fix(cache): include tool_choice/tools/response_format in semantic cache signature (#12734)

.env.example

@@ -1646,7 +1646,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 
 # ── TLS client (wreq-js fingerprint proxy) ──
 # TLS_CLIENT_TIMEOUT_MS=600000       # Inherits from FETCH_TIMEOUT_MS by default
-# TLS_FIRST_BYTE_WATCHDOG_MS=10000   # #12656: bounds time-to-first-byte on the wreq body (0 disables)
 
 # ── API Bridge (/v1 proxy server) ──
 # API_BRIDGE_PROXY_TIMEOUT_MS=600000             # Proxy hop timeout (default: 10min)

changelog.d/fixes/12656-tls-wreq-first-byte-watchdog.md

@@ -1 +0,0 @@
-- fix(sse): add first-byte watchdog to the TLS-fingerprint transport so a stalled wreq body falls back instead of hanging for minutes (#12656)

changelog.d/fixes/12734-semantic-cache-tool-choice.md

@@ -0,0 +1 @@
+- fix(cache): fold tool_choice/tools/response_format into the semantic cache signature so a cached tool_calls response can no longer be replayed for a request whose tool policy forbids it (#12734)

docs/reference/ENVIRONMENT.md

@@ -729,7 +729,6 @@ REQUEST_TIMEOUT_MS (global override)
 │   ├─→ FETCH_HEADERS_TIMEOUT_MS (inherits from FETCH_TIMEOUT_MS)
 │   ├─→ FETCH_BODY_TIMEOUT_MS (inherits from FETCH_TIMEOUT_MS)
 │   ├─→ TLS_CLIENT_TIMEOUT_MS (inherits from FETCH_TIMEOUT_MS)
-│   │   └── TLS_FIRST_BYTE_WATCHDOG_MS (independent, default: 10000)
 │   ├── FETCH_CONNECT_TIMEOUT_MS (independent, default: 30000)
 │   └── FETCH_KEEPALIVE_TIMEOUT_MS (independent, default: 4000)
 ├─→ STREAM_IDLE_TIMEOUT_MS (inherits from REQUEST_TIMEOUT_MS, default: 600000)
@@ -767,7 +766,6 @@ REQUEST_TIMEOUT_MS (global override)
 | `FETCH_CONNECT_TIMEOUT_MS`                | `30000`              | TCP connection establishment timeout.                                                                                                                           |
 | `FETCH_KEEPALIVE_TIMEOUT_MS`              | `4000`               | Keep-alive socket idle timeout.                                                                                                                                 |
 | `TLS_CLIENT_TIMEOUT_MS`                   | = `FETCH_TIMEOUT_MS` | TLS fingerprint proxy (wreq-js) timeout.                                                                                                                        |
-| `TLS_FIRST_BYTE_WATCHDOG_MS`              | `10000`              | Bounds time-to-first-byte on the wreq-js TLS-fingerprint transport's body specifically; `TLS_CLIENT_TIMEOUT_MS` alone cannot catch a stalled body since it resolves as soon as headers arrive (#12656). A timeout cancels the wreq reader and falls back to the direct/proxy dispatcher; `0` disables the watchdog. |
 | `API_BRIDGE_PROXY_TIMEOUT_MS`             | `30000`              | Proxy hop timeout for `/v1` bridge requests.                                                                                                                    |
 | `FIRECRAWL_BASE_URL`                      | `https://api.firecrawl.dev` | Point the Firecrawl web-fetch executor at a self-hosted instance (API key optional off-cloud).                                                          |
 | `FIRECRAWL_TIMEOUT_MS`                    | `30000`              | Per-request timeout for the Firecrawl web-fetch executor.                                                                                                       |

docs/security/STEALTH_GUIDE.md

@@ -31,13 +31,6 @@ unavailable; a caller may explicitly select a fallback outside this wrapper.
 - Proxy resolution (priority): `HTTPS_PROXY` → `HTTP_PROXY` → `ALL_PROXY` (also lower-case)
 - Timeout: `TLS_CLIENT_TIMEOUT_MS` (inherits from `FETCH_TIMEOUT_MS`, default 600000)
 - `wreq-js` Response is fetch-compatible (`headers`, `text()`, `json()`, `clone()`, `body`).
-- First-byte watchdog (`open-sse/utils/tlsFirstByteWatchdog.ts`, #12656): `TlsClient.fetch()`
-  resolves as soon as upstream headers arrive, so `TLS_CLIENT_TIMEOUT_MS` alone cannot bound a
-  body that never yields a first byte. `guardTlsFirstByte()` races the body's first `read()`
-  against `TLS_FIRST_BYTE_WATCHDOG_MS` (default `10000`, `0` disables it); a healthy body is
-  unaffected, while a stalled body cancels the wreq reader and lets `proxyFetch`'s existing
-  TLS-fallback logic fall through to the direct/proxy dispatcher (a non-replay-safe request, e.g.
-  a POST with a body, still throws instead of being silently retried).
 
 ### Web-cookie provider transport — wreq-js 3.2.0
 

open-sse/handlers/chatCore/semanticCache.ts

@@ -29,7 +29,13 @@ export async function checkSemanticCache({
   semanticCacheEnabled: boolean;
   // Only the fields this read path actually touches are named; everything else
   // on the request body stays `unknown` via the index signature.
-  body: Record<string, unknown> & { temperature?: number; top_p?: number };
+  body: Record<string, unknown> & {
+    temperature?: number;
+    top_p?: number;
+    tool_choice?: unknown;
+    tools?: unknown;
+    response_format?: unknown;
+  };
   clientRawRequest: { headers?: unknown } | null;
   model: string;
   provider: string;
@@ -51,7 +57,8 @@ export async function checkSemanticCache({
       body.messages ?? body.input,
       body.temperature,
       body.top_p,
-      apiKeyId ?? undefined
+      apiKeyId ?? undefined,
+      { toolChoice: body.tool_choice, tools: body.tools, responseFormat: body.response_format }
     );
     const cached = getCachedResponse(signature);
     if (cached) {

open-sse/handlers/chatCore/semanticCacheStore.ts

@@ -22,6 +22,9 @@ type CacheBody = {
   input?: unknown;
   temperature?: number;
   top_p?: number;
+  tool_choice?: unknown;
+  tools?: unknown;
+  response_format?: unknown;
 };
 
 type UsageLike = { prompt_tokens?: number; completion_tokens?: number } | null | undefined;
@@ -65,7 +68,12 @@ export function storeSemanticCacheResponse(
     args.body.messages ?? args.body.input,
     args.body.temperature,
     args.body.top_p,
-    args.apiKeyId ?? undefined
+    args.apiKeyId ?? undefined,
+    {
+      toolChoice: args.body.tool_choice,
+      tools: args.body.tools,
+      responseFormat: args.body.response_format,
+    }
   );
   const tokensSaved = args.usage?.prompt_tokens + args.usage?.completion_tokens || 0;
   deps.setCachedResponse(signature, args.model, args.translatedResponse, tokensSaved);

open-sse/handlers/chatCore/streamingSemanticCacheStore.ts

@@ -23,6 +23,9 @@ type CacheBody = {
   input?: unknown;
   temperature?: number;
   top_p?: number;
+  tool_choice?: unknown;
+  tools?: unknown;
+  response_format?: unknown;
 };
 
 export interface StreamingSemanticCacheStoreDeps {
@@ -69,7 +72,12 @@ function writeStreamingCacheEntry(
       args.body.messages ?? args.body.input,
       args.body.temperature,
       args.body.top_p,
-      args.apiKeyId ?? undefined
+      args.apiKeyId ?? undefined,
+      {
+        toolChoice: args.body.tool_choice,
+        tools: args.body.tools,
+        responseFormat: args.body.response_format,
+      }
     );
     const tokensSaved = streamTokensSaved(args.streamUsage);
     deps.setCachedResponse(sig, args.model, cleanBody, tokensSaved);

open-sse/utils/proxyFetch.ts

@@ -13,7 +13,7 @@ import {
   proxyConfigToUrl,
   proxyUrlForLogs,
 } from "./proxyDispatcher.ts";
-import tlsClient, { type TlsFetchOptions, guardTlsFirstByte } from "./tlsClient.ts";
+import tlsClient, { type TlsFetchOptions } from "./tlsClient.ts";
 import { isProxyReachable } from "@/lib/proxyHealth";
 import {
   isControlPlaneProxyDirectFallbackEnabled,
@@ -807,7 +807,7 @@ async function patchedFetch(
           ...tlsProfileForProvider(tlsStore?.provider),
         });
         if (tlsStore) tlsStore.used = true;
-        return await guardTlsFirstByte(response);
+        return response;
       } catch (error) {
         if (isCallerAbort(error, getEffectiveSignal(input, options))) throw error;
         const sessionHadCookies =
@@ -1100,7 +1100,7 @@ async function patchedFetch(
         ...tlsProfileForProvider(tlsStore?.provider),
       });
       if (tlsStore) tlsStore.used = true;
-      return await guardTlsFirstByte(response);
+      return response;
     } catch (error) {
       if (isCallerAbort(error, getEffectiveSignal(input, options))) throw error;
       const sessionHadCookies =

open-sse/utils/tlsClient.ts

@@ -1,9 +1,6 @@
 import { createHash } from "node:crypto";
 import * as nodeModule from "node:module";
 import { getTlsClientTimeoutConfig } from "@/shared/utils/runtimeTimeouts";
-// #12656 — re-exported so proxyFetch.ts (frozen at its file-size cap) can
-// import the first-byte watchdog alongside TlsClient without adding a line.
-export { guardTlsFirstByte } from "./tlsFirstByteWatchdog.ts";
 
 const runtimeRequire = nodeModule.createRequire(import.meta.url);
 

open-sse/utils/tlsFirstByteWatchdog.ts

@@ -1,115 +0,0 @@
-import { getTlsFirstByteWatchdogMs } from "@/shared/utils/runtimeTimeouts";
-
-// #12656 — the wreq-js TLS-fingerprint transport resolves the Response as
-// soon as upstream headers arrive, with zero protection around how long the
-// caller then waits for the body's first byte. The only timing guard on that
-// path, TlsClient's flat `timeout`, defaults to 600_000ms — matching the
-// reported 90-600s stall window exactly. This module races the body's first
-// `read()` against a short, env-overridable watchdog: a healthy body is
-// completely unaffected (bytes already buffered are replayed through a
-// passthrough stream, nothing is dropped), while a body that never yields
-// within the deadline cancels the wreq reader and throws so the caller
-// (proxyFetch's existing TLS-fallback catch blocks) can fall back to the
-// direct/proxy dispatcher instead of hanging for minutes.
-
-export const TLS_FIRST_BYTE_WATCHDOG_TIMEOUT_CODE = "TLS_FIRST_BYTE_WATCHDOG_TIMEOUT";
-
-type BodyReader = ReadableStreamDefaultReader<Uint8Array>;
-type FirstReadResult = ReadableStreamReadResult<Uint8Array>;
-
-function createWatchdogTimeoutError(timeoutMs: number): Error & { code: string } {
-  const err = new Error(
-    `TLS fingerprint transport produced no first byte within ${timeoutMs}ms`
-  ) as Error & { code: string };
-  err.name = "TimeoutError";
-  err.code = TLS_FIRST_BYTE_WATCHDOG_TIMEOUT_CODE;
-  return err;
-}
-
-export function isTlsFirstByteWatchdogTimeout(err: unknown): boolean {
-  return (
-    !!err &&
-    typeof err === "object" &&
-    "code" in err &&
-    (err as { code?: unknown }).code === TLS_FIRST_BYTE_WATCHDOG_TIMEOUT_CODE
-  );
-}
-
-async function raceFirstChunk(reader: BodyReader, timeoutMs: number): Promise<FirstReadResult> {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const timeoutPromise = new Promise<never>((_, reject) => {
-    timer = setTimeout(() => reject(createWatchdogTimeoutError(timeoutMs)), timeoutMs);
-    timer.unref?.();
-  });
-  try {
-    return await Promise.race([reader.read(), timeoutPromise]);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-async function pumpRemainingChunks(
-  reader: BodyReader,
-  controller: ReadableStreamDefaultController<Uint8Array>
-): Promise<void> {
-  try {
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done) {
-        controller.close();
-        return;
-      }
-      if (value) controller.enqueue(value);
-    }
-  } catch (error) {
-    controller.error(error);
-  }
-}
-
-function buildPassthroughStream(
-  reader: BodyReader,
-  firstChunk: FirstReadResult
-): ReadableStream<Uint8Array> {
-  return new ReadableStream<Uint8Array>({
-    start(controller) {
-      if (firstChunk.value) controller.enqueue(firstChunk.value);
-      if (firstChunk.done) {
-        controller.close();
-        return;
-      }
-      void pumpRemainingChunks(reader, controller);
-    },
-    cancel(reason) {
-      void reader.cancel(reason).catch(() => {});
-    },
-  });
-}
-
-/**
- * Guard a TLS-fingerprint Response's first body byte with a short watchdog.
- * Resolves with an equivalent Response (status/headers preserved) whose body
- * has already produced at least one byte, or throws
- * TLS_FIRST_BYTE_WATCHDOG_TIMEOUT after cancelling the reader so the caller
- * can fall back to another transport.
- */
-export async function guardTlsFirstByte(
-  response: Response,
-  timeoutMs: number = getTlsFirstByteWatchdogMs()
-): Promise<Response> {
-  if (!timeoutMs || timeoutMs <= 0 || !response.body) return response;
-
-  const reader = response.body.getReader();
-  let firstChunk: FirstReadResult;
-  try {
-    firstChunk = await raceFirstChunk(reader, timeoutMs);
-  } catch (error) {
-    await reader.cancel(error).catch(() => {});
-    throw error;
-  }
-
-  return new Response(buildPassthroughStream(reader, firstChunk), {
-    status: response.status,
-    statusText: response.statusText,
-    headers: response.headers,
-  });
-}

src/lib/semanticCache.ts

@@ -137,6 +137,43 @@ export function clearMemoryCache(): void {
 
 // ─── Signature Generation ─────────────────
 
+/**
+ * Behavior-changing generation constraints that MUST be folded into the cache signature
+ * (#12734). Without these, a cached response produced under one `tool_choice`/`tools`/
+ * `response_format` could be replayed for a later request that forbids or changes that
+ * behavior (e.g. a cached `tool_calls` response served to a `tool_choice: "none"` request).
+ */
+export interface SignatureConstraints {
+  toolChoice?: unknown;
+  tools?: unknown;
+  responseFormat?: unknown;
+}
+
+/** Normalize a single tool definition, keeping only the fields that define its policy. */
+function normalizeTool(tool: unknown): unknown {
+  const record = asRecord(tool);
+  const fn = asRecord(record.function);
+  if (Object.keys(fn).length === 0 && Object.keys(record).length === 0) return tool;
+  return {
+    type: typeof record.type === "string" ? record.type : "function",
+    function: {
+      name: fn.name,
+      description: fn.description,
+      parameters: fn.parameters,
+    },
+  };
+}
+
+/**
+ * Normalize `tools` for consistent hashing (mirrors `normalizeConversation` for messages):
+ * strips volatile/irrelevant fields while keeping name/description/parameters, which are
+ * what actually define the tool policy a cached response was generated under.
+ */
+function normalizeTools(tools: unknown): unknown {
+  if (!Array.isArray(tools) || tools.length === 0) return undefined;
+  return tools.map(normalizeTool);
+}
+
 /**
  * Generate deterministic cache signature from request params.
  * @param {string} model
@@ -144,6 +181,8 @@ export function clearMemoryCache(): void {
  * @param {number} temperature
  * @param {number} topP
  * @param {string} [apiKeyId] - API key ID for per-key isolation (prevents cross-user cache hits)
+ * @param {SignatureConstraints} [constraints] - tool_choice/tools/response_format (#12734):
+ *   these change model behavior and must not collide with a signature computed without them.
  * @returns {string} hex signature
  */
 export function generateSignature(
@@ -151,13 +190,17 @@ export function generateSignature(
   conversation,
   temperature = 0,
   topP = 1,
-  apiKeyId?: string
+  apiKeyId?: string,
+  constraints?: SignatureConstraints
 ) {
   const payload = JSON.stringify({
     model,
     messages: normalizeConversation(conversation),
     temperature,
     top_p: topP,
+    tool_choice: constraints?.toolChoice,
+    tools: normalizeTools(constraints?.tools),
+    response_format: constraints?.responseFormat,
   });
   const digest = crypto.createHash("sha256").update(payload).digest("hex");
   // Per-key cache isolation (#3740) namespaces the signature with the apiKeyId as a

src/shared/utils/runtimeTimeouts.ts

@@ -35,14 +35,6 @@ export const DEFAULT_MAIN_SERVER_HEADERS_TIMEOUT_MS = 66_000;
 // failure, wait this long for the real completion to land. Set to 0 to
 // disable and restore the old immediate-fail behavior.
 export const DEFAULT_STREAM_DISCONNECT_GRACE_PERIOD_MS = 10_000;
-// #12656 — the wreq-js TLS-fingerprint transport resolves the Response as
-// soon as upstream headers arrive; the only timing guard on the body itself
-// was TlsClient's flat `timeout` (defaults to DEFAULT_FETCH_TIMEOUT_MS =
-// 600_000ms), matching the reporter's observed 90-600s stall range exactly.
-// This bounds time-to-first-byte specifically for that transport so a wedged
-// wreq body falls back fast instead of riding the 10-minute ceiling. Set to
-// 0 to disable the watchdog entirely.
-export const DEFAULT_TLS_FIRST_BYTE_WATCHDOG_MS = 10_000;
 
 function hasEnvValue(env: EnvSource, name: string): boolean {
   const raw = env[name];
@@ -220,16 +212,6 @@ export function getTlsClientTimeoutConfig(
   };
 }
 
-export function getTlsFirstByteWatchdogMs(
-  env: EnvSource = process.env,
-  logger?: TimeoutLogger
-): number {
-  return readTimeoutMs(env, "TLS_FIRST_BYTE_WATCHDOG_MS", DEFAULT_TLS_FIRST_BYTE_WATCHDOG_MS, {
-    allowZero: true,
-    logger,
-  });
-}
-
 export function getApiBridgeTimeoutConfig(
   env: EnvSource = process.env,
   logger?: TimeoutLogger

tests/unit/chatcore-semantic-cache-store.test.ts

@@ -135,3 +135,38 @@ test("missing usage → tokensSaved coerces to 0 (NaN || 0)", () => {
   storeSemanticCacheResponse(baseArgs({ usage: undefined }), deps);
   assert.equal(stored[0].tokens, 0);
 });
+
+// #12734: tool_choice/tools/response_format must reach generateSignature so a cached
+// tool_calls response cannot be replayed under a stricter tool policy.
+test("signature is called with tool_choice/tools/response_format from body (#12734)", () => {
+  let captured: unknown[] = [];
+  const { deps } = makeDeps({
+    generateSignature: (...a: unknown[]) => {
+      captured = a;
+      return "sig";
+    },
+  });
+  const tools = [{ type: "function", function: { name: "get_weather" } }];
+  storeSemanticCacheResponse(
+    baseArgs({
+      body: {
+        messages: [{ role: "user", content: "hi" }],
+        temperature: 0,
+        top_p: 1,
+        tool_choice: "none",
+        tools,
+        response_format: { type: "json_object" },
+      },
+    }),
+    deps
+  );
+  // args: (model, messages ?? input, temperature, top_p, apiKeyId, constraints)
+  const constraints = captured[5] as {
+    toolChoice: unknown;
+    tools: unknown;
+    responseFormat: unknown;
+  };
+  assert.equal(constraints.toolChoice, "none");
+  assert.deepEqual(constraints.tools, tools);
+  assert.deepEqual(constraints.responseFormat, { type: "json_object" });
+});

tests/unit/chatcore-semantic-cache.test.ts

@@ -180,12 +180,14 @@ function makeHitArgs(overrides: Record<string, unknown> = {}) {
 
 // Seed the cache under the EXACT signature checkSemanticCache rebuilds for `args`.
 function seedHit(args: ReturnType<typeof makeHitArgs>["args"], response: unknown) {
+  const body = args.body as Record<string, unknown>;
   const signature = generateSignature(
     args.model,
-    args.body.messages ?? (args.body as Record<string, unknown>).input,
+    body.messages ?? body.input,
     args.body.temperature,
-    (args.body as Record<string, unknown>).top_p,
-    args.apiKeyId ?? undefined
+    body.top_p,
+    args.apiKeyId ?? undefined,
+    { toolChoice: body.tool_choice, tools: body.tools, responseFormat: body.response_format }
   );
   setCachedResponse(signature, args.model, response);
   return signature;
@@ -492,3 +494,76 @@ test("checkSemanticCache HIT includes X-OmniRoute-Cache-Latency: synthetic heade
     "HIT response carries X-OmniRoute-Cache-Latency: synthetic marker"
   );
 });
+
+// ─── tool_choice / tools / response_format must be part of the signature (#12734) ────────────
+
+test("#12734: cached tool_calls response must NOT be replayed for tool_choice: 'none'", async () => {
+  clearCache();
+  const messages = [{ role: "user", content: "what is 2+2?" }];
+  const toolCallResponse = {
+    id: "chatcmpl-tool-calls",
+    choices: [
+      {
+        index: 0,
+        finish_reason: "tool_calls",
+        message: {
+          role: "assistant",
+          content: null,
+          tool_calls: [
+            { id: "call_1", type: "function", function: { name: "memory_search", arguments: "{}" } },
+          ],
+        },
+      },
+    ],
+    usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
+  };
+  // Stored under a body with NO tool_choice (mirrors the real pipeline: the cache check
+  // runs before memory/skill tool injection, so the signature it stores under never saw
+  // tool_choice at all).
+  const { args: storeArgs } = makeHitArgs({ body: { model: "gpt-4o", messages, temperature: 0 } });
+  seedHit(storeArgs, toolCallResponse);
+
+  const { args: forbidArgs } = makeHitArgs({
+    body: { model: "gpt-4o", messages, temperature: 0, tool_choice: "none" },
+  });
+  const result = await checkSemanticCache(forbidArgs as Parameters<typeof checkSemanticCache>[0]);
+
+  assert.equal(
+    result,
+    null,
+    "a tool_choice:'none' request must be a cache MISS against a tool_calls response cached without tool_choice"
+  );
+});
+
+test("#12734: identical tool_choice/tools/response_format across requests still HITs", async () => {
+  clearCache();
+  const messages = [{ role: "user", content: "what is the weather?" }];
+  const tools = [
+    {
+      type: "function",
+      function: { name: "get_weather", description: "Get the weather", parameters: { type: "object" } },
+    },
+  ];
+  const cached = {
+    id: "chatcmpl-tool-config-hit",
+    choices: [
+      { index: 0, message: { role: "assistant", content: "sunny" }, finish_reason: "stop" },
+    ],
+    usage: { prompt_tokens: 8, completion_tokens: 2, total_tokens: 10 },
+  };
+  const body = {
+    model: "gpt-4o",
+    messages,
+    temperature: 0,
+    tool_choice: "auto",
+    tools,
+    response_format: { type: "json_object" },
+  };
+  const { args: storeArgs } = makeHitArgs({ body });
+  seedHit(storeArgs, cached);
+
+  const { args: readArgs } = makeHitArgs({ body: { ...body } });
+  const result = await checkSemanticCache(readArgs as Parameters<typeof checkSemanticCache>[0]);
+
+  assert.ok(result, "identical tool_choice/tools/response_format must still HIT");
+});

tests/unit/chatcore-streaming-cache-store.test.ts

@@ -127,3 +127,38 @@ test("a throwing dep is swallowed (fail-open, non-critical)", () => {
   });
   assert.doesNotThrow(() => storeStreamingSemanticCacheResponse(baseArgs(), deps));
 });
+
+// #12734: tool_choice/tools/response_format must reach generateSignature so a cached
+// tool_calls streaming response cannot be replayed under a stricter tool policy.
+test("signature is called with tool_choice/tools/response_format from body (#12734)", () => {
+  let captured: unknown[] = [];
+  const { deps } = makeDeps({
+    generateSignature: (...a: unknown[]) => {
+      captured = a;
+      return "sig";
+    },
+  });
+  const tools = [{ type: "function", function: { name: "get_weather" } }];
+  storeStreamingSemanticCacheResponse(
+    baseArgs({
+      body: {
+        messages: [{ role: "user", content: "hi" }],
+        temperature: 0,
+        top_p: 1,
+        tool_choice: "none",
+        tools,
+        response_format: { type: "json_object" },
+      },
+    }),
+    deps
+  );
+  // args: (model, messages ?? input, temperature, top_p, apiKeyId, constraints)
+  const constraints = captured[5] as {
+    toolChoice: unknown;
+    tools: unknown;
+    responseFormat: unknown;
+  };
+  assert.equal(constraints.toolChoice, "none");
+  assert.deepEqual(constraints.tools, tools);
+  assert.deepEqual(constraints.responseFormat, { type: "json_object" });
+});

tests/unit/semantic-cache.test.ts

@@ -107,6 +107,81 @@ describe("Semantic Cache", () => {
       const sigKeyless = generateSignature("gpt-4o", messages, 0, 1, undefined);
       assert.notEqual(sigKeyed, sigKeyless);
     });
+
+    // #12734: tool_choice/tools/response_format change model behavior and must not be
+    // ignored by the signature — otherwise a cached tool_calls response can be replayed
+    // for a request whose tool policy forbids it.
+    describe("tool_choice / tools / response_format (#12734)", () => {
+      const messages = [{ role: "user", content: "what is 2+2?" }];
+
+      it("generates different signatures for different tool_choice ('auto' vs 'none')", () => {
+        const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          toolChoice: "auto",
+        });
+        const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          toolChoice: "none",
+        });
+        assert.notEqual(sig1, sig2);
+      });
+
+      it("generates different signatures for a forced-function tool_choice", () => {
+        const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          toolChoice: "auto",
+        });
+        const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          toolChoice: { type: "function", function: { name: "get_weather" } },
+        });
+        assert.notEqual(sig1, sig2);
+      });
+
+      it("generates different signatures for no tool_choice vs an explicit one (the #12734 collision)", () => {
+        const sigNoToolChoice = generateSignature("gpt-4o", messages, 0, 1);
+        const sigWithToolChoice = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          toolChoice: "none",
+        });
+        assert.notEqual(sigNoToolChoice, sigWithToolChoice);
+      });
+
+      it("generates different signatures for different tools arrays", () => {
+        const tools1 = [{ type: "function", function: { name: "get_weather", parameters: {} } }];
+        const tools2 = [{ type: "function", function: { name: "get_stock_price", parameters: {} } }];
+        const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, { tools: tools1 });
+        const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, { tools: tools2 });
+        assert.notEqual(sig1, sig2);
+      });
+
+      it("generates different signatures for different response_format", () => {
+        const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          responseFormat: { type: "text" },
+        });
+        const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          responseFormat: { type: "json_object" },
+        });
+        assert.notEqual(sig1, sig2);
+      });
+
+      it("generates identical signatures when constraints are identical (no hit-rate regression)", () => {
+        const tools = [{ type: "function", function: { name: "get_weather", parameters: {} } }];
+        const constraints = {
+          toolChoice: "auto",
+          tools,
+          responseFormat: { type: "json_object" },
+        };
+        const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, constraints);
+        const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
+          toolChoice: "auto",
+          tools: [{ type: "function", function: { name: "get_weather", parameters: {} } }],
+          responseFormat: { type: "json_object" },
+        });
+        assert.equal(sig1, sig2);
+      });
+
+      it("generates identical signatures for omitted constraints vs an explicitly empty constraints object", () => {
+        const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined);
+        const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {});
+        assert.equal(sig1, sig2);
+      });
+    });
   });
 
   describe("isCacheableForRead", () => {

tests/unit/tls-first-byte-watchdog-12656.test.ts

@@ -1,150 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import {
-  proxyFetch,
-  runWithTlsTracking,
-  setTlsClientForTest,
-} from "../../open-sse/utils/proxyFetch.ts";
-import type { TlsFetchOptions } from "../../open-sse/utils/tlsClient.ts";
-
-// #12656 — when ENABLE_TLS_FINGERPRINT=true, the wreq-js TLS-fingerprint
-// transport used to return the Response as soon as headers resolved, with no
-// guard on how long the caller then waited for the body's first byte (the
-// only timing control, TlsClient's flat `timeout`, defaults to 600_000ms).
-// These tests promote the RED probe from the #12656 plan-file into a
-// permanent regression suite for the first-byte watchdog added in
-// open-sse/utils/tlsFirstByteWatchdog.ts.
-
-type EnvState = Record<string, string | undefined>;
-
-const ENV_KEYS = [
-  "ENABLE_TLS_FINGERPRINT",
-  "TLS_FINGERPRINT_PROVIDERS",
-  "TLS_FIRST_BYTE_WATCHDOG_MS",
-] as const;
-
-async function withEnv(env: EnvState, fn: () => Promise<void> | void): Promise<void> {
-  const prior = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]]));
-  for (const key of ENV_KEYS) {
-    if (env[key] === undefined) delete process.env[key];
-    else process.env[key] = env[key];
-  }
-  try {
-    await fn();
-  } finally {
-    for (const key of ENV_KEYS) {
-      if (prior[key] === undefined) delete process.env[key];
-      else process.env[key] = prior[key];
-    }
-    setTlsClientForTest(null);
-  }
-}
-
-function fakeTlsClient(fetch: (url: string, options?: TlsFetchOptions) => Promise<Response>) {
-  return { available: true, fetch };
-}
-
-function neverYieldingBody(): ReadableStream<Uint8Array> {
-  return new ReadableStream<Uint8Array>({
-    pull() {
-      // Never enqueue, never close — simulates the reported wreq stall.
-    },
-  });
-}
-
-test("#12656 (a) a stalled wreq body falls back to the direct dispatcher within the watchdog window", async () => {
-  await withEnv({ ENABLE_TLS_FINGERPRINT: "true", TLS_FIRST_BYTE_WATCHDOG_MS: "80" }, async () => {
-    setTlsClientForTest(
-      fakeTlsClient(
-        async () =>
-          new Response(neverYieldingBody(), {
-            status: 200,
-            headers: { "content-type": "text/event-stream" },
-          })
-      )
-    );
-
-    let dispatcherCalls = 0;
-    const startedAt = Date.now();
-    const tracked = await runWithTlsTracking("openai", () =>
-      proxyFetch(
-        "https://example-provider.test/v1/chat/completions",
-        { method: "GET" },
-        {
-          undiciFetch: async () => {
-            dispatcherCalls++;
-            return new Response("fallback-body", { status: 200 });
-          },
-        }
-      )
-    );
-    const elapsedMs = Date.now() - startedAt;
-
-    assert.equal(dispatcherCalls, 1);
-    assert.equal(await tracked.result.text(), "fallback-body");
-    // Well under the OLD 600_000ms flat TlsClient timeout — proves the
-    // watchdog fired instead of riding the default request timeout.
-    assert.ok(elapsedMs < 5_000, `expected fast fallback, took ${elapsedMs}ms`);
-    // tlsStore.used is flipped back to false on the fallback path in
-    // proxyFetch's existing catch block, same as any other TLS failure.
-    assert.equal(tracked.tlsFingerprintUsed, false);
-  });
-});
-
-test("#12656 (b) a healthy/fast wreq body is unaffected by the watchdog", async () => {
-  await withEnv({ ENABLE_TLS_FINGERPRINT: "true", TLS_FIRST_BYTE_WATCHDOG_MS: "80" }, async () => {
-    setTlsClientForTest(fakeTlsClient(async () => new Response("healthy-body", { status: 200 })));
-
-    let dispatcherCalls = 0;
-    const tracked = await runWithTlsTracking("openai", () =>
-      proxyFetch(
-        "https://example-provider.test/v1/chat/completions",
-        { method: "GET" },
-        {
-          undiciFetch: async () => {
-            dispatcherCalls++;
-            return new Response("fallback-body", { status: 200 });
-          },
-        }
-      )
-    );
-
-    assert.equal(dispatcherCalls, 0);
-    assert.equal(await tracked.result.text(), "healthy-body");
-    assert.equal(tracked.tlsFingerprintUsed, true);
-  });
-});
-
-test("#12656 (c) a non-replay-safe POST throws on watchdog timeout instead of silently retrying", async () => {
-  await withEnv({ ENABLE_TLS_FINGERPRINT: "true", TLS_FIRST_BYTE_WATCHDOG_MS: "80" }, async () => {
-    setTlsClientForTest(
-      fakeTlsClient(
-        async () =>
-          new Response(neverYieldingBody(), {
-            status: 200,
-            headers: { "content-type": "text/event-stream" },
-          })
-      )
-    );
-
-    let dispatcherCalls = 0;
-    await assert.rejects(
-      runWithTlsTracking("openai", () =>
-        proxyFetch(
-          "https://example-provider.test/v1/chat/completions",
-          { method: "POST", body: "{}" },
-          {
-            undiciFetch: async () => {
-              dispatcherCalls++;
-              return new Response("unexpected", { status: 200 });
-            },
-          }
-        )
-      ),
-      (error: Error) =>
-        error.message === "TLS fingerprint request failed; request is not safe to replay"
-    );
-    assert.equal(dispatcherCalls, 0);
-  });
-});