diff --git a/src/adapters/zed.ts b/src/adapters/zed.ts
index 61f748d0449..5769417e809 100644
--- a/src/adapters/zed.ts
+++ b/src/adapters/zed.ts
@@ -53,7 +53,9 @@ function delegateProvider(provider: OcxProviderConfig, zedProvider: ZedProvider)
     return { ...common, adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", googleMode: "ai-studio" };
   }
   if (zedProvider === "open_ai") {
-    return { ...common, adapter: "openai-responses", baseUrl: "https://api.openai.com/v1" };
+    // The builder targets Zed's /completions envelope. Keep its destination set to Zed as well,
+    // so OpenAI-private Responses fields are stripped instead of being sent through to Zed.
+    return { ...common, adapter: "openai-responses", baseUrl: provider.baseUrl };
   }
   return { ...common, adapter: "openai-chat", baseUrl: "https://api.x.ai/v1" };
 }
@@ -300,6 +302,21 @@ export function createZedAdapter(provider: OcxProviderConfig): ProviderAdapter {
       }
     }
     if (!isRecord(providerRequest)) throw new Error("Zed delegate produced a non-object request body");
+    if (zedProvider === "open_ai" && Array.isArray(providerRequest.input)) {
+      // Zed's OpenAI Responses parser accepts user/assistant/system/tool roles but rejects
+      // OpenAI's newer developer role. System is the closest supported role for instructions.
+      providerRequest.input = providerRequest.input.map(item =>
+        isRecord(item) && item.type === "message" && item.role === "developer"
+          ? { ...item, role: "system" }
+          : item,
+      );
+    }
+    if (zedProvider === "open_ai" && Array.isArray(providerRequest.tools)) {
+      // Zed's Responses decoder supports function/custom tools, not Codex's built-in web_search.
+      providerRequest.tools = providerRequest.tools.filter(tool =>
+        isRecord(tool) && (tool.type === "function" || tool.type === "custom"),
+      );
+    }
     delegate = { provider: zedProvider, adapter: selected };
     const requestUrl = `${provider.baseUrl.replace(/\/+$/, "")}/completions`;
     return {
diff --git a/structure/providers-and-adapters.md b/structure/providers-and-adapters.md
index a8c63a4cdc2..00ade56965d 100644
--- a/structure/providers-and-adapters.md
+++ b/structure/providers-and-adapters.md
@@ -209,7 +209,7 @@ rewrite rules and the routed-id settlement.
 | `src/adapters/declaration-carrier.ts`, `src/adapters/input-media-guard.ts` | Default-deny allowlists for constraints the normalized request carries but a wire may not be able to express: `tools[*].allowed_callers`, which fences a tool off from callers, and inline document bytes. Both are refused with a 400 at the single guard every registered adapter passes through, rather than left to each adapter, because an adapter that never learned about the carrier rebuilds without it and answers normally. `allowed_callers` reaches the `anthropic` wire; document bytes reach `anthropic`, `openai-chat` and `google`; the `openai-responses` wire is exempt from the whole guard because it forwards the original body. Adding an `AdapterWire` member makes the omission visible in these lists instead of at a customer's upstream. The unrestricted `["direct"]` caller default is not a restriction. |
 | `src/adapters/azure.ts` | Azure OpenAI bridge; optional `minMaxOutputTokens` raises only smaller explicit positive integer output budgets. Unset preserves caller caps. Serialization and pre-admission spend estimates share `effectiveAzureOutputBudget`; see the [spend contract](transports/responses-spend.md#durable-spend-reservations). |
 | `src/adapters/cursor.ts`, `src/adapters/cursor/` | Cursor protobuf transport: discovery, request builder, event decoding, MCP, thread continuity, native-exec policy. |
-| `src/adapters/zed.ts`, `src/providers/zed.ts`, `src/oauth/zed.ts` | Zed Hosted AI native-app RSA login, account-scoped short-lived LLM-token exchange, bounded live model discovery, and provider-envelope translation through the existing Anthropic, Google, Responses, and Chat builders. Buffered delivery retains events under the shared translator budget and cancels delegated streams on early exit. Experimental and unofficial; the Zed terms risk is intentionally surfaced in user docs and release review. |
+| `src/adapters/zed.ts`, `src/providers/zed.ts`, `src/oauth/zed.ts` | Zed Hosted AI native-app RSA login, account-scoped short-lived LLM-token exchange, bounded live model discovery, and provider-envelope translation through the existing Anthropic, Google, Responses, and Chat builders. Buffered delivery retains events under the shared translator budget and cancels delegated streams on early exit. The Responses delegate applies destination compatibility, strips OpenAI-private fields and unsupported built-in tools, and maps OpenAI `developer` messages to Zed-supported `system` messages before wrapping the request. Experimental and unofficial; the Zed terms risk is intentionally surfaced in user docs and release review. |
 | `src/adapters/devin.ts`, `src/adapters/devin/cloud-direct/` | Devin runTurn transport over Cognition Connect-RPC. Assistant reasoning replays as ChatMessagePrompt #11 thinking, #12 signature and #18 signature type (`src/adapters/devin/reasoning-signature.ts`): the #10/#21 pair arrives after the visible answer and becomes its own signature-only reasoning item, so a single unsigned thinking block plus exactly one signature-only block is replayed as one signed prompt, and a signature-only turn (GPT, Gemini) is replayed rather than dropped. An Anthropic signature is replayed, but because the streamed thinking is a summary the signature may not cover, a turn Cognition refuses with `invalid_argument` before any visible output (reasoning alone does not count) is retried once with Anthropic signatures withheld and the thinking text kept. `GetChatMessage` uses the Responses provider executor and shared physical-send budget; catalog, JWT, and `src/web-search/devin-executor.ts` native search support RPCs remain outside inference-send accounting. Provider-stated pre-output 429 reset delays are surfaced immediately by default, releasing shared active-turn capacity. A positive `OPENCODEX_DEVIN_STATED_RESET_WAIT_MS` explicitly enables bounded waiting and up to two replays on standalone turns, which hold that capacity until completion or cancellation. Combo children bypass that wait and surface a pre-output 429 so the next target can run. During an opted-in standalone wait, safe heartbeats commit the response preflight and keep the stream's stall watchdog fed. Invalid values fail closed to the immediate-refusal behavior. A recorded tenant host is used only for the stored account whose credential owns the transmitted key, searched in the configured provider id and then its deprecated alias; a configured, forwarded, or unmatched key uses the configured base URL or the US default. Native search previews the current route by effective adapter without mutating combo selection state, pins one admitted active-account snapshot for the request, and calls `GetWebSearchResults`, so it starts no CLI or second model. The wire model UID comes from the catalog's family metadata (`ClientModelConfig` #23/#30/#31): a family id with no effort anchors on the family's default member and selects the nearest enabled rung, rounding up first; an effort moves only the effort axis, to the lowest rung at or above it (else the highest below) while Fast Mode, 1M Context and the other axes stay at the anchor's values unless the caller asked for `fast` or a `1m` value; not lowering a requested effort outranks keeping those axes (an unranked member counts as lower), a disabled row the caller named is kept when the request still selects it so the preflight names that refusal, and resolution never leaves the family. Rows without family metadata fall back to suffix resolution, whose variant scan matches the collapsed base rather than a string prefix. With no caller or configured output cap, the selected row's catalog `maxOutputTokens` fills CompletionConfiguration #2; #3 is `max_newlines` and is sent at a fixed value, never a context window. The leading system text is sent as `GetChatMessage` #2, a failed tool result sets ChatMessagePrompt #9 and keeps an in-band `ERROR:` marker, and Gemini uids have JSON-Schema type arrays expressed as type-only `anyOf` branches in tool parameters. Shared constraints remain on the surrounding node, so nested schemas have one wire representation while outer enum/const, boolean constraints (including `not`, `oneOf`, and `allOf`) on null, and existing null-branch restrictions retain their conjunctive meaning. A null-only type keeps its null constraint even when an outer enum/const excludes null, preserving an unsatisfiable schema without producing an empty anyOf. Schema resource identifiers, anchors, definition maps, and existing anyOf branches remain on their original node. The type constraint is appended to existing allOf entries without shifting their indices, so JSON Pointer targets and reference scopes remain unchanged. A pre-output `invalid_argument` on a history whose word-piece estimate, using the sanitized and truncated tool descriptions actually sent on the wire, reaches 95% of the selected UID's catalog input window, capped by configured provider and model limits (512 KiB of text only when no window is known) is surfaced as `context_length_exceeded` so Codex compacts; a small request with the same code stays a plain 400. Known limit: a malformed schema on a history already at or above that 95% threshold is also reported as overflow because the upstream returns the same `invalid_argument`. The `COGNITION_BLOCKLIST_REWRITES` sanitizer rewrites exact phrases Cognition refuses with `permission_denied`; it runs only on instruction surfaces — tool descriptions and the #2 system prompt — while message text, replayed thinking (#11), and tool-call arguments stay byte-exact, because a rewrite there would silently change literal content such as patches or quoted file bytes; a trigger inside a data field surfaces as the upstream `permission_denied` instead (the Codex `<permissions instructions>` escalation boilerplate is the recorded #2 case). |
 | `src/adapters/kiro.ts` and `src/adapters/kiro/` | Kiro event/tool/thinking/truncation/retry handling, including an egress-aware completion fallback, fixed public HTTP 5xx text, and closed-set status/code diagnostics. The original path is a facade over leaves for wire identity, reasoning, conversation state, token estimation, payload assembly, streaming, and the adapter. |
 | `src/adapters/mimo-free.ts` | Mimo Free transport (client identity + JWT). Concurrent requests share one JWT bootstrap bound only to its timeout; each request stops waiting on its own abort without cancelling the others. |
diff --git a/tests/providers/zed-hosted-provider.test.ts b/tests/providers/zed-hosted-provider.test.ts
index f7178289175..ce081c5cee8 100644
--- a/tests/providers/zed-hosted-provider.test.ts
+++ b/tests/providers/zed-hosted-provider.test.ts
@@ -269,7 +269,7 @@ describe("Zed Hosted AI provider", () => {
       content: [{ type: "text", text: "hello zed" }],
     });
   });
-  test("normalizes OpenAI string input to sequence blocks with input_text for Zed backend", async () => {
+  test("normalizes OpenAI input and removes Codex-only fields for Zed backend", async () => {
     const responses = [
       jsonResponse({ default_organization_id: "org-1" }),
       jsonResponse({ token: "llm-token-1" }),
@@ -287,18 +287,43 @@ describe("Zed Hosted AI provider", () => {
       authMode: "oauth",
       apiKey: "access-token",
     };
-    const parsed = parseRequest({ model: "gpt-6.1-sol", input: "hello zed openai", stream: true });
+    const parsed = parseRequest({
+      model: "gpt-6.1-sol",
+      input: [
+        { type: "message", role: "developer", content: [{ type: "input_text", text: "Follow the user request." }] },
+        { type: "message", role: "user", content: [{ type: "input_text", text: "hello zed openai" }] },
+      ],
+      stream: true,
+      access_programs: { cyber: ["standard"] },
+      tools: [
+        { type: "web_search", search_context_size: "medium" },
+        { type: "function", name: "synthetic_tool", parameters: { type: "object", properties: {} } },
+      ],
+    });
     parsed._zedAuthContext = { userId: "user-1" };
     const adapter = withTestTranslatorBudget(createZedAdapter(provider));
     const request = await adapter.buildRequest(parsed);
-    const body = JSON.parse(request.body) as { provider: string; provider_request: { input: Array<{ type: string; role: string; content: unknown }> } };
+    const body = JSON.parse(request.body) as {
+      provider: string;
+      provider_request: {
+        input: Array<{ type: string; role: string; content: unknown }>;
+        tools: Array<{ type: string }>;
+      };
+    };
 
     expect(body.provider).toBe("open_ai");
     expect(body.provider_request.input[0]).toEqual({
+      type: "message",
+      role: "system",
+      content: [{ type: "input_text", text: "Follow the user request." }],
+    });
+    expect(body.provider_request.input[1]).toEqual({
       type: "message",
       role: "user",
       content: [{ type: "input_text", text: "hello zed openai" }],
     });
+    expect(body.provider_request).not.toHaveProperty("access_programs");
+    expect(body.provider_request.tools).toEqual([{ type: "function", name: "synthetic_tool", parameters: { type: "object", properties: {} } }]);
   });
 });