fix: bug-PR merge train batch 6 (tool-call id remint, native Chat reset replacement, test stability)

devlog/_plan/260926_bug_train_6/000_plan.md

@@ -0,0 +1,34 @@
+# Bug-PR merge train batch 6 — plan
+
+Branch `codex/bug-train-6` from `origin/dev` at `e807e1e27b`. One PR to `dev`; each carried PR is one
+squashed commit with the contributor as author and a `Co-authored-by` trailer. Integration fixes are
+separate commits after the carried ones.
+
+## Carried
+
+| PR | Change | Why it is in |
+|---|---|---|
+| #5914 (@moseoridev) | `withUniqueToolCallIds` wraps the `openai-chat` adapter and remints only tool-call ids that repeat the caller's history or an id already emitted in the response (`-<n>` suffix). | Real infinite-loop bug with Claude Code behind upstreams that mint positional ids (`call-0-0`). Adapter-local, no credential path. |
+| #5882 (@Yum-wu) | Native Chat refetches once on a zero-output mid-stream socket reset, gated by the ambiguous-resend allowance; replacement send releases its retained request copy. | Fixes dropped native Chat turns on reset. Maintainer blocker (retained request bytes after reselection) answered by `318520ebd6`; audit must confirm. |
+| #5849 (@lzfxxx) | Test-only isolation and budget fixes (serial lane additions, fixture executable, timeouts, launcher wait for config injection). | Removes known flakes on macOS/Linux runners; no runtime change. Needs conflict resolution against current `dev`. |
+
+## Left out, with reason
+
+- #5539 — flips deliberate "preserve caller spelling" tests for unpinned native Chat; a policy change the author marked `[WRONG BRANCH]`.
+- #5916, #5831, #5911, #5915 — OAuth / main-account credential paths; they need a written security review (batch 7 candidate).
+- #5782, #5800, #5497, #4222 — large feature-sized or conflicting, hygiene failures.
+
+## Build steps
+
+1. `git merge --squash pr-<n>` per PR in order 5914, 5882, 5849; resolve conflicts against `dev`.
+2. Check file-size ratchet, test-layout registries, structure docs for each carried file set.
+3. Integration commits only if a gate fails.
+
+## Check
+
+- `bun x tsc --noEmit`, `bun run structure:check`, `bun run privacy:scan`.
+- Focused: `tests/adapters/openai/openai-chat-tool-call-id-remint.test.ts`, `tests/responses/chat-native-spend.test.ts`,
+  `tests/responses/responses-reset-replay.test.ts`, `tests/lib/upstream-retry-zero-output.test.ts`, test-layout guards,
+  file-size ratchet, the files #5849 touches.
+- Exact-head hosted CI on the batch PR, then `gh pr merge --squash --admin --match-head-commit`.
+

devlog/_plan/260926_unique_tool_call_ids/000_overview.md

@@ -0,0 +1,9 @@
+# Unique tool-call ids for positionally-minting chat upstreams
+
+Unit opened 2026-09-26.
+
+- [010_remint.md](010_remint.md) — the `openai-chat` lane. **DONE.**
+
+Origin: a DeepSeek V4.1 Flash conversation through this proxy looped with a thinking-only turn that
+never terminated, while the same client against the same gateway on a GLM model was unaffected.
+The two models differ in the id they mint (positional vs random), which is the whole defect.

devlog/_plan/260926_unique_tool_call_ids/010_remint.md

@@ -0,0 +1,50 @@
+# Unique tool-call ids for positionally-minting chat upstreams
+
+Defect: `src/adapters/registry.ts` `openai-chat` entry. The adapter forwards
+`tool_calls[].id` upstream-verbatim, which is correct for an upstream that mints a fresh random id
+per call (measured: `zai-org/glm-5.3-flash` mints `call_<24 hex>`, never repeating). An upstream
+that derives the id from the call's **position in its response** instead mints the same `call-0-0`
+on every turn of a conversation (measured: `deepseek-ai/deepseek-v4.1-flash` behind the same
+gateway — three sequential turns, `call-0-0` every time; non-streaming mints `call-<toolIdx>`).
+A Messages client has already paired that id with an earlier call, drops the duplicate, and is left
+with a tool call carrying no result: the turn folds to an assistant message with no content, the
+model re-issues the same call, and the conversation loops without ever erroring. The client's own
+debug log confirms it sees no duplicate — `tool_uses=[call-0-0]` / `tool_results=[call-0-0]` with
+zero `api_retry` — so the loop is not a retry storm but a silently-dropped pairing.
+
+Reproduced with real Claude Code against a mock upstream that always mints `call-0-0`:
+**unpatched, 2186 stream events, 1 unique id, exit 124 (loop); patched, 3 unique ids
+(`call-0-0`, `call-0-0-2`, `call-0-0-3`), `subtype: success`, exit 0.**
+
+Change:
+
+- New leaf `src/adapters/openai-chat/tool-call-id-remint.ts`: `createToolCallIdReminter(reserved)` and
+  `reservedToolCallIdsFromHistory(messages)`. First occurrence of an id is emitted byte-identical —
+  prompt-cache keys, reasoning-replay lookups and already-unique upstreams are untouched; only a
+  **repeat** is rewritten, to the smallest unused suffix that fits the 64-char Anthropic id bound.
+  The suffix is `-<n>`, never `_<n>`: an id extending another as `<earlier>_<digits>` is read by the
+  client as batch sub-call N of `<earlier>`, which pairs the second call's result to the first. That
+  shape was measured separately: with an `_<n>` remint the same harness accumulated 10 placeholder
+  results; `-<n>` produced none.
+- New wrapper `src/adapters/unique-tool-call-ids.ts`: remints `tool_call_start` on both the
+  streaming and buffered paths, seeded from `parsed.context.messages` in `buildRequest` — the only
+  point that sees the caller's history, which is the authority on which ids are taken because it is
+  the side that discards duplicates. Emission-only: ingest-time rewriting would strip a pending
+  streamed call of the identity its own delta fragments match against.
+- `src/adapters/registry.ts`: the `openai-chat` factory now wraps in `withUniqueToolCallIds`, the
+  same shape as the existing `withClinePassDeepSeekV4ToolReplayCompatibility` wrapper.
+- `src/adapters/openai-chat.ts` is **untouched**: it sits at its 822-line ratchet cap with zero
+  headroom, and the remedy is a sibling file, not a raised number (`AGENTS.md:255-271`).
+
+Tests (new `tests/adapters/openai/openai-chat-tool-call-id-remint.test.ts`, registered in both
+`scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`): a positional
+upstream driven through three real turns emits three distinct ids; a first turn with no history
+emits the upstream id byte-identical; the suffix shape is asserted directly; repeated occurrences
+within one response stay distinct; a reserved suffix is skipped; every rewrite stays conforming and
+within the length bound; a non-conforming id is sanitized rather than dropped; the history scan
+reads both the assistant call and the tool result. Verified to fail against a pass-through wrapper
+(`["call-0-0","call-0-0","call-0-0"]`) and pass with the fix.
+
+Docs: `structure/providers-and-adapters.md` gains the `src/adapters/unique-tool-call-ids.ts` row and
+the `tool-call-id-remint.ts` leaf. `structure/providers/chat-compat.md` would have been the natural
+home but sits at exactly its 600-line budget.

scripts/test-layout/layout.json

@@ -171,6 +171,7 @@
     "deepseek-artifact-tool-schema.test.ts": "providers",
     "client-config-export-output-limit.test.ts": "config",
     "openai-chat-serialized-tool-call-scaling.test.ts": "adapters/openai",
+    "openai-chat-tool-call-id-remint.test.ts": "adapters/openai",
     "coding-agent-json-lines-scaling.test.ts": "providers",
     "usage-snapshot-digest-reuse.test.ts": "usage",
     "release-desktop-scripts.test.ts": "ci-workflows",
@@ -1803,6 +1804,7 @@
     "upstream-http-version.test.ts": "server",
     "upstream-reachability.test.ts": "codex-integration",
     "upstream-retry.test.ts": "lib",
+    "upstream-retry-zero-output.test.ts": "lib",
     "upstream-transient-retry.test.ts": "providers",
     "url-normalization.test.ts": "config",
     "usage-aggregate-cache.test.ts": "usage",

scripts/test.ts

@@ -371,6 +371,9 @@ export const SERIAL_FULL_SUITE_FILES = [
   // Synchronous injection subprocesses can wedge the long-lived macOS isolate
   // parent while reaping a history Worker; contain them in a fresh bounded lane.
   "codex-integration/codex-inject-write-lock.test.ts",
+  // Its management API import stalled the long-lived macOS isolate pool before
+  // any case ran; the complete file finishes in under a second in a fresh process.
+  "routing/subagent-roster-retention.test.ts",
   "update/update-stop-first.test.ts",
   // Relays a 50 MiB WebSocket frame end to end against a 15s deadline, so its result is a
   // measurement of the whole process, not of the relay. On a healthy 3-CPU macOS runner the
@@ -386,6 +389,9 @@ export const SERIAL_FULL_SUITE_FILES = [
   "service/service-ownership-state.test.ts",
   "service/service-sqlite-home.test.ts",
   "service/service.test.ts",
+  "service/service-claim.test.ts",
+  "service/service-wsl-home-ownership.test.ts",
+  "codex-integration/native-codex-toggle.test.ts",
   "codex-integration/native-grok-toggle.test.ts",
 ] as const;
 

src/adapters/openai-chat/tool-call-id-remint.ts

@@ -0,0 +1,65 @@
+import { isConformingToolCallId, MAX_TOOL_CALL_ID_LENGTH } from "../tool-call-id";
+import type { OcxMessage } from "../../types";
+
+/**
+ * Remint a tool-call id the client's history already carries.
+ *
+ * Some upstreams mint tool-call ids deterministically per RESPONSE rather than per call: the same
+ * `call-0-0` on every turn of a conversation. Anthropic's wire requires `tool_use.id` to identify
+ * one call, and a client that has already stored that id for an earlier call cannot pair the new
+ * result to the new call — it drops one of them, the turn becomes an assistant message whose
+ * tool call has no result, and the model re-issues the same call forever.
+ *
+ * The first occurrence of an id is emitted byte-identical, so prompt-cache keys, reasoning-replay
+ * lookups, and every upstream that already mints unique ids stay untouched. Only a repeat — against
+ * the history the caller seeded, or against a call already emitted in this response — is rewritten,
+ * to the smallest unused suffix that still fits Anthropic's id bound.
+ */
+export function createToolCallIdReminter(reservedIds: Iterable<string>): (rawId: string) => string {
+  const occupied = new Set(reservedIds);
+  return rawId => {
+    if (!occupied.has(rawId)) {
+      occupied.add(rawId);
+      return rawId;
+    }
+    // A non-conforming source is sanitized, never dropped: the wire still needs an id, and the
+    // occupied check below covers a sanitized form that now equals some other call's id.
+    const base = isConformingToolCallId(rawId) ? rawId : rawId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    for (let n = 2; ; n++) {
+      // Hyphen, not underscore: an id that extends another id as `<earlier>_<digits>` is parsed by
+      // at least one client as a batch sub-call of `<earlier>`, which pairs the second call's
+      // result to the first call. A `-<n>` suffix is in the same id family without that reading.
+      const suffix = `-${n}`;
+      const candidate = base.slice(0, Math.max(1, MAX_TOOL_CALL_ID_LENGTH - suffix.length)) + suffix;
+      if (!occupied.has(candidate)) {
+        occupied.add(candidate);
+        return candidate;
+      }
+    }
+  };
+}
+
+/**
+ * Tool-call ids the client's own history has already fixed: every assistant tool call it kept, plus
+ * every tool result that answered one. A response repeating any of them is the collision this
+ * module exists for.
+ *
+ * Read from the client's history rather than from earlier responses because the client is the
+ * authority on uniqueness here: it is the side that drops duplicates, so the proxy cannot observe
+ * the ids it discarded — a dropped id only ever exists as the absence it caused. A Messages client
+ * sends the whole conversation on every turn, which is why one turn's history is a complete picture
+ * of the ids that may not be reused.
+ */
+export function reservedToolCallIdsFromHistory(messages: readonly OcxMessage[]): Set<string> {
+  const ids = new Set<string>();
+  for (const message of messages) {
+    if (message.role === "assistant") {
+      for (const part of message.content) {
+        if (part.type === "toolCall") ids.add(part.id);
+      }
+      continue;
+    }
+    if (message.role === "toolResult") ids.add(message.toolCallId);
+  }
+  return ids;
+}

src/adapters/registry.ts

@@ -3,6 +3,7 @@ import { createAzureAdapter } from "./azure";
 import type { ProviderAdapter } from "./base";
 import { createClaudeCliAdapter } from "./claude-cli/adapter";
 import { withClinePassDeepSeekV4ToolReplayCompatibility } from "./cline-pass-deepseek-v4-tool-replay";
+import { withUniqueToolCallIds } from "./unique-tool-call-ids";
 import { createCodeBuddyAdapter } from "./codebuddy/adapter";
 import { createQoderAdapter } from "./qoder/adapter";
 import { createCommandCodeAdapter } from "./command-code";
@@ -84,7 +85,7 @@ export const ADAPTER_REGISTRY = {
     wire: "openai-chat",
     mutation: "codex-owned",
     create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) =>
-      withClinePassDeepSeekV4ToolReplayCompatibility(createOpenAIChatAdapter(provider)),
+      withUniqueToolCallIds(withClinePassDeepSeekV4ToolReplayCompatibility(createOpenAIChatAdapter(provider))),
   },
   "ollama-native": {
     wire: "ollama-native",

src/adapters/unique-tool-call-ids.ts

@@ -0,0 +1,63 @@
+import type { ProviderAdapter } from "./base";
+import type { AdapterEvent, OcxMessage } from "../types";
+import { createToolCallIdReminter, reservedToolCallIdsFromHistory } from "./openai-chat/tool-call-id-remint";
+
+/**
+ * Give every tool call in a conversation a wire id the client has not already stored.
+ *
+ * The openai-chat adapter forwards `tool_calls[].id` upstream-verbatim, which is correct for an
+ * upstream that mints a fresh random id per call. An upstream that derives the id from the call's
+ * position in its response mints the same `call-0-0` on every turn. The client has already paired
+ * that id with an earlier call, so it drops the duplicate; the dropped call has no result, the turn
+ * reads as an assistant message with no content, and the model re-issues the same call forever.
+ *
+ * Applied as a wrapper rather than inside the adapter so the adapter's own id handling stays
+ * untouched, matching how this repository already scopes a wire-compatibility policy
+ * (`withClinePassDeepSeekV4ToolReplayCompatibility`).
+ *
+ * Reminting happens at emission — on the events the adapter yields — never at ingestion: ingestion
+ * matches streamed deltas and continuation fragments against the id the upstream sent, so rewriting
+ * there would strip a pending call of its own identity mid-stream. The ids to avoid come from the
+ * caller's own history, captured where the request is built because that is the only point that sees
+ * the inbound conversation; the client is the authority on which ids are taken, since it is the side
+ * that discards the duplicates the proxy would otherwise never observe.
+ *
+ * The first occurrence of an id is emitted byte-identical, so prompt-cache keys, reasoning-replay
+ * lookups, and upstreams that already mint unique ids are unaffected.
+ */
+export function withUniqueToolCallIds(adapter: ProviderAdapter): ProviderAdapter {
+  // Set where the request is built and consumed by the two emission paths below — the same
+  // build-into-parse handoff the openai-chat adapter already uses for its requested model id. The
+  // identity default means a parse that runs without a build cannot fail: it has no history to
+  // collide with.
+  let remintToolCallId: (rawId: string) => string = id => id;
+
+  const remintEvents = (events: AdapterEvent[]): AdapterEvent[] =>
+    events.map(event => event.type === "tool_call_start" ? { ...event, id: remintToolCallId(event.id) } : event);
+
+  return {
+    ...adapter,
+
+    async buildRequest(parsed, incoming) {
+      const history: OcxMessage[] | undefined = parsed.context?.messages;
+      remintToolCallId = createToolCallIdReminter(
+        Array.isArray(history) ? reservedToolCallIdsFromHistory(history) : [],
+      );
+      return adapter.buildRequest(parsed, incoming);
+    },
+
+    async *parseStream(response, budget, tierMetadata): AsyncGenerator<AdapterEvent> {
+      for await (const event of adapter.parseStream(response, budget, tierMetadata)) {
+        yield event.type === "tool_call_start" ? { ...event, id: remintToolCallId(event.id) } : event;
+      }
+    },
+
+    ...(adapter.parseResponse
+      ? {
+        async parseResponse(response, budget, tierMetadata) {
+          return remintEvents(await adapter.parseResponse!(response, budget, tierMetadata));
+        },
+      }
+      : {}),
+  };
+}

src/lib/upstream-retry.ts

@@ -847,6 +847,62 @@ export async function refetchAfterProtocolSafeReset(
     console.warn("[upstream-retry] protocol-safe refetch rejected" + label + "; preserving original stream error");
     return null;
   }
-  console.warn("[upstream-retry] pre-output Responses reset" + label + "; using one replacement stream");
+  console.warn("[upstream-retry] pre-output stream reset" + label + "; using one replacement stream");
   return replacement;
 }
+
+/**
+ * Wrap a streamed body so a reset that arrives before the downstream reader has consumed a single
+ * byte swaps in ONE replacement body.
+ *
+ * The zero-byte gate is the whole reason this wrapper exists: the caller observed nothing, which is
+ * the stage where a replacement may even be considered. Every other question -- whether the operator
+ * granted one, whether the request is replayable, whether the replacement is a fresh unlocked body
+ * that matches the contract already promised to the client -- belongs to
+ * {@link refetchAfterProtocolSafeReset}. Delegating rather than re-deciding is what keeps the chat
+ * lane from drifting away from the one the Responses stream already uses.
+ *
+ * Partial output is never masked: once a byte has reached the caller, the original failure stands.
+ */
+export function wrapWithZeroOutputRefetch(
+  body: ReadableStream<Uint8Array>,
+  doFetch: ProtocolSafeRefetch,
+  // `authorize` is optional on the shared options but required here: a zero-output replacement
+  // is always a post-header resend, so every caller must name the gate that weighs it.
+  opts: ProtocolSafeRefetchOptions & { authorize: () => boolean },
+): ReadableStream<Uint8Array> {
+  let reader = body.getReader();
+  let bytesRead = 0;
+  let retried = false;
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      for (;;) {
+        try {
+          const { done, value } = await reader.read();
+          if (done) {
+            controller.close();
+            return;
+          }
+          bytesRead += value.byteLength;
+          controller.enqueue(value);
+          return;
+        } catch (err) {
+          if (!retried && bytesRead === 0 && !opts.abortSignal?.aborted) {
+            retried = true;
+            const replacement = await refetchAfterProtocolSafeReset(doFetch, err, { ...opts, authorize: opts.authorize });
+            if (replacement?.body) {
+              try { void reader.cancel().catch(() => {}); } catch { /* broken reader; the replacement won */ }
+              reader = replacement.body.getReader();
+              continue;
+            }
+          }
+          try { controller.error(err); } catch { /* already torn down */ }
+          return;
+        }
+      }
+    },
+    cancel(reason) {
+      try { void reader.cancel(reason).catch(() => {}); } catch { /* already torn down */ }
+    },
+  });
+}