@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/responses/freeform-wrapper-scan.ts

@@ -0,0 +1,279 @@
+// Bounded classification of a PARTIAL freeform tool-call wrapper.
+//
+// `unwrapFreeformToolInput` decides the completed input with `JSON.parse`, which does not care
+// what order an object's properties arrive in or how their names are spelled. The streaming side
+// has to reach the same answer from a prefix, and it used to do that by comparing the buffer
+// against the literal `{"input":"`. Spellings `JSON.parse` calls identical therefore matched no
+// wrapper at all, streamed as raw JSON, and then completed as the unwrapped body:
+// `{"metadata":1,"input":"cmd"}` and `{"\u0069nput":"cmd"}` both previewed the whole object and
+// completed as `cmd` (#5151). #5047 and #5129 closed the compact and whitespace spellings of the
+// same disagreement; reordering and escaping are the two the literal matcher could never see,
+// because RFC 8259 objects are unordered and their names are strings with escapes.
+//
+// So the prefix is scanned as JSON instead of matched as text. The scan answers one question —
+// which wrapper, if any, the completed text will unwrap to — and it answers it three ways:
+//
+//   `input`  the canonical key is present with a string value, whatever preceded it and however
+//            its name was spelled. Its value can be decoded progressively, because
+//            `unwrapFreeformToolInput` gives an own `input` precedence over every other property.
+//   `raw`    no wrapper can apply, because the text is not an object or because it is one that
+//            `JSON.parse` will reject. Completion returns the buffer, so streaming it agrees.
+//   `hold`   undecided. A key that has not arrived yet can still change the answer, so nothing
+//            is published until the object parses and completion's own rule decides.
+//
+// The bound matters as much as the classification. A scan that walks the whole buffer on every
+// delta is quadratic in the argument size, so classification gives up after
+// `MAX_FREEFORM_WRAPPER_SCAN_CHARS` and holds. Giving up costs preview, never agreement: a held
+// buffer is still resolved by the authoritative parse at completion.
+
+/** The insignificant whitespace `JSON.parse` accepts between tokens. */
+export const JSON_WHITESPACE = new Set([" ", "\t", "\n", "\r"]);
+
+/** The two-character escapes JSON defines, and nothing else. */
+export const JSON_ESCAPES = new Map<string, string>([
+  ['"', '"'], ["\\", "\\"], ["/", "/"],
+  ["b", "\b"], ["f", "\f"], ["n", "\n"], ["r", "\r"], ["t", "\t"],
+]);
+
+/**
+ * How far a classification scan walks before it gives up and holds.
+ *
+ * A wrapper's own structure — its property names and the small scalar siblings a model puts
+ * beside the body — lives at the front of the object. A buffer still undecided after this much
+ * scanning is one whose preceding values are large, and holding it is what the routed
+ * restoration path already does for every unrecognized object.
+ */
+export const MAX_FREEFORM_WRAPPER_SCAN_CHARS = 4096;
+
+const CANONICAL_KEY = "input";
+
+/** The buffer ends inside a token: what follows can still change the answer. */
+const HOLD = -1;
+/** `JSON.parse` will reject this text no matter what is appended to it. */
+const NEVER = -2;
+
+export type FreeformWrapperScan =
+  | { kind: "hold"; parse: boolean }
+  | { kind: "raw" }
+  | { kind: "input"; valueStart: number };
+
+/** Index of the first non-whitespace character at or after `from`, or HOLD past the end. */
+function skipWhitespace(text: string, from: number): number {
+  let i = from;
+  while (i < text.length && JSON_WHITESPACE.has(text[i]!)) i++;
+  return i < text.length ? i : HOLD;
+}
+
+/**
+ * Index just past the complete JSON string opening at `from`, or HOLD / NEVER.
+ *
+ * This reports a BOUNDARY where `decodeJsonStringPrefix` reports a decoded PREFIX: one has to
+ * fail on a truncated string and the other has to return what it decoded so far. They answer
+ * different questions about the same bytes and share one escape table so they cannot disagree
+ * about which escapes exist.
+ */
+function scanString(text: string, from: number): number {
+  let i = from + 1;
+  while (i < text.length) {
+    const c = text[i]!;
+    if (c === '"') return i + 1;
+    if (c === "\\") {
+      const n = text[i + 1];
+      if (n === undefined) return HOLD;
+      if (n === "u") {
+        const hex = text.slice(i + 2, i + 6);
+        if (hex.length < 4) return HOLD;
+        if (!/^[0-9a-fA-F]{4}$/.test(hex)) return NEVER;
+        i += 6;
+        continue;
+      }
+      if (!JSON_ESCAPES.has(n)) return NEVER;
+      i += 2;
+      continue;
+    }
+    // A literal control character is not legal inside a JSON string.
+    if (c.charCodeAt(0) <= 0x1f) return NEVER;
+    i++;
+  }
+  return HOLD;
+}
+
+const JSON_NUMBER_CHARS = /[-+0-9.eE]/;
+const JSON_NUMBER = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$/;
+
+/** Index just past one complete scalar at `from`, or HOLD / NEVER. */
+function scanScalar(text: string, from: number): number {
+  const c = text[from]!;
+  if (c === '"') return scanString(text, from);
+  if (c === "t" || c === "f" || c === "n") {
+    const literal = c === "t" ? "true" : c === "f" ? "false" : "null";
+    if (text.startsWith(literal, from)) return from + literal.length;
+    return literal.startsWith(text.slice(from)) ? HOLD : NEVER;
+  }
+  let end = from;
+  while (end < text.length && JSON_NUMBER_CHARS.test(text[end]!)) end++;
+  if (end === from) return NEVER;
+  // A number running to the end of the buffer can still grow another digit or exponent.
+  if (end >= text.length) return HOLD;
+  return JSON_NUMBER.test(text.slice(from, end)) ? end : NEVER;
+}
+
+/** Index where the value of the member whose name opens at `from` begins, or HOLD / NEVER. */
+function scanMemberKey(text: string, from: number): number {
+  if (text[from] !== '"') return NEVER;
+  const nameEnd = scanString(text, from);
+  if (nameEnd < 0) return nameEnd;
+  const colon = skipWhitespace(text, nameEnd);
+  if (colon === HOLD) return HOLD;
+  if (text[colon] !== ":") return NEVER;
+  return skipWhitespace(text, colon + 1);
+}
+
+/**
+ * Index just past one complete JSON value at `from`, or HOLD / NEVER.
+ *
+ * Containers are walked with an explicit stack rather than recursion: the value being skipped
+ * is provider-controlled, and a deeply nested one must not be able to exhaust the call stack.
+ */
+function scanValue(text: string, from: number): number {
+  const closers: string[] = [];
+  let i = from;
+  for (;;) {
+    const c = text[i]!;
+    if (c === "{" || c === "[") {
+      const closer = c === "{" ? "}" : "]";
+      closers.push(closer);
+      const first = skipWhitespace(text, i + 1);
+      if (first === HOLD) return HOLD;
+      if (text[first] === closer) {
+        closers.pop();
+        i = first + 1;
+      } else if (closer === "}") {
+        const value = scanMemberKey(text, first);
+        if (value < 0) return value;
+        i = value;
+        continue;
+      } else {
+        i = first;
+        continue;
+      }
+    } else {
+      const end = scanScalar(text, i);
+      if (end < 0) return end;
+      i = end;
+    }
+
+    // One value is complete: close whatever it finished and find the next value, if any.
+    for (;;) {
+      if (closers.length === 0) return i;
+      const at = skipWhitespace(text, i);
+      if (at === HOLD) return HOLD;
+      const closer = closers[closers.length - 1]!;
+      if (text[at] === closer) {
+        closers.pop();
+        i = at + 1;
+        continue;
+      }
+      if (text[at] !== ",") return NEVER;
+      const next = skipWhitespace(text, at + 1);
+      if (next === HOLD) return HOLD;
+      if (closer === "}") {
+        const value = scanMemberKey(text, next);
+        if (value < 0) return value;
+        i = value;
+      } else {
+        i = next;
+      }
+      break;
+    }
+  }
+}
+
+/**
+ * Which wrapper the completed text will unwrap to, as far as this prefix can say.
+ *
+ * Fallback keys are deliberately not recognized here. They only unwrap when exactly one of them
+ * carries a string, and a second one can still arrive, so no prefix decides them — which makes
+ * them indistinguishable from any other undecided object and lets one HOLD cover both.
+ */
+export function scanFreeformWrapper(text: string): FreeformWrapperScan {
+  // One clamp rather than a budget threaded through every helper. Every helper already holds
+  // when it runs off the end of what it can see, so a buffer whose classification needs more
+  // than this holds for exactly the right reason, and no scan can cost more than this many
+  // characters however large the arguments grow. Indices into the clamp are indices into the
+  // full text, because the clamp is a prefix of it.
+  const bounded = text.length > MAX_FREEFORM_WRAPPER_SCAN_CHARS
+    ? text.slice(0, MAX_FREEFORM_WRAPPER_SCAN_CHARS)
+    : text;
+  // `parse` is true only where this scan actually SAW the object close. Every other hold ran
+  // out of buffer or out of budget, and in both cases asking `JSON.parse` is work with no
+  // possible payoff: the first is provably incomplete, and the second would re-read a growing
+  // buffer on every delta that happens to end in a brace — repeated braces inside a long
+  // unterminated string are enough to make that quadratic. Holding a budget-exhausted prefix
+  // costs nothing that matters, because the value it would release arrives in the same instant
+  // as the authoritative completion that follows it.
+  const hold = (): FreeformWrapperScan => ({ kind: "hold", parse: false });
+  const open = skipWhitespace(bounded, 0);
+  if (open === HOLD) return hold();
+  // Not an object, so no wrapper rule reaches it: arrays, scalars and ordinary bodies all
+  // complete as themselves.
+  if (bounded[open] !== "{") return { kind: "raw" };
+
+  let i = open + 1;
+  for (;;) {
+    const at = skipWhitespace(bounded, i);
+    if (at === HOLD) return hold();
+    if (bounded[at] === "}") return afterTopLevelClose(bounded, at + 1);
+    if (bounded[at] !== '"') return { kind: "raw" };
+
+    const nameEnd = scanString(bounded, at);
+    if (nameEnd === HOLD) return hold();
+    if (nameEnd === NEVER) return { kind: "raw" };
+    let name: string;
+    try {
+      // The authoritative decoder for the name, so `{"\u0069nput":...}` resolves to the same
+      // key completion sees. Decoding it by hand here is the second implementation that would
+      // drift from `JSON.parse`, which is how this defect existed in the first place.
+      name = JSON.parse(bounded.slice(at, nameEnd)) as string;
+    } catch {
+      return { kind: "raw" };
+    }
+
+    const colon = skipWhitespace(bounded, nameEnd);
+    if (colon === HOLD) return hold();
+    if (bounded[colon] !== ":") return { kind: "raw" };
+    const valueAt = skipWhitespace(bounded, colon + 1);
+    if (valueAt === HOLD) return hold();
+
+    if (name === CANONICAL_KEY) {
+      // An own `input` wins over everything else in the object, so this is decidable now. A
+      // non-string value is decidable too, in the other direction: completion hands back the
+      // argument text unchanged rather than unwrapping a value it cannot use.
+      return bounded[valueAt] === '"'
+        ? { kind: "input", valueStart: valueAt + 1 }
+        : { kind: "raw" };
+    }
+
+    const valueEnd = scanValue(bounded, valueAt);
+    if (valueEnd === HOLD) return hold();
+    if (valueEnd === NEVER) return { kind: "raw" };
+
+    const next = skipWhitespace(bounded, valueEnd);
+    if (next === HOLD) return hold();
+    if (bounded[next] === ",") {
+      i = next + 1;
+      continue;
+    }
+    if (bounded[next] === "}") return afterTopLevelClose(bounded, next + 1);
+    return { kind: "raw" };
+  }
+}
+
+/**
+ * The object closed without a canonical key. Only whitespace may follow one that parses, so
+ * anything else makes the text raw; otherwise the completed parse decides between a fallback
+ * wrapper and no wrapper at all.
+ */
+function afterTopLevelClose(text: string, from: number): FreeformWrapperScan {
+  return skipWhitespace(text, from) === HOLD ? { kind: "hold", parse: true } : { kind: "raw" };
+}

package/src/responses/function-call-compat.ts

@@ -33,6 +33,38 @@ function namespaceOf(value: unknown): string | undefined {
   return typeof value === "string" && value !== "functions" ? value : undefined;
 }
 
+/**
+ * Repair one provider spelling drift for Codex's flat shell bridge.
+ *
+ * This is schema-bound rather than a general alias: `input` is also a legitimate
+ * argument name for arbitrary caller and MCP tools. Only the exact bare
+ * `exec_command` declaration can establish that its sole string input has one faithful
+ * reading as the required string `cmd` member.
+ */
+function repairExecCommandInput(
+  argumentsText: string,
+  schema: FunctionCallRepairSchema,
+): string {
+  if (schema.namespace !== undefined || schema.name !== "exec_command") return argumentsText;
+  const parameters = schema.parameters;
+  if (!isObject(parameters) || parameters.type !== "object"
+    || !Array.isArray(parameters.required) || !parameters.required.includes("cmd")
+    || !isObject(parameters.properties) || !isObject(parameters.properties.cmd)
+    || parameters.properties.cmd.type !== "string") return argumentsText;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(argumentsText);
+  } catch {
+    return argumentsText;
+  }
+  if (!isObject(parsed)) return argumentsText;
+  const keys = Object.keys(parsed);
+  if (keys.length !== 1 || keys[0] !== "input" || typeof parsed.input !== "string") {
+    return argumentsText;
+  }
+  return JSON.stringify({ cmd: parsed.input });
+}
+
 function selectorAllows(
   selector: unknown,
   lowered: unknown,
@@ -131,7 +163,12 @@ function repairItem(item: unknown, schemas: FunctionCallRepairSchemas, completed
       if (unsafe) return item;
     } catch { return item; }
   }
-  const argumentsText = coerceIntegerToolArguments(raw || "{}", schema.parameters, schema.namespace ? undefined : schema.name);
+  const integerRepaired = coerceIntegerToolArguments(
+    raw || "{}",
+    schema.parameters,
+    schema.namespace ? undefined : schema.name,
+  );
+  const argumentsText = repairExecCommandInput(integerRepaired, schema);
   return argumentsText === raw ? item : { ...item, arguments: argumentsText };
 }
 

package/src/responses/inline-document.ts

@@ -0,0 +1,65 @@
+import type { OcxDocumentContent } from "../types";
+
+const DATA_URL = /^data:([^;,]+)((?:;[^;,]*)*),(.*)$/s;
+const BASE64_PAYLOAD = /^[A-Za-z0-9+/]+={0,2}$/;
+
+function usableBase64(payload: string): boolean {
+  if (!BASE64_PAYLOAD.test(payload)) return false;
+  // Preserve valid unpadded encodings, but a single sextet cannot represent any byte.
+  // Padding, when present, must complete a four-character quantum. No payload allocation.
+  return payload.endsWith("=") ? payload.length % 4 === 0 : payload.length % 4 !== 1;
+}
+
+/** The one marker vocabulary for an attached document, derived from what the part knows. */
+export function inlineDocumentMarker(filename: string | undefined): string {
+  return filename !== undefined && filename.length > 0 ? `[document: ${filename}]` : "[document]";
+}
+
+/**
+ * An inline document part from a `data:` URL, or `undefined` when there are no usable bytes.
+ *
+ * A reference with no payload — a `file_id`, a bare filename — is deliberately not a document:
+ * there is nothing to carry, and minting a part for it would claim an attachment the request
+ * never contained. Those keep the marker path they already had.
+ */
+export function inlineDocumentFromDataUrl(
+  fileData: string | undefined,
+  filename: string | undefined,
+): OcxDocumentContent | undefined {
+  if (typeof fileData !== "string" || fileData.length === 0) return undefined;
+  const match = DATA_URL.exec(fileData);
+  if (!match) return undefined;
+  const mediaType = match[1]!;
+  const payload = match[3]!;
+  if (!hasBase64Parameter(match[2] ?? "") || !usableBase64(payload)) return undefined;
+  return {
+    type: "document",
+    text: inlineDocumentMarker(filename),
+    mediaType,
+    data: payload,
+    ...(filename !== undefined && filename.length > 0 ? { filename } : {}),
+  };
+}
+
+/** The `data:` URL spelling of a document part, for wires whose counterpart takes one. */
+export function inlineDocumentDataUrl(part: OcxDocumentContent): string {
+  return `data:${part.mediaType};base64,${part.data}`;
+}
+
+/**
+ * Whether this string is a `data:` URL this module would actually decode.
+ *
+ * The media-type scanner and this parser have to agree exactly. A looser scanner would exempt an
+ * attachment from the untranslated-media refusal that the parser then reduces to a marker, which
+ * is the silent drop the refusal exists to prevent. `;base64` must be a whole parameter token,
+ * not a substring of one: `;notbase64,` and `;x=base64,` are not base64 payloads.
+ */
+export function isInlineDocumentDataUrl(value: unknown): boolean {
+  if (typeof value !== "string" || value.length === 0) return false;
+  const match = DATA_URL.exec(value);
+  return match !== null && hasBase64Parameter(match[2] ?? "") && usableBase64(match[3]!);
+}
+
+function hasBase64Parameter(parameters: string): boolean {
+  return parameters.split(";").includes("base64");
+}

package/src/responses/input-media.ts

@@ -1,3 +1,5 @@
+import { isInlineDocumentDataUrl } from "./inline-document";
+
 /** Input kinds for which the normalized request has no lossless content carrier. */
 export type UntranslatedInputMedia = "audio" | "file";
 
@@ -7,20 +9,47 @@ function isRecord(value: unknown): value is RecordValue {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
-function mediaKind(value: unknown): UntranslatedInputMedia | undefined {
+/**
+ * Whether the position being scanned has a converter that builds a document part.
+ *
+ * Only user content does. A tool output, a system or assistant message, and a Chat `developer`
+ * message are all flattened to text by their converters, so exempting an attachment there would
+ * turn today's explicit refusal into the silent drop this scanner exists to prevent.
+ */
+type CarrierPosition = "user-content" | "flattened";
+
+function mediaKind(value: unknown, position: CarrierPosition): UntranslatedInputMedia | undefined {
   if (!isRecord(value)) return undefined;
   if (value.type === "input_audio" || value.type === "audio") return "audio";
-  if (value.type === "input_file" || value.type === "file" || value.type === "document") return "file";
+  if (value.type === "input_file" || value.type === "file" || value.type === "document") {
+    // A document that carries its own bytes has a lossless carrier in user content, so refusing
+    // it there would reject the very request #5212 exists to preserve. A reference with no
+    // payload has none anywhere: translated adapters cannot dereference a file_id or a remote
+    // source.
+    return position === "user-content" && carriesInlineDocumentBytes(value) ? undefined : "file";
+  }
   // A file-id-only image is not pixels: translated adapters cannot dereference it.
   if (value.type === "input_image" && typeof value.file_id === "string" && value.file_id.length > 0
       && !(typeof value.image_url === "string" && value.image_url.length > 0)) return "file";
   return undefined;
 }
 
-function contentMedia(content: unknown): UntranslatedInputMedia | undefined {
+/** Presence of a base64 payload only. No payload is read, decoded, copied or returned. */
+function carriesInlineDocumentBytes(value: RecordValue): boolean {
+  if (isInlineDocumentDataUrl(value.file_data)) return true;
+  // Chat Completions nests the payload under `file`.
+  if (isRecord(value.file) && isInlineDocumentDataUrl(value.file.file_data)) return true;
+  // Anthropic nests it under a base64 `source`.
+  return isRecord(value.source)
+    && value.source.type === "base64"
+    && typeof value.source.data === "string"
+    && value.source.data.length > 0;
+}
+
+function contentMedia(content: unknown, position: CarrierPosition): UntranslatedInputMedia | undefined {
   if (!Array.isArray(content)) return undefined;
   for (const part of content) {
-    const kind = mediaKind(part);
+    const kind = mediaKind(part, position);
     if (kind) return kind;
   }
   return undefined;
@@ -35,13 +64,16 @@ export function untranslatedResponsesInputMedia(body: unknown): UntranslatedInpu
   if (!isRecord(body) || !Array.isArray(body.input)) return undefined;
   for (const item of body.input) {
     if (!isRecord(item)) continue;
-    const direct = mediaKind(item);
+    const direct = mediaKind(item, "flattened");
     if (direct) return direct;
     if (item.type === "function_call_output" || item.type === "custom_tool_call_output") {
-      const kind = contentMedia(item.output);
+      const kind = contentMedia(item.output, "flattened");
       if (kind) return kind;
     } else if (item.type === "message" || item.type === undefined) {
-      const kind = contentMedia(item.content);
+      // `inputContentParts` runs for user and developer messages only; a system message is
+      // flattened to text by the parser.
+      const role = item.role;
+      const kind = contentMedia(item.content, role === "user" || role === "developer" ? "user-content" : "flattened");
       if (kind) return kind;
     }
   }
@@ -53,7 +85,9 @@ export function untranslatedChatInputMedia(body: unknown): UntranslatedInputMedi
   if (!isRecord(body) || !Array.isArray(body.messages)) return undefined;
   for (const message of body.messages) {
     if (!isRecord(message)) continue;
-    const kind = contentMedia(message.content);
+    // Only the `user` branch of the Chat projection builds content blocks. `system`,
+    // `developer`, `assistant` and `tool` all reduce their content to a string.
+    const kind = contentMedia(message.content, message.role === "user" ? "user-content" : "flattened");
     if (kind) return kind;
   }
   return undefined;

package/src/responses/legacy-dotted-tool-name-repair.ts

@@ -0,0 +1,134 @@
+import { collectResponsesToolGroups } from "./tool-groups";
+import { isSchemaValidResponsesToolName, wireToolInnerName } from "./tool-name-aliases";
+import { CODE_MODE_HELPER_WIRE_NAMES, dottedToolName, namespacedToolName } from "../types";
+
+/**
+ * The one invented namespace this proxy is known to have emitted. Routed providers flatten a
+ * namespaced call as `ns.name`, and a provider that invents the grouping picks `default`; #3402,
+ * #4176 and #4412 all repaired that spelling on the way IN, each on its own path.
+ *
+ * This is deliberately one literal prefix rather than a rule. "Strip everything before the first
+ * dot" would silently rewrite a legitimate tool name that happens to contain a dot in some other
+ * provider's vocabulary, and a replayed history item is the worst possible place to guess: it names
+ * a call that already happened.
+ */
+const LEGACY_INVENTED_NAMESPACE_PREFIX = "default.";
+
+/** Item types whose `name` the upstream validates against the tool-name pattern. */
+const NAMED_CALL_ITEM_TYPES = new Set(["function_call", "custom_tool_call"]);
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+type DeclarationView = {
+  /** Wire spellings the caller's own catalog declares, including flattened namespace forms. */
+  readonly spellings: ReadonlySet<string>;
+  /** How many declared identities answer to a given inner name. */
+  readonly ownersByInnerName: ReadonlyMap<string, number>;
+};
+
+/**
+ * Read the request's own catalog. Namespace children contribute their inner name and both
+ * flattened spellings, which is what makes a declared `default` namespace distinguishable from an
+ * invented one.
+ */
+function readDeclarations(body: unknown): DeclarationView {
+  const spellings = new Set<string>();
+  const owners = new Map<string, number>();
+  const identities = new Map<string, Set<string>>();
+  const claim = (innerName: string, identity: string): void => {
+    const seen = identities.get(innerName);
+    if (seen === undefined) identities.set(innerName, new Set([identity]));
+    else seen.add(identity);
+  };
+  for (const group of collectResponsesToolGroups(body)) {
+    for (const spec of group) {
+      if (!isPlainObject(spec)) continue;
+      if (spec.type === "namespace" && Array.isArray(spec.tools)) {
+        const namespace = typeof spec.name === "string" ? spec.name : undefined;
+        if (namespace === undefined) continue;
+        for (const child of spec.tools) {
+          const inner = wireToolInnerName(child);
+          if (!inner) continue;
+          spellings.add(namespacedToolName(namespace, inner));
+          spellings.add(dottedToolName(namespace, inner));
+          claim(inner, JSON.stringify([namespace, inner]));
+        }
+        continue;
+      }
+      const name = wireToolInnerName(spec);
+      if (!name) continue;
+      spellings.add(name);
+      claim(name, JSON.stringify([null, name]));
+    }
+  }
+  for (const [inner, owning] of identities) owners.set(inner, owning.size);
+  return { spellings, ownersByInnerName: owners };
+}
+
+/**
+ * Canonical name a legacy dotted alias should be replayed under, or undefined to leave it alone.
+ *
+ * Fail-closed in both directions that matter. A dotted spelling the caller's catalog actually
+ * declares is a real tool identity, so it is never stripped — rewriting it would change which tool
+ * the history says was called. A suffix claimed by two declared identities is ambiguous and is
+ * left as it is. Only two things resolve: a suffix that names exactly one declared tool, and the
+ * bounded set of code-mode helper spellings, which a code-mode catalog never declares because they
+ * exist only as nested `tools.*` helpers inside `exec`.
+ */
+function repairedCallName(name: string, declarations: DeclarationView): string | undefined {
+  if (isSchemaValidResponsesToolName(name)) return undefined;
+  if (!name.startsWith(LEGACY_INVENTED_NAMESPACE_PREFIX)) return undefined;
+  if (declarations.spellings.has(name)) return undefined;
+  const suffix = name.slice(LEGACY_INVENTED_NAMESPACE_PREFIX.length);
+  if (!isSchemaValidResponsesToolName(suffix)) return undefined;
+  const owners = declarations.ownersByInnerName.get(suffix);
+  if (owners === 1) return suffix;
+  if (owners !== undefined) return undefined;
+  return CODE_MODE_HELPER_WIRE_NAMES.has(suffix) ? suffix : undefined;
+}
+
+function repairedItem(item: unknown, declarations: DeclarationView): unknown {
+  if (!isPlainObject(item)) return item;
+  if (typeof item.type !== "string" || !NAMED_CALL_ITEM_TYPES.has(item.type)) return item;
+  // An item carrying an explicit namespace is a namespaced identity whose `name` is the inner
+  // name; it is not the flattened shape this repairs, and its own field is the authority.
+  if (item.namespace !== undefined) return item;
+  if (typeof item.name !== "string") return item;
+  const repaired = repairedCallName(item.name, declarations);
+  return repaired === undefined ? item : { ...item, name: repaired };
+}
+
+/**
+ * Make an already-damaged conversation replayable.
+ *
+ * A `function_call` whose name violates `^[a-zA-Z0-9_-]+$` is not a one-turn failure: Codex stores
+ * the item, and the upstream then refuses EVERY later request that replays it
+ * (`Invalid 'input[N].name': ...`) — including the automatic compaction a long task or a side chat
+ * triggers. The emit-side fix stops new items from being created; without this the conversations
+ * that already contain one stay permanently unusable, which is the part of #5095 that actually
+ * hurts.
+ *
+ * Only replayed input items are touched. The caller's tool catalog is never rewritten, and a body
+ * with nothing to repair is returned by reference.
+ */
+export function repairLegacyDottedToolCallNames(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+  if (!body.input.some(item =>
+    isPlainObject(item)
+    && typeof item.type === "string"
+    && NAMED_CALL_ITEM_TYPES.has(item.type)
+    && typeof item.name === "string"
+    && item.name.startsWith(LEGACY_INVENTED_NAMESPACE_PREFIX)
+  )) return body;
+
+  const declarations = readDeclarations(body);
+  let changed = false;
+  const input = body.input.map(item => {
+    const repaired = repairedItem(item, declarations);
+    if (repaired !== item) changed = true;
+    return repaired;
+  });
+  return changed ? { ...body, input } : body;
+}

package/src/responses/muse-tool-name-alias.ts

@@ -8,6 +8,25 @@ const MUSE_SAFE_NAME = /^[a-zA-Z0-9_-]+$/;
 
 export type MuseToolNameAliases = ReadonlyMap<string, string>;
 
+/**
+ * Final wire name for an identity before the Muse length rewrite.
+ *
+ * The alias map is request-local and already narrowed by `tool_choice`. Returning undefined for
+ * a contradictory map keeps downstream identity checks fail-closed instead of choosing one alias.
+ */
+export function museWireNameForOriginal(
+  originalName: string,
+  aliases: MuseToolNameAliases,
+): string | undefined {
+  let wireName: string | undefined;
+  for (const [candidate, original] of aliases) {
+    if (original !== originalName) continue;
+    if (wireName !== undefined && wireName !== candidate) return undefined;
+    wireName = candidate;
+  }
+  return wireName ?? originalName;
+}
+
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }

package/src/responses/parser-content.ts

@@ -1,4 +1,5 @@
 import type { OcxContentPart, OcxTextContent } from "../types";
+import { inlineDocumentFromDataUrl } from "./inline-document";
 
 export function isObj(v: unknown): v is Record<string, unknown> {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -90,8 +91,13 @@ export function inputContentParts(blocks: unknown): string | OcxContentPart[] {
       if (fileId) {
         parts.push({ type: "text", text: `[file: ${fileId}]` });
       } else if (fileData) {
-        // Inline file_data is often large base64. Preserve only its presence and name, never bytes.
-        parts.push({ type: "text", text: filename ? `[file: ${filename}]` : "[file: inline data]" });
+        // Inline bytes used to be reduced to a name here, which meant no adapter could forward
+        // the attachment even to a target that has a representation for it, and a title-only
+        // forward came back as a confident answer about a document the model never saw (#5212).
+        // The marker survives on the part for every wire that still cannot carry one. Bytes with
+        // no declared media type are not decodable into a document and keep the marker they had.
+        const document = inlineDocumentFromDataUrl(fileData, filename);
+        parts.push(document ?? { type: "text", text: filename ? `[file: ${filename}]` : "[file: inline data]" });
       }
       // A bare filename is not a file resource in the Responses schema, so omit it rather than
       // fabricating a "[file: ...]" marker for an attachment that was never sent.