@bitkyc08/opencodex 2.7.33 → 2.7.34

package/src/server/responses.ts

@@ -2,12 +2,13 @@ import type { Server } from "bun";
 import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type ResponsesTerminalStatus } from "../bridge";
 import {
   getConfigPath,
+  multiAgentGuidanceEnabled,
   resolveEnvValue,
 } from "../config";
 import { parseRequest } from "../responses/parser";
 import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractCompactUserMessages } from "../responses/compaction";
 import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../adapters/openai-responses";
-import { expandPreviousResponseInput, previousResponseConversationId, rememberResponseState } from "../responses/state";
+import { expandPreviousResponseInput, previousResponseProviderState, rememberResponseState } from "../responses/state";
 import { routeModel } from "../router";
 import {
   advanceComboAfterFailure,
@@ -26,7 +27,7 @@ import {
 import { isInjectionDebugEnabled } from "../lib/debug-settings";
 import { injectionDebugLog } from "../lib/injection-debug-log";
 import { modelInList, namespacedToolName } from "../types";
-import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../types";
+import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../types";
 import {
   forceRefreshOAuthAccessSnapshot,
   getOAuthCredentialApiBaseUrl,
@@ -58,6 +59,8 @@ import {
 import { fetchWithResetRetry, fetchWithTransientRetry, applyUpstreamRecoveryInit } from "../lib/upstream-retry";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../providers/openai-sidecar";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { slugsEquivalent } from "../providers/slug-codec";
 import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../providers/openai-virtual-models";
 import { isUsageDebugEnabled } from "../usage/debug";
 import { readJsonRequestBody, DecompressedBodyTooLargeError, UnsupportedContentEncodingError } from "./request-decompress";
@@ -91,6 +94,7 @@ import {
   relayWithAbort,
   sanitizePassthroughHeaders,
 } from "./relay";
+import { hasResponsesItemIdRepair, relaySseWithResponsesItemIdRepair } from "./responses-item-id-repair";
 
 export function buildToolBridgeMaps(parsed: OcxParsedRequest): {
   toolNsMap: Map<string, { namespace: string; name: string }>;
@@ -182,13 +186,9 @@ export function collabSurface(parsed: OcxParsedRequest): "v1" | "v2" | null {
  * model/effort overrides on a full-history fork (multi_agents_v2/spawn.rs
  * reject_full_fork_spawn_overrides), so the prompt mandates fork_turns "none" or a
  * partial fork plus a self-contained task message.
- * The published spawn_agent schema HIDES model/reasoning_effort by
- * default (hide_spawn_agent_metadata=true upstream — and it must STAY hidden: the
- * ChatGPT backend treats collaboration.spawn_agent as a reserved function and
- * rejects any request whose declared schema deviates, "Invalid Value: 'tools'").
- * That is prompt-workable: SpawnAgentArgs always parses model/reasoning_effort
- * regardless of the flag (spawn.rs), so the prompt tells the model to pass the
- * arguments even though the schema does not list them.
+ * Current Codex surfaces can expose model/reasoning_effort overrides directly or
+ * omit them. The proxy wording therefore stays schema-agnostic and advertises only
+ * the effective candidates described for this collaboration surface.
  *
  * The v2 body is budgeted to <= 700 chars (V2_GUIDANCE_CHAR_BUDGET): rules first,
  * then the preferred model, then the compact roster of configured `subagentModels`
@@ -197,7 +197,43 @@ export function collabSurface(parsed: OcxParsedRequest): "v1" | "v2" | null {
  * v2 body with {{model}}/{{effort}}/{{roster}} placeholder substitution (own length,
  * user-owned); firing gates are unchanged.
  */
-export async function multiAgentGuidanceText(parsed: OcxParsedRequest, injectionModel?: string, injectionEffort?: string, subagentModels?: string[], injectionPrompt?: string): Promise<string | null> {
+import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../codex/catalog";
+
+export interface MultiAgentGuidanceOptions {
+  multiAgentGuidanceEnabled?: boolean;
+  injectionModel?: string;
+  injectionEffort?: string;
+  subagentModels?: string[];
+  injectionPrompt?: string;
+}
+
+export interface MultiAgentGuidanceDeps {
+  resolveEffectiveSubagentRoster?: (
+    configuredModels: readonly string[],
+    surface: SpawnAgentSurface,
+  ) => EffectiveSubagentRoster | Promise<EffectiveSubagentRoster>;
+}
+
+async function resolveEffectiveSubagentRoster(
+  configuredModels: readonly string[],
+  surface: SpawnAgentSurface,
+): Promise<EffectiveSubagentRoster> {
+  const { effectiveSubagentRoster } = await import("../codex/catalog");
+  return effectiveSubagentRoster(configuredModels, surface);
+}
+
+export async function multiAgentGuidanceText(
+  parsed: OcxParsedRequest,
+  options: MultiAgentGuidanceOptions = {},
+  deps: MultiAgentGuidanceDeps = {},
+): Promise<string | null> {
+  if (options.multiAgentGuidanceEnabled === false) return null;
+  const {
+    injectionModel,
+    injectionEffort,
+    subagentModels,
+    injectionPrompt,
+  } = options;
   const surface = collabSurface(parsed);
   if (surface === null) return null;
 
@@ -205,17 +241,37 @@ export async function multiAgentGuidanceText(parsed: OcxParsedRequest, injection
     // codex-rs supplies the Proactive text on v2; the proxy only adds model-designation
     // guidance, and only when there is something concrete to designate: a configured
     // injectionModel and/or a roster entry that resolves in the injected catalog.
-    const roster = await subagentRosterText(subagentModels);
+    const configuredForGuidance = [
+      ...(subagentModels ?? []),
+      ...(injectionModel ? [injectionModel] : []),
+    ];
+    const resolveRoster = deps.resolveEffectiveSubagentRoster ?? resolveEffectiveSubagentRoster;
+    const effective = await resolveRoster(configuredForGuidance, "v2");
+    const rosterModels = effective.advertised.filter(candidate =>
+      (subagentModels ?? []).some(model => slugsEquivalent(model, candidate.model))
+    );
+    const roster = subagentRosterText(rosterModels);
+    const preferred = injectionModel
+      ? effective.candidates.find(candidate => slugsEquivalent(injectionModel, candidate.model))
+      : undefined;
+
+    if (isInjectionDebugEnabled() && effective.excluded.length > 0) {
+      injectionDebugLog(`[opencodex] multi-agent guidance excluded: ${effective.excluded
+        .map(item => `${item.configured}:${item.reason}`)
+        .join(", ")}`);
+    }
     if (!injectionModel && roster === "") return null;
     if (injectionPrompt) {
       return `<multi_agent_mode>${applyInjectionPlaceholders(injectionPrompt, injectionModel, injectionEffort, roster)}</multi_agent_mode>`;
     }
-    let text = "spawn_agent also accepts hidden \"model\" and \"reasoning_effort\" string arguments "
-      + "(not in the schema, but parsed and applied) — never claim sub-agent models cannot be selected. "
-      + "When setting either, set fork_turns to \"none\" (or e.g. \"3\"; full-history forks reject overrides) "
-      + "and make the message self-contained.";
-    if (injectionModel) {
-      text += ` Preferred sub-agent: model "${injectionModel}"`
+    if (!preferred && roster === "") return null;
+    let text = "When the active spawn_agent tool supports optional \"model\" or \"reasoning_effort\" overrides, "
+      + "use only models listed for this collaboration surface. "
+      + "When setting either override, set fork_turns to \"none\" "
+      + "(or a positive turn count such as \"3\"; full-history forks reject overrides) "
+      + "and make the task message self-contained.";
+    if (preferred) {
+      text += ` Preferred sub-agent: model "${preferred.model}"`
         + (injectionEffort ? `, reasoning_effort "${injectionEffort}"` : "")
         + " — use it unless the user names another.";
     }
@@ -246,25 +302,21 @@ function applyInjectionPlaceholders(prompt: string, model?: string, effort?: str
 }
 
 /**
- * Compact one-line roster of configured sub-agent models, or "" when no configured
- * model resolves to a catalog entry. Efforts come from the injected catalog
- * (catalogModelEfforts) so only rungs codex-rs will actually accept are advertised.
+ * Compact one-line roster of effective sub-agent candidates, or "" when empty.
+ * Efforts come from the injected catalog so only rungs codex-rs will actually
+ * accept are advertised.
  */
-async function subagentRosterText(subagentModels?: string[]): Promise<string> {
-  const featured = (subagentModels ?? []).filter(id => typeof id === "string" && id.trim().length > 0);
-  if (featured.length === 0) return "";
-  const { catalogModelEfforts } = await import("../codex/catalog");
-  const efforts = catalogModelEfforts(featured);
-  const resolved = featured.filter(id => efforts.has(id));
-  if (resolved.length === 0) return "";
-  const ladders = new Set(resolved.map(id => efforts.get(id)!.join("/")));
-  if (ladders.size === 1) {
-    // Shared ladder (the common case: the injected catalog advertises one rung set)
-    // -> state it once instead of per model, keeping the roster inside the budget.
-    const ids = resolved.map(id => `"${id}"`).join(", ");
-    return ` Available models (reasoning_effort ${[...ladders][0]}): ${ids}.`;
+function subagentRosterText(models: Array<{ model: string; efforts: string[] }>): string {
+  if (models.length === 0) return "";
+  const ladders = new Set(models.map(model => model.efforts.join("/")));
+  if (!ladders.has("") && ladders.size === 1) {
+    return ` Available models (reasoning_effort ${[...ladders][0]}): ${models
+      .map(model => `"${model.model}"`)
+      .join(", ")}.`;
   }
-  const entries = resolved.map(id => `"${id}" (${efforts.get(id)!.join("/")})`);
+  const entries = models.map(model => model.efforts.length > 0
+    ? `"${model.model}" (${model.efforts.join("/")})`
+    : `"${model.model}"`);
   return ` Available models (valid reasoning_effort): ${entries.join(", ")}.`;
 }
 
@@ -311,6 +363,57 @@ function looksLikeBackendCiphertext(payload: string): boolean {
  */
 const FERNET_TOKEN_RUN = /gAAAA[A-Za-z0-9_-]{60,}={0,2}/g;
 
+const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*NEW_TASK[^\n]*\nTask name\s*:[^\n]*\nSender\s*:[^\n]*\nPayload\s*:\s*(?:\n|$)/gi;
+const AGENT_MESSAGE_CONTROL_PREAMBLE = /(?:^|\n)\[CXC-(?:LEAF-GUARD|SKILL-AFFORDANCE)\][\s\S]*?(?=\n{2,}|$)/g;
+
+/**
+ * True when a V2 agent message contains a backend-minted Fernet task but no
+ * provider-readable task text. The routing envelope and hook-added control
+ * preambles are metadata, not actionable work. Inspect this before spawn-message
+ * sanitization splits mixed encrypted slots into plaintext and ciphertext parts.
+ */
+export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
+  if (!Array.isArray(input)) return false;
+
+  return input.some(item => {
+    if (!item || typeof item !== "object" || (item as { type?: unknown }).type !== "agent_message") {
+      return false;
+    }
+
+    const content = (item as { content?: unknown }).content;
+    if (!Array.isArray(content)) return false;
+
+    let hasFernetTask = false;
+    const readableParts: string[] = [];
+    for (const part of content) {
+      if (!part || typeof part !== "object") continue;
+      const record = part as { type?: unknown; text?: unknown; encrypted_content?: unknown };
+      if (
+        (record.type === "input_text" || record.type === "text" || record.type === "output_text")
+        && typeof record.text === "string"
+      ) {
+        readableParts.push(record.text);
+        continue;
+      }
+      if (record.type !== "encrypted_content" || typeof record.encrypted_content !== "string") {
+        continue;
+      }
+
+      const withoutFernet = record.encrypted_content.replace(FERNET_TOKEN_RUN, "\n\n");
+      if (withoutFernet !== record.encrypted_content) hasFernetTask = true;
+      readableParts.push(withoutFernet);
+    }
+
+    if (!hasFernetTask) return false;
+    const readableTask = readableParts
+      .join("\n\n")
+      .replace(AGENT_MESSAGE_ROUTING_ENVELOPE, "\n")
+      .replace(AGENT_MESSAGE_CONTROL_PREAMBLE, "\n")
+      .trim();
+    return readableTask.length === 0;
+  });
+}
+
 /**
  * Split a non-ciphertext encrypted slot into ordered parts: prose becomes input_text,
  * embedded Fernet blobs stay encrypted_content so the backend can still decrypt the
@@ -607,10 +710,14 @@ async function handleComboResponses(
   logCtx: RequestLogContext,
   options: HandleResponsesOptions,
 ): Promise<Response> {
+  const requestedModel = typeof (rawBody as { model?: unknown } | null)?.model === "string"
+    ? (rawBody as { model: string }).model
+    : `combo/${comboId}`;
   Object.assign(logCtx, {
-    requestedModel: `combo/${comboId}`,
-    model: `combo/${comboId}`,
+    requestedModel,
+    model: requestedModel,
     provider: "combo",
+    comboId,
   });
   const combo = getCombo(config, comboId);
   if (!combo) {
@@ -713,9 +820,10 @@ async function handleComboResponses(
       attemptRetained = true;
       noteComboSuccess(comboId, combo, pick.target);
       Object.assign(logCtx, childLog, {
-        requestedModel: `combo/${comboId}`,
-        model: `combo/${comboId}`,
+        requestedModel,
+        model: requestedModel,
         provider: "combo",
+        comboId,
         attempts: logCtx.attempts,
         activeAttempt: attempt,
         activeAttemptStartedAt: started,
@@ -763,9 +871,10 @@ async function handleComboResponses(
     lastFailure = failure.response;
     if (comboFailureDecision(response.status, failure.classificationText) === "stop") {
       Object.assign(logCtx, childLog, {
-        requestedModel: `combo/${comboId}`,
-        model: `combo/${comboId}`,
+        requestedModel,
+        model: requestedModel,
         provider: "combo",
+        comboId,
         attempts: logCtx.attempts,
         activeAttempt: undefined,
         activeAttemptStartedAt: undefined,
@@ -795,13 +904,16 @@ export async function handleResponses(
   } catch (err) {
     return decodeRequestErrorResponse(err, "responses");
   }
-  const comboId = !options.comboAttempt ? comboIdFromRawBody(body) : null;
+  const comboId = !options.comboAttempt ? comboIdFromRawBody(body, config) : null;
   if (comboId && Object.hasOwn(config.combos ?? {}, comboId)) {
     return handleComboResponses(req, body, comboId, config, logCtx, options);
   }
   const originalBody = body;
   body = expandPreviousResponseInput(body);
   const previousResponseInputExpanded = body !== originalBody;
+  const unreadableEncryptedAgentTask = hasUnreadableEncryptedAgentTask(
+    (body as { input?: unknown } | undefined)?.input,
+  );
 
   // Spawn-message compatibility (both directions): agent_message task payloads ride in
   // encrypted_content slots as plaintext. Rewrite them to input_text on the RAW body BEFORE
@@ -822,7 +934,8 @@ export async function handleResponses(
   try {
     parsed = parseRequest(body);
     if (previousResponseInputExpanded) parsed._previousResponseInputExpanded = true;
-    parsed._cursorConversationId = previousResponseConversationId(parsed.previousResponseId);
+    parsed._providerContinuation = previousResponseProviderState(parsed.previousResponseId);
+    parsed._cursorConversationId = parsed._providerContinuation?.cursor?.conversationId;
   } catch (err) {
     return formatErrorResponse(400, "invalid_request_error", err instanceof Error ? err.message : String(err));
   }
@@ -859,6 +972,17 @@ export async function handleResponses(
     return formatErrorResponse(404, "invalid_request_error", err instanceof Error ? err.message : String(err));
   }
 
+  // The canonical ChatGPT backend can decrypt its V2 Fernet task tokens; routed
+  // providers cannot. Reject the raw-input classification before adapter construction
+  // or provider dispatch so an unreadable worker task cannot trigger a cost storm.
+  if (!isCanonicalOpenAiForwardProvider(route.provider) && unreadableEncryptedAgentTask) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "Routed V2 worker task is encrypted for the native ChatGPT backend and cannot be read by the selected provider. Use plaintext V2 agent-message delivery or select a native ChatGPT model.",
+    );
+  }
+
   // Apply the routed model id upstream: routing may strip a "<provider>/" namespace
   // (e.g. "opencode-go/deepseek-v4-pro" → "deepseek-v4-pro"). Adapters read parsed.modelId,
   // and the passthrough adapter serializes _rawBody, so rewrite both.
@@ -888,17 +1012,23 @@ export async function handleResponses(
   }
 
   // Multi-agent guidance shim: codex-rs emits its Proactive delegation developer
-  // message only on the v2 surface. The proxy fills both gaps: the Proactive text
-  // for v1 collab surfaces at the top tier, and the sub-agent model designation on
-  // BOTH surfaces when an injectionModel is configured (v2 additionally gets the
-  // fork_turns override rules). The surface is judged from the request's own tool list.
-  // Runs BEFORE the mock-max clamp below so the synthetic top tier (ultra arrives
-  // as max on the codex wire) is still visible. Both request shapes are rewritten.
+  // message only on the v2 surface. The proxy fills the gaps: the Proactive text
+  // for v1 collab surfaces at the top tier (no model designation on v1), and the
+  // sub-agent model/roster designation plus fork_turns override rules on v2.
+  // The surface is judged from the request's own tool list. Runs BEFORE the
+  // mock-max clamp below so the synthetic top tier (ultra arrives as max on the
+  // codex wire) is still visible. Both request shapes are rewritten.
   {
-    const guidance = await multiAgentGuidanceText(parsed, config.injectionModel, config.injectionEffort, config.subagentModels, config.injectionPrompt);
+    const guidance = await multiAgentGuidanceText(parsed, {
+      multiAgentGuidanceEnabled: config.multiAgentGuidanceEnabled,
+      injectionModel: config.injectionModel,
+      injectionEffort: config.injectionEffort,
+      subagentModels: config.subagentModels,
+      injectionPrompt: config.injectionPrompt,
+    });
     if (guidance) {
       injectDeveloperMessage(parsed, guidance);
-      if (isInjectionDebugEnabled()) injectionDebugLog(`[opencodex] ${route.modelId}: multi-agent guidance injected (surface=${collabSurface(parsed)}, ${guidance.length} chars)`);
+      if (isInjectionDebugEnabled()) injectionDebugLog(`[opencodex] ${route.modelId}: multi-agent guidance injected (surface=${collabSurface(parsed)}, guidanceEnabled=${multiAgentGuidanceEnabled(config)}, ${guidance.length} chars)`);
     } else if (isInjectionDebugEnabled() && collabSurface(parsed) !== null) {
       injectionDebugLog(`[opencodex] ${route.modelId}: collab surface=${collabSurface(parsed)}, guidance silent (effort=${parsed.options.reasoning ?? "unset"}, injectionModel=${config.injectionModel ?? "unset"})`);
     }
@@ -935,16 +1065,17 @@ export async function handleResponses(
   // receive `max` when the user picks Ultra (codex converts ultra->max client-side).
   // Clamp to the model's highest real effort BEFORE any adapter — the ChatGPT
   // passthrough serializes _rawBody verbatim, so both shapes must be rewritten.
-  // GUARD: judge nativeness by the ORIGINALLY REQUESTED id (logCtx.requestedModel),
-  // never by route.modelId — routing strips the "<provider>/" namespace, so a routed
-  // model (anthropic/claude-opus-4-6, real max) would masquerade as an off-snapshot
-  // bare native and get wrongly clamped. Routed efforts belong to their adapters.
+  // GUARD: judge nativeness by BOTH the originally requested id (logCtx.requestedModel)
+  // and the resolved provider identity. Routing strips the "<provider>/" namespace, and
+  // some third-party providers expose bare `defaultModel` selectors, so route.modelId
+  // alone can make a routed model masquerade as an off-snapshot native. Only the
+  // canonical built-in ChatGPT forward provider should receive the native clamp.
   {
     const requestedModelId = logCtx.requestedModel ?? route.modelId;
-    const { nativeEffortClamp } = await import("../codex/catalog");
-    const clamped = requestedModelId.includes("/")
-      ? null
-      : nativeEffortClamp(route.modelId, parsed.options.reasoning);
+    const { nativeEffortClamp, shouldApplyNativeEffortClamp } = await import("../codex/catalog");
+    const clamped = shouldApplyNativeEffortClamp(route.providerName, route.provider, requestedModelId)
+      ? nativeEffortClamp(route.modelId, parsed.options.reasoning)
+      : null;
     if (clamped) {
       parsed.options.reasoning = clamped;
       const raw = parsed._rawBody as { reasoning?: { effort?: string } } | undefined;
@@ -999,7 +1130,7 @@ export async function handleResponses(
 
   // OAuth providers: swap in a fresh access token (auto-refreshed) as the Bearer key, so the
   // existing openai-chat / anthropic adapters authenticate with no change.
-  const isOAuth401ReplayProvider = (route.providerName === "xai" || route.providerName === "github-copilot")
+  const isOAuth401ReplayProvider = (route.providerName === "xai" || route.providerName === "github-copilot" || route.providerName === "kiro")
     && route.provider.authMode === "oauth";
   let sentOAuthSnapshot: OAuthAccessSnapshot | undefined;
   if (route.provider.authMode === "oauth") {
@@ -1036,6 +1167,14 @@ export async function handleResponses(
   sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, adapter.name);
   const isPassthrough = "passthrough" in adapter && !!adapter.passthrough;
 
+  if (adapter.name === "kiro" && parsed.previousResponseId && !parsed._previousResponseInputExpanded) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "Kiro continuation state is missing; start a new session instead of reusing this previous_response_id.",
+    );
+  }
+
   let openAiSidecar: ResolvedOpenAiForwardSidecar | undefined;
   const needsOpenAiVision = shouldResolveOpenAiVisionSidecar(config, route.provider, route.modelId, parsed);
   const needsOpenAiSearch = shouldResolveOpenAiWebSearchSidecar(config, parsed, isPassthrough);
@@ -1074,6 +1213,30 @@ export async function handleResponses(
 
   const recordTerminalOutcomes = options.recordTerminalOutcomes !== false;
 
+  const continuationStateForResponse = (
+    emitted?: OcxProviderContinuationState,
+  ): OcxProviderContinuationState | undefined => {
+    const cursorConversationId = parsed._cursorConversationId;
+    const inherited = parsed._providerContinuation;
+    if (!emitted && !inherited && !cursorConversationId) return undefined;
+    return {
+      ...(inherited ?? {}),
+      ...(emitted ?? {}),
+      ...((inherited?.kiro || emitted?.kiro)
+        ? { kiro: { ...(inherited?.kiro ?? {}), ...(emitted?.kiro ?? {}) } }
+        : {}),
+      ...(cursorConversationId
+        ? {
+            cursor: {
+              ...(inherited?.cursor ?? {}),
+              ...(emitted?.cursor ?? {}),
+              conversationId: cursorConversationId,
+            },
+          }
+        : {}),
+    };
+  };
+
   // Remote compaction v2 on a ROUTED model: Codex sent `compaction_trigger` and requires exactly
   // one `{type:"compaction"}` output item (codex-rs compact_remote_v2.rs). Passthrough handles it
   // natively upstream; here we run the routed model as a plain summarizer — no tools, no web-search
@@ -1215,6 +1378,7 @@ export async function handleResponses(
     // background for terminal-outcome/quota inspection only.
     if (upstreamResponse.ok && isEventStream && upstreamResponse.body) {
       const [nativeBody, inspectBody] = upstreamResponse.body.tee();
+      const repairConfig = route.provider.responsesItemIdRepair;
       const turnAc = new AbortController();
       linkAbortSignal(upstream, turnAc.signal);
       registerTurn(turnAc);
@@ -1251,9 +1415,12 @@ export async function handleResponses(
       // win32 must keep the pure native relay (Bun#32111 JS-sink segfault); elsewhere a JS pull
       // relay is established practice (relayWithAbort, relaySseWithHeartbeat) and lets a
       // mid-stream reset end with a clean response.failed terminal instead of a raw socket error.
-      const clientBody = process.platform === "win32"
+      const repairedBody = hasResponsesItemIdRepair(repairConfig)
+        ? relaySseWithResponsesItemIdRepair(nativeBody, repairConfig!)
+        : nativeBody;
+      const clientBody = process.platform === "win32" && !hasResponsesItemIdRepair(repairConfig)
         ? nativeBody
-        : relaySseWithFailedTail(nativeBody, upstream);
+        : relaySseWithFailedTail(repairedBody, upstream);
       return markNativePassthroughSseResponse(new Response(clientBody, {
         status: upstreamResponse.status,
         headers,
@@ -1335,7 +1502,15 @@ export async function handleResponses(
           hideThinkingSummary: parsed.options.hideThinkingSummary,
           ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
           ...(routedCompaction ? { compaction: true } : {}),
-          ...(routedCompaction ? {} : { onCompletedResponse: (response: Record<string, unknown>) => rememberResponseState(parsed._rawBody, response, parsed._cursorConversationId) }),
+          ...(routedCompaction ? {} : {
+            onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) =>
+              rememberResponseState(
+                parsed._rawBody,
+                response,
+                continuationStateForResponse(providerState),
+                adapter.name === "kiro" ? { force: true } : undefined,
+              ),
+          }),
         },
       );
       const bridgeTurnAc = new AbortController();
@@ -1356,14 +1531,23 @@ export async function handleResponses(
         return formatErrorResponse(502, "upstream_error", redactSecretString(message));
       }
     }
+    let providerState: OcxProviderContinuationState | undefined;
     const json = buildResponseJSON(events, parsed.modelId, {
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       toolNsMap,
       freeformToolNames,
       toolSearchToolNames,
       ...(routedCompaction ? { compaction: true } : {}),
+      onProviderState: state => { providerState = state; },
     });
-    if (!routedCompaction) rememberResponseState(parsed._rawBody, json, parsed._cursorConversationId);
+    if (!routedCompaction) {
+      rememberResponseState(
+        parsed._rawBody,
+        json,
+        continuationStateForResponse(providerState),
+        adapter.name === "kiro" ? { force: true } : undefined,
+      );
+    }
     return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } });
   }
 
@@ -1420,17 +1604,18 @@ export async function handleResponses(
   const upstream = new AbortController();
   const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal);
   const connectMs = config.connectTimeoutMs ?? 200_000;
+  let activeAdapter = adapter;
 
-  const request = await adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
+  const request = await activeAdapter.buildRequest(parsed, { headers: selectedForwardHeaders });
   const inputTokenEstimate = typeof request.usageLog?.inputTokens === "number"
     ? request.usageLog.inputTokens
     : undefined;
   if (inputTokenEstimate !== undefined) logCtx.usageLogInputTokens = inputTokenEstimate;
   let upstreamResponse: Response;
   try {
-    if (adapter.fetchResponse) {
+    if (activeAdapter.fetchResponse) {
       noteAttemptSend(logCtx.activeAttempt, inputTokenEstimate);
-      upstreamResponse = await adapter.fetchResponse(request, {
+      upstreamResponse = await activeAdapter.fetchResponse(request, {
         abortSignal: upstream.signal,
         timeoutMs: connectMs,
         stream: parsed.stream,
@@ -1464,7 +1649,6 @@ export async function handleResponses(
     // both paths so a 429→413 sequence never rebuilds against a stale pre-rotation
     // adapter, and imageTierBias — once armed — rides EVERY subsequent rebuild so a
     // 413→429 rotation cannot silently undo the tightening.
-    let activeAdapter = adapter;
     let imageTierBias = 0;
     let imageRetryAttempted = false;
     let oauth401ReplayAttempted = false;
@@ -1591,7 +1775,7 @@ export async function handleResponses(
   }
 
   if (parsed.stream) {
-    const eventStream = adapter.parseStream(upstreamResponse);
+    const eventStream = activeAdapter.parseStream(upstreamResponse);
     const { toolNsMap, freeformToolNames, toolSearchToolNames } = buildToolBridgeMaps(parsed);
     const sseStream = bridgeToResponsesSSE(
       eventStream, parsed.modelId, toolNsMap, freeformToolNames, toolSearchToolNames,
@@ -1605,7 +1789,15 @@ export async function handleResponses(
         // Compaction turns must NOT enter the continuation cache: _rawBody still holds the full
         // PRE-compaction history, and a later previous_response_id expansion would rehydrate the
         // giant stale chain Codex just replaced.
-        ...(routedCompaction ? {} : { onCompletedResponse: (response: Record<string, unknown>) => rememberResponseState(parsed._rawBody, response, parsed._cursorConversationId) }),
+        ...(routedCompaction ? {} : {
+          onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) =>
+            rememberResponseState(
+              parsed._rawBody,
+              response,
+              continuationStateForResponse(providerState),
+              activeAdapter.name === "kiro" ? { force: true } : undefined,
+            ),
+        }),
       },
     );
     const bridgeTurnAc = new AbortController();
@@ -1615,27 +1807,36 @@ export async function handleResponses(
     });
   }
 
-  if (adapter.parseResponse) {
+  if (activeAdapter.parseResponse) {
     let events: AdapterEvent[];
     try {
-      events = await adapter.parseResponse(upstreamResponse);
+      events = await activeAdapter.parseResponse(upstreamResponse);
     } finally {
       cleanupUpstreamAbort();
     }
     const { toolNsMap, freeformToolNames, toolSearchToolNames } = buildToolBridgeMaps(parsed);
+    let providerState: OcxProviderContinuationState | undefined;
     const json = buildResponseJSON(events, parsed.modelId, {
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       toolNsMap,
       freeformToolNames,
       toolSearchToolNames,
       ...(routedCompaction ? { compaction: true } : {}),
+      onProviderState: state => { providerState = state; },
     });
     // See the streaming branch: compaction turns skip the continuation cache.
-    if (!routedCompaction) rememberResponseState(parsed._rawBody, json, parsed._cursorConversationId);
+    if (!routedCompaction) {
+      rememberResponseState(
+        parsed._rawBody,
+        json,
+        continuationStateForResponse(providerState),
+        activeAdapter.name === "kiro" ? { force: true } : undefined,
+      );
+    }
     return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } });
   }
 
-  return formatErrorResponse(500, "internal_error", "Non-streaming not supported by this adapter");
+  return formatErrorResponse(400, "invalid_request_error", "Non-streaming not supported by this adapter");
 }
 
 export function linkAbortSignal(upstream: AbortController, signal?: AbortSignal): () => void {