@gajae-code/ai 0.13.3 → 0.14.0

package/src/providers/cursor.ts

@@ -27,7 +27,7 @@ import type {
 } from "../types";
 import { normalizeSystemPrompts } from "../utils";
 import { AssistantMessageEventStream } from "../utils/event-stream";
-import { parseStreamingJson } from "../utils/json-parse";
+import { findUnnecessaryUnicodeEscape, parseStreamingJson } from "../utils/json-parse";
 import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
 import { flattenToolRootCombinators, toolWireSchema } from "../utils/schema";
 import { CURSOR_COMPOSER_EDIT_DISCIPLINE_PROMPT, isComposerHarnessModel } from "./composer-discipline";
@@ -564,6 +564,9 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			if (state.currentToolCall) {
 				const idx = output.content.indexOf(state.currentToolCall);
 				state.currentToolCall.arguments = parseStreamingJson(state.currentToolCall.partialJson);
+				if (findUnnecessaryUnicodeEscape(state.currentToolCall.partialJson ?? "")) {
+					state.currentToolCall.escapedNonAsciiArguments = true;
+				}
 				delete (state.currentToolCall as any).partialJson;
 				delete (state.currentToolCall as any).index;
 				stream.push({
@@ -1913,7 +1916,75 @@ function cursorNativeToolName(kindKey: string): string {
 // do not otherwise handle (everything except mcpToolCall / updateTodosToolCall), so
 // without this they are silently dropped and never render. Build a generic toolCall
 // block from whichever *ToolCall field is set so the call (and its result) is shown.
-function buildNativeToolCallBlock(
+
+/** Hard node budget for one native-payload conversion; bounds hostile or cyclic graphs. */
+const CURSOR_JSON_SAFE_MAX_NODES = 10_000;
+const CURSOR_JSON_SAFE_MAX_DEPTH = 100;
+
+/**
+ * Total conversion of a Cursor protobuf payload into plain JSON-safe data.
+ *
+ * protobuf-es v2 messages are plain objects, but they carry `$typeName`
+ * markers, `bigint` fields (e.g. `fileSize`, `durationMs`, `timestampMs`,
+ * `fileOutputThresholdBytes`), and `Uint8Array` blobs. None of those may leak
+ * into assistant message content: toolCall `arguments` are staged into managed
+ * snapshots, persisted to the JSONL transcript, and replayed to providers —
+ * all of which require `JSON.stringify`-safe values. Attaching the raw payload
+ * is exactly the local-snapshot producer defect class behind issue #4578.
+ *
+ * Rules: `$typeName` is stripped, safe-range bigints become numbers (decimal
+ * strings beyond `Number.MAX_SAFE_INTEGER`), byte arrays become base64
+ * strings, dates become ISO strings, functions/symbols are dropped, cycles
+ * and over-depth values collapse to null, and containers stop accepting
+ * entries once the shared node budget is exhausted.
+ */
+function cursorJsonSafeValue(value: unknown, path?: Set<object>, budget?: { remaining: number }, depth = 0): unknown {
+	const seen = path ?? new Set<object>();
+	const nodes = budget ?? { remaining: CURSOR_JSON_SAFE_MAX_NODES };
+	if (nodes.remaining-- <= 0) return null;
+	if (depth >= CURSOR_JSON_SAFE_MAX_DEPTH) return null;
+	if (typeof value === "bigint") {
+		return value <= BigInt(Number.MAX_SAFE_INTEGER) && value >= BigInt(-Number.MAX_SAFE_INTEGER)
+			? Number(value)
+			: value.toString();
+	}
+	if (typeof value === "function" || typeof value === "symbol" || value === undefined) return null;
+	if (typeof value === "number" && !Number.isFinite(value)) return null;
+	if (value === null || typeof value !== "object") return value;
+	if (seen.has(value)) return null;
+	if (value instanceof Uint8Array)
+		return Buffer.from(value.buffer, value.byteOffset, value.byteLength).toString("base64");
+	if (value instanceof Date) return Number.isFinite(value.getTime()) ? value.toISOString() : null;
+	seen.add(value);
+	try {
+		if (Array.isArray(value)) {
+			const array: unknown[] = [];
+			for (const entry of value) {
+				if (nodes.remaining <= 0) break;
+				array.push(cursorJsonSafeValue(entry, seen, nodes, depth + 1));
+			}
+			return array;
+		}
+		const record: Record<string, unknown> = {};
+		for (const [key, entry] of Object.entries(value)) {
+			if (key === "$typeName") continue;
+			if (nodes.remaining <= 0) break;
+			record[key] = cursorJsonSafeValue(entry, seen, nodes, depth + 1);
+		}
+		return record;
+	} catch {
+		return null;
+	} finally {
+		seen.delete(value);
+	}
+}
+
+/** Exported for direct regression coverage of the JSON-safety boundary. */
+export function cursorJsonSafeValueForTest(value: unknown): unknown {
+	return cursorJsonSafeValue(value);
+}
+
+export function buildNativeToolCallBlock(
 	toolCall: Record<string, unknown>,
 	callId: string,
 	index: number,
@@ -1922,11 +1993,20 @@ function buildNativeToolCallBlock(
 		if (!/ToolCall$/.test(key) || !payload || typeof payload !== "object") continue;
 		if (key === "mcpToolCall" || key === "updateTodosToolCall") continue;
 		const args = (payload as { args?: unknown }).args;
+		const hasObjectArgs = args !== null && typeof args === "object";
+		const convertedArgs = hasObjectArgs ? cursorJsonSafeValue(args) : undefined;
+		const safeArguments =
+			convertedArgs !== undefined &&
+			convertedArgs !== null &&
+			typeof convertedArgs === "object" &&
+			!Array.isArray(convertedArgs)
+				? (convertedArgs as Record<string, unknown>)
+				: { raw: hasObjectArgs ? convertedArgs : cursorJsonSafeValue(payload) };
 		return {
 			type: "toolCall",
 			id: callId,
 			name: cursorNativeToolName(key),
-			arguments: args && typeof args === "object" ? (args as Record<string, unknown>) : { raw: payload },
+			arguments: safeArguments,
 			index,
 			kind: "native",
 		};

package/src/providers/mock.ts

@@ -75,10 +75,12 @@ export type MockContent =
 			arguments: Record<string, unknown> | string;
 			/** Simulate a provider-flagged truncated call (cut off mid-arguments). */
 			incompleteArguments?: boolean;
-			/** Simulate a provider-flagged `\uXXXX`-escaped-arguments call. */
+			/** Typed reason matching `ToolCall.incompleteArgumentsReason`. Defaults to `"truncated"`. */
+			incompleteArgumentsReason?: "truncated" | "malformed" | "conflicting" | "ambiguous";
+			/** Simulate a provider-flagged `\uXXXX`-escaped non-ASCII argument payload. */
 			escapedNonAsciiArguments?: boolean;
+			thoughtSignature?: string;
 	  };
-
 /** One scripted response. */
 export interface MockResponse {
 	/** Content blocks to emit, in order. Strings become text blocks. */
@@ -89,6 +91,9 @@ export interface MockResponse {
 	usage?: Partial<Omit<Usage, "cost">> & { cost?: Partial<Usage["cost"]> };
 	/** Pre-set responseId. */
 	responseId?: string;
+	/** Optional provider metadata copied onto the final assistant message. */
+	disabledFeatures?: string[];
+	providerPayload?: AssistantMessage["providerPayload"];
 	/** Optional typed provider failure metadata for retry/fallback tests. */
 	transportFailure?: AssistantMessage["transportFailure"];
 	/** If set, the stream emits a terminal error event instead of completing. */
@@ -367,6 +372,8 @@ async function runMock(
 		provider: model.provider,
 		model: model.id,
 		responseId: response.responseId,
+		disabledFeatures: response.disabledFeatures,
+		providerPayload: response.providerPayload,
 		transportFailure: response.transportFailure,
 		usage: emptyUsage(),
 		stopReason: "stop",
@@ -424,8 +431,11 @@ function normalizeContent(input: MockContent, state: MockModel): TextContent | T
 			id: input.id ?? generateToolCallId(state),
 			name: input.name,
 			arguments: typeof input.arguments === "string" ? input.arguments : { ...input.arguments },
-			...(input.incompleteArguments ? { incompleteArguments: true } : {}),
+			...(input.incompleteArguments
+				? { incompleteArguments: true, incompleteArgumentsReason: input.incompleteArgumentsReason ?? "truncated" }
+				: {}),
 			...(input.escapedNonAsciiArguments ? { escapedNonAsciiArguments: true } : {}),
+			...(input.thoughtSignature ? { thoughtSignature: input.thoughtSignature } : {}),
 		} as ToolCall;
 	}
 	return input;

package/src/providers/ollama.ts

@@ -18,7 +18,7 @@ import { normalizeSystemPrompts } from "../utils";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { transportFailureFacts } from "../utils/fallback-transport";
 import { finalizeErrorMessage, type RawHttpRequestDump } from "../utils/http-inspector";
-import { isCompleteJson, parseStreamingJson } from "../utils/json-parse";
+import { findUnnecessaryUnicodeEscape, isCompleteJson, parseStreamingJson } from "../utils/json-parse";
 import { resolveRetryBudget } from "../utils/retry-budget";
 import { flattenToolRootCombinators, toolWireSchema } from "../utils/schema";
 import {
@@ -361,6 +361,9 @@ function endToolCallBlock(stream: AssistantMessageEventStream, output: Assistant
 	if (toolCall.partialJson !== undefined) {
 		if (toolCall.partialJson.trim()) {
 			toolCall.arguments = parseStreamingJson<Record<string, unknown>>(toolCall.partialJson);
+			if (findUnnecessaryUnicodeEscape(toolCall.partialJson)) {
+				toolCall.escapedNonAsciiArguments = true;
+			}
 		}
 		delete toolCall.partialJson;
 	}
@@ -550,6 +553,7 @@ export const streamOllama: StreamFunction<"ollama-chat"> = (
 							name,
 							arguments: parseStreamingJson<Record<string, unknown>>(partialJson),
 							partialJson,
+							...(findUnnecessaryUnicodeEscape(partialJson) ? { escapedNonAsciiArguments: true } : {}),
 						};
 						if (unverifiableArguments) unverifiableArgumentToolCallIds.add(toolCall.id);
 						output.content.push(toolCall);
@@ -591,7 +595,10 @@ export const streamOllama: StreamFunction<"ollama-chat"> = (
 						for (const block of output.content) {
 							if (block.type !== "toolCall") continue;
 							const partialJson = (block as InternalToolCallBlock).partialJson;
-							if (partialJson !== undefined && !isCompleteJson(partialJson)) block.incompleteArguments = true;
+							if (partialJson !== undefined && !isCompleteJson(partialJson)) {
+								block.incompleteArguments = true;
+								block.incompleteArgumentsReason = "truncated";
+							}
 						}
 					}
 					for (const index of activeToolIndices) {

package/src/providers/openai-codex-responses.ts

@@ -57,7 +57,7 @@ import {
 	getStreamFirstEventTimeoutMs,
 	iterateWithIdleTimeout,
 } from "../utils/idle-iterator";
-import { parseStreamingJson } from "../utils/json-parse";
+import { findUnnecessaryUnicodeEscape, parseStreamingJson } from "../utils/json-parse";
 import { resolveRetryBudget } from "../utils/retry-budget";
 import {
 	adaptSchemaForStrict,
@@ -1276,6 +1276,7 @@ function handleToolCallArgumentsDone(
 	if (typeof args === "string") {
 		currentBlock.partialJson = args;
 		currentBlock.arguments = parseStreamingJson(currentBlock.partialJson);
+		if (findUnnecessaryUnicodeEscape(args)) currentBlock.escapedNonAsciiArguments = true;
 	}
 }
 
@@ -1391,6 +1392,7 @@ function handleOutputItemDone(
 			id,
 			name: codexToolCanonicalName(item.name),
 			arguments: parseStreamingJson(item.arguments || "{}"),
+			...(findUnnecessaryUnicodeEscape(item.arguments || "") ? { escapedNonAsciiArguments: true } : {}),
 		};
 		runtime.canSafelyReplayWebsocketOverSse = false;
 		stream.push({ type: "toolcall_end", contentIndex: blockIndex(), toolCall, partial: output });
@@ -1853,24 +1855,29 @@ export const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses"
 	context: Context,
 	options?: OpenAICodexResponsesOptions,
 ): AssistantMessageEventStream => {
-	const stream = new AssistantMessageEventStream();
+	const consumerAbortController = new AbortController();
+	const stream = new AssistantMessageEventStream(() => consumerAbortController.abort());
+	const signal = options?.signal
+		? AbortSignal.any([options.signal, consumerAbortController.signal])
+		: consumerAbortController.signal;
+	const streamOptions = { ...options, signal };
 
 	(async () => {
 		const startTime = Date.now();
 		const output = createAssistantOutput(model);
-		const requestSetup = createRequestSetup(options);
+		const requestSetup = createRequestSetup(streamOptions);
 		let processingContext: CodexStreamProcessingContext | undefined;
 
 		try {
-			const requestContext = await buildCodexRequestContext(model, context, options, output);
+			const requestContext = await buildCodexRequestContext(model, context, streamOptions, output);
 			let initialTransport: CodexInitialTransport;
 			try {
-				initialTransport = await openInitialCodexEventStream(model, options, requestSetup, requestContext);
+				initialTransport = await openInitialCodexEventStream(model, streamOptions, requestSetup, requestContext);
 			} catch (error) {
-				if (options?.fallbackManaged) throw error;
+				if (streamOptions.fallbackManaged) throw error;
 				initialTransport = await retryCodexInitialTransportWithoutToolChoice(
 					model,
-					options,
+					streamOptions,
 					requestSetup,
 					requestContext,
 					stream,
@@ -1889,7 +1896,7 @@ export const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses"
 				model,
 				output,
 				stream,
-				options,
+				options: streamOptions,
 				requestSetup,
 				requestContext,
 				startTime,
@@ -1907,7 +1914,7 @@ export const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses"
 					model,
 					output,
 					stream,
-					options,
+					options: streamOptions,
 					requestSetup,
 					requestContext: {
 						apiKey: "",

package/src/providers/openai-completions.ts

@@ -676,8 +676,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 					return;
 				}
 				block.arguments = parseStreamingJson(block.partialArgs);
-				// Raw-wire check: after decode the escape is invisible.
-				if (findUnnecessaryUnicodeEscape(block.partialArgs)) block.escapedNonAsciiArguments = true;
+				if (findUnnecessaryUnicodeEscape(block.partialArgs ?? "")) block.escapedNonAsciiArguments = true;
 				delete (block as { partialArgs?: string }).partialArgs;
 				stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial: output });
 			};
@@ -806,7 +805,9 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 					partialArgs: call.arguments,
 				};
 				block.arguments = parseStreamingJson(call.arguments);
-				if (findUnnecessaryUnicodeEscape(call.arguments)) block.escapedNonAsciiArguments = true;
+				// The healer already normalized `call.arguments`, decoding any escapes away,
+				// so the signal has to come from its pre-round-trip sample of the raw payload.
+				if (call.escapedNonAsciiArguments) block.escapedNonAsciiArguments = true;
 				currentBlock = block;
 				output.content.push(block);
 				stream.push({ type: "toolcall_start", contentIndex: blockIndex(block), partial: output });
@@ -1023,6 +1024,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 				const partial = (currentBlock as { partialArgs?: string }).partialArgs;
 				if (partial !== undefined && !isCompleteJson(partial)) {
 					currentBlock.incompleteArguments = true;
+					currentBlock.incompleteArgumentsReason = "truncated";
 				}
 			}
 

package/src/providers/openai-responses-shared.ts

@@ -31,6 +31,7 @@ import {
 import { normalizeResponsesToolCallId, sanitizeJsonStrings } from "../utils";
 import type { AssistantMessageEventStream } from "../utils/event-stream";
 import { findUnnecessaryUnicodeEscape, isCompleteJson, parseStreamingJson } from "../utils/json-parse";
+import { areJsonValuesEqual } from "../utils/schema";
 import { joinTextWithImagePlaceholder, NON_VISION_IMAGE_PLACEHOLDER, partitionVisionContent } from "./vision-guard";
 
 const OPENAI_RESPONSES_PROGRESS_EVENT_TYPES = new Set([
@@ -405,6 +406,27 @@ export async function processResponsesStream<TApi extends Api>(
 		summaryBuffer: string;
 		rawBuffer: string;
 		summaryStarted: boolean;
+		/**
+		 * Raw `arguments` carried by the item's `response.output_item.added` snapshot.
+		 * Kept out of the streaming buffer (a relay may put a `{}` placeholder here)
+		 * but retained as the lowest-precedence source for relays that supply the
+		 * real payload only in that snapshot.
+		 */
+		addedArguments: string;
+		/**
+		 * Set when this entry's tool identity is ambiguous (a duplicate `call_id`,
+		 * an `id`/`call_id` namespace collision, or any other shape where a delta
+		 * cannot be unambiguously attributed). The entry is finalized as
+		 * `incompleteArguments` so the agent loop rejects it instead of executing
+		 * possibly-misattributed arguments.
+		 */
+		ambiguousIdentity: boolean;
+		/**
+		 * Whether this entry has already been finalized by a terminal
+		 * `response.output_item.done`. A duplicate terminal event for the same item
+		 * must not emit a second `toolcall_end`/`text_end`/`thinking_end`.
+		 */
+		finalized: boolean;
 	}
 	// Per-item argument buffer keyed on stable item identity. Multiple tool-call
 	// items can stream interleaved argument deltas in one response, so a single
@@ -412,6 +434,7 @@ export async function processResponsesStream<TApi extends Api>(
 	const items = new Map<string, ItemEntry>();
 	let lastKey: string | null = null;
 	const idKey = (id: string) => `id:${id}`;
+	const callKey = (id: string) => `call:${id}`;
 	const idxKey = (n: number) => `idx:${n}`;
 	const hasIndex = (n: number | undefined): n is number => typeof n === "number" && Number.isFinite(n);
 	const resolveEntry = (
@@ -428,7 +451,18 @@ export async function processResponsesStream<TApi extends Api>(
 	): ItemEntry | undefined => {
 		if (itemId) {
 			const byId = items.get(idKey(itemId));
+			const byCallId = items.get(callKey(itemId));
+			// Ambiguous identity: `item_id` matches one entry as its canonical id and
+			// a *different* entry as its `call_id` (an id/call_id namespace collision).
+			// Picking either silently mis-attributes the payload, so mark both
+			// ambiguous and drop the delta instead of resolving.
+			if (byId && byCallId && byId !== byCallId) {
+				byId.ambiguousIdentity = true;
+				byCallId.ambiguousIdentity = true;
+				return undefined;
+			}
 			if (byId) return byId;
+			if (byCallId) return byCallId;
 		}
 		if (hasIndex(outputIndex)) {
 			const byIdx = items.get(idxKey(outputIndex));
@@ -448,23 +482,62 @@ export async function processResponsesStream<TApi extends Api>(
 			summaryBuffer: "",
 			rawBuffer: "",
 			summaryStarted: false,
+			addedArguments: item.type === "function_call" ? (item.arguments ?? "") : "",
+			ambiguousIdentity: false,
+			finalized: false,
 		};
 		// Primary key prefers the stable item id; if the wire omits it, fall back to
 		// the positional index. A synthetic key keeps the entry addressable as lastKey
 		// for continuation-style non-tool events even when neither is present.
 		const key = item.id ? idKey(item.id) : hasIndex(outputIndex) ? idxKey(outputIndex) : `seq:${items.size}`;
 		items.set(key, entry);
-		if (item.id && hasIndex(outputIndex)) items.set(idxKey(outputIndex), entry);
+		// Index alias: only claim it when no other entry already holds it. Two items
+		// sharing one `output_index` (a relay defect) must not have the second steal
+		// the alias and drop the first's index-routed deltas; each stays addressable
+		// by its own stable id/call_id, and the index keeps resolving to the first
+		// occupant rather than silently reassigning.
+		if (hasIndex(outputIndex)) {
+			const idxK = idxKey(outputIndex);
+			if (!items.has(idxK)) items.set(idxK, entry);
+		}
+		if ((item.type === "function_call" || item.type === "custom_tool_call") && item.call_id) {
+			const callK = callKey(item.call_id);
+			const existing = items.get(callK);
+			// Duplicate `call_id` in one response: two distinct items claim the same
+			// alias. Fail closed for both — neither's arguments can be trusted to
+			// belong to the right call once their deltas and terminals are aliased.
+			if (existing && existing !== entry) {
+				existing.ambiguousIdentity = true;
+				entry.ambiguousIdentity = true;
+			} else if (!existing) {
+				items.set(callK, entry);
+			}
+		}
+		// Detect an id/call_id collision at registration too: a new item whose id
+		// equals another item's call_id (or vice versa) makes id-based resolution
+		// ambiguous for any delta keyed on that shared string.
+		if (item.id) {
+			const callAliasOfOther = items.get(callKey(item.id));
+			if (callAliasOfOther && callAliasOfOther !== entry) {
+				callAliasOfOther.ambiguousIdentity = true;
+				entry.ambiguousIdentity = true;
+			}
+		}
 		lastKey = key;
 		return entry;
 	};
-	const dropEntry = (itemId: string | undefined, outputIndex: number | undefined): void => {
-		const key = itemId ? idKey(itemId) : hasIndex(outputIndex) ? idxKey(outputIndex) : null;
-		if (key) {
+	const dropEntry = (itemId: string | undefined, outputIndex: number | undefined, callId?: string): void => {
+		const entry =
+			(itemId ? (items.get(idKey(itemId)) ?? items.get(callKey(itemId))) : undefined) ??
+			(callId ? items.get(callKey(callId)) : undefined) ??
+			(hasIndex(outputIndex) ? items.get(idxKey(outputIndex)) : undefined);
+		if (!entry) return;
+		entry.finalized = true;
+		for (const [key, candidate] of items) {
+			if (candidate !== entry) continue;
 			items.delete(key);
 			if (lastKey === key) lastKey = null;
 		}
-		if (itemId && hasIndex(outputIndex)) items.delete(idxKey(outputIndex));
 	};
 	let sawFirstToken = false;
 
@@ -492,7 +565,7 @@ export async function processResponsesStream<TApi extends Api>(
 					id: encodeResponsesToolCallId(item.call_id, item.id),
 					name: item.name,
 					arguments: {},
-					partialJson: item.arguments || "",
+					partialJson: "",
 				};
 				const entry = registerEntry(item, block, outputIndex);
 				stream.push({ type: "toolcall_start", contentIndex: entry.blockContentIndex, partial: output });
@@ -649,7 +722,21 @@ export async function processResponsesStream<TApi extends Api>(
 		} else if (event.type === "response.output_item.done") {
 			const item = structuredCloneJSON(event.item);
 			options?.onOutputItemDone?.(item);
-			const entry = resolveEntry(item.id, event.output_index, "never");
+			// A tool item may be registered under its call id alone (relays that omit
+			// item ids in `added`) and then introduce an item id in the terminal event,
+			// so both identities are tried before the positional fallback.
+			const isToolItem = item.type === "function_call" || item.type === "custom_tool_call";
+			const entry =
+				resolveEntry(item.id, event.output_index, "never") ??
+				(isToolItem && item.call_id ? resolveEntry(item.call_id, event.output_index, "never") : undefined);
+			// A duplicate terminal event for an item already finalized (dropped) must
+			// not emit a second end event. After finalization the entry is gone from
+			// the map, so a second `output_item.done` for the same tool item resolves
+			// to no live entry — skip it rather than re-emitting.
+			// An orphan terminal event (no preceding `output_item.added`, so no live
+			// entry) for a tool item must not synthesize a phantom block at a stale
+			// content index. Only finalize tool items that resolved to a live entry.
+			if (isToolItem && !entry) continue;
 			if (item.type === "reasoning") {
 				// Prefer the streamed summary buffer only when it carries real text. When it
 				// holds only synthetic separators (e.g. a part.done arrived before/without any
@@ -732,23 +819,59 @@ export async function processResponsesStream<TApi extends Api>(
 				});
 				dropEntry(item.id, event.output_index);
 			} else if (item.type === "function_call") {
-				// Finalize onto the same block object stored in output.content, reading
-				// the matching entry's buffered partialJson first and only then the done
-				// item's arguments — never an adjacent item's buffer.
-				const rawArguments =
-					entry?.block.type === "toolCall" && entry.block.partialJson
-						? entry.block.partialJson
-						: item.arguments || "{}";
-				const args = parseStreamingJson(rawArguments);
-				// Detected on the raw wire text: after JSON decode an unnecessary
-				// `\uXXXX` escape is indistinguishable from legitimate literal UTF-8,
-				// so this is the only point where the defect is still observable.
+				// The terminal item is canonical. Some compatible Responses relays put an
+				// empty placeholder in output_item.added and only provide real arguments
+				// here. When streamed arguments also exist, require agreement rather than
+				// silently choosing one source — but compare the decoded payloads, since a
+				// relay that re-serializes the terminal item (different key spacing or
+				// escaping) is not a disagreement about what the model asked for.
+				const streamedArguments = entry?.block.type === "toolCall" ? entry.block.partialJson : "";
+				const finalArguments = item.arguments ?? "";
+				const hasStreamedArguments = streamedArguments.length > 0;
+				const hasFinalArguments = finalArguments.length > 0;
+				const conflictingArgumentSources =
+					hasStreamedArguments &&
+					hasFinalArguments &&
+					streamedArguments !== finalArguments &&
+					!isEquivalentJsonPayload(streamedArguments, finalArguments);
+				// Source precedence: terminal, then streamed deltas, then the `added`
+				// snapshot. The last one only matters for relays that never emit deltas
+				// and leave the terminal `arguments` empty; without it their real payload
+				// would silently degrade to `{}`.
+				const rawArguments = hasFinalArguments
+					? finalArguments
+					: hasStreamedArguments
+						? streamedArguments
+						: (entry?.addedArguments ?? "");
+				const decodedArguments =
+					conflictingArgumentSources || !isCompleteJson(rawArguments)
+						? undefined
+						: parseStreamingJson(rawArguments);
+				// Function-call arguments must decode to a JSON object; `null`, arrays and
+				// scalars cannot be dispatched against a tool schema, so they fail closed
+				// instead of reaching validation as a non-record value. An ambiguous
+				// tool-call identity (duplicate call_id, id/call_id collision) also fails
+				// closed: attribution of the streamed/terminal payload is unsafe.
+				const ambiguousIdentity = entry?.ambiguousIdentity ?? false;
+				const incompleteArguments = ambiguousIdentity || !isJsonRecord(decodedArguments);
+				const args = incompleteArguments ? {} : (decodedArguments as Record<string, unknown>);
+				// Typed reason lets the agent loop give accurate recovery guidance instead
+				// of always suggesting "split the work" (truncation-only) for a malformed
+				// or conflicting terminal payload, or an ambiguous identity.
+				const incompleteArgumentsReason: "malformed" | "conflicting" | "ambiguous" | undefined = incompleteArguments
+					? ambiguousIdentity
+						? "ambiguous"
+						: conflictingArgumentSources
+							? "conflicting"
+							: "malformed"
+					: undefined;
 				const escapedNonAscii = findUnnecessaryUnicodeEscape(rawArguments) !== undefined;
 				const toolCall: ToolCall = {
 					type: "toolCall",
 					id: encodeResponsesToolCallId(item.call_id, item.id),
 					name: item.name,
 					arguments: args,
+					...(incompleteArguments ? { incompleteArguments: true, incompleteArgumentsReason } : {}),
 					...(escapedNonAscii ? { escapedNonAsciiArguments: true } : {}),
 				};
 				if (entry?.block.type === "toolCall") {
@@ -757,9 +880,16 @@ export async function processResponsesStream<TApi extends Api>(
 					entry.block.arguments = args;
 					if (escapedNonAscii) entry.block.escapedNonAsciiArguments = true;
 					else delete entry.block.escapedNonAsciiArguments;
+					if (incompleteArguments) {
+						entry.block.incompleteArguments = true;
+						entry.block.incompleteArgumentsReason = incompleteArgumentsReason;
+					} else {
+						delete entry.block.incompleteArguments;
+						delete entry.block.incompleteArgumentsReason;
+					}
 				}
 				const contentIndex = entry?.blockContentIndex ?? output.content.length - 1;
-				dropEntry(item.id, event.output_index);
+				dropEntry(item.id, event.output_index, item.call_id);
 				stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });
 			} else if (item.type === "custom_tool_call") {
 				const rawInput =
@@ -779,7 +909,7 @@ export async function processResponsesStream<TApi extends Api>(
 					entry.block.arguments = { input: rawInput };
 				}
 				const contentIndex = entry?.blockContentIndex ?? output.content.length - 1;
-				dropEntry(item.id, event.output_index);
+				dropEntry(item.id, event.output_index, item.call_id);
 				stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });
 			}
 		} else if (event.type === "response.completed") {
@@ -828,6 +958,26 @@ export async function processResponsesStream<TApi extends Api>(
 	}
 }
 
+/**
+ * Whether two raw JSON argument strings decode to the same value. Used to tell a
+ * relay's re-serialization of the same tool arguments apart from a genuine
+ * disagreement between the streamed and terminal payloads; anything that does
+ * not decode cleanly on both sides is treated as a disagreement (fail closed).
+ */
+/** Whether a decoded JSON value is a plain object usable as tool-call arguments. */
+function isJsonRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isEquivalentJsonPayload(left: string, right: string): boolean {
+	if (!isCompleteJson(left) || !isCompleteJson(right)) return false;
+	try {
+		return areJsonValuesEqual(JSON.parse(left), JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Mark tool-call blocks left incomplete by a length-truncated response so the
  * agent loop rejects them instead of executing a best-effort partial parse.
@@ -852,13 +1002,17 @@ export function flagTruncatedToolCalls(
 		if (block.type !== "toolCall") continue;
 		if (!isFinalized(block)) {
 			block.incompleteArguments = true;
+			block.incompleteArgumentsReason = "truncated";
 			continue;
 		}
 		// Finalized: custom tools carry raw (non-JSON) input and are complete once
 		// finalized; only JSON function calls get the parse double-check.
 		if (!block.customWireName) {
 			const partial = (block as { partialJson?: string }).partialJson;
-			if (partial !== undefined && !isCompleteJson(partial)) block.incompleteArguments = true;
+			if (partial !== undefined && !isCompleteJson(partial)) {
+				block.incompleteArguments = true;
+				block.incompleteArgumentsReason = "truncated";
+			}
 		}
 	}
 }

package/src/providers/register-builtins.ts

@@ -339,12 +339,15 @@ function createLazyStream<TApi extends Api>(
 	limits?: LazyStreamLimits,
 ): (model: Model<TApi>, context: Context, options: OptionsForApi<TApi>) => EventStreamImpl {
 	return (model, context, options) => {
-		const outer = new EventStreamImpl();
+		let abortTracker: AbortSourceTracker | undefined;
+		const outer = new EventStreamImpl(() =>
+			abortTracker?.abortLocally(new Error("Provider stream consumer stopped before completion")),
+		);
 		const streamOptions = (options ?? {}) as OptionsForApi<TApi>;
 
 		loadModule()
 			.then(module => {
-				const abortTracker = createAbortSourceTracker(streamOptions.signal);
+				abortTracker = createAbortSourceTracker(streamOptions.signal);
 				const providerOptions = { ...streamOptions, signal: abortTracker.requestSignal } as OptionsForApi<TApi>;
 				const inner = module.stream(model, context, providerOptions);
 				forwardStream(outer, inner, model, streamOptions, abortTracker, limits);