@iislee/opencodex 2.31.0 → 2.35.0

package/src/providers/slug-codec.ts

@@ -101,3 +101,55 @@ export function slugEquivalenceKey(slug: string): string {
 export function slugsEquivalent(a: string, b: string): boolean {
   return a === b || slugEquivalenceKey(a) === slugEquivalenceKey(b);
 }
+
+/**
+ * Resolve one config selection against a provider's known native ids (#2491).
+ *
+ * `slugEquivalenceKey` is deliberately lossy — the Codex one-slash rule forces `a/b` and
+ * `a-b` onto the same encoded form — so a selection written in either spelling matches BOTH
+ * when a provider publishes both. Filtering and persisted sync share that key, which keeps
+ * them consistent with each other but silently over-grants.
+ *
+ * This resolver keeps the tolerant behaviour (a selection still matches through either
+ * spelling, and an id absent from an incomplete live roster still resolves) while reporting
+ * whether the match was EXACT or merely equivalent. A caller that can afford to be strict —
+ * one holding a complete known-id set — can then prefer the exact row instead of granting the
+ * whole collision class.
+ *
+ * Returning the ambiguity rather than resolving it is deliberate: the roster is an incomplete
+ * dictionary, so silently narrowing to the exact spelling would hide a published id whenever
+ * discovery omitted it. The caller owns that tradeoff because only the caller knows whether
+ * its id set is complete.
+ */
+export interface SlugSelectionMatch {
+  /** Native ids this selection admits. */
+  readonly matched: readonly string[];
+  /** The id whose raw form the selection names exactly, when one exists. */
+  readonly exact: string | undefined;
+  /** True when more than one known id shares the selection's encoded form. */
+  readonly ambiguous: boolean;
+}
+
+export function resolveSlugSelection(
+  provider: string,
+  selection: string,
+  knownIds: Iterable<string>,
+): SlugSelectionMatch {
+  // A slash in the selection is ambiguous on its own: `p/a-b` is provider-qualified, while
+  // `a/b` is a bare NATIVE id that happens to contain a slash. Treating every slash-bearing
+  // selection as provider-qualified made `a/b` resolve against provider "a", so the same
+  // collision reported ambiguous through the dash spelling and unambiguous through the slash
+  // spelling — the exact asymmetry this resolver exists to remove.
+  const qualified = selection.startsWith(`${provider}/`)
+    ? selection
+    : routedSlug(provider, selection);
+  const selectionKey = slugEquivalenceKey(qualified);
+  const matched: string[] = [];
+  let exact: string | undefined;
+  for (const id of knownIds) {
+    if (slugEquivalenceKey(routedSlug(provider, id)) !== selectionKey) continue;
+    matched.push(id);
+    if (id === selection || `${provider}/${id}` === selection) exact = id;
+  }
+  return { matched, exact, ambiguous: matched.length > 1 };
+}

package/src/providers/xai-transport.ts

@@ -4,6 +4,27 @@ import { resolveGithubCopilotTransport } from "./github-copilot-transport";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
+/** The two hosts that serve xAI's Responses API: the public API and the Grok CLI proxy. */
+const XAI_RESPONSES_HOSTS = new Set(["api.x.ai", "cli-chat-proxy.grok.com"]);
+
+/**
+ * True when this provider's Responses traffic terminates at xAI itself.
+ *
+ * Probed 2026-08-22 one field per request: the two hosts accept and refuse exactly the same
+ * web_search fields, so they are one dialect rather than two. Matching is exact-host over
+ * https, which keeps lookalikes (`api.x.ai.evil.test`) and nonstandard ports out.
+ */
+export function isXaiResponsesDestination(provider: Pick<OcxProviderConfig, "baseUrl">): boolean {
+  try {
+    const url = new URL(provider.baseUrl);
+    return url.protocol === "https:"
+      && XAI_RESPONSES_HOSTS.has(url.hostname.toLowerCase())
+      && (url.port === "" || url.port === "443");
+  } catch {
+    return false;
+  }
+}
+
 export const XAI_GROK_COMPATIBILITY = {
   version: "0.2.93",
   userAgent: "opencodex-grok/0.2.93",

package/src/reasoning-effort.ts

@@ -14,6 +14,16 @@ export const CODEX_REASONING_LEVELS: { effort: string; description: string }[] =
 const CODEX_REASONING_ORDER = CODEX_REASONING_LEVELS.map(l => l.effort);
 const CODEX_REASONING_SET = new Set(CODEX_REASONING_ORDER);
 
+/**
+ * Sentinel wire value in reasoningEffortMap / modelReasoningEffortMap to explicitly
+ * omit the reasoning_effort field from the upstream wire request (issue #2356).
+ */
+export const REASONING_EFFORT_OMIT_SENTINEL = "__omit__";
+
+export function isReasoningEffortOmitted(wireEffort: string | undefined): boolean {
+  return wireEffort === REASONING_EFFORT_OMIT_SENTINEL;
+}
+
 /** True when `effort` is a member of the Codex reasoning ladder (low..ultra). */
 export function isCodexReasoningEffort(effort: string): boolean {
   return CODEX_REASONING_SET.has(effort);
@@ -170,7 +180,10 @@ export function mapReasoningEffort(provider: OcxProviderConfig, modelId: string,
   const boundary = requested === "ultra" ? "max" : requested;
 
   const wireMap = reasoningEffortMapFor(provider, modelId);
-  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, boundary)) return wireMap[boundary];
+  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, boundary)) {
+    const mapped = wireMap[boundary];
+    return mapped === REASONING_EFFORT_OMIT_SENTINEL ? undefined : mapped;
+  }
 
   const supported = configuredReasoningEfforts(provider, modelId);
   const codexEffort = supported !== undefined ? clampToSupportedCodexEffort(boundary, supported) : requestToCodexEffort(boundary);
@@ -178,6 +191,10 @@ export function mapReasoningEffort(provider: OcxProviderConfig, modelId: string,
 
   // Belt for the odd config where the supported ladder is ultra-only and the clamp lands on it.
   const wire = codexEffort === "ultra" ? "max" : codexEffort;
-  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, wire)) return wireMap[wire];
+  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, wire)) {
+    const mapped = wireMap[wire];
+    return mapped === REASONING_EFFORT_OMIT_SENTINEL ? undefined : mapped;
+  }
+  if (wire === REASONING_EFFORT_OMIT_SENTINEL) return undefined;
   return wire;
 }

package/src/responses/apply-patch-envelope.ts

@@ -0,0 +1,63 @@
+// Representation repair for top-level Codex apply_patch custom-tool payloads.
+//
+// Some routed models decorate the first and last lines as
+// `*** Begin Patch ***` / `*** End Patch ***`. Codex rejects those otherwise
+// valid custom-tool payloads. Repair is deliberately limited to a complete,
+// structurally recognizable top-level patch: arbitrary `exec` JavaScript is
+// caller-authored executable input and must remain byte-identical.
+//
+// This is the same intent boundary as `src/lib/tool-argument-integers.ts`:
+// repair the one faithful reading, leave genuine patch content alone.
+
+const PATCH_BEGIN = "*** Begin Patch";
+const PATCH_END = "*** End Patch";
+const TOP_LEVEL_PATCH_ENVELOPE = /^(\*\*\* Begin Patch(?: \*\*\*)?)(\r?\n)([\s\S]*)(\r?\n)(\*\*\* End Patch(?: \*\*\*)?)(\r?\n)?$/;
+const PATCH_OPERATION_LINE = /^\*\*\* (?:Add|Update|Delete) File: .+$/m;
+
+/** Unwrap the `{input:string}` function-call wrapper used for freeform tools. */
+export function unwrapFreeformToolInput(argumentsText: unknown): string {
+  if (typeof argumentsText !== "string") return "";
+  try {
+    const parsed: unknown = JSON.parse(argumentsText);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const input = (parsed as { input?: unknown }).input;
+      if (typeof input === "string") return input;
+    }
+  } catch {
+    // The string is the freeform body, not nested JSON.
+  }
+  return argumentsText;
+}
+
+/**
+ * Strip trailing `***` only from the outer lines of one complete patch.
+ * Internal patch content, incomplete envelopes, and non-patch text are exact
+ * pass-throughs.
+ */
+export function normalizeApplyPatchDelimiters(text: string): string {
+  const match = TOP_LEVEL_PATCH_ENVELOPE.exec(text);
+  if (!match) return text;
+  const [, begin, beginBreak, body, endBreak, end, trailingBreak = ""] = match;
+  if (!PATCH_OPERATION_LINE.test(body)) return text;
+  if (begin === PATCH_BEGIN && end === PATCH_END) return text;
+  return `${PATCH_BEGIN}${beginBreak}${body}${endBreak}${PATCH_END}${trailingBreak}`;
+}
+
+/**
+ * Repair freeform input before Codex sees it.
+ *
+ * Only a bare or reserved-`functions` `apply_patch` payload may receive delimiter
+ * repair. Remote namespaces own their grammar; those bodies and every other
+ * freeform input are unwrapped and left byte-exact.
+ */
+export function repairFreeformToolInput(
+  argumentsText: unknown,
+  toolName = "",
+  namespace?: string,
+): string {
+  const unwrapped = unwrapFreeformToolInput(argumentsText);
+  const ownsApplyPatchGrammar = namespace === undefined || namespace === "functions";
+  return ownsApplyPatchGrammar && toolName === "apply_patch"
+    ? normalizeApplyPatchDelimiters(unwrapped)
+    : unwrapped;
+}

package/src/responses/code-mode-helper-compat.ts

@@ -0,0 +1,50 @@
+import { normalizeApplyPatchDelimiters } from "./apply-patch-envelope";
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function unwrapPatchInput(value: string): string {
+  try {
+    const parsed: unknown = JSON.parse(value);
+    if (isPlainObject(parsed)) {
+      if (typeof parsed.input === "string") return parsed.input;
+      if (typeof parsed.patch === "string") return parsed.patch;
+    }
+  } catch {
+    // Native custom calls carry the patch body directly.
+  }
+  return value;
+}
+
+/**
+ * Convert a nested Code Mode helper call into unified-exec JavaScript.
+ *
+ * Parsed values are serialized as data, never interpolated as source, so command and patch text
+ * cannot escape the generated call. Invalid structured shell payloads are also passed as data so
+ * nested-tool validation can reject them without evaluating provider text as JavaScript.
+ */
+export function compileCodeModeHelperInput(argumentsText: unknown, toolName: string): string {
+  if (typeof argumentsText !== "string") return "";
+  if (toolName === "apply_patch") {
+    const patch = normalizeApplyPatchDelimiters(unwrapPatchInput(argumentsText));
+    return `const result = await tools.apply_patch(${JSON.stringify(patch)});\ntext(result);`;
+  }
+  let parsed: unknown = argumentsText;
+  try {
+    parsed = JSON.parse(argumentsText);
+  } catch {
+    // Keep malformed provider text as data rather than executable source.
+  }
+  const args: unknown = isPlainObject(parsed) ? { ...parsed } : parsed;
+  if (
+    toolName === "shell_command"
+    && isPlainObject(args)
+    && typeof args.command === "string"
+    && args.cmd === undefined
+  ) {
+    args.cmd = args.command;
+    delete args.command;
+  }
+  return `const result = await tools.exec_command(${JSON.stringify(args)});\ntext(result);`;
+}

package/src/responses/custom-tool-compat.ts

@@ -1,4 +1,10 @@
-import { namespacedToolName } from "../types";
+import { namespacedToolName, normalizeDeclaredToolName } from "../types";
+import {
+  normalizeApplyPatchDelimiters,
+  repairFreeformToolInput,
+  unwrapFreeformToolInput,
+} from "./apply-patch-envelope";
+import { compileCodeModeHelperInput } from "./code-mode-helper-compat";
 import { collectResponsesToolGroups } from "./tool-groups";
 
 const ROUTED_CUSTOM_TOOL_PASSTHROUGH = new Set(["apply_patch"]);
@@ -15,19 +21,42 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
-function customToolInput(argumentsText: unknown): string {
-  if (typeof argumentsText !== "string") return "";
-  try {
-    const parsed = JSON.parse(argumentsText) as unknown;
-    if (isPlainObject(parsed) && typeof parsed.input === "string") return parsed.input;
-  } catch { /* malformed arguments stay visible to the client */ }
-  return argumentsText;
-}
-
 function customToolWireName(namespace: string | undefined, name: string): string {
   return namespace === BUILTIN_FUNCTIONS_NAMESPACE ? name : namespacedToolName(namespace, name);
 }
 
+function toolChoiceAllowsRoutedCustomTool(
+  body: unknown,
+  wireName: string,
+  candidateNames: ReadonlySet<string>,
+): boolean {
+  if (!isPlainObject(body)) return true;
+  const choice = body.tool_choice;
+  if (choice === undefined || choice === null || choice === "auto" || choice === "required") {
+    return true;
+  }
+  if (choice === "none") return false;
+  if (!isPlainObject(choice)) return true;
+
+  const selectorAllows = (selector: unknown): boolean => {
+    if (!isPlainObject(selector) || typeof selector.name !== "string") return false;
+    if (selector.type !== "custom") return false;
+    if (typeof selector.namespace === "string") {
+      return customToolWireName(selector.namespace, selector.name) === wireName;
+    }
+    if (selector.name === wireName) return true;
+    const suffix = `__${selector.name}`;
+    const candidates = [...candidateNames].filter(name => name.endsWith(suffix));
+    return candidates.length === 1 && candidates[0] === wireName;
+  };
+
+  if (choice.type === "function" || choice.type === "custom") return selectorAllows(choice);
+  if (choice.type === "allowed_tools" && Array.isArray(choice.tools)) {
+    return choice.tools.some(selectorAllows);
+  }
+  return false;
+}
+
 /** Final upstream identity of a call, including a namespace restored by an earlier rewrite. */
 export function routedCustomToolWireName(value: unknown): string | undefined {
   if (!isPlainObject(value) || typeof value.name !== "string") return undefined;
@@ -37,13 +66,28 @@ export function routedCustomToolWireName(value: unknown): string | undefined {
   );
 }
 
+/** Resolve a provider-emitted wire name to the routed custom tool the client declared. */
+export function routedCustomToolTargetName(
+  value: unknown,
+  names: ReadonlySet<string>,
+  declaredNames?: ReadonlySet<string>,
+): string | undefined {
+  const wireName = routedCustomToolWireName(value);
+  if (wireName === undefined) return undefined;
+  if (names.has(wireName)) return wireName;
+  if (!isPlainObject(value) || typeof value.namespace === "string") return undefined;
+  const normalized = normalizeDeclaredToolName(wireName, declaredNames);
+  return normalized !== wireName && names.has(normalized) ? normalized : undefined;
+}
+
 /**
- * Names of converted custom declarations after namespace lowering. Restoration uses these exact
- * wire identities so same-named function and custom children in different namespaces stay distinct.
+ * Names of custom declarations after namespace lowering. The selection flag separates converted
+ * names from native passthrough names while keeping same-named function and custom children distinct.
  */
 function collectRoutedCustomToolWireNames(
   body: unknown,
   supportsResponsesCustomTools?: boolean,
+  passthrough = false,
 ): Set<string> {
   const names = new Set<string>();
   const groups = collectResponsesToolGroups(body);
@@ -64,7 +108,7 @@ function collectRoutedCustomToolWireNames(
       if (
         tool.type === "custom"
         && typeof tool.name === "string"
-        && !routedCustomToolPassesThrough(tool.name, supportsResponsesCustomTools)
+        && routedCustomToolPassesThrough(tool.name, supportsResponsesCustomTools) === passthrough
       ) {
         names.add(tool.name);
         continue;
@@ -77,7 +121,8 @@ function collectRoutedCustomToolWireNames(
           isPlainObject(child)
           && child.type === "custom"
           && typeof child.name === "string"
-          && !routedCustomToolPassesThrough(child.name, supportsResponsesCustomTools)
+          && routedCustomToolPassesThrough(child.name, supportsResponsesCustomTools) === passthrough
+          && (!passthrough || tool.name === BUILTIN_FUNCTIONS_NAMESPACE)
           && !(tool.name === BUILTIN_FUNCTIONS_NAMESPACE && bareWireNames.has(child.name))
         ) names.add(customToolWireName(tool.name, child.name));
       }
@@ -85,7 +130,6 @@ function collectRoutedCustomToolWireNames(
   }
   return names;
 }
-
 export function customToolItemId(id: unknown): unknown {
   if (typeof id !== "string") return id;
   return id.startsWith("fc_") ? `ctc_${id.slice(3)}` : id;
@@ -203,64 +247,138 @@ export function rewriteRoutedCustomToolsForUpstream(
 ): {
   body: unknown;
   names: Set<string>;
+  repairNames: Set<string>;
 } {
   const conversionNames = collectRoutedCustomToolNames(body, supportsResponsesCustomTools);
   const names = collectRoutedCustomToolWireNames(body, supportsResponsesCustomTools);
-  if (conversionNames.size === 0) return { body, names };
+  const repairNames = collectRoutedCustomToolWireNames(body, supportsResponsesCustomTools, true);
+  for (const name of repairNames) {
+    if (!toolChoiceAllowsRoutedCustomTool(body, name, repairNames)) repairNames.delete(name);
+  }
+  if (conversionNames.size === 0) return { body, names, repairNames };
   const callIds = new Set<string>();
   collectConvertedCallIds(body, conversionNames, callIds);
-  return { body: rewriteForUpstream(body, conversionNames, callIds), names };
+  return { body: rewriteForUpstream(body, conversionNames, callIds), names, repairNames };
 }
 
 export function restoreRoutedCustomCalls(
   value: unknown,
   names: ReadonlySet<string>,
+  repairNames: ReadonlySet<string> = new Set(),
+  declaredNames?: ReadonlySet<string>,
 ): { value: unknown; changed: boolean } {
-  if (Array.isArray(value)) {
+  if (!isPlainObject(value)) return { value, changed: false };
+
+  const restoreItem = (item: unknown): { value: unknown; changed: boolean } => {
+    if (!isPlainObject(item)) return { value: item, changed: false };
+    const wireName = routedCustomToolWireName(item);
+    const targetName = routedCustomToolTargetName(item, names, declaredNames);
+    if (
+      (item.type === "function_call" || item.type === "custom_tool_call")
+      && typeof item.name === "string"
+      && wireName !== undefined
+      && targetName !== undefined
+    ) {
+      const sourceInput = item.type === "function_call" ? item.arguments : item.input;
+      const aliased = targetName !== wireName;
+      const restored: Record<string, unknown> = {
+        ...item,
+        type: "custom_tool_call",
+        id: customToolItemId(item.id),
+        name: aliased ? targetName : item.name,
+        input: aliased && sourceInput !== ""
+          ? compileCodeModeHelperInput(sourceInput, item.name)
+          : repairFreeformToolInput(
+            sourceInput,
+            targetName,
+            typeof item.namespace === "string" ? item.namespace : undefined,
+          ),
+      };
+      delete restored.arguments;
+      if (aliased) delete restored.namespace;
+      return { value: restored, changed: true };
+    }
+    if (
+      item.type === "custom_tool_call"
+      && typeof item.name === "string"
+      && wireName !== undefined
+      && repairNames.has(wireName)
+      && typeof item.input === "string"
+    ) {
+      const input = normalizeApplyPatchDelimiters(item.input);
+      if (input !== item.input) return { value: { ...item, input }, changed: true };
+    }
+    return { value: item, changed: false };
+  };
+
+  const restoreOutput = (output: unknown): { value: unknown; changed: boolean } => {
+    if (!Array.isArray(output)) return { value: output, changed: false };
     let changed = false;
-    const restored = value.map(entry => {
-      const result = restoreRoutedCustomCalls(entry, names);
+    const restored = output.map(item => {
+      const result = restoreItem(item);
       changed ||= result.changed;
       return result.value;
     });
-    return changed ? { value: restored, changed: true } : { value, changed: false };
-  }
-  if (!isPlainObject(value)) return { value, changed: false };
+    return changed ? { value: restored, changed: true } : { value: output, changed: false };
+  };
 
   let changed = false;
-  const restored: Record<string, unknown> = {};
-  for (const [key, entry] of Object.entries(value)) {
-    const result = restoreRoutedCustomCalls(entry, names);
-    restored[key] = result.value;
-    changed ||= result.changed;
+  const restored: Record<string, unknown> = { ...value };
+  const output = restoreOutput(value.output);
+  if (output.changed) {
+    restored.output = output.value;
+    changed = true;
   }
 
-  const wireName = routedCustomToolWireName(value);
-  if (value.type === "function_call" && wireName !== undefined && names.has(wireName)) {
-    restored.type = "custom_tool_call";
-    restored.id = customToolItemId(value.id);
-    restored.input = customToolInput(value.arguments);
-    delete restored.arguments;
-    changed = true;
+  if (
+    (value.type === "response.output_item.added" || value.type === "response.output_item.done")
+    && isPlainObject(value.item)
+  ) {
+    const item = restoreItem(value.item);
+    if (item.changed) {
+      restored.item = item.value;
+      changed = true;
+    }
+  }
+
+  if (
+    typeof value.type === "string"
+    && value.type.startsWith("response.")
+    && isPlainObject(value.response)
+  ) {
+    const response = restoreRoutedCustomCalls(value.response, names, repairNames, declaredNames);
+    if (response.changed) {
+      restored.response = response.value;
+      changed = true;
+    }
   }
+
   return changed ? { value: restored, changed: true } : { value, changed: false };
 }
 
 export function restoreRoutedCustomCallsInJson(
   text: string,
   names: ReadonlySet<string>,
+  repairNames: ReadonlySet<string> = new Set(),
+  declaredNames?: ReadonlySet<string>,
 ): string {
-  if (names.size === 0) return text;
+  if (names.size === 0 && repairNames.size === 0) return text;
   let payload: unknown;
   try {
     payload = JSON.parse(text);
   } catch {
     return text;
   }
-  const restored = restoreRoutedCustomCalls(payload, names);
+  const restored = restoreRoutedCustomCalls(payload, names, repairNames, declaredNames);
   return restored.changed ? JSON.stringify(restored.value) : text;
 }
 
-export function unwrapRoutedCustomToolArguments(argumentsText: unknown): string {
-  return customToolInput(argumentsText);
+export function unwrapRoutedCustomToolArguments(
+  argumentsText: unknown,
+  toolName = "",
+  namespace?: string,
+): string {
+  return toolName
+    ? repairFreeformToolInput(argumentsText, toolName, namespace)
+    : unwrapFreeformToolInput(argumentsText);
 }

package/src/responses/namespace-tool-compat.ts

@@ -4,6 +4,14 @@ import { collectResponsesToolGroups } from "./tool-groups";
 export interface RoutedNamespaceToolIdentity {
   namespace: string;
   name: string;
+  /**
+   * The kind the tool was DECLARED as. Restoration and `tool_choice` matching both
+   * need it: a wire name identifies which tool, not which kind of call may carry it,
+   * so without this a tool declared `function` could be selected by a `custom`
+   * selector and come back as a `custom_tool_call` — the same name/kind mismatch
+   * that motivated narrowing the alias map in the first place.
+   */
+  kind: "function" | "custom";
 }
 
 export type RoutedNamespaceToolAliases = ReadonlyMap<string, RoutedNamespaceToolIdentity>;
@@ -138,7 +146,10 @@ function buildRewritePlan(groups: readonly unknown[][]): NamespaceRewritePlan {
         addSelector(selectors, `${parsed.namespace}.${childName}`, wireName);
         addSelector(selectors, childName, wireName);
         if (parsed.namespace !== BUILTIN_FUNCTIONS_NAMESPACE) {
-          aliases.set(wireName, { namespace: parsed.namespace, name: childName });
+          // A child declared `custom` stays custom; everything else lowers to a
+          // function, which is how `buildTools` flattens it upstream.
+          const kind = child.type === "custom" ? "custom" : "function";
+          aliases.set(wireName, { namespace: parsed.namespace, name: childName, kind });
         }
       }
     }
@@ -206,18 +217,34 @@ function rewriteToolList(
  * the failure this layer exists to prevent, and this layer's own response restoration is what put
  * the key on the item.
  */
+/**
+ * A selector's `namespace` is either absent — meaning "unqualified, resolve the bare
+ * name" — or a string naming the group. A present-but-non-string value is neither, and
+ * a malformed selector must not authorize anything: not through the unqualified
+ * fallback, and not by happening to carry an already-flattened wire name, which would
+ * otherwise match the alias map exactly and arm it anyway.
+ */
+function hasMalformedNamespace(value: Record<string, unknown>): boolean {
+  return "namespace" in value && typeof value.namespace !== "string";
+}
+
 function rewriteNamedSelector(
   value: unknown,
   plan: NamespaceRewritePlan,
   bareFallback: boolean,
 ): unknown {
   if (!isPlainObject(value) || typeof value.name !== "string") return value;
-  if (typeof value.namespace !== "string") {
+  // Malformed: hand it back untouched so no rewrite occurs. Authorization rejects it
+  // separately — returning it unchanged is not by itself enough, because the name it
+  // carries may already BE a wire name.
+  if (hasMalformedNamespace(value)) return value;
+  const namespace = value.namespace;
+  if (typeof namespace !== "string") {
     if (!bareFallback) return value;
     const wireName = plan.selectors.get(value.name) ?? undefined;
     return wireName === undefined || wireName === value.name ? value : { ...value, name: wireName };
   }
-  const { namespace, ...rest } = value;
+  const { namespace: _dropped, ...rest } = value;
   const wireName = plan.identities.get(loweredIdentity(namespace, value.name))
     ?? loweredWireName(namespace, value.name);
   return { ...rest, name: wireName };
@@ -239,6 +266,59 @@ function rewriteToolChoice(value: unknown, plan: NamespaceRewritePlan): unknown
   return changed ? { ...value, tools } : value;
 }
 
+/**
+ * Keep response restoration inside the caller's per-turn tool authorization boundary. The
+ * upstream sees every flattened declaration even when `tool_choice` narrows the tools it may call,
+ * so its output cannot be trusted merely because a wire name appeared in that catalog.
+ */
+function authorizedAliases(
+  aliases: Map<string, RoutedNamespaceToolIdentity>,
+  toolChoice: unknown,
+): Map<string, RoutedNamespaceToolIdentity> {
+  if (toolChoice === undefined || toolChoice === "auto" || toolChoice === "required") return aliases;
+  if (toolChoice === "none" || !isPlainObject(toolChoice)) return new Map();
+
+  // name -> the kind the selector claimed. A selector authorizes a tool only when it
+  // names it AND agrees about what kind of tool it is.
+  let authorized: Map<string, "function" | "custom">;
+  if (
+    (toolChoice.type === "function" || toolChoice.type === "custom")
+    && typeof toolChoice.name === "string"
+  ) {
+    // A malformed namespace makes the whole selector untrustworthy, even when its
+    // name is already a flattened wire name that would match the alias map exactly.
+    if (hasMalformedNamespace(toolChoice)) return new Map();
+    authorized = new Map([[toolChoice.name, toolChoice.type]]);
+  } else if (toolChoice.type === "allowed_tools" && Array.isArray(toolChoice.tools)) {
+    authorized = new Map();
+    for (const tool of toolChoice.tools) {
+      // Match the top-level branch above: only a function/custom selector can
+      // authorize a client namespace call. `allowed_tools` entries are typed
+      // `{type: string}` by the schema, so the accepted set is open-ended and
+      // an allowlist is the only closure that also covers kinds added later.
+      // Without this, `{type: "file_search", name: "<wire-name>"}` keeps the
+      // alias, and an upstream `function_call` carrying that name is restored
+      // into a namespace call the caller never permitted.
+      if (!isPlainObject(tool)) continue;
+      if (tool.type !== "function" && tool.type !== "custom") continue;
+      if (typeof tool.name !== "string") continue;
+      if (hasMalformedNamespace(tool)) continue;
+      authorized.set(tool.name, tool.type);
+    }
+  } else {
+    // An explicit selector for another tool kind does not authorize a client namespace call.
+    return new Map();
+  }
+
+  // The kind must agree too. A wire name says WHICH tool, not what kind of call may
+  // carry it, so a `custom` selector naming a tool declared `function` is the same
+  // name/kind mismatch as a `file_search` selector naming it — narrower, but the
+  // same class, and `allowed_tools[].type` accepts any string so both are reachable.
+  return new Map(
+    [...aliases].filter(([wireName, identity]) => authorized.get(wireName) === identity.kind),
+  );
+}
+
 function rewriteInputItem(item: unknown, plan: NamespaceRewritePlan, emitted: Set<string>): unknown {
   if (!isPlainObject(item)) return item;
   if (item.type === "additional_tools" && Array.isArray(item.tools)) {
@@ -292,7 +372,7 @@ export function rewriteRoutedNamespaceToolsForUpstream(body: unknown): {
       ...(input !== body.input ? { input } : {}),
       ...(toolChoice !== body.tool_choice ? { tool_choice: toolChoice } : {}),
     },
-    aliases: plan.aliases,
+    aliases: authorizedAliases(plan.aliases, toolChoice),
   };
 }