@oh-my-pi/pi-ai 16.1.9 → 16.1.10

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [16.1.10] - 2026-06-21
+
+### Changed
+
+- Improved JSON robustness by replacing external dependency with a custom, high-performance parser
+- Strengthened streaming JSON parsing to prevent non-finite numbers from surfacing as `undefined/NaN`
+- Configured JSON parser to reject JS-specific `NaN` and `Infinity` values for tool arguments
+- Replaced the JSON repair/parse helpers (`parseJsonWithRepair`, `parseStreamingJson`) with a single from-scratch tolerant parser (`RelaxedJson`) that accepts single-quoted strings, unquoted object keys, trailing/stray commas, `//` and `/* */` comments, Python `True`/`False`/`None`, raw control characters, invalid escapes, and unescaped apostrophes (`'it's'`). Final parsing still throws on truncated/garbage input (so a malformed tool call is skipped rather than executed with half-formed args) and rejects JS-only `NaN`/`Infinity`; streaming parsing stays non-throwing and rolls back incomplete trailing tokens instead of surfacing `undefined`/`NaN`. The Cursor provider's ad-hoc regex + JSON5 tool-argument parser now routes through the shared parser.
+
+### Fixed
+
+- Fixed tool call ID normalization for Anthropic-compatible models
+- Fixed Anthropic Messages replay sanitizing malformed tool-call IDs, including aborted native tool calls with empty IDs, so retries no longer send invalid `tool_use.id` / `tool_result.tool_use_id` pairs.
+- Fixed the Codex Responses WebSocket transport attributing a prior turn's output to the current one on a reused connection: a trailing/duplicate frame from a cleanly-completed previous response that slipped past the queue drain could be consumed as this request's terminal (ending the turn with empty output) or as a stale tool call. Frames are now keyed by `response.id` — a frame carrying the previous response's id is dropped, and one carrying a third id (or a regressed `sequence_number`) fails closed so the turn retries instead of mixing two responses' streams. Idless frames (deltas, the rate-limit/metadata preamble, `response.created`-less streams) still pass through, matching upstream codex-rs.
+- Fixed `transformMessages` pulling an earlier, orphaned tool result onto a later tool call that reused the same id (left behind when compaction folded the originating `tool_use` into a summary). The pending-call flush now pairs each call with a result positioned *after* its assistant turn, so a reused id surfaces its own output rather than a prior turn's.
+- Fixed DashScope 429 rate-limit messages that mention authorization being classified as credential failures, preventing valid API keys from being invalidated after throttling. ([#3172](https://github.com/can1357/oh-my-pi/issues/3172))
+- Fixed OpenCode Go `401 Insufficient balance` quota errors being treated as unknown failures instead of usage-limit errors, restoring credential rotation and fallback chains. ([#3169](https://github.com/can1357/oh-my-pi/issues/3169))
+
+### Removed
+
+- Removed the `partial-json` dependency; streaming JSON parsing now uses the in-house `RelaxedJson` parser.
+
 ## [16.1.9] - 2026-06-21
 
 ### Added

package/dist/types/utils/json-parse.d.ts

@@ -1,11 +1,22 @@
+/**
+ * Lightweight string-level repair of the escape/control-char hazards that make
+ * otherwise-valid JSON fail `JSON.parse`: raw control characters inside strings
+ * are escaped, and invalid `\x` escapes have their backslash escaped. Returns the
+ * input unchanged when no repair is needed. Pure string→string; does not parse.
+ */
 export declare function repairJson(json: string): string;
+/**
+ * Final-parse a JSON value, repairing the common LLM malformations
+ * ({@link RelaxedJson}). Tries strict `JSON.parse` first (fast path, exact JSON
+ * semantics), then the relaxed parser. Throws when the input is unrepairable,
+ * truncated, or carries trailing garbage — so callers can skip a bad tool call
+ * rather than execute a half-formed one.
+ */
 export declare function parseJsonWithRepair<T>(json: string): T;
 /**
- * Attempts to parse potentially incomplete JSON during streaming.
- * Always returns a valid object, even if the JSON is incomplete.
- *
- * @param partialJson The partial JSON string from streaming
- * @returns Parsed object or empty object if parsing fails
+ * Parse possibly-incomplete JSON during streaming. Always returns a value, never
+ * throws: `{}` for empty/whitespace/unrecoverable buffers, and an auto-closed
+ * best-effort object for truncated ones.
  */
 export declare function parseStreamingJson<T = Record<string, unknown>>(partialJson: string | undefined): T;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.1.9",
+	"version": "16.1.10",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,11 +38,10 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.1.9",
-		"@oh-my-pi/pi-utils": "16.1.9",
-		"@oh-my-pi/pi-wire": "16.1.9",
+		"@oh-my-pi/pi-catalog": "16.1.10",
+		"@oh-my-pi/pi-utils": "16.1.10",
+		"@oh-my-pi/pi-wire": "16.1.10",
 		"arktype": "^2.2.0",
-		"partial-json": "^0.1.7",
 		"zod": "^4"
 	},
 	"devDependencies": {

package/src/auth-gateway/server.ts

@@ -229,11 +229,10 @@ export function classifyGatewayError(err: unknown): { status: number; type: stri
 	if (/\baborted\b|\babort signal\b/i.test(message)) {
 		return { status: 499, type: "request_aborted", message };
 	}
-	if (/\b(?:unauthorized|forbidden)\b/i.test(message)) {
-		return { status: 401, type: "authentication_error", message };
-	}
 	if (
-		// Match rate-limit phrasings without colliding with
+		// Match rate-limit phrasings before auth wording: some providers
+		// describe throttling as "unauthorized due to rate limit".
+		// Keep boundaries so this does not collide with
 		// `GenerateContentRequest`, `accelerate`, `iterate`, `deprecated`, etc.
 		/\brate[- _]?limit(?:s|ed|ing)?\b|\bquota(?:_exceeded| exceeded)?\b|\btoo[- _]many[- _]requests\b/i.test(
 			message,
@@ -249,6 +248,9 @@ export function classifyGatewayError(err: unknown): { status: number; type: stri
 	) {
 		return { status: 429, type: "rate_limit_error", message };
 	}
+	if (/\b(?:unauthorized|forbidden)\b/i.test(message)) {
+		return { status: 401, type: "authentication_error", message };
+	}
 	if (/\b(?:unsupported|invalid_request|invalid request|bad request|malformed)\b/i.test(message)) {
 		return { status: 400, type: "invalid_request_error", message };
 	}

package/src/providers/cursor.ts

@@ -125,7 +125,7 @@ import type {
 } from "../types";
 import { normalizeSystemPrompts } from "../utils";
 import { AssistantMessageEventStream } from "../utils/event-stream";
-import { parseStreamingJson } from "../utils/json-parse";
+import { parseJsonWithRepair, parseStreamingJson } from "../utils/json-parse";
 import { createRequestDebugSession, isRequestDebugEnabled, type RequestDebugResponseLog } from "../utils/request-debug";
 import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
 import { toolWireSchema } from "../utils/schema/wire";
@@ -1781,13 +1781,10 @@ function parseToolArgsJson(text: string): unknown {
 		return text;
 	}
 	try {
-		const normalized = trimmed
-			.replace(/\bNone\b/g, "null")
-			.replace(/\bTrue\b/g, "true")
-			.replace(/\bFalse\b/g, "false");
-		return Bun.JSON5.parse(normalized);
-	} catch {}
-	return text;
+		return parseJsonWithRepair<unknown>(trimmed);
+	} catch {
+		return text;
+	}
 }
 
 function decodeMcpArgValue(value: Uint8Array): unknown {

package/src/providers/openai-codex-responses.ts

@@ -205,6 +205,17 @@ function isCodexStreamProgressEvent(event: unknown): boolean {
 	return typeof type === "string" && CODEX_ADDITIONAL_PROGRESS_EVENT_TYPES.has(type);
 }
 
+function extractCodexFrameResponseId(frame: Record<string, unknown>): string | undefined {
+	const response = (frame as { response?: { id?: unknown } }).response;
+	const id = response?.id;
+	return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+
+function extractCodexFrameSequenceNumber(frame: Record<string, unknown>): number | undefined {
+	const raw = (frame as { sequence_number?: unknown }).sequence_number;
+	return typeof raw === "number" && Number.isFinite(raw) ? Math.trunc(raw) : undefined;
+}
+
 type CodexWebSocketTimeoutDetails = {
 	lastEventAt: number;
 	lastEventType?: string;
@@ -2403,6 +2414,12 @@ class CodexWebSocketConnection {
 	#lastInboundAt = 0;
 	/** Wall-clock of the last heartbeat ping we issued; 0 if none yet. */
 	#lastPingAt = 0;
+	/**
+	 * Most recent `response.id` accepted on this socket, retained across
+	 * requests. Lets the next request drop a trailing/duplicate frame from the
+	 * previous (cleanly-completed) response that outlived the queue drain.
+	 */
+	#lastSeenResponseId?: string;
 
 	constructor(url: string, headers: Record<string, string>, options: CodexWebSocketConnectionOptions) {
 		this.#url = url;
@@ -2650,6 +2667,11 @@ class CodexWebSocketConnection {
 			let lastProgressEventType: string | undefined;
 			let lastEventAt = lastProgressAt;
 			let lastEventType: string | undefined;
+			// Cross-request frame guard: lock onto this response's id and reject
+			// frames belonging to another response interleaved on the reused socket.
+			let activeResponseId: string | undefined;
+			let lastSequence: number | undefined;
+			const priorResponseId = this.#lastSeenResponseId;
 			while (true) {
 				let timeoutMs: number | undefined;
 				let timeoutReason: string;
@@ -2691,8 +2713,51 @@ class CodexWebSocketConnection {
 				if (next === null) {
 					throw new CodexWebSocketTransportError(`websocket closed before response completion`);
 				}
-				sawFirstEvent = true;
 				const eventType = typeof next.type === "string" ? next.type : "";
+				// Cross-request frame guard. The socket is reused across turns. Upstream
+				// codex-rs leans on the protocol guarantee that nothing follows a
+				// response's terminal event, but our queue can still surface a trailing
+				// or duplicate frame from a cleanly-completed prior response after
+				// #dropStaleFrames() drained the queue at send time. Attaching such a
+				// frame to THIS turn misattributes an earlier turn's output (a stale
+				// `response.completed` ends the turn early; a stale item makes the model
+				// see an unrelated call). Only lifecycle events (created/completed/
+				// failed/incomplete) carry a `response.id` — exactly the harmful ones —
+				// so key the guard on it and let idless frames (deltas, the rate-limit/
+				// metadata preamble, created-less streams) pass through, matching
+				// upstream rather than gating on `response.created`.
+				const frameResponseId = extractCodexFrameResponseId(next);
+				const frameSequence = extractCodexFrameSequenceNumber(next);
+				if (frameResponseId !== undefined) {
+					if (activeResponseId === undefined) {
+						if (priorResponseId !== undefined && frameResponseId === priorResponseId) {
+							// Trailing/duplicate frame of the previous response that
+							// outlived the drain. Drop without locking or advancing the
+							// first-event clocks so our own response can still start.
+							continue;
+						}
+						activeResponseId = frameResponseId;
+					} else if (frameResponseId !== activeResponseId) {
+						// A different response is interleaving on the socket; the idless
+						// deltas that follow are indistinguishable, so fail closed
+						// (retryable) instead of risking misattribution.
+						this.close("stale-frame");
+						throw new CodexWebSocketTransportError(
+							`websocket frame for response ${frameResponseId} interleaved into active response ${activeResponseId}`,
+						);
+					}
+					this.#lastSeenResponseId = frameResponseId;
+				}
+				if (frameSequence !== undefined) {
+					if (activeResponseId !== undefined && lastSequence !== undefined && frameSequence < lastSequence) {
+						this.close("stale-frame");
+						throw new CodexWebSocketTransportError(
+							`websocket sequence_number ${frameSequence} regressed below ${lastSequence} within response ${activeResponseId}`,
+						);
+					}
+					lastSequence = frameSequence;
+				}
+				sawFirstEvent = true;
 				lastEventAt = Date.now();
 				lastEventType = eventType || undefined;
 				if (isCodexStreamProgressEvent(next)) {

package/src/providers/transform-messages.ts

@@ -143,6 +143,29 @@ function isAnthropicMessagesModel(model: Model): model is Model<"anthropic-messa
 	return model.api === "anthropic-messages";
 }
 
+const ANTHROPIC_TOOL_CALL_ID_PATTERN = /^[a-zA-Z0-9_-]{1,64}$/;
+
+function isValidAnthropicToolCallId(id: string): boolean {
+	return ANTHROPIC_TOOL_CALL_ID_PATTERN.test(id);
+}
+
+function fallbackAnthropicToolCallId(originalId: string): string {
+	return `toolu_${Bun.hash(originalId).toString(36)}`;
+}
+
+function normalizeAnthropicTargetToolCallId<TApi extends Api>(
+	id: string,
+	model: Model<TApi>,
+	source: AssistantMessage,
+	normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string,
+): string {
+	if (isValidAnthropicToolCallId(id)) return id;
+	const normalized =
+		normalizeToolCallId?.(id, model, source) ?? id.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, MAX_TOOL_CALL_ID_LENGTH);
+	if (isValidAnthropicToolCallId(normalized)) return normalized;
+	return fallbackAnthropicToolCallId(id);
+}
+
 /**
  * Normalize tool call ID for cross-provider compatibility.
  * OpenAI Responses API generates IDs that are 450+ chars with special characters like `|`.
@@ -164,211 +187,243 @@ export function transformMessages<TApi extends Api>(
 
 	const latestSurvivingAssistantIndex = getLatestSurvivingAssistantIndex(messages);
 	// First pass: transform messages (thinking blocks, tool call ID normalization)
-	const transformed = deduplicateToolCallIds(
-		messages.map((msg, index) => {
-			// User and developer messages pass through unchanged
-			if (msg.role === "user" || msg.role === "developer") {
-				return msg;
-			}
+	const normalizedMessages = messages.map((msg, index) => {
+		// User and developer messages pass through unchanged
+		if (msg.role === "user" || msg.role === "developer") {
+			return msg;
+		}
 
-			// Handle toolResult messages - normalize toolCallId if we have a mapping
-			if (msg.role === "toolResult") {
-				const normalizedId = toolCallIdMap.get(msg.toolCallId);
-				if (normalizedId && normalizedId !== msg.toolCallId) {
-					return { ...msg, toolCallId: normalizedId };
-				}
-				return msg;
+		// Handle toolResult messages - normalize toolCallId if we have a mapping
+		if (msg.role === "toolResult") {
+			const normalizedId = toolCallIdMap.get(msg.toolCallId);
+			if (normalizedId && normalizedId !== msg.toolCallId) {
+				return { ...msg, toolCallId: normalizedId };
 			}
+			return msg;
+		}
 
-			// Assistant messages need transformation check
-			if (msg.role === "assistant") {
-				const assistantMsg = msg as AssistantMessage;
-				const isSameModel =
-					assistantMsg.provider === model.provider &&
-					assistantMsg.api === model.api &&
-					assistantMsg.model === model.id;
-
-				const isAnthropicTarget = isAnthropicMessagesModel(model);
-				// Anthropic's all-or-none contract on prior-turn thinking blocks
-				// applies to every `anthropic-messages → anthropic-messages` replay,
-				// not just the latest assistant turn. The legacy
-				// `mustPreserveLatestAnthropicThinking` flag only honored it for the
-				// latest turn; every prior turn fell through to the cross-API
-				// text-demotion path whenever the conversation crossed a model id,
-				// silently dropping the reasoning chain on continuation for custom
-				// anthropic-messages providers configured via `models.yaml` and
-				// session-level model swaps (#2257).
-				const isAnthropicReplay = isAnthropicTarget && assistantMsg.api === "anthropic-messages";
-				const isLatestSurvivingAssistant = index === latestSurvivingAssistantIndex;
-				// Signature policy is a second axis. Anthropic cryptographically
-				// binds reasoning signatures to its key+session+model, so cross-model
-				// signatures must be stripped whenever official Anthropic is on
-				// either end of the replay:
-				//   * official → 3p: the 3p target can't reverify the signature;
-				//     keeping it leaks private continuation metadata for no benefit.
-				//   * 3p → official: official rejects a foreign signature outright.
-				//   * official → official cross-model: the new model rejects the
-				//     previous model's signature.
-				// 3p ↔ 3p replays preserve signatures because compatible providers
-				// (Z.AI, DeepSeek, custom `models.yaml` providers) treat them as
-				// opaque continuation hints rather than verified material; stripping
-				// degrades the reasoning chain into unsigned/text on the next turn
-				// (#2265). Source-side official detection uses the canonical catalog
-				// provider id `"anthropic"` because assistant messages carry no
-				// `baseUrl` — a user who manually points `provider: "anthropic"` at
-				// a custom proxy via `models.yaml` will see signatures stripped, the
-				// conservative direction (degraded reasoning, not broken requests).
-				const isOfficialAnthropicSource = isAnthropicReplay && assistantMsg.provider === "anthropic";
-				const isOfficialAnthropicTarget = isAnthropicTarget && model.compat.officialEndpoint;
-				const officialAnthropicInvolved = isOfficialAnthropicSource || isOfficialAnthropicTarget;
-				// Compatible Anthropic-messages reasoning targets that accept
-				// unsigned thinking natively (Z.AI, DeepSeek, the generic
-				// `reasoning && !official` case in the compat builder). Used to keep
-				// `redacted_thinking` siblings beside unsigned visible thinking on
-				// targets that won't text-demote it.
-				const replaysUnsignedAnthropicThinking = isAnthropicTarget && model.compat.replayUnsignedThinking;
-				// Thinking signatures can be untrustworthy for two distinct reasons with very
-				// different blast radii:
-				//
-				// 1. Aborted/errored turns: the stream stopped mid-block, so only the block
-				//    that was streaming at the abort point — always the FINAL content block —
-				//    can carry a partially-streamed (invalid) signature. Every earlier block
-				//    completed: Anthropic delivers a block's signature at its
-				//    `content_block_stop`, which necessarily fired before the next block began,
-				//    so those signatures are whole and valid. Stripping them would needlessly
-				//    discard a replayable thinking chain — e.g. interrupting during the visible
-				//    text output after thinking already finished leaves a fully-signed thinking
-				//    block that must be kept, or Anthropic rejects the replay with HTTP 400
-				//    "Invalid `signature` in `thinking` block".
-				//
-				// 2. Abandoned tool-use turns: a turn that carries toolCall blocks but did NOT
-				//    request tool execution (stopReason !== "toolUse" — e.g. adaptive-thinking
-				//    Opus emitting tool calls and then ending on `end_turn`/`stop`). The agent
-				//    loop pairs those calls with placeholder tool_results to keep the
-				//    tool_use/tool_result contract valid. The turn completed cleanly, but its
-				//    signatures are end_turn-bound and cannot be replayed in that synthesized
-				//    continuation, so EVERY thinking signature is stripped.
-				//
-				// Latest abandoned turns are exempt because Anthropic requires thinking blocks
-				// from its most recent response to remain byte-for-byte unmodified.
-				const invalidStopReason = assistantMsg.stopReason === "aborted" || assistantMsg.stopReason === "error";
-				const abandonedToolUse =
-					!invalidStopReason &&
-					assistantMsg.stopReason !== "toolUse" &&
-					assistantMsg.content.some(b => b.type === "toolCall");
-				const lastBlockIndex = assistantMsg.content.length - 1;
-
-				const transformedContent = assistantMsg.content.flatMap((block, blockIndex) => {
-					if (block.type === "thinking") {
-						// Only an aborted/errored turn's final (mid-stream) block can hold a
-						// partial signature; abandoned tool-use turns strip all. Drop the
-						// untrustworthy signature so the encoder can downgrade the block to text.
-						const signatureUntrustworthy =
-							abandonedToolUse || (invalidStopReason && blockIndex === lastBlockIndex);
-						let sanitized: typeof block =
-							signatureUntrustworthy && block.thinkingSignature
-								? { ...block, thinkingSignature: undefined }
-								: block;
-						if (isAnthropicReplay) {
-							// Latest abandoned turn: Anthropic's byte-for-byte rule forbids
-							// even stripping a signature on the latest message.
-							if (isLatestSurvivingAssistant && abandonedToolUse) return block;
-							// Cross-model prior turns crossing an official Anthropic endpoint
-							// must strip the source signature so the downstream encoder
-							// applies its `replayUnsignedThinking` policy (unsigned thinking
-							// is emitted natively on Anthropic-compatible reasoning endpoints
-							// and demoted to text on official Anthropic). 3p ↔ 3p replays
-							// keep the signature so the reasoning chain stays signed on
-							// continuation (#2265).
-							if (
-								!isLatestSurvivingAssistant &&
-								!isSameModel &&
-								officialAnthropicInvolved &&
-								sanitized.thinkingSignature
-							) {
-								sanitized = { ...sanitized, thinkingSignature: undefined };
-							}
-							// Drop blocks with neither a signature anchor nor any text —
-							// nothing for the next turn to replay.
-							if (!sanitized.thinkingSignature && (!sanitized.thinking || sanitized.thinking.trim() === "")) {
-								return [];
-							}
-							return sanitized;
+		// Assistant messages need transformation check
+		if (msg.role === "assistant") {
+			const assistantMsg = msg as AssistantMessage;
+			const isSameModel =
+				assistantMsg.provider === model.provider &&
+				assistantMsg.api === model.api &&
+				assistantMsg.model === model.id;
+
+			const isAnthropicTarget = isAnthropicMessagesModel(model);
+			// Anthropic's all-or-none contract on prior-turn thinking blocks
+			// applies to every `anthropic-messages → anthropic-messages` replay,
+			// not just the latest assistant turn. The legacy
+			// `mustPreserveLatestAnthropicThinking` flag only honored it for the
+			// latest turn; every prior turn fell through to the cross-API
+			// text-demotion path whenever the conversation crossed a model id,
+			// silently dropping the reasoning chain on continuation for custom
+			// anthropic-messages providers configured via `models.yaml` and
+			// session-level model swaps (#2257).
+			const isAnthropicReplay = isAnthropicTarget && assistantMsg.api === "anthropic-messages";
+			const isLatestSurvivingAssistant = index === latestSurvivingAssistantIndex;
+			// Signature policy is a second axis. Anthropic cryptographically
+			// binds reasoning signatures to its key+session+model, so cross-model
+			// signatures must be stripped whenever official Anthropic is on
+			// either end of the replay:
+			//   * official → 3p: the 3p target can't reverify the signature;
+			//     keeping it leaks private continuation metadata for no benefit.
+			//   * 3p → official: official rejects a foreign signature outright.
+			//   * official → official cross-model: the new model rejects the
+			//     previous model's signature.
+			// 3p ↔ 3p replays preserve signatures because compatible providers
+			// (Z.AI, DeepSeek, custom `models.yaml` providers) treat them as
+			// opaque continuation hints rather than verified material; stripping
+			// degrades the reasoning chain into unsigned/text on the next turn
+			// (#2265). Source-side official detection uses the canonical catalog
+			// provider id `"anthropic"` because assistant messages carry no
+			// `baseUrl` — a user who manually points `provider: "anthropic"` at
+			// a custom proxy via `models.yaml` will see signatures stripped, the
+			// conservative direction (degraded reasoning, not broken requests).
+			const isOfficialAnthropicSource = isAnthropicReplay && assistantMsg.provider === "anthropic";
+			const isOfficialAnthropicTarget = isAnthropicTarget && model.compat.officialEndpoint;
+			const officialAnthropicInvolved = isOfficialAnthropicSource || isOfficialAnthropicTarget;
+			// Compatible Anthropic-messages reasoning targets that accept
+			// unsigned thinking natively (Z.AI, DeepSeek, the generic
+			// `reasoning && !official` case in the compat builder). Used to keep
+			// `redacted_thinking` siblings beside unsigned visible thinking on
+			// targets that won't text-demote it.
+			const replaysUnsignedAnthropicThinking = isAnthropicTarget && model.compat.replayUnsignedThinking;
+			// Thinking signatures can be untrustworthy for two distinct reasons with very
+			// different blast radii:
+			//
+			// 1. Aborted/errored turns: the stream stopped mid-block, so only the block
+			//    that was streaming at the abort point — always the FINAL content block —
+			//    can carry a partially-streamed (invalid) signature. Every earlier block
+			//    completed: Anthropic delivers a block's signature at its
+			//    `content_block_stop`, which necessarily fired before the next block began,
+			//    so those signatures are whole and valid. Stripping them would needlessly
+			//    discard a replayable thinking chain — e.g. interrupting during the visible
+			//    text output after thinking already finished leaves a fully-signed thinking
+			//    block that must be kept, or Anthropic rejects the replay with HTTP 400
+			//    "Invalid `signature` in `thinking` block".
+			//
+			// 2. Abandoned tool-use turns: a turn that carries toolCall blocks but did NOT
+			//    request tool execution (stopReason !== "toolUse" — e.g. adaptive-thinking
+			//    Opus emitting tool calls and then ending on `end_turn`/`stop`). The agent
+			//    loop pairs those calls with placeholder tool_results to keep the
+			//    tool_use/tool_result contract valid. The turn completed cleanly, but its
+			//    signatures are end_turn-bound and cannot be replayed in that synthesized
+			//    continuation, so EVERY thinking signature is stripped.
+			//
+			// Latest abandoned turns are exempt because Anthropic requires thinking blocks
+			// from its most recent response to remain byte-for-byte unmodified.
+			const invalidStopReason = assistantMsg.stopReason === "aborted" || assistantMsg.stopReason === "error";
+			const abandonedToolUse =
+				!invalidStopReason &&
+				assistantMsg.stopReason !== "toolUse" &&
+				assistantMsg.content.some(b => b.type === "toolCall");
+			const lastBlockIndex = assistantMsg.content.length - 1;
+
+			const transformedContent = assistantMsg.content.flatMap((block, blockIndex) => {
+				if (block.type === "thinking") {
+					// Only an aborted/errored turn's final (mid-stream) block can hold a
+					// partial signature; abandoned tool-use turns strip all. Drop the
+					// untrustworthy signature so the encoder can downgrade the block to text.
+					const signatureUntrustworthy = abandonedToolUse || (invalidStopReason && blockIndex === lastBlockIndex);
+					let sanitized: typeof block =
+						signatureUntrustworthy && block.thinkingSignature
+							? { ...block, thinkingSignature: undefined }
+							: block;
+					if (isAnthropicReplay) {
+						// Latest abandoned turn: Anthropic's byte-for-byte rule forbids
+						// even stripping a signature on the latest message.
+						if (isLatestSurvivingAssistant && abandonedToolUse) return block;
+						// Cross-model prior turns crossing an official Anthropic endpoint
+						// must strip the source signature so the downstream encoder
+						// applies its `replayUnsignedThinking` policy (unsigned thinking
+						// is emitted natively on Anthropic-compatible reasoning endpoints
+						// and demoted to text on official Anthropic). 3p ↔ 3p replays
+						// keep the signature so the reasoning chain stays signed on
+						// continuation (#2265).
+						if (
+							!isLatestSurvivingAssistant &&
+							!isSameModel &&
+							officialAnthropicInvolved &&
+							sanitized.thinkingSignature
+						) {
+							sanitized = { ...sanitized, thinkingSignature: undefined };
 						}
-						// Cross-API target: keep the existing text-demotion fallback.
-						// For same model: keep thinking blocks with signatures (needed for replay)
-						// even if the thinking text is empty (OpenAI encrypted reasoning)
-						if (isSameModel && sanitized.thinkingSignature) return sanitized;
-						// Skip empty thinking blocks, convert others to plain text
-						if (!sanitized.thinking || sanitized.thinking.trim() === "") return [];
-						if (isSameModel) return sanitized;
-						return {
-							type: "text" as const,
-							text: sanitized.thinking,
-						};
-					}
-
-					if (block.type === "redactedThinking") {
-						// Redacted thinking is native-only. Keep it for same-model
-						// signed replay, the latest byte-for-byte Anthropic turn, or
-						// compatible targets that will also emit sibling unsigned
-						// thinking natively. Drop it when the visible thinking was
-						// cross-model stripped and will be demoted to text.
-						if (isAnthropicReplay) {
-							if (isSameModel || isLatestSurvivingAssistant || replaysUnsignedAnthropicThinking) return block;
+						// Drop blocks with neither a signature anchor nor any text —
+						// nothing for the next turn to replay.
+						if (!sanitized.thinkingSignature && (!sanitized.thinking || sanitized.thinking.trim() === "")) {
 							return [];
 						}
-						if (isSameModel) return block;
-						return [];
+						return sanitized;
 					}
+					// Cross-API target: keep the existing text-demotion fallback.
+					// For same model: keep thinking blocks with signatures (needed for replay)
+					// even if the thinking text is empty (OpenAI encrypted reasoning)
+					if (isSameModel && sanitized.thinkingSignature) return sanitized;
+					// Skip empty thinking blocks, convert others to plain text
+					if (!sanitized.thinking || sanitized.thinking.trim() === "") return [];
+					if (isSameModel) return sanitized;
+					return {
+						type: "text" as const,
+						text: sanitized.thinking,
+					};
+				}
 
-					if (block.type === "text") {
-						if (isSameModel) return block;
-						return {
-							type: "text" as const,
-							text: block.text,
-						};
+				if (block.type === "redactedThinking") {
+					// Redacted thinking is native-only. Keep it for same-model
+					// signed replay, the latest byte-for-byte Anthropic turn, or
+					// compatible targets that will also emit sibling unsigned
+					// thinking natively. Drop it when the visible thinking was
+					// cross-model stripped and will be demoted to text.
+					if (isAnthropicReplay) {
+						if (isSameModel || isLatestSurvivingAssistant || replaysUnsignedAnthropicThinking) return block;
+						return [];
 					}
+					if (isSameModel) return block;
+					return [];
+				}
 
-					if (block.type === "toolCall") {
-						const toolCall = block as ToolCall;
-						let normalizedToolCall: ToolCall = toolCall;
+				if (block.type === "text") {
+					if (isSameModel) return block;
+					return {
+						type: "text" as const,
+						text: block.text,
+					};
+				}
 
-						if (!isSameModel && toolCall.thoughtSignature) {
-							normalizedToolCall = { ...toolCall };
-							delete (normalizedToolCall as { thoughtSignature?: string }).thoughtSignature;
-						}
+				if (block.type === "toolCall") {
+					const toolCall = block as ToolCall;
+					let normalizedToolCall: ToolCall = toolCall;
 
-						if (!isSameModel && normalizeToolCallId) {
-							const normalizedId = normalizeToolCallId(toolCall.id, model, assistantMsg);
-							if (normalizedId !== toolCall.id) {
-								toolCallIdMap.set(toolCall.id, normalizedId);
-								normalizedToolCall = { ...normalizedToolCall, id: normalizedId };
-							}
-						}
+					if (!isSameModel && toolCall.thoughtSignature) {
+						normalizedToolCall = { ...toolCall };
+						delete (normalizedToolCall as { thoughtSignature?: string }).thoughtSignature;
+					}
 
-						return normalizedToolCall;
+					if (isAnthropicTarget) {
+						const normalizedId = normalizeAnthropicTargetToolCallId(
+							toolCall.id,
+							model,
+							assistantMsg,
+							normalizeToolCallId,
+						);
+						if (normalizedId !== toolCall.id) {
+							toolCallIdMap.set(toolCall.id, normalizedId);
+							normalizedToolCall = { ...normalizedToolCall, id: normalizedId };
+						}
+					} else if (!isSameModel && normalizeToolCallId) {
+						const normalizedId = normalizeToolCallId(toolCall.id, model, assistantMsg);
+						if (normalizedId !== toolCall.id) {
+							toolCallIdMap.set(toolCall.id, normalizedId);
+							normalizedToolCall = { ...normalizedToolCall, id: normalizedId };
+						}
 					}
 
-					return block;
-				});
+					return normalizedToolCall;
+				}
 
-				return {
-					...assistantMsg,
-					content: transformedContent,
-				};
-			}
-			return msg;
-		}),
+				return block;
+			});
+
+			return {
+				...assistantMsg,
+				content: transformedContent,
+			};
+		}
+		return msg;
+	});
+	const transformed = deduplicateToolCallIds(
+		normalizedMessages,
 		maxNormalizedToolCallIdLength,
 		duplicateToolCallIdSuffixPrefix,
 	);
-	const realToolResultsById = new Map<string, ToolResultMessage>();
-	for (const msg of transformed) {
-		if (msg.role === "toolResult" && !realToolResultsById.has(msg.toolCallId)) {
-			realToolResultsById.set(msg.toolCallId, msg);
+	// All real tool results, keyed by id, in document order. One id can map to
+	// more than one result: compaction can fold an assistant `tool_use` into a
+	// summary string while its `tool_result` survives, and a later turn may reuse
+	// the id. `takeRealToolResult` pulls the earliest unconsumed result positioned
+	// AFTER the call's assistant turn, so an orphaned earlier result is never
+	// pulled forward onto a later call (which would surface a prior turn's output).
+	type IndexedToolResult = { index: number; msg: ToolResultMessage; consumed: boolean };
+	const realToolResultsById = new Map<string, IndexedToolResult[]>();
+	for (let index = 0; index < transformed.length; index++) {
+		const msg = transformed[index];
+		if (msg.role === "toolResult") {
+			const entry: IndexedToolResult = { index, msg, consumed: false };
+			const entries = realToolResultsById.get(msg.toolCallId);
+			if (entries) entries.push(entry);
+			else realToolResultsById.set(msg.toolCallId, [entry]);
 		}
 	}
+	const takeRealToolResult = (id: string, afterIndex: number): ToolResultMessage | undefined => {
+		const entries = realToolResultsById.get(id);
+		if (!entries) return undefined;
+		for (const entry of entries) {
+			if (entry.consumed || entry.index <= afterIndex) continue;
+			entry.consumed = true;
+			return entry.msg;
+		}
+		return undefined;
+	};
 
 	// Anthropic rejects `tool_result` blocks whose `tool_use_id` does not appear in a prior
 	// `tool_use` block. After handoff/compaction folds an assistant turn into a summary
@@ -387,8 +442,12 @@ export function transformMessages<TApi extends Api>(
 	// followed by exactly one corresponding tool result.
 	const result: Message[] = [];
 	let pendingToolCalls: ToolCall[] = [];
+	// Index of the assistant turn that declared `pendingToolCalls`; a pulled
+	// result must be positioned after it (see `takeRealToolResult`).
+	let pendingToolCallsStartIndex = -1;
 	let pendingAbortedToolCalls = new Map<string, ToolCall>();
 	let pendingAbortedTimestamp: number | undefined;
+	let pendingAbortedStartIndex = -1;
 	// Track which tool calls already have an emitted result so delayed/duplicate
 	// toolResult messages cannot create a second provider-visible result.
 	const toolCallStatus = new Map<string, ToolCallStatus>();
@@ -397,7 +456,7 @@ export function transformMessages<TApi extends Api>(
 		if (pendingToolCalls.length === 0) return;
 		for (const tc of pendingToolCalls) {
 			if (toolCallStatus.has(tc.id)) continue;
-			const realToolResult = realToolResultsById.get(tc.id);
+			const realToolResult = takeRealToolResult(tc.id, pendingToolCallsStartIndex);
 			if (realToolResult) {
 				result.push(realToolResult);
 				toolCallStatus.set(tc.id, ToolCallStatus.Resolved);
@@ -420,7 +479,7 @@ export function transformMessages<TApi extends Api>(
 		if (pendingAbortedTimestamp === undefined) return;
 		for (const tc of pendingAbortedToolCalls.values()) {
 			if (toolCallStatus.has(tc.id)) continue;
-			const realToolResult = realToolResultsById.get(tc.id);
+			const realToolResult = takeRealToolResult(tc.id, pendingAbortedStartIndex);
 			if (realToolResult) {
 				result.push(realToolResult);
 				toolCallStatus.set(tc.id, ToolCallStatus.Resolved);
@@ -476,11 +535,13 @@ export function transformMessages<TApi extends Api>(
 				result.push(msg);
 				pendingAbortedToolCalls = new Map(toolCalls.map(toolCall => [toolCall.id, toolCall] as const));
 				pendingAbortedTimestamp = assistantMsg.timestamp;
+				pendingAbortedStartIndex = i;
 				continue;
 			}
 
 			if (toolCalls.length > 0) {
 				pendingToolCalls = toolCalls;
+				pendingToolCallsStartIndex = i;
 			}
 
 			result.push(msg);

package/src/rate-limit-utils.ts

@@ -18,6 +18,7 @@ const SERVER_ERROR_BACKOFF_MS = 20 * 1000; // 20s
 
 const ACCOUNT_RATE_LIMIT_PATTERN =
 	/\baccount(?:'s)?\b[^\n]{0,80}\brate.?limit\b|\brate.?limit\b[^\n]{0,80}\baccount\b/i;
+const INSUFFICIENT_BALANCE_PATTERN = /insufficient.?balance/i;
 
 /**
  * Classify a rate-limit error message into a reason category.
@@ -62,7 +63,12 @@ export function parseRateLimitReason(errorMessage: string): RateLimitReason {
 		return "RATE_LIMIT_EXCEEDED";
 	}
 
-	if (lower.includes("exhausted") || lower.includes("quota") || lower.includes("usage limit")) {
+	if (
+		lower.includes("exhausted") ||
+		lower.includes("quota") ||
+		lower.includes("usage limit") ||
+		INSUFFICIENT_BALANCE_PATTERN.test(errorMessage)
+	) {
 		return "QUOTA_EXHAUSTED";
 	}
 
@@ -94,7 +100,7 @@ export function calculateRateLimitBackoffMs(reason: RateLimitReason): number {
 
 /** Detect usage/quota limit errors in error messages (persistent, requires credential switch). */
 const USAGE_LIMIT_PATTERN =
-	/usage.?limit|usage_limit_reached|usage_not_included|limit_reached|quota.?exceeded|quota.?reached|resource.?exhausted|exhausted your capacity|quota will reset/i;
+	/usage.?limit|usage_limit_reached|usage_not_included|limit_reached|quota.?exceeded|quota.?reached|resource.?exhausted|exhausted your capacity|quota will reset|insufficient.?balance/i;
 
 export function isUsageLimitError(errorMessage: string): boolean {
 	return USAGE_LIMIT_PATTERN.test(errorMessage) || ACCOUNT_RATE_LIMIT_PATTERN.test(errorMessage);

package/src/utils/json-parse.ts

@@ -1,8 +1,7 @@
-import { parse as partialParse } from "partial-json";
-
 const QUOTE = 0x22;
 const BACKSLASH = 0x5c;
 const U = 0x75;
+const SQUOTE = 0x27;
 
 // Valid chars after `\`: " \ / b f n r t u
 const VALID_ESCAPE_CHAR = new Uint8Array(128);
@@ -21,10 +20,48 @@ const CONTROL_ESCAPES: readonly string[] = (() => {
 	return e;
 })();
 
+const HEX4_RE = /^[0-9a-fA-F]{4}$/;
+
 function isHexDigit(cp: number): boolean {
 	return (cp >= 0x30 && cp <= 0x39) || ((cp | 0x20) >= 0x61 && (cp | 0x20) <= 0x66);
 }
 
+function isWhitespace(cp: number): boolean {
+	return cp === 0x20 || cp === 0x09 || cp === 0x0a || cp === 0x0d;
+}
+
+function isIdentChar(cp: number): boolean {
+	return (
+		(cp >= 0x30 && cp <= 0x39) ||
+		((cp | 0x20) >= 0x61 && (cp | 0x20) <= 0x7a) ||
+		cp === 0x5f /* _ */ ||
+		cp === 0x24 /* $ */
+	);
+}
+
+/** Bareword literals: standard JSON plus Python `True`/`False`/`None`. */
+const KEYWORDS: readonly (readonly [string, unknown])[] = [
+	["true", true],
+	["false", false],
+	["null", null],
+	["True", true],
+	["False", false],
+	["None", null],
+];
+
+/**
+ * Sentinel returned by partial-mode value parsing when an atomic value
+ * (number / keyword) is incomplete at the streaming edge, so the enclosing
+ * object/array rolls back to the last valid prefix instead of committing junk.
+ */
+const INCOMPLETE = Symbol("incomplete");
+
+/**
+ * Lightweight string-level repair of the escape/control-char hazards that make
+ * otherwise-valid JSON fail `JSON.parse`: raw control characters inside strings
+ * are escaped, and invalid `\x` escapes have their backslash escaped. Returns the
+ * input unchanged when no repair is needed. Pure string→string; does not parse.
+ */
 export function repairJson(json: string): string {
 	const len = json.length;
 	const parts: string[] = [];
@@ -110,38 +147,377 @@ export function repairJson(json: string): string {
 	return parts.join("");
 }
 
+/**
+ * Recursive-descent parser for a forgiving superset of JSON. Beyond strict JSON
+ * it accepts, and normalizes, the malformations LLM tool-call bodies leak in
+ * practice:
+ *
+ * - single-quoted strings and unquoted object keys (JSON5);
+ * - trailing / stray commas, and `//` + block comments;
+ * - Python literals `True` / `False` / `None` and JS `NaN` / `Infinity`;
+ * - raw control characters and invalid `\x` escapes inside strings (kept literally);
+ * - unescaped quotes inside strings — a quote only closes a string when followed
+ *   by a value terminator, recovering apostrophes such as `'it's'`.
+ *
+ * In `partial` mode an unterminated string/object/array (or a value cut off at
+ * end-of-input) is auto-closed with whatever was parsed so far — for streaming.
+ * In strict mode, end-of-input mid-value and trailing garbage both throw, so a
+ * final parse never silently accepts a half-formed tool call.
+ */
+class RelaxedJson {
+	readonly #s: string;
+	readonly #n: number;
+	readonly #partial: boolean;
+	#i = 0;
+
+	constructor(source: string, partial: boolean) {
+		this.#s = source;
+		this.#n = source.length;
+		this.#partial = partial;
+	}
+
+	parse(): unknown {
+		this.#ws();
+		if (this.#i >= this.#n) {
+			if (this.#partial) return undefined;
+			throw new SyntaxError("Unexpected end of JSON input");
+		}
+		const value = this.#value();
+		if (value === INCOMPLETE) return undefined;
+		this.#ws();
+		if (!this.#partial && this.#i < this.#n) {
+			throw new SyntaxError(`Unexpected trailing characters at position ${this.#i}`);
+		}
+		return value;
+	}
+
+	#ws(): void {
+		const s = this.#s;
+		for (;;) {
+			while (this.#i < this.#n && isWhitespace(s.charCodeAt(this.#i))) this.#i++;
+			if (this.#i + 1 < this.#n && s.charCodeAt(this.#i) === 0x2f /* / */) {
+				const next = s.charCodeAt(this.#i + 1);
+				if (next === 0x2f /* / line comment */) {
+					this.#i += 2;
+					while (this.#i < this.#n && s.charCodeAt(this.#i) !== 0x0a) this.#i++;
+					continue;
+				}
+				if (next === 0x2a /* * block comment */) {
+					this.#i += 2;
+					while (
+						this.#i + 1 < this.#n &&
+						!(s.charCodeAt(this.#i) === 0x2a && s.charCodeAt(this.#i + 1) === 0x2f)
+					) {
+						this.#i++;
+					}
+					this.#i = Math.min(this.#i + 2, this.#n);
+					continue;
+				}
+			}
+			break;
+		}
+	}
+
+	#value(): unknown {
+		const s = this.#s;
+		const c = s[this.#i];
+		if (c === "{") return this.#object();
+		if (c === "[") return this.#array();
+		if (c === '"' || c === "'") return this.#string(s.charCodeAt(this.#i));
+		const cc = s.charCodeAt(this.#i);
+		if (cc === 0x2d /* - */ || cc === 0x2b /* + */ || cc === 0x2e /* . */ || (cc >= 0x30 && cc <= 0x39)) {
+			// JS-only NaN / Infinity are deliberately not accepted: a tool must not
+			// execute with a non-finite numeric arg; they fall through #number's
+			// NaN guard (strict throw / partial rollback) like other bad tokens.
+			return this.#number();
+		}
+		return this.#keyword();
+	}
+
+	#object(): Record<string, unknown> {
+		this.#i++; // consume {
+		const out: Record<string, unknown> = {};
+		for (;;) {
+			this.#ws();
+			if (this.#i >= this.#n) {
+				if (this.#partial) return out;
+				throw new SyntaxError("Unterminated object");
+			}
+			const c = this.#s[this.#i];
+			if (c === "}") {
+				this.#i++;
+				return out;
+			}
+			if (c === ",") {
+				// Tolerate leading / doubled / trailing commas.
+				this.#i++;
+				continue;
+			}
+			const key = this.#key();
+			this.#ws();
+			if (this.#i < this.#n && this.#s[this.#i] === ":") {
+				this.#i++;
+			} else if (this.#partial) {
+				return out;
+			} else {
+				throw new SyntaxError("Expected ':' in object");
+			}
+			this.#ws();
+			if (this.#i >= this.#n) {
+				if (this.#partial) return out;
+				throw new SyntaxError("Expected value after ':'");
+			}
+			const value = this.#value();
+			if (value === INCOMPLETE) return out;
+			out[key] = value;
+			this.#ws();
+			const d = this.#i < this.#n ? this.#s[this.#i] : "";
+			if (d === ",") {
+				this.#i++;
+				continue;
+			}
+			if (d === "}") {
+				this.#i++;
+				return out;
+			}
+			if (this.#partial) return out;
+			throw new SyntaxError("Expected ',' or '}' in object");
+		}
+	}
+
+	#array(): unknown[] {
+		this.#i++; // consume [
+		const out: unknown[] = [];
+		for (;;) {
+			this.#ws();
+			if (this.#i >= this.#n) {
+				if (this.#partial) return out;
+				throw new SyntaxError("Unterminated array");
+			}
+			const c = this.#s[this.#i];
+			if (c === "]") {
+				this.#i++;
+				return out;
+			}
+			if (c === ",") {
+				this.#i++;
+				continue;
+			}
+			const value = this.#value();
+			if (value === INCOMPLETE) return out;
+			out.push(value);
+			this.#ws();
+			const d = this.#i < this.#n ? this.#s[this.#i] : "";
+			if (d === ",") {
+				this.#i++;
+				continue;
+			}
+			if (d === "]") {
+				this.#i++;
+				return out;
+			}
+			if (this.#partial) return out;
+			throw new SyntaxError("Expected ',' or ']' in array");
+		}
+	}
+
+	#key(): string {
+		const c = this.#s[this.#i];
+		if (c === '"' || c === "'") return this.#string(this.#s.charCodeAt(this.#i));
+		// Unquoted identifier key: read until a structural delimiter / whitespace.
+		const start = this.#i;
+		while (this.#i < this.#n) {
+			const ch = this.#s[this.#i];
+			if (ch === ":" || ch === "," || ch === "}" || isWhitespace(this.#s.charCodeAt(this.#i))) break;
+			this.#i++;
+		}
+		if (this.#i === start) {
+			if (this.#partial) return "";
+			throw new SyntaxError("Expected object key");
+		}
+		return this.#s.slice(start, this.#i);
+	}
+
+	#string(quote: number): string {
+		const s = this.#s;
+		const n = this.#n;
+		let i = this.#i + 1; // skip opening quote
+		let out = "";
+		let runStart = i;
+		while (i < n) {
+			const cc = s.charCodeAt(i);
+			if (cc !== BACKSLASH && cc !== quote) {
+				i++;
+				continue;
+			}
+			if (cc === quote) {
+				// Apostrophe / inner-quote recovery (a quote that isn't followed by a
+				// value terminator is literal) is safe for single quotes and in partial
+				// mode. For double quotes in strict mode, close on the first unescaped
+				// quote like standard JSON so malformed structure fails loudly instead
+				// of silently swallowing commas/colons into one string.
+				const lenient = quote === SQUOTE || this.#partial;
+				if (!lenient || this.#closesString(i + 1)) {
+					out += s.slice(runStart, i);
+					this.#i = i + 1;
+					return out;
+				}
+				// Unescaped inner quote (e.g. apostrophe in `'it's'`) — keep it literal.
+				i++;
+				continue;
+			}
+			// Backslash escape.
+			out += s.slice(runStart, i);
+			i++;
+			if (i >= n) {
+				out += "\\";
+				runStart = i;
+				break;
+			}
+			const esc = s.charCodeAt(i);
+			switch (esc) {
+				case QUOTE:
+					out += '"';
+					break;
+				case SQUOTE:
+					out += "'";
+					break;
+				case BACKSLASH:
+					out += "\\";
+					break;
+				case 0x2f:
+					out += "/";
+					break;
+				case 0x62:
+					out += "\b";
+					break;
+				case 0x66:
+					out += "\f";
+					break;
+				case 0x6e:
+					out += "\n";
+					break;
+				case 0x72:
+					out += "\r";
+					break;
+				case 0x74:
+					out += "\t";
+					break;
+				case U: {
+					const hex = s.slice(i + 1, i + 5);
+					if (HEX4_RE.test(hex)) {
+						out += String.fromCharCode(parseInt(hex, 16));
+						i += 4;
+					} else {
+						out += "\\u"; // invalid \u — keep literal
+					}
+					break;
+				}
+				default:
+					out += `\\${s[i]}`; // invalid escape — keep backslash literal
+			}
+			i++;
+			runStart = i;
+		}
+		out += s.slice(runStart, i);
+		if (this.#partial) {
+			this.#i = i;
+			return out;
+		}
+		throw new SyntaxError("Unterminated string");
+	}
+
+	/** A quote closes a string only when the next non-space char ends a value. */
+	#closesString(from: number): boolean {
+		const s = this.#s;
+		let k = from;
+		while (k < this.#n && isWhitespace(s.charCodeAt(k))) k++;
+		if (k >= this.#n) return true;
+		const c = s[k];
+		return c === "," || c === "}" || c === "]" || c === ":";
+	}
+
+	#number(): unknown {
+		const s = this.#s;
+		const start = this.#i;
+		while (this.#i < this.#n) {
+			const ch = s[this.#i];
+			if (
+				(ch >= "0" && ch <= "9") ||
+				ch === "-" ||
+				ch === "+" ||
+				ch === "." ||
+				ch === "e" ||
+				ch === "E" ||
+				ch === "x" ||
+				ch === "X" ||
+				(ch >= "a" && ch <= "f") ||
+				(ch >= "A" && ch <= "F")
+			) {
+				this.#i++;
+			} else {
+				break;
+			}
+		}
+		const token = s.slice(start, this.#i);
+		const num = Number(token);
+		if (Number.isNaN(num)) {
+			if (this.#partial) return INCOMPLETE;
+			throw new SyntaxError(`Invalid number: ${token}`);
+		}
+		return num;
+	}
+
+	#keyword(): unknown {
+		const s = this.#s;
+		const i = this.#i;
+		for (const [word, value] of KEYWORDS) {
+			// Require a non-identifier boundary so `Truex` / `nullish` are not misread
+			// as the keyword followed by junk.
+			if (s.startsWith(word, i) && !isIdentChar(s.charCodeAt(i + word.length))) {
+				this.#i += word.length;
+				return value;
+			}
+		}
+		if (this.#partial) {
+			// Incomplete / unrecognized atomic token at the streaming edge — signal the
+			// caller to roll back to the last valid prefix instead of committing junk.
+			this.#i = this.#n;
+			return INCOMPLETE;
+		}
+		throw new SyntaxError(`Unexpected token at position ${this.#i}`);
+	}
+}
+
+/**
+ * Final-parse a JSON value, repairing the common LLM malformations
+ * ({@link RelaxedJson}). Tries strict `JSON.parse` first (fast path, exact JSON
+ * semantics), then the relaxed parser. Throws when the input is unrepairable,
+ * truncated, or carries trailing garbage — so callers can skip a bad tool call
+ * rather than execute a half-formed one.
+ */
 export function parseJsonWithRepair<T>(json: string): T {
 	try {
 		return JSON.parse(json) as T;
-	} catch (error) {
-		const repairedJson = repairJson(json);
-		if (repairedJson !== json) {
-			return JSON.parse(repairedJson) as T;
-		}
-		throw error;
+	} catch {
+		return new RelaxedJson(json, false).parse() as T;
 	}
 }
 
 /**
- * Attempts to parse potentially incomplete JSON during streaming.
- * Always returns a valid object, even if the JSON is incomplete.
- *
- * @param partialJson The partial JSON string from streaming
- * @returns Parsed object or empty object if parsing fails
+ * Parse possibly-incomplete JSON during streaming. Always returns a value, never
+ * throws: `{}` for empty/whitespace/unrecoverable buffers, and an auto-closed
+ * best-effort object for truncated ones.
  */
 export function parseStreamingJson<T = Record<string, unknown>>(partialJson: string | undefined): T {
-	partialJson = partialJson?.trimStart();
-	if (!partialJson) {
-		return {} as T;
-	}
+	const trimmed = partialJson?.trimStart();
+	if (!trimmed) return {} as T;
 	try {
-		return JSON.parse(partialJson) as T;
+		return JSON.parse(trimmed) as T;
 	} catch {
-		partialJson = repairJson(partialJson);
 		try {
-			return (partialParse(partialJson) ?? {}) as T;
+			return (new RelaxedJson(trimmed, true).parse() ?? {}) as T;
 		} catch {
-			// If all parsing fails, return empty object
 			return {} as T;
 		}
 	}