@gajae-code/ai 0.14.2 → 0.15.0

package/src/providers/openai-codex-responses.ts

@@ -8,6 +8,7 @@ import {
 	fetchWithRetry,
 	logger,
 	readSseJson,
+	sanitizeHeaderComponent,
 	structuredCloneJSON,
 } from "@gajae-code/utils";
 import type OpenAI from "openai";
@@ -39,6 +40,7 @@ import {
 	type Tool,
 	type ToolCall,
 	type ToolChoice,
+	type ToolResultMessage,
 } from "../types";
 import {
 	createOpenAIResponsesHistoryPayload,
@@ -115,6 +117,46 @@ const CODEX_WEBSOCKET_IDLE_TIMEOUT_MS = 300000;
 const CODEX_WEBSOCKET_RETRY_BUDGET = CODEX_MAX_RETRIES;
 const CODEX_WEBSOCKET_TRANSPORT_ERROR_PREFIX = "Codex websocket transport error";
 const CODEX_PREVIOUS_RESPONSE_STALE_CODES = new Set(["previous_response_not_found", "codex_previous_response_stale"]);
+// Some Codex deployments reject a stale continuation anchor with a generic
+// `invalid_request_error` code and name the anchor only in the message
+// (`Invalid \`previous_response_id\`.`). Match the canonical request-field token
+// with a stale qualifier on either side, so the anchor is cleared and the turn
+// retried with full context instead of killing the session.
+//
+// The compact form deliberately requires the `previous_response_id` field token
+// and is unguarded: a message naming the field itself is about the anchor. Prose
+// references are guarded separately below — the division of labor is compact
+// token (unguarded, field-naming) vs prose phrase (guarded, fault-noun checked
+// on both sides of the anchor phrase), since a deterministic history fault such
+// as `Previous response's tool call ID is malformed.` must stay fatal:
+// replaying it re-sends the same offending item.
+const CODEX_PREVIOUS_RESPONSE_ID_TOKEN = String.raw`previous[ _-]response[ _-]id`;
+// Prose anchor reference ("Previous response with id 'resp_1' not found."):
+// the canonical `previous_response_not_found` wording, which codex-lb re-codes
+// as `invalid_request_error` the same way it re-codes the anchor-expiry fault
+// to `codex_previous_response_stale`. The compact token above cannot match it,
+// so the recovery path missed these and the session died.
+const CODEX_PREVIOUS_RESPONSE_PROSE_TOKEN = `previous[ _-]response`;
+// Sub-field faults INSIDE the previous response (tool call / call id / message
+// id / item) are deterministic history faults: replaying full context re-sends
+// the same offending item. Tempering the qualifier⇄token scan against these
+// tokens keeps them fatal while pure anchor-stale prose still matches.
+const CODEX_PREVIOUS_RESPONSE_STALE_SUBFIELD_GUARD = `tool[ _]calls?|function[ _]calls?|custom[ _]tools?|call[ _-]?ids?|message[ _]?ids?|items?\\b|output[ _-]?items?`;
+const CODEX_ANCHOR_STALE_QUALIFIER = String.raw`invalid|expired|unknown|stale|not[ _-]?found|no longer`;
+const CODEX_PREVIOUS_RESPONSE_STALE_MESSAGE = new RegExp(
+	`(?:${CODEX_ANCHOR_STALE_QUALIFIER})[^\\n]{0,48}?${CODEX_PREVIOUS_RESPONSE_ID_TOKEN}` +
+		`|${CODEX_PREVIOUS_RESPONSE_ID_TOKEN}[^\\n]{0,48}?(?:${CODEX_ANCHOR_STALE_QUALIFIER})`,
+	"i",
+);
+const CODEX_PREVIOUS_RESPONSE_STALE_PROSE_MESSAGE = new RegExp(
+	// The fault noun can sit on EITHER side of the anchor phrase AND on either
+	// side of the qualifier (`Unknown previous response tool call.`,
+	// `Previous response includes an unknown tool call.`), so every alternative
+	// carries both the tempered inter-token scan and a post-anchor lookahead.
+	`(?:${CODEX_ANCHOR_STALE_QUALIFIER})(?:(?!${CODEX_PREVIOUS_RESPONSE_STALE_SUBFIELD_GUARD})[^\\n]){0,48}?${CODEX_PREVIOUS_RESPONSE_PROSE_TOKEN}(?![^\\n]{0,48}(?:${CODEX_PREVIOUS_RESPONSE_STALE_SUBFIELD_GUARD}))` +
+		`|${CODEX_PREVIOUS_RESPONSE_PROSE_TOKEN}(?:(?!${CODEX_PREVIOUS_RESPONSE_STALE_SUBFIELD_GUARD})[^\\n]){0,48}?(?:${CODEX_ANCHOR_STALE_QUALIFIER})(?![^\\n]{0,48}(?:${CODEX_PREVIOUS_RESPONSE_STALE_SUBFIELD_GUARD}))`,
+	"i",
+);
 const CODEX_RETRYABLE_EVENT_CODES = new Set(["model_error", "server_error", "internal_error"]);
 const CODEX_NON_RETRYABLE_EVENT_CODES = new Set([
 	"invalid_function_parameters",
@@ -163,10 +205,21 @@ const CODEX_PROGRESS_EVENT_TYPES = new Set([
 	"error",
 ]);
 
+/**
+ * A progress event must carry real semantic payload, matching the Anthropic
+ * predicate: a recognized envelope whose `delta` is absent or not a non-empty
+ * string is NOT progress — otherwise repeated malformed/no-op deltas reset the
+ * idle watchdog indefinitely and a managed attempt need never terminate.
+ * Non-delta envelope types (lifecycle, item boundaries, terminal events) count
+ * as progress by type alone, as before.
+ */
 function isCodexStreamProgressEvent(event: unknown): boolean {
 	if (!event || typeof event !== "object") return false;
 	const type = (event as { type?: unknown }).type;
-	return typeof type === "string" && CODEX_PROGRESS_EVENT_TYPES.has(type);
+	if (typeof type !== "string" || !CODEX_PROGRESS_EVENT_TYPES.has(type)) return false;
+	if (!type.endsWith(".delta")) return true;
+	const delta = (event as { delta?: unknown }).delta;
+	return typeof delta === "string" && delta.length > 0;
 }
 type CodexTransport = "sse" | "websocket";
 interface CodexInitialTransport {
@@ -174,10 +227,12 @@ interface CodexInitialTransport {
 	requestBodyForState: RequestBody;
 	transport: CodexTransport;
 	toolChoiceFallbackApplied?: boolean;
+	/** Whether the dispatched request actually carried a `previous_response_id` anchor. */
+	sentPreviousResponseId?: boolean;
 }
 type CodexEventItem = ResponseReasoningItem | ResponseOutputMessage | ResponseFunctionToolCall | ResponseCustomToolCall;
 type CodexThinkingBlock = ThinkingContent & { summaryBuffer: string; rawBuffer: string; summaryStarted: boolean };
-type CodexOutputBlock = CodexThinkingBlock | TextContent | (ToolCall & { partialJson: string });
+type CodexOutputBlock = CodexThinkingBlock | TextContent | (ToolCall & { partialJson: string; doneInput?: string });
 export interface OpenAICodexWebSocketDebugStats {
 	fullContextRequests: number;
 	deltaRequests: number;
@@ -277,11 +332,27 @@ interface CodexStreamRuntime {
 	websocketStreamRetries: number;
 	providerRetryAttempt: number;
 	toolChoiceFallbackAttempted: boolean;
+	/**
+	 * Stale-anchor recovery is one-shot. Once the anchor is cleared the replay no
+	 * longer carries `previous_response_id`, so a repeated rejection is a real
+	 * fault and must surface instead of replaying full context up to five times.
+	 */
+	previousResponseRecoveryAttempted: boolean;
+	/**
+	 * Whether the in-flight request actually carried a `previous_response_id`.
+	 * Anchor recovery is only meaningful when it did: a rejection naming the field
+	 * on an anchor-free request (`previous_response_id is required`) is a real
+	 * validation fault, and clearing session state plus resending the identical
+	 * body would destroy valid metadata to no effect.
+	 */
+	sentPreviousResponseId: boolean;
 	sseRequestBodyOverride?: RequestBody;
 	sawTerminalEvent: boolean;
 	canSafelyReplayWebsocketOverSse: boolean;
 	/** Ids of tool calls that received their terminal `output_item.done`. */
 	finalizedToolCallIds: Set<string>;
+	/** Event types whose degraded non-string increment was already diagnosed. */
+	degradedIncrementDiagnostics: Set<string>;
 }
 
 interface CodexStreamProcessingContext {
@@ -520,8 +591,13 @@ function createEmptyUsage(): AssistantMessage["usage"] {
 	};
 }
 
+/** @internal Exported for tests. */
+export function formatCodexUserAgent(platform: string, release: string, arch: string): string {
+	return `pi/${packageJson.version} (${sanitizeHeaderComponent(platform)} ${sanitizeHeaderComponent(release)}; ${sanitizeHeaderComponent(arch)})`;
+}
+
 function getCodexUserAgent(): string {
-	return `pi/${packageJson.version} (${os.platform()} ${os.release()}; ${os.arch()})`;
+	return formatCodexUserAgent(os.platform(), os.release(), os.arch());
 }
 
 function getCodexServiceTierCostMultiplier(
@@ -592,6 +668,10 @@ function resetOutputState(output: AssistantMessage): void {
 function removeTransientBlockIndices(output: AssistantMessage): void {
 	for (const block of output.content) {
 		delete (block as { index?: number }).index;
+		if (block.type === "toolCall") {
+			delete (block as { partialJson?: string }).partialJson;
+			delete (block as { doneInput?: string }).doneInput;
+		}
 	}
 }
 
@@ -808,8 +888,10 @@ async function openCodexWebSocketTransport(
 	eventStream: AsyncGenerator<Record<string, unknown>>;
 	requestBodyForState: RequestBody;
 	transport: CodexTransport;
+	sentPreviousResponseId: boolean;
 }> {
 	const websocketRequest = buildCodexWebSocketRequest(requestContext.transformedBody, websocketState);
+	const sentPreviousResponseId = typeof websocketRequest.previous_response_id === "string";
 	const websocketHeaders = createCodexHeaders(
 		requestContext.requestHeaders,
 		requestContext.accountId,
@@ -827,6 +909,7 @@ async function openCodexWebSocketTransport(
 		sentTurnStateHeader: websocketHeaders.has(X_CODEX_TURN_STATE_HEADER),
 		sentModelsEtagHeader: websocketHeaders.has(X_MODELS_ETAG_HEADER),
 		requestType: websocketRequest.type,
+		sentPreviousResponseId,
 		retry,
 		retryBudget: getCodexWebSocketRetryBudget(options),
 	});
@@ -839,7 +922,7 @@ async function openCodexWebSocketTransport(
 		options,
 		requestSetup.firstEventTimeoutMs,
 	);
-	return { eventStream, requestBodyForState, transport: "websocket" };
+	return { eventStream, requestBodyForState, transport: "websocket", sentPreviousResponseId };
 }
 
 async function openCodexSseTransport(
@@ -904,6 +987,7 @@ async function reopenCodexWebSocketRuntimeStream(
 		runtime.eventStream = next.eventStream;
 		runtime.requestBodyForState = next.requestBodyForState;
 		runtime.transport = next.transport;
+		runtime.sentPreviousResponseId = next.sentPreviousResponseId === true;
 		state.lastTransport = next.transport;
 	} catch (error) {
 		const wsError = error instanceof Error ? error : new Error(String(error));
@@ -936,6 +1020,8 @@ async function reopenCodexSseRuntimeStream(
 	runtime.eventStream = next.eventStream;
 	runtime.requestBodyForState = next.requestBodyForState;
 	runtime.transport = next.transport;
+	// SSE never attaches `previous_response_id`; only buildCodexWebSocketRequest does.
+	runtime.sentPreviousResponseId = false;
 	if (state) {
 		state.lastTransport = next.transport;
 	}
@@ -947,6 +1033,7 @@ function createCodexStreamRuntime(initial: {
 	transport: CodexTransport;
 	websocketState?: CodexWebSocketSessionState;
 	toolChoiceFallbackApplied?: boolean;
+	sentPreviousResponseId?: boolean;
 }): CodexStreamRuntime {
 	return {
 		eventStream: initial.eventStream,
@@ -959,12 +1046,15 @@ function createCodexStreamRuntime(initial: {
 		websocketStreamRetries: 0,
 		providerRetryAttempt: 0,
 		toolChoiceFallbackAttempted: initial.toolChoiceFallbackApplied === true,
+		previousResponseRecoveryAttempted: false,
+		sentPreviousResponseId: initial.sentPreviousResponseId === true,
 		sseRequestBodyOverride: initial.toolChoiceFallbackApplied
 			? structuredCloneJSON(initial.requestBodyForState)
 			: undefined,
 		sawTerminalEvent: false,
 		canSafelyReplayWebsocketOverSse: true,
 		finalizedToolCallIds: new Set<string>(),
+		degradedIncrementDiagnostics: new Set<string>(),
 	};
 }
 
@@ -1019,6 +1109,13 @@ function handleCodexStreamEvent(args: {
 		runtime.currentItem = item;
 		runtime.currentBlock = createOutputBlockForItem(item);
 		if (!runtime.currentBlock) return firstTokenTime;
+		const currentBlock = runtime.currentBlock;
+		if (
+			currentBlock.type === "toolCall" &&
+			output.content.some(block => block.type === "toolCall" && block.id === currentBlock.id)
+		) {
+			throw new Error("Codex stream reused an active tool-call identifier");
+		}
 		output.content.push(runtime.currentBlock);
 		stream.push({
 			type: getOutputBlockStartEventType(runtime.currentBlock),
@@ -1034,7 +1131,13 @@ function handleCodexStreamEvent(args: {
 	}
 
 	if (eventType === "response.reasoning_summary_text.delta") {
-		handleReasoningSummaryTextDelta(runtime.currentItem, runtime.currentBlock, rawEvent, stream, output, blockIndex);
+		const delta = normalizeCodexIncrement(
+			rawEvent,
+			"response.reasoning_summary_text.delta",
+			model,
+			runtime.degradedIncrementDiagnostics,
+		);
+		handleReasoningSummaryTextDelta(runtime.currentItem, runtime.currentBlock, delta, stream, output, blockIndex);
 		return firstTokenTime;
 	}
 
@@ -1044,7 +1147,13 @@ function handleCodexStreamEvent(args: {
 	}
 
 	if (eventType === "response.reasoning_text.delta") {
-		handleReasoningTextDelta(runtime.currentItem, runtime.currentBlock, rawEvent, stream, output, blockIndex);
+		const delta = normalizeCodexIncrement(
+			rawEvent,
+			"response.reasoning_text.delta",
+			model,
+			runtime.degradedIncrementDiagnostics,
+		);
+		handleReasoningTextDelta(runtime.currentItem, runtime.currentBlock, delta, stream, output, blockIndex);
 		return firstTokenTime;
 	}
 
@@ -1054,10 +1163,16 @@ function handleCodexStreamEvent(args: {
 	}
 
 	if (eventType === "response.output_text.delta") {
+		const delta = normalizeCodexIncrement(
+			rawEvent,
+			"response.output_text.delta",
+			model,
+			runtime.degradedIncrementDiagnostics,
+		);
 		handleMessageTextDelta(
 			runtime.currentItem,
 			runtime.currentBlock,
-			rawEvent,
+			delta,
 			stream,
 			output,
 			blockIndex,
@@ -1067,20 +1182,19 @@ function handleCodexStreamEvent(args: {
 	}
 
 	if (eventType === "response.refusal.delta") {
-		handleMessageTextDelta(
-			runtime.currentItem,
-			runtime.currentBlock,
+		const delta = normalizeCodexIncrement(
 			rawEvent,
-			stream,
-			output,
-			blockIndex,
-			"refusal",
+			"response.refusal.delta",
+			model,
+			runtime.degradedIncrementDiagnostics,
 		);
+		handleMessageTextDelta(runtime.currentItem, runtime.currentBlock, delta, stream, output, blockIndex, "refusal");
 		return firstTokenTime;
 	}
 
 	if (eventType === "response.function_call_arguments.delta") {
-		handleToolCallArgumentsDelta(runtime.currentItem, runtime.currentBlock, rawEvent, stream, output, blockIndex);
+		const delta = assertStringToolArgumentIncrement(rawEvent, "response.function_call_arguments.delta");
+		handleToolCallArgumentsDelta(runtime.currentItem, runtime.currentBlock, delta, stream, output, blockIndex);
 		return firstTokenTime;
 	}
 
@@ -1090,7 +1204,8 @@ function handleCodexStreamEvent(args: {
 	}
 
 	if (eventType === "response.custom_tool_call_input.delta") {
-		handleCustomToolCallInputDelta(runtime.currentItem, runtime.currentBlock, rawEvent, stream, output, blockIndex);
+		const delta = assertStringToolArgumentIncrement(rawEvent, "response.custom_tool_call_input.delta");
+		handleCustomToolCallInputDelta(runtime.currentItem, runtime.currentBlock, delta, stream, output, blockIndex);
 		return firstTokenTime;
 	}
 
@@ -1137,6 +1252,10 @@ function createOutputBlockForItem(item: CodexEventItem): CodexOutputBlock | null
 		};
 	}
 	if (item.type === "custom_tool_call") {
+		const initialInput: unknown = item.input;
+		if (typeof initialInput !== "string") {
+			throw new Error("Codex custom_tool_call started with non-string input");
+		}
 		// Wire name flows through unchanged; the agent-loop dispatcher also
 		// matches `Tool.customWireName`. Reuse `partialJson` as the
 		// accumulation buffer for the raw input string.
@@ -1144,9 +1263,9 @@ function createOutputBlockForItem(item: CodexEventItem): CodexOutputBlock | null
 			type: "toolCall",
 			id: encodeResponsesToolCallId(item.call_id, item.id),
 			name: item.name,
-			arguments: { input: item.input ?? "" },
+			arguments: { input: initialInput },
 			customWireName: item.name,
-			partialJson: item.input ?? "",
+			partialJson: initialInput,
 		};
 	}
 	return null;
@@ -1164,10 +1283,52 @@ function handleReasoningSummaryPartAdded(currentItem: CodexEventItem | null, raw
 	currentItem.summary.push((rawEvent as { part: ResponseReasoningItem["summary"][number] }).part);
 }
 
+/**
+ * Primitive anomalies (undefined, null, numbers, booleans) stay coerced to
+ * an empty string by the increment handlers. Diagnose at most once per event
+ * type per stream, naming only the envelope shape — never the payload.
+ */
+function normalizeCodexIncrement(
+	rawEvent: Record<string, unknown>,
+	eventType: string,
+	model: Model<"openai-codex-responses">,
+	degradedIncrementDiagnostics: Set<string>,
+): string {
+	const raw = (rawEvent as { delta?: unknown }).delta;
+	if (typeof raw === "string") return raw;
+	if (!degradedIncrementDiagnostics.has(eventType)) {
+		degradedIncrementDiagnostics.add(eventType);
+		logger.warn("codex: degraded non-string stream increment to empty string", {
+			model: model.id,
+			provider: model.provider,
+			eventType,
+			receivedType: raw === null ? "null" : typeof raw,
+		});
+	}
+	return "";
+}
+
+/**
+ * Tool-argument fragments are positional JSON text. Erasing or coercing ANY
+ * malformed increment — primitive, object, or function — assembles
+ * valid-but-wrong arguments (e.g. `{"n":1` + numeric primitive erased to ""
+ * + `3}` parses as {"n":13} and executes), so the turn fails closed on every
+ * non-string delta. The payload never enters the error message.
+ */
+function assertStringToolArgumentIncrement(rawEvent: Record<string, unknown>, eventType: string): string {
+	const raw = (rawEvent as { delta?: unknown }).delta;
+	if (typeof raw !== "string") {
+		throw new Error(
+			`Codex stream sent a non-string ${eventType} tool-argument increment; failing the turn instead of assembling wrong tool arguments`,
+		);
+	}
+	return raw;
+}
+
 function handleReasoningSummaryTextDelta(
 	currentItem: CodexEventItem | null,
 	currentBlock: CodexOutputBlock | null,
-	rawEvent: Record<string, unknown>,
+	delta: string,
 	stream: AssistantMessageEventStream,
 	output: AssistantMessage,
 	blockIndex: () => number,
@@ -1180,7 +1341,6 @@ function handleReasoningSummaryTextDelta(
 	currentItem.summary = currentItem.summary || [];
 	const lastPart = currentItem.summary[currentItem.summary.length - 1];
 	if (!lastPart) return;
-	const delta = (rawEvent as { delta?: string }).delta || "";
 	currentBlock.thinking += delta;
 	currentBlock.summaryBuffer += delta;
 	lastPart.text += delta;
@@ -1207,13 +1367,12 @@ function handleReasoningSummaryPartDone(
 function handleReasoningTextDelta(
 	currentItem: CodexEventItem | null,
 	currentBlock: CodexOutputBlock | null,
-	rawEvent: Record<string, unknown>,
+	delta: string,
 	stream: AssistantMessageEventStream,
 	output: AssistantMessage,
 	blockIndex: () => number,
 ): void {
 	if (currentItem?.type !== "reasoning" || currentBlock?.type !== "thinking") return;
-	const delta = (rawEvent as { delta?: string }).delta || "";
 	currentBlock.thinking += delta;
 	currentBlock.rawBuffer += delta;
 	stream.push({ type: "thinking_delta", contentIndex: blockIndex(), delta, partial: output });
@@ -1231,7 +1390,7 @@ function handleContentPartAdded(currentItem: CodexEventItem | null, rawEvent: Re
 function handleMessageTextDelta(
 	currentItem: CodexEventItem | null,
 	currentBlock: CodexOutputBlock | null,
-	rawEvent: Record<string, unknown>,
+	delta: string,
 	stream: AssistantMessageEventStream,
 	output: AssistantMessage,
 	blockIndex: () => number,
@@ -1241,7 +1400,6 @@ function handleMessageTextDelta(
 	if (!currentItem.content || currentItem.content.length === 0) return;
 	const lastPart = currentItem.content[currentItem.content.length - 1];
 	if (!lastPart || lastPart.type !== partType) return;
-	const delta = (rawEvent as { delta?: string }).delta || "";
 	currentBlock.text += delta;
 	if (lastPart.type === "output_text") {
 		lastPart.text += delta;
@@ -1254,13 +1412,12 @@ function handleMessageTextDelta(
 function handleToolCallArgumentsDelta(
 	currentItem: CodexEventItem | null,
 	currentBlock: CodexOutputBlock | null,
-	rawEvent: Record<string, unknown>,
+	delta: string,
 	stream: AssistantMessageEventStream,
 	output: AssistantMessage,
 	blockIndex: () => number,
 ): void {
 	if (currentItem?.type !== "function_call" || currentBlock?.type !== "toolCall") return;
-	const delta = (rawEvent as { delta?: string }).delta || "";
 	currentBlock.partialJson += delta;
 	currentBlock.arguments = parseStreamingJson(currentBlock.partialJson);
 	stream.push({ type: "toolcall_delta", contentIndex: blockIndex(), delta, partial: output });
@@ -1283,13 +1440,12 @@ function handleToolCallArgumentsDone(
 function handleCustomToolCallInputDelta(
 	currentItem: CodexEventItem | null,
 	currentBlock: CodexOutputBlock | null,
-	rawEvent: Record<string, unknown>,
+	delta: string,
 	stream: AssistantMessageEventStream,
 	output: AssistantMessage,
 	blockIndex: () => number,
 ): void {
 	if (currentItem?.type !== "custom_tool_call" || currentBlock?.type !== "toolCall") return;
-	const delta = (rawEvent as { delta?: string }).delta || "";
 	currentBlock.partialJson += delta;
 	currentBlock.arguments = { input: currentBlock.partialJson };
 	stream.push({ type: "toolcall_delta", contentIndex: blockIndex(), delta, partial: output });
@@ -1301,11 +1457,17 @@ function handleCustomToolCallInputDone(
 	rawEvent: Record<string, unknown>,
 ): void {
 	if (currentItem?.type !== "custom_tool_call" || currentBlock?.type !== "toolCall") return;
-	const input = (rawEvent as { input?: string }).input;
-	if (typeof input === "string") {
-		currentBlock.partialJson = input;
-		currentBlock.arguments = { input };
+	const input = (rawEvent as { input?: unknown }).input;
+	if (typeof input !== "string") {
+		throw new Error("Codex stream sent non-string input in custom_tool_call_input.done");
 	}
+	if (currentBlock.partialJson && currentBlock.partialJson !== input) {
+		throw new Error(
+			"Codex custom_tool_call input.done disagrees with the streamed input buffer; failing the turn instead of executing corrupted input",
+		);
+	}
+	currentBlock.doneInput = input;
+	currentBlock.arguments = { input };
 }
 
 function handleOutputItemDone(
@@ -1385,36 +1547,90 @@ function handleOutputItemDone(
 	}
 
 	if (item.type === "function_call") {
+		if (typeof item.arguments !== "string") {
+			throw new Error("Codex function_call completed with non-string terminal arguments");
+		}
+		let terminalArguments: unknown;
+		try {
+			terminalArguments = JSON.parse(item.arguments);
+		} catch {
+			throw new Error("Codex function_call completed with malformed terminal arguments");
+		}
+		if (!terminalArguments || typeof terminalArguments !== "object" || Array.isArray(terminalArguments)) {
+			throw new Error("Codex function_call terminal arguments were not a JSON object");
+		}
 		const id = encodeResponsesToolCallId(item.call_id, item.id);
+		if (runtime.currentBlock?.type !== "toolCall" || runtime.currentBlock.id !== id) {
+			throw new Error("Codex function_call terminal item did not match the active tool call");
+		}
 		runtime.finalizedToolCallIds.add(id);
 		const toolCall: ToolCall = {
 			type: "toolCall",
 			id,
 			name: codexToolCanonicalName(item.name),
-			arguments: parseStreamingJson(item.arguments || "{}"),
+			arguments: terminalArguments as Record<string, unknown>,
 			...(findUnnecessaryUnicodeEscape(item.arguments || "") ? { escapedNonAsciiArguments: true } : {}),
 		};
+		Object.assign(runtime.currentBlock, toolCall);
+		delete (runtime.currentBlock as { partialJson?: string }).partialJson;
+		delete (runtime.currentBlock as { doneInput?: string }).doneInput;
 		runtime.canSafelyReplayWebsocketOverSse = false;
 		stream.push({ type: "toolcall_end", contentIndex: blockIndex(), toolCall, partial: output });
+		runtime.currentItem = null;
+		runtime.currentBlock = null;
 		return;
 	}
 
 	if (item.type === "custom_tool_call") {
+		const terminalInput: unknown = item.input;
+		if (typeof terminalInput !== "string") {
+			throw new Error(
+				"Codex custom_tool_call completed with non-string terminal input; failing the turn instead of finalizing from the streamed buffer",
+			);
+		}
 		const id = encodeResponsesToolCallId(item.call_id, item.id);
+		if (runtime.currentBlock?.type !== "toolCall" || runtime.currentBlock.id !== id) {
+			throw new Error("Codex custom_tool_call terminal item did not match the active tool call");
+		}
 		runtime.finalizedToolCallIds.add(id);
-		const rawInput =
+		// The terminal `output_item.done.item.input` is the authoritative
+		// complete input; the streamed `partialJson` buffer is advisory. If both
+		// exist and disagree, the stream was corrupted (dropped/malformed
+		// increments), so fail closed instead of executing either variant —
+		// matching function-call finalization, which always trusts the terminal
+		// `item.arguments`.
+		const streamedInput =
 			runtime.currentBlock?.type === "toolCall" && runtime.currentBlock.partialJson
 				? runtime.currentBlock.partialJson
-				: (item.input ?? "");
+				: undefined;
+		if (streamedInput !== undefined && streamedInput !== terminalInput) {
+			throw new Error(
+				"Codex custom_tool_call terminal input disagrees with the streamed input buffer; failing the turn instead of executing a corrupted tool call",
+			);
+		}
+		if (
+			runtime.currentBlock?.type === "toolCall" &&
+			runtime.currentBlock.doneInput !== undefined &&
+			runtime.currentBlock.doneInput !== terminalInput
+		) {
+			throw new Error(
+				"Codex custom_tool_call terminal input disagrees with input.done; failing the turn instead of executing conflicting input",
+			);
+		}
 		const toolCall: ToolCall = {
 			type: "toolCall",
 			id,
 			name: item.name,
-			arguments: { input: rawInput },
+			arguments: { input: terminalInput },
 			customWireName: item.name,
 		};
+		Object.assign(runtime.currentBlock, toolCall);
+		delete (runtime.currentBlock as { partialJson?: string }).partialJson;
+		delete (runtime.currentBlock as { doneInput?: string }).doneInput;
 		runtime.canSafelyReplayWebsocketOverSse = false;
 		stream.push({ type: "toolcall_end", contentIndex: blockIndex(), toolCall, partial: output });
+		runtime.currentItem = null;
+		runtime.currentBlock = null;
 		return;
 	}
 
@@ -1476,6 +1692,12 @@ function handleResponseCompleted(
 	// call that never received its `output_item.done` so the agent loop rejects
 	// the truncated arguments instead of executing a best-effort partial parse.
 	flagTruncatedToolCalls(output, output.stopReason, block => runtime.finalizedToolCallIds.has(block.id));
+	if (
+		output.stopReason === "stop" &&
+		output.content.some(block => block.type === "toolCall" && !runtime.finalizedToolCallIds.has(block.id))
+	) {
+		throw new Error("Codex response completed with an unfinalized tool call");
+	}
 	if (output.content.some(block => block.type === "toolCall") && output.stopReason === "stop") {
 		output.stopReason = "toolUse";
 	}
@@ -1540,6 +1762,7 @@ async function tryRetryWithoutForcedToolChoice(
 	runtime.currentBlock = null;
 	runtime.sawTerminalEvent = false;
 	runtime.nativeOutputItems.length = 0;
+	runtime.finalizedToolCallIds.clear();
 	resetOutputState(context.output);
 	context.firstTokenTime = undefined;
 
@@ -1559,6 +1782,7 @@ async function tryRetryWithoutForcedToolChoice(
 	runtime.requestBodyForState = next.requestBodyForState;
 	runtime.sseRequestBodyOverride = next.requestBodyForState;
 	runtime.transport = next.transport;
+	runtime.sentPreviousResponseId = false;
 	if (websocketState) {
 		websocketState.lastTransport = next.transport;
 	}
@@ -1635,6 +1859,7 @@ async function tryReconnectCodexWebSocketOnConnectionLimit(
 		runtime.currentItem = null;
 		runtime.currentBlock = null;
 		runtime.nativeOutputItems.length = 0;
+		runtime.finalizedToolCallIds.clear();
 		resetOutputState(context.output);
 		context.firstTokenTime = undefined;
 		recordCodexWebSocketFailure(websocketState, true);
@@ -1649,10 +1874,13 @@ async function tryReconnectCodexWebSocketOnConnectionLimit(
 }
 
 function isCodexPreviousResponseNotFound(error: unknown): boolean {
+	if (!(error instanceof CodexProviderStreamError)) return false;
+	if (typeof error.code === "string" && CODEX_PREVIOUS_RESPONSE_STALE_CODES.has(error.code)) return true;
+	// Raw provider message only — `error.message` carries appended `code=` metadata
+	// that would supply the stale qualifier the provider never sent.
 	return (
-		error instanceof CodexProviderStreamError &&
-		typeof error.code === "string" &&
-		CODEX_PREVIOUS_RESPONSE_STALE_CODES.has(error.code)
+		CODEX_PREVIOUS_RESPONSE_STALE_MESSAGE.test(error.providerMessage) ||
+		CODEX_PREVIOUS_RESPONSE_STALE_PROSE_MESSAGE.test(error.providerMessage)
 	);
 }
 
@@ -1664,6 +1892,12 @@ async function tryRecoverCodexPreviousResponseNotFound(
 	const websocketState = context.requestContext.websocketState;
 	if (
 		!isCodexPreviousResponseNotFound(error) ||
+		// An anchor rejection is only actionable when this request actually sent one.
+		// `previous_response_id is required` on an anchor-free request is a genuine
+		// validation fault: clearing session metadata and resending the identical
+		// body cannot fix it.
+		!runtime.sentPreviousResponseId ||
+		runtime.previousResponseRecoveryAttempted ||
 		!websocketState ||
 		context.options?.fallbackManaged ||
 		runtime.transport !== "websocket" ||
@@ -1675,12 +1909,14 @@ async function tryRecoverCodexPreviousResponseNotFound(
 	}
 
 	runtime.providerRetryAttempt += 1;
+	runtime.previousResponseRecoveryAttempted = true;
 	resetCodexWebSocketAppendState(websocketState);
 	resetCodexSessionMetadata(websocketState);
 	runtime.currentItem = null;
 	runtime.currentBlock = null;
 	runtime.sawTerminalEvent = false;
 	runtime.nativeOutputItems.length = 0;
+	runtime.finalizedToolCallIds.clear();
 	resetOutputState(context.output);
 	context.firstTokenTime = undefined;
 
@@ -1739,6 +1975,7 @@ async function tryReplayWebsocketFailureOverSse(
 		runtime.currentItem = null;
 		runtime.currentBlock = null;
 		runtime.nativeOutputItems.length = 0;
+		runtime.finalizedToolCallIds.clear();
 		resetOutputState(context.output);
 		context.firstTokenTime = undefined;
 	}
@@ -1779,6 +2016,8 @@ async function tryRetryCodexProviderError(
 	runtime.currentItem = null;
 	runtime.currentBlock = null;
 	runtime.sawTerminalEvent = false;
+	runtime.nativeOutputItems.length = 0;
+	runtime.finalizedToolCallIds.clear();
 	resetOutputState(context.output);
 	context.firstTokenTime = undefined;
 	await scheduler.wait(CODEX_RETRY_DELAY_MS * runtime.providerRetryAttempt, {
@@ -1821,6 +2060,7 @@ function finalizeCodexResponse(
 		throw new Error("Codex response failed");
 	}
 
+	removeTransientBlockIndices(output);
 	output.providerPayload = createOpenAIResponsesHistoryPayload(context.model.provider, runtime.nativeOutputItems);
 	output.duration = Date.now() - context.startTime;
 	if (completion.firstTokenTime) {
@@ -2290,10 +2530,15 @@ class CodexWebSocketConnection {
 		this.#socket = socket;
 		let settled = false;
 		let timeout: NodeJS.Timeout | undefined;
+		const clearPending = () => {
+			if (timeout) clearTimeout(timeout);
+			if (signal) signal.removeEventListener("abort", onAbort);
+		};
 		const onAbort = () => {
 			socket.close(1000, "aborted");
 			if (!settled) {
 				settled = true;
+				clearPending();
 				reject(createCodexWebSocketTransportError("request was aborted"));
 			}
 		};
@@ -2304,17 +2549,16 @@ class CodexWebSocketConnection {
 				signal.addEventListener("abort", onAbort, { once: true });
 			}
 		}
-		const clearPending = () => {
-			if (timeout) clearTimeout(timeout);
-			if (signal) signal.removeEventListener("abort", onAbort);
-		};
-		timeout = setTimeout(() => {
-			socket.close(1000, "connect-timeout");
-			if (!settled) {
-				settled = true;
-				reject(createCodexWebSocketTransportError("connection timeout"));
-			}
-		}, CODEX_WEBSOCKET_CONNECT_TIMEOUT_MS);
+		if (!settled) {
+			timeout = setTimeout(() => {
+				socket.close(1000, "connect-timeout");
+				if (!settled) {
+					settled = true;
+					clearPending();
+					reject(createCodexWebSocketTransportError("connection timeout"));
+				}
+			}, CODEX_WEBSOCKET_CONNECT_TIMEOUT_MS);
+		}
 
 		socket.onopen = event => {
 			if (!settled) {
@@ -2352,6 +2596,7 @@ class CodexWebSocketConnection {
 		};
 		socket.onmessage = event => {
 			try {
+				if (!this.#activeRequest) return;
 				const text = typeof event.data === "string" ? event.data : Buffer.from(event.data).toString("utf-8");
 				if (!text) return;
 				const parsed = JSON.parse(text) as Record<string, unknown>;
@@ -2382,6 +2627,7 @@ class CodexWebSocketConnection {
 		request: Record<string, unknown>,
 		signal?: AbortSignal,
 		firstEventTimeoutMs?: number,
+		idleTimeoutMs = this.#idleTimeoutMs,
 	): AsyncGenerator<Record<string, unknown>> {
 		if (!this.#socket || this.#socket.readyState !== WebSocket.OPEN) {
 			throw createCodexWebSocketTransportError("websocket connection is unavailable");
@@ -2405,14 +2651,23 @@ class CodexWebSocketConnection {
 		try {
 			this.#socket.send(JSON.stringify(request));
 			let sawFirstProgress = false;
-			let lastProgressAt = Date.now();
+			const startedAt = Date.now();
+			let lastProgressAt = startedAt;
 			while (true) {
-				let timeoutMs = firstEventTimeoutMs;
+				let timeoutMs =
+					firstEventTimeoutMs === undefined ? undefined : firstEventTimeoutMs - (Date.now() - startedAt);
 				if (sawFirstProgress) {
-					timeoutMs = this.#idleTimeoutMs - (Date.now() - lastProgressAt);
+					timeoutMs = idleTimeoutMs - (Date.now() - lastProgressAt);
 					if (timeoutMs <= 0) {
+						this.close("idle-timeout");
 						throw createCodexWebSocketTransportError("idle timeout waiting for websocket");
 					}
+				} else if (timeoutMs !== undefined && timeoutMs <= 0) {
+					this.close("first-event-timeout");
+					throw createCodexWebSocketTransportError(
+						"timeout waiting for first websocket event",
+						STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE,
+					);
 				}
 				const next = await this.#nextMessage(
 					timeoutMs,
@@ -2429,20 +2684,19 @@ class CodexWebSocketConnection {
 					sawFirstProgress = true;
 					lastProgressAt = Date.now();
 				}
-				yield next;
 				const eventType = typeof next.type === "string" ? next.type : "";
-				if (
+				const terminal =
 					eventType === "response.completed" ||
 					eventType === "response.done" ||
 					eventType === "response.incomplete" ||
 					eventType === "response.failed" ||
-					eventType === "error"
-				) {
-					break;
-				}
+					eventType === "error";
+				yield next;
+				if (terminal) break;
 			}
 		} finally {
 			this.#activeRequest = false;
+			this.#queue.length = 0;
 			if (signal) {
 				signal.removeEventListener("abort", onAbort);
 			}
@@ -2485,9 +2739,9 @@ class CodexWebSocketConnection {
 			await promise;
 			if (timeout) clearTimeout(timeout);
 			if (timedOut && this.#queue.length === 0) {
-				if (providerCode === STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE) {
-					this.close("first-event-timeout");
-				}
+				this.close(
+					providerCode === STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE ? "first-event-timeout" : "idle-timeout",
+				);
 				return createCodexWebSocketTransportError(timeoutReason, providerCode);
 			}
 		}
@@ -2590,7 +2844,12 @@ async function openCodexWebSocketEventStream(
 	firstEventTimeoutMs?: number,
 ): Promise<AsyncGenerator<Record<string, unknown>>> {
 	const connection = await getOrCreateCodexWebSocketConnection(state, url, headers, signal, options);
-	return connection.streamRequest(request, signal, firstEventTimeoutMs);
+	return connection.streamRequest(
+		request,
+		signal,
+		firstEventTimeoutMs,
+		getCodexWebSocketIdleTimeoutMs(options?.streamIdleTimeoutMs),
+	);
 }
 
 function createCodexHeaders(
@@ -2710,8 +2969,27 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 	// `function_call_output` (OpenAI rejects mismatched pairs).
 	const customCallIds = new Set<string>();
 	const knownCallIds = new Set<string>();
+	// Consecutive tool results are batched into one append call so every output
+	// of the turn stays contiguous before the collected image user message;
+	// per-result image user messages interleave with sibling outputs and break
+	// tool_use→tool_result adjacency through Anthropic-translating proxies (#4807).
+	let pendingToolResults: ToolResultMessage[] = [];
+	const flushPendingToolResults = (): void => {
+		if (pendingToolResults.length === 0) return;
+		appendResponsesToolResultMessages(messages, pendingToolResults, model, false, knownCallIds, customCallIds);
+		pendingToolResults = [];
+	};
 
 	for (const msg of transformedMessages) {
+		if (msg.role === "toolResult") {
+			pendingToolResults.push(msg);
+			msgIndex += 1;
+			continue;
+		}
+		// Flush pending tool results before any non-tool-result message so the
+		// batched outputs (and their collected image user message) stay directly
+		// after their assistant tool-call turn, never behind later turns (#4807).
+		flushPendingToolResults();
 		if (msg.role === "user" || msg.role === "developer") {
 			const providerPayload = (msg as { providerPayload?: AssistantMessage["providerPayload"] }).providerPayload;
 			const historyItems = getOpenAIResponsesHistoryItems(providerPayload, model.provider);
@@ -2780,15 +3058,9 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 				messages.push(...outputItems);
 			}
 			msgIndex += 1;
-			continue;
 		}
-
-		if (msg.role === "toolResult") {
-			appendResponsesToolResultMessages(messages, msg, model, false, knownCallIds, customCallIds);
-		}
-
-		msgIndex += 1;
 	}
+	flushPendingToolResults();
 
 	return messages;
 }
@@ -2897,12 +3169,20 @@ function getCodexEventErrorMessage(rawEvent: Record<string, unknown>): string {
 class CodexProviderStreamError extends Error {
 	readonly retryable: boolean;
 	readonly code?: string;
-
-	constructor(message: string, retryable: boolean, code?: string) {
+	/**
+	 * Provider-supplied message, before display formatting appends `code=`/`status=`
+	 * metadata. Classification must read this, never `message`: the formatted string
+	 * mixes the code into the prose and would let `code=invalid_request_error`
+	 * satisfy a message pattern the provider never actually sent.
+	 */
+	readonly providerMessage: string;
+
+	constructor(message: string, retryable: boolean, code: string | undefined, providerMessage: string) {
 		super(message);
 		this.name = "CodexProviderStreamError";
 		this.retryable = retryable;
 		this.code = code;
+		this.providerMessage = providerMessage;
 	}
 }
 
@@ -2928,7 +3208,12 @@ function createCodexProviderStreamError(rawEvent: Record<string, unknown>): Code
 		typeof rawEvent.type === "string" && rawEvent.type === "error"
 			? formatCodexErrorEvent(rawEvent, code, message)
 			: (formatCodexFailure(rawEvent) ?? "Codex response failed");
-	return new CodexProviderStreamError(formattedMessage, isRetryableCodexFailureEvent(rawEvent), code || undefined);
+	return new CodexProviderStreamError(
+		formattedMessage,
+		isRetryableCodexFailureEvent(rawEvent),
+		code || undefined,
+		message,
+	);
 }
 
 function isRetryableCodexProviderError(error: unknown): boolean {