@iislee/opencodex 2.11.0 → 2.35.0

package/src/adapters/identity.ts

@@ -1,5 +1,5 @@
 /**
- * Central identity neutralization.
+ * Central routed-model identity repair.
  *
  * Codex sends the SAME GPT-5 identity line to EVERY model at request time (the per-model catalog
  * `base_instructions` is ignored on the wire). For routed, non-OpenAI providers that line is both
@@ -8,10 +8,11 @@
  * into the upstream payload — a signature no first-party client (Claude Code, Gemini CLI, Kiro) ever
  * sends, and a likely ToS trigger.
  *
- * The neutral replacement keeps ONLY the necessary instruction (don't misreport as GPT-5/OpenAI)
- * and names no proxy. Provider-native identity blocks (e.g. the anthropic OAuth "You are a Claude
- * agent..." prefix) are layered on TOP of this by the individual adapters; this module never claims
- * to be a specific first-party client.
+ * The replacement keeps the necessary instruction (don't misreport as GPT-5/OpenAI), names the
+ * model id that is actually sent on the wire when it is safe to interpolate, and names no proxy.
+ * Provider-native identity blocks (e.g. the anthropic OAuth "You are a Claude agent..." prefix)
+ * are layered on TOP of this by the individual adapters; this module never claims to be a specific
+ * first-party client.
  */
 
 /** Historical exact identity line Codex injected for every model. */
@@ -37,7 +38,39 @@ export const NEUTRAL_IDENTITY_LINE = "You are a coding agent. Do not claim to be
  * the leak can't reappear in one adapter while being fixed in another.
  */
 export function neutralizeIdentity(systemText: string): string {
-  return systemText.replace(CODEX_GPT5_IDENTITY_RE, NEUTRAL_IDENTITY_LINE);
+  // A callback avoids `$&`, `$'`, and other replacement-string substitutions if this constant ever
+  // becomes configurable. Keep the same safe form in identifyRoutedModel below.
+  return systemText.replace(CODEX_GPT5_IDENTITY_RE, () => NEUTRAL_IDENTITY_LINE);
+}
+
+function safeRoutedModelIdentity(modelName: string): string | null {
+  // Callers pass the model id after adapter-specific wire normalization. Brackets remain valid for
+  // providers that intentionally send a suffix such as `[1m]`; the OpenAI-chat adapter strips that
+  // suffix before calling us only when modelSuffixBracketStrip is enabled.
+  const trimmed = modelName.trim();
+  if (trimmed.length === 0 || trimmed.length > 128) return null;
+  const allowedPunctuation = "._/@:+-[]~";
+  for (const char of trimmed) {
+    const code = char.charCodeAt(0);
+    const isAsciiAlphaNumeric = (code >= 48 && code <= 57)
+      || (code >= 65 && code <= 90)
+      || (code >= 97 && code <= 122);
+    if (!isAsciiAlphaNumeric && !allowedPunctuation.includes(char)) return null;
+  }
+  return trimmed;
+}
+
+/**
+ * Identity for a routed model. Callers pass the concrete model id that will be sent upstream, so
+ * identity questions can name it instead of falling back to Codex/GPT identity inherited from the
+ * native template.
+ */
+export function identifyRoutedModel(systemText: string, modelName: string): string {
+  const identity = safeRoutedModelIdentity(modelName);
+  const replacement = identity
+    ? `You are a coding agent powered by the ${identity}. If asked which model you are, identify as ${identity}. Do not claim to be a different model or to have a different creator.`
+    : "You are a coding agent powered by the configured model. If asked which model you are, identify as configured model. Do not claim to be GPT-5 or made by OpenAI.";
+  return systemText.replace(CODEX_GPT5_IDENTITY_RE, () => replacement);
 }
 
 /** The catalog (static, on-disk) replacement for `base_instructions`. Same neutral wording. */

package/src/adapters/image.ts

@@ -18,6 +18,6 @@ export function parseDataUrl(url: string): { mediaType: string; base64: string }
  */
 export function contentPartsToText(content: string | OcxContentPart[]): string {
   if (typeof content === "string") return content;
-  const text = content.map(p => (p.type === "text" ? p.text : "[image]")).join("");
+  const text = content.map(p => p.type === "text" ? p.text : p.type === "image" ? "[image]" : "[video]").join("");
   return text || "[image]";
 }

package/src/adapters/kiro-constants.ts

@@ -1,4 +1,19 @@
 export const KIRO_COMPLETION_TOOL_NAME = "codex_kiro_final_answer";
+
+/**
+ * Request-scoped CodeWhisperer service profile for AWS Builder ID accounts.
+ *
+ * Builder ID is a personal identity with no AWS account behind it, so AWS never mints an
+ * account-scoped `profile/<id>` ARN for it. The Kiro CLI resolves this the same way: it carries
+ * this fixed service profile on Builder ID requests. The embedded account id is Amazon's own, not
+ * the user's, which is why sending it is not the same as synthesizing an account identity.
+ *
+ * Request-scoped is load-bearing. This value must never be persisted into `KiroOAuthMetadata`,
+ * never seed region inference (it is `us-east-1` and would pin every Builder ID account there),
+ * and never participate in account matching.
+ */
+export const KIRO_BUILDER_ID_SERVICE_PROFILE_ARN =
+  "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX";
 export const KIRO_CONTINUATION_MESSAGE =
   "Continue from the prior conversation. Do not quote or mention this instruction.";
 export const KIRO_COMPLETION_RETRY_MESSAGE =
@@ -7,6 +22,18 @@ export const KIRO_COMPLETION_RETRY_MESSAGE =
 export const KIRO_TOOL_RESULT_CARRIER_MESSAGE = "The requested tool result is attached.";
 export const KIRO_EMPTY_TOOL_RESULT_MESSAGE = "The tool completed without textual output.";
 
+/**
+ * Placeholder for the user turn Kiro requires after an assistant turn that ALREADY delivered its
+ * final answer.
+ *
+ * The protocol needs a trailing user turn, but the usual continuation/retry text instructs the
+ * model to keep working, which reopens a finished task and reads as a still-open goal. This states
+ * the delivered state and explicitly withholds a new request, so the turn stays structurally valid
+ * without asking for more work.
+ */
+export const KIRO_ANSWER_DELIVERED_MESSAGE =
+  "The previous final answer was delivered to the user and that task is closed. No new request has been made yet. Do not repeat, revise, or continue that work; wait for the user's next instruction.";
+
 export const KIRO_COMPLETION_INSTRUCTIONS =
   `When tools are available, ordinary assistant text is mid-task commentary and does not end the turn. Continue using tools after progress updates. When the task is fully complete and no more tool calls are needed, call ${KIRO_COMPLETION_TOOL_NAME} exactly once with the complete user-facing final answer in \`answer\`. Do not provide the final answer as ordinary assistant text.`;
 

package/src/adapters/kiro-errors.ts

@@ -109,6 +109,17 @@ function classifyKiroFailure(
       retryable: false,
     };
   }
+  // #993: a gated model demanding a profileArn gets a stable, actionable code
+  // instead of the generic validation bucket. Non-retryable by definition.
+  if (evidence.includes("profilearn") && evidence.includes("required")) {
+    return {
+      message: "kiro_profile_required: Kiro requires a CodeWhisperer profileArn for this account and model. Re-login or re-import the matching Kiro account (ocx account login kiro --reauth) so the profile is captured, then retry.",
+      status: 400,
+      errorType: "invalid_request_error",
+      code: "kiro_profile_required",
+      retryable: false,
+    };
+  }
   if (
     evidence.includes("insufficient_quota")
     || evidence.includes("quota exhausted")

package/src/adapters/kiro-events.ts

@@ -3,7 +3,8 @@ import { kiroTruncationReason } from "./kiro-truncation";
 
 export type ParsedKiroEvent =
   | { type: "content"; data?: string; modelId?: string }
-  | { type: "reasoning"; data?: string }
+  | { type: "reasoning"; data?: string; redactedContent?: string }
+  | { type: "context_usage"; contextUsagePercentage: number }
   | { type: "tool"; name?: string; toolUseId?: string; input?: string; stop?: boolean }
   | { type: "truncation"; data: string }
   | { type: "metadata"; usage?: OcxUsage; contextUsagePercentage?: number; stopReason?: string }
@@ -17,6 +18,10 @@ const KNOWN_EVENT_TYPES = new Set([
   "toolUseEvent",
   "messageMetadataEvent",
   "metadataEvent",
+  // Authoritative context pressure. Every capture (kiro-cli 2.14.1 and 2.16.0) put the percentage
+  // HERE and left `metadataEvent` carrying only `stopReason`; metadataEvent's own
+  // contextUsagePercentage stays supported as a fallback rather than being dropped.
+  "contextUsageEvent",
   "invalidStateEvent",
   "error",
 ]);
@@ -114,11 +119,17 @@ export function parseKiroEvent(eventType: string, payload: Uint8Array): ParsedKi
           : {}),
       };
     case "reasoningContentEvent":
+      // `text` is plaintext reasoning; `redactedContent` is the encrypted blob the GPT-5.6 family
+      // (sol/terra/luna) actually returns — they never send `text`. Keyed off the wire field, not
+      // the model id. Both may be absent on a bare event.
       return {
         type: "reasoning",
         ...(optionalString(eventType, parsed, "text") !== undefined
           ? { data: optionalString(eventType, parsed, "text") }
           : {}),
+        ...(optionalString(eventType, parsed, "redactedContent") !== undefined
+          ? { redactedContent: optionalString(eventType, parsed, "redactedContent") }
+          : {}),
       };
     case "toolUseEvent":
       return {
@@ -161,6 +172,13 @@ export function parseKiroEvent(eventType: string, payload: Uint8Array): ParsedKi
         ...(stopReason !== undefined ? { stopReason } : {}),
       };
     }
+    case "contextUsageEvent": {
+      const contextUsagePercentage = parsed.contextUsagePercentage;
+      if (typeof contextUsagePercentage !== "number" || !Number.isFinite(contextUsagePercentage)) {
+        return malformed(eventType, "contextUsagePercentage must be a finite number");
+      }
+      return { type: "context_usage", contextUsagePercentage };
+    }
     case "invalidStateEvent":
       return { type: "invalid_state", message: optionalString(eventType, parsed, "message") };
     case "error":

package/src/adapters/kiro-thinking.ts

@@ -75,6 +75,14 @@ export class KiroThinkingParser {
     return [];
   }
 
+  /** Release any partial tag/content carry when the owning stream stops early. */
+  dispose(): void {
+    this.replaceCarry("preBuffer", "");
+    this.replaceCarry("thinkingBuffer", "");
+    this.closeTag = "";
+    this.state = "streaming";
+  }
+
   private drainThinking(): AdapterEvent[] {
     const close = this.closeTag;
     const idx = this.thinkingBuffer.indexOf(close);
@@ -89,8 +97,16 @@ export class KiroThinkingParser {
       return events;
     }
     if (this.thinkingBuffer.length <= MAX_CLOSE_TAG) return [];
-    const send = this.thinkingBuffer.slice(0, -MAX_CLOSE_TAG);
-    this.replaceCarry("thinkingBuffer", this.thinkingBuffer.slice(-MAX_CLOSE_TAG));
+    // Never split a surrogate pair at the send boundary: a lone high
+    // surrogate at the end of one delta encodes as U+FFFD. Move the cut one
+    // unit earlier so the whole pair stays in the carry.
+    let cut = this.thinkingBuffer.length - MAX_CLOSE_TAG;
+    if (cut > 0 && cut < this.thinkingBuffer.length) {
+      const atCut = this.thinkingBuffer.charCodeAt(cut - 1);
+      if (atCut >= 0xd800 && atCut <= 0xdbff) cut -= 1;
+    }
+    const send = this.thinkingBuffer.slice(0, cut);
+    this.replaceCarry("thinkingBuffer", this.thinkingBuffer.slice(cut));
     return send ? [{ type: "reasoning_raw_delta", text: send }] : [];
   }
 }

package/src/adapters/kiro-tools.ts

@@ -1,6 +1,7 @@
 import type { OcxParsedRequest, OcxTool } from "../types";
 import { namespacedToolName } from "../types";
 import { normalizeKiroModelId } from "../providers/kiro-models";
+import { isCodexCodeModeExecTool } from "./tool-catalog-nudge";
 import { createKiroToolNameRegistry, type KiroToolNameRegistry } from "./kiro-wire";
 
 const MAX_KIRO_TOOL_DESCRIPTION_UNVERIFIED = 1024;
@@ -103,7 +104,7 @@ function ensureRootObjectType(schema: unknown): Record<string, unknown> {
   // Seed with the root's own properties/required so a schema like
   // { type:"object", properties:{path}, required:["path"], oneOf:[...] } keeps them.
   if (obj.properties && typeof obj.properties === "object") {
-    Object.assign(props, sanitizeKiroSchema(obj.properties) as Record<string, unknown>);
+    Object.assign(props, sanitizeSchemaMap(obj.properties) as Record<string, unknown>);
   }
   if (Array.isArray(obj.required)) {
     for (const r of obj.required) if (typeof r === "string") required.add(r);
@@ -118,7 +119,7 @@ function ensureRootObjectType(schema: unknown): Record<string, unknown> {
       if (!variant || typeof variant !== "object" || Array.isArray(variant)) continue;
       const v = variant as Record<string, unknown>;
       if (v.properties && typeof v.properties === "object") {
-        Object.assign(props, sanitizeKiroSchema(v.properties) as Record<string, unknown>);
+        Object.assign(props, sanitizeSchemaMap(v.properties) as Record<string, unknown>);
       }
       if (mergeRequired && Array.isArray(v.required)) {
         for (const r of v.required) if (typeof r === "string") required.add(r);
@@ -149,7 +150,16 @@ function toolDescriptionLimit(modelId: string): number {
 function truncateDescription(description: string, limit: number): string {
   if (description.length <= limit) return description;
   if (limit <= 1) return description.slice(0, limit);
-  return `${description.slice(0, limit - 1)}…`;
+  let end = limit - 1;
+  // Never end the kept text on a lone high surrogate; one step back keeps
+  // the whole pair out instead of a U+FFFD-producing half.
+  if (description.charCodeAt(end - 1) >= 0xd800 && description.charCodeAt(end - 1) <= 0xdbff) end -= 1;
+  return `${description.slice(0, end)}…`;
+}
+
+/** Test-only: exercise the surrogate-safe description truncation directly. */
+export function truncateDescriptionForTests(description: string, limit: number): string {
+  return truncateDescription(description, limit);
 }
 
 function serializedToolCatalogBytes(tools: readonly unknown[]): number {
@@ -163,6 +173,18 @@ function omittedToolCatalogNotice(kept: number, omitted: readonly OcxTool[], reg
   return `[opencodex] Kiro's outbound catalog budget allows ${kept} of ${kept + omitted.length} client tools this turn. Omitted and unavailable this turn: ${summary}.`;
 }
 
+function boundedCatalogPriority(tool: OcxTool): number {
+  if (tool.loadedFromToolSearch) return 0;
+  // Codex code mode reaches shell, file edits, apply_patch and every MCP helper ONLY as nested
+  // `tools.<name>(...)` calls inside this one tool. Dropping it does not shrink the catalog, it
+  // makes the rest of the catalog uncallable -- so it outranks the search gateway and filler.
+  // It stays BEHIND `loadedFromToolSearch` because those are tools the model asked for by name
+  // this turn (#2475). Cursor pins its execution path the same way (request-builder.ts, #399).
+  if (isCodexCodeModeExecTool(tool)) return 1;
+  if (tool.toolSearch) return 2;
+  return 3;
+}
+
 export function convertKiroToolContext(
   parsed: OcxParsedRequest,
   registry: KiroToolNameRegistry = createKiroToolNameRegistry(),
@@ -172,9 +194,7 @@ export function convertKiroToolContext(
   // Validate every listed name even when tool_choice:none emulates a tool-free turn.
   for (const tool of tools) registry.alias(namespacedToolName(tool.namespace, tool.name));
   const effectiveTools = parsed.options.toolChoice === "none" ? [] : tools;
-  const convertedTools: unknown[] = [];
-  let omittedAt = effectiveTools.length;
-  for (const [index, tool] of effectiveTools.entries()) {
+  const convertedEntries = effectiveTools.map((tool, index) => {
     const description = tool.description || `Tool: ${tool.name}`;
     // Send the full namespaced wire name (e.g. mcp__chrome-devtools__navigate_page) so Kiro echoes
     // it back; the bridge's toolNsMap is keyed by this name and restores the MCP namespace Codex
@@ -189,19 +209,47 @@ export function convertKiroToolContext(
         inputSchema: { json: ensureRootObjectType(sanitizeKiroSchema(tool.parameters ?? {})) },
       },
     };
-    // Preserve declaration order and only omit a suffix. Ranking tools would make a catalog change
-    // silently alter which capability disappears; this deterministic policy is paired with a
-    // model-visible omission notice so unavailable tools are explicit rather than assumed absent.
+    return { tool, index, converted };
+  });
+  const exceedsBudget = convertedEntries.length > MAX_KIRO_TOOL_COUNT
+    || serializedToolCatalogBytes(convertedEntries.map(entry => entry.converted)) > MAX_KIRO_TOOL_CATALOG_BYTES;
+  const candidates = exceedsBudget
+    ? convertedEntries.toSorted((a, b) => boundedCatalogPriority(a.tool) - boundedCatalogPriority(b.tool) || a.index - b.index)
+    : convertedEntries;
+  // Reserve a seat for the code-mode execution path before filling the rest.
+  //
+  // Priority alone cannot save it. `loadedFromToolSearch` tools outrank it and arrive unbounded
+  // (the Responses parser pushes every `tool_search_output` spec), so a session that accumulated
+  // MAX_KIRO_TOOL_COUNT loaded tools would exhaust the budget before reaching tier 1 and drop the
+  // one tool through which all of them are actually callable.
+  //
+  // Reservation rather than eviction: this lowers the room the fill loop sees, so it admits one
+  // fewer tool. It never removes a tool that already fit, which is what keeps #2475's loaded-result
+  // guarantee intact -- Cursor's `evictNonExecutionPath` exempts only the execution path and could
+  // evict a loaded tool instead.
+  const reserved = candidates.find(entry => isCodexCodeModeExecTool(entry.tool));
+  const admitted = new Set<number>();
+  const filled: unknown[] = [];
+  for (const entry of candidates) {
+    if (entry === reserved) continue;
+    // Measure the projected FINAL array: the byte budget is computed over the serialized array, so
+    // subtracting a standalone size would misjudge it by the separators JSON adds between entries.
+    const projected = reserved ? [...filled, entry.converted, reserved.converted] : [...filled, entry.converted];
     if (
-      convertedTools.length >= MAX_KIRO_TOOL_COUNT
-      || serializedToolCatalogBytes([...convertedTools, converted]) > MAX_KIRO_TOOL_CATALOG_BYTES
-    ) {
-      omittedAt = index;
-      break;
-    }
-    convertedTools.push(converted);
+      projected.length > MAX_KIRO_TOOL_COUNT
+      || serializedToolCatalogBytes(projected) > MAX_KIRO_TOOL_CATALOG_BYTES
+    ) break;
+    filled.push(entry.converted);
+    admitted.add(entry.index);
   }
-  const omittedTools = effectiveTools.slice(omittedAt);
+  if (reserved) admitted.add(reserved.index);
+  // Rebuild in sorted-candidate order so the wire order stays loaded -> exec -> gateway -> filler.
+  // Pushing the reserved entry after the loop would place it last instead.
+  const convertedTools = candidates.filter(entry => admitted.has(entry.index)).map(entry => entry.converted);
+  // Derive omissions by set difference. The old `candidates.slice(omittedAt)` assumed every
+  // candidate after the first rejection was omitted, which stops being true once one of them was
+  // reserved and admitted: the notice would name `exec` unavailable while it is on the wire.
+  const omittedTools = candidates.filter(entry => !admitted.has(entry.index)).map(entry => entry.tool);
   return {
     tools: convertedTools,
     systemAdditions: omittedTools.length > 0 ? [omittedToolCatalogNotice(convertedTools.length, omittedTools, registry)] : [],