@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/server/responses/request-prepare.ts

@@ -1,4 +1,8 @@
-import type { ResponsesRequestContext, ResponsesAdmissionState, ResponsesDispatchers } from "./core-options";
+import type { HandleResponsesOptions, ResponsesRequestContext, ResponsesAdmissionState, ResponsesDispatchers } from "./core-options";
+import type { PolicyRequestEvidence } from "../../routing/evaluator";
+import type { RequestLogContext } from "../request-log";
+import { markProtocolEntry, protocolMarkFeatures } from "../../protocols/trace";
+import { isAntigravityRoute } from "../antigravity-direct-eligibility";
 import { capturePolicyRequestRoute, assertPolicyNormalizedRoute, recordPolicyPreparedDestination, policyCandidateRefusalResponse } from "./policy-request-scope";
 import {
   agentTaskRecoveryConfig,
@@ -13,7 +17,7 @@ import {
   unreadableEncryptedAgentTaskResponse,
 } from "./core-errors";
 import { parseSyntheticRowId } from "../fast-row";
-import { resolveComboId, comboIdFromRawBody, NoAvailableComboTargetsError } from "../../combos";
+import { resolveComboId, comboIdFromRawBody, comboExclusionReasons, NoAvailableComboTargetsError, pickComboTarget } from "../../combos";
 import { INTERCEPT_TARGET_UNAVAILABLE_CODE, interceptTargetUnavailableResponse, resolveChosenTarget, resolveShadowCallTarget } from "./shadow-target-availability";
 import {
   MEMORY_MODEL_TARGET_UNAVAILABLE_CODE,
@@ -80,6 +84,7 @@ import {
 } from "../../router";
 import { evidenceFromBody } from "../../routing/request-evidence";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { resolveNativeReasoningRetention } from "../../config/schema/native-reasoning-retention";
 import { isThreadSpawnRequest } from "../effort-policy";
 import {
   resolveSubagentFallbackChain,
@@ -129,6 +134,7 @@ import {
 } from "../../codex/loopback-target";
 import { checkComboTargetInputAdmission, checkInputAdmission } from "./input-admission";
 import {
+  admissionMayUseMeteredComboTargets,
   admissionModelDeniedResponse,
   AdmissionModelDeniedError,
   assertRouteAllowedByScope,
@@ -136,6 +142,13 @@ import {
   routeAllowedByScope,
 } from "../admission-model-scope";
 import { nativeContextLimits } from "../../codex/catalog";
+import type { ClientToolCatalogRestriction } from "../../lib/empty-tool-catalog";
+import {
+  currentTurnWireToolCatalogBody,
+  hasExplicitEmptyToolCatalog,
+  collectDeclaredWireToolNames,
+  collectDeclaredBareCustomWireToolNames,
+} from "../responses-undeclared-tool-guard";
 import { streamingContextOverflowResponse } from "./context-overflow";
 import {
   preAuthUpstreamHostCircuitKey,
@@ -145,6 +158,7 @@ import {
 } from "./core-codex-account";
 import { acquireUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { applyCompactionRoutingOverride, compactionRoutingKeepsProviderIdentity } from "./compaction-routing";
+import { applyMainHardLockFallbackOverride } from "./main-hard-lock-routing";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import {
   conversationStateBindingFromAuth,
@@ -155,6 +169,48 @@ import {
 
 import { redactHostedImageDisplayPaths } from "../responses-hosted-image-display";
 
+/** Policy-routing evidence. The direct lane's settings-only body has no conversation to scan. */
+function routeEvidence(options: Pick<HandleResponsesOptions, "directRequest">, parsed: OcxParsedRequest): PolicyRequestEvidence {
+  return options.directRequest?.evidence ?? evidenceFromBody(parsed._rawBody);
+}
+
+/**
+ * Leave the Antigravity direct lane for this request: put the bridge conversation back on the
+ * Responses body so every `_rawBody` reader sees what the bridge would have sent, and trace the
+ * request as the bridge. The IR conversation already decoded stays: it equals what
+ * `parseRequest` builds from the restored body (`tests/protocols/chat-ir-parity.test.ts`).
+ */
+function restoreDirectRequestConversation(options: HandleResponsesOptions, body: unknown, logCtx: RequestLogContext): void {
+  const direct = options.directRequest;
+  if (!direct) return;
+  options.directRequest = undefined;
+  if (body && typeof body === "object" && !Array.isArray(body)) Object.assign(body, direct.bridgeConversation());
+  if (options.clientEncoder) options.clientEncoder = { ...options.clientEncoder, requestLane: "bridge" };
+  markProtocolEntry(logCtx, {
+    inbound: direct.protocol,
+    lane: "bridge",
+    reasonCodes: ["not-migrated"],
+    features: protocolMarkFeatures(logCtx) ?? [],
+  });
+}
+
+/**
+ * Leave the direct lane as soon as the route stops being the Antigravity route it was decided
+ * for. Called after every route assignment, so readers that run between a reroute and dispatch
+ * (canonical sanitization, ciphertext stripping, final normalization) see the bridge body.
+ */
+function leaveDirectLaneIfRerouted(
+  options: HandleResponsesOptions,
+  route: Pick<RouteResult, "providerName" | "modelId" | "provider">,
+  parsed: OcxParsedRequest,
+  logCtx: RequestLogContext,
+): void {
+  const direct = options.directRequest;
+  if (!direct) return;
+  if (route.providerName === direct.providerName && route.modelId === direct.modelId && isAntigravityRoute(route)) return;
+  restoreDirectRequestConversation(options, parsed._rawBody, logCtx);
+}
+
 /** Parses, selects, and admits one request without changing the dispatch policy. */
 export async function prepareResponsesRequest(
   requestContext: Pick<ResponsesRequestContext, "options" | "config" | "req" | "logCtx">,
@@ -240,14 +296,14 @@ export async function prepareResponsesRequest(
       effort: comboEffortRow.effort,
     };
   }
+  const isCompactionTrigger = body !== null && typeof body === "object" && !Array.isArray(body)
+    && Array.isArray((body as { input?: unknown }).input)
+    && ((body as { input: unknown[] }).input).some((item: unknown) =>
+      typeof item === "object" && item !== null && (item as { type?: string }).type === "compaction_trigger");
   // Compaction may send the last client-visible bare model after a combo switch.
   // Configured selectors take precedence; otherwise recall before combo dispatch (#3891).
   if (!concreteSelection && !options.compactionRoutingOverride && body && typeof body === "object" && !Array.isArray(body)) {
     const rawModel = (body as { model?: unknown }).model;
-    const rawInput = (body as { input?: unknown }).input;
-    const isCompactionTrigger = Array.isArray(rawInput)
-      && rawInput.some((item: unknown) =>
-        typeof item === "object" && item !== null && (item as { type?: string }).type === "compaction_trigger");
     if (typeof rawModel === "string" && !rawModel.includes("/") && isCompactionTrigger
       && !comboRows.fastRow && !comboEffortRow
       && !resolveComboId(config, rawModel)) {
@@ -276,6 +332,7 @@ export async function prepareResponsesRequest(
     }
   }
   let shadowCallIntercepted = false;
+  let shadowCallMatches = false;
   // Luna is also selectable by users/children. Both intercept sites use the same
   // per-turn provenance; WS frames must not inherit the handshake's classification.
   const threadSpawn = isThreadSpawnRequest(req.headers);
@@ -285,6 +342,7 @@ export async function prepareResponsesRequest(
     const rawShadowModel = (body as { model?: unknown }).model;
     if (shadowIntercept?.enabled && shadowIntercept.model && typeof rawShadowModel === "string"
       && isShadowSourceModel(rawShadowModel, shadowIntercept.sourceModels)) {
+      shadowCallMatches = true;
       const shadowComboId = resolveComboId(config, shadowIntercept.model);
       if (shadowComboId && Object.hasOwn(config.combos ?? {}, shadowComboId)) {
         shadowCallIntercepted = true;
@@ -298,6 +356,16 @@ export async function prepareResponsesRequest(
       }
     }
   }
+  // The hard-lock fallback owns ordinary turns only, and only after every more specific
+  // routing setting had its chance above: a shadow-intercepted, memory-phased, compaction
+  // or decision turn keeps its own destination, and an intercepted combo selector is
+  // already owned by the intercept. A spawned sub-agent turn names its model on purpose,
+  // the same reason the shadow intercept leaves it alone. Like the sites above it, this
+  // must run before comboIdFromRawBody reads `model`.
+  if (!concreteSelection && !options.compactionRoutingOverride && !isCompactionTrigger && !options.internalDecisionCall
+    && !shadowCallIntercepted && !shadowCallMatches && !memoryModelApplies && !threadSpawn && inboundWire === "responses") {
+    options.mainHardLockFallbackOverride = applyMainHardLockFallbackOverride(body, config);
+  }
   const comboId = !concreteSelection ? comboIdFromRawBody(body, config) : null;
   // A decision model may be a plain model or a non-JEV combo. A JEV combo here would recurse
   // into another decision, so the call is refused and the parent decision fails open.
@@ -306,6 +374,9 @@ export async function prepareResponsesRequest(
   }
   if (comboId && Object.hasOwn(config.combos ?? {}, comboId)) {
     options.onRequestBodyRead?.();
+    // The Antigravity direct lane is decided for one concrete route; a body that reached a combo
+    // goes through the combo's own child loop with the full bridge conversation.
+    restoreDirectRequestConversation(options, body, logCtx);
     return requestDispatchers.handleComboResponses(req, body, comboId, config, logCtx, {
       ...options,
       // Concrete combo child selectors no longer match the shadow source model. Carry the
@@ -381,11 +452,30 @@ export async function prepareResponsesRequest(
 
   let parsed: OcxParsedRequest;
   let toolBridgeMaps: ReturnType<typeof buildToolBridgeMaps>;
+  let clientToolCatalogRestriction: ClientToolCatalogRestriction | undefined;
   try {
     parsed = parseRequest(body);
+    // Antigravity direct lane: the body carried only the request settings, so the parse above
+    // produced them with an empty conversation; the conversation itself comes straight from the
+    // client body. Inside this try so a decode error answers exactly like a parse error.
+    if (options.directRequest) parsed = options.directRequest.decode(parsed);
+    parsed._nativeReasoningRetention = resolveNativeReasoningRetention(config);
+    // Capture before route rewrites or hosted sidecars can add tools; replayed catalogs are history.
+    // The direct settings body omits tools, including current legacy Chat functions. Recover
+    // their wire names only when this restriction needs a non-empty decoded catalog.
+    const catalogBody = options.directRequest && options.clientDeclaredEmptyToolCatalog === true && parsed.context.tools?.length
+      ? options.directRequest.bridgeConversation() : parsed._rawBody;
+    const currentCatalog = currentTurnWireToolCatalogBody(catalogBody, parsed._replayPrefixLen);
+    if (options.clientDeclaredEmptyToolCatalog === true || hasExplicitEmptyToolCatalog(currentCatalog)) {
+      clientToolCatalogRestriction = {
+        declaredToolNames: collectDeclaredWireToolNames(currentCatalog),
+        bareCustomToolNames: collectDeclaredBareCustomWireToolNames(currentCatalog),
+      };
+    }
     if (options.inboundWire === "anthropic") {
       parsed._nativeReasoningReplay = options.nativeReasoningReplay;
       parsed._nativeReasoningMint = options.nativeReasoningMint;
+      parsed._anthropicServerTools = options.anthropicServerTools;
     }
     parsed._promptCacheKeyIsSharedCohort = options.promptCacheKeyIsSharedCohort;
     // The body may have been rebuilt since the inbound observation (previous-response
@@ -508,7 +598,10 @@ export async function prepareResponsesRequest(
   if (!logCtx.conversationId) {
     logCtx.conversationId = resolvedConversationId;
   }
-  logCtx.requestedModel = options.compactionRoutingOverride?.sourceModel ?? parsed.modelId;
+  // A rewritten turn logs the selector the client asked for, so the usage log never
+  // claims the operator typed the fallback model themselves.
+  logCtx.requestedModel = options.mainHardLockFallbackOverride?.sourceModel
+    ?? options.compactionRoutingOverride?.sourceModel ?? parsed.modelId;
   logCtx.requestedEffort = parsed.options.reasoning;
   // What this request may spend beyond its input, for the durable spend reservation (#4707).
   // Read from the caller rather than from the adapter's serialized body, because the
@@ -529,7 +622,7 @@ export async function prepareResponsesRequest(
   // The selector the caller actually sent, captured before shadow interception
   // or a subagent fallback rewrites it, so a refusal names the client's own
   // request rather than a destination it never asked for.
-  const inboundSelector = parsed.modelId;
+  const inboundSelector = options.mainHardLockFallbackOverride?.sourceModel ?? parsed.modelId;
   const selectorTargetsSecondary = (selector: string): boolean => {
     const slash = selector.indexOf("/");
     if (slash <= 0) return false;
@@ -549,6 +642,19 @@ export async function prepareResponsesRequest(
   }
   const admissionScope = resolveAdmissionModelScope(config, options.admission);
   const captureInboundRoutePolicy = (candidate: RouteResult, captureRequestPolicy = true): RouteResult => {
+    // Router-collapsed aliases bypass the combo loop. Re-pick before capturing destination
+    // policy so random/RR cannot refuse while an unmetered target is still usable.
+    if (candidate.combo?.target.metered && !admissionMayUseMeteredComboTargets(
+      config, options.admission, config.combos?.[candidate.combo.comboId],
+    )) {
+      const pick = pickComboTarget(config, candidate.combo.comboId, { eligible: target => !target.metered });
+      if (!pick) {
+        throw new NoAvailableComboTargetsError(candidate.combo.comboId,
+          comboExclusionReasons(config, candidate.combo.comboId, target => !target.metered));
+      }
+      const routed = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
+      candidate = { ...routed, combo: pick, routeKind: "combo", routeReason: routed.routeReason === "blocked-model-redirect" ? "blocked-model-redirect" : "combo-pick" };
+    }
     // Every route this request path produces passes through here: the direct
     // name, an alias, a policy or combo selection, a compaction override, a
     // shadow-intercept target and both subagent-fallback re-routes. Checking
@@ -582,8 +688,8 @@ export async function prepareResponsesRequest(
       const resolved = concreteSelection
         ? routeConcreteModel(config, modelId)
         : parsed._compactionRequest === true
-          ? routeCompactionModel(config, modelId, evidenceFromBody(parsed._rawBody))
-          : routeModel(config, modelId, evidenceFromBody(parsed._rawBody));
+          ? routeCompactionModel(config, modelId, routeEvidence(options, parsed))
+          : routeModel(config, modelId, routeEvidence(options, parsed));
       // A Pool 2 selector may leave Pool 2 only through an operator-configured cross-provider
       // blocked-model redirect, which the router marks as a credential-domain rewrite. Any other
       // destination means the selector fell through to default resolution, which stays refused.
@@ -615,7 +721,7 @@ export async function prepareResponsesRequest(
     }
     const _sci = config.shadowCallIntercept;
     let shadowRoute: RouteResult | undefined;
-    if (!concreteSelection && !memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !options.internalDecisionCall && !preserveShadowModel && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
+    if (!concreteSelection && !memoryRoute && !options.memoryModelPhase && !options.compactionRoutingOverride && !options.mainHardLockFallbackOverride && !options.internalDecisionCall && !preserveShadowModel && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
       const sourcePrefix = shadowSourceModelPrefix(parsed.modelId, _sci.sourceModels)!;
       let sourceIdentity = { providerName: OPENAI_CODEX_PROVIDER_ID, modelId: sourcePrefix };
       try {
@@ -654,6 +760,7 @@ export async function prepareResponsesRequest(
     if (parsed._compactionRequest === true || options.compactionRoutingOverride) parsed._cursorIsolateConversation = true;
     route = memoryRoute ?? shadowRoute ?? resolveRoute(options.policyFallbackCandidate
       ? `${options.policyFallbackCandidate.provider}/${options.policyFallbackCandidate.model}` : parsed.modelId);
+    leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
     // Name the phase in the persisted route decision, so the request log says why this turn went to
     // the memory destination instead of leaving it looking like a plain user selection. Set here, on
     // the resolved route, so a combo child's own route carries it too.
@@ -667,15 +774,22 @@ export async function prepareResponsesRequest(
         };
       }
     }
-    if (options.compactionRoutingOverride && !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route)) {
+    if ((options.compactionRoutingOverride && !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route))
+      || options.mainHardLockFallbackOverride) {
       credentialDomainWasRewritten = true;
       // The destination does not share the conversation's credential domain, so it can neither
       // verify the source backend's reasoning ciphertext nor decode its native compaction blob.
       // This is the same condition an account change already reports (account-change-state.ts),
       // and the serializer turns a stored summary into readable text instead of dropping it.
       parsed._stripReasoningEncryptedContent = true;
+      parsed._stripNativeCompactionEncryptedContent = true;
       if (parsed._compactionRequest === true) parsed._portableCompaction = true;
     }
+    // A v1 fallback needs an ocx1 summary for replacement-history decoding, even when this
+    // custom destination separately accepts native v2 triggers. Legacy defaults stay intact.
+    if (options.compactionRecoveryKind === "compaction-v1" && parsed._compactionRequest === true
+      && route.provider.adapter === "openai-responses" && route.provider.supportsNativeCompactionTrigger === true
+      && !isCanonicalOpenAiForwardProvider(route.provider)) parsed._portableCompaction = true;
     logCtx.routeDecision = route.routeDecision;
     logCtx.policyEligibility = route.policyEligibility;
   } catch (err) {
@@ -686,7 +800,7 @@ export async function prepareResponsesRequest(
     if (policyRefusal) return policyRefusal;
     if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
     if (err instanceof NoAvailableComboTargetsError) {
-      return comboUnavailable(err.comboId);
+      return comboUnavailable(err.comboId, undefined, err.reasons);
     }
     if (err instanceof NoEligiblePolicyCandidateError) {
       // Persist the evaluation trace (per-candidate exclusions + the
@@ -893,8 +1007,9 @@ export async function prepareResponsesRequest(
     if (fallback?.to && !slugsEquivalent(fallback.to, route.modelId)) {
       try {
         route = captureInboundRoutePolicy(
-          routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody)),
+          routeModel(config, fallback.to, routeEvidence(options, parsed)),
         );
+        leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
         credentialDomainWasRewritten = true;
         logCtx.routeDecision = route.routeDecision;
         logCtx.policyEligibility = route.policyEligibility;
@@ -903,7 +1018,7 @@ export async function prepareResponsesRequest(
         if (policyRefusal) return policyRefusal;
         if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
         if (err instanceof NoAvailableComboTargetsError) {
-          return comboUnavailable(err.comboId);
+          return comboUnavailable(err.comboId, undefined, err.reasons);
         }
         if (err instanceof NoEligiblePolicyCandidateError) {
           logCtx.routeDecision = err.trace;
@@ -975,6 +1090,7 @@ export async function prepareResponsesRequest(
             "_promptCacheKeyIsSharedCohort",
             "_cursorClientThreadId",
             "_reasoningReplayScope",
+            "_nativeReasoningRetention",
             "_cursorIsolateConversation",
           ];
           for (const key of kept) {
@@ -1109,8 +1225,9 @@ export async function prepareResponsesRequest(
           if (fallback?.to && !slugsEquivalent(fallback.to, route.modelId)) {
             try {
               route = captureInboundRoutePolicy(
-                routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody)),
+                routeModel(config, fallback.to, routeEvidence(options, parsed)),
               );
+              leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
               credentialDomainWasRewritten = true;
               logCtx.routeDecision = route.routeDecision;
               logCtx.policyEligibility = route.policyEligibility;
@@ -1119,7 +1236,7 @@ export async function prepareResponsesRequest(
               if (policyRefusal) return policyRefusal;
               if (err instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(err);
               if (err instanceof NoAvailableComboTargetsError) {
-                return comboUnavailable(err.comboId);
+                return comboUnavailable(err.comboId, undefined, err.reasons);
               }
               if (err instanceof NoEligiblePolicyCandidateError) {
                 logCtx.routeDecision = err.trace;
@@ -1257,6 +1374,8 @@ export async function prepareResponsesRequest(
   // for streaming clients.
   const clientRequestedStream = parsed.stream;
   const admittedPolicyRoute = { providerName: route.providerName, modelId: route.modelId };
+  // Final guard before normalization may inject guidance into the raw body.
+  leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
   await applyFinalRouteRequestNormalization({
     parsed,
     route,
@@ -1434,6 +1553,8 @@ export async function prepareResponsesRequest(
       applyAccountChangeConversationStateScrub({
         body: parsed._rawBody,
         parsed,
+        preserveReasoningEncryptedContent: isCanonicalOpenAiForwardProvider(route.provider)
+          && parsed._nativeReasoningRetention?.accountSwitch === true,
         bindingKey: binding.bindingKey,
         servingAccountId: binding.accountId,
         logCtx,
@@ -1452,6 +1573,12 @@ export async function prepareResponsesRequest(
   commitSkillsSnapshot?.();
   return {
     inboundWire,
+    clientDeclaredEmptyToolCatalog: options.clientDeclaredEmptyToolCatalog === true,
+    clientToolCatalogRestriction,
+    // Admission facts later route rewrites must not re-derive: the selector the caller sent and
+    // the key scope as it stood when this request was admitted.
+    inboundSelector,
+    admissionScope,
     translatorBudget,
     parsed,
     toolBridgeMaps,

package/src/server/responses/request-sidecar-auth.ts

@@ -2,7 +2,7 @@ import type { ResponsesRequestContext } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
 import type { ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactionTrigger } from "../../providers/openai-tiers";
 import { omitEarlierCompactionImages } from "../../responses/compaction-images";
 import {
   shouldResolveOpenAiVisionSidecar,
@@ -51,7 +51,7 @@ export async function prepareResponsesSidecarAuth(
   let openAiSidecar: ResolvedOpenAiForwardSidecar | undefined;
   const visionDescribeTerminal = options.visionDescribeTerminal === true;
   const routedCompaction = parsed._compactionRequest === true
-    && (!isCanonicalOpenAiForwardProvider(route.provider) || parsed._portableCompaction === true);
+    && (!supportsNativeResponsesCompactionTrigger(route.provider) || parsed._portableCompaction === true);
   if (routedCompaction) parsed.context.messages = omitEarlierCompactionImages(parsed.context.messages);
   const needsOpenAiVision = !visionDescribeTerminal
     && shouldResolveOpenAiVisionSidecar(config, route.provider, route.modelId, parsed, route.providerName);