Clawpatch finding
- Severity: medium
- Category: api-contract
- Confidence: high
- Finding ID(s):
fnd_sig-feat-custom-apis-openai-tool_7ba6baa2ce
- Run ID(s):
20260907T072309-c9f4e4
- Reviewed commit:
3cfddbcbf4d6adcab02d8257bbdb272981c433c7
- Prior-run overlap: No prior-run overlap found.
Evidence
apis/src/openai/responses/agentic_loop/mod.rs:481-506 (collect_output_items) — A function_call is collected only when status is exactly "completed"; missing status falls through without entering tool_calls or messages.apis/src/openai/responses/agentic_loop/tests.rs:1184-1218 (ignores_non_completed_function_calls) — Coverage exercises status "in_progress" but not an omitted status.
Description
The Responses schemas require type, call_id, name, and arguments for a function call, while status is optional. A conforming backend may therefore omit status. The loop then leaves state.tool_calls empty, signals done, and returns the encoded function call instead of dispatching it or re-entering inference. Explicit in_progress and incomplete calls should remain non-dispatchable, but absence should be treated as a completed non-streaming output or otherwise handled according to the response-level completion state.
Reproduction
Return a non-streaming backend response with object:"response", status:"completed", and output:[{"type":"function_call","call_id":"c1","name":"weather__get_weather","arguments":"{}"}] without an item status. Observe openai_agentic_loop.action="done" and zero MCP tools/call requests.
Recommendation
For a successfully completed non-streaming response, accept function_call items whose status is absent or "completed"; continue rejecting or ignoring explicit "in_progress" and "incomplete" values.
Generated by the scheduled Clawpatch Codex gpt-5.6-sol / xhigh review of apis/src. Validate before assigning or implementing.
Clawpatch finding
fnd_sig-feat-custom-apis-openai-tool_7ba6baa2ce20260907T072309-c9f4e43cfddbcbf4d6adcab02d8257bbdb272981c433c7Evidence
apis/src/openai/responses/agentic_loop/mod.rs:481-506(collect_output_items) — A function_call is collected only when status is exactly "completed"; missing status falls through without entering tool_calls or messages.apis/src/openai/responses/agentic_loop/tests.rs:1184-1218(ignores_non_completed_function_calls) — Coverage exercises status "in_progress" but not an omitted status.Description
The Responses schemas require type, call_id, name, and arguments for a function call, while status is optional. A conforming backend may therefore omit status. The loop then leaves state.tool_calls empty, signals done, and returns the encoded function call instead of dispatching it or re-entering inference. Explicit in_progress and incomplete calls should remain non-dispatchable, but absence should be treated as a completed non-streaming output or otherwise handled according to the response-level completion state.
Reproduction
Return a non-streaming backend response with object:"response", status:"completed", and output:[{"type":"function_call","call_id":"c1","name":"weather__get_weather","arguments":"{}"}] without an item status. Observe openai_agentic_loop.action="done" and zero MCP tools/call requests.
Recommendation
For a successfully completed non-streaming response, accept function_call items whose status is absent or "completed"; continue rejecting or ignoring explicit "in_progress" and "incomplete" values.
Generated by the scheduled Clawpatch Codex
gpt-5.6-sol/xhighreview ofapis/src. Validate before assigning or implementing.