cartethyia 2.5.4 → 2.5.7

package/src/protocol/codecs.ts

@@ -3,8 +3,7 @@
  * `src/protocol/`. This is the single home for the generic guards, UTF-16
  * well-formedness coercion, JSON/argument helpers, hash helpers, endpoint
  * URL construction, image-source resolution, and custom-header validation
- * that the per-wire request/response codecs build on — previously duplicated
- * across the Claude/Codex protocol modules and `providers/compatible-adapter`.
+ * that the per-wire request/response codecs build on.
  *
  * Provider-specific primitives that depend on provider identity (e.g. Codex
  * identity headers) deliberately live with their provider, not here.
@@ -273,6 +272,46 @@ const SUPPORTED_SCHEMA_KEYS: Readonly<Record<string, true>> = Object.freeze({
   maxProperties: true,
 });
 
+/**
+ * True when a schema string carries a backslash before an underscore.
+ *
+ * Some clients emit a property or pattern key containing a literal `\_` (an
+ * escaped underscore). Upstreams reject it, so the escape has to be stripped —
+ * and stripping it can collapse two previously distinct keys onto the same
+ * name, which is why {@link mergeCollidingKeys} exists below.
+ */
+function hasUnderscoreEscape(value: string): boolean {
+  return /\\+_/.test(value);
+}
+
+/**
+ * Merges map entries whose normalized keys collide, rather than overwriting.
+ *
+ * `allOf` accepts boolean schemas, so neither constraint is lost — a plain
+ * overwrite would silently drop one of two rules the caller actually sent.
+ */
+function mergeCollidingKeys(entries: ReadonlyArray<readonly [string, unknown]>): Record<string, unknown> {
+  const merged: Record<string, unknown> = {};
+  for (const [key, value] of entries) {
+    const existing = merged[key];
+    if (existing === undefined) {
+      merged[key] = value;
+      continue;
+    }
+    merged[key] = { allOf: [existing, value] };
+  }
+  return merged;
+}
+
+/** One schema map's keys, with `\_` escapes stripped and collisions merged. */
+function normalizeSchemaMapKeys(map: Record<string, unknown>): Record<string, unknown> {
+  const entries = Object.entries(map);
+  if (!entries.some(([key]) => hasUnderscoreEscape(key))) return map;
+  return mergeCollidingKeys(
+    entries.map(([key, value]) => [key.replace(/\\+_/g, "_"), value] as const),
+  );
+}
+
 export function sanitizeSchemaForAnthropic(value: unknown): unknown {
   return sanitizeSchemaWalk(value, ROOT_WALK);
 }
@@ -292,10 +331,21 @@ function sanitizeSchemaWalk(value: unknown, walk: RewriteWalk): unknown {
     // preserve them while sanitizing each property's schema recursively.
     if (key === "properties" && isRecord(child)) {
       out.properties = Object.fromEntries(
-        Object.entries(child).map(([name, schema]) => [name, sanitizeSchemaWalk(schema, inner)]),
+        // Escaped-underscore keys are normalized first: two names differing only
+        // by an escape would otherwise survive as two properties and be rebuilt
+        // into a `required` list the upstream rejects.
+        Object.entries(normalizeSchemaMapKeys(child)).map(([name, schema]) => [
+          name,
+          sanitizeSchemaWalk(schema, inner),
+        ]),
       );
       continue;
     }
+    // `patternProperties` is deliberately NOT re-emitted: it is absent from
+    // `SUPPORTED_SCHEMA_KEYS` because the Anthropic wire does not accept it, and
+    // writing it here would be undone by the keyword filter a few lines down
+    // anyway. Its keys are still walked below, so nested schemas are sanitized
+    // and an escaped-underscore key inside one is still normalized.
     // Drop wire-unsupported keywords so a strict upstream never 400s on
     // them — but never invent caller text to say so. The dropped names are
     // debug-logged by the caller-facing builder when that matters.
@@ -676,12 +726,96 @@ export function canonicalTerminal(input: {
   };
 }
 
+/**
+ * JSON Schema keywords. A parameter root containing any of these is already a
+ * schema object, not a legacy property-name → schema map.
+ */
+const SCHEMA_KEYWORDS: ReadonlySet<string> = new Set([
+  "$schema", "$id", "$ref", "$anchor", "$dynamicRef", "$dynamicAnchor", "$defs",
+  "$vocabulary", "$comment", "definitions", "type", "properties", "patternProperties",
+  "additionalProperties", "unevaluatedProperties", "propertyNames", "required",
+  "dependentRequired", "dependentSchemas", "dependencies", "minProperties", "maxProperties",
+  "allOf", "anyOf", "oneOf", "not", "if", "then", "else", "items", "prefixItems",
+  "additionalItems", "contains", "unevaluatedItems", "minItems", "maxItems", "uniqueItems",
+  "minContains", "maxContains", "minimum", "maximum", "exclusiveMinimum", "exclusiveMaximum",
+  "multipleOf", "minLength", "maxLength", "pattern", "format", "contentEncoding",
+  "contentMediaType", "contentSchema", "enum", "const", "title", "description", "default",
+  "examples", "deprecated", "readOnly", "writeOnly",
+]);
+
+/** The JSON Schema primitive type names. */
+const SCHEMA_TYPES: ReadonlySet<string> = new Set([
+  "string", "number", "integer", "boolean", "object", "array", "null",
+]);
+
+/**
+ * Rewrites one legacy tool parameter root into an explicit object schema.
+ *
+ * Two shapes reach here and are both rejected upstream as-is:
+ *
+ * - **An empty root.** `{}` carries no `type`, and a schema with no type is not
+ *   a schema the upstream will accept — it answers `invalid_function_parameters`
+ *   (CodeBuddy `11129`).
+ * - **A legacy property-name → schema map.** Every field names a parameter and
+ *   carries its own boolean `required` flag, with no `{"type":"object",
+ *   "properties":…}` wrapper around them. Old clients in the wild still emit
+ *   this; the upstream wants the wrapper and the `required` array.
+ *
+ * Anything ambiguous is returned **untouched**. A root that already holds schema
+ * keywords, or one whose fields do not all look like `{type: <primitive>}`
+ * entries, is left alone: guessing there would rewrite a valid schema into a
+ * wrong one, which is worse than the refusal it was trying to avoid.
+ */
+export function normalizeToolParameterRoot(value: unknown): unknown {
+  if (!isRecord(value)) return value;
+  if (Object.keys(value).length === 0) return { type: "object", properties: {} };
+  // Schema keywords (or an extension/annotation key) mean this is a real
+  // schema object already, not a property map.
+  if (SCHEMA_KEYWORDS.has(Object.keys(value)[0] ?? "")) return value;
+  if (Object.keys(value).some((name) => SCHEMA_KEYWORDS.has(name))) return value;
+  if (Object.keys(value).some((name) => name.startsWith("$") || name.startsWith("x-")))
+    return value;
+  const entries = Object.entries(value);
+  // A legacy map is identified by its per-field boolean `required`. Without at
+  // least one, this is not recognisably the legacy shape.
+  if (!entries.some(([, field]) => isRecord(field) && typeof field["required"] === "boolean"))
+    return value;
+  if (
+    !entries.every(
+      ([, field]) =>
+        isRecord(field) &&
+        typeof field["type"] === "string" &&
+        SCHEMA_TYPES.has(field["type"]) &&
+        (!("required" in field) || typeof field["required"] === "boolean"),
+    )
+  )
+    return value;
+
+  const properties: Record<string, unknown> = {};
+  const required: string[] = [];
+  for (const [name, field] of entries) {
+    const copy = { ...(field as Record<string, unknown>) };
+    if (copy["required"] === true) required.push(name);
+    delete copy["required"];
+    properties[name] = copy;
+  }
+  return {
+    type: "object",
+    properties,
+    ...(required.length > 0 ? { required } : {}),
+  };
+}
+
 /**
  * Defaults a tool schema's `required` list to all declared properties while
  * preserving an explicit list, including optional properties.
+ *
+ * Also normalizes a legacy parameter root first (see
+ * {@link normalizeToolParameterRoot}), so a caller sending an empty root or a
+ * property-name → schema map still ships a schema the upstream accepts.
  */
 export function completeRequiredSchema(value: unknown): unknown {
-  return completeRequiredWalk(value, ROOT_WALK);
+  return completeRequiredWalk(normalizeToolParameterRoot(value), ROOT_WALK);
 }
 
 function completeRequiredWalk(value: unknown, walk: RewriteWalk): unknown {

package/src/protocol/gateway-error.ts

@@ -12,6 +12,8 @@ export type GatewayErrorCode =
   | "accounts_unavailable"
   | "accounts_rate_limited"
   | "capacity_exhausted"
+  | "provider_capacity_exhausted"
+  | "upstream_queued"
   | "proxy_pool_capacity_exceeded"
   | "proxy_pool_provider_capacity_exceeded"
   | "proxy_pool_blocked"
@@ -110,11 +112,11 @@ function stripLegacyOriginLabel(message: string): string {
  * stamped into it.
  *
  * The code is not lost — it travels in the envelope's `error.code` field, and
- * the HTTP status carries the class. It used to be prefixed into the text
+ * the HTTP status carries the class. Stamping it into the text
  * (`accounts_unavailable: Model 'x' has no available account (52 candidate(s)
- * unusable: credit_floor_reached, model_cooldown)`), which put internal enum
- * names in front of the operator's sentence and made the message unreadable
- * while adding nothing the field did not already carry.
+ * unusable: credit_floor_reached, model_cooldown)`) would put internal enum
+ * names in front of the operator's sentence and make the message unreadable
+ * while adding nothing the field does not already carry.
  *
  * Stripping is idempotent, and that is the point: a message that already
  * carries a `code:` prefix — stamped by an older builder, or by a code path

package/src/protocol/request/chat.ts

@@ -353,7 +353,24 @@ export function canonicalToChatPayload(
           // `display: "omitted"`, and dropping it stripped the replay the
           // provider demands on the next request. `reasoning_content` is an
           // assistant-only field, so it is emitted here and nowhere else.
-          if (m.role === "assistant" && hasReasoning) {
+          //
+          // Load-bearing requires *content* in the replay: a non-empty summary
+          // or a non-empty serialised payload. Pushing `{content:"",
+          // reasoning_content:""}` is the opposite of load-bearing — the
+          // upstream reads it as "thinking mode with the reasoning stripped"
+          // and rejects the whole request (`WorkBuddy/CodeBuddy 11151 "history
+          // not found"`). The canonical form that reaches this branch with no
+          // trace is an input `reasoning` item whose `summary` was absent and
+          // whose `payload` was `null` — a signature-less thinking block
+          // emitted under `display: "omitted"` and already stripped by an
+          // earlier hop. There is nothing to replay, so the turn is dropped
+          // instead of being forwarded as an invalid stub.
+          // This non-empty echo is load-bearing for non-buddy
+          // OpenAI-compatible providers. Buddy providers deliberately drop
+          // the resulting bare stub later in `dropEmptyBuddyMessages`
+          // (`providers/integrations/buddy/buddy-chat-shared.ts`) because
+          // their upstream rejects that shape with 11151.
+          if (m.role === "assistant" && hasReasoning && reasoningContent.length > 0) {
             messages.push({
               role: "assistant",
               content: "",
@@ -361,6 +378,9 @@ export function canonicalToChatPayload(
             });
             continue;
           }
+          // No trace to carry: skip the turn entirely rather than emit an
+          // empty assistant message the upstream will reject.
+          if (m.role === "assistant" && hasReasoning) continue;
           if (m.role !== "assistant" && hasReasoning && reasoningContent.length > 0) {
             const last = messages[messages.length - 1];
             if (last !== undefined && last["role"] === "tool") {

package/src/protocol/request/codex.ts

@@ -374,7 +374,16 @@ export function canonicalToCodexResponsesPayload(
               summary: summaryArray,
               encrypted_content: r.encrypted_content,
             };
-            if (r.summary !== undefined || r.encrypted_content !== undefined) {
+            // The upstream binds encrypted reasoning to the item it was issued
+            // for and rejects a replay whose id does not match, so the id that
+            // came back with the payload is authoritative. A synthesized
+            // `rs_<hash>` never matched the real item and failed the whole
+            // request with "Encrypted content item_id did not match the target
+            // item id"; only fall back to it when no id survived, where a
+            // mismatch is unavoidable anyway.
+            if (typeof r.item_id === "string" && r.item_id.length > 0) {
+              item["id"] = r.item_id;
+            } else if (r.summary !== undefined || r.encrypted_content !== undefined) {
               const idSource = `${r.summary ?? ""}|${r.encrypted_content ?? ""}`;
               if (idSource.length > 1) {
                 item["id"] = `rs_${hashToBase36(idSource)}`;

package/src/protocol/request/messages.ts

@@ -157,12 +157,11 @@ function applyImageClamp(
  * the upstream rejects anything else. A canonical image part is an opaque
  * origin payload, so it can arrive in a vocabulary that is *not* Anthropic's:
  * a Responses part carries `type: "input_image"` with a top-level `image_url`
- * string, and a Chat part carries a nested `image_url` object. Both used to be
- * forwarded with their own `type` intact (or with no `source` at all), so a
- * Responses- or Chat-origin image sent to a Claude model produced
- * `source.type: "input_image"` — an invalid block the provider refused.
+ * string, and a Chat part carries a nested `image_url` object. Forwarding either
+ * with its own `type` intact (or with no `source` at all) sends a Claude model
+ * `source.type: "input_image"` — an invalid block the provider refuses.
  *
- * Every shape now collapses to a valid source, preferring the cheapest
+ * Every shape collapses to a valid source, preferring the cheapest
  * transport: a Files API reference, then a URL, then base64 bytes (a `data:`
  * URL is split rather than embedded, because Anthropic has no data-URL field).
  */

package/src/protocol/request/responses.ts

@@ -163,7 +163,15 @@ export function canonicalToResponsesPayload(
         flushMessage();
         // Replays prior encrypted reasoning so the model retains continuity
         // across turns; never decrypted or reconstructed from summary text.
-        input.push({ type: "reasoning", encrypted_content: p.encrypted_content });
+        // The upstream binds encrypted reasoning to the item it was issued
+        // for and rejects a replay whose id does not match ("Encrypted content
+        // item_id did not match the target item id"), so the item carries the
+        // id it was parsed with. Without one there is nothing to match and the
+        // payload would be rejected anyway — it is dropped rather than sent
+        // under an id the upstream cannot verify.
+        if (p.item_id !== undefined) {
+          input.push({ type: "reasoning", id: p.item_id, encrypted_content: p.encrypted_content });
+        }
       } else if (p.kind === "reasoning") {
         // Plain reasoning replayed from another surface (a Messages `thinking`
         // block, or Chat `reasoning_content`). It has no encrypted artifact, so

package/src/protocol/response/chat.ts

@@ -10,7 +10,7 @@ import { mergeResponsesUsage } from "./responses";
 import { usageFromProvider, readReasoningText } from "../../providers/provider-usage";
 import { createToolEmitLedger } from "../tool-identity";
 import { MimoThinkSplitter, stripThinkingTags } from "../../providers/integrations/xiaomi-mimo/think-stream";
-import { parseDsmlToolCalls } from "./dsml";
+import { DsmlToolCallParser, parseDsmlToolCalls } from "./dsml";
 import {
   OmpToolCallMarkupParser,
   parseOmpToolCallMarkup,
@@ -83,7 +83,7 @@ export function parseChatResponseToEvents(
     const contentWithoutMarkup = recoveredMarkup?.text ?? content;
     const recovered =
       typeof contentWithoutMarkup === "string"
-        ? parseDsmlToolCalls(contentWithoutMarkup)
+        ? parseDsmlToolCalls(contentWithoutMarkup, declaredToolNames)
         : undefined;
     const visible = recovered === undefined ? contentWithoutMarkup : recovered.text;
     if (typeof visible === "string" && visible.includes("<think")) {
@@ -144,6 +144,13 @@ export function parseChatResponseToEvents(
               : undefined;
         return callId && name !== undefined && name.length > 0;
       });
+    // A request that declared no tools carries no allowlist to enforce, so a
+    // recovered block is honoured as-is exactly as before; a request that did
+    // declare them must never execute a name it did not offer.
+    const recoveredCalls =
+      declaredToolNames.size > 0
+        ? (recovered?.calls ?? []).filter((call) => callableToolNames.has(call.name))
+        : (recovered?.calls ?? []);
     const toolCalls = hasStructuredCalls
       ? structuredCalls
       : recoveredMarkup?.calls.some((call) => callableToolNames.has(call.name))
@@ -153,7 +160,7 @@ export function parseChatResponseToEvents(
               id: call.id,
               function: { name: call.name, arguments: call.arguments },
             }))
-        : recovered?.calls ?? [];
+        : recoveredCalls;
     if (!hasStructuredCalls && recoveredMarkup !== undefined) {
       recoveredToolCalls = recoveredMarkup.calls.filter((call) =>
         callableToolNames.has(call.name),
@@ -257,6 +264,8 @@ export async function* decodeChatSseStream(
     (request.tools?.length ?? 0) > 0 ? new OmpToolCallMarkupParser(declaredToolNames) : undefined;
   const reasoningMarkup =
     (request.tools?.length ?? 0) > 0 ? new OmpToolCallMarkupParser(declaredToolNames) : undefined;
+  const dsmlMarkup =
+    (request.tools?.length ?? 0) > 0 ? new DsmlToolCallParser(declaredToolNames) : undefined;
   yield {
     type: "response_start",
     sequence_number: seq++,
@@ -302,7 +311,7 @@ export async function* decodeChatSseStream(
           const raw = delta["content"] as string;
           const markup = contentMarkup?.push(raw);
           if (markup !== undefined) recoveredMarkupCalls.push(...markup.calls);
-          const recovered = parseDsmlToolCalls(markup?.text ?? raw);
+          const recovered = dsmlMarkup?.push(markup?.text ?? raw);
           const visible = recovered?.text ?? markup?.text ?? raw;
           const split = think.push(visible);
           if (split.reasoning.length > 0) {
@@ -478,6 +487,27 @@ export async function* decodeChatSseStream(
       }
     }
   }
+  const dsmlMarkupTail = dsmlMarkup?.flush();
+  if (dsmlMarkupTail !== undefined) {
+    if (dsmlMarkupTail.text.length > 0) {
+      const split = think.push(dsmlMarkupTail.text);
+      if (split.reasoning.length > 0) {
+        yield {
+          type: "content_delta",
+          sequence_number: seq++,
+          content: { kind: "reasoning", payload: null, summary: split.reasoning },
+        } as CanonicalEvent;
+      }
+      if (split.text.length > 0) {
+        yield {
+          type: "content_delta",
+          sequence_number: seq++,
+          content: { kind: "text", text: split.text },
+        } as CanonicalEvent;
+      }
+    }
+    for (const call of dsmlMarkupTail.calls) recoveredMarkupCalls.push(call);
+  }
   const reasoningMarkupTail = reasoningMarkup?.flush();
   if (reasoningMarkupTail?.text) {
     const reasoningText = stripThinkingTags(reasoningMarkupTail.text);

package/src/protocol/response/codex.ts

@@ -84,7 +84,10 @@ export function reasoningEvent(
       payload: null,
       ...(summary === undefined ? {} : { summary }),
       ...(typeof encrypted === "string"
-        ? { encrypted_content: encrypted }
+        ? {
+            encrypted_content: encrypted,
+            ...(typeof item["id"] === "string" ? { item_id: item["id"] } : {}),
+          }
         : {}),
       ...(summary === undefined && typeof encrypted === "string"
         ? { opaque: true as const }
@@ -235,9 +238,9 @@ export function parseCodexResponsesJsonToEvents(
       | undefined);
   // An incomplete response that produced a tool call is always a tool-use
   // stop; every other incomplete response is a length stop. There is no
-  // separate executability gate — the branch that used to scan tool arguments
-  // for parseable JSON returned `tool_use` on both outcomes, so the scan and
-  // the `incomplete_details.reason` read could not change the result.
+  // separate executability gate — scanning tool arguments for parseable JSON
+  // returns `tool_use` on both outcomes, so the scan and the
+  // `incomplete_details.reason` read could not change the result.
   const stopReason = mapCodexStopReason(status, hasToolCall, endTurn);
   let finalStopReason = stopReason;
   if (endTurn === false && stopReason === "stop") {

package/src/protocol/response/dsml.ts

@@ -1,15 +1,17 @@
 /**
- * DeepSeek sometimes emits its native tool markup as assistant text when the
- * structured tool channel was dropped in transit. A complete, well-formed block
- * becomes ordinary tool calls; anything incomplete stays text.
+ * CodeBuddy-family DeepSeek sometimes emits native tool markup as assistant text.
+ * Complete declared calls are recovered; incomplete and undeclared blocks stay text.
  */
-
-const PIPE = "\uFF5C\uFF5C";
-const CALLS = new RegExp(`<${PIPE}DSML${PIPE}\\s+calls>([\\s\\S]*?)</${PIPE}DSML${PIPE}\\s+calls>`, "i");
-const INVOKE = new RegExp(`<${PIPE}DSML${PIPE}\\s+invoke\\s+name=["']([^"']+)["']>([\\s\\S]*?)</${PIPE}DSML${PIPE}\\s+invoke>`, "gi");
-const PARAMETER = new RegExp(`<${PIPE}DSML${PIPE}\\s+parameter\\s+name=["']([^"']+)["'][^>]*>([\\s\\S]*?)</${PIPE}DSML${PIPE}\\s+parameter>`, "gi");
+const SEPARATORS = ["｜｜", "｜", "|"] as const;
+const BLOCK_NAMES = ["calls", "function_calls"] as const;
+const OPENERS = SEPARATORS.flatMap((separator) => BLOCK_NAMES.map((name) => `<${separator}DSML${separator} ${name}>`));
 const TOOL_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.:-]{0,63}$/;
 
+/** Escapes regex metacharacters so a `|` separator is literal, not alternation. */
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 export interface DsmlToolCall {
   readonly id: string;
   readonly name: string;
@@ -21,27 +23,137 @@ export interface DsmlRecovery {
   readonly calls: readonly DsmlToolCall[];
 }
 
-export function parseDsmlToolCalls(text: string): DsmlRecovery | undefined {
+export class DsmlToolCallParser {
+  readonly #allowedNames: ReadonlySet<string>;
+  #pending = "";
+  #callSequence = 0;
+
+  constructor(allowedNames: ReadonlySet<string>) {
+    this.#allowedNames = allowedNames;
+  }
+
+  push(chunk: string): DsmlRecovery {
+    this.#pending += chunk;
+    let cursor = 0;
+    let visible = "";
+    const calls: DsmlToolCall[] = [];
+    for (;;) {
+      let openIndex = -1;
+      let opener = "";
+      for (const candidate of OPENERS) {
+        const index = this.#pending.indexOf(candidate, cursor);
+        if (index >= 0 && (openIndex < 0 || index < openIndex)) {
+          openIndex = index;
+          opener = candidate;
+        }
+      }
+      if (openIndex < 0) {
+        const safeEnd = this.#settledEnd(cursor);
+        visible += this.#pending.slice(cursor, safeEnd);
+        cursor = safeEnd;
+        break;
+      }
+      visible += this.#pending.slice(cursor, openIndex);
+      const separator = SEPARATORS.find((value) => opener.startsWith(`<${value}DSML`));
+      const blockName = BLOCK_NAMES.find((value) => opener.endsWith(` ${value}>`));
+      if (separator === undefined || blockName === undefined) {
+        visible += "<";
+        cursor = openIndex + 1;
+        continue;
+      }
+      const close = `</${separator}DSML${separator} ${blockName}>`;
+      const closeIndex = this.#pending.indexOf(close, openIndex + opener.length);
+      if (closeIndex < 0) {
+        cursor = openIndex;
+        break;
+      }
+      const end = closeIndex + close.length;
+      const block = this.#pending.slice(openIndex, end);
+      const parsed = parseBlock(block, opener, close, separator, this.#allowedNames);
+      if (parsed === undefined) visible += block;
+      else {
+        for (const call of parsed) calls.push({ ...call, id: `call_dsml_${this.#callSequence++}_${call.name}` });
+      }
+      cursor = end;
+    }
+    this.#pending = this.#pending.slice(cursor);
+    return { text: visible, calls };
+  }
+
+  flush(): DsmlRecovery {
+    const text = this.#pending;
+    this.#pending = "";
+    return { text, calls: [] };
+  }
+
+  #settledEnd(start: number): number {
+    const remaining = this.#pending.slice(start);
+    for (let length = Math.min(OPENERS.reduce((max, opener) => Math.max(max, opener.length - 1), 0), remaining.length); length > 0; length -= 1) {
+      const suffix = remaining.slice(-length);
+      if (OPENERS.some((opener) => opener.startsWith(suffix))) return this.#pending.length - length;
+    }
+    return this.#pending.length;
+  }
+}
+
+export function parseDsmlToolCalls(
+  text: string,
+  allowedNames: ReadonlySet<string> = new Set(),
+): DsmlRecovery | undefined {
   if (!text.includes("DSML")) return undefined;
-  const block = CALLS.exec(text);
-  if (block === null || block[1] === undefined || block.index === undefined) return undefined;
-  const calls: DsmlToolCall[] = [];
-  for (const invoke of block[1].matchAll(INVOKE)) {
-    const name = invoke[1]?.trim() ?? "";
-    if (!TOOL_NAME.test(name)) return undefined;
-    const args: Record<string, string> = {};
-    for (const parameter of (invoke[2] ?? "").matchAll(PARAMETER)) {
-      const key = parameter[1]?.trim();
-      if (key === undefined || key.length === 0) return undefined;
-      args[key] = (parameter[2] ?? "").trim();
+  const parser = new DsmlToolCallParser(allowedNames);
+  const first = parser.push(text);
+  const last = parser.flush();
+  const recovered = [...first.calls, ...last.calls];
+  return recovered.length === 0 ? undefined : { text: `${first.text}${last.text}`.trim(), calls: recovered };
+}
+
+function parseBlock(
+  block: string,
+  opener: string,
+  close: string,
+  separator: string,
+  allowedNames: ReadonlySet<string>,
+): Omit<DsmlToolCall, "id">[] | undefined {
+  const inner = block.slice(opener.length, -close.length);
+  const pipe = escapeRegExp(separator);
+  const invokePattern = new RegExp(`<${pipe}DSML${pipe}\\s+invoke\\s+name="([^"]*)"\\s*>`, "g");
+  const calls: Omit<DsmlToolCall, "id">[] = [];
+  // The allowlist is strict only when the caller knows the declared tools: a
+  // caller without one (a direct parse) keeps the generic name rule, while a
+  // dispatch that declared its tools must never execute a name it did not offer.
+  const strict = allowedNames.size > 0;
+  let cursor = 0;
+  for (const invoke of inner.matchAll(invokePattern)) {
+    const name = invoke[1] ?? "";
+    if (!TOOL_NAME.test(name) || (strict && !allowedNames.has(name)) || invoke.index === undefined) return undefined;
+    if (inner.slice(cursor, invoke.index).trim().length > 0) return undefined;
+    const bodyStart = invoke.index + invoke[0].length;
+    const invokeClose = `</${separator}DSML${separator} invoke>`;
+    const invokeEnd = inner.indexOf(invokeClose, bodyStart);
+    if (invokeEnd < 0) return undefined;
+    const parameterPattern = new RegExp(`<${pipe}DSML${pipe}\\s+parameter\\s+name="([^"]*)"(?:\\s+string="(true|false)")?\\s*>`, "g");
+    const body = inner.slice(bodyStart, invokeEnd);
+    const args: Record<string, unknown> = {};
+    let parameterCursor = 0;
+    for (const parameter of body.matchAll(parameterPattern)) {
+      const key = parameter[1] ?? "";
+      if (key.length === 0 || parameter.index === undefined || body.slice(parameterCursor, parameter.index).trim().length > 0) return undefined;
+      const valueStart = parameter.index + parameter[0].length;
+      const parameterClose = `</${separator}DSML${separator} parameter>`;
+      const valueEnd = body.indexOf(parameterClose, valueStart);
+      if (valueEnd < 0) return undefined;
+      const raw = body.slice(valueStart, valueEnd);
+      if (parameter[2] === "true") args[key] = raw;
+      else {
+        try { args[key] = JSON.parse(raw); }
+        catch { args[key] = raw; }
+      }
+      parameterCursor = valueEnd + parameterClose.length;
     }
-    calls.push({
-      id: `call_dsml_${calls.length}_${name}`,
-      name,
-      arguments: JSON.stringify(args),
-    });
+    if (body.slice(parameterCursor).trim().length > 0) return undefined;
+    calls.push({ name, arguments: JSON.stringify(args) });
+    cursor = invokeEnd + invokeClose.length;
   }
-  if (calls.length === 0) return undefined;
-  const visible = `${text.slice(0, block.index)}${text.slice(block.index + block[0].length)}`.trim();
-  return { text: visible, calls };
+  return calls.length > 0 && inner.slice(cursor).trim().length === 0 ? calls : undefined;
 }

package/src/protocol/response/responses.ts

@@ -182,7 +182,10 @@ export function parseResponsesResponseToEvents(
                 }
               : { payload: text }),
             ...(position === 0 && encryptedContent !== undefined
-              ? { encrypted_content: encryptedContent }
+              ? {
+                  encrypted_content: encryptedContent,
+                  ...(itemId === undefined ? {} : { item_id: itemId }),
+                }
               : {}),
           },
         });
@@ -342,9 +345,9 @@ export async function* decodeResponsesSseStream(
     const eventType = event["type"];
     // An explicit failure inside a 200 OK. Two shapes carry one: a top-level
     // `type: "error"` frame (the error object itself), and a `response.failed`
-    // terminal whose `response.error` explains why. Both used to be recorded
-    // only as a `failed` terminal, so the client got no code and telemetry got
-    // `unknown_error`; the Claude and Gemini decoders already raised.
+    // terminal whose `response.error` explains why. Recording either only as a
+    // `failed` terminal would leave the client with no code and telemetry with
+    // `unknown_error`; the Claude and Gemini decoders already raise.
     const failedResponse = eventType === "response.failed" && isRecord(event["response"]) ? event["response"] : undefined;
     const streamError = gatewayErrorFromStreamError(
       eventType === "error" ? event : failedResponse?.["error"],
@@ -566,7 +569,10 @@ export async function* decodeResponsesSseStream(
                     ? { payload: null, summary: text, summary_index: reasoningPart.index }
                     : { payload: text }),
                   ...(position === 0 && encryptedContent !== undefined
-                    ? { encrypted_content: encryptedContent }
+                    ? {
+                        encrypted_content: encryptedContent,
+                        ...(itemId === undefined ? {} : { item_id: itemId }),
+                      }
                     : {}),
                 },
               } as CanonicalEvent;

package/src/protocol/stream-error-frames.ts

@@ -2,11 +2,10 @@
  * OpenAI-family in-stream error frames → typed `GatewayError`.
  *
  * A `200 OK` whose SSE body carries an explicit error envelope is an upstream
- * failure that arrived *after* the status line. The chat, responses, and codex
- * decoders used to record it only as a terminal `state: "failed"`, which left
- * the client with no `error.code`, no message, and telemetry with the
- * `unknown_error` category — while the Claude (`messages.ts`) and Gemini
- * decoders already threw for the identical event. This module is the one
+ * failure that arrived *after* the status line. Recording it only as a terminal
+ * `state: "failed"` leaves the client with no `error.code`, no message, and
+ * telemetry with the `unknown_error` category — while the Claude (`messages.ts`)
+ * and Gemini decoders throw for the identical event. This module is the one
  * classifier those surfaces share.
  *
  * Classification reads **structured identifiers only** (`error.type`,