fix(ai): reject unfinished Responses tool calls instead of running them

The agent runs every tool call in the final assistant message, including
calls whose output_item.done never arrived. Those can carry cut-off or
mixed-up arguments. With llama.cpp, which omits output_index, two parallel
calls became three (echo a, echo a, echo b), two of them with the same id.

processResponsesStream now fails the stream when a completed response
still has an unfinished tool call.

fixes #9974

packages/ai/CHANGELOG.md

@@ -29,6 +29,7 @@
 - Fixed OpenAI Fast mode requests being priced at the standard rate when the response reports `service_tier: "fast"`, as GPT-6 models do ([#10034](https://github.com/earendil-works/pi/issues/10034)).
 - Fixed Mistral reasoning models ignoring the requested thinking level: GLM 5.3 now uses `reasoning_effort` instead of `prompt_mode`, GLM 5.2 accepts `max`, and Mistral models only offer the effort levels the API supports ([#9678](https://github.com/earendil-works/pi/issues/9678)).
 - Fixed OpenCode Zen and OpenCode Go `qwen3.8-flash` thinking being replayed as plain text on later turns because the endpoint returns empty thinking signatures ([#10047](https://github.com/earendil-works/pi/issues/10047)).
+- Fixed OpenAI Responses streams returning unfinished tool calls as runnable, which made servers that omit `output_index` (such as llama.cpp) run mixed-up commands; such streams now end with an error ([#9974](https://github.com/earendil-works/pi/issues/9974)).
 
 ## [0.87.1] - 2026-09-22
 

packages/ai/src/api/openai-responses-shared.ts

@@ -761,6 +761,20 @@ export async function processResponsesStream<TApi extends Api>(
 	if (!sawTerminalResponseEvent) {
 		throw new Error("OpenAI Responses stream ended before a terminal response event");
 	}
+	// The agent runs every tool call in the final message. Refuse to hand over calls whose
+	// output_item.done never arrived: their arguments may be cut off or mixed up, e.g. when a
+	// non-compliant server omits output_index. Finished calls have their scratch buffers removed.
+	if (output.stopReason === "toolUse") {
+		for (const block of output.content) {
+			if (block.type !== "toolCall") continue;
+			const toolCall = block as StreamingToolCall;
+			if (toolCall.partialJson !== undefined || toolCall.customInput !== undefined) {
+				throw new Error(
+					`OpenAI Responses stream completed with an unfinished tool call: ${toolCall.name} (${toolCall.id})`,
+				);
+			}
+		}
+	}
 }
 
 function mapStopReason(

packages/ai/test/openai-responses-terminal-event.test.ts

@@ -204,6 +204,42 @@ async function* createPhasedMessageEvents(
 	} as ResponseStreamEvent;
 }
 
+async function* createUnfinishedToolCallEvents(): AsyncIterable<ResponseStreamEvent> {
+	yield {
+		type: "response.output_item.added",
+		sequence_number: 0,
+		output_index: 0,
+		item: { type: "function_call", id: "fc_1", call_id: "call_1", name: "bash", arguments: "" },
+	} as ResponseStreamEvent;
+	yield {
+		type: "response.function_call_arguments.delta",
+		sequence_number: 1,
+		output_index: 0,
+		item_id: "fc_1",
+		delta: '{"command":"rm -rf /tmp/build',
+	} as ResponseStreamEvent;
+	yield {
+		type: "response.completed",
+		sequence_number: 2,
+		response: { id: "resp_unfinished", status: "completed" },
+	} as ResponseStreamEvent;
+}
+
+// llama.cpp omits output_index from every event and sends both done events after all deltas.
+async function* createToolCallsWithoutOutputIndexEvents(): AsyncIterable<ResponseStreamEvent> {
+	const call = (n: string) => ({ type: "function_call", id: `fc_${n}`, call_id: `call_${n}`, name: "bash" });
+	const events = [
+		{ type: "response.output_item.added", item: { ...call("a"), arguments: "" } },
+		{ type: "response.function_call_arguments.delta", item_id: "fc_a", delta: '{"command":"echo a"}' },
+		{ type: "response.output_item.added", item: { ...call("b"), arguments: "" } },
+		{ type: "response.function_call_arguments.delta", item_id: "fc_b", delta: '{"command":"echo b"}' },
+		{ type: "response.output_item.done", item: { ...call("a"), arguments: '{"command":"echo a"}' } },
+		{ type: "response.output_item.done", item: { ...call("b"), arguments: '{"command":"echo b"}' } },
+		{ type: "response.completed", response: { id: "resp_no_output_index", status: "completed" } },
+	];
+	for (const event of events) yield event as unknown as ResponseStreamEvent;
+}
+
 describe("OpenAI Responses terminal event handling", () => {
 	it("rejects streams that end before a terminal response event", async () => {
 		const model = createModel();
@@ -215,6 +251,33 @@ describe("OpenAI Responses terminal event handling", () => {
 		);
 	});
 
+	it("rejects completed streams whose tool call never received output_item.done", async () => {
+		const model = createModel();
+
+		await expect(
+			processResponsesStream(
+				createUnfinishedToolCallEvents(),
+				createOutput(model),
+				new AssistantMessageEventStream(),
+				model,
+			),
+		).rejects.toThrow("OpenAI Responses stream completed with an unfinished tool call: bash (call_1|fc_1)");
+	});
+
+	// https://github.com/earendil-works/pi/issues/9974
+	it("rejects parallel tool calls without output_index instead of running mixed-up calls", async () => {
+		const model = createModel();
+
+		await expect(
+			processResponsesStream(
+				createToolCallsWithoutOutputIndexEvents(),
+				createOutput(model),
+				new AssistantMessageEventStream(),
+				model,
+			),
+		).rejects.toThrow("OpenAI Responses stream completed with an unfinished tool call: bash (call_a|fc_a)");
+	});
+
 	it("forwards parsed provider stream events in order", async () => {
 		const model = createModel();
 		const context = normalizeContext({