@tyvm/knowhow 0.0.154 → 0.0.156

package/src/commands/services.ts

@@ -69,32 +69,37 @@ export async function setupServices() {
 
   Agents.setAgentContext(agentContext);
 
-  console.log("🔌 Connecting to MCP...");
-  try {
-    await Mcp.connectToConfigured(Tools);
-  } catch (mcpError) {
-    const msg = mcpError instanceof Error ? mcpError.message : String(mcpError);
-    console.warn(
-      `⚠ Some MCP servers failed to connect (continuing without them): ${msg}`
-    );
-  }
-  // Attempt silent JWT refresh via SSH identity before registering models.
-  // This handles the case where the JWT has expired but the user has a valid
-  // SSH identity registered — they shouldn't need to run `knowhow login` again
-  // unless they want to switch organizations.
+  // Refresh authentication before MCP transports, model clients, or remote
+  // sync modules can read the project JWT file.
   try {
     const startupConfig = getConfigSync();
     if (startupConfig.orgId && !process.env.KNOWHOW_JWT) {
-      await authenticateWithKey(
+      const refreshed = await authenticateWithKey(
         startupConfig.orgId,
         process.env.KNOWHOW_API_URL || "https://api.knowhow.tyvm.ai",
         startupConfig.cliIdentityPath
       );
+      if (!refreshed) {
+        console.warn(
+          `⚠ Could not renew the Knowhow session: no available CLI identity is registered ` +
+          `for configured organization ${startupConfig.orgId}. Run \`knowhow login\` to select ` +
+          `an organization and register the global identity.`
+        );
+      }
     }
-  } catch (_err) {
-    // Non-fatal: if SSH refresh fails (no key, revoked, network issue), we
-    // continue with the existing JWT (or no JWT). The user will see model
-    // warnings if no valid JWT is available.
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`⚠ Could not renew the Knowhow session before startup: ${message}`);
+  }
+
+  console.log("🔌 Connecting to MCP...");
+  try {
+    await Mcp.connectToConfigured(Tools);
+  } catch (mcpError) {
+    const msg = mcpError instanceof Error ? mcpError.message : String(mcpError);
+    console.warn(
+      `⚠ Some MCP servers failed to connect (continuing without them): ${msg}`
+    );
   }
 
   console.log("Connecting to clients...");

package/src/login.ts

@@ -1,12 +1,13 @@
 import http from "./utils/http";
 import fs from "fs";
+import os from "os";
 import path from "path";
 import { ask } from "./utils";
 import { getConfig, updateConfig } from "./config";
 import { KNOWHOW_API_URL } from "./services/KnowhowClient";
 import { BrowserLoginService } from "./auth/browserLogin";
 import { authenticateWithKey, hasKeyPair, registerPublicKey } from "./auth/keyAuth";
-import { getOrCreatePublicKey } from "./auth/keyManager";
+import { getDefaultPrivateKeyPath, getOrCreatePublicKey } from "./auth/keyManager";
 
 /**
  * Log in to Knowhow.
@@ -40,18 +41,19 @@ export async function login(jwtFlag?: boolean, identityPath?: string): Promise<v
     fs.chmodSync(jwtFile, 0o600);
     console.log("JWT updated successfully.");
   } else {
+    const selectedIdentityPath = identityPath ?? getDefaultPrivateKeyPath();
     const config = await getConfig();
     const orgId = config.orgId;
 
     // A local key is not proof of registration. Let the selected environment
     // check it, but only when an organization is available to bind the attempt.
-    if (orgId && hasKeyPair(identityPath)) {
+    if (orgId && hasKeyPair(selectedIdentityPath)) {
       console.log("Found CLI identity — authenticating with public key...");
       try {
-        const success = await authenticateWithKey(orgId, KNOWHOW_API_URL, identityPath);
+        const success = await authenticateWithKey(orgId, KNOWHOW_API_URL, selectedIdentityPath);
         if (success) {
           console.log("✅ Successfully authenticated via public key!");
-          return await postLoginConfigUpdate(identityPath);
+          return await postLoginConfigUpdate(selectedIdentityPath);
         }
         console.warn("Key authentication returned no JWT, falling back to browser login...");
       } catch (error: unknown) {
@@ -61,7 +63,8 @@ export async function login(jwtFlag?: boolean, identityPath?: string): Promise<v
     }
 
     // Fall back when no org/key is configured or when key auth is unavailable.
-    await doBrowserLogin(identityPath);
+    await doBrowserLogin(selectedIdentityPath);
+    identityPath = selectedIdentityPath;
   }
 
   await postLoginConfigUpdate(identityPath);
@@ -101,6 +104,15 @@ async function doBrowserLogin(identityPath?: string): Promise<void> {
   }
 }
 
+function isTemporaryIdentityPath(identityPath: string): boolean {
+  const resolvedIdentity = path.resolve(identityPath);
+  const temporaryRoots = new Set([os.tmpdir(), "/tmp", "/var/tmp"]);
+  return Array.from(temporaryRoots).some((temporaryRoot) => {
+    const relativePath = path.relative(path.resolve(temporaryRoot), resolvedIdentity);
+    return relativePath !== "" && !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+  });
+}
+
 /** After any successful login, update the local config with the current user/org. */
 async function postLoginConfigUpdate(identityPath?: string): Promise<void> {
   try {
@@ -129,8 +141,12 @@ async function postLoginConfigUpdate(identityPath?: string): Promise<void> {
       config.orgId = orgId;
     }
 
-    if (identityPath) {
+    if (identityPath && !isTemporaryIdentityPath(identityPath)) {
       config.cliIdentityPath = path.resolve(identityPath);
+    } else if (
+      config.cliIdentityPath && isTemporaryIdentityPath(config.cliIdentityPath)
+    ) {
+      delete config.cliIdentityPath;
     }
 
     await updateConfig(config);

package/src/processors/Base64ImageDetector.ts

@@ -316,25 +316,26 @@ export class Base64ImageProcessor {
 
   createProcessor(): MessageProcessorFunction {
     return (originalMessages: Message[], modifiedMessages: Message[]) => {
-      // Only process the last (newest) message for hint injection.
-      // Processing all historical messages on every call would re-append hints
-      // to already-processed messages, causing the hint to multiply and busting
-      // Anthropic's prefix cache (which requires byte-identical prior messages).
       const lastIndex = modifiedMessages.length - 1;
       if (lastIndex < 0) return;
 
       const lastMessage = modifiedMessages[lastIndex];
 
-      // Process user messages (images from user input)
-      if (lastMessage.role === "user") {
-        this.processMessageContent(lastMessage);
+      // Every request starts with a fresh clone of the persisted thread. Normalize
+      // all images: parallel calls can place another tool result after an image,
+      // while historical image results remain persisted as JSON strings.
+      for (const message of modifiedMessages) {
+        if (message.role === "user") {
+          this.processMessageContent(message);
+        }
+        if (message.role === "tool") {
+          this.processToolMessageContent(message);
+        }
       }
 
-      // Process tool messages (images from loadImageAsBase64 tool)
-      // Tool responses come back as JSON strings that need to be parsed
-      // and converted to proper image content before the agent sees them
+      // Add path hints only to the newest message. Re-appending hints to history
+      // would multiply them and invalidate the provider's prompt cache.
       if (lastMessage.role === "tool") {
-        this.processToolMessageContent(lastMessage);
         // After processing tool content (which may not convert to image if it's plain text
         // describing a screenshot path), add hints for any image file paths found in the text.
         this.applyImagePathHintsToMessage(lastMessage);

package/src/services/KnowhowClient.ts

@@ -3,7 +3,7 @@ import { TraceAll } from "../util/Trace";
 import http, { HTTP_UNAUTHORIZED_HANDLER, RefreshableHeaders } from "../utils/http";
 import fs from "fs";
 import { getConfigSync } from "../config";
-import { exchangePublicKeyJwt, storeJwt } from "../auth/keyAuth";
+import { exchangeAvailablePublicKeyJwt, storeJwt } from "../auth/keyAuth";
 import { keyPairExists } from "../auth/keyManager";
 import { Message } from "../clients/types";
 import path from "path";
@@ -189,6 +189,7 @@ export class KnowhowSimpleClient {
   }
 
   private jwtExpiresSoon(): boolean {
+    if (!this.jwt) return true;
     try {
       const payload = JSON.parse(Buffer.from(this.jwt.split(".")[1], "base64url").toString("utf8"));
       return typeof payload.exp === "number" && payload.exp * 1000 - Date.now() < 5 * 60 * 1000;
@@ -205,11 +206,11 @@ export class KnowhowSimpleClient {
     this.refreshPromise = (async () => {
       const config = getConfigSync();
       const identityPath = config.cliIdentityPath;
-      if (!config.orgId || !keyPairExists(identityPath)) {
+      if (!config.orgId || (!keyPairExists(identityPath) && !keyPairExists())) {
         throw new Error("JWT expired and the CLI identity is unavailable. Please run `knowhow login` again.");
       }
       try {
-        const freshJwt = await exchangePublicKeyJwt(config.orgId, this.baseUrl, identityPath);
+        const freshJwt = await exchangeAvailablePublicKeyJwt(config.orgId, this.baseUrl, identityPath);
         storeJwt(freshJwt);
         this.setJwt(freshJwt);
         this.jwtValidated = true;
@@ -226,12 +227,12 @@ export class KnowhowSimpleClient {
   }
 
   async checkJwt() {
+    await this.renewJwt();
+
     if (!this.jwt) {
       throw new Error("No JWT found. Please login first.");
     }
 
-    await this.renewJwt();
-
     if (!this.jwtValidated) {
       try {
         this.jwtValidated = true;

package/src/services/watchers/FsSyncer.ts

@@ -15,7 +15,9 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
   public taskId: string = "";
   private taskPath: string = "";
   private watcher: fs.FSWatcher | null = null;
+  private lastThreadIndex: number = -1;
   private lastThreadLength: number = 0;
+  private lastMessageJson: string | null = null;
   public agentName: string = "unknown";
   private debounceTimer: NodeJS.Timeout | null = null;
   public agentEvents = new EventService();
@@ -37,7 +39,9 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
       const threads: any[][] = metadata.threads || [];
       const lastThread = threads[threads.length - 1] || [];
       this.agentName = metadata.agentName || taskId;
+      this.lastThreadIndex = threads.length - 1;
       this.lastThreadLength = lastThread.length;
+      this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
     }
 
     // Watch the directory for metadata.json changes
@@ -68,8 +72,26 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
     const threads: any[][] = metadata.threads;
     const lastThread = threads[threads.length - 1] || [];
 
+    const threadIndex = threads.length - 1;
+    let newMessages: any[];
+    if (
+      threadIndex === this.lastThreadIndex &&
+      lastThread.length >= this.lastThreadLength
+    ) {
+      newMessages = lastThread.slice(this.lastThreadLength);
+    } else {
+      const retainedIndex = this.findLastMessage(
+        lastThread,
+        this.lastMessageJson
+      );
+      newMessages = lastThread.slice(retainedIndex + 1);
+    }
+
+    this.lastThreadIndex = threadIndex;
+    this.lastThreadLength = lastThread.length;
+    this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
+
     // Only render NEW messages since last check
-    const newMessages = lastThread.slice(this.lastThreadLength);
     if (newMessages.length > 0) {
       const renderEvents = messagesToRenderEvents(
         newMessages,
@@ -93,7 +115,6 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
         }
       }
       this.agentEvents.emit(this.eventTypes.threadUpdate, lastThread);
-      this.lastThreadLength = lastThread.length;
     }
 
     // Emit done if the agent has completed and has a result
@@ -149,6 +170,23 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
     console.log(`🫵 Interrupt written to input for agent: ${this.taskId}`);
   }
 
+  private messageJson(message: any): string | null {
+    if (message == null) return null;
+    try {
+      return JSON.stringify(message);
+    } catch {
+      return null;
+    }
+  }
+
+  private findLastMessage(messages: any[], messageJson: string | null): number {
+    if (messageJson == null) return -1;
+    for (let index = messages.length - 1; index >= 0; index--) {
+      if (this.messageJson(messages[index]) === messageJson) return index;
+    }
+    return -1;
+  }
+
   private async readMetadata(): Promise<any> {
     try {
       const metaPath = path.join(this.taskPath, "metadata.json");

package/src/services/watchers/RemoteSyncer.ts

@@ -16,7 +16,9 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
   public taskId: string = "";
   private client: KnowhowSimpleClient;
   private pollInterval: NodeJS.Timeout | null = null;
+  private lastThreadIndex: number = -1;
   private lastThreadLength: number = 0;
+  private lastMessageJson: string | null = null;
   public agentName: string = "remote-agent";
   private stopped: boolean = false;
   public agentEvents = new EventService();
@@ -41,8 +43,10 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
       const details = await this.client.getTaskDetails(taskId);
       const threads: any[][] = details?.data?.threads || [];
       const lastThread = threads[threads.length - 1] || [];
+      this.lastThreadIndex = threads.length - 1;
       this.agentName = "remote-agent";
       this.lastThreadLength = lastThread.length;
+      this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
     } catch (err: any) {
       console.warn(
         `⚠️  Could not load initial state for task ${taskId}: ${err.message}`
@@ -68,8 +72,26 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
       const details = await this.client.getTaskDetails(this.taskId);
       const threads: any[][] = details?.data?.threads || [];
       const lastThread = threads[threads.length - 1] || [];
+      const threadIndex = threads.length - 1;
+
+      let newMessages: any[];
+      if (
+        threadIndex === this.lastThreadIndex &&
+        lastThread.length >= this.lastThreadLength
+      ) {
+        newMessages = lastThread.slice(this.lastThreadLength);
+      } else {
+        const retainedIndex = this.findLastMessage(
+          lastThread,
+          this.lastMessageJson
+        );
+        newMessages = lastThread.slice(retainedIndex + 1);
+      }
+
+      this.lastThreadIndex = threadIndex;
+      this.lastThreadLength = lastThread.length;
+      this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
 
-      const newMessages = lastThread.slice(this.lastThreadLength);
       if (newMessages.length > 0) {
         const renderEvents = messagesToRenderEvents(
           newMessages,
@@ -93,7 +115,6 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
           }
         }
         this.agentEvents.emit(this.eventTypes.threadUpdate, lastThread);
-        this.lastThreadLength = lastThread.length;
       }
 
       // Stop polling and emit done if task is complete with a result
@@ -155,4 +176,21 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
     await this.client.sendMessageToAgent(this.taskId, `/poke ${message || ""}`.trim());
     console.log(`🫵 Interrupt sent to remote web agent: ${this.taskId}`);
   }
+
+  private messageJson(message: any): string | null {
+    if (message == null) return null;
+    try {
+      return JSON.stringify(message);
+    } catch {
+      return null;
+    }
+  }
+
+  private findLastMessage(messages: any[], messageJson: string | null): number {
+    if (messageJson == null) return -1;
+    for (let index = messages.length - 1; index >= 0; index--) {
+      if (this.messageJson(messages[index]) === messageJson) return index;
+    }
+    return -1;
+  }
 }

package/src/tunnel.ts

@@ -10,10 +10,13 @@ import { WorkerPasskeyAuthService } from "./workers/auth/WorkerPasskeyAuth";
 import { WsMiddlewareStack } from "./workers/auth/WsMiddleware";
 import { makeAuthMiddleware } from "./workers/auth/authMiddleware";
 
+const PROD_TUNNEL_WORKER_DOMAIN = "worker.tyvm-apps.com";
+
 /**
- * Extract the tunnel domain and protocol from the API URL.
- * e.g., "https://api.knowhow.tyvm.ai" -> { domain: "worker.knowhow.tyvm.ai", useHttps: true }
- * e.g., "http://localhost:4000" -> { domain: "worker.localhost:4000", useHttps: false }
+ * Resolve the tunnel domain and protocol from the environment and API URL.
+ * TUNNEL_WORKER_DOMAIN takes precedence. Otherwise localhost API URLs use the
+ * local tunnel proxy, dev API URLs use the dev tunnel domain, and all other API
+ * URLs use the production tunnel domain.
  */
 export function extractTunnelDomain(apiUrl: string): {
   domain: string;
@@ -22,18 +25,31 @@ export function extractTunnelDomain(apiUrl: string): {
   try {
     const url = new URL(apiUrl);
     const useHttps = url.protocol === "https:";
-
-    // For localhost, include port; for production, just use hostname
-    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-      return {
-        domain: `worker.${url.hostname}:${url.port || "80"}`,
-        useHttps,
-      };
-    }
-    return { domain: `worker.${url.hostname}`, useHttps };
+    const configuredDomain = process.env.TUNNEL_WORKER_DOMAIN?.trim();
+
+    const isLocalApi =
+      url.hostname === "localhost" ||
+      url.hostname.endsWith(".localhost") ||
+      url.hostname === "127.0.0.1" ||
+      url.hostname === "[::1]";
+    const isDevApi = url.hostname.split(".").includes("dev");
+    const domain =
+      configuredDomain ||
+      (isLocalApi
+        ? `worker.localhost:${url.port || (useHttps ? "443" : "80")}`
+        : isDevApi
+          ? `worker.dev.tyvm-apps.com`
+          : PROD_TUNNEL_WORKER_DOMAIN);
+
+    return { domain, useHttps };
   } catch (err) {
     console.error("Failed to parse API_URL for tunnel domain:", err);
-    return { domain: "worker.localhost:4000", useHttps: false }; // fallback
+    return {
+      domain:
+        process.env.TUNNEL_WORKER_DOMAIN?.trim() ||
+        PROD_TUNNEL_WORKER_DOMAIN,
+      useHttps: false,
+    };
   }
 }
 

package/src/worker.ts

@@ -6,6 +6,7 @@ import { loadJwt } from "./login";
 import { services } from "./services";
 import { PasskeySetupService } from "./workers/auth/PasskeySetup";
 import { WorkerPasskeyAuthService } from "./workers/auth/WorkerPasskeyAuth";
+import { authenticateWithKey, hasKeyPair } from "./auth/keyAuth";
 import {
   makeUnlockTool,
   makeLockTool,
@@ -303,8 +304,8 @@ export async function worker(options?: {
   let connected = false;
   let tunnelHandler: TunnelHandler | null = null;
   let tunnelWs: WebSocket | null = null;
-  let lastJwt: string | null = null;
   let unauthorizedJwt: string | null = null;
+  let refreshAttemptedJwt: string | null = null;
 
   // ---------------------------------------------------------------------------
   // Liveness watchdog state
@@ -353,7 +354,6 @@ export async function worker(options?: {
   async function connectWebSocket() {
     const jwt = await loadJwt();
     console.log(`Connecting to ${API_URL}`);
-    lastJwt = jwt;
 
     // Reset the MCP server to avoid "Already connected to a transport" error on reconnects
     await mcpServer.reset();
@@ -476,11 +476,17 @@ export async function worker(options?: {
         },
         onClose: (code, _reason) => {
           if (code === 1008) {
-            unauthorizedJwt = lastJwt;
+            unauthorizedJwt = jwt;
+            // The worker and tunnel sockets share a JWT and must be renewed as
+            // one connection cycle. Ensure a later worker "open" event cannot
+            // leave us connected with a permanently closed tunnel.
+            if (ws.readyState !== WebSocket.CLOSED) {
+              ws.terminate();
+            }
             console.error(
               "❌ Tunnel received Unauthorized (1008). The JWT may be expired."
             );
-            console.error("   Pausing reconnection until JWT changes...");
+            console.error("   Attempting to refresh the JWT with the CLI identity...");
           } else {
             console.log(
               "Tunnel connection will reconnect on next connection cycle..."
@@ -532,14 +538,16 @@ export async function worker(options?: {
       // If we got an Unauthorized (1008) close, record the JWT that failed
       // so we don't keep hammering the server with the same expired token
       if (code === 1008) {
-        unauthorizedJwt = lastJwt;
+        unauthorizedJwt = jwt;
+        if (tunnelConnection?.readyState !== WebSocket.CLOSED) {
+          tunnelConnection?.terminate();
+        }
         console.error(
           "❌ Worker received Unauthorized (1008). The JWT may be expired."
         );
         console.error(
-          "   Run 'knowhow login' to refresh your token, then restart the worker."
+          "   Attempting to refresh the JWT with the CLI identity..."
         );
-        console.error("   Pausing reconnection until JWT changes...");
       } else {
         console.log("Attempting to reconnect...");
       }
@@ -566,17 +574,59 @@ export async function worker(options?: {
 
   while (true) {
     if (!connected) {
-      // If we got an Unauthorized error, check if the JWT has changed before retrying
+      // A registered CLI identity can renew an expired JWT without requiring an
+      // interactive login. Attempt this once per rejected token; if it fails,
+      // continue watching the JWT file so `knowhow login` in another shell works.
       if (unauthorizedJwt !== null) {
-        const currentJwt = await loadJwt().catch(() => null);
+        let currentJwt = await loadJwt().catch(() => null);
         if (currentJwt === unauthorizedJwt) {
-          // JWT hasn't changed - don't reconnect, just wait
-          await wait(5000);
-          continue;
+          let attemptedRefreshNow = false;
+          if (refreshAttemptedJwt !== currentJwt) {
+            refreshAttemptedJwt = currentJwt;
+            attemptedRefreshNow = true;
+            const freshConfig = await getConfig();
+            const identityPath = freshConfig.cliIdentityPath;
+            if (freshConfig.orgId && hasKeyPair(identityPath)) {
+              try {
+                const refreshed = await authenticateWithKey(
+                  freshConfig.orgId,
+                  API_URL,
+                  identityPath
+                );
+                if (refreshed) {
+                  currentJwt = await loadJwt();
+                  console.log("✅ JWT refreshed automatically; reconnecting...");
+                } else {
+                  console.error(
+                    "❌ CLI identity was rejected and could not refresh the JWT."
+                  );
+                }
+              } catch (error) {
+                const message =
+                  error instanceof Error ? error.message : String(error);
+                console.error(`❌ Automatic JWT refresh failed: ${message}`);
+              }
+            } else {
+              console.error(
+                "❌ No registered CLI identity is available for automatic JWT refresh."
+              );
+            }
+          }
+
+          if (currentJwt === unauthorizedJwt) {
+            if (attemptedRefreshNow) {
+              console.error(
+                "   Run 'knowhow login' in another shell; reconnection will resume when the JWT changes."
+              );
+            }
+            await wait(5000);
+            continue;
+          }
         }
         // JWT changed - clear the unauthorized state and reconnect
         console.log("🔄 JWT has changed, attempting to reconnect...");
         unauthorizedJwt = null;
+        refreshAttemptedJwt = null;
       }
 
       console.log("Attempting to connect...");

package/tests/clients/reasoningEffort.test.ts

@@ -45,6 +45,63 @@ describe("reasoning effort values", () => {
     expect(client.resolveReasoningEffortForModel(options("unknown", "max"))).toBe("xhigh");
   });
 
+  it("explicitly disables reasoning in Responses API requests", async () => {
+    const client = new GenericOpenAiClient("fake-key");
+    const create = jest.fn().mockResolvedValue({
+      id: "resp_disabled",
+      status: "completed",
+      output: [{ type: "message", content: [{ type: "output_text", text: "summary" }] }],
+      usage: { input_tokens: 1, output_tokens: 1 },
+    });
+    (client.client as any).responses.create = create;
+
+    await client.createChatResponse({
+      model: Models.openai.GPT_56_Sol,
+      messages: [{ role: "user", content: "summarize" }],
+      reasoning_effort: "none",
+    });
+
+    expect(create).toHaveBeenCalledWith(
+      expect.objectContaining({ reasoning: { effort: "none" } })
+    );
+  });
+
+  it("diagnoses empty Responses output but not valid tool-only output", async () => {
+    const client = new GenericOpenAiClient("fake-key");
+    const warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    const create = jest.fn()
+      .mockResolvedValueOnce({
+        id: "resp_empty",
+        status: "incomplete",
+        incomplete_details: { reason: "max_output_tokens" },
+        output: [{ type: "reasoning", summary: [] }],
+        usage: { input_tokens: 2, output_tokens: 3 },
+      })
+      .mockResolvedValueOnce({
+        id: "resp_tool",
+        status: "completed",
+        output: [{
+          type: "function_call", call_id: "call_1", name: "readFile", arguments: "{}",
+        }],
+        usage: { input_tokens: 2, output_tokens: 3 },
+      });
+    (client.client as any).responses.create = create;
+    const request = {
+      model: Models.openai.GPT_56_Sol,
+      messages: [{ role: "user" as const, content: "continue" }],
+    };
+
+    await client.createChatResponse(request);
+    expect(warn).toHaveBeenCalledWith(
+      "[Responses API] Response contained no text or tool calls",
+      expect.objectContaining({ responseId: "resp_empty", status: "incomplete" })
+    );
+    warn.mockClear();
+    await client.createChatResponse(request);
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+
   it("maps all values to valid Gemini thinking levels and budgets", () => {
     const client = new GenericGeminiClient("fake-key");
     const levelModel = GoogleThinkingLevelModels.find(

package/tests/processors/Base64ImageDetector.test.ts

@@ -220,6 +220,38 @@ describe("Base64ImageDetector", () => {
       expect(content[0].image_url.url).toBe(imageDataUrl);
     });
 
+    it("should process an image result that is not the newest parallel tool result", () => {
+      const imageDataUrl =
+        "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==";
+      const modifiedMessages: Message[] = [
+        {
+          role: "tool",
+          content: JSON.stringify({
+            type: "image_url",
+            image_url: { url: imageDataUrl, detail: "high" },
+          }),
+          tool_call_id: "call_image",
+        },
+        {
+          role: "tool",
+          content: "A later readFile result",
+          tool_call_id: "call_file",
+        },
+        {
+          role: "user",
+          content: "A pending workflow update",
+        },
+      ];
+
+      detector.createProcessor()([], modifiedMessages);
+
+      expect(Array.isArray(modifiedMessages[0].content)).toBe(true);
+      expect((modifiedMessages[0].content as any[])[0]).toEqual({
+        type: "image_url",
+        image_url: { url: imageDataUrl, detail: "high" },
+      });
+    });
+
     it("should not promote a compressed image URL placeholder to image content", () => {
       const toolResponseJson = JSON.stringify({
         type: "image_url",