@bitkyc08/opencodex 2.68.0 → 2.69.0

package/src/server/responses/adapter-delivery.ts

@@ -119,7 +119,7 @@ export async function deliverAdapterResponse(
           continuation: fetchGuardedEmptyCompletionRetry,
         })
       : eventStream;
-    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, toolSearchToolNames } = toolBridgeMaps;
+    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = toolBridgeMaps;
     // One completion owner for both deliveries: the bridge calls it from its terminal, the
     // direct client encoder from the fold of the same events.
     const onCompletedResponse = (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
@@ -153,7 +153,7 @@ export async function deliverAdapterResponse(
         fold: {
           replayCacheScope: parsed._reasoningReplayScope,
           hideThinkingSummary: parsed.options.hideThinkingSummary,
-          toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, toolSearchToolNames,
+          toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames,
         },
         stallTimeoutSec: config.stallTimeoutSec,
         localUpstream,
@@ -176,8 +176,9 @@ export async function deliverAdapterResponse(
         localUpstream,
         hideThinkingSummary: parsed.options.hideThinkingSummary,
         declaredToolNames,
+        bareCustomToolNames,
         enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
-      toolParameterSchemas,
+        toolParameterSchemas,
         ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
         ...(routedCompaction ? { compaction: true } : {}),
         // Same grok-surface split as the runTurn branch above.
@@ -236,7 +237,7 @@ export async function deliverAdapterResponse(
     } finally {
       cleanupUpstreamAbort();
     }
-    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, toolSearchToolNames } = toolBridgeMaps;
+    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = toolBridgeMaps;
     let providerState: OcxProviderContinuationState | undefined;
     const json = buildResponseJSON(events, parsed._responseModelId ?? parsed.modelId, {
       translatorBudget,
@@ -244,6 +245,7 @@ export async function deliverAdapterResponse(
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       toolNsMap,
       declaredToolNames,
+      bareCustomToolNames,
       enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
       toolParameterSchemas,
       freeformToolNames,

package/src/server/responses/adapter-dispatch.ts

@@ -42,7 +42,8 @@ import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import type { OAuthAccessSnapshot } from "../../oauth";
-import { OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { getAccountSet } from "../../oauth/store";
 import { tryKiroAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
 import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
 import { normalizeFinalKiroHttpError } from "../../adapters/kiro-retry";
@@ -64,6 +65,7 @@ import {
   rotateGenericOAuthAccountOnRefusal,
   quarantineKiroSuspendedAccount,
   failoverAccountSnapshot,
+  rotateAntigravityAccountOnAuthRefusal,
 } from "../../oauth/generic-account-failover";
 import {
   attemptOpaqueBlobRecovery,
@@ -197,6 +199,8 @@ export async function prepareAdapterExchange(
   // Key/OAuth rotation re-resolves credentials, never the origin, so the routed baseUrl is stable.
   const localUpstream = isLocalUpstream(route.provider.baseUrl);
   transportState.activeAdapter = transportState.adapter;
+  const antigravityPoolActivated = route.providerName === "google-antigravity"
+    && isGenericOAuthFailoverEnabled(config, route.providerName);
 
   // One immutable, body-safe outbound request per same-target sequence (URL, serialized body,
   // auth headers, generated compat headers). Same-target 429 replays reuse it verbatim; the
@@ -409,6 +413,7 @@ export async function prepareAdapterExchange(
     // moments later; at most one byte-identical replay is allowed per request.
     const consoleGoUploadRetryGuard: { attempted: boolean } = { attempted: false };
     let oauth401ReplayAttempted = false;
+    let antigravity401RotationAttempted = false;
     // At most one reasoning-effort downgrade per request. This sits outside the recovery loop
     // below for the same reason the two guards above do: a guard declared inside it is reset by
     // every `continue recovery`, which would let one turn walk the whole ladder down.
@@ -588,6 +593,54 @@ export async function prepareAdapterExchange(
         return { failed: formatErrorResponse(502, "upstream_error", msg) };
       }
     };
+    const rotateAntigravityAuth = async (
+      failedResponse: Response,
+      recovery: AttemptRecoveryKind,
+    ): Promise<Response | null> => {
+      const sent = transportState.replayOAuthCredentialSnapshot ?? transportState.sentOAuthSnapshot;
+      if (!antigravityPoolActivated || !sent
+        || transportState.genericFailovers >= transportState.genericFailoverLimit) return null;
+      const nextId = rotateAntigravityAccountOnAuthRefusal(
+        antigravityPoolActivated, sent.accountId, sent.generation, route.modelId,
+      );
+      if (!nextId) return null;
+      const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
+      const hop = reserveCredentialHop("auth-recovery",
+        `${route.providerName}|${route.modelId}|antigravity-auth`,
+        !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null);
+      if (!hop.allowed) return null;
+      try {
+        const snapshot = await failoverAccountSnapshot(route.providerName, nextId);
+        const admitted = await applyFailoverSnapshot(snapshot);
+        if (admitted?.accountId !== nextId) return null;
+        invalidateSameTargetRequest();
+        transportState.activeAdapter = resolveSelectionAdapter(
+          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+          config.cacheRetention);
+        bindRouteReasoningReplayScope({
+          parsed, providerName: route.providerName, provider: route.provider,
+          adapterName: transportState.activeAdapter.name,
+          oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+        });
+        sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider,
+          transportState.activeAdapter.name, logCtx.accountLogLabel);
+        recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName,
+          route.provider, transportState.activeAdapter.name);
+        sendBudgetState.pendingHopPermit = hop.permit;
+        const result = await rebuildAndRefetch(recovery, () => {
+          if (!adapterOwnsDispatch) hop.permit?.use();
+        }, failedResponse);
+        if ("failed" in result) return result.failed === failedResponse ? null : result.failed;
+        transportState.genericFailovers += 1;
+        try { void failedResponse.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+        return result;
+      } catch {
+        return null;
+      } finally {
+        sendBudgetState.pendingHopPermit = undefined;
+        hop.permit?.release();
+      }
+    };
    // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
    recovery: for (;;) {
       // Preserve the terminal verdict through adapter and combo error formatting.
@@ -604,12 +657,18 @@ export async function prepareAdapterExchange(
         && !sendBudgetExhausted()
       ) {
         oauth401ReplayAttempted = true;
-        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
         let refreshed: OAuthAccessSnapshot;
         try {
           refreshed = await refreshResolvedOAuthSelection(transportState.sentOAuthSnapshot);
         } catch (err) {
           const failed = transportState.sentOAuthSnapshot;
+          if (route.providerName === "google-antigravity" && err instanceof OAuthLoginRequiredError && failed
+            && getAccountSet(route.providerName)?.accounts.some(row =>
+              row.id === failed.accountId && row.needsReauth === true)) {
+            antigravity401RotationAttempted = true;
+            const rotated = await rotateAntigravityAuth(upstreamResponse, "oauth-401");
+            if (rotated) { upstreamResponse = rotated; continue recovery; }
+          }
           if (route.providerName === "kiro" && err instanceof OAuthLoginRequiredError && failed
             && transportState.genericFailovers < transportState.genericFailoverLimit) {
             const alternate = await tryKiroAlternateAfterTerminalRefresh(config, failed.accountId, failed.generation);
@@ -650,6 +709,9 @@ export async function prepareAdapterExchange(
             }
           }
           cleanupUpstreamAbort();
+          if (err instanceof OAuthAccountPausedError) {
+            return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(err));
+          }
           return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(err));
         }
         if (route.provider.googleMode === "cloud-code-assist" && !refreshed.projectId) {
@@ -695,6 +757,14 @@ export async function prepareAdapterExchange(
         continue recovery;
       }
 
+      if (route.providerName === "google-antigravity" && upstreamResponse.status === 401
+        && oauth401ReplayAttempted && !antigravity401RotationAttempted
+        && !isNonReplayableResponse(upstreamResponse)) {
+        antigravity401RotationAttempted = true;
+        const rotated = await rotateAntigravityAuth(upstreamResponse, "oauth-401");
+        if (rotated) { upstreamResponse = rotated; continue recovery; }
+      }
+
       // Static API-key pools can recover a credential-scoped 401 without abandoning the
       // provider: one revoked or mistyped key says nothing about its siblings. OAuth providers
       // refresh above and never enter here — `hasKeyPoolFailover` rejects oauth/forward modes.

package/src/server/responses/core-combo.ts

@@ -45,6 +45,7 @@ import {
 } from "../../responses/state";
 import { hasUnreadableEncryptedAgentTask } from "./encrypted-payload";
 import { routeConcreteModel, comboRouteDecisionTrace } from "../../router";
+import { memoryModelRouteReason } from "./memory-models";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import type { AgentTaskRecoveryFailureReason } from "./agent-task-recovery";
 import {
@@ -226,6 +227,7 @@ function eligibleJevComboChoices(
         provider: pick.target.provider,
         model: pick.target.model,
         reasoningEfforts,
+        modelProfile: pick.target.modelProfile,
       },
     });
   }
@@ -558,7 +560,10 @@ export async function executeComboResponses(
   }
   // One immutable combo selection trace, before any child dispatch; child
   // adoption below must never replace it with a concrete child route trace.
-  logCtx.routeDecision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
+  const decision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
+  logCtx.routeDecision = options.memoryModelPhase
+    ? { ...decision, selected: { ...decision.selected, reason: memoryModelRouteReason(options.memoryModelPhase) } }
+    : decision;
 
   const originalReasoning = body && typeof body === "object" && !Array.isArray(body)
     ? (body as { reasoning?: unknown }).reasoning

package/src/server/responses/core-normalize.ts

@@ -17,6 +17,7 @@ import { resolveOpenCodeGoTransport } from "../../providers/opencode-go-transpor
 import { getOrAllocateRequestSessionLane } from "../request-log-conversation";
 import { shouldPreparePlaintextV2AgentMessages } from "../../responses/plaintext-v2-agent-messages";
 import { hasValidatedActiveReasoningEffort } from "../../responses/parser";
+import { responseTierAuthorityForProvider } from "../../providers/openai-tiers-destination";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { applyOpenAiVirtualModel } from "../../providers/openai-virtual-models";
 import { renameRoutedIdentityInContext } from "../../adapters/identity";
@@ -220,14 +221,12 @@ export async function applyFinalRouteRequestNormalization(args: {
   );
   const modelServiceTierSupport = serviceTierSupportFromPolicy(fastPolicy);
   const callerTier = parsed.options.serviceTier;
-  // The ChatGPT-internal Codex backend echoes `service_tier: "default"` even on turns it
-  // scheduled as priority, so its echo cannot confirm OR deny Fast. Believing it reported every
-  // Fast request as `response-declined` (#2558). The public API's echo stays authoritative.
+  // Capture destination evidence policy separately from the unchanged outbound Fast decision.
   parsed.options.tierObservation = tierObservationContext(
     fastPolicy,
     config.fastMode,
     callerTier,
-    isCanonicalOpenAiForwardProvider(route.provider) ? false : undefined,
+    responseTierAuthorityForProvider(route.provider),
   );
   parsed.options.tierDecision = decideTier(fastPolicy, config.fastMode, callerTier);
   parsed.options.serviceTier = tierValueAfterDecision(parsed.options.tierDecision, callerTier);
@@ -279,6 +278,22 @@ export async function applyFinalRouteRequestNormalization(args: {
     }
   }
 
+  {
+    // Last word on a memory turn's effort: the phase setting is more specific than a provider-wide
+    // pin, and Codex hard-codes the phase effort with no config key of its own.
+    const phase = parsed._memoryModelPhase;
+    if (phase) {
+      const { applyMemoryModelEffort } = await import("./memory-models");
+      const applied = applyMemoryModelEffort(parsed, config, phase);
+      if (applied) {
+        logCtx.requestedEffort = applied.from ? `${applied.from}->${applied.to}` : applied.to;
+        if (isInjectionDebugEnabled()) {
+          injectionDebugLog(`[opencodex] ${route.modelId}: memory ${phase} effort applied (${applied.from ?? "none"} -> ${applied.to})`);
+        }
+      }
+    }
+  }
+
   {
     const { applyEffortCap, effortCapAppliesTo, supportedLadderFor } = await import("../effort-policy");
     const surface = collabSurface(parsed);

package/src/server/responses/core-options.ts

@@ -145,6 +145,8 @@ export interface HandleResponsesOptions {
   comboAttempt?: boolean;
   /** Internal handoff: this combo was selected by shadow-call interception. */
   shadowCallIntercepted?: boolean;
+  /** Internal handoff: the memory phase this turn belongs to, so combo children keep its routing. */
+  memoryModelPhase?: "extract" | "consolidation";
   compactionRoutingOverride?: CompactionRoutingOverride | null;
   /** Internal combo handoff for one parent-validated continuation snapshot. */
   comboReplaySnapshot?: {

package/src/server/responses/memory-models.ts

@@ -0,0 +1,169 @@
+/**
+ * Model routing for Codex's own memory pipeline.
+ *
+ * Codex writes memories in two background phases, and both ask the provider for a bare native
+ * model: Phase 1 ("extract") summarizes one finished thread per call and asks for
+ * `gpt-5.6-luna` at effort `low`; Phase 2 ("consolidation") is one agent run that merges those
+ * summaries into the files under `$CODEX_HOME/memories` and asks for `gpt-5.6-terra` at effort
+ * `medium`. Without a configured target each keeps its existing route; Phase 1 additionally looks like the app's
+ * title/commit helper traffic, because the app uses the same model id for those.
+ *
+ * A phase is therefore recognized from Codex's own turn metadata, never inferred from the model
+ * id, the timing, or the token counts. Phase 1 sends `request_kind: "memory"`; both phases carry
+ * `thread_source: "memory_consolidation"`, and Phase 2 additionally arrives with
+ * `x-openai-subagent: memory_consolidation` (codex-rs `core/src/responses_metadata.rs`).
+ */
+import type { OcxConfig, OcxParsedRequest } from "../../types";
+import { isDeclaredReasoningEffort } from "../../reasoning-effort";
+
+/** The two phases Codex runs, in the order it runs them. */
+export type MemoryModelPhase = "extract" | "consolidation";
+
+/** codex-rs serializes both keys below into the JSON `x-codex-turn-metadata` header. */
+const TURN_METADATA_HEADER = "x-codex-turn-metadata";
+const REQUEST_KIND_KEY = "request_kind";
+const THREAD_SOURCE_KEY = "thread_source";
+/** `CodexResponsesRequestKind::Memory` (codex-rs `core/src/responses_metadata.rs`). */
+const MEMORY_REQUEST_KIND = "memory";
+/** `ThreadSource::MemoryConsolidation` / `InternalSessionSource::MemoryConsolidation`. */
+const MEMORY_THREAD_SOURCE = "memory_consolidation";
+const SUBAGENT_HEADER = "x-openai-subagent";
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+}
+
+/** One metadata copy's verdict. `"none"` is a well-formed copy that is not a memory turn. */
+type CopyVerdict = MemoryModelPhase | "none";
+
+function verdictOf(parsed: Record<string, unknown>): CopyVerdict {
+  // Phase 1's detached request names the memory kind explicitly. Phase 2 is an ordinary turn
+  // inside the `memory_consolidation` thread, so its thread source is the only signal there.
+  if (parsed[REQUEST_KIND_KEY] === MEMORY_REQUEST_KIND) return "extract";
+  if (parsed[THREAD_SOURCE_KEY] === MEMORY_THREAD_SOURCE) return "consolidation";
+  return "none";
+}
+
+/**
+ * Recognize a memory-pipeline turn, or null.
+ *
+ * Every copy of the turn metadata the request carries must agree — the same rule
+ * `applyCompactionRoutingOverride` applies to compaction turns: a request that contradicts itself
+ * is not a memory turn, so neither copy can widen what the setting covers. On HTTP the sub-agent
+ * header is accepted on its own because Codex may deliver only that copy; on websocket it is not,
+ * because the bridge re-attaches the handshake's header to every frame, so there it marks the
+ * connection rather than the turn and the per-frame metadata decides alone.
+ */
+export function detectMemoryModelPhase(
+  body: unknown,
+  headers: Headers,
+  options: { transport?: "websocket" } = {},
+): MemoryModelPhase | null {
+  const metadata: unknown[] = [];
+  const header = headers.get(TURN_METADATA_HEADER);
+  if (options.transport !== "websocket" && header !== null) metadata.push(header);
+  const bodyRecord = record(body);
+  const rawClient = bodyRecord?.["client_metadata"];
+  // Present but malformed client metadata is a turn that failed validation, not an absent
+  // copy; it must not fall through to the connection-level sub-agent header below.
+  if (bodyRecord && Object.hasOwn(bodyRecord, "client_metadata") && !record(rawClient)) return null;
+  const client = record(rawClient);
+  if (client && Object.hasOwn(client, TURN_METADATA_HEADER)) metadata.push(client[TURN_METADATA_HEADER]);
+
+  let verdict: CopyVerdict | null = null;
+  for (const value of metadata) {
+    if (typeof value !== "string") return null;
+    let parsed: Record<string, unknown> | undefined;
+    try {
+      parsed = record(JSON.parse(value));
+    } catch {
+      return null;
+    }
+    if (!parsed) return null;
+    const copy = verdictOf(parsed);
+    if (verdict !== null && verdict !== copy) return null;
+    verdict = copy;
+  }
+  if (verdict === "extract" || verdict === "consolidation") return verdict;
+  // A validated non-memory turn is an explicit decision. The connection-level sub-agent
+  // header is only a compatibility signal when turn metadata is wholly absent.
+  if (verdict === "none") return null;
+  // The websocket bridge rebuilds internal requests from a header allowlist and re-attaches the
+  // handshake's sub-agent header to every frame. Trusting it here would sweep the connection's
+  // later ordinary turns into the consolidation phase, so websocket frames rely on the per-frame
+  // turn metadata above and nothing else.
+  if (options.transport === "websocket") return null;
+  return headers.get(SUBAGENT_HEADER) === MEMORY_THREAD_SOURCE ? "consolidation" : null;
+}
+
+/** The configured destination for one phase, or undefined while the phase keeps Codex's choice. */
+export function configuredMemoryModel(
+  config: Pick<OcxConfig, "memoryModels"> | undefined,
+  phase: MemoryModelPhase,
+): { model: string; reasoningEffort?: string } | undefined {
+  const setting = config?.memoryModels?.[phase];
+  if (!setting) return undefined;
+  const model = typeof setting.model === "string" ? setting.model.trim() : "";
+  if (!model) return undefined;
+  const effort = typeof setting.reasoningEffort === "string" ? setting.reasoningEffort : undefined;
+  return { model, ...(effort ? { reasoningEffort: effort } : {}) };
+}
+
+/**
+ * Force the configured effort onto a memory turn.
+ *
+ * Codex hard-codes the phase effort (`low` for Phase 1, `medium` for Phase 2) and has no config
+ * key for it, so this is the only place the operator's choice can land. Both wire shapes are
+ * written: `parsed.options.reasoning` feeds the routed adapters, `_rawBody.reasoning.effort` feeds
+ * the ChatGPT passthrough serializer — the same dual-shape contract `applyPinnedEffort` uses.
+ */
+export function applyMemoryModelEffort(
+  parsed: OcxParsedRequest,
+  config: Pick<OcxConfig, "memoryModels"> | undefined,
+  phase: MemoryModelPhase,
+): { from: string | undefined; to: string } | null {
+  const effort = configuredMemoryModel(config, phase)?.reasoningEffort;
+  if (!effort || !isDeclaredReasoningEffort(effort)) return null;
+  const requested = parsed.options.reasoning;
+  if (requested === effort) return null;
+  parsed.options.reasoning = effort;
+  const raw = parsed._rawBody as { reasoning?: { effort?: string } } | undefined;
+  if (raw && typeof raw === "object") {
+    raw.reasoning = { ...(record(raw.reasoning) ?? {}), effort } as { effort?: string };
+  }
+  return { from: requested, to: effort };
+}
+
+/** Route reason recorded for a routed memory turn, so the request log names the phase. */
+export function memoryModelRouteReason(phase: MemoryModelPhase): string {
+  return phase === "extract" ? "memory-extract" : "memory-consolidation";
+}
+
+/** Non-retryable: the target stays unavailable until the operator changes the setting. */
+export const MEMORY_MODEL_TARGET_UNAVAILABLE_CODE = "memory_model_target_unavailable";
+export const MEMORY_MODEL_TARGET_UNAVAILABLE_STATUS = 409;
+
+const warnedPhases = new Set<MemoryModelPhase>();
+
+/**
+ * A configured phase destination that stopped resolving fails its call once, clearly, instead of
+ * silently falling back to the native model the operator routed away from — the same contract the
+ * shadow intercept uses for its single target.
+ */
+export function memoryModelTargetUnavailableResponse(
+  phase: MemoryModelPhase,
+): Response {
+  // A hand-edited model id or resolver detail may contain a credential-bearing URL. Neither
+  // belongs in logs or the client error; the settings panel already displays the saved target.
+  const message = `Memory ${phase} model is unavailable. Choose another model in Memory routing or re-enable its provider.`;
+  if (!warnedPhases.has(phase)) {
+    warnedPhases.add(phase);
+    console.warn(`memory-models: ${message}`);
+  }
+  return new Response(
+    JSON.stringify({ error: { message, type: "invalid_request_error", code: MEMORY_MODEL_TARGET_UNAVAILABLE_CODE } }),
+    { status: MEMORY_MODEL_TARGET_UNAVAILABLE_STATUS, headers: { "Content-Type": "application/json" } },
+  );
+}

package/src/server/responses/passthrough-delivery.ts

@@ -313,6 +313,7 @@ export async function deliverPassthroughResponse(
     | "declaredNamelessClientCallTypes"
     | "providerExecutedCallTypes"
     | "declaredBareWireToolNames"
+    | "recoverableBareCustomWireToolNames"
     | "rememberPassthroughResponse"
     | "noteInspectedPayload"
     | "normalizeFunctionCompletionJson"
@@ -336,6 +337,7 @@ export async function deliverPassthroughResponse(
     declaredNamelessClientCallTypes,
     providerExecutedCallTypes,
     declaredBareWireToolNames,
+    recoverableBareCustomWireToolNames,
     rememberPassthroughResponse,
     noteInspectedPayload,
     normalizeFunctionCompletionJson,
@@ -732,6 +734,7 @@ export async function deliverPassthroughResponse(
             declaredNamelessClientCallTypes,
             providerExecutedCallTypes,
             declaredBareWireToolNames,
+            recoverableBareCustomWireToolNames,
           )
           : undefined,
         grokUpstreamEchoEnabled
@@ -998,6 +1001,7 @@ export async function deliverPassthroughResponse(
               declaredNamelessClientCallTypes,
               providerExecutedCallTypes,
               declaredBareWireToolNames,
+              recoverableBareCustomWireToolNames,
             );
           } catch {
             return undefined;

package/src/server/responses/passthrough-dispatch.ts

@@ -22,6 +22,7 @@ import {
   hasExplicitWireToolCatalog,
   collectDeclaredWireToolNames,
   collectDeclaredBareWireToolNames,
+  collectDeclaredBareCustomWireToolNames,
   collectDeclaredNamelessClientCallTypes,
   collectProviderExecutedCallTypes,
   undeclaredToolCallName,
@@ -314,6 +315,7 @@ export async function preparePassthroughExchange(
     const clientExplicitWireToolCatalog = hasExplicitWireToolCatalog(clientToolAuthorizationBody);
     const clientDeclaredWireToolNames = collectDeclaredWireToolNames(clientToolAuthorizationBody);
     const clientDeclaredBareWireToolNames = collectDeclaredBareWireToolNames(clientToolAuthorizationBody);
+    const clientDeclaredBareCustomWireToolNames = collectDeclaredBareCustomWireToolNames(clientToolAuthorizationBody);
     const clientDeclaredNamelessCallTypes = collectDeclaredNamelessClientCallTypes(
       clientToolAuthorizationBody,
     );
@@ -361,6 +363,11 @@ export async function preparePassthroughExchange(
         ) routedCustomToolRepairNames.add(name);
       }
     }
+    // Only grant direct MCP recovery when this delivery actually restores converted custom
+    // calls. Native forward and injection paths have no such rewrite.
+    const recoverableBareCustomWireToolNames = new Set(
+      [...clientDeclaredBareCustomWireToolNames].filter(name => routedCustomToolNames.has(name)),
+    );
     for (const name of request.convertedRoutedToolSearchNames ?? []) {
       // The adapter already keeps this set empty when tool_choice forbids the private search.
       // Its wire name may be collision-aliased, so comparing it to the caller-facing name here
@@ -560,6 +567,7 @@ export async function preparePassthroughExchange(
         declaredNamelessClientCallTypes,
         providerExecutedCallTypes,
         declaredBareWireToolNames,
+        recoverableBareCustomWireToolNames,
       ) !== undefined) {
         inspectionSawUndeclaredTool = true;
       }
@@ -605,6 +613,7 @@ export async function preparePassthroughExchange(
           declaredNamelessClientCallTypes,
           providerExecutedCallTypes,
           declaredBareWireToolNames,
+          recoverableBareCustomWireToolNames,
         ) !== undefined
       ) {
         return;
@@ -1815,6 +1824,7 @@ export async function preparePassthroughExchange(
     },
     declaredWireToolNames,
     declaredBareWireToolNames,
+    recoverableBareCustomWireToolNames,
     declaredNamelessClientCallTypes,
     authorizedBareNamespaceToolAliases,
     normalizeFunctionCompletionJson,