@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/providers/registry/model-seeds.ts

@@ -315,6 +315,13 @@ export const DEEPSEEK_VISION_PREVIEW_MODEL = "deepseek-v4-flash-vision-exp";
  */
 export const COMMAND_CODE_IMAGE_MODELS = [
   `deepseek/${DEEPSEEK_VISION_PREVIEW_MODEL}`,
+  // Probed 2026-09-18 through a running 2.58.0 proxy: a 3x3 random-color grid
+  // (180x180 PNG, six candidate colors) came back 9/9 correct both as a user
+  // message and as a tool_result, and the request logs show the route served
+  // the image natively — no vision-sidecar call in either window. #4505 asked
+  // for exactly this upstream probe before promoting the id. The sibling
+  // deepseek/deepseek-v4-flash route remains verified-negative above.
+  "deepseek/deepseek-v4.1-flash",
   "gpt-5.6-luna",
   "gpt-5.6-sol",
   "MiniMaxAI/MiniMax-M3",
@@ -334,20 +341,19 @@ export const COMMAND_CODE_IMAGE_MODELS = [
 /**
  * Native image stays sourced from COMMAND_CODE_IMAGE_MODELS. Text-only routes
  * sit beside that list so the catalog can still advertise sidecar coverage
- * without claiming the gateway itself accepts a picture.
- *
- * The gateway-prefixed DeepSeek V4.1 Flash route has no verified native image
- * support, so declaring it image-capable would hand it a picture it drops. A
- * positive text-only declaration makes it a vision-sidecar consumer
+ * without claiming the gateway itself accepts a picture. A positive text-only
+ * declaration makes the route a vision-sidecar consumer
  * (src/vision/eligibility.ts), so the catalog advertises image input on its
- * behalf and the four-target combo in #4505 intersects to ["text","image"]
- * instead of ["text"] — without claiming native vision. modelInputModalities
- * is per-key filled, so this reaches an existing install even when
- * noVisionModels was persisted before the id joined that list.
+ * behalf — without claiming native vision — and modelInputModalities is
+ * per-key filled, so that reaches an existing install even when noVisionModels
+ * was persisted before the id joined a list.
+ *
+ * Empty as of 2026-09-18. Its only entry, deepseek/deepseek-v4.1-flash, moved
+ * to COMMAND_CODE_IMAGE_MODELS once the #4505-requested probe passed on both
+ * the user-message and tool-result paths (see the note at that entry). The
+ * mechanism stays for the next route that measures text-only.
  */
-export const COMMAND_CODE_TEXT_ONLY_MODELS = [
-  "deepseek/deepseek-v4.1-flash",
-] as const;
+export const COMMAND_CODE_TEXT_ONLY_MODELS = [] as const;
 export const COMMAND_CODE_MODEL_INPUT_MODALITIES: Record<string, ["text"] | ["text", "image"]> = {
   ...Object.fromEntries(COMMAND_CODE_IMAGE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
   ...Object.fromEntries(COMMAND_CODE_TEXT_ONLY_MODELS.map(id => [id, ["text"] as ["text"]])),
@@ -439,9 +445,15 @@ export const deepseekReasoningMapFor = (modelId: string): Record<string, string>
 //           https://help.aliyun.com/en/model-studio/token-plan-quickstart
 // 260909 refresh, re-probed against the live gateway (both regions, both tiers):
 // https://github.com/oliver-mee/alibaba-token-plan-wiki (machine-readable catalog).
-// glm-5.3 / glm-5.3-flash removed from both Token Plan catalogs: they exist on Z.AI
-// endpoints but the Token Plan gateway has never served either id (the 260826 seed
-// propagated them across every GLM-carrying catalog; a selected row 404s).
+// 260918: glm-5.3 returns. The 260909 removal was correct at the time (the id
+// 404'd on every plan key), but the gateway started serving glm-5.3 on 260917:
+// it now appears on /models for global Team, global Personal, and CN Team, and
+// answers a completion on a Personal key (probed 260918). Contract on the plan
+// gateway: effort low/high/max (default max), thinking always-on (the gateway
+// rejects enable_thinking:false with 400), 1M context, 131,072 max output,
+// text-only input, strict json_schema accepted. glm-5.3-flash REMAINS OUT:
+// still never served by the Token Plan gateway (docs.z.ai VLM id, not plan
+// entitlement).
 // The Beijing preset keeps the Personal Edition subset; non-chat ids (audio/image/
 // video families) stay out: they answer only on async endpoints openai-chat cannot
 // reach. deepseek-v4-pro-0813 is callable but NOT listed by /models, which is the
@@ -457,7 +469,7 @@ export const deepseekReasoningMapFor = (modelId: string): Record<string, string>
 // drifting ones.
 export const ALIBABA_TOKEN_PLAN_MODELS = [
   "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash",
-  "deepseek-v4-pro", "deepseek-v4-flash-0731", "deepseek-v4.1-flash", "glm-5.2",
+  "deepseek-v4-pro", "deepseek-v4-flash-0731", "deepseek-v4.1-flash", "glm-5.2", "glm-5.3",
 ];
 export const ALIBABA_TOKEN_PLAN_QWEN_MODELS = [
   "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash",
@@ -474,6 +486,7 @@ export const ALIBABA_TOKEN_PLAN_INPUT_MODALITIES: Record<string, string[]> = {
   // Vision probed on the plan gateway 260915 (user message and tool result, both 200).
   "deepseek-v4.1-flash": ["text", "image"],
   "glm-5.2": ["text"],
+  "glm-5.3": ["text"],
 };
 
 // 260721 Alibaba Token Plan International (ap-southeast-1 / Singapore, hardened 260721).
@@ -487,7 +500,7 @@ export const ALIBABA_INTL_TOKEN_PLAN_MODELS = [
   "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
   "deepseek-v4-pro", "deepseek-v4-pro-0813", "deepseek-v4-flash", "deepseek-v4-flash-0731", "deepseek-v4.1-flash", "deepseek-v3.2",
   "kimi-k2.7-code", "kimi-k2.6", "kimi-k2.5",
-  "glm-5.2", "glm-5.1", "glm-5",
+  "glm-5.2", "glm-5.3", "glm-5.1", "glm-5",
   "MiniMax-M2.5",
 ];
 export const ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS = [
@@ -589,7 +602,7 @@ export const ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS: Record<string, number> = {
   "deepseek-v4-pro": 1_000_000, "deepseek-v4-pro-0813": 1_000_000, "deepseek-v4-flash": 1_000_000,
   "deepseek-v4-flash-0731": 1_000_000, "deepseek-v4.1-flash": 1_000_000, "deepseek-v3.2": 131_072,
   "kimi-k2.7-code": 262_144, "kimi-k2.6": 262_144, "kimi-k2.5": 262_144,
-  "glm-5.2": 1_000_000, "glm-5.1": 202_752, "glm-5": 202_752,
+  "glm-5.2": 1_000_000, "glm-5.3": 1_000_000, "glm-5.1": 202_752, "glm-5": 202_752,
   "MiniMax-M2.5": 196_608,
 };
 export const ALIBABA_TOKEN_PLAN_MAX_OUTPUT_TOKENS: Record<string, number> = {
@@ -598,17 +611,17 @@ export const ALIBABA_TOKEN_PLAN_MAX_OUTPUT_TOKENS: Record<string, number> = {
   "deepseek-v4-pro": 393_216, "deepseek-v4-pro-0813": 393_216, "deepseek-v4-flash": 393_216,
   "deepseek-v4-flash-0731": 393_216, "deepseek-v4.1-flash": 393_216, "deepseek-v3.2": 65_536,
   "kimi-k2.7-code": 262_144, "kimi-k2.6": 262_144, "kimi-k2.5": 98_304,
-  "glm-5.2": 131_072, "glm-5.1": 128_000, "glm-5": 16_384,
+  "glm-5.2": 131_072, "glm-5.3": 131_072, "glm-5.1": 128_000, "glm-5": 16_384,
   "MiniMax-M2.5": 32_768,
 };
 export const ALIBABA_TOKEN_PLAN_NO_VISION = [
   "qwen3.7-max", "deepseek-v4-pro", "deepseek-v4-pro-0813", "deepseek-v4-flash",
-  "deepseek-v4-flash-0731", "deepseek-v3.2", "glm-5.2", "glm-5.1", "glm-5", "MiniMax-M2.5",
+  "deepseek-v4-flash-0731", "deepseek-v3.2", "glm-5.2", "glm-5.3", "glm-5.1", "glm-5", "MiniMax-M2.5",
 ];
 export const ALIBABA_TOKEN_PLAN_PRESERVE_REASONING = [
   "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
   "deepseek-v4-pro", "deepseek-v4-pro-0813", "deepseek-v4-flash", "deepseek-v4-flash-0731",
-  "deepseek-v4.1-flash", "glm-5.2",
+  "deepseek-v4.1-flash", "glm-5.2", "glm-5.3",
 ];
 
 // 260717 Kimi K3: the subscription endpoint uses one upstream id (`k3`) for both
@@ -960,3 +973,47 @@ export const CLINE_PASS_TEXT_ONLY_MODELS = CLINE_PASS_MODALITY_KNOWN_MODELS.filt
 export const CLINE_PASS_MODEL_INPUT_MODALITIES: Record<string, string[]> = Object.fromEntries(
   CLINE_PASS_MODALITY_KNOWN_MODELS.map(id => [id, CLINE_PASS_IMAGE_MODELS.has(id) ? ["text", "image"] : ["text"]]),
 );
+
+// Opper seed: bare *pool* names. A pool is every provider Opper serves that model through; Opper
+// picks the route per request. Each name is the `.model` of a `pooled: true` entry in the public
+// catalogue snapshot supplied by the original provider author
+// (https://api.opper.ai/v3/models?limit=2000, captured 2026-09-14); `vendor/model` ids
+// (anthropic/claude-sonnet-4-6) pin one route and stay valid, they are just not seeded.
+export const OPPER_MODELS = [
+  "claude-sonnet-4-6",
+  "claude-opus-5",
+  "gpt-5.5",
+  "gpt-5.4-mini",
+  "gemini-3.8-flash",
+  "deepseek-v4-pro",
+  "kimi-k3",
+  "mistral-large-2512",
+];
+// Smallest value across each pool's members in that snapshot, capped at the lab model's own limit
+// (kimi-k3 output); live discovery owns which models exist.
+export const OPPER_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "claude-sonnet-4-6": 1_000_000,
+  "claude-opus-5": 1_000_000,
+  "gpt-5.5": 1_050_000,
+  "gpt-5.4-mini": 400_000,
+  "gemini-3.8-flash": 1_048_576,
+  "deepseek-v4-pro": 1_000_000,
+  "kimi-k3": 1_048_576,
+  "mistral-large-2512": 256_000,
+};
+export const OPPER_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "claude-sonnet-4-6": 64_000,
+  "claude-opus-5": 128_000,
+  "gpt-5.5": 128_000,
+  "gpt-5.4-mini": 128_000,
+  "gemini-3.8-flash": 65_536,
+  "deepseek-v4-pro": 65_536,
+  "kimi-k3": 131_072,
+  "mistral-large-2512": 8_192,
+};
+// Pools whose members do not all accept image input (deepseek-v4-pro: no member does; kimi-k3: the
+// sference route is text-only), so the shared modality set is text.
+export const OPPER_TEXT_ONLY_MODELS = ["deepseek-v4-pro", "kimi-k3"];
+export const OPPER_MODEL_INPUT_MODALITIES: Record<string, string[]> = Object.fromEntries(
+  OPPER_MODELS.map(id => [id, OPPER_TEXT_ONLY_MODELS.includes(id) ? ["text"] : ["text", "image"]]),
+);

package/src/responses/apply-patch-envelope.ts

@@ -2,9 +2,9 @@
 //
 // Some routed models decorate the first and last lines as
 // `*** Begin Patch ***` / `*** End Patch ***`. Codex rejects those otherwise
-// valid custom-tool payloads. Repair is deliberately limited to a complete,
-// structurally recognizable top-level patch: arbitrary `exec` JavaScript is
-// caller-authored executable input and must remain byte-identical.
+// valid custom-tool payloads. Repair of executable bodies is deliberately limited to
+// unambiguous wrapper mistakes: one recognized alternate field or one complete outer
+// Markdown fence. Ordinary `exec` JavaScript remains byte-identical.
 //
 // This is the same intent boundary as `src/lib/tool-argument-integers.ts`:
 // repair the one faithful reading, leave genuine patch content alone.
@@ -22,20 +22,52 @@ const PATCH_BEGIN = "*** Begin Patch";
 const PATCH_END = "*** End Patch";
 const TOP_LEVEL_PATCH_ENVELOPE = /^(\*\*\* Begin Patch(?: \*\*\*)?)(\r?\n)([\s\S]*)(\r?\n)(\*\*\* End Patch(?: \*\*\*)?)(\r?\n)?$/;
 const PATCH_OPERATION_LINE = /^\*\*\* (?:Add|Update|Delete) File: .+$/m;
+const OUTER_MARKDOWN_CODE_FENCE = /^```[^\r\n]*\r?\n([\s\S]*?)\r?\n```$/;
+const FREEFORM_FALLBACK_KEYS: Readonly<Record<string, readonly string[]>> = {
+  exec: ["code", "script", "js", "javascript", "command", "cmd", "content"],
+  apply_patch: ["patch", "content"],
+};
+
+function stripMarkdownCodeFence(text: string, toolName: string): string {
+  if (toolName !== "exec" && toolName !== "apply_patch") return text;
+  const match = OUTER_MARKDOWN_CODE_FENCE.exec(text.trim());
+  return match ? match[1] : text;
+}
+
+/**
+ * The single-field wrappers `unwrapFreeformToolInput` accepts for one tool name, besides the
+ * canonical `input`.
+ *
+ * Exported so the streaming side can hold a buffer that is still turning into one of these.
+ * A second list of key names beside this one is how the streamed bytes and the completed item
+ * come to disagree, which is the defect it exists to prevent (#5047).
+ */
+export function freeformFallbackKeys(toolName: string): readonly string[] {
+  return FREEFORM_FALLBACK_KEYS[toolName] ?? [];
+}
 
 /** Unwrap the `{input:string}` function-call wrapper used for freeform tools. */
-export function unwrapFreeformToolInput(argumentsText: unknown): string {
+export function unwrapFreeformToolInput(argumentsText: unknown, toolName = ""): string {
   if (typeof argumentsText !== "string") return "";
   try {
     const parsed: unknown = JSON.parse(argumentsText);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      const input = (parsed as { input?: unknown }).input;
-      if (typeof input === "string") return input;
+      const record = parsed as Record<string, unknown>;
+      if (Object.prototype.hasOwnProperty.call(record, "input")) {
+        return typeof record.input === "string"
+          ? stripMarkdownCodeFence(record.input, toolName)
+          : argumentsText;
+      }
+      const fallbackKeys = FREEFORM_FALLBACK_KEYS[toolName] ?? [];
+      const candidates = fallbackKeys.filter(key => typeof record[key] === "string");
+      if (candidates.length === 1) {
+        return stripMarkdownCodeFence(record[candidates[0]] as string, toolName);
+      }
     }
   } catch {
     // The string is the freeform body, not nested JSON.
   }
-  return argumentsText;
+  return stripMarkdownCodeFence(argumentsText, toolName);
 }
 
 /**
@@ -92,17 +124,18 @@ export function mayBecomePatchEnvelope(text: string): boolean {
 /**
  * Repair freeform input before Codex sees it.
  *
- * Only a bare or reserved-`functions` `apply_patch` payload may receive delimiter
- * repair. Remote namespaces own their grammar; those bodies and every other
- * freeform input are unwrapped and left byte-exact.
+ * Only a bare or reserved-`functions` tool may receive fallback-field or outer-fence
+ * repair, and only `apply_patch` may receive delimiter repair. Remote namespaces own
+ * their grammar; those bodies and every other freeform input are unwrapped and left
+ * byte-exact.
  */
 export function repairFreeformToolInput(
   argumentsText: unknown,
   toolName = "",
   namespace?: string,
 ): string {
-  const unwrapped = unwrapFreeformToolInput(argumentsText);
   const ownsApplyPatchGrammar = namespace === undefined || namespace === "functions";
+  const unwrapped = unwrapFreeformToolInput(argumentsText, ownsApplyPatchGrammar ? toolName : "");
   return ownsApplyPatchGrammar && toolName === "apply_patch"
     ? normalizeApplyPatchDelimiters(unwrapped)
     : unwrapped;

package/src/responses/bridge-search-replay-cache.ts

@@ -0,0 +1,152 @@
+/**
+ * Process-local memo pairing a bridged hosted `web_search` cell with the destination's own
+ * call and the result the proxy executed for it (issue #4587).
+ *
+ * The web-search passthrough bridge (`src/web-search/passthrough-bridge.ts`) intercepts the
+ * destination's `function_call` named `web_search`, runs the search itself, and shows the
+ * caller a hosted `web_search_call` cell under a proxy-minted `ws_<uuid>` id. The caller
+ * stores that cell and replays it on every later turn. The destination, which never produced a
+ * `web_search_call` in its life, then sees an unknown item type carrying a query and sources
+ * but no result — so it usually just searches again.
+ *
+ * This memo is what lets the pre-dispatch rewrite in the Responses adapter put the destination's
+ * own `function_call` and `function_call_output` back in that item's place. It records exactly
+ * what `appendBridgeSearchTurn` would have written onto a continuation leg, so a replayed turn
+ * and a continued turn show the destination the same conversation.
+ *
+ * Scope. Entries are keyed by the upstream destination in addition to the cell id. The cell id is
+ * a v4 UUID minted here, so it cannot collide across conversations, but an unscoped key would let
+ * a history replayed against a DIFFERENT provider resurrect a call that provider never made.
+ *
+ * Bounds and privacy. Result text is web content the caller already received, but it is still
+ * request-derived data: it lives in memory only, is never logged, serialized, or exported, and is
+ * bounded by entry count, total bytes, and TTL so a long-lived proxy cannot grow without limit.
+ *
+ * A miss is deliberately indistinguishable from "no entry": the caller leaves the replayed item
+ * alone. Neither re-running the search nor inventing a result is an acceptable recovery.
+ */
+
+import { reasoningReplayDestinationIdentity } from "./reasoning-replay-cache";
+
+const MAX_ENTRIES = 64;
+const MAX_TOTAL_BYTES = 512 * 1024;
+const TTL_MS = 60 * 60 * 1000;
+
+export interface BridgeSearchReplayEntry {
+  /** The destination's own call id, as it appeared on the intercepted item. */
+  callId: string;
+  /** The destination's own item id, replayed when the upstream supplied one. */
+  sourceItemId?: string;
+  /** The tool name the destination called, recorded rather than assumed. */
+  name: string;
+  /** The intercepted call's complete arguments text. */
+  argumentsText: string;
+  /** The tool result the bridge produced for that call. */
+  output: string;
+}
+
+interface StoredEntry {
+  entry: BridgeSearchReplayEntry;
+  bytes: number;
+  at: number;
+}
+
+const entries = new Map<string, StoredEntry>();
+let totalBytes = 0;
+let clockForTests: (() => number) | null = null;
+
+const now = (): number => clockForTests?.() ?? Date.now();
+
+/**
+ * Identify the upstream destination a bridged search belongs to.
+ *
+ * Reuses the salted process-local destination digest the reasoning replay cache already defines,
+ * so both stores agree on what "the same upstream" means and neither invents a second notion of
+ * destination identity.
+ */
+export function bridgeSearchReplayScope(baseUrl: string | undefined): string | undefined {
+  return reasoningReplayDestinationIdentity(baseUrl);
+}
+
+function keyFor(scope: string, cellItemId: string): string {
+  return scope + "\u0000" + cellItemId;
+}
+
+function drop(key: string, stored: StoredEntry): void {
+  entries.delete(key);
+  totalBytes -= stored.bytes;
+}
+
+function sweep(at: number): void {
+  for (const [key, stored] of entries) {
+    if (at - stored.at >= TTL_MS) drop(key, stored);
+  }
+  // Map iteration is insertion-ordered, so the oldest surviving entry is always the first one.
+  while (entries.size > MAX_ENTRIES || totalBytes > MAX_TOTAL_BYTES) {
+    const oldest = entries.entries().next();
+    if (oldest.done) {
+      totalBytes = 0;
+      return;
+    }
+    drop(oldest.value[0], oldest.value[1]);
+  }
+}
+
+/**
+ * Record one executed bridged search.
+ *
+ * An entry with no call id is not recorded: the restore would have to emit a `function_call`
+ * without one, which is not a valid item and could not be paired with its output anyway.
+ */
+export function rememberBridgeSearchReplay(
+  scope: string | undefined,
+  cellItemId: string,
+  entry: BridgeSearchReplayEntry,
+): void {
+  if (!scope || cellItemId.length === 0 || entry.callId.length === 0) return;
+  const key = keyFor(scope, cellItemId);
+  const existing = entries.get(key);
+  if (existing) drop(key, existing);
+  const bytes = 2 * (
+    key.length
+    + entry.callId.length
+    + (entry.sourceItemId?.length ?? 0)
+    + entry.name.length
+    + entry.argumentsText.length
+    + entry.output.length
+  );
+  // A single oversized result is refused outright rather than evicting the whole store for it.
+  if (bytes > MAX_TOTAL_BYTES) return;
+  entries.set(key, { entry: { ...entry }, bytes, at: now() });
+  totalBytes += bytes;
+  sweep(now());
+}
+
+/**
+ * Look up one recorded search without consuming it.
+ *
+ * The same cell is replayed on every subsequent turn of the conversation, so a consuming read
+ * would restore the pair once and then silently stop. Expiry stays absolute: a conversation that
+ * outlives the TTL degrades to today's behaviour (the hosted cell replays unchanged) rather than
+ * pinning entries open for as long as anyone keeps talking.
+ */
+export function peekBridgeSearchReplay(
+  scope: string | undefined,
+  cellItemId: string,
+): BridgeSearchReplayEntry | undefined {
+  if (!scope || cellItemId.length === 0) return undefined;
+  const key = keyFor(scope, cellItemId);
+  const stored = entries.get(key);
+  if (!stored) return undefined;
+  if (now() - stored.at >= TTL_MS) {
+    drop(key, stored);
+    return undefined;
+  }
+  return stored.entry;
+}
+
+export function clearBridgeSearchReplayCacheForTests(clock?: (() => number) | null): void {
+  entries.clear();
+  totalBytes = 0;
+  clockForTests = clock ?? null;
+}

package/src/responses/code-mode-helper-compat.ts

@@ -9,33 +9,43 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
-function unwrapPatchInput(value: string): string {
-  try {
-    const parsed: unknown = JSON.parse(value);
-    if (isPlainObject(parsed)) {
-      if (typeof parsed.input === "string") return parsed.input;
-      if (typeof parsed.patch === "string") return parsed.patch;
-    }
-  } catch {
-    // Native custom calls carry the patch body directly.
-  }
-  return value;
-}
-
 /**
  * Convert a nested Code Mode helper call into unified-exec JavaScript.
  *
  * Parsed values are serialized as data, never interpolated as source, so command and patch text
  * cannot escape the generated call. Invalid structured helper payloads are also passed as data so
  * nested-tool validation can reject them without evaluating provider text as JavaScript.
+ *
+ * `wireToolName` is the name the body actually arrived under, which is not always the helper:
+ * a provider that got the NAME right and the BODY wrong sends `exec`, and the apply-patch
+ * helper is inferred from the payload. Recognition and compilation must read ONE canonical
+ * body, so both unwrap under that same name — see the apply-patch branch below. It defaults to
+ * the helper name, which is correct for the name-based path where the wire name IS the helper.
  */
-export function compileCodeModeHelperInput(argumentsText: unknown, toolName: string): string {
+export function compileCodeModeHelperInput(
+  argumentsText: unknown,
+  toolName: string,
+  wireToolName?: string,
+): string {
   if (typeof argumentsText !== "string") return "";
   const helperName = toolName.startsWith("default.")
     ? toolName.slice("default.".length)
     : toolName;
   if (helperName === "apply_patch") {
-    const patch = normalizeApplyPatchDelimiters(unwrapPatchInput(argumentsText));
+    // `resolveCodeModeHelperName` decides this IS an apply-patch call by reading
+    // `unwrapFreeformToolInput(argumentsText, wireToolName)`, which strips an outer Markdown
+    // fence and accepts that name's fallback fields (#4983). Compiling from a narrower unwrap
+    // meant a body accepted through a fence or a fallback field reached `tools.apply_patch`
+    // still wrapped, so the host rejected the JSON or the fence instead of applying the patch
+    // (#5046). One unwrap, one body, one decision.
+    //
+    // The vocabulary is the WIRE name rather than the helper name on purpose. `{"patch": ...}`
+    // is an apply_patch wrapper and is not an `exec` fallback field, and the recognizer already
+    // declines it under `exec`; reading it here would compile a body that recognition rejected,
+    // which is exactly the drift a second, looser unwrap introduces.
+    const patch = normalizeApplyPatchDelimiters(
+      unwrapFreeformToolInput(argumentsText, wireToolName ?? helperName),
+    );
     return `const result = await tools.apply_patch(${JSON.stringify(patch)});\ntext(result);`;
   }
   let parsed: unknown = argumentsText;
@@ -106,5 +116,5 @@ export function resolveCodeModeHelperName(
   // `tools.apply_patch(...)` JavaScript would be the mis-route this repair exists to avoid.
   if (!declaresCodeModeExec(declaredNames)) return undefined;
   if (typeof argumentsText !== "string" || argumentsText === "") return undefined;
-  return isCompletePatchEnvelope(unwrapFreeformToolInput(argumentsText)) ? "apply_patch" : undefined;
+  return isCompletePatchEnvelope(unwrapFreeformToolInput(argumentsText, "exec")) ? "apply_patch" : undefined;
 }

package/src/responses/custom-tool-compat.ts

@@ -326,7 +326,7 @@ export function restoreRoutedCustomCalls(
         id: customToolItemId(item.id),
         name: aliased ? targetName : item.name,
         input: helper
-          ? compileCodeModeHelperInput(sourceInput, helper)
+          ? compileCodeModeHelperInput(sourceInput, helper, aliased ? String(item.name) : targetName)
           : repairFreeformToolInput(
             sourceInput,
             targetName,

package/src/responses/hosted-tool-policy.ts

@@ -10,7 +10,90 @@ const UNSUPPORTED_HOSTED_TOOLS: ReadonlyArray<{
   },
 ];
 
-/** True when forwarding this hosted tool to the model would be rejected upstream. */
-export function isHostedToolUnsupportedForModel(modelId: string, tool: string, baseUrl?: string): boolean {
+/**
+ * Hosted-tool declaration names an operator may list in `unsupportedHostedTools`.
+ *
+ * A gateway must be able to deny anything a client can send it, so this is the set of
+ * nameless hosted/private declaration types the proxy recognizes on a Responses request.
+ * It is deliberately a closed vocabulary: the provider config schema ends in
+ * `.passthrough()`, so an unvalidated misspelling would be accepted, persisted, and then
+ * silently strip nothing -- which is the exact 400 the operator set the field to avoid
+ * (the `codexToolMode` lesson in #2106).
+ */
+export const DECLARABLE_HOSTED_TOOL_TYPES: ReadonlySet<string> = new Set([
+  "web_search",
+  "web_search_preview",
+  "file_search",
+  "computer_use_preview",
+  "computer_use",
+  "code_interpreter",
+  "image_generation",
+  "image_gen",
+  "mcp",
+  "tool_search",
+  "local_shell",
+  "x_search",
+]);
+
+/**
+ * Spellings that name one capability. Declaring either member denies both, because the
+ * rest of the proxy already treats these as a single tool: the parser folds
+ * `web_search_preview` onto one name (`src/responses/parser-tools.ts`), Chat ingress
+ * accepts the pair together (`src/chat/inbound.ts`), and the canonical-field strip lists
+ * the pair in a single `toolTypes` set
+ * (`src/adapters/openai-responses/request-strips.ts`).
+ *
+ * Without the alias a capability declaration would be honoured for the spelling the
+ * operator happened to write and ignored for the one the client happened to send, which
+ * reproduces the original rejection while the config claims to have prevented it.
+ */
+const HOSTED_TOOL_ALIAS_GROUPS: ReadonlyArray<ReadonlySet<string>> = [
+  new Set(["web_search", "web_search_preview"]),
+  new Set(["image_generation", "image_gen"]),
+  new Set(["computer_use_preview", "computer_use"]),
+];
+
+const NO_DECLARED_HOSTED_TOOLS: ReadonlySet<string> = new Set();
+
+/**
+ * Expand a provider's declared denials through the alias groups once per request, so the
+ * per-tool predicate stays a set lookup. Returns a shared empty set when the provider
+ * declares nothing, keeping the common path allocation-free.
+ */
+export function declaredUnsupportedHostedTools(
+  provider?: { unsupportedHostedTools?: readonly string[] },
+): ReadonlySet<string> {
+  const declared = provider?.unsupportedHostedTools;
+  if (!Array.isArray(declared) || declared.length === 0) return NO_DECLARED_HOSTED_TOOLS;
+  const out = new Set<string>();
+  for (const raw of declared) {
+    if (typeof raw !== "string") continue;
+    const tool = raw.trim();
+    if (!tool) continue;
+    out.add(tool);
+    for (const group of HOSTED_TOOL_ALIAS_GROUPS) {
+      if (!group.has(tool)) continue;
+      for (const alias of group) out.add(alias);
+    }
+  }
+  return out.size > 0 ? out : NO_DECLARED_HOSTED_TOOLS;
+}
+
+/**
+ * True when forwarding this hosted tool to the model would be rejected upstream.
+ *
+ * `declaredUnsupported` is the provider's own capability declaration, expanded by
+ * `declaredUnsupportedHostedTools`. It is additive to the built-in table rather than a
+ * replacement for it: the table covers destinations that reject a tool regardless of how
+ * the operator configured them, so an operator who never heard of the field stays
+ * protected.
+ */
+export function isHostedToolUnsupportedForModel(
+  modelId: string,
+  tool: string,
+  baseUrl?: string,
+  declaredUnsupported?: ReadonlySet<string>,
+): boolean {
+  if (declaredUnsupported?.has(tool)) return true;
   return UNSUPPORTED_HOSTED_TOOLS.some(entry => entry.match(modelId, baseUrl) && entry.tools.has(tool));
 }

package/src/responses/schema.ts

@@ -126,10 +126,17 @@ export const toolSchema = z.object({
 
 const builtinToolSchema = z.object({ type: z.string() }).loose();
 
-const hostedToolType = z.enum([
+/**
+ * Hosted tool types a client may declare on an inbound Responses request. Exported so the
+ * provider-side capability vocabulary in `src/responses/hosted-tool-policy.ts` can be
+ * asserted to cover all of them: a gateway must be able to deny anything it can be sent.
+ */
+export const HOSTED_TOOL_TYPES = [
   "web_search", "web_search_preview", "file_search", "computer_use_preview",
   "code_interpreter", "image_generation", "mcp",
-]);
+] as const;
+
+const hostedToolType = z.enum(HOSTED_TOOL_TYPES);
 
 const allowedToolEntrySchema = z.object({ type: z.string(), name: z.string().optional() });