@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/responses/bridge-search-replay-cache.ts

@@ -0,0 +1,152 @@
+/**
+ * Process-local memo pairing a bridged hosted `web_search` cell with the destination's own
+ * call and the result the proxy executed for it (issue #4587).
+ *
+ * The web-search passthrough bridge (`src/web-search/passthrough-bridge.ts`) intercepts the
+ * destination's `function_call` named `web_search`, runs the search itself, and shows the
+ * caller a hosted `web_search_call` cell under a proxy-minted `ws_<uuid>` id. The caller
+ * stores that cell and replays it on every later turn. The destination, which never produced a
+ * `web_search_call` in its life, then sees an unknown item type carrying a query and sources
+ * but no result — so it usually just searches again.
+ *
+ * This memo is what lets the pre-dispatch rewrite in the Responses adapter put the destination's
+ * own `function_call` and `function_call_output` back in that item's place. It records exactly
+ * what `appendBridgeSearchTurn` would have written onto a continuation leg, so a replayed turn
+ * and a continued turn show the destination the same conversation.
+ *
+ * Scope. Entries are keyed by the upstream destination in addition to the cell id. The cell id is
+ * a v4 UUID minted here, so it cannot collide across conversations, but an unscoped key would let
+ * a history replayed against a DIFFERENT provider resurrect a call that provider never made.
+ *
+ * Bounds and privacy. Result text is web content the caller already received, but it is still
+ * request-derived data: it lives in memory only, is never logged, serialized, or exported, and is
+ * bounded by entry count, total bytes, and TTL so a long-lived proxy cannot grow without limit.
+ *
+ * A miss is deliberately indistinguishable from "no entry": the caller leaves the replayed item
+ * alone. Neither re-running the search nor inventing a result is an acceptable recovery.
+ */
+
+import { reasoningReplayDestinationIdentity } from "./reasoning-replay-cache";
+
+const MAX_ENTRIES = 64;
+const MAX_TOTAL_BYTES = 512 * 1024;
+const TTL_MS = 60 * 60 * 1000;
+
+export interface BridgeSearchReplayEntry {
+  /** The destination's own call id, as it appeared on the intercepted item. */
+  callId: string;
+  /** The destination's own item id, replayed when the upstream supplied one. */
+  sourceItemId?: string;
+  /** The tool name the destination called, recorded rather than assumed. */
+  name: string;
+  /** The intercepted call's complete arguments text. */
+  argumentsText: string;
+  /** The tool result the bridge produced for that call. */
+  output: string;
+}
+
+interface StoredEntry {
+  entry: BridgeSearchReplayEntry;
+  bytes: number;
+  at: number;
+}
+
+const entries = new Map<string, StoredEntry>();
+let totalBytes = 0;
+let clockForTests: (() => number) | null = null;
+
+const now = (): number => clockForTests?.() ?? Date.now();
+
+/**
+ * Identify the upstream destination a bridged search belongs to.
+ *
+ * Reuses the salted process-local destination digest the reasoning replay cache already defines,
+ * so both stores agree on what "the same upstream" means and neither invents a second notion of
+ * destination identity.
+ */
+export function bridgeSearchReplayScope(baseUrl: string | undefined): string | undefined {
+  return reasoningReplayDestinationIdentity(baseUrl);
+}
+
+function keyFor(scope: string, cellItemId: string): string {
+  return scope + "\u0000" + cellItemId;
+}
+
+function drop(key: string, stored: StoredEntry): void {
+  entries.delete(key);
+  totalBytes -= stored.bytes;
+}
+
+function sweep(at: number): void {
+  for (const [key, stored] of entries) {
+    if (at - stored.at >= TTL_MS) drop(key, stored);
+  }
+  // Map iteration is insertion-ordered, so the oldest surviving entry is always the first one.
+  while (entries.size > MAX_ENTRIES || totalBytes > MAX_TOTAL_BYTES) {
+    const oldest = entries.entries().next();
+    if (oldest.done) {
+      totalBytes = 0;
+      return;
+    }
+    drop(oldest.value[0], oldest.value[1]);
+  }
+}
+
+/**
+ * Record one executed bridged search.
+ *
+ * An entry with no call id is not recorded: the restore would have to emit a `function_call`
+ * without one, which is not a valid item and could not be paired with its output anyway.
+ */
+export function rememberBridgeSearchReplay(
+  scope: string | undefined,
+  cellItemId: string,
+  entry: BridgeSearchReplayEntry,
+): void {
+  if (!scope || cellItemId.length === 0 || entry.callId.length === 0) return;
+  const key = keyFor(scope, cellItemId);
+  const existing = entries.get(key);
+  if (existing) drop(key, existing);
+  const bytes = 2 * (
+    key.length
+    + entry.callId.length
+    + (entry.sourceItemId?.length ?? 0)
+    + entry.name.length
+    + entry.argumentsText.length
+    + entry.output.length
+  );
+  // A single oversized result is refused outright rather than evicting the whole store for it.
+  if (bytes > MAX_TOTAL_BYTES) return;
+  entries.set(key, { entry: { ...entry }, bytes, at: now() });
+  totalBytes += bytes;
+  sweep(now());
+}
+
+/**
+ * Look up one recorded search without consuming it.
+ *
+ * The same cell is replayed on every subsequent turn of the conversation, so a consuming read
+ * would restore the pair once and then silently stop. Expiry stays absolute: a conversation that
+ * outlives the TTL degrades to today's behaviour (the hosted cell replays unchanged) rather than
+ * pinning entries open for as long as anyone keeps talking.
+ */
+export function peekBridgeSearchReplay(
+  scope: string | undefined,
+  cellItemId: string,
+): BridgeSearchReplayEntry | undefined {
+  if (!scope || cellItemId.length === 0) return undefined;
+  const key = keyFor(scope, cellItemId);
+  const stored = entries.get(key);
+  if (!stored) return undefined;
+  if (now() - stored.at >= TTL_MS) {
+    drop(key, stored);
+    return undefined;
+  }
+  return stored.entry;
+}
+
+export function clearBridgeSearchReplayCacheForTests(clock?: (() => number) | null): void {
+  entries.clear();
+  totalBytes = 0;
+  clockForTests = clock ?? null;
+}

package/src/responses/code-mode-helper-compat.ts

@@ -9,33 +9,43 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
-function unwrapPatchInput(value: string): string {
-  try {
-    const parsed: unknown = JSON.parse(value);
-    if (isPlainObject(parsed)) {
-      if (typeof parsed.input === "string") return parsed.input;
-      if (typeof parsed.patch === "string") return parsed.patch;
-    }
-  } catch {
-    // Native custom calls carry the patch body directly.
-  }
-  return value;
-}
-
 /**
  * Convert a nested Code Mode helper call into unified-exec JavaScript.
  *
  * Parsed values are serialized as data, never interpolated as source, so command and patch text
  * cannot escape the generated call. Invalid structured helper payloads are also passed as data so
  * nested-tool validation can reject them without evaluating provider text as JavaScript.
+ *
+ * `wireToolName` is the name the body actually arrived under, which is not always the helper:
+ * a provider that got the NAME right and the BODY wrong sends `exec`, and the apply-patch
+ * helper is inferred from the payload. Recognition and compilation must read ONE canonical
+ * body, so both unwrap under that same name — see the apply-patch branch below. It defaults to
+ * the helper name, which is correct for the name-based path where the wire name IS the helper.
  */
-export function compileCodeModeHelperInput(argumentsText: unknown, toolName: string): string {
+export function compileCodeModeHelperInput(
+  argumentsText: unknown,
+  toolName: string,
+  wireToolName?: string,
+): string {
   if (typeof argumentsText !== "string") return "";
   const helperName = toolName.startsWith("default.")
     ? toolName.slice("default.".length)
     : toolName;
   if (helperName === "apply_patch") {
-    const patch = normalizeApplyPatchDelimiters(unwrapPatchInput(argumentsText));
+    // `resolveCodeModeHelperName` decides this IS an apply-patch call by reading
+    // `unwrapFreeformToolInput(argumentsText, wireToolName)`, which strips an outer Markdown
+    // fence and accepts that name's fallback fields (#4983). Compiling from a narrower unwrap
+    // meant a body accepted through a fence or a fallback field reached `tools.apply_patch`
+    // still wrapped, so the host rejected the JSON or the fence instead of applying the patch
+    // (#5046). One unwrap, one body, one decision.
+    //
+    // The vocabulary is the WIRE name rather than the helper name on purpose. `{"patch": ...}`
+    // is an apply_patch wrapper and is not an `exec` fallback field, and the recognizer already
+    // declines it under `exec`; reading it here would compile a body that recognition rejected,
+    // which is exactly the drift a second, looser unwrap introduces.
+    const patch = normalizeApplyPatchDelimiters(
+      unwrapFreeformToolInput(argumentsText, wireToolName ?? helperName),
+    );
     return `const result = await tools.apply_patch(${JSON.stringify(patch)});\ntext(result);`;
   }
   let parsed: unknown = argumentsText;
@@ -106,5 +116,5 @@ export function resolveCodeModeHelperName(
   // `tools.apply_patch(...)` JavaScript would be the mis-route this repair exists to avoid.
   if (!declaresCodeModeExec(declaredNames)) return undefined;
   if (typeof argumentsText !== "string" || argumentsText === "") return undefined;
-  return isCompletePatchEnvelope(unwrapFreeformToolInput(argumentsText)) ? "apply_patch" : undefined;
+  return isCompletePatchEnvelope(unwrapFreeformToolInput(argumentsText, "exec")) ? "apply_patch" : undefined;
 }

package/src/responses/custom-tool-compat.ts

@@ -326,7 +326,7 @@ export function restoreRoutedCustomCalls(
         id: customToolItemId(item.id),
         name: aliased ? targetName : item.name,
         input: helper
-          ? compileCodeModeHelperInput(sourceInput, helper)
+          ? compileCodeModeHelperInput(sourceInput, helper, aliased ? String(item.name) : targetName)
           : repairFreeformToolInput(
             sourceInput,
             targetName,

package/src/responses/hosted-tool-policy.ts

@@ -10,7 +10,90 @@ const UNSUPPORTED_HOSTED_TOOLS: ReadonlyArray<{
   },
 ];
 
-/** True when forwarding this hosted tool to the model would be rejected upstream. */
-export function isHostedToolUnsupportedForModel(modelId: string, tool: string, baseUrl?: string): boolean {
+/**
+ * Hosted-tool declaration names an operator may list in `unsupportedHostedTools`.
+ *
+ * A gateway must be able to deny anything a client can send it, so this is the set of
+ * nameless hosted/private declaration types the proxy recognizes on a Responses request.
+ * It is deliberately a closed vocabulary: the provider config schema ends in
+ * `.passthrough()`, so an unvalidated misspelling would be accepted, persisted, and then
+ * silently strip nothing -- which is the exact 400 the operator set the field to avoid
+ * (the `codexToolMode` lesson in #2106).
+ */
+export const DECLARABLE_HOSTED_TOOL_TYPES: ReadonlySet<string> = new Set([
+  "web_search",
+  "web_search_preview",
+  "file_search",
+  "computer_use_preview",
+  "computer_use",
+  "code_interpreter",
+  "image_generation",
+  "image_gen",
+  "mcp",
+  "tool_search",
+  "local_shell",
+  "x_search",
+]);
+
+/**
+ * Spellings that name one capability. Declaring either member denies both, because the
+ * rest of the proxy already treats these as a single tool: the parser folds
+ * `web_search_preview` onto one name (`src/responses/parser-tools.ts`), Chat ingress
+ * accepts the pair together (`src/chat/inbound.ts`), and the canonical-field strip lists
+ * the pair in a single `toolTypes` set
+ * (`src/adapters/openai-responses/request-strips.ts`).
+ *
+ * Without the alias a capability declaration would be honoured for the spelling the
+ * operator happened to write and ignored for the one the client happened to send, which
+ * reproduces the original rejection while the config claims to have prevented it.
+ */
+const HOSTED_TOOL_ALIAS_GROUPS: ReadonlyArray<ReadonlySet<string>> = [
+  new Set(["web_search", "web_search_preview"]),
+  new Set(["image_generation", "image_gen"]),
+  new Set(["computer_use_preview", "computer_use"]),
+];
+
+const NO_DECLARED_HOSTED_TOOLS: ReadonlySet<string> = new Set();
+
+/**
+ * Expand a provider's declared denials through the alias groups once per request, so the
+ * per-tool predicate stays a set lookup. Returns a shared empty set when the provider
+ * declares nothing, keeping the common path allocation-free.
+ */
+export function declaredUnsupportedHostedTools(
+  provider?: { unsupportedHostedTools?: readonly string[] },
+): ReadonlySet<string> {
+  const declared = provider?.unsupportedHostedTools;
+  if (!Array.isArray(declared) || declared.length === 0) return NO_DECLARED_HOSTED_TOOLS;
+  const out = new Set<string>();
+  for (const raw of declared) {
+    if (typeof raw !== "string") continue;
+    const tool = raw.trim();
+    if (!tool) continue;
+    out.add(tool);
+    for (const group of HOSTED_TOOL_ALIAS_GROUPS) {
+      if (!group.has(tool)) continue;
+      for (const alias of group) out.add(alias);
+    }
+  }
+  return out.size > 0 ? out : NO_DECLARED_HOSTED_TOOLS;
+}
+
+/**
+ * True when forwarding this hosted tool to the model would be rejected upstream.
+ *
+ * `declaredUnsupported` is the provider's own capability declaration, expanded by
+ * `declaredUnsupportedHostedTools`. It is additive to the built-in table rather than a
+ * replacement for it: the table covers destinations that reject a tool regardless of how
+ * the operator configured them, so an operator who never heard of the field stays
+ * protected.
+ */
+export function isHostedToolUnsupportedForModel(
+  modelId: string,
+  tool: string,
+  baseUrl?: string,
+  declaredUnsupported?: ReadonlySet<string>,
+): boolean {
+  if (declaredUnsupported?.has(tool)) return true;
   return UNSUPPORTED_HOSTED_TOOLS.some(entry => entry.match(modelId, baseUrl) && entry.tools.has(tool));
 }

package/src/responses/schema.ts

@@ -126,10 +126,17 @@ export const toolSchema = z.object({
 
 const builtinToolSchema = z.object({ type: z.string() }).loose();
 
-const hostedToolType = z.enum([
+/**
+ * Hosted tool types a client may declare on an inbound Responses request. Exported so the
+ * provider-side capability vocabulary in `src/responses/hosted-tool-policy.ts` can be
+ * asserted to cover all of them: a gateway must be able to deny anything it can be sent.
+ */
+export const HOSTED_TOOL_TYPES = [
   "web_search", "web_search_preview", "file_search", "computer_use_preview",
   "code_interpreter", "image_generation", "mcp",
-]);
+] as const;
+
+const hostedToolType = z.enum(HOSTED_TOOL_TYPES);
 
 const allowedToolEntrySchema = z.object({ type: z.string(), name: z.string().optional() });
 

package/src/responses/spill-store.ts

@@ -159,6 +159,23 @@ function spillNow(): number {
   return spillNowOverride?.() ?? Date.now();
 }
 
+/**
+ * The spill deadline clock, shared with the shutdown drain in `state/spill-queue.ts`.
+ *
+ * Every deadline the shutdown path enforces has to read the same clock the work it
+ * budgets reads. When the drain measured its reserve on `Date.now()` while the ACL
+ * harden it was budgeting ran on this injected clock, a test could freeze the clock,
+ * believe it had removed wall time from the case, and still lose an 80 ms reserve to
+ * real elapsed time on a loaded runner — which is what turned
+ * `shutdown fallback prices the job-owned superseded generation before publishing`
+ * red on macOS 2/2 in run 35137850114 while the assertion it was written for never ran.
+ *
+ * Production is unchanged: with no override installed this is `Date.now()`.
+ */
+export function responseSpillNow(): number {
+  return spillNow();
+}
+
 function record(event: "write" | "fsync" | "close" | "harden" | "publish" | "dir-fsync" | "stub-swap"): void {
   spillIoForTest?.record?.(event);
 }

package/src/responses/state/body-policy.ts

@@ -0,0 +1,25 @@
+/**
+ * Request bodies that must never enter the continuation cache.
+ *
+ * The cache is persisted to `responses-state.json`, so anything recorded here reaches disk.
+ * Encrypted-agent-task recovery decrypts task text into the request body and promises
+ * in-memory, TTL-bounded retention; recording that body would put the plaintext on disk with
+ * no TTL and break the promise.
+ *
+ * A WeakSet rather than a body field on purpose: `_rawBody` is serialized verbatim by the
+ * native passthrough, so any marker written into the body itself would be sent upstream.
+ * Marking is enforced once here rather than at each call site, because every recording path
+ * (streaming, non-streaming, passthrough, forced) funnels through `rememberResponseState` —
+ * a new call site cannot reintroduce the leak by forgetting a guard.
+ */
+const nonPersistableBodies = new WeakSet<object>();
+
+/** Bar this exact request body from the continuation cache, and therefore from disk. */
+export function markBodyNonPersistable(body: unknown): void {
+  if (body && typeof body === "object") nonPersistableBodies.add(body as object);
+}
+
+/** Test the body's in-memory persistence restriction without adding a wire marker. */
+export function isBodyNonPersistable(body: unknown): boolean {
+  return !!body && typeof body === "object" && nonPersistableBodies.has(body);
+}

package/src/responses/state/spill-queue.ts

@@ -7,6 +7,7 @@ import {
   MAX_RESPONSE_SPILL_PAYLOAD_BYTES,
   prospectiveResponseSpillBytes,
   responseSpillPayloadCap,
+  responseSpillNow,
   type ResponseSpillPublicationControl,
   type ResponseSpillRef,
   writeResponseSpillDurably,
@@ -377,7 +378,7 @@ function responseSpillShutdownBudget(): { totalMs: number; fallbackReserveMs: nu
 }
 
 function awaitResponseSpillTailUntil(observed: Promise<void>, deadline: number): Promise<boolean> {
-  const remaining = deadline - Date.now();
+  const remaining = deadline - responseSpillNow();
   if (remaining <= 0) return Promise.resolve(false);
   return new Promise(resolve => {
     let finished = false;
@@ -554,12 +555,13 @@ function terminalizeExhaustedShutdownFallback(
 }
 
 function fallbackPendingResponseSpills(reserveMs: number): Error[] {
-  const deadline = Date.now() + reserveMs;
+  // Same clock as the harden work this reserve is budgeting — see `responseSpillNow`.
+  const deadline = responseSpillNow() + reserveMs;
   const failures: Error[] = [];
   for (;;) {
     const pending = pendingShutdownFallbackCandidates();
     if (pending.length === 0) return failures;
-    if (Date.now() >= deadline) {
+    if (responseSpillNow() >= deadline) {
       terminalizeExhaustedShutdownFallback(pending, failures);
       return failures;
     }
@@ -569,7 +571,7 @@ function fallbackPendingResponseSpills(reserveMs: number): Error[] {
     for (let index = 0; index < pending.length; index += 1) {
       const { job, candidate } = pending[index]!;
       if (requireStore().currentEntry(job.id) !== candidate) continue;
-      const remaining = deadline - Date.now();
+      const remaining = deadline - responseSpillNow();
       if (remaining <= 0) {
         reserveExhausted = true;
         for (const exhausted of pending.slice(index)) {
@@ -587,7 +589,7 @@ function fallbackPendingResponseSpills(reserveMs: number): Error[] {
     requireStore().recomputeOldestResident();
     requireStore().pruneResponses();
     enforceAppOwnedMemoryBudget();
-    if (reserveExhausted || Date.now() >= deadline) {
+    if (reserveExhausted || responseSpillNow() >= deadline) {
       terminalizeExhaustedShutdownFallback(pendingShutdownFallbackCandidates(), failures);
       return failures;
     }
@@ -597,7 +599,7 @@ function fallbackPendingResponseSpills(reserveMs: number): Error[] {
 export async function drainResponseSpillPublications(): Promise<void> {
   const budget = responseSpillShutdownBudget();
   const fallbackReserveMs = Math.min(budget.totalMs, Math.max(1, budget.fallbackReserveMs));
-  const drainDeadline = Date.now() + Math.max(0, budget.totalMs - fallbackReserveMs);
+  const drainDeadline = responseSpillNow() + Math.max(0, budget.totalMs - fallbackReserveMs);
 
   for (;;) {
     if (pendingResponseSpills.size === 0) return;

package/src/responses/state.ts

@@ -23,6 +23,8 @@ import type { ResponseSpillWriteFailureCode, ResponseSpillWriteStatus, ResponseS
 export { responseAdmissionCountersForTests } from "./state/spill-failure";
 import { admissionCounters, noteSpillWriteFailure, noteSpillWriteSuccess, spillCounters, spillWriteHealth } from "./state/spill-failure";
 import { loadSnapshotEntry } from "./state/snapshot-codec";
+import { isBodyNonPersistable } from "./state/body-policy";
+export { isBodyNonPersistable, markBodyNonPersistable } from "./state/body-policy";
 export { flushPendingResponseSpillsForTests, awaitResponseSpillPublicationTailForTests, pendingResponseSpillMetricsForTests, setResponseSpillShutdownBudgetForTests, setResponseSpillAsyncAclAttemptBudgetForTests, setResponseSpillShutdownTerminalizationPassLimitForTests } from "./state/spill-queue";
 import {
   bindSpillQueueStore,
@@ -1235,27 +1237,6 @@ export function responseStateMetrics(): ResponseStateMetrics {
  * Cache completed output and max_output_tokens partial output for previous_response_id replay.
  * Content-filtered incomplete and failed output are not authoritative replay history.
  */
-/**
- * Request bodies that must never enter the continuation cache.
- *
- * The cache is persisted to `responses-state.json`, so anything recorded here reaches disk.
- * Encrypted-agent-task recovery decrypts task text into the request body and promises
- * in-memory, TTL-bounded retention; recording that body would put the plaintext on disk with
- * no TTL and break the promise.
- *
- * A WeakSet rather than a body field on purpose: `_rawBody` is serialized verbatim by the
- * native passthrough, so any marker written into the body itself would be sent upstream.
- * Marking is enforced once here rather than at each call site, because every recording path
- * (streaming, non-streaming, passthrough, forced) funnels through `rememberResponseState` —
- * a new call site cannot reintroduce the leak by forgetting a guard.
- */
-const nonPersistableBodies = new WeakSet<object>();
-
-/** Bar this exact request body from the continuation cache, and therefore from disk. */
-export function markBodyNonPersistable(body: unknown): void {
-  if (body && typeof body === "object") nonPersistableBodies.add(body as object);
-}
-
 export function rememberResponseState(
   requestBody: unknown,
   response: { id?: unknown; output?: unknown; status?: unknown; incomplete_details?: unknown },
@@ -1264,7 +1245,7 @@ export function rememberResponseState(
 ): void {
   if (!requestBody || typeof requestBody !== "object" || Array.isArray(requestBody)) return;
   const request = requestBody as Record<string, unknown>;
-  if (nonPersistableBodies.has(request)) return;
+  if (isBodyNonPersistable(request)) return;
   // `force` bypasses only the store:false skip: Codex sends `store:false` on every non-Azure
   // HTTP request (and WS inherits it), yet its WS turns still chain with previous_response_id.
   // The passthrough branch records with force so those chains can be expanded locally; the

package/src/router.ts

@@ -384,6 +384,10 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       && registryEntry.requiresAdjacentResponsesToolResults !== undefined
       ? { requiresAdjacentResponsesToolResults: registryEntry.requiresAdjacentResponsesToolResults }
       : {}),
+    ...(provider.requiresPairedResponsesToolResults === undefined
+      && registryEntry.requiresPairedResponsesToolResults !== undefined
+      ? { requiresPairedResponsesToolResults: registryEntry.requiresPairedResponsesToolResults }
+      : {}),
     ...(provider.annotateEmptyToolOutputs === undefined
       && registryEntry.annotateEmptyToolOutputs !== undefined
       ? { annotateEmptyToolOutputs: registryEntry.annotateEmptyToolOutputs }

package/src/server/auth-cors.ts

@@ -1,3 +1,4 @@
+import { providerRelativeSendPathConfigError } from "../config/provider-relative-send-path";
 import { modelCapabilitiesConfigError } from "../config/provider-validation";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { initialModelSelection } from "../providers/initial-model-selection";
@@ -29,6 +30,7 @@ import {
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
+import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -754,6 +756,10 @@ export function providerManagementConfigError(
   }
   const destinationError = providerDestinationConfigError(name, typed);
   if (destinationError) return `provider ${name} ${destinationError}`;
+  for (const field of ["responsesPath", "chatCompletionsPath"] as const) {
+    const sendPathError = providerRelativeSendPathConfigError(field, raw[field]);
+    if (sendPathError) return `provider ${JSON.stringify(redactSecretString(name))} ${sendPathError}`;
+  }
   const headersError = providerHeadersConfigError(typed.headers);
   if (headersError) return `provider ${name} ${headersError}`;
   const retryOn429Error = retryOn429PolicyConfigError(raw.retryOn429);
@@ -793,6 +799,8 @@ export function providerManagementConfigError(
   }
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
+  const suppressSyntheticMaxError = booleanRecordConfigError(raw.modelSuppressSyntheticMax, "modelSuppressSyntheticMax");
+  if (suppressSyntheticMaxError) return `provider ${name} ${suppressSyntheticMaxError}`;
   const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
     raw.modelReasoningSummaryDelivery,
     raw.modelSupportsReasoningSummaries,
@@ -834,6 +842,22 @@ export function providerManagementConfigError(
     "omitReasoningEffortWithToolsModels",
   );
   if (toolReasoningOptOutError) return `provider ${name} ${toolReasoningOptOutError}`;
+  const unsupportedHostedToolsError = nonBlankStringArrayConfigError(
+    raw.unsupportedHostedTools,
+    "unsupportedHostedTools",
+  );
+  if (unsupportedHostedToolsError) return `provider ${name} ${unsupportedHostedToolsError}`;
+  if (Array.isArray(raw.unsupportedHostedTools)) {
+    // Closed vocabulary, same reason as the config schema: an unrecognized name would be
+    // stored and then strip nothing, so the operator would keep getting the upstream 400
+    // this field exists to prevent.
+    const unknownTool = (raw.unsupportedHostedTools as unknown[])
+      .find(tool => typeof tool === "string" && !DECLARABLE_HOSTED_TOOL_TYPES.has(tool.trim()));
+    if (unknownTool !== undefined) {
+      return `provider ${name} unsupportedHostedTools must name only hosted tool types: `
+        + `${[...DECLARABLE_HOSTED_TOOL_TYPES].join(", ")}`;
+    }
+  }
   const openRouterError = openRouterRoutingConfigError(typed);
   if (openRouterError) return `provider ${name} ${openRouterError}`;
   const vercelError = vercelGatewayRoutingConfigError(typed);
@@ -913,6 +937,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   commandCodeVersion: "editor",
   statelessResponses: "editor",
   requiresAdjacentResponsesToolResults: "editor",
+  requiresPairedResponsesToolResults: "editor",
   annotateEmptyToolOutputs: "editor",
   supportsServiceTier: "editor",
   modelSupportsServiceTier: "editor",
@@ -963,6 +988,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   refreshPolicy: "editor",
   reasoningEfforts: "editor",
   modelReasoningEfforts: "editor",
+  modelSuppressSyntheticMax: "editor",
   modelDefaultReasoningEfforts: "editor",
   pinnedReasoningEffort: "editor",
   modelPinnedReasoningEfforts: "editor",
@@ -978,6 +1004,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   xaiResponsesDefaultVersion: "runtime",
   zaiResponsesDefaultVersion: "runtime",
   supportsResponsesCustomTools: "editor",
+  unsupportedHostedTools: "editor",
   responsesSnapshotRepair: "editor",
   webSearchBridge: "editor",
   reasoningEffortMap: "editor",

package/src/server/chat-completions.ts

@@ -150,10 +150,15 @@ async function handleChatCompletionsWithBudget(
   let chatNativeRoute: ReturnType<typeof routeModel> | null = null;
   try {
     const route = routeModel(config, chatBody.model as string, evidenceFromBody(chatBody));
-    route.provider = resolveOpenCodeGoTransport(route.provider, getOrAllocateRequestSessionLane(req));
-    // Settle the wire once so every branch below reads the adapter this model will
-    // actually use, not the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "chat");
+    // Preserve the routed destination for Go recognition, then settle the wire before
+    // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
+    const routedProvider = route.provider;
+    const wireProvider = resolveWireProtocolOverride(route.providerName, route.modelId, routedProvider, "chat");
+    route.provider = resolveOpenCodeGoTransport(
+      wireProvider,
+      getOrAllocateRequestSessionLane(req),
+      routedProvider,
+    );
     logCtx.model = route.modelId;
     logCtx.providerAdapter = route.provider.adapter;
     logCtx.requestedModel = requestedModel;