@yansigit/opencodex 2.31.0

package/src/adapters/azure.ts

@@ -0,0 +1,36 @@
+import type { IncomingMeta, ProviderAdapter } from "./base";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { createResponsesPassthroughAdapter } from "./openai-responses";
+
+export function createAzureAdapter(provider: OcxProviderConfig): ProviderAdapter & { passthrough: true } {
+  const inner = createResponsesPassthroughAdapter({
+    ...provider,
+    baseUrl: provider.baseUrl,
+  });
+
+  return {
+    ...inner,
+    name: "azure-openai",
+
+    async buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta) {
+      if (provider.authMode === "forward") {
+        throw new Error("azure-openai does not support forward auth mode");
+      }
+      if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
+        throw new Error("azure-openai requires a non-empty apiKey");
+      }
+
+      const request = await inner.buildRequest(parsed, incoming);
+      const unresolvedPlaceholder = request.url.match(/\{[^}]*\}/)?.[0] ?? request.url.match(/[{}]/)?.[0];
+      if (unresolvedPlaceholder) {
+        throw new Error(`azure-openai baseUrl contains unresolved ${unresolvedPlaceholder} — set your real resource URL`);
+      }
+
+      const headers = { ...request.headers };
+      headers["api-key"] = provider.apiKey;
+      delete headers["Authorization"];
+      // The inner adapter always targets Azure's v1 API here, which needs no api-version query.
+      return { ...request, headers };
+    },
+  };
+}

package/src/adapters/base.ts

@@ -0,0 +1,121 @@
+import type { AdapterEvent, OcxParsedRequest } from "../types";
+import type { TranslatorBudget } from "../lib/translator-budget";
+import type { AdapterTierMetadata } from "../providers/fastwire";
+
+/** Metadata about the caller's incoming request, for auth-forwarding adapters. */
+export interface IncomingMeta {
+  headers: Headers;
+  translatorBudget: TranslatorBudget;
+  abortSignal?: AbortSignal;
+  /**
+   * Provider-scoped fetch prepared by the Responses router. Stateful transports that emit more
+   * than one physical HTTP request per logical turn must reuse it so every request participates in
+   * the same pacing queue and custom provider fetch seam.
+   */
+  providerFetch?: typeof globalThis.fetch;
+  /**
+   * Image-normalization ladder bias for upstream-413 tightened retries: every image
+   * starts one tier lower (devlog/260714_image_normalization_pipeline/030). Only the
+   * anthropic adapter consumes it; others ignore it.
+   */
+  imageTierBias?: number;
+}
+
+export interface ProviderAdapter {
+  name: string;
+
+  /**
+   * Convert an already-read provider HTTP error into client-safe text. This hook must be pure and
+   * return fully redacted output: callers may pass untrusted provider headers and payload text.
+   */
+  formatErrorBody?(status: number, headers: Headers, payloadText: string): string;
+
+  /**
+   * Build the upstream request. May be async: adapters that resolve a short-lived credential
+   * (e.g. Vertex AI ADC token) return a Promise. Sync adapters return the object directly; callers
+   * must `await` the result (awaiting a non-Promise is a no-op).
+   */
+  buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta): AdapterRequest | Promise<AdapterRequest>;
+
+  fetchResponse?(request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response>;
+
+  /**
+   * Parse one upstream response. `tierMetadata` is the same live observer returned on the
+   * corresponding AdapterRequest; adapters that receive a documented tier echo may update it.
+   */
+  parseStream(
+    response: Response,
+    budget: TranslatorBudget,
+    tierMetadata?: AdapterTierMetadata,
+  ): AsyncGenerator<AdapterEvent>;
+  parseResponse?(
+    response: Response,
+    budget: TranslatorBudget,
+    tierMetadata?: AdapterTierMetadata,
+  ): Promise<AdapterEvent[]>;
+  runTurn?(
+    parsed: OcxParsedRequest,
+    incoming: IncomingMeta,
+    emit: (event: AdapterEvent) => void,
+  ): Promise<void>;
+
+  /** Exact no-field observation for runTurn adapters, which expose no AdapterRequest object. */
+  tierLogForRunTurn?(parsed: OcxParsedRequest): AdapterTierMetadata | undefined;
+}
+
+export interface AdapterRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    /** Final upstream wire names of custom tools lowered to functions while building this request. */
+    convertedRoutedCustomToolNames?: ReadonlySet<string>;
+    /** Client tool-search names actually lowered to upstream function calls for this request. */
+    convertedRoutedToolSearchNames?: ReadonlySet<string>;
+    /** Upstream-only aliases for namespace tools flattened in this request. */
+    convertedRoutedNamespaceToolAliases?: ReadonlyMap<string, { namespace: string; name: string }>;
+    /** Releases observation of a serialized request body after its final fetch attempt settles. */
+    releaseBodyObservation?: () => void;
+    /** Exact reasoning parameter emitted by the adapter, for request-log diagnostics only. */
+    reasoningLog?:
+      | {
+          effectiveEffort: string;
+          wireField: "reasoning.enabled";
+          wireValue: boolean;
+        }
+      | {
+          effectiveEffort: string;
+          wireField: "thinking_budget";
+          wireValue: number;
+        }
+      | {
+          effectiveEffort: string;
+          wireField: "reasoning_effort" | "reasoning.effort" | "thinking.type";
+          wireValue: string;
+        };
+    /**
+     * Exact tier outcome seeded after this adapter serialized the outbound request.
+     * This is a live shared observer: response-phase methods mutate `outcome`, so retain
+     * the reference rather than cloning or snapshotting it.
+     */
+    tierLog?: AdapterTierMetadata;
+    usageLog?: {
+      inputTokens?: number;
+      estimated?: boolean;
+    };
+}
+
+export interface AdapterFetchContext {
+  /** Remains attached to the returned response body after the response headers arrive. */
+  abortSignal?: AbortSignal;
+  /** OAuth account identity used for provider-local cooldown bookkeeping. */
+  accountId?: string;
+  /** Deadline for receiving response headers on each attempt, not for consuming the response body. */
+  timeoutMs?: number;
+  /** Return final non-2xx responses untouched so the caller can own the error-body read. */
+  returnRawErrors?: boolean;
+  /** Whether the upstream response will be consumed as a stream; adapters may select low-latency transport settings. */
+  stream?: boolean;
+  /** Custom fetch executor to use for physical upstream network requests (defaults to globalThis.fetch). */
+  executor?: typeof globalThis.fetch;
+}

package/src/adapters/client-fingerprint.ts

@@ -0,0 +1,65 @@
+/**
+ * First-party client fingerprints.
+ *
+ * Routed OAuth providers reject — or quietly flag — requests whose header signature doesn't match
+ * the real first-party client that minted the token. Sending a valid OAuth token with an empty
+ * header set (or a giveaway literal UA like "antigravity") is a non-first-party signature. These
+ * constants mirror the headers the real Claude Code CLI and Antigravity CLI send, so the proxy's
+ * request fingerprint matches the credential.
+ *
+ * Pinned versions live HERE (single source) so they're trivial to bump. Values that need a live
+ * manifest fetch (Antigravity auto-updater) or a cryptographic billing signature (Claude cch) are
+ * intentionally NOT modeled — those are brittle and a wrong guess does more harm than the gap.
+ */
+import { createHash } from "node:crypto";
+
+// ── Claude Code CLI (matches Claude Code 2.1.63 / @anthropic-ai/sdk 0.74.0) ──
+export const CLAUDE_CODE_HEADERS: Record<string, string> = {
+  "X-App": "cli",
+  "X-Stainless-Retry-Count": "0",
+  "X-Stainless-Runtime": "node",
+  "X-Stainless-Lang": "js",
+  "X-Stainless-Timeout": "600",
+  "X-Stainless-Arch": process.arch,
+  "X-Stainless-OS": process.platform,
+  "X-Stainless-Package-Version": "0.74.0",
+  "X-Stainless-Runtime-Version": process.version.slice(1),
+};
+
+/**
+ * Stable per-credential session id, matching Claude Code's `X-Claude-Code-Session-Id`. Real Claude
+ * Code keeps one session id per CLI session; we derive a deterministic UUIDv4-shaped id from the
+ * OAuth token so it stays stable across a conversation's turns without persisting state. The token
+ * itself never leaves this function (only its hash drives the id).
+ */
+export function claudeCodeSessionId(token: string | undefined): string {
+  const seed = token && token.length > 0 ? token : "opencodex-anon";
+  const h = createHash("sha256").update(`claude-code-session:${seed}`, "utf8").digest("hex");
+  // Shape the hash into a v4-looking UUID (version nibble 4, variant nibble 8-b).
+  const variant = ((parseInt(h[16], 16) & 0x3) | 0x8).toString(16);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-${variant}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+
+// ── Antigravity IDE ──
+/** Pinned fallback Antigravity IDE language-server version (matches the bundled LS 2.5.5). */
+export const ANTIGRAVITY_IDE_VERSION = "2.5.5";
+const ANTIGRAVITY_IDE_CLIENT_NAME = "aidev_client";
+const ANTIGRAVITY_IDE_PLATFORM = "windows/amd64";
+
+/**
+ * Real Antigravity IDE User-Agent format, decompiled from 2.5.5 Go LS (`setHeaders` @ `0x1018fbe00`):
+ * `antigravity/ide/${version} (os_type=${osType}; arch=${arch}; aidev_client; auth_method=oauth)`
+ *
+ * Token ordering from decompiled binary: `os_type` -> `arch` -> `aidev_client` -> `auth_method=oauth`.
+ *
+ * Must be the IDE client family (`antigravity/ide/...`): Cloud Code Assist backend gates
+ * newer agent models (e.g. `gemini-3.7-flash`) by User-Agent and answers 404 NOT_FOUND to
+ * CLI-shaped UAs even with a valid OAuth token. Only `antigravity/ide/<ver>` unlocks them.
+ * A `GOOGLE_ANTIGRAVITY_USER_AGENT` override (set by the caller) takes precedence upstream.
+ */
+export function antigravityUserAgent(version = ANTIGRAVITY_IDE_VERSION, authMethod = "oauth"): string {
+  const ov = process.env.GOOGLE_ANTIGRAVITY_USER_AGENT?.trim();
+  if (ov) return ov;
+  const [osType, arch] = ANTIGRAVITY_IDE_PLATFORM.split("/");
+  return `antigravity/ide/${version} (os_type=${osType}; arch=${arch}; ${ANTIGRAVITY_IDE_CLIENT_NAME}; auth_method=${authMethod})`;
+}

package/src/adapters/cline-pass-deepseek-v4-tool-replay.ts

@@ -0,0 +1,69 @@
+import type { ProviderAdapter } from "./base";
+
+const CLINE_PASS_DEEPSEEK_V4_MODELS = new Set([
+  "cline-pass/deepseek-v4-flash",
+  "cline-pass/deepseek-v4-pro",
+]);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function isClinePassDeepSeekV4Model(modelId: string): boolean {
+  return CLINE_PASS_DEEPSEEK_V4_MODELS.has(modelId);
+}
+
+/**
+ * DeepSeek V4 can copy historical pre-tool narration back into the next turn and
+ * eventually degenerate into text-only "I'll call the tool" loops. For the two
+ * affected ClinePass models, replay historical assistant tool turns as the
+ * structured call only. Normal assistant messages, tool results, and separate
+ * reasoning metadata remain untouched.
+ */
+export function stripClinePassDeepSeekV4ToolReplayNarration(
+  body: string,
+  modelId: string,
+): string {
+  if (!isClinePassDeepSeekV4Model(modelId)) return body;
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return body;
+  }
+  if (!isRecord(parsed) || !Array.isArray(parsed.messages)) return body;
+
+  let changed = false;
+  const messages = parsed.messages.map(message => {
+    if (!isRecord(message) || message.role !== "assistant") return message;
+    const toolCalls = message.tool_calls;
+    if (!Array.isArray(toolCalls) || toolCalls.length === 0) return message;
+    if (message.content === "") return message;
+
+    changed = true;
+    return { ...message, content: "" };
+  });
+
+  return changed ? JSON.stringify({ ...parsed, messages }) : body;
+}
+
+/**
+ * Apply the ClinePass DeepSeek V4 replay compatibility policy after the ordinary
+ * OpenAI-chat request has been serialized. The adapter's response parsing and all
+ * non-target request behavior stay identical.
+ */
+export function withClinePassDeepSeekV4ToolReplayCompatibility(
+  adapter: ProviderAdapter,
+): ProviderAdapter {
+  return {
+    ...adapter,
+    async buildRequest(parsed, incoming) {
+      const request = await adapter.buildRequest(parsed, incoming);
+      if (!isClinePassDeepSeekV4Model(parsed.modelId)) return request;
+
+      const body = stripClinePassDeepSeekV4ToolReplayNarration(request.body, parsed.modelId);
+      return body === request.body ? request : { ...request, body };
+    },
+  };
+}