// blocked (…)") but never messages that merely mention blocking mid-text.
+const REQUEST_BLOCKED_MESSAGE_RE = /^\s*request blocked\b/i;
 
 export async function parseCodexError(response: Response): Promise<CodexErrorInfo> {
 	const raw = await response.text();
@@ -28,7 +31,7 @@ export async function parseCodexError(response: Response): Promise<CodexErrorInf
 	let code: string | undefined;
 
 	try {
-		const parsed = JSON.parse(raw) as { error?: Record<string, unknown> };
+		const parsed = JSON.parse(raw) as { error?: Record<string, unknown>; detail?: unknown };
 		const err = parsed?.error ?? {};
 
 		const headers = response.headers;
@@ -67,11 +70,30 @@ export async function parseCodexError(response: Response): Promise<CodexErrorInf
 		}
 
 		const errMessage = (err as { message?: string }).message;
-		message = errMessage || friendlyMessage || message;
+		// The chatgpt.com/backend-api gate rejects with a bare-`detail` body
+		// (`{"detail": "Request blocked."}`) that carries no `error.*` envelope.
+		const detail =
+			typeof parsed?.detail === "string"
+				? parsed.detail
+				: typeof (parsed?.detail as { message?: unknown } | undefined)?.message === "string"
+					? (parsed.detail as { message: string }).message
+					: undefined;
+		message = errMessage || detail || friendlyMessage || message;
 	} catch {
 		// raw body not JSON
 	}
 
+	// A bare "Request blocked" body (detail-shaped JSON or plain text) is the
+	// pre-model gate's form of the deterministic `invalid_prompt` content
+	// rejection. It never carries a structured code, so classify it explicitly
+	// here; otherwise `isInvalidPromptError`, the codex non-retryable event set,
+	// and the session-level circuit breaker all miss it and the failure surfaces
+	// as an unexplained, unrepairable "Request Blocked".
+	if (!code && REQUEST_BLOCKED_MESSAGE_RE.test(message)) {
+		code = "invalid_prompt";
+		friendlyMessage = `${message.trim().replace(/\.+$/, "")} (code=invalid_prompt)`;
+	}
+
 	return {
 		message,
 		status: response.status,

package/src/providers/openai-codex-responses.ts

@@ -2823,7 +2823,7 @@ export function convertOpenAICodexResponsesTools(
 	model: Model<"openai-codex-responses">,
 ): CodexToolPayload[] {
 	const allowFreeform = supportsFreeformApplyPatchCodex(model);
-	return tools.map((tool): CodexToolPayload => {
+	const payloads = tools.map((tool): CodexToolPayload => {
 		if (allowFreeform && tool.customFormat) {
 			return {
 				type: "custom",
@@ -2847,6 +2847,10 @@ export function convertOpenAICodexResponsesTools(
 			...(effectiveStrict && { strict: true }),
 		};
 	});
+	// Tool definitions bypass the `input`/`instructions` sanitizers, so a
+	// leaked Harmony marker in an MCP/skill tool description or schema string
+	// makes the gate reject every request (bare `Request blocked`).
+	return neutralizeResponsesInputControlTokens(payloads);
 }
 
 function getString(value: unknown): string | undefined {