fix(claude): decloak tool names in same-format streaming passthrough

translateResponse() short-circuited untouched on claude->claude streaming,
so OAuth-cloaked tool names (CLAUDE_TOOL_SUFFIX) leaked to the client and
every tool call was rejected as unknown. Add decloakStreamChunk(), the
streaming counterpart of decloakToolNames(), and call it on the same-format
path using the already-plumbed state.toolNameMap.

tests/translator/claude-claude-stream-decloak.test.js

@@ -0,0 +1,49 @@
+// Regression test: claude → claude streaming passthrough must still decloak
+// tool names. translateRequest() cloaks client tool names with CLAUDE_TOOL_SUFFIX
+// for OAuth-cloaked Claude providers (cloakToolsOnOAuth) even when source and
+// target formats match; the same-format fast path in translateResponse() used
+// to return chunks untouched, leaking the suffixed name (e.g. "run_code_ide")
+// to the client, which then rejected the call as an unknown tool.
+import { describe, it, expect } from "vitest";
+import "./registerAll.js";
+import { translateResponse } from "../../open-sse/translator/index.js";
+import { FORMATS } from "../../open-sse/translator/formats.js";
+import { CLAUDE_TOOL_SUFFIX } from "../../open-sse/config/appConstants.js";
+
+const CLOAKED = "run_code" + CLAUDE_TOOL_SUFFIX;
+
+const toolUseStart = (name) => ({
+  type: "content_block_start",
+  index: 1,
+  content_block: { type: "tool_use", id: "toolu_01XYZ", name, input: {} }
+});
+
+describe("Claude → Claude streaming passthrough (OAuth tool cloak)", () => {
+  const state = { toolNameMap: new Map([[CLOAKED, "run_code"]]) };
+
+  it("restores the original tool name on tool_use content_block_start", () => {
+    const [out] = translateResponse(FORMATS.CLAUDE, FORMATS.CLAUDE, toolUseStart(CLOAKED), state);
+    expect(out.content_block.name).toBe("run_code");
+  });
+
+  it("leaves uncloaked chunks untouched (identity passthrough)", () => {
+    const chunk = toolUseStart("Bash"); // decoy name, not in the map
+    const [out] = translateResponse(FORMATS.CLAUDE, FORMATS.CLAUDE, chunk, state);
+    expect(out).toBe(chunk);
+
+    const textChunk = { type: "content_block_delta", index: 0, delta: { type: "text_delta", text: "hi" } };
+    const [outText] = translateResponse(FORMATS.CLAUDE, FORMATS.CLAUDE, textChunk, state);
+    expect(outText).toBe(textChunk);
+  });
+
+  it("is a no-op when no cloak map is present", () => {
+    const chunk = toolUseStart(CLOAKED);
+    const [out] = translateResponse(FORMATS.CLAUDE, FORMATS.CLAUDE, chunk, {});
+    expect(out).toBe(chunk);
+  });
+
+  it("tolerates the null flush chunk", () => {
+    const [out] = translateResponse(FORMATS.CLAUDE, FORMATS.CLAUDE, null, state);
+    expect(out).toBeNull();
+  });
+});

tests/unit/claude-cloaking.test.js

@@ -3,10 +3,11 @@
  *
  * Tests cover:
  *  - cloakClaudeTools() - tool renaming and forced tool_choice suffixing
+ *  - decloakStreamChunk() - restoring tool names in streamed Claude SSE events
  */
 
 import { describe, it, expect } from "vitest";
-import { cloakClaudeTools } from "../../open-sse/utils/claudeCloaking.js";
+import { cloakClaudeTools, decloakStreamChunk } from "../../open-sse/utils/claudeCloaking.js";
 import { CLAUDE_TOOL_SUFFIX } from "../../open-sse/config/appConstants.js";
 
 describe("cloakClaudeTools", () => {
@@ -74,3 +75,44 @@ describe("cloakClaudeTools", () => {
     expect(toolNameMap).toBeNull();
   });
 });
+
+describe("decloakStreamChunk", () => {
+  // Cloaked exactly as cloakClaudeTools() does on the request side
+  const toolNameMap = new Map([["run_code" + CLAUDE_TOOL_SUFFIX, "run_code"]]);
+
+  const toolUseStart = (name) => ({
+    type: "content_block_start",
+    index: 1,
+    content_block: { type: "tool_use", id: "toolu_01abc", name, input: {} }
+  });
+
+  it("restores the original name on a tool_use content_block_start", () => {
+    const out = decloakStreamChunk(toolUseStart("run_code" + CLAUDE_TOOL_SUFFIX), toolNameMap);
+    expect(out.content_block.name).toBe("run_code");
+  });
+
+  it("does not mutate the input chunk", () => {
+    const chunk = toolUseStart("run_code" + CLAUDE_TOOL_SUFFIX);
+    decloakStreamChunk(chunk, toolNameMap);
+    expect(chunk.content_block.name).toBe("run_code" + CLAUDE_TOOL_SUFFIX);
+  });
+
+  it("passes through names the map does not know (e.g. decoy tools)", () => {
+    const chunk = toolUseStart("Bash");
+    expect(decloakStreamChunk(chunk, toolNameMap)).toBe(chunk);
+  });
+
+  it("passes through non-tool_use events unchanged", () => {
+    const textStart = { type: "content_block_start", index: 0, content_block: { type: "text", text: "" } };
+    expect(decloakStreamChunk(textStart, toolNameMap)).toBe(textStart);
+
+    const delta = { type: "content_block_delta", index: 1, delta: { type: "input_json_delta", partial_json: "{}" } };
+    expect(decloakStreamChunk(delta, toolNameMap)).toBe(delta);
+  });
+
+  it("tolerates null chunks and missing maps (stream flush path)", () => {
+    expect(decloakStreamChunk(null, toolNameMap)).toBeNull();
+    expect(decloakStreamChunk(toolUseStart("run_code" + CLAUDE_TOOL_SUFFIX), null).content_block.name).toBe("run_code" + CLAUDE_TOOL_SUFFIX);
+    expect(decloakStreamChunk(toolUseStart("run_code" + CLAUDE_TOOL_SUFFIX), new Map()).content_block.name).toBe("run_code" + CLAUDE_TOOL_SUFFIX);
+  });
+});