opencode-zen-freex 0.2.10 → 0.2.12

package/MAINTAINING.md

@@ -354,8 +354,9 @@ What ships is `package.json`'s `files` list, and it is deliberately narrower tha
 the repository: the three maintenance scripts (`capture.mjs`, `tools-smoke.mjs`,
 `limits-audit.mjs`) stay here, because a host never loads them and one of them
 rewrites the shipped `fingerprint.json` if it is ever imported. `LICENSE` is
-verbatim MIT; the fork's provenance is in `NOTICE`, so a licence scanner reads a
-standard MIT file and a reader still finds why this fork exists.
+MIT with its text unmodified and both copyright lines in place — upstream's and
+this fork's — so what a licence scanner reads is a standard MIT file; the fork's
+provenance is in `NOTICE`, which is where a reader finds why this fork exists.
 
 **The second factor is a browser, not a password.** Run `npm publish` in a
 terminal. When the account has 2FA on, the command stops and offers the whole

package/NOTICE

@@ -3,7 +3,9 @@
 This package is a maintained fork of the OpenCode Zen Free plugin from
 [magpie-community/plugins](https://github.com/magpie-community/plugins), which
 is MIT licensed. Upstream's notice, `Copyright (c) 2026 xiaozhou26`, is kept in
-[LICENSE](./LICENSE) alongside this fork's own.
+[LICENSE](./LICENSE) alongside this fork's own — the second copyright line
+there, `Copyright (c) 2026 OpenCode-Zen-FreeX contributors`. The license text
+itself is unmodified MIT.
 
 The fork is maintained separately from upstream under the name
 `opencode-zen-freex` (https://github.com/tkhs101/OpenCode-Zen-FreeX) because the

package/README.md

@@ -125,6 +125,8 @@ Zen 的免费层会检查 session id 是否是 OpenCode 能生成的那种：时
 
 偶尔 Zen 会在发出 `[DONE]` 之前就结束一个流式的 Chat Completions 回复。如果回复已经说了内容、且其中没有未完成的工具调用，就以普通回答结束，正文里会说明它被截断了；再问一次就会接着往下走。如果是带着未完成的工具调用被截断、或者什么都没说就断了、或者被折叠给一个不支持流式的客户端，请求就会失败，错误信息里写明这个回复的 id 和收到了多少。走 Anthropic Messages 或 Responses 的回复被截断同样会失败：magpie 能把它和完整的回复区分开，并且在该模型支持的情况下继续往下走。
 
+失败回复的正文会被读一小段，用来找 Zen 自己说出的上下文窗口或输出上限（见下）。因此透传给你的错误正文有两个规矩：读完的按原样给，只去掉描述旧字节的长度、编码与校验头；**没读完的不会冒充完整正文**——状态码仍是上游的，正文换成一段说明（写明上游的状态、读到了多少），并把读到的开头放在 `upstream` 字段里。不这么做的话，超长的错误正文会被截断成一段解析不了的 JSON，看起来像是解析出错而不是 Zen 说了什么。
+
 ## 排查
 
 | 看到的现象 | 这是什么 | 怎么办 |
@@ -134,7 +136,7 @@ Zen 的免费层会检查 session id 是否是 OpenCode 能生成的那种：时
 | `404 … not available as an OpenCode Zen free model now` | Zen 不再免费开放这个模型 | 从错误信息列出的模型里换一个 |
 | `Model is not an available free model for this protocol` | 请求发来时列表变了 | 让宿主刷新模型列表再试 |
 | `uses the public credential` | 存的密钥不是 `public` | 用 `public` 重新登录 |
-| 不带 `FreeTierError` 的 403 | 是别的 403，原样透传 | 按 Zen 自己的错误来读，别当成这个插件的 |
+| 不带 `FreeTierError` 的 403 | 是别的 403：正文原样透传，只去掉描述旧字节的头（`content-length`、`content-encoding`、`transfer-encoding`、`content-md5`、`etag`、`last-modified`） | 按 Zen 自己的错误来读，别当成这个插件的 |
 
 这个插件给出的 403 会写明发出去的措辞来自哪个 OpenCode 版本。那正是 `check:gate` 在问的那份指纹，所以从它开始查，而不是从请求头开始查。
 
@@ -142,4 +144,4 @@ Zen 的免费层会检查 session id 是否是 OpenCode 能生成的那种：时
 
 ## 许可
 
-MIT，分叉自 [zen-free](https://github.com/magpie-community/plugins/tree/main/packages/zen-free)。版权署名：`Copyright (c) 2026 xiaozhou26` 是上游原作者，本分支的贡献者另有署名。`LICENSE` 是原样的 MIT 正文，本分支的来源与维护缘由写在 [NOTICE](https://github.com/tkhs101/OpenCode-Zen-FreeX/blob/main/NOTICE)，这样许可证扫描器读到的是一份标准的 MIT 文件，而想知道这个分支为什么存在的人仍然找得到答案。
+MIT，分叉自 [zen-free](https://github.com/magpie-community/plugins/tree/main/packages/zen-free)。`LICENSE` 的 MIT 正文原样未改，版权行有两条：上游原作者的 `Copyright (c) 2026 xiaozhou26`，和本分支贡献者的 `Copyright (c) 2026 OpenCode-Zen-FreeX contributors`。本分支的来源与维护缘由写在 [NOTICE](https://github.com/tkhs101/OpenCode-Zen-FreeX/blob/main/NOTICE)，这样许可证扫描器读到的是一份标准的 MIT 文件，而想知道这个分支为什么存在的人仍然找得到答案。

package/core-tools.mjs

@@ -22,19 +22,38 @@ import { fileURLToPath } from "node:url";
 
 const CAPTURE = new URL("./fingerprint.json", import.meta.url);
 
+// The one remedy every failure below points at, written once: only a capture
+// writes this file, so a message that names a command instead of the file to fix
+// would have to be edited in three places the day that command is renamed.
+const REMEDY = "run `bun run capture` to write a new one";
+
+// Every failure in this module is the same shape — what could not be read or
+// used, then the remedy — so the wording lives in one place and each throw names
+// only its own half.
+function captureError(what) {
+  return `core-tools: ${what} — ${REMEDY}`;
+}
+
 // Read once, here, because every answer in this module comes out of it. Guarded
 // because the failure this replaces is a bare ENOENT or SyntaxError thrown out of
 // whichever module imported this one, which reads as *that* module being broken
-// and never names the file to fix. One message covers both, since the remedy is
-// the same for either: only a capture writes this file.
+// and never names the file to fix. The remedy is the same whatever went wrong,
+// but the diagnosis is not: an unreadable file (EACCES, EISDIR, a directory
+// where a file should be) is neither missing nor invalid JSON, and saying it is
+// sends the reader to a command that cannot fix a permission problem.
 function readProfiles() {
   let captured;
   try {
     captured = JSON.parse(readFileSync(CAPTURE, "utf8"));
   } catch (error) {
+    const reason =
+      error.code === "ENOENT"
+        ? "missing"
+        : error instanceof SyntaxError
+          ? "invalid JSON"
+          : `could not be read (${error.code ?? error.message})`;
     throw new Error(
-      `core-tools: could not load the capture at ${fileURLToPath(CAPTURE)}; ` +
-        "missing or invalid JSON — run `bun run capture` to write a new one",
+      captureError(`the capture at ${fileURLToPath(CAPTURE)} is ${reason}`),
       { cause: error },
     );
   }
@@ -51,8 +70,8 @@ function readProfiles() {
     !Object.keys(profiles).length
   ) {
     throw new Error(
-      `core-tools: the capture at ${fileURLToPath(CAPTURE)} has no profiles; ` +
-        "run `bun run capture` to write a new one",
+      captureError(`the capture at ${fileURLToPath(CAPTURE)} has no profiles`),
+      { cause: captured },
     );
   }
   return profiles;
@@ -84,17 +103,40 @@ export function generationOf(tools) {
 // asked for and what the capture holds. Ownership rather than truthiness: a
 // plain object answers `constructor` and `toString` out of Object.prototype, so
 // `PROFILES[generation]` alone would hand back a function and then fail on its
-// `.agent` with a TypeError that names nothing.
-function profileFor(generation) {
+// `.agent` with a TypeError that names nothing. Ownership of the key is half of
+// it — a capture holding `{"1.x": null}` owns the key and still has no profile,
+// and the `.agent` of that is the same unnamed TypeError.
+//
+// Exported, because the same two mistakes are reachable from outside this file
+// and are made there: `provider.mjs` indexes `PROFILES[...]` directly to read a
+// profile's `tools`, and a capture missing that generation then fails with
+// "Cannot read properties of undefined" instead of the sentence below.
+export function profileFor(generation) {
   if (!Object.hasOwn(PROFILES, generation)) {
     throw new Error(
       `core-tools: no profile for generation ${JSON.stringify(generation)}; ` +
         `the capture holds ${Object.keys(PROFILES).join(", ")}`,
     );
   }
-  return PROFILES[generation];
+  const profile = PROFILES[generation];
+  if (typeof profile !== "object" || profile === null || Array.isArray(profile)) {
+    throw new Error(
+      captureError(
+        `the ${JSON.stringify(generation)} profile in the capture is not an object`,
+      ),
+    );
+  }
+  return profile;
 }
 
+// A field interpolated into the User-Agent has to be a string with something in
+// it: each one is read by Zen, and a missing or mistyped one used to compose
+// `opencode/undefined/1.19.0/undefined` — a header that gets a refusal saying
+// nothing about the capture it came out of. `Object.hasOwn` alone would only
+// prove the key is there: `{"chat": null}` and `{"chat": ""}` both compose a
+// version of `null`.
+const filledIn = (value) => typeof value === "string" && value !== "";
+
 /**
  * The User-Agent that generation of OpenCode sends, for a protocol. Each
  * protocol's ai-sdk package bundles its own provider-utils, so 1.x differs by
@@ -102,15 +144,30 @@ function profileFor(generation) {
  */
 export function agentFor(generation, protocol = "chat") {
   const agent = profileFor(generation).agent;
-  if (typeof agent !== "object" || agent === null) {
+  if (typeof agent !== "object" || agent === null || Array.isArray(agent)) {
     throw new Error(
-      `core-tools: the ${JSON.stringify(generation)} profile in the capture has no agent; ` +
-        "run `bun run capture` to write a new one",
+      captureError(`the ${JSON.stringify(generation)} profile in the capture has no agent`),
     );
   }
   // The release shape carries no provider-utils at all, and is composed the same
   // way whatever protocol was asked for.
-  if (!agent.providerUtils) return `opencode/${agent.channel}/${agent.opencode}/${agent.client}`;
+  if (!agent.providerUtils) {
+    if (![agent.channel, agent.opencode, agent.client].every(filledIn)) {
+      throw new Error(
+        captureError(
+          `the ${JSON.stringify(generation)} profile in the capture is not a release agent`,
+        ),
+      );
+    }
+    return `opencode/${agent.channel}/${agent.opencode}/${agent.client}`;
+  }
+  if (typeof agent.providerUtils !== "object" || agent.providerUtils === null) {
+    throw new Error(
+      captureError(
+        `the ${JSON.stringify(generation)} profile in the capture has no per-protocol provider-utils`,
+      ),
+    );
+  }
   // `?? "undefined"` used to be interpolated here for a protocol the capture has
   // no provider-utils for, and a prototype member (`toString`) as the version.
   // Zen reads this header, so a malformed one is rejected upstream with an error
@@ -122,5 +179,13 @@ export function agentFor(generation, protocol = "chat") {
         `it holds ${Object.keys(agent.providerUtils).join(", ")}`,
     );
   }
+  if (!filledIn(agent.providerUtils[protocol]) || !filledIn(agent.opencode) || !filledIn(agent.runtime)) {
+    throw new Error(
+      captureError(
+        `the ${JSON.stringify(generation)} profile in the capture does not fill in every field of ` +
+          `its ${JSON.stringify(protocol)} User-Agent`,
+      ),
+    );
+  }
   return `opencode/${agent.opencode} ai-sdk/provider-utils/${agent.providerUtils[protocol]} ${agent.runtime}`;
 }

package/index.mjs

@@ -11,9 +11,13 @@ import plugin from "./provider.mjs"
 //
 // The named export stays for anything that already imported it by name, and
 // `server` is offered as a name too, so `mod.default.server` and `mod.server`
-// both resolve.
-if (typeof plugin?.server !== "function") {
-  throw new TypeError("provider.mjs must default-export a plugin with a `server` factory")
+// both resolve. Both halves of what the object carries are checked here, the
+// `id` as well as the factory: a provider.mjs that lost either one would
+// otherwise load cleanly and hand the host a plugin it cannot key or start.
+if (typeof plugin?.server !== "function" || typeof plugin?.id !== "string" || !plugin.id) {
+  throw new TypeError(
+    "provider.mjs must default-export a plugin with a `server` factory and an `id`",
+  )
 }
 
 export const ZenFreePlugin = plugin.server

package/limits.mjs

@@ -109,7 +109,7 @@ export const LIMITS = {
 // says nothing attributable and is left alone; §7 of the measured notes has a
 // context overflow and an invalid parameter answering with byte-identical 400s
 // on another Zen model.
-const NAMED_CONTEXT = /maximum context length is (\d+) tokens/i;
+const NAMED_CONTEXT = /maximum context length is (\d+) tokens/id;
 
 // "max_tokens is too large: 200000. This model supports at most 131072 completion
 // tokens, whereas you provided 200000." — an upstream that validates the ceiling
@@ -119,10 +119,10 @@ const NAMED_CONTEXT = /maximum context length is (\d+) tokens/i;
 // answers 200 there, so silence from this one says nothing about a model, and a
 // request that is served is not evidence of a ceiling either way.
 const NAMED_OUTPUT = [
-  /supports at most (\d+) completion tokens/i,
+  /supports at most (\d+) completion tokens/id,
   // "/max_tokens: 1000000 is not less or equal to 262144" — LongCat's wording for
   // the same fact, where the ceiling is the number it has to stay under.
-  /max_tokens:?\s*\d+\s+is not less or equal to\s+(\d+)/i,
+  /max_tokens:?\s*\d+\s+is not less or equal to\s+(\d+)/id,
 ];
 
 // Names a refusal made while this process is running, by model id. Not
@@ -318,6 +318,14 @@ export async function readBoundedText(response, limit = 4096, { signal } = {}) {
 // the stream is still going, and a number sliced there (`262144` read as
 // `2621`) must not be taken for a limit the route stated.
 //
+// `ended` is the read's own answer to "is this the whole body?": true when the
+// body was read to its end, false when the budget, the deadline or a failed
+// read stopped it short — a read that got nothing at all included, which is the
+// same answer for a different reason. A caller that hands these bytes on has to
+// know which of the two it holds: a prefix presented as the whole reply is a
+// lie the caller cannot see, and the bytes cannot be gone back for, since this
+// read is the body's one reader.
+//
 // Returns undefined only when nothing was read — a response that is not a
 // refusal, or one with no body to read — and otherwise whichever axes the text
 // named, with that text alongside them. An axis the body did not name is
@@ -327,37 +335,47 @@ export async function observeRouteStatement(id, response, limit = 4096, { signal
   try {
     if (typeof id !== "string" || !id || response?.ok !== false) return undefined;
     // A response with no body was not read and is not consumed: the caller
-    // still holds the one it had, and undefined says so.
-    if (response.body == null) return undefined;
-    const { text, over } = await readBoundedText(response, limit, { signal });
+    // still holds the one it had, and undefined says so. Written out rather
+    // than left to a loose comparison, which the project's rules do not allow
+    // and which would also answer for a body that is not one of these two.
+    if (response.body === null || response.body === undefined) return undefined;
+    const { text, over, ended } = await readBoundedText(response, limit, { signal });
     const { context, output } = namedAxes(text, limit, over);
     if (context !== undefined) OBSERVED.set(id, context);
     if (output !== undefined) OBSERVED_OUTPUT.set(id, output);
-    return { context, output, text };
+    return { context, output, text, ended };
   } catch {
     return undefined;
   }
 }
 
-// How close to the end of what was read a match has to end before a truncated
-// body makes it unusable. A number ending inside this margin of the last
-// character read may have had digits past it — `2621` where the body said
-// `262144` — and a smaller limit that looks like a real one is the one failure
-// this guard exists to prevent. Numbers further back are inside the buffer
-// entirely and are read as they stand.
-const CUT_MARGIN = 8;
+// Where the number a match named ends, in the text it was matched against. The
+// `d` flag is what makes this exact: `NAMED_CONTEXT` and the first
+// `NAMED_OUTPUT` run on past the digits (" completion tokens"), so judging the
+// cut by the match's own end threw away numbers that were provably whole — the
+// digits ended well before the read did, with text after them that the greedy
+// `(\d+)` had refused to consume.
+function digitsEnd(found) {
+  const at = found?.match?.indices?.[1]?.[1];
+  // The match's own end is the conservative answer when the pattern cannot say
+  // where the digits are: it drops a whole number rather than reading a cut one,
+  // which is the direction this guard has to fail in.
+  return Number.isSafeInteger(at) ? at : found.match.index + found.match[0].length;
+}
 
 // The axes the first `limit` characters of `text` name. `cut` says the read
-// stopped at the budget with the body going on, so a match ending at the margin
-// may have been a longer number: that axis is left unread rather than reported a
-// digit short. Each axis is read from the match its number came from, so the
-// match the guard judges and the number that is returned cannot be two answers.
+// stopped before the body did, so a number whose own digits reach the last
+// character read may have had digits past it: that axis is left unread rather
+// than reported a digit short. Any character after the digits inside the head
+// proves the number ended, since a greedy `\d+` would have taken it — only
+// digits touching the boundary are ambiguous. Each axis is read from the match
+// its number came from, so the match the guard judges and the number that is
+// returned cannot be two answers.
 function namedAxes(text, limit, cut) {
   const head = text.slice(0, limit);
   const context = namedFrom([NAMED_CONTEXT], head);
   const output = namedFrom(NAMED_OUTPUT, head);
-  const onCut = (found) =>
-    cut && Boolean(found) && found.match.index + found.match[0].length >= head.length - CUT_MARGIN;
+  const onCut = (found) => cut && found !== undefined && digitsEnd(found) >= head.length;
   return {
     context: onCut(context) ? undefined : context?.value,
     output: onCut(output) ? undefined : output?.value,
@@ -384,7 +402,12 @@ export function limitOverrides(
   // declared, from a table that never named it.
   const record = table && Object.hasOwn(table, id) ? table[id] : undefined;
   for (const axis of ["context", "output"]) {
-    const declaredValue = declared?.[axis];
+    // Own property, like the table lookup two lines up: `declared` is handed in
+    // by a caller, and a `context` inherited from a custom prototype — or from a
+    // polluted `Object.prototype` — would otherwise be read as a declaration the
+    // catalogue never made, feeding the staleness compare and the raise-only
+    // check with a number nobody declared.
+    const declaredValue = declared && Object.hasOwn(declared, axis) ? declared[axis] : undefined;
     const entry = record?.[axis];
     const live = (axis === "context" ? observed : observedOutput)?.get(id);
     // A route statement made while this process was running is the same tier as

package/models.mjs

@@ -33,7 +33,9 @@ function sdkProtocol(npm) {
 }
 
 // Set, and not merely present: the catalogue writes both a missing date and an
-// explicit null, and neither retires a model.
+// explicit null, and neither retires a model. A blank string is not a date
+// either — see `isSet` below, which is the same rule stated for the two axes
+// the retirement checks read.
 const hasValue = (value) => value !== null && value !== undefined;
 
 // A status has to say something to be one. The catalogue writes an empty string
@@ -48,8 +50,11 @@ function isRetired(model) {
     ["deprecated", "retired", "disabled"].includes(
       isSet(model.status) ? model.status : model.lifecycle,
     ) ||
-    hasValue(model.deprecated_at) ||
-    hasValue(model.retirement_date)
+    // Read through `isSet`, not `hasValue`: a blank `deprecated_at` is the empty
+    // string the catalogue writes for a date it does not have, and reading it as
+    // a date retired a model that was still on offer.
+    isSet(model.deprecated_at) ||
+    isSet(model.retirement_date)
   );
 }
 
@@ -67,8 +72,13 @@ export function isFree(id, model = {}) {
 // model is offered the hour Zen lists it rather than the hour the catalogue
 // catches up. An id that does not call itself free still needs the catalogue's
 // word (a paid one, or a zero-cost one Zen never named).
+//
+// The same question `isFree` asks, and answered the same way: case-insensitive.
+// Asked case-sensitively, an id like `new-model-FREE` passed the free gate above
+// and then found no protocol here, so it was dropped at the `SDK` lookup below —
+// silently, which is the one outcome the fallback exists to prevent.
 function listedFree(id) {
-  return /-free$/.test(id);
+  return /-free$/i.test(id);
 }
 
 // Which protocol a model is asked at, in the order the answer is trusted: the
@@ -99,6 +109,22 @@ const modalities = (values) =>
     ]),
   );
 
+// A window is a positive whole number of tokens. The catalogue writes an
+// explicit `null` — and an empty string, and a zero — for an axis it does not
+// have, and every one of those used to be copied over the 32768/4096 defaults by
+// the spread below, so the host was handed `context: null` as the model's window.
+const usable = (value) => Number.isSafeInteger(value) && value > 0;
+
+// The limit the model is offered with, from the axes that are usable: the
+// defaults first, then the catalogue's own numbers, then what the plugin has
+// evidence for — each level only contributing axes it can actually state.
+function limitFor(id, declared) {
+  const limit = { context: 32768, output: 4096 };
+  for (const [axis, value] of Object.entries(declared ?? {})) if (usable(value)) limit[axis] = value;
+  for (const [axis, value] of Object.entries(limitOverrides(id, declared))) limit[axis] = value;
+  return limit;
+}
+
 export function buildModels(ids, provider, protocols, baseURL) {
   const result = {};
   for (const id of ids) {
@@ -128,7 +154,7 @@ export function buildModels(ids, provider, protocols, baseURL) {
       providerID: PROVIDER,
       name: model.name ?? id,
       api: { id, url: baseURL, npm: SDK[protocol] },
-      limit: { context: 32768, output: 4096, ...model.limit, ...limitOverrides(id, model.limit) },
+      limit: limitFor(id, model.limit),
       capabilities: {
         temperature: model.temperature ?? true,
         reasoning: model.reasoning ?? false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-zen-freex",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "OpenCode Zen's free models, for hosts that are not OpenCode: the public credential, automatic discovery and native streaming protocols",
   "type": "module",
   "main": "./index.mjs",

package/provider.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { PROFILES, agentFor, generationOf } from "./core-tools.mjs";
+import { agentFor, generationOf, profileFor } from "./core-tools.mjs";
 import {
   PROVIDER,
   SDK,
@@ -114,6 +114,66 @@ function rewrittenHeaders(response) {
   return headers;
 }
 
+// The headers a body this package read once and writes again unchanged is
+// described by. The staleness rule is the same one `rewrittenHeaders` applies —
+// a length, an encoding and the validators all describe the bytes that arrived,
+// not the ones going out — but the content type is left as the upstream sent
+// it: a refusal relayed from a gateway may be HTML, and calling it JSON here
+// would be this package's word rather than the upstream's.
+function relayedHeaders(response) {
+  const headers = new Headers(response.headers);
+  for (const name of STALE_BODY_HEADERS) headers.delete(name);
+  return headers;
+}
+
+// What was read of a refusal is a prefix, not necessarily the refusal. Handing
+// that prefix on as the whole body is a lie the caller cannot see: a host that
+// parses it reports a JSON error of its own instead of Zen's, which is the one
+// message this path exists to keep readable. So a read that did not reach the
+// end of the body — one that got nothing at all included — is answered with a
+// refusal that says what happened, carries the opening that was read under
+// `upstream`, and keeps the status the upstream sent.
+const KEPT_PREFIX = 512;
+
+function relayedRefusal(response, observed) {
+  const read = typeof observed.text === "string" ? observed.text : "";
+  const why = read
+    ? `its body ran past the ${read.length} characters this plugin reads of a refusal, so only the opening of it came back`
+    : "its body could not be read at all";
+  return new Response(
+    JSON.stringify({
+      type: "error",
+      error: {
+        type: "upstream_error",
+        message:
+          `Upstream answered HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""}, and ${why}.`,
+        upstream: read.slice(0, KEPT_PREFIX) + (read.length > KEPT_PREFIX ? "…" : ""),
+      },
+    }),
+    {
+      status: response.status,
+      statusText: response.statusText,
+      headers: rewrittenHeaders(response),
+    },
+  );
+}
+
+// The response this path hands on, from what the limits reader made of the one
+// that arrived: the same response when it never read it — the reader touches no
+// 2xx body, so that is the common branch — the bytes it read under headers
+// corrected for them when it read the whole body, and a refusal that says so
+// when it stopped short. One decision, written once, so the three outcomes
+// cannot be read as a chain of ternaries at the call site.
+function relayed(response, observed) {
+  if (observed === undefined) return response;
+  if (!observed.ended) return relayedRefusal(response, observed);
+  return new Response(observed.text, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: relayedHeaders(response),
+  });
+}
+
 // How long a request for a model the last list didn't have waits before it
 // asks Zen's list again: a model Zen made free since is served at once,
 // and a model typed in by hand doesn't ask the list on every request.
@@ -166,20 +226,23 @@ function normalizeTools(body, protocol) {
   const declared = new Set([...present].filter((value) => typeof value === "string"));
   // The legacy top-level `functions` array is the older way of declaring the
   // same tools, and one a chat host may still use. Its names are declarations,
-  // so they count as declared — and, since they are not in `body.tools`, they
-  // are also remembered as "do not stand in for this name": the fill loop
-  // below looks at where a name already sits, and a name that only arrived
-  // through `functions` has no index there. Without this the same tool would go
-  // out twice, which is what the note on `nameOf` says must not happen.
+  // so they count as declared, and the fill loop below finds them by name: a
+  // name that only arrived through `functions` has no index in `body.tools`, so
+  // it is looked up in the array itself and reworded where it sits rather than
+  // being stood in for. Without that the same tool would go out twice, which is
+  // what the note on `nameOf` says must not happen.
   const legacy = Array.isArray(body.functions) && protocol === "chat" ? body.functions : [];
   for (const tool of legacy) if (typeof tool?.name === "string") declared.add(tool.name);
-  const declaredElsewhere = new Set(legacy.map((tool) => tool?.name));
   // Zen takes a request for one generation of OpenCode or the other, and the tools
   // it carries say which: `shell` is 2.x, `bash` is 1.x. Names move far less
   // often than descriptions do, so this survives a rewording that a pinned
   // User-Agent would not.
   const generation = generationOf(body.tools) ?? DEFAULT_GENERATION;
-  const profile = PROFILES[generation];
+  // Through `profileFor`, not `PROFILES[generation]`: a capture that holds one
+  // generation leaves the other key absent, and the direct read fails below on
+  // `profile.tools` with a TypeError that names nothing — the capture is what
+  // has to change, and it is the one thing that error does not say.
+  const profile = profileFor(generation);
   const filled = [];
   const at = new Map();
   body.tools.forEach((tool, index) => {
@@ -208,8 +271,17 @@ function normalizeTools(body, protocol) {
     // tightened check would otherwise find missing.
     if (!profile.required.includes(name)) continue;
     // Declared through `functions` rather than `tools`: this host does have the
-    // tool, so it is not one to stand in for.
-    if (declaredElsewhere.has(name)) continue;
+    // tool, so it is not one to stand in for. Its wording is still the host's,
+    // though, and Zen reads the wording of a tool it knows by name whichever
+    // array carried it — leaving that one entry as the host wrote it is the
+    // refusal this loop exists to prevent, and it is the entry `explain()`
+    // would then describe wrongly. The legacy shape carries `description` at
+    // the top level, which `setDescription` already handles.
+    const throughFunctions = legacy.find((tool) => tool?.name === name);
+    if (throughFunctions) {
+      setDescription(throughFunctions, spoken.description);
+      continue;
+    }
     filled.push(name);
     // A tool added here has nothing behind it: the agent has no such tool and
     // a call to it is dropped. Describing it as OpenCode describes it is what
@@ -264,7 +336,10 @@ function explain(text, source, toolPolicy) {
   // A 403 that is not Zen's free tier is somebody else's; it is left as sent —
   // its bytes are what arrived, and so are the headers describing them.
   if (source.status === 403 && !text.includes("FreeTierError")) return source;
-  const profile = PROFILES[toolPolicy.generation];
+  // The same lookup `normalizeTools` made, through the same owner: the refusal
+  // this message explains is about the generation that request was sent as, and
+  // a capture that lost that profile has to say so rather than fail on `.tools`.
+  const profile = profileFor(toolPolicy.generation);
   const names = Object.keys(profile.tools).join(", ");
   const { filled } = toolPolicy;
   // 426 is not a refusal of the wording: it is this plugin presenting itself as
@@ -544,23 +619,16 @@ async function server(_input, options = {}) {
             // quietly never used.
             //
             // A response body can only be read once, so what the limits reader
-            // took is handed on as the response the rest of the path works with:
-            // the bytes are the ones that arrived, under headers that still
-            // describe them, and nothing re-reads a body that is already gone.
-            // A response the reader did not consume is used as it arrived.
+            // took is handed on as the response the rest of the path works with
+            // (see `relayed`): never the upstream's own headers over bytes this
+            // package wrote again, and never a prefix presented as the whole
+            // reply. A response the reader did not consume is used as it arrived.
             const observed = await observeRouteStatement(body.model, response, undefined, {
               // The caller's own cancellation reaches this read as well: a host
               // that has given up is not waiting for a number out of a refusal.
               signal: request.signal,
             });
-            const answered =
-              observed === undefined
-                ? response
-                : new Response(observed.text, {
-                    status: response.status,
-                    statusText: response.statusText,
-                    headers: response.headers,
-                  });
+            const answered = relayed(response, observed);
             const guarded = await guardToolResponse(
               explain(observed?.text ?? null, answered, toolPolicy),
               protocol,

package/stream.mjs

@@ -143,10 +143,24 @@ function chatAccumulator() {
           choice.finish_reason = part.finish_reason;
         if (part.logprobs) {
           choice.logprobs ??= {};
+          // Written as a defined own property, and read back as one. A
+          // "__proto__" key arrives as an own property of the parsed object,
+          // and `choice.logprobs[key] = value` would take the inherited
+          // accessor instead: an object value silently re-parented the
+          // accumulated object and the key never reached the reply, while an
+          // array value read Object.prototype back and spread it, throwing
+          // "not iterable" — a 502 on an otherwise valid stream. The delta
+          // written by tool-response.mjs follows the same rule.
           for (const [key, value] of Object.entries(part.logprobs)) {
-            if (Array.isArray(value))
-              choice.logprobs[key] = [...(choice.logprobs[key] ?? []), ...value];
-            else choice.logprobs[key] = value;
+            const held = Object.hasOwn(choice.logprobs, key) ? choice.logprobs[key] : undefined;
+            Object.defineProperty(choice.logprobs, key, {
+              value: Array.isArray(value)
+                ? [...(Array.isArray(held) ? held : []), ...value]
+                : value,
+              writable: true,
+              enumerable: true,
+              configurable: true,
+            });
           }
         }
       }
@@ -173,14 +187,19 @@ function responsesAccumulator() {
   // naming an item the stream never opened has no slot at all — slot 0 is
   // only for a frame that names nothing, which a stream that never indexed
   // its items means as the first one. Merging an unknown item into slot 0
-  // was measured handing a function_call there the text of a message.
-  function slot(data, id) {
+  // was measured handing a function_call there the text of a message. An
+  // `added` frame opens an item, so the id it names is new there by
+  // definition and takes the next free slot; a frame that has to find an
+  // item that is already open still throws.
+  function slot(data, id, fresh = false) {
     if (data.output_index !== undefined) return index(data.output_index);
     if (id === undefined || id === null || id === "") return index(undefined);
     const position = [...output].find(([, value]) => value.id === id)?.[0];
-    if (position === undefined)
-      throw new Error("Upstream frame names an unknown item without an output index");
-    return index(position);
+    if (position !== undefined) return index(position);
+    if (!fresh) throw new Error("Upstream frame names an unknown item without an output index");
+    let next = 0;
+    for (const held of output.keys()) next = Math.max(next, held + 1);
+    return index(next);
   }
   // A snapshot replaces the item in its slot only when it is a whole view of
   // it; a partial one leaves what the deltas delivered standing.
@@ -211,11 +230,19 @@ function responsesAccumulator() {
             keep(position, value);
         }
       } else if (type === "response.output_item.added" || type === "response.output_item.done") {
-        if (data.item) keep(slot(data, data.item.id), data.item);
+        if (data.item)
+          keep(slot(data, data.item.id, type === "response.output_item.added"), data.item);
       } else if (type === "response.content_part.added" || type === "response.content_part.done") {
         const value = item(data);
         value.content ??= [];
-        value.content[index(data.content_index)] = data.part;
+        // A re-emitted opening part carries an empty text where the deltas
+        // have already filled the slot — the partial-snapshot hazard the item
+        // guard above and content_block_start exist for, so the same test.
+        // `refusal` is weighed too: a part whose only content is a refusal
+        // weighs nothing on text alone and would be taken for an empty one.
+        const at = index(data.content_index);
+        if (carries(data.part, value.content[at], ["text", "refusal"]))
+          value.content[at] = data.part;
       } else if (
         type === "response.output_text.delta" ||
         type === "response.output_text.done" ||
@@ -244,7 +271,9 @@ function responsesAccumulator() {
       ) {
         const value = item(data, "reasoning");
         value.summary ??= [];
-        value.summary[index(data.summary_index)] = data.part;
+        // The same re-emitted-opening-frame hazard as content_part above.
+        const at = index(data.summary_index);
+        if (carries(data.part, value.summary[at], ["text"])) value.summary[at] = data.part;
       } else if (/^response\.reasoning_(summary_)?text\.(delta|done)$/.test(type)) {
         const value = item(data, "reasoning");
         const summary = type.includes("summary");
@@ -287,8 +316,18 @@ function responsesAccumulator() {
       const whole = Array.isArray(final.output)
         ? final.output.length > 0
         : final.output !== null && final.output !== undefined;
-      if (whole || !kept.length || Array.isArray(final)) return final;
-      return { ...final, output: kept };
+      // An array is not a reply object at all, and is returned as it came.
+      if (Array.isArray(final)) return final;
+      // The terminal is not the whole reply either. What apply merged onto
+      // the body from the events' top level — usage, status,
+      // incomplete_details, finish_reason, and the object this reply is — is
+      // the upstream's too, and answering with the terminal alone dropped it:
+      // a terminal carrying its whole response beside a top-level usage, or
+      // one that omits object, answered without them. The body is the base,
+      // the terminal overrides what it carries, and the items it lost come
+      // back from the accumulation.
+      if (whole || !kept.length) return { ...body, ...final };
+      return { ...body, ...final, output: kept };
     },
   };
 }
@@ -317,7 +356,15 @@ function anthropicAccumulator() {
         for (const [position, block] of (data.message?.content ?? []).entries())
           if (carries(block, blocks.get(position), fields)) blocks.set(position, block);
       } else if (type === "content_block_start") {
-        blocks.set(index(data.index), data.content_block);
+        // The same test message_start's blocks get, for the same reason: a
+        // gateway re-emitting a block's opening frame carries a block that
+        // was never filled in (a text one opens with text: ""), and taking
+        // it would discard the text, thinking or signature the deltas
+        // already delivered. A start with nothing accumulated applies, as
+        // does one that carries content of its own.
+        const position = index(data.index);
+        if (carries(data.content_block, blocks.get(position), fields))
+          blocks.set(position, data.content_block);
       } else if (type === "content_block_delta") {
         const position = index(data.index);
         const block = blocks.get(position);

package/tool-response.mjs

@@ -158,13 +158,36 @@ function isCall(protocol, value) {
   );
 }
 
+// Counts the ids invented for calls the reply gives nothing to place: a
+// counter cannot be stable, but it is the only thing that keeps two of them
+// apart (see inPlaceOf).
+let synthesized = 0;
+
 // What a call left out of a Responses or Messages reply becomes: text
-// saying so, in the call's place, so no later index moves.
-function inPlaceOf(protocol, call, note) {
+// saying so, in the call's place, so no later index moves. `at` is where the
+// call sits in the reply as far as the caller can tell — a frame's
+// output_index, or the index the walk found it at.
+function inPlaceOf(protocol, call, note, at) {
   if (protocol === "anthropic") return { type: "text", text: note };
+  // An item id is what a Responses client keys the item by, and what the
+  // streaming path suppresses arguments by. One call is replaced more than
+  // once — its output_item.added, its output_item.done, and the copy inside
+  // the terminal response's output — so the invented id has to be the same
+  // every time: a counter made one call into several items to the client, and
+  // left leftIDs unable to match its arguments frames. A call's place is the
+  // same in all three, and two calls cannot share one, so the id names it.
+  //
+  // A call the reply places nowhere keeps the counter — and names it under a
+  // different word, because both arms are inventing ids in one reply: a counter
+  // that happened to reach another call's index would hand two unrelated calls
+  // the same item, which is the failure the counter was introduced to prevent.
+  const id =
+    typeof call.id === "string" && call.id
+      ? call.id
+      : `msg_${call.call_id ?? (at === undefined ? `anon_${++synthesized}` : `dropped_${at}`)}`;
   return {
     type: "message",
-    id: typeof call.id === "string" && call.id ? call.id : `msg_${call.call_id ?? "dropped"}`,
+    id,
     role: "assistant",
     status: call.status ?? "completed",
     content: [{ type: "output_text", text: note, annotations: [] }],
@@ -194,10 +217,15 @@ function checkSnapshots(data, protocol, checkName) {
   let kept = 0;
   let left = 0;
   if (!object(data)) throw new GuardError("Invalid upstream tool snapshot");
-  // Each entry is a value and where it sits, so a call can be replaced.
-  const stack = [[data, null, null]];
+  // Each entry is a value, where it sits, and the place it holds in the reply
+  // as far as the walk knows: an item of an output array is at its index, and
+  // anything reached through an object — a frame's own `item` — keeps the
+  // output_index the frame carries, which is where that item sits. A call
+  // left out is replaced by an item whose invented id names that place, so
+  // the added, done and terminal copies of one call are one item (inPlaceOf).
+  const stack = [[data, null, null, object(data) ? data.output_index : undefined]];
   while (stack.length) {
-    const [value, holder, key] = stack.pop();
+    const [value, holder, key, at] = stack.pop();
     if (!object(value)) throw new GuardError("Invalid upstream tool snapshot");
     if (
       protocol === "responses" &&
@@ -211,7 +239,7 @@ function checkSnapshots(data, protocol, checkName) {
       const name = checkName(value.name);
       if (name == null) {
         if (!holder) throw new GuardError(droppedNote(value.name), "undeclared_tool");
-        holder[key] = inPlaceOf(protocol, value, droppedNote(value.name));
+        holder[key] = inPlaceOf(protocol, value, droppedNote(value.name), at);
         changed = true;
         left++;
         continue;
@@ -229,10 +257,10 @@ function checkSnapshots(data, protocol, checkName) {
       // Text content is not a snapshot container.
       if (typeof value[name] === "string") continue;
       const items = list(value[name]);
-      for (let i = 0; i < items.length; i++) stack.push([items[i], items, i]);
+      for (let i = 0; i < items.length; i++) stack.push([items[i], items, i, i]);
     }
     for (const name of objects) {
-      if (value[name] != null) stack.push([value[name], value, name]);
+      if (value[name] != null) stack.push([value[name], value, name, at]);
     }
   }
   if (
@@ -451,7 +479,10 @@ function snapshotStream(protocol, checkName) {
           checkName(item.name) == null
         ) {
           const note = droppedNote(item.name);
-          const message = inPlaceOf(protocol, item, note);
+          // The frame's output_index is this call's place in the reply, which
+          // is the id its later frames (done, the terminal's output) invent
+          // for it again (inPlaceOf).
+          const message = inPlaceOf(protocol, item, note, data.output_index);
           left.set(data.output_index, true);
           leftIDs.add(message.id);
           if (typeof item.id === "string") leftIDs.add(item.id);
@@ -532,6 +563,7 @@ async function readBounded(response) {
   if (!reader) return "";
   const parts = [];
   let bytes = 0;
+  let failure;
   try {
     while (true) {
       const { done, value } = await reader.read();
@@ -541,20 +573,28 @@ async function readBounded(response) {
         throw new GuardError(`Upstream response exceeds the ${LIMIT} buffer limit`);
       parts.push(value);
     }
+  } catch (error) {
+    failure = error;
+  }
+  // Whatever ended the read — the limit, a malformed body, or the end of it —
+  // this body is never read again, so the stream is cancelled and the reader
+  // loosed. This was the one place in the package that abandoned a body
+  // without cancelling it (measured: no cancellation past the limit, and the
+  // source still pulled after the 502), which leaves an upstream writing into
+  // a socket nobody reads. A cancel that fails must not stand in for what
+  // ended the read: an oversized body is the 502 this function promises, not
+  // an opaque transport error, so the cancel's failure is kept as that
+  // error's cause — and is thrown itself only when nothing else went wrong.
+  // The lock is released either way.
+  try {
+    await reader.cancel();
+  } catch (error) {
+    if (!failure) throw error;
+    if (failure instanceof Error && !("cause" in failure)) failure.cause = error;
   } finally {
-    // Whatever ended the read — the limit, a malformed body, or the end of
-    // it — this body is never read again, so the reader is loosed and the
-    // stream cancelled. This was the one place in the package that abandoned
-    // a body without cancelling it (measured: no cancellation past the limit,
-    // and the source still pulled after the 502), which leaves an upstream
-    // writing into a socket nobody reads. The cancel's own failure is not
-    // swallowed, and the lock is released whether it threw or not.
-    try {
-      await reader.cancel();
-    } finally {
-      reader.releaseLock();
-    }
+    reader.releaseLock();
   }
+  if (failure) throw failure;
   const all = new Uint8Array(bytes);
   let offset = 0;
   for (const part of parts) {
@@ -743,7 +783,14 @@ function chatTrack() {
         if (choice.finish_reason != null) {
           finished.add(index);
           open.delete(index);
-        } else if (!finished.has(index)) open.add(index);
+        } else {
+          // A frame for this choice after it finished opens a new round of it
+          // (chatBuffer.apply judges a later round the same way), so the
+          // choice is open again: latching it shut for good left a round cut
+          // short with no note and no finish_reason, only a bare [DONE].
+          finished.delete(index);
+          open.add(index);
+        }
       }
     },
     // ending answers the frames that end the reply as cut short, or null
@@ -919,7 +966,17 @@ function guardedStream(response, protocol, checkName, endCutShort) {
             );
             controller.close();
           } else {
-            release();
+            // A failure that is not the guard's own is a transport one: the
+            // stream is over either way, and what is left of the body is not
+            // something to keep writing into a socket nobody reads — the
+            // same rule readBounded follows. Cancel's own failure is not
+            // allowed to replace the error the client has to see, which is
+            // the one that got here.
+            try {
+              await cancel(error);
+            } catch {
+              /* the original error is the one the client must see */
+            }
             controller.error(error);
           }
         }
@@ -938,9 +995,12 @@ function guardedStream(response, protocol, checkName, endCutShort) {
 // collapsed for a client that doesn't stream fails instead, so it can be
 // asked again before anything reached the client.
 export async function guardToolResponse(response, protocol, policy, options = {}) {
-  if (!response.ok) return response;
+  // A protocol this guard has no rules for is the caller's mistake, and it
+  // is one whichever the upstream answered: checked before the status is
+  // read, so an error response cannot return it unexamined.
   if (!["chat", "responses", "anthropic"].includes(protocol))
     throw new TypeError(`Unsupported protocol: ${protocol}`);
+  if (!response.ok) return response;
   const checkName = nameGuard(policy);
   const headers = headersFor(response);
   const contentType = response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase();