fix(codex-bridge): preserve plaintext peer tasks and fail invalid transfers without retries

apps/desktop/assets/codex-bridge/kopru.py

@@ -42,7 +42,7 @@ from bekci_watch import MetadataFilter
 # Installed only by owned native launcher, never an HTTP control endpoint.
 WATCH_OWNER = None
 
-SURUM = "20"
+SURUM = "21"
 HERE = os.path.dirname(os.path.abspath(__file__))
 try:
     with open(os.path.abspath(__file__), "rb") as _f:
@@ -883,11 +883,27 @@ class SseRewriter:
                 self.bekleyen = d
                 return once
         return once + [d]
-    def _restore_tool_name(self, item):
+    def _restore_tool_name(self, item, plaintext=False):
         if isinstance(item, dict) and item.get("type") in ("function_call", "custom_tool_call"):
             identity = self.tool_names.get(item.get("name"))
             if identity:
                 item["namespace"], item["name"] = identity
+            if (plaintext and item.get("type") == "function_call"
+                    and item.get("namespace") == "collaboration"
+                    and item.get("name") in ("spawn_agent", "send_message", "followup_task")
+                    and "encrypted_function_args" not in item):
+                # Codex distinguishes missing encryption metadata (opaque) from
+                # an explicit empty list (plaintext). External providers return
+                # ordinary JSON strings; stamp only a complete readable message,
+                # after its final arguments arrive. Never override owner state.
+                try:
+                    message = json.loads(item.get("arguments") or "{}").get("message")
+                except (ValueError, AttributeError, TypeError):
+                    message = None
+                if (isinstance(message, str) and message.strip()
+                        and not message.startswith("gAAAA")
+                        and not re.fullmatch(r"[A-Za-z0-9_+/=-]{128,}", message)):
+                    item["encrypted_function_args"] = []
         return item
     def _fix(self, d):
         t = d.get("type", "")
@@ -923,10 +939,10 @@ class SseRewriter:
                     item = {"type": "custom_tool_call", "id": item.get("id"), "call_id": item.get("call_id"),
                             "name": item.get("name"), "input": inp, "status": "completed"}
                     fix_tool_ids({"input": [item]})
-                out.append(self._restore_tool_name(item))
+                out.append(self._restore_tool_name(item, plaintext=True))
             d["response"]["output"] = out
             fix_tool_ids({"input": out})
-        self._restore_tool_name(d.get("item"))
+        self._restore_tool_name(d.get("item"), plaintext=t == "response.output_item.done")
         return d
     def feed(self, chunk):
         self.buf += chunk