@gajae-code/ai 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.8.2] - 2026-07-06
+
+### Fixed
+
+- Refreshed matching existing OAuth credentials during `importCredentialIfAbsent` and cleared provider usage caches after the write, so external credential import no longer keeps stale tokens or stale usage-limit reports for the same account.
+
 ## [0.7.9] - 2026-07-01
 
 ### Fixed

package/dist/types/auth-broker/remote-store.d.ts

@@ -70,6 +70,7 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     getCache(key: string): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
     cleanExpiredCache(): void;
+    deleteCachePrefix(prefix: string): void;
     /**
      * Store-level hook consumed by `AuthStorage` — routes refresh through the
      * broker so the actual refresh token never leaves the broker host. Returns

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -420,6 +420,7 @@ export declare const credentialIfAbsentUploadResponseSchema: z.ZodObject<{
         "skipped-existing-fallback": "skipped-existing-fallback";
         "skipped-existing-runtime": "skipped-existing-runtime";
         "skipped-invalid": "skipped-invalid";
+        "updated-existing": "updated-existing";
     }>;
     entries: z.ZodArray<z.ZodObject<{
         id: z.ZodNumber;

package/dist/types/auth-storage.d.ts

@@ -102,7 +102,7 @@ export interface AuthCredentialSnapshotEntry {
     credential: SnapshotCredential;
     identityKey: string | null;
 }
-export type AuthCredentialIfAbsentReason = "inserted" | "skipped-existing" | "skipped-existing-runtime" | "skipped-existing-config" | "skipped-existing-env" | "skipped-existing-fallback" | "skipped-invalid";
+export type AuthCredentialIfAbsentReason = "inserted" | "updated-existing" | "skipped-existing" | "skipped-existing-runtime" | "skipped-existing-config" | "skipped-existing-env" | "skipped-existing-fallback" | "skipped-invalid";
 export interface AuthCredentialIfAbsentResult {
     inserted: boolean;
     reason: AuthCredentialIfAbsentReason;
@@ -147,6 +147,7 @@ export interface AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    deleteCachePrefix?(prefix: string): void;
     cleanExpiredCache(): void;
     /**
      * Optional store-supplied OAuth refresh. When present, `AuthStorage` uses
@@ -646,6 +647,7 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    deleteCachePrefix(prefix: string): void;
     cleanExpiredCache(): void;
     /**
      * Save OAuth credentials for a provider.

package/dist/types/utils.d.ts

@@ -2,6 +2,7 @@ import type { ResponseInput } from "openai/resources/responses/responses";
 import type { CacheRetention, OpenAIResponsesHistoryPayload, ProviderPayload } from "./types";
 export { isRecord } from "@gajae-code/utils";
 export declare function normalizeSystemPrompts(systemPrompt: readonly string[] | string | undefined | null): string[];
+export declare function sanitizeJsonStrings(value: unknown): unknown;
 export declare function toNumber(value: unknown): number | undefined;
 export declare function toPositiveNumber(value: unknown, fallback: number): number;
 export declare function toBoolean(value: unknown): boolean | undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.8.0",
+	"version": "0.8.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo",
@@ -43,7 +43,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.8.0",
+		"@gajae-code/utils": "0.8.2",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/remote-store.ts

@@ -86,6 +86,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	#cache: Map<string, CacheEntry> = new Map();
 	#usageCache?: UsageCacheEntry;
 	#usageInflight?: Promise<UsageReport[] | null>;
+	#usageCacheEpoch = 0;
 	#closed = false;
 	/**
 	 * `true` once the SSE consumer received its first frame and hasn't dropped
@@ -465,6 +466,19 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		}
 	}
 
+	deleteCachePrefix(prefix: string): void {
+		for (const key of this.#cache.keys()) {
+			if (key.startsWith(prefix)) this.#cache.delete(key);
+		}
+		if (prefix.startsWith("usage_cache:")) this.#invalidateUsageCache();
+	}
+
+	#invalidateUsageCache(): void {
+		this.#usageCache = undefined;
+		this.#usageInflight = undefined;
+		this.#usageCacheEpoch += 1;
+	}
+
 	/**
 	 * Store-level hook consumed by `AuthStorage` — routes refresh through the
 	 * broker so the actual refresh token never leaves the broker host. Returns
@@ -561,10 +575,11 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 			return Promise.resolve(cached.reports);
 		}
 		if (this.#usageInflight) return this.#usageInflight;
+		const epoch = this.#usageCacheEpoch;
 		const inflight = this.#client
 			.fetchUsage()
 			.then(body => {
-				this.#usageCache = { reports: body.reports, fetchedAt: Date.now() };
+				if (this.#usageCacheEpoch === epoch) this.#usageCache = { reports: body.reports, fetchedAt: Date.now() };
 				return body.reports;
 			})
 			.catch(error => {
@@ -572,7 +587,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 				return null;
 			})
 			.finally(() => {
-				this.#usageInflight = undefined;
+				if (this.#usageCacheEpoch === epoch) this.#usageInflight = undefined;
 			});
 		this.#usageInflight = inflight;
 		return inflight;

package/src/auth-broker/wire-schemas.ts

@@ -187,6 +187,7 @@ export const credentialDisableResponseSchema = z
 // ─── Upload ────────────────────────────────────────────────────────────────
 const credentialIfAbsentReasonSchema = z.enum([
 	"inserted",
+	"updated-existing",
 	"skipped-existing",
 	"skipped-existing-runtime",
 	"skipped-existing-config",

package/src/auth-storage.ts

@@ -154,6 +154,7 @@ export interface AuthCredentialSnapshotEntry {
 
 export type AuthCredentialIfAbsentReason =
 	| "inserted"
+	| "updated-existing"
 	| "skipped-existing"
 	| "skipped-existing-runtime"
 	| "skipped-existing-config"
@@ -210,6 +211,7 @@ export interface AuthCredentialStore {
 	deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
 	getCache(key: string, options?: { includeExpired?: boolean }): string | null;
 	setCache(key: string, value: string, expiresAtSec: number): void;
+	deleteCachePrefix?(prefix: string): void;
 	cleanExpiredCache(): void;
 	/**
 	 * Optional store-supplied OAuth refresh. When present, `AuthStorage` uses
@@ -472,6 +474,7 @@ interface UsageCache {
 	get<T>(key: string): UsageCacheEntry<T> | undefined;
 	getStale<T>(key: string): UsageCacheEntry<T> | undefined;
 	set<T>(key: string, entry: UsageCacheEntry<T>): void;
+	deletePrefix?(prefix: string): void;
 	cleanup?(): void;
 }
 
@@ -662,6 +665,10 @@ class AuthStorageUsageCache implements UsageCache {
 		this.store.setCache(`${USAGE_CACHE_PREFIX}${key}`, payload, Math.floor(durableExpiresAt / 1000));
 	}
 
+	deletePrefix(prefix: string): void {
+		this.store.deleteCachePrefix?.(`${USAGE_CACHE_PREFIX}${prefix}`);
+	}
+
 	cleanup(): void {
 		this.store.cleanExpiredCache();
 	}
@@ -1297,8 +1304,6 @@ export class AuthStorage {
 			return this.#snapshotSkipResult(storageProvider, "skipped-existing-runtime");
 		if (this.#configOverrides.has(storageProvider))
 			return this.#snapshotSkipResult(storageProvider, "skipped-existing-config");
-		if (this.#getCredentialsForProvider(storageProvider).length > 0)
-			return this.#snapshotSkipResult(storageProvider, "skipped-existing");
 		if (getEnvApiKey(storageProvider)) return this.#snapshotSkipResult(storageProvider, "skipped-existing-env");
 		if (this.#fallbackResolver?.(storageProvider))
 			return this.#snapshotSkipResult(storageProvider, "skipped-existing-fallback");
@@ -1311,6 +1316,7 @@ export class AuthStorage {
 			result.entries.map(entry => ({ id: entry.id, credential: entry.credential })),
 		);
 		this.#resetProviderAssignments(storageProvider);
+		if (result.inserted) this.#invalidateUsageCacheForProvider(storageProvider);
 		return {
 			inserted: result.inserted,
 			reason: result.reason,
@@ -1328,6 +1334,13 @@ export class AuthStorage {
 			stored.map(record => ({ id: record.id, credential: record.credential })),
 		);
 		this.#resetProviderAssignments(provider);
+		this.#invalidateUsageCacheForProvider(provider);
+	}
+
+	#invalidateUsageCacheForProvider(provider: string): void {
+		this.#usageRequestInFlight.clear();
+		this.#usageReportsInFlight.clear();
+		this.#usageCache.deletePrefix?.(`report:${provider}:`);
 	}
 
 	/**
@@ -3705,6 +3718,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	#getCacheStmt: Statement;
 	#getCacheIncludingExpiredStmt: Statement;
 	#upsertCacheStmt: Statement;
+	#deleteCachePrefixStmt: Statement;
 	#deleteExpiredCacheStmt: Statement;
 	#closed = false;
 
@@ -3744,6 +3758,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#upsertCacheStmt = this.#db.prepare(
 			"INSERT INTO cache (key, value, expires_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at",
 		);
+		this.#deleteCachePrefixStmt = this.#db.prepare("DELETE FROM cache WHERE substr(key, 1, ?) = ?");
 		this.#deleteExpiredCacheStmt = this.#db.prepare(`DELETE FROM cache WHERE expires_at <= ${SQLITE_NOW_EPOCH}`);
 	}
 
@@ -4102,16 +4117,58 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		}
 
 		const writeIfAbsent = this.#db.transaction(
-			(providerName: string, record: SerializedCredentialRecord): AuthCredentialIfAbsentResult => {
+			(
+				providerName: string,
+				item: AuthCredential,
+				record: SerializedCredentialRecord,
+			): AuthCredentialIfAbsentResult => {
 				const existingRows = this.#listActiveByProviderStmt.all(providerName) as AuthRow[];
-				const existing: StoredAuthCredential[] = [];
+				const existing: Array<{
+					id: number;
+					credential: AuthCredential;
+					identityKey: string | null;
+				}> = [];
 				for (const row of existingRows) {
 					const activeCredential = deserializeCredential(row);
 					if (!activeCredential) continue;
-					existing.push(toStoredAuthCredential(row, activeCredential));
+					existing.push({
+						id: row.id,
+						credential: activeCredential,
+						identityKey: resolveRowCredentialIdentityKey(providerName, row),
+					});
 				}
 				if (existing.length > 0) {
-					return { inserted: false, reason: "skipped-existing", provider: providerName, entries: existing };
+					let targetId: number | null = null;
+					for (const row of existing) {
+						if (!matchesReplacementCredential(providerName, row.credential, row.identityKey, item)) continue;
+						if (targetId === null) {
+							targetId = row.id;
+							this.#updateStmt.run(record.credentialType, record.data, record.identityKey, row.id);
+						} else {
+							this.#deleteStmt.run("replaced by newer credential", row.id);
+						}
+					}
+
+					if (targetId !== null) {
+						return {
+							inserted: true,
+							reason: "updated-existing",
+							provider: providerName,
+							entries: this.listAuthCredentials(providerName),
+						};
+					}
+
+					return {
+						inserted: false,
+						reason: "skipped-existing",
+						provider: providerName,
+						entries: existing.map(row => ({
+							id: row.id,
+							provider: providerName,
+							credential: row.credential,
+							disabledCause: null,
+						})),
+					};
 				}
 
 				this.#insertStmt.get(providerName, record.credentialType, record.data, record.identityKey);
@@ -4124,7 +4181,9 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 			},
 		);
 
-		return writeIfAbsent.immediate(provider, serialized);
+		const result = writeIfAbsent.immediate(provider, credential, serialized);
+		if (result.inserted) this.#purgeSupersededDisabledRows(provider, result.entries);
+		return result;
 	}
 
 	/**
@@ -4221,6 +4280,13 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		}
 	}
 
+	deleteCachePrefix(prefix: string): void {
+		if (prefix.length === 0) return;
+		try {
+			this.#deleteCachePrefixStmt.run(prefix.length, prefix);
+		} catch {}
+	}
+
 	cleanExpiredCache(): void {
 		try {
 			this.#deleteExpiredCacheStmt.run();
@@ -4311,6 +4377,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#getCacheStmt.finalize();
 		this.#getCacheIncludingExpiredStmt.finalize();
 		this.#upsertCacheStmt.finalize();
+		this.#deleteCachePrefixStmt.finalize();
 		this.#deleteExpiredCacheStmt.finalize();
 		this.#db.close();
 	}

package/src/providers/amazon-bedrock.ts

@@ -28,7 +28,7 @@ import type {
 	ToolChoice,
 	ToolResultMessage,
 } from "../types";
-import { normalizeToolCallId, resolveCacheRetention } from "../utils";
+import { normalizeToolCallId, resolveCacheRetention, sanitizeJsonStrings } from "../utils";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { appendRawHttpRequestDumpFor400, type RawHttpRequestDump, withHttpStatus } from "../utils/http-inspector";
 import { parseStreamingJson } from "../utils/json-parse";
@@ -701,7 +701,7 @@ function convertMessages(
 								toolUse: {
 									toolUseId: normalizeToolCallId(c.id),
 									name: c.name,
-									input: c.arguments,
+									input: sanitizeJsonStrings(c.arguments),
 								},
 							});
 							break;

package/src/providers/anthropic-messages-server.ts

@@ -13,6 +13,7 @@ import type {
 	ToolResultMessage,
 	UserMessage,
 } from "../types";
+import { sanitizeJsonStrings } from "../utils";
 import {
 	type AnthropicAssistantContentBlock,
 	type AnthropicMessage,
@@ -433,7 +434,7 @@ function encodeContentBlocks(message: AssistantMessage): Record<string, unknown>
 				blocks.push({ type: "redacted_thinking", data: c.data });
 				break;
 			case "toolCall":
-				blocks.push({ type: "tool_use", id: c.id, name: c.name, input: c.arguments ?? {} });
+				blocks.push({ type: "tool_use", id: c.id, name: c.name, input: sanitizeJsonStrings(c.arguments ?? {}) });
 				break;
 		}
 	}

package/src/providers/anthropic.ts

@@ -53,6 +53,7 @@ import {
 	normalizeSystemPrompts,
 	normalizeToolCallId,
 	resolveCacheRetention,
+	sanitizeJsonStrings,
 } from "../utils";
 import { createAbortSourceTracker } from "../utils/abort";
 import { AssistantMessageEventStream } from "../utils/event-stream";
@@ -2280,8 +2281,6 @@ function buildParams(
 					params.output_config = { effort } as typeof params.output_config;
 				}
 			}
-		} else if (options?.thinkingEnabled === false) {
-			params.thinking = { type: "disabled" };
 		}
 	}
 
@@ -2491,7 +2490,7 @@ export function convertAnthropicMessages(
 						type: "tool_use",
 						id: block.id,
 						name: isOAuthToken ? applyClaudeToolPrefix(block.name) : block.name,
-						input: block.arguments ?? {},
+						input: sanitizeJsonStrings(block.arguments ?? {}),
 					});
 				}
 			}

package/src/providers/google-shared.ts

@@ -18,7 +18,7 @@ import type {
 	Tool,
 	ToolCall,
 } from "../types";
-import { normalizeSystemPrompts } from "../utils";
+import { normalizeSystemPrompts, sanitizeJsonStrings } from "../utils";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { finalizeErrorMessage, type RawHttpRequestDump, withHttpStatus } from "../utils/http-inspector";
 import { normalizeSchemaForCCA, normalizeSchemaForGoogle, toolWireSchema } from "../utils/schema";
@@ -237,7 +237,7 @@ export function convertMessages<T extends GoogleApiType>(model: Model<T>, contex
 					const part: Part = {
 						functionCall: {
 							name: block.name,
-							args: block.arguments ?? {},
+							args: sanitizeJsonStrings(block.arguments ?? {}) as Record<string, unknown>,
 							...(requiresToolCallId(model.id) ? { id: block.id } : {}),
 						},
 					};
@@ -467,7 +467,7 @@ export function pushToolCallEvents(
 	stream.push({
 		type: "toolcall_delta",
 		contentIndex,
-		delta: JSON.stringify(toolCall.arguments),
+		delta: JSON.stringify(sanitizeJsonStrings(toolCall.arguments)),
 		partial: output,
 	});
 	stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });

package/src/providers/openai-chat-server.ts

@@ -19,6 +19,7 @@ import type {
 	ToolResultMessage,
 	TSchema,
 } from "../types";
+import { sanitizeJsonStrings } from "../utils";
 import {
 	type OpenAIChatContentPart,
 	type OpenAIChatMessage,
@@ -453,9 +454,9 @@ function isOnlyRaw(args: Record<string, unknown>): boolean {
 
 function stringifyArgs(args: Record<string, unknown>): string {
 	// `__raw` is our fallback marker for un-parseable inbound args; preserve it verbatim on the way out.
-	if (typeof args.__raw === "string" && isOnlyRaw(args)) return args.__raw;
+	if (typeof args.__raw === "string" && isOnlyRaw(args)) return args.__raw.toWellFormed();
 	try {
-		return JSON.stringify(args);
+		return JSON.stringify(sanitizeJsonStrings(args));
 	} catch {
 		return "{}";
 	}

package/src/providers/openai-codex/request-transformer.ts

@@ -1,6 +1,7 @@
 import type { Effort } from "../../model-thinking";
 import { requireSupportedEffort } from "../../model-thinking";
 import type { Api, Model } from "../../types";
+import { sanitizeJsonStrings } from "../../utils";
 
 export interface ReasoningConfig {
 	effort: "none" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
@@ -109,6 +110,10 @@ function normalizeInputTextPartFields(input: InputItem[] | undefined): InputItem
 		}
 		if (normalizedItem.type === "message") {
 			normalizedItem.content = normalizeTextPartFields(normalizedItem.content, `input[${itemIndex}].content`);
+		} else if (normalizedItem.type === "function_call" && "arguments" in itemRecord) {
+			itemRecord.arguments = sanitizeJsonStrings(itemRecord.arguments);
+		} else if (normalizedItem.type === "custom_tool_call" && typeof itemRecord.input === "string") {
+			itemRecord.input = itemRecord.input.toWellFormed();
 		}
 		return normalizedItem;
 	});

package/src/providers/openai-completions.ts

@@ -35,7 +35,7 @@ import {
 	type ToolChoice,
 	type ToolResultMessage,
 } from "../types";
-import { normalizeSystemPrompts } from "../utils";
+import { normalizeSystemPrompts, sanitizeJsonStrings } from "../utils";
 import { createAbortSourceTracker } from "../utils/abort";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { toFirepassWireModelId, toFireworksWireModelId } from "../utils/fireworks-model-id";
@@ -166,7 +166,7 @@ function normalizeStreamingContentText(content: unknown): string {
 function serializeToolArguments(value: unknown): string {
 	if (value && typeof value === "object" && !Array.isArray(value)) {
 		try {
-			return JSON.stringify(value);
+			return JSON.stringify(sanitizeJsonStrings(value));
 		} catch {
 			return "{}";
 		}
@@ -178,7 +178,7 @@ function serializeToolArguments(value: unknown): string {
 		try {
 			const parsed = JSON.parse(trimmed);
 			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-				return JSON.stringify(parsed);
+				return JSON.stringify(sanitizeJsonStrings(parsed));
 			}
 		} catch {}
 		return "{}";

package/src/providers/openai-responses-server.ts

@@ -22,6 +22,7 @@ import type {
 	Tool,
 	ToolCall,
 } from "../types";
+import { sanitizeJsonStrings } from "../utils";
 import {
 	type OpenAIResponsesFunctionCallItem,
 	type OpenAIResponsesFunctionCallOutputItem,
@@ -612,7 +613,8 @@ function buildOutputItems(message: AssistantMessage): OutputItem[] {
 		} else if (part.type === "toolCall") {
 			flushMessage();
 			if (part.customWireName) {
-				const rawInput = typeof part.arguments?.input === "string" ? (part.arguments.input as string) : "";
+				const rawInput =
+					typeof part.arguments?.input === "string" ? (part.arguments.input as string).toWellFormed() : "";
 				out.push({
 					type: "custom_tool_call",
 					id: part.thoughtSignature ?? makeCustomCallId(),
@@ -627,7 +629,7 @@ function buildOutputItems(message: AssistantMessage): OutputItem[] {
 					id: part.thoughtSignature ?? makeFuncCallId(),
 					call_id: part.id,
 					name: part.name,
-					arguments: JSON.stringify(part.arguments ?? {}),
+					arguments: JSON.stringify(sanitizeJsonStrings(part.arguments ?? {})),
 					status: "completed",
 				});
 			}
@@ -1085,7 +1087,8 @@ export function encodeStream(
 							} else {
 								// Standard JSON tool: arguments object on the gjc side, the
 								// wire wants the JSON string the model emitted (= streamed deltas).
-								const argsJson = cur.argsText || JSON.stringify(tc.arguments ?? {});
+								const argsJson =
+									cur.argsText.toWellFormed() || JSON.stringify(sanitizeJsonStrings(tc.arguments ?? {}));
 								cur.argsText = argsJson;
 								emit("response.function_call_arguments.done", {
 									item_id: cur.itemId,

package/src/providers/openai-responses-shared.ts

@@ -28,7 +28,7 @@ import {
 	type ToolCall,
 	type ToolResultMessage,
 } from "../types";
-import { normalizeResponsesToolCallId } from "../utils";
+import { normalizeResponsesToolCallId, sanitizeJsonStrings } from "../utils";
 import type { AssistantMessageEventStream } from "../utils/event-stream";
 import { isCompleteJson, parseStreamingJson } from "../utils/json-parse";
 import { joinTextWithImagePlaceholder, NON_VISION_IMAGE_PLACEHOLDER, partitionVisionContent } from "./vision-guard";
@@ -275,7 +275,7 @@ export function convertResponsesAssistantMessage<TApi extends Api>(
 		}
 		knownCallIds.add(normalized.callId);
 		if (block.customWireName) {
-			const rawInput = typeof block.arguments?.input === "string" ? block.arguments.input : "";
+			const rawInput = typeof block.arguments?.input === "string" ? block.arguments.input.toWellFormed() : "";
 			customCallIds?.add(normalized.callId);
 			outputItems.push({
 				type: "custom_tool_call",
@@ -291,7 +291,7 @@ export function convertResponsesAssistantMessage<TApi extends Api>(
 			id: itemId,
 			call_id: normalized.callId,
 			name: block.name,
-			arguments: JSON.stringify(block.arguments),
+			arguments: JSON.stringify(sanitizeJsonStrings(block.arguments ?? {})),
 		});
 	}
 

package/src/utils.ts

@@ -11,6 +11,34 @@ export function normalizeSystemPrompts(systemPrompt: readonly string[] | string
 	return prompts.map(prompt => prompt.toWellFormed()).filter(prompt => prompt.length > 0);
 }
 
+export function sanitizeJsonStrings(value: unknown): unknown {
+	return sanitizeJsonStringsInner(value, new WeakMap<object, unknown>());
+}
+
+function sanitizeJsonStringsInner(value: unknown, seen: WeakMap<object, unknown>): unknown {
+	if (typeof value === "string") return value.toWellFormed();
+	if (!value || typeof value !== "object") return value;
+
+	const cached = seen.get(value);
+	if (cached !== undefined) return cached;
+
+	if (Array.isArray(value)) {
+		const sanitized: unknown[] = [];
+		seen.set(value, sanitized);
+		for (const item of value) {
+			sanitized.push(sanitizeJsonStringsInner(item, seen));
+		}
+		return sanitized;
+	}
+
+	const sanitized: Record<string, unknown> = {};
+	seen.set(value, sanitized);
+	for (const [key, nestedValue] of Object.entries(value)) {
+		sanitized[key.toWellFormed()] = sanitizeJsonStringsInner(nestedValue, seen);
+	}
+	return sanitized;
+}
+
 export function toNumber(value: unknown): number | undefined {
 	if (typeof value === "number" && Number.isFinite(value)) return value;
 	if (typeof value === "string" && value.trim()) {