mixdog 0.9.1 → 0.9.3

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -1,12 +1,28 @@
 import {
     PROVIDER_FIRST_BYTE_TIMEOUT_MS,
-    PROVIDER_SSE_IDLE_TIMEOUT_MS,
     PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    streamStalledError,
     createTimeoutSignal,
     providerTimeoutError,
 } from '../stall-policy.mjs';
 import { populateHttpStatusFromMessage } from './retry-classifier.mjs';
 import { customToolCallFromResponseItem } from './custom-tool-wire.mjs';
+import { createLeakGuard, createToolCallDedupe, dedupeToolCallList } from './anthropic-leaked-toolcall.mjs';
+import { randomBytes } from 'crypto';
+
+// Synthesize a native-shaped OpenAI tool call from a recovered leaked call.
+// Matches the `call_...` id scheme the native Responses/Chat paths use so the
+// dispatch loop and any downstream tool_result reference line up.
+function synthLeakedOpenAICall(recovered) {
+    let args = recovered?.arguments;
+    if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+    return {
+        id: `call_leaked_${randomBytes(8).toString('hex')}`,
+        name: recovered.name,
+        arguments: args,
+    };
+}
 
 function truncatedCompatStreamError(label, detail) {
     return Object.assign(
@@ -15,8 +31,7 @@ function truncatedCompatStreamError(label, detail) {
     );
 }
 
-// Invalid-tool-args marker. Native-provider convergence (openai-oauth /
-// opencode): completed-but-malformed tool_call arguments JSON must NOT throw
+// Invalid-tool-args marker: completed-but-malformed tool_call arguments JSON must NOT throw
 // (kills the turn) NOR be silently swallowed to `{}`. Instead the parse
 // failure is carried as data on the tool call's `arguments` slot so the
 // dispatch loop can turn it into an is_error tool_result and let the model
@@ -33,8 +48,7 @@ export function isInvalidToolArgsMarker(value) {
     return !!value && typeof value === 'object' && value.__invalidToolArgs === true;
 }
 /** Model-facing tool_result text for a tool call whose arguments failed to
- * parse. Mirrors opencode `The arguments provided to the tool are invalid` and
- * `failed to parse function arguments` — instructs an in-turn retry. */
+ * parse; instructs the model to retry with valid JSON in the same turn. */
 export function formatInvalidToolArgsResult(call) {
     const name = call?.name || 'tool';
     const detail = call?.arguments?.__parseError || 'arguments were not valid JSON';
@@ -69,9 +83,9 @@ export function parseCompletedToolCallArgumentsJson(raw, label, meta) {
         // Invariant: a completion/finish signal was observed for this tool call
         // (finish_reason present, or a per-call/response "done" event fired), so
         // the arguments are NOT mid-stream-truncated — they are complete but
-        // malformed. Native convergence: return an invalid-args MARKER (not a
-        // throw) so the dispatch loop feeds the parse error back to the model as
-        // a tool_result and the model self-corrects in the same turn. Only an
+        // malformed. Return an invalid-args MARKER (not a throw) so the
+        // dispatch loop feeds the parse error back to the model as a
+        // tool_result and the model self-corrects in the same turn. Only an
         // unfinished stream (no finishReason) stays the retryable truncation
         // case — that transient behavior is deliberately preserved.
         if (meta?.finishReason) {
@@ -87,17 +101,29 @@ function firstByteCompatStreamError(label) {
     return err;
 }
 
-async function nextAsyncWithWatchdog(iterator, { signal, idleMs, idleEnabled, idleLabel } = {}) {
+async function nextAsyncWithWatchdog(iterator, { signal, idleMs, idleEnabled, idleLabel, emittedToolCall } = {}) {
     let idleTimer = null;
     let idleReject = null;
     let idleTimedOut = false;
+    // Double-dispatch guard (reviewer High): if a tool call was already emitted
+    // this stream, a stall must be unsafe-to-retry so withRetry() won't replay
+    // the turn and re-run the side-effecting tool. `emittedToolCall` may be a
+    // boolean or a getter evaluated at abort time (state mutates mid-stream).
+    const didEmitToolCall = () => {
+        try { return typeof emittedToolCall === 'function' ? !!emittedToolCall() : !!emittedToolCall; }
+        catch { return false; }
+    };
     const armIdle = () => {
         if (!idleEnabled || !(idleMs > 0)) return;
         if (idleTimer) clearTimeout(idleTimer);
         idleTimer = setTimeout(() => {
             idleTimedOut = true;
-            const e = providerTimeoutError(idleLabel || 'compat SSE idle', idleMs);
-            e.code = 'ETIMEDOUT';
+            // SEMANTIC idle abort: this timer is (re)armed only around waiting
+            // for the NEXT stream event, so keepalive/comment frames the SDK
+            // filters out cannot keep it alive. Throw the named terminal
+            // StreamStalledError so the retry-classifier treats it as a stream
+            // failure (owner gets notified) rather than a user cancel.
+            const e = streamStalledError(idleLabel || 'compat SSE', idleMs, { emittedToolCall: didEmitToolCall() });
             if (idleReject) {
                 const r = idleReject;
                 idleReject = null;
@@ -143,7 +169,7 @@ async function nextAsyncWithWatchdog(iterator, { signal, idleMs, idleEnabled, id
         return result;
     } catch (err) {
         if (idleTimer) clearTimeout(idleTimer);
-        if (idleTimedOut) throw providerTimeoutError(idleLabel || 'compat SSE idle', idleMs);
+        if (idleTimedOut) throw streamStalledError(idleLabel || 'compat SSE', idleMs, { emittedToolCall: didEmitToolCall() });
         throw err;
     }
 }
@@ -213,6 +239,15 @@ function emitCompatToolCallOnce(state, call, onToolCall) {
     const key = `id:${call.id}`;
     if (!state.emittedToolCallKeys) state.emittedToolCallKeys = new Set();
     if (state.emittedToolCallKeys.has(key)) return false;
+    // Fix 2: cross-path name+args dedupe. A synthesized text-leaked call and an
+    // identical native tool_call must fire onToolCall exactly once. state._toolDedupe
+    // is created per stream; when absent (older callers) behavior is unchanged.
+    if (state._toolDedupe && !state._toolDedupe.shouldDispatch(call.name, call.arguments)) {
+        // Still mark the id as emitted so later id-frames for the same native
+        // call don't retry, but do NOT invoke onToolCall (already dispatched).
+        state.emittedToolCallKeys.add(key);
+        return false;
+    }
     state.emittedToolCallKeys.add(key);
     state.emittedToolCall = true;
     const { _pendingItemId, ...cleanCall } = call;
@@ -257,11 +292,14 @@ function isMaxOutputIncompleteReason(reason) {
     return /^(?:max_output_tokens|max_tokens|length|output_token_limit)$/i.test(String(reason || '').trim());
 }
 
-export async function consumeCompatChatCompletionStream(stream, { signal, label, onStreamDelta, onToolCall, onTextDelta, parseToolCalls } = {}) {
+export async function consumeCompatChatCompletionStream(stream, { signal, label, onStreamDelta, onToolCall, onTextDelta, parseToolCalls, knownToolNames } = {}) {
     const iterator = stream[Symbol.asyncIterator]();
     const firstByteTimeout = createTimeoutSignal(signal, PROVIDER_FIRST_BYTE_TIMEOUT_MS, `${label} first byte`);
     const idleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED;
-    const idleMs = PROVIDER_SSE_IDLE_TIMEOUT_MS;
+    // Per-event (last-event-relative) SEMANTIC idle: nextAsyncWithWatchdog arms
+    // the timer only while awaiting the NEXT stream event, so a stream that
+    // emits some deltas then goes silent trips it within the window.
+    const idleMs = PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
     let sawFirstEvent = false;
     let content = '';
     let reasoningContent = '';
@@ -276,6 +314,46 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
     let rawUsage = null;
     const toolAcc = new Map();
     const toolBucketState = { _orderSeq: 0, _nextAnonId: 0, _lastAnonKey: null };
+    // Fix 2: one dedupe per stream, shared by the synthetic leaked-call
+    // dispatch and every native emit so an identical (name,args) fires once.
+    const _toolDedupe = createToolCallDedupe();
+    // Leaked tool-call guard: the model sometimes emits a tool call as plain
+    // text (XML `<invoke>`/`<function_calls>` or gpt-oss harmony
+    // `<|channel|>...to=functions.NAME...<|call|>`) inside `delta.content`
+    // instead of a native `tool_calls` delta. Route content through the guard
+    // so leaked calls are suppressed from visible text, synthesized, and
+    // dispatched like native calls. Additive: the native tool_calls path is
+    // untouched. Harmony detection is opt-in here (gpt-oss compat backends).
+    const leakGuard = createLeakGuard({ knownToolNames, harmony: true });
+    const dispatchLeakedCall = (recovered) => {
+        const call = synthLeakedOpenAICall(recovered);
+        const emitState = { emittedToolCallKeys: new Set(), _toolDedupe };
+        emitCompatToolCallOnce(emitState, call, onToolCall);
+        return call;
+    };
+    const leakedCalls = [];
+    const relayText = (delta) => {
+        const { text, calls } = leakGuard.push(delta);
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) leakedCalls.push(dispatchLeakedCall(c));
+    };
+    const flushLeak = () => {
+        const { text, calls } = leakGuard.flush();
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) leakedCalls.push(dispatchLeakedCall(c));
+    };
     try {
         while (true) {
             const { value: chunk, done } = await nextAsyncWithWatchdog(iterator, {
@@ -285,6 +363,9 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
                 idleMs,
                 idleEnabled: sawFirstEvent && idleEnabled,
                 idleLabel: `${label} SSE idle`,
+                // A stall after a tool call has already been dispatched (native
+                // or recovered-leaked) must be unsafe-to-retry (no double-run).
+                emittedToolCall: () => leakedCalls.length > 0 || toolAcc.size > 0,
             });
             if (done) break;
             if (!sawFirstEvent) {
@@ -296,12 +377,18 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
             if (chunk?.model) model = chunk.model;
             const choice = chunk?.choices?.[0];
             if (choice?.delta?.content) {
-                content += choice.delta.content;
-                // Live text relay (gateway): explicit assistant text delta.
+                // Live text relay (gateway): explicit assistant text delta,
+                // routed through the leaked-tool-call guard (which appends to
+                // `content`, forwards visible text, and recovers leaked calls).
                 // reasoning_content + tool_calls deltas stay off this path.
-                if (onTextDelta) {
-                    emittedText = true;
-                    try { onTextDelta(choice.delta.content); } catch {}
+                if (leakGuard.enabled) {
+                    relayText(choice.delta.content);
+                } else {
+                    content += choice.delta.content;
+                    if (onTextDelta) {
+                        emittedText = true;
+                        try { onTextDelta(choice.delta.content); } catch {}
+                    }
                 }
             }
             if (typeof choice?.delta?.reasoning_content === 'string') {
@@ -311,9 +398,23 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
             if (choice?.finish_reason) stopReason = choice.finish_reason;
             if (chunk?.usage) rawUsage = chunk.usage;
         }
+        // Flush any partial-sentinel tail held back mid-stream so legitimate
+        // trailing text is never lost.
+        if (leakGuard.enabled) flushLeak();
     } catch (err) {
         // Any mid-stream failure after live text was relayed is non-retryable.
         if (emittedText) throw markErrorLiveTextEmitted(err);
+        // Partial-final recovery: on a mid-stream stall, attach the
+        // streamed partial state so the loop can accept a wedged FINAL no-tool
+        // summary as partial-final success. pendingToolUse gates out any
+        // in-flight/emitted tool call.
+        if (err?.streamStalled === true) {
+            try {
+                err.partialContent = content;
+                err.pendingToolUse = toolAcc.size > 0 || leakedCalls.length > 0;
+                err.partialModel = model || undefined;
+            } catch { /* best-effort */ }
+        }
         throw err;
     } finally {
         firstByteTimeout.cleanup();
@@ -356,9 +457,18 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
         throw err;
     }
     if (Array.isArray(toolCalls) && toolCalls.length) {
-        const emitState = { emittedToolCallKeys: new Set() };
+        const emitState = { emittedToolCallKeys: new Set(), _toolDedupe };
         for (const call of toolCalls) emitCompatToolCallOnce(emitState, call, onToolCall);
     }
+    // Fold recovered leaked calls into the returned toolCalls so the dispatch
+    // loop treats them exactly like native ones. They were already emitted via
+    // onToolCall in relayText/flushLeak, so no re-dispatch here. Dedupe the
+    // final array by name+args (Fix 2, array side): a synthetic leaked call and
+    // an identical native tool_call must not both remain, else the loop runs
+    // the side-effecting tool twice.
+    if (leakedCalls.length) {
+        toolCalls = dedupeToolCallList([...(Array.isArray(toolCalls) ? toolCalls : []), ...leakedCalls]);
+    }
     return {
         response,
         model,
@@ -370,18 +480,21 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
     };
 }
 
-function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta }) {
+function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta, relayLeakText }) {
     if (!event || typeof event.type !== 'string') return;
     const pushToolSearchCall = (item) => {
         if (!item || item.type !== 'tool_search_call') return;
         const callId = item.call_id || item.id || '';
         if (!callId || state.toolCalls.some((call) => call.id === callId)) return;
+        const _tsArgs = item.arguments && typeof item.arguments === 'object' && !Array.isArray(item.arguments)
+            ? item.arguments
+            : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: callId, name: 'tool_search', finishReason: 'done' });
         const call = {
             id: callId,
             name: 'tool_search',
-            arguments: item.arguments && typeof item.arguments === 'object'
-                ? item.arguments
-                : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: callId, name: 'tool_search', finishReason: 'done' }),
+            // Schema is a plain object ({query,select,limit}); an array must
+            // never pass through as args.
+            arguments: (_tsArgs && typeof _tsArgs === 'object' && !Array.isArray(_tsArgs)) ? _tsArgs : {},
             nativeType: 'tool_search_call',
         };
         state.toolCalls.push(call);
@@ -399,12 +512,17 @@ function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesT
             if (event.response?.id) state.responseId = event.response.id;
             break;
         case 'response.output_text.delta':
-            state.content += event.delta || '';
             state.sawOutput = true;
             try { onStreamDelta?.(); } catch {}
-            if (event.delta && onTextDelta) {
-                state.emittedText = true;
-                try { onTextDelta(event.delta); } catch {}
+            // Route assistant text through the leaked-tool-call guard (appends
+            // to state.content, forwards visible text, recovers leaked calls).
+            if (relayLeakText) relayLeakText(event.delta || '');
+            else {
+                state.content += event.delta || '';
+                if (event.delta && onTextDelta) {
+                    state.emittedText = true;
+                    try { onTextDelta(event.delta); } catch {}
+                }
             }
             break;
         case 'response.output_item.added':
@@ -413,13 +531,29 @@ function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesT
                     name: event.item.name || '',
                     callId: event.item.call_id || '',
                 });
+                state.toolInFlight = true;
+            } else if (event.item?.type === 'custom_tool_call') {
+                state.toolInFlight = true;
+            } else if (event.item?.type === 'tool_search_call') {
+                // Mark tool_search in-flight at item-added time, same as
+                // function_call/custom_tool_call above, so the stall-recovery
+                // pendingToolUse gate never drops a mid-flight tool_search
+                // before response.output_item.done pushes it.
+                state.toolInFlight = true;
             }
             try { onStreamDelta?.(); } catch {}
             break;
         case 'response.function_call_arguments.delta':
+            // A tool call's args are streaming — mark tool work in-flight so a
+            // mid-args stall is NEVER accepted as a text-only partial-final.
+            state.toolInFlight = true;
             try { onStreamDelta?.(); } catch {}
             break;
         case 'response.custom_tool_call_input.delta':
+            // Custom-tool input streams before output_item.done records the call
+            // in pendingCalls; flag it so a mid-input stall gates out partial-
+            // final success (otherwise a tool-bearing turn looks text-only).
+            state.toolInFlight = true;
             try { onStreamDelta?.(); } catch {}
             break;
         case 'response.function_call_arguments.done': {
@@ -555,11 +689,13 @@ export async function consumeCompatResponsesStream(stream, {
     onTextDelta,
     parseResponsesToolCalls,
     responseOutputText,
+    knownToolNames,
 } = {}) {
     const iterator = stream[Symbol.asyncIterator]();
     const firstByteTimeout = createTimeoutSignal(signal, PROVIDER_FIRST_BYTE_TIMEOUT_MS, `${label} first byte`);
     const idleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED;
-    const idleMs = PROVIDER_SSE_IDLE_TIMEOUT_MS;
+    // Per-event (last-event-relative) SEMANTIC idle — see the Chat path note.
+    const idleMs = PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
     const state = {
         content: '',
         model: '',
@@ -572,13 +708,51 @@ export async function consumeCompatResponsesStream(stream, {
         completed: false,
         completedResponse: null,
         sawOutput: false,
+        // Fix 2: cross-path name+args dedupe shared by synthetic leaked-call
+        // dispatch and every native emit in this Responses stream.
+        _toolDedupe: createToolCallDedupe(),
         // Gateway live-text relay invariant: set once a non-empty text chunk
         // has been forwarded. A later failure is non-retryable (rendered text
         // cannot be withdrawn; a retry would concatenate attempts).
         emittedText: false,
     };
     let sawFirstEvent = false;
-    const deps = { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta };
+    // Leaked tool-call guard for the Responses text stream. Same recovery as
+    // the Chat path: leaked XML/harmony tool syntax in `output_text.delta` is
+    // suppressed from visible text, synthesized, and dispatched like native.
+    const leakGuard = createLeakGuard({ knownToolNames, harmony: true });
+    const leakedCalls = [];
+    const dispatchLeakedCall = (recovered) => {
+        const call = synthLeakedOpenAICall(recovered);
+        emitCompatToolCallOnce(state, call, onToolCall);
+        leakedCalls.push(call);
+    };
+    const relayLeakText = leakGuard.enabled
+        ? (delta) => {
+            const { text, calls } = leakGuard.push(delta);
+            if (text) {
+                state.content += text;
+                if (onTextDelta) {
+                    state.emittedText = true;
+                    try { onTextDelta(text); } catch {}
+                }
+            }
+            for (const c of calls) dispatchLeakedCall(c);
+        }
+        : null;
+    const flushLeak = () => {
+        if (!leakGuard.enabled) return;
+        const { text, calls } = leakGuard.flush();
+        if (text) {
+            state.content += text;
+            if (onTextDelta) {
+                state.emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+    const deps = { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta, relayLeakText };
     try {
         while (true) {
             const { value: event, done } = await nextAsyncWithWatchdog(iterator, {
@@ -586,6 +760,9 @@ export async function consumeCompatResponsesStream(stream, {
                 idleMs,
                 idleEnabled: sawFirstEvent && idleEnabled,
                 idleLabel: `${label} SSE idle`,
+                // Unsafe-to-retry once any tool call (native or recovered-leaked)
+                // has been emitted this stream — avoid a double side-effect.
+                emittedToolCall: () => state.emittedToolCall || leakedCalls.length > 0,
             });
             if (done) break;
             if (!sawFirstEvent) {
@@ -594,7 +771,21 @@ export async function consumeCompatResponsesStream(stream, {
             }
             handleCompatResponsesStreamEvent(event, state, deps);
         }
+        flushLeak();
     } catch (err) {
+        // Partial-final recovery: attach streamed partial state so a
+        // wedged FINAL no-tool summary can be accepted as partial-final success.
+        if (err?.streamStalled === true) {
+            try {
+                err.partialContent = state.content || '';
+                err.pendingToolUse = state.emittedToolCall === true
+                    || leakedCalls.length > 0
+                    || (state.pendingCalls && state.pendingCalls.size > 0)
+                    || (Array.isArray(state.toolCalls) && state.toolCalls.length > 0)
+                    || state.toolInFlight === true;
+                err.partialModel = state.model || undefined;
+            } catch { /* best-effort */ }
+        }
         throw markUnsafeRetryIfToolEmitted(err, state);
     } finally {
         firstByteTimeout.cleanup();
@@ -618,9 +809,14 @@ export async function consumeCompatResponsesStream(stream, {
         output_text: state.content,
         output: [],
     };
-    const toolCalls = state.toolCalls.length
+    let toolCalls = state.toolCalls.length
         ? state.toolCalls.map(({ _pendingItemId, ...t }) => t)
         : parseResponsesToolCalls(response, label);
+    // Fold recovered leaked calls in (already emitted via onToolCall above).
+    // Dedupe by name+args so an identical native+synthetic pair can't run twice.
+    if (leakedCalls.length) {
+        toolCalls = dedupeToolCallList([...(Array.isArray(toolCalls) ? toolCalls : []), ...leakedCalls]);
+    }
     return {
         response,
         content: state.content || responseOutputText(response),

package/src/runtime/agent/orchestrator/providers/openai-compat.mjs

@@ -1,7 +1,8 @@
-import OpenAI from 'openai';
+import { createRequire } from 'node:module';
 import { createHash } from 'crypto';
 import { loadConfig } from '../config.mjs';
 import { shouldFallbackTransport, withRetry } from './retry-classifier.mjs';
+import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { sendViaWebSocket } from './openai-oauth-ws.mjs';
 import {
     consumeCompatChatCompletionStream,
@@ -32,6 +33,17 @@ import {
     customToolCallFromResponseItem,
 } from './custom-tool-wire.mjs';
 import { OPENAI_COMPAT_PRESETS } from './openai-compat-presets.mjs';
+
+const requireOpenAI = createRequire(import.meta.url);
+let _OpenAI = null;
+
+function loadOpenAI() {
+    if (!_OpenAI) {
+        const mod = requireOpenAI('openai');
+        _OpenAI = mod.default || mod.OpenAI || mod;
+    }
+    return _OpenAI;
+}
 export { OPENAI_COMPAT_PRESETS } from './openai-compat-presets.mjs';
 const PRESETS = OPENAI_COMPAT_PRESETS;
 const MODEL_LIST_TIMEOUT_MS = resolveTimeoutMs(
@@ -970,6 +982,25 @@ function nativeResponsesTools(opts) {
         ? opts.nativeTools.filter(t => t && typeof t === 'object')
         : [];
 }
+// Known tool-name sets for the leaked-tool-call guard, derived from the exact
+// request body so a recovered leaked call is only synthesized when it names a
+// tool the model was actually offered. Chat tools nest the name under
+// `function.name`; Responses tools carry a top-level `name`.
+function knownToolNamesFromOpenAITools(tools) {
+    return new Set(
+        (Array.isArray(tools) ? tools : [])
+            .map((t) => (typeof t?.function?.name === 'string' ? t.function.name
+                : typeof t?.name === 'string' ? t.name : null))
+            .filter(Boolean),
+    );
+}
+function knownToolNamesFromResponsesTools(tools) {
+    return new Set(
+        (Array.isArray(tools) ? tools : [])
+            .map((t) => (typeof t?.name === 'string' ? t.name : null))
+            .filter(Boolean),
+    );
+}
 export function parseToolCalls(choice, label) {
     const calls = choice.message?.tool_calls;
     if (!calls?.length)
@@ -1001,12 +1032,15 @@ export function parseResponsesToolCalls(response, label) {
             const call = customToolCallFromResponseItem(item);
             if (call) out.push(call);
         } else if (item?.type === 'tool_search_call') {
+            const _tsArgs = item.arguments && typeof item.arguments === 'object' && !Array.isArray(item.arguments)
+                ? item.arguments
+                : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: item.call_id || item.id, name: 'tool_search', finishReason });
             out.push({
                 id: item.call_id || item.id,
                 name: 'tool_search',
-                arguments: item.arguments && typeof item.arguments === 'object'
-                    ? item.arguments
-                    : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: item.call_id || item.id, name: 'tool_search', finishReason }),
+                // Schema is a plain object ({query,select,limit}); an array
+                // (parsed JSON or passthrough) must never pass through as args.
+                arguments: (_tsArgs && typeof _tsArgs === 'object' && !Array.isArray(_tsArgs)) ? _tsArgs : {},
                 nativeType: 'tool_search_call',
             });
         }
@@ -1198,10 +1232,20 @@ export class OpenAICompatProvider {
         // extraHeaders behave exactly as before.
         this.defaultHeaders = { ...(preset?.extraHeaders || {}), ...(config.extraHeaders || {}) };
         this.defaultModel = preset?.defaultModel || 'default';
-        this.client = new OpenAI({
+        this.client = new (loadOpenAI())({
             baseURL,
             apiKey,
             defaultHeaders: this.defaultHeaders,
+            // The SDK's own retry loop (default 2) would nest underneath our
+            // withRetry wrapper and multiply tail latency on a transient
+            // backend. We own retry/backoff via withRetry, so disable the SDK's.
+            maxRetries: 0,
+            // Force the shared long-keepalive undici dispatcher to be installed
+            // globally (setGlobalDispatcher) so the SDK's global fetch rides a
+            // warm socket pool instead of Node's short-keepalive default. The
+            // return value is undefined once installed globally; the option is
+            // a harmless no-op then.
+            fetchOptions: { dispatcher: getLlmDispatcher() },
         });
     }
     reloadApiKey() {
@@ -1216,10 +1260,12 @@ export class OpenAICompatProvider {
                 this.baseURL = baseURL;
                 this.apiKey = newKey;
                 this.defaultHeaders = { ...(preset?.extraHeaders || {}), ...(this.config.extraHeaders || {}) };
-                this.client = new OpenAI({
+                this.client = new (loadOpenAI())({
                     baseURL,
                     apiKey: newKey,
                     defaultHeaders: this.defaultHeaders,
+                    maxRetries: 0,
+                    fetchOptions: { dispatcher: getLlmDispatcher() },
                 });
             }
         } catch { /* best effort */ }
@@ -1239,6 +1285,10 @@ export class OpenAICompatProvider {
     async _doSend(messages, model, tools, sendOpts) {
         const useModel = model || this.defaultModel;
         const opts = sendOpts || {};
+        // Re-warm a kept-alive socket to the provider origin before the turn so
+        // the request hot path lands on a live socket instead of paying a cold
+        // TLS handshake after an idle gap. Fire-and-forget; never awaited.
+        preconnect(this.baseURL);
         if (this.name === 'xai' && useXaiResponsesApi(opts, this.config)) {
             if (useXaiResponsesWebSocket(opts, this.config)) {
                 try {
@@ -1339,6 +1389,11 @@ export class OpenAICompatProvider {
                         ({ signal: openSignal }) => this.client.chat.completions.create(params, { signal: openSignal }),
                         {
                             signal: attemptSignal,
+                            // Single attempt: this inner wrapper exists only to
+                            // apply the first-byte per-attempt timeout. Retry is
+                            // owned by the outer withRetry — nesting retry loops
+                            // here multiplied tail latency (5x5).
+                            maxAttempts: 1,
                             perAttemptTimeoutMs: PROVIDER_FIRST_BYTE_TIMEOUT_MS,
                             perAttemptLabel: `${this.name} first byte`,
                         },
@@ -1351,6 +1406,10 @@ export class OpenAICompatProvider {
                         onToolCall: opts.onToolCall,
                         onTextDelta: opts.onTextDelta,
                         parseToolCalls,
+                        // Known tool names for the leaked-tool-call guard:
+                        // recovered leaked calls only synthesize when they name
+                        // a tool actually offered to this request.
+                        knownToolNames: knownToolNamesFromOpenAITools(params.tools),
                     });
                 },
                 {
@@ -1434,6 +1493,13 @@ export class OpenAICompatProvider {
             model: response.model || useModel,
             toolCalls,
             stopReason,
+            // P1 audit fix: a text-only completion that hit finish_reason=
+            // 'length' (no tool calls, so not thrown above as
+            // ProviderIncompleteError) previously returned as an ordinary
+            // success with no signal that the content is a mid-sentence
+            // cutoff. Flag it so loop.mjs can surface a one-line warning
+            // instead of silently treating a truncated answer as complete.
+            ...(stopReason === 'length' && (assembled.content || '').length > 0 ? { truncated: true } : {}),
             ...(reasoningContent ? { reasoningContent } : {}),
             usage: response.usage ? (() => {
                 const input = response.usage.prompt_tokens ?? response.usage.input_tokens ?? 0;
@@ -1516,6 +1582,9 @@ export class OpenAICompatProvider {
                             ({ signal: openSignal }) => this.client.responses.create(params, { signal: openSignal }),
                             {
                                 signal: attemptSignal,
+                                // Single attempt: first-byte timeout only; retry
+                                // is owned by the outer withRetry (see chat path).
+                                maxAttempts: 1,
                                 perAttemptTimeoutMs: PROVIDER_FIRST_BYTE_TIMEOUT_MS,
                                 perAttemptLabel: 'xai responses first byte',
                             },
@@ -1529,6 +1598,7 @@ export class OpenAICompatProvider {
                             onTextDelta: opts.onTextDelta,
                             parseResponsesToolCalls,
                             responseOutputText,
+                            knownToolNames: knownToolNamesFromResponsesTools(params.tools),
                         });
                     },
                     {
@@ -1598,6 +1668,10 @@ export class OpenAICompatProvider {
             model: response.model || useModel,
             toolCalls,
             stopReason: streamed.stopReason || null,
+            // P1 audit fix: mirror the chat-completions truncated flag for
+            // the xAI Responses HTTP path — a max-output cutoff with real
+            // content must not look identical to a clean stop.
+            ...(streamed.stopReason === 'length' && (streamed.content || '').length > 0 ? { truncated: true } : {}),
             citations: searchSources.citations.length ? searchSources.citations : undefined,
             webSearchCalls: searchSources.webSearchCalls.length ? searchSources.webSearchCalls : undefined,
             providerState: {
@@ -1753,6 +1827,9 @@ export class OpenAICompatProvider {
             model: result.model || useModel,
             toolCalls: result.toolCalls,
             stopReason: result.stopReason || null,
+            // P1 audit fix: same truncated signal as the HTTP path (see
+            // _doSendXaiResponses above) for the WebSocket transport.
+            ...(result.stopReason === 'length' && (result.content || '').length > 0 ? { truncated: true } : {}),
             providerState: {
                 ...(opts.providerState || {}),
                 xaiResponses: {