fix(provider-protocol): preserve tool content and response semantics

[ewen-poch]

Problem

Provider protocol conversion can silently change tool results and completion semantics: tool images become text or disappear, truncated answers look complete, cached input is undercounted, xAI Chat SSE omits requested usage, parallel tools have no stream index, malformed tool arguments become {}, multiline native SSE loses tool identity, and request sanitization removes legitimate schema fields and null constraints.

Proposed change

• Preserve tool-result text/call IDs and attach typed images in associated upstream user content, keeping parallel Chat tool results adjacent.
• Map truncation/filter reasons consistently in JSON and SSE; reject explicit failed/nonterminal or unsupported termination values while retaining compatibility with omitted status fields.
• Sum uncached input, cache reads and cache writes; retain the existing cache_creation_input_tokens compatibility extension. Emit requested xAI SSE usage with empty choices before [DONE] and add stable parallel tool indexes at Chat serialization.
• Reject malformed or non-object Responses tool arguments before publishing Messages tool calls, including before downstream SSE starts; valid {} remains allowed.
• Join native SSE data lines at the existing event boundary before restoring tool identity, preserving limits, comments and unknown events. Strip unsupported request-level metadata without recursively modifying business schemas or tool data.

Scope and non-goals

Six existing production files, no new production module or public export. No database/schema migration, application enum, persisted format, historical backfill, UI component, dependency or subscription owner. Correct future usage can flow through existing persistence consumers. Existing unknown/omitted-status compatibility is covered separately from explicit failure handling.

Images use supported upstream content parts; this does not enable new models or change the application's saved user messages. No automatic continuation/retry or tool execution is added. No UI screenshots apply because renderer pages and error presentation are unchanged; HTTP error behavior is tested, not claimed as a UI reproduction.

Acceptance criteria and validation

The final regression suite contains 41 cases. Against the unchanged base production files, 36 cases failed and 5 controls passed on each of two runs. Failures were behavioral assertions matching R01–R08, not startup errors. The same suite passes 41/41 after the fix. Existing captured Codex/Claude image requests and real loopback HTTP bridges are used; no production test seam was introduced.

All checks below ran after the last material edit. The worktree reused the root installation for Vitest:

Behavior / boundary	Command	Result
R01–R08 HTTP/adapters; parallel image association, malformed arguments, LF/CRLF fragmented SSE, unknown reasons, opaque schema values	node ../../node_modules/vitest/vitest.mjs run src/main/settings/provider-protocol-regressions.test.ts src/main/settings/chat-provider-compatibility.test.ts src/main/acp/codebuddy-turn-adapter.test.ts src/main/agent-framework/codebuddy.test.ts src/shared/settings.test.ts --maxWorkers=2	74 passed, including all 41 regressions
Settings transport owners, request/result architecture boundaries, native SSE limits/cancellation/diagnostics, same-protocol image fixtures, OAuth refresh/retarget/cleanup, framework contracts and representative ACP/CLI/reviewer/artifact consumers	npm run test:module -- settings_backend_resolution	741 passed, 4 skipped; 38 files passed, 1 skipped
Main, preload/shared and renderer typing	npm run typecheck	Passed, including sandbox-package typecheck
Repository lint	npm run lint	Passed
Changed-file formatting and whitespace	prettier --check <11 changed files>; git diff --check	Passed
Final impact explanation	npm run test:affected:explain -- --base f4897533d853740320dbbf29b4e0aa7dd92c9d68 --head HEAD	Full CI fallback: Chat compatibility/new regression ownership is not declared; no classifier rules changed

The module set covers Claude Code, OpenCode, Codex Responses and Codex Chat routes; supplemental checks cover CodeBuddy. No local full npm test was run, per maintainer instruction. The exact-head PR Gate remains authoritative for full and platform-risk lanes. Independent AI review is pending CI; local checks are not a claim of completed independent review.

Limitations: deterministic upstream fixtures establish wire contracts, not real-provider acceptance, real CLI tool execution, UI billing, or historical data recovery. The R05 consumer composition demonstrates the index contract and is not presented as a real CodeBuddy-to-Responses production chain. Four module tests remain skipped under their existing environment gates.

Review focus

Image association and parallel-result ordering; completion versus truncation/error semantics; cache totals and the additive cache-write field; no fabricated tool arguments; SSE metadata/limits preservation; sanitization boundaries. Local planning files and raw evidence are excluded from the PR.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: Static inspection of the base-to-HEAD changes found no concrete merge-blocking defects.