@iislee/opencodex 2.31.0 → 2.35.0

package/src/server/responses-custom-tool-repair.ts

@@ -1,7 +1,10 @@
 import type { TranslatorBudget } from "../lib/translator-budget";
+import { normalizeApplyPatchDelimiters } from "../responses/apply-patch-envelope";
+import { compileCodeModeHelperInput } from "../responses/code-mode-helper-compat";
 import {
   customToolItemId,
   restoreRoutedCustomCalls,
+  routedCustomToolTargetName,
   routedCustomToolWireName,
   unwrapRoutedCustomToolArguments,
 } from "../responses/custom-tool-compat";
@@ -85,8 +88,12 @@ type PendingArgumentBlock = {
 export function createRoutedCustomToolRestoreBlockRewrite(
   names: ReadonlySet<string>,
   budget?: TranslatorBudget,
+  repairNames: ReadonlySet<string> = new Set(),
+  declaredNames?: ReadonlySet<string>,
 ): SseBlockRewrite {
-  const itemNames = new Map<string, string>();
+  const itemNames = new Map<string, { name: string; aliased: boolean; namespace?: string }>();
+  const customAliasItemNames = new Map<string, string>();
+  const repairItemNames = new Map<string, string>();
   const ordinaryItemIds = new Set<string>();
   const openCalls = new Map<string, OpenCustomCall>();
   let pendingArguments: PendingArgumentBlock[] = [];
@@ -111,6 +118,8 @@ export function createRoutedCustomToolRestoreBlockRewrite(
     }
     pendingArguments = [];
     itemNames.clear();
+    customAliasItemNames.clear();
+    repairItemNames.clear();
     ordinaryItemIds.clear();
   };
 
@@ -175,6 +184,32 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       && parsed.output_index >= 0
       ? parsed.output_index
       : undefined;
+    if (
+      (type === "response.output_item.added" || type === "response.output_item.done")
+      && isPlainObject(parsed.item)
+      && parsed.item.type === "custom_tool_call"
+      && typeof parsed.item.name === "string"
+    ) {
+      const upstreamItemId = typeof parsed.item.id === "string" ? parsed.item.id : undefined;
+      const wireName = routedCustomToolWireName(parsed.item);
+      const targetName = routedCustomToolTargetName(parsed.item, names, declaredNames);
+      const aliased = targetName !== undefined && targetName !== wireName;
+      if (upstreamItemId && aliased) {
+        customAliasItemNames.set(upstreamItemId, parsed.item.name);
+        if (type === "response.output_item.added") {
+          openCalls.set(upstreamItemId, { argumentsText: "", emittedInput: "", retainedBytes: 0 });
+        }
+      }
+      const repairable = wireName !== undefined && repairNames.has(wireName);
+      if (upstreamItemId && repairable) repairItemNames.set(upstreamItemId, parsed.item.name);
+      const restored = repairable || aliased
+        ? restoreRoutedCustomCalls(parsed, names, repairNames, declaredNames)
+        : { value: parsed, changed: false };
+      if (type === "response.output_item.done" && upstreamItemId) releaseCall(upstreamItemId);
+      return restored.changed
+        ? [replaceSseDataPayload(block, JSON.stringify(restored.value))]
+        : [block];
+    }
     if (
       (type === "response.output_item.added" || type === "response.output_item.done")
       && isPlainObject(parsed.item)
@@ -182,11 +217,16 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       && typeof parsed.item.name === "string"
     ) {
       const upstreamItemId = typeof parsed.item.id === "string" ? parsed.item.id : undefined;
+      const targetName = routedCustomToolTargetName(parsed.item, names, declaredNames);
+      const routed = targetName !== undefined;
       const wireName = routedCustomToolWireName(parsed.item);
-      const routed = wireName !== undefined && names.has(wireName);
       if (upstreamItemId) {
         if (routed) {
-          itemNames.set(upstreamItemId, parsed.item.name);
+          itemNames.set(upstreamItemId, {
+            name: parsed.item.name,
+            aliased: targetName !== wireName,
+            ...(typeof parsed.item.namespace === "string" ? { namespace: parsed.item.namespace } : {}),
+          });
           ordinaryItemIds.delete(upstreamItemId);
         } else {
           ordinaryItemIds.add(upstreamItemId);
@@ -203,7 +243,7 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       if (upstreamItemId && pending.length > 0 && !openCalls.has(upstreamItemId)) {
         openCalls.set(upstreamItemId, { argumentsText: "", emittedInput: "", retainedBytes: 0 });
       }
-      const restored = restoreRoutedCustomCalls(parsed, names);
+      const restored = restoreRoutedCustomCalls(parsed, names, repairNames, declaredNames);
       const restoredBlock = restored.changed
         ? replaceSseDataPayload(block, JSON.stringify(restored.value))
         : block;
@@ -215,6 +255,44 @@ export function createRoutedCustomToolRestoreBlockRewrite(
     }
 
     const upstreamItemId = typeof parsed.item_id === "string" ? parsed.item_id : undefined;
+    if (
+      type === "response.custom_tool_call_input.delta"
+      && upstreamItemId
+      && customAliasItemNames.has(upstreamItemId)
+    ) {
+      const open = openCalls.get(upstreamItemId) ?? { argumentsText: "", emittedInput: "", retainedBytes: 0 };
+      const delta = typeof parsed.delta === "string" ? parsed.delta : "";
+      const deltaBytes = Buffer.byteLength(delta, "utf8");
+      if (deltaBytes > 0) budget?.chargeRetained(deltaBytes, { kind: "retained_collectors" });
+      open.argumentsText += delta;
+      open.retainedBytes += deltaBytes;
+      openCalls.set(upstreamItemId, open);
+      return [];
+    }
+    if (
+      type === "response.custom_tool_call_input.done"
+      && upstreamItemId
+      && customAliasItemNames.has(upstreamItemId)
+    ) {
+      const source = typeof parsed.input === "string"
+        ? parsed.input
+        : openCalls.get(upstreamItemId)?.argumentsText ?? "";
+      return [replaceSseDataPayload(block, JSON.stringify({
+        ...parsed,
+        input: compileCodeModeHelperInput(source, customAliasItemNames.get(upstreamItemId)!),
+      }))];
+    }
+    if (
+      type === "response.custom_tool_call_input.done"
+      && upstreamItemId
+      && repairItemNames.has(upstreamItemId)
+      && typeof parsed.input === "string"
+    ) {
+      const input = normalizeApplyPatchDelimiters(parsed.input);
+      if (input !== parsed.input) {
+        return [replaceSseDataPayload(block, JSON.stringify({ ...parsed, input }))];
+      }
+    }
     const argumentEvent = type === "response.function_call_arguments.delta"
       || type === "response.function_call_arguments.done";
     if (argumentEvent && (!upstreamItemId || (!itemNames.has(upstreamItemId) && !ordinaryItemIds.has(upstreamItemId)))) {
@@ -261,16 +339,19 @@ export function createRoutedCustomToolRestoreBlockRewrite(
         ? parsed.arguments
         : openCalls.get(upstreamItemId)?.argumentsText ?? "";
       const { arguments: _arguments, ...rest } = parsed;
+      const itemName = itemNames.get(upstreamItemId);
       const next = {
         ...rest,
         type: nextType,
         item_id: customToolItemId(upstreamItemId),
-        input: unwrapRoutedCustomToolArguments(source),
+        input: itemName?.aliased
+          ? compileCodeModeHelperInput(source, itemName.name)
+          : unwrapRoutedCustomToolArguments(source, itemName?.name ?? "", itemName?.namespace),
       };
       return [replaceSseDataPayload(replaceSseEventName(block, nextType), JSON.stringify(next))];
     }
 
-    const restored = restoreRoutedCustomCalls(parsed, names);
+    const restored = restoreRoutedCustomCalls(parsed, names, repairNames, declaredNames);
     const terminal = type === "response.completed" || type === "response.failed" || type === "response.incomplete";
     if (terminal) releaseAll();
     return restored.changed

package/src/server/responses-terminal-repair.ts

@@ -22,6 +22,22 @@ function isPlainRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function isUnframedTerminalLikeSuffix(block: string): boolean {
+  const payload = sseDataPayload(block);
+  if (payload === "[DONE]") return true;
+  if (!payload) return false;
+  try {
+    const parsed = JSON.parse(payload);
+    if (!isPlainRecord(parsed)) return false;
+    return parsed.type === "response.completed"
+      || parsed.type === "response.failed"
+      || parsed.type === "response.incomplete"
+      || parsed.type === "error";
+  } catch {
+    return false;
+  }
+}
+
 function outputIndex(value: unknown): number | null {
   return Number.isInteger(value) && (value as number) >= 0 ? value as number : null;
 }
@@ -292,11 +308,16 @@ export function relayResponsesSseWithTerminalRepair(
         if (done) {
           appendBuffer(decoder.decode());
           if (buffer.length > 0) {
-            // A delimiter-less suffix is not a complete SSE event. Preserve the
-            // upstream bytes for passthrough compatibility, but never let a
-            // truncated lifecycle frame establish synthetic success.
+            // A delimiter-less suffix is not a complete SSE event. Preserve an
+            // ordinary suffix for passthrough compatibility, but never promote
+            // a terminal-like suffix by adding the delimiter it did not receive
+            // upstream. The latter must stay tainted and fail closed through the
+            // synthetic incomplete terminal below.
             tainted = true;
-            controller.enqueue(encoder.encode(buffer));
+            if (!isUnframedTerminalLikeSuffix(buffer)) {
+              controller.enqueue(encoder.encode(buffer));
+              controller.enqueue(encoder.encode(buffer.includes("\r\n") ? "\r\n\r\n" : "\n\n"));
+            }
           }
           if (!realTerminalSeen) {
             emitSynthetic(completeCandidate() ? "completed" : "incomplete", controller);

package/src/server/responses-undeclared-tool-guard.ts

@@ -1,12 +1,63 @@
-import { namespacedToolName } from "../types";
+import { namespacedToolName, normalizeDeclaredToolName } from "../types";
 import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 
+/** Item types the client executes through a request-declared wire name. */
+const CLIENT_EXECUTED_CALL_TYPES = new Set(["function_call", "custom_tool_call"]);
+
 /**
- * Item types the CLIENT executes by name. Hosted calls (`web_search_call`,
- * `image_generation_call`, `local_shell_call`, `tool_search_call`, …) are run upstream or
- * carry no tool name, so they are never matched against the request catalog.
+ * Hosted declarations whose response items the PROVIDER executes, keyed by the request
+ * declaration type. These need no client answer, so their names are deliberately absent from
+ * the request catalog and must not be read as an undeclared client tool.
+ *
+ * xAI surfaces hosted `x_search` as `custom_tool_call`. Probed 2026-08-23 against the OAuth CLI
+ * destination: its hosted calls use an `xs_call-` call-id prefix. Observed call names were
+ * `x_keyword_search`, `x_semantic_search`, and `x_user_search` — three literals for one tool,
+ * which is why authorization keys on the declaration, item type, and call-id prefix, never on
+ * the name.
  */
-const CLIENT_EXECUTED_CALL_TYPES = new Set(["function_call", "custom_tool_call"]);
+export type ProviderExecutedCallType = Readonly<{
+  itemType: string;
+  callIdPrefix: string;
+}>;
+
+type ProviderExecutedCallTypes = ReadonlySet<ProviderExecutedCallType>;
+
+export const PROVIDER_EXECUTED_DECLARATION_CALL_TYPES = new Map<string, ProviderExecutedCallType>([
+  ["x_search", { itemType: "custom_tool_call", callIdPrefix: "xs_call-" }],
+]);
+
+/** Nameless declaration kinds whose response items still require client execution. */
+const NAMELESS_CLIENT_DECLARATION_CALL_TYPES = new Map([
+  ["local_shell", "local_shell_call"],
+  ["tool_search", "tool_search_call"],
+  ["computer_use_preview", "computer_call"],
+  ["computer_use", "computer_call"],
+]);
+
+const NAMELESS_CLIENT_CALL_DISPLAY_NAMES = new Map([
+  ["local_shell_call", "local_shell"],
+  ["tool_search_call", "tool_search"],
+  ["computer_call", "computer_use"],
+]);
+
+const EMPTY_DECLARED_NAMELESS_CLIENT_CALL_TYPES: ReadonlySet<string> = new Set();
+const EMPTY_PROVIDER_EXECUTED_CALL_TYPES: ReadonlySet<ProviderExecutedCallType> = new Set();
+
+/** Supported hosted/private declarations that carry no client-executable wire name. */
+const NAMELESS_TOOL_SPEC_TYPES = new Set([
+  "web_search",
+  "web_search_preview",
+  "file_search",
+  "computer_use_preview",
+  "computer_use",
+  "code_interpreter",
+  "image_generation",
+  "image_gen",
+  "mcp",
+  "tool_search",
+  "local_shell",
+  "x_search",
+]);
 
 /** An upstream-supplied name reaches the error message; keep it bounded. */
 const MAX_REPORTED_NAME_CHARS = 100;
@@ -18,12 +69,40 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 }
 
 function addWireToolName(names: Set<string>, tool: unknown, namespace?: string): void {
-  if (!isPlainObject(tool) || typeof tool.name !== "string" || tool.name.length === 0) return;
-  names.add(tool.name);
+  if (!isPlainObject(tool)) return;
+  const nestedFunction = tool.type === "function" && isPlainObject(tool.function)
+    ? tool.function
+    : undefined;
+  const name = typeof tool.name === "string" && tool.name.length > 0
+    ? tool.name
+    : typeof nestedFunction?.name === "string" && nestedFunction.name.length > 0
+      ? nestedFunction.name
+      : undefined;
+  if (!name) return;
+  names.add(name);
   // Codex routes MCP calls by an explicit `namespace` field, so the same tool is reachable
   // as a bare inner name or as the flattened form; accept both rather than guess which
   // coordinate system this provider echoes back.
-  if (namespace) names.add(namespacedToolName(namespace, tool.name));
+  if (namespace) names.add(namespacedToolName(namespace, name));
+}
+
+/**
+ * Catalog view owned by the current Responses turn.
+ *
+ * `previous_response_id` expansion prepends stored input items, including historical
+ * `additional_tools` declarations. Those items remain conversation history but cannot grant
+ * execution authority to this turn. Top-level `tools` always belongs to the current request;
+ * only input catalogs at or after the replay boundary are current.
+ */
+export function currentTurnWireToolCatalogBody(
+  body: unknown,
+  replayPrefixLength: number | undefined,
+): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+  if (typeof replayPrefixLength !== "number" || !Number.isFinite(replayPrefixLength)) return body;
+  const start = Math.min(body.input.length, Math.max(0, Math.trunc(replayPrefixLength)));
+  if (start === 0) return body;
+  return { ...body, input: body.input.slice(start) };
 }
 
 function addWireToolSpecs(names: Set<string>, specs: unknown): void {
@@ -53,21 +132,159 @@ export function collectDeclaredWireToolNames(body: unknown): Set<string> {
   addWireToolSpecs(names, body.tools);
   if (Array.isArray(body.input)) {
     for (const item of body.input) {
-      if (isPlainObject(item) && item.type === "additional_tools") addWireToolSpecs(names, item.tools);
+      if (
+        isPlainObject(item)
+        && (item.type === "additional_tools" || item.type === "tool_search_output")
+      ) addWireToolSpecs(names, item.tools);
     }
   }
   return names;
 }
 
-function undeclaredNameInItem(item: unknown, declared: ReadonlySet<string>): string | undefined {
+function addNamelessClientCallTypes(callTypes: Set<string>, specs: unknown): void {
+  if (!Array.isArray(specs)) return;
+  for (const spec of specs) {
+    if (!isPlainObject(spec) || typeof spec.type !== "string") continue;
+    const callType = NAMELESS_CLIENT_DECLARATION_CALL_TYPES.get(spec.type);
+    if (callType) callTypes.add(callType);
+  }
+}
+
+function addProviderExecutedCallTypes(
+  callTypes: Set<ProviderExecutedCallType>,
+  specs: unknown,
+): void {
+  if (!Array.isArray(specs)) return;
+  for (const spec of specs) {
+    if (!isPlainObject(spec) || typeof spec.type !== "string") continue;
+    const callType = PROVIDER_EXECUTED_DECLARATION_CALL_TYPES.get(spec.type);
+    if (callType) callTypes.add(callType);
+  }
+}
+
+/**
+ * Item types this turn's hosted declarations authorize the PROVIDER to emit unnamed.
+ *
+ * Caller must gate this on the destination actually being that provider; a declaration alone
+ * is not authority, or any upstream could claim a hosted shape it never serves.
+ */
+export function collectProviderExecutedCallTypes(body: unknown): Set<ProviderExecutedCallType> {
+  const callTypes = new Set<ProviderExecutedCallType>();
+  if (!isPlainObject(body)) return callTypes;
+  addProviderExecutedCallTypes(callTypes, body.tools);
+  if (Array.isArray(body.input)) {
+    for (const item of body.input) {
+      if (
+        isPlainObject(item)
+        && (item.type === "additional_tools" || item.type === "tool_search_output")
+      ) addProviderExecutedCallTypes(callTypes, item.tools);
+    }
+  }
+  return callTypes;
+}
+
+function isAuthorizedProviderExecutedCall(
+  item: Record<string, unknown>,
+  callTypes: ProviderExecutedCallTypes,
+): boolean {
+  if (typeof item.call_id !== "string") return false;
+  for (const callType of callTypes) {
+    if (
+      item.type === callType.itemType
+      && item.call_id.startsWith(callType.callIdPrefix)
+    ) return true;
+  }
+  return false;
+}
+
+/** Nameless client-call item types authorized by supported request tool declarations. */
+export function collectDeclaredNamelessClientCallTypes(body: unknown): Set<string> {
+  const callTypes = new Set<string>();
+  if (!isPlainObject(body)) return callTypes;
+  addNamelessClientCallTypes(callTypes, body.tools);
+  if (Array.isArray(body.input)) {
+    for (const item of body.input) {
+      if (
+        isPlainObject(item)
+        && (item.type === "additional_tools" || item.type === "tool_search_output")
+      ) {
+        addNamelessClientCallTypes(callTypes, item.tools);
+      }
+    }
+  }
+  return callTypes;
+}
+
+function isReadableWireToolSpec(spec: unknown): boolean {
+  if (!isPlainObject(spec) || typeof spec.type !== "string" || spec.type.length === 0) return false;
+  if (spec.type === "function") {
+    return (typeof spec.name === "string" && spec.name.length > 0)
+      || (isPlainObject(spec.function)
+        && typeof spec.function.name === "string"
+        && spec.function.name.length > 0);
+  }
+  if (spec.type === "custom") return typeof spec.name === "string" && spec.name.length > 0;
+  if (spec.type === "namespace") {
+    return typeof spec.name === "string"
+      && spec.name.length > 0
+      && Array.isArray(spec.tools)
+      && (spec.tools.length === 0 || spec.tools.some(inner =>
+        isPlainObject(inner)
+        && (inner.type === "function" || inner.type === "custom")
+        && typeof inner.name === "string"
+        && inner.name.length > 0
+      ));
+  }
+  if (NAMELESS_TOOL_SPEC_TYPES.has(spec.type)) return true;
+  return typeof spec.name === "string" && spec.name.length > 0;
+}
+
+function isReadableWireToolCatalog(value: unknown): boolean {
+  return Array.isArray(value)
+    && (value.length === 0 || value.some(isReadableWireToolSpec));
+}
+
+/** Whether a request contains a supported catalog, including an explicit empty deny-all array. */
+export function hasExplicitWireToolCatalog(body: unknown): boolean {
+  if (!isPlainObject(body)) return false;
+  if (isReadableWireToolCatalog(body.tools)) return true;
+  if (!Array.isArray(body.input)) return false;
+  return body.input.some(item =>
+    isPlainObject(item)
+    && item.type === "additional_tools"
+    && isReadableWireToolCatalog(item.tools)
+  );
+}
+
+function undeclaredNameInItem(
+  item: unknown,
+  declared: ReadonlySet<string>,
+  declaredNamelessClientCallTypes: ReadonlySet<string>,
+  providerExecutedCallTypes: ProviderExecutedCallTypes = EMPTY_PROVIDER_EXECUTED_CALL_TYPES,
+): string | undefined {
   if (!isPlainObject(item)) return undefined;
-  if (typeof item.type !== "string" || !CLIENT_EXECUTED_CALL_TYPES.has(item.type)) return undefined;
+  if (typeof item.type !== "string") return undefined;
+  // The provider executes this exact measured shape itself, so there is no client name to
+  // authorize. The caller supplies these signatures only for the matching destination and
+  // declarations; the item must additionally carry the hosted call-id prefix.
+  if (isAuthorizedProviderExecutedCall(item, providerExecutedCallTypes)) return undefined;
+  const namelessDisplayName = NAMELESS_CLIENT_CALL_DISPLAY_NAMES.get(item.type);
+  if (namelessDisplayName !== undefined) {
+    // Only Codex's explicit `execution: "client"` form delegates tool search to the client.
+    if (item.type === "tool_search_call" && item.execution !== "client") return undefined;
+    return declaredNamelessClientCallTypes.has(item.type) ? undefined : namelessDisplayName;
+  }
+  if (!CLIENT_EXECUTED_CALL_TYPES.has(item.type)) return undefined;
   const name = item.name;
   if (typeof name !== "string" || name.length === 0) return undefined;
-  if (declared.has(name)) return undefined;
-  if (typeof item.namespace === "string" && declared.has(namespacedToolName(item.namespace, name))) {
-    return undefined;
+  if (typeof item.namespace === "string") {
+    // Namespaced calls are matched by their full wire name only — never legacy-normalize
+    // them, or an undeclared namespaced `exec_command` could slip through as bare `exec`.
+    if (declared.has(namespacedToolName(item.namespace, name))) return undefined;
+    return name;
   }
+  const effectiveName = normalizeDeclaredToolName(name, declared);
+  if (declared.has(effectiveName)) return undefined;
   return name;
 }
 
@@ -75,14 +292,16 @@ function undeclaredNameInItem(item: unknown, declared: ReadonlySet<string>): str
 export function undeclaredToolCallName(
   payload: unknown,
   declared: ReadonlySet<string>,
+  declaredNamelessClientCallTypes: ReadonlySet<string> = EMPTY_DECLARED_NAMELESS_CLIENT_CALL_TYPES,
+  providerExecutedCallTypes: ProviderExecutedCallTypes = EMPTY_PROVIDER_EXECUTED_CALL_TYPES,
 ): string | undefined {
   if (!isPlainObject(payload)) return undefined;
   if (payload.type === "response.output_item.added" || payload.type === "response.output_item.done") {
-    return undeclaredNameInItem(payload.item, declared);
+    return undeclaredNameInItem(payload.item, declared, declaredNamelessClientCallTypes, providerExecutedCallTypes);
   }
   // Sparse gateways skip incremental items and only ever ship the terminal snapshot.
   if (payload.type === "response.completed" || payload.type === "response.incomplete") {
-    return undeclaredToolCallNameInResponse(payload.response, declared);
+    return undeclaredToolCallNameInResponse(payload.response, declared, declaredNamelessClientCallTypes, providerExecutedCallTypes);
   }
   return undefined;
 }
@@ -91,10 +310,12 @@ export function undeclaredToolCallName(
 export function undeclaredToolCallNameInResponse(
   response: unknown,
   declared: ReadonlySet<string>,
+  declaredNamelessClientCallTypes: ReadonlySet<string> = EMPTY_DECLARED_NAMELESS_CLIENT_CALL_TYPES,
+  providerExecutedCallTypes: ProviderExecutedCallTypes = EMPTY_PROVIDER_EXECUTED_CALL_TYPES,
 ): string | undefined {
   if (!isPlainObject(response) || !Array.isArray(response.output)) return undefined;
   for (const item of response.output) {
-    const name = undeclaredNameInItem(item, declared);
+    const name = undeclaredNameInItem(item, declared, declaredNamelessClientCallTypes, providerExecutedCallTypes);
     if (name !== undefined) return name;
   }
   return undefined;
@@ -133,6 +354,8 @@ function failedBlocks(name: string, newline: string): readonly string[] {
  */
 export function createUndeclaredToolCallGuardBlockRewrite(
   declared: ReadonlySet<string>,
+  declaredNamelessClientCallTypes: ReadonlySet<string> = EMPTY_DECLARED_NAMELESS_CLIENT_CALL_TYPES,
+  providerExecutedCallTypes: ProviderExecutedCallTypes = EMPTY_PROVIDER_EXECUTED_CALL_TYPES,
 ): SseBlockRewrite {
   let tripped = false;
   return (block: string) => {
@@ -145,7 +368,7 @@ export function createUndeclaredToolCallGuardBlockRewrite(
     } catch {
       return [block];
     }
-    const name = undeclaredToolCallName(parsed, declared);
+    const name = undeclaredToolCallName(parsed, declared, declaredNamelessClientCallTypes, providerExecutedCallTypes);
     if (name === undefined) return [block];
     tripped = true;
     return failedBlocks(name, block.includes("\r\n") ? "\r\n" : "\n");

package/src/server/sse-frame-buffer.ts

@@ -1,3 +1,5 @@
+import { isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
+
 export const MAX_CLIENT_SSE_FRAME_BYTES = 4 * 1024 * 1024;
 
 const LF_LF = Uint8Array.of(10, 10);
@@ -106,10 +108,35 @@ function isResponsesTerminalFrame(block: Uint8Array): boolean {
   const payload = data.join("\n");
   if (payload === "[DONE]") return false;
   try {
-    const parsed = JSON.parse(payload) as { type?: unknown };
-    return parsed.type === "response.completed"
+    const parsed = JSON.parse(payload) as {
+      type?: unknown;
+      code?: unknown;
+      message?: unknown;
+      error?: unknown;
+      last_error?: unknown;
+      response?: { error?: unknown; incomplete_details?: unknown };
+    };
+    if (parsed.type === "response.completed"
       || parsed.type === "response.failed"
-      || parsed.type === "response.incomplete";
+      || parsed.type === "response.incomplete") return true;
+    if (parsed.type !== "error") return false;
+    // A top-level error is terminal for this boundary only when it carries the
+    // same high-confidence cyber-policy evidence used by relay.ts. Ordinary
+    // upstream errors remain transport failures and still become a bounded 502.
+    const candidates = [
+      parsed,
+      parsed.error,
+      parsed.last_error,
+      parsed.response?.error,
+      parsed.response?.incomplete_details,
+    ];
+    for (const candidate of candidates) {
+      if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) continue;
+      const record = candidate as { code?: unknown; message?: unknown };
+      if (isCyberPolicyCode(typeof record.code === "string" ? record.code : undefined)) return true;
+      if (typeof record.message === "string" && isCyberPolicyMessage(record.message)) return true;
+    }
+    return false;
   } catch {
     return false;
   }
@@ -289,4 +316,4 @@ export function joinSseFrameBytes(parts: readonly Uint8Array[]): Uint8Array {
     offset += part.byteLength;
   }
   return joined;
-}
+}

package/src/server/ws-bridge.ts

@@ -34,6 +34,8 @@ export interface WsData {
   authContext?: CodexAuthContext; // last resolved account decision for observability/registry cleanup
   cancel?: () => void; // cancels the in-flight stream reader/fetch
   turnId?: number; // monotonically increasing per socket; prevents stale frames after replacement turns
+  /** Fixed-size logical session lane derived at the HTTP upgrade boundary. */
+  sessionLaneId?: string;
   /** Discriminator: Responses reframing vs transparent live/realtime sideband relay. */
   kind?: "responses" | "live-sideband";
   liveUpstream?: WebSocket;
@@ -60,10 +62,20 @@ export interface WsData {
  * A test that only asserts "the socket opened" would still pass if the admission
  * were dropped from the payload, so the payload itself is what gets asserted.
  */
-export function buildResponsesWsData(headers: Headers, admission: DataPlaneAdmission, admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>): WsData {
+export function buildResponsesWsData(
+  headers: Headers,
+  admission: DataPlaneAdmission,
+  admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>,
+  sessionLaneId?: string,
+): WsData {
   // Auth is handshake-time only on this path: the per-frame contexts have no
   // request headers left to re-resolve from, so the decision rides along here.
-  return { headers, admission, ...(admissionLease ? { admissionLease } : {}) };
+  return {
+    headers,
+    admission,
+    ...(admissionLease ? { admissionLease } : {}),
+    ...(sessionLaneId ? { sessionLaneId } : {}),
+  };
 }
 
 export class WsSendDroppedError extends Error {