@coseung2/opencodex 2.8.0-cs.16 → 2.8.0-cs.17

package/src/responses/turn-termination.ts

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+import type { OcxAssistantMessage, OcxMessage, OcxParsedRequest } from "../types";
+
+const DELIVERED_FINAL_ANSWER_TTL_MS = 60 * 60 * 1_000;
+const DELIVERED_FINAL_ANSWER_MAX_ENTRIES = 1_024;
+
+interface DeliveredFinalAnswerRecord {
+  fingerprint: string;
+  createdAt: number;
+}
+
+const scopesByRequest = new WeakMap<OcxParsedRequest, string>();
+const deliveredFinalAnswers = new Map<string, DeliveredFinalAnswerRecord>();
+
+function pruneDeliveredFinalAnswers(at = Date.now()): void {
+  for (const [scope, record] of deliveredFinalAnswers) {
+    if (at - record.createdAt > DELIVERED_FINAL_ANSWER_TTL_MS) deliveredFinalAnswers.delete(scope);
+  }
+  while (deliveredFinalAnswers.size > DELIVERED_FINAL_ANSWER_MAX_ENTRIES) {
+    const oldest = deliveredFinalAnswers.keys().next().value;
+    if (oldest === undefined) break;
+    deliveredFinalAnswers.delete(oldest);
+  }
+}
+
+function textFingerprint(text: string): string {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+
+function assistantText(message: OcxAssistantMessage): string | undefined {
+  if (message.content.some(part => part.type === "toolCall")) return undefined;
+  const text = message.content
+    .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
+    .map(part => part.text)
+    .join("");
+  return text.trim().length > 0 ? text : undefined;
+}
+
+function deliveredFinalAnswerText(response: unknown): string | undefined {
+  if (!response || typeof response !== "object" || Array.isArray(response)) return undefined;
+  const output = (response as { output?: unknown }).output;
+  if (!Array.isArray(output)) return undefined;
+  for (let index = output.length - 1; index >= 0; index -= 1) {
+    const item = output[index];
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const message = item as { type?: unknown; role?: unknown; phase?: unknown; content?: unknown };
+    if (message.type !== "message" || message.role !== "assistant" || message.phase !== "final_answer") continue;
+    if (!Array.isArray(message.content)) return undefined;
+    const text = message.content
+      .filter(part => !!part && typeof part === "object" && !Array.isArray(part)
+        && (part as { type?: unknown }).type === "output_text"
+        && typeof (part as { text?: unknown }).text === "string")
+      .map(part => (part as { text: string }).text)
+      .join("");
+    return text.trim().length > 0 ? text : undefined;
+  }
+  return undefined;
+}
+
+/** Bind only the already-normalized per-conversation digest; raw client ids never enter this map. */
+export function bindTurnTerminationScope(parsed: OcxParsedRequest, scope: string | undefined): void {
+  if (!scope || !/^[0-9a-f]{32}$/.test(scope)) return;
+  scopesByRequest.set(parsed, scope);
+}
+
+/** Remember only a final-answer message the proxy actually emitted for this exact conversation. */
+export function rememberDeliveredFinalAnswer(parsed: OcxParsedRequest, response: unknown): void {
+  const scope = scopesByRequest.get(parsed);
+  if (!scope) return;
+  const text = deliveredFinalAnswerText(response);
+  if (!text) return;
+  const at = Date.now();
+  pruneDeliveredFinalAnswers(at);
+  deliveredFinalAnswers.delete(scope);
+  deliveredFinalAnswers.set(scope, { fingerprint: textFingerprint(text), createdAt: at });
+  pruneDeliveredFinalAnswers(at);
+}
+
+/**
+ * Match only when the remembered assistant answer is still the trailing content-bearing message.
+ * Any later user/tool-result message is new work and must reach Kiro.
+ */
+export function hasRecordedTrailingDeliveredFinalAnswer(
+  parsed: OcxParsedRequest,
+  messages: readonly OcxMessage[],
+): boolean {
+  const scope = scopesByRequest.get(parsed);
+  if (!scope) return false;
+  pruneDeliveredFinalAnswers();
+  const record = deliveredFinalAnswers.get(scope);
+  if (!record) return false;
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = messages[index];
+    if (message.role !== "assistant") return false;
+    const text = assistantText(message as OcxAssistantMessage);
+    if (text === undefined) {
+      if ((message as OcxAssistantMessage).content.some(part => part.type === "toolCall")) return false;
+      continue;
+    }
+    return textFingerprint(text) === record.fingerprint;
+  }
+  return false;
+}
+
+/** Test-only reset for deterministic cross-test isolation. */
+export function clearDeliveredFinalAnswersForTests(): void {
+  deliveredFinalAnswers.clear();
+}

package/src/responses/xai-custom-tool-compat.ts

@@ -0,0 +1,237 @@
+import type { SsePayloadRewrite } from "../server/sse-payload-rewrite";
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function collectBareCustomToolNames(value: unknown, out: Set<string>): void {
+  if (Array.isArray(value)) {
+    for (const entry of value) collectBareCustomToolNames(entry, out);
+    return;
+  }
+  if (!isPlainObject(value)) return;
+  if (value.type === "custom" && typeof value.name === "string" && typeof value.namespace !== "string") {
+    out.add(value.name);
+  }
+  for (const entry of Object.values(value)) collectBareCustomToolNames(entry, out);
+}
+
+function collectConvertedCallIds(value: unknown, names: ReadonlySet<string>, out: Set<string>): void {
+  if (Array.isArray(value)) {
+    for (const entry of value) collectConvertedCallIds(entry, names, out);
+    return;
+  }
+  if (!isPlainObject(value)) return;
+  if (value.type === "custom_tool_call" && typeof value.name === "string" && names.has(value.name) && typeof value.call_id === "string") {
+    out.add(value.call_id);
+  }
+  for (const entry of Object.values(value)) collectConvertedCallIds(entry, names, out);
+}
+
+function rewriteToolChoiceForUpstream(value: unknown, names: ReadonlySet<string>): unknown {
+  if (!isPlainObject(value)) return value;
+  if ((value.type === "custom" || value.type === "function") && typeof value.name === "string" && names.has(value.name)) {
+    return value.type === "function" ? value : { ...value, type: "function" };
+  }
+  if (value.type === "allowed_tools" && Array.isArray(value.tools)) {
+    let changed = false;
+    const tools = value.tools.map(tool => {
+      if (!isPlainObject(tool) || tool.type !== "custom" || typeof tool.name !== "string" || !names.has(tool.name)) return tool;
+      changed = true;
+      return { ...tool, type: "function" };
+    });
+    return changed ? { ...value, tools } : value;
+  }
+  return value;
+}
+
+function rewriteForUpstream(value: unknown, names: ReadonlySet<string>, callIds: ReadonlySet<string>): unknown {
+  if (Array.isArray(value)) return value.map(entry => rewriteForUpstream(entry, names, callIds));
+  if (!isPlainObject(value)) return value;
+
+  if (value.type === "custom" && typeof value.name === "string" && names.has(value.name)) {
+    const { format: _format, ...rest } = value;
+    return {
+      ...rest,
+      type: "function",
+      parameters: {
+        type: "object",
+        properties: {
+          input: { type: "string", description: "Raw input for this client-executed custom tool." },
+        },
+        required: ["input"],
+        additionalProperties: false,
+      },
+    };
+  }
+
+  if (value.type === "custom_tool_call" && typeof value.name === "string" && names.has(value.name)) {
+    const { input, id: _id, ...rest } = value;
+    return {
+      ...rest,
+      type: "function_call",
+      arguments: JSON.stringify({ input: typeof input === "string" ? input : "" }),
+    };
+  }
+
+  if (value.type === "custom_tool_call_output" && typeof value.call_id === "string" && callIds.has(value.call_id)) {
+    return { ...value, type: "function_call_output" };
+  }
+
+  let changed = false;
+  const next: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(value)) {
+    const rewritten = key === "tool_choice"
+      ? rewriteToolChoiceForUpstream(entry, names)
+      : rewriteForUpstream(entry, names, callIds);
+    next[key] = rewritten;
+    changed ||= rewritten !== entry;
+  }
+  return changed ? next : value;
+}
+
+/** Names of bare Responses custom tools that xAI must receive as ordinary functions. */
+export function xaiResponsesCustomToolNames(body: unknown): Set<string> {
+  const names = new Set<string>();
+  collectBareCustomToolNames(body, names);
+  return names;
+}
+
+/** Lower bare Responses custom tools to functions for xAI, preserving enough metadata to restore calls. */
+export function lowerXaiResponsesCustomTools(body: unknown): { body: unknown; names: Set<string> } {
+  const names = xaiResponsesCustomToolNames(body);
+  if (names.size === 0) return { body, names };
+  const callIds = new Set<string>();
+  collectConvertedCallIds(body, names, callIds);
+  return { body: rewriteForUpstream(body, names, callIds), names };
+}
+
+function customItemId(id: unknown): unknown {
+  return typeof id === "string" && id.startsWith("fc_") ? `ctc_${id.slice(3)}` : id;
+}
+
+function unwrapInput(argumentsText: unknown): string {
+  if (typeof argumentsText !== "string") return "";
+  try {
+    const parsed: unknown = JSON.parse(argumentsText);
+    if (isPlainObject(parsed) && typeof parsed.input === "string") return parsed.input;
+  } catch {
+    // Provider may return raw input; preserve it.
+  }
+  return argumentsText;
+}
+
+function restoreItem(item: unknown, names: ReadonlySet<string>): unknown {
+  if (!isPlainObject(item) || (item.type !== "function_call" && item.type !== "custom_tool_call")) return item;
+  if (typeof item.name !== "string" || !names.has(item.name)) return item;
+  const sourceInput = item.type === "function_call" ? item.arguments : item.input;
+  const restored: Record<string, unknown> = {
+    ...item,
+    type: "custom_tool_call",
+    id: customItemId(item.id),
+    input: unwrapInput(sourceInput),
+  };
+  delete restored.arguments;
+  return restored;
+}
+
+function restorePayload(value: unknown, names: ReadonlySet<string>): unknown {
+  if (!isPlainObject(value)) return value;
+  let changed = false;
+  const next: Record<string, unknown> = { ...value };
+
+  if (Array.isArray(value.output)) {
+    const output = value.output.map(item => {
+      const restored = restoreItem(item, names);
+      changed ||= restored !== item;
+      return restored;
+    });
+    if (changed) next.output = output;
+  }
+
+  if ((value.type === "response.output_item.added" || value.type === "response.output_item.done") && isPlainObject(value.item)) {
+    const restored = restoreItem(value.item, names);
+    if (restored !== value.item) {
+      next.item = restored;
+      changed = true;
+    }
+  }
+
+  if (typeof value.type === "string" && value.type.startsWith("response.") && isPlainObject(value.response)) {
+    const restored = restorePayload(value.response, names);
+    if (restored !== value.response) {
+      next.response = restored;
+      changed = true;
+    }
+  }
+  return changed ? next : value;
+}
+
+/** Restore converted calls in a non-streaming Responses JSON body. */
+export function restoreXaiCustomCallsInJson(text: string, names: ReadonlySet<string>): string {
+  if (names.size === 0) return text;
+  try {
+    const parsed = JSON.parse(text) as unknown;
+    const restored = restorePayload(parsed, names);
+    return restored === parsed ? text : JSON.stringify(restored);
+  } catch {
+    return text;
+  }
+}
+
+/**
+ * Client-facing SSE rewrite. Argument deltas stay preview-only: until the `{input:string}` wrapper
+ * becomes valid JSON they are emitted as empty custom-input deltas, then the done frame and final
+ * item carry the authoritative raw input. This avoids leaking wrapper JSON while keeping the event
+ * sequence valid for Codex.
+ */
+export function createXaiCustomToolPayloadRewrite(names: ReadonlySet<string>): SsePayloadRewrite | undefined {
+  if (names.size === 0) return undefined;
+  const itemIds = new Map<string, string>();
+  const convertedItemIds = new Set<string>();
+  return (payload: string): string => {
+    if (payload === "[DONE]") return payload;
+    let value: unknown;
+    try { value = JSON.parse(payload); } catch { return payload; }
+    if (!isPlainObject(value)) return payload;
+
+    if ((value.type === "response.output_item.added" || value.type === "response.output_item.done") && isPlainObject(value.item)) {
+      const item = value.item;
+      if ((item.type === "function_call" || item.type === "custom_tool_call") && typeof item.name === "string" && names.has(item.name)) {
+        const oldId = typeof item.id === "string" ? item.id : undefined;
+        const newId = customItemId(oldId);
+        if (oldId && typeof newId === "string") {
+          itemIds.set(oldId, newId);
+          convertedItemIds.add(oldId);
+        }
+      }
+    }
+
+    if (value.type === "response.function_call_arguments.delta") {
+      const itemId = typeof value.item_id === "string" ? value.item_id : undefined;
+      if (!itemId || !convertedItemIds.has(itemId)) return payload;
+      return JSON.stringify({
+        ...value,
+        type: "response.custom_tool_call_input.delta",
+        ...(itemId ? { item_id: itemIds.get(itemId) ?? customItemId(itemId) } : {}),
+        delta: "",
+      });
+    }
+    if (value.type === "response.function_call_arguments.done") {
+      const itemId = typeof value.item_id === "string" ? value.item_id : undefined;
+      if (!itemId || !convertedItemIds.has(itemId)) return payload;
+      const input = unwrapInput(value.arguments);
+      const next: Record<string, unknown> = {
+        ...value,
+        type: "response.custom_tool_call_input.done",
+        ...(itemId ? { item_id: itemIds.get(itemId) ?? customItemId(itemId) } : {}),
+        input,
+      };
+      delete next.arguments;
+      return JSON.stringify(next);
+    }
+
+    const restored = restorePayload(value, names);
+    return restored === value ? payload : JSON.stringify(restored);
+  };
+}

package/src/server/grok-responses-snapshot-repair.ts

@@ -0,0 +1,338 @@
+import type { TranslatorBudget } from "../lib/translator-budget";
+import { MAX_COMPLETED_OUTPUT_ITEMS, MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES } from "./relay";
+import type { SsePayloadRewrite } from "./sse-payload-rewrite";
+
+interface OpenItemIdentity {
+  type: string;
+  id?: string;
+  sourceBytes: number;
+}
+
+interface CompletedItem {
+  item: Record<string, unknown>;
+  sourceBytes: number;
+  visibleToGrok: boolean;
+}
+
+const SUPPORTED_ITEM_TYPES = new Set([
+  "message",
+  "reasoning",
+  "function_call",
+  "custom_tool_call",
+  "web_search_call",
+  "code_interpreter_call",
+  "mcp_call",
+]);
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function validOptionalId(item: Record<string, unknown>): boolean {
+  return !("id" in item) || (typeof item.id === "string" && item.id.trim().length > 0);
+}
+
+function completedStatusWhenPresent(item: Record<string, unknown>): boolean {
+  return !("status" in item) || item.status === "completed";
+}
+
+function nullableString(value: unknown): boolean {
+  return value === null || typeof value === "string";
+}
+
+function backfillOutputTextPart(part: unknown): unknown {
+  if (!isPlainObject(part) || part.type !== "output_text" || Array.isArray(part.annotations)) return part;
+  return { ...part, annotations: [] };
+}
+
+function backfillMessageItem(item: unknown): unknown {
+  if (!isPlainObject(item) || item.type !== "message" || !Array.isArray(item.content)) return item;
+  let changed = false;
+  const content = item.content.map(part => {
+    const next = backfillOutputTextPart(part);
+    changed ||= next !== part;
+    return next;
+  });
+  return changed ? { ...item, content } : item;
+}
+
+function backfillGrokRequiredFields(payload: Record<string, unknown>): Record<string, unknown> {
+  let changed = false;
+  const next: Record<string, unknown> = { ...payload };
+  if (isPlainObject(payload.item)) {
+    const item = backfillMessageItem(payload.item);
+    if (item !== payload.item) { next.item = item; changed = true; }
+  }
+  if (isPlainObject(payload.part)) {
+    const part = backfillOutputTextPart(payload.part);
+    if (part !== payload.part) { next.part = part; changed = true; }
+  }
+  if (isPlainObject(payload.response) && Array.isArray(payload.response.output)) {
+    let outputChanged = false;
+    const output = payload.response.output.map(item => {
+      const repaired = backfillMessageItem(item);
+      outputChanged ||= repaired !== item;
+      return repaired;
+    });
+    if (outputChanged) {
+      next.response = { ...payload.response, output };
+      changed = true;
+    }
+  }
+  return changed ? next : payload;
+}
+
+function validOutputMessagePart(part: unknown): boolean {
+  if (!isPlainObject(part)) return false;
+  if (part.type === "output_text") {
+    return typeof part.text === "string"
+      && (!("annotations" in part) || Array.isArray(part.annotations))
+      && (!("logprobs" in part) || part.logprobs === null || Array.isArray(part.logprobs));
+  }
+  return part.type === "refusal" && typeof part.refusal === "string";
+}
+
+function validReasoningPart(part: unknown, type: "summary_text" | "reasoning_text"): boolean {
+  return isPlainObject(part) && part.type === type && typeof part.text === "string";
+}
+
+function validWebSearchAction(value: unknown): boolean {
+  if (!isPlainObject(value)) return false;
+  if (value.type === "search") {
+    return typeof value.query === "string"
+      && (!("sources" in value) || value.sources === null || (Array.isArray(value.sources)
+        && value.sources.every(source => isPlainObject(source)
+          && typeof source.type === "string" && typeof source.url === "string")));
+  }
+  if (value.type === "open_page") return !("url" in value) || nullableString(value.url);
+  if (value.type === "find" || value.type === "find_in_page") {
+    return typeof value.url === "string" && typeof value.pattern === "string";
+  }
+  return false;
+}
+
+function validCodeInterpreterOutput(value: unknown): boolean {
+  return isPlainObject(value)
+    && ((value.type === "logs" && typeof value.logs === "string")
+      || (value.type === "image" && typeof value.url === "string"));
+}
+
+/**
+ * Accept only semantic-complete items from a real output_item.done. Missing optional ids/status
+ * are tolerated, but content is never invented to justify a sparse terminal reconstruction.
+ */
+function trustedCompletedItem(item: Record<string, unknown>): { visibleToGrok: boolean } | null {
+  if (!validOptionalId(item) || !completedStatusWhenPresent(item)) return null;
+
+  if (item.type === "message") {
+    if (item.role !== "assistant" || !Array.isArray(item.content)) return null;
+    if (!item.content.every(validOutputMessagePart)) return null;
+    if ("phase" in item && item.phase !== "commentary" && item.phase !== "final_answer") return null;
+    return {
+      visibleToGrok: item.content.some(part => isPlainObject(part)
+        && part.type === "output_text" && typeof part.text === "string" && part.text.length > 0),
+    };
+  }
+
+  if (item.type === "reasoning") {
+    if (!Array.isArray(item.summary) || !item.summary.every(part => validReasoningPart(part, "summary_text"))) return null;
+    if ("content" in item && item.content !== null
+      && (!Array.isArray(item.content) || !item.content.every(part => validReasoningPart(part, "reasoning_text")))) return null;
+    if ("encrypted_content" in item && !nullableString(item.encrypted_content)) return null;
+    return { visibleToGrok: false };
+  }
+
+  if (item.type === "function_call") {
+    if (typeof item.call_id !== "string" || item.call_id.trim().length === 0
+      || typeof item.name !== "string" || item.name.trim().length === 0
+      || typeof item.arguments !== "string") return null;
+    return { visibleToGrok: true };
+  }
+
+  if (item.type === "custom_tool_call") {
+    if (typeof item.call_id !== "string" || item.call_id.trim().length === 0
+      || typeof item.name !== "string" || item.name.trim().length === 0
+      || typeof item.input !== "string") return null;
+    // xAI restoration runs first: a client-executed function may already be a custom call.
+    return { visibleToGrok: true };
+  }
+
+  if (item.type === "web_search_call") {
+    if (item.status !== "completed" || !validWebSearchAction(item.action)) return null;
+    return { visibleToGrok: false };
+  }
+
+  if (item.type === "code_interpreter_call") {
+    if (item.status !== "completed"
+      || typeof item.container_id !== "string" || item.container_id.trim().length === 0
+      || ("code" in item && !nullableString(item.code))
+      || ("outputs" in item && item.outputs !== null
+        && (!Array.isArray(item.outputs) || !item.outputs.every(validCodeInterpreterOutput)))) return null;
+    return { visibleToGrok: false };
+  }
+
+  if (item.type === "mcp_call") {
+    if (typeof item.arguments !== "string"
+      || typeof item.name !== "string" || item.name.trim().length === 0
+      || typeof item.server_label !== "string" || item.server_label.trim().length === 0
+      || ("approval_request_id" in item && !nullableString(item.approval_request_id))
+      || ("error" in item && !nullableString(item.error))
+      || ("output" in item && !nullableString(item.output))) return null;
+    return { visibleToGrok: false };
+  }
+
+  return null;
+}
+
+function plausibleOpenItem(item: Record<string, unknown>): Omit<OpenItemIdentity, "sourceBytes"> | null {
+  const type = typeof item.type === "string" ? item.type : "";
+  if (!SUPPORTED_ITEM_TYPES.has(type) || !validOptionalId(item)) return null;
+  if ("status" in item && item.status !== "in_progress") return null;
+  if (type === "message") {
+    if ("role" in item && item.role !== "assistant") return null;
+    if ("content" in item && !Array.isArray(item.content)) return null;
+  }
+  return { type, ...(typeof item.id === "string" ? { id: item.id } : {}) };
+}
+
+/**
+ * Grok Build shows streaming deltas live but persists the final assistant turn from
+ * response.completed.response.output. Some native Responses streams leave that terminal array
+ * absent/empty while carrying complete items in output_item.done. Reconstruct only the sparse
+ * terminal case from unique, contiguous, bounded, validated done events; every ambiguity fails
+ * closed and leaves the provider payload byte-equivalent.
+ */
+export function createGrokResponsesSparseTerminalPayloadRewrite(
+  budget?: TranslatorBudget,
+): SsePayloadRewrite {
+  const openItems = new Map<number, OpenItemIdentity>();
+  const completedItems = new Map<number, CompletedItem>();
+  let aggregateCompletedBytes = 0;
+  let aggregateOpenBytes = 0;
+  let tainted = false;
+  let hasVisibleOutput = false;
+
+  const clearRetained = (): void => {
+    const retained = aggregateCompletedBytes + aggregateOpenBytes;
+    if (retained > 0) budget?.releaseRetained(retained, { kind: "retained_collectors" });
+    openItems.clear();
+    completedItems.clear();
+    aggregateCompletedBytes = 0;
+    aggregateOpenBytes = 0;
+    hasVisibleOutput = false;
+  };
+  const reset = (): void => {
+    clearRetained();
+    tainted = false;
+  };
+  const taint = (): void => {
+    clearRetained();
+    tainted = true;
+  };
+
+  const closeOpen = (index: number): void => {
+    const open = openItems.get(index);
+    if (!open) return;
+    openItems.delete(index);
+    aggregateOpenBytes -= open.sourceBytes;
+    budget?.releaseRetained(open.sourceBytes, { kind: "retained_collectors" });
+  };
+
+  const rewrite = ((payload: string): string => {
+    if (payload === "[DONE]") {
+      reset();
+      return payload;
+    }
+    let decoded: unknown;
+    try { decoded = JSON.parse(payload); }
+    catch { taint(); return payload; }
+    if (!isPlainObject(decoded) || typeof decoded.type !== "string") {
+      taint();
+      return payload;
+    }
+    const parsed = backfillGrokRequiredFields(decoded);
+    const basePayload = parsed === decoded ? payload : JSON.stringify(parsed);
+
+    const outputIndex = Number.isInteger(parsed.output_index) && (parsed.output_index as number) >= 0
+      ? parsed.output_index as number
+      : undefined;
+
+    if (parsed.type === "response.output_item.added") {
+      const open = isPlainObject(parsed.item) ? plausibleOpenItem(parsed.item) : null;
+      if (outputIndex === undefined || !open || openItems.has(outputIndex) || completedItems.has(outputIndex)
+        || openItems.size >= MAX_COMPLETED_OUTPUT_ITEMS) {
+        taint();
+      } else if (!tainted) {
+        const sourceBytes = Buffer.byteLength(JSON.stringify(open), "utf8");
+        if (sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES
+          || aggregateOpenBytes + sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES) {
+          taint();
+        } else {
+          budget?.chargeRetained(sourceBytes, { kind: "retained_collectors" });
+          openItems.set(outputIndex, { ...open, sourceBytes });
+          aggregateOpenBytes += sourceBytes;
+        }
+      }
+      return basePayload;
+    }
+
+    if (parsed.type === "response.output_item.done") {
+      const item = isPlainObject(parsed.item) ? parsed.item : null;
+      const proof = item ? trustedCompletedItem(item) : null;
+      if (outputIndex === undefined || !proof || completedItems.has(outputIndex)) {
+        taint();
+        return basePayload;
+      }
+      const open = openItems.get(outputIndex);
+      const doneId = typeof item!.id === "string" ? item!.id : undefined;
+      if (open && (open.type !== item!.type || open.id !== doneId)) {
+        taint();
+        return basePayload;
+      }
+      closeOpen(outputIndex);
+      if (!tainted) {
+        const sourceBytes = Buffer.byteLength(JSON.stringify(item), "utf8");
+        if (sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES
+          || completedItems.size >= MAX_COMPLETED_OUTPUT_ITEMS
+          || aggregateCompletedBytes + sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES) {
+          taint();
+        } else {
+          budget?.chargeRetained(sourceBytes, { kind: "retained_collectors" });
+          completedItems.set(outputIndex, { item: item!, sourceBytes, visibleToGrok: proof.visibleToGrok });
+          aggregateCompletedBytes += sourceBytes;
+          hasVisibleOutput ||= proof.visibleToGrok;
+        }
+      }
+      return basePayload;
+    }
+
+    const terminal = parsed.type === "response.completed"
+      || parsed.type === "response.failed"
+      || parsed.type === "response.incomplete";
+    if (!terminal) return basePayload;
+
+    let rewritten = basePayload;
+    if (parsed.type === "response.completed" && !tainted && isPlainObject(parsed.response)) {
+      const response = parsed.response;
+      const output = response.output;
+      const statusConsistent = !("status" in response) || response.status === "completed";
+      const authoritative = Array.isArray(output) && output.length > 0;
+      const sparse = !("output" in response) || (Array.isArray(output) && output.length === 0);
+      if (!authoritative && sparse && statusConsistent && completedItems.size > 0
+        && openItems.size === 0 && hasVisibleOutput) {
+        const ordered = [...completedItems.entries()].sort(([a], [b]) => a - b);
+        if (ordered.every(([index], position) => index === position)) {
+          rewritten = JSON.stringify({
+            ...parsed,
+            response: { ...response, output: ordered.map(([, retained]) => retained.item) },
+          });
+        }
+      }
+    }
+    reset();
+    return rewritten;
+  }) as SsePayloadRewrite;
+
+  rewrite.dispose = reset;
+  return rewrite;
+}