lynkr 9.14.20 → 9.14.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lynkr",
-  "version": "9.14.20",
+  "version": "9.14.22",
   "files": [
     "index.js",
     "install.sh",
@@ -38,7 +38,7 @@
     "start:supervised": "while true; do node index.js 2>&1 | npx pino-pretty --sync; code=$?; echo \"[supervisor] lynkr exited ($code) — restarting in 3s\"; sleep 3; done",
     "lint": "eslint src index.js",
     "test": "npm run test:unit && npm run test:performance",
-    "test:unit": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com LOG_FILE_ENABLED=false node --test test/routing.test.js test/hybrid-routing-integration.test.js test/retry-logic.test.js test/sse-transformer.test.js test/passthrough-stream.test.js test/passthrough-mode.test.js test/openrouter-error-resilience.test.js test/format-conversion.test.js test/azure-openai-config.test.js test/azure-openai-format-conversion.test.js test/azure-openai-routing.test.js test/azure-openai-streaming.test.js test/azure-openai-error-resilience.test.js test/azure-openai-integration.test.js test/openai-integration.test.js test/atlas-integration.test.js test/toon-compression.test.js test/gcf-compression.test.js test/llamacpp-integration.test.js test/resilience.test.js test/telemetry-routing.test.js test/memory/store.test.js test/memory/surprise.test.js test/memory/extractor.test.js test/memory/search.test.js test/memory/retriever.test.js test/memory/distiller.test.js test/memory/distiller-freeze.test.js test/memory/wiki.test.js test/memory/skills-cache.test.js test/memory/tencentdb-launcher.test.js test/distill.test.js test/large-payload.test.js test/prompt-cache-injection.test.js test/risk-analyzer.test.js test/interaction-block.test.js test/preflight.test.js test/token-reduction.test.js test/session-affinity.test.js test/cache-state.test.js test/cache-switch-cost.test.js test/lens-recommendations.test.js test/model-registry-cost.test.js test/output-format-guard.test.js test/tier-fallback.test.js test/wrap.test.js test/init.test.js test/tool-call-response-metadata.test.js test/degradation.test.js test/routing-telemetry-columns.test.js test/sticky-routing.test.js test/knn-ambiguous-escalate.test.js test/deescalator.test.js test/client-profiles.test.js test/strip-internal-fields.test.js test/complexity-tool-subtraction.test.js test/bandit.test.js test/routing-propensity.test.js test/reward-pipeline.test.js test/knn-cold-start.test.js test/calibration.test.js test/feedback-loop.test.js test/session-fingerprint.test.js test/side-request-guards.test.js test/verifier.test.js test/intent-score.test.js test/difficulty-classifier.test.js test/classifier-setup.test.js test/usage-stats.test.js test/loop-guard.test.js test/moonshot-model-mapping.test.js test/baidu-model-mapping.test.js test/tenant-policy-ingress-parity.test.js test/decide.test.js test/embeddings-degradation.test.js test/health-probe.test.js test/stuck-detector.test.js test/onnx-embedder.test.js test/ope.test.js test/hierarchical-budget.test.js test/token-rate-limit.test.js test/otel-export.test.js test/mcp-broker.test.js test/compression-budget.test.js test/gpt-utils.test.js test/dedup-observe-only.test.js test/context-window-header.test.js test/token-budget-auto.test.js test/opencode-setup.test.js test/auth-mode-first-party.test.js test/harness-envelope.test.js test/task-ledger.test.js test/jev-router.test.js test/jev-routing.test.js test/force-patterns.test.js test/upstream-fidelity.test.js test/tool-schema-compression.test.js test/passthrough-route.test.js test/quota-ledger.test.js test/shortfall-semantic.test.js test/routing-decisions.test.js test/routing-corpus.test.js test/switch-gate-grounding.test.js",
+    "test:unit": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com LOG_FILE_ENABLED=false node --test test/routing.test.js test/hybrid-routing-integration.test.js test/retry-logic.test.js test/sse-transformer.test.js test/passthrough-stream.test.js test/passthrough-mode.test.js test/openrouter-error-resilience.test.js test/format-conversion.test.js test/azure-openai-config.test.js test/azure-openai-format-conversion.test.js test/azure-openai-routing.test.js test/azure-openai-streaming.test.js test/azure-openai-error-resilience.test.js test/azure-openai-integration.test.js test/openai-integration.test.js test/atlas-integration.test.js test/toon-compression.test.js test/gcf-compression.test.js test/llamacpp-integration.test.js test/resilience.test.js test/telemetry-routing.test.js test/memory/store.test.js test/memory/surprise.test.js test/memory/extractor.test.js test/memory/search.test.js test/memory/retriever.test.js test/memory/distiller.test.js test/memory/distiller-freeze.test.js test/memory/wiki.test.js test/memory/skills-cache.test.js test/memory/tencentdb-launcher.test.js test/distill.test.js test/large-payload.test.js test/prompt-cache-injection.test.js test/risk-analyzer.test.js test/interaction-block.test.js test/preflight.test.js test/token-reduction.test.js test/session-affinity.test.js test/cache-state.test.js test/cache-switch-cost.test.js test/lens-recommendations.test.js test/model-registry-cost.test.js test/output-format-guard.test.js test/tier-fallback.test.js test/wrap.test.js test/init.test.js test/tool-call-response-metadata.test.js test/degradation.test.js test/routing-telemetry-columns.test.js test/sticky-routing.test.js test/knn-ambiguous-escalate.test.js test/deescalator.test.js test/client-profiles.test.js test/openai-ingress-tool-injection.test.js test/tool-result-compression-gate.test.js test/strip-internal-fields.test.js test/complexity-tool-subtraction.test.js test/bandit.test.js test/routing-propensity.test.js test/reward-pipeline.test.js test/knn-cold-start.test.js test/calibration.test.js test/feedback-loop.test.js test/session-fingerprint.test.js test/side-request-guards.test.js test/verifier.test.js test/intent-score.test.js test/difficulty-classifier.test.js test/classifier-setup.test.js test/usage-stats.test.js test/loop-guard.test.js test/moonshot-model-mapping.test.js test/baidu-model-mapping.test.js test/tenant-policy-ingress-parity.test.js test/decide.test.js test/embeddings-degradation.test.js test/health-probe.test.js test/stuck-detector.test.js test/onnx-embedder.test.js test/ope.test.js test/hierarchical-budget.test.js test/token-rate-limit.test.js test/otel-export.test.js test/mcp-broker.test.js test/compression-budget.test.js test/gpt-utils.test.js test/dedup-observe-only.test.js test/context-window-header.test.js test/token-budget-auto.test.js test/opencode-setup.test.js test/auth-mode-first-party.test.js test/harness-envelope.test.js test/task-ledger.test.js test/jev-router.test.js test/jev-routing.test.js test/force-patterns.test.js test/upstream-fidelity.test.js test/tool-schema-compression.test.js test/passthrough-route.test.js test/quota-ledger.test.js test/shortfall-semantic.test.js test/routing-decisions.test.js test/routing-corpus.test.js test/switch-gate-grounding.test.js",
     "test:memory": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node --test test/memory/store.test.js test/memory/surprise.test.js test/memory/extractor.test.js test/memory/search.test.js test/memory/retriever.test.js test/memory/distiller.test.js test/memory/distiller-freeze.test.js test/memory/wiki.test.js test/memory/skills-cache.test.js test/memory/tencentdb-launcher.test.js",
     "test:new-features": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node --test test/passthrough-mode.test.js test/openrouter-error-resilience.test.js test/format-conversion.test.js",
     "test:performance": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node test/hybrid-routing-performance.test.js && DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node test/performance-tests.js",

package/src/api/openai-router.js

@@ -28,6 +28,23 @@ const clientProfiles = require("../routing/client-profiles");
 
 const router = express.Router();
 
+/**
+ * WS3 — client-profile detection for the OpenAI-compat ingress. Wraps
+ * src/routing/client-profiles.js so a detector bug can never fail a request.
+ *
+ * @param {object} headers - incoming request headers
+ * @param {object} payload - the Anthropic-shaped request (tools as sent, or as injected)
+ * @returns {object|null} matched profile or null
+ */
+function detectClientProfile(headers, payload) {
+  try {
+    return clientProfiles.detectClient({ headers, payload }) || null;
+  } catch (err) {
+    logger.debug({ err: err.message }, "[OpenAI Router] client profile detection failed");
+    return null;
+  }
+}
+
 /**
  * Served-model decision headers for the OpenAI-compat ingress.
  *
@@ -551,48 +568,66 @@ router.post("/chat/completions", async (req, res) => {
 
     const anthropicRequest = convertOpenAIToAnthropic(req.body);
 
-    // Inject tools if client didn't send any.
-    // Two-layer filtering:
-    //   1. IDE_SAFE_TOOLS = STANDARD_TOOLS minus AskUserQuestion (can't work through proxy)
-    //   2. For known clients (codex, cline, etc.), further filter to only tools
-    //      that have a mapping in CLIENT_TOOL_MAPPINGS — this ensures clients like
-    //      Codex don't see tools they can't handle (Task, WebFetch, NotebookEdit)
-    //      while Claude Code (unknown client) gets the full IDE_SAFE_TOOLS set.
-    // Skip injection if client explicitly opted out (tool_choice: "none" or empty tools array).
+    // WS3 — detect the client harness BEFORE tool injection, on the request
+    // as the client sent it (user-agent / x-client header, prompt marker, or
+    // the tools it actually attached). A profile found here may veto
+    // injection (`injectTools: false`): app harnesses such as OpenMausBot
+    // execute only the tools they sent, so an injected IDE_SAFE_TOOLS
+    // tool_call would come back to them as a failed turn. For every other
+    // client this pass matches exactly what the post-injection pass below
+    // used to — a harness that identifies itself or fingerprints on its own
+    // loadout matches the same profile either way.
+    let clientProfile = detectClientProfile(req.headers, anthropicRequest);
+
+    // Tool injection — ONLY for the coding harnesses Lynkr has a tool mapping
+    // for (CLIENT_TOOL_MAPPINGS: codex, cline, kilo, continue). They expect
+    // Lynkr's IDE_SAFE_TOOLS under their own names, filtered to the tools
+    // they can execute (no Task / WebFetch / NotebookEdit for Codex).
+    //
+    // Everyone else gets their request upstream exactly as sent. Until
+    // 2026-10 an unrecognized tool-less request received the full
+    // IDE_SAFE_TOOLS set; that turned every tool-less chat — Cursor's chat
+    // mode, goose's summarizer side-requests, Terminus, OpenMausBot bots,
+    // plain curl — into a tool-calling turn the caller could not execute,
+    // the same failure #120 removed on the provider side. A client profile
+    // with `injectTools: false` additionally vetoes injection outright.
+    //
+    // An explicit opt-out (tool_choice: "none" or any tools array, even
+    // empty) is honoured for every client, mapped or not.
     const clientType = detectClient(req.headers);
+    const clientMappings = CLIENT_TOOL_MAPPINGS[clientType];
     const clientExplicitlyDisabledTools = req.body.tool_choice === "none" || Array.isArray(req.body.tools);
-    if (!clientExplicitlyDisabledTools && (!anthropicRequest.tools || anthropicRequest.tools.length === 0)) {
-      const clientMappings = CLIENT_TOOL_MAPPINGS[clientType];
-      let clientTools = clientMappings
-        ? IDE_SAFE_TOOLS.filter(t => clientMappings[t.name])
-        : IDE_SAFE_TOOLS;
+    const requestHasNoTools = !anthropicRequest.tools || anthropicRequest.tools.length === 0;
+    if (clientProfiles.vetoesToolInjection(clientProfile)) {
+      logger.debug({
+        clientType,
+        clientProfile: clientProfile?.name ?? null,
+        reqToolsPresent: Array.isArray(req.body.tools),
+      }, "=== TOOLS NOT INJECTED — client profile executes only the tools it sent ===");
+    } else if (requestHasNoTools && !clientExplicitlyDisabledTools && !clientMappings) {
+      logger.debug({
+        clientType,
+        clientProfile: clientProfile?.name ?? null,
+      }, "=== TOOLS NOT INJECTED — no tool mapping for this client; request forwarded tool-less ===");
+    } else if (requestHasNoTools && !clientExplicitlyDisabledTools) {
+      const clientTools = IDE_SAFE_TOOLS.filter(t => clientMappings[t.name]);
       anthropicRequest.tools = clientTools;
       logger.debug({
         clientType,
         injectedToolCount: clientTools.length,
         injectedToolNames: clientTools.map(t => t.name),
-        reason: clientMappings
-          ? `Known client '${clientType}' — filtered to mapped tools only`
-          : "Unknown client — injecting full IDE_SAFE_TOOLS"
+        reason: `Known client '${clientType}' — filtered to mapped tools only`,
       }, "=== INJECTING TOOLS ===");
     }
 
-    // WS3 — detect the client harness on the OpenAI-compat paths too (the
-    // /v1/messages router already does this). Runs after tool injection so
-    // the fingerprint sees the final tools array either way: goose/Cursor
-    // send their own loadout, tool-less clients get IDE_SAFE_TOOLS injected
-    // and fingerprint as claude-code. Without this the agentic detector
-    // counts the harness baseline as intent and floors every request —
-    // including "hi" — at the ITERATIVE minTier (COMPLEX).
-    try {
-      const profile = clientProfiles.detectClient({
-        headers: req.headers,
-        payload: anthropicRequest,
-      });
-      if (profile) anthropicRequest._clientProfile = profile;
-    } catch (err) {
-      logger.debug({ err: err.message }, "[OpenAI Router] client profile detection failed");
+    // WS3 — second detection pass, only when the first found nothing and
+    // tools were just injected: the mapped loadout may now fingerprint a
+    // profile (see lynkr-injected in client-profiles.js) so the agentic
+    // detector does not count Lynkr's own tools as user intent.
+    if (!clientProfile && anthropicRequest.tools?.length) {
+      clientProfile = detectClientProfile(req.headers, anthropicRequest);
     }
+    if (clientProfile) anthropicRequest._clientProfile = clientProfile;
 
     // Explicit model/effort pin: Codex's model picker (or any OpenAI-format
     // caller) can name a real OpenAI model + reasoning.effort combo that
@@ -1861,46 +1896,47 @@ router.post("/responses", async (req, res) => {
       }))
     }, "After Chat→Anthropic conversion");
 
-    // Inject tools if the Anthropic request has none.
+    // Tool injection — ONLY for clients with a CLIENT_TOOL_MAPPINGS entry
+    // (Codex is the one that actually uses this route). See the matching
+    // block in /v1/chat/completions for the full rationale; unrecognized
+    // tool-less callers are forwarded tool-less, and an `injectTools: false`
+    // client profile vetoes injection outright.
     // The client may have sent tools in Responses API format (top-level name)
     // which convertOpenAIToAnthropic silently drops because it expects Chat
     // Completions format ({function: {name}}).  Always check the CONVERTED
     // result, not the raw request.
+    let clientProfile = detectClientProfile(req.headers, anthropicRequest);
     const clientDisabledToolChoice = req.body.tool_choice === "none";
-    if (!clientDisabledToolChoice && (!anthropicRequest.tools || anthropicRequest.tools.length === 0)) {
+    const requestHasNoTools = !anthropicRequest.tools || anthropicRequest.tools.length === 0;
+    if (clientProfiles.vetoesToolInjection(clientProfile)) {
+      logger.info({
+        clientType,
+        clientProfile: clientProfile?.name ?? null,
+        toolCount: anthropicRequest.tools?.length || 0,
+      }, "=== TOOLS NOT INJECTED (responses) — client profile executes only the tools it sent ===");
+    } else if (requestHasNoTools && !clientDisabledToolChoice && !clientMappings) {
+      logger.info({
+        clientType,
+        clientProfile: clientProfile?.name ?? null,
+      }, "=== TOOLS NOT INJECTED (responses) — no tool mapping for this client; request forwarded tool-less ===");
+    } else if (requestHasNoTools && !clientDisabledToolChoice) {
       // Exclude server-side-only tools (Task, web_search, etc.) from the
       // Responses endpoint — they can't be executed by external clients like
       // Codex and would be converted to broken shell echo commands.
       const RESPONSES_EXCLUDED_TOOLS = new Set(["Task", "AskUserQuestion", "TodoWrite", "WebSearch", "WebFetch", "WebAgent"]);
-      const clientMappings = CLIENT_TOOL_MAPPINGS[clientType];
-      let clientTools = (clientMappings
-        ? IDE_SAFE_TOOLS.filter(t => clientMappings[t.name])
-        : IDE_SAFE_TOOLS
-      ).filter(t => !RESPONSES_EXCLUDED_TOOLS.has(t.name));
-
       // Rename tools to client-expected names so the model uses the right names
       // e.g., for Codex: "Read" → "read_file", "Bash" → "shell"
       // The lynkrToClient map above normalizes any stale Lynkr names in history
-      if (clientMappings) {
-        clientTools = clientTools.map(t => {
-          const mapping = clientMappings[t.name];
-          if (!mapping) return t;
-          return {
-            ...t,
-            name: mapping.name,
-            description: t.description || '',
-          };
-        });
-      }
+      const clientTools = IDE_SAFE_TOOLS
+        .filter(t => clientMappings[t.name] && !RESPONSES_EXCLUDED_TOOLS.has(t.name))
+        .map(t => ({ ...t, name: clientMappings[t.name].name, description: t.description || '' }));
 
       anthropicRequest.tools = clientTools;
       logger.info({
         clientType,
         injectedToolCount: clientTools.length,
         injectedToolNames: clientTools.map(t => t.name),
-        reason: clientMappings
-          ? `Known client '${clientType}' — tools renamed to client conventions`
-          : "Unknown client — injecting full IDE_SAFE_TOOLS"
+        reason: `Known client '${clientType}' — tools renamed to client conventions`,
       }, "=== INJECTING TOOLS (responses) ===");
     } else {
       logger.info({
@@ -1923,22 +1959,14 @@ router.post("/responses", async (req, res) => {
       anthropicRequest.tools = anthropicRequest.tools.filter(t => !RESPONSES_EXCLUDED.has(t.name));
     }
 
-    // WS3 — detect the client harness on the OpenAI-compat paths too (the
-    // /v1/messages router already does this). Runs after tool injection so
-    // the fingerprint sees the final tools array either way: goose/Cursor
-    // send their own loadout, tool-less clients get IDE_SAFE_TOOLS injected
-    // and fingerprint as claude-code. Without this the agentic detector
-    // counts the harness baseline as intent and floors every request —
-    // including "hi" — at the ITERATIVE minTier (COMPLEX).
-    try {
-      const profile = clientProfiles.detectClient({
-        headers: req.headers,
-        payload: anthropicRequest,
-      });
-      if (profile) anthropicRequest._clientProfile = profile;
-    } catch (err) {
-      logger.debug({ err: err.message }, "[OpenAI Router] client profile detection failed");
+    // WS3 — second detection pass, only when the pre-injection pass found
+    // nothing and tools were just injected, so the mapped loadout can
+    // fingerprint a profile and the agentic detector does not count Lynkr's
+    // own tools as user intent.
+    if (!clientProfile && anthropicRequest.tools?.length) {
+      clientProfile = detectClientProfile(req.headers, anthropicRequest);
     }
+    if (clientProfile) anthropicRequest._clientProfile = clientProfile;
 
     // Explicit model/effort pin — see the identical block in /chat/completions
     // above for the full rationale. This is the route Codex Desktop actually

package/src/orchestrator/index.js

@@ -3,6 +3,7 @@ const { invokeModel, toolsDeclined } = require("../clients/databricks");
 const { appendTurnToSession } = require("../sessions/record");
 const { upsertSession } = require("../sessions/store");
 const policy = require("../policy");
+const { vetoesToolResultCompression } = require("../routing/client-profiles");
 const logger = require("../logger");
 const promptCache = require("../cache/prompt");
 const tokens = require("../utils/tokens");
@@ -1955,8 +1956,10 @@ IMPORTANT TOOL USAGE RULES:
   }
 
   // RTK-inspired tool result compression: compress large tool_results
-  // before they reach the model (saves 60-90% on test/git/lint output)
-  if (config.toolResultCompression?.enabled !== false) {
+  // before they reach the model (saves 60-90% on test/git/lint output).
+  // Skipped for clients whose profile says their tool results are data,
+  // not re-runnable command output (see toolResultCompressionAllowed).
+  if (toolResultCompressionAllowed(cleanPayload)) {
     const { compressToolResults } = require("../context/tool-result-compressor");
     // Fixed threshold: compression must be deterministic per message — the
     // routed tier flaps between turns, and re-compressing history differently
@@ -3299,8 +3302,36 @@ function trimLoopMessages(messages, max) {
   return trimmed;
 }
 
+/**
+ * Whether the tool-result compressor may run on this request's history.
+ *
+ * Off globally via TOOL_RESULT_COMPRESSION_ENABLED=false. Otherwise on,
+ * unless the request's detected client profile (src/routing/client-profiles.js,
+ * attached by the ingress routers as `payload._clientProfile`) carries
+ * `compressToolResults: false`. The compressor was built for shell output a
+ * coding agent can re-run; an app harness such as OpenMausBot sends tool
+ * results that ARE the data, and may append its own paging notice (saved
+ * result id + offset) that compressJSON would delete — the model then pages
+ * with a bad id and the harness fails the turn (2026-10-14).
+ *
+ * @param {object} payload - sanitized request payload
+ * @returns {boolean}
+ */
+function toolResultCompressionAllowed(payload) {
+  if (config.toolResultCompression?.enabled === false) return false;
+  if (vetoesToolResultCompression(payload?._clientProfile)) {
+    logger.debug({
+      clientProfile: payload._clientProfile?.name,
+    }, "Tool result compression skipped — client profile keeps tool results intact");
+    return false;
+  }
+  return true;
+}
+
 module.exports = {
   processMessage,
+  // Exported for unit testing of the client-profile gate on tool-result compression.
+  toolResultCompressionAllowed,
   // Exported for unit testing of sanitizePayload tool handling.
   sanitizePayload,
   // Exported for unit testing of response-metadata conversion.

package/src/routing/client-profiles.js

@@ -11,10 +11,28 @@
  * specific spot for one specific client — but it also discarded real MCP
  * tools the user had configured, and did nothing for Cursor / Codex.
  *
- * This module fixes the root cause. Given a request's `user-agent` header
- * and its tools list, `detectClient` returns the matching profile (or null),
- * and `effectiveTools` subtracts the baseline so the agentic detector scores
- * only tools the user actually added beyond the harness default.
+ * This module fixes the root cause. Given a request's `user-agent` (or
+ * `x-client`) header and its tools list, `detectClient` returns the matching
+ * profile (or null), and `effectiveTools` subtracts the baseline so the
+ * agentic detector scores only tools the user actually added beyond the
+ * harness default.
+ *
+ * A profile may also carry behaviour flags the ingress routers read:
+ *   - `toolless: true`     — the client never sends tools; src/api/router.js
+ *                            uses it to tell harness side-traffic from plain
+ *                            API clients.
+ *   - `injectTools: false` — the OpenAI-compat routers must NOT inject
+ *                            IDE_SAFE_TOOLS for this client. App harnesses
+ *                            such as OpenMausBot execute only the tools they
+ *                            sent; an injected tool_call comes back to them
+ *                            as a failed turn. See `vetoesToolInjection`.
+ *   - `compressToolResults: false` — the orchestrator must NOT run the
+ *                            RTK-style tool-result compressor on this
+ *                            client's history. It was built for shell output
+ *                            a coding agent can re-run; an app harness's tool
+ *                            results are the data itself, and the harness may
+ *                            append its own paging notice that the compressor
+ *                            would delete. See `vetoesToolResultCompression`.
  *
  * @module routing/client-profiles
  */
@@ -80,14 +98,16 @@ const PROFILES = {
   'lynkr-injected': {
     name: 'lynkr-injected',
     baselineTools: new Set([
-      // Lynkr's own IDE_SAFE_TOOLS loadout (src/clients/standard-tools.js),
-      // injected by the OpenAI-compat routers when a client sends no tools.
-      // These are Lynkr plumbing, not user intent: without this profile the
-      // agentic detector counts its own injected tools and floors every
-      // tool-less client (e.g. goose's summarizer side-requests) at
-      // ITERATIVE/COMPLEX. Matches claude-code's names plus the four
-      // (MultiEdit, LS, NotebookRead, WebAgent) that keep it from
-      // fingerprinting as claude-code.
+      // Lynkr's own IDE_SAFE_TOOLS loadout (src/clients/standard-tools.js).
+      // Until 2026-10 the OpenAI-compat routers injected it into every
+      // tool-less request from an unrecognized client; they now inject only
+      // for clients with a CLIENT_TOOL_MAPPINGS entry (codex, cline, kilo,
+      // continue), filtered to the mapped names. The profile stays so a
+      // request that does carry this loadout — a mapped client, or a caller
+      // replaying one — is still read as Lynkr plumbing, not user intent:
+      // otherwise the agentic detector floors it at ITERATIVE/COMPLEX.
+      // Matches claude-code's names plus the four (MultiEdit, LS,
+      // NotebookRead, WebAgent) that keep it from fingerprinting as claude-code.
       'Write', 'Read', 'Edit', 'Bash', 'Glob', 'Grep', 'MultiEdit', 'LS',
       'NotebookRead', 'TodoWrite', 'Task', 'WebSearch', 'WebFetch',
       'WebAgent', 'NotebookEdit',
@@ -187,6 +207,69 @@ const PROFILES = {
       minToolFingerprintMatch: 0.5,
     },
   },
+  'openmausbot': {
+    name: 'openmausbot',
+    // OpenMausBot (github.com/milind-soni/OpenMausBot) is a messaging app
+    // whose bots run as `openai-compat` engines against /v1/chat/completions
+    // (server/drivers/openai-chat.ts). It executes ONLY the tools it sent —
+    // its own harness (ask_user + whichever MCP servers the bot mounted) —
+    // and omits the `tools` key entirely when a bot has none. Without this
+    // profile a tool-less bot got the full IDE_SAFE_TOOLS loadout injected
+    // (the router only treats an *array* as an opt-out), fingerprinted as
+    // lynkr-injected, and the first Read/Bash call came back as "provider
+    // returned tool calls, but no tools are available for this turn".
+    injectTools: false,
+    // OpenMausBot truncates oversized tool results itself and appends a
+    // notice carrying a saved result id + offset for agents_tool_result_read.
+    // Lynkr's compressJSON rewrote a 15 KB Composio result to a 111-char key
+    // skeleton (2026-10-14), deleting that notice; the model then paged with
+    // a bad id and OpenMausBot failed the turn. Its tool results are data,
+    // not re-runnable command output — leave them intact.
+    compressToolResults: false,
+    baselineTools: new Set([
+      // Attached whenever the bot may ask the user a question
+      // (shared/ask-question.ts, pushed in openai-chat.ts).
+      'ask_user',
+      // The built-in "agents" MCP server (server/drivers/agents-catalog.ts),
+      // mounted by chat-mcp-tools.ts as `agents_<tool>`. Bot-scoped core
+      // loadout as of OpenMausBot 0.1.110; the feature-gated names (skills_*,
+      // shared computers, send_voice_note, chief-only, vm_exec on cloud
+      // homes) are left out — subtraction only removes names present.
+      'agents_tool_result_read', 'agents_list_room_targets',
+      'agents_coordinate_bots', 'agents_assignment_status',
+      'agents_list_bots', 'agents_list_rooms', 'agents_select_computer',
+      'agents_list_threads', 'agents_close_thread', 'agents_start_thread',
+      'agents_attach_file', 'agents_post_to_room',
+      'agents_request_credential', 'agents_request_sign_in',
+      'agents_fill_login', 'agents_memory_update', 'agents_memory_log',
+      'agents_session_search', 'agents_session_read',
+      'agents_list_routines', 'agents_propose_routine',
+      'agents_propose_routine_action', 'agents_propose_profile',
+      'agents_propose_model', 'agents_propose_team_memory',
+      'agents_add_mcp_server',
+    ]),
+    detect: {
+      // OpenMausBot 0.1.x sends NO user-agent and no x-client header (its
+      // fetch sets only authorization + content-type), so today detection
+      // rests on the tool fingerprint and the prompt marker below. The
+      // header pattern is for a release that identifies itself, or an
+      // operator fronting the app with an `x-client: openmausbot` header.
+      headerPatterns: [/openmausbot/i],
+      // The app prepends a context note to the user turn whenever its
+      // volatile prompt sections changed (server/drivers/prompt-split.ts).
+      // Not on every turn, but the only stable "OpenMausBot" text a
+      // tool-less bot ever sends — best-effort, never a false positive.
+      promptPatterns: [
+        /Context from OpenMausBot updated since this conversation started/i,
+        /OpenMausBot context notes from earlier in this conversation/i,
+      ],
+      // 0.5: memory can be off (-2 names), a non-chief bot sees the same
+      // propose_* names, and a bot whose agents server is unmounted sends
+      // just ask_user and will not match — correct: with tools present there
+      // is no injection to veto and nothing of ours to subtract.
+      minToolFingerprintMatch: 0.5,
+    },
+  },
 };
 
 // Union of every baseline tool across all known profiles — used for the
@@ -203,7 +286,14 @@ function _knownBaselineTools() {
 }
 
 // User overrides / additions from data/client-profiles.json — loaded once
-// at first use. Shape: { profileName: { baselineTools: [...], detect: {...} } }
+// at first use. Shape:
+//   { profileName: { baselineTools: [...], headerPatterns: [...],
+//                    promptPatterns: [...], minToolFingerprintMatch: 0.8,
+//                    toolless: false, injectTools: true,
+//                    compressToolResults: true } }
+// Every key is optional. An omitted key keeps the seed profile's value (or
+// the default for a brand-new name), so overriding one field — say, a newer
+// baseline for openmausbot — never silently drops its injectTools veto.
 let _userProfilesLoaded = false;
 function _loadUserProfiles() {
   if (_userProfilesLoaded) return;
@@ -214,20 +304,32 @@ function _loadUserProfiles() {
     const raw = JSON.parse(fs.readFileSync(overridePath, 'utf8'));
     for (const [name, def] of Object.entries(raw || {})) {
       if (!def || typeof def !== 'object') continue;
+      const seed = PROFILES[name];
       const baseline = Array.isArray(def.baselineTools)
         ? new Set(def.baselineTools)
-        : PROFILES[name]?.baselineTools ?? new Set();
+        : seed?.baselineTools ?? new Set();
       const patterns = Array.isArray(def.headerPatterns)
         ? def.headerPatterns.map((p) => new RegExp(p, 'i'))
-        : PROFILES[name]?.detect?.headerPatterns ?? [];
+        : seed?.detect?.headerPatterns ?? [];
+      const promptPatterns = Array.isArray(def.promptPatterns)
+        ? def.promptPatterns.map((p) => new RegExp(p, 'i'))
+        : seed?.detect?.promptPatterns ?? [];
+      const flag = (key) => (typeof def[key] === 'boolean' ? def[key] : seed?.[key]);
+      const toolless = flag('toolless');
+      const injectTools = flag('injectTools');
+      const compressToolResults = flag('compressToolResults');
       PROFILES[name] = {
         name,
+        ...(toolless === undefined ? {} : { toolless }),
+        ...(injectTools === undefined ? {} : { injectTools }),
+        ...(compressToolResults === undefined ? {} : { compressToolResults }),
         baselineTools: baseline,
         detect: {
           headerPatterns: patterns,
+          promptPatterns,
           minToolFingerprintMatch: Number.isFinite(def.minToolFingerprintMatch)
             ? def.minToolFingerprintMatch
-            : 0.8,
+            : seed?.detect?.minToolFingerprintMatch ?? 0.8,
         },
       };
     }
@@ -247,7 +349,10 @@ function _toolName(t) {
  *
  * Match order:
  *   1. user-agent header regex — strongest signal, cheap.
- *   2. Tool-set fingerprint — ≥ minToolFingerprintMatch (default 80%) of the
+ *   2. x-client / x-client-name header regex — same patterns; lets a client
+ *      (or an operator fronting one) name itself when it cannot set a UA.
+ *   3. First user message vs. the profile's promptPatterns.
+ *   4. Tool-set fingerprint — ≥ minToolFingerprintMatch (default 80%) of the
  *      profile's baseline tool names must be present in payload.tools.
  *
  * @param {Object} args
@@ -259,10 +364,19 @@ function detectClient({ headers = {}, payload = {} } = {}) {
   _loadUserProfiles();
 
   const ua = String(headers['user-agent'] || headers['User-Agent'] || '');
-  if (ua) {
+  const xClient = String(
+    headers['x-client'] || headers['X-Client']
+    || headers['x-client-name'] || headers['X-Client-Name'] || ''
+  );
+  for (const header of [ua, xClient]) {
+    if (!header) continue;
     for (const profile of Object.values(PROFILES)) {
-      for (const pattern of profile.detect.headerPatterns) {
-        if (pattern.test(ua)) return profile;
+      for (const pattern of (profile.detect?.headerPatterns || [])) {
+        try {
+          if (pattern.test(header)) return profile;
+        } catch (err) {
+          logger.warn({ profile: profile.name, pattern: String(pattern), err: err.message }, 'Client profile header pattern failed');
+        }
       }
     }
   }
@@ -344,6 +458,31 @@ function allToolsAreBaseline(payload) {
   return true;
 }
 
+/**
+ * True when the detected profile says the client executes only the tools it
+ * sent, so the OpenAI-compat routers must not inject IDE_SAFE_TOOLS for it.
+ * A null / unrecognized profile never vetoes — injection for unrecognized
+ * tool-less clients is unchanged.
+ *
+ * @param {Object|null} profile
+ * @returns {boolean}
+ */
+function vetoesToolInjection(profile) {
+  return !!profile && profile.injectTools === false;
+}
+
+/**
+ * True when the detected profile says this client's tool results must reach
+ * the model unmodified, so the orchestrator skips the tool-result compressor
+ * for the request. A null / unrecognized profile never vetoes.
+ *
+ * @param {Object|null} profile
+ * @returns {boolean}
+ */
+function vetoesToolResultCompression(profile) {
+  return !!profile && profile.compressToolResults === false;
+}
+
 /** Test helper — clear cached override state (unit tests reload from disk). */
 function _resetForTests() {
   _userProfilesLoaded = false;
@@ -355,5 +494,7 @@ module.exports = {
   detectClient,
   effectiveTools,
   allToolsAreBaseline,
+  vetoesToolInjection,
+  vetoesToolResultCompression,
   _resetForTests,
 };

package/src/routing/complexity-analyzer.js

@@ -113,9 +113,30 @@ const FORCE_REASONING_PATTERNS = [
   // and generic nouns (module/api/database) that misfire on non-technical
   // asks. Known overlap: "explain the deployment plan" fires — accepted,
   // deployment planning benefits from the strong model anyway.
-  /(?=.*\b(plans?|roadmaps?|strateg(y|ies)|blueprints?|proposals?|rfcs?|design\s+docs?)\b)(?=.*\b(refactor\w*|implement\w*|migrat\w+|architect\w+|redesign\w*|restructur\w+|rewrit\w+|overhaul\w*|codebases?|infrastructure|pipelines?|deploy\w*|systems?)\b)/i,
+  // NOTE: the frontier-planning trigger lives below as two independent
+  // regexes (PLANNING_ASK_RE / TECHNICAL_SCOPE_RE), not in this array.
 ];
 
+// Frontier planning (the removed array entry above): asking FOR a
+// plan/strategy/design of technical work — a plan word AND a technical
+// scope word must both be present, so "plan my vacation", "lesson plan"
+// and "business plan" stay quiet while "give me a plan to refactor X"
+// escalates. Implemented as two independent whole-content tests instead of
+// a single (?=.*A)(?=.*B) lookahead regex: `.` never crosses a newline, so
+// on long lines every start position rescans `.*` to end-of-line — O(n²).
+// A single 200KB line measured 61s per call, ×2 calls per request via
+// determineProviderSmart → 150s+ end-to-end (live incident 2026-10-15:
+// /v1/messages 50k-token single-line probe). Two linear passes preserve
+// the documented intent: co-occurrence anywhere in the ask, either order.
+const PLANNING_ASK_RE =
+  /\b(plans?|roadmaps?|strateg(y|ies)|blueprints?|proposals?|rfcs?|design\s+docs?)\b/i;
+const TECHNICAL_SCOPE_RE =
+  /\b(refactor\w*|implement\w*|migrat\w+|architect\w+|redesign\w*|restructur\w+|rewrit\w+|overhaul\w*|codebases?|infrastructure|pipelines?|deploy\w*|systems?)\b/i;
+
+function isFrontierPlanningAsk(content) {
+  return PLANNING_ASK_RE.test(content) && TECHNICAL_SCOPE_RE.test(content);
+}
+
 // Force COMPLEX patterns - route to COMPLEX (GLM in config B) regardless of
 // score. Architecture/refactor/code-review are substantial but not
 // security-critical, so GLM is appropriate.
@@ -506,6 +527,10 @@ function scoreTaskType(content) {
     }
   }
 
+  if (isFrontierPlanningAsk(content)) {
+    return { score: 100, reason: 'force_reasoning', pattern: 'frontier_planning_two_sided' };
+  }
+
   for (const pattern of FORCE_LOCAL_PATTERNS) {
     if (pattern.test(content)) {
       return { score: 0, reason: 'force_local', pattern: 'greeting_or_simple' };
@@ -1005,7 +1030,8 @@ function shouldForceCloud(payload) {
 function shouldForceReasoning(payload) {
   if (process.env.FORCE_TIER_PATTERNS === "false") return false;
   const content = extractContent(payload);
-  const matched = FORCE_REASONING_PATTERNS.find(pattern => pattern.test(content));
+  let matched = FORCE_REASONING_PATTERNS.find((pattern) => pattern.test(content));
+  if (!matched && isFrontierPlanningAsk(content)) matched = PLANNING_ASK_RE;
   if (matched) {
     logger.debug({ pattern: matched.source.slice(0, 50), text: content.slice(0, 100) }, '[Force] force_reasoning matched');
   }
@@ -1159,6 +1185,9 @@ module.exports = {
   FORCE_REASONING_PATTERNS,
   FORCE_CLOUD_PATTERNS,
   FORCE_LOCAL_PATTERNS,
+  PLANNING_ASK_RE,
+  TECHNICAL_SCOPE_RE,
+  isFrontierPlanningAsk,
   DIMENSION_WEIGHTS,
   TOOL_COMPLEXITY_WEIGHTS,
   DOMAIN_KEYWORDS,