@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/responses/parser.ts

@@ -1,3 +1,4 @@
+import { anthropicProgressEnvelope, isAnthropicProgressMirror } from "./anthropic-progress";
 import type {
   OcxAssistantMessage,
   OcxContentPart,
@@ -15,7 +16,8 @@ import { createToolChoiceResolver, namespacedToolName } from "../types";
 import { responsesRequestSchema } from "./schema";
 import { providerMetadataFromResponsesFunctionCall } from "./provider-opaque-metadata";
 import { lookupReplayThoughtSignature } from "./thought-signature-replay";
-import { CHECKPOINT_CONTINUATION_NOTE, compactionItemToText, decodeCompactionSummary, isCompactionItemType } from "./compaction";
+import { decodeRetainedCompaction, RETAINED_COMPACTION_PREFIX } from "./retained-compaction";
+import { CHECKPOINT_CONTINUATION_NOTE, compactionItemToText, decodeCompactionSummary, isCompactionItemType, SUMMARY_PREFIX } from "./compaction";
 import { previousResponseReplayPrefixLength } from "./state";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
 import { hasRoutedIdentity, nameRoutedIdentity } from "../adapters/identity";
@@ -28,6 +30,7 @@ import { mapToolChoice, buildTools, customToolNamespaces } from "./parser-tools"
 import { parseTextFormat } from "./parser-text-format";
 import { externalTaskInputContent } from "./task-input";
 import { normalizeVisualizationContext } from "./visualization-directives";
+import { frameCompactionHistory } from "./compaction-history-framing";
 
 /**
  * Wrap a remembered proxy-side signature as provider metadata for a replayed tool call.
@@ -66,10 +69,35 @@ function repairJsonObjectEnvelope(text: string): Record<string, unknown> | undef
   return undefined;
 }
 
+/**
+ * Repair the observed MiMo tool-call corruption: the model emits its proprietary
+ * `</function></tool_call>` closing tags INSIDE the JSON string value of the
+ * function arguments, and drops the JSON object's closing brace. Strip the
+ * suffix, restore the brace, and only accept the repair when the result parses
+ * into an object.
+ */
+function repairMimoToolCallEnvelope(text: string): Record<string, unknown> | undefined {
+  const suffix = "</function></tool_call>";
+  if (!text.endsWith(suffix)) return undefined;
+  const stripped = text.slice(0, -suffix.length);
+  if (!stripped.startsWith("{")) return undefined;
+  // A trailing brace or quote can itself belong to the unterminated string.
+  // Try only the three observed envelope endings, accepting an object parse.
+  for (const candidate of [stripped, `${stripped}}`, `${stripped}"}`]) {
+    try {
+      const parsed: unknown = JSON.parse(candidate);
+      if (isObj(parsed)) return parsed;
+    } catch {
+      /* try the next bounded envelope ending */
+    }
+  }
+  return undefined;
+}
+
 /**
  * Decode a function call's serialized arguments the way history replay tolerates them: empty
- * or non-JSON text becomes `{}` instead of failing every later turn, and the one bounded
- * lost-brace corruption above is repaired. Shared with the direct Chat decoder
+ * or non-JSON text becomes `{}` instead of failing every later turn, and the bounded
+ * lost-brace and MiMo closing-tag corruptions above are repaired. Shared with the direct Chat decoder
  * (`src/protocols/codecs/chat-ir.ts`) so both decode the same call to the same object.
  */
 export function functionCallArgumentsFromText(callId: string, rawArguments: string | undefined): Record<string, unknown> {
@@ -80,6 +108,15 @@ export function functionCallArgumentsFromText(callId: string, rawArguments: stri
       const parsed: unknown = JSON.parse(rawArgs);
       if (isObj(parsed)) args = parsed;
     } catch {
+      // Corruptions observed on Xiaomi MiMo routed requests, each with a bounded
+      // repair so a serialized call the model can still see is restored instead
+      // of replaying {} forever.
+      const mimoRepaired = repairMimoToolCallEnvelope(rawArgs);
+      if (mimoRepaired !== undefined) {
+        args = mimoRepaired;
+        console.warn(`[parser] function_call ${callId} repaired MiMo tool-call envelope (tags inside string)`);
+        return args;
+      }
       // One observed serialization corruption loses exactly the JSON object's opening
       // brace; the closed envelope is tight enough to repair back into a call the
       // routed model can still see and retry, instead of replaying {} forever.
@@ -189,7 +226,7 @@ export function parseRequest(
   if (!parsed.success) {
     throw new Error(`responses parse error: ${parsed.error.message}`);
   }
-  const data = parsed.data;
+  const data = frameCompactionHistory(parsed.data);
   const now = Date.now();
   const messages: OcxMessage[] = [];
   // Built before the item loop: a custom_tool_call echoed back in `input` needs the
@@ -239,6 +276,7 @@ export function parseRequest(
   } else if (data.input) {
     for (let inputIndex = 0; inputIndex < data.input.length; inputIndex++) {
       const item = data.input[inputIndex];
+      if (inputIndex > 0 && isAnthropicProgressMirror(item, anthropicProgressEnvelope(data.input[inputIndex - 1]))) continue;
       const effectiveType = (item as { type?: string }).type ?? ("role" in item ? "message" : undefined);
       const itemRole = (item as { role?: string }).role;
       const externalTaskInput = effectiveType === "function_call_output" ? externalTaskInputContent(item) : undefined;
@@ -281,7 +319,7 @@ export function parseRequest(
       }
 
       if (isCompactionItemType(effectiveType)) {
-        // A stored summary from a previous compaction. Decode our ocx1 envelope into plain text so
+        // A stored summary from a previous compaction. Decode our ocx1/ocx2 envelopes into plain text so
         // the routed model keeps the compacted context; real OpenAI-encrypted blobs degrade to a note.
         // `context_compaction` (encrypted_content optional) is codex-rs's local-compaction marker;
         // with no payload it is a pure marker (the summary follows as its own user message), so it
@@ -293,6 +331,13 @@ export function parseRequest(
         if (effectiveType === "context_compaction" && typeof encrypted !== "string") continue;
         if (typeof encrypted === "string" && decodeCompactionSummary(encrypted) !== null) decodedCheckpoint = true;
         pendingReasoning.length = 0;
+        if (typeof encrypted === "string" && encrypted.startsWith(RETAINED_COMPACTION_PREFIX)) {
+          const retained = decodeRetainedCompaction(encrypted);
+          if (!retained) throw new Error("Invalid OpenCodex retained compaction envelope");
+          messages.push({ role: "user", content: `${SUMMARY_PREFIX}\n\n${retained.summary}`, timestamp: now });
+          messages.push(...retained.reasoning.map(content => ({ role: "user" as const, content, timestamp: now })));
+          continue;
+        }
         messages.push({
           role: "user",
           content: compactionItemToText(typeof encrypted === "string" ? encrypted : undefined),

package/src/responses/reasoning-envelope.ts

@@ -20,6 +20,8 @@ export const OCX_REASONING_PREFIX = "ocxr1:";
 export interface ReasoningEnvelope {
   /** Anthropic thinking-block signature (signature_delta), if captured. */
   sig?: string;
+  /** ID of the immediately following commentary copy of this signed thinking block. */
+  upd?: string;
   /** Raw redacted_thinking block data payloads, order preserved. */
   red?: string[];
   /**
@@ -133,6 +135,8 @@ export function decodeReasoningEnvelope(encryptedContent: string, budget?: Trans
       const obj = parsed as { sig?: unknown; red?: unknown };
       const envelope: ReasoningEnvelope = {};
       if (typeof obj.sig === "string") envelope.sig = obj.sig;
+      const upd = (parsed as { upd?: unknown }).upd;
+      if (typeof upd === "string" && /^msg_[a-f0-9]{32}$/.test(upd)) envelope.upd = upd;
       if (Array.isArray(obj.red)) {
         const red = obj.red.filter((r): r is string => typeof r === "string");
         if (red.length > 0) envelope.red = red;

package/src/responses/reasoning-replay-cache.ts

@@ -46,6 +46,7 @@ export function nativeReasoningTagMatches(expected: string | undefined, presente
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
 const OPAQUE_BLOB_REJECTION_TTL_MS = 5 * 60 * 1000;
+const MAX_OPAQUE_BLOB_REJECTION_FINGERPRINTS = 256;
 const replayIdentityKey = randomBytes(32);
 const CREDENTIAL_HEADER_NAMES = new Set([
   "authorization",
@@ -78,8 +79,14 @@ interface ServingIdentityEntry {
 interface OpaqueBlobRejectionEntry {
   bytes: number;
   at: number;
+  /** Undefined retains the legacy blanket rejection; only payload digests are stored here. */
+  fingerprints?: ReadonlySet<string>;
 }
 
+export type ReasoningReplayOpaqueBlobRejection =
+  | { mode: "blanket" }
+  | { mode: "selective"; fingerprints: ReadonlySet<string> };
+
 const entries = new Map<string, CacheEntry>();
 const servingIdentities = new Map<string, ServingIdentityEntry>();
 const opaqueBlobRejections = new Map<string, OpaqueBlobRejectionEntry>();
@@ -200,12 +207,34 @@ function sweepExpiredOpaqueBlobRejections(at: number): void {
 export function reasoningReplayServingIdentityChanged(
   scope: OcxReasoningReplayScopeRef | undefined,
 ): boolean {
+  return reasoningReplayServingIdentityChange(scope) !== undefined;
+}
+
+/** Known durable route differences; an unknown issuer never establishes compatibility. */
+export function reasoningReplayServingIdentityChange(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): {
+  providerChanged: boolean;
+  destinationChanged: boolean;
+  adapterChanged: boolean;
+  modelChanged: boolean;
+  credentialChanged: boolean;
+} | undefined {
   const current = servingIdentityFor(scope);
-  if (!current) return false;
+  if (!current) return undefined;
   const at = now();
   sweepExpiredServingIdentities(at);
   const previous = servingIdentities.get(current.threadId);
-  return previous !== undefined && previous.identity !== current.identity;
+  if (previous === undefined || previous.identity === current.identity) return undefined;
+  const before = JSON.parse(previous.identity) as ReasoningReplayIdentityTuple;
+  const after = JSON.parse(current.identity) as ReasoningReplayIdentityTuple;
+  return {
+    providerChanged: before[0] !== after[0],
+    destinationChanged: before[1] !== after[1],
+    adapterChanged: before[2] !== after[2],
+    modelChanged: before[3] !== after[3],
+    credentialChanged: before[4] !== after[4],
+  };
 }
 
 /**
@@ -288,18 +317,57 @@ export function reasoningReplayOpaqueBlobRejectionMemoized(
   return opaqueBlobRejections.has(key);
 }
 
+/** Undefined means no live memo; a selective result owns a defensive copy of its digests. */
+export function getReasoningReplayOpaqueBlobRejection(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): ReasoningReplayOpaqueBlobRejection | undefined {
+  const key = opaqueBlobRejectionKeyFor(scope);
+  if (!key) return undefined;
+  sweepExpiredOpaqueBlobRejections(now());
+  const entry = opaqueBlobRejections.get(key);
+  return entry === undefined ? undefined : entry.fingerprints === undefined ? { mode: "blanket" }
+    : { mode: "selective", fingerprints: new Set(entry.fingerprints) };
+}
+
+/** Incomplete, invalid or unbounded enumerations cannot safely narrow the legacy rejection. */
+function boundedRejectionFingerprints(fingerprints: ReadonlySet<string> | undefined): Set<string> | undefined {
+  if (fingerprints === undefined) return undefined;
+  const copy = new Set<string>();
+  try {
+    // The intrinsic validates a real Set without trusting an overridden iterator or size getter.
+    for (const value of Set.prototype.values.call(fingerprints) as IterableIterator<unknown>) {
+      if (typeof value !== "string" || value.length !== 64 || !/^[a-f0-9]{64}$/.test(value)
+        || copy.size >= MAX_OPAQUE_BLOB_REJECTION_FINGERPRINTS) return undefined;
+      copy.add(value);
+    }
+  } catch { return undefined; }
+  return copy.size > 0 ? copy : undefined;
+}
+
 /** Record only after a blobless retry succeeded for this durable serving identity. */
 export function rememberReasoningReplayOpaqueBlobRejection(
   scope: OcxReasoningReplayScopeRef | undefined,
+  fingerprints?: ReadonlySet<string>,
 ): void {
   const key = opaqueBlobRejectionKeyFor(scope);
   if (!key) return;
-  const bytes = Buffer.byteLength(key, "utf8");
-  if (bytes > MAX_TOTAL_BYTES) return;
+  const keyBytes = Buffer.byteLength(key, "utf8");
+  if (keyBytes > MAX_TOTAL_BYTES) return;
   const at = now();
   sweepExpiredOpaqueBlobRejections(at);
-  if (opaqueBlobRejections.has(key)) deleteOpaqueBlobRejection(key);
-  opaqueBlobRejections.set(key, { bytes, at });
+  const previous = opaqueBlobRejections.get(key);
+  let merged = previous && previous.fingerprints === undefined ? undefined : boundedRejectionFingerprints(fingerprints);
+  if (merged && previous?.fingerprints) {
+    for (const fingerprint of previous.fingerprints) {
+      merged.add(fingerprint);
+      if (merged.size > MAX_OPAQUE_BLOB_REJECTION_FINGERPRINTS) { merged = undefined; break; }
+    }
+  }
+  // A near-limit key can still retain its existing blanket memo if the digest set will not fit.
+  if (merged && keyBytes + merged.size * 64 > MAX_TOTAL_BYTES) merged = undefined;
+  const bytes = keyBytes + (merged?.size ?? 0) * 64;
+  if (previous) deleteOpaqueBlobRejection(key);
+  opaqueBlobRejections.set(key, { bytes, at, ...(merged ? { fingerprints: merged } : {}) });
   opaqueBlobRejectionTotalBytes += bytes;
   while (
     (opaqueBlobRejectionTotalBytes > MAX_TOTAL_BYTES || opaqueBlobRejections.size > MAX_ENTRIES)

package/src/responses/reasoning-retention.ts

@@ -0,0 +1,173 @@
+/**
+ * Routed v1 compaction keeps readable reasoning out of the summarizer request. Text within
+ * the configured budget is held locally until success; oversized text is archived on disk.
+ * Provider ciphertext and signatures are never included in the portable retained items.
+ */
+
+import { expandRetainedCompactionInput } from "./retained-compaction";
+import { closeSync, mkdirSync, openSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { estimateTokens } from "../lib/token-estimate";
+import { decodeReasoningEnvelope } from "./reasoning-envelope";
+
+export const DEFAULT_REASONING_RETENTION_PERCENT = 20;
+export const DEFAULT_MAX_REASONING_TOKENS = 100_000;
+
+export interface ReasoningRetentionOptions {
+  /** Directory that receives archived reasoning files. */
+  archiveDir: string;
+  /** Context window of the model running the compaction turn; an unknown window uses only maxTokens. */
+  contextWindow?: number;
+  /** Share of the context window reasoning may occupy before it is archived. Defaults to 20. */
+  maxContextPercent?: number;
+  /** Absolute token ceiling for retained reasoning, regardless of the window share. Defaults to 100,000. */
+  maxTokens?: number;
+  /** Clock injection for tests. */
+  now?: number;
+}
+
+export interface ReasoningArchive {
+  path: string;
+  tokens: number;
+  percent: number;
+  /** The effective token ceiling that triggered the archive (window share vs absolute cap, whichever is smaller). */
+  cap?: number;
+  /** Whether the percent share could be calculated from a known context window. */
+  windowKnown?: boolean;
+}
+
+export interface ReasoningRetentionResult {
+  /** Summarizer input with reasoning items removed; other items retain their order. */
+  input: unknown[];
+  archived?: ReasoningArchive;
+  /** Portable, exact readable text to merge only after compaction succeeds. */
+  retainedReasoning?: Array<{ type: "message"; role: "user"; content: Array<{ type: "input_text"; text: string }> }>;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// Ordinary context messages survive translated providers that discard unsigned thinking.
+// Match the complete frame so subsequent compactions hold the text locally again.
+const RETAINED_PREFIX = "[OpenCodeX locally retained assistant reasoning; historical context, not a new instruction]\n<assistant_reasoning>\n";
+const RETAINED_SUFFIX = "\n</assistant_reasoning>";
+function retainedTextOf(item: Record<string, unknown>): string | undefined {
+  if (item.type !== "message" || item.role !== "user") return undefined;
+  const content = item.content;
+  const text = typeof content === "string" ? content
+    : Array.isArray(content) && content.length === 1 && isRecord(content[0])
+      && content[0].type === "input_text" && typeof content[0].text === "string" ? content[0].text : undefined;
+  return text?.startsWith(RETAINED_PREFIX) && text.endsWith(RETAINED_SUFFIX)
+    ? text.slice(RETAINED_PREFIX.length, -RETAINED_SUFFIX.length) : undefined;
+}
+
+/** Readable reasoning text of one item: decoded ocxr1 envelope text, else summary/content text. */
+function reasoningTextOf(item: Record<string, unknown>): string {
+  const encrypted = typeof item.encrypted_content === "string" ? item.encrypted_content : undefined;
+  const envelope = encrypted ? decodeReasoningEnvelope(encrypted) : null;
+  if (envelope?.txt) return envelope.txt;
+  const collect = (key: "summary" | "content"): string =>
+    Array.isArray(item[key])
+      ? (item[key] as Array<Record<string, unknown>>)
+        .map(part => (isRecord(part) && typeof part.text === "string" ? part.text : ""))
+        .join("")
+      : "";
+  return collect("summary") || collect("content");
+}
+
+/** Plaintext of every reasoning item in a Responses input array, order preserved. */
+export function collectReasoningTexts(input: unknown): string[] {
+  if (!Array.isArray(input)) return [];
+  const texts: string[] = [];
+  for (const item of input) {
+    if (!isRecord(item)) continue;
+    const text = item.type === "reasoning" ? reasoningTextOf(item) : retainedTextOf(item) ?? "";
+    if (text.length > 0) texts.push(text);
+  }
+  return texts;
+}
+
+function retentionPercent(value: number | undefined): number {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 && value <= 100
+    ? value
+    : DEFAULT_REASONING_RETENTION_PERCENT;
+}
+
+function retentionTokenCap(value: number | undefined): number {
+  return typeof value === "number" && Number.isInteger(value) && value > 0
+    ? value
+    : DEFAULT_MAX_REASONING_TOKENS;
+}
+
+/** Separate reasoning locally before dispatch; unknown windows enforce the absolute cap. */
+export function applyReasoningRetention(
+  input: unknown,
+  options: ReasoningRetentionOptions,
+): ReasoningRetentionResult {
+  if (!Array.isArray(input)) return { input: [] };
+  input = expandRetainedCompactionInput(input);
+  if (!Array.isArray(input)) return { input: [] };
+  const texts = collectReasoningTexts(input);
+  const retained = input.filter(item => !(isRecord(item) && (item.type === "reasoning" || retainedTextOf(item) !== undefined)));
+  if (texts.length === 0) return { input: retained.length === input.length ? input : retained };
+  const window = options.contextWindow;
+
+  const percent = retentionPercent(options.maxContextPercent);
+  const cap = retentionTokenCap(options.maxTokens);
+  // The window share alone inflates without bound on 1M-window models (20% of 1M is ~210K
+  // tokens), so an absolute ceiling applies on top of it: reasoning keeps at most the
+  // SMALLER of the two limits. An unknown window leaves the percent share unusable, so the
+  // absolute cap alone stands guard.
+  const windowKnown = typeof window === "number" && Number.isInteger(window) && window > 0;
+  const limit = windowKnown ? Math.min(Math.floor(window * (percent / 100)), cap) : cap;
+  const framedTexts = texts.map(text => RETAINED_PREFIX + text + RETAINED_SUFFIX);
+  // Budget the historical context that is actually replayed, including every block's frame.
+  const tokens = estimateTokens(framedTexts.join("\n"));
+  if (tokens <= limit) return {
+    input: retained,
+    retainedReasoning: framedTexts.map(text => ({ type: "message", role: "user",
+      content: [{ type: "input_text", text }] })),
+  };
+
+  mkdirSync(options.archiveDir, { recursive: true, mode: 0o700 });
+  const stamp = new Date(options.now ?? Date.now()).toISOString().replace(/[:.]/g, "-");
+  const path = join(options.archiveDir, "reasoning-" + stamp + "-" + Math.random().toString(36).slice(2, 8) + ".md");
+  // Only a successful exclusive open grants ownership; an occupied path is never removed.
+  const fd = openSync(path, "wx", 0o600);
+  let failure: unknown;
+  try { writeFileSync(fd, texts.join("\n\n---\n\n"), "utf-8"); } catch (error) { failure = error; }
+  try { closeSync(fd); } catch (error) { failure ??= error; }
+  if (failure !== undefined) {
+    try { rmSync(path); } catch { /* preserve the original I/O error; cleanup is best-effort */ }
+    throw failure;
+  }
+
+  const limitDescription = windowKnown
+    ? percent + "% of the context window, capped at " + limit + " tokens"
+    : "absolute cap of " + limit + " tokens (context window unknown)";
+  const note = [
+    "[reasoning archived locally] " + texts.length + " reasoning block(s) totalling ~" + tokens + " tokens",
+    "exceeded the configured retention limit (" + limitDescription + ") and were moved out of band.",
+    "Full text: " + path,
+  ].join(" ");
+  const triggerIndex = retained.findIndex(item => isRecord(item) && item.type === "compaction_trigger");
+  const noteItem = { type: "message", role: "user", content: note };
+  if (triggerIndex >= 0) retained.splice(triggerIndex, 0, noteItem);
+  else retained.push(noteItem);
+  return { input: retained, archived: { path, tokens, percent, cap: limit, windowKnown } };
+}
+
+/**
+ * User-visible notice appended to a compaction summary when reasoning was archived. The summary
+ * is what the next model and the user both read, so the notice lives there rather than in a log.
+ */
+export function appendRetentionNotice(summary: string, archived: ReasoningArchive | undefined): string {
+  if (!archived) return summary;
+  const limitDescription = archived.windowKnown === false
+    ? "absolute cap of " + (archived.cap ?? "unknown") + " tokens (context window unknown)"
+    : archived.percent + "% of the context window (effective cap: " + (archived.cap ?? "unknown") + " tokens)";
+  return summary + "\n\n[reasoning retention notice] Reasoning of ~" + archived.tokens + " tokens exceeded " + limitDescription
+    + " and was archived locally at " + archived.path
+    + ". This summary covers conclusions only; read that file for the full reasoning.";
+}

package/src/responses/retained-compaction.ts

@@ -0,0 +1,46 @@
+/** Versioned, proxy-owned compaction data. This is encoding, never provider ciphertext. */
+export const RETAINED_COMPACTION_PREFIX = "ocx2:";
+
+export interface RetainedCompaction {
+  version: 2;
+  summary: string;
+  /** Already framed historical context, preserved byte-for-byte on replay. */
+  reasoning: string[];
+}
+
+export function encodeRetainedCompaction(summary: string, reasoning: string[]): string {
+  return RETAINED_COMPACTION_PREFIX + Buffer.from(JSON.stringify({ version: 2, summary, reasoning }), "utf-8").toString("base64");
+}
+
+export function decodeRetainedCompaction(value: string): RetainedCompaction | null {
+  if (!value.startsWith(RETAINED_COMPACTION_PREFIX)) return null;
+  try {
+    const payload = value.slice(RETAINED_COMPACTION_PREFIX.length);
+    const bytes = Buffer.from(payload, "base64");
+    if (bytes.toString("base64") !== payload) return null;
+    const parsed: unknown = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const item = parsed as Record<string, unknown>;
+    if (Object.keys(item).some(key => !["version", "summary", "reasoning"].includes(key))
+      || item.version !== 2 || typeof item.summary !== "string" || !item.summary.trim()
+      || !Array.isArray(item.reasoning) || !item.reasoning.every(text => typeof text === "string")) return null;
+    return item as unknown as RetainedCompaction;
+  } catch { return null; }
+}
+
+/** Expand only our structured envelopes; callers retain their existing native/ocx1 policy. */
+export function expandRetainedCompactionInput(input: unknown): unknown {
+  if (!Array.isArray(input)) return input;
+  if (!input.some(item => item && typeof item === "object" && ["compaction", "compaction_summary", "context_compaction"].includes(item.type)
+    && typeof item.encrypted_content === "string" && item.encrypted_content.startsWith(RETAINED_COMPACTION_PREFIX))) return input;
+  return input.flatMap(item => {
+    if (!item || typeof item !== "object" || !["compaction", "compaction_summary", "context_compaction"].includes(item.type)
+      || typeof item.encrypted_content !== "string" || !item.encrypted_content.startsWith(RETAINED_COMPACTION_PREFIX)) return [item];
+    const data = decodeRetainedCompaction(item.encrypted_content);
+    if (!data) throw new Error("Invalid OpenCodex retained compaction envelope");
+    return [
+      { ...item, encrypted_content: "ocx1:" + Buffer.from(data.summary, "utf-8").toString("base64") },
+      ...data.reasoning.map(text => ({ type: "message", role: "user", content: [{ type: "input_text", text }] })),
+    ];
+  });
+}

package/src/responses/schema.ts

@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { isCompactionItemType } from "./compaction";
 
 const inputTextSchema = z.object({ type: z.literal("input_text"), text: z.string() });
 const plainTextSchema = z.object({ type: z.literal("text"), text: z.string() });
@@ -75,6 +76,28 @@ const reasoningItemSchema = z.object({
   // Round-tripped opaque payload (native OpenAI encryption OR the proxy's ocxr1 envelope).
   encrypted_content: z.string().optional(),
 });
+
+/** A native v1 replacement history may establish replay provenance only after body success. */
+export const nativeCompactResponseSchema = z.object({
+  status: z.literal("completed").optional(),
+  error: z.null().optional(),
+  output: z.array(z.union([
+    userMessageItemSchema.required({ content: true }),
+    systemMessageItemSchema.required({ content: true }),
+    assistantMessageItemSchema.required({ content: true }),
+    reasoningItemSchema,
+    z.object({
+      type: z.string().refine(isCompactionItemType),
+      encrypted_content: z.string().refine(value => value.trim().length > 0),
+    }),
+  ])).min(1).refine(items => items.some(item => {
+    if (isCompactionItemType(item.type)) return true;
+    if (!("role" in item)) return false;
+    return typeof item.content === "string" ? item.content.trim().length > 0
+      : item.content.some(part => "text" in part && part.text.trim().length > 0);
+  })),
+});
+
 const functionCallItemSchema = z.object({
   type: z.literal("function_call"),
   id: z.string().optional(),