feat: SOCKS5 outbound + Claude instructions cache stabilize

[Warexpor]

Summary

This branch is for Warexpor/opencodex only. It is not the upstream PR to lidge-jun/opencodex; that discussion is next.

Upstream sync. Fork dev was ~1560 commits behind lidge-jun/opencodex dev. It has been fast-forwarded to current upstream dev. This PR is rebased onto that tip.

SOCKS5 outbound. feat/outbound-socks5 was far behind current integration, so the work is re-applied onto today's dev rather than a raw rebase. Semantics preserved:

• ocx start --socks5 [host:port] (default socks5://127.0.0.1:10808) writes config.proxy and mirrors it to ALL_PROXY.
• --socks5-off clears only a saved SOCKS5 config.proxy.
• HTTP(S) config.proxy still fills HTTP_PROXY/HTTPS_PROXY when unset.
• SOCKS5 URLs use a dependency-free tunnel (src/lib/socks5-fetch.ts) with NO_PROXY, auth, streaming, and abort support. Codex WS falls back to SSE while SOCKS5 is configured (Clash mixed-port HTTP_PROXY cannot CONNECT a SOCKS listener).

Claude prompt-cache stabilize. Claude Code Anthropic→Responses translation puts system text into top-level instructions. Claude Code appends growing <total_tokens>…</total_tokens> footers (and occasional TaskCreate nudges) into that system text each turn, so instructions churns and Muse/Go prefix cache collapses even when tools stay stable. This change strips those dynamics from instructions and appends the latest notice as a trailing Responses input user message so the model still sees current budget without poisoning the cached prefix. tools and prompt_cache_key logic are unchanged.

Measured in a controlled suite on Muse Spark via Go: Claude hit-rate ~0.17 → ~0.86 after this stabilize. No extra tables.

Go session header. Fork main carried a second x-opencode-session helper. Current dev already does this via resolveOpenCodeGoTransport (opaque ocx_ ids, canonical HTTPS Go destination, omit when Claude has no usable identity). The duplicate path matched http://opencode.ai/zen/go/v1 and always filled a header, which failed Cross-platform CI. It is dropped; the existing dev affinity path is unchanged.

Verification

After dropping the duplicate Go session helper (all pass):

• bun test tests/adapters/routed-agent-messages.test.ts — pass (includes http://opencode.ai/zen/go/v1 Go-like destination)
• bun test tests/providers/opencode-go-session-header.test.ts — pass (Claude omit-affinity cases included)
• bun test tests/ci-workflows/repo-hygiene.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts — pass (no duplicate basenames; layout membership agrees)
• bun test tests/cli/start-args.test.ts tests/server/socks5-fetch.test.ts tests/server/proxy-env.test.ts — pass
• bun test tests/claude-integration/claude-inbound-cache-stabilize.test.ts tests/claude-integration/claude-inbound.test.ts — pass
• bun test tests/responses/responses-fetch-helpers-boundary.test.ts — pass
• bun test tests/responses/ws-upstream.test.ts -t "uses HTTP SSE when SOCKS5 outbound transport is configured" — pass
• bun run typecheck — pass
• bun run privacy:scan — pass

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

  

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.