cartethyia 2.5.3 → 2.5.6

package/src/protocol/codecs.ts

@@ -3,8 +3,7 @@
  * `src/protocol/`. This is the single home for the generic guards, UTF-16
  * well-formedness coercion, JSON/argument helpers, hash helpers, endpoint
  * URL construction, image-source resolution, and custom-header validation
- * that the per-wire request/response codecs build on — previously duplicated
- * across the Claude/Codex protocol modules and `providers/compatible-adapter`.
+ * that the per-wire request/response codecs build on.
  *
  * Provider-specific primitives that depend on provider identity (e.g. Codex
  * identity headers) deliberately live with their provider, not here.
@@ -273,6 +272,46 @@ const SUPPORTED_SCHEMA_KEYS: Readonly<Record<string, true>> = Object.freeze({
   maxProperties: true,
 });
 
+/**
+ * True when a schema string carries a backslash before an underscore.
+ *
+ * Some clients emit a property or pattern key containing a literal `\_` (an
+ * escaped underscore). Upstreams reject it, so the escape has to be stripped —
+ * and stripping it can collapse two previously distinct keys onto the same
+ * name, which is why {@link mergeCollidingKeys} exists below.
+ */
+function hasUnderscoreEscape(value: string): boolean {
+  return /\\+_/.test(value);
+}
+
+/**
+ * Merges map entries whose normalized keys collide, rather than overwriting.
+ *
+ * `allOf` accepts boolean schemas, so neither constraint is lost — a plain
+ * overwrite would silently drop one of two rules the caller actually sent.
+ */
+function mergeCollidingKeys(entries: ReadonlyArray<readonly [string, unknown]>): Record<string, unknown> {
+  const merged: Record<string, unknown> = {};
+  for (const [key, value] of entries) {
+    const existing = merged[key];
+    if (existing === undefined) {
+      merged[key] = value;
+      continue;
+    }
+    merged[key] = { allOf: [existing, value] };
+  }
+  return merged;
+}
+
+/** One schema map's keys, with `\_` escapes stripped and collisions merged. */
+function normalizeSchemaMapKeys(map: Record<string, unknown>): Record<string, unknown> {
+  const entries = Object.entries(map);
+  if (!entries.some(([key]) => hasUnderscoreEscape(key))) return map;
+  return mergeCollidingKeys(
+    entries.map(([key, value]) => [key.replace(/\\+_/g, "_"), value] as const),
+  );
+}
+
 export function sanitizeSchemaForAnthropic(value: unknown): unknown {
   return sanitizeSchemaWalk(value, ROOT_WALK);
 }
@@ -292,10 +331,21 @@ function sanitizeSchemaWalk(value: unknown, walk: RewriteWalk): unknown {
     // preserve them while sanitizing each property's schema recursively.
     if (key === "properties" && isRecord(child)) {
       out.properties = Object.fromEntries(
-        Object.entries(child).map(([name, schema]) => [name, sanitizeSchemaWalk(schema, inner)]),
+        // Escaped-underscore keys are normalized first: two names differing only
+        // by an escape would otherwise survive as two properties and be rebuilt
+        // into a `required` list the upstream rejects.
+        Object.entries(normalizeSchemaMapKeys(child)).map(([name, schema]) => [
+          name,
+          sanitizeSchemaWalk(schema, inner),
+        ]),
       );
       continue;
     }
+    // `patternProperties` is deliberately NOT re-emitted: it is absent from
+    // `SUPPORTED_SCHEMA_KEYS` because the Anthropic wire does not accept it, and
+    // writing it here would be undone by the keyword filter a few lines down
+    // anyway. Its keys are still walked below, so nested schemas are sanitized
+    // and an escaped-underscore key inside one is still normalized.
     // Drop wire-unsupported keywords so a strict upstream never 400s on
     // them — but never invent caller text to say so. The dropped names are
     // debug-logged by the caller-facing builder when that matters.
@@ -485,13 +535,12 @@ export function endpointUrl(
   return url;
 }
 
-/** Session-scoped state (turn-state / models-etag / session identity). */
+/** Session-scoped state (turn-state / session identity). */
 export interface CodexSessionState {
   sessionId: string;
   threadId: string;
   windowId: string;
   turnState?: string;
-  modelsEtag?: string;
   turnStartedAtUnixMs?: number;
 }
 
@@ -677,12 +726,96 @@ export function canonicalTerminal(input: {
   };
 }
 
+/**
+ * JSON Schema keywords. A parameter root containing any of these is already a
+ * schema object, not a legacy property-name → schema map.
+ */
+const SCHEMA_KEYWORDS: ReadonlySet<string> = new Set([
+  "$schema", "$id", "$ref", "$anchor", "$dynamicRef", "$dynamicAnchor", "$defs",
+  "$vocabulary", "$comment", "definitions", "type", "properties", "patternProperties",
+  "additionalProperties", "unevaluatedProperties", "propertyNames", "required",
+  "dependentRequired", "dependentSchemas", "dependencies", "minProperties", "maxProperties",
+  "allOf", "anyOf", "oneOf", "not", "if", "then", "else", "items", "prefixItems",
+  "additionalItems", "contains", "unevaluatedItems", "minItems", "maxItems", "uniqueItems",
+  "minContains", "maxContains", "minimum", "maximum", "exclusiveMinimum", "exclusiveMaximum",
+  "multipleOf", "minLength", "maxLength", "pattern", "format", "contentEncoding",
+  "contentMediaType", "contentSchema", "enum", "const", "title", "description", "default",
+  "examples", "deprecated", "readOnly", "writeOnly",
+]);
+
+/** The JSON Schema primitive type names. */
+const SCHEMA_TYPES: ReadonlySet<string> = new Set([
+  "string", "number", "integer", "boolean", "object", "array", "null",
+]);
+
+/**
+ * Rewrites one legacy tool parameter root into an explicit object schema.
+ *
+ * Two shapes reach here and are both rejected upstream as-is:
+ *
+ * - **An empty root.** `{}` carries no `type`, and a schema with no type is not
+ *   a schema the upstream will accept — it answers `invalid_function_parameters`
+ *   (CodeBuddy `11129`).
+ * - **A legacy property-name → schema map.** Every field names a parameter and
+ *   carries its own boolean `required` flag, with no `{"type":"object",
+ *   "properties":…}` wrapper around them. Old clients in the wild still emit
+ *   this; the upstream wants the wrapper and the `required` array.
+ *
+ * Anything ambiguous is returned **untouched**. A root that already holds schema
+ * keywords, or one whose fields do not all look like `{type: <primitive>}`
+ * entries, is left alone: guessing there would rewrite a valid schema into a
+ * wrong one, which is worse than the refusal it was trying to avoid.
+ */
+export function normalizeToolParameterRoot(value: unknown): unknown {
+  if (!isRecord(value)) return value;
+  if (Object.keys(value).length === 0) return { type: "object", properties: {} };
+  // Schema keywords (or an extension/annotation key) mean this is a real
+  // schema object already, not a property map.
+  if (SCHEMA_KEYWORDS.has(Object.keys(value)[0] ?? "")) return value;
+  if (Object.keys(value).some((name) => SCHEMA_KEYWORDS.has(name))) return value;
+  if (Object.keys(value).some((name) => name.startsWith("$") || name.startsWith("x-")))
+    return value;
+  const entries = Object.entries(value);
+  // A legacy map is identified by its per-field boolean `required`. Without at
+  // least one, this is not recognisably the legacy shape.
+  if (!entries.some(([, field]) => isRecord(field) && typeof field["required"] === "boolean"))
+    return value;
+  if (
+    !entries.every(
+      ([, field]) =>
+        isRecord(field) &&
+        typeof field["type"] === "string" &&
+        SCHEMA_TYPES.has(field["type"]) &&
+        (!("required" in field) || typeof field["required"] === "boolean"),
+    )
+  )
+    return value;
+
+  const properties: Record<string, unknown> = {};
+  const required: string[] = [];
+  for (const [name, field] of entries) {
+    const copy = { ...(field as Record<string, unknown>) };
+    if (copy["required"] === true) required.push(name);
+    delete copy["required"];
+    properties[name] = copy;
+  }
+  return {
+    type: "object",
+    properties,
+    ...(required.length > 0 ? { required } : {}),
+  };
+}
+
 /**
  * Defaults a tool schema's `required` list to all declared properties while
  * preserving an explicit list, including optional properties.
+ *
+ * Also normalizes a legacy parameter root first (see
+ * {@link normalizeToolParameterRoot}), so a caller sending an empty root or a
+ * property-name → schema map still ships a schema the upstream accepts.
  */
 export function completeRequiredSchema(value: unknown): unknown {
-  return completeRequiredWalk(value, ROOT_WALK);
+  return completeRequiredWalk(normalizeToolParameterRoot(value), ROOT_WALK);
 }
 
 function completeRequiredWalk(value: unknown, walk: RewriteWalk): unknown {

package/src/protocol/gateway-error.ts

@@ -12,6 +12,8 @@ export type GatewayErrorCode =
   | "accounts_unavailable"
   | "accounts_rate_limited"
   | "capacity_exhausted"
+  | "provider_capacity_exhausted"
+  | "upstream_queued"
   | "proxy_pool_capacity_exceeded"
   | "proxy_pool_provider_capacity_exceeded"
   | "proxy_pool_blocked"
@@ -110,11 +112,11 @@ function stripLegacyOriginLabel(message: string): string {
  * stamped into it.
  *
  * The code is not lost — it travels in the envelope's `error.code` field, and
- * the HTTP status carries the class. It used to be prefixed into the text
+ * the HTTP status carries the class. Stamping it into the text
  * (`accounts_unavailable: Model 'x' has no available account (52 candidate(s)
- * unusable: credit_floor_reached, model_cooldown)`), which put internal enum
- * names in front of the operator's sentence and made the message unreadable
- * while adding nothing the field did not already carry.
+ * unusable: credit_floor_reached, model_cooldown)`) would put internal enum
+ * names in front of the operator's sentence and make the message unreadable
+ * while adding nothing the field does not already carry.
  *
  * Stripping is idempotent, and that is the point: a message that already
  * carries a `code:` prefix — stamped by an older builder, or by a code path

package/src/protocol/image-clamp.ts

@@ -56,6 +56,17 @@ export interface ImageClampInput {
   readonly height?: number;
   /** Images in the whole request, including this one. Defaults to this one alone. */
   readonly imageCount?: number;
+  /**
+   * Per-tenant byte ceiling override, in bytes.
+   *
+   * Absent means the deployment default (`IMAGE_CLAMP_MAX_BYTES`). A tenant
+   * raising this asserts that its upstreams accept larger attachments: the
+   * clamp exists so an oversized block cannot poison every retry and every
+   * replayed turn with a request the upstream rejects whole. An override
+   * promising more than the provider accepts turns that protection back off,
+   * which is why it is a deliberate per-tenant choice and not a global knob.
+   */
+  readonly maxBytesOverride?: number;
 }
 
 export interface ImageClampDecision {
@@ -108,7 +119,14 @@ export function imageClampMaxDimensionPx(imageCount: number): number {
 export function clampImage(input: ImageClampInput): ImageClampDecision {
   const imageCount = input.imageCount ?? 1;
   const maxDimensionPx = imageClampMaxDimensionPx(imageCount);
-  const maxBytes = IMAGE_CLAMP_MAX_BYTES;
+  // A non-finite or non-positive override is not a ceiling, it is a mistake:
+  // falling back to the default keeps a malformed preference from silently
+  // admitting (or rejecting) every image.
+  const override = input.maxBytesOverride;
+  const maxBytes =
+    typeof override === "number" && Number.isFinite(override) && override > 0
+      ? Math.floor(override)
+      : IMAGE_CLAMP_MAX_BYTES;
   const longestEdge = Math.max(input.width ?? 0, input.height ?? 0);
   if (longestEdge > maxDimensionPx) {
     return {

package/src/protocol/registry.ts

@@ -8,6 +8,11 @@ export interface CodecContext {
   readonly maxOutputTokens?: number;
   readonly promptCacheKey?: string;
   readonly signal?: AbortSignal;
+  /**
+   * Per-tenant ceiling for one inline attachment, in bytes. Absent means the
+   * deployment default; only wire encoders that clamp images read it.
+   */
+  readonly maxBytesOverride?: number;
 }
 
 /**
@@ -138,6 +143,9 @@ export async function encodeWireRequest(
   if (codec.family === "messages") {
     return codec.encodeWireRequest(request, {
       ...(context?.isOAuth === undefined ? {} : { isOAuth: context.isOAuth }),
+      ...(context?.maxBytesOverride === undefined
+        ? {}
+        : { maxBytesOverride: context.maxBytesOverride }),
     });
   }
   if (codec.family === "chat") {

package/src/protocol/request/chat.ts

@@ -353,7 +353,24 @@ export function canonicalToChatPayload(
           // `display: "omitted"`, and dropping it stripped the replay the
           // provider demands on the next request. `reasoning_content` is an
           // assistant-only field, so it is emitted here and nowhere else.
-          if (m.role === "assistant" && hasReasoning) {
+          //
+          // Load-bearing requires *content* in the replay: a non-empty summary
+          // or a non-empty serialised payload. Pushing `{content:"",
+          // reasoning_content:""}` is the opposite of load-bearing — the
+          // upstream reads it as "thinking mode with the reasoning stripped"
+          // and rejects the whole request (`WorkBuddy/CodeBuddy 11151 "history
+          // not found"`). The canonical form that reaches this branch with no
+          // trace is an input `reasoning` item whose `summary` was absent and
+          // whose `payload` was `null` — a signature-less thinking block
+          // emitted under `display: "omitted"` and already stripped by an
+          // earlier hop. There is nothing to replay, so the turn is dropped
+          // instead of being forwarded as an invalid stub.
+          // This non-empty echo is load-bearing for non-buddy
+          // OpenAI-compatible providers. Buddy providers deliberately drop
+          // the resulting bare stub later in `dropEmptyBuddyMessages`
+          // (`providers/integrations/buddy/buddy-chat-shared.ts`) because
+          // their upstream rejects that shape with 11151.
+          if (m.role === "assistant" && hasReasoning && reasoningContent.length > 0) {
             messages.push({
               role: "assistant",
               content: "",
@@ -361,6 +378,9 @@ export function canonicalToChatPayload(
             });
             continue;
           }
+          // No trace to carry: skip the turn entirely rather than emit an
+          // empty assistant message the upstream will reject.
+          if (m.role === "assistant" && hasReasoning) continue;
           if (m.role !== "assistant" && hasReasoning && reasoningContent.length > 0) {
             const last = messages[messages.length - 1];
             if (last !== undefined && last["role"] === "tool") {

package/src/protocol/request/codex.ts

@@ -374,7 +374,16 @@ export function canonicalToCodexResponsesPayload(
               summary: summaryArray,
               encrypted_content: r.encrypted_content,
             };
-            if (r.summary !== undefined || r.encrypted_content !== undefined) {
+            // The upstream binds encrypted reasoning to the item it was issued
+            // for and rejects a replay whose id does not match, so the id that
+            // came back with the payload is authoritative. A synthesized
+            // `rs_<hash>` never matched the real item and failed the whole
+            // request with "Encrypted content item_id did not match the target
+            // item id"; only fall back to it when no id survived, where a
+            // mismatch is unavoidable anyway.
+            if (typeof r.item_id === "string" && r.item_id.length > 0) {
+              item["id"] = r.item_id;
+            } else if (r.summary !== undefined || r.encrypted_content !== undefined) {
               const idSource = `${r.summary ?? ""}|${r.encrypted_content ?? ""}`;
               if (idSource.length > 1) {
                 item["id"] = `rs_${hashToBase36(idSource)}`;

package/src/protocol/request/gemini.ts

@@ -147,6 +147,7 @@ function geminiMediaPart(part: {
 function toGeminiPart(
   part: CanonicalRequest["messages"][number]["content"][number],
   toolNames: ReadonlyMap<string, string>,
+  maxBytesOverride?: number,
 ): Record<string, unknown>[] {
   if (part.kind === "text") return [{ text: part.text }];
   if (part.kind === "reasoning") {
@@ -173,6 +174,7 @@ function toGeminiPart(
         // whose attachment silently vanished.
         const decision = clampImage({
           bytes: base64DecodedByteLength(split.data),
+          ...(maxBytesOverride === undefined ? {} : { maxBytesOverride }),
         });
         if (decision.action === "reject") {
           // Only the byte ceiling refuses a block. A `downscale` decision is
@@ -255,7 +257,10 @@ function parseJsonObject(value: string): Record<string, unknown> {
   }
 }
 
-export function buildGeminiPayload(request: CanonicalRequest): Record<string, unknown> {
+export function buildGeminiPayload(
+  request: CanonicalRequest,
+  options: { maxBytesOverride?: number } = {},
+): Record<string, unknown> {
   const systemParts: Array<{ text: string }> = [];
   const pushSystemText = (text: string): void => {
     if (!isClaudeBillingHeaderText(text)) systemParts.push({ text });
@@ -275,7 +280,9 @@ export function buildGeminiPayload(request: CanonicalRequest): Record<string, un
     .map((message) => {
       // Gemini roles: user or model (assistant -> model)
       const role = message.role === "assistant" ? "model" : message.role === "tool" ? "user" : "user";
-      const parts = message.content.flatMap((block) => toGeminiPart(block, toolNames));
+      const parts = message.content.flatMap((block) =>
+        toGeminiPart(block, toolNames, options.maxBytesOverride),
+      );
       return { role, parts: parts.length ? parts : [{ text: "" }] };
     });
   const payload: Record<string, unknown> = { contents };

package/src/protocol/request/messages.ts

@@ -121,6 +121,7 @@ function applyImageClamp(
   block: ClaudeWireObject,
   imageCount: number,
   payload: unknown,
+  maxBytesOverride?: number,
 ): ClaudeWireObject {
   const source = block["source"];
   const data = isRecord(source) ? source["data"] : undefined;
@@ -131,6 +132,7 @@ function applyImageClamp(
     ...(width === undefined ? {} : { width }),
     ...(height === undefined ? {} : { height }),
     imageCount,
+    ...(maxBytesOverride === undefined ? {} : { maxBytesOverride }),
   });
   if (decision.action === "pass") return block;
   log.warn(
@@ -155,12 +157,11 @@ function applyImageClamp(
  * the upstream rejects anything else. A canonical image part is an opaque
  * origin payload, so it can arrive in a vocabulary that is *not* Anthropic's:
  * a Responses part carries `type: "input_image"` with a top-level `image_url`
- * string, and a Chat part carries a nested `image_url` object. Both used to be
- * forwarded with their own `type` intact (or with no `source` at all), so a
- * Responses- or Chat-origin image sent to a Claude model produced
- * `source.type: "input_image"` — an invalid block the provider refused.
+ * string, and a Chat part carries a nested `image_url` object. Forwarding either
+ * with its own `type` intact (or with no `source` at all) sends a Claude model
+ * `source.type: "input_image"` — an invalid block the provider refuses.
  *
- * Every shape now collapses to a valid source, preferring the cheapest
+ * Every shape collapses to a valid source, preferring the cheapest
  * transport: a Files API reference, then a URL, then base64 bytes (a `data:`
  * URL is split rather than embedded, because Anthropic has no data-URL field).
  */
@@ -281,6 +282,7 @@ function partToClaudeBlock(
     idMap: Map<string, string>;
     isOAuth: boolean;
     imageCount: number;
+    maxBytesOverride?: number;
   },
 ): ClaudeWireObject | undefined {
   switch (part.kind) {
@@ -291,6 +293,7 @@ function partToClaudeBlock(
         normalizeImageBlock(part.payload),
         ctx?.imageCount ?? 1,
         part.payload,
+        ctx?.maxBytesOverride,
       );
     case "file":
       return {
@@ -553,14 +556,22 @@ export function claudeFallbacksChain(
 
 export function canonicalToClaudeMessagesPayload(
   request: CanonicalRequest,
-  options: { isOAuth?: boolean } = {},
+  options: { isOAuth?: boolean; maxBytesOverride?: number } = {},
 ): ClaudeWireObject {
   const seen = new Map<string, number>();
   const idMap = new Map<string, string>();
   // The clamp's per-image ceiling depends on how many images the whole request
   // carries, so it is counted once over every part rather than per message.
   const imageCount = allParts(request).filter((part) => part.kind === "image").length;
-  const ctx = { seen, idMap, isOAuth: options.isOAuth ?? false, imageCount };
+  const ctx = {
+    seen,
+    idMap,
+    isOAuth: options.isOAuth ?? false,
+    imageCount,
+    ...(options.maxBytesOverride === undefined
+      ? {}
+      : { maxBytesOverride: options.maxBytesOverride }),
+  };
   const messages: ClaudeWireObject[] = [];
   // Anthropic accepts system content only at the top level. Chat `developer`
   // turns and Responses `instructions` have no `developer` role upstream, and

package/src/protocol/request/responses.ts

@@ -163,7 +163,15 @@ export function canonicalToResponsesPayload(
         flushMessage();
         // Replays prior encrypted reasoning so the model retains continuity
         // across turns; never decrypted or reconstructed from summary text.
-        input.push({ type: "reasoning", encrypted_content: p.encrypted_content });
+        // The upstream binds encrypted reasoning to the item it was issued
+        // for and rejects a replay whose id does not match ("Encrypted content
+        // item_id did not match the target item id"), so the item carries the
+        // id it was parsed with. Without one there is nothing to match and the
+        // payload would be rejected anyway — it is dropped rather than sent
+        // under an id the upstream cannot verify.
+        if (p.item_id !== undefined) {
+          input.push({ type: "reasoning", id: p.item_id, encrypted_content: p.encrypted_content });
+        }
       } else if (p.kind === "reasoning") {
         // Plain reasoning replayed from another surface (a Messages `thinking`
         // block, or Chat `reasoning_content`). It has no encrypted artifact, so

package/src/protocol/response/chat.ts

@@ -10,7 +10,7 @@ import { mergeResponsesUsage } from "./responses";
 import { usageFromProvider, readReasoningText } from "../../providers/provider-usage";
 import { createToolEmitLedger } from "../tool-identity";
 import { MimoThinkSplitter, stripThinkingTags } from "../../providers/integrations/xiaomi-mimo/think-stream";
-import { parseDsmlToolCalls } from "./dsml";
+import { DsmlToolCallParser, parseDsmlToolCalls } from "./dsml";
 import {
   OmpToolCallMarkupParser,
   parseOmpToolCallMarkup,
@@ -83,7 +83,7 @@ export function parseChatResponseToEvents(
     const contentWithoutMarkup = recoveredMarkup?.text ?? content;
     const recovered =
       typeof contentWithoutMarkup === "string"
-        ? parseDsmlToolCalls(contentWithoutMarkup)
+        ? parseDsmlToolCalls(contentWithoutMarkup, declaredToolNames)
         : undefined;
     const visible = recovered === undefined ? contentWithoutMarkup : recovered.text;
     if (typeof visible === "string" && visible.includes("<think")) {
@@ -144,6 +144,13 @@ export function parseChatResponseToEvents(
               : undefined;
         return callId && name !== undefined && name.length > 0;
       });
+    // A request that declared no tools carries no allowlist to enforce, so a
+    // recovered block is honoured as-is exactly as before; a request that did
+    // declare them must never execute a name it did not offer.
+    const recoveredCalls =
+      declaredToolNames.size > 0
+        ? (recovered?.calls ?? []).filter((call) => callableToolNames.has(call.name))
+        : (recovered?.calls ?? []);
     const toolCalls = hasStructuredCalls
       ? structuredCalls
       : recoveredMarkup?.calls.some((call) => callableToolNames.has(call.name))
@@ -153,7 +160,7 @@ export function parseChatResponseToEvents(
               id: call.id,
               function: { name: call.name, arguments: call.arguments },
             }))
-        : recovered?.calls ?? [];
+        : recoveredCalls;
     if (!hasStructuredCalls && recoveredMarkup !== undefined) {
       recoveredToolCalls = recoveredMarkup.calls.filter((call) =>
         callableToolNames.has(call.name),
@@ -257,6 +264,8 @@ export async function* decodeChatSseStream(
     (request.tools?.length ?? 0) > 0 ? new OmpToolCallMarkupParser(declaredToolNames) : undefined;
   const reasoningMarkup =
     (request.tools?.length ?? 0) > 0 ? new OmpToolCallMarkupParser(declaredToolNames) : undefined;
+  const dsmlMarkup =
+    (request.tools?.length ?? 0) > 0 ? new DsmlToolCallParser(declaredToolNames) : undefined;
   yield {
     type: "response_start",
     sequence_number: seq++,
@@ -302,7 +311,7 @@ export async function* decodeChatSseStream(
           const raw = delta["content"] as string;
           const markup = contentMarkup?.push(raw);
           if (markup !== undefined) recoveredMarkupCalls.push(...markup.calls);
-          const recovered = parseDsmlToolCalls(markup?.text ?? raw);
+          const recovered = dsmlMarkup?.push(markup?.text ?? raw);
           const visible = recovered?.text ?? markup?.text ?? raw;
           const split = think.push(visible);
           if (split.reasoning.length > 0) {
@@ -478,6 +487,27 @@ export async function* decodeChatSseStream(
       }
     }
   }
+  const dsmlMarkupTail = dsmlMarkup?.flush();
+  if (dsmlMarkupTail !== undefined) {
+    if (dsmlMarkupTail.text.length > 0) {
+      const split = think.push(dsmlMarkupTail.text);
+      if (split.reasoning.length > 0) {
+        yield {
+          type: "content_delta",
+          sequence_number: seq++,
+          content: { kind: "reasoning", payload: null, summary: split.reasoning },
+        } as CanonicalEvent;
+      }
+      if (split.text.length > 0) {
+        yield {
+          type: "content_delta",
+          sequence_number: seq++,
+          content: { kind: "text", text: split.text },
+        } as CanonicalEvent;
+      }
+    }
+    for (const call of dsmlMarkupTail.calls) recoveredMarkupCalls.push(call);
+  }
   const reasoningMarkupTail = reasoningMarkup?.flush();
   if (reasoningMarkupTail?.text) {
     const reasoningText = stripThinkingTags(reasoningMarkupTail.text);

package/src/protocol/response/codex.ts

@@ -84,7 +84,10 @@ export function reasoningEvent(
       payload: null,
       ...(summary === undefined ? {} : { summary }),
       ...(typeof encrypted === "string"
-        ? { encrypted_content: encrypted }
+        ? {
+            encrypted_content: encrypted,
+            ...(typeof item["id"] === "string" ? { item_id: item["id"] } : {}),
+          }
         : {}),
       ...(summary === undefined && typeof encrypted === "string"
         ? { opaque: true as const }
@@ -235,9 +238,9 @@ export function parseCodexResponsesJsonToEvents(
       | undefined);
   // An incomplete response that produced a tool call is always a tool-use
   // stop; every other incomplete response is a length stop. There is no
-  // separate executability gate — the branch that used to scan tool arguments
-  // for parseable JSON returned `tool_use` on both outcomes, so the scan and
-  // the `incomplete_details.reason` read could not change the result.
+  // separate executability gate — scanning tool arguments for parseable JSON
+  // returns `tool_use` on both outcomes, so the scan and the
+  // `incomplete_details.reason` read could not change the result.
   const stopReason = mapCodexStopReason(status, hasToolCall, endTurn);
   let finalStopReason = stopReason;
   if (endTurn === false && stopReason === "stop") {