opencode-zen-freex 0.2.11 → 0.2.13

package/MAINTAINING.md

@@ -22,7 +22,13 @@ small. `deepseek-v4.1-flash-free` is declared 200000/32000 while
 `deepseek-v4.1-flash` — the paid id serving the same upstream model, which
 `x-opencode-upstream-model-id` confirms — is declared 1000000/384000 in that
 same catalogue, and `mimo-v2.6-flash-free` is declared 200000/32000 against a
-model whose own vendor publishes 1048576/131072.
+model whose own vendor publishes 1048576/131072. The ids the tier added on
+2026-10-16 were under-reported the same way on the day they appeared:
+`ll-alpha-free` names a 262144-token completion ceiling in its own refusal
+against a declared 65536, and `glm-5.3-flash-free` is declared 200000/32000
+while its paid twin `glm-5.3-flash` is declared 1000000/131072 in the same
+catalogue — and a 232685-token prompt was served through the free id, which the
+declared window does not allow.
 
 Both numbers are acted on. The window decides when a conversation is compacted
 and how much of it is ever sent; the output cap is sent as `max_tokens` on every
@@ -42,6 +48,9 @@ measured against. Each axis carries `samples` and `how`; the short of it:
 | `big-pickle` | output | 131072 | the ceiling the route names when it is asked for too much |
 | `nemotron-3.5-lightning-free` | context | 1000000 | the route's own refusal, in its own words |
 | `longcat-2.5-preview-free` | output | 262144 | the ceiling the route names when it is asked for too much |
+| `ll-alpha-free` | output | 262144 | the ceiling the route's own refusal names, against a declared 65536 |
+| `glm-5.3-flash-free` | context | 1000000 | what this route declares for the same upstream model, with a 232685-token prompt served as witness |
+| `glm-5.3-flash-free` | output | 131072 | what this route declares for the same upstream model |
 
 A prompt sized just over the window is refused with
 

package/README.md

@@ -47,7 +47,7 @@ magpie plugin login opencode-zen-free
 
 免费模型的目录上限有时被 Zen 少报，而少报的那一边没有谁会报错：`deepseek-v4.1-flash-free` 在目录里是 20 万上下文 / 3.2 万输出，而同一上游模型的付费 id 是 100 万 / 38.4 万。上下文窗口太小只会让宿主安静地早点压缩，输出上限太小会把回复截断成看起来像模型自己停下的样子，所以插件对这类模型按实测与路由自述对齐（依据与复测方法见 `MAINTAINING.md` 的 “Limits Zen under-reports”），并在运行中采用上游自报的窗口。
 
-已下线的模型和 SystemOne 模型会被排除。这份列表在宿主每次列举模型时重新获取（magpie 在启动时做一次，之后每小时一次）：Zen 不再免费开放的模型会退出列表，新转为免费的模型会加入列表——**不等** OpenCode 的目录或文档写到它：只要 Zen 的列表里有、id 里带 `-free`，就按 provider 自己的协议（OpenAI 兼容 / chat）提供，目录晚一步也不影响。
+已下线的模型和 SystemOne 模型会被排除：「下线」指的是状态写着 `retired`/`disabled`，或带着已生效的退役日期。目录里标了 `deprecated` 但 Zen 的列表里还在的模型**照常提供**——`deprecated` 是预告，而「还在不在」由列表说了算（实测 2026-10-16：`muse-spark-1.2-contributor-free` 在目录里是 `deprecated`，Zen 仍在服务它，把它当退役就把一个能用的免费模型藏掉了）。这份列表在宿主每次列举模型时重新获取（magpie 在启动时做一次，之后每小时一次）：Zen 不再免费开放的模型会退出列表，新转为免费的模型会加入列表——**不等** OpenCode 的目录或文档写到它：只要 Zen 的列表里有、id 里带 `-free`，就按 provider 自己的协议（OpenAI 兼容 / chat）提供，目录晚一步也不影响。
 
 目录或文档读不到时**不算 fallback**：Zen 的列表已经读到了，它就是当前该提供的东西；报成 fallback 会让宿主保守地沿用上一次完整读到的列表，于是读不到 `raw.githubusercontent.com` 或 `models.opencode.ai` 的机器永远看不到之后新转免费的模型。只有**列表本身**读不到才沿用上一次结果；第一次还没读到之前，用的是打包在插件里的那份，所以这个 provider 不会空着。请求一个当前并不免费的模型，会得到一个 404 并列出当时免费的模型；若某个模型是在上次列举之后才转免费的，请求会在重新获取列表后照常服务（最多每分钟一次）。可用性和限流由 Zen 决定，插件这边拿不到剩余额度。
 

package/core-tools.mjs

@@ -106,7 +106,12 @@ export function generationOf(tools) {
 // `.agent` with a TypeError that names nothing. Ownership of the key is half of
 // it — a capture holding `{"1.x": null}` owns the key and still has no profile,
 // and the `.agent` of that is the same unnamed TypeError.
-function profileFor(generation) {
+//
+// Exported, because the same two mistakes are reachable from outside this file
+// and are made there: `provider.mjs` indexes `PROFILES[...]` directly to read a
+// profile's `tools`, and a capture missing that generation then fails with
+// "Cannot read properties of undefined" instead of the sentence below.
+export function profileFor(generation) {
   if (!Object.hasOwn(PROFILES, generation)) {
     throw new Error(
       `core-tools: no profile for generation ${JSON.stringify(generation)}; ` +

package/limits.mjs

@@ -96,20 +96,62 @@ export const LIMITS = {
       how: "\"Upstream request failed: [invalid_parameter] 参数校验失败: /max_tokens: 1000000 is not less or equal to 262144\" — the second wording namedOutputCap reads, where the ceiling is the number max_tokens has to stay under. Its context needs nothing: the catalogue's 1000000 is what that same refusal calls the endpoint's window.",
     },
   },
+  // The two the free tier added on 2026-10-16, each measured the day it was
+  // noticed. Both under-report in the catalogue the same way the older entries
+  // do, and both were checked on every axis: nothing below is what a refusal
+  // happened to say, it is all that was asked.
+  "ll-alpha-free": {
+    output: {
+      value: 262144,
+      source: "route",
+      declaredAt: 65536,
+      measured: "2026-10-16",
+      samples: "max_completion_tokens 1000000 and 300000 both refused, each naming 262144; nothing above 65536 watched — the ceiling is the route's own number, four times what the catalogue declares",
+      how: "\"Upstream request failed: [400] max_completion_tokens is too large: 300000.This model supports at most 262144 completion tokens.\" — the ceiling is the number the sentence names. Its context needs nothing: the same day's refusal, \"The input (341480 tokens) is longer than the model's context length (262144 tokens).\", is the window the catalogue already declares.",
+    },
+  },
+  "glm-5.3-flash-free": {
+    context: {
+      value: 1000000,
+      source: "route-twin",
+      declaredAt: 200000,
+      measured: "2026-10-16",
+      samples: "a 232685-token prompt was served and answered from (usage.prompt_tokens 232685), so the declared 200000 is already known to be small; nothing above it was refused, because this upstream refuses no max_tokens at all",
+      how: "glm-5.3-flash, the paid id serving the same upstream model — the catalogue's own canonical_model_id for this free id is zhipuai/glm-5.3-flash — is declared 1000000 in this same catalogue",
+    },
+    output: {
+      value: 131072,
+      source: "route-twin",
+      declaredAt: 32000,
+      measured: "2026-10-16",
+      samples: "max_tokens 4000000 was accepted with no refusal at all, which is the DeepSeek upstream's shape: silence here is not evidence of a ceiling either way, and nothing above 32000 was watched",
+      how: "the same paid twin declares 131072 on this axis",
+    },
+  },
 };
 
 // "This model's maximum context length is 1048576 tokens. However, you
 // requested 1422278 tokens (1038278 in the messages, 384000 in the
-// completion)." — the route's own words, and the only sentence seen on this
-// route that states a window. A second upstream phrases the same fact as "This
-// endpoint's maximum context length is ...", with the request broken into text
-// input, tool input and output; both are the route naming its own window, and
-// its "requested about" figure is a rough one (chars, not tokens) rather than
-// the count a served request reports in `usage.prompt_tokens`. A generic 400
-// says nothing attributable and is left alone; §7 of the measured notes has a
-// context overflow and an invalid parameter answering with byte-identical 400s
+// completion)." — the route's own words, and the sentence seen most often on
+// this route that states a window. A second upstream phrases the same fact as
+// "This endpoint's maximum context length is ...", with the request broken into
+// text input, tool input and output; both are the route naming its own window,
+// and its "requested about" figure is a rough one (chars, not tokens) rather
+// than the count a served request reports in `usage.prompt_tokens`. A generic
+// 400 says nothing attributable and is left alone; §7 of the measured notes has
+// a context overflow and an invalid parameter answering with byte-identical 400s
 // on another Zen model.
-const NAMED_CONTEXT = /maximum context length is (\d+) tokens/i;
+//
+// A third wording states the same fact as a parenthetical, and was missed until
+// it was measured: "The input (341480 tokens) is longer than the model's context
+// length (262144 tokens)." (`ll-alpha-free`, 2026-10-16). It names the same
+// number in the same sentence, so it is read the same way — a window this file
+// does not read is a window the plugin keeps under-declaring, which is the one
+// failure it exists to remove.
+const NAMED_CONTEXT = [
+  /maximum context length is (\d+) tokens/id,
+  /context length \((\d+) tokens?\)/id,
+];
 
 // "max_tokens is too large: 200000. This model supports at most 131072 completion
 // tokens, whereas you provided 200000." — an upstream that validates the ceiling
@@ -119,10 +161,10 @@ const NAMED_CONTEXT = /maximum context length is (\d+) tokens/i;
 // answers 200 there, so silence from this one says nothing about a model, and a
 // request that is served is not evidence of a ceiling either way.
 const NAMED_OUTPUT = [
-  /supports at most (\d+) completion tokens/i,
+  /supports at most (\d+) completion tokens/id,
   // "/max_tokens: 1000000 is not less or equal to 262144" — LongCat's wording for
   // the same fact, where the ceiling is the number it has to stay under.
-  /max_tokens:?\s*\d+\s+is not less or equal to\s+(\d+)/i,
+  /max_tokens:?\s*\d+\s+is not less or equal to\s+(\d+)/id,
 ];
 
 // Names a refusal made while this process is running, by model id. Not
@@ -169,7 +211,7 @@ function describe({ kind, id, axis, value, measuredAgainst, declared }) {
 // The window a refusal names, or undefined when the body says nothing
 // attributable. Exported for the tests and for anyone reading a capture.
 export function namedContextWindow(text) {
-  return namedFrom([NAMED_CONTEXT], text)?.value;
+  return namedFrom(NAMED_CONTEXT, text)?.value;
 }
 
 // The completion ceiling a refusal names, or undefined. Same rule as the window:
@@ -349,25 +391,33 @@ export async function observeRouteStatement(id, response, limit = 4096, { signal
   }
 }
 
-// How close to the end of what was read a match has to end before a truncated
-// body makes it unusable. A number ending inside this margin of the last
-// character read may have had digits past it — `2621` where the body said
-// `262144` — and a smaller limit that looks like a real one is the one failure
-// this guard exists to prevent. Numbers further back are inside the buffer
-// entirely and are read as they stand.
-const CUT_MARGIN = 8;
+// Where the number a match named ends, in the text it was matched against. The
+// `d` flag is what makes this exact: `NAMED_CONTEXT` and the first
+// `NAMED_OUTPUT` run on past the digits (" completion tokens"), so judging the
+// cut by the match's own end threw away numbers that were provably whole — the
+// digits ended well before the read did, with text after them that the greedy
+// `(\d+)` had refused to consume.
+function digitsEnd(found) {
+  const at = found?.match?.indices?.[1]?.[1];
+  // The match's own end is the conservative answer when the pattern cannot say
+  // where the digits are: it drops a whole number rather than reading a cut one,
+  // which is the direction this guard has to fail in.
+  return Number.isSafeInteger(at) ? at : found.match.index + found.match[0].length;
+}
 
 // The axes the first `limit` characters of `text` name. `cut` says the read
-// stopped at the budget with the body going on, so a match ending at the margin
-// may have been a longer number: that axis is left unread rather than reported a
-// digit short. Each axis is read from the match its number came from, so the
-// match the guard judges and the number that is returned cannot be two answers.
+// stopped before the body did, so a number whose own digits reach the last
+// character read may have had digits past it: that axis is left unread rather
+// than reported a digit short. Any character after the digits inside the head
+// proves the number ended, since a greedy `\d+` would have taken it — only
+// digits touching the boundary are ambiguous. Each axis is read from the match
+// its number came from, so the match the guard judges and the number that is
+// returned cannot be two answers.
 function namedAxes(text, limit, cut) {
   const head = text.slice(0, limit);
-  const context = namedFrom([NAMED_CONTEXT], head);
+  const context = namedFrom(NAMED_CONTEXT, head);
   const output = namedFrom(NAMED_OUTPUT, head);
-  const onCut = (found) =>
-    cut && Boolean(found) && found.match.index + found.match[0].length >= head.length - CUT_MARGIN;
+  const onCut = (found) => cut && found !== undefined && digitsEnd(found) >= head.length;
   return {
     context: onCut(context) ? undefined : context?.value,
     output: onCut(output) ? undefined : output?.value,
@@ -394,7 +444,12 @@ export function limitOverrides(
   // declared, from a table that never named it.
   const record = table && Object.hasOwn(table, id) ? table[id] : undefined;
   for (const axis of ["context", "output"]) {
-    const declaredValue = declared?.[axis];
+    // Own property, like the table lookup two lines up: `declared` is handed in
+    // by a caller, and a `context` inherited from a custom prototype — or from a
+    // polluted `Object.prototype` — would otherwise be read as a declaration the
+    // catalogue never made, feeding the staleness compare and the raise-only
+    // check with a number nobody declared.
+    const declaredValue = declared && Object.hasOwn(declared, axis) ? declared[axis] : undefined;
     const entry = record?.[axis];
     const live = (axis === "context" ? observed : observedOutput)?.get(id);
     // A route statement made while this process was running is the same tier as

package/models.mjs

@@ -44,15 +44,23 @@ const hasValue = (value) => value !== null && value !== undefined;
 // offered. A status that is set — "active" included — is still read as itself.
 const isSet = (value) => hasValue(value) && String(value).trim() !== "";
 
+// A status ends a model when it says the model is gone: "retired" and
+// "disabled" are endings. "deprecated" is not one — it says the catalogue
+// expects the model to go, and what decides whether it is still there is the
+// list Zen serves, which discovery already reads: measured 2026-10-16,
+// `muse-spark-1.2-contributor-free` is marked deprecated in the catalogue while
+// Zen lists it and the free tier answers a request for it through this plugin,
+// so reading that status as an ending hid a model that was being served.
+const ENDED = ["retired", "disabled"];
+
 function isRetired(model) {
   return (
     model.deprecated === true ||
-    ["deprecated", "retired", "disabled"].includes(
-      isSet(model.status) ? model.status : model.lifecycle,
-    ) ||
+    ENDED.includes(isSet(model.status) ? model.status : model.lifecycle) ||
     // Read through `isSet`, not `hasValue`: a blank `deprecated_at` is the empty
     // string the catalogue writes for a date it does not have, and reading it as
-    // a date retired a model that was still on offer.
+    // a date retired a model that was still on offer. An effective date is an
+    // ending whatever the status beside it says.
     isSet(model.deprecated_at) ||
     isSet(model.retirement_date)
   );
@@ -191,10 +199,19 @@ export const bootstrapProtocols = {
   "nemotron-3.5-lightning-free": "chat",
   "muse-spark-1.3-contributor-free": "responses",
   "jev-1.13-free": "systemone",
+  // The free tier's list on 2026-10-16, when these five appeared: the four chat
+  // ones and the responses one below, whose paid twin the docs table names.
+  "deepseek-v4.1-flash-free": "chat",
+  "glm-5.3-flash-free": "chat",
+  "ll-alpha-free": "chat",
+  "nemotron-3.5-super-vl-free": "chat",
+  "muse-spark-1.2-contributor-free": "responses",
 };
 
-// Offline bootstrap metadata from the OpenCode catalog, 2026-10-06; the
-// free models listed since added on 2026-10-15.
+// Offline bootstrap metadata from the OpenCode catalog, 2026-10-06; the free
+// models listed since added on 2026-10-15, and the ids the tier was serving on
+// 2026-10-16 added then. A host that reaches nothing on its first run offers
+// these; the first discovery replaces the list.
 export const bootstrapProvider = {
   npm: SDK.chat,
   models: {
@@ -270,6 +287,66 @@ export const bootstrapProvider = {
         { type: "effort", values: ["minimal", "low", "medium", "high", "xhigh"] },
       ],
     },
+    // The free ids the tier was serving on 2026-10-16 and this snapshot did not
+    // carry. Their numbers are the catalogue's, as every other entry here is —
+    // `limits.mjs` is what corrects the ones the catalogue under-reports, and it
+    // carries entries for two of these.
+    "deepseek-v4.1-flash-free": {
+      name: "DeepSeek V4.1 Flash Free",
+      cost: { input: 0, output: 0 },
+      limit: { context: 200000, output: 32000 },
+      reasoning: true,
+      tool_call: true,
+      interleaved: { field: "reasoning_content" },
+      modalities: { input: ["text", "image"], output: ["text"] },
+      reasoning_options: [{ type: "effort", values: ["low", "high", "max"] }],
+    },
+    "glm-5.3-flash-free": {
+      name: "GLM-5.3-Flash Free",
+      cost: { input: 0, output: 0 },
+      limit: { context: 200000, output: 32000 },
+      reasoning: true,
+      tool_call: true,
+      interleaved: { field: "reasoning_content" },
+      modalities: { input: ["text", "image", "video", "pdf"], output: ["text"] },
+      reasoning_options: [{ type: "effort", values: ["low", "high", "max"] }],
+    },
+    "ll-alpha-free": {
+      name: "LL Alpha Free",
+      cost: { input: 0, output: 0 },
+      limit: { context: 262144, output: 65536 },
+      reasoning: true,
+      tool_call: true,
+      interleaved: { field: "reasoning_content" },
+      modalities: { input: ["text"], output: ["text"] },
+      reasoning_options: [
+        { type: "effort", values: ["low", "medium", "high", "xhigh", "max"] },
+      ],
+    },
+    "nemotron-3.5-super-vl-free": {
+      name: "Nemotron 3.5 Super VL Free",
+      cost: { input: 0, output: 0 },
+      limit: { context: 1048576, output: 131072 },
+      reasoning: true,
+      tool_call: true,
+      interleaved: { field: "reasoning_content" },
+      modalities: { input: ["text", "image"], output: ["text"] },
+      reasoning_options: [
+        { type: "effort", values: ["none", "minimal", "low", "medium", "high", "xhigh"] },
+      ],
+    },
+    "muse-spark-1.2-contributor-free": {
+      name: "Muse Spark 1.2 Free",
+      cost: { input: 0, output: 0 },
+      provider: { npm: SDK.responses },
+      limit: { context: 1048576, output: 131072 },
+      reasoning: true,
+      tool_call: true,
+      modalities: { input: ["text", "image", "video", "pdf", "audio"], output: ["text"] },
+      reasoning_options: [
+        { type: "effort", values: ["minimal", "low", "medium", "high", "xhigh"] },
+      ],
+    },
   },
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-zen-freex",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "OpenCode Zen's free models, for hosts that are not OpenCode: the public credential, automatic discovery and native streaming protocols",
   "type": "module",
   "main": "./index.mjs",

package/provider.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { PROFILES, agentFor, generationOf } from "./core-tools.mjs";
+import { agentFor, generationOf, profileFor } from "./core-tools.mjs";
 import {
   PROVIDER,
   SDK,
@@ -158,6 +158,22 @@ function relayedRefusal(response, observed) {
   );
 }
 
+// The response this path hands on, from what the limits reader made of the one
+// that arrived: the same response when it never read it — the reader touches no
+// 2xx body, so that is the common branch — the bytes it read under headers
+// corrected for them when it read the whole body, and a refusal that says so
+// when it stopped short. One decision, written once, so the three outcomes
+// cannot be read as a chain of ternaries at the call site.
+function relayed(response, observed) {
+  if (observed === undefined) return response;
+  if (!observed.ended) return relayedRefusal(response, observed);
+  return new Response(observed.text, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: relayedHeaders(response),
+  });
+}
+
 // How long a request for a model the last list didn't have waits before it
 // asks Zen's list again: a model Zen made free since is served at once,
 // and a model typed in by hand doesn't ask the list on every request.
@@ -210,20 +226,23 @@ function normalizeTools(body, protocol) {
   const declared = new Set([...present].filter((value) => typeof value === "string"));
   // The legacy top-level `functions` array is the older way of declaring the
   // same tools, and one a chat host may still use. Its names are declarations,
-  // so they count as declared — and, since they are not in `body.tools`, they
-  // are also remembered as "do not stand in for this name": the fill loop
-  // below looks at where a name already sits, and a name that only arrived
-  // through `functions` has no index there. Without this the same tool would go
-  // out twice, which is what the note on `nameOf` says must not happen.
+  // so they count as declared, and the fill loop below finds them by name: a
+  // name that only arrived through `functions` has no index in `body.tools`, so
+  // it is looked up in the array itself and reworded where it sits rather than
+  // being stood in for. Without that the same tool would go out twice, which is
+  // what the note on `nameOf` says must not happen.
   const legacy = Array.isArray(body.functions) && protocol === "chat" ? body.functions : [];
   for (const tool of legacy) if (typeof tool?.name === "string") declared.add(tool.name);
-  const declaredElsewhere = new Set(legacy.map((tool) => tool?.name));
   // Zen takes a request for one generation of OpenCode or the other, and the tools
   // it carries say which: `shell` is 2.x, `bash` is 1.x. Names move far less
   // often than descriptions do, so this survives a rewording that a pinned
   // User-Agent would not.
   const generation = generationOf(body.tools) ?? DEFAULT_GENERATION;
-  const profile = PROFILES[generation];
+  // Through `profileFor`, not `PROFILES[generation]`: a capture that holds one
+  // generation leaves the other key absent, and the direct read fails below on
+  // `profile.tools` with a TypeError that names nothing — the capture is what
+  // has to change, and it is the one thing that error does not say.
+  const profile = profileFor(generation);
   const filled = [];
   const at = new Map();
   body.tools.forEach((tool, index) => {
@@ -252,8 +271,17 @@ function normalizeTools(body, protocol) {
     // tightened check would otherwise find missing.
     if (!profile.required.includes(name)) continue;
     // Declared through `functions` rather than `tools`: this host does have the
-    // tool, so it is not one to stand in for.
-    if (declaredElsewhere.has(name)) continue;
+    // tool, so it is not one to stand in for. Its wording is still the host's,
+    // though, and Zen reads the wording of a tool it knows by name whichever
+    // array carried it — leaving that one entry as the host wrote it is the
+    // refusal this loop exists to prevent, and it is the entry `explain()`
+    // would then describe wrongly. The legacy shape carries `description` at
+    // the top level, which `setDescription` already handles.
+    const throughFunctions = legacy.find((tool) => tool?.name === name);
+    if (throughFunctions) {
+      setDescription(throughFunctions, spoken.description);
+      continue;
+    }
     filled.push(name);
     // A tool added here has nothing behind it: the agent has no such tool and
     // a call to it is dropped. Describing it as OpenCode describes it is what
@@ -308,7 +336,10 @@ function explain(text, source, toolPolicy) {
   // A 403 that is not Zen's free tier is somebody else's; it is left as sent —
   // its bytes are what arrived, and so are the headers describing them.
   if (source.status === 403 && !text.includes("FreeTierError")) return source;
-  const profile = PROFILES[toolPolicy.generation];
+  // The same lookup `normalizeTools` made, through the same owner: the refusal
+  // this message explains is about the generation that request was sent as, and
+  // a capture that lost that profile has to say so rather than fail on `.tools`.
+  const profile = profileFor(toolPolicy.generation);
   const names = Object.keys(profile.tools).join(", ");
   const { filled } = toolPolicy;
   // 426 is not a refusal of the wording: it is this plugin presenting itself as
@@ -588,28 +619,16 @@ async function server(_input, options = {}) {
             // quietly never used.
             //
             // A response body can only be read once, so what the limits reader
-            // took is handed on as the response the rest of the path works with:
-            // never the upstream's own headers over bytes this package wrote
-            // again, and never a prefix presented as the whole reply. A read
-            // that reached the end of the body is that body, relayed under
-            // headers corrected for it; one that stopped short is answered with
-            // a refusal that says so (see `relayedRefusal`). A response the
-            // reader did not consume is used as it arrived.
+            // took is handed on as the response the rest of the path works with
+            // (see `relayed`): never the upstream's own headers over bytes this
+            // package wrote again, and never a prefix presented as the whole
+            // reply. A response the reader did not consume is used as it arrived.
             const observed = await observeRouteStatement(body.model, response, undefined, {
               // The caller's own cancellation reaches this read as well: a host
               // that has given up is not waiting for a number out of a refusal.
               signal: request.signal,
             });
-            const answered =
-              observed === undefined
-                ? response
-                : observed.ended
-                  ? new Response(observed.text, {
-                      status: response.status,
-                      statusText: response.statusText,
-                      headers: relayedHeaders(response),
-                    })
-                  : relayedRefusal(response, observed);
+            const answered = relayed(response, observed);
             const guarded = await guardToolResponse(
               explain(observed?.text ?? null, answered, toolPolicy),
               protocol,

package/stream.mjs

@@ -187,14 +187,19 @@ function responsesAccumulator() {
   // naming an item the stream never opened has no slot at all — slot 0 is
   // only for a frame that names nothing, which a stream that never indexed
   // its items means as the first one. Merging an unknown item into slot 0
-  // was measured handing a function_call there the text of a message.
-  function slot(data, id) {
+  // was measured handing a function_call there the text of a message. An
+  // `added` frame opens an item, so the id it names is new there by
+  // definition and takes the next free slot; a frame that has to find an
+  // item that is already open still throws.
+  function slot(data, id, fresh = false) {
     if (data.output_index !== undefined) return index(data.output_index);
     if (id === undefined || id === null || id === "") return index(undefined);
     const position = [...output].find(([, value]) => value.id === id)?.[0];
-    if (position === undefined)
-      throw new Error("Upstream frame names an unknown item without an output index");
-    return index(position);
+    if (position !== undefined) return index(position);
+    if (!fresh) throw new Error("Upstream frame names an unknown item without an output index");
+    let next = 0;
+    for (const held of output.keys()) next = Math.max(next, held + 1);
+    return index(next);
   }
   // A snapshot replaces the item in its slot only when it is a whole view of
   // it; a partial one leaves what the deltas delivered standing.
@@ -225,11 +230,19 @@ function responsesAccumulator() {
             keep(position, value);
         }
       } else if (type === "response.output_item.added" || type === "response.output_item.done") {
-        if (data.item) keep(slot(data, data.item.id), data.item);
+        if (data.item)
+          keep(slot(data, data.item.id, type === "response.output_item.added"), data.item);
       } else if (type === "response.content_part.added" || type === "response.content_part.done") {
         const value = item(data);
         value.content ??= [];
-        value.content[index(data.content_index)] = data.part;
+        // A re-emitted opening part carries an empty text where the deltas
+        // have already filled the slot — the partial-snapshot hazard the item
+        // guard above and content_block_start exist for, so the same test.
+        // `refusal` is weighed too: a part whose only content is a refusal
+        // weighs nothing on text alone and would be taken for an empty one.
+        const at = index(data.content_index);
+        if (carries(data.part, value.content[at], ["text", "refusal"]))
+          value.content[at] = data.part;
       } else if (
         type === "response.output_text.delta" ||
         type === "response.output_text.done" ||
@@ -258,7 +271,9 @@ function responsesAccumulator() {
       ) {
         const value = item(data, "reasoning");
         value.summary ??= [];
-        value.summary[index(data.summary_index)] = data.part;
+        // The same re-emitted-opening-frame hazard as content_part above.
+        const at = index(data.summary_index);
+        if (carries(data.part, value.summary[at], ["text"])) value.summary[at] = data.part;
       } else if (/^response\.reasoning_(summary_)?text\.(delta|done)$/.test(type)) {
         const value = item(data, "reasoning");
         const summary = type.includes("summary");
@@ -301,8 +316,18 @@ function responsesAccumulator() {
       const whole = Array.isArray(final.output)
         ? final.output.length > 0
         : final.output !== null && final.output !== undefined;
-      if (whole || !kept.length || Array.isArray(final)) return final;
-      return { ...final, output: kept };
+      // An array is not a reply object at all, and is returned as it came.
+      if (Array.isArray(final)) return final;
+      // The terminal is not the whole reply either. What apply merged onto
+      // the body from the events' top level — usage, status,
+      // incomplete_details, finish_reason, and the object this reply is — is
+      // the upstream's too, and answering with the terminal alone dropped it:
+      // a terminal carrying its whole response beside a top-level usage, or
+      // one that omits object, answered without them. The body is the base,
+      // the terminal overrides what it carries, and the items it lost come
+      // back from the accumulation.
+      if (whole || !kept.length) return { ...body, ...final };
+      return { ...body, ...final, output: kept };
     },
   };
 }

package/tool-response.mjs

@@ -158,22 +158,33 @@ function isCall(protocol, value) {
   );
 }
 
-// Counts the ids invented for calls that came without one, so that no two of
-// them can be handed the same id (see inPlaceOf).
+// Counts the ids invented for calls the reply gives nothing to place: a
+// counter cannot be stable, but it is the only thing that keeps two of them
+// apart (see inPlaceOf).
 let synthesized = 0;
 
 // What a call left out of a Responses or Messages reply becomes: text
-// saying so, in the call's place, so no later index moves.
-function inPlaceOf(protocol, call, note) {
+// saying so, in the call's place, so no later index moves. `at` is where the
+// call sits in the reply as far as the caller can tell — a frame's
+// output_index, or the index the walk found it at.
+function inPlaceOf(protocol, call, note, at) {
   if (protocol === "anthropic") return { type: "text", text: note };
   // An item id is what a Responses client keys the item by, and what the
-  // streaming path suppresses arguments by: two calls that arrived without
-  // one and shared the id invented here would be one item to the client, and
-  // the arguments of one would be read as the other's.
+  // streaming path suppresses arguments by. One call is replaced more than
+  // once — its output_item.added, its output_item.done, and the copy inside
+  // the terminal response's output — so the invented id has to be the same
+  // every time: a counter made one call into several items to the client, and
+  // left leftIDs unable to match its arguments frames. A call's place is the
+  // same in all three, and two calls cannot share one, so the id names it.
+  //
+  // A call the reply places nowhere keeps the counter — and names it under a
+  // different word, because both arms are inventing ids in one reply: a counter
+  // that happened to reach another call's index would hand two unrelated calls
+  // the same item, which is the failure the counter was introduced to prevent.
   const id =
     typeof call.id === "string" && call.id
       ? call.id
-      : `msg_${call.call_id ?? `dropped_${++synthesized}`}`;
+      : `msg_${call.call_id ?? (at === undefined ? `anon_${++synthesized}` : `dropped_${at}`)}`;
   return {
     type: "message",
     id,
@@ -206,10 +217,15 @@ function checkSnapshots(data, protocol, checkName) {
   let kept = 0;
   let left = 0;
   if (!object(data)) throw new GuardError("Invalid upstream tool snapshot");
-  // Each entry is a value and where it sits, so a call can be replaced.
-  const stack = [[data, null, null]];
+  // Each entry is a value, where it sits, and the place it holds in the reply
+  // as far as the walk knows: an item of an output array is at its index, and
+  // anything reached through an object — a frame's own `item` — keeps the
+  // output_index the frame carries, which is where that item sits. A call
+  // left out is replaced by an item whose invented id names that place, so
+  // the added, done and terminal copies of one call are one item (inPlaceOf).
+  const stack = [[data, null, null, object(data) ? data.output_index : undefined]];
   while (stack.length) {
-    const [value, holder, key] = stack.pop();
+    const [value, holder, key, at] = stack.pop();
     if (!object(value)) throw new GuardError("Invalid upstream tool snapshot");
     if (
       protocol === "responses" &&
@@ -223,7 +239,7 @@ function checkSnapshots(data, protocol, checkName) {
       const name = checkName(value.name);
       if (name == null) {
         if (!holder) throw new GuardError(droppedNote(value.name), "undeclared_tool");
-        holder[key] = inPlaceOf(protocol, value, droppedNote(value.name));
+        holder[key] = inPlaceOf(protocol, value, droppedNote(value.name), at);
         changed = true;
         left++;
         continue;
@@ -241,10 +257,10 @@ function checkSnapshots(data, protocol, checkName) {
       // Text content is not a snapshot container.
       if (typeof value[name] === "string") continue;
       const items = list(value[name]);
-      for (let i = 0; i < items.length; i++) stack.push([items[i], items, i]);
+      for (let i = 0; i < items.length; i++) stack.push([items[i], items, i, i]);
     }
     for (const name of objects) {
-      if (value[name] != null) stack.push([value[name], value, name]);
+      if (value[name] != null) stack.push([value[name], value, name, at]);
     }
   }
   if (
@@ -463,7 +479,10 @@ function snapshotStream(protocol, checkName) {
           checkName(item.name) == null
         ) {
           const note = droppedNote(item.name);
-          const message = inPlaceOf(protocol, item, note);
+          // The frame's output_index is this call's place in the reply, which
+          // is the id its later frames (done, the terminal's output) invent
+          // for it again (inPlaceOf).
+          const message = inPlaceOf(protocol, item, note, data.output_index);
           left.set(data.output_index, true);
           leftIDs.add(message.id);
           if (typeof item.id === "string") leftIDs.add(item.id);
@@ -544,6 +563,7 @@ async function readBounded(response) {
   if (!reader) return "";
   const parts = [];
   let bytes = 0;
+  let failure;
   try {
     while (true) {
       const { done, value } = await reader.read();
@@ -553,20 +573,28 @@ async function readBounded(response) {
         throw new GuardError(`Upstream response exceeds the ${LIMIT} buffer limit`);
       parts.push(value);
     }
+  } catch (error) {
+    failure = error;
+  }
+  // Whatever ended the read — the limit, a malformed body, or the end of it —
+  // this body is never read again, so the stream is cancelled and the reader
+  // loosed. This was the one place in the package that abandoned a body
+  // without cancelling it (measured: no cancellation past the limit, and the
+  // source still pulled after the 502), which leaves an upstream writing into
+  // a socket nobody reads. A cancel that fails must not stand in for what
+  // ended the read: an oversized body is the 502 this function promises, not
+  // an opaque transport error, so the cancel's failure is kept as that
+  // error's cause — and is thrown itself only when nothing else went wrong.
+  // The lock is released either way.
+  try {
+    await reader.cancel();
+  } catch (error) {
+    if (!failure) throw error;
+    if (failure instanceof Error && !("cause" in failure)) failure.cause = error;
   } finally {
-    // Whatever ended the read — the limit, a malformed body, or the end of
-    // it — this body is never read again, so the reader is loosed and the
-    // stream cancelled. This was the one place in the package that abandoned
-    // a body without cancelling it (measured: no cancellation past the limit,
-    // and the source still pulled after the 502), which leaves an upstream
-    // writing into a socket nobody reads. The cancel's own failure is not
-    // swallowed, and the lock is released whether it threw or not.
-    try {
-      await reader.cancel();
-    } finally {
-      reader.releaseLock();
-    }
+    reader.releaseLock();
   }
+  if (failure) throw failure;
   const all = new Uint8Array(bytes);
   let offset = 0;
   for (const part of parts) {
@@ -755,7 +783,14 @@ function chatTrack() {
         if (choice.finish_reason != null) {
           finished.add(index);
           open.delete(index);
-        } else if (!finished.has(index)) open.add(index);
+        } else {
+          // A frame for this choice after it finished opens a new round of it
+          // (chatBuffer.apply judges a later round the same way), so the
+          // choice is open again: latching it shut for good left a round cut
+          // short with no note and no finish_reason, only a bare [DONE].
+          finished.delete(index);
+          open.add(index);
+        }
       }
     },
     // ending answers the frames that end the reply as cut short, or null