@iislee/opencodex 2.11.0 → 2.31.0

package/src/server/responses/terminal-guard.ts

@@ -117,7 +117,7 @@ export function analyzeTerminalTurn(parsed: OcxParsedRequest, events: readonly A
   return { decision: "continue", reason: "suspicious_no_tool", assistantText: text, userText, hasToolCall };
 }
 
-function assistantMessageFromEvents(events: readonly AdapterEvent[]): OcxAssistantMessage | undefined {
+function assistantMessageFromEvents(events: readonly AdapterEvent[], timestamp: number): OcxAssistantMessage | undefined {
   let text = "";
   let thinking = "";
   let signature: string | undefined;
@@ -134,14 +134,18 @@ function assistantMessageFromEvents(events: readonly AdapterEvent[]): OcxAssista
   }
   if (text) content.push({ type: "text", text });
   if (content.length === 0) return undefined;
-  return { role: "assistant", content, timestamp: Date.now() };
+  return { role: "assistant", content, timestamp };
 }
 
 export function buildContinuationRequest(parsed: OcxParsedRequest, events: readonly AdapterEvent[]): OcxParsedRequest {
   const messages = [...parsed.context.messages];
-  const assistant = assistantMessageFromEvents(events);
+  // One clock read for the whole rebuild. Two Date.now() calls could straddle a millisecond
+  // boundary, which made the retained-heartbeat contract test fail intermittently in CI on a
+  // 1ms skew between the assistant message and the nudge that follows it.
+  const timestamp = Date.now();
+  const assistant = assistantMessageFromEvents(events, timestamp);
   if (assistant) messages.push(assistant);
-  messages.push({ role: "developer", content: TERMINAL_GUARD_NUDGE, timestamp: Date.now() });
+  messages.push({ role: "developer", content: TERMINAL_GUARD_NUDGE, timestamp });
   return { ...parsed, context: { ...parsed.context, messages } };
 }
 
@@ -153,6 +157,16 @@ export interface GuardedEventStreamOptions {
   maxAutoContinuations?: number;
 }
 
+/**
+ * Events that are useful to the downstream stream consumer but carry no state used by the
+ * terminal-continuation decision or its rebuilt request. Keep them out of the retained event
+ * list so adapter liveness markers and arbitrarily large tool-argument fragments cannot make
+ * the guard's per-turn memory grow without adding any continuation semantics.
+ */
+export function isTerminalGuardPassthroughOnly(event: AdapterEvent): boolean {
+  return event.type === "heartbeat" || event.type === "tool_call_delta";
+}
+
 function mergeUsage(first: OcxUsage | undefined, second: OcxUsage | undefined): OcxUsage | undefined {
   if (!first) return second;
   if (!second) return first;
@@ -193,9 +207,16 @@ export async function* guardTerminalEventStream(options: GuardedEventStreamOptio
     const seen: AdapterEvent[] = [];
     let terminalSeen = false;
     for await (const event of source) {
+      // Liveness markers and tool argument fragments are passed through to the bridge, but
+      // neither analyzeTerminalTurn nor buildContinuationRequest consumes them. Retaining the
+      // fragments would duplicate arbitrarily large argument payloads in `seen` for no effect.
+      if (isTerminalGuardPassthroughOnly(event)) {
+        yield event;
+        continue;
+      }
       if (event.type === "done") {
         terminalSeen = true;
-        const analysis = options.adapterName === "anthropic"
+        const analysis = (options.adapterName === "anthropic" || options.adapterName === "openai-chat")
           ? analyzeTerminalTurn(parsed, seen)
           : { decision: "pass" as const };
         const normalStop = event.stopReason !== "max_tokens" && event.stopReason !== "content_filter";

package/src/server/responses/upstream-error.ts

@@ -5,7 +5,12 @@
  * #553 looking for an adapter URL bug that does not exist. Name the likely cause and the
  * command that settles it.
  */
+import { RequestPacingQueueOverloadError } from "../../providers/request-pacing";
+
 export function describeUpstreamConnectFailure(err: unknown, connectMs: number): string {
+  // Local pacing admission is not a transport failure. Let the outer response boundary
+  // preserve its retryable 429 identity instead of laundering it into a 502.
+  if (err instanceof RequestPacingQueueOverloadError) throw err;
   if (err instanceof Error && err.name === "TimeoutError") {
     return `Provider connect timeout after ${connectMs}ms`;
   }

package/src/server/responses/ws-upstream.ts

@@ -0,0 +1,308 @@
+// Upstream WebSocket transport for the ChatGPT Codex backend.
+//
+// Why this exists: the Codex backend serves the responses_websockets path from
+// a measurably faster queue than the plain SSE POST path. Measured 2026-08-12
+// KST (same account, same payload, strictly sequential): gpt-5.6-luna TTFT p50
+// ~1.0s over WS vs ~3.9s over SSE. Codex CLI itself defaults to the WS
+// transport; opencodex previously always POSTed SSE, which is where its extra
+// 2-3s of TTFT came from.
+//
+// The wrapper only swaps the transport. It dials wss:// with the same headers,
+// sends the JSON body as a single `response.create` frame, and re-encodes the
+// returned event frames as an SSE byte stream, so every downstream consumer
+// (passthrough relay, adapter parsers, usage sniffing) is unchanged.
+
+import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
+import { compareBunVersions } from "../../lib/bun-stream-caps";
+
+const CODEX_RESPONSES_HTTP_URL = "https://chatgpt.com/backend-api/codex/responses";
+const CODEX_RESPONSES_WS_URL = "wss://chatgpt.com/backend-api/codex/responses";
+const WS_BETA = "responses_websockets=2026-02-06";
+// If the 101 never arrives (network black hole), give SSE a chance well before
+// the caller's connect timeout (default 200s) would fire.
+const UPGRADE_DEADLINE_MS = 10_000;
+// Keep the push-based WS transport inside the same memory envelope as the
+// bounded SSE relays that consume this response. Unlike fetch response bodies,
+// a WebSocket cannot be paused when a ReadableStream applies backpressure, so
+// an upstream that outruns the consumer must be disconnected.
+export const MAX_CODEX_WS_FRAME_BYTES = MAX_CLIENT_SSE_FRAME_BYTES;
+export const MAX_CODEX_WS_QUEUE_BYTES = 8 * 1024 * 1024;
+export const MIN_BOUNDED_CODEX_WS_BUN_VERSION = "1.4.0";
+
+export type BunRuntimeIdentity = {
+  version: string;
+  versionWithSha: string;
+};
+
+export type BunRuntimeGateInput = string | BunRuntimeIdentity;
+
+const codexWsUpstreamResponses = new WeakSet<Response>();
+
+/** True only for a successful Codex WebSocket upgrade, never an HTTP fallback. */
+export function isCodexWsUpstreamResponse(response: Response): boolean {
+  return codexWsUpstreamResponses.has(response);
+}
+
+export function currentBunRuntimeIdentity(): BunRuntimeIdentity {
+  return {
+    version: Bun.version,
+    versionWithSha: Bun.version_with_sha,
+  };
+}
+
+function boundedRelayVersion(input: BunRuntimeGateInput): string | null {
+  if (typeof input === "string") return input.trim() || null;
+  const numericVersion = input.version.trim();
+  const numericMatch = /^(\d+\.\d+\.\d+)$/.exec(numericVersion);
+  const detailedMatch = /^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\s+\([0-9a-fA-F]+\)$/.exec(
+    input.versionWithSha.trim(),
+  );
+  if (!numericMatch || !detailedMatch) return null;
+  const detailedNumeric = /^(\d+\.\d+\.\d+)/.exec(detailedMatch[1])?.[1];
+  return detailedNumeric === numericMatch[1] ? detailedMatch[1] : null;
+}
+
+/**
+ * Bun 1.3.14 does not propagate a stalled HTTP response socket back to a JS
+ * ReadableStream producer on Windows. A real raw-TCP slow-client probe drained
+ * the entire upstream despite the eager relay queue; Bun 1.4.0-canary.1 stopped
+ * below one MiB. Prereleases still fail closed; release builds before 1.4.0
+ * fall back to HTTP SSE.
+ */
+export function bunSupportsBoundedCodexWsRelay(
+  runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
+): boolean {
+  const version = boundedRelayVersion(runtime);
+  if (!version) return false;
+  if (/^\d+\.\d+\.\d+-/.test(version.trim())) return false;
+  const comparison = compareBunVersions(version, MIN_BOUNDED_CODEX_WS_BUN_VERSION);
+  return comparison !== null && comparison >= 0;
+}
+
+export function shouldUseCodexWsUpstream(
+  url: string,
+  init?: RequestInit,
+  runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
+): boolean {
+  if (!bunSupportsBoundedCodexWsRelay(runtime)) return false;
+  if (url !== CODEX_RESPONSES_HTTP_URL) return false;
+  if ((init?.method ?? "GET").toUpperCase() !== "POST") return false;
+  const body = init?.body;
+  if (typeof body !== "string") return false;
+  // Only root-level stream:true selects WS: JSON-mode calls keep the HTTP path
+  // because the WS path only speaks the event protocol, and a nested
+  // {"metadata":{"stream":true}} must not flip the transport. Parsing (not
+  // substring matching) also keeps whitespace-formatted bodies routable.
+  try {
+    const parsed = JSON.parse(body) as unknown;
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+      && (parsed as Record<string, unknown>).stream === true;
+  } catch {
+    return false;
+  }
+}
+
+export function codexWsUpstreamFetch(
+  url: string,
+  init: RequestInit,
+  sseFallback: typeof globalThis.fetch,
+  runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
+): Promise<Response> {
+  if (!bunSupportsBoundedCodexWsRelay(runtime)) {
+    return sseFallback(url, init);
+  }
+  const signal = init.signal ?? undefined;
+  if (signal?.aborted) {
+    return Promise.reject(signal.reason ?? new DOMException("The operation was aborted.", "AbortError"));
+  }
+
+  let frameText: string;
+  try {
+    const body = JSON.parse(init.body as string) as Record<string, unknown>;
+    // The WS create frame is implicitly streaming; the backend rejects the
+    // HTTP-only `stream` flag inside a frame.
+    delete body.stream;
+    frameText = JSON.stringify({ ...body, type: "response.create" });
+  } catch {
+    return sseFallback(url, init);
+  }
+
+  const headers: Record<string, string> = {};
+  new Headers(init.headers ?? {}).forEach((value, key) => {
+    // HTTP-body framing headers do not apply to a WS handshake.
+    if (key === "content-type" || key === "content-length" || key === "accept" || key === "accept-encoding") return;
+    headers[key] = value;
+  });
+  headers["openai-beta"] = headers["openai-beta"]
+    ? headers["openai-beta"].includes("responses_websockets")
+      ? headers["openai-beta"]
+      : `${headers["openai-beta"]}, ${WS_BETA}`
+    : WS_BETA;
+  // A genuine caller `originator` is already in these headers via the forward
+  // set. Never fabricate one here: pool/forward traffic must not impersonate
+  // Codex CLI, per the metadata-integrity contract. (The backend's fast lane
+  // keys on WS + originator, so callers without the tag simply keep their own
+  // provenance and scheduling.)
+
+  return new Promise<Response>((resolve, reject) => {
+    let ws: WebSocket;
+    try {
+      // Bun accepts per-handshake headers; the DOM lib types only list protocol arrays.
+      ws = new WebSocket(CODEX_RESPONSES_WS_URL, { headers } as unknown as string[]);
+    } catch {
+      resolve(sseFallback(url, init));
+      return;
+    }
+
+    let opened = false;
+    let settledPreOpen = false;
+    let terminal = false;
+    let controller: ReadableStreamDefaultController<Uint8Array> | null = null;
+    const encoder = new TextEncoder();
+
+    const failStream = (message: string) => {
+      if (terminal) return;
+      terminal = true;
+      try { controller?.error(new Error(message)); } catch { /* stream already done */ }
+      try { ws.close(); } catch { /* already closing */ }
+    };
+
+    const upgradeTimer = setTimeout(() => {
+      if (opened || settledPreOpen) return;
+      settledPreOpen = true;
+      try { ws.close(); } catch { /* already closing */ }
+      resolve(sseFallback(url, init));
+    }, UPGRADE_DEADLINE_MS);
+
+    const onAbort = () => {
+      if (!opened) {
+        if (settledPreOpen) return;
+        // Settle BEFORE close(): the close handler treats a pre-open close as
+        // an upgrade rejection and would dial the SSE fallback for a request
+        // the caller just cancelled.
+        settledPreOpen = true;
+        clearTimeout(upgradeTimer);
+        try { ws.close(); } catch { /* already closing */ }
+        reject(signal?.reason ?? new DOMException("The operation was aborted.", "AbortError"));
+        return;
+      }
+      if (controller && !terminal) {
+        terminal = true;
+        // Mirror an aborted fetch: the body read rejects with the abort reason.
+        try { controller.error(signal?.reason ?? new DOMException("The operation was aborted.", "AbortError")); } catch { /* stream already done */ }
+      }
+      // Error the body before close(): test doubles and some runtimes dispatch
+      // close synchronously, and the caller's abort reason must stay authoritative.
+      try { ws.close(); } catch { /* already closing */ }
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+
+    ws.addEventListener("open", () => {
+      if (settledPreOpen) return;
+      clearTimeout(upgradeTimer);
+      try {
+        ws.send(frameText);
+      } catch {
+        // send() throwing means the frame never left, so no upstream turn
+        // started and the SSE resend cannot double-generate. Falling back
+        // (instead of erroring a synthetic 200 body) keeps the pre-stream
+        // HTTP error/refresh/failover machinery in charge.
+        settledPreOpen = true;
+        try { ws.close(); } catch { /* already closing */ }
+        resolve(sseFallback(url, init));
+        return;
+      }
+      opened = true;
+      const stream = new ReadableStream<Uint8Array>({
+        start(c) { controller = c; },
+        cancel() { try { ws.close(); } catch { /* already closing */ } },
+      }, new ByteLengthQueuingStrategy({ highWaterMark: MAX_CODEX_WS_QUEUE_BYTES }));
+      const response = new Response(stream, {
+        status: 200,
+        // The 101 response headers (x-codex-*-reset-at quota hints) are not
+        // exposed by Bun's WebSocket; the periodic quota poller covers those.
+        headers: { "content-type": "text/event-stream; charset=utf-8" },
+      });
+      codexWsUpstreamResponses.add(response);
+      resolve(response);
+    });
+
+    ws.addEventListener("message", (event) => {
+      if (!controller || terminal) return;
+      const text = typeof event.data === "string" ? event.data : "";
+      if (!text) return;
+      // UTF-8 byte length is always at least the JS string length. Reject this
+      // cheap lower bound before parsing so an obviously oversized frame does
+      // not create another large object graph.
+      if (text.length > MAX_CODEX_WS_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      const encodedText = encoder.encode(text);
+      if (encodedText.byteLength > MAX_CODEX_WS_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      let type: unknown;
+      try { type = (JSON.parse(text) as { type?: unknown }).type; } catch { return; }
+      if (typeof type !== "string") return;
+      // Relay only the event surface the SSE path produces today. WS-only
+      // frames (codex.rate_limits, responsesapi.websocket_timing) are dropped
+      // so downstream clients see exactly the stream shape they always got.
+      if (!type.startsWith("response.") && type !== "error") return;
+      const prefix = encoder.encode(`event: ${type}\ndata: `);
+      const suffix = encoder.encode("\n\n");
+      const frameBytes = prefix.byteLength + encodedText.byteLength + suffix.byteLength;
+      if (frameBytes > MAX_CLIENT_SSE_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      const availableBytes = controller.desiredSize ?? 0;
+      if (frameBytes > availableBytes) {
+        failStream("codex websocket response exceeded the buffered queue limit");
+        return;
+      }
+      const sseFrame = new Uint8Array(frameBytes);
+      sseFrame.set(prefix);
+      sseFrame.set(encodedText, prefix.byteLength);
+      sseFrame.set(suffix, prefix.byteLength + encodedText.byteLength);
+      try {
+        controller.enqueue(sseFrame);
+      } catch {
+        failStream("codex websocket response stream closed while enqueueing");
+        return;
+      }
+      if (type === "response.completed" || type === "response.failed" || type === "response.incomplete" || type === "error") {
+        terminal = true;
+        try { controller.close(); } catch { /* already closed */ }
+        try { ws.close(); } catch { /* already closing */ }
+      }
+    });
+
+    ws.addEventListener("close", () => {
+      signal?.removeEventListener("abort", onAbort);
+      if (!opened) {
+        if (settledPreOpen) return;
+        settledPreOpen = true;
+        clearTimeout(upgradeTimer);
+        // Upgrade rejected (401/403/429/5xx). Retry over plain SSE so the real
+        // HTTP status reaches the existing refresh/rotation handlers. No turn
+        // started upstream, so the resend cannot double-generate.
+        resolve(sseFallback(url, init));
+        return;
+      }
+      if (controller && !terminal) {
+        terminal = true;
+        // Connection dropped before a Responses terminal event. A clean EOF
+        // here would reach clients with no response.completed/failed at all —
+        // relaySseWithFailedTail() only synthesizes a failed terminal when the
+        // body read THROWS. Error the stream like a reset TCP socket.
+        try { controller.error(new Error("codex websocket closed before a Responses terminal event")); } catch { /* stream already done */ }
+      }
+    });
+
+    ws.addEventListener("error", () => {
+      /* Bun always follows error with close; the close handler settles. */
+    });
+  });
+}

package/src/server/responses-custom-tool-repair.ts

@@ -0,0 +1,282 @@
+import type { TranslatorBudget } from "../lib/translator-budget";
+import {
+  customToolItemId,
+  restoreRoutedCustomCalls,
+  routedCustomToolWireName,
+  unwrapRoutedCustomToolArguments,
+} from "../responses/custom-tool-compat";
+import {
+  replaceSseDataPayload,
+  sseDataPayload,
+  type SseBlockRewrite,
+} from "./sse-payload-rewrite";
+
+/** Exact compact prefix used by our upstream rewriter; progressive matching also
+ *  tolerates insignificant JSON whitespace via FREEFORM_WRAP_PREFIX_RE. */
+const FREEFORM_WRAP_PREFIX = '{"input":"';
+const FREEFORM_WRAP_PREFIX_RE = /^\s*\{\s*"input"\s*:\s*"/;
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * Progressive decode of the freeform `{ "input": "…" }` wrapper.
+ * Returns null when the accumulated text does not (yet) match that wrapper so
+ * callers suppress deltas and rely on `response.custom_tool_call_input.done`.
+ */
+function partialCustomToolInput(argumentsText: string): string | null {
+  const match = FREEFORM_WRAP_PREFIX_RE.exec(argumentsText);
+  if (!match) return null;
+  const body = argumentsText.slice(match[0]!.length);
+  let output = "";
+  for (let index = 0; index < body.length; index++) {
+    const char = body[index];
+    if (char === '"') break;
+    if (char !== "\\") {
+      output += char;
+      continue;
+    }
+    const escaped = body[index + 1];
+    if (escaped === undefined) break;
+    index += 1;
+    if (escaped === "n") output += "\n";
+    else if (escaped === "t") output += "\t";
+    else if (escaped === "r") output += "\r";
+    else if (escaped === "b") output += "\b";
+    else if (escaped === "f") output += "\f";
+    else if (escaped === "u") {
+      const hex = body.slice(index + 1, index + 5);
+      if (hex.length !== 4 || !/^[0-9a-fA-F]{4}$/.test(hex)) break;
+      output += String.fromCharCode(Number.parseInt(hex, 16));
+      index += 4;
+    } else output += escaped;
+  }
+  return output;
+}
+
+function replaceSseEventName(block: string, type: string): string {
+  const newline = block.includes("\r\n") ? "\r\n" : "\n";
+  const lines = block.split(/\r?\n/);
+  let replaced = false;
+  const next = lines.map(line => {
+    if (!replaced && line.startsWith("event:")) {
+      replaced = true;
+      return `event: ${type}`;
+    }
+    return line;
+  });
+  return next.join(newline);
+}
+
+type OpenCustomCall = {
+  argumentsText: string;
+  emittedInput: string;
+  retainedBytes: number;
+};
+
+type PendingArgumentBlock = {
+  block: string;
+  itemId?: string;
+  outputIndex?: number;
+  retainedBytes: number;
+};
+
+export function createRoutedCustomToolRestoreBlockRewrite(
+  names: ReadonlySet<string>,
+  budget?: TranslatorBudget,
+): SseBlockRewrite {
+  const itemNames = new Map<string, string>();
+  const ordinaryItemIds = new Set<string>();
+  const openCalls = new Map<string, OpenCustomCall>();
+  let pendingArguments: PendingArgumentBlock[] = [];
+  let disposed = false;
+
+  const releaseCall = (itemId: string): void => {
+    const open = openCalls.get(itemId);
+    if (!open) return;
+    if (open.retainedBytes > 0) {
+      budget?.releaseRetained(open.retainedBytes, { kind: "retained_collectors" });
+    }
+    openCalls.delete(itemId);
+  };
+
+  const releaseAll = (): void => {
+    if (disposed) return;
+    disposed = true;
+    for (const itemId of openCalls.keys()) releaseCall(itemId);
+    const pendingBytes = pendingArguments.reduce((total, pending) => total + pending.retainedBytes, 0);
+    if (pendingBytes > 0) {
+      budget?.releaseRetained(pendingBytes, { kind: "retained_collectors" });
+    }
+    pendingArguments = [];
+    itemNames.clear();
+    ordinaryItemIds.clear();
+  };
+
+  const retainPendingArgument = (
+    block: string,
+    itemId: string | undefined,
+    outputIndex: number | undefined,
+  ): void => {
+    const retainedBytes = Buffer.byteLength(block, "utf8");
+    if (retainedBytes > 0) budget?.chargeRetained(retainedBytes, { kind: "retained_collectors" });
+    pendingArguments.push({ block, itemId, outputIndex, retainedBytes });
+  };
+
+  const takePendingArguments = (
+    itemId: string | undefined,
+    outputIndex: number | undefined,
+  ): string[] => {
+    const matched: PendingArgumentBlock[] = [];
+    const remaining: PendingArgumentBlock[] = [];
+    for (const pending of pendingArguments) {
+      const matches = pending.itemId !== undefined
+        ? itemId !== undefined && pending.itemId === itemId
+        : outputIndex !== undefined && pending.outputIndex === outputIndex;
+      (matches ? matched : remaining).push(pending);
+    }
+    pendingArguments = remaining;
+    const retainedBytes = matched.reduce((total, pending) => total + pending.retainedBytes, 0);
+    if (retainedBytes > 0) {
+      budget?.releaseRetained(retainedBytes, { kind: "retained_collectors" });
+    }
+    // Index-matched entries carry no item id. Stamp the resolved id so replay
+    // classifies the event instead of buffering it a second time.
+    return matched.map(pending => {
+      if (pending.itemId !== undefined || itemId === undefined) return pending.block;
+      const payload = sseDataPayload(pending.block);
+      if (payload === null) return pending.block;
+      try {
+        const parsed: unknown = JSON.parse(payload);
+        if (!isPlainObject(parsed)) return pending.block;
+        return replaceSseDataPayload(pending.block, JSON.stringify({ ...parsed, item_id: itemId }));
+      } catch {
+        return pending.block;
+      }
+    });
+  };
+
+  const rewrite: SseBlockRewrite = (block: string): readonly string[] => {
+    if (disposed) return [block];
+    const payload = sseDataPayload(block);
+    if (payload === null || payload === "[DONE]") return [block];
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    if (!isPlainObject(parsed)) return [block];
+
+    const type = typeof parsed.type === "string" ? parsed.type : "";
+    const outputIndex = typeof parsed.output_index === "number"
+      && Number.isInteger(parsed.output_index)
+      && parsed.output_index >= 0
+      ? parsed.output_index
+      : undefined;
+    if (
+      (type === "response.output_item.added" || type === "response.output_item.done")
+      && isPlainObject(parsed.item)
+      && parsed.item.type === "function_call"
+      && typeof parsed.item.name === "string"
+    ) {
+      const upstreamItemId = typeof parsed.item.id === "string" ? parsed.item.id : undefined;
+      const wireName = routedCustomToolWireName(parsed.item);
+      const routed = wireName !== undefined && names.has(wireName);
+      if (upstreamItemId) {
+        if (routed) {
+          itemNames.set(upstreamItemId, parsed.item.name);
+          ordinaryItemIds.delete(upstreamItemId);
+        } else {
+          ordinaryItemIds.add(upstreamItemId);
+        }
+        if (routed && type === "response.output_item.added") {
+          openCalls.set(upstreamItemId, { argumentsText: "", emittedInput: "", retainedBytes: 0 });
+        }
+      }
+      const pending = takePendingArguments(upstreamItemId, outputIndex);
+      if (!routed) {
+        if (type === "response.output_item.done" && upstreamItemId) ordinaryItemIds.delete(upstreamItemId);
+        return [...pending, block];
+      }
+      if (upstreamItemId && pending.length > 0 && !openCalls.has(upstreamItemId)) {
+        openCalls.set(upstreamItemId, { argumentsText: "", emittedInput: "", retainedBytes: 0 });
+      }
+      const restored = restoreRoutedCustomCalls(parsed, names);
+      const restoredBlock = restored.changed
+        ? replaceSseDataPayload(block, JSON.stringify(restored.value))
+        : block;
+      const replayed = pending.flatMap(pendingBlock => rewrite(pendingBlock));
+      if (type === "response.output_item.done" && upstreamItemId) releaseCall(upstreamItemId);
+      return type === "response.output_item.added"
+        ? [restoredBlock, ...replayed]
+        : [...replayed, restoredBlock];
+    }
+
+    const upstreamItemId = typeof parsed.item_id === "string" ? parsed.item_id : undefined;
+    const argumentEvent = type === "response.function_call_arguments.delta"
+      || type === "response.function_call_arguments.done";
+    if (argumentEvent && (!upstreamItemId || (!itemNames.has(upstreamItemId) && !ordinaryItemIds.has(upstreamItemId)))) {
+      retainPendingArgument(block, upstreamItemId, outputIndex);
+      return [];
+    }
+    if (
+      type === "response.function_call_arguments.delta"
+      && upstreamItemId
+      && itemNames.has(upstreamItemId)
+    ) {
+      const open = openCalls.get(upstreamItemId) ?? { argumentsText: "", emittedInput: "", retainedBytes: 0 };
+      const delta = typeof parsed.delta === "string" ? parsed.delta : "";
+      const deltaBytes = Buffer.byteLength(delta, "utf8");
+      if (deltaBytes > 0) budget?.chargeRetained(deltaBytes, { kind: "retained_collectors" });
+      open.argumentsText += delta;
+      open.retainedBytes += deltaBytes;
+      openCalls.set(upstreamItemId, open);
+      // Still accumulating toward the compact wrapper, or an unrecognized shape:
+      // suppress progressive emission and let the done event carry input.
+      if (FREEFORM_WRAP_PREFIX.startsWith(open.argumentsText)) return [];
+      const fullInput = partialCustomToolInput(open.argumentsText);
+      if (fullInput === null) return [];
+      if (!fullInput.startsWith(open.emittedInput) || fullInput.length === open.emittedInput.length) return [];
+      const inputDelta = fullInput.slice(open.emittedInput.length);
+      open.emittedInput = fullInput;
+      const nextType = "response.custom_tool_call_input.delta";
+      const next = {
+        ...parsed,
+        type: nextType,
+        item_id: customToolItemId(upstreamItemId),
+        delta: inputDelta,
+      };
+      return [replaceSseDataPayload(replaceSseEventName(block, nextType), JSON.stringify(next))];
+    }
+
+    if (
+      type === "response.function_call_arguments.done"
+      && upstreamItemId
+      && itemNames.has(upstreamItemId)
+    ) {
+      const nextType = "response.custom_tool_call_input.done";
+      const source = typeof parsed.arguments === "string"
+        ? parsed.arguments
+        : openCalls.get(upstreamItemId)?.argumentsText ?? "";
+      const { arguments: _arguments, ...rest } = parsed;
+      const next = {
+        ...rest,
+        type: nextType,
+        item_id: customToolItemId(upstreamItemId),
+        input: unwrapRoutedCustomToolArguments(source),
+      };
+      return [replaceSseDataPayload(replaceSseEventName(block, nextType), JSON.stringify(next))];
+    }
+
+    const restored = restoreRoutedCustomCalls(parsed, names);
+    const terminal = type === "response.completed" || type === "response.failed" || type === "response.incomplete";
+    if (terminal) releaseAll();
+    return restored.changed
+      ? [replaceSseDataPayload(block, JSON.stringify(restored.value))]
+      : [block];
+  };
+  rewrite.dispose = releaseAll;
+  return rewrite;
+}