@yansigit/opencodex 2.31.0

package/src/server/responses/empty-completion-guard.ts

@@ -0,0 +1,276 @@
+import type { AdapterEvent, OcxConfig, OcxUsage } from "../../types";
+
+/**
+ * Empty-completion guard for Responses turns (port of codex-router's
+ * empty-completion-guard + single retry, PR #145).
+ *
+ * Failure mode: the upstream answers 200 and completes the turn but never
+ * produced output text or a tool call (a reasoning-only stream that ends with
+ * nothing is the canonical shape). The client has no code path for "the model
+ * said nothing", so it silently records the turn as done — the "random stop"
+ * nobody can explain. The guard holds pre-content events (reasoning deltas
+ * are deliberately NOT content), and when a terminal event arrives with no
+ * content it suppresses the terminal and retries the IDENTICAL turn once
+ * (same request bytes, same headers). If the retry is also empty — or fails
+ * upstream — the client sees a stated failure instead of a second silent
+ * success.
+ *
+ * The retry is explicitly enabled by top-level config. The environment switch
+ * is a disable-only emergency override: OCX_EMPTY_COMPLETION_RETRY=0 restores
+ * the previous relay behavior without editing the persisted config.
+ */
+export const EMPTY_COMPLETION_RETRY_ENV = "OCX_EMPTY_COMPLETION_RETRY";
+
+/** Retained pre-content events are bounded independently by count and encoded size. */
+export const EMPTY_COMPLETION_MAX_BUFFERED_EVENTS = 1_024;
+export const EMPTY_COMPLETION_MAX_BUFFERED_BYTES = 1_048_576;
+
+export function emptyCompletionRetryEnabled(
+  config: Pick<OcxConfig, "emptyCompletionRetry">,
+  env: Record<string, string | undefined> = process.env,
+): boolean {
+  return config.emptyCompletionRetry === true && env[EMPTY_COMPLETION_RETRY_ENV] !== "0";
+}
+
+/** Surfaced when the single retry was also empty or failed upstream. */
+export const EMPTY_COMPLETION_RETRY_FAILED_CODE = "empty_completion_retry_failed";
+
+/**
+ * Terminal stop reasons the bridge renders as a visible `response.incomplete`
+ * (max_tokens / content_filter). Those are already a stated failure, not the
+ * silent empty success this guard exists to catch, and retrying the identical
+ * request would burn tokens for the same truncated result.
+ */
+const VISIBLE_INCOMPLETE_STOP_REASONS = new Set(["max_tokens", "content_filter"]);
+const UTF8_ENCODER = new TextEncoder();
+
+function retainedEventBytes(event: AdapterEvent): number {
+  return UTF8_ENCODER.encode(JSON.stringify(event)).byteLength;
+}
+
+function isReasoningEvent(event: AdapterEvent): boolean {
+  return event.type === "thinking_delta"
+    || event.type === "thinking_signature"
+    || event.type === "redacted_thinking"
+    || event.type === "kiro_redacted_reasoning"
+    || event.type === "reasoning_raw_delta";
+}
+
+function isTerminalEvent(
+  event: AdapterEvent,
+): event is Extract<AdapterEvent, { type: "done" | "incomplete" | "error" }> {
+  return event.type === "done" || event.type === "incomplete" || event.type === "error";
+}
+
+/**
+ * Content means something the client can act on: output text or a tool call
+ * (web-search cells included). Reasoning deltas are deliberately not content —
+ * a turn that streams only reasoning and then completes with nothing is
+ * exactly the empty completion this guard exists to catch. Empty text deltas
+ * (some batch adapters always carry `""`) are not content either.
+ */
+export function isContentEvent(event: AdapterEvent): boolean {
+  switch (event.type) {
+    case "text_delta":
+      return event.text.length > 0;
+    case "tool_call_start":
+    case "tool_call_delta":
+    case "tool_call_end":
+    case "web_search_call_begin":
+    case "web_search_call_end":
+      return true;
+    default:
+      return false;
+  }
+}
+
+export function emptyCompletionRetryFailedEvent(
+  usage?: OcxUsage,
+  retryFailedUpstream = false,
+): Extract<AdapterEvent, { type: "error" }> {
+  return {
+    type: "error",
+    status: 502,
+    errorType: "upstream_error",
+    code: EMPTY_COMPLETION_RETRY_FAILED_CODE,
+    message: retryFailedUpstream
+      ? "The model returned an empty completion and the retry failed upstream."
+      : "The model returned an empty completion. opencodex retried once and the completion was empty again.",
+    ...(usage ? { usage } : {}),
+  };
+}
+
+/**
+ * Sum two usage snapshots. Same semantics as terminal-guard's mergeUsage and
+ * request-log's aggregateAttemptUsage: token totals add across the attempts;
+ * `estimated` wins when either attempt only estimated.
+ */
+export function mergeUsage(
+  first: OcxUsage | undefined,
+  second: OcxUsage | undefined,
+): OcxUsage | undefined {
+  if (!first) return second;
+  if (!second) return first;
+  const sumOptional = (key: keyof OcxUsage): number | undefined => {
+    const left = first[key];
+    const right = second[key];
+    return typeof left === "number" || typeof right === "number"
+      ? (typeof left === "number" ? left : 0) + (typeof right === "number" ? right : 0)
+      : undefined;
+  };
+  const cachedInputTokens = sumOptional("cachedInputTokens");
+  const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
+  const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
+  const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
+  const contextTotalTokens = second.contextTotalTokens ?? first.contextTotalTokens;
+  const inputTokens = first.inputTokens + second.inputTokens;
+  const outputTokens = first.outputTokens + second.outputTokens;
+  return {
+    inputTokens,
+    outputTokens,
+    totalTokens: inputTokens + outputTokens,
+    ...(contextTotalTokens !== undefined ? { contextTotalTokens } : {}),
+    ...(cachedInputTokens !== undefined ? { cachedInputTokens } : {}),
+    ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
+    ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
+    ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
+    ...(first.estimated || second.estimated ? { estimated: true } : {}),
+  };
+}
+
+export interface EmptyCompletionGuardOptions {
+  firstEvents: AsyncIterable<AdapterEvent>;
+  /**
+   * Re-run the IDENTICAL turn: same request body, same headers, same signal.
+   * Receives no arguments — the request must not be modified between attempts.
+   */
+  continuation: () => AsyncIterable<AdapterEvent> | Promise<AsyncIterable<AdapterEvent>>;
+  /** How many times an empty completion is retried; default 1 (the router's single retry). */
+  maxRetries?: number;
+}
+
+/**
+ * Watch an adapter event stream for the empty-completion failure mode. Events
+ * are held until the turn produces content or ends: reasoning and other
+ * pre-content events stay buffered (released in order on first content), the
+ * terminal is withheld, and an empty terminal triggers one identical-turn
+ * retry through `continuation`. Usage is merged across attempts so the bridge
+ * and request log meter the whole turn, not just the attempt that succeeded.
+ *
+ * Heartbeats always pass through untouched: they feed the bridge's stall
+ * watchdog, so holding them behind the content gate would trip false
+ * upstream_stall_timeout failures on slow reasoning-only turns.
+ */
+export async function* guardEmptyCompletionEventStream(
+  options: EmptyCompletionGuardOptions,
+): AsyncGenerator<AdapterEvent> {
+  const maxRetries = Math.max(0, Math.floor(options.maxRetries ?? 1));
+  let source = options.firstEvents;
+  let held: AdapterEvent[] = [];
+  let heldBytes = 0;
+  let sawContent = false;
+  let passthrough = false;
+  let retries = 0;
+  let usage: OcxUsage | undefined;
+
+  const withUsage = (event: AdapterEvent & { usage?: OcxUsage }): AdapterEvent => {
+    const merged = mergeUsage(usage, event.usage);
+    return merged ? { ...event, ...(merged ? { usage: merged } : {}) } : event;
+  };
+  const releaseHeld = (): AdapterEvent[] => {
+    const released = held;
+    held = [];
+    heldBytes = 0;
+    return released;
+  };
+
+  while (true) {
+    let terminalSeen = false;
+    for await (const event of source) {
+      if (event.type === "heartbeat") {
+        yield event;
+        continue;
+      }
+      if (sawContent || passthrough) {
+        // Buffered content is already flowing; everything downstream passes
+        // through. Every terminal carries usage merged across every attempt.
+        yield isTerminalEvent(event) ? withUsage(event) : event;
+        continue;
+      }
+      if (isContentEvent(event)) {
+        sawContent = true;
+        yield* releaseHeld();
+        yield event;
+        continue;
+      }
+      if (event.type === "done") {
+        usage = mergeUsage(usage, event.usage);
+        if (event.stopReason !== undefined && VISIBLE_INCOMPLETE_STOP_REASONS.has(event.stopReason)) {
+          // Rendered as response.incomplete: a stated failure, not the silent
+          // empty success this guard exists to catch.
+          yield* releaseHeld();
+          yield { ...event, ...(usage ? { usage } : {}) };
+          return;
+        }
+        if (retries < maxRetries) {
+          // Suppress the terminal: the client must never see a completed event
+          // for a turn that produced nothing. Retry the identical turn.
+          retries += 1;
+          try {
+            source = await options.continuation();
+          } catch {
+            yield emptyCompletionRetryFailedEvent(usage, true);
+            return;
+          }
+          terminalSeen = true;
+          break;
+        }
+        // The retry was also empty: a stated failure, not a second silent
+        // success.
+        yield emptyCompletionRetryFailedEvent(usage);
+        return;
+      }
+      if (event.type === "error") {
+        if (retries > 0 && event.status !== 499) {
+          // The retry failed upstream. Its body cannot reach the client (the
+          // 200 head went out with the first attempt), so state the failure in
+          // the stream's own error framing — same move as the router's
+          // empty_completion_retry_failed. Client cancels (499) pass through.
+          yield emptyCompletionRetryFailedEvent(mergeUsage(usage, event.usage), true);
+          return;
+        }
+        yield* releaseHeld();
+        yield withUsage(event);
+        return;
+      }
+      if (event.type === "incomplete") {
+        // A structured incomplete is already a visible failure; never convert
+        // it into an empty completion.
+        yield* releaseHeld();
+        yield withUsage(event);
+        return;
+      }
+      const eventBytes = retainedEventBytes(event);
+      if (held.length + 1 > EMPTY_COMPLETION_MAX_BUFFERED_EVENTS
+        || heldBytes + eventBytes > EMPTY_COMPLETION_MAX_BUFFERED_BYTES) {
+        // Preserve data rather than retaining without bound: release the prefix,
+        // emit this event, and stop attempting an empty-completion retry for the turn.
+        yield* releaseHeld();
+        yield event;
+        passthrough = true;
+        continue;
+      }
+      held.push(event);
+      heldBytes += eventBytes;
+      // The bridge watchdog sees only yielded events. Feed it while reasoning is
+      // held so a long reasoning-only prefix remains live without exposing it early.
+      if (isReasoningEvent(event)) yield { type: "heartbeat" };
+    }
+    if (!terminalSeen) {
+      // The source ended without a terminal event (truncated stream). Release
+      // what was held so the bridge can mark the stream incomplete.
+      yield* releaseHeld();
+      return;
+    }
+  }
+}

package/src/server/responses/encrypted-payload.ts

@@ -0,0 +1,331 @@
+import type { Server } from "bun";
+import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type ResponsesTerminalStatus } from "../../bridge";
+import {
+  getConfigPath,
+  multiAgentGuidanceEnabled,
+  resolveEnvValue,
+} from "../../config";
+import { parseRequest } from "../../responses/parser";
+import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractCompactUserMessages } from "../../responses/compaction";
+import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../../adapters/openai-responses";
+import { expandPreviousResponseInput, previousResponseProviderState, rememberResponseState } from "../../responses/state";
+import { routeModel } from "../../router";
+import {
+  advanceComboAfterFailure,
+  comboDefaultEffort,
+  comboFailureDecision,
+  comboIdFromRawBody,
+  concreteComboRequestBody,
+  getCombo,
+  isComboTargetInCooldown,
+  NoAvailableComboTargetsError,
+  noteComboSuccess,
+  parseRetryAfterMs,
+  pickComboTarget,
+  targetKey,
+} from "../../combos";
+import { isInjectionDebugEnabled } from "../../lib/debug-settings";
+import { injectionDebugLog } from "../../lib/injection-debug-log";
+import { modelInList, namespacedToolName } from "../../types";
+import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../../types";
+import {
+  forceRefreshOAuthAccessSnapshot,
+  getOAuthCredentialApiBaseUrl,
+  getOAuthCredentialProjectId,
+  getValidAccessTokenSnapshot,
+  type OAuthAccessSnapshot,
+  UnsupportedOAuthProviderError,
+} from "../../oauth";
+import { buildWebSearchTool, planWebSearch, runWithWebSearch, shouldResolveOpenAiWebSearchSidecar } from "../../web-search";
+import { describeImagesInPlace, planVisionSidecar, shouldResolveOpenAiVisionSidecar, stripImagesInPlace } from "../../vision";
+import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/run-turn-queue";
+import {
+  applyCodexAuthContextToProvider,
+  CodexAccountCooldownError,
+  CodexAuthContextError,
+  CodexDirectAuthenticationError,
+  CodexPoolAuthenticationError,
+  CodexThreadAffinityExpiredError,
+  headersForCodexAuthContext,
+  isCodexAuthContextUsable,
+  resolveCodexAuthContext,
+  type CodexAuthContext,
+} from "../../codex/auth-context";
+import {
+  formatCodexProviderForLog,
+  recordCodexUpstreamOutcome,
+  type CodexUpstreamOutcome,
+} from "../../codex/routing";
+import { fetchWithResetRetry, fetchWithTransientRetry, applyUpstreamRecoveryInit } from "../../lib/upstream-retry";
+import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "../auth-cors";
+import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
+import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { slugsEquivalent } from "../../providers/slug-codec";
+import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
+import { isUsageDebugEnabled } from "../../usage/debug";
+import { readJsonRequestBody, DecompressedBodyTooLargeError, UnsupportedContentEncodingError } from "../request-decompress";
+import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
+import { hasKeyPoolFailover, rotateProviderTransportOn429 } from "../../providers/key-failover";
+import { shouldAttemptImageTierRetry } from "../image-retry";
+import { resolveProviderTransport } from "../../providers/xai-transport";
+import type { WsData } from "../ws-bridge";
+import { registerTurn, trackStreamLifetime, unregisterTurn } from "../lifecycle";
+import { redactSecretString } from "../../lib/redact";
+import { readBoundedResponseBody } from "../../lib/bounded-body";
+import { supportedLadderFor } from "../effort-policy";
+import {
+  beginRequestAttempt,
+  catalogModelSupportsServiceTier,
+  finishRequestAttempt,
+  inspectResponseLogJson,
+  noteAttemptSend,
+  readConfiguredCodexServiceTier,
+  requestLogSpeedLabel,
+  sealRequestAttemptIdentity,
+  usageFromResponsesPayload,
+  type RequestLogContext,
+} from "../request-log";
+import type { AttemptRecoveryKind } from "../../usage/log";
+import {
+  consumeForInspection,
+  consumeForResponseLogMetadata,
+  markNativePassthroughSseResponse,
+  relaySseWithFailedTail,
+  relayWithAbort,
+  sanitizePassthroughHeaders,
+} from "../relay";
+import { hasResponsesItemIdRepair, relaySseWithResponsesItemIdRepair } from "../responses-item-id-repair";
+import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/catalog";
+
+
+export function looksLikeBackendCiphertext(payload: string): boolean {
+  return payload.length >= 64 && /^[A-Za-z0-9+/=_-]+$/.test(payload);
+}
+
+
+
+/**
+ * Backend-minted ciphertext runs are Fernet tokens (base64url, version byte 0x80).
+ * Used to carve embedded blobs out of MIXED slots: plugin hooks may prepend
+ * plaintext control metadata to a task body that is already backend-encrypted.
+ */
+const FERNET_TOKEN_CANDIDATE = /g[A-Za-z0-9_-]{97,}={0,2}/g;
+const FERNET_TOKEN_BOUNDARY_CHAR = /[A-Za-z0-9_=-]/;
+
+interface FernetTokenRun {
+  index: number;
+  token: string;
+}
+
+/**
+ * Validate only the key-independent Fernet wire structure. Authenticity cannot be
+ * checked without the backend key, but a real token must still be canonical base64url
+ * containing version(1) + timestamp(8) + IV(16) + AES-CBC ciphertext(16*n) + HMAC(32).
+ * Timestamp freshness is deliberately not enforced: old history can contain valid tokens.
+ */
+function isStructurallyValidFernetToken(token: string): boolean {
+  if (token.length < 100 || token.length % 4 !== 0) return false;
+  if (!/^[A-Za-z0-9_-]+={0,2}$/.test(token)) return false;
+
+  const unpadded = token.replace(/=+$/, "");
+  const paddingLength = token.length - unpadded.length;
+  const expectedPadding = (4 - (unpadded.length % 4)) % 4;
+  if (expectedPadding > 2 || paddingLength !== expectedPadding) return false;
+
+  let decoded: Buffer;
+  try {
+    decoded = Buffer.from(unpadded, "base64url");
+  } catch {
+    return false;
+  }
+  if (decoded.toString("base64url") !== unpadded) return false;
+  if (decoded.length < 73 || decoded[0] !== 0x80) return false;
+
+  const ciphertextLength = decoded.length - 57;
+  return ciphertextLength >= 16 && ciphertextLength % 16 === 0;
+}
+
+export function structurallyValidFernetTokens(payload: string): string[] {
+  return fernetTokenRuns(payload).map(run => run.token);
+}
+
+/** Maximal, boundary-delimited and structurally valid Fernet runs embedded in a slot. */
+function fernetTokenRuns(payload: string): FernetTokenRun[] {
+  const runs: FernetTokenRun[] = [];
+  for (const match of payload.matchAll(FERNET_TOKEN_CANDIDATE)) {
+    const index = match.index ?? 0;
+    const token = match[0];
+    const before = index > 0 ? payload[index - 1] : undefined;
+    const after = payload[index + token.length];
+    if (before && FERNET_TOKEN_BOUNDARY_CHAR.test(before)) continue;
+    if (after && FERNET_TOKEN_BOUNDARY_CHAR.test(after)) continue;
+    if (!isStructurallyValidFernetToken(token)) continue;
+    runs.push({ index, token });
+  }
+  return runs;
+}
+
+function textWithoutFernetRuns(payload: string, runs: readonly FernetTokenRun[]): string {
+  let last = 0;
+  let text = "";
+  for (const run of runs) {
+    text += `${payload.slice(last, run.index)}\n\n`;
+    last = run.index + run.token.length;
+  }
+  return `${text}${payload.slice(last)}`;
+}
+
+export const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*NEW_TASK[^\n]*\nTask name\s*:[^\n]*\nSender\s*:[^\n]*\nPayload\s*:\s*(?:\n|$)/gi;
+
+// CXC is the compatibility-hook control namespace. Strip only the tagged paragraph:
+// later untagged paragraphs may be genuine task text. Repeated CXC paragraphs are
+// removed independently, and a following routing envelope remains available to the
+// envelope stripper below.
+export const AGENT_MESSAGE_CONTROL_PREAMBLE = /(?:^|\n)\[CXC-[A-Z0-9-]+\][^\n]*(?:\n(?!\n|Message Type\s*:)[^\n]*)*(?=\n{2,}|\nMessage Type\s*:|$)/gi;
+
+export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
+  if (!Array.isArray(input)) return false;
+
+  // codex-rs appends one NEW_TASK agent_message at the current input tail. Historical
+  // agent messages may be adjacent in full-history bodies; they must not poison the
+  // later task. compaction_trigger/additional_tools are trailing metadata rather than
+  // a newer user turn.
+  let index = input.length - 1;
+  while (index >= 0) {
+    const item = input[index];
+    const type = item && typeof item === "object" ? (item as { type?: unknown }).type : undefined;
+    if (type !== "compaction_trigger" && type !== "additional_tools") break;
+    index -= 1;
+  }
+  const item = input[index];
+  if (!item || typeof item !== "object" || (item as { type?: unknown }).type !== "agent_message") {
+    return false;
+  }
+
+  const content = (item as { content?: unknown }).content;
+  if (!Array.isArray(content)) return false;
+
+  let hasFernetTask = false;
+  const readableParts: string[] = [];
+  for (const part of content) {
+    if (!part || typeof part !== "object") continue;
+    const record = part as { type?: unknown; text?: unknown; encrypted_content?: unknown };
+    if (
+      (record.type === "input_text" || record.type === "text")
+      && typeof record.text === "string"
+    ) {
+      readableParts.push(record.text);
+      continue;
+    }
+    if (record.type !== "encrypted_content" || typeof record.encrypted_content !== "string") {
+      continue;
+    }
+
+    const runs = fernetTokenRuns(record.encrypted_content);
+    if (runs.length > 0) hasFernetTask = true;
+    readableParts.push(textWithoutFernetRuns(record.encrypted_content, runs));
+  }
+
+  if (!hasFernetTask) return false;
+  const readableTask = readableParts
+    .join("\n\n")
+    .replace(AGENT_MESSAGE_CONTROL_PREAMBLE, "\n")
+    .replace(AGENT_MESSAGE_ROUTING_ENVELOPE, "\n")
+    .trim();
+  return readableTask.length === 0;
+}
+
+
+
+export function encryptedSlotParts(payload: string): Array<Record<string, string>> {
+  const parts: Array<Record<string, string>> = [];
+  let last = 0;
+  for (const run of fernetTokenRuns(payload)) {
+    const before = payload.slice(last, run.index);
+    if (before.trim().length > 0) parts.push({ type: "input_text", text: before });
+    parts.push({ type: "encrypted_content", encrypted_content: run.token });
+    last = run.index + run.token.length;
+  }
+  const rest = payload.slice(last);
+  if (rest.trim().length > 0) parts.push({ type: "input_text", text: rest });
+  return parts.length > 0 ? parts : [{ type: "input_text", text: payload }];
+}
+
+
+
+export function hasEncryptedContentPart(content: unknown): boolean {
+  return Array.isArray(content) && content.some(part => (
+    part && typeof part === "object"
+    && (part as { type?: unknown }).type === "encrypted_content"
+  ));
+}
+
+
+
+export function sanitizeEncryptedContentInPlace(input: unknown): number {
+  if (!Array.isArray(input)) return 0;
+  let rewritten = 0;
+  type VisitFrame =
+    | { kind: "visit"; node: unknown }
+    | { kind: "array"; node: unknown[]; index: number }
+    | { kind: "object"; values: unknown[]; index: number }
+    | { kind: "agent"; message: Record<string, unknown>; rewrittenBefore: number };
+  const stack: VisitFrame[] = [{ kind: "visit", node: input }];
+
+  while (stack.length > 0) {
+    const frame = stack.pop()!;
+    if (frame.kind === "visit") {
+      if (Array.isArray(frame.node)) {
+        stack.push({ kind: "array", node: frame.node, index: 0 });
+      } else if (frame.node && typeof frame.node === "object") {
+        stack.push({ kind: "object", values: Object.values(frame.node), index: 0 });
+      }
+      continue;
+    }
+
+    if (frame.kind === "array") {
+      if (frame.index >= frame.node.length) continue;
+      const child = frame.node[frame.index] as unknown;
+      if (
+        child && typeof child === "object"
+        && (child as { type?: unknown }).type === "encrypted_content"
+        && typeof (child as { encrypted_content?: unknown }).encrypted_content === "string"
+      ) {
+        const payload = (child as { encrypted_content: string }).encrypted_content;
+        if (!looksLikeBackendCiphertext(payload)) {
+          const parts = encryptedSlotParts(payload);
+          frame.node.splice(frame.index, 1, ...parts);
+          rewritten += 1;
+          stack.push({ kind: "array", node: frame.node, index: frame.index + parts.length });
+          continue;
+        }
+      }
+      stack.push({ kind: "array", node: frame.node, index: frame.index + 1 });
+      if (child && typeof child === "object" && (child as { type?: unknown }).type === "agent_message") {
+        stack.push({ kind: "agent", message: child as Record<string, unknown>, rewrittenBefore: rewritten });
+      }
+      stack.push({ kind: "visit", node: child });
+      continue;
+    }
+
+    if (frame.kind === "object") {
+      if (frame.index >= frame.values.length) continue;
+      stack.push({ kind: "object", values: frame.values, index: frame.index + 1 });
+      stack.push({ kind: "visit", node: frame.values[frame.index] });
+      continue;
+    }
+
+    if (
+      rewritten > frame.rewrittenBefore
+      && frame.message.type === "agent_message"
+      && !hasEncryptedContentPart(frame.message.content)
+    ) {
+      frame.message.type = "message";
+      frame.message.role = "user";
+      delete frame.message.id;
+      delete frame.message.author;
+      delete frame.message.recipient;
+    }
+  }
+  return rewritten;
+}