pi-freeflow 1.36.0 → 1.36.3

package/src/proxy.ts

@@ -35,11 +35,12 @@ import {
 } from "./config.ts";
 
 import {
- convertSseToJson,
- enforceOpencodeFingerprint,
- sseToChatCompletionJson,
- type CaseRestoreMap,
- type FindGlobRestore,
+	convertSseToJson,
+	enforceOpencodeFingerprint,
+	repairJsonToolArguments,
+	sseToChatCompletionJson,
+	type CaseRestoreMap,
+	type FindGlobRestore,
 } from "./opencode-fingerprint.ts";
 import { isDebugEnabled, log } from "./logger.ts";
 import { getModelUpstream, isClineModel, isOvhModel, KILO_MODEL_IDS, MODEL_MAP, ovhUpstreamModelId, resolveCanonicalModelId } from "./models.ts";
@@ -47,10 +48,12 @@ import { ClineAuthError, refreshClineToken, toApiKey } from "./cline-device-auth
 import { rollChat } from "./cline-accounts.ts";
 import { fetchWithSystemCA } from "./system-ca-fetch.ts";
 import {
- chatResponsesJsonFromChatCompletion,
- chatResponsesSseFromChatCompletion,
- chatBodyFromResponsesBody,
- translateToolsForPath,
+	buildFindGlobRestore,
+	chatBodyFromResponsesBody,
+	chatResponsesJsonFromChatCompletion,
+	chatResponsesSseFromChatCompletion,
+	restoreToolNameForCaller,
+	translateToolsForPath,
 } from "./tool-translation.ts";
 import { buildArgRepairSchemas } from "./tool-args.ts";
 // normalize removed — host pi-ai already normalizes thinking/reasoning before proxy
@@ -77,6 +80,7 @@ import {
 import { pipeUpstreamStream, type StreamCloakOptions } from "./stream-pipe.ts";
 import {
  decideZenRoute,
+ isFreeTierGate,
  isUnprovenSession,
  isUpstreamGated,
  pickFailoverModel,
@@ -271,6 +275,10 @@ async function handleClineRequest(opts: {
  // Cline bypasses the fingerprint, but its arguments still malform the same
  // way: capture the caller's own schemas before translation for repair.
  const argSchemas = buildArgRepairSchemas(Array.isArray(parsedBody.tools) ? parsedBody.tools : []);
+ // Translation renames the caller's `find` to `glob` upstream and folds any
+ // name the upstream shape forbids; without this map the answer returns under
+ // a name Pi never registered.
+ const findGlob = buildFindGlobRestore(Array.isArray(parsedBody.tools) ? parsedBody.tools : []);
  chatBody.stream = true;
  let upstreamRes: Response;
  let limitHint: ClineLimitHint | undefined;
@@ -334,8 +342,8 @@ async function handleClineRequest(opts: {
    req,
    reqId,
    "direct",
-   argSchemas.size > 0
-    ? { callerHadTools: true, argSchemas, pathname: "/v1/chat/completions" }
+   findGlob.renamedFindToGlob || findGlob.renamed !== undefined || argSchemas.size > 0
+    ? { callerHadTools: true, argSchemas, findGlob, pathname: "/v1/chat/completions" }
     : undefined,
   );
   return;
@@ -352,7 +360,7 @@ async function handleClineRequest(opts: {
   return;
  }
  if (!responsesRequest) {
-  const data = convertSseToJson(sseText, pathname, true, undefined, undefined, undefined, argSchemas);
+ const data = convertSseToJson(sseText, pathname, true, undefined, findGlob, undefined, argSchemas);
   if (!res.headersSent) {
    res.writeHead(upstreamRes.status, { "content-type": "application/json" });
    res.end(data);
@@ -361,7 +369,7 @@ async function handleClineRequest(opts: {
   }
   return;
  }
- const chat = sseToChatCompletionJson(sseText, true, undefined, undefined, undefined, argSchemas);
+ const chat = sseToChatCompletionJson(sseText, true, undefined, findGlob, undefined, argSchemas);
  const resp = chatResponsesJsonFromChatCompletion(chat, model);
  if (clientRequestedStream) {
   if (!res.headersSent) {
@@ -423,6 +431,10 @@ async function handleOvhRequest(opts: {
  // Bypassing the fingerprint does not exempt OVH from malformed tool
  // arguments: capture the caller's own schemas before translation for repair.
  const argSchemas = buildArgRepairSchemas(Array.isArray(parsedBody.tools) ? parsedBody.tools : []);
+ // Translation renames the caller's `find` to `glob` upstream and folds any
+ // name the upstream shape forbids; without this map the answer returns under
+ // a name Pi never registered.
+ const findGlob = buildFindGlobRestore(Array.isArray(parsedBody.tools) ? parsedBody.tools : []);
  chatBody.stream = true;
  // Header-wait timeout + client-disconnect abort, cleared once headers arrive
  // so a long stream is not killed at the timeout ceiling.
@@ -501,8 +513,8 @@ async function handleOvhRequest(opts: {
    req,
    reqId,
    "direct",
-   argSchemas.size > 0
-    ? { callerHadTools: true, argSchemas, pathname: "/v1/chat/completions" }
+   findGlob.renamedFindToGlob || findGlob.renamed !== undefined || argSchemas.size > 0
+    ? { callerHadTools: true, argSchemas, findGlob, pathname: "/v1/chat/completions" }
     : undefined,
   );
   return;
@@ -519,7 +531,7 @@ async function handleOvhRequest(opts: {
   return;
  }
  if (!responsesRequest) {
-  const data = convertSseToJson(sseText, pathname, true, undefined, undefined, undefined, argSchemas);
+ const data = convertSseToJson(sseText, pathname, true, undefined, findGlob, undefined, argSchemas);
   if (!res.headersSent) {
    res.writeHead(upstreamRes.status, { "content-type": "application/json" });
    res.end(data);
@@ -528,7 +540,7 @@ async function handleOvhRequest(opts: {
   }
   return;
  }
- const chat = sseToChatCompletionJson(sseText, true, undefined, undefined, undefined, argSchemas);
+ const chat = sseToChatCompletionJson(sseText, true, undefined, findGlob, undefined, argSchemas);
  const resp = chatResponsesJsonFromChatCompletion(chat, requestedModel);
  if (clientRequestedStream) {
   if (!res.headersSent) {
@@ -552,6 +564,172 @@ async function handleOvhRequest(opts: {
  }
 }
 
+/**
+ * Keyless gateway handling for Kilo models (both direct Kilo models and
+ * Zen sessions failed over to Kilo). Serves chat completions and responses
+ * natively, repairs tool arguments, and recovers from 400 token overflows.
+ */
+async function handleKiloRequest(opts: {
+ parsedBody: Record<string, unknown>;
+ pathname: string;
+ req: http.IncomingMessage;
+ res: http.ServerResponse;
+ reqId: string;
+ clientRequestedStream: boolean;
+ sessionKey?: string | null;
+}): Promise<void> {
+ const { parsedBody, pathname, req, res, reqId, clientRequestedStream, sessionKey } = opts;
+ const isStream = clientRequestedStream;
+ const kiloController = new AbortController();
+ const kiloArgSchemas = buildArgRepairSchemas(Array.isArray(parsedBody.tools) ? parsedBody.tools : []);
+ const kiloTimeoutId = setTimeout(
+  () => kiloController.abort(upstreamTimeoutError()),
+  UPSTREAM_HEADER_TIMEOUT_MS,
+ );
+ const abortKiloOnClientGone = () => {
+  if (!res.writableEnded) kiloController.abort();
+ };
+ res.once("close", abortKiloOnClientGone);
+ req.once("error", abortKiloOnClientGone);
+ let response: Response;
+ const kiloUrl = pathname.endsWith("/responses") ? KILO_RESPONSES_URL : KILO_CHAT_URL;
+ try {
+  response = await relayFetch(
+   kiloUrl,
+   {
+    method: "POST",
+    headers: {
+     "Content-Type": "application/json",
+    },
+    body: JSON.stringify(parsedBody),
+    signal: kiloController.signal,
+   },
+   reqId,
+  );
+  if (response.status === 400 && !res.writableEnded) {
+   const retryBody = { ...parsedBody };
+   let changed = false;
+   if (typeof retryBody.max_output_tokens === "number" && retryBody.max_output_tokens > 4096) {
+    retryBody.max_output_tokens = 4096;
+    changed = true;
+   }
+   if (typeof retryBody.max_tokens === "number" && retryBody.max_tokens > 4096) {
+    retryBody.max_tokens = 4096;
+    changed = true;
+   }
+   if (retryBody.model === "dots-studio/dots-3-note-preview:free") {
+    retryBody.model = "nvidia/nemotron-3.5-lightning:free";
+    changed = true;
+   }
+   if (changed) {
+    log("warn", `kilo 400 for model ${String(parsedBody.model)} — retrying with clamped tokens`, { model: parsedBody.model }, reqId);
+    try {
+     const retryRes = await relayFetch(
+      kiloUrl,
+      {
+       method: "POST",
+       headers: {
+        "Content-Type": "application/json",
+       },
+       body: JSON.stringify(retryBody),
+       signal: kiloController.signal,
+      },
+      reqId,
+     );
+     if (retryRes.ok) {
+      log("info", `kilo 400 recovery succeeded with model ${String(retryBody.model)}`, { model: retryBody.model }, reqId);
+      response = retryRes;
+     }
+    } catch { }
+   }
+  }
+ } finally {
+  clearTimeout(kiloTimeoutId);
+  res.off("close", abortKiloOnClientGone);
+  req.off("error", abortKiloOnClientGone);
+ }
+ if (response.ok) recordUpstreamSuccess("kilo", { sessionKey });
+
+ if (isStream && response.ok && response.body) {
+  const ct = response.headers.get("content-type") || "text/event-stream";
+  res.writeHead(response.status, {
+   "content-type": ct,
+   "cache-control": "no-cache, no-transform",
+   connection: "keep-alive",
+   "x-accel-buffering": "no",
+  });
+  pipeUpstreamStream(
+   Readable.fromWeb(
+    response.body as unknown as WebReadableStream,
+   ),
+   res,
+   req,
+   reqId,
+   undefined,
+   kiloArgSchemas.size > 0
+    ? {
+     callerHadTools: true,
+     argSchemas: kiloArgSchemas,
+     pathname: pathname.endsWith("/responses") ? "/v1/responses" : "/v1/chat/completions",
+    }
+    : undefined,
+  );
+ } else {
+  let rawText = await response.text();
+  if (response.ok && kiloArgSchemas.size > 0) {
+   rawText = convertSseToJson(rawText, pathname, true, undefined, undefined, undefined, kiloArgSchemas);
+   rawText = repairJsonToolArguments(rawText, pathname, kiloArgSchemas);
+  }
+  const data = withRateLimitHint(response.status, rawText);
+  const ct = response.headers.get("content-type") || "application/json";
+  res.writeHead(response.status, { "content-type": ct });
+  res.end(data);
+ }
+}
+
+/**
+ * In-flight auto-recovery for Zen 403 FreeTierError: immediately fail over
+ * the current request to a healthy Kilo model instead of surfacing 403 to the caller.
+ * Returns true when recovery was dispatched; false when failover is impossible.
+ */
+async function tryZenGateAutoFailover(opts: {
+ parsedBody: Record<string, unknown> | null;
+ pathname: string;
+ req: http.IncomingMessage;
+ res: http.ServerResponse;
+ reqId: string;
+ clientRequestedStream: boolean;
+ sessionKey?: string | null;
+}): Promise<boolean> {
+ const { parsedBody, pathname, req, res, reqId, clientRequestedStream, sessionKey } = opts;
+ if (!parsedBody || res.headersSent || res.writableEnded) return false;
+ const fallbackModel = pickFailoverModel(parsedBody.model);
+ if (!fallbackModel) return false;
+ try {
+  const fromModel = String(parsedBody.model ?? "?");
+  parsedBody.model = fallbackModel;
+  if (pathname.endsWith("/responses")) {
+   prepareResponsesFailoverBody(parsedBody);
+  } else {
+   prepareChatFailoverBody(parsedBody);
+  }
+  log("warn", `zen 403 FreeTierError auto-fixed: failing over ${fromModel} -> ${fallbackModel}`, { model: fromModel, failover: fallbackModel }, reqId);
+  await handleKiloRequest({
+   parsedBody,
+   pathname,
+   req,
+   res,
+   reqId,
+   clientRequestedStream,
+   sessionKey,
+  });
+  return true;
+ } catch (err) {
+  log("warn", `zen 403 FreeTierError auto-failover failed: ${String(err)}`, { error: String(err) }, reqId);
+  return false;
+ }
+}
+
 /**
  * Relay eligibility: only free-catalog models ride relay egress. Returns true
  * when the model is a non-empty string present in MODEL_MAP or KILO_MODEL_IDS
@@ -679,11 +857,11 @@ export function sanitizeHeaders(
  sanitized.connection = "keep-alive";
  return sanitized;
 }
-export async function isProxyAlive(port: number): Promise<boolean> {
+export async function isProxyAlive(port: number, timeoutMs = 600): Promise<boolean> {
  if (!Number.isInteger(port) || port < 1 || port > 65535) return false;
  try {
   const res = await fetch(`http://${HOST}:${port}/v1/models`, {
-   signal: AbortSignal.timeout(1500),
+   signal: AbortSignal.timeout(timeoutMs),
   });
   const ct = res.headers.get("content-type") || "";
   return res.ok && ct.includes("application/json");
@@ -1266,129 +1444,15 @@ export function startProxy(
      // token: the proxy only passes the body and maps the answer.
      await handleClineRequest({ parsedBody, pathname: target.pathname, req, res, reqId, clientRequestedStream });
     } else if (isKilo && parsedBody) {
-     // Header-wait timeout + client-disconnect abort: once headers
-     // arrive the timer is cleared so a long stream is not killed at
-     // the timeout ceiling; the stream phase is owned by
-     // pipeUpstreamStream and its close handling.
-     const kiloController = new AbortController();
-     // Kilo bodies ride verbatim, but its models malform arguments the same
-     // way: capture the caller's schemas so the reply can be repaired too.
-     const kiloArgSchemas = buildArgRepairSchemas(Array.isArray(parsedBody.tools) ? parsedBody.tools : []);
-     const kiloTimeoutId = setTimeout(
-      () => kiloController.abort(upstreamTimeoutError()),
-      UPSTREAM_HEADER_TIMEOUT_MS,
-     );
-     const abortKiloOnClientGone = () => {
-      if (!res.writableEnded) kiloController.abort();
-     };
-     res.once("close", abortKiloOnClientGone);
-     req.once("error", abortKiloOnClientGone);
-     let response: Response;
-     // Kilo serves both wire APIs natively: responses-shaped bodies go to
-     // its responses endpoint, chat bodies to chat completions. Sending a
-     // responses body to the chat URL (or vice versa) would 400.
-     const kiloUrl = target.pathname.endsWith("/responses") ? KILO_RESPONSES_URL : KILO_CHAT_URL;
-     try {
-      response = await relayFetch(
-       kiloUrl,
-       {
-        method: "POST",
-        headers: {
-         // Keyless, like Zen: Kilo's gateway rejects a placeholder bearer
-         // (live 2026-09-22 — "Bearer kilo-free" answers 401 INVALID_TOKEN,
-         // omitting Authorization answers 200 for every free catalog model).
-         "Content-Type": "application/json",
-        },
-        body: JSON.stringify(parsedBody),
-        signal: kiloController.signal,
-       },
-       reqId,
-      );
-      // Kilo 400 recovery: if upstream Kilo rejected the body with 400 (e.g.
-      // prompt + max_output_tokens exceeded model's operational context limit),
-      // retry once with clamped max tokens and fallback to a 1M model.
-      if (response.status === 400 && !res.writableEnded) {
-       const retryBody = { ...parsedBody };
-       let changed = false;
-       if (typeof retryBody.max_output_tokens === "number" && retryBody.max_output_tokens > 4096) {
-        retryBody.max_output_tokens = 4096;
-        changed = true;
-       }
-       if (typeof retryBody.max_tokens === "number" && retryBody.max_tokens > 4096) {
-        retryBody.max_tokens = 4096;
-        changed = true;
-       }
-       if (retryBody.model === "dots-studio/dots-3-note-preview:free") {
-        retryBody.model = "nvidia/nemotron-3.5-lightning:free";
-        changed = true;
-       }
-       if (changed) {
-        log("warn", `kilo 400 for model ${String(parsedBody.model)} — retrying with clamped tokens`, { model: parsedBody.model }, reqId);
-        try {
-         const retryRes = await relayFetch(
-          kiloUrl,
-          {
-           method: "POST",
-           headers: {
-            "Content-Type": "application/json",
-           },
-           body: JSON.stringify(retryBody),
-           signal: kiloController.signal,
-          },
-          reqId,
-         );
-         if (retryRes.ok) {
-          log("info", `kilo 400 recovery succeeded with model ${String(retryBody.model)}`, { model: retryBody.model }, reqId);
-          response = retryRes;
-         }
-        } catch { }
-       }
-      }
-     } finally {
-      clearTimeout(kiloTimeoutId);
-      res.off("close", abortKiloOnClientGone);
-      req.off("error", abortKiloOnClientGone);
-     }
-     if (response.ok) recordUpstreamSuccess("kilo", { sessionKey });
-
-     if (isStream && response.ok && response.body) {
-      const ct =
-       response.headers.get("content-type") || "text/event-stream";
-      res.writeHead(response.status, {
-       "content-type": ct,
-       "cache-control": "no-cache, no-transform",
-       connection: "keep-alive",
-       "x-accel-buffering": "no",
-      });
-      // Kilo is fetched directly (not via the relay pool), so pass undefined as
-      // the issuer: attributing kilo-side stream failures to an unrelated
-      // opencode relay would mark a healthy relay as failed.
-      pipeUpstreamStream(
-       Readable.fromWeb(
-        response.body as unknown as WebReadableStream,
-       ),
-       res,
-       req,
-       reqId,
-       undefined,
-       kiloArgSchemas.size > 0
-        ? {
-         callerHadTools: true,
-         argSchemas: kiloArgSchemas,
-         pathname: target.pathname.endsWith("/responses") ? "/v1/responses" : "/v1/chat/completions",
-        }
-        : undefined,
-      );
-     } else {
-      let rawText = await response.text();
-      if (response.ok && kiloArgSchemas.size > 0) {
-       rawText = convertSseToJson(rawText, target.pathname, true, undefined, undefined, undefined, kiloArgSchemas);
-      }
-      const data = withRateLimitHint(response.status, rawText);
-      const ct = response.headers.get("content-type") || "application/json";
-      res.writeHead(response.status, { "content-type": ct });
-      res.end(data);
-     }
+     await handleKiloRequest({
+      parsedBody,
+      pathname: target.pathname,
+      req,
+      res,
+      reqId,
+      clientRequestedStream,
+      sessionKey,
+     });
    } else if (isOvh && parsedBody) {
     // OVH serves chat upstream only (see handleOvhRequest): direct, keyless,
     // no fingerprint, and a responses-path body translated to chat and back.
@@ -1651,6 +1715,18 @@ export function startProxy(
           log("warn", `upstream ${response.status} for model ${String((parsedBody as Record<string, unknown> | null)?.model ?? "?")} via ${servedRelay === "direct" ? "direct upstream" : `relay ${servedRelay}`}`, { status: response.status, model: (parsedBody as Record<string, unknown> | null)?.model, path: req.url, relay: servedRelay }, reqId);
          }
          let rawText = await response.text();
+         if (response.status === 403 && isFreeTierGate(403, rawText)) {
+          const recovered = await tryZenGateAutoFailover({
+           parsedBody: parsedBody as Record<string, unknown> | null,
+           pathname: target.pathname,
+           req,
+           res,
+           reqId,
+           clientRequestedStream,
+           sessionKey,
+          });
+          if (recovered) return;
+         }
          let ct =
           response.headers.get("content-type") ||
           "application/json";
@@ -1809,14 +1885,28 @@ export function startProxy(
       // Gated upstream: a 403 free-tier gate is a final answer, not a
       // stream — buffer it and attach the recovery hint instead of
       // piping it through as a stream body.
+      // Gated upstream: a 403 free-tier gate is auto-recovered via Kilo failover.
+      // If failover is impossible, buffer it and attach the recovery hint.
       if (upstreamRes.status === 403) {
-       const data = withFreeTierHint(403, await upstreamRes.text());
+       const rawText403 = await upstreamRes.text();
+       if (isFreeTierGate(403, rawText403)) {
+        const recovered = await tryZenGateAutoFailover({
+         parsedBody: parsedBody as Record<string, unknown> | null,
+         pathname: target.pathname,
+         req,
+         res,
+         reqId,
+         clientRequestedStream,
+         sessionKey,
+        });
+        if (recovered) return;
+       }
+       const data = withFreeTierHint(403, rawText403);
        const ct403 = upstreamRes.headers.get("content-type") || "application/json";
        res.writeHead(403, { "content-type": ct403 });
        res.end(data);
        return;
       }
-
       const outHeaders: Record<string, string> = {};
       for (const h of ["content-type", "cache-control", "x-request-id"] as const) {
        const v = upstreamRes.headers.get(h);

package/src/stream-pipe.ts

@@ -15,7 +15,7 @@ import {
  WATCHDOG_SSE_MIN_SAMPLES,
  WATCHDOG_SSE_WINDOW,
 } from "./config.ts";
-import type { CaseRestoreMap, FindGlobRestore } from "./opencode-fingerprint.ts";
+import { cloakMessagesContent, type CaseRestoreMap, type FindGlobRestore } from "./opencode-fingerprint.ts";
 import { restoreToolNameForCaller } from "./tool-translation.ts";
 import { repairToolArguments } from "./tool-args.ts";
 
@@ -211,6 +211,52 @@ export function createSseStreamCloakState(): SseStreamCloakState {
  };
 }
 
+/**
+ * Emit every tool call still holding buffered arguments, then clear the
+ * buffers. The fragments were withheld so the packet could be judged whole
+ * (see {@link SseStreamCloakState}); the terminal event that normally releases
+ * them never arrived when upstream cut the stream without one, and without
+ * this the client would receive a tool call whose `arguments` were deleted and
+ * never re-emitted. Repaired exactly as the terminal path repairs.
+ *
+ * Shape follows the pathname: Chat re-emits one `tool_calls` delta, Anthropic
+ * one `input_json_delta` per open block. Responses carries whole arguments on
+ * its `.done` event and buffers nothing, so it has nothing to flush.
+ * Returns null when nothing is buffered.
+ */
+export function flushBufferedToolArgs(
+ state: SseStreamCloakState,
+ cloak: StreamCloakOptions,
+): string | null {
+ if (state.messagesArgsByIndex.size > 0) {
+  const blocks: string[] = [];
+  for (const [index, args] of state.messagesArgsByIndex) {
+   const name = state.messagesNameByIndex.get(index) ?? "";
+   blocks.push(
+    `event: content_block_delta\ndata: ${JSON.stringify({
+     type: "content_block_delta",
+     index,
+     delta: { type: "input_json_delta", partial_json: repairToolArguments(name, args, cloak.argSchemas) },
+    })}\n\n`,
+   );
+  }
+  state.messagesArgsByIndex.clear();
+  state.messagesNameByIndex.clear();
+  return blocks.join("");
+ }
+ if (state.chatArgsByIndex.size === 0) return null;
+ const calls: unknown[] = [];
+ for (const [index, args] of state.chatArgsByIndex) {
+  const name = state.chatNameByIndex.get(index);
+  if (name === undefined) continue;
+  calls.push({ index, type: "function", function: { name, arguments: repairToolArguments(name, args, cloak.argSchemas) } });
+ }
+ state.chatArgsByIndex.clear();
+ state.chatNameByIndex.clear();
+ if (calls.length === 0) return null;
+ return `data: ${JSON.stringify({ object: "chat.completion.chunk", choices: [{ index: 0, delta: { tool_calls: calls } }] })}\n\n`;
+}
+
 /**
  * True when the stream needs no rewrite and must flow byte-identical:
  * nothing injected, no casing to restore, no find->glob rename, and the
@@ -656,6 +702,27 @@ function rewriteMessagesBlock(
   const stopBlock = emitSseBlock(event, JSON.stringify(parsed), hadEventPrefix);
   return `${emitSseBlock("content_block_delta", JSON.stringify(flushed), false)}\n\n${stopBlock}`;
  }
+ // A `message` frame carries a whole finished message mid-stream. It needs the
+ // same treatment the aggregate path gives it — injected tool_use dropped,
+ // caller names restored, inputs repaired — otherwise a placeholder call leaks
+ // downstream and a malformed one reaches the host unrepaired. Any block still
+ // buffering arguments is completed first so nothing is orphaned.
+ if (type === "message") {
+  const flushed = flushBufferedToolArgs(state, cloak);
+  cloakMessagesContent(parsed.message ?? parsed, cloak.callerHadTools, cloak.caseRestore, cloak.findGlob, cloak.injected, cloak.argSchemas);
+  if (flushed === null) return emitSseBlock(event, JSON.stringify(parsed), hadEventPrefix);
+  return `${flushed}${emitSseBlock(event, JSON.stringify(parsed), hadEventPrefix)}`;
+ }
+ // A tool_use block still holding buffered arguments is completed HERE, while
+ // its own event order is intact: `message_delta` / `message_stop` close the
+ // message, so the recovered `input_json_delta` has to precede them. (An
+ // end-of-stream flush would emit it after `message_stop`, where a strict
+ // Anthropic client has already closed the message.)
+ if (type === "message_delta" || type === "message_stop") {
+  const flushed = flushBufferedToolArgs(state, cloak);
+  if (flushed === null) return block;
+  return `${flushed}${emitSseBlock(event, JSON.stringify(parsed), hadEventPrefix)}`;
+ }
  return block;
 }
 
@@ -1099,6 +1166,15 @@ export function pipeUpstreamStream(
     }
    }
   }
+ // Buffered tool arguments are released on the call's terminal event, which a
+ // cut stream never sends. Flush them here: the client already saw the call
+ // announced, so it must receive the arguments too rather than a name with no
+ // payload. Runs before the terminal-marker decision and before the re-fire
+ // offer, because a rescue regenerates the turn and would double the calls.
+ if (cloakState && cloak) {
+  const flushed = flushBufferedToolArgs(cloakState, cloak);
+  if (flushed !== null) forwardText(flushed);
+ }
   if (hasTerminalEvent) recordOnce(false);
   const elapsed = ((Date.now() - startAt) / 1000).toFixed(1);
   if (!hasTerminalEvent && totalChunks > 0) {
@@ -1140,6 +1216,14 @@ export function pipeUpstreamStream(
   // inject a terminal nor end res — the replacement stream owns the turn now.
   if (refirePending) return;
   try {
+  // Same obligation as the clean-end flush: the client already saw the call
+  // announced, so its buffered arguments must still arrive before the turn is
+  // terminated — and before the re-fire offer, since a rescue regenerates the
+  // turn and would double the calls.
+  if (cloakState && cloak) {
+   const flushed = flushBufferedToolArgs(cloakState, cloak);
+   if (flushed !== null) forwardText(flushed);
+  }
    if (!hasTerminalEvent && totalChunks > 0) {
     if (clientAborted || upstreamEnded) {
      // Client disconnect teardown or post-end cleanup — the relay