@yansigit/opencodex 2.33.0 → 2.35.0

package/src/adapters/cursor.ts

@@ -3,18 +3,13 @@ import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../types
 import type { ProviderAdapter } from "./base";
 import { isTranslatorBudgetExceededError } from "../lib/translator-budget";
 import { cursorExecDeniedMessage, cursorRequestDeclaresFullAccess } from "./cursor/exec-policy";
-import {
-  isCursorBenignCancelError,
-  isCursorInvalidArgumentError,
-  isCursorOverflowRemintCandidate,
-  safeCursorErrorMessage,
-  type CursorSizeContext,
-} from "./cursor/cursor-errors";
+import { isCursorBenignCancelError, isCursorInvalidArgumentError, isCursorOverflowRemintCandidate, safeCursorErrorMessage, type CursorSizeContext } from "./cursor/cursor-errors";
 import { cursorCheckpointModelAffinityId, inferCursorContextWindow, isCursorExternalWireModel } from "./cursor/discovery";
 import { createCursorKvStore, type CursorKvStore } from "./cursor/kv-store";
 import { mapCursorServerMessage } from "./cursor/message-mapper";
 import {
   createCursorRequest,
+  cursorClientThreadOwner,
   cursorCoveredPrefixDigest,
   cursorInstructionDigest,
 } from "./cursor/request-builder";
@@ -41,6 +36,15 @@ import {
   shouldSurfaceCursorOverflowFirst,
 } from "./cursor/thread-continuity";
 import { runCursorTurnWithRetry } from "./cursor/transport-retry";
+import { cursorRequestHasShellAlias, cursorRequestUsesCodeMode } from "./cursor/tool-definitions";
+import {
+  CURSOR_ECHO_RETRY_CONTINUATION_TEXT,
+  CURSOR_ROUTING_COMMENTARY_RETRY_TEXT,
+  CursorEnvelopeEchoSniffer,
+  CursorRoutingCommentaryError,
+  CursorRoutingCommentarySniffer,
+  CursorToolResultEchoError,
+} from "./cursor/envelope-echo";
 import {
   createDisabledCursorTransport,
   CursorTransportDisabledError,
@@ -167,15 +171,36 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
         let completedNormally = false;
         let lastTransport: { captured?: Uint8Array } | undefined;
         let emittedClientTool = false;
+        // Ordering proof for tool-suspended checkpoints: true only when the newest captured
+        // checkpoint bytes arrived AFTER the turn emitted a client tool call, i.e. upstream
+        // serialized its suspended-on-tool-call state. Only that snapshot can safely resume
+        // with the covered-prefix + trailing-toolResult path (devlog 260826 050).
+        let capturedAfterClientTool = false;
 
         const commitCapturedCheckpoint = (activeRequest: ReturnType<typeof createCursorRequest>): void => {
+          const toolSuspendedCommit =
+            emittedClientTool
+            && capturedAfterClientTool
+            && isCursorExternalWireModel(activeRequest.modelId);
           if (
             replayUnsafe
-            || emittedClientTool
+            || (emittedClientTool && !toolSuspendedCommit)
             || activeRequest.contextUsageStoreCheckpoints === false
             || !lastTransport?.captured
             || lastTransport.captured.byteLength === 0
-          ) return;
+          ) {
+            // Refusal diagnostics (devlog 260826 050/080): name the exact guard so a live
+            // missing_ref chain can be attributed without instrumented rebuilds.
+            debugProviderDiagnostic("cursor", "checkpoint-commit-refused", {
+              replayUnsafe,
+              emittedClientTool,
+              capturedAfterClientTool,
+              externalModel: isCursorExternalWireModel(activeRequest.modelId),
+              storeCheckpoints: activeRequest.contextUsageStoreCheckpoints !== false,
+              capturedBytes: lastTransport?.captured?.byteLength ?? 0,
+            });
+            return;
+          }
           const previousRef = _parsed._providerContinuation?.cursor?.checkpointRef;
           const coveredMessageCount = _parsed.context.messages.length;
           const checkpointRef = commitCursorCheckpoint({
@@ -194,7 +219,9 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             cursor: {
               ...(_parsed._providerContinuation?.cursor ?? {}),
               conversationId: activeRequest.conversationId,
-              checkpointUsable: true,
+              // A tool-suspended checkpoint is only usable by the immediate trailing-toolResult
+              // continuation; the request-builder guard keys on checkpointUsable=false for that.
+              checkpointUsable: !toolSuspendedCommit,
               checkpointRef,
             },
           };
@@ -204,6 +231,7 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             checkpointRefHash: cursorCheckpointRefHash(checkpointRef),
             checkpointBytes: lastTransport.captured.byteLength,
             wireModel: activeRequest.modelId,
+            ...(toolSuspendedCommit ? { toolSuspended: true } : {}),
           });
         };
 
@@ -216,6 +244,38 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             || activeRequest.modelId.includes("kimi-k3")
             || activeRequest.modelId.includes("opus-4-8");
           const heartbeatOnlyMs = isHeavyReasoning ? 300_000 : 180_000;
+          // Envelope echo quarantine (devlog 260826 gap-10): external full-replay continuations
+          // whose trailing input is a tool result sometimes ECHO the replayed "[Tool Result]"
+          // envelope as assistant text (kimi-k3 ~30-40% of multi-round probes). Hold the first
+          // text deltas until they provably diverge from the markers; a completed marker turns
+          // the turn into a retryable semantic failure BEFORE any client-visible delta escapes.
+          // Armed for ANY external turn whose replayed history contains a tool result — echo
+          // priming was observed live on user-action rounds too (the envelope lives in the
+          // flattened history regardless of which role ends the input).
+          const armEchoSniffer =
+            isCursorExternalWireModel(activeRequest.modelId)
+            && (_parsed.context.messages ?? []).some(message => message.role === "toolResult");
+          const echoSniffer = armEchoSniffer ? new CursorEnvelopeEchoSniffer() : undefined;
+          const armRoutingCommentarySniffer =
+            isCursorExternalWireModel(activeRequest.modelId)
+            && (
+              cursorRequestUsesCodeMode(activeRequest.tools, activeRequest.toolChoice)
+              || cursorRequestHasShellAlias(activeRequest.tools)
+            );
+          const routingCommentarySniffer = armRoutingCommentarySniffer
+            ? new CursorRoutingCommentarySniffer()
+            : undefined;
+          let guardHeld: AdapterEvent[] = [];
+          const releaseGuardHeld = () => {
+            for (const held of guardHeld) {
+              if (held.type !== "heartbeat") emittedOutput = true;
+              emit(held);
+            }
+            guardHeld = [];
+          };
+          const guardsSettled = () =>
+            (!echoSniffer || echoSniffer.settled)
+            && (!routingCommentarySniffer || routingCommentarySniffer.settled);
           await runCursorTurnWithRetry(
             makeTransport,
             {
@@ -238,14 +298,54 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
               if (message.type === "done") completedNormally = true;
               if (message.type === "tool_call_end") emittedClientTool = true;
               const captured = capturedCursorCheckpointBytes(activeTransport);
-              if (captured) lastTransport = { captured };
-              const events = mapCursorServerMessage(message, {
-                kv,
-                writeClient: clientMessage => {
-                  void activeTransport.writeClient(clientMessage);
-                },
-              });
-              for (const event of events) {
+              if (captured) {
+                if (captured !== lastTransport?.captured) capturedAfterClientTool = emittedClientTool;
+                lastTransport = { captured };
+              }
+             const events = mapCursorServerMessage(message, {
+               kv,
+               writeClient: clientMessage => {
+                 void activeTransport.writeClient(clientMessage);
+               },
+             });
+             for (const event of events) {
+                if (!guardsSettled()) {
+                  if (event.type === "text_delta") {
+                    guardHeld.push(event);
+                    if (echoSniffer && !echoSniffer.settled) {
+                      const decision = echoSniffer.feed(event.text);
+                      if (decision.kind === "echo") {
+                        guardHeld = [];
+                        throw new CursorToolResultEchoError(decision.marker);
+                      }
+                    }
+                    if (routingCommentarySniffer && !routingCommentarySniffer.settled) {
+                      const decision = routingCommentarySniffer.feed(event.text);
+                      if (decision.kind === "hallucination") {
+                        guardHeld = [];
+                        throw new CursorRoutingCommentaryError();
+                      }
+                    }
+                    if (guardsSettled()) releaseGuardHeld();
+                    continue;
+                  } else if (event.type === "thinking_delta" || event.type === "heartbeat") {
+                    // Reasoning before first text stays ordered; liveness still passes through.
+                    if (event.type === "thinking_delta") {
+                      guardHeld.push(event);
+                      continue;
+                    }
+                  } else {
+                    // A tool call, done, or error closes the text quarantine. Re-check the full
+                    // held first line before release so a fragmented routing claim cannot leak.
+                    echoSniffer?.finish();
+                    const routingDecision = routingCommentarySniffer?.finish();
+                    if (routingDecision?.kind === "hallucination") {
+                      guardHeld = [];
+                      throw new CursorRoutingCommentaryError();
+                    }
+                    releaseGuardHeld();
+                  }
+                }
                 if (event.type !== "heartbeat") emittedOutput = true;
                 if (event.type === "done") {
                   commitCapturedCheckpoint(activeRequest);
@@ -284,9 +384,10 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
           const next = createCursorRequest(_parsed, { forceFreshConversation: true });
           rekeyContextUsage(failedConversationId, next.conversationId);
           _parsed._cursorConversationId = next.conversationId;
-          if (_parsed._clientThreadId && _parsed._cursorIsolateConversation !== true) {
+          const threadOwner = cursorClientThreadOwner(_parsed);
+          if (threadOwner && _parsed._cursorIsolateConversation !== true) {
             rememberCursorThreadConversation(
-              _parsed._clientThreadId,
+              threadOwner,
               next.conversationId,
               _parsed._cursorIdentityScope,
             );
@@ -299,6 +400,51 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             await runOnce(request);
             break;
           } catch (err) {
+          const outputGuardRetryText =
+            err instanceof CursorToolResultEchoError
+              ? CURSOR_ECHO_RETRY_CONTINUATION_TEXT
+              : err instanceof CursorRoutingCommentaryError
+                ? CURSOR_ROUTING_COMMENTARY_RETRY_TEXT
+                : undefined;
+          // One-shot corrective retry for guarded external output (devlog 260826 gap-10/11).
+          // The quarantine guarantees no client-visible delta escaped, so a fresh-conversation
+          // retry is safe. A second rejection propagates as an error rather than looping.
+          if (
+            outputGuardRetryText
+            && !emittedOutput
+            && !replayUnsafe
+            && !incoming.abortSignal?.aborted
+          ) {
+            debugProviderDiagnostic(
+              "cursor",
+              err instanceof CursorToolResultEchoError
+                ? "envelope-echo-retry"
+                : "routing-commentary-retry",
+              {
+              wireModel: request.modelId,
+              conversationHash: request.conversationId.slice(0, 16),
+              },
+            );
+            const echoedConversationId = request.conversationId;
+            lastTransport = undefined;
+            _parsed._cursorConversationId = undefined;
+            request = {
+              ...createCursorRequest(_parsed, { forceFreshConversation: true }),
+              echoRetryContinuationText: outputGuardRetryText,
+            };
+            rekeyContextUsage(echoedConversationId, request.conversationId);
+            _parsed._cursorConversationId = request.conversationId;
+            const echoThreadOwner = cursorClientThreadOwner(_parsed);
+            if (echoThreadOwner && _parsed._cursorIsolateConversation !== true) {
+              rememberCursorThreadConversation(
+                echoThreadOwner,
+                request.conversationId,
+                _parsed._cursorIdentityScope,
+              );
+            }
+            await runOnce(request);
+            break;
+          } else {
             const overflowRemintSafe =
               !lastRawIsToolResult
               && !emittedOutput
@@ -308,25 +454,19 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
               _parsed,
               overflowRemintBaseId ?? request.conversationId,
             );
-
             if (
               overflowScopeKey
               && overflowRemintSafe
               && isCursorOverflowRemintCandidate(err, requestSizeContext)
             ) {
-              if (shouldSkipCursorOverflowRemint(overflowScopeKey)) {
-                throw err;
-              }
+              if (shouldSkipCursorOverflowRemint(overflowScopeKey)) throw err;
               if (shouldSurfaceCursorOverflowFirst(overflowScopeKey)) {
                 markCursorOverflowSurfaced(overflowScopeKey);
                 throw err;
               }
-              if (!recordCursorOverflowRemint(overflowScopeKey)) {
-                throw err;
-              }
-              const failedConversationId = request.conversationId;
+              if (!recordCursorOverflowRemint(overflowScopeKey)) throw err;
               if (inheritedCheckpointRef) invalidateCursorCheckpoint(inheritedCheckpointRef);
-              request = remintConversationId(failedConversationId);
+              request = remintConversationId(request.conversationId);
               continue;
             }
 
@@ -348,6 +488,7 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             break;
           }
         }
+        }
         if (
           request.checkpointInvalidationReason
           && request.checkpointInvalidationReason !== "missing_ref"

package/src/adapters/google-aistudio-parser.ts

@@ -0,0 +1,49 @@
+/**
+ * Resilient streaming chunk parser for Google AI Studio MakerSuite private RPC protocol.
+ */
+
+export interface MakerSuiteParsedResult {
+  text: string;
+  thought?: string;
+  thoughtSignature?: string;
+}
+
+export function parseMakerSuiteChunk(raw: string): MakerSuiteParsedResult {
+  const result: MakerSuiteParsedResult = { text: "" };
+  if (!raw || typeof raw !== "string") return result;
+
+  // 1. Extract regular model response text: [null, "escaped_text"]
+  const textMatches = raw.matchAll(/\[\s*null\s*,\s*"((?:[^"\\]|\\.)*)"/g);
+  for (const m of textMatches) {
+    if (!m[1]) continue;
+    try {
+      const decoded = JSON.parse('"' + m[1] + '"');
+      if (decoded) result.text += decoded;
+    } catch (err) {
+      void err;
+      result.text += m[1];
+    }
+  }
+
+  // 2. Extract model reasoning / thoughts: [true, "escaped_thought"]
+  const thoughtMatches = raw.matchAll(/\[\s*true\s*,\s*"((?:[^"\\]|\\.)*)"/g);
+  for (const m of thoughtMatches) {
+    if (!m[1]) continue;
+    try {
+      const decoded = JSON.parse('"' + m[1] + '"');
+      if (decoded) result.thought = (result.thought ?? "") + decoded;
+    } catch (err) {
+      void err;
+      result.thought = (result.thought ?? "") + m[1];
+    }
+  }
+
+  // 3. Extract Gemini thought signature token if present
+  const sigMatch = raw.match(/"(ErQ[A-Za-z0-9+/=_-]{30,})"/);
+  if (sigMatch?.[1]) {
+    result.thoughtSignature = sigMatch[1];
+  }
+
+  return result;
+}
+

package/src/adapters/google-antigravity-replay.ts

@@ -3,6 +3,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, statSync } from "node:f
 import { dirname, join } from "node:path";
 import { atomicWriteFileAsync, getConfigDir, type AtomicWriteAsyncTestSeam } from "../config";
 import { enforceAppOwnedMemoryBudget } from "../lib/app-owned-memory";
+import { ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL } from "./google-antigravity-wire";
 
 /**
  * Google-family thoughtSignature reasoning-replay cache.
@@ -19,6 +20,7 @@ import { enforceAppOwnedMemoryBudget } from "../lib/app-owned-memory";
 
 interface ReplayCall {
   signature: string;
+  signatures?: string[];
   sizeBytes: number;
   touchedAtMs: number;
 }
@@ -34,6 +36,7 @@ interface ReplayEntry {
 }
 
 const MIN_SIGNATURE_LEN = 16;
+const MAX_SIGNATURES_PER_CALL = 32;
 const REPLAY_TTL_MS = 60 * 60 * 1000; // 1h
 export const ANTIGRAVITY_REPLAY_MAX_ENTRIES = 10_240;
 const REPLAY_EVICT_BATCH = 128;
@@ -103,16 +106,38 @@ function loadReplaySnapshotEntry(key: string, value: unknown): void {
   for (const pair of rec.byCall) {
     if (!Array.isArray(pair) || pair.length !== 2 || typeof pair[0] !== "string") continue;
     if (!/^[0-9a-f]{64}$/.test(pair[0])) continue;
-    const call = pair[1] as { signature?: unknown; touchedAtMs?: unknown } | null;
+    const call = pair[1] as { signature?: unknown; signatures?: unknown; touchedAtMs?: unknown } | null;
     if (!call || typeof call !== "object" || Array.isArray(call)) continue;
     if (typeof call.signature !== "string" || call.signature.length < MIN_SIGNATURE_LEN) continue;
     if (typeof call.touchedAtMs !== "number" || !Number.isFinite(call.touchedAtMs)) continue;
-    // Never trust a serialized sizeBytes: a forged snapshot could claim a tiny
-    // size for a huge signature and bypass every byte cap. Recompute from the
-    // signature itself, exactly like the live write path.
-    const signatureBytes = utf8.encode(call.signature).byteLength;
-    if (signatureBytes > replayLimits.maxSignatureBytes) continue;
-    const callBytes = utf8.encode(pair[0]).byteLength + signatureBytes;
+    let sigs: string[] = [];
+    if (Array.isArray(call.signatures)) {
+      for (const s of call.signatures) {
+        if (typeof s === "string" && s.length >= MIN_SIGNATURE_LEN) {
+          sigs.push(s);
+        }
+      }
+    }
+    if (sigs.length === 0) {
+      sigs = [call.signature];
+    } else if (!sigs.includes(call.signature)) {
+      sigs.push(call.signature);
+    }
+    if (sigs.length > MAX_SIGNATURES_PER_CALL) {
+      sigs = sigs.slice(-MAX_SIGNATURES_PER_CALL);
+    }
+    let totalSigBytes = 0;
+    let anySigOversized = false;
+    for (const s of sigs) {
+      const sb = utf8.encode(s).byteLength;
+      if (sb > replayLimits.maxSignatureBytes) {
+        anySigOversized = true;
+        break;
+      }
+      totalSigBytes += sb;
+    }
+    if (anySigOversized) continue;
+    const callBytes = utf8.encode(pair[0]).byteLength + totalSigBytes;
     if (callBytes > replayLimits.maxBytesPerSession) continue;
     // A duplicated call key would overstate entry.bytes (the map keeps only the
     // last value) and could evict valid sessions; keep the first occurrence.
@@ -122,6 +147,7 @@ function loadReplaySnapshotEntry(key: string, value: unknown): void {
     }
     byCall.set(pair[0], {
       signature: call.signature,
+      signatures: sigs,
       sizeBytes: callBytes,
       touchedAtMs: call.touchedAtMs,
     });
@@ -226,7 +252,11 @@ async function persistReplaySnapshotNow(): Promise<void> {
     for (const [key, entry] of [...replayCache].sort((a, b) => b[1].lastActiveAtMs - a[1].lastActiveAtMs)) {
       const byCall = [...entry.byCall].map(([callKey, call]) => [
         callKey,
-        { signature: call.signature, touchedAtMs: call.touchedAtMs },
+        {
+          signature: call.signature,
+          ...(call.signatures && call.signatures.length > 1 ? { signatures: call.signatures } : {}),
+          touchedAtMs: call.touchedAtMs,
+        },
       ]);
       const persistEntry: [string, unknown] = [key, {
         byCall,
@@ -483,10 +513,10 @@ export function antigravityReplaySessionKeysForTests(): string[] {
 
 function extractSignature(part: Record<string, unknown>): string | undefined {
   const direct = part.thoughtSignature ?? part.thought_signature;
-  if (typeof direct === "string" && direct.length >= MIN_SIGNATURE_LEN) return direct;
+  if (typeof direct === "string" && direct.length >= MIN_SIGNATURE_LEN && direct !== ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL) return direct;
   const extra = part.extra_content as { google?: { thought_signature?: unknown } } | undefined;
   const nested = extra?.google?.thought_signature;
-  if (typeof nested === "string" && nested.length >= MIN_SIGNATURE_LEN) return nested;
+  if (typeof nested === "string" && nested.length >= MIN_SIGNATURE_LEN && nested !== ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL) return nested;
   return undefined;
 }
 
@@ -644,10 +674,37 @@ export function observeAntigravityReplay(
     const ck = functionCallKey(fc.name, fc.args);
     if (!ck) continue; // only function-call signatures are replayable by identity
     const signatureBytes = utf8.encode(callSig).byteLength;
-    const sizeBytes = utf8.encode(ck).byteLength + signatureBytes;
-    if (signatureBytes > replayLimits.maxSignatureBytes || sizeBytes > replayLimits.maxBytesPerSession) continue;
+    if (signatureBytes > replayLimits.maxSignatureBytes) continue;
+
+    const existingCall = entry.byCall.get(ck);
+    let sigs: string[];
+    if (existingCall) {
+      sigs = existingCall.signatures && existingCall.signatures.length > 0
+        ? [...existingCall.signatures]
+        : [existingCall.signature];
+      if (!sigs.includes(callSig)) {
+        if (sigs.length >= MAX_SIGNATURES_PER_CALL) {
+          sigs.shift();
+        }
+        sigs.push(callSig);
+      }
+    } else {
+      sigs = [callSig];
+    }
+    let totalSigBytes = 0;
+    for (const s of sigs) {
+      totalSigBytes += utf8.encode(s).byteLength;
+    }
+    const sizeBytes = utf8.encode(ck).byteLength + totalSigBytes;
+    if (sizeBytes > replayLimits.maxBytesPerSession) continue;
+
     deleteReplayCall(entry, ck);
-    entry.byCall.set(ck, { signature: callSig, sizeBytes, touchedAtMs: now });
+    entry.byCall.set(ck, {
+      signature: callSig,
+      signatures: sigs,
+      sizeBytes,
+      touchedAtMs: now,
+    });
     entry.bytes += sizeBytes;
     replayBytes += sizeBytes;
     inserted = true;
@@ -692,15 +749,22 @@ export function applyAntigravityReplay(model: string, sessionId: string, content
   if (!entry) {
     return contents;
   }
+
   let touched = false;
-  for (const c of contents as { role?: string; parts?: unknown[] }[]) {
+  // Align from the END of the recorded signature list. History may have been truncated
+  // (compaction / previous_response_id): the last remaining occurrence is the most recent call,
+  // so it must receive the newest signature. Iterate backwards and count every occurrence
+  // (signed or not) so signed Mechanism-① parts still occupy their chronological slot.
+  const reverseOccurrence = new Map<string, number>();
+  for (let ci = (contents as { role?: string; parts?: unknown[] }[]).length - 1; ci >= 0; ci--) {
+    const c = (contents as { role?: string; parts?: unknown[] }[])[ci];
     if (!c || typeof c !== "object" || c.role !== "model" || !Array.isArray(c.parts)) continue;
-    for (const raw of c.parts) {
+    for (let pi = c.parts.length - 1; pi >= 0; pi--) {
+      const raw = c.parts[pi];
       if (!raw || typeof raw !== "object") continue;
       const part = raw as Record<string, unknown>;
       const fc = part.functionCall as { name?: unknown; args?: unknown } | undefined;
       if (!fc) continue;
-      if (part.thoughtSignature !== undefined || part.thought_signature !== undefined) continue;
       const ck = functionCallKey(fc.name, fc.args);
       let call = ck ? entry.byCall.get(ck) : undefined;
       let matchedKey = ck;
@@ -717,27 +781,43 @@ export function applyAntigravityReplay(model: string, sessionId: string, content
           ) {
             try {
               const parsedInput = JSON.parse(trimmedInput);
-            if (parsedInput && typeof parsedInput === "object") {
-              const altKey = functionCallKey(fc.name, parsedInput);
-              if (altKey && entry.byCall.has(altKey)) {
-                call = entry.byCall.get(altKey);
-                matchedKey = altKey;
+              if (parsedInput && typeof parsedInput === "object") {
+                const altKey = functionCallKey(fc.name, parsedInput);
+                if (altKey && entry.byCall.has(altKey)) {
+                  call = entry.byCall.get(altKey);
+                  matchedKey = altKey;
+                }
               }
-            }
             } catch {
               // not JSON, keep default
             }
           }
         }
       }
-      if (call && matchedKey) {
+      if (matchedKey) {
+        const revIdx = reverseOccurrence.get(matchedKey) ?? 0;
+        reverseOccurrence.set(matchedKey, revIdx + 1);
+        if (part.thoughtSignature !== undefined || part.thought_signature !== undefined) {
+          // Already signed (e.g. Mechanism ① or upstream response), preserve it.
+          continue;
+        }
+        if (call) {
+          const sigs = call.signatures && call.signatures.length > 0 ? call.signatures : [call.signature];
+          const chosenSig = revIdx < sigs.length
+            ? sigs[sigs.length - 1 - revIdx]
+            : sigs[sigs.length - 1] ?? call.signature;
+          part.thoughtSignature = chosenSig;
+          entry.byCall.delete(matchedKey);
+          entry.byCall.set(matchedKey, { ...call, touchedAtMs: now });
+          touched = true;
+        }
+      } else if (part.thoughtSignature === undefined && part.thought_signature === undefined && call) {
         part.thoughtSignature = call.signature;
-        entry.byCall.delete(matchedKey);
-        entry.byCall.set(matchedKey, { ...call, touchedAtMs: now });
         touched = true;
       }
     }
   }
+
   if (touched) {
     entry.lastActiveAtMs = now;
     refreshReplaySessionCandidate(replayKey(model, sessionId), entry);

package/src/adapters/google-antigravity-wire.ts

@@ -36,6 +36,11 @@ export const ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL = "skip_thought_signature_val
  */
 export function isLikelyRealThoughtSignature(sig: string | undefined): boolean {
   if (typeof sig !== "string" || sig.length < 16) return false;
+  // The validator-bypass sentinel is something WE fabricate for outbound requests when no real
+  // signature exists. It is alphanumeric with underscores, so it would otherwise satisfy every
+  // check below and be re-ingested as genuine — cached, replayed, and eventually treated as
+  // evidence that a turn was signed. It is never a real signature.
+  if (sig === ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL) return false;
   // Reject synthetic Responses/tool-call ids and Anthropic tool-use ids (`_` or `-` separators).
   if (/^(fc|ctc|tsc|call|msg|rs|resp|reasoning|item|ws|toolu|tool|func|function)[-_]/i.test(sig)) return false;
   // Real Gemini thought signatures are opaque base64/base64url blobs: only [A-Za-z0-9+/_=-].

package/src/adapters/google-errors.ts

@@ -18,6 +18,43 @@ function googleErrorDetail(payloadText: string): { message?: string; status?: st
   };
 }
 
+const GOOGLE_QUOTA_EXHAUSTED_NEEDLES = [
+  "quotafailure",
+  "quota exceeded",
+  "exceeded your current quota",
+  "billing",
+  "individual quota reached",
+  "quota reached",
+  "enable overages",
+  "exhausted your capacity",
+  "daily limit reached",
+  "weekly limit reached",
+];
+
+// Per-minute / per-second / concurrency limits are transient rate limits: they should be
+// retried, not treated as hard quota exhaustion. These guards run before the needles so a
+// message like "Per-minute quota exceeded" stays in the retryable bucket.
+const GOOGLE_TRANSIENT_RATE_LIMIT_PATTERNS = [
+  "per minute",
+  "per-minute",
+  "per min",
+  "rpm",
+  "requests per minute",
+  "too many requests",
+  "rate limit",
+  "retry after",
+  // Upstream writes the header name both ways in prose ("retry-after: 60"); matching only the
+  // spaced spelling let a transient 429 fall through to the exhaustion needles below.
+  "retry-after",
+  "concurrent request limit",
+];
+
+export function isGoogleQuotaExhaustedText(text: string): boolean {
+  const lower = text.toLowerCase();
+  if (GOOGLE_TRANSIENT_RATE_LIMIT_PATTERNS.some(needle => lower.includes(needle))) return false;
+  return GOOGLE_QUOTA_EXHAUSTED_NEEDLES.some(needle => lower.includes(needle));
+}
+
 const ANTIGRAVITY_GEO_BLOCKED_MARKER = "user location is not supported for the api use";
 
 export function isAntigravityGeoBlockedBody(payloadText: string): boolean {
@@ -27,12 +64,8 @@ export function isAntigravityGeoBlockedBody(payloadText: string): boolean {
 
 function classifyGoogle(label: string, status: number | undefined, enumStatus: string | undefined, text: string): string {
   const lower = `${enumStatus ?? ""} ${text}`.toLowerCase();
-  const quotaExhausted =
-    lower.includes("quotafailure") ||
-    lower.includes("quota exceeded") ||
-    lower.includes("exceeded your current quota") ||
-    lower.includes("billing");
-  if (enumStatus === "RESOURCE_EXHAUSTED" && quotaExhausted) return `${label} quota exhausted`;
+  const quotaExhausted = isGoogleQuotaExhaustedText(lower);
+  if ((!enumStatus || enumStatus === "RESOURCE_EXHAUSTED") && quotaExhausted) return `${label} quota exhausted`;
   if (status === 429 || enumStatus === "RESOURCE_EXHAUSTED" || lower.includes("rate limit")) {
     return `${label} rate limit exceeded`;
   }
@@ -87,10 +120,6 @@ export function retryableGoogleStatus(status: number): boolean {
  */
 export function isQuotaExhaustedBody(payloadText: string): boolean {
   const { message, status } = googleErrorDetail(payloadText);
-  if (status !== "RESOURCE_EXHAUSTED") return false;
-  const lower = (message ?? "").toLowerCase();
-  return lower.includes("quotafailure")
-    || lower.includes("quota exceeded")
-    || lower.includes("exceeded your current quota")
-    || lower.includes("billing");
+  if (status && status !== "RESOURCE_EXHAUSTED") return false;
+  return isGoogleQuotaExhaustedText(message ?? payloadText);
 }