@iislee/opencodex 2.11.0

package/src/adapters/azure.ts

@@ -0,0 +1,36 @@
+import type { IncomingMeta, ProviderAdapter } from "./base";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { createResponsesPassthroughAdapter } from "./openai-responses";
+
+export function createAzureAdapter(provider: OcxProviderConfig): ProviderAdapter & { passthrough: true } {
+  const inner = createResponsesPassthroughAdapter({
+    ...provider,
+    baseUrl: provider.baseUrl,
+  });
+
+  return {
+    ...inner,
+    name: "azure-openai",
+
+    async buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta) {
+      if (provider.authMode === "forward") {
+        throw new Error("azure-openai does not support forward auth mode");
+      }
+      if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
+        throw new Error("azure-openai requires a non-empty apiKey");
+      }
+
+      const request = await inner.buildRequest(parsed, incoming);
+      const unresolvedPlaceholder = request.url.match(/\{[^}]*\}/)?.[0] ?? request.url.match(/[{}]/)?.[0];
+      if (unresolvedPlaceholder) {
+        throw new Error(`azure-openai baseUrl contains unresolved ${unresolvedPlaceholder} — set your real resource URL`);
+      }
+
+      const headers = { ...request.headers };
+      headers["api-key"] = provider.apiKey;
+      delete headers["Authorization"];
+      // The inner adapter always targets Azure's v1 API here, which needs no api-version query.
+      return { ...request, headers };
+    },
+  };
+}

package/src/adapters/base.ts

@@ -0,0 +1,72 @@
+import type { AdapterEvent, OcxParsedRequest } from "../types";
+import type { TranslatorBudget } from "../lib/translator-budget";
+
+/** Metadata about the caller's incoming request, for auth-forwarding adapters. */
+export interface IncomingMeta {
+  headers: Headers;
+  translatorBudget: TranslatorBudget;
+  abortSignal?: AbortSignal;
+  /**
+   * Image-normalization ladder bias for upstream-413 tightened retries: every image
+   * starts one tier lower (devlog/260714_image_normalization_pipeline/030). Only the
+   * anthropic adapter consumes it; others ignore it.
+   */
+  imageTierBias?: number;
+}
+
+export interface ProviderAdapter {
+  name: string;
+
+  /**
+   * Convert an already-read provider HTTP error into client-safe text. This hook must be pure and
+   * return fully redacted output: callers may pass untrusted provider headers and payload text.
+   */
+  formatErrorBody?(status: number, headers: Headers, payloadText: string): string;
+
+  /**
+   * Build the upstream request. May be async: adapters that resolve a short-lived credential
+   * (e.g. Vertex AI ADC token) return a Promise. Sync adapters return the object directly; callers
+   * must `await` the result (awaiting a non-Promise is a no-op).
+   */
+  buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta): AdapterRequest | Promise<AdapterRequest>;
+
+  fetchResponse?(request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response>;
+
+  parseStream(response: Response, budget: TranslatorBudget): AsyncGenerator<AdapterEvent>;
+  parseResponse?(response: Response, budget: TranslatorBudget): Promise<AdapterEvent[]>;
+  runTurn?(
+    parsed: OcxParsedRequest,
+    incoming: IncomingMeta,
+    emit: (event: AdapterEvent) => void,
+  ): Promise<void>;
+}
+
+export interface AdapterRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    /** Releases observation of a serialized request body after its final fetch attempt settles. */
+    releaseBodyObservation?: () => void;
+    /** Exact reasoning parameter emitted by the adapter, for request-log diagnostics only. */
+    reasoningLog?: {
+      effectiveEffort: string;
+      wireField: "reasoning_effort" | "thinking_budget" | "thinking.type";
+      wireValue: string | number;
+    };
+    usageLog?: {
+      inputTokens?: number;
+      estimated?: boolean;
+    };
+}
+
+export interface AdapterFetchContext {
+  /** Remains attached to the returned response body after the response headers arrive. */
+  abortSignal?: AbortSignal;
+  /** Deadline for receiving response headers on each attempt, not for consuming the response body. */
+  timeoutMs?: number;
+  /** Return final non-2xx responses untouched so the caller can own the error-body read. */
+  returnRawErrors?: boolean;
+  /** Whether the upstream response will be consumed as a stream; adapters may select low-latency transport settings. */
+  stream?: boolean;
+}

package/src/adapters/client-fingerprint.ts

@@ -0,0 +1,59 @@
+/**
+ * First-party client fingerprints.
+ *
+ * Routed OAuth providers reject — or quietly flag — requests whose header signature doesn't match
+ * the real first-party client that minted the token. Sending a valid OAuth token with an empty
+ * header set (or a giveaway literal UA like "antigravity") is a non-first-party signature. These
+ * constants mirror the headers the real Claude Code CLI and Antigravity CLI send, so the proxy's
+ * request fingerprint matches the credential.
+ *
+ * Pinned versions live HERE (single source) so they're trivial to bump. Values that need a live
+ * manifest fetch (Antigravity auto-updater) or a cryptographic billing signature (Claude cch) are
+ * intentionally NOT modeled — those are brittle and a wrong guess does more harm than the gap.
+ */
+import { createHash } from "node:crypto";
+
+// ── Claude Code CLI (matches Claude Code 2.1.63 / @anthropic-ai/sdk 0.74.0) ──
+export const CLAUDE_CODE_HEADERS: Record<string, string> = {
+  "X-App": "cli",
+  "X-Stainless-Retry-Count": "0",
+  "X-Stainless-Runtime": "node",
+  "X-Stainless-Lang": "js",
+  "X-Stainless-Timeout": "600",
+  "X-Stainless-Arch": process.arch,
+  "X-Stainless-OS": process.platform,
+  "X-Stainless-Package-Version": "0.74.0",
+  "X-Stainless-Runtime-Version": process.version.slice(1),
+};
+
+/**
+ * Stable per-credential session id, matching Claude Code's `X-Claude-Code-Session-Id`. Real Claude
+ * Code keeps one session id per CLI session; we derive a deterministic UUIDv4-shaped id from the
+ * OAuth token so it stays stable across a conversation's turns without persisting state. The token
+ * itself never leaves this function (only its hash drives the id).
+ */
+export function claudeCodeSessionId(token: string | undefined): string {
+  const seed = token && token.length > 0 ? token : "opencodex-anon";
+  const h = createHash("sha256").update(`claude-code-session:${seed}`, "utf8").digest("hex");
+  // Shape the hash into a v4-looking UUID (version nibble 4, variant nibble 8-b).
+  const variant = ((parseInt(h[16], 16) & 0x3) | 0x8).toString(16);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-${variant}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+
+// ── Antigravity CLI ──
+/** Pinned fallback Antigravity CLI version (real client fetches a manifest; we pin to avoid the network dependency). */
+export const ANTIGRAVITY_CLI_VERSION = "1.0.13";
+const ANTIGRAVITY_CLI_CLIENT_NAME = "aidev_client";
+const ANTIGRAVITY_CLI_PLATFORM = "darwin/arm64";
+/** Secondary Google API client UA the Antigravity client library reports. */
+export const ANTIGRAVITY_GOOG_API_CLIENT_UA = "google-api-nodejs-client/10.3.0";
+
+/**
+ * The real Antigravity CLI User-Agent, e.g.
+ * `antigravity/cli/1.0.13 (aidev_client; os_type=darwin; arch=arm64)`.
+ * A `GOOGLE_ANTIGRAVITY_USER_AGENT` override (set by the caller) takes precedence upstream.
+ */
+export function antigravityUserAgent(version = ANTIGRAVITY_CLI_VERSION): string {
+  const [osType, arch] = ANTIGRAVITY_CLI_PLATFORM.split("/");
+  return `antigravity/cli/${version} (${ANTIGRAVITY_CLI_CLIENT_NAME}; os_type=${osType}; arch=${arch})`;
+}

package/src/adapters/cursor/arg-codec.ts

@@ -0,0 +1,38 @@
+import { fromBinary, toBinary, toJson } from "@bufbuild/protobuf";
+import { ValueSchema } from "@bufbuild/protobuf/wkt";
+import { textDecoder } from "./native-exec-common";
+
+function parseJsonText(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+
+export function decodeCursorArgValue(value: Uint8Array): unknown {
+  try {
+    const parsed = fromBinary(ValueSchema, value);
+    if (!sameBytes(toBinary(ValueSchema, parsed), value)) throw new Error("not canonical protobuf Value bytes");
+    const jsonValue = toJson(ValueSchema, parsed);
+    return typeof jsonValue === "string" ? parseJsonText(jsonValue) : jsonValue;
+  } catch {
+    return parseJsonText(textDecoder.decode(value));
+  }
+}
+
+export function decodeCursorArgsMap(args: { [key: string]: Uint8Array } | undefined): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(args ?? {})) {
+    out[key] = decodeCursorArgValue(value);
+  }
+  return out;
+}

package/src/adapters/cursor/arg-normalize.ts

@@ -0,0 +1,104 @@
+/**
+ * Schema-aware argument key normalization for Cursor tool calls.
+ *
+ * Cursor-trained models sometimes emit argument keys that differ from the tool's declared schema
+ * (e.g. `filepath` instead of `path`, `cmd` instead of `command`). This module maps common aliases
+ * to the canonical key name ONLY when the tool schema declares that canonical key. Keys already
+ * matching the schema are never touched.
+ *
+ * Derived from opencode-cursor reference (src/provider/tool-schema-compat.ts).
+ */
+
+const KEY_ALIASES = new Map<string, string>([
+  ["filepath", "path"],
+  ["filename", "path"],
+  ["file", "path"],
+  ["targetpath", "path"],
+  ["directorypath", "path"],
+  ["dir", "path"],
+  ["folder", "path"],
+  ["directory", "path"],
+  ["targetdirectory", "path"],
+  ["targetfile", "path"],
+  ["globpattern", "pattern"],
+  ["filepattern", "pattern"],
+  ["searchpattern", "pattern"],
+  ["includepattern", "include"],
+  ["workingdirectory", "cwd"],
+  ["workdir", "cwd"],
+  ["currentdirectory", "cwd"],
+  ["cmd", "command"],
+  ["script", "command"],
+  ["shellcommand", "command"],
+  ["terminalcommand", "command"],
+  ["contents", "content"],
+  ["text", "content"],
+  ["body", "content"],
+  ["data", "content"],
+  ["payload", "content"],
+  ["streamcontent", "content"],
+  ["oldstring", "old_string"],
+  ["newstring", "new_string"],
+  ["oldtext", "old_string"],
+  ["newtext", "new_string"],
+  ["oldcontent", "old_string"],
+  ["newcontent", "new_string"],
+  ["recursive", "force"],
+]);
+
+/**
+ * Extract the set of declared property names from a JSON Schema parameters object.
+ * Handles the common `{ type: "object", properties: { ... } }` shape.
+ */
+function schemaPropertyNames(schema: unknown): Set<string> | undefined {
+  if (!schema || typeof schema !== "object") return undefined;
+  const obj = schema as Record<string, unknown>;
+  const props = obj.properties;
+  if (!props || typeof props !== "object") return undefined;
+  return new Set(Object.keys(props as Record<string, unknown>));
+}
+
+/**
+ * Normalize argument keys against the tool's declared schema. Keys not in the schema that have a
+ * known alias pointing to a schema-declared key are renamed. Explicitly supplied canonical keys
+ * always win over aliases, regardless of object property insertion order — conflicting aliases
+ * are discarded rather than left beside the canonical key.
+ *
+ * Returns the original object reference if no changes were needed (cheap identity check for callers).
+ */
+export function normalizeArgKeys(args: Record<string, unknown>, toolSchema: unknown): Record<string, unknown> {
+  const declared = schemaPropertyNames(toolSchema);
+  if (!declared || declared.size === 0) return args;
+
+  const suppliedCanonical = new Set<string>();
+  for (const key of Object.keys(args)) {
+    if (declared.has(key)) suppliedCanonical.add(key);
+  }
+
+  let changed = false;
+  const result: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(args)) {
+    if (declared.has(key)) {
+      result[key] = value;
+      continue;
+    }
+    const canonical = KEY_ALIASES.get(key.toLowerCase());
+    if (canonical && declared.has(canonical)) {
+      // Canonical was explicitly supplied (any order) — drop the alias entirely.
+      if (suppliedCanonical.has(canonical)) {
+        changed = true;
+        continue;
+      }
+      // First alias fills the canonical slot; later aliases for the same key are discarded.
+      if (!(canonical in result)) {
+        result[canonical] = value;
+        changed = true;
+      } else {
+        changed = true;
+      }
+      continue;
+    }
+    result[key] = value;
+  }
+  return changed ? result : args;
+}

package/src/adapters/cursor/cursor-errors.ts

@@ -0,0 +1,165 @@
+import { redactSecretString } from "../../lib/redact";
+
+const ABSOLUTE_PATH_PATTERN = /(?:\/Users\/[^ "';,]+|\/home\/[^ "';,]+|[A-Za-z]:\\Users\\[^ "';,]+)/g;
+// Cursor error messages can contain raw credential key=value pairs beyond what the shared
+// redactSecretString covers. We handle the additional transport-specific patterns locally.
+const CURSOR_CREDENTIAL_PATTERN = /\b(authorization|auth[_-]?token|cursor[_-]?token)=([^&\s"',;]+)/gi;
+
+function sanitize(value: string): string {
+  return redactSecretString(value)
+    .replace(CURSOR_CREDENTIAL_PATTERN, "$1=[REDACTED]")
+    .replace(ABSOLUTE_PATH_PATTERN, "[REDACTED_PATH]");
+}
+
+function errorMessage(value: unknown): string {
+  if (value instanceof Error) return value.message;
+  if (typeof value === "string") return value;
+  return String(value ?? "");
+}
+
+function errorCode(value: unknown): string {
+  if (typeof value !== "object" || !value || !("code" in value)) return "";
+  const code = (value as { code?: unknown }).code;
+  return code === undefined || code === null ? "" : String(code);
+}
+
+/**
+ * True when Cursor intentionally cancelled the HTTP/2 stream after a client-tool suspend.
+ * These are expected between multi-turn Responses bridge cycles, not upstream failures.
+ */
+export function isCursorBenignCancelError(value: unknown): boolean {
+  const message = errorMessage(value).toLowerCase();
+  const code = errorCode(value).toUpperCase();
+  if (code === "NGHTTP2_CANCEL") return true;
+  if (message.includes("nghttp2_cancel")) return true;
+  if (message.includes("cursor stream suspended")) return true;
+  return false;
+}
+
+/**
+ * True when Cursor Connect rejected the turn with invalid_argument.
+ * Seen after stepCompleted on brittle external-model continuations.
+ */
+export function isCursorInvalidArgumentError(value: unknown): boolean {
+  const code = errorCode(value).toLowerCase();
+  if (code === "invalid_argument") return true;
+  const message = errorMessage(value).toLowerCase();
+  return message.includes("invalid_argument");
+}
+
+const QUOTA_RATE_CUES = ["too many requests", "quota", "rate limit", "rate-limit", "throttl"];
+const REQUEST_TOO_LARGE_PATTERNS: (string | RegExp)[] = [
+  "tool catalog too large",
+  "tool registration too large",
+  "too many tools",
+  "message too large",
+  "payload too large",
+  "request too large",
+  // Size cue required somewhere: a bare "request exceeds ... limit" (concurrency/quota
+  // shape) must NOT match, but "request body/size exceeds ... limit" and
+  // "request exceeds maximum allowed size" are deterministic overflow (WP3 r1/r2).
+  /request exceeds .*size/,
+  /request (?:body|size) exceeds .*(?:size|limit)/,
+  "maximum allowed size",
+];
+
+/**
+ * True when a resource_exhausted detail names a request-size overflow rather than quota.
+ * Quota/rate cues are rejected FIRST: "resource_exhausted while loading tool catalog: quota
+ * exhausted" is rate limiting, not a too-large request, even though it mentions the catalog.
+ */
+export function isCursorRequestTooLargeDetail(lowerMessage: string): boolean {
+  if (QUOTA_RATE_CUES.some(cue => lowerMessage.includes(cue))) return false;
+  return REQUEST_TOO_LARGE_PATTERNS.some(pattern =>
+    typeof pattern === "string" ? lowerMessage.includes(pattern) : pattern.test(lowerMessage),
+  );
+}
+
+/**
+ * Classify a Cursor transport/Connect/gRPC error message into an actionable category.
+ * The returned prefix string is recognized by `src/lib/errors.ts` `classifyError` keywords,
+ * so bridge-level error mapping produces the right Codex error type (rate_limit, auth, etc.).
+ */
+export function classifyCursorError(message: string): string {
+  const lower = message.toLowerCase();
+
+  if (isCursorBenignCancelError(message)) return "Cursor stream suspended";
+
+  if (
+    lower.includes("resource_exhausted") ||
+    lower.includes("resource exhausted")
+  ) {
+    // gRPC RESOURCE_EXHAUSTED is quota/rate exhaustion unless the detail names a
+    // request-size overflow (tool catalog/registration). Only the latter is a
+    // client-fixable 400; everything else surfaces as a 429 so Codex backs off
+    // instead of hammering retries (live evidence: 6x 400 retry storm, devlog
+    // 260723_cursor_context_continuity/000_plan.md).
+    return isCursorRequestTooLargeDetail(lower)
+      ? "Cursor resource limit exceeded"
+      : "Cursor rate limit exceeded";
+  }
+
+  if (
+    lower.includes("rate limit") ||
+    lower.includes("rate-limit") ||
+    lower.includes("too many requests") ||
+    lower.includes("throttling")
+  ) return "Cursor rate limit exceeded";
+
+  if (
+    lower.includes("unauthenticated") ||
+    lower.includes("unauthorized") ||
+    lower.includes("permission_denied") ||
+    lower.includes("permission denied") ||
+    lower.includes("forbidden") ||
+    lower.includes("invalid token") ||
+    lower.includes("expired token") ||
+    lower.includes("authentication") ||
+    lower.includes("access denied")
+  ) return "Cursor authentication failed";
+
+  if (
+    lower.includes("unavailable") ||
+    lower.includes("overloaded") ||
+    lower.includes("temporarily") ||
+    lower.includes("server is busy")
+  ) return "Cursor server overloaded";
+
+  if (
+    lower.includes("invalid") ||
+    lower.includes("not found") ||
+    lower.includes("unsupported") ||
+    lower.includes("malformed") ||
+    lower.includes("unimplemented")
+  ) return "Cursor invalid request";
+
+  if (
+    lower.includes("timed out") ||
+    lower.includes("timeout") ||
+    lower.includes("etimedout") ||
+    lower.includes("deadline")
+  ) return "Cursor request timed out";
+
+  if (
+    lower.includes("econnreset") ||
+    lower.includes("econnrefused") ||
+    lower.includes("goaway") ||
+    lower.includes("nghttp2") ||
+    lower.includes("socket hang up") ||
+    lower.includes("connection reset")
+  ) return "Cursor connection failed";
+
+  return "Cursor upstream error";
+}
+
+/**
+ * Produce a user-facing, secret-safe Cursor error message with an actionable category prefix.
+ * Mirrors `safeKiroErrorMessage` / `safeKiroHttpErrorMessage` in kiro-errors.ts.
+ */
+export function safeCursorErrorMessage(rawMessage: string): string {
+  const prefix = classifyCursorError(rawMessage);
+  const detail = sanitize(rawMessage)
+    .replace(/resource[_ ]exhausted/gi, "resource limit exceeded")
+    .slice(0, 500);
+  return detail ? `${prefix}: ${detail}` : prefix;
+}