@yansigit/opencodex 2.35.2-dev.20260829.13 → 2.36.1-dev.20260829.17

package/src/server/management/logs-usage-routes.ts

@@ -10,7 +10,6 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,

package/src/server/management/model-routes.ts

@@ -81,7 +81,6 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,
@@ -148,7 +147,7 @@ import type {
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import type { ManagementContext } from "./context";
+import { saveManagementConfig, type ManagementContext } from "./context";
 import { listManagementModelRows, loadExportModels } from "./model-rows";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import {
@@ -177,7 +176,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   // the real store; tests that pass an in-memory fixture inject a no-op/spy. Do not
   // bypass this seam with a dynamic config import — doing so replaced a user's
   // ~/.opencodex/config.json with the `existing-uuid` test fixture.
-  const persistConfig = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
+  const persistConfig = (candidate: OcxConfig) => saveManagementConfig(deps, candidate);
 
   if (url.pathname === "/api/model-discovery" && req.method === "GET") {
     const providers = Object.fromEntries(Object.entries(config.providers).map(([name, provider]) => [

package/src/server/management/native-integration-routes.ts

@@ -17,7 +17,7 @@
  * Design of record: devlog/_fin/260803_integrations_toggle_all/030 (routes),
  * 011 (Claude Code), 012 (Grok).
  */
-import { loadConfig, saveConfigPreservingClaudeCode } from "../../config";
+import { loadConfig } from "../../config";
 import { readRuntimePort } from "../../config/process-state";
 import { desktopVisibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, visibleNativeSlugs } from "../../codex/catalog";
 import { providerContextCap } from "../../providers/context-cap";
@@ -31,7 +31,7 @@ import type { CodexNativeRestoreResult } from "../../codex/inject";
 import type { OcxConfig } from "../../types";
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
-import type { ManagementContext } from "./context";
+import { ManagementPersistenceError, saveManagementConfig, type ManagementContext } from "./context";
 
 export type NativeIntegrationClientId = "claude" | "grok" | "codex" | "claude-desktop";
 
@@ -221,9 +221,10 @@ function grokStatus(config: ManagementContext["config"]): NativeStatus {
  * cannot open, which fails identically forever (audit r8 #2).
  */
 function isLockContention(error: unknown): boolean {
-  if (!error || typeof error !== "object") return false;
-  const cause = (error as { cause?: { code?: unknown } }).cause;
-  return cause?.code === "SQLITE_BUSY";
+  for (let current = error; current && typeof current === "object"; current = (current as { cause?: unknown }).cause) {
+    if ((current as { code?: unknown }).code === "SQLITE_BUSY") return true;
+  }
+  return false;
 }
 
 function isConfigLockError(error: unknown): boolean {
@@ -732,10 +733,20 @@ export async function handleNativeIntegrationRoutes(ctx: ManagementContext): Pro
      * `deps.` first: ManagementApiDeps carries this seam so route tests with an
      * in-memory fixture cannot overwrite the developer's real OPENCODEX_HOME.
      */
-    const persist = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
+    const persist = (candidate: OcxConfig) => saveManagementConfig(deps, candidate);
     try {
       persist(config);
     } catch (error) {
+      if (error instanceof ManagementPersistenceError) {
+        if (isConfigLockError(error)) {
+          error.response = isLockContention(error)
+            ? refusal(409, "claude", "config_busy",
+                "Another process is saving the configuration right now. Try again in a moment.")
+            : refusal(500, "claude", "write_failed",
+                `The configuration lock could not be acquired: ${error.message}`);
+        }
+        throw error;
+      }
       if (isConfigLockError(error)) {
         return isLockContention(error)
           ? refusal(409, "claude", "config_busy",

package/src/server/management/oauth-account-routes.ts

@@ -12,7 +12,6 @@ import {
   providerHeadersConfigError,
   readConfigDiagnostics,
   reconcileLiveConfigFromDisk,
-  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,
@@ -68,7 +67,7 @@ import { isAzureIdentityProvider } from "../../config/provider-validation";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import type { ManagementContext } from "./context";
+import { saveManagementConfig, type ManagementContext } from "./context";
 import { readManagementJsonBody, readManagementJsonBodyOr, rethrowManagementBodyTooLarge } from "./body";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 import { ACCOUNT_IMPORT_DEADLINE_MS, ACCOUNT_IMPORT_MAX_REQUEST_BYTES } from "../../oauth/account-import";
@@ -374,7 +373,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         enabled = body.enabled;
       }
       config.cursorAccountPool = { enabled };
-      saveConfigPreservingClaudeCode(config);
+      saveManagementConfig(deps, config);
       reconcileLiveStateStores();
       return jsonResponse({
         ok: true,
@@ -422,7 +421,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       ...(strategy !== undefined ? { strategy } : {}),
       ...(stickyLimit !== undefined ? { stickyLimit } : {}),
     };
-    saveConfigPreservingClaudeCode(config);
+    saveManagementConfig(deps, config);
     reconcileLiveStateStores();
     return jsonResponse({
       ok: true,
@@ -667,7 +666,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const key = "ocx_data_" + randomBytes(20).toString("hex");
     const entry = { id: randomUUID(), name, key, createdAt: new Date().toISOString() };
     config.apiKeys = [...(config.apiKeys ?? []), entry];
-    saveConfigPreservingClaudeCode(config);
+    saveManagementConfig(deps, config);
     reconcileLiveStateStores();
     return jsonResponse({ id: entry.id, name: entry.name, key: entry.key, createdAt: entry.createdAt }, 201, req, config);
   }
@@ -681,7 +680,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const entry = (config.apiKeys ?? []).find(k => k.id === body.id);
     if (!entry) return jsonResponse({ error: "key not found" }, 404, req, config);
     entry.name = nameField.value;
-    saveConfigPreservingClaudeCode(config);
+    saveManagementConfig(deps, config);
     reconcileLiveStateStores();
     // Never echo key material from a rename.
     return jsonResponse({ id: entry.id, name: entry.name, createdAt: entry.createdAt }, 200, req, config);
@@ -695,7 +694,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     config.apiKeys = (config.apiKeys ?? []).filter(k => k.id !== body.id);
     // A stale id must not read as a successful revocation.
     if (config.apiKeys.length === before) return jsonResponse({ error: "key not found" }, 404, req, config);
-    saveConfigPreservingClaudeCode(config);
+    saveManagementConfig(deps, config);
     reconcileLiveStateStores();
     return jsonResponse({ success: true }, 200, req, config);
   }

package/src/server/management/provider-routes.ts

@@ -16,7 +16,6 @@ import {
   providerHeadersConfigError,
   requestPacingConfigError,
   readConfigAdmissionSnapshot,
-  saveConfigPreservingClaudeCode,
   upstreamHttpVersionConfigError,
   withConfigMutationLockSync,
 } from "../../config";
@@ -95,7 +94,7 @@ import {
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import type { ManagementContext } from "./context";
+import { saveManagementConfig, type ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { resolveAiStudioCredentials } from "../../oauth/aistudio-credentials";
 import { buildAiStudioHeaders, parseGoogleCookieJar } from "../../oauth/google-aistudio-auth";
@@ -743,7 +742,6 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const submittedModelAutoCompactTokenLimits = Object.hasOwn(prov, "modelAutoCompactTokenLimits");
     const submittedRequestPacing = Object.hasOwn(prov, "requestPacing");
     enrichProviderFromCatalog(name, prov);
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     // Overwriting an existing provider must not drop its multi-key pool: carry it over, then
     // let the (possibly new) apiKey join the pool as the active entry.
     const existingPool = config.providers[name]?.apiKeyPool;
@@ -786,7 +784,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     }
     config.providers[name] = stripRegistryOnlyStaticHeaders(name, prov);
     if (body.setDefault === true) config.defaultProvider = name;
-    save(config);
+    saveManagementConfig(deps, config);
     reconcileLiveStateStores();
     if (prov.apiKey && prov.apiKeyPool) {
       const { addProviderApiKey } = await import("../../providers/api-keys");
@@ -826,9 +824,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (!provider || !isCanonicalOpenAiForwardProvider(provider)) {
         return jsonResponse({ error: "provider openai must be the canonical built-in provider" }, 400);
       }
-      const { saveConfigPreservingClaudeCode: save } = await import("../../config");
       config.providers.openai = { ...provider, codexAccountMode: mode };
-      save(config);
+      saveManagementConfig(deps, config);
       reconcileLiveStateStores();
       (deps.clearProviderQuotaCache ?? clearProviderQuotaCache)();
       (deps.clearThreadAccountMap ?? clearThreadAccountMap)();
@@ -853,9 +850,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (config.providers[name]!.disabled) {
         return jsonResponse({ error: "cannot set a disabled provider as default", code: "default_provider_disabled" }, 400);
       }
-      const { saveConfigPreservingClaudeCode: save } = await import("../../config");
       config.defaultProvider = name;
-      save(config);
+      saveManagementConfig(deps, config);
       reconcileLiveStateStores();
       return jsonResponse({ success: true, name, defaultProvider: name });
     }
@@ -926,7 +922,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       // A PATCH that managed headers owns the resulting block: the clear path restores
       // registry static headers, so exact-match stripping must not erase them again.
       config.providers[name] = replay.headersTouched ? replay.next : stripRegistryOnlyStaticHeaders(name, replay.next);
-      saveConfigPreservingClaudeCode(config);
+      saveManagementConfig(deps, config);
     });
     if (replayError !== undefined) return jsonResponse({ error: replayError }, 409);
     reconcileLiveStateStores();
@@ -1125,13 +1121,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         combos: dependentCombos,
       }, 409);
     }
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     if (fallbackDefault) config.defaultProvider = fallbackDefault;
     delete config.providers[name];
     const { dropProviderCustomModels } = await import("../../providers/provider-id-rewrite");
     const droppedCustomModels = dropProviderCustomModels(config, name);
     setProviderContextCap(config, name, false);
-    save(config);
+    saveManagementConfig(deps, config);
     await replaceProviderAccountSet(name, null);
     reconcileLiveStateStores();
     const { clearModelCache: clearCache } = await import("../../codex/model-cache");
@@ -1156,7 +1151,6 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // property access, with the route's consistent 400 response.
     if (!isPlainRecord(rawBody)) return jsonResponse({ error: "provider-context-caps body must be a plain object" }, 400);
     const body = rawBody as { provider?: unknown; enabled?: unknown; value?: unknown; setAll?: unknown };
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     const { clearModelCache } = await import("../../codex/model-cache");
     const respond = (catalogRefresh: Awaited<ReturnType<typeof convergeCodexCatalog>>) => jsonResponse({
       ok: true,
@@ -1202,7 +1196,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         return jsonResponse({ error: "value must be a positive number" }, 400);
       }
       setProviderContextCap(config, provider, body.enabled, perProviderValue);
-      save(config);
+    saveManagementConfig(deps, config);
       reconcileLiveStateStores();
       clearModelCache(provider);
       const catalogRefresh = await convergeCodexCatalog();
@@ -1228,7 +1222,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       const affected = Object.keys(providerContextCaps(config));
       const applyToAll = body.setAll === true;
       setGlobalContextCapValue(config, normalizedValue, applyToAll);
-      save(config);
+      saveManagementConfig(deps, config);
       reconcileLiveStateStores();
       if (applyToAll) {
         for (const provider of affected) clearModelCache(provider);
@@ -1245,7 +1239,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       const before = Object.keys(providerContextCaps(config));
       const names = Object.keys(config.providers);
       setAllProviderContextCaps(config, names, body.setAll);
-      save(config);
+      saveManagementConfig(deps, config);
       reconcileLiveStateStores();
       for (const provider of new Set([...before, ...names])) clearModelCache(provider);
       const catalogRefresh = await convergeCodexCatalog();

package/src/server/management/replit-provider-routes.ts

@@ -9,6 +9,8 @@ function isPlainRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+const unavailableMutation = <T,>() => ({ status: "unavailable" as const, reason: "missing" as const });
+
 export async function handleReplitProviderRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog } = ctx;
 
@@ -41,7 +43,6 @@ export async function handleReplitProviderRoutes(ctx: ManagementContext): Promis
   if (body.setDefault !== undefined && typeof body.setDefault !== "boolean") {
     return jsonResponse({ error: "setDefault must be a boolean" }, 400);
   }
-
   const result = await installReplitProviderPair(config, {
     origin,
     gatewayKey,
@@ -49,10 +50,15 @@ export async function handleReplitProviderRoutes(ctx: ManagementContext): Promis
     replace: body.replace === true,
     setDefault: body.setDefault === true,
   }, {
-    mutatePersistedConfig: deps.mutatePersistedConfig,
+    // Direct management dispatch has no authority to activate the service's CLI fallback.
+    mutatePersistedConfig: deps.mutatePersistedConfig ?? unavailableMutation,
     probeFetch: deps.probeFetch,
   });
 
+  if (!deps.mutatePersistedConfig) {
+    return jsonResponse({ error: "management persistence unavailable" }, 500, req, config);
+  }
+
   if (!result.ok) {
     const status = result.code === "provider_collision"
       ? 409

package/src/server/management/routing-profile-routes.ts

@@ -20,12 +20,12 @@ import { assemblePolicyCandidateEvidence } from "../../routing/compatibility/ass
 import { activateLab, labActivationRequired } from "../../lib/lab-activation";
 import { quotaEvidenceForCandidate } from "../../routing/quota";
 import { routedProviderConfig } from "../../router";
-import { deleteConfigTopLevelKey, saveConfigPreservingClaudeCode, getConfigDir } from "../../config";
+import { deleteConfigTopLevelKey, getConfigDir } from "../../config";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { isPlainRecord } from "./shared";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { jsonResponse } from "../auth-cors";
-import type { ManagementContext } from "./context";
+import { saveManagementConfig, type ManagementContext } from "./context";
 import type { OcxConfig, OcxRoutingProfileConfig } from "../../types";
 
 function profileDto(config: Parameters<typeof getRoutingProfile>[0], id: string): Record<string, unknown> | null {
@@ -310,8 +310,7 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
       const newPublicModel = policyPublicModelId(id, getRoutingProfile(config, id)!);
       shouldSyncClaudeAgentDefs = migrateProfileModelReferences(config, oldPublicModel, newPublicModel);
     }
-    const save = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
-    save(config);
+    saveManagementConfig(deps, config);
     reconcileLiveStateStores();
     const catalogRefresh = await convergeCodexCatalog();
     if (shouldSyncClaudeAgentDefs) await syncClaudeAgentDefsBestEffort();
@@ -338,8 +337,7 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     delete nextProfiles[id];
     if (Object.keys(nextProfiles).length > 0) config.routingProfiles = nextProfiles;
     else deleteConfigTopLevelKey(config, "routingProfiles");
-    const saveConfigPreservingClaudeCodeSafe = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
-    saveConfigPreservingClaudeCodeSafe(config);
+    saveManagementConfig(deps, config);
     reconcileLiveStateStores();
     const catalogRefresh = await convergeCodexCatalog();
     return jsonResponse({ success: true, id, catalogRefresh }, 200, req, config);

package/src/server/management/shared.ts

@@ -10,7 +10,6 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,

package/src/server/management-api.ts

@@ -75,6 +75,7 @@ import { handleIntegrationRoutes } from "./management/integration-routes";
 import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
 import type { ManagementContext } from "./management/context";
 import type { ManagementPrincipal } from "./management-auth";
+import { ManagementPersistenceError, MissingManagementPersistenceError } from "./management/context";
 export type { ManagementApiDeps } from "./management/context";
 import { fetchAllModels } from "./management/shared";
 import { CatalogGatherBusyError } from "../codex/catalog/provider-fetch";
@@ -216,6 +217,10 @@ export async function handleManagementAPI(
     } catch { /* best-effort */ }
   }
   const ctx: ManagementContext = { req, url, config, deps, principal, convergeCodexCatalog, syncClaudeAgentDefsBestEffort };
+  const configBeforeDispatch = (["GET", "HEAD", "OPTIONS"].includes(req.method)
+    || (req.method === "POST" && url.pathname === "/api/providers/test"))
+    ? undefined
+    : structuredClone(config);
   let routed: Response | null;
   try {
     routed = (await handleConfigRoutes(ctx))
@@ -239,6 +244,13 @@ export async function handleManagementAPI(
   } catch (error) {
     const tooLarge = managementBodyTooLargeResponse(error, req, config);
     if (tooLarge) return tooLarge;
+    if (error instanceof MissingManagementPersistenceError || error instanceof ManagementPersistenceError) {
+      if (configBeforeDispatch === undefined) throw error;
+      const response = error instanceof ManagementPersistenceError ? error.response : undefined;
+      for (const key of Object.keys(config)) delete (config as unknown as Record<string, unknown>)[key];
+      Object.assign(config, configBeforeDispatch);
+      return response ?? jsonResponse({ error: "management persistence unavailable" }, 500, req, config);
+    }
     if (error instanceof OAuthMutationBusyError) {
       return new Response(JSON.stringify({ error: { type: "server_error", code: "oauth_mutation_busy", message: error.message } }), {
         status: 503,

package/src/server/responses/v2-routed-delegation-bridge.ts

@@ -1,4 +1,3 @@
-import { isDeepStrictEqual } from "node:util";
 import type { OcxParsedRequest, OcxTool } from "../../types";
 import type { SsePayloadRewrite } from "../sse-payload-rewrite";
 
@@ -7,6 +6,7 @@ const NATIVE_NAMESPACE = "collaboration";
 const MIRRORED_NAMES = new Set(["spawn_agent", "send_message", "followup_task"]);
 const GUIDANCE = "Use this routed-child mirror for collaboration operations.";
 const MAX_SSE_BINDINGS = 128;
+const injectedGroups = new WeakSet<object>();
 
 type RecordValue = Record<string, unknown>;
 
@@ -33,21 +33,38 @@ function rawToolLists(body: unknown, replayPrefixLength: number): unknown[][] {
 }
 
 function requestStateBody(body: unknown): unknown {
-  if (!isRecord(body) || !Array.isArray(body.input)) return body;
-  // Only additional_tools containers are mutated below. Clone that narrow path so the
-  // continuation cache retains the caller's catalog without copying unrelated context.
+  if (!isRecord(body)) return body;
+  const cloneTools = (tools: unknown[]) => tools.map(tool => (
+    isRecord(tool) && tool.type === "namespace" && Array.isArray(tool.tools)
+      ? { ...tool, tools: [...tool.tools] }
+      : tool
+  ));
+  if (!Array.isArray(body.tools) && !Array.isArray(body.input)) return body;
+  // Only tool catalogs are mutated below. Clone that narrow path so the continuation
+  // cache retains the caller's catalog without copying unrelated context.
   return {
     ...body,
-    input: body.input.map(item => (
+    ...(Array.isArray(body.tools) ? { tools: cloneTools(body.tools) } : {}),
+    ...(Array.isArray(body.input) ? { input: body.input.map(item => (
       isRecord(item) && item.type === "additional_tools" && Array.isArray(item.tools)
-        ? { ...item, tools: [...item.tools] }
+        ? { ...item, tools: cloneTools(item.tools) }
         : item
-    )),
+    )) } : {}),
   };
 }
 
 function mirrorTool(tool: RecordValue): RecordValue {
-  return { ...tool, description: `${GUIDANCE} ${tool.name}.` };
+  const parameters = isRecord(tool.parameters) ? tool.parameters : undefined;
+  const properties = isRecord(parameters?.properties) ? parameters.properties : undefined;
+  const message = isRecord(properties?.message) ? properties.message : undefined;
+  const { encrypted: _, ...plaintextMessage } = message ?? {};
+  return {
+    ...tool,
+    description: `${GUIDANCE} ${tool.name}.`,
+    ...(message && Object.hasOwn(message, "encrypted") ? {
+      parameters: { ...parameters, properties: { ...properties, message: plaintextMessage } },
+    } : {}),
+  };
 }
 
 function mirrorChildren(group: RecordValue): RecordValue[] {
@@ -85,25 +102,31 @@ export function injectV2RoutedDelegationBridge(
   for (const { group } of nativeGroups) {
     for (const child of mirrorChildren(group)) names.add(child.name as string);
   }
+  for (const { group } of existing) {
+    for (const child of mirrorChildren(group)) names.add(child.name as string);
+  }
   if (names.size === 0) return undefined;
 
   const expected = nativeGroups.map(({ list, index, group }) => ({ list, index: index + 1, group: mirrorGroup(group) }));
-  const idempotent = existing.length === expected.length && expected.every(candidate => {
-    const actual = candidate.list[candidate.index];
-    return isRecord(actual) && isDeepStrictEqual(actual, candidate.group);
-  });
+  const idempotent = existing.length === nativeGroups.length && existing.every(({ list, index, group }) => (
+    injectedGroups.has(group)
+    && nativeGroups.some(native => native.list === list && native.index + 1 === index)
+  ));
   if (existing.length > 0 && !idempotent) {
     throw new Error("v2 routed delegation bridge namespace collision");
   }
   if (!idempotent) {
-    for (const { list, index, group } of [...expected].reverse()) list.splice(index, 0, group);
+    for (const { list, index, group } of [...expected].reverse()) {
+      injectedGroups.add(group);
+      list.splice(index, 0, group);
+    }
   }
 
   const mirrorTools: OcxTool[] = [];
   for (const name of names) {
     const source = parsed.context.tools?.find(tool => tool.namespace === NATIVE_NAMESPACE && tool.name === name);
     if (source) {
-      mirrorTools.push({ ...source, namespace: MIRROR_NAMESPACE, description: `${GUIDANCE} ${name}.` });
+      mirrorTools.push({ ...mirrorTool(source as unknown as RecordValue), namespace: MIRROR_NAMESPACE } as OcxTool);
       continue;
     }
     const raw = nativeGroups.flatMap(entry => mirrorChildren(entry.group)).find(tool => tool.name === name);
@@ -114,7 +137,15 @@ export function injectV2RoutedDelegationBridge(
       parameters: isRecord(raw?.parameters) ? raw.parameters : {},
     });
   }
+  for (const { group } of nativeGroups) {
+    if (Array.isArray(group.tools)) group.tools = group.tools.filter(tool => (
+      !isRecord(tool) || typeof tool.name !== "string" || !MIRRORED_NAMES.has(tool.name)
+    ));
+  }
   if (mirrorTools.length > 0) {
+    parsed.context.tools = (parsed.context.tools ?? []).filter(tool => (
+      tool.namespace !== NATIVE_NAMESPACE || !MIRRORED_NAMES.has(tool.name)
+    ));
     const present = new Set((parsed.context.tools ?? [])
       .filter(tool => tool.namespace === MIRROR_NAMESPACE)
       .map(tool => tool.name));