@bitkyc08/opencodex 2.56.0 → 2.58.0

package/src/adapters/openai-chat/tool-name-registry.ts

@@ -0,0 +1,166 @@
+import { createHash } from "node:crypto";
+import { namespacedToolName, type OcxParsedRequest, type OcxTool } from "../../types";
+import { frameAgentRouterMessages } from "../agentrouter";
+
+const MAX_CHAT_TOOL_NAME_LENGTH = 64;
+const ALIAS_HINT_CHARS = 16;
+const RESERVED_ALIAS_PATTERN = /^ocx_[a-zA-Z0-9_-]{16}_[a-zA-Z0-9_-]{43}$/;
+type ToolIdentity = Readonly<Pick<OcxTool, "namespace" | "name">>;
+
+export interface OpenAIChatToolNameRegistry {
+  alias(tool: ToolIdentity): string;
+  aliasWireName(wireName: string): string;
+  restore(wireName: string): string;
+}
+
+interface OpenAIChatToolNameScope {
+  messages(parsed: OcxParsedRequest, baseUrl: string, messages: readonly unknown[]): unknown;
+  registry(): OpenAIChatToolNameRegistry;
+  restore(wireName: string): string;
+}
+
+function identityKey(tool: ToolIdentity): string {
+  return JSON.stringify([tool.namespace ?? null, tool.name]);
+}
+
+function boundedAlias(tool: ToolIdentity, wireName: string): string {
+  const hint = wireName
+    .replace(/[^a-zA-Z0-9_-]/g, "_")
+    .slice(-ALIAS_HINT_CHARS)
+    .padStart(ALIAS_HINT_CHARS, "_");
+  const key = identityKey(tool);
+  const digest = createHash("sha256")
+    .update(key)
+    .digest("base64url");
+  return `ocx_${hint}_${digest}`;
+}
+
+/** Catalog declarations plus structured calls retained in replay history. */
+export function openAIChatToolNameIdentities(parsed: OcxParsedRequest): ToolIdentity[] {
+  const identities: ToolIdentity[] = [...(parsed.context.tools ?? [])];
+  for (const message of parsed.context.messages) {
+    if (message.role !== "assistant" || !Array.isArray(message.content)) continue;
+    for (const part of message.content) {
+      if (part.type !== "toolCall") continue;
+      identities.push({
+        name: part.name,
+        ...(part.namespace === undefined ? {} : { namespace: part.namespace }),
+      });
+    }
+  }
+  return identities;
+}
+
+/**
+ * One collision domain for a translated Chat Completions request.
+ *
+ * Namespaced names whose flattened spelling exceeds Chat Completions' 64-character function-name
+ * bound are rewritten. Ordinary names and bare names pass through byte-for-byte unless they occupy
+ * the reserved alias spelling; those are re-aliased so no declaration can shadow another identity's
+ * deterministic alias. Distinct identities sharing one flattened spelling each keep an identity
+ * alias, while replay rewriting leaves that ambiguous spelling untouched. Echoed aliases restore to
+ * the original flattened name consumed by the Responses bridge's existing namespace map.
+ */
+export function createOpenAIChatToolNameRegistry(
+  tools: readonly ToolIdentity[] | undefined,
+): OpenAIChatToolNameRegistry {
+  const identities = new Map<string, ToolIdentity>();
+  for (const tool of tools ?? []) identities.set(identityKey(tool), tool);
+  const sortedIdentities = [...identities.entries()]
+    .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+
+  const aliasesByIdentity = new Map<string, string>();
+  const aliasesByWireName = new Map<string, string>();
+  const originalsByAlias = new Map<string, string>();
+  const wireOwners = new Map<string, string | null>();
+  for (const [key, tool] of sortedIdentities) {
+    const wireName = namespacedToolName(tool.namespace, tool.name);
+    const owner = wireOwners.get(wireName);
+    if (owner === undefined) wireOwners.set(wireName, key);
+    else if (owner !== key) wireOwners.set(wireName, null);
+  }
+
+  const aliasOwners = new Map<string, string>();
+  const wireClaims = new Map<string, { key: string; alias: string } | null>();
+  for (const [key, tool] of sortedIdentities) {
+    const wireName = namespacedToolName(tool.namespace, tool.name);
+    const candidate = (tool.namespace !== undefined && wireName.length > MAX_CHAT_TOOL_NAME_LENGTH)
+      || RESERVED_ALIAS_PATTERN.test(wireName)
+      || wireOwners.get(wireName) === null
+      ? boundedAlias(tool, wireName)
+      : wireName;
+    // A full SHA-256 collision is not safely attributable. Keep the later identity's native
+    // spelling instead of failing the request or stealing the first identity's restore entry.
+    const alias = aliasOwners.has(candidate) ? wireName : candidate;
+    aliasesByIdentity.set(key, alias);
+    if (!aliasOwners.has(alias)) aliasOwners.set(alias, key);
+    if (alias !== wireName) originalsByAlias.set(alias, wireName);
+
+    const claim = wireClaims.get(wireName);
+    if (claim === undefined) wireClaims.set(wireName, { key, alias });
+    else if (claim !== null && claim.key !== key) wireClaims.set(wireName, null);
+  }
+  for (const [wireName, claim] of wireClaims) {
+    if (claim !== null) aliasesByWireName.set(wireName, claim.alias);
+  }
+
+  return {
+    alias(tool: ToolIdentity): string {
+      const key = identityKey(tool);
+      const known = aliasesByIdentity.get(key);
+      if (known !== undefined) return known;
+      return namespacedToolName(tool.namespace, tool.name);
+    },
+    aliasWireName(wireName: string): string {
+      return aliasesByWireName.get(wireName) ?? wireName;
+    },
+    restore(wireName: string): string {
+      return originalsByAlias.get(wireName) ?? wireName;
+    },
+  };
+}
+
+export function restoreOpenAIChatToolName(
+  registry: OpenAIChatToolNameRegistry,
+  wireName: string,
+): string {
+  return registry.restore(wireName);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Rewrite replayed assistant tool calls after the ordinary message converter has flattened them. */
+export function aliasOpenAIChatMessageToolNames(
+  messages: readonly unknown[],
+  registry: OpenAIChatToolNameRegistry,
+): unknown[] {
+  return messages.map(message => {
+    if (!isRecord(message) || !Array.isArray(message.tool_calls)) return message;
+    let changed = false;
+    const toolCalls = message.tool_calls.map(toolCall => {
+      if (!isRecord(toolCall) || !isRecord(toolCall.function)
+          || typeof toolCall.function.name !== "string") return toolCall;
+      const name = registry.aliasWireName(toolCall.function.name);
+      if (name === toolCall.function.name) return toolCall;
+      changed = true;
+      return { ...toolCall, function: { ...toolCall.function, name } };
+    });
+    return changed ? { ...message, tool_calls: toolCalls } : message;
+  });
+}
+
+export function withOpenAIChatToolNames<T>(
+  build: (scope: OpenAIChatToolNameScope) => T,
+): T {
+  let registry = createOpenAIChatToolNameRegistry(undefined);
+  return build({
+    messages(parsed, baseUrl, messages): unknown {
+      registry = createOpenAIChatToolNameRegistry(openAIChatToolNameIdentities(parsed));
+      return frameAgentRouterMessages(baseUrl, aliasOpenAIChatMessageToolNames(messages, registry));
+    },
+    registry: () => registry,
+    restore: wireName => restoreOpenAIChatToolName(registry, wireName),
+  });
+}

package/src/adapters/openai-chat/tool-schema.ts

@@ -1,7 +1,8 @@
 import { isNativeOpenAIChatTarget } from "./wire";
+import { createOpenAIChatToolNameRegistry, type OpenAIChatToolNameRegistry } from "./tool-name-registry";
 import { isXaiSchemaTarget, lookupLocalJsonPointer, normalizeXaiToolParameters } from "../xai-tool-schema";
 import { stripResponsesOnlyEncryptedMarker, stripUnicodePropertyPatterns } from "../responses-tool-schema";
-import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../../types";
+import { isAllowedToolChoice, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../../types";
 import type { OcxParsedRequest, OcxProviderConfig } from "../../types";
 
 const ZEN_SCHEMA_MAP_KEYS = new Set(["properties", "$defs", "definitions"]);
@@ -409,7 +410,11 @@ function normalizeMoonshotToolParameters(parameters: unknown): Record<string, un
   return isXaiObjectSchema(normalized) ? normalized : rooted;
 }
 
-export function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderConfig): unknown[] | undefined {
+export function toolsToChatFormat(
+  parsed: OcxParsedRequest,
+  provider: OcxProviderConfig,
+  registry: OpenAIChatToolNameRegistry = createOpenAIChatToolNameRegistry(parsed.context.tools),
+): unknown[] | undefined {
   if (!parsed.context.tools || parsed.context.tools.length === 0) return undefined;
   const tools = parsed.context.tools.filter(toolChoiceToolPredicate(parsed.options.toolChoice, parsed.context.tools));
   if (tools.length === 0) return undefined;
@@ -427,7 +432,7 @@ export function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProvide
     return [{
       type: "function",
       function: {
-        name: namespacedToolName(t.namespace, t.name),
+        name: registry.alias(t),
         ...(t.description ? { description: t.description } : {}),
         parameters,
         ...(t.strict !== undefined ? { strict: t.strict } : {}),
@@ -437,8 +442,12 @@ export function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProvide
   return formatted.length > 0 ? formatted : undefined;
 }
 
-export function toolsToChatFormatForProvider(parsed: OcxParsedRequest, provider: OcxProviderConfig): unknown[] | undefined {
-  const base = toolsToChatFormat(parsed, provider);
+export function toolsToChatFormatForProvider(
+  parsed: OcxParsedRequest,
+  provider: OcxProviderConfig,
+  registry: OpenAIChatToolNameRegistry = createOpenAIChatToolNameRegistry(parsed.context.tools),
+): unknown[] | undefined {
+  const base = toolsToChatFormat(parsed, provider, registry);
   const azureChat = isAzureOpenAiChatTarget(provider);
   const zenChat = shouldSanitizeZenToolParameters(provider);
   if (!base || (!zenChat && !azureChat)) return base;
@@ -463,15 +472,24 @@ export function toolChoiceToChatFormat(
   tc: OcxParsedRequest["options"]["toolChoice"],
   tools: OcxParsedRequest["context"]["tools"],
   provider: OcxProviderConfig,
+  registry: OpenAIChatToolNameRegistry = createOpenAIChatToolNameRegistry(tools),
 ): unknown {
   if (!tc) return undefined;
   if (isAllowedToolChoice(tc)) {
     if (tc.mode === "required" && tc.allowedTools.length === 1 && isNativeOpenAIChatTarget(provider)) {
-      return { type: "function", function: { name: resolveToolChoiceWireName(tools, tc.allowedTools[0]) } };
+      return {
+        type: "function",
+        function: { name: registry.aliasWireName(resolveToolChoiceWireName(tools, tc.allowedTools[0])) },
+      };
     }
     return tc.mode === "required" ? "required" : "auto";
   }
   if (tc === "auto" || tc === "none" || tc === "required") return tc;
-  if ("name" in tc) return { type: "function", function: { name: resolveToolChoiceWireName(tools, tc.name) } };
+  if ("name" in tc) {
+    return {
+      type: "function",
+      function: { name: registry.aliasWireName(resolveToolChoiceWireName(tools, tc.name)) },
+    };
+  }
   return undefined;
 }

package/src/adapters/openai-chat.ts

@@ -6,7 +6,6 @@ import { mapReasoningEffort, modelRecordValue } from "../reasoning-effort";
 import { debugProviderDiagnostic } from "../lib/debug";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { isDebugEnabled } from "../lib/debug-settings";
-import { frameAgentRouterMessages } from "./agentrouter";
 import { openRouterProviderPayload, resolveOpenRouterRouting } from "../providers/openrouter-routing";
 import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../providers/vercel-gateway-routing";
 import { fastPolicyForModel } from "../providers/service-tier";
@@ -39,6 +38,7 @@ import {
   upstreamErrorEvent,
 } from "./openai-chat/errors";
 import { messagesToChatFormat } from "./openai-chat/messages";
+import { withOpenAIChatToolNames } from "./openai-chat/tool-name-registry";
 import { isNativeOpenAIChatTarget, openAIChatTransport, stripBracketedModelSuffix } from "./openai-chat/wire";
 import { toolChoiceToChatFormat, toolsToChatFormatForProvider } from "./openai-chat/tool-schema";
 
@@ -88,7 +88,7 @@ function canSerializeOpenAIChatServiceTier(
 
 export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAdapter {
   let lastRequestedModelId: string | undefined;
-  return {
+  return withOpenAIChatToolNames(toolNames => ({
     name: "openai-chat",
 
     formatErrorBody: formatOpenAIChatErrorBody,
@@ -96,10 +96,10 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
     buildRequest(parsed: OcxParsedRequest, incoming?: IncomingMeta) {
       lastRequestedModelId = parsed.modelId;
       const { url, headers, hasCredential } = openAIChatTransport(provider);
-      const messages = frameAgentRouterMessages(provider.baseUrl, messagesToChatFormat(parsed, provider));
+      const messages = toolNames.messages(parsed, provider.baseUrl, messagesToChatFormat(parsed, provider));
       const finish = (): AdapterRequest => {
-        const tools = toolsToChatFormatForProvider(parsed, provider);
-        const toolChoice = toolChoiceToChatFormat(parsed.options.toolChoice, parsed.context.tools, provider);
+        const tools = toolsToChatFormatForProvider(parsed, provider, toolNames.registry());
+        const toolChoice = toolChoiceToChatFormat(parsed.options.toolChoice, parsed.context.tools, provider, toolNames.registry());
 
         const body: Record<string, unknown> = {
           model: provider.modelSuffixBracketStrip ? stripBracketedModelSuffix(parsed.modelId) : parsed.modelId,
@@ -365,7 +365,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
             return "terminate";
           }
           if (!call.id) call.id = `call_${++toolCallSeq}`;
-          yield { type: "tool_call_start", id: call.id, name: call.name };
+          yield { type: "tool_call_start", id: call.id, name: toolNames.restore(call.name) };
           if (call.args.length > 0) yield { type: "tool_call_delta", arguments: call.args };
           yield { type: "tool_call_end" };
         }
@@ -801,7 +801,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
               logInvalidToolCalls("response", rawToolCalls);
               return [invalidToolCallsEvent(rawToolCalls, "response", usage)];
             }
-            events.push({ type: "tool_call_start", id, name });
+            events.push({ type: "tool_call_start", id, name: toolNames.restore(name) });
             events.push({ type: "tool_call_delta", arguments: args });
             events.push({ type: "tool_call_end" });
           }
@@ -818,5 +818,5 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         budget.releaseRetained(responseBytes, { kind: "retained_collectors" });
       }
     },
-  };
+  }));
 }

package/src/adapters/openai-responses/passthrough.ts

@@ -32,7 +32,7 @@ import {
   createAdapterTierMetadata,
 } from "../../providers/fastwire";
 import { mapRoutedResponsesReasoningEffort, normalizeConfiguredReasoningSummaryDelivery, sanitizeReasoningInputContent, stripDisabledReasoningSummaries, stripDisabledVerbosity, stripUnsupportedReasoningSummaryDelivery } from "./reasoning";
-import { scrubOcxCompactionItems, stripCanonicalOnlyToolFields, stripInternalChatMessageMetadataPassthrough, stripInvalidItemIds, stripItemIdsWhenUnstored } from "./request-strips";
+import { scrubOcxCompactionItems, stripCanonicalOnlyToolFields, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough, stripInvalidItemIds, stripItemIdsWhenUnstored } from "./request-strips";
 import { stripCanonicalForwardPromptCacheOptions, stripDeprecatedPromptCacheRetention } from "./prompt-cache";
 import { isPlainObject } from "./internal";
 import { normalizeToolSchemas, promoteClientLoadedTools, stripUnsupportedHostedTools } from "./tool-schema";
@@ -41,6 +41,19 @@ import { applyTierDecisionToResponsesBody, normalizeCanonicalForwardContinuation
 import { normalizeImageGenClientTools, preferConfiguredHostedTools } from "./image-gen";
 import { stripMuseSparkUnsupportedWebSearchFields, stripOpenAiOnlyWebSearchFields } from "./web-search";
 
+/**
+ * Identifies DeepSeek's strict Responses replay contract: tool-bearing continuations need
+ * plaintext reasoning and cannot consume opaque reasoning state. The two existing flags are
+ * current evidence for that one provider contract, not equivalent capabilities: preservation
+ * keeps plaintext reasoning on the wire, while adjacency marks its strict tool-history shape.
+ * The moment a second provider needs this behavior, replace this derivation with an explicit
+ * registry capability rather than extending the inference.
+ */
+export function requiresPlaintextReasoningReplay(provider: OcxProviderConfig): boolean {
+  return provider.preserveResponsesReasoningContent === true
+    && provider.requiresAdjacentResponsesToolResults === true;
+}
+
 // Headers relayed verbatim from the caller in OAuth-passthrough ("forward") mode.
 // Exported so the web-search sidecar reuses the exact same forwarded-auth set for its ChatGPT call.
 export const FORWARD_HEADERS = [
@@ -64,6 +77,16 @@ export const FORWARD_HEADERS = [
   CODEX_RESPONSES_LITE_HEADER,
 ];
 
+/** Preserve the caller fingerprint unless the provider explicitly owns that header. */
+function applyCallerUserAgentFallback(
+  headers: Record<string, string>,
+  incoming: IncomingMeta,
+): void {
+  if (Object.keys(headers).some(name => name.toLowerCase() === "user-agent")) return;
+  const userAgent = incoming.headers.get("user-agent");
+  if (userAgent) headers["User-Agent"] = userAgent;
+}
+
 /** Replace every `input_image` part under a routed-compaction body with a short marker. */
 function stripInputImagesDeep(value: unknown): unknown {
   if (Array.isArray(value)) return value.map(stripInputImagesDeep);
@@ -221,6 +244,10 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
         if (provider.headers) Object.assign(headers, provider.headers);
       }
+      // Some Responses-compatible gateways select their Codex compatibility path from the real
+      // client fingerprint. This is a single non-credential fallback, not broader caller-header
+      // forwarding. Static provider headers remain authoritative in either auth mode.
+      applyCallerUserAgentFallback(headers, incoming);
 
       const forward = provider.authMode === "forward";
       let convertedRoutedCustomToolNames: Set<string> | undefined;
@@ -243,19 +270,31 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       // tier write so a force-fast/default decision can never mutate parsed._rawBody.
       outBody = applyTierDecisionToResponsesBody(outBody, parsed.options?.tierDecision);
       const stateless = provider.statelessResponses === true;
+      const adjacentToolResults = provider.requiresAdjacentResponsesToolResults === true;
+      // Adjacency reorders items the upstream would accept in some order. Pairing synthesizes an
+      // item the client never sent, which is a larger claim about the conversation, so it is its
+      // own capability: Kimi carries the adjacency flag but accepts a dangling call (#4726) and
+      // must not start receiving placeholders it never needed.
+      const pairedToolResults = provider.requiresPairedResponsesToolResults === true;
       if (stateless) outBody = stripStatefulResponsesParams(outBody);
       // A replay miss can leave a function_call_output whose paired function_call sat
       // in the prefix that was never expanded. A stateless upstream cannot resolve the
       // pair from its own storage either, so it needs the same repair the forward
       // backend gets — dropping previous_response_id is not much use if the body that
       // reaches the wire is unparseable.
+      // A parser can also 400 on a function_call with no matching output at all. DeepSeek gets
+      // that repair through statelessResponses. xAI cannot be marked stateless: its Responses API
+      // stores conversations for 30 days and documents previous_response_id. So it carries the
+      // pairing capability instead, which reuses the orphan-call placeholder without touching
+      // store or previous_response_id.
       if (provider.annotateEmptyToolOutputs === true) {
         outBody = annotateEmptyResponsesToolOutputs(outBody, true);
       }
-      if (forward || stateless) {
-        outBody = repairOrphanedInputItems(outBody, unexpandedMiss, stateless && !forward);
+      const synthesizeMissingCallOutputs = !forward && (stateless || pairedToolResults);
+      if (forward || stateless || pairedToolResults) {
+        outBody = repairOrphanedInputItems(outBody, unexpandedMiss, synthesizeMissingCallOutputs);
       }
-      if (provider.requiresAdjacentResponsesToolResults === true) {
+      if (adjacentToolResults) {
         outBody = normalizeResponsesToolResultAdjacency(outBody);
       }
       if (forward) {
@@ -289,6 +328,20 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       outBody = backfillWebSearchQueries(outBody);
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         outBody = stripInternalChatMessageMetadataPassthrough(outBody);
+        // The same class of private field, one level up, but keyed on the DESTINATION rather than
+        // on the canonical surface alone. `src/server/responses/compact.ts` spreads the caller's
+        // raw body into the native `/responses/compact` request without passing through this
+        // adapter, and that endpoint is offered only to OpenAI-operated destinations
+        // (supportsNativeResponsesCompactEndpoint). Stripping on the canonical predicate here
+        // would make the two paths disagree for `openai-apikey`; stripping on the destination
+        // keeps every OpenAI-operated route byte-identical and removes the field exactly where it
+        // is known to break, which is a gateway this proxy does not operate.
+        //
+        // Placed before the routed compaction body is built and before serialization, so the HTTP,
+        // routed-compaction and WebSocket outbounds are all covered by this one call.
+        if (!isOpenAiOperatedResponsesDestination(provider)) {
+          outBody = stripCanonicalOnlyTopLevelFields(outBody);
+        }
         outBody = promoteClientLoadedTools(outBody);
       }
       if (!isCanonicalOpenAiForwardProvider(provider)) {
@@ -357,6 +410,10 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         }
       }
       const threadServingIdentityChanged = parsed._stripReasoningEncryptedContent === true;
+      // Providers with the strict plaintext tool-continuation contract cannot consume any
+      // encrypted reasoning blob, including one whose provenance is unknown. Combo routing
+      // separately refuses a proven cross-route replay when no plaintext exists; this final
+      // serializer guard ensures the foreign opaque state is never forwarded regardless.
       const sanitizedBody = normalizeToolSchemas(
         stripItemIdsWhenUnstored(
           stripInvalidItemIds(
@@ -370,7 +427,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
                 {
                   preserveRawReasoningContent: provider.preserveResponsesReasoningContent === true,
                   dropNullContentChannel: !isOpenAiOperatedResponsesDestination(provider),
-                  stripEncryptedContent: threadServingIdentityChanged,
+                  stripEncryptedContent: threadServingIdentityChanged || requiresPlaintextReasoningReplay(provider),
                 },
               ),
               provider,

package/src/adapters/openai-responses/request-strips.ts

@@ -120,6 +120,49 @@ export function stripInternalChatMessageMetadataPassthrough(body: unknown): unkn
   return changed ? { ...body, input } : body;
 }
 
+/**
+ * OpenAI-private TOP-LEVEL request keys, the sibling of `CANONICAL_ONLY_TOOL_FIELDS` one level up.
+ *
+ * Codex attaches these on the request body itself rather than on a tool or an input item, and gates
+ * them on its own auth rather than on the destination URL. Loopback injection keeps Codex pointed at
+ * its built-in `openai` provider, so the client still believes it is addressing the canonical
+ * ChatGPT backend and keeps the key no matter where this proxy routes the turn. A Responses gateway
+ * that validates its top-level schema then rejects the whole request before inference.
+ *
+ * Keep this a table, and keep it to keys a client is OBSERVED to send. It is not an unknown-field
+ * sanitizer: a top-level key nobody has traced to a client is forwarded untouched, because deleting
+ * it would silently drop a parameter some other caller means.
+ */
+const CANONICAL_ONLY_TOP_LEVEL_FIELDS: readonly string[] = [
+  // Cyber access program selector, new in Codex 0.155. codex-rs mints it from
+  // `cyber_access_program::for_auth`, which filters on ChatGPT auth alone and never on the
+  // destination base URL, and serializes it on the Responses request, the compaction input and the
+  // WebSocket `response.create` envelope. No public specification defines it, so a strict
+  // third-party gateway answers with an unknown-parameter error naming it, and every turn of that
+  // thread fails (#4853).
+  //
+  // `codex_output_schema` is deliberately NOT here. In codex-rs it is the `name` of the JSON-schema
+  // `text.format` object, not a top-level key, so listing it would delete a field this client never
+  // sends and discard it for any client that does send it meaningfully.
+  "access_programs",
+];
+
+/**
+ * Remove the OpenAI-private top-level keys.
+ *
+ * The caller decides the boundary; see the call site in `passthrough.ts`, which applies this only
+ * to a destination OpenCodex does not operate. Returns the input unchanged when no listed key is
+ * present, so the common path allocates nothing and the caller-owned raw body is never mutated.
+ */
+export function stripCanonicalOnlyTopLevelFields(body: unknown): unknown {
+  if (!isPlainObject(body)) return body;
+  if (!CANONICAL_ONLY_TOP_LEVEL_FIELDS.some(field => Object.hasOwn(body, field))) return body;
+
+  const next = { ...body };
+  for (const field of CANONICAL_ONLY_TOP_LEVEL_FIELDS) delete next[field];
+  return next;
+}
+
 /**
  * When `store` is false, the upstream API does not persist response items. Any item ID
  * forwarded in `input` is then interpreted as a reference to a stored item that does not

package/src/adapters/physical-send.ts

@@ -0,0 +1,50 @@
+import type { AdapterFetchContext } from "./base";
+import type { SendClass } from "../lib/request-execution-budget";
+import type { AttemptRecoveryKind } from "../usage/log";
+import { abortError, SendBudgetExhaustedError } from "../lib/upstream-retry";
+
+type PacedFetch = typeof globalThis.fetch & {
+  waitForPacing?: (signal?: AbortSignal) => Promise<void>;
+  unpacedFetch?: typeof globalThis.fetch;
+};
+
+/** One ordinal sequence per adapter fetchResponse call, across all of its inference retries.
+ * Consumption starts at underlying executor invocation; its own later preflight may still fail. */
+export function createAdapterPhysicalSend(ctx: AdapterFetchContext = {}, fallback = globalThis.fetch) {
+  const executor = (ctx.executor ?? fallback) as PacedFetch;
+  let ordinal = 0;
+  return async (options: {
+    url: string;
+    sendClass?: SendClass;
+    recovery?: AttemptRecoveryKind;
+    /** Runs only after admission, e.g. backoff and cancellation of a superseded response. */
+    beforeDispatch?: () => void | Promise<void>;
+    dispatch: (executor: typeof globalThis.fetch) => Promise<Response>;
+  }): Promise<Response> => {
+    if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
+    const decision = ctx.sendBudget?.reserveDispatch({
+      sendClass: options.sendClass ?? "transient", targetKey: options.url,
+    });
+    if (decision && !decision.allowed) throw new SendBudgetExhaustedError(options.url);
+    const permit = decision?.allowed ? decision.permit : undefined;
+    let dispatched = false;
+    const physicalExecutor = (async (input, init) => {
+      if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
+      if (init?.signal?.aborted) throw abortError(init.signal);
+      if (dispatched || (permit && !permit.use())) throw new SendBudgetExhaustedError(options.url);
+      dispatched = true;
+      ordinal += 1;
+      ctx.onPhysicalSend?.({ ordinal, ...(options.recovery ? { recovery: options.recovery } : {}) });
+      return (executor.unpacedFetch ?? executor)(input, init);
+    }) as typeof globalThis.fetch;
+    try {
+      await executor.waitForPacing?.(ctx.abortSignal);
+      if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
+      await options.beforeDispatch?.();
+      if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
+      return await options.dispatch(physicalExecutor);
+    } finally {
+      permit?.release();
+    }
+  };
+}

package/src/bridge/errors.ts

@@ -1,3 +1,10 @@
+import {
+  isNonReplayableUpstreamCode,
+  isReplayRefusalCode,
+  markReplayRefusalResponse,
+  markResponseNonReplayable,
+  REPLAY_REFUSED_STATUS,
+} from "../lib/upstream-retry";
 import {
   adapterFailureFromMessage,
   classifyError,
@@ -18,17 +25,34 @@ export function formatErrorResponse(
     error.code = CYBER_POLICY_ERROR_CODE;
     error.type = cyberPolicyErrorType(type);
   }
-  const finalStatus = error.code === CYBER_POLICY_ERROR_CODE ? 400 : status;
+  // Only the allowlisted transport verdicts survive this formatter. Do not forward
+  // arbitrary provider codes, and preserve the existing cyber-policy precedence.
+  const replayBlocked = error.code !== CYBER_POLICY_ERROR_CODE
+    && isNonReplayableUpstreamCode(options?.code);
+  if (replayBlocked) error.code = options!.code!;
+  // The replay refusal owns its status as well as its code. A combo or adapter formatter
+  // reaches here holding the upstream-shaped status it was about to report, and inheriting
+  // that would hand the client a 5xx it is configured to retry four times.
+  const finalStatus = error.code === CYBER_POLICY_ERROR_CODE
+    ? 400
+    : isReplayRefusalCode(error.code) ? REPLAY_REFUSED_STATUS : status;
   const headers = new Headers({ "Content-Type": "application/json" });
   const retryAfter = options?.retryAfter?.trim();
   if (error.code !== CYBER_POLICY_ERROR_CODE
+    && !replayBlocked
     && retryAfter
     && retryAfter.length > 0
     && retryAfter.length <= 128) {
     headers.set("Retry-After", retryAfter);
   }
-  return new Response(JSON.stringify({ error }), {
+  const response = new Response(JSON.stringify({ error }), {
     status: finalStatus,
     headers,
   });
+  if (replayBlocked) markResponseNonReplayable(response);
+  // Re-wrapping is where the refusal loses its provenance: combo failure consumption parses
+  // the JSON and builds a new Response, and the code alone does not tell a later quota
+  // recorder that no upstream produced this status. Carry the narrower marker across too.
+  if (replayBlocked && isReplayRefusalCode(error.code)) markReplayRefusalResponse(response);
+  return response;
 }

package/src/bridge/response-json.ts

@@ -68,6 +68,8 @@ function buildResponseJSONWithBudget(
     toolNsMap?: Map<string, { namespace: string; name: string; freeform?: true }>;
     /** Request-visible tool names. When present, an upstream call outside this set fails closed. */
     declaredToolNames?: ReadonlySet<string>;
+    /** See `bridgeToResponsesSSE`: enforcement is separate from normalization (#4735). */
+    enforceDeclaredToolNames?: boolean;
     /** Declared parameter schema per tool name; repairs integral-float integer args (#1611). */
     toolParameterSchemas?: ReadonlyMap<string, Record<string, unknown>>;
     freeformToolNames?: Set<string>;
@@ -432,7 +434,11 @@ function buildResponseJSONWithBudget(
         }
         flushToolCall();
         const effectiveName = normalizeDeclaredToolName(e.name, options?.declaredToolNames);
-        if (options?.declaredToolNames && !options.declaredToolNames.has(effectiveName)) {
+        if (
+          options?.declaredToolNames
+          && options.enforceDeclaredToolNames !== false
+          && !options.declaredToolNames.has(effectiveName)
+        ) {
           errorEvent = {
             type: "error",
             message: `routed provider emitted undeclared client tool "${effectiveName}"; only request-declared tools may be called`,
@@ -521,7 +527,7 @@ function buildResponseJSONWithBudget(
         compactionEncryptedContent = e.compactionEncryptedContent;
         sawTerminal = true;
         endTurn = e.endTurn;
-        cleanDone = e.stopReason === undefined;
+        cleanDone = !isTruncatedStopReason(e.stopReason);
         rawStopReason = e.stopReason;
         if (e.providerState) options?.onProviderState?.(e.providerState);
         // Match streaming: max_tokens and content_filter both terminate as incomplete.

package/src/bridge/sse.ts

@@ -88,6 +88,20 @@ export function bridgeToResponsesSSE(
     onUsage?: (usage: OcxUsage | undefined) => void;
     /** Request-visible tool names. When present, an upstream call outside this set fails closed. */
     declaredToolNames?: ReadonlySet<string>;
+    /**
+     * Whether `declaredToolNames` is an authorization boundary this proxy enforces, or only the
+     * catalog used to normalize provider-invented names back to declared ones.
+     *
+     * Defaults to enforcing. The chat and Anthropic inbound wires set it false: those specs make
+     * the server relay a tool call and leave execution or refusal to the client's own runner, and
+     * harnesses on them legitimately defer part of their catalog (#4735).
+     *
+     * It is a separate flag rather than simply withholding `declaredToolNames`, because the set
+     * also drives `normalizeDeclaredToolName` and `declaresCodeModeExec`. Passing `undefined`
+     * turns those off too, so a provider that invents `default.lookup` for a declared `lookup`
+     * would reach the client under the invented name instead of the normalized one.
+     */
+    enforceDeclaredToolNames?: boolean;
     /** Declared parameter schema per tool name; repairs integral-float integer args (#1611). */
     toolParameterSchemas?: ReadonlyMap<string, Record<string, unknown>>;
     /**
@@ -1008,7 +1022,11 @@ export function bridgeToResponsesSSE(
                 : undefined;
               const mapped = toolNsMap?.get(effectiveName);
               const realName = mapped?.name ?? effectiveName;
-              if (options?.declaredToolNames && !options.declaredToolNames.has(effectiveName)) {
+              if (
+                options?.declaredToolNames
+                && options.enforceDeclaredToolNames !== false
+                && !options.declaredToolNames.has(effectiveName)
+              ) {
                 const failure = responseError(
                   502,
                   "upstream_error",
@@ -1153,7 +1171,7 @@ export function bridgeToResponsesSSE(
               break;
             }
             case "done": {
-              if (currentMsg) closeCurrentMessage(event.stopReason ? undefined : "final_answer");
+              if (currentMsg) closeCurrentMessage(isTruncatedStopReason(event.stopReason) ? undefined : "final_answer");
               if (currentReasoning) closeCurrentReasoning();
               if (currentRawReasoning) closeCurrentRawReasoning();
               flushHiddenRawReasoning();