@yansigit/opencodex 2.31.3 → 2.33.0

package/src/adapters/google.ts

@@ -1,7 +1,8 @@
-import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
+import type { AdapterFetchContext, AdapterRequest, IncomingMeta, ProviderAdapter } from "./base";
 import { debugDroppedFrame } from "../lib/debug";
 import { createToolCallIdAllocator } from "./tool-call-id";
 import { createImageBudget, materializeInlineImage, MAX_ENCODED_BYTES_PER_IMAGE, artifactHttpUrl } from "../images/artifacts";
+import { OcxRequestValidationError } from "../lib/errors";
 import type {
   AdapterEvent,
   OcxAssistantMessage,
@@ -14,13 +15,14 @@ import type {
   OcxToolResultMessage,
   OcxUsage,
 } from "../types";
-import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolAllowedByChoice } from "../types";
+import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../types";
 import { contentPartsToText, parseDataUrl } from "./image";
 import { getVertexAccessToken } from "../lib/gcp-adc";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
 import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
-import { isVertexTruncatedTurn, vertexTruncationErrorMessage } from "./google-truncation";
-import { ANTIGRAVITY_REQUEST_UA, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
+import { sanitizeUpstreamErrorText } from "./upstream-http-error";
+import { googleTruncationErrorMessage, isVertexTruncatedTurn, vertexTruncationErrorMessage } from "./google-truncation";
+import { ANTIGRAVITY_REQUEST_UA, ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
 import { repairGoogleToolPairs, stripTrailingClaudePrefill } from "./google-antigravity-tools";
 import { canonicalAntigravityHttpsHost, isAntigravityHttpsHost } from "./google-antigravity-hosts";
 import { compileGoogleWireBody } from "./google-wire-compiler";
@@ -45,6 +47,16 @@ import {
 } from "../lib/translator-budget";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { configuredReasoningEfforts, mapReasoningEffort } from "../reasoning-effort";
+import { normalizeAntigravityProviderError } from "../oauth/antigravity-routing";
+
+const INLINE_ERROR_URL_USERINFO = /https?:\/\/[^\s"'<>]*@/gi;
+
+function safeAntigravityInlineErrorMessage(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  return sanitizeUpstreamErrorText(value)
+    .replace(INLINE_ERROR_URL_USERINFO, "[REDACTED_URL]")
+    .slice(0, 500);
+}
 
 // Google-family models (Gemini/Vertex/Antigravity) tend to emit long running commentary between
 // tool calls. This steers them to keep the BETWEEN-STEP text to one line and reason internally
@@ -139,6 +151,19 @@ const GEMINI_EMPTY_PLACEHOLDER = "(empty)";
 const GEMINI_EMPTY_TOOL_OUTPUT_PLACEHOLDER = "(empty tool output)";
 const GEMINI_MISSING_TOOL_RESULT = "[missing tool_result for this tool_use in history]";
 
+function appendGeminiContent(
+  contents: unknown[],
+  next: { role: string; parts: unknown[] },
+  mergeAdjacentUsers = true,
+): void {
+  const previous = contents.at(-1) as { role?: unknown; parts?: unknown[] } | undefined;
+  if (mergeAdjacentUsers && previous?.role === "user" && next.role === "user" && Array.isArray(previous.parts)) {
+    previous.parts.push(...next.parts);
+  } else {
+    contents.push(next);
+  }
+}
+
 /** A Gemini text part, or undefined when the value cannot form a valid non-empty text block. */
 function geminiTextPart(text: unknown): { text: string } | undefined {
   return typeof text === "string" && text.length > 0 ? { text } : undefined;
@@ -208,6 +233,11 @@ function messagesToGeminiFormat(
   const systemInstruction = { parts: [{ text: systemText }] };
 
   const contents: unknown[] = [];
+  let userMergeBarrier = false;
+  const appendContent = (next: { role: string; parts: unknown[] }): void => {
+    appendGeminiContent(contents, next, !userMergeBarrier);
+    userMergeBarrier = false;
+  };
   const messages = repairGoogleToolPairs(parsed.context.messages, { dropUnmatchedCalls: repairToolPairs });
 
   const callIds = createToolCallIdAllocator();
@@ -226,7 +256,7 @@ function messagesToGeminiFormat(
       case "user":
       case "developer": {
         if (typeof msg.content === "string") {
-          contents.push({ role: "user", parts: [{ text: msg.content || GEMINI_EMPTY_PLACEHOLDER }] });
+          appendContent({ role: "user", parts: [{ text: msg.content || GEMINI_EMPTY_PLACEHOLDER }] });
         } else {
           const parts: unknown[] = [];
           for (const p of msg.content as OcxContentPart[]) {
@@ -241,7 +271,7 @@ function messagesToGeminiFormat(
             const textPart = geminiTextPart(p.text);
             if (textPart) parts.push(textPart);
           }
-          contents.push({ role: "user", parts: parts.length > 0 ? parts : [{ text: GEMINI_EMPTY_PLACEHOLDER }] });
+          appendContent({ role: "user", parts: parts.length > 0 ? parts : [{ text: GEMINI_EMPTY_PLACEHOLDER }] });
         }
         break;
       }
@@ -291,8 +321,11 @@ function messagesToGeminiFormat(
         // A turn with nothing Gemini can represent (e.g. thinking-only) would serialize as
         // `parts: []`, which the Anthropic translation rejects. Skip it, as the Anthropic
         // adapter does for its own empty assistant content.
-        if (parts.length === 0) break;
-        contents.push({ role: "model", parts });
+        if (parts.length === 0) {
+          userMergeBarrier = true;
+          break;
+        }
+        appendContent({ role: "model", parts });
         if (toolCalls.length > 0) {
           // Gemini/Claude-on-Antigravity requires one adjacent response batch for the whole
           // function-call turn. Replayed histories can be interrupted, reversed, duplicated, or
@@ -321,7 +354,7 @@ function messagesToGeminiFormat(
           for (const orphan of orphanResults) {
             responseParts.push(...geminiOrphanToolResultParts(orphan));
           }
-          contents.push({ role: "user", parts: responseParts });
+          appendContent({ role: "user", parts: responseParts });
           i = j - 1;
         }
         break;
@@ -332,7 +365,7 @@ function messagesToGeminiFormat(
         // batch never reach here (the assistant branch consumes them). Standalone or
         // barrier-delayed results still have to stay visible — especially image-bearing
         // screenshots — as explicit user text rather than vanishing or 400ing CCA.
-        contents.push({ role: "user", parts: geminiOrphanToolResultParts(msg as OcxToolResultMessage) });
+        appendContent({ role: "user", parts: geminiOrphanToolResultParts(msg as OcxToolResultMessage) });
         break;
       }
     }
@@ -346,11 +379,8 @@ function toolsToGeminiFormat(
   wireModelId: string,
 ): unknown[] | undefined {
   const grounding = parsed._ccaInTurnGrounding;
-  const allowed = isAllowedToolChoice(parsed.options.toolChoice)
-    ? new Set(parsed.options.toolChoice.allowedTools)
-    : undefined;
-  const tools = allowed
-    ? parsed.context.tools?.filter(t => toolAllowedByChoice(t, allowed, parsed.context.tools)) ?? []
+  const tools = isAllowedToolChoice(parsed.options.toolChoice)
+    ? parsed.context.tools?.filter(toolChoiceToolPredicate(parsed.options.toolChoice, parsed.context.tools)) ?? []
     : parsed.context.tools ?? [];
   const functionDeclarations = tools.map(t => ({
     name: namespacedToolName(t.namespace, t.name),
@@ -398,6 +428,13 @@ function usageFromGemini(usage: Record<string, number> | undefined): OcxUsage |
   };
 }
 
+function googlePromptFeedbackError(root: Record<string, unknown>): Extract<AdapterEvent, { type: "error" }> | undefined {
+  const feedback = root.promptFeedback;
+  if (!isGoogleRecord(feedback) || typeof feedback.blockReason !== "string" || !feedback.blockReason.trim()) return undefined;
+  const reason = sanitizeUpstreamErrorText(feedback.blockReason).slice(0, 160);
+  return { type: "error", message: `google response blocked by prompt feedback: ${reason}` };
+}
+
 /**
  * Cap on the buffered non-streaming response body (100 MiB), matching
  * IMAGES_RESPONSE_MAX_BYTES in src/server/images.ts. Enforced by streaming the
@@ -675,6 +712,7 @@ function invalidGoogleShapeEvent(
 export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapter {
   // Per-request closure: resolveAdapter builds a fresh adapter per request (server.ts), so buildRequest
   // can stash the CCA model/session for parseStream's reasoning-replay observation.
+  let observeProviderError: IncomingMeta["onProviderError"];
   let antigravityModel: string | undefined;
   let antigravitySession: string | undefined;
   // Vertex returns the same opaque Gemini thought signatures as CCA, but its replay namespace
@@ -684,8 +722,23 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
   let vertexReplaySession: string | undefined;
   let restoreGoogleToolName = (name: string): string => name;
   const emitInTurnGroundingSourcesQueue: boolean[] = [];
+  const truncationErrorMessage = provider.googleMode === "vertex" || provider.googleMode === "cloud-code-assist"
+    ? vertexTruncationErrorMessage
+    : googleTruncationErrorMessage;
   return {
     name: "google",
+    validateRequest(parsed: OcxParsedRequest) {
+      if (provider.googleMode === "cloud-code-assist" && parsed.options.providerOptions?.google) {
+        throw new OcxRequestValidationError("provider_options.google is not supported on Google Cloud Code Assist routes");
+      }
+      const googleOptions = parsed.options.providerOptions?.google;
+      if (isImageCapableModel(parsed.modelId)
+        && (googleOptions?.thinkingBudget !== undefined || googleOptions?.includeThoughts !== undefined)) {
+        throw new OcxRequestValidationError(
+          "provider_options.google thinking_budget and include_thoughts are not supported for image-capable Gemini models",
+        );
+      }
+    },
 
     // Vertex + Antigravity get Kiro-style retry/timeout + classified, redacted errors.
     // Direct AI-Studio uses the canonical server transport (fetchWithTransientRetry), which
@@ -700,7 +753,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         }
       : {}),
 
-    async buildRequest(parsed: OcxParsedRequest) {
+    async buildRequest(parsed: OcxParsedRequest, options?: IncomingMeta) {
+      observeProviderError = options?.onProviderError;
       const routedModelId = provider.googleMode === "cloud-code-assist"
         ? resolveAntigravityEffortWireModel(
             parsed.modelId,
@@ -726,6 +780,9 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       // catalog is a guaranteed upstream 400.
       const toolConfig = tools ? toolChoiceToGeminiToolConfig(parsed) : undefined;
       if (toolConfig) body.toolConfig = toolConfig;
+      const googleOptions = parsed.options.providerOptions?.google;
+      if (googleOptions?.safetySettings) body.safetySettings = googleOptions.safetySettings;
+      if (googleOptions?.cachedContent) body.cachedContent = googleOptions.cachedContent;
 
       const generationConfig: Record<string, unknown> = {};
       if (parsed.options.maxOutputTokens) generationConfig.maxOutputTokens = parsed.options.maxOutputTokens;
@@ -747,7 +804,13 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       const thinkingLevel = thinkingEligible
         ? mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning)
         : undefined;
-      if (thinkingLevel) generationConfig.thinkingConfig = { thinkingLevel };
+      if (!isImageCapableModel(parsed.modelId)) {
+        const thinkingConfig: Record<string, unknown> = {};
+        if (googleOptions?.thinkingBudget !== undefined) thinkingConfig.thinkingBudget = googleOptions.thinkingBudget;
+        else if (thinkingLevel) thinkingConfig.thinkingLevel = thinkingLevel;
+        if (googleOptions?.includeThoughts !== undefined) thinkingConfig.includeThoughts = googleOptions.includeThoughts;
+        if (Object.keys(thinkingConfig).length > 0) generationConfig.thinkingConfig = thinkingConfig;
+      }
       if (!generationConfig.thinkingConfig && isImageCapableModel(parsed.modelId)) {
         generationConfig.responseModalities = ["TEXT", "IMAGE"];
       }
@@ -819,6 +882,19 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           const strippedModelTail = /claude/i.test(wireModelId) ? stripTrailingClaudePrefill(contents) : false;
           if (antigravityUsesReplayCache(wireModelId)) {
             applyAntigravityReplay(wireModelId, sessionId, contents);
+            // If any functionCall still lacks a thoughtSignature on Gemini Antigravity,
+            // supply the bypass sentinel so Antigravity does not reject the turn with HTTP 400.
+            for (const c of contents as { role?: string; parts?: unknown[] }[]) {
+              if (c?.role !== "model" || !Array.isArray(c.parts)) continue;
+              for (const p of c.parts) {
+                if (p && typeof p === "object") {
+                  const partObj = p as Record<string, unknown>;
+                  if (partObj.functionCall && !partObj.thoughtSignature && !partObj.thought_signature) {
+                    partObj.thoughtSignature = ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL;
+                  }
+                }
+              }
+            }
           } else {
             sanitizeAntigravityClaudeSignatures(contents);
           }
@@ -973,17 +1049,31 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
 
         // Inline provider error inside a 200 stream → terminal error (see openai-chat.ts).
         if (chunk.error) {
-          const err = chunk.error as { message?: string } | undefined;
+          const rawError = chunk.error as { code?: unknown; status?: unknown; message?: unknown };
+          const safeMessage = safeAntigravityInlineErrorMessage(rawError.message);
+          const error = normalizeAntigravityProviderError({
+            code: rawError.code,
+            status: rawError.status,
+            message: safeMessage,
+          });
+          if (provider.googleMode === "cloud-code-assist" && error) observeProviderError?.(error);
+          const err = { ...(error ?? {}), message: error?.message ?? safeMessage ?? "upstream error" };
           // Clear-on-invalid: a signature rejection means our replayed thoughtSignatures are stale.
           // Drop the cache entry so the next turn starts clean instead of re-injecting a bad sig.
           const replayModel = provider.googleMode === "cloud-code-assist" ? antigravityModel : vertexReplayModel;
           const replaySession = provider.googleMode === "cloud-code-assist" ? antigravitySession : vertexReplaySession;
           if ((provider.googleMode === "cloud-code-assist" || provider.googleMode === "vertex")
             && replayModel && replaySession
+            && !/missing.*thought_signature/i.test(err?.message ?? "")
             && /signature|invalid_argument|invalid argument/i.test(err?.message ?? "")) {
             clearAntigravityReplay(replayModel, replaySession);
           }
-          yield { type: "error", message: err?.message ?? "upstream error" };
+          yield {
+            type: "error",
+            ...(error?.status !== undefined ? { status: error.status } : {}),
+            ...(error?.code ? { code: error.code } : {}),
+            message: err.message ?? "upstream error",
+          };
           return "terminate";
         }
 
@@ -1013,7 +1103,14 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         // absent key and an empty array are already skipped here; `null` joins them. A non-null
         // non-array container is still claimed structure the parser cannot read, and stays
         // terminal.
-        if (rawCandidates === undefined || rawCandidates === null) return "continue";
+        if (rawCandidates === undefined || rawCandidates === null) {
+          const feedbackError = googlePromptFeedbackError(root);
+          if (feedbackError) {
+            yield feedbackError;
+            return "terminate";
+          }
+          return "continue";
+        }
         if (!Array.isArray(rawCandidates)) {
           yield invalidGoogleShapeEvent({
             reason: "candidates_not_array",
@@ -1021,7 +1118,14 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           });
           return "terminate";
         }
-        if (rawCandidates.length === 0) return "continue";
+        if (rawCandidates.length === 0) {
+          const feedbackError = googlePromptFeedbackError(root);
+          if (feedbackError) {
+            yield feedbackError;
+            return "terminate";
+          }
+          return "continue";
+        }
         const rawCandidate = rawCandidates[0];
         if (!isGoogleRecord(rawCandidate)) {
           // Unlike a root `data: null` keepalive, this is a claimed response candidate. Treat it
@@ -1077,7 +1181,9 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         const replaySession = provider.googleMode === "cloud-code-assist" ? antigravitySession : vertexReplaySession;
         if ((provider.googleMode === "cloud-code-assist" || provider.googleMode === "vertex")
           && parts && replayModel && replaySession) {
-          pendingStreamThoughtSig = observeAntigravityReplay(
+          // Observation may scan the whole frame, so use it only for replay-cache side effects.
+          // The source-order loop below exclusively owns stream carry and cannot pair backwards.
+          observeAntigravityReplay(
             replayModel,
             replaySession,
             parts as unknown[],
@@ -1087,7 +1193,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         if (parts) {
           for (const part of parts) {
             const sig = googlePartThoughtSignature(part);
-            if (part.thought === true && sig && isLikelyRealThoughtSignature(sig)) {
+            if (sig && isLikelyRealThoughtSignature(sig) && (part.thought === true || !part.functionCall)) {
               pendingStreamThoughtSig = sig;
             }
             const textEvent = googlePartTextEvent(part, filterCcaSearchSuggestionHtml);
@@ -1192,9 +1298,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         }
         // Fail-closed: a turn cut off mid tool call (MAX_TOKENS / MALFORMED_FUNCTION_CALL) surfaces
         // an error instead of a silently-incomplete done. Mirrors kiro-truncation.
-        if ((provider.googleMode === "vertex" || provider.googleMode === "cloud-code-assist")
-          && isVertexTruncatedTurn(lastFinishReason, toolCallsStarted)) {
-          yield { type: "error", message: vertexTruncationErrorMessage(lastFinishReason) };
+        if (isVertexTruncatedTurn(lastFinishReason, toolCallsStarted)) {
+          yield { type: "error", message: truncationErrorMessage(lastFinishReason) };
           return;
         }
         if (!sawAnyFrame || !sawTerminalSignal) {
@@ -1238,7 +1343,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       // Cloud Code Assist exposes only the SSE transport. Unary callers still use this
       // buffered adapter entry point, so collect the exact same events parseStream emits
       // instead of maintaining a second CCA JSON parser.
-      if (provider.googleMode === "cloud-code-assist") {
+      const isSse = response.headers.get("content-type")?.includes("text/event-stream") ?? false;
+      if (provider.googleMode === "cloud-code-assist" && isSse) {
         const events: AdapterEvent[] = [];
         let previousTail: AdapterEvent | undefined;
         try {
@@ -1327,10 +1433,24 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         return events;
       };
       if (raw.error) {
-        const err = raw.error as { message?: string };
-        return finish([{ type: "error", message: err.message ?? "upstream error" }]);
+        const rawError = raw.error as { code?: unknown; status?: unknown; message?: unknown };
+        const safeMessage = safeAntigravityInlineErrorMessage(rawError.message);
+        const error = normalizeAntigravityProviderError({
+          code: rawError.code,
+          status: rawError.status,
+          message: safeMessage,
+        });
+        if (error) observeProviderError?.(error);
+        return finish([{
+          type: "error",
+          ...(error?.status !== undefined ? { status: error.status } : {}),
+          ...(error?.code ? { code: error.code } : {}),
+          message: error?.message ?? safeMessage ?? "upstream error",
+        }]);
       }
-      const json = raw;
+      const json = (provider.googleMode === "cloud-code-assist" && raw.response && typeof raw.response === "object" && !Array.isArray(raw.response))
+        ? (raw.response as Record<string, unknown>)
+        : raw;
       const events: AdapterEvent[] = [];
 
       const rawCandidates: unknown = json.candidates;
@@ -1346,6 +1466,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       }
       const candidates = rawCandidates as { finishReason?: string }[] | undefined;
       if (!candidates?.length) {
+        const feedbackError = googlePromptFeedbackError(json);
+        if (feedbackError) return finish([feedbackError]);
         return finish([{ type: "error", message: "google response contained no candidates" }]);
       }
       const rawCandidate: unknown = candidates[0];
@@ -1418,9 +1540,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
 
       // Fail-closed truncation, same as the stream path: a non-stream turn cut off mid tool call
       // (MAX_TOKENS / MALFORMED_FUNCTION_CALL) surfaces an error instead of a silent done.
-      if (provider.googleMode === "vertex"
-        && isVertexTruncatedTurn(candidate.finishReason, toolCallsStarted)) {
-        return finish([{ type: "error", message: vertexTruncationErrorMessage(candidate.finishReason) }]);
+      if (isVertexTruncatedTurn(candidate.finishReason, toolCallsStarted)) {
+        return finish([{ type: "error", message: truncationErrorMessage(candidate.finishReason) }]);
       }
 
       const usage = json.usageMetadata as Record<string, number> | undefined;

package/src/adapters/kiro-tools.ts

@@ -172,6 +172,12 @@ function omittedToolCatalogNotice(kept: number, omitted: readonly OcxTool[], reg
   return `[opencodex] Kiro's outbound catalog budget allows ${kept} of ${kept + omitted.length} client tools this turn. Omitted and unavailable this turn: ${summary}.`;
 }
 
+function boundedCatalogPriority(tool: OcxTool): number {
+  if (tool.loadedFromToolSearch) return 0;
+  if (tool.toolSearch) return 1;
+  return 2;
+}
+
 export function convertKiroToolContext(
   parsed: OcxParsedRequest,
   registry: KiroToolNameRegistry = createKiroToolNameRegistry(),
@@ -181,9 +187,7 @@ export function convertKiroToolContext(
   // Validate every listed name even when tool_choice:none emulates a tool-free turn.
   for (const tool of tools) registry.alias(namespacedToolName(tool.namespace, tool.name));
   const effectiveTools = parsed.options.toolChoice === "none" ? [] : tools;
-  const convertedTools: unknown[] = [];
-  let omittedAt = effectiveTools.length;
-  for (const [index, tool] of effectiveTools.entries()) {
+  const convertedEntries = effectiveTools.map((tool, index) => {
     const description = tool.description || `Tool: ${tool.name}`;
     // Send the full namespaced wire name (e.g. mcp__chrome-devtools__navigate_page) so Kiro echoes
     // it back; the bridge's toolNsMap is keyed by this name and restores the MCP namespace Codex
@@ -198,19 +202,26 @@ export function convertKiroToolContext(
         inputSchema: { json: ensureRootObjectType(sanitizeKiroSchema(tool.parameters ?? {})) },
       },
     };
-    // Preserve declaration order and only omit a suffix. Ranking tools would make a catalog change
-    // silently alter which capability disappears; this deterministic policy is paired with a
-    // model-visible omission notice so unavailable tools are explicit rather than assumed absent.
+    return { tool, index, converted };
+  });
+  const exceedsBudget = convertedEntries.length > MAX_KIRO_TOOL_COUNT
+    || serializedToolCatalogBytes(convertedEntries.map(entry => entry.converted)) > MAX_KIRO_TOOL_CATALOG_BYTES;
+  const candidates = exceedsBudget
+    ? convertedEntries.toSorted((a, b) => boundedCatalogPriority(a.tool) - boundedCatalogPriority(b.tool) || a.index - b.index)
+    : convertedEntries;
+  const convertedTools: unknown[] = [];
+  let omittedAt = candidates.length;
+  for (const [index, entry] of candidates.entries()) {
     if (
       convertedTools.length >= MAX_KIRO_TOOL_COUNT
-      || serializedToolCatalogBytes([...convertedTools, converted]) > MAX_KIRO_TOOL_CATALOG_BYTES
+      || serializedToolCatalogBytes([...convertedTools, entry.converted]) > MAX_KIRO_TOOL_CATALOG_BYTES
     ) {
       omittedAt = index;
       break;
     }
-    convertedTools.push(converted);
+    convertedTools.push(entry.converted);
   }
-  const omittedTools = effectiveTools.slice(omittedAt);
+  const omittedTools = candidates.slice(omittedAt).map(entry => entry.tool);
   return {
     tools: convertedTools,
     systemAdditions: omittedTools.length > 0 ? [omittedToolCatalogNotice(convertedTools.length, omittedTools, registry)] : [],

package/src/adapters/kiro.ts

@@ -318,9 +318,6 @@ function validateKiroCapabilities(parsed: OcxParsedRequest): void {
   if (choice !== undefined && choice !== "auto" && choice !== "none") {
     throw new Error("Kiro supports only automatic tool choice or tool_choice:none");
   }
-  if (parsed.options.parallelToolCalls === true) {
-    throw new Error("Kiro does not support parallel tool calls");
-  }
   if (parsed.options.serviceTier !== undefined) {
     throw new Error("Kiro does not support service tiers");
   }

package/src/adapters/openai-chat.ts

@@ -1244,6 +1244,15 @@ function toolsToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderConfig
       },
     }];
   });
+  if (xaiTarget) {
+    const omitted = tools.length - formatted.length;
+    debugProviderDiagnostic("openai-chat", "tool-catalog", {
+      declared: tools.length,
+      emitted: formatted.length,
+      omitted,
+      ...(omitted > 0 ? { omissionCause: "xai_schema_not_lossless" } : {}),
+    });
+  }
   return formatted.length > 0 ? formatted : undefined;
 }
 

package/src/adapters/openai-responses.ts

@@ -1684,8 +1684,9 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
 
       const forward = provider.authMode === "forward";
       let convertedRoutedCustomToolNames: Set<string> | undefined;
+      let routedCustomToolRepairNames: Set<string> | undefined;
       let convertedRoutedToolSearchNames: Set<string> | undefined;
-      let convertedRoutedNamespaceToolAliases: Map<string, { namespace: string; name: string }> | undefined;
+      let convertedRoutedNamespaceToolAliases: Map<string, { namespace: string; name: string; kind: "function" | "custom" }> | undefined;
       const unexpandedMiss = !!parsed.previousResponseId && parsed._previousResponseInputExpanded !== true;
       let outBody = stripPreviousResponseId(
         parsed._rawBody,
@@ -1741,6 +1742,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         );
         outBody = rewritten.body;
         convertedRoutedCustomToolNames = rewritten.names;
+        routedCustomToolRepairNames = rewritten.repairNames;
       }
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         // Run after custom-tool lowering so the search compatibility layer can choose a
@@ -1811,6 +1813,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         body,
         releaseBodyObservation,
         ...(convertedRoutedCustomToolNames ? { convertedRoutedCustomToolNames } : {}),
+        ...(routedCustomToolRepairNames ? { routedCustomToolRepairNames } : {}),
         ...(convertedRoutedToolSearchNames ? { convertedRoutedToolSearchNames } : {}),
         ...(convertedRoutedNamespaceToolAliases ? { convertedRoutedNamespaceToolAliases } : {}),
         ...(tierLog ? { tierLog } : {}),

package/src/adapters/tool-catalog-nudge.ts

@@ -120,7 +120,7 @@ export function buildNonOpenAIToolCatalogNudgeFromNames(
     "Call only listed names with their listed argument keys; do not invent, translate, or rename tools.",
     "Names mentioned only in instructions, tool descriptions, argument descriptions, or nested helper APIs are not additional top-level tools.",
     verifiedCodeModeExecName
-      ? "`" + verifiedCodeModeExecName + "` is Codex code mode: its body is JavaScript evaluated in a V8 isolate. Nested helpers are called INSIDE that body as `await tools.<name>(...)`, for example `await tools.exec_command({cmd: \"ls\"})` or `await tools.codex_app__list_threads({})`. Absence from the top-level catalog or from `" + verifiedCodeModeExecName + "`'s description is not absence: deferred helpers stay callable on `tools.<name>`. Discover them from the isolate global `ALL_TOOLS`, not `tools.ALL_TOOLS`. Do not skip an available nested helper because it is omitted from the listed top-level names."
+      ? "`" + verifiedCodeModeExecName + "` is Codex code mode: its body is JavaScript evaluated in a V8 isolate. Nested helpers are called INSIDE that body as `await tools.<name>(...)`, for example `await tools.exec_command({cmd: \"ls\"})` or `await tools.codex_app__list_threads({})`. Absence from the top-level catalog or from `" + verifiedCodeModeExecName + "`'s description is not absence: deferred helpers stay callable on `tools.<name>`. Discover them from the isolate global `ALL_TOOLS`, not `tools.ALL_TOOLS`. Do not skip an available nested helper because it is omitted from the listed top-level names. Nested `tools.apply_patch(input)` is host-executed: the string must begin exactly with `*** Begin Patch` and end with `*** End Patch` (no trailing `***` on those lines). OpenCodex does not rewrite JavaScript inside exec, so a decorated `*** Begin Patch ***` envelope is rejected by Codex before the file is touched."
       : "If a listed tool exposes nested helpers such as a tools.* API, call the listed parent tool and use those helpers only inside that tool's input.",
     unavailableNeighborNames.length > 0
       ? "Do not use neighboring-agent tool names " + quoteNames(unavailableNeighborNames) + " unless this turn's catalog lists those exact names."

package/src/adapters/xai-web-search.ts

@@ -60,10 +60,15 @@ function normalizeToolGroup(tools: unknown[]): ToolGroupRewrite {
       : undefined;
     const enableImageSearch = searchContentTypes?.includes("image") === true;
     const next: Record<string, unknown> = { ...tool, type: CODEX_WEB_SEARCH_TOOL };
+    // Only the two fields xAI actually refuses are removed. Probed 2026-08-22, one field per
+    // request, against BOTH xAI destinations (api.x.ai and cli-chat-proxy.grok.com): they behave
+    // identically — `external_web_access` 400s on every value including `true`, and
+    // `search_context_size` 400s, while `user_location`, `search_content_types`, `filters` and
+    // `enable_image_search` are all accepted. Deleting the accepted ones was a silent capability
+    // loss, and it contradicted the sibling layer, whose own probe note already records
+    // user_location/filters as accepted (tests/responses-routed-web-search-fields.test.ts).
     delete next.external_web_access;
     delete next.search_context_size;
-    delete next.search_content_types;
-    delete next.user_location;
     if (enableImageSearch && !Object.hasOwn(next, "enable_image_search")) {
       next.enable_image_search = true;
     }