@jeffusion/bungee-llms 5.22.0 → 5.23.0

package/dist/index.js

@@ -3465,7 +3465,13 @@ function normalizeUsage(raw, protocol, prior = {}) {
     output_tokens_details: { reasoning_tokens: tokens(reasoning ?? prior.output_tokens_details?.reasoning_tokens, "reasoning_tokens") }
   };
 }
-function toolItem(id, name, args, names, status = "completed") {
+function isCollaborationFunction(name, namespace, custom = false) {
+  return !custom && namespace === "collaboration" && typeof name === "string" && ["spawn_agent", "send_message", "followup_task"].includes(name);
+}
+function plaintextCollaborationCall(item, delivery) {
+  return delivery === "plaintext" && item.type === "function_call" && isCollaborationFunction(item.name, item.namespace) ? { ...item, encrypted_function_args: [] } : item;
+}
+function toolItem(id, name, args, names, status = "completed", agentMessageDelivery) {
   const original = restoreTool(name, names);
   const item = { id: `fc_${id}`, type: original.custom ? "custom_tool_call" : "function_call", call_id: id, name: original.name, status };
   if (original.namespace)
@@ -3476,7 +3482,7 @@ function toolItem(id, name, args, names, status = "completed") {
     argumentObject(args);
     item.arguments = args;
   }
-  return item;
+  return plaintextCollaborationCall(item, agentMessageDelivery);
 }
 function responsePayload(id, model, output, end, usage, error, createdAt = Math.floor(Date.now() / 1000)) {
   const result = { id, object: "response", created_at: createdAt, model, status: end.status, output, usage: Object.keys(usage).length ? usage : null };
@@ -3487,6 +3493,114 @@ function responsePayload(id, model, output, end, usage, error, createdAt = Math.
   return result;
 }
 
+// src/responses-codec/agent-messages.ts
+function exact(value, keys, path) {
+  for (const key of Object.keys(value))
+    if (!keys.includes(key))
+      fail("unsupported_content", "Unknown agent message field", `${path}.${key}`);
+}
+function validateAgentMessage(raw, path, configuredLimits, allowEncrypted = false) {
+  const budget = limits(configuredLimits);
+  const item = atParam(path, () => record(raw, "agent message"));
+  exact(item, ["type", "id", "author", "recipient", "content", "internal_chat_message_metadata_passthrough"], path);
+  if (item.type !== "agent_message")
+    fail("unsupported_content", "Expected agent message", `${path}.type`);
+  if (item.id !== undefined)
+    atParam(`${path}.id`, () => string(item.id, "agent message id", true));
+  if (item.internal_chat_message_metadata_passthrough !== undefined)
+    atParam(`${path}.internal_chat_message_metadata_passthrough`, () => record(item.internal_chat_message_metadata_passthrough, "message metadata"));
+  for (const key of ["author", "recipient"])
+    atParam(`${path}.${key}`, () => string(item[key], "agent identity", true));
+  const content = atParam(`${path}.content`, () => list(item.content, "agent content"));
+  if (content.length > budget.maxItems)
+    fail("resource_limit", "Too many agent content parts", `${path}.content`);
+  for (const [index, rawPart] of content.entries()) {
+    const partPath = `${path}.content[${index}]`;
+    const part = atParam(partPath, () => record(rawPart, "agent content part"));
+    if (part.type === "encrypted_content") {
+      exact(part, ["type", "encrypted_content"], partPath);
+      atParam(`${partPath}.encrypted_content`, () => string(part.encrypted_content, "encrypted content", true));
+      if (!allowEncrypted)
+        fail("unsupported_content", "Encrypted agent content requires explicit plaintext replacement", `${partPath}.encrypted_content`);
+    } else {
+      exact(part, ["type", "text"], partPath);
+      if (part.type !== "input_text")
+        fail("unsupported_content", "Agent messages require input text", `${partPath}.type`);
+      atParam(`${partPath}.text`, () => string(part.text, "agent input text"));
+    }
+  }
+  atParam(path, () => serialized(item, budget.maxRequestBytes, "agent message"));
+  return item;
+}
+function inspectAgentMessages(raw, options = {}) {
+  const budget = limits(options.limits);
+  const body = atParam("request", () => record(raw, "request"));
+  atParam("request", () => serialized(body, budget.maxRequestBytes, "request"));
+  const input = typeof body.input === "string" ? [] : atParam("input", () => list(body.input, "input"));
+  if (input.length > budget.maxItems)
+    fail("resource_limit", "Too many input items", "input");
+  const messages = [], diagnostics = [];
+  let parts = 0;
+  for (const [inputIndex, rawItem] of input.entries()) {
+    const item = atParam(`input[${inputIndex}]`, () => record(rawItem, "input item"));
+    if (item.type !== "agent_message")
+      continue;
+    validateAgentMessage(item, `input[${inputIndex}]`, options.limits, true);
+    const encryptedContents = [];
+    for (const [contentIndex, part] of item.content.entries()) {
+      if (++parts > budget.maxItems)
+        fail("resource_limit", "Too many agent content parts", "input");
+      if (part.type === "encrypted_content") {
+        const param = `input[${inputIndex}].content[${contentIndex}].encrypted_content`;
+        encryptedContents.push({ contentIndex, param });
+      }
+    }
+    messages.push({ inputIndex, author: item.author, recipient: item.recipient, encryptedContents });
+  }
+  return { messages, diagnostics };
+}
+function replaceAgentMessageEncryptedContent(raw, replacements, options = {}) {
+  const inspection = inspectAgentMessages(raw, options);
+  const budget = limits(options.limits);
+  if (!Array.isArray(replacements))
+    fail("invalid_payload", "Replacements must be an array", "replacements");
+  if (replacements.length > budget.maxItems)
+    fail("resource_limit", "Too many replacements", "replacements");
+  const locations = new Map(inspection.messages.flatMap((m) => m.encryptedContents.map((c) => [c.param, { inputIndex: m.inputIndex, contentIndex: c.contentIndex }])));
+  const selected = new Set;
+  let body;
+  try {
+    body = structuredClone(record(raw, "request"));
+  } catch {
+    fail("invalid_payload", "Request must be cloneable JSON", "request");
+  }
+  const diagnostics = [];
+  for (const [i, rawReplacement] of replacements.entries()) {
+    const replacement = atParam(`replacements[${i}]`, () => record(rawReplacement, "replacement"));
+    exact(replacement, ["param", "text"], `replacements[${i}]`);
+    const param = atParam(`replacements[${i}].param`, () => string(replacement.param, "replacement param", true));
+    const text = atParam(`replacements[${i}].text`, () => string(replacement.text, "replacement text"));
+    const location = locations.get(param);
+    if (!location || selected.has(param))
+      fail("invalid_payload", "Replacement must identify one unique encrypted agent content block", `replacements[${i}].param`);
+    selected.add(param);
+    record(body.input[location.inputIndex], "agent message").content[location.contentIndex] = { type: "input_text", text };
+    diagnostics.push({ param, action: "mapped", reason: "agent_message_plaintext_replacement" });
+  }
+  atParam("request", () => serialized(body, budget.maxRequestBytes, "request"));
+  return { body, diagnostics };
+}
+function validateEncryptedFunctionArgs(item, delivery, path) {
+  if (item.encrypted_function_args === undefined)
+    return;
+  const param = `${path}.encrypted_function_args`;
+  if (delivery !== "plaintext" || !isCollaborationFunction(item.name, item.namespace, item.type !== "function_call"))
+    fail("unsupported_content", "Encrypted function argument marker is unavailable for this tool", param);
+  const values = atParam(param, () => list(item.encrypted_function_args, "encrypted function arguments"));
+  if (values.length)
+    fail("unsupported_content", "Encrypted function arguments cannot cross protocols", param);
+}
+
 // src/responses-codec/request-preferences.ts
 function fields(value, allowed, path) {
   for (const key of Object.keys(value))
@@ -3620,6 +3734,8 @@ function definitionKey(value) {
 }
 function decodeResponsesRequest(raw, protocol, capabilities = {}) {
   const body = record(raw, "Responses request");
+  if (capabilities.agentMessageDelivery !== undefined && capabilities.agentMessageDelivery !== "plaintext")
+    fail("invalid_payload", "Unknown agent message delivery policy", "agentMessageDelivery");
   const budget = limits(capabilities.limits);
   serialized(body, budget.maxRequestBytes, "request");
   const supported = new Set([
@@ -3744,7 +3860,18 @@ function decodeResponsesRequest(raw, protocol, capabilities = {}) {
     }
     const wire = register(name, namespace, custom);
     definitions.set(key, signature);
-    const parameters = custom ? { type: "object", properties: { input: { type: "string" } }, required: ["input"], additionalProperties: false } : record(tool.parameters ?? { type: "object", properties: {} }, "tool parameters");
+    let parameters = custom ? { type: "object", properties: { input: { type: "string" } }, required: ["input"], additionalProperties: false } : record(tool.parameters ?? { type: "object", properties: {} }, "tool parameters");
+    if (capabilities.agentMessageDelivery === "plaintext" && isCollaborationFunction(name, namespace, custom)) {
+      const properties = parameters.properties;
+      if (properties && typeof properties === "object" && !Array.isArray(properties)) {
+        const message = properties.message;
+        if (message && typeof message === "object" && !Array.isArray(message) && message.encrypted === true) {
+          const { encrypted: _encrypted, ...plaintext } = message;
+          parameters = { ...parameters, properties: { ...properties, message: plaintext } };
+          diagnostics.push({ param: `${path}.parameters.properties.message.encrypted`, action: "omitted", reason: "collaboration_message_plaintext_delivery" });
+        }
+      }
+    }
     const declaredDescription = tool.description === undefined ? undefined : string(tool.description, "tool description");
     const identityHint = capabilities.preserveToolIdentityDescription ? `Original tool identity: ${JSON.stringify({ name, ...namespace ? { namespace } : {} })}` : undefined;
     const description = [identityHint, namespaceDescription, declaredDescription].filter((value) => value !== undefined).join(`
@@ -3849,7 +3976,20 @@ function decodeResponsesRequest(raw, protocol, capabilities = {}) {
       const item = record(rawItem, "input item");
       if (item.type === "additional_tools")
         return;
-      if (item.encrypted_content != null || item.type === "compaction")
+      if (item.type === "agent_message") {
+        validateAgentMessage(item, messageParam, capabilities.limits);
+        if (capabilities.agentMessageDelivery !== "plaintext")
+          fail("unsupported_content", "Agent messages require explicit plaintext delivery", messageParam);
+        if (pendingReasoning)
+          fail("unsupported_reasoning", "Reasoning must precede an assistant item", messageParam);
+        addMessage({ role: "user", content: [{ type: "text", text: `[Agent message metadata: ${JSON.stringify({ author: item.author, recipient: item.recipient })}]
+` }, ...item.content.map((part) => ({ type: "text", text: part.text }))] });
+        diagnostics.push({ param: messageParam, action: "mapped", reason: "agent_message_plaintext_delivery" });
+        return;
+      }
+      if (item.encrypted_content != null)
+        fail("unsupported_content", "Encrypted content cannot cross protocols", `${messageParam}.encrypted_content`);
+      if (item.type === "compaction")
         fail("unsupported_content", "Encrypted reasoning and compaction cannot be restored");
       if (item.type === "item_reference")
         fail("unresolved_reference", "Input item references must be resolved before conversion");
@@ -3869,6 +4009,7 @@ function decodeResponsesRequest(raw, protocol, capabilities = {}) {
       }
       if (item.type === "function_call" || item.type === "custom_tool_call") {
         const custom = item.type === "custom_tool_call";
+        validateEncryptedFunctionArgs(item, capabilities.agentMessageDelivery, messageParam);
         const id = string(item.call_id, "call_id", true);
         if (callIds.has(id))
           fail("invalid_tool_history", "Duplicate tool call identifier");
@@ -4087,9 +4228,9 @@ class ResponsesEventEncoder {
   item(state, status, strict = false) {
     if (state.kind === "tool") {
       if (strict)
-        return { ...toolItem(state.callId, state.name, state.args || "{}", this.toolNames, status), id: state.id };
+        return { ...toolItem(state.callId, state.name, state.args || "{}", this.toolNames, status, this.options.agentMessageDelivery), id: state.id };
       const original = state.original ?? restoreTool(state.name, this.toolNames);
-      return {
+      return plaintextCollaborationCall({
         id: state.id,
         type: original.custom ? "custom_tool_call" : "function_call",
         call_id: state.callId,
@@ -4097,7 +4238,7 @@ class ResponsesEventEncoder {
         ...original.namespace ? { namespace: original.namespace } : {},
         status,
         ...original.custom ? { input: state.emittedInput } : { arguments: state.args }
-      };
+      }, this.options.agentMessageDelivery);
     }
     if (state.kind === "reasoning")
       return { id: state.id, type: "reasoning", summary: status === "in_progress" ? [] : [{ type: "summary_text", text: state.text }] };
@@ -4410,13 +4551,13 @@ class ResponsesEventEncoder {
 }
 
 // src/responses-codec/result.ts
-function encodeResponsesResult(raw, protocol, model, toolNames = new Map, configuredLimits) {
+function encodeResponsesResult(raw, protocol, model, toolNames = new Map, configuredLimits, options = {}) {
   const body = record(raw, "upstream response");
   const budget = limits(configuredLimits);
   serialized(body, budget.maxOutputBytes, "upstream response");
   if (body.error !== undefined || body.type === "error")
     return responsePayload(`resp_${crypto.randomUUID().replaceAll("-", "")}`, model, [], { status: "failed", reason: "upstream_error" }, {}, record(body.error, "upstream error"));
-  const encoder = new ResponsesEventEncoder(protocol, model, toolNames, configuredLimits);
+  const encoder = new ResponsesEventEncoder(protocol, model, toolNames, configuredLimits, options);
   if (protocol === "chat_completions") {
     const choices = list(body.choices, "choices");
     if (choices.length !== 1)
@@ -4834,7 +4975,7 @@ function canonicalRequest(raw, protocol, model) {
   }
   return out;
 }
-function validateCanonical(b) {
+function validateCanonical(b, context) {
   for (const key of ["stream", "parallel_tool_calls", "store", "background"])
     if (b[key] !== undefined)
       bool(b[key], key);
@@ -4864,7 +5005,11 @@ function validateCanonical(b) {
   const input = typeof b.input === "string" ? [] : list(b.input, "input");
   for (const [i, raw] of input.entries()) {
     const t = record(raw, "input item"), p = `input[${i}]`;
-    const allowed = t.type === "function_call" ? ["type", "id", "status", "call_id", "name", "namespace", "arguments"] : t.type === "custom_tool_call" ? ["type", "id", "status", "call_id", "name", "namespace", "input"] : t.type === "function_call_output" || t.type === "custom_tool_call_output" ? ["type", "id", "call_id", "output", "is_error"] : t.type === "reasoning" ? ["type", "id", "status", "summary", "content", "encrypted_content", "internal_chat_message_metadata_passthrough"] : t.type === "additional_tools" ? ["type", "id", "role", "tools"] : ["type", "id", "status", "role", "content", "internal_chat_message_metadata_passthrough"];
+    if (t.type === "agent_message") {
+      validateAgentMessage(t, p, context.capabilities?.limits);
+      continue;
+    }
+    const allowed = t.type === "function_call" ? ["type", "id", "status", "call_id", "name", "namespace", "arguments", "encrypted_function_args"] : t.type === "custom_tool_call" ? ["type", "id", "status", "call_id", "name", "namespace", "input"] : t.type === "function_call_output" || t.type === "custom_tool_call_output" ? ["type", "id", "call_id", "output", "is_error"] : t.type === "reasoning" ? ["type", "id", "status", "summary", "content", "encrypted_content", "internal_chat_message_metadata_passthrough"] : t.type === "additional_tools" ? ["type", "id", "role", "tools"] : ["type", "id", "status", "role", "content", "internal_chat_message_metadata_passthrough"];
     fields2(t, [...allowed, "internal_chat_message_metadata_passthrough"], p, "unsupported_content");
     if (t.is_error !== undefined)
       bool(t.is_error, `${p}.is_error`);
@@ -4914,8 +5059,8 @@ function convertProtocolRequest(raw, context) {
       fail("invalid_payload", "Request stream mode disagrees with transport context", "stream");
     b.stream = context.streaming;
   }
-  validateCanonical(b);
-  const cap = { ...context.capabilities, omitOptionalWebSearch: true, preserveToolIdentityDescription: true, preserveRefusalContent: true }, policy = context.reasoningPolicy;
+  validateCanonical(b, context);
+  const cap = { ...context.capabilities, agentMessageDelivery: context.agentMessageDelivery ?? context.capabilities?.agentMessageDelivery, omitOptionalWebSearch: true, preserveToolIdentityDescription: true, preserveRefusalContent: true }, policy = context.reasoningPolicy;
   const reasoning = b.reasoning === undefined ? undefined : record(b.reasoning, "reasoning");
   const sourceThinking = b.sourceThinking;
   delete b.sourceThinking;
@@ -5202,7 +5347,7 @@ function validateCanonicalResponse(raw, context, itemOnly = false) {
       fail("unsupported_response", "Unknown item status", `${path}.status`);
     if (b.status === "completed" && t.status !== undefined && t.status !== "completed")
       fail("invalid_stream", "Completed response contains an unfinished item", `${path}.status`);
-    fields2(t, t.type === "message" ? ["type", "id", "role", "status", "content"] : t.type === "reasoning" ? ["type", "id", "summary", "status", "encrypted_content", "content"] : t.type === "function_call" ? ["type", "id", "status", "name", "namespace", "call_id", "arguments"] : ["type", "id", "status", "name", "namespace", "call_id", "input"], path, "unsupported_content");
+    fields2(t, t.type === "message" ? ["type", "id", "role", "status", "content"] : t.type === "reasoning" ? ["type", "id", "summary", "status", "encrypted_content", "content"] : t.type === "function_call" ? ["type", "id", "status", "name", "namespace", "call_id", "arguments", "encrypted_function_args"] : ["type", "id", "status", "name", "namespace", "call_id", "input"], path, "unsupported_content");
     if (t.type === "message") {
       if (t.role !== "assistant")
         fail("unsupported_content", "Output message must be assistant", `${path}.role`);
@@ -5229,6 +5374,7 @@ function validateCanonicalResponse(raw, context, itemOnly = false) {
         string(p.text, "summary");
       }
     } else if (t.type === "function_call" || t.type === "custom_tool_call") {
+      validateEncryptedFunctionArgs(t, context.capabilities?.agentMessageDelivery, path);
       const id = string(t.call_id, "call_id", true);
       if (ids.has(id))
         fail("invalid_tool_arguments", "Duplicate output tool call id", path);
@@ -5439,7 +5585,7 @@ function canonicalResponse(raw, context, names) {
     return record(events.at(-1)?.response, "response");
   }
   validateProviderResponse(raw, context.targetProtocol);
-  const result = encodeResponsesResult(raw, context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits);
+  const result = encodeResponsesResult(raw, context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits, { agentMessageDelivery: context.capabilities?.agentMessageDelivery });
   if (result.status === "failed")
     result.error = safeProtocolError();
   const usage = record(raw, "response").usage;
@@ -5834,6 +5980,10 @@ function createProtocolSession(context) {
     capabilities: context.capabilities ? { ...context.capabilities, limits: context.capabilities.limits ? { ...context.capabilities.limits } : undefined } : undefined,
     reasoningPolicy: context.reasoningPolicy ? { ...context.reasoningPolicy, effortMap: context.reasoningPolicy.effortMap ? { ...context.reasoningPolicy.effortMap } : undefined } : undefined
   };
+  const delivery = context.agentMessageDelivery ?? context.capabilities?.agentMessageDelivery;
+  if (delivery !== undefined && delivery !== "plaintext")
+    fail("invalid_payload", "Unknown agent message delivery policy", "agentMessageDelivery");
+  context.capabilities = { ...context.capabilities, agentMessageDelivery: delivery };
   if (!LLM_PROTOCOLS.includes(context.sourceProtocol) || !LLM_PROTOCOLS.includes(context.targetProtocol))
     fail("unsupported_protocol", "Unknown protocol");
   if (typeof context.model !== "string" || !context.model)
@@ -5872,7 +6022,7 @@ function createProtocolSession(context) {
     else if (context.targetProtocol === "gemini_generate_content")
       encoder = new GeminiCanonicalDecoder(context, names);
     else
-      encoder = new ResponsesEventEncoder(context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits, { preserveContentOrder: true });
+      encoder = new ResponsesEventEncoder(context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits, { preserveContentOrder: true, agentMessageDelivery: context.capabilities?.agentMessageDelivery });
     validator = context.targetProtocol === "responses" ? undefined : new CanonicalStreamValidator(context);
     renderer = new CanonicalStreamRenderer(context.sourceProtocol, context);
   };
@@ -6086,7 +6236,9 @@ export {
   encodeResponsesResult,
   finalizeTokenAccountingEvent,
   getProviderTokenAccountingCapabilities,
+  inspectAgentMessages,
   isRecord5 as isRecord,
   readNumber,
-  readRecord
+  readRecord,
+  replaceAgentMessageEncryptedContent
 };

package/dist/plugin-api.js

@@ -1757,6 +1757,311 @@ function createTokenAccountingSession(input, options = {}) {
     }
   };
 }
+// src/responses-codec/common.ts
+var DEFAULT_RESPONSES_CODEC_LIMITS = Object.freeze({
+  maxRequestBytes: 8 * 1024 * 1024,
+  maxOutputBytes: 8 * 1024 * 1024,
+  maxArgumentBytes: 1024 * 1024,
+  maxItems: 1024
+});
+
+class ResponsesCodecError extends Error {
+  code;
+  param;
+  constructor(code, message, param) {
+    super(message);
+    this.code = code;
+    this.param = param;
+    this.name = "ResponsesCodecError";
+  }
+}
+function fail(code, message, param) {
+  throw new ResponsesCodecError(code, message, param);
+}
+function atParam(param, run) {
+  try {
+    return run();
+  } catch (error) {
+    if (error instanceof ResponsesCodecError && error.param === undefined)
+      throw new ResponsesCodecError(error.code, error.message, param);
+    throw error;
+  }
+}
+function record(value, where) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail("invalid_payload", `${where} must be an object`);
+  return value;
+}
+function string(value, where, nonempty = false) {
+  if (typeof value !== "string" || nonempty && !value)
+    fail("invalid_payload", `${where} must be a${nonempty ? " non-empty" : ""} string`);
+  return value;
+}
+function list(value, where) {
+  if (!Array.isArray(value))
+    fail("invalid_payload", `${where} must be an array`);
+  return value;
+}
+function limits(overrides) {
+  const result = { ...DEFAULT_RESPONSES_CODEC_LIMITS, ...overrides };
+  for (const [key, value] of Object.entries(result)) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+      fail("invalid_limit", `${key} must be a positive integer`);
+  }
+  return result;
+}
+function bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function bounded(value, max, where) {
+  if (bytes(value) > max)
+    fail("resource_limit", `${where} exceeds ${max} bytes`);
+  return value;
+}
+function serialized(value, max, where) {
+  let result;
+  try {
+    result = JSON.stringify(value);
+  } catch {
+    fail("invalid_payload", `${where} must be serializable JSON`);
+  }
+  if (result === undefined)
+    fail("invalid_payload", `${where} must be serializable JSON`);
+  return bounded(result, max, where);
+}
+function argumentObject(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    fail("invalid_tool_arguments", "Tool arguments must be complete JSON");
+  }
+  return record(value, "tool arguments");
+}
+function restoreTool(name, names) {
+  const result = names.get(name);
+  if (result)
+    return result;
+  if (names.size)
+    fail("unknown_tool", `Provider returned undeclared tool ${name}`);
+  return { name, custom: false };
+}
+function customInput(text) {
+  const value = argumentObject(text);
+  if (Object.keys(value).length !== 1 || typeof value.input !== "string") {
+    fail("invalid_tool_arguments", "Custom tools require exactly one string input property");
+  }
+  return value.input;
+}
+function customInputPrefix(text) {
+  const prefix = /^\s*\{\s*"input"\s*:\s*"/.exec(text);
+  if (!prefix)
+    return "";
+  let result = "";
+  for (let i = prefix[0].length;i < text.length; ) {
+    const char = text[i];
+    if (char === '"')
+      break;
+    if (char !== "\\") {
+      if (char.charCodeAt(0) < 32)
+        fail("invalid_tool_arguments", "Invalid JSON string character");
+      result += char;
+      i++;
+      continue;
+    }
+    const escape = text[i + 1];
+    if (escape === undefined)
+      break;
+    const size = escape === "u" ? 6 : 2;
+    if (i + size > text.length)
+      break;
+    try {
+      result += JSON.parse(`"${text.slice(i, i + size)}"`);
+    } catch {
+      fail("invalid_tool_arguments", "Invalid JSON string escape");
+    }
+    i += size;
+  }
+  return result;
+}
+function terminal(reason, protocol) {
+  if (typeof reason !== "string" || !reason)
+    fail("missing_terminal", "Upstream has no explicit completion reason");
+  const completed = protocol === "chat_completions" ? ["stop", "tool_calls", "function_call"] : ["end_turn", "tool_use", "stop_sequence"];
+  if (completed.includes(reason))
+    return { status: "completed", reason };
+  if (reason === "length" || reason === "max_tokens" || reason === "model_context_window_exceeded")
+    return { status: "incomplete", reason: "max_output_tokens" };
+  if (reason === "content_filter" || reason === "refusal")
+    return { status: "incomplete", reason: "content_filter" };
+  if (reason === "error")
+    return { status: "failed", reason: "upstream_error" };
+  fail("unknown_terminal", `Unsupported upstream completion reason: ${reason}`);
+}
+function tokens(value, where) {
+  if (value === undefined)
+    return 0;
+  if (!Number.isSafeInteger(value) || value < 0)
+    fail("invalid_usage", `${where} must be a non-negative integer`);
+  return value;
+}
+function normalizeUsage(raw, protocol, prior = {}) {
+  if (raw === undefined || raw === null)
+    return prior;
+  const usage = record(raw, "usage");
+  const chat = protocol === "chat_completions";
+  const input = tokens(usage[chat ? "prompt_tokens" : "input_tokens"] ?? prior.input_tokens, "input_tokens");
+  const output = tokens(usage[chat ? "completion_tokens" : "output_tokens"] ?? prior.output_tokens, "output_tokens");
+  const details = chat ? usage.prompt_tokens_details : undefined;
+  const cached = chat ? details ? record(details, "prompt_tokens_details").cached_tokens : undefined : usage.cache_read_input_tokens;
+  const cacheRead = tokens(cached ?? prior.input_tokens_details?.cached_tokens, "cached_tokens");
+  const cacheWrite = chat ? 0 : tokens(usage.cache_creation_input_tokens ?? prior.input_tokens_details?.cache_creation_tokens, "cache_creation_input_tokens");
+  const totalInput = chat ? input : usage.input_tokens === undefined ? input : input + cacheRead + cacheWrite;
+  const reasoning = chat && usage.completion_tokens_details ? record(usage.completion_tokens_details, "completion_tokens_details").reasoning_tokens : undefined;
+  return {
+    input_tokens: totalInput,
+    output_tokens: output,
+    total_tokens: totalInput + output,
+    input_tokens_details: { cached_tokens: cacheRead, ...cacheWrite ? { cache_creation_tokens: cacheWrite } : {} },
+    output_tokens_details: { reasoning_tokens: tokens(reasoning ?? prior.output_tokens_details?.reasoning_tokens, "reasoning_tokens") }
+  };
+}
+function isCollaborationFunction(name, namespace, custom = false) {
+  return !custom && namespace === "collaboration" && typeof name === "string" && ["spawn_agent", "send_message", "followup_task"].includes(name);
+}
+function plaintextCollaborationCall(item, delivery) {
+  return delivery === "plaintext" && item.type === "function_call" && isCollaborationFunction(item.name, item.namespace) ? { ...item, encrypted_function_args: [] } : item;
+}
+function toolItem(id, name, args, names, status = "completed", agentMessageDelivery) {
+  const original = restoreTool(name, names);
+  const item = { id: `fc_${id}`, type: original.custom ? "custom_tool_call" : "function_call", call_id: id, name: original.name, status };
+  if (original.namespace)
+    item.namespace = original.namespace;
+  if (original.custom)
+    item.input = customInput(args);
+  else {
+    argumentObject(args);
+    item.arguments = args;
+  }
+  return plaintextCollaborationCall(item, agentMessageDelivery);
+}
+function responsePayload(id, model, output, end, usage, error, createdAt = Math.floor(Date.now() / 1000)) {
+  const result = { id, object: "response", created_at: createdAt, model, status: end.status, output, usage: Object.keys(usage).length ? usage : null };
+  if (end.status === "incomplete")
+    result.incomplete_details = { reason: end.reason };
+  if (end.status === "failed")
+    result.error = error ?? { code: end.reason, message: end.reason };
+  return result;
+}
+
+// src/responses-codec/agent-messages.ts
+function exact(value, keys, path) {
+  for (const key of Object.keys(value))
+    if (!keys.includes(key))
+      fail("unsupported_content", "Unknown agent message field", `${path}.${key}`);
+}
+function validateAgentMessage(raw, path, configuredLimits, allowEncrypted = false) {
+  const budget = limits(configuredLimits);
+  const item = atParam(path, () => record(raw, "agent message"));
+  exact(item, ["type", "id", "author", "recipient", "content", "internal_chat_message_metadata_passthrough"], path);
+  if (item.type !== "agent_message")
+    fail("unsupported_content", "Expected agent message", `${path}.type`);
+  if (item.id !== undefined)
+    atParam(`${path}.id`, () => string(item.id, "agent message id", true));
+  if (item.internal_chat_message_metadata_passthrough !== undefined)
+    atParam(`${path}.internal_chat_message_metadata_passthrough`, () => record(item.internal_chat_message_metadata_passthrough, "message metadata"));
+  for (const key of ["author", "recipient"])
+    atParam(`${path}.${key}`, () => string(item[key], "agent identity", true));
+  const content = atParam(`${path}.content`, () => list(item.content, "agent content"));
+  if (content.length > budget.maxItems)
+    fail("resource_limit", "Too many agent content parts", `${path}.content`);
+  for (const [index, rawPart] of content.entries()) {
+    const partPath = `${path}.content[${index}]`;
+    const part = atParam(partPath, () => record(rawPart, "agent content part"));
+    if (part.type === "encrypted_content") {
+      exact(part, ["type", "encrypted_content"], partPath);
+      atParam(`${partPath}.encrypted_content`, () => string(part.encrypted_content, "encrypted content", true));
+      if (!allowEncrypted)
+        fail("unsupported_content", "Encrypted agent content requires explicit plaintext replacement", `${partPath}.encrypted_content`);
+    } else {
+      exact(part, ["type", "text"], partPath);
+      if (part.type !== "input_text")
+        fail("unsupported_content", "Agent messages require input text", `${partPath}.type`);
+      atParam(`${partPath}.text`, () => string(part.text, "agent input text"));
+    }
+  }
+  atParam(path, () => serialized(item, budget.maxRequestBytes, "agent message"));
+  return item;
+}
+function inspectAgentMessages(raw, options = {}) {
+  const budget = limits(options.limits);
+  const body = atParam("request", () => record(raw, "request"));
+  atParam("request", () => serialized(body, budget.maxRequestBytes, "request"));
+  const input = typeof body.input === "string" ? [] : atParam("input", () => list(body.input, "input"));
+  if (input.length > budget.maxItems)
+    fail("resource_limit", "Too many input items", "input");
+  const messages = [], diagnostics = [];
+  let parts = 0;
+  for (const [inputIndex, rawItem] of input.entries()) {
+    const item = atParam(`input[${inputIndex}]`, () => record(rawItem, "input item"));
+    if (item.type !== "agent_message")
+      continue;
+    validateAgentMessage(item, `input[${inputIndex}]`, options.limits, true);
+    const encryptedContents = [];
+    for (const [contentIndex, part] of item.content.entries()) {
+      if (++parts > budget.maxItems)
+        fail("resource_limit", "Too many agent content parts", "input");
+      if (part.type === "encrypted_content") {
+        const param = `input[${inputIndex}].content[${contentIndex}].encrypted_content`;
+        encryptedContents.push({ contentIndex, param });
+      }
+    }
+    messages.push({ inputIndex, author: item.author, recipient: item.recipient, encryptedContents });
+  }
+  return { messages, diagnostics };
+}
+function replaceAgentMessageEncryptedContent(raw, replacements, options = {}) {
+  const inspection = inspectAgentMessages(raw, options);
+  const budget = limits(options.limits);
+  if (!Array.isArray(replacements))
+    fail("invalid_payload", "Replacements must be an array", "replacements");
+  if (replacements.length > budget.maxItems)
+    fail("resource_limit", "Too many replacements", "replacements");
+  const locations = new Map(inspection.messages.flatMap((m) => m.encryptedContents.map((c) => [c.param, { inputIndex: m.inputIndex, contentIndex: c.contentIndex }])));
+  const selected = new Set;
+  let body;
+  try {
+    body = structuredClone(record(raw, "request"));
+  } catch {
+    fail("invalid_payload", "Request must be cloneable JSON", "request");
+  }
+  const diagnostics = [];
+  for (const [i, rawReplacement] of replacements.entries()) {
+    const replacement = atParam(`replacements[${i}]`, () => record(rawReplacement, "replacement"));
+    exact(replacement, ["param", "text"], `replacements[${i}]`);
+    const param = atParam(`replacements[${i}].param`, () => string(replacement.param, "replacement param", true));
+    const text = atParam(`replacements[${i}].text`, () => string(replacement.text, "replacement text"));
+    const location = locations.get(param);
+    if (!location || selected.has(param))
+      fail("invalid_payload", "Replacement must identify one unique encrypted agent content block", `replacements[${i}].param`);
+    selected.add(param);
+    record(body.input[location.inputIndex], "agent message").content[location.contentIndex] = { type: "input_text", text };
+    diagnostics.push({ param, action: "mapped", reason: "agent_message_plaintext_replacement" });
+  }
+  atParam("request", () => serialized(body, budget.maxRequestBytes, "request"));
+  return { body, diagnostics };
+}
+function validateEncryptedFunctionArgs(item, delivery, path) {
+  if (item.encrypted_function_args === undefined)
+    return;
+  const param = `${path}.encrypted_function_args`;
+  if (delivery !== "plaintext" || !isCollaborationFunction(item.name, item.namespace, item.type !== "function_call"))
+    fail("unsupported_content", "Encrypted function argument marker is unavailable for this tool", param);
+  const values = atParam(param, () => list(item.encrypted_function_args, "encrypted function arguments"));
+  if (values.length)
+    fail("unsupported_content", "Encrypted function arguments cannot cross protocols", param);
+}
+
 // src/providers/openai/protocol-conversion.ts
 var THINKING_TAG_PATTERN = /<thinking>([\s\S]*?)<\/thinking>/gi;
 var TOOL_CALL_CONTENT_TYPES = new Set([
@@ -2336,197 +2641,6 @@ class OpenAIProtocolConversion {
   }
 }
 
-// src/responses-codec/common.ts
-var DEFAULT_RESPONSES_CODEC_LIMITS = Object.freeze({
-  maxRequestBytes: 8 * 1024 * 1024,
-  maxOutputBytes: 8 * 1024 * 1024,
-  maxArgumentBytes: 1024 * 1024,
-  maxItems: 1024
-});
-
-class ResponsesCodecError extends Error {
-  code;
-  param;
-  constructor(code, message, param) {
-    super(message);
-    this.code = code;
-    this.param = param;
-    this.name = "ResponsesCodecError";
-  }
-}
-function fail(code, message, param) {
-  throw new ResponsesCodecError(code, message, param);
-}
-function atParam(param, run) {
-  try {
-    return run();
-  } catch (error) {
-    if (error instanceof ResponsesCodecError && error.param === undefined)
-      throw new ResponsesCodecError(error.code, error.message, param);
-    throw error;
-  }
-}
-function record(value, where) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    fail("invalid_payload", `${where} must be an object`);
-  return value;
-}
-function string(value, where, nonempty = false) {
-  if (typeof value !== "string" || nonempty && !value)
-    fail("invalid_payload", `${where} must be a${nonempty ? " non-empty" : ""} string`);
-  return value;
-}
-function list(value, where) {
-  if (!Array.isArray(value))
-    fail("invalid_payload", `${where} must be an array`);
-  return value;
-}
-function limits(overrides) {
-  const result = { ...DEFAULT_RESPONSES_CODEC_LIMITS, ...overrides };
-  for (const [key, value] of Object.entries(result)) {
-    if (!Number.isSafeInteger(value) || value <= 0)
-      fail("invalid_limit", `${key} must be a positive integer`);
-  }
-  return result;
-}
-function bytes(value) {
-  return new TextEncoder().encode(value).byteLength;
-}
-function bounded(value, max, where) {
-  if (bytes(value) > max)
-    fail("resource_limit", `${where} exceeds ${max} bytes`);
-  return value;
-}
-function serialized(value, max, where) {
-  let result;
-  try {
-    result = JSON.stringify(value);
-  } catch {
-    fail("invalid_payload", `${where} must be serializable JSON`);
-  }
-  if (result === undefined)
-    fail("invalid_payload", `${where} must be serializable JSON`);
-  return bounded(result, max, where);
-}
-function argumentObject(text) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    fail("invalid_tool_arguments", "Tool arguments must be complete JSON");
-  }
-  return record(value, "tool arguments");
-}
-function restoreTool(name, names) {
-  const result = names.get(name);
-  if (result)
-    return result;
-  if (names.size)
-    fail("unknown_tool", `Provider returned undeclared tool ${name}`);
-  return { name, custom: false };
-}
-function customInput(text) {
-  const value = argumentObject(text);
-  if (Object.keys(value).length !== 1 || typeof value.input !== "string") {
-    fail("invalid_tool_arguments", "Custom tools require exactly one string input property");
-  }
-  return value.input;
-}
-function customInputPrefix(text) {
-  const prefix = /^\s*\{\s*"input"\s*:\s*"/.exec(text);
-  if (!prefix)
-    return "";
-  let result = "";
-  for (let i = prefix[0].length;i < text.length; ) {
-    const char = text[i];
-    if (char === '"')
-      break;
-    if (char !== "\\") {
-      if (char.charCodeAt(0) < 32)
-        fail("invalid_tool_arguments", "Invalid JSON string character");
-      result += char;
-      i++;
-      continue;
-    }
-    const escape = text[i + 1];
-    if (escape === undefined)
-      break;
-    const size = escape === "u" ? 6 : 2;
-    if (i + size > text.length)
-      break;
-    try {
-      result += JSON.parse(`"${text.slice(i, i + size)}"`);
-    } catch {
-      fail("invalid_tool_arguments", "Invalid JSON string escape");
-    }
-    i += size;
-  }
-  return result;
-}
-function terminal(reason, protocol) {
-  if (typeof reason !== "string" || !reason)
-    fail("missing_terminal", "Upstream has no explicit completion reason");
-  const completed = protocol === "chat_completions" ? ["stop", "tool_calls", "function_call"] : ["end_turn", "tool_use", "stop_sequence"];
-  if (completed.includes(reason))
-    return { status: "completed", reason };
-  if (reason === "length" || reason === "max_tokens" || reason === "model_context_window_exceeded")
-    return { status: "incomplete", reason: "max_output_tokens" };
-  if (reason === "content_filter" || reason === "refusal")
-    return { status: "incomplete", reason: "content_filter" };
-  if (reason === "error")
-    return { status: "failed", reason: "upstream_error" };
-  fail("unknown_terminal", `Unsupported upstream completion reason: ${reason}`);
-}
-function tokens(value, where) {
-  if (value === undefined)
-    return 0;
-  if (!Number.isSafeInteger(value) || value < 0)
-    fail("invalid_usage", `${where} must be a non-negative integer`);
-  return value;
-}
-function normalizeUsage(raw, protocol, prior = {}) {
-  if (raw === undefined || raw === null)
-    return prior;
-  const usage = record(raw, "usage");
-  const chat = protocol === "chat_completions";
-  const input = tokens(usage[chat ? "prompt_tokens" : "input_tokens"] ?? prior.input_tokens, "input_tokens");
-  const output = tokens(usage[chat ? "completion_tokens" : "output_tokens"] ?? prior.output_tokens, "output_tokens");
-  const details = chat ? usage.prompt_tokens_details : undefined;
-  const cached = chat ? details ? record(details, "prompt_tokens_details").cached_tokens : undefined : usage.cache_read_input_tokens;
-  const cacheRead = tokens(cached ?? prior.input_tokens_details?.cached_tokens, "cached_tokens");
-  const cacheWrite = chat ? 0 : tokens(usage.cache_creation_input_tokens ?? prior.input_tokens_details?.cache_creation_tokens, "cache_creation_input_tokens");
-  const totalInput = chat ? input : usage.input_tokens === undefined ? input : input + cacheRead + cacheWrite;
-  const reasoning = chat && usage.completion_tokens_details ? record(usage.completion_tokens_details, "completion_tokens_details").reasoning_tokens : undefined;
-  return {
-    input_tokens: totalInput,
-    output_tokens: output,
-    total_tokens: totalInput + output,
-    input_tokens_details: { cached_tokens: cacheRead, ...cacheWrite ? { cache_creation_tokens: cacheWrite } : {} },
-    output_tokens_details: { reasoning_tokens: tokens(reasoning ?? prior.output_tokens_details?.reasoning_tokens, "reasoning_tokens") }
-  };
-}
-function toolItem(id, name, args, names, status = "completed") {
-  const original = restoreTool(name, names);
-  const item = { id: `fc_${id}`, type: original.custom ? "custom_tool_call" : "function_call", call_id: id, name: original.name, status };
-  if (original.namespace)
-    item.namespace = original.namespace;
-  if (original.custom)
-    item.input = customInput(args);
-  else {
-    argumentObject(args);
-    item.arguments = args;
-  }
-  return item;
-}
-function responsePayload(id, model, output, end, usage, error, createdAt = Math.floor(Date.now() / 1000)) {
-  const result = { id, object: "response", created_at: createdAt, model, status: end.status, output, usage: Object.keys(usage).length ? usage : null };
-  if (end.status === "incomplete")
-    result.incomplete_details = { reason: end.reason };
-  if (end.status === "failed")
-    result.error = error ?? { code: end.reason, message: end.reason };
-  return result;
-}
-
 // src/responses-codec/request-preferences.ts
 function fields(value, allowed, path) {
   for (const key of Object.keys(value))
@@ -2660,6 +2774,8 @@ function definitionKey(value) {
 }
 function decodeResponsesRequest(raw, protocol, capabilities = {}) {
   const body = record(raw, "Responses request");
+  if (capabilities.agentMessageDelivery !== undefined && capabilities.agentMessageDelivery !== "plaintext")
+    fail("invalid_payload", "Unknown agent message delivery policy", "agentMessageDelivery");
   const budget = limits(capabilities.limits);
   serialized(body, budget.maxRequestBytes, "request");
   const supported = new Set([
@@ -2784,7 +2900,18 @@ function decodeResponsesRequest(raw, protocol, capabilities = {}) {
     }
     const wire = register(name, namespace, custom);
     definitions.set(key, signature);
-    const parameters = custom ? { type: "object", properties: { input: { type: "string" } }, required: ["input"], additionalProperties: false } : record(tool.parameters ?? { type: "object", properties: {} }, "tool parameters");
+    let parameters = custom ? { type: "object", properties: { input: { type: "string" } }, required: ["input"], additionalProperties: false } : record(tool.parameters ?? { type: "object", properties: {} }, "tool parameters");
+    if (capabilities.agentMessageDelivery === "plaintext" && isCollaborationFunction(name, namespace, custom)) {
+      const properties = parameters.properties;
+      if (properties && typeof properties === "object" && !Array.isArray(properties)) {
+        const message = properties.message;
+        if (message && typeof message === "object" && !Array.isArray(message) && message.encrypted === true) {
+          const { encrypted: _encrypted, ...plaintext } = message;
+          parameters = { ...parameters, properties: { ...properties, message: plaintext } };
+          diagnostics.push({ param: `${path}.parameters.properties.message.encrypted`, action: "omitted", reason: "collaboration_message_plaintext_delivery" });
+        }
+      }
+    }
     const declaredDescription = tool.description === undefined ? undefined : string(tool.description, "tool description");
     const identityHint = capabilities.preserveToolIdentityDescription ? `Original tool identity: ${JSON.stringify({ name, ...namespace ? { namespace } : {} })}` : undefined;
     const description = [identityHint, namespaceDescription, declaredDescription].filter((value) => value !== undefined).join(`
@@ -2889,7 +3016,20 @@ function decodeResponsesRequest(raw, protocol, capabilities = {}) {
       const item = record(rawItem, "input item");
       if (item.type === "additional_tools")
         return;
-      if (item.encrypted_content != null || item.type === "compaction")
+      if (item.type === "agent_message") {
+        validateAgentMessage(item, messageParam, capabilities.limits);
+        if (capabilities.agentMessageDelivery !== "plaintext")
+          fail("unsupported_content", "Agent messages require explicit plaintext delivery", messageParam);
+        if (pendingReasoning)
+          fail("unsupported_reasoning", "Reasoning must precede an assistant item", messageParam);
+        addMessage({ role: "user", content: [{ type: "text", text: `[Agent message metadata: ${JSON.stringify({ author: item.author, recipient: item.recipient })}]
+` }, ...item.content.map((part) => ({ type: "text", text: part.text }))] });
+        diagnostics.push({ param: messageParam, action: "mapped", reason: "agent_message_plaintext_delivery" });
+        return;
+      }
+      if (item.encrypted_content != null)
+        fail("unsupported_content", "Encrypted content cannot cross protocols", `${messageParam}.encrypted_content`);
+      if (item.type === "compaction")
         fail("unsupported_content", "Encrypted reasoning and compaction cannot be restored");
       if (item.type === "item_reference")
         fail("unresolved_reference", "Input item references must be resolved before conversion");
@@ -2909,6 +3049,7 @@ function decodeResponsesRequest(raw, protocol, capabilities = {}) {
       }
       if (item.type === "function_call" || item.type === "custom_tool_call") {
         const custom = item.type === "custom_tool_call";
+        validateEncryptedFunctionArgs(item, capabilities.agentMessageDelivery, messageParam);
         const id = string(item.call_id, "call_id", true);
         if (callIds.has(id))
           fail("invalid_tool_history", "Duplicate tool call identifier");
@@ -3127,9 +3268,9 @@ class ResponsesEventEncoder {
   item(state, status, strict = false) {
     if (state.kind === "tool") {
       if (strict)
-        return { ...toolItem(state.callId, state.name, state.args || "{}", this.toolNames, status), id: state.id };
+        return { ...toolItem(state.callId, state.name, state.args || "{}", this.toolNames, status, this.options.agentMessageDelivery), id: state.id };
       const original = state.original ?? restoreTool(state.name, this.toolNames);
-      return {
+      return plaintextCollaborationCall({
         id: state.id,
         type: original.custom ? "custom_tool_call" : "function_call",
         call_id: state.callId,
@@ -3137,7 +3278,7 @@ class ResponsesEventEncoder {
         ...original.namespace ? { namespace: original.namespace } : {},
         status,
         ...original.custom ? { input: state.emittedInput } : { arguments: state.args }
-      };
+      }, this.options.agentMessageDelivery);
     }
     if (state.kind === "reasoning")
       return { id: state.id, type: "reasoning", summary: status === "in_progress" ? [] : [{ type: "summary_text", text: state.text }] };
@@ -3450,13 +3591,13 @@ class ResponsesEventEncoder {
 }
 
 // src/responses-codec/result.ts
-function encodeResponsesResult(raw, protocol, model, toolNames = new Map, configuredLimits) {
+function encodeResponsesResult(raw, protocol, model, toolNames = new Map, configuredLimits, options = {}) {
   const body = record(raw, "upstream response");
   const budget = limits(configuredLimits);
   serialized(body, budget.maxOutputBytes, "upstream response");
   if (body.error !== undefined || body.type === "error")
     return responsePayload(`resp_${crypto.randomUUID().replaceAll("-", "")}`, model, [], { status: "failed", reason: "upstream_error" }, {}, record(body.error, "upstream error"));
-  const encoder = new ResponsesEventEncoder(protocol, model, toolNames, configuredLimits);
+  const encoder = new ResponsesEventEncoder(protocol, model, toolNames, configuredLimits, options);
   if (protocol === "chat_completions") {
     const choices = list(body.choices, "choices");
     if (choices.length !== 1)
@@ -3874,7 +4015,7 @@ function canonicalRequest(raw, protocol, model) {
   }
   return out;
 }
-function validateCanonical(b) {
+function validateCanonical(b, context) {
   for (const key of ["stream", "parallel_tool_calls", "store", "background"])
     if (b[key] !== undefined)
       bool(b[key], key);
@@ -3904,7 +4045,11 @@ function validateCanonical(b) {
   const input = typeof b.input === "string" ? [] : list(b.input, "input");
   for (const [i, raw] of input.entries()) {
     const t = record(raw, "input item"), p = `input[${i}]`;
-    const allowed = t.type === "function_call" ? ["type", "id", "status", "call_id", "name", "namespace", "arguments"] : t.type === "custom_tool_call" ? ["type", "id", "status", "call_id", "name", "namespace", "input"] : t.type === "function_call_output" || t.type === "custom_tool_call_output" ? ["type", "id", "call_id", "output", "is_error"] : t.type === "reasoning" ? ["type", "id", "status", "summary", "content", "encrypted_content", "internal_chat_message_metadata_passthrough"] : t.type === "additional_tools" ? ["type", "id", "role", "tools"] : ["type", "id", "status", "role", "content", "internal_chat_message_metadata_passthrough"];
+    if (t.type === "agent_message") {
+      validateAgentMessage(t, p, context.capabilities?.limits);
+      continue;
+    }
+    const allowed = t.type === "function_call" ? ["type", "id", "status", "call_id", "name", "namespace", "arguments", "encrypted_function_args"] : t.type === "custom_tool_call" ? ["type", "id", "status", "call_id", "name", "namespace", "input"] : t.type === "function_call_output" || t.type === "custom_tool_call_output" ? ["type", "id", "call_id", "output", "is_error"] : t.type === "reasoning" ? ["type", "id", "status", "summary", "content", "encrypted_content", "internal_chat_message_metadata_passthrough"] : t.type === "additional_tools" ? ["type", "id", "role", "tools"] : ["type", "id", "status", "role", "content", "internal_chat_message_metadata_passthrough"];
     fields2(t, [...allowed, "internal_chat_message_metadata_passthrough"], p, "unsupported_content");
     if (t.is_error !== undefined)
       bool(t.is_error, `${p}.is_error`);
@@ -3954,8 +4099,8 @@ function convertProtocolRequest(raw, context) {
       fail("invalid_payload", "Request stream mode disagrees with transport context", "stream");
     b.stream = context.streaming;
   }
-  validateCanonical(b);
-  const cap = { ...context.capabilities, omitOptionalWebSearch: true, preserveToolIdentityDescription: true, preserveRefusalContent: true }, policy = context.reasoningPolicy;
+  validateCanonical(b, context);
+  const cap = { ...context.capabilities, agentMessageDelivery: context.agentMessageDelivery ?? context.capabilities?.agentMessageDelivery, omitOptionalWebSearch: true, preserveToolIdentityDescription: true, preserveRefusalContent: true }, policy = context.reasoningPolicy;
   const reasoning = b.reasoning === undefined ? undefined : record(b.reasoning, "reasoning");
   const sourceThinking = b.sourceThinking;
   delete b.sourceThinking;
@@ -4242,7 +4387,7 @@ function validateCanonicalResponse(raw, context, itemOnly = false) {
       fail("unsupported_response", "Unknown item status", `${path}.status`);
     if (b.status === "completed" && t.status !== undefined && t.status !== "completed")
       fail("invalid_stream", "Completed response contains an unfinished item", `${path}.status`);
-    fields2(t, t.type === "message" ? ["type", "id", "role", "status", "content"] : t.type === "reasoning" ? ["type", "id", "summary", "status", "encrypted_content", "content"] : t.type === "function_call" ? ["type", "id", "status", "name", "namespace", "call_id", "arguments"] : ["type", "id", "status", "name", "namespace", "call_id", "input"], path, "unsupported_content");
+    fields2(t, t.type === "message" ? ["type", "id", "role", "status", "content"] : t.type === "reasoning" ? ["type", "id", "summary", "status", "encrypted_content", "content"] : t.type === "function_call" ? ["type", "id", "status", "name", "namespace", "call_id", "arguments", "encrypted_function_args"] : ["type", "id", "status", "name", "namespace", "call_id", "input"], path, "unsupported_content");
     if (t.type === "message") {
       if (t.role !== "assistant")
         fail("unsupported_content", "Output message must be assistant", `${path}.role`);
@@ -4269,6 +4414,7 @@ function validateCanonicalResponse(raw, context, itemOnly = false) {
         string(p.text, "summary");
       }
     } else if (t.type === "function_call" || t.type === "custom_tool_call") {
+      validateEncryptedFunctionArgs(t, context.capabilities?.agentMessageDelivery, path);
       const id = string(t.call_id, "call_id", true);
       if (ids.has(id))
         fail("invalid_tool_arguments", "Duplicate output tool call id", path);
@@ -4479,7 +4625,7 @@ function canonicalResponse(raw, context, names) {
     return record(events.at(-1)?.response, "response");
   }
   validateProviderResponse(raw, context.targetProtocol);
-  const result = encodeResponsesResult(raw, context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits);
+  const result = encodeResponsesResult(raw, context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits, { agentMessageDelivery: context.capabilities?.agentMessageDelivery });
   if (result.status === "failed")
     result.error = safeProtocolError();
   const usage = record(raw, "response").usage;
@@ -4874,6 +5020,10 @@ function createProtocolSession(context) {
     capabilities: context.capabilities ? { ...context.capabilities, limits: context.capabilities.limits ? { ...context.capabilities.limits } : undefined } : undefined,
     reasoningPolicy: context.reasoningPolicy ? { ...context.reasoningPolicy, effortMap: context.reasoningPolicy.effortMap ? { ...context.reasoningPolicy.effortMap } : undefined } : undefined
   };
+  const delivery = context.agentMessageDelivery ?? context.capabilities?.agentMessageDelivery;
+  if (delivery !== undefined && delivery !== "plaintext")
+    fail("invalid_payload", "Unknown agent message delivery policy", "agentMessageDelivery");
+  context.capabilities = { ...context.capabilities, agentMessageDelivery: delivery };
   if (!LLM_PROTOCOLS.includes(context.sourceProtocol) || !LLM_PROTOCOLS.includes(context.targetProtocol))
     fail("unsupported_protocol", "Unknown protocol");
   if (typeof context.model !== "string" || !context.model)
@@ -4912,7 +5062,7 @@ function createProtocolSession(context) {
     else if (context.targetProtocol === "gemini_generate_content")
       encoder = new GeminiCanonicalDecoder(context, names);
     else
-      encoder = new ResponsesEventEncoder(context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits, { preserveContentOrder: true });
+      encoder = new ResponsesEventEncoder(context.targetProtocol, context.responseModel ?? context.model, names, context.capabilities?.limits, { preserveContentOrder: true, agentMessageDelivery: context.capabilities?.agentMessageDelivery });
     validator = context.targetProtocol === "responses" ? undefined : new CanonicalStreamValidator(context);
     renderer = new CanonicalStreamRenderer(context.sourceProtocol, context);
   };
@@ -5105,5 +5255,7 @@ export {
   decodeResponsesRequest,
   describeProtocolConversion,
   encodeResponsesResult,
-  getProviderTokenAccountingCapabilities
+  getProviderTokenAccountingCapabilities,
+  inspectAgentMessages,
+  replaceAgentMessageEncryptedContent
 };

package/dist/protocol-session/types.d.ts

@@ -19,6 +19,8 @@ export interface ProtocolSessionCapabilities extends ResponsesCodecCapabilities
     geminiJsonSchema?: boolean;
 }
 export interface ProtocolSessionContext {
+    /** Request-scoped opt-in; absence preserves strict collaboration handling. */
+    agentMessageDelivery?: ResponsesCodecCapabilities['agentMessageDelivery'];
     sourceProtocol: LLMProtocol;
     targetProtocol: LLMProtocol;
     /** Target model; caller owns routing and source URL validation. */

package/dist/responses-codec/agent-messages.d.ts

@@ -0,0 +1,33 @@
+import { type JsonRecord, type ResponsesCodecLimits, type ResponsesConversionDiagnostic } from './common';
+export type AgentMessageDelivery = 'plaintext';
+export interface AgentMessageInspection {
+    inputIndex: number;
+    author: string;
+    recipient: string;
+    encryptedContents: Array<{
+        contentIndex: number;
+        param: string;
+    }>;
+}
+export interface AgentMessagePlaintextReplacement {
+    param: string;
+    text: string;
+}
+export interface AgentMessageInspectionResult {
+    messages: AgentMessageInspection[];
+    diagnostics: ResponsesConversionDiagnostic[];
+}
+/** Validate identities as metadata, never as instruction roles. Inspection permits opaque blocks only to locate them. */
+export declare function validateAgentMessage(raw: unknown, path: string, configuredLimits?: Partial<ResponsesCodecLimits>, allowEncrypted?: boolean): JsonRecord;
+/** Pure bounded inspection. Neither plaintext nor opaque content is returned in diagnostics. */
+export declare function inspectAgentMessages(raw: unknown, options?: {
+    limits?: Partial<ResponsesCodecLimits>;
+}): AgentMessageInspectionResult;
+/** Replace only explicitly selected agent opaque blocks, at their original positions. Other history is untouched. */
+export declare function replaceAgentMessageEncryptedContent(raw: unknown, replacements: readonly AgentMessagePlaintextReplacement[], options?: {
+    limits?: Partial<ResponsesCodecLimits>;
+}): {
+    body: JsonRecord;
+    diagnostics: ResponsesConversionDiagnostic[];
+};
+export declare function validateEncryptedFunctionArgs(item: JsonRecord, delivery: AgentMessageDelivery | undefined, path: string): void;

package/dist/responses-codec/common.d.ts

@@ -1,3 +1,4 @@
+import type { AgentMessageDelivery } from './agent-messages';
 export type ResponsesProtocol = 'chat_completions' | 'anthropic_messages';
 export type JsonRecord = Record<string, unknown>;
 export interface ResponsesToolName {
@@ -15,6 +16,8 @@ export interface ResponsesCodecLimits {
 }
 export declare const DEFAULT_RESPONSES_CODEC_LIMITS: Readonly<ResponsesCodecLimits>;
 export interface ResponsesCodecCapabilities {
+    /** Explicit caller policy for plaintext collaboration across protocols. */
+    agentMessageDelivery?: AgentMessageDelivery;
     reasoningEffort?: boolean;
     /** Plain reasoning history support is independent of effort parameter mapping. */
     reasoningHistory?: boolean;
@@ -59,5 +62,7 @@ export interface Terminal {
 }
 export declare function terminal(reason: unknown, protocol: ResponsesProtocol): Terminal;
 export declare function normalizeUsage(raw: unknown, protocol: ResponsesProtocol, prior?: JsonRecord): JsonRecord;
-export declare function toolItem(id: string, name: string, args: string, names: ResponsesToolNames, status?: string): JsonRecord;
+export declare function isCollaborationFunction(name: unknown, namespace: unknown, custom?: boolean): boolean;
+export declare function plaintextCollaborationCall(item: JsonRecord, delivery?: AgentMessageDelivery): JsonRecord;
+export declare function toolItem(id: string, name: string, args: string, names: ResponsesToolNames, status?: string, agentMessageDelivery?: AgentMessageDelivery): JsonRecord;
 export declare function responsePayload(id: string, model: string, output: JsonRecord[], end: Terminal, usage: JsonRecord, error?: unknown, createdAt?: number): JsonRecord;

package/dist/responses-codec/events.d.ts

@@ -1,3 +1,4 @@
+import type { AgentMessageDelivery } from './agent-messages';
 import { type JsonRecord, type ResponsesCodecLimits, type ResponsesProtocol, type ResponsesToolNames } from './common';
 /** Incremental payload codec. SSE framing and transport cancellation remain caller-owned.
  * Chat terminal is deferred until finish() so trailing usage-only chunks are retained.
@@ -28,6 +29,7 @@ export declare class ResponsesEventEncoder {
     private contentSerial;
     constructor(protocol: ResponsesProtocol, model: string, toolNames?: ResponsesToolNames, configuredLimits?: Partial<ResponsesCodecLimits>, options?: {
         preserveContentOrder?: boolean;
+        agentMessageDelivery?: AgentMessageDelivery;
     });
     private contentState;
     private event;

package/dist/responses-codec/index.d.ts

@@ -2,3 +2,4 @@ export { decodeResponsesRequest, type DecodedResponsesRequest } from './request'
 export { encodeResponsesResult } from './result';
 export { ResponsesEventEncoder } from './events';
 export { ResponsesCodecError, DEFAULT_RESPONSES_CODEC_LIMITS, type ResponsesProtocol, type ResponsesToolName, type ResponsesToolNames, type ResponsesCodecCapabilities, type ResponsesCodecLimits, type ResponsesConversionDiagnostic } from './common';
+export { inspectAgentMessages, replaceAgentMessageEncryptedContent, type AgentMessageDelivery, type AgentMessageInspection, type AgentMessageInspectionResult, type AgentMessagePlaintextReplacement } from './agent-messages';

package/dist/responses-codec/result.d.ts

@@ -1,3 +1,6 @@
+import type { AgentMessageDelivery } from './agent-messages';
 import { type JsonRecord, type ResponsesCodecLimits, type ResponsesProtocol, type ResponsesToolNames } from './common';
 /** JSON and SSE share the same validation and item/terminal semantics. */
-export declare function encodeResponsesResult(raw: unknown, protocol: ResponsesProtocol, model: string, toolNames?: ResponsesToolNames, configuredLimits?: Partial<ResponsesCodecLimits>): JsonRecord;
+export declare function encodeResponsesResult(raw: unknown, protocol: ResponsesProtocol, model: string, toolNames?: ResponsesToolNames, configuredLimits?: Partial<ResponsesCodecLimits>, options?: {
+    agentMessageDelivery?: AgentMessageDelivery;
+}): JsonRecord;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee-llms",
-  "version": "5.22.0",
+  "version": "5.23.0",
   "description": "Extensible LLM adapters and protocol conversion package for Bungee",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,7 +11,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@jeffusion/bungee-types": "^5.22.0"
+    "@jeffusion/bungee-types": "^5.23.0"
   },
   "devDependencies": {
     "bun-types": "^1.3.2",