@code-yeongyu/senpi-ai 2026.10.10 → 2026.10.12

package/dist/api/bedrock-converse-stream.js

@@ -590,6 +590,7 @@ function supportsAdaptiveThinking(modelId, modelName) {
         s.includes("opus-5") ||
         s.includes("sonnet-4-6") ||
         s.includes("sonnet-5") ||
+        s.includes("haiku-5-5") ||
         s.includes("fable-5") ||
         s.includes("mythos-5"));
 }
@@ -599,6 +600,7 @@ function supportsNativeXhighEffort(model) {
         s.includes("opus-4-8") ||
         s.includes("opus-5") ||
         s.includes("sonnet-5") ||
+        s.includes("haiku-5-5") ||
         s.includes("fable-5") ||
         s.includes("mythos-5"));
 }
@@ -616,7 +618,9 @@ function rejectsDisabledThinking(model) {
         s.includes("opus-5-5") ||
         s.includes("opus-5.5") ||
         s.includes("sonnet-5-5") ||
-        s.includes("sonnet-5.5"));
+        s.includes("sonnet-5.5") ||
+        s.includes("haiku-5-5") ||
+        s.includes("haiku-5.5"));
 }
 function mapThinkingLevelToEffort(model, level) {
     if (level === "xhigh" && supportsNativeXhighEffort(model))

package/dist/api/google-shared.js

@@ -127,6 +127,17 @@ export function requiresToolCallId(modelId) {
         modelId.startsWith("gpt-oss-") ||
         (geminiMajorVersion !== undefined && geminiMajorVersion >= 3));
 }
+/**
+ * Gemini 3+ strictly validates replayed tool calls: the first functionCall part of every step
+ * in the current turn must carry the thoughtSignature the model returned, or the API answers
+ * 400 "Function call is missing a thought_signature in functionCall parts" (Vertex and AI
+ * Studio both; enforced even at MINIMAL thinking). See:
+ * https://docs.cloud.google.com/vertex-ai/generative-ai/docs/thought-signatures
+ */
+function requiresThoughtSignatureReplay(modelId) {
+    const geminiMajorVersion = getGeminiMajorVersion(modelId);
+    return geminiMajorVersion !== undefined && geminiMajorVersion >= 3;
+}
 function getGeminiMajorVersion(modelId) {
     const match = modelId.toLowerCase().match(/^gemini(?:-live)?-(\d+)/);
     if (!match)
@@ -155,6 +166,25 @@ function appendContent(contents, content) {
     }
     contents.push(content);
 }
+// The current turn starts after the last user message that carries content. An image-only
+// user message (a pasted screenshot with no caption) starts a new turn exactly like a text
+// prompt does: assistant steps after it are current-turn steps. Empty user messages carry
+// no content and never act as the boundary.
+function findLastUserContentMessageIndex(messages) {
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const msg = messages[i];
+        if (msg.role !== "user")
+            continue;
+        if (typeof msg.content === "string") {
+            if (msg.content.trim().length > 0)
+                return i;
+        }
+        else if (msg.content.some((item) => (item.type === "text" ? item.text.trim().length > 0 : true))) {
+            return i;
+        }
+    }
+    return -1;
+}
 /**
  * Convert internal messages to Gemini Content[] format.
  */
@@ -162,6 +192,9 @@ export function convertMessages(model, context, options = {}) {
     // Gemini has no mid-conversation system messages; the leading prompt is sent as systemInstruction.
     const conversation = withoutInitialSystemMessage(collapseSystemMessages(context).messages);
     const contents = [];
+    // Tool-call blocks replayed as text under a strict-signature model; their paired tool
+    // results must follow the same shape so no unpaired functionResponse part is emitted.
+    const textToolCallIds = new Set();
     const normalizeId = (id) => {
         if (!requiresToolCallId(model.id))
             return id;
@@ -170,7 +203,9 @@ export function convertMessages(model, context, options = {}) {
     const transformedMessages = transformMessages(conversation, model, normalizeId, {
         preserveThinking: options.preserveThinking,
     });
-    for (const msg of transformedMessages) {
+    const lastUserContentIndex = findLastUserContentMessageIndex(transformedMessages);
+    for (let msgIndex = 0; msgIndex < transformedMessages.length; msgIndex++) {
+        const msg = transformedMessages[msgIndex];
         if (msg.role === "user") {
             if (typeof msg.content === "string") {
                 appendContent(contents, {
@@ -204,6 +239,17 @@ export function convertMessages(model, context, options = {}) {
             const parts = [];
             // Check if message is from same provider and model - only then keep thinking blocks
             const isSameProviderAndModel = msg.provider === model.provider && msg.model === model.id;
+            // Strict validation (requiring a thoughtSignature on the first functionCall part) applies
+            // to the current turn — assistant steps after the last user message carrying content.
+            // Earlier turns preserve structured function calls. In the current turn, if the first
+            // toolCall block lacks a valid signature, the whole step is replayed as text, because
+            // the documented skip_thought_signature_validator sentinel is rejected by Vertex (pi-mono #4032)
+            // and an unsigned functionCall part is a hard 400 on Gemini 3+.
+            const isCurrentTurn = msgIndex > lastUserContentIndex;
+            const firstToolCall = msg.content.find((b) => b.type === "toolCall");
+            const hasValidFirstSignature = firstToolCall !== undefined &&
+                resolveThoughtSignature(isSameProviderAndModel, firstToolCall.thoughtSignature) !== undefined;
+            const replayUnsignedToolCallsAsText = requiresThoughtSignatureReplay(model.id) && isCurrentTurn && !hasValidFirstSignature;
             for (const block of msg.content) {
                 if (block.type === "text") {
                     const thoughtSignature = resolveThoughtSignature(isSameProviderAndModel, block.textSignature);
@@ -243,16 +289,24 @@ export function convertMessages(model, context, options = {}) {
                     }
                 }
                 else if (block.type === "toolCall") {
-                    const thoughtSignature = resolveThoughtSignature(isSameProviderAndModel, block.thoughtSignature);
-                    const part = {
-                        functionCall: {
-                            name: block.name,
-                            args: block.arguments ?? {},
-                            ...(requiresToolCallId(model.id) ? { id: block.id } : {}),
-                        },
-                        ...(thoughtSignature && { thoughtSignature }),
-                    };
-                    parts.push(part);
+                    if (replayUnsignedToolCallsAsText) {
+                        textToolCallIds.add(block.id);
+                        parts.push({
+                            text: sanitizeSurrogates(`[Tool Call: ${block.name} (id: ${block.id})]\nArguments: ${JSON.stringify(block.arguments ?? {}, null, 2)}`),
+                        });
+                    }
+                    else {
+                        const thoughtSignature = resolveThoughtSignature(isSameProviderAndModel, block.thoughtSignature);
+                        const part = {
+                            functionCall: {
+                                name: block.name,
+                                args: block.arguments ?? {},
+                                ...(requiresToolCallId(model.id) ? { id: block.id } : {}),
+                            },
+                            ...(thoughtSignature && { thoughtSignature }),
+                        };
+                        parts.push(part);
+                    }
                 }
                 else if (block.type === "providerNative") {
                 }
@@ -268,9 +322,41 @@ export function convertMessages(model, context, options = {}) {
             // Extract text and image content
             const textContent = msg.content.filter((c) => c.type === "text");
             const textResult = textContent.map((c) => c.text).join("\n");
-            const imageContent = model.input.includes("image")
-                ? msg.content.filter((c) => c.type === "image")
-                : [];
+            const allImageBlocks = msg.content.filter((c) => c.type === "image");
+            const modelAcceptsImages = model.input.includes("image");
+            const imageContent = modelAcceptsImages ? allImageBlocks : [];
+            const imageParts = imageContent.map((imageBlock) => ({
+                inlineData: {
+                    mimeType: imageBlock.mimeType,
+                    data: imageBlock.data,
+                },
+            }));
+            const sanitizedToolName = sanitizeSurrogates(msg.toolName);
+            // A tool call replayed as text pairs with its result as text: an unpaired
+            // functionResponse part would break the model turn's call/response pairing.
+            if (textToolCallIds.has(msg.toolCallId)) {
+                // Unsupported tool images never arrive here as image blocks: transformMessages already
+                // replaced them with placeholder text for non-vision models, so an image-only result on
+                // such a model reaches this branch as text. A vision model's image-only result keeps an
+                // empty body and pairs with the inlineData parts appended below.
+                let bodyText = "";
+                if (textResult.length > 0) {
+                    bodyText = `\n${sanitizeSurrogates(textResult)}`;
+                }
+                else if (allImageBlocks.length === 0) {
+                    bodyText = "\n(no output)";
+                }
+                const errorMarker = msg.isError ? " (error)" : "";
+                const callIdPart = ` (id: ${msg.toolCallId})`;
+                appendContent(contents, {
+                    role: "user",
+                    parts: [
+                        { text: `[Tool Result: ${sanitizedToolName}${callIdPart}]${errorMarker}${bodyText}` },
+                        ...imageParts,
+                    ],
+                });
+                continue;
+            }
             const hasText = textResult.length > 0;
             const hasImages = imageContent.length > 0;
             // Gemini 3+ models support multimodal function responses with images nested inside
@@ -279,16 +365,10 @@ export function convertMessages(model, context, options = {}) {
             const modelSupportsMultimodalFunctionResponse = supportsMultimodalFunctionResponse(model.id);
             // Use "output" key for success, "error" key for errors as per SDK documentation
             const responseValue = hasText ? sanitizeSurrogates(textResult) : hasImages ? "(see attached image)" : "";
-            const imageParts = imageContent.map((imageBlock) => ({
-                inlineData: {
-                    mimeType: imageBlock.mimeType,
-                    data: imageBlock.data,
-                },
-            }));
             const includeId = requiresToolCallId(model.id);
             const functionResponsePart = {
                 functionResponse: {
-                    name: msg.toolName,
+                    name: sanitizedToolName,
                     response: msg.isError ? { error: responseValue } : { output: responseValue },
                     ...(hasImages && modelSupportsMultimodalFunctionResponse && { parts: imageParts }),
                     ...(includeId ? { id: msg.toolCallId } : {}),

package/dist/api/lazy.js

@@ -1,5 +1,7 @@
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
+import { isOAuthRefreshUnavailableError } from "../utils/oauth-refresh-error.js";
 import { describeReplacedInstall } from "../utils/provider-failure-description.js";
+import { OAUTH_REFRESH_UNAVAILABLE_DIAGNOSTIC } from "../utils/retry.js";
 function createSetupErrorMessage(model, error) {
     return {
         role: "assistant",
@@ -17,6 +19,17 @@ function createSetupErrorMessage(model, error) {
         },
         stopReason: "error",
         errorMessage: describeReplacedInstall(error) ?? (error instanceof Error ? error.message : String(error)),
+        ...(isOAuthRefreshUnavailableError(error)
+            ? {
+                diagnostics: [
+                    {
+                        type: OAUTH_REFRESH_UNAVAILABLE_DIAGNOSTIC,
+                        timestamp: Date.now(),
+                        details: { provider: model.provider },
+                    },
+                ],
+            }
+            : {}),
         timestamp: Date.now(),
     };
 }

package/dist/api/mistral-conversations.js

@@ -612,6 +612,21 @@ function stripSymbolKeys(value) {
     }
     return value;
 }
+/**
+ * Consecutive user turns become one user message, as the OpenAI Chat converter does for
+ * non-OpenAI endpoints: a word message rebuilt after tool results (senpi#2920) is often followed
+ * by a steer or the next prompt, and Mistral's role-order validation is not documented to accept
+ * two user messages in a row.
+ */
+function appendUserMessage(result, content) {
+    const previous = result[result.length - 1];
+    if (previous?.role !== "user") {
+        result.push({ role: "user", content });
+        return;
+    }
+    const chunks = (value) => typeof value === "string" ? [{ type: "text", text: value }] : (value ?? []);
+    previous.content = [...chunks(previous.content), ...chunks(content)];
+}
 function toChatMessages(messages, supportsImages) {
     const result = [];
     for (const [index, msg] of messages.entries()) {
@@ -625,7 +640,7 @@ function toChatMessages(messages, supportsImages) {
         }
         if (msg.role === "user") {
             if (typeof msg.content === "string") {
-                result.push({ role: "user", content: sanitizeSurrogates(msg.content) });
+                appendUserMessage(result, sanitizeSurrogates(msg.content));
                 continue;
             }
             const hadImages = msg.content.some((item) => item.type === "image");
@@ -637,11 +652,11 @@ function toChatMessages(messages, supportsImages) {
                 return { type: "image_url", imageUrl: `data:${item.mimeType};base64,${item.data}` };
             });
             if (content.length > 0) {
-                result.push({ role: "user", content });
+                appendUserMessage(result, content);
                 continue;
             }
             if (hadImages && !supportsImages) {
-                result.push({ role: "user", content: "(image omitted: model does not support images)" });
+                appendUserMessage(result, "(image omitted: model does not support images)");
             }
             continue;
         }

package/dist/api/openai-codex-responses.js

@@ -450,9 +450,9 @@ function buildRequestBody(model, context, options, cacheSessionId, grammarToolIn
 function getServiceTierCostMultiplier(model, serviceTier) {
     switch (serviceTier) {
         case "ultrafast":
-            // OpenAI publishes an Ultrafast price for GPT-6 Astra only: 6x Standard on every
+            // OpenAI prices GPT-6 Astra and GPT-6.1 Sol Ultrafast at 6x Standard on every
             // token class and context tier. Any other model keeps its base rate.
-            return model.id === "gpt-6-astra" ? 6 : 1;
+            return ["gpt-6-astra", "gpt-6.1-sol"].includes(model.upstreamModelId ?? model.id) ? 6 : 1;
         case "flex":
             return 0.5;
         case "priority":

package/dist/api/openai-completions.js

@@ -14,7 +14,7 @@ import { getProviderEnvValue } from "../utils/provider-env.js";
 import { retryProviderStreamRequest } from "../utils/provider-retry.js";
 import { sanitizeSurrogates } from "../utils/sanitize-unicode.js";
 import { getSystemMessageText, renderSystemMessageUpdate } from "../utils/text.js";
-import { sendWithForcedToolChoiceFallback } from "../utils/tool-choice-fallback.js";
+import { primeStreamUntilContent, sendWithForcedToolChoiceFallback } from "../utils/tool-choice-fallback.js";
 import { normalizeToolParametersForMoonshot, normalizeToolParametersForOpenAICompat, } from "../utils/tool-schema-compat.js";
 import { getCurrentTools, getDeclaredTools, resolveTranscript, resolveTranscriptTools, } from "../utils/transcript.js";
 import { appendGrammarToolInputJsonDelta, createGrammarToolInputProperties, getGrammarToolInput, getJsonSchemaToolParameters, resolveGrammarConstrainedSampling, resolveJsonSchemaStrictSampling, } from "./constrained-sampling.js";
@@ -169,6 +169,23 @@ function getOpenRouterRawMetadata(error) {
 function isForcedOpenAICompletionsToolChoice(toolChoice) {
     return toolChoice !== undefined && toolChoice !== "auto" && toolChoice !== "none";
 }
+/** A chunk that carries model output or a finish: text, reasoning, a tool call, or a finish_reason. */
+function chatChunkHasContent(chunk) {
+    if (!isRecord(chunk) || !Array.isArray(chunk.choices))
+        return false;
+    return chunk.choices.some((choice) => {
+        if (!isRecord(choice))
+            return false;
+        if (typeof choice.finish_reason === "string" && choice.finish_reason.length > 0)
+            return true;
+        const delta = choice.delta;
+        if (!isRecord(delta))
+            return false;
+        if (Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0)
+            return true;
+        return ["content", "reasoning_content", "reasoning", "reasoning_text"].some((field) => typeof delta[field] === "string" && delta[field].length > 0);
+    });
+}
 function isReasoningDetailObject(detail) {
     return typeof detail === "object" && detail !== null && !Array.isArray(detail);
 }
@@ -362,7 +379,14 @@ export const stream = (model, context, options) => {
                     params,
                     acceptsForcedToolChoice: compat.supportsForcedToolChoice !== false,
                     isForced: isForcedOpenAICompletionsToolChoice,
-                    send: createStream,
+                    // A keepalive gateway answers 200 and refuses a forced choice in-band (senpi#2801): a forced
+                    // request is read up to its first content so that refusal can still be retried.
+                    send: async (sentParams) => {
+                        const created = await createStream(sentParams);
+                        if (!isForcedOpenAICompletionsToolChoice(sentParams.tool_choice))
+                            return created;
+                        return { ...created, data: await primeStreamUntilContent(created.data, chatChunkHasContent) };
+                    },
                 });
                 params = sent.params;
                 return sent.result;

package/dist/api/openai-responses-allowed-tools.d.ts

@@ -0,0 +1,33 @@
+import type { ResponseCreateParamsStreaming } from "openai/resources/responses/responses.js";
+import type { Api, Model, OpenAIResponsesCompat, TranscriptContext } from "../types.ts";
+export type AllowedToolsTarget = Pick<Model<Api>, "api" | "provider" | "baseUrl" | "id">;
+export declare function hasRefusedAllowedToolsChoice(target: AllowedToolsTarget): boolean;
+export declare function rememberAllowedToolsChoiceRefusal(target: AllowedToolsTarget): void;
+export declare function clearAllowedToolsChoiceRefusals(): void;
+/**
+ * A refusal of `allowed_tools` as a `tool_choice` type, sent to a request that carried one. Over HTTP it is
+ * a 400; a WebSocket error event before any content carries no status, so the caller vouches for it with
+ * `beforeContent`. Observed on a Responses-compatible gateway: "Invalid value: 'allowed_tools'. Supported
+ * values are: ..." with param `tool_choice.type`.
+ */
+export declare function isAllowedToolsChoiceRefusal(error: unknown, params: {
+    readonly tool_choice?: unknown;
+}, options?: {
+    readonly beforeContent?: boolean;
+}): boolean;
+/**
+ * The pre-senpi#2095 request shape for an `allowed_tools` request: top-level function and custom tools
+ * outside the allowed list leave `tools`, hosted tools stay, and `tool_choice` goes. Tools that transcript
+ * items load in place are not filtered; a call to an inactive one is still refused by the session's active
+ * tool set. Any other request is unchanged.
+ */
+export declare function restrictToAllowedTools<TParams extends ResponseCreateParamsStreaming>(params: TParams): TParams;
+/**
+ * senpi#2095: `tools` carries every tool declared this session, so removing a tool never rewrites the
+ * cached prefix; the callable subset rides `tool_choice: allowed_tools` instead. Hosted tools a payload
+ * hook added stay callable, and deferred tools (declared by transcript items rather than `tools`) are
+ * referenced by name. A declared tool a payload hook removed from `tools` is not referenced (senpi#2234).
+ * An empty subset forbids tool calls. An explicit `tool_choice` always wins.
+ */
+export declare function applyAllowedToolsChoice<TParams extends ResponseCreateParamsStreaming>(params: TParams, context: TranscriptContext, activeToolNames: readonly string[] | undefined, compat: Required<OpenAIResponsesCompat>): TParams;
+//# sourceMappingURL=openai-responses-allowed-tools.d.ts.map

package/dist/api/openai-responses-allowed-tools.js

@@ -0,0 +1,108 @@
+import { isRequestRefusal } from "../utils/tool-choice-fallback.js";
+import { getCurrentTools } from "../utils/transcript.js";
+import { convertResponsesTools, resolveResponsesDeferredToolsMode, resolveResponsesToolPlacement, } from "./openai-responses-shared.js";
+/**
+ * Models whose endpoint refused `tool_choice: allowed_tools` and then accepted the same request
+ * restricted to the active tools, for the life of the process (senpi#3080).
+ */
+const allowedToolsRefusals = new Set();
+function refusalKey(target) {
+    return JSON.stringify([target.api, target.provider, target.baseUrl, target.id]);
+}
+export function hasRefusedAllowedToolsChoice(target) {
+    return allowedToolsRefusals.has(refusalKey(target));
+}
+export function rememberAllowedToolsChoiceRefusal(target) {
+    allowedToolsRefusals.add(refusalKey(target));
+}
+export function clearAllowedToolsChoiceRefusals() {
+    allowedToolsRefusals.clear();
+}
+function allowedReference(tool) {
+    if (tool.type === "function" || tool.type === "custom")
+        return { type: tool.type, name: tool.name };
+    if (tool.type === "mcp")
+        return { type: "mcp", server_label: tool.server_label };
+    return { type: tool.type };
+}
+function allowedToolsChoice(params) {
+    const choice = params.tool_choice;
+    if (typeof choice !== "object" || choice === null)
+        return undefined;
+    const { type, tools } = choice;
+    return type === "allowed_tools" && Array.isArray(tools) ? tools : undefined;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * A refusal of `allowed_tools` as a `tool_choice` type, sent to a request that carried one. Over HTTP it is
+ * a 400; a WebSocket error event before any content carries no status, so the caller vouches for it with
+ * `beforeContent`. Observed on a Responses-compatible gateway: "Invalid value: 'allowed_tools'. Supported
+ * values are: ..." with param `tool_choice.type`.
+ */
+export function isAllowedToolsChoiceRefusal(error, params, options = {}) {
+    if (allowedToolsChoice(params) === undefined)
+        return false;
+    if (!options.beforeContent && !isRequestRefusal(error))
+        return false;
+    const message = errorMessage(error);
+    return /\ballowed_tools\b/.test(message) && /invalid|unsupported|not\s+supported/i.test(message);
+}
+/**
+ * The pre-senpi#2095 request shape for an `allowed_tools` request: top-level function and custom tools
+ * outside the allowed list leave `tools`, hosted tools stay, and `tool_choice` goes. Tools that transcript
+ * items load in place are not filtered; a call to an inactive one is still refused by the session's active
+ * tool set. Any other request is unchanged.
+ */
+export function restrictToAllowedTools(params) {
+    const allowed = allowedToolsChoice(params);
+    if (allowed === undefined)
+        return params;
+    const allowedNames = new Set(allowed.map((tool) => tool.name).filter((name) => typeof name === "string"));
+    const tools = (params.tools ?? []).filter((tool) => (tool.type !== "function" && tool.type !== "custom") || allowedNames.has(tool.name));
+    const restricted = { ...params, tools };
+    delete restricted.tool_choice;
+    return restricted;
+}
+/**
+ * senpi#2095: `tools` carries every tool declared this session, so removing a tool never rewrites the
+ * cached prefix; the callable subset rides `tool_choice: allowed_tools` instead. Hosted tools a payload
+ * hook added stay callable, and deferred tools (declared by transcript items rather than `tools`) are
+ * referenced by name. A declared tool a payload hook removed from `tools` is not referenced (senpi#2234).
+ * An empty subset forbids tool calls. An explicit `tool_choice` always wins.
+ */
+export function applyAllowedToolsChoice(params, context, activeToolNames, compat) {
+    if (!compat.supportsAllowedTools || activeToolNames === undefined || params.tool_choice !== undefined) {
+        return params;
+    }
+    const active = new Set(activeToolNames);
+    const declaredTools = getCurrentTools(context.messages);
+    if (declaredTools.every((tool) => active.has(tool.name)))
+        return params;
+    const allowed = [];
+    const namedInTools = new Set();
+    for (const tool of params.tools ?? []) {
+        if (tool.type === "function" || tool.type === "custom") {
+            namedInTools.add(tool.name);
+            if (!active.has(tool.name))
+                continue;
+        }
+        allowed.push(allowedReference(tool));
+    }
+    // Tools missing from the request-level `tools` placement are the ones transcript items load in place.
+    const requestToolNames = new Set(resolveResponsesToolPlacement(context.messages, resolveResponsesDeferredToolsMode(compat) !== undefined).requestTools.map((tool) => tool.name));
+    for (const tool of declaredTools) {
+        if (namedInTools.has(tool.name) || !active.has(tool.name) || requestToolNames.has(tool.name))
+            continue;
+        const [converted] = convertResponsesTools([tool], {
+            supportsStrictMode: compat.supportsStrictMode,
+            supportsOpenAIGrammarTools: compat.supportsOpenAIGrammarTools,
+        });
+        if (converted)
+            allowed.push(allowedReference(converted));
+    }
+    const toolChoice = allowed.length > 0 ? { type: "allowed_tools", mode: "auto", tools: allowed } : "none";
+    return { ...params, tool_choice: toolChoice };
+}
+//# sourceMappingURL=openai-responses-allowed-tools.js.map

package/dist/api/openai-responses-shared.js

@@ -322,6 +322,25 @@ export function convertResponsesMessages(model, context, allowedToolCallProvider
                     // Signed foreign blocks with no text are intentionally dropped.
                 }
                 else if (block.type === "providerNative") {
+                    // Responses accepts its completed web_search_call output items
+                    // in the next input. Keep them only on the originating route/model;
+                    // encrypted/native state must never cross provider boundaries.
+                    // https://developers.openai.com/api/docs/guides/conversation-state
+                    // Verified against the ChatGPT subscription endpoint for senpi#3122.
+                    const raw = block.raw;
+                    if (isSameModel &&
+                        block.subtype === "web_search_call" &&
+                        raw !== null &&
+                        typeof raw === "object" &&
+                        "type" in raw &&
+                        raw.type === "web_search_call" &&
+                        "id" in raw &&
+                        typeof raw.id === "string" &&
+                        "action" in raw &&
+                        "status" in raw &&
+                        (raw.status === "completed" || raw.status === "failed")) {
+                        output.push(raw);
+                    }
                 }
                 else if (block.type === "text") {
                     const textBlock = block;