fix(sse): keep each functionCall's own thoughtSignature on parallel Gemini tool-call turns (#11510)

claude-to-gemini.ts and openai-to-gemini.ts only re-attached a resolved thoughtSignature to the FIRST functionCall of an assistant message, silently dropping it for every subsequent tool_use/tool_calls entry in the same parallel (multi tool-call) turn -- even when a real, previously-stored signature existed for it. Gemini 3.x then rejected the request with HTTP 400 'Function call is missing a thought_signature in functionCall parts'.

Each functionCall part now carries its own resolved thoughtSignature unconditionally, instead of only the first one in the message.

Regression tests: tests/unit/issue-11510-parallel-tool-thought-signature.test.ts (claude-to-gemini) and tests/unit/issue-11510-parallel-tool-thought-signature-openai.test.ts (openai-to-gemini), both proven RED against unfixed code and GREEN after the fix.

changelog.d/fixes/11510-gemini-parallel-tool-thought-signature.md

@@ -0,0 +1 @@
+- **fix(sse):** stop dropping resolved `thoughtSignature` values on parallel (multi tool-call) turns sent to Gemini 3.x — the claude→gemini and openai→gemini translators previously kept the signature only on the *first* function call of a message, causing Gemini to reject subsequent calls in the same turn with HTTP 400 "Function call is missing a thought_signature"; each function call now keeps its own resolved signature ([#11510](https://github.com/diegosouzapw/OmniRoute/issues/11510)).

open-sse/executors/zai-web.ts

@@ -90,13 +90,19 @@ async function resolveZaiBrowserAttachments(
 > {
   try {
     // Browser-page upload: keep the original bytes/mimeType (no Cursor wire prep).
+    // EncodedImage.mimeType is optional on the wire type, but every producer
+    // reachable here (decodeDataUrl / fetchImageBytes) validates an image/*
+    // string before pushing; the fallback only satisfies the attachment type.
     const images = await resolveCursorImages(imageUrls, { prepareForWire: false });
     return {
-      attachments: images.map((image, index) => ({
-        name: zaiImageFileName(image.mimeType, index),
-        mimeType: image.mimeType,
-        buffer: image.data,
-      })),
+      attachments: images.map((image, index) => {
+        const mimeType = image.mimeType ?? "image/jpeg";
+        return {
+          name: zaiImageFileName(mimeType, index),
+          mimeType,
+          buffer: image.data,
+        };
+      }),
     };
   } catch (error) {
     const message =

open-sse/translator/request/claude-to-gemini.ts

@@ -136,7 +136,6 @@ export function claudeToGeminiRequest(model, body, stream, credentials = null) {
     const omittedToolCallIds = new Set<string>();
     for (const msg of body.messages) {
       const parts = [];
-      let shouldUseEmbeddedSignature = true;
 
       if (Array.isArray(msg.content)) {
         for (const block of msg.content) {
@@ -160,15 +159,15 @@ export function claudeToGeminiRequest(model, body, stream, credentials = null) {
                 break;
               }
 
-              const embeddedThoughtSignature = shouldUseEmbeddedSignature
-                ? signatureForToolCall
-                : undefined;
-              if (embeddedThoughtSignature) {
-                shouldUseEmbeddedSignature = false;
-              }
-
+              // #11510: each functionCall part carries its OWN resolved
+              // thoughtSignature — a parallel (multi tool_use) turn can have a
+              // real, individually-valid signature per tool call, and Gemini
+              // 3.x rejects the request if any functionCall in the turn is
+              // missing one. Previously only the first functionCall of the
+              // message kept its signature; this dropped valid signatures for
+              // every subsequent parallel tool call in the same turn.
               parts.push({
-                ...(embeddedThoughtSignature ? { thoughtSignature: embeddedThoughtSignature } : {}),
+                ...(signatureForToolCall ? { thoughtSignature: signatureForToolCall } : {}),
                 functionCall: {
                   ...(stripFunctionCallId ? {} : { id: block.id }),
                   name: sanitizeToolName(block.name),

open-sse/translator/request/openai-to-gemini.ts

@@ -383,7 +383,6 @@ function openaiToGeminiBase(
         if (toolCalls && Array.isArray(toolCalls)) {
           const toolCallIds: string[] = [];
           const resolvedSignatures = new Map<string, string>();
-          let firstPersistedSignature: string | undefined;
           for (const tc of toolCalls) {
             const id = tc.id as string;
             const resolved = resolveGeminiThoughtSignature(
@@ -392,11 +391,9 @@ function openaiToGeminiBase(
             );
             if (typeof resolved === "string" && resolved.length > 0) {
               resolvedSignatures.set(id, resolved);
-              firstPersistedSignature ??= resolved;
             }
           }
 
-          let shouldUseEmbeddedSignature = !parts.some((p) => p.thoughtSignature);
           const signaturelessToolCallMode = toolNameOptions.signaturelessToolCallMode;
           const stringifySignaturelessToolCalls = signaturelessToolCallMode === "text";
           const contextualizeSignaturelessToolResponses =
@@ -433,13 +430,14 @@ function openaiToGeminiBase(
             }
 
             const args = tryParseJSON(fn.arguments || "{}");
-            const embeddedThoughtSignature = shouldUseEmbeddedSignature
-              ? firstPersistedSignature || signatureForToolCall
-              : undefined;
-
-            if (embeddedThoughtSignature) {
-              shouldUseEmbeddedSignature = false;
-            }
+            // #11510: each functionCall part carries its OWN resolved
+            // thoughtSignature — a parallel (multi tool_calls) turn can have a
+            // real, individually-valid signature per tool call, and Gemini 3.x
+            // rejects the request if any functionCall in the turn is missing
+            // one. Previously only the first functionCall of the message kept
+            // its signature; this dropped valid signatures for every
+            // subsequent parallel tool call in the same turn.
+            const embeddedThoughtSignature = signatureForToolCall;
 
             // Gemini expects the signature on the functionCall part itself.
             // If we are in a mode where missing signatures cause 400s (and we couldn't find one),

open-sse/utils/error.ts

@@ -15,6 +15,7 @@ interface ErrorResponseBody {
     message: string;
     type?: string;
     code?: string;
+    reason?: string;
   };
   upstream_details?: Record<string, unknown> | null; // sanitized upstream provider body
 }
@@ -108,6 +109,7 @@ export function sanitizeUpstreamDetails(value: unknown, depth = 0): unknown {
 export type ErrorBodyClassification = {
   type?: string;
   code?: string;
+  reason?: string;
 };
 
 /**
@@ -132,6 +134,7 @@ export function buildErrorBody(
       message: safeMessage,
       type: classification?.type ?? errorInfo.type,
       code: classification?.code ?? errorInfo.code,
+      reason: classification?.reason,
     },
   };
 

scripts/ad-hoc/nvidia-startswith-diag.ts

@@ -19,12 +19,20 @@
  */
 
 const KEY = process.env.NVIDIA_API_KEY ?? "";
-const BASE_URL = process.env.NVIDIA_BASE_URL || "https://integrate.api.nvidia.com/v1/chat/completions";
+const BASE_URL =
+  process.env.NVIDIA_BASE_URL || "https://integrate.api.nvidia.com/v1/chat/completions";
 const MODEL = process.env.NVIDIA_MODEL || "openai/gpt-oss-120b";
 
 // Neutralize CR/LF before logging so env-derived values (NVIDIA_MODEL, etc.)
-// cannot forge extra log lines (S5145 log injection).
-const line = (s = "") => console.log(String(s).replace(/[\r\n]+/g, " "));
+// cannot forge extra log lines (S5145 log injection). Also strip any raw
+// occurrence of the API key so an upstream error/response that echoes it
+// back (e.g. inside err.stack or a validation result) never reaches the
+// terminal in clear text (js/clear-text-logging, CWE-312/532).
+const line = (s = "") => {
+  let out = String(s).replace(/[\r\n]+/g, " ");
+  if (KEY) out = out.split(KEY).join("[REDACTED]");
+  console.log(out);
+};
 const hr = () => line("─".repeat(72));
 
 function show(label: string, value: unknown) {
@@ -52,8 +60,13 @@ async function partA() {
     });
     line("  ✅ validateProviderApiKey retornou (sem crash):");
     show("resultado", result);
-    if (typeof (result as any)?.error === "string" && (result as any).error.includes("startsWith")) {
-      line("  ⚠️  A mensagem de erro contém 'startsWith' → crash CAPTURADO dentro do try/catch da validação.");
+    if (
+      typeof (result as any)?.error === "string" &&
+      (result as any).error.includes("startsWith")
+    ) {
+      line(
+        "  ⚠️  A mensagem de erro contém 'startsWith' → crash CAPTURADO dentro do try/catch da validação."
+      );
     }
   } catch (err: any) {
     line("  ❌ validateProviderApiKey LANÇOU (crash não tratado):");

scripts/build/prepublish.ts

@@ -23,7 +23,7 @@ import {
   statSync,
   chmodSync,
 } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { assembleStandalone } from "./assembleStandalone.mjs";
@@ -35,6 +35,12 @@ import {
   APP_STAGING_REMOVAL_PATHS,
   findUnexpectedArtifactPaths,
 } from "./pack-artifact-policy.ts";
+import {
+  collectWorkspaceVersions,
+  findPackageJsonFiles,
+  hasWorkspaceProtocol,
+  resolvePackageJsonWorkspaceProtocols,
+} from "./resolveWorkspaceProtocols.ts";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -707,6 +713,33 @@ if (remainingUnexpectedFiles.length > 0) {
   process.exit(1);
 }
 
+// -- Step 11: Resolve workspace: protocol dependencies -----------------
+// npm/pnpm workspace protocol specifiers (workspace:*, workspace:^, ...)
+// are meaningless to the npm registry and make `npm install -g omniroute`
+// fail with EUNSUPPORTEDPROTOCOL. Rewrite any that leaked into published
+// package.json files to the concrete workspace package version.
+// Only touch files inside the staged dist/ tree; workspace member source
+// package.json files must never be mutated by the publish step.
+const workspaceVersions = collectWorkspaceVersions(ROOT);
+const publishablePackageJsonDirs = [DIST_DIR];
+const publishablePackageJsonPaths = publishablePackageJsonDirs
+  .flatMap((dir) => (existsSync(dir) ? findPackageJsonFiles(dir) : []))
+  .filter((filePath) => existsSync(filePath));
+
+for (const pkgJsonPath of publishablePackageJsonPaths) {
+  let pkg: Record<string, unknown>;
+  try {
+    pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8")) as Record<string, unknown>;
+  } catch {
+    continue;
+  }
+  if (!hasWorkspaceProtocol(pkg)) continue;
+
+  const resolved = resolvePackageJsonWorkspaceProtocols(pkg, workspaceVersions);
+  writeFileSync(pkgJsonPath, JSON.stringify(resolved, null, 2) + "\n");
+  console.log(`  [resolved] Resolved workspace: protocols in ${relative(ROOT, pkgJsonPath)}`);
+}
+
 // ── Done ───────────────────────────────────────────────────
 const distPkg = join(DIST_DIR, "package.json");
 if (existsSync(distPkg)) {

scripts/build/resolveWorkspaceProtocols.ts

@@ -0,0 +1,228 @@
+/**
+ * Resolve pnpm/npm workspace protocol dependencies to concrete semver versions.
+ *
+ * The npm registry clients cannot parse `workspace:` specifiers. During prepublish
+ * we rewrite any `workspace:*`, `workspace:^`, `workspace:~` (or explicit
+ * `workspace:<range>`) dependency declarations to the matching workspace package's
+ * actual version before npm pack/publish sees them.
+ */
+
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import * as yaml from "js-yaml";
+
+const WORKSPACE_PROTOCOL_RE = /^workspace:/;
+
+const DEPENDENCY_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies",
+] as const;
+
+/**
+ * Parse a simple workspace glob entry into concrete directories relative to a root.
+ * Supports entries like "packages/*" and literal directory names like "open-sse".
+ */
+function expandWorkspaceEntry(root: string, entry: string): string[] {
+  const trimmed = entry.trim();
+  if (!trimmed) return [];
+  if (!trimmed.endsWith("/*")) {
+    const dir = join(root, trimmed);
+    try {
+      return statSync(dir).isDirectory() ? [dir] : [];
+    } catch {
+      return [];
+    }
+  }
+  const parent = join(root, trimmed.slice(0, -2));
+  let entries: string[] = [];
+  try {
+    entries = readdirSync(parent);
+  } catch {
+    return [];
+  }
+  return entries
+    .map((name) => join(parent, name))
+    .filter((dir) => {
+      try {
+        return statSync(dir).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+}
+
+/**
+ * Read the root package.json and, if present, pnpm-workspace.yaml to discover
+ * workspace member directories. Returns a map of package name -> version.
+ */
+export function collectWorkspaceVersions(projectRoot: string): Map<string, string> {
+  const versions = new Map<string, string>();
+
+  const rootPkgPath = join(projectRoot, "package.json");
+  let workspaceEntries: string[] = [];
+  try {
+    const rootPkg = JSON.parse(readFileSync(rootPkgPath, "utf8")) as {
+      workspaces?: string[];
+    };
+    if (Array.isArray(rootPkg.workspaces)) {
+      workspaceEntries.push(...rootPkg.workspaces);
+    }
+  } catch {
+    // ignore unreadable root package.json
+  }
+
+  const pnpmWorkspacePath = join(projectRoot, "pnpm-workspace.yaml");
+  try {
+    const yamlContent = readFileSync(pnpmWorkspacePath, "utf8");
+    const doc = yaml.load(yamlContent) as { packages?: unknown } | null | undefined;
+    if (doc && Array.isArray(doc.packages)) {
+      for (const entry of doc.packages) {
+        if (typeof entry === "string" && entry) {
+          workspaceEntries.push(entry);
+        }
+      }
+    }
+  } catch {
+    // ignore missing or malformed pnpm-workspace.yaml
+  }
+
+  const seenDirs = new Set<string>();
+  for (const entry of workspaceEntries) {
+    for (const dir of expandWorkspaceEntry(projectRoot, entry)) {
+      if (seenDirs.has(dir)) continue;
+      seenDirs.add(dir);
+      try {
+        const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
+          name?: string;
+          version?: string;
+        };
+        if (pkg.name && pkg.version) {
+          versions.set(pkg.name, pkg.version);
+        }
+      } catch {
+        // skip unreadable workspace member package.json
+      }
+    }
+  }
+
+  return versions;
+}
+
+/**
+ * Resolve workspace protocol dependencies inside a package.json object.
+ *
+ * Replaces `workspace:*`, `workspace:^`, `workspace:~`, `workspace:<range>`,
+ * and `workspace:<packageName>` with the concrete version of the referenced
+ * workspace package. Throws if a workspace specifier cannot be resolved.
+ */
+export function resolvePackageJsonWorkspaceProtocols(
+  pkg: Record<string, unknown>,
+  workspaceVersions: Map<string, string>
+): Record<string, unknown> {
+  const resolved: Record<string, unknown> = { ...pkg };
+
+  for (const field of DEPENDENCY_FIELDS) {
+    const deps = pkg[field];
+    if (!deps || typeof deps !== "object" || Array.isArray(deps)) continue;
+
+    const resolvedDeps: Record<string, string> = {};
+    let changed = false;
+    for (const [depName, versionSpec] of Object.entries(deps as Record<string, unknown>)) {
+      if (typeof versionSpec !== "string") {
+        resolvedDeps[depName] = String(versionSpec ?? "");
+        continue;
+      }
+      if (!WORKSPACE_PROTOCOL_RE.test(versionSpec)) {
+        resolvedDeps[depName] = versionSpec;
+        continue;
+      }
+
+      const body = versionSpec.slice("workspace:".length);
+      let concrete: string | undefined;
+
+      if (body === "*") {
+        concrete = workspaceVersions.get(depName);
+      } else if (body === "^") {
+        const version = workspaceVersions.get(depName);
+        concrete = version ? `^${version}` : undefined;
+      } else if (body === "~") {
+        const version = workspaceVersions.get(depName);
+        concrete = version ? `~${version}` : undefined;
+      } else if (body.startsWith("^") || body.startsWith("~") || /^[\d<>=]/.test(body)) {
+        // Explicit range inside workspace: protocol - strip the protocol prefix.
+        concrete = body;
+      } else {
+        // workspace:<packageName> - resolve to that package's version.
+        concrete = workspaceVersions.get(body);
+      }
+
+      if (concrete) {
+        resolvedDeps[depName] = concrete;
+        changed = true;
+      } else {
+        throw new Error(
+          `Cannot resolve workspace protocol "${versionSpec}" for dependency "${depName}". ` +
+            "Make sure the referenced package is a declared workspace member with a version."
+        );
+      }
+    }
+
+    if (changed) {
+      resolved[field] = resolvedDeps;
+    }
+  }
+
+  return resolved;
+}
+
+/**
+ * Return true if any dependency field in the package contains a workspace: specifier.
+ */
+export function hasWorkspaceProtocol(pkg: Record<string, unknown>): boolean {
+  for (const field of DEPENDENCY_FIELDS) {
+    const deps = pkg[field];
+    if (!deps || typeof deps !== "object" || Array.isArray(deps)) continue;
+    for (const versionSpec of Object.values(deps as Record<string, unknown>)) {
+      if (typeof versionSpec === "string" && WORKSPACE_PROTOCOL_RE.test(versionSpec)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Recursively walk a directory and return every package.json path found.
+ * Stops descending after maxDepth to avoid runaway recursion on deep trees.
+ */
+export function findPackageJsonFiles(dir: string, maxDepth = 10): string[] {
+  const results: string[] = [];
+  if (maxDepth < 0) return results;
+
+  let entries: string[] = [];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return results;
+  }
+
+  for (const entry of entries) {
+    if (entry === "node_modules") continue;
+    const fullPath = join(dir, entry);
+    let stat;
+    try {
+      stat = statSync(fullPath);
+    } catch {
+      continue;
+    }
+    if (stat.isDirectory()) {
+      results.push(...findPackageJsonFiles(fullPath, maxDepth - 1));
+    } else if (entry === "package.json") {
+      results.push(fullPath);
+    }
+  }
+
+  return results;
+}

src/shared/middleware/chatAdmissionResponses.ts

@@ -66,8 +66,8 @@ export function structuralRejectionResponse(status: 413 | 503, maxMessages: numb
     {
       type: historyLimit ? "payload_too_large" : "server_error",
       code: historyLimit ? "chat_history_too_large" : "chat_admission_busy",
+      reason: historyLimit ? "message_limit" : "structure_limit",
     }
   );
-  body.error.reason = historyLimit ? "message_limit" : "structure_limit";
   return new Response(JSON.stringify(body), { status, headers });
 }

tests/unit/build/pack-no-workspace-protocol.test.ts

@@ -0,0 +1,269 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  collectWorkspaceVersions,
+  resolvePackageJsonWorkspaceProtocols,
+  hasWorkspaceProtocol,
+  findPackageJsonFiles,
+} from "../../../scripts/build/resolveWorkspaceProtocols.ts";
+
+function tmpDir(prefix: string): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+function writeJson(filePath: string, data: unknown): void {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(data, null, 2));
+}
+
+function readJson(filePath: string): Record<string, unknown> {
+  return JSON.parse(fs.readFileSync(filePath, "utf8")) as Record<string, unknown>;
+}
+
+test("resolvePackageJsonWorkspaceProtocols replaces workspace:*, workspace:^, workspace:~", () => {
+  const versions = new Map([
+    ["@omniroute/open-sse", "3.8.51"],
+    ["@omniroute/shared", "1.2.3"],
+  ]);
+
+  const resolved = resolvePackageJsonWorkspaceProtocols(
+    {
+      name: "omniroute",
+      version: "3.8.51",
+      dependencies: {
+        "@omniroute/open-sse": "workspace:^",
+        "@omniroute/shared": "workspace:*",
+        lodash: "^4.17.0",
+      },
+      devDependencies: {
+        "@omniroute/open-sse": "workspace:~",
+      },
+      peerDependencies: {
+        "@omniroute/shared": "workspace:1.2.3",
+      },
+      optionalDependencies: {
+        "@omniroute/open-sse": "workspace:>=3.0.0",
+      },
+    },
+    versions
+  );
+
+  assert.equal((resolved.dependencies as Record<string, string>)["@omniroute/open-sse"], "^3.8.51");
+  assert.equal((resolved.dependencies as Record<string, string>)["@omniroute/shared"], "1.2.3");
+  assert.equal((resolved.dependencies as Record<string, string>).lodash, "^4.17.0");
+  assert.equal(
+    (resolved.devDependencies as Record<string, string>)["@omniroute/open-sse"],
+    "~3.8.51"
+  );
+  assert.equal((resolved.peerDependencies as Record<string, string>)["@omniroute/shared"], "1.2.3");
+  assert.equal(
+    (resolved.optionalDependencies as Record<string, string>)["@omniroute/open-sse"],
+    ">=3.0.0"
+  );
+});
+
+test("resolvePackageJsonWorkspaceProtocols leaves non-workspace specs untouched", () => {
+  const resolved = resolvePackageJsonWorkspaceProtocols(
+    {
+      name: "x",
+      dependencies: {
+        a: "^1.0.0",
+        b: "file:../b",
+        c: "npm:alias@1.0.0",
+      },
+    },
+    new Map()
+  );
+
+  assert.equal((resolved.dependencies as Record<string, string>).a, "^1.0.0");
+  assert.equal((resolved.dependencies as Record<string, string>).b, "file:../b");
+  assert.equal((resolved.dependencies as Record<string, string>).c, "npm:alias@1.0.0");
+  assert.equal(hasWorkspaceProtocol(resolved), false);
+});
+
+test("resolvePackageJsonWorkspaceProtocols throws for unresolvable workspace protocol", () => {
+  assert.throws(
+    () =>
+      resolvePackageJsonWorkspaceProtocols(
+        {
+          name: "x",
+          dependencies: {
+            "@missing/pkg": "workspace:^",
+          },
+        },
+        new Map()
+      ),
+    /Cannot resolve workspace protocol/
+  );
+});
+
+test("collectWorkspaceVersions reads npm workspaces and pnpm-workspace.yaml", () => {
+  const root = tmpDir("workspace-versions-");
+
+  writeJson(path.join(root, "package.json"), {
+    name: "root",
+    version: "0.0.0",
+    workspaces: ["packages/*", "open-sse"],
+  });
+
+  fs.mkdirSync(path.join(root, "packages", "a"), { recursive: true });
+  writeJson(path.join(root, "packages", "a", "package.json"), {
+    name: "@scope/a",
+    version: "1.0.0",
+  });
+
+  fs.mkdirSync(path.join(root, "open-sse"), { recursive: true });
+  writeJson(path.join(root, "open-sse", "package.json"), {
+    name: "@scope/open-sse",
+    version: "2.0.0",
+  });
+
+  // pnpm-workspace.yaml adds an extra directory not in npm workspaces.
+  fs.mkdirSync(path.join(root, "packages", "b"), { recursive: true });
+  writeJson(path.join(root, "packages", "b", "package.json"), {
+    name: "@scope/b",
+    version: "3.0.0",
+  });
+  fs.writeFileSync(path.join(root, "pnpm-workspace.yaml"), "packages:\n  - 'packages/*'\n");
+
+  const versions = collectWorkspaceVersions(root);
+  assert.equal(versions.get("@scope/a"), "1.0.0");
+  assert.equal(versions.get("@scope/open-sse"), "2.0.0");
+  assert.equal(versions.get("@scope/b"), "3.0.0");
+});
+
+test("findPackageJsonFiles skips node_modules and respects maxDepth", () => {
+  const root = tmpDir("pkg-json-files-");
+  fs.mkdirSync(path.join(root, "a"), { recursive: true });
+  writeJson(path.join(root, "a", "package.json"), {});
+  fs.mkdirSync(path.join(root, "node_modules", "x"), { recursive: true });
+  writeJson(path.join(root, "node_modules", "x", "package.json"), {});
+
+  const files = findPackageJsonFiles(root);
+  assert.equal(files.length, 1);
+  assert.ok(files[0].endsWith(path.join("a", "package.json")));
+
+  // Build a deep tree and confirm maxDepth bounds the walk.
+  const deep = tmpDir("pkg-json-deep-");
+  let current = deep;
+  for (let i = 0; i < 12; i += 1) {
+    current = path.join(current, `level${i}`);
+    fs.mkdirSync(current, { recursive: true });
+  }
+  writeJson(path.join(current, "package.json"), {});
+  assert.equal(findPackageJsonFiles(deep, 10).length, 0);
+  assert.equal(findPackageJsonFiles(deep, 12).length, 1);
+});
+
+test("collectWorkspaceVersions parses pnpm-workspace.yaml with js-yaml", () => {
+  const root = tmpDir("pnpm-yaml-");
+
+  writeJson(path.join(root, "package.json"), { name: "root", version: "0.0.0" });
+
+  // Flow-style array, nested quotes, comments inside the packages list, and an
+  // unrelated top-level key before packages are all valid YAML that the old line
+  // scanner could not handle.
+  fs.writeFileSync(
+    path.join(root, "pnpm-workspace.yaml"),
+    "preferWorkspacePackages: true\n" +
+      "packages:\n" +
+      '  - "packages/*"\n' +
+      "  - 'apps/*'\n" +
+      "  # comment inside the list\n" +
+      "  - open-sse\n"
+  );
+
+  fs.mkdirSync(path.join(root, "packages", "a"), { recursive: true });
+  writeJson(path.join(root, "packages", "a", "package.json"), {
+    name: "@scope/a",
+    version: "1.0.0",
+  });
+
+  fs.mkdirSync(path.join(root, "apps", "web"), { recursive: true });
+  writeJson(path.join(root, "apps", "web", "package.json"), {
+    name: "@scope/web",
+    version: "2.0.0",
+  });
+
+  fs.mkdirSync(path.join(root, "open-sse"), { recursive: true });
+  writeJson(path.join(root, "open-sse", "package.json"), {
+    name: "@scope/open-sse",
+    version: "3.0.0",
+  });
+
+  const versions = collectWorkspaceVersions(root);
+  assert.equal(versions.get("@scope/a"), "1.0.0");
+  assert.equal(versions.get("@scope/web"), "2.0.0");
+  assert.equal(versions.get("@scope/open-sse"), "3.0.0");
+});
+
+test("prepublish Step 11 fixture resolves workspace: protocols in dist package.json files", () => {
+  const root = tmpDir("prepublish-step11-");
+  const distDir = path.join(root, "dist");
+
+  // Workspace member source files contain a workspace: specifier (simulating the
+  // monorepo source). They must NOT be mutated by the publish step.
+  fs.mkdirSync(path.join(root, "packages", "shared"), { recursive: true });
+  const sourcePkgPath = path.join(root, "packages", "shared", "package.json");
+  writeJson(sourcePkgPath, {
+    name: "@scope/shared",
+    version: "1.2.3",
+    dependencies: {
+      "@scope/other": "workspace:*",
+    },
+  });
+
+  fs.mkdirSync(path.join(root, "packages", "other"), { recursive: true });
+  writeJson(path.join(root, "packages", "other", "package.json"), {
+    name: "@scope/other",
+    version: "4.5.6",
+  });
+
+  writeJson(path.join(root, "package.json"), {
+    name: "root",
+    version: "0.0.0",
+    workspaces: ["packages/*"],
+  });
+
+  // The staged dist/ package.json contains workspace: specifiers that leaked
+  // into the publish artifact and must be rewritten to concrete versions.
+  fs.mkdirSync(distDir, { recursive: true });
+  const distPkgPath = path.join(distDir, "package.json");
+  writeJson(distPkgPath, {
+    name: "omniroute",
+    version: "3.8.51",
+    dependencies: {
+      "@scope/shared": "workspace:^",
+      "@scope/other": "workspace:*",
+      lodash: "^4.17.0",
+    },
+  });
+
+  // This is the same logic prepublish.ts Step 11 runs, scoped to the fixture.
+  const workspaceVersions = collectWorkspaceVersions(root);
+  const publishablePackageJsonPaths = findPackageJsonFiles(distDir).filter((filePath) =>
+    fs.existsSync(filePath)
+  );
+
+  for (const pkgJsonPath of publishablePackageJsonPaths) {
+    const pkg = readJson(pkgJsonPath);
+    if (!hasWorkspaceProtocol(pkg)) continue;
+    const resolved = resolvePackageJsonWorkspaceProtocols(pkg, workspaceVersions);
+    fs.writeFileSync(pkgJsonPath, JSON.stringify(resolved, null, 2) + "\n");
+  }
+
+  // dist/package.json must have concrete versions.
+  const distPkg = readJson(distPkgPath);
+  assert.equal((distPkg.dependencies as Record<string, string>)["@scope/shared"], "^1.2.3");
+  assert.equal((distPkg.dependencies as Record<string, string>)["@scope/other"], "4.5.6");
+  assert.equal((distPkg.dependencies as Record<string, string>).lodash, "^4.17.0");
+  assert.equal(hasWorkspaceProtocol(distPkg), false);
+
+  // Source package.json must remain untouched.
+  const sourcePkg = readJson(sourcePkgPath);
+  assert.equal((sourcePkg.dependencies as Record<string, string>)["@scope/other"], "workspace:*");
+});

tests/unit/chat-admission-rejection-reason.test.ts

@@ -0,0 +1,35 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  structuralRejectionResponse,
+} from "../../src/shared/middleware/chatAdmissionResponses.ts";
+
+// Pins the machine-readable error.reason contract of the chat admission
+// structural rejections (#TS2339 regression guard): buildErrorBody now owns
+// the reason field via ErrorBodyClassification, so the response bodies keep
+// carrying it without post-construction mutation of an untyped field.
+test("structuralRejectionResponse 413 carries reason=message_limit classification", () => {
+  const res = structuralRejectionResponse(413, 40);
+  assert.equal(res.status, 413);
+  assert.ok(!res.headers.has("Retry-After"), "413 is not retryable-by-header");
+  return res.text().then((raw) => {
+    const body = JSON.parse(raw);
+    assert.equal(body.error.reason, "message_limit");
+    assert.equal(body.error.type, "payload_too_large");
+    assert.equal(body.error.code, "chat_history_too_large");
+    assert.ok(!body.error.message.includes("at /"), "must not leak stack traces");
+  });
+});
+
+test("structuralRejectionResponse 503 carries reason=structure_limit and Retry-After", () => {
+  const res = structuralRejectionResponse(503, 40);
+  assert.equal(res.status, 503);
+  assert.equal(res.headers.get("Retry-After"), "1");
+  return res.text().then((raw) => {
+    const body = JSON.parse(raw);
+    assert.equal(body.error.reason, "structure_limit");
+    assert.equal(body.error.type, "server_error");
+    assert.equal(body.error.code, "chat_admission_busy");
+  });
+});

tests/unit/issue-11510-parallel-tool-thought-signature-openai.test.ts

@@ -0,0 +1,78 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { openaiToGeminiRequest } from "../../open-sse/translator/request/openai-to-gemini.ts";
+import {
+  storeGeminiThoughtSignature,
+  buildGeminiThoughtSignatureKey,
+} from "../../open-sse/services/geminiThoughtSignatureStore.ts";
+
+// Mirror of tests/unit/issue-11510-parallel-tool-thought-signature.test.ts for the
+// OpenAI-protocol → Gemini path (openai-to-gemini.ts). The same
+// shouldUseEmbeddedSignature/firstPersistedSignature gating dropped a resolved,
+// individually-valid thoughtSignature for every tool_calls[] entry after the
+// first one in a parallel (multi tool_calls) assistant turn, reproducing
+// Gemini 3.x's HTTP 400 "Function call is missing a thought_signature in
+// functionCall parts" (#11510).
+test("openai→gemini must attach EACH resolved thoughtSignature on a parallel (multi tool_calls) turn (#11510)", () => {
+  const ns = "conn-11510-openai-parallel";
+  const toolId1 = "call_11510_first";
+  const toolId2 = "call_11510_second_webfetch";
+  const sig1 = "SIG_11510_OPENAI_FIRST";
+  const sig2 = "SIG_11510_OPENAI_SECOND";
+
+  storeGeminiThoughtSignature(buildGeminiThoughtSignatureKey(ns, toolId1), sig1);
+  storeGeminiThoughtSignature(buildGeminiThoughtSignatureKey(ns, toolId2), sig2);
+
+  const result = openaiToGeminiRequest(
+    "gemini-3.5-flash",
+    {
+      messages: [
+        {
+          role: "assistant",
+          content: null,
+          tool_calls: [
+            {
+              id: toolId1,
+              type: "function",
+              function: { name: "default_api:Read", arguments: JSON.stringify({ path: "/a" }) },
+            },
+            {
+              id: toolId2,
+              type: "function",
+              function: {
+                name: "default_api:WebFetch",
+                arguments: JSON.stringify({ url: "https://example.com" }),
+              },
+            },
+          ],
+        },
+        { role: "tool", tool_call_id: toolId1, content: "file a" },
+        { role: "tool", tool_call_id: toolId2, content: "fetched" },
+      ],
+    },
+    false,
+    { _signatureNamespace: ns }
+  ) as { contents: Array<{ role: string; parts: Array<Record<string, unknown>> }> };
+
+  const modelTurn = result.contents.find(
+    (c) => c.role === "model" && c.parts?.some((p) => p.functionCall)
+  );
+  assert.ok(modelTurn, "expected a model turn with functionCall parts");
+
+  const fcParts = modelTurn!.parts.filter((p) => p.functionCall) as Array<{
+    thoughtSignature?: string;
+    functionCall: { name: string };
+  }>;
+  assert.equal(fcParts.length, 2, "both tool_calls entries must be emitted as native functionCall");
+
+  const webFetchPart = fcParts.find((p) => p.functionCall.name.includes("WebFetch"));
+  assert.ok(webFetchPart, "WebFetch functionCall part must be present");
+
+  assert.equal(
+    webFetchPart!.thoughtSignature,
+    sig2,
+    "second functionCall in a parallel tool_calls turn must keep its own resolved " +
+      "thoughtSignature, or Gemini 3.x rejects the request with HTTP 400 " +
+      "'Function call is missing a thought_signature in functionCall parts'"
+  );
+});

tests/unit/issue-11510-parallel-tool-thought-signature.test.ts

@@ -0,0 +1,85 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { claudeToGeminiRequest } from "../../open-sse/translator/request/claude-to-gemini.ts";
+import {
+  storeGeminiThoughtSignature,
+  buildGeminiThoughtSignatureKey,
+} from "../../open-sse/services/geminiThoughtSignatureStore.ts";
+
+// Repro for GitHub issue #11510: Claude Code (or any client) issuing a PARALLEL
+// tool-call turn (2+ tool_use blocks in one assistant message) against a Gemini
+// 3.x thinking model. Gemini attaches (and requires) an individual
+// thoughtSignature on EVERY functionCall part in a multi-call turn, and OmniRoute
+// stores one per tool_use id (gemini-to-claude.ts reads `part.thoughtSignature`
+// per-part, not just a single pending value). But claude-to-gemini.ts's
+// `shouldUseEmbeddedSignature` flag strips the signature from every functionCall
+// after the first one in the SAME assistant message, even when a real resolved
+// signature exists for it — reproducing Gemini's exact HTTP 400:
+// "Function call is missing a thought_signature in functionCall parts."
+test("claude→gemini must attach EACH resolved thoughtSignature on a parallel (multi tool_use) turn (#11510)", () => {
+  const ns = "conn-11510-parallel";
+  const toolId1 = "toolu_11510_first";
+  const toolId2 = "toolu_11510_second_webfetch";
+  const sig1 = "SIG_11510_FIRST";
+  const sig2 = "SIG_11510_SECOND";
+
+  // Simulate what gemini-to-claude.ts really stores today: a distinct,
+  // individually-valid signature per tool_use id, because Gemini attached one
+  // to each functionCall part of the original response turn.
+  storeGeminiThoughtSignature(buildGeminiThoughtSignatureKey(ns, toolId1), sig1);
+  storeGeminiThoughtSignature(buildGeminiThoughtSignatureKey(ns, toolId2), sig2);
+
+  const result = claudeToGeminiRequest(
+    "gemini-3.5-flash",
+    {
+      messages: [
+        {
+          role: "assistant",
+          content: [
+            { type: "tool_use", id: toolId1, name: "default_api:Read", input: { path: "/a" } },
+            {
+              type: "tool_use",
+              id: toolId2,
+              name: "default_api:WebFetch",
+              input: { url: "https://example.com" },
+            },
+          ],
+        },
+        {
+          role: "user",
+          content: [
+            { type: "tool_result", tool_use_id: toolId1, content: "file a" },
+            { type: "tool_result", tool_use_id: toolId2, content: "fetched" },
+          ],
+        },
+      ],
+    },
+    false,
+    { _signatureNamespace: ns }
+  ) as { contents: Array<{ role: string; parts: Array<Record<string, unknown>> }> };
+
+  const modelTurn = result.contents.find(
+    (c) => c.role === "model" && c.parts?.some((p) => p.functionCall)
+  );
+  assert.ok(modelTurn, "expected a model turn with functionCall parts");
+
+  const fcParts = modelTurn!.parts.filter((p) => p.functionCall) as Array<{
+    thoughtSignature?: string;
+    functionCall: { name: string };
+  }>;
+  assert.equal(fcParts.length, 2, "both tool_use blocks must be emitted as native functionCall");
+
+  const webFetchPart = fcParts.find((p) => p.functionCall.name.includes("WebFetch"));
+  assert.ok(webFetchPart, "WebFetch functionCall part must be present");
+
+  // THIS is the reported bug: the second tool_use in the turn has a real,
+  // resolved thoughtSignature (sig2) available, but the translator drops it
+  // because it is not the first functionCall in the message.
+  assert.equal(
+    webFetchPart!.thoughtSignature,
+    sig2,
+    "second functionCall in a parallel tool-call turn must keep its own resolved " +
+      "thoughtSignature, or Gemini 3.x rejects the request with HTTP 400 " +
+      "'Function call is missing a thought_signature in functionCall parts'"
+  );
+});

tests/unit/zai-web-attachment-mime-contract.test.ts

@@ -0,0 +1,20 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { resolveCursorImages } from "../../open-sse/utils/cursorImages.ts";
+
+// zai-web maps resolveCursorImages() output into browser-upload attachments
+// whose mimeType is REQUIRED. EncodedImage.mimeType is optional on the wire
+// type, so zai-web carries an `?? "image/jpeg"` fallback — this test pins the
+// producer contract that makes the fallback dead code in practice: every
+// image that reaches a browser upload must arrive with a concrete image/*
+// mime string (decodeDataUrl / fetchImageBytes validate it before pushing).
+const PIXEL_PNG =
+  "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==";
+
+test("resolveCursorImages (prepareForWire:false) always yields a concrete image/* mimeType", async () => {
+  const images = await resolveCursorImages([PIXEL_PNG], { prepareForWire: false });
+  assert.equal(images.length, 1);
+  assert.equal(typeof images[0]!.mimeType, "string");
+  assert.match(images[0]!.mimeType as string, /^image\//);
+});