llm-switcher 1.6.5 → 1.6.7

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog — LLM Switcher
 
+## Release 1.6.7 — 2026-10-09
+
+- **Jev Goal Check Interception Gate:** Intercept Claude Code stopping condition evaluators (`/goal`) and verify task completion independently using Jev System One typed decision judgments (`complete`, `evidence`, `unfinished`). Fails closed on missing or unverified work, preventing premature completion claims when models merely edit reports rather than implementing fixes.
+- **Dedicated Goal Check Dashboard (`#/goal-check`):** Manage Goal Check with provider source inheritance, custom URL and endpoint overrides, model combobox with auto-discovery, live connection test probe, fine-grained threshold controls, and real-time verification history.
+- **Notice Shim Preflight Model & Credential Check:** Automatically verify upstream endpoint reachability, API key validity, and configured model availability whenever a tool session is launched from the notice shim (`claude`, `codex`, `agy`). Instantly alerts the developer in the terminal if an active model was deprecated or dropped upstream, preventing cryptic downstream errors.
+- **Clear Gateway Error Messages:** Translate ambiguous upstream 404 (model not found) and 401 (invalid key) errors into actionable explanations directing users to reconfigure via `switch ui`.
+
+## Release 1.6.6 — 2026-10-09
+
+- **Consistent MCP Tool Aliasing across ToolSearch and History:** Ensure tool names in instructions, structured `ToolSearch` references, query history, and upstream declarations use the identical collision-resolved alias mapping across Chat, Anthropic, and Vertex conversions. Original client tool names are restored before Claude Code executes tool calls or queries `ToolSearch`, preventing mid-response stream rejections (`upstream called undeclared tool`) when interacting with MCP tools exceeding 64 characters (such as Chrome DevTools MCP).
+- **Buffered Argument Restoration for Parallel Streaming Calls:** Hold streaming `ToolSearch` query arguments across Anthropic, Chat, and Responses renderers until JSON reassembly completes, ensuring query tool aliases are accurately restored to their original names while guaranteeing independent parallel calls flush without truncation.
+
 ## Release 1.6.5 — 2026-10-08
 
 - **Automatic Tether Gate Disable for Claude Code (`CLAUDE_CODE_TETHER_LIVE=0`):** Automatically inject `CLAUDE_CODE_TETHER_LIVE=0` into `env-claude.sh` and `env-claude.cmd` whenever the Claude route is active, ensuring Claude Code runs in stateless mode and prevents `message-threads` validation failures on non-Anthropic upstreams. The shim cleans the variable on route deactivation, and the gateway safely rejects unexpected thread requests with `thread_unsupported_request` (HTTP 400).

package/compaction.mjs

@@ -0,0 +1,72 @@
+import crypto from 'node:crypto';
+import { readUpstreamPayloads } from './upstream-stream.mjs';
+
+// A gateway capsule, not OpenAI ciphertext. Both intact and this gateway use this format.
+export const COMPACTION_PREFIX = 'llm-gateway-compact-v1:';
+export const COMPACTION_INSTRUCTION = 'Summarize this conversation so it can replace the history. Keep the user task, decisions and reasons, changed files and commands, resolved errors and pending work. Write a complete, concise summary that a continuing agent can use without the original transcript.';
+
+export function encodeCompaction(summary) {
+  return COMPACTION_PREFIX + Buffer.from(JSON.stringify({ summary })).toString('base64url');
+}
+
+export function decodeCompaction(value) {
+  if (typeof value !== 'string' || !value.startsWith(COMPACTION_PREFIX)) {
+    throw new Error('Cannot convert native or legacy compaction state; resume through its original Responses provider.');
+  }
+  try {
+    const encoded = value.slice(COMPACTION_PREFIX.length);
+    if (!/^[A-Za-z0-9_-]+$/.test(encoded)) throw new Error('invalid encoding');
+    const decoded = Buffer.from(encoded, 'base64url');
+    if (decoded.toString('base64url') !== encoded) throw new Error('invalid encoding');
+    const item = JSON.parse(decoded.toString('utf8'));
+    if (typeof item.summary !== 'string' || !item.summary.trim()) throw new Error('empty summary');
+    return item.summary;
+  } catch { throw new Error('Invalid gateway compaction capsule; history was not forwarded.'); }
+}
+
+export function expandGatewayCompactions(payload) {
+  if (!Array.isArray(payload.input)) return payload;
+  let changed = false;
+  const input = payload.input.map(item => {
+    if (item?.type !== 'compaction' || !item.encrypted_content?.startsWith(COMPACTION_PREFIX)) return item;
+    changed = true;
+    return { type: 'message', role: 'user', content: [{ type: 'input_text', text: `Conversation summary from an earlier turn:\n${decodeCompaction(item.encrypted_content)}` }] };
+  });
+  return changed ? { ...payload, input } : payload;
+}
+
+export function compactionResponse(col, model, splitText = text => text) {
+  const summary = splitText(col.text.join('')).trim();
+  if (col.error || col.finish !== 'stop' || col.tools.size || !summary) {
+    throw new Error('Compaction requires a complete text summary without tool calls; upstream returned incomplete or invalid output.');
+  }
+  if (Buffer.byteLength(summary, 'utf8') > 24 * 1024) throw new Error('Compaction summary exceeds the 24 KiB limit; history was not replaced.');
+  const item = { type: 'compaction', id: `cmp_${crypto.randomUUID()}`, encrypted_content: encodeCompaction(summary) };
+  return { id: `resp_${crypto.randomUUID()}`, object: 'response', status: 'completed', model, output: [item] };
+}
+
+export async function collectCompaction(upstreamRes, format, stream, normalize, col) {
+  let messageStopped = false;
+  const add = payload => {
+    const raw = payload.response || payload;
+    const reasons = format === 'openai-chat' ? (raw.choices || []).map(c => c.finish_reason)
+      : format === 'vertex' ? (raw.candidates || []).map(c => c.finishReason)
+        : [raw.stop_reason, raw.delta?.stop_reason];
+    const accepted = format === 'openai-chat' ? ['stop'] : format === 'vertex' ? ['STOP'] : ['end_turn', 'stop_sequence'];
+    if (reasons.some(r => r && !accepted.includes(r))) throw new Error('Upstream returned an incomplete compaction summary.');
+    if (raw.type === 'message_stop') messageStopped = true;
+    col.add(normalize(payload));
+    if (col.error) throw new Error(String(col.error));
+    if (Buffer.byteLength(col.text.join(''), 'utf8') > 24 * 1024) throw new Error('Compaction summary exceeds the 24 KiB limit.');
+  };
+  if (stream) {
+    for await (const payload of readUpstreamPayloads(upstreamRes)) add(payload);
+    if (format === 'anthropic' && !messageStopped) throw new Error('Compaction stream ended before message_stop.');
+  } else add(await upstreamRes.json());
+}
+
+export function emitCompaction(response, emit) {
+  emit('response.created', { type: 'response.created', sequence_number: 0, response: { ...response, status: 'in_progress', output: [] } });
+  emit('response.output_item.done', { type: 'response.output_item.done', sequence_number: 1, output_index: 0, item: response.output[0] });
+  emit('response.completed', { type: 'response.completed', sequence_number: 2, response });
+}

package/docs/goal-check.md

@@ -0,0 +1,75 @@
+# Goal Check: Kiểm Tra Hoàn Thành Goal Bằng Jev System One
+
+**Goal Check** là cơ chế cổng kiểm soát (gatekeeper/veto) độc lập tích hợp tại `llm-switcher`. Tính năng này bảo vệ các prompt-based stopping condition evaluator của Claude Code (đặc biệt là lệnh `/goal`), ngăn chặn các phán quyết hoàn thành sai (false completion) khi chưa có đủ bằng chứng thực thi bằng tool.
+
+---
+
+## 1. Vấn đề giải quyết
+
+Trong Claude Code (v2.1.295), khi người dùng đặt `/goal`, hệ thống sử dụng một evaluator model riêng đọc transcript và trả về `{ok, reason, impossible?}`:
+- **Lỗ hổng**: Evaluator chỉ đọc văn bản và dễ bị nhầm lẫn giữa việc *sửa báo cáo* (rút finding, ghi PASS audit) với việc *sửa code thật sự*.
+- **Hệ quả**: Ngay khi evaluator trả về `ok: true`, Claude Code lập tức gỡ hook và ghi nhận `goal_status.met: true`.
+- **Giải pháp**: `llm-switcher` chặn phản hồi của evaluator trước khi gửi về client, đồng thời gọi mô hình quyết định **Jev (System One typed decision API)** trên 3 trục độc lập:
+  1. `complete`: Toàn bộ công việc theo condition đã hoàn thành thực sự (ngưỡng mặc định: $\ge 0.90$).
+  2. `evidence`: Có tool-result trực tiếp chứng minh kết quả thực thi (ngưỡng mặc định: $\ge 0.85$).
+  3. `unfinished`: Còn công việc dang dở, lỗi chưa xử lý hoặc verification thiếu (ngưỡng mặc định: $\le 0.10$).
+
+---
+
+## 2. Nguyên tắc hoạt động & Quyết định hợp nhất
+
+Gateway chỉ trả về `ok: true` khi **cả hai bên đồng thuận**:
+- Evaluator gốc của Claude Code trả về `ok: true`.
+- Jev xác nhận cả 3 điểm số đều đạt ngưỡng cấu hình và evidence không vượt kích thước tối đa.
+
+| Native Evaluator | Jev / Evidence Checks | Trả về Claude Code | Ghi chú |
+| :--- | :--- | :--- | :--- |
+| `ok: false` | Bất kỳ | `ok: false` | Giữ nguyên lý do gốc của native |
+| `ok: true` | Đạt cả 3 ngưỡng | `ok: true` | Cho phép hoàn thành lượt |
+| `ok: true` | Một trong 3 trục không đạt | `ok: false` | Veto: Nêu rõ trục vi phạm (ví dụ `complete=0.14 < 0.90`) và yêu cầu cung cấp tool evidence |
+| `ok: true` | Lỗi mạng / HTTP 5xx / timeout / thiếu key | `ok: false` | Fail-closed: Báo `Goal Check verification unavailable` |
+| `ok: true` | State vượt quá `maxStateChars` | `ok: false` | Báo `Insufficient evidence` (state quá lớn) |
+| `impossible: true` | Bất kỳ | `ok: false, impossible: true` | Giữ nguyên ngữ nghĩa thất bại của native |
+
+> **Fail-closed**: Lỗi mạng, thiếu dữ liệu hoặc lỗi cấu hình Jev **không bao giờ** biến thành phán quyết hoàn thành.
+
+---
+
+## 3. Cấu hình qua Dashboard
+
+Truy cập `# /goal-check` từ menu bên trái:
+
+1. **Enable Goal Check**: Toggle bật/tắt (Mặc định: **OFF**).
+2. **Model Provider Source**: Chọn profile có sẵn (như `intact-claude`) để kế thừa Base URL và API key, hoặc chọn *Custom Endpoint*.
+3. **Base URL**: URL nhà cung cấp Jev (ví dụ: `https://intact.louispham.qzz.io/v1`).
+4. **API Key**: Khóa truy cập (được che dạng masked khi hiển thị).
+5. **Goal Check Model**: Model ID quyết định (mặc định: `typesafe/jev-latest`).
+6. **Test Connection**: Probe thử nghiệm gửi payload quyết định mẫu nhỏ để xác minh kết nối và schema trả về.
+7. **Save Configuration**: Lưu cấu hình an toàn vào `config.json`.
+
+### Tùy chọn nâng cao (Advanced)
+- **Decision Endpoint Override**: Cho phép ghi đè đường dẫn đầy đủ tới API quyết định (mặc định: `<Base URL>/systemone`).
+- **Complete Score Threshold (`completeMin`)**: Ngưỡng hoàn thành tối thiểu (mặc định: 0.90).
+- **Evidence Score Threshold (`evidenceMin`)**: Ngưỡng bằng chứng thực thi tối thiểu (mặc định: 0.85).
+- **Unfinished Score Max (`unfinishedMax`)**: Trần công việc dang dở tối đa (mặc định: 0.10).
+- **Timeout (`timeoutMs`)**: Thời gian chờ cuộc gọi Jev (mặc định: 8000 ms).
+- **Total Gate Deadline (`totalTimeoutMs`)**: Tổng hạn ngạch thời gian của cổng (mặc định: 25000 ms).
+- **Max State Evidence Budget (`maxStateChars`)**: Giới hạn ký tự transcript gửi Jev (mặc định: 60000 ký tự).
+
+---
+
+## 4. API Endpoints
+
+Tất cả endpoint yêu cầu header `x-llm-switcher-token` (hoặc admin cookie):
+- `GET /api/goal-check`: Lấy cấu hình (đã mask key) và trạng thái kết nối.
+- `POST /api/goal-check`: Cập nhật cấu hình, lưu vào `config.json`.
+- `POST /api/goal-check/test`: Thử nghiệm kết nối tới Jev endpoint.
+- `GET /api/goal-check/logs`: Lấy danh sách ring buffer các lượt kiểm tra gần nhất.
+
+---
+
+## 5. Phạm vi & Giới hạn
+
+- **Phạm vi bảo vệ**: Áp dụng cho các prompt stop-condition hook của Claude Code (bao gồm `/goal`).
+- **Không áp dụng**: Request chat thông thường, Idle Compaction, Codex CLI, TaskUpdate/TaskCompleted.
+- **Giới hạn mô hình**: Jev là mô hình quyết định dựa trên văn bản; không tự chạy lệnh, đọc file hay xem ảnh chụp màn hình trực tiếp. Nếu task đòi hỏi bằng chứng thị giác mà không có biểu diễn text tương đương, gate sẽ đánh giá là thiếu bằng chứng.

package/formats.mjs

@@ -24,7 +24,8 @@
 // }
 // ============================================================
 
-import { sanitizeToolName } from './toolvocab.mjs';
+import { sanitizeToolName, toolNameMapForIR, rewriteToolNameMentions, rewriteToolSearchArgs } from './toolvocab.mjs';
+import { decodeCompaction, COMPACTION_INSTRUCTION } from './compaction.mjs';
 
 export const OUT_FORMATS = ['openai-chat', 'anthropic', 'vertex'];
 
@@ -466,20 +467,30 @@ function anthropicToIR(payload) {
             toolCalls.push({ id: part.id, name: part.name, args: part.input ?? {} });
           } else if (part.type === 'tool_result') {
             let resultText = '';
+            let resultParts;
+            const images = [];
             if (typeof part.content === 'string') resultText = part.content;
             else if (Array.isArray(part.content)) {
-              // Don't stuff image base64 into text (token blowup); keep only a placeholder.
-              resultText = part.content.map(c => {
+              resultParts = part.content.map(c => {
                 if (typeof c === 'string') return c;
                 if (c?.type === 'text') return c.text || '';
-                if (c?.type === 'image') return '[image omitted]';
+                if (c?.type === 'image') {
+                  const url = c.source?.type === 'base64' ? `data:${c.source.media_type || 'image/jpeg'};base64,${c.source.data}`
+                    : c.source?.type === 'url' ? c.source.url : null;
+                  if (!url) throw new Error('Unsupported image in tool result');
+                  images.push({ type: 'image_url', image_url: { url } });
+                  return '';
+                }
+                if (c?.type === 'tool_reference' && typeof c.tool_name === 'string') return c;
                 return JSON.stringify(c);
-              }).filter(Boolean).join('\n');
+              }).filter(Boolean);
+              resultText = resultParts.map(c => typeof c === 'string' ? c : JSON.stringify(c)).join('\n');
             } else if (part.content) resultText = JSON.stringify(part.content);
             if (part.is_error && !resultText.toLowerCase().startsWith('error')) {
               resultText = `[Tool Error] ${resultText}`;
             }
-            ir.messages.push({ role: 'tool', toolCallId: part.tool_use_id, content: resultText || '(empty tool output)' });
+            ir.messages.push({ role: 'tool', toolCallId: part.tool_use_id, content: resultText || '(empty tool output)', ...(images.length ? { images } : {}),
+              ...(resultParts?.some(c => typeof c === 'object') ? { toolResultParts: resultParts, toolResultIsError: Boolean(part.is_error) } : {}) });
           }
         }
         const out = { role: msg.role };
@@ -500,6 +511,7 @@ function anthropicToIR(payload) {
       .filter(t => t && t.name)
       .map(t => ({
         name: t.name, description: t.description || '',
+        ...(typeof t.strict === 'boolean' ? { strict: t.strict } : {}),
         parameters: sanitizeJsonSchema(t.input_schema || {}),
         // A client tool is `{"name","input_schema"}`, optionally typed "custom". A dated type is a
         // server tool: Anthropic runs it, its result reaches the caller without the caller executing
@@ -645,7 +657,7 @@ function responsesOutputToText(out) {
 }
 
 // OpenAI Responses API (Codex) -> IR.
-function responsesToIR(payload) {
+function responsesToIR(payload, { allowOpaqueCompaction = false } = {}) {
   const ir = baseIR();
   ir.model = payload.model || '';
   ir.stream = payload.stream === true;
@@ -720,6 +732,13 @@ function responsesToIR(payload) {
         ir.messages.push({ role: 'tool', toolCallId: item.call_id || item.id, content: responsesOutputToText(item.output) });
       } else if (item.type === 'additional_tools' && Array.isArray(item.tools)) {
         toolList.push(...item.tools);
+      } else if (item.type === 'compaction') {
+        if (allowOpaqueCompaction && !item.encrypted_content?.startsWith('llm-gateway-compact-v1:')) { ir.opaqueCompaction = true; continue; }
+        pushText('user', `Conversation summary from an earlier turn:\n${decodeCompaction(item.encrypted_content)}`);
+      } else if (item.type === 'compaction_trigger') {
+        if (item !== input.at(-1)) throw new Error('compaction_trigger must be the last input item');
+        ir.compaction = true;
+        pushText('user', COMPACTION_INSTRUCTION);
       }
     }
   }
@@ -737,7 +756,7 @@ function responsesToIR(payload) {
       }
       if (t.type === 'function' && t.name) {
         const name = responsesToolName(namespace, t.name);
-        ir.tools.push({ name, description: t.description || '', parameters: sanitizeJsonSchema(t.parameters || {}) });
+        ir.tools.push({ name, description: t.description || '', parameters: sanitizeJsonSchema(t.parameters || {}), ...(typeof t.strict === 'boolean' ? { strict: t.strict } : {}) });
         ir.toolMeta[name] = { kind: 'function', name: t.name, namespace: namespace || null };
       } else if (t.type === 'custom' && t.name) {
         const name = responsesToolName(namespace, t.name);
@@ -769,6 +788,7 @@ function responsesToIR(payload) {
     ir.thinking = thinkingFromReasoningParam(payload.reasoning);
   }
   ir.responseFormat = responseFormatIR(payload.text?.format);
+  if (ir.compaction) { ir.tools = []; ir.toolChoice = 'none'; ir.responseFormat = null; }
   return ir;
 }
 
@@ -871,10 +891,10 @@ function lowerSchemaTypes(schema) {
 // that reaches here anyway is an error, never a silent fallback to another protocol (a different
 // API key!). The UPSTREAM formats are a different axis: emitUpstreamBody still speaks openai-chat,
 // anthropic and vertex to whatever provider the profile points at.
-function parseToIR(clientFormat, payload) {
+function parseToIR(clientFormat, payload, opts = {}) {
   switch (clientFormat) {
     case 'anthropic': return anthropicToIR(payload);
-    case 'responses': return responsesToIR(payload);
+    case 'responses': return responsesToIR(payload, opts);
     case 'codeassist': return codeAssistToIR(payload);
     default: throw new Error(`Unsupported input format: ${clientFormat}. Only anthropic (Claude Code), responses (Codex) and codeassist (agy) accept requests.`);
   }
@@ -909,16 +929,45 @@ function repairToolCall(tc, vocab) {
 //
 // Nothing is said about a tool fewer than two, because one tool has no other name to be confused
 // with, and nothing about a tool the provider runs, because the caller never executes those.
-function toolNamesNotice(ir, systemText) {
+function toolNamesNotice(ir, systemText, toolName = sanitizeToolName) {
   const names = (ir.tools || [])
     .filter(t => t && typeof t.name === 'string' && t.name && t.side !== 'provider')
-    .map(t => sanitizeToolName(t.name));
+    .map(t => toolName(t.name));
   if (names.length < 2) return '';
   const missing = names.filter(n => !String(systemText || '').includes(n));
   if (!missing.length) return '';
   return `When you call a tool, use exactly these names and do not substitute another: ${missing.join(', ')}.`;
 }
 
+// ToolSearch references and tool instructions must use the vocabulary declared upstream.
+// Keep the IR and user/tool data intact; only structured references and ToolSearch queries move.
+function withUpstreamToolNames(ir, names) {
+  const declared = new Map(clientTools(ir).map(t => [t.name, names.name(t.name)]));
+  const mention = text => rewriteToolNameMentions(text, declared);
+  return {
+    ...ir,
+    system: mention(ir.system),
+    tools: (ir.tools || []).map(t => t.side === 'provider' ? t : { ...t, description: mention(t.description) }),
+    messages: (ir.messages || []).map(m => {
+      const out = { ...m };
+      if (m.toolResultParts) {
+        let content = m.toolResultParts.map(c => typeof c === 'string' ? c
+          : JSON.stringify({ ...c, tool_name: declared.get(c.tool_name) || c.tool_name })).join('\n');
+        if (m.toolResultIsError && !content.toLowerCase().startsWith('error')) content = `[Tool Error] ${content}`;
+        out.content = content;
+      }
+      if (m.toolCalls) out.toolCalls = m.toolCalls.map(tc => {
+        if (tc.name !== 'ToolSearch') return tc;
+        let args;
+        try { args = typeof tc.args === 'string' ? JSON.parse(tc.args) : tc.args; } catch { return tc; }
+        const translated = rewriteToolSearchArgs(tc.name, args, declared);
+        return translated === args ? tc : { ...tc, args: typeof tc.args === 'string' ? JSON.stringify(translated) : translated };
+      });
+      return out;
+    })
+  };
+}
+
 function hasNativeReasoning(model) {
   // model IDs change often, but all current Opus variants support reasoning.
   const m = String(model || '').toLowerCase();
@@ -948,7 +997,8 @@ function healToolPairs(messages) {
 
   const orphanText = (m) => ({
     role: 'user',
-    content: `[Tool Result${m.toolCallId ? ` (${m.toolCallId})` : ''}]: ${m.content ?? ''}`
+    content: m.images?.length ? [{ type: 'text', text: `[Tool Result${m.toolCallId ? ` (${m.toolCallId})` : ''}]: ${m.content ?? ''}` }, ...m.images]
+      : `[Tool Result${m.toolCallId ? ` (${m.toolCallId})` : ''}]: ${m.content ?? ''}`
   });
   const flush = () => {
     if (pending) {
@@ -1023,7 +1073,12 @@ function normThinkingEffort(effort) {
 //             the client requests thinking, don't touch the system prompt, use `max_completion_tokens`.
 //  - 'off'    : never send reasoning params, never inject prompts.
 function irToChatBody(ir, model, opts = {}) {
+  const names = toolNameMapForIR(ir);
+  const toolName = names.name;
+  ir = withUpstreamToolNames(ir, names);
   const messages = [];
+  const pendingImages = [];
+  const flushImages = () => { if (pendingImages.length) messages.push({ role: 'user', content: pendingImages.splice(0) }); };
   const mode = normThinkingMode(opts.thinkingMode);
   const clientWantsThinking = Boolean(ir.thinking && ir.thinking.type !== 'disabled');
   const modelIsThinking = hasNativeReasoning(model);
@@ -1044,20 +1099,22 @@ function irToChatBody(ir, model, opts = {}) {
   // its tools in its system prompt (Claude Code does, at length) gets nothing at all, so there is no
   // second list for the model to weigh against the first; a client with no such prompt gets the
   // whole list. Fewer tools than two cannot be confused with each other, so nothing is said.
-  const toolNotice = mode === 'auto' ? toolNamesNotice(ir, systemText) : '';
+  const toolNotice = mode === 'auto' ? toolNamesNotice(ir, systemText, toolName) : '';
   if (toolNotice) systemText = systemText ? `${systemText}\n\n${toolNotice}` : toolNotice;
   if (systemText.trim()) messages.push({ role: 'system', content: systemText });
 
   for (const m of healToolPairs(ir.messages)) {
     if (m.role === 'tool') {
       messages.push({ role: 'tool', tool_call_id: m.toolCallId, content: m.content ?? '' });
+      if (m.images?.length) pendingImages.push({ type: 'text', text: `Images returned by tool call ${m.toolCallId}:` }, ...m.images);
       continue;
     }
+    flushImages();
     const out = { role: m.role === 'assistant' ? 'assistant' : 'user' };
     if (m.content !== undefined) out.content = m.content;
     if (m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length) {
       out.tool_calls = m.toolCalls.map(tc => {
-        const call = { id: tc.id, type: 'function', function: { name: sanitizeToolName(tc.name), arguments: stringifyArgs(tc.args) } };
+        const call = { id: tc.id, type: 'function', function: { name: toolName(tc.name), arguments: stringifyArgs(tc.args) } };
         const sig = tc.sig || lookupToolSignature(tc.id);
         if (sig) call.extra_content = { google: { thought_signature: sig } };
         return call;
@@ -1067,6 +1124,7 @@ function irToChatBody(ir, model, opts = {}) {
     if (out.content === undefined) out.content = '';
     messages.push(out);
   }
+  flushImages();
 
   const body = { model, messages, stream: ir.stream === true };
   if (body.stream) body.stream_options = { include_usage: true };
@@ -1074,14 +1132,14 @@ function irToChatBody(ir, model, opts = {}) {
   if (tools.length) {
     body.tools = tools.map(t => ({
       type: 'function',
-      function: { name: sanitizeToolName(t.name), description: t.description || '', parameters: sanitizeJsonSchema(t.parameters || {}) }
+      function: { name: toolName(t.name), description: t.description || '', parameters: sanitizeJsonSchema(t.parameters || {}), ...(typeof t.strict === 'boolean' ? { strict: t.strict } : {}) }
     }));
   }
   if (ir.toolChoice) {
     if (typeof ir.toolChoice === 'string') {
       body.tool_choice = ir.toolChoice === 'required' ? 'required' : ir.toolChoice;
     } else if (ir.toolChoice.name) {
-      body.tool_choice = { type: 'function', function: { name: sanitizeToolName(ir.toolChoice.name) } };
+      body.tool_choice = { type: 'function', function: { name: toolName(ir.toolChoice.name) } };
     }
   }
   if (typeof ir.params.maxTokens === 'number') {
@@ -1165,20 +1223,24 @@ function contentToAnthropicBlocks(c) {
 
 // IR -> Anthropic Messages body.
 function irToAnthropicBody(ir, model, opts = {}) {
+  const names = toolNameMapForIR(ir);
+  const toolName = names.name;
+  ir = withUpstreamToolNames(ir, names);
   const messages = [];
 
   for (const m of healToolPairs(ir.messages)) {
     if (m.role === 'tool') {
       messages.push({
         role: 'user',
-        content: [{ type: 'tool_result', tool_use_id: m.toolCallId, content: m.content ?? '' }]
+        content: [{ type: 'tool_result', tool_use_id: m.toolCallId,
+          content: m.images?.length ? [...contentToAnthropicBlocks(m.content), ...contentToAnthropicBlocks(m.images)] : m.content ?? '' }]
       });
       continue;
     }
     if (m.role === 'assistant') {
       const blocks = contentToAnthropicBlocks(m.content).filter(b => b.type === 'text');
       for (const tc of (m.toolCalls || [])) {
-        blocks.push({ type: 'tool_use', id: tc.id, name: sanitizeToolName(tc.name), input: parseArgs(tc.args) });
+        blocks.push({ type: 'tool_use', id: tc.id, name: toolName(tc.name), input: parseArgs(tc.args) });
       }
       if (blocks.length) messages.push({ role: 'assistant', content: blocks });
       continue;
@@ -1222,15 +1284,15 @@ function irToAnthropicBody(ir, model, opts = {}) {
   const anthropicTools = clientTools(ir);
   if (anthropicTools.length) {
     body.tools = anthropicTools.map(t => ({
-      name: sanitizeToolName(t.name), description: t.description || '',
-      input_schema: sanitizeJsonSchema(t.parameters || {})
+      name: toolName(t.name), description: t.description || '',
+      input_schema: sanitizeJsonSchema(t.parameters || {}), ...(typeof t.strict === 'boolean' ? { strict: t.strict } : {})
     }));
   }
   if (ir.toolChoice) {
     if (typeof ir.toolChoice === 'string') {
       body.tool_choice = ir.toolChoice === 'required' ? { type: 'any' } : { type: ir.toolChoice };
     } else if (ir.toolChoice.name) {
-      body.tool_choice = { type: 'tool', name: sanitizeToolName(ir.toolChoice.name) };
+      body.tool_choice = { type: 'tool', name: toolName(ir.toolChoice.name) };
     }
   }
   if (ir.params.parallelToolCalls === false && body.tool_choice) body.tool_choice.disable_parallel_tool_use = true;
@@ -1286,7 +1348,12 @@ function dataUrlToInlineData(url) {
 
 // IR -> Vertex generateContent body.
 function irToVertexBody(ir, model, opts = {}) {
+  const names = toolNameMapForIR(ir, { allowHyphens: false });
+  const toolName = names.name;
+  ir = withUpstreamToolNames(ir, names);
   const contents = [];
+  const pendingImages = [];
+  const flushImages = () => { if (pendingImages.length) push('user', pendingImages.splice(0)); };
   const textPartsOf = (c) => {
     if (typeof c === 'string') return c ? [{ text: c }] : [];
     if (Array.isArray(c)) {
@@ -1295,7 +1362,8 @@ function irToVertexBody(ir, model, opts = {}) {
         if (p.type === 'text' && p.text) parts.push({ text: p.text });
         else if (p.type === 'image_url') {
           const inline = dataUrlToInlineData(p.image_url?.url);
-          if (inline) parts.push(inline);
+          if (!inline) throw new Error('Vertex image conversion requires a base64 data URL; remote image URLs are not supported on this route.');
+          parts.push(inline);
         }
       }
       return parts;
@@ -1329,13 +1397,15 @@ function irToVertexBody(ir, model, opts = {}) {
         resp = (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) ? parsed : { result: parsed ?? '' };
       } catch { resp = { result: m.content ?? '' }; }
       // Gemini API & Vertex only accept roles 'user' | 'model' (functionResponse lives in the 'user' role).
-      push('user', [{ functionResponse: { name: sanitizeToolName(m.name || 'tool', { allowHyphens: false }), response: resp } }]);
+      push('user', [{ functionResponse: { name: toolName(m.name || 'tool'), response: resp } }]);
+      if (m.images?.length) pendingImages.push({ text: `Images returned by tool call ${m.toolCallId}:` }, ...textPartsOf(m.images));
       continue;
     }
+    flushImages();
     if (m.role === 'assistant') {
       const parts = textPartsOf(m.content).filter(p => p.text);
       (m.toolCalls || []).forEach((tc, j) => {
-        const part = { functionCall: { name: sanitizeToolName(tc.name, { allowHyphens: false }), args: parseArgs(tc.args) } };
+        const part = { functionCall: { name: toolName(tc.name), args: parseArgs(tc.args) } };
         const sig = tc.sig || lookupToolSignature(tc.id);
         if (sig) part.thoughtSignature = sig;
         // Only the first functionCall of each step in the current turn is checked.
@@ -1347,6 +1417,7 @@ function irToVertexBody(ir, model, opts = {}) {
     }
     push('user', textPartsOf(m.content));
   }
+  flushImages();
 
   const body = { contents };
   if (ir.system && ir.system.trim()) {
@@ -1356,7 +1427,7 @@ function irToVertexBody(ir, model, opts = {}) {
   if (vertexTools.length) {
     body.tools = [{
       functionDeclarations: vertexTools.map(t => ({
-        name: sanitizeToolName(t.name, { allowHyphens: false }), description: t.description || '',
+        name: toolName(t.name), description: t.description || '',
         parameters: toGeminiSchema(t.parameters || { type: 'object', properties: {} })
       }))
     }];
@@ -1364,7 +1435,7 @@ function irToVertexBody(ir, model, opts = {}) {
   if (ir.toolChoice) {
     const mode = ir.toolChoice === 'none' ? 'NONE' : ir.toolChoice === 'auto' ? 'AUTO' : 'ANY';
     const fcc = { mode };
-    if (typeof ir.toolChoice === 'object' && ir.toolChoice.name) fcc.allowedFunctionNames = [sanitizeToolName(ir.toolChoice.name, { allowHyphens: false })];
+    if (typeof ir.toolChoice === 'object' && ir.toolChoice.name) fcc.allowedFunctionNames = [toolName(ir.toolChoice.name)];
     if (body.tools) body.toolConfig = { functionCallingConfig: fcc };
   }
   const gc = {};
@@ -2017,6 +2088,7 @@ function createAnthropicStream(emit, model, opts = {}) {
   // the block is never closed with arguments still pending and never has two deltas fighting over it.
   function flushBuffered(st) {
     if (!st.buffered) return;
+    if (st.held && vocab) st.buffered = vocab.args(st.name, st.buffered);
     emit('content_block_delta', {
       type: 'content_block_delta', index: st.index,
       delta: { type: 'input_json_delta', partial_json: st.buffered }
@@ -2076,8 +2148,8 @@ function createAnthropicStream(emit, model, opts = {}) {
         const isShort = Boolean(vocab && typeof vocab.isShortened === 'function' && vocab.isShortened(tc.name));
         st = {
           index: nextIndex++, id: tc.id || `toolu_${rand(24)}`, name: fixed || 'tool', closed: false,
-          // Only a renamed name needs the arguments held back. Shortened names use caller's schema.
-          buffered: '', held: Boolean(vocab && fixed && fixed !== tc.name && !isShort)
+          // Shortened names keep caller's schema; ToolSearch query aliases still need restoring.
+          buffered: '', held: Boolean(vocab && ((fixed && fixed !== tc.name && !isShort) || vocab.needsArgsRewrite?.(tc.name)))
         };
         tools.set(key, st);
         emit('content_block_start', {
@@ -2167,9 +2239,10 @@ function createChatStream(emit, model, opts = {}) {
   };
   // Chat has no rule about which block a delta belongs to, so held arguments go out at the end of the
   // turn. A key can only be renamed once the whole object exists.
-  const flushHeld = () => {
+  const flushHeld = (only) => {
     for (const st of seenTools.values()) {
-      if (!st.held) continue;
+      if (!st.held || (only && only !== st)) continue;
+      if (vocab) st.buffered = vocab.args(st.name, st.buffered);
       chunk([{ index: 0, delta: { tool_calls: [{ index: st.idx, function: { arguments: st.buffered } }] }, finish_reason: null }]);
       st.held = false;
       st.buffered = '';
@@ -2190,7 +2263,7 @@ function createChatStream(emit, model, opts = {}) {
       if (!seenTools.has(idx)) {
         const name = vocab ? vocab.name(tc.name) : tc.name;
         const isShort = Boolean(vocab && typeof vocab.isShortened === 'function' && vocab.isShortened(tc.name));
-        seenTools.set(idx, { idx, name, buffered: '', held: Boolean(vocab && name && name !== tc.name && !isShort) });
+        seenTools.set(idx, { idx, name, buffered: '', held: Boolean(vocab && ((name && name !== tc.name && !isShort) || vocab.needsArgsRewrite?.(tc.name))) });
         chunk([{ index: 0, delta: { tool_calls: [{ index: idx, id: tc.id || `call_${rand(24)}`, type: 'function', function: { name: name || 'tool', arguments: '' } }] }, finish_reason: null }]);
       }
       const st = seenTools.get(idx);
@@ -2203,8 +2276,7 @@ function createChatStream(emit, model, opts = {}) {
       const repaired = vocab.args(st.name, st.buffered);
       if (repaired !== st.buffered) {
         st.buffered = repaired;
-        st.held = false;
-        flushHeld();
+        flushHeld(st);
       }
     },
     finish(canonical, stats = {}) {
@@ -2402,7 +2474,7 @@ function createResponsesStream(emit, model, opts = {}) {
         st = {
           id: `${prefix}_${rand(24)}`, callId: tc.id || `call_${rand(24)}`, index: nextOutput++,
           name: name || '', args: '', done: false, kind, upstream: tc.name,
-          held: Boolean(vocab && name && name !== tc.name && !isShort)
+          held: Boolean(vocab && ((name && name !== tc.name && !isShort) || vocab.needsArgsRewrite?.(tc.name)))
         };
         tools.set(key, st);
         if (kind !== 'local_shell') {