@gajae-code/ai 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.10.2] - 2026-07-14
+
+### Fixed
+
+- Fixed frequent `Request blocked (code=invalid_prompt)` failures on gpt-5.6 (Sol/Terra/Luna) subagent, default-agent, and compaction turns (ref openai/codex#32028, oh-my-pi#5184). Leaked Harmony control-token markers (e.g. `<|channel|>analysis`) were only neutralized on the replayed-history payload path, so markers in assistant reasoning summaries, live-converted message/tool-output text, and user-authored content reached the OpenAI Responses and OpenAI-codex-responses transports verbatim and wedged the session (the poisoned item was re-sent every turn). Both transports now neutralize reserved control tokens across the entire outgoing `input` array at the request boundary via an idempotent zero-width-space insertion that keeps the text human-readable.
+
 ## [0.10.0] - 2026-07-12
 ### Fixed
 

package/dist/types/utils.d.ts

@@ -18,6 +18,31 @@ export declare function normalizeResponsesToolCallId(id: string, itemPrefix?: Re
  */
 export declare function truncateResponseItemId(id: string, prefix: string): string;
 export declare function sanitizeOpenAIResponsesHistoryItemsForReplay(items: Array<Record<string, unknown>>): ResponseInput;
+/**
+ * Neutralize leaked OpenAI Harmony / control tokens (`<|channel|>`, `<|message|>`,
+ * `<|call|>`, `<|constrain|>`, `<|recipient|>`, `<|content|>`, ...) in replayed
+ * history text. A subagent whose tool-call channel degenerates can dump raw
+ * control-token scaffolding into its reply text; once that poisoned text lands in
+ * history the Codex / Responses endpoint rejects every subsequent request with
+ * `Request blocked (code=invalid_prompt)`, permanently wedging the session because
+ * the offending item is re-sent on each turn. Insert a zero-width space after `<`
+ * so the delimiter can no longer be tokenized as a reserved control token while the
+ * text stays human-readable.
+ */
+export declare function neutralizeReservedControlTokens(text: string): string;
+/**
+ * Neutralize leaked reserved control tokens across every string in an outgoing
+ * Responses `input` array. This is the request-boundary complement to the
+ * replay-history sanitizer: leaked Harmony markers (`<|channel|>analysis`, ...)
+ * can enter the payload from assistant reasoning summaries, live-converted
+ * message/tool-output text, or user-authored content — not just replayed
+ * history — and every gpt-5.6 request that carries one is rejected with
+ * `Request blocked (code=invalid_prompt)`. Walking every string (rather than an
+ * item-type allowlist) guarantees no leak source is missed as item shapes
+ * evolve; the zero-width-space insertion is idempotent (`<\u200b|` no longer
+ * matches `<|`) and keeps the text human-readable.
+ */
+export declare function neutralizeResponsesInputControlTokens<T>(items: readonly T[]): T[];
 export declare function createOpenAIResponsesHistoryPayload(provider: string, items: Array<Record<string, unknown>>, incremental?: boolean): OpenAIResponsesHistoryPayload;
 export declare function getOpenAIResponsesHistoryPayload(providerPayload: ProviderPayload | undefined, currentProvider: string, fallbackProvider?: string): OpenAIResponsesHistoryPayload | undefined;
 export declare function getOpenAIResponsesHistoryItems(providerPayload: ProviderPayload | undefined, currentProvider: string, fallbackProvider?: string): Array<Record<string, unknown>> | undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.10.0",
+	"version": "0.10.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.10.0",
+		"@gajae-code/utils": "0.10.2",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/providers/openai-codex-responses.ts

@@ -43,6 +43,7 @@ import {
 	createOpenAIResponsesHistoryPayload,
 	getOpenAIResponsesHistoryItems,
 	getOpenAIResponsesHistoryPayload,
+	neutralizeResponsesInputControlTokens,
 	normalizeSystemPrompts,
 	sanitizeOpenAIResponsesHistoryItemsForReplay,
 } from "../utils";
@@ -633,7 +634,7 @@ async function buildTransformedCodexRequestBody(
 ): Promise<RequestBody> {
 	const params: RequestBody = {
 		model: model.id,
-		input: [...convertMessages(model, context)],
+		input: neutralizeResponsesInputControlTokens(convertMessages(model, context)),
 		stream: true,
 		prompt_cache_key: normalizeOpenAIResponsesPromptCacheKey(options?.sessionId),
 	};

package/src/providers/openai-responses.ts

@@ -33,6 +33,7 @@ import {
 	createOpenAIResponsesHistoryPayload,
 	getOpenAIResponsesHistoryItems,
 	getOpenAIResponsesHistoryPayload,
+	neutralizeResponsesInputControlTokens,
 	normalizeSystemPrompts,
 	resolveCacheRetention,
 	sanitizeOpenAIResponsesHistoryItemsForReplay,
@@ -493,7 +494,7 @@ function buildParams(
 		strictResponsesPairing,
 		providerSessionState,
 	);
-	const messages: ResponseInput = [...conversationMessages];
+	const messages: ResponseInput = neutralizeResponsesInputControlTokens(conversationMessages);
 
 	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);
 	if (isComposerHarnessModel(model.id)) {

package/src/utils.ts

@@ -119,22 +119,68 @@ export function sanitizeOpenAIResponsesHistoryItemsForReplay(items: Array<Record
 		return sanitized ? [sanitized] : [];
 	});
 }
+const RESERVED_CONTROL_TOKEN_RE = /<\|(?=[A-Za-z0-9_]{1,32}\|>)/g;
+/**
+ * Neutralize leaked OpenAI Harmony / control tokens (`<|channel|>`, `<|message|>`,
+ * `<|call|>`, `<|constrain|>`, `<|recipient|>`, `<|content|>`, ...) in replayed
+ * history text. A subagent whose tool-call channel degenerates can dump raw
+ * control-token scaffolding into its reply text; once that poisoned text lands in
+ * history the Codex / Responses endpoint rejects every subsequent request with
+ * `Request blocked (code=invalid_prompt)`, permanently wedging the session because
+ * the offending item is re-sent on each turn. Insert a zero-width space after `<`
+ * so the delimiter can no longer be tokenized as a reserved control token while the
+ * text stays human-readable.
+ */
+export function neutralizeReservedControlTokens(text: string): string {
+	if (!text.includes("<|")) return text;
+	return text.replace(RESERVED_CONTROL_TOKEN_RE, "<\u200b|");
+}
+
+/**
+ * Neutralize leaked reserved control tokens across every string in an outgoing
+ * Responses `input` array. This is the request-boundary complement to the
+ * replay-history sanitizer: leaked Harmony markers (`<|channel|>analysis`, ...)
+ * can enter the payload from assistant reasoning summaries, live-converted
+ * message/tool-output text, or user-authored content — not just replayed
+ * history — and every gpt-5.6 request that carries one is rejected with
+ * `Request blocked (code=invalid_prompt)`. Walking every string (rather than an
+ * item-type allowlist) guarantees no leak source is missed as item shapes
+ * evolve; the zero-width-space insertion is idempotent (`<\u200b|` no longer
+ * matches `<|`) and keeps the text human-readable.
+ */
+export function neutralizeResponsesInputControlTokens<T>(items: readonly T[]): T[] {
+	return items.map(item => deepNeutralizeReservedControlTokens(item) as T);
+}
+
+function deepNeutralizeReservedControlTokens(value: unknown): unknown {
+	if (typeof value === "string") return neutralizeReservedControlTokens(value);
+	if (Array.isArray(value)) return value.map(deepNeutralizeReservedControlTokens);
+	if (value && typeof value === "object") {
+		const out: Record<string, unknown> = {};
+		for (const [key, nested] of Object.entries(value)) {
+			out[key] = deepNeutralizeReservedControlTokens(nested);
+		}
+		return out;
+	}
+	return value;
+}
+
 function stringifyResponsesStringParamForReplay(value: unknown): string {
-	if (typeof value === "string") return value.toWellFormed();
+	if (typeof value === "string") return neutralizeReservedControlTokens(value.toWellFormed());
 	try {
 		const encoded = JSON.stringify(value);
-		if (typeof encoded === "string") return encoded.toWellFormed();
+		if (typeof encoded === "string") return neutralizeReservedControlTokens(encoded.toWellFormed());
 	} catch {
 		// Fall through to String().
 	}
-	return String(value ?? "").toWellFormed();
+	return neutralizeReservedControlTokens(String(value ?? "").toWellFormed());
 }
 
 function normalizeResponsesMessageTextForReplay(value: unknown): string {
-	if (typeof value === "string") return value.toWellFormed();
+	if (typeof value === "string") return neutralizeReservedControlTokens(value.toWellFormed());
 	if (value && typeof value === "object") {
 		const nestedText = (value as { text?: unknown }).text;
-		if (typeof nestedText === "string") return nestedText.toWellFormed();
+		if (typeof nestedText === "string") return neutralizeReservedControlTokens(nestedText.toWellFormed());
 	}
 	return stringifyResponsesStringParamForReplay(value);
 }
@@ -163,7 +209,7 @@ function normalizeResponsesImageUrlForReplay(value: unknown): NormalizedResponse
 }
 
 function sanitizeResponsesMessageContentForReplay(content: unknown): unknown {
-	if (typeof content === "string") return content.toWellFormed();
+	if (typeof content === "string") return neutralizeReservedControlTokens(content.toWellFormed());
 	if (!Array.isArray(content)) return content;
 	return content.map(part => {
 		if (!part || typeof part !== "object") return part;
@@ -197,12 +243,11 @@ function sanitizeResponsesStringFieldsForReplay(item: Record<string, unknown>):
 	if (item.type === "custom_tool_call" && "input" in item && typeof item.input !== "string") {
 		item.input = stringifyResponsesStringParamForReplay(item.input);
 	}
-	if (
-		(item.type === "function_call_output" || item.type === "custom_tool_call_output") &&
-		"output" in item &&
-		typeof item.output !== "string"
-	) {
-		item.output = stringifyResponsesStringParamForReplay(item.output);
+	if ((item.type === "function_call_output" || item.type === "custom_tool_call_output") && "output" in item) {
+		item.output =
+			typeof item.output === "string"
+				? neutralizeReservedControlTokens(item.output.toWellFormed())
+				: stringifyResponsesStringParamForReplay(item.output);
 	}
 }