opencode-zen-freex 0.2.10 → 0.2.11

package/MAINTAINING.md

@@ -354,8 +354,9 @@ What ships is `package.json`'s `files` list, and it is deliberately narrower tha
 the repository: the three maintenance scripts (`capture.mjs`, `tools-smoke.mjs`,
 `limits-audit.mjs`) stay here, because a host never loads them and one of them
 rewrites the shipped `fingerprint.json` if it is ever imported. `LICENSE` is
-verbatim MIT; the fork's provenance is in `NOTICE`, so a licence scanner reads a
-standard MIT file and a reader still finds why this fork exists.
+MIT with its text unmodified and both copyright lines in place — upstream's and
+this fork's — so what a licence scanner reads is a standard MIT file; the fork's
+provenance is in `NOTICE`, which is where a reader finds why this fork exists.
 
 **The second factor is a browser, not a password.** Run `npm publish` in a
 terminal. When the account has 2FA on, the command stops and offers the whole

package/NOTICE

@@ -3,7 +3,9 @@
 This package is a maintained fork of the OpenCode Zen Free plugin from
 [magpie-community/plugins](https://github.com/magpie-community/plugins), which
 is MIT licensed. Upstream's notice, `Copyright (c) 2026 xiaozhou26`, is kept in
-[LICENSE](./LICENSE) alongside this fork's own.
+[LICENSE](./LICENSE) alongside this fork's own — the second copyright line
+there, `Copyright (c) 2026 OpenCode-Zen-FreeX contributors`. The license text
+itself is unmodified MIT.
 
 The fork is maintained separately from upstream under the name
 `opencode-zen-freex` (https://github.com/tkhs101/OpenCode-Zen-FreeX) because the

package/README.md

@@ -125,6 +125,8 @@ Zen 的免费层会检查 session id 是否是 OpenCode 能生成的那种：时
 
 偶尔 Zen 会在发出 `[DONE]` 之前就结束一个流式的 Chat Completions 回复。如果回复已经说了内容、且其中没有未完成的工具调用，就以普通回答结束，正文里会说明它被截断了；再问一次就会接着往下走。如果是带着未完成的工具调用被截断、或者什么都没说就断了、或者被折叠给一个不支持流式的客户端，请求就会失败，错误信息里写明这个回复的 id 和收到了多少。走 Anthropic Messages 或 Responses 的回复被截断同样会失败：magpie 能把它和完整的回复区分开，并且在该模型支持的情况下继续往下走。
 
+失败回复的正文会被读一小段，用来找 Zen 自己说出的上下文窗口或输出上限（见下）。因此透传给你的错误正文有两个规矩：读完的按原样给，只去掉描述旧字节的长度、编码与校验头；**没读完的不会冒充完整正文**——状态码仍是上游的，正文换成一段说明（写明上游的状态、读到了多少），并把读到的开头放在 `upstream` 字段里。不这么做的话，超长的错误正文会被截断成一段解析不了的 JSON，看起来像是解析出错而不是 Zen 说了什么。
+
 ## 排查
 
 | 看到的现象 | 这是什么 | 怎么办 |
@@ -134,7 +136,7 @@ Zen 的免费层会检查 session id 是否是 OpenCode 能生成的那种：时
 | `404 … not available as an OpenCode Zen free model now` | Zen 不再免费开放这个模型 | 从错误信息列出的模型里换一个 |
 | `Model is not an available free model for this protocol` | 请求发来时列表变了 | 让宿主刷新模型列表再试 |
 | `uses the public credential` | 存的密钥不是 `public` | 用 `public` 重新登录 |
-| 不带 `FreeTierError` 的 403 | 是别的 403，原样透传 | 按 Zen 自己的错误来读，别当成这个插件的 |
+| 不带 `FreeTierError` 的 403 | 是别的 403：正文原样透传，只去掉描述旧字节的头（`content-length`、`content-encoding`、`transfer-encoding`、`content-md5`、`etag`、`last-modified`） | 按 Zen 自己的错误来读，别当成这个插件的 |
 
 这个插件给出的 403 会写明发出去的措辞来自哪个 OpenCode 版本。那正是 `check:gate` 在问的那份指纹，所以从它开始查，而不是从请求头开始查。
 
@@ -142,4 +144,4 @@ Zen 的免费层会检查 session id 是否是 OpenCode 能生成的那种：时
 
 ## 许可
 
-MIT，分叉自 [zen-free](https://github.com/magpie-community/plugins/tree/main/packages/zen-free)。版权署名：`Copyright (c) 2026 xiaozhou26` 是上游原作者，本分支的贡献者另有署名。`LICENSE` 是原样的 MIT 正文，本分支的来源与维护缘由写在 [NOTICE](https://github.com/tkhs101/OpenCode-Zen-FreeX/blob/main/NOTICE)，这样许可证扫描器读到的是一份标准的 MIT 文件，而想知道这个分支为什么存在的人仍然找得到答案。
+MIT，分叉自 [zen-free](https://github.com/magpie-community/plugins/tree/main/packages/zen-free)。`LICENSE` 的 MIT 正文原样未改，版权行有两条：上游原作者的 `Copyright (c) 2026 xiaozhou26`，和本分支贡献者的 `Copyright (c) 2026 OpenCode-Zen-FreeX contributors`。本分支的来源与维护缘由写在 [NOTICE](https://github.com/tkhs101/OpenCode-Zen-FreeX/blob/main/NOTICE)，这样许可证扫描器读到的是一份标准的 MIT 文件，而想知道这个分支为什么存在的人仍然找得到答案。

package/core-tools.mjs

@@ -22,19 +22,38 @@ import { fileURLToPath } from "node:url";
 
 const CAPTURE = new URL("./fingerprint.json", import.meta.url);
 
+// The one remedy every failure below points at, written once: only a capture
+// writes this file, so a message that names a command instead of the file to fix
+// would have to be edited in three places the day that command is renamed.
+const REMEDY = "run `bun run capture` to write a new one";
+
+// Every failure in this module is the same shape — what could not be read or
+// used, then the remedy — so the wording lives in one place and each throw names
+// only its own half.
+function captureError(what) {
+  return `core-tools: ${what} — ${REMEDY}`;
+}
+
 // Read once, here, because every answer in this module comes out of it. Guarded
 // because the failure this replaces is a bare ENOENT or SyntaxError thrown out of
 // whichever module imported this one, which reads as *that* module being broken
-// and never names the file to fix. One message covers both, since the remedy is
-// the same for either: only a capture writes this file.
+// and never names the file to fix. The remedy is the same whatever went wrong,
+// but the diagnosis is not: an unreadable file (EACCES, EISDIR, a directory
+// where a file should be) is neither missing nor invalid JSON, and saying it is
+// sends the reader to a command that cannot fix a permission problem.
 function readProfiles() {
   let captured;
   try {
     captured = JSON.parse(readFileSync(CAPTURE, "utf8"));
   } catch (error) {
+    const reason =
+      error.code === "ENOENT"
+        ? "missing"
+        : error instanceof SyntaxError
+          ? "invalid JSON"
+          : `could not be read (${error.code ?? error.message})`;
     throw new Error(
-      `core-tools: could not load the capture at ${fileURLToPath(CAPTURE)}; ` +
-        "missing or invalid JSON — run `bun run capture` to write a new one",
+      captureError(`the capture at ${fileURLToPath(CAPTURE)} is ${reason}`),
       { cause: error },
     );
   }
@@ -51,8 +70,8 @@ function readProfiles() {
     !Object.keys(profiles).length
   ) {
     throw new Error(
-      `core-tools: the capture at ${fileURLToPath(CAPTURE)} has no profiles; ` +
-        "run `bun run capture` to write a new one",
+      captureError(`the capture at ${fileURLToPath(CAPTURE)} has no profiles`),
+      { cause: captured },
     );
   }
   return profiles;
@@ -84,7 +103,9 @@ export function generationOf(tools) {
 // asked for and what the capture holds. Ownership rather than truthiness: a
 // plain object answers `constructor` and `toString` out of Object.prototype, so
 // `PROFILES[generation]` alone would hand back a function and then fail on its
-// `.agent` with a TypeError that names nothing.
+// `.agent` with a TypeError that names nothing. Ownership of the key is half of
+// it — a capture holding `{"1.x": null}` owns the key and still has no profile,
+// and the `.agent` of that is the same unnamed TypeError.
 function profileFor(generation) {
   if (!Object.hasOwn(PROFILES, generation)) {
     throw new Error(
@@ -92,9 +113,25 @@ function profileFor(generation) {
         `the capture holds ${Object.keys(PROFILES).join(", ")}`,
     );
   }
-  return PROFILES[generation];
+  const profile = PROFILES[generation];
+  if (typeof profile !== "object" || profile === null || Array.isArray(profile)) {
+    throw new Error(
+      captureError(
+        `the ${JSON.stringify(generation)} profile in the capture is not an object`,
+      ),
+    );
+  }
+  return profile;
 }
 
+// A field interpolated into the User-Agent has to be a string with something in
+// it: each one is read by Zen, and a missing or mistyped one used to compose
+// `opencode/undefined/1.19.0/undefined` — a header that gets a refusal saying
+// nothing about the capture it came out of. `Object.hasOwn` alone would only
+// prove the key is there: `{"chat": null}` and `{"chat": ""}` both compose a
+// version of `null`.
+const filledIn = (value) => typeof value === "string" && value !== "";
+
 /**
  * The User-Agent that generation of OpenCode sends, for a protocol. Each
  * protocol's ai-sdk package bundles its own provider-utils, so 1.x differs by
@@ -102,15 +139,30 @@ function profileFor(generation) {
  */
 export function agentFor(generation, protocol = "chat") {
   const agent = profileFor(generation).agent;
-  if (typeof agent !== "object" || agent === null) {
+  if (typeof agent !== "object" || agent === null || Array.isArray(agent)) {
     throw new Error(
-      `core-tools: the ${JSON.stringify(generation)} profile in the capture has no agent; ` +
-        "run `bun run capture` to write a new one",
+      captureError(`the ${JSON.stringify(generation)} profile in the capture has no agent`),
     );
   }
   // The release shape carries no provider-utils at all, and is composed the same
   // way whatever protocol was asked for.
-  if (!agent.providerUtils) return `opencode/${agent.channel}/${agent.opencode}/${agent.client}`;
+  if (!agent.providerUtils) {
+    if (![agent.channel, agent.opencode, agent.client].every(filledIn)) {
+      throw new Error(
+        captureError(
+          `the ${JSON.stringify(generation)} profile in the capture is not a release agent`,
+        ),
+      );
+    }
+    return `opencode/${agent.channel}/${agent.opencode}/${agent.client}`;
+  }
+  if (typeof agent.providerUtils !== "object" || agent.providerUtils === null) {
+    throw new Error(
+      captureError(
+        `the ${JSON.stringify(generation)} profile in the capture has no per-protocol provider-utils`,
+      ),
+    );
+  }
   // `?? "undefined"` used to be interpolated here for a protocol the capture has
   // no provider-utils for, and a prototype member (`toString`) as the version.
   // Zen reads this header, so a malformed one is rejected upstream with an error
@@ -122,5 +174,13 @@ export function agentFor(generation, protocol = "chat") {
         `it holds ${Object.keys(agent.providerUtils).join(", ")}`,
     );
   }
+  if (!filledIn(agent.providerUtils[protocol]) || !filledIn(agent.opencode) || !filledIn(agent.runtime)) {
+    throw new Error(
+      captureError(
+        `the ${JSON.stringify(generation)} profile in the capture does not fill in every field of ` +
+          `its ${JSON.stringify(protocol)} User-Agent`,
+      ),
+    );
+  }
   return `opencode/${agent.opencode} ai-sdk/provider-utils/${agent.providerUtils[protocol]} ${agent.runtime}`;
 }

package/index.mjs

@@ -11,9 +11,13 @@ import plugin from "./provider.mjs"
 //
 // The named export stays for anything that already imported it by name, and
 // `server` is offered as a name too, so `mod.default.server` and `mod.server`
-// both resolve.
-if (typeof plugin?.server !== "function") {
-  throw new TypeError("provider.mjs must default-export a plugin with a `server` factory")
+// both resolve. Both halves of what the object carries are checked here, the
+// `id` as well as the factory: a provider.mjs that lost either one would
+// otherwise load cleanly and hand the host a plugin it cannot key or start.
+if (typeof plugin?.server !== "function" || typeof plugin?.id !== "string" || !plugin.id) {
+  throw new TypeError(
+    "provider.mjs must default-export a plugin with a `server` factory and an `id`",
+  )
 }
 
 export const ZenFreePlugin = plugin.server

package/limits.mjs

@@ -318,6 +318,14 @@ export async function readBoundedText(response, limit = 4096, { signal } = {}) {
 // the stream is still going, and a number sliced there (`262144` read as
 // `2621`) must not be taken for a limit the route stated.
 //
+// `ended` is the read's own answer to "is this the whole body?": true when the
+// body was read to its end, false when the budget, the deadline or a failed
+// read stopped it short — a read that got nothing at all included, which is the
+// same answer for a different reason. A caller that hands these bytes on has to
+// know which of the two it holds: a prefix presented as the whole reply is a
+// lie the caller cannot see, and the bytes cannot be gone back for, since this
+// read is the body's one reader.
+//
 // Returns undefined only when nothing was read — a response that is not a
 // refusal, or one with no body to read — and otherwise whichever axes the text
 // named, with that text alongside them. An axis the body did not name is
@@ -327,13 +335,15 @@ export async function observeRouteStatement(id, response, limit = 4096, { signal
   try {
     if (typeof id !== "string" || !id || response?.ok !== false) return undefined;
     // A response with no body was not read and is not consumed: the caller
-    // still holds the one it had, and undefined says so.
-    if (response.body == null) return undefined;
-    const { text, over } = await readBoundedText(response, limit, { signal });
+    // still holds the one it had, and undefined says so. Written out rather
+    // than left to a loose comparison, which the project's rules do not allow
+    // and which would also answer for a body that is not one of these two.
+    if (response.body === null || response.body === undefined) return undefined;
+    const { text, over, ended } = await readBoundedText(response, limit, { signal });
     const { context, output } = namedAxes(text, limit, over);
     if (context !== undefined) OBSERVED.set(id, context);
     if (output !== undefined) OBSERVED_OUTPUT.set(id, output);
-    return { context, output, text };
+    return { context, output, text, ended };
   } catch {
     return undefined;
   }

package/models.mjs

@@ -33,7 +33,9 @@ function sdkProtocol(npm) {
 }
 
 // Set, and not merely present: the catalogue writes both a missing date and an
-// explicit null, and neither retires a model.
+// explicit null, and neither retires a model. A blank string is not a date
+// either — see `isSet` below, which is the same rule stated for the two axes
+// the retirement checks read.
 const hasValue = (value) => value !== null && value !== undefined;
 
 // A status has to say something to be one. The catalogue writes an empty string
@@ -48,8 +50,11 @@ function isRetired(model) {
     ["deprecated", "retired", "disabled"].includes(
       isSet(model.status) ? model.status : model.lifecycle,
     ) ||
-    hasValue(model.deprecated_at) ||
-    hasValue(model.retirement_date)
+    // Read through `isSet`, not `hasValue`: a blank `deprecated_at` is the empty
+    // string the catalogue writes for a date it does not have, and reading it as
+    // a date retired a model that was still on offer.
+    isSet(model.deprecated_at) ||
+    isSet(model.retirement_date)
   );
 }
 
@@ -67,8 +72,13 @@ export function isFree(id, model = {}) {
 // model is offered the hour Zen lists it rather than the hour the catalogue
 // catches up. An id that does not call itself free still needs the catalogue's
 // word (a paid one, or a zero-cost one Zen never named).
+//
+// The same question `isFree` asks, and answered the same way: case-insensitive.
+// Asked case-sensitively, an id like `new-model-FREE` passed the free gate above
+// and then found no protocol here, so it was dropped at the `SDK` lookup below —
+// silently, which is the one outcome the fallback exists to prevent.
 function listedFree(id) {
-  return /-free$/.test(id);
+  return /-free$/i.test(id);
 }
 
 // Which protocol a model is asked at, in the order the answer is trusted: the
@@ -99,6 +109,22 @@ const modalities = (values) =>
     ]),
   );
 
+// A window is a positive whole number of tokens. The catalogue writes an
+// explicit `null` — and an empty string, and a zero — for an axis it does not
+// have, and every one of those used to be copied over the 32768/4096 defaults by
+// the spread below, so the host was handed `context: null` as the model's window.
+const usable = (value) => Number.isSafeInteger(value) && value > 0;
+
+// The limit the model is offered with, from the axes that are usable: the
+// defaults first, then the catalogue's own numbers, then what the plugin has
+// evidence for — each level only contributing axes it can actually state.
+function limitFor(id, declared) {
+  const limit = { context: 32768, output: 4096 };
+  for (const [axis, value] of Object.entries(declared ?? {})) if (usable(value)) limit[axis] = value;
+  for (const [axis, value] of Object.entries(limitOverrides(id, declared))) limit[axis] = value;
+  return limit;
+}
+
 export function buildModels(ids, provider, protocols, baseURL) {
   const result = {};
   for (const id of ids) {
@@ -128,7 +154,7 @@ export function buildModels(ids, provider, protocols, baseURL) {
       providerID: PROVIDER,
       name: model.name ?? id,
       api: { id, url: baseURL, npm: SDK[protocol] },
-      limit: { context: 32768, output: 4096, ...model.limit, ...limitOverrides(id, model.limit) },
+      limit: limitFor(id, model.limit),
       capabilities: {
         temperature: model.temperature ?? true,
         reasoning: model.reasoning ?? false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-zen-freex",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "OpenCode Zen's free models, for hosts that are not OpenCode: the public credential, automatic discovery and native streaming protocols",
   "type": "module",
   "main": "./index.mjs",

package/provider.mjs

@@ -114,6 +114,50 @@ function rewrittenHeaders(response) {
   return headers;
 }
 
+// The headers a body this package read once and writes again unchanged is
+// described by. The staleness rule is the same one `rewrittenHeaders` applies —
+// a length, an encoding and the validators all describe the bytes that arrived,
+// not the ones going out — but the content type is left as the upstream sent
+// it: a refusal relayed from a gateway may be HTML, and calling it JSON here
+// would be this package's word rather than the upstream's.
+function relayedHeaders(response) {
+  const headers = new Headers(response.headers);
+  for (const name of STALE_BODY_HEADERS) headers.delete(name);
+  return headers;
+}
+
+// What was read of a refusal is a prefix, not necessarily the refusal. Handing
+// that prefix on as the whole body is a lie the caller cannot see: a host that
+// parses it reports a JSON error of its own instead of Zen's, which is the one
+// message this path exists to keep readable. So a read that did not reach the
+// end of the body — one that got nothing at all included — is answered with a
+// refusal that says what happened, carries the opening that was read under
+// `upstream`, and keeps the status the upstream sent.
+const KEPT_PREFIX = 512;
+
+function relayedRefusal(response, observed) {
+  const read = typeof observed.text === "string" ? observed.text : "";
+  const why = read
+    ? `its body ran past the ${read.length} characters this plugin reads of a refusal, so only the opening of it came back`
+    : "its body could not be read at all";
+  return new Response(
+    JSON.stringify({
+      type: "error",
+      error: {
+        type: "upstream_error",
+        message:
+          `Upstream answered HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""}, and ${why}.`,
+        upstream: read.slice(0, KEPT_PREFIX) + (read.length > KEPT_PREFIX ? "…" : ""),
+      },
+    }),
+    {
+      status: response.status,
+      statusText: response.statusText,
+      headers: rewrittenHeaders(response),
+    },
+  );
+}
+
 // How long a request for a model the last list didn't have waits before it
 // asks Zen's list again: a model Zen made free since is served at once,
 // and a model typed in by hand doesn't ask the list on every request.
@@ -545,9 +589,12 @@ async function server(_input, options = {}) {
             //
             // A response body can only be read once, so what the limits reader
             // took is handed on as the response the rest of the path works with:
-            // the bytes are the ones that arrived, under headers that still
-            // describe them, and nothing re-reads a body that is already gone.
-            // A response the reader did not consume is used as it arrived.
+            // never the upstream's own headers over bytes this package wrote
+            // again, and never a prefix presented as the whole reply. A read
+            // that reached the end of the body is that body, relayed under
+            // headers corrected for it; one that stopped short is answered with
+            // a refusal that says so (see `relayedRefusal`). A response the
+            // reader did not consume is used as it arrived.
             const observed = await observeRouteStatement(body.model, response, undefined, {
               // The caller's own cancellation reaches this read as well: a host
               // that has given up is not waiting for a number out of a refusal.
@@ -556,11 +603,13 @@ async function server(_input, options = {}) {
             const answered =
               observed === undefined
                 ? response
-                : new Response(observed.text, {
-                    status: response.status,
-                    statusText: response.statusText,
-                    headers: response.headers,
-                  });
+                : observed.ended
+                  ? new Response(observed.text, {
+                      status: response.status,
+                      statusText: response.statusText,
+                      headers: relayedHeaders(response),
+                    })
+                  : relayedRefusal(response, observed);
             const guarded = await guardToolResponse(
               explain(observed?.text ?? null, answered, toolPolicy),
               protocol,

package/stream.mjs

@@ -143,10 +143,24 @@ function chatAccumulator() {
           choice.finish_reason = part.finish_reason;
         if (part.logprobs) {
           choice.logprobs ??= {};
+          // Written as a defined own property, and read back as one. A
+          // "__proto__" key arrives as an own property of the parsed object,
+          // and `choice.logprobs[key] = value` would take the inherited
+          // accessor instead: an object value silently re-parented the
+          // accumulated object and the key never reached the reply, while an
+          // array value read Object.prototype back and spread it, throwing
+          // "not iterable" — a 502 on an otherwise valid stream. The delta
+          // written by tool-response.mjs follows the same rule.
           for (const [key, value] of Object.entries(part.logprobs)) {
-            if (Array.isArray(value))
-              choice.logprobs[key] = [...(choice.logprobs[key] ?? []), ...value];
-            else choice.logprobs[key] = value;
+            const held = Object.hasOwn(choice.logprobs, key) ? choice.logprobs[key] : undefined;
+            Object.defineProperty(choice.logprobs, key, {
+              value: Array.isArray(value)
+                ? [...(Array.isArray(held) ? held : []), ...value]
+                : value,
+              writable: true,
+              enumerable: true,
+              configurable: true,
+            });
           }
         }
       }
@@ -317,7 +331,15 @@ function anthropicAccumulator() {
         for (const [position, block] of (data.message?.content ?? []).entries())
           if (carries(block, blocks.get(position), fields)) blocks.set(position, block);
       } else if (type === "content_block_start") {
-        blocks.set(index(data.index), data.content_block);
+        // The same test message_start's blocks get, for the same reason: a
+        // gateway re-emitting a block's opening frame carries a block that
+        // was never filled in (a text one opens with text: ""), and taking
+        // it would discard the text, thinking or signature the deltas
+        // already delivered. A start with nothing accumulated applies, as
+        // does one that carries content of its own.
+        const position = index(data.index);
+        if (carries(data.content_block, blocks.get(position), fields))
+          blocks.set(position, data.content_block);
       } else if (type === "content_block_delta") {
         const position = index(data.index);
         const block = blocks.get(position);

package/tool-response.mjs

@@ -158,13 +158,25 @@ function isCall(protocol, value) {
   );
 }
 
+// Counts the ids invented for calls that came without one, so that no two of
+// them can be handed the same id (see inPlaceOf).
+let synthesized = 0;
+
 // What a call left out of a Responses or Messages reply becomes: text
 // saying so, in the call's place, so no later index moves.
 function inPlaceOf(protocol, call, note) {
   if (protocol === "anthropic") return { type: "text", text: note };
+  // An item id is what a Responses client keys the item by, and what the
+  // streaming path suppresses arguments by: two calls that arrived without
+  // one and shared the id invented here would be one item to the client, and
+  // the arguments of one would be read as the other's.
+  const id =
+    typeof call.id === "string" && call.id
+      ? call.id
+      : `msg_${call.call_id ?? `dropped_${++synthesized}`}`;
   return {
     type: "message",
-    id: typeof call.id === "string" && call.id ? call.id : `msg_${call.call_id ?? "dropped"}`,
+    id,
     role: "assistant",
     status: call.status ?? "completed",
     content: [{ type: "output_text", text: note, annotations: [] }],
@@ -919,7 +931,17 @@ function guardedStream(response, protocol, checkName, endCutShort) {
             );
             controller.close();
           } else {
-            release();
+            // A failure that is not the guard's own is a transport one: the
+            // stream is over either way, and what is left of the body is not
+            // something to keep writing into a socket nobody reads — the
+            // same rule readBounded follows. Cancel's own failure is not
+            // allowed to replace the error the client has to see, which is
+            // the one that got here.
+            try {
+              await cancel(error);
+            } catch {
+              /* the original error is the one the client must see */
+            }
             controller.error(error);
           }
         }
@@ -938,9 +960,12 @@ function guardedStream(response, protocol, checkName, endCutShort) {
 // collapsed for a client that doesn't stream fails instead, so it can be
 // asked again before anything reached the client.
 export async function guardToolResponse(response, protocol, policy, options = {}) {
-  if (!response.ok) return response;
+  // A protocol this guard has no rules for is the caller's mistake, and it
+  // is one whichever the upstream answered: checked before the status is
+  // read, so an error response cannot return it unexamined.
   if (!["chat", "responses", "anthropic"].includes(protocol))
     throw new TypeError(`Unsupported protocol: ${protocol}`);
+  if (!response.ok) return response;
   const checkName = nameGuard(policy);
   const headers = headersFor(response);
   const contentType = response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase();