@yansigit/opencodex 2.31.3 → 2.33.0

package/src/providers/request-pacing.ts

@@ -33,6 +33,8 @@ interface Waiter {
   modelId?: string;
   providerIntervalMs: number;
   modelIntervalMs: number;
+  providerJitterMs: number;
+  modelJitterMs: number;
   queuedAt: number;
   signal?: AbortSignal;
   resolve: () => void;
@@ -54,6 +56,7 @@ export interface RequestPacingRuntime {
   setTimer: (callback: () => void, delayMs: number) => unknown;
   clearTimer: (handle: unknown) => void;
   enqueueMicrotask: (callback: () => void) => void;
+  random: () => number;
 }
 
 export interface ProviderRequestPacingStatus {
@@ -71,6 +74,7 @@ const defaultRuntime: RequestPacingRuntime = {
   setTimer: (callback, delayMs) => setTimeout(callback, delayMs),
   clearTimer: handle => clearTimeout(handle as ReturnType<typeof setTimeout>),
   enqueueMicrotask: queueMicrotask,
+  random: Math.random,
 };
 let runtime = defaultRuntime;
 let lastReconciledGeneration = 0;
@@ -90,6 +94,19 @@ function normalizedInterval(rule: RequestPacingRule | undefined): number {
   return Math.max(rpmInterval, fixedInterval);
 }
 
+function normalizedJitter(rule: RequestPacingRule | undefined): number {
+  return rule?.jitterMs !== undefined && Number.isInteger(rule.jitterMs)
+    ? Math.min(60_000, Math.max(0, rule.jitterMs))
+    : 0;
+}
+
+function jitterDelay(jitterMs: number): number {
+  if (jitterMs <= 0) return 0;
+  const sample = runtime.random();
+  if (!Number.isFinite(sample)) return 0;
+  return Math.min(jitterMs, Math.floor(Math.max(0, sample) * jitterMs));
+}
+
 export function requestPacingIntervalMs(provider: OcxProviderConfig, modelId?: string): number {
   const policy = provider.requestPacing;
   if (!policy?.enabled) return 0;
@@ -100,12 +117,17 @@ export function requestPacingIntervalMs(provider: OcxProviderConfig, modelId?: s
 function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string): {
   providerIntervalMs: number;
   modelIntervalMs: number;
+  providerJitterMs: number;
+  modelJitterMs: number;
 } {
   const policy = provider.requestPacing;
-  if (!policy?.enabled) return { providerIntervalMs: 0, modelIntervalMs: 0 };
+  if (!policy?.enabled) return { providerIntervalMs: 0, modelIntervalMs: 0, providerJitterMs: 0, modelJitterMs: 0 };
+  const model = modelId ? policy.models?.[modelId] : undefined;
   return {
     providerIntervalMs: normalizedInterval(policy),
-    modelIntervalMs: modelId ? normalizedInterval(policy.models?.[modelId]) : 0,
+    modelIntervalMs: normalizedInterval(model),
+    providerJitterMs: normalizedJitter(policy),
+    modelJitterMs: normalizedJitter(model),
   };
 }
 
@@ -186,9 +208,9 @@ function runQueue(providerName: string, state: ProviderPacer): void {
   const startedAt = runtime.now();
   state.lastStartedAt = startedAt;
   state.lastModelId = waiter.modelId;
-  state.providerNextStartAt = startedAt + waiter.providerIntervalMs;
-  if (waiter.modelId && waiter.modelIntervalMs > 0) {
-    state.modelNextStartAt.set(waiter.modelId, startedAt + waiter.modelIntervalMs);
+  state.providerNextStartAt = startedAt + waiter.providerIntervalMs + jitterDelay(waiter.providerJitterMs);
+  if (waiter.modelId && (waiter.modelIntervalMs > 0 || waiter.modelJitterMs > 0)) {
+    state.modelNextStartAt.set(waiter.modelId, startedAt + waiter.modelIntervalMs + jitterDelay(waiter.modelJitterMs));
   }
   waiter.resolve();
   runtime.enqueueMicrotask(() => runQueue(providerName, state));
@@ -201,7 +223,12 @@ export async function waitForProviderRequestSlot(
   signal?: AbortSignal,
 ): Promise<void> {
   const intervals = requestPacingIntervals(provider, modelId);
-  if (Math.max(intervals.providerIntervalMs, intervals.modelIntervalMs) <= 0) return;
+  if (Math.max(
+    intervals.providerIntervalMs,
+    intervals.modelIntervalMs,
+    intervals.providerJitterMs,
+    intervals.modelJitterMs,
+  ) <= 0) return;
   if (signal?.aborted) throw abortReason(signal);
 
   const state = pacers.get(providerName) ?? {

package/src/providers/xai-transport.ts

@@ -4,6 +4,27 @@ import { resolveGithubCopilotTransport } from "./github-copilot-transport";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
+/** The two hosts that serve xAI's Responses API: the public API and the Grok CLI proxy. */
+const XAI_RESPONSES_HOSTS = new Set(["api.x.ai", "cli-chat-proxy.grok.com"]);
+
+/**
+ * True when this provider's Responses traffic terminates at xAI itself.
+ *
+ * Probed 2026-08-22 one field per request: the two hosts accept and refuse exactly the same
+ * web_search fields, so they are one dialect rather than two. Matching is exact-host over
+ * https, which keeps lookalikes (`api.x.ai.evil.test`) and nonstandard ports out.
+ */
+export function isXaiResponsesDestination(provider: Pick<OcxProviderConfig, "baseUrl">): boolean {
+  try {
+    const url = new URL(provider.baseUrl);
+    return url.protocol === "https:"
+      && XAI_RESPONSES_HOSTS.has(url.hostname.toLowerCase())
+      && (url.port === "" || url.port === "443");
+  } catch {
+    return false;
+  }
+}
+
 export const XAI_GROK_COMPATIBILITY = {
   version: "0.2.93",
   userAgent: "opencodex-grok/0.2.93",

package/src/reasoning-effort.ts

@@ -14,6 +14,16 @@ export const CODEX_REASONING_LEVELS: { effort: string; description: string }[] =
 const CODEX_REASONING_ORDER = CODEX_REASONING_LEVELS.map(l => l.effort);
 const CODEX_REASONING_SET = new Set(CODEX_REASONING_ORDER);
 
+/**
+ * Sentinel wire value in reasoningEffortMap / modelReasoningEffortMap to explicitly
+ * omit the reasoning_effort field from the upstream wire request (issue #2356).
+ */
+export const REASONING_EFFORT_OMIT_SENTINEL = "__omit__";
+
+export function isReasoningEffortOmitted(wireEffort: string | undefined): boolean {
+  return wireEffort === REASONING_EFFORT_OMIT_SENTINEL;
+}
+
 /** True when `effort` is a member of the Codex reasoning ladder (low..ultra). */
 export function isCodexReasoningEffort(effort: string): boolean {
   return CODEX_REASONING_SET.has(effort);
@@ -170,7 +180,10 @@ export function mapReasoningEffort(provider: OcxProviderConfig, modelId: string,
   const boundary = requested === "ultra" ? "max" : requested;
 
   const wireMap = reasoningEffortMapFor(provider, modelId);
-  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, boundary)) return wireMap[boundary];
+  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, boundary)) {
+    const mapped = wireMap[boundary];
+    return mapped === REASONING_EFFORT_OMIT_SENTINEL ? undefined : mapped;
+  }
 
   const supported = configuredReasoningEfforts(provider, modelId);
   const codexEffort = supported !== undefined ? clampToSupportedCodexEffort(boundary, supported) : requestToCodexEffort(boundary);
@@ -178,6 +191,10 @@ export function mapReasoningEffort(provider: OcxProviderConfig, modelId: string,
 
   // Belt for the odd config where the supported ladder is ultra-only and the clamp lands on it.
   const wire = codexEffort === "ultra" ? "max" : codexEffort;
-  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, wire)) return wireMap[wire];
+  if (wireMap && Object.prototype.hasOwnProperty.call(wireMap, wire)) {
+    const mapped = wireMap[wire];
+    return mapped === REASONING_EFFORT_OMIT_SENTINEL ? undefined : mapped;
+  }
+  if (wire === REASONING_EFFORT_OMIT_SENTINEL) return undefined;
   return wire;
 }

package/src/responses/apply-patch-envelope.ts

@@ -0,0 +1,63 @@
+// Representation repair for top-level Codex apply_patch custom-tool payloads.
+//
+// Some routed models decorate the first and last lines as
+// `*** Begin Patch ***` / `*** End Patch ***`. Codex rejects those otherwise
+// valid custom-tool payloads. Repair is deliberately limited to a complete,
+// structurally recognizable top-level patch: arbitrary `exec` JavaScript is
+// caller-authored executable input and must remain byte-identical.
+//
+// This is the same intent boundary as `src/lib/tool-argument-integers.ts`:
+// repair the one faithful reading, leave genuine patch content alone.
+
+const PATCH_BEGIN = "*** Begin Patch";
+const PATCH_END = "*** End Patch";
+const TOP_LEVEL_PATCH_ENVELOPE = /^(\*\*\* Begin Patch(?: \*\*\*)?)(\r?\n)([\s\S]*)(\r?\n)(\*\*\* End Patch(?: \*\*\*)?)(\r?\n)?$/;
+const PATCH_OPERATION_LINE = /^\*\*\* (?:Add|Update|Delete) File: .+$/m;
+
+/** Unwrap the `{input:string}` function-call wrapper used for freeform tools. */
+export function unwrapFreeformToolInput(argumentsText: unknown): string {
+  if (typeof argumentsText !== "string") return "";
+  try {
+    const parsed: unknown = JSON.parse(argumentsText);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const input = (parsed as { input?: unknown }).input;
+      if (typeof input === "string") return input;
+    }
+  } catch {
+    // The string is the freeform body, not nested JSON.
+  }
+  return argumentsText;
+}
+
+/**
+ * Strip trailing `***` only from the outer lines of one complete patch.
+ * Internal patch content, incomplete envelopes, and non-patch text are exact
+ * pass-throughs.
+ */
+export function normalizeApplyPatchDelimiters(text: string): string {
+  const match = TOP_LEVEL_PATCH_ENVELOPE.exec(text);
+  if (!match) return text;
+  const [, begin, beginBreak, body, endBreak, end, trailingBreak = ""] = match;
+  if (!PATCH_OPERATION_LINE.test(body)) return text;
+  if (begin === PATCH_BEGIN && end === PATCH_END) return text;
+  return `${PATCH_BEGIN}${beginBreak}${body}${endBreak}${PATCH_END}${trailingBreak}`;
+}
+
+/**
+ * Repair freeform input before Codex sees it.
+ *
+ * Only a bare or reserved-`functions` `apply_patch` payload may receive delimiter
+ * repair. Remote namespaces own their grammar; those bodies and every other
+ * freeform input are unwrapped and left byte-exact.
+ */
+export function repairFreeformToolInput(
+  argumentsText: unknown,
+  toolName = "",
+  namespace?: string,
+): string {
+  const unwrapped = unwrapFreeformToolInput(argumentsText);
+  const ownsApplyPatchGrammar = namespace === undefined || namespace === "functions";
+  return ownsApplyPatchGrammar && toolName === "apply_patch"
+    ? normalizeApplyPatchDelimiters(unwrapped)
+    : unwrapped;
+}

package/src/responses/custom-tool-compat.ts

@@ -1,4 +1,9 @@
 import { namespacedToolName } from "../types";
+import {
+  normalizeApplyPatchDelimiters,
+  repairFreeformToolInput,
+  unwrapFreeformToolInput,
+} from "./apply-patch-envelope";
 import { collectResponsesToolGroups } from "./tool-groups";
 
 const ROUTED_CUSTOM_TOOL_PASSTHROUGH = new Set(["apply_patch"]);
@@ -15,19 +20,42 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
-function customToolInput(argumentsText: unknown): string {
-  if (typeof argumentsText !== "string") return "";
-  try {
-    const parsed = JSON.parse(argumentsText) as unknown;
-    if (isPlainObject(parsed) && typeof parsed.input === "string") return parsed.input;
-  } catch { /* malformed arguments stay visible to the client */ }
-  return argumentsText;
-}
-
 function customToolWireName(namespace: string | undefined, name: string): string {
   return namespace === BUILTIN_FUNCTIONS_NAMESPACE ? name : namespacedToolName(namespace, name);
 }
 
+function toolChoiceAllowsRoutedCustomTool(
+  body: unknown,
+  wireName: string,
+  candidateNames: ReadonlySet<string>,
+): boolean {
+  if (!isPlainObject(body)) return true;
+  const choice = body.tool_choice;
+  if (choice === undefined || choice === null || choice === "auto" || choice === "required") {
+    return true;
+  }
+  if (choice === "none") return false;
+  if (!isPlainObject(choice)) return true;
+
+  const selectorAllows = (selector: unknown): boolean => {
+    if (!isPlainObject(selector) || typeof selector.name !== "string") return false;
+    if (selector.type !== "custom") return false;
+    if (typeof selector.namespace === "string") {
+      return customToolWireName(selector.namespace, selector.name) === wireName;
+    }
+    if (selector.name === wireName) return true;
+    const suffix = `__${selector.name}`;
+    const candidates = [...candidateNames].filter(name => name.endsWith(suffix));
+    return candidates.length === 1 && candidates[0] === wireName;
+  };
+
+  if (choice.type === "function" || choice.type === "custom") return selectorAllows(choice);
+  if (choice.type === "allowed_tools" && Array.isArray(choice.tools)) {
+    return choice.tools.some(selectorAllows);
+  }
+  return false;
+}
+
 /** Final upstream identity of a call, including a namespace restored by an earlier rewrite. */
 export function routedCustomToolWireName(value: unknown): string | undefined {
   if (!isPlainObject(value) || typeof value.name !== "string") return undefined;
@@ -38,12 +66,13 @@ export function routedCustomToolWireName(value: unknown): string | undefined {
 }
 
 /**
- * Names of converted custom declarations after namespace lowering. Restoration uses these exact
- * wire identities so same-named function and custom children in different namespaces stay distinct.
+ * Names of custom declarations after namespace lowering. The selection flag separates converted
+ * names from native passthrough names while keeping same-named function and custom children distinct.
  */
 function collectRoutedCustomToolWireNames(
   body: unknown,
   supportsResponsesCustomTools?: boolean,
+  passthrough = false,
 ): Set<string> {
   const names = new Set<string>();
   const groups = collectResponsesToolGroups(body);
@@ -64,7 +93,7 @@ function collectRoutedCustomToolWireNames(
       if (
         tool.type === "custom"
         && typeof tool.name === "string"
-        && !routedCustomToolPassesThrough(tool.name, supportsResponsesCustomTools)
+        && routedCustomToolPassesThrough(tool.name, supportsResponsesCustomTools) === passthrough
       ) {
         names.add(tool.name);
         continue;
@@ -77,7 +106,8 @@ function collectRoutedCustomToolWireNames(
           isPlainObject(child)
           && child.type === "custom"
           && typeof child.name === "string"
-          && !routedCustomToolPassesThrough(child.name, supportsResponsesCustomTools)
+          && routedCustomToolPassesThrough(child.name, supportsResponsesCustomTools) === passthrough
+          && (!passthrough || tool.name === BUILTIN_FUNCTIONS_NAMESPACE)
           && !(tool.name === BUILTIN_FUNCTIONS_NAMESPACE && bareWireNames.has(child.name))
         ) names.add(customToolWireName(tool.name, child.name));
       }
@@ -85,7 +115,6 @@ function collectRoutedCustomToolWireNames(
   }
   return names;
 }
-
 export function customToolItemId(id: unknown): unknown {
   if (typeof id !== "string") return id;
   return id.startsWith("fc_") ? `ctc_${id.slice(3)}` : id;
@@ -203,64 +232,129 @@ export function rewriteRoutedCustomToolsForUpstream(
 ): {
   body: unknown;
   names: Set<string>;
+  repairNames: Set<string>;
 } {
   const conversionNames = collectRoutedCustomToolNames(body, supportsResponsesCustomTools);
   const names = collectRoutedCustomToolWireNames(body, supportsResponsesCustomTools);
-  if (conversionNames.size === 0) return { body, names };
+  const repairNames = collectRoutedCustomToolWireNames(body, supportsResponsesCustomTools, true);
+  for (const name of repairNames) {
+    if (!toolChoiceAllowsRoutedCustomTool(body, name, repairNames)) repairNames.delete(name);
+  }
+  if (conversionNames.size === 0) return { body, names, repairNames };
   const callIds = new Set<string>();
   collectConvertedCallIds(body, conversionNames, callIds);
-  return { body: rewriteForUpstream(body, conversionNames, callIds), names };
+  return { body: rewriteForUpstream(body, conversionNames, callIds), names, repairNames };
 }
 
 export function restoreRoutedCustomCalls(
   value: unknown,
   names: ReadonlySet<string>,
+  repairNames: ReadonlySet<string> = new Set(),
 ): { value: unknown; changed: boolean } {
-  if (Array.isArray(value)) {
+  if (!isPlainObject(value)) return { value, changed: false };
+
+  const restoreItem = (item: unknown): { value: unknown; changed: boolean } => {
+    if (!isPlainObject(item)) return { value: item, changed: false };
+    const wireName = routedCustomToolWireName(item);
+    if (
+      item.type === "function_call"
+      && typeof item.name === "string"
+      && wireName !== undefined
+      && names.has(wireName)
+    ) {
+      const restored: Record<string, unknown> = {
+        ...item,
+        type: "custom_tool_call",
+        id: customToolItemId(item.id),
+        input: repairFreeformToolInput(
+          item.arguments,
+          item.name,
+          typeof item.namespace === "string" ? item.namespace : undefined,
+        ),
+      };
+      delete restored.arguments;
+      return { value: restored, changed: true };
+    }
+    if (
+      item.type === "custom_tool_call"
+      && typeof item.name === "string"
+      && wireName !== undefined
+      && repairNames.has(wireName)
+      && typeof item.input === "string"
+    ) {
+      const input = normalizeApplyPatchDelimiters(item.input);
+      if (input !== item.input) return { value: { ...item, input }, changed: true };
+    }
+    return { value: item, changed: false };
+  };
+
+  const restoreOutput = (output: unknown): { value: unknown; changed: boolean } => {
+    if (!Array.isArray(output)) return { value: output, changed: false };
     let changed = false;
-    const restored = value.map(entry => {
-      const result = restoreRoutedCustomCalls(entry, names);
+    const restored = output.map(item => {
+      const result = restoreItem(item);
       changed ||= result.changed;
       return result.value;
     });
-    return changed ? { value: restored, changed: true } : { value, changed: false };
-  }
-  if (!isPlainObject(value)) return { value, changed: false };
+    return changed ? { value: restored, changed: true } : { value: output, changed: false };
+  };
 
   let changed = false;
-  const restored: Record<string, unknown> = {};
-  for (const [key, entry] of Object.entries(value)) {
-    const result = restoreRoutedCustomCalls(entry, names);
-    restored[key] = result.value;
-    changed ||= result.changed;
+  const restored: Record<string, unknown> = { ...value };
+  const output = restoreOutput(value.output);
+  if (output.changed) {
+    restored.output = output.value;
+    changed = true;
   }
 
-  const wireName = routedCustomToolWireName(value);
-  if (value.type === "function_call" && wireName !== undefined && names.has(wireName)) {
-    restored.type = "custom_tool_call";
-    restored.id = customToolItemId(value.id);
-    restored.input = customToolInput(value.arguments);
-    delete restored.arguments;
-    changed = true;
+  if (
+    (value.type === "response.output_item.added" || value.type === "response.output_item.done")
+    && isPlainObject(value.item)
+  ) {
+    const item = restoreItem(value.item);
+    if (item.changed) {
+      restored.item = item.value;
+      changed = true;
+    }
+  }
+
+  if (
+    typeof value.type === "string"
+    && value.type.startsWith("response.")
+    && isPlainObject(value.response)
+  ) {
+    const response = restoreRoutedCustomCalls(value.response, names, repairNames);
+    if (response.changed) {
+      restored.response = response.value;
+      changed = true;
+    }
   }
+
   return changed ? { value: restored, changed: true } : { value, changed: false };
 }
 
 export function restoreRoutedCustomCallsInJson(
   text: string,
   names: ReadonlySet<string>,
+  repairNames: ReadonlySet<string> = new Set(),
 ): string {
-  if (names.size === 0) return text;
+  if (names.size === 0 && repairNames.size === 0) return text;
   let payload: unknown;
   try {
     payload = JSON.parse(text);
   } catch {
     return text;
   }
-  const restored = restoreRoutedCustomCalls(payload, names);
+  const restored = restoreRoutedCustomCalls(payload, names, repairNames);
   return restored.changed ? JSON.stringify(restored.value) : text;
 }
 
-export function unwrapRoutedCustomToolArguments(argumentsText: unknown): string {
-  return customToolInput(argumentsText);
+export function unwrapRoutedCustomToolArguments(
+  argumentsText: unknown,
+  toolName = "",
+  namespace?: string,
+): string {
+  return toolName
+    ? repairFreeformToolInput(argumentsText, toolName, namespace)
+    : unwrapFreeformToolInput(argumentsText);
 }

package/src/responses/google-provider-options.ts

@@ -0,0 +1,36 @@
+import { effectiveGoogleMode } from "../providers/registry";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+
+const AI_STUDIO_CACHED_CONTENT = /^cachedContents\/[^/?#\s]+$/;
+const VERTEX_CACHED_CONTENT = /^projects\/[^/?#\s]+\/locations\/[^/?#\s]+\/cachedContents\/[^/?#\s]+$/;
+
+export function googleProviderOptionsRouteError(
+  parsed: Pick<OcxParsedRequest, "options">,
+  route: {
+    providerName: string;
+    provider: OcxProviderConfig;
+    adapterName: string;
+  },
+): string | undefined {
+  if (!parsed.options.providerOptions?.google) return undefined;
+  const mode = effectiveGoogleMode(route.providerName, route.provider);
+  if (mode === "cloud-code-assist") {
+    return "provider_options.google is not supported on Google Cloud Code Assist routes";
+  }
+  if (route.adapterName !== "google" || (mode !== "ai-studio" && mode !== "vertex")) {
+    return "provider_options.google is supported only on Google AI Studio or Vertex routes";
+  }
+  if (mode === "ai-studio") {
+    const cachedContent = parsed.options.providerOptions.google.cachedContent;
+    if (cachedContent && VERTEX_CACHED_CONTENT.test(cachedContent)) {
+      return "provider_options.google.cached_content must use cachedContents/{id} on Google AI Studio routes";
+    }
+  }
+  if (mode === "vertex") {
+    const cachedContent = parsed.options.providerOptions.google.cachedContent;
+    if (cachedContent && AI_STUDIO_CACHED_CONTENT.test(cachedContent)) {
+      return "provider_options.google.cached_content must use projects/{project}/locations/{location}/cachedContents/{id} on Vertex routes";
+    }
+  }
+  return undefined;
+}

package/src/responses/namespace-tool-compat.ts

@@ -4,6 +4,14 @@ import { collectResponsesToolGroups } from "./tool-groups";
 export interface RoutedNamespaceToolIdentity {
   namespace: string;
   name: string;
+  /**
+   * The kind the tool was DECLARED as. Restoration and `tool_choice` matching both
+   * need it: a wire name identifies which tool, not which kind of call may carry it,
+   * so without this a tool declared `function` could be selected by a `custom`
+   * selector and come back as a `custom_tool_call` — the same name/kind mismatch
+   * that motivated narrowing the alias map in the first place.
+   */
+  kind: "function" | "custom";
 }
 
 export type RoutedNamespaceToolAliases = ReadonlyMap<string, RoutedNamespaceToolIdentity>;
@@ -138,7 +146,10 @@ function buildRewritePlan(groups: readonly unknown[][]): NamespaceRewritePlan {
         addSelector(selectors, `${parsed.namespace}.${childName}`, wireName);
         addSelector(selectors, childName, wireName);
         if (parsed.namespace !== BUILTIN_FUNCTIONS_NAMESPACE) {
-          aliases.set(wireName, { namespace: parsed.namespace, name: childName });
+          // A child declared `custom` stays custom; everything else lowers to a
+          // function, which is how `buildTools` flattens it upstream.
+          const kind = child.type === "custom" ? "custom" : "function";
+          aliases.set(wireName, { namespace: parsed.namespace, name: childName, kind });
         }
       }
     }
@@ -206,18 +217,34 @@ function rewriteToolList(
  * the failure this layer exists to prevent, and this layer's own response restoration is what put
  * the key on the item.
  */
+/**
+ * A selector's `namespace` is either absent — meaning "unqualified, resolve the bare
+ * name" — or a string naming the group. A present-but-non-string value is neither, and
+ * a malformed selector must not authorize anything: not through the unqualified
+ * fallback, and not by happening to carry an already-flattened wire name, which would
+ * otherwise match the alias map exactly and arm it anyway.
+ */
+function hasMalformedNamespace(value: Record<string, unknown>): boolean {
+  return "namespace" in value && typeof value.namespace !== "string";
+}
+
 function rewriteNamedSelector(
   value: unknown,
   plan: NamespaceRewritePlan,
   bareFallback: boolean,
 ): unknown {
   if (!isPlainObject(value) || typeof value.name !== "string") return value;
-  if (typeof value.namespace !== "string") {
+  // Malformed: hand it back untouched so no rewrite occurs. Authorization rejects it
+  // separately — returning it unchanged is not by itself enough, because the name it
+  // carries may already BE a wire name.
+  if (hasMalformedNamespace(value)) return value;
+  const namespace = value.namespace;
+  if (typeof namespace !== "string") {
     if (!bareFallback) return value;
     const wireName = plan.selectors.get(value.name) ?? undefined;
     return wireName === undefined || wireName === value.name ? value : { ...value, name: wireName };
   }
-  const { namespace, ...rest } = value;
+  const { namespace: _dropped, ...rest } = value;
   const wireName = plan.identities.get(loweredIdentity(namespace, value.name))
     ?? loweredWireName(namespace, value.name);
   return { ...rest, name: wireName };
@@ -239,6 +266,59 @@ function rewriteToolChoice(value: unknown, plan: NamespaceRewritePlan): unknown
   return changed ? { ...value, tools } : value;
 }
 
+/**
+ * Keep response restoration inside the caller's per-turn tool authorization boundary. The
+ * upstream sees every flattened declaration even when `tool_choice` narrows the tools it may call,
+ * so its output cannot be trusted merely because a wire name appeared in that catalog.
+ */
+function authorizedAliases(
+  aliases: Map<string, RoutedNamespaceToolIdentity>,
+  toolChoice: unknown,
+): Map<string, RoutedNamespaceToolIdentity> {
+  if (toolChoice === undefined || toolChoice === "auto" || toolChoice === "required") return aliases;
+  if (toolChoice === "none" || !isPlainObject(toolChoice)) return new Map();
+
+  // name -> the kind the selector claimed. A selector authorizes a tool only when it
+  // names it AND agrees about what kind of tool it is.
+  let authorized: Map<string, "function" | "custom">;
+  if (
+    (toolChoice.type === "function" || toolChoice.type === "custom")
+    && typeof toolChoice.name === "string"
+  ) {
+    // A malformed namespace makes the whole selector untrustworthy, even when its
+    // name is already a flattened wire name that would match the alias map exactly.
+    if (hasMalformedNamespace(toolChoice)) return new Map();
+    authorized = new Map([[toolChoice.name, toolChoice.type]]);
+  } else if (toolChoice.type === "allowed_tools" && Array.isArray(toolChoice.tools)) {
+    authorized = new Map();
+    for (const tool of toolChoice.tools) {
+      // Match the top-level branch above: only a function/custom selector can
+      // authorize a client namespace call. `allowed_tools` entries are typed
+      // `{type: string}` by the schema, so the accepted set is open-ended and
+      // an allowlist is the only closure that also covers kinds added later.
+      // Without this, `{type: "file_search", name: "<wire-name>"}` keeps the
+      // alias, and an upstream `function_call` carrying that name is restored
+      // into a namespace call the caller never permitted.
+      if (!isPlainObject(tool)) continue;
+      if (tool.type !== "function" && tool.type !== "custom") continue;
+      if (typeof tool.name !== "string") continue;
+      if (hasMalformedNamespace(tool)) continue;
+      authorized.set(tool.name, tool.type);
+    }
+  } else {
+    // An explicit selector for another tool kind does not authorize a client namespace call.
+    return new Map();
+  }
+
+  // The kind must agree too. A wire name says WHICH tool, not what kind of call may
+  // carry it, so a `custom` selector naming a tool declared `function` is the same
+  // name/kind mismatch as a `file_search` selector naming it — narrower, but the
+  // same class, and `allowed_tools[].type` accepts any string so both are reachable.
+  return new Map(
+    [...aliases].filter(([wireName, identity]) => authorized.get(wireName) === identity.kind),
+  );
+}
+
 function rewriteInputItem(item: unknown, plan: NamespaceRewritePlan, emitted: Set<string>): unknown {
   if (!isPlainObject(item)) return item;
   if (item.type === "additional_tools" && Array.isArray(item.tools)) {
@@ -292,7 +372,7 @@ export function rewriteRoutedNamespaceToolsForUpstream(body: unknown): {
       ...(input !== body.input ? { input } : {}),
       ...(toolChoice !== body.tool_choice ? { tool_choice: toolChoice } : {}),
     },
-    aliases: plan.aliases,
+    aliases: authorizedAliases(plan.aliases, toolChoice),
   };
 }