@bitkyc08/opencodex 2.56.0 → 2.58.0

package/src/types/config.ts

@@ -749,6 +749,10 @@ export interface OcxConfig {
   shutdownTimeoutMs?: number;
   /** Advertise supports_websockets so Codex opens the WS endpoint. Default false; set true to opt in. */
   websockets?: boolean;
+  /** Experimental single-lane native OpenAI WebSocket steering; default off. */
+  codexNativeSteering?: boolean;
+  /** Experimental, default-off saved function-result injection on native multi-agent WebSockets. */
+  codexNativeInjection?: boolean;
   /**
    * Opt-in auto-cleanup policy for archived Codex sessions (issue #42 Phase 3).
    * Default OFF (`enabled` false / unset). Never enabled implicitly.
@@ -1011,6 +1015,7 @@ export type OcxAccountPoolQuotaWindow = "five-hour" | "weekly" | "max-utilizatio
 
 export type OcxComboStrategy = "failover" | "round-robin" | "random" | "least-used" | "reset-window";
 export type OcxComboDefaultEffort = "low" | "medium" | "high" | "xhigh" | "max" | "ultra";
+export type OcxComboDefaultEffortMode = "fallback" | "force";
 
 /**
  * How a combo derives the reasoning ladder it publishes to the picker.
@@ -1046,8 +1051,10 @@ export interface OcxComboConfig {
   cooldownMs?: number;
   /** Maximum wait for an eligible target cooldown to expire before failing closed. Default 0; range 0..600000, per selection attempt. */
   waitForCooldownMs?: number;
-  /** Used when the client omits reasoning.effort. null/omitted leaves the target default unchanged. */
+  /** Used as a fallback when the client omits reasoning.effort, or as an override in `force` mode. null/omitted leaves the target default unchanged. */
   defaultEffort?: OcxComboDefaultEffort | null;
+  /** `force` makes the combo default override a valid client effort. Omitted / `fallback` preserves client precedence. */
+  defaultEffortMode?: OcxComboDefaultEffortMode;
   /**
    * Picker-ladder derivation policy. Omitted / `"strict"` keeps the legacy rule where an
    * explicitly empty target ladder suppresses the whole combo's effort control.

package/src/types/provider.ts

@@ -311,6 +311,19 @@ export interface OcxProviderConfig {
    * preserved after it, and parallel calls stay together with the reasoning turn that produced them.
    */
   requiresAdjacentResponsesToolResults?: boolean;
+  /**
+   * Responses upstream whose parser also rejects a tool call that has no matching output
+   * anywhere in the replayed input, not merely one whose result sits out of order. A call left
+   * dangling by an interrupted stream is answered with an explicit unknown-status placeholder
+   * so the thread can continue.
+   *
+   * Separate from `requiresAdjacentResponsesToolResults` on purpose: adjacency reorders items a
+   * strict parser already accepts in some order, while this synthesizes an item the client never
+   * sent. Kimi accepts a dangling call (#4726), so it must not inherit the synthesis.
+   * `statelessResponses` implies this, because an upstream that stores nothing cannot resolve
+   * the missing half from its own history either.
+   */
+  requiresPairedResponsesToolResults?: boolean;
   /**
    * When enabled, a tool result that is present but empty (no usable text or content
    * part) is rewritten to an explicit annotation before it reaches the upstream wire,

package/src/types/request.ts

@@ -154,9 +154,11 @@ export interface OcxAssistantMessage {
   model?: string;
   timestamp: number;
   /**
-   * Kiro `reasoningContent.redactedContent` for THIS assistant turn — an opaque encrypted blob
-   * Kiro replays to preserve model reasoning across turns. Provider-specific and unrenderable, so
-   * it rides the message rather than a content part: any other adapter simply ignores it.
+   * Kiro's encrypted reasoning blob for THIS assistant turn — the opaque value from the turn's
+   * `reasoningContentEvent` (`signature` for the GPT-5.6 family, `redactedContent` for the base64
+   * shape), tagged with the wire field it must be replayed on (see kiro/reasoning.ts). Kiro
+   * replays it to preserve model reasoning across turns. Provider-specific and unrenderable, so it
+   * rides the message rather than a content part: any other adapter simply ignores it.
    */
   kiroRedactedReasoning?: string;
 }
@@ -317,8 +319,9 @@ export type AdapterEvent =
   // opaque redacted_thinking blocks. Both must be replayed verbatim or tool-use turns 400.
   | { type: "thinking_signature"; signature: string }
   | { type: "redacted_thinking"; data: string }
-  // Kiro reasoning round-trip: the encrypted `redactedContent` blob for the CURRENT assistant turn.
-  // Never rendered — it only rides the reasoning item's envelope so the next request can replay it.
+  // Kiro reasoning round-trip: the encrypted reasoning blob for the CURRENT assistant turn, tagged
+  // with the wire field it arrived on. Never rendered — it only rides the reasoning item's envelope
+  // so the next request can replay it verbatim.
   | { type: "kiro_redacted_reasoning"; data: string }
   | { type: "reasoning_raw_delta"; text: string }
   | { type: "tool_call_start"; id: string; name: string; providerMetadata?: OcxProviderOpaqueToolCallMetadata }

package/src/types/tools.ts

@@ -67,6 +67,30 @@ const CODE_MODE_HELPER_TOOL_NAMES = [
  */
 export const CODE_MODE_EXEC_TOOL_NAME = "exec";
 
+/**
+ * Spellings that may never be MANUFACTURED as a bare alias for a namespaced tool.
+ *
+ * A bare alias is an ordinary compatibility affordance -- providers echo a namespaced tool
+ * without its prefix, and restoring the identity needs the bare spelling registered. For these
+ * six it is also an authorization decision, because a declared-name set is what
+ * `normalizeDeclaredToolName` and `declaresCodeModeExec` read: bare `exec` turns nested-helper
+ * normalization on for a catalog that never declared the shell, bare `exec_command` or
+ * `shell_command` turns it off for one that did, and the rest are accepted as declared calls the
+ * caller only ever authorized under a namespace.
+ *
+ * This is a property of the SPELLING, not of the namespace that declared it and not of the reason
+ * the alias was being added. It lives here, beside the names it protects, because every site that
+ * builds a declared-name set has to apply the same list -- the two that kept their own copies each
+ * drifted, once to a single namespace and once to a single name.
+ *
+ * A genuine namespace-free declaration is NOT covered: that is the caller declaring the tool, not
+ * a namespace being discarded to synthesize a bare name.
+ */
+export const NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES: ReadonlySet<string> = new Set<string>([
+  CODE_MODE_EXEC_TOOL_NAME,
+  ...CODE_MODE_HELPER_TOOL_NAMES,
+]);
+
 /**
  * Normalizes provider-emitted tool names against declared tool catalogs.
  *

package/src/types.ts

@@ -16,6 +16,7 @@ export {
   isAllowedToolChoice,
   toolChoiceToolPredicate,
   declaresCodeModeExec,
+  NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES,
 } from "./types/tools";
 
 export type { UpstreamHttpVersion, ReasoningSummaryDelivery, CodexAccountMode } from "./types/wire";
@@ -74,6 +75,7 @@ export type {
   OcxAccountPoolQuotaWindow,
   OcxComboStrategy,
   OcxComboDefaultEffort,
+  OcxComboDefaultEffortMode,
   OcxComboReasoningEffortMode,
   OcxComboTarget,
   OcxComboConfig,

package/src/update/index.ts

@@ -481,6 +481,16 @@ export async function runUpdate(): Promise<void> {
         "    After the update: close the Codex app, run 'ocx doctor', then run 'ocx stop' once to retry.",
       );
     }
+    if (decision.reason === "history-deferred") {
+      // Not the same warning: nothing was restored here. Saying "history metadata is
+      // incomplete" would imply config and catalog came back, and an operator who
+      // believed that would not know a teardown is still owed.
+      console.warn(
+        "⚠️  The shared teardown was refused by the Codex history preflight and restored nothing.\n" +
+        "    Config, catalog, history and provenance were preserved, and the teardown receipt was kept.\n" +
+        "    The proxy is down, so the update continues; close the Codex app and run 'ocx stop' once afterwards to finish the restore.",
+      );
+    }
   }
 
   console.log(`Updating${latest ? ` to v${latest}` : ""}…\n$ ${bin} ${cmdArgs.join(" ")}`);

package/src/update/stop-contract.d.mts

@@ -1,2 +1,3 @@
 /** Declaration for the plain-ESM stop contract shared with `bin/ocx.mjs`. */
 export declare const STOP_HISTORY_INCOMPLETE_EXIT_CODE: 79;
+export declare const STOP_HISTORY_DEFERRED_EXIT_CODE: 80;

package/src/update/stop-contract.mjs

@@ -13,3 +13,22 @@
  * the child's code faithfully enough to propagate the confusion.
  */
 export const STOP_HISTORY_INCOMPLETE_EXIT_CODE = 79;
+
+/**
+ * The exit code `ocx stop` uses to say "the proxy is down and the shared teardown was
+ * refused before it changed anything" (#4718).
+ *
+ * This is NOT 79. Seventy-nine means the teardown ran: config and catalog came back to
+ * their native values and only the Codex history metadata could not be finalized, so the
+ * receipt is discharged. Eighty means the Codex history preflight refused FIRST, so
+ * config, catalog, history and provenance are all untouched, the client is still routed
+ * at the proxy that just stopped, and the receipt stays outstanding for a later stop.
+ *
+ * Collapsing the two would be a data-loss bug in the quiet direction: a caller reading 79
+ * discharges an obligation that was never performed.
+ *
+ * Eighty sits in the same unoccupied window as 79 — above `sysexits.h` (64-78), below
+ * `128 + signal`, and outside 0, 1, 2, 4, 64 and 130, which are the codes this CLI and its
+ * dispatcher already emit.
+ */
+export const STOP_HISTORY_DEFERRED_EXIT_CODE = 80;

package/src/update/stop-decision.d.mts

@@ -6,5 +6,5 @@ export declare function decidePostStopUpdate(input: {
   teardownOutstanding?: boolean;
 }): {
   proceed: boolean;
-  reason: "stop-failed" | "runtime-state" | "teardown-outstanding" | "proxy-live" | "proxy-unknown" | "history-only" | "ok";
+  reason: "stop-failed" | "runtime-state" | "teardown-outstanding" | "proxy-live" | "proxy-unknown" | "history-only" | "history-deferred" | "ok";
 };

package/src/update/stop-decision.mjs

@@ -1,4 +1,4 @@
-import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
+import { STOP_HISTORY_DEFERRED_EXIT_CODE, STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
 
 /**
  * May an update replace package files after `ocx stop` returned?
@@ -22,13 +22,22 @@ import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
  *   absence, and replacing files under a live server leaves it running a mix of old and
  *   new modules.
  * - `ok` / `history-only` — proceed; the second also prints the manifest warning.
+ * - `history-deferred` — proceed; the stop is down but restored nothing, because the
+ *   Codex history preflight refused first (#4718). The receipts it kept are the ONLY
+ *   obligations it left, which the child proved before choosing this status, so
+ *   `teardownOutstanding` seeing them is expected rather than disqualifying. Every other
+ *   gate still applies: runtime records and a live or unreadable endpoint abort exactly
+ *   as they do for a clean stop, because package replacement under a live server is the
+ *   danger this function exists to prevent, and a history refusal says nothing about it.
  */
 export function decidePostStopUpdate({ status, hasRuntimeState, liveness, teardownOutstanding = false }) {
   const historyOnly = status === STOP_HISTORY_INCOMPLETE_EXIT_CODE;
-  if (status !== 0 && !historyOnly) return { proceed: false, reason: "stop-failed" };
+  const historyDeferred = status === STOP_HISTORY_DEFERRED_EXIT_CODE;
+  if (status !== 0 && !historyOnly && !historyDeferred) return { proceed: false, reason: "stop-failed" };
   if (hasRuntimeState) return { proceed: false, reason: "runtime-state" };
-  if (teardownOutstanding) return { proceed: false, reason: "teardown-outstanding" };
+  if (teardownOutstanding && !historyDeferred) return { proceed: false, reason: "teardown-outstanding" };
   if (liveness === "live") return { proceed: false, reason: "proxy-live" };
   if (liveness !== "dead") return { proceed: false, reason: "proxy-unknown" };
+  if (historyDeferred) return { proceed: true, reason: "history-deferred" };
   return { proceed: true, reason: historyOnly ? "history-only" : "ok" };
 }

package/src/usage/log.ts

@@ -38,7 +38,7 @@ export type UsageStatus = "reported" | "unreported" | "unsupported" | "estimated
  * The old name `CodexUsageAccountLogLabel` is kept as an alias because it is exported and used
  * across modules; the two predicates below are what callers should choose between.
  */
-export type UsageAccountLogLabel = "main" | `p${string}` | `o${string}`;
+export type UsageAccountLogLabel = "main" | `p${string}` | `o${string}` | `k${string}`;
 export type CodexUsageAccountLogLabel = UsageAccountLogLabel;
 
 /**

package/src/vision/anthropic-describe.ts

@@ -205,7 +205,7 @@ export async function describeImageAnthropic(
         body: JSON.stringify(body),
         signal: linkedSignal.signal,
       }, recovery)),
-      { abortSignal: linkedSignal.signal, label: "vision-sidecar-anthropic" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "vision-sidecar-anthropic" },
     );
     if (!res.ok) {
       // The body is untrusted and only feeds one auth-failure message, so read a bounded prefix.

package/src/vision/describe.ts

@@ -87,7 +87,7 @@ export async function describeImage(
     input: [{ type: "message", role: "user", content }],
     reasoning: { effort: settings.reasoning },
     // The ChatGPT (codex) backend rejects `max_output_tokens` ("Unsupported parameter"); the shared
-    // SSE parser bounds raw response bytes before DESC_MAX_CHARS applies its display clamp.
+    // SSE parser bounds wire and decoded payload before DESC_MAX_CHARS applies its display clamp.
     store: false,
     stream: true,
   };
@@ -108,7 +108,7 @@ export async function describeImage(
         // `session_id`, and `x-codex-turn-metadata` to the redirect target.
         redirect: "manual",
       }, recovery)),
-      { abortSignal: linkedSignal.signal, label: "vision-sidecar" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "vision-sidecar" },
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
     try {
@@ -121,9 +121,9 @@ export async function describeImage(
       const parsed = await parseSidecarSSE(res);
       if (linkedSignal.signal.aborted) throw linkedSignal.signal.reason;
       recordOutcome?.(res.status);
-      // The backend can return HTTP 200 then stream a `response.failed`/`error` event with no text;
-      // surface that as a describe error instead of an empty (silently-blank) description.
-      if (!parsed.text.trim() && parsed.error) return { text: "", error: parsed.error };
+      // Any parser error invalidates decoded text: it may be a prefix from a bounded or incomplete
+      // stream and must never be rendered or cached as a complete image description.
+      if (parsed.error) return { text: "", error: parsed.error };
       return { text: parsed.text };
     } finally {
       detachBodyGuard();

package/src/web-search/anthropic-executor.ts

@@ -215,7 +215,7 @@ export async function runAnthropicWebSearch(
         body: JSON.stringify(body),
         signal: linkedSignal.signal,
       }, recovery)),
-      { abortSignal: linkedSignal.signal, label: "web-search-sidecar-anthropic" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "web-search-sidecar-anthropic" },
     );
     // Guard before any branch reads the body: the failure branch's `res.text()` ran ahead of
     // the success-path guard, reopening the fetch-resolution-to-reader-attach race

package/src/web-search/exa-executor.ts

@@ -46,7 +46,7 @@ export async function runExaWebSearch(
         signal: linkedSignal.signal,
         redirect: "manual",
       }, recovery)),
-      { abortSignal: linkedSignal.signal, label: "exa-web-search-sidecar" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "exa-web-search-sidecar" },
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
     try {

package/src/web-search/executor.ts

@@ -94,7 +94,7 @@ export async function runWebSearch(
         // `session_id`, and `x-codex-turn-metadata` to the redirect target.
         redirect: "manual",
       }, recovery), forwardProvider)),
-      { abortSignal: linkedSignal.signal, label: "web-search-sidecar" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "web-search-sidecar" },
     );
     // Attach the body guard before ANY branch reads it. The success path guarded itself below,
     // but the failure branch's `res.text()` runs first, so a cancel landing between fetch

package/src/web-search/gemini-executor.ts

@@ -80,7 +80,7 @@ export async function runGeminiWebSearch(
         signal: linkedSignal.signal,
         redirect: "manual",
       }, recovery)),
-      { abortSignal: linkedSignal.signal, label: "gemini-web-search-sidecar" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "gemini-web-search-sidecar" },
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
     try {

package/src/web-search/loop.ts

@@ -512,7 +512,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
                   signal: headerDeadline.signal,
                 }, retryRecovery));
               },
-              { abortSignal: headerDeadline.signal, label: "web-search-loop" },
+              { replaySafe: true, abortSignal: headerDeadline.signal, label: "web-search-loop" },
             );
           }
         } finally {

package/src/web-search/ollama-executor.ts

@@ -57,7 +57,7 @@ export async function runOllamaWebSearch(
         // Bun forwards custom headers across redirects, so a redirect would leak the key.
         redirect: "manual",
       }, recovery)),
-      { abortSignal: linkedSignal.signal, label: "ollama-web-search-bridge" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "ollama-web-search-bridge" },
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
     try {

package/src/web-search/parse.ts

@@ -12,7 +12,7 @@ export type WebSearchSource = SafeWebSearchSource;
 export interface WebSearchResult {
   text: string;
   sources: WebSearchSource[];
-  /** Set only when the stream surfaced an error AND produced no usable answer text. */
+  /** Set when the stream failed, including when partial text was decoded before failure. */
   error?: string;
 }
 
@@ -31,9 +31,12 @@ interface OutputItem {
   content?: OutputTextBlock[];
 }
 
-// ChatGPT's Codex backend does not accept `max_output_tokens` on sidecar requests. Bound the raw
-// streamed response here, before decoded text and authoritative/delta copies can accumulate.
+// Keep this compatibility export for non-Responses sidecar executors and bounded error bodies.
 export const MAX_SIDECAR_RESPONSE_BYTES = 64 * 1024;
+// Responses SSE can spend far more wire bytes on JSON framing than on useful model output. Keep a
+// larger finite wire ceiling while separately bounding the decoded text copies accumulated below.
+export const MAX_SIDECAR_STREAM_BYTES = MAX_SIDECAR_RESPONSE_BYTES * 16;
+export const MAX_SIDECAR_DECODED_CHARS = 64 * 1024;
 
 /** Push a `url_citation` annotation as a source, de-duplicated by URL. */
 function collectAnnotation(ann: AnnotationLike | undefined, sources: WebSearchSource[], seen: Set<string>): void {
@@ -208,10 +211,11 @@ export function cancelReaderWithoutWaiting(
  * `response.output_text.done` text; falls back to accumulated `response.output_text.delta`. Sources are
  * collected from EVERY shape they arrive in — `response.output_text.annotation.added` events (the
  * streaming path, which earlier testing missed → empty citations), `done`-block `annotations[]`, and
- * the final output[]. `response.failed`/`error` events surface as `error` when no answer text was produced.
+ * the final output[]. A terminal failure, a safety bound, or EOF before a terminal event surfaces as
+ * `error` even when partial answer text was decoded.
  */
 export async function parseSidecarSSE(response: Response): Promise<WebSearchResult> {
-  if (!response.body) return { text: "", sources: [] };
+  if (!response.body) return { text: "", sources: [], error: "sidecar stream returned no response body" };
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
@@ -224,10 +228,37 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     final: WebSearchResult | null;
     streamSources: WebSearchSource[];
     error: string | null;
-  } = { deltaText: "", doneText: "", final: null, streamSources: [], error: null };
+    decodedChars: number;
+    terminalEvent: boolean;
+    limitReached: boolean;
+  } = {
+    deltaText: "",
+    doneText: "",
+    final: null,
+    streamSources: [],
+    error: null,
+    decodedChars: 0,
+    terminalEvent: false,
+    limitReached: false,
+  };
+
+  const acceptDecodedChars = (count: number): boolean => {
+    if (count > MAX_SIDECAR_DECODED_CHARS - acc.decodedChars) {
+      acc.error = "sidecar response decoded text limit reached";
+      acc.limitReached = true;
+      return false;
+    }
+    acc.decodedChars += count;
+    return true;
+  };
 
   const handle = (payload: string): void => {
-    if (!payload || payload === "[DONE]") return;
+    if (!payload) return;
+    if (payload === "[DONE]") {
+      acc.terminalEvent = true;
+      return;
+    }
+    if (acc.limitReached) return;
     // Neither warning below copies the frame's content. An upstream SSE payload can carry model
     // output or credential material, and a malformed frame is exactly the case where the content
     // is least trustworthy. Length plus a classification separates the two failure modes in a log
@@ -247,19 +278,27 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     const data = parsed as Record<string, unknown>;
     const type = data.type as string | undefined;
     if (type === "response.output_text.delta" && typeof data.delta === "string") {
-      acc.deltaText += data.delta;
+      if (acceptDecodedChars(data.delta.length)) acc.deltaText += data.delta;
     } else if (type === "response.output_text.done" && typeof data.text === "string") {
       // The `done` event carries the full, authoritative text for one content part.
-      acc.doneText += data.text;
+      if (acceptDecodedChars(data.text.length)) acc.doneText += data.text;
     } else if (type === "response.completed" || type === "response.done") {
+      acc.terminalEvent = true;
       const resp = data.response as { output?: OutputItem[] } | undefined;
-      if (resp?.output) acc.final = fromOutputArray(resp.output, seen);
+      if (resp?.output) {
+        const final = fromOutputArray(resp.output, seen);
+        if (acceptDecodedChars(final.text.length)) acc.final = final;
+      }
     } else if (type === "response.failed" || type === "response.incomplete" || type === "error") {
+      acc.terminalEvent = true;
       const resp = data.response as { error?: { message?: string } } | undefined;
       const msg = resp?.error?.message
         ?? (data.error as { message?: string } | undefined)?.message
         ?? (typeof data.message === "string" ? data.message : undefined);
-      if (msg) acc.error = msg;
+      acc.error = msg ?? `sidecar stream ended with ${type}`;
+    } else if (type?.includes("reasoning") && typeof data.delta === "string") {
+      // Reasoning is not returned, but it is still decoded payload retained transiently by JSON.parse.
+      acceptDecodedChars(data.delta.length);
     }
     // Citations stream as a dedicated `response.output_text.annotation.added` event (singular
     // `annotation`); capture it regardless of the exact event name so they aren't lost.
@@ -270,7 +309,7 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     while (true) {
       const { done, value } = await reader.read();
       if (done) break;
-      const remaining = MAX_SIDECAR_RESPONSE_BYTES - responseBytes;
+      const remaining = MAX_SIDECAR_STREAM_BYTES - responseBytes;
       const accepted = value.byteLength <= remaining ? value : value.subarray(0, remaining);
       responseBytes += accepted.byteLength;
       buffer += decoder.decode(accepted, { stream: true });
@@ -280,11 +319,24 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
         const data = sseFieldValue(line, "data");
         if (data !== null) handle(data.trim());
       }
-      if (responseBytes >= MAX_SIDECAR_RESPONSE_BYTES) {
+      if (acc.limitReached) {
+        cancelReaderWithoutWaiting(reader, "sidecar response decoded text limit reached");
+        buffer = "";
+        break;
+      }
+      if (acc.terminalEvent) {
+        cancelReaderWithoutWaiting(reader, "sidecar terminal event received");
+        buffer = "";
+        break;
+      }
+      if (responseBytes >= MAX_SIDECAR_STREAM_BYTES) {
         // Preserve complete events accepted up to the cap, but discard any unterminated line and
         // TextDecoder carry. Do not let a rejecting/hung cancel turn bounded partial output into
         // an error or keep this parser waiting on upstream teardown.
         cancelReaderWithoutWaiting(reader, "sidecar response byte limit reached");
+        acc.error = "sidecar response byte limit reached before terminal event";
+        acc.limitReached = true;
+        buffer = "";
         break;
       }
     }
@@ -310,6 +362,7 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     appendSafeWebSearchSource(sources, s);
   }
   const finalText = stripped ? body : (typeof text === "string" ? text : "");
-  if (!finalText.trim() && acc.error) return { text: "", sources, error: acc.error };
+  const error = acc.error ?? (!acc.terminalEvent ? "sidecar stream ended before terminal event" : null);
+  if (error) return { text: finalText, sources, error };
   return { text: finalText, sources };
 }