clauderipple 0.9.3 → 0.9.5

package/dist/router/src/providers/openai/translate.js

@@ -5,6 +5,14 @@ import crypto from "node:crypto";
 import { clampEffort } from "../../compat.js";
 import { conversationKey, estimateTokens, normalizeSchema, serverToolNames, systemWithDroppedToolNote, toolNameForResponses } from "../chatgpt/translate.js";
 import { identityPrefix, instructionsSuffix } from "../../identity.js";
+import { encodeEnvelope, envelopeFor, replayableReasoning } from "../../reasoning.js";
+/** Counts a replay outcome, creating the tally the adapter reports from when it is the first. */
+function bump(opts, kind, by = 1) {
+    if (!opts)
+        return;
+    const carried = opts.carried ?? (opts.carried = { replayed: 0, undecodable: 0 });
+    carried[kind] += by;
+}
 function textOf(content) {
     if (typeof content === "string")
         return content;
@@ -104,6 +112,14 @@ export function toChatMessages(req, opts) {
         if (role === "assistant") {
             const text = [];
             const calls = [];
+            // The reasoning this turn came back with, rejoined into one string and sent as
+            // `reasoning_content` on the same assistant message — the shape DeepSeek's own example builds
+            // by appending the whole response message, and the only shape its API documents. The field
+            // name is the one the vendor sent it under, carried in the envelope: a model heard on
+            // `reasoning` is answered on `reasoning` (reasoning.ts).
+            const reasoning = [];
+            let field = "reasoning_content";
+            let carriedHere = 0;
             for (const block of message.content) {
                 if (block.type === "text")
                     text.push(String(block.text ?? ""));
@@ -112,9 +128,31 @@ export function toChatMessages(req, opts) {
                     knownCalls.add(call.id);
                     calls.push({ id: call.id, type: "function", function: { name: toolNameForResponses(call.name), arguments: typeof call.input === "string" ? call.input : JSON.stringify(call.input ?? {}) } });
                 }
+                const envelope = envelopeFor(block, "chat", opts?.env, (reason) => {
+                    bump(opts, "undecodable");
+                    if (opts?.replay !== false)
+                        opts?.log?.(`dropped a reasoning carrier: ${reason}`);
+                });
+                if (!envelope || opts?.replay === false)
+                    continue;
+                const held = block.thinking;
+                if (typeof held === "string" && held.length > 0)
+                    reasoning.push(held);
+                field = envelope.f === "reasoning" ? "reasoning" : "reasoning_content";
+                carriedHere++;
+            }
+            if (carriedHere > 0)
+                bump(opts, "replayed", carriedHere);
+            // A turn whose only content was reasoning is still a turn the model had: it goes out with the
+            // reasoning alone rather than vanishing, which is what dropping thinking did before.
+            if (text.some(Boolean) || calls.length || reasoning.length) {
+                messages.push({
+                    role: "assistant",
+                    content: text.join("\n") || null,
+                    ...(calls.length ? { tool_calls: calls } : {}),
+                    ...(reasoning.length ? (field === "reasoning" ? { reasoning: reasoning.join("\n\n") } : { reasoning_content: reasoning.join("\n\n") }) : {}),
+                });
             }
-            if (text.some(Boolean) || calls.length)
-                messages.push({ role: "assistant", content: text.join("\n") || null, ...(calls.length ? { tool_calls: calls } : {}) });
             continue;
         }
         let parts = [];
@@ -158,9 +196,16 @@ export function toChatMessages(req, opts) {
     return messages;
 }
 /** Translate to the stateless OpenAI Responses input grammar. */
-export function toResponsesInput(req) {
+export function toResponsesInput(req, opts) {
     const input = [];
     const knownCalls = new Set();
+    let lastCallId;
+    // A translation with no options is a translation with nothing to say about reasoning: there is no
+    // provider to name in an envelope and no model to check it against, so nothing is carried either
+    // way. `opts` is only consulted when it is there.
+    const carried = (count) => {
+        bump(opts, count);
+    };
     for (const message of req.messages) {
         const role = message.role === "assistant" ? "assistant" : "user";
         if (typeof message.content === "string") {
@@ -177,6 +222,27 @@ export function toResponsesInput(req) {
             parts = [];
         };
         for (const block of message.content) {
+            // A reasoning item this conversation came back with, in the position it was replayed from —
+            // beside the function calls of that turn, and never for the other wire's carrier (reasoning.ts).
+            const envelope = envelopeFor(block, "responses", opts?.env, (reason) => {
+                carried("undecodable");
+                if (opts?.replay !== false)
+                    opts?.log?.(`dropped a reasoning carrier: ${reason}`);
+            });
+            if (envelope) {
+                if (opts?.replay !== false) {
+                    const item = replayableReasoning(envelope.r);
+                    if (item) {
+                        flush();
+                        input.push(item);
+                        carried("replayed");
+                        opts?.onArrival?.(item, lastCallId);
+                    }
+                    else
+                        carried("undecodable");
+                }
+                continue;
+            }
             if (block.type === "text") {
                 const text = String(block.text ?? "");
                 if (text)
@@ -191,6 +257,7 @@ export function toResponsesInput(req) {
                 flush();
                 const call = block;
                 knownCalls.add(call.id);
+                lastCallId = call.id;
                 input.push({ type: "function_call", call_id: call.id, name: toolNameForResponses(call.name), arguments: typeof call.input === "string" ? call.input : JSON.stringify(call.input ?? {}) });
             }
             else if (block.type === "tool_result") {
@@ -243,11 +310,18 @@ export function toOpenAiRequest(req, opts) {
         return out;
     }
     const responseTools = tools.map(({ function: fn }) => ({ type: "function", ...fn }));
+    const input = toResponsesInput(req, opts);
     const out = {
         model: opts.model,
-        input: toResponsesInput(req),
+        input,
         stream: true,
     };
+    // A vendor marked `sealedReasoning` is asked for its reasoning on every turn, the way OpenCode's own
+    // client asks: asking only once a conversation already carried some would never start one on a
+    // vendor that seals nothing unasked. Anyone else is asked only when the conversation is already
+    // carrying its reasoning, so a request for a vendor never measured stays as it was.
+    if (opts.replay !== false && (opts.sealedReasoning || input.some((item) => item.type === "reasoning")))
+        out.include = ["reasoning.encrypted_content"];
     const instructions = systemWithIdentity(systemWithDroppedToolNote(req), opts);
     if (instructions)
         out.instructions = instructions;
@@ -268,7 +342,7 @@ export function toOpenAiRequest(req, opts) {
     if (typeof req.temperature === "number")
         out.temperature = req.temperature;
     if (effort)
-        out.reasoning = { effort };
+        out.reasoning = opts.sealedReasoning && opts.replay !== false ? { effort, summary: "auto" } : { effort };
     return out;
 }
 export { conversationKey, estimateTokens };
@@ -277,26 +351,43 @@ export class OpenAiStreamMapper {
     started = false;
     finished = false;
     blockIndex = -1;
+    /** `block` is the content entry this block writes into; `signature` seals a Responses item. */
     open = null;
     sawTool = false;
     finishReason;
     responseItems = [];
     responseItemsById = new Map();
+    /** Reasoning items of a Responses stream, by item id, until the item that carries one is done. */
+    reasoningItems = new Map();
+    /** The item id of the most recent function_call, which is what a following reasoning describes. */
+    lastCallId;
+    /** The field a Chat vendor's reasoning arrived under; the same one it is replayed under. */
+    chatReasoningField = "reasoning_content";
     messageId = `msg_${crypto.randomBytes(12).toString("hex")}`;
     servedTier;
     content = [];
     usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 };
     stopReason = "end_turn";
+    /** How many reasoning items this response handed over whole. The `reasoning=` figure in the log. */
+    reasoningCount = 0;
     model;
     startInput;
     /** Mangled tool name → the name Claude Code knows, from `toolNameRestoreMap`. */
     toolNames;
+    /** What goes in each envelope: the provider and model this stream is going to (reasoning.ts). */
+    env;
+    /**
+     * The wire this stream is on. It is fixed for the mapper's life — the adapter knows it before the
+     * first event. Decides what a closing block does: on Chat the block itself is the carrier.
+     */
+    wire = "chat";
     /** Applied to every error message before it is stored or sent. */
     redactError = (message) => message;
-    constructor(model, startInput = 0, toolNames = new Map()) {
+    constructor(model, startInput = 0, toolNames = new Map(), env = { p: "", m: "" }) {
         this.model = model;
         this.startInput = startInput;
         this.toolNames = toolNames;
+        this.env = { p: env.p, m: env.m || model };
     }
     get isFinished() { return this.finished; }
     /**
@@ -315,17 +406,40 @@ export class OpenAiStreamMapper {
         this.started = true;
         return [{ event: "message_start", data: { type: "message_start", message: { id: this.messageId, type: "message", role: "assistant", model: this.model, content: [], stop_reason: null, stop_sequence: null, usage: { input_tokens: this.startInput, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 } } } }];
     }
+    /**
+     * Close the block that is open, writing any envelope it carries as a `signature_delta` first — last
+     * in the block, after all of its text, the order Anthropic's own thinking blocks use.
+     *
+     * A Chat reasoning block is sealed here, because only now is its text whole; a Responses one was
+     * sealed by its item (see `sealReasoningItem`) before this is reached, so it never gets here
+     * unsigned.
+     */
     closeBlock() {
         if (!this.open)
             return [];
-        const index = this.open.index;
+        const { index, kind, block } = this.open;
+        let signature = this.open.signature;
+        if (signature === undefined && kind === "thinking" && this.wire === "chat") {
+            signature = this.signatureForChat(block);
+        }
         this.open = null;
-        return [{ event: "content_block_stop", data: { type: "content_block_stop", index } }];
+        const out = [];
+        if (signature !== undefined)
+            out.push({ event: "content_block_delta", data: { type: "content_block_delta", index, delta: { type: "signature_delta", signature } } });
+        out.push({ event: "content_block_stop", data: { type: "content_block_stop", index } });
+        return out;
     }
-    openBlock(kind, contentBlock, toolIndex) {
+    /**
+     * `block` is the caller's entry in `this.content` for this block, when it has one. It is held here
+     * rather than found as the last entry, because a Chat caller pushes the entry it is about to open
+     * *before* calling this — which would close the block against the wrong entry.
+     */
+    openBlock(kind, contentBlock, toolIndex, block) {
         const out = this.closeBlock();
         const index = ++this.blockIndex;
-        this.open = { kind, index, ...(toolIndex === undefined ? {} : { toolIndex }) };
+        if (block !== undefined)
+            this.content.push(block);
+        this.open = { kind, index, ...(toolIndex === undefined ? {} : { toolIndex }), ...(block === undefined ? {} : { block }) };
         out.push({ event: "content_block_start", data: { type: "content_block_start", index, content_block: contentBlock } });
         return out;
     }
@@ -371,27 +485,34 @@ export class OpenAiStreamMapper {
         for (const choice of choices) {
             const delta = choice.delta ?? {};
             // Thinking arrives before the answer, so it opens the first block of the turn. `reasoning` is
-            // accepted alongside `reasoning_content` because vendors on this wire disagree on the name.
-            const reasoning = typeof delta.reasoning_content === "string" && delta.reasoning_content ? delta.reasoning_content
-                : typeof delta.reasoning === "string" && delta.reasoning ? delta.reasoning : "";
+            // accepted alongside `reasoning_content` because vendors on this wire disagree on the name;
+            // the name it arrived under is remembered, because the same name is what the reasoning has to
+            // be replayed under on the next turn (reasoning.ts).
+            const field = typeof delta.reasoning_content === "string" && delta.reasoning_content ? "reasoning_content"
+                : typeof delta.reasoning === "string" && delta.reasoning ? "reasoning" : null;
+            const reasoning = field === "reasoning_content" ? delta.reasoning_content : field === "reasoning" ? delta.reasoning : "";
+            if (field)
+                this.chatReasoningField = field;
             if (reasoning) {
                 if (!this.open || this.open.kind !== "thinking") {
-                    this.content.push({ type: "thinking", thinking: "" });
-                    out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
+                    // A Chat model's reasoning has no sealed blob to resume from, so the carrier is the block
+                    // itself: the block's text is the reasoning to replay, and its signature is the envelope
+                    // naming the field to replay it under (reasoning.ts). It is sealed when the block closes,
+                    // so the envelope is built once the whole string has arrived (see `signatureForChat`).
+                    out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }, undefined, { type: "thinking", thinking: "" }));
                 }
-                const last = this.content[this.content.length - 1];
-                if (last?.type === "thinking")
-                    last.thinking += reasoning;
+                const block = this.open?.block;
+                if (block)
+                    block.thinking += reasoning;
                 out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "thinking_delta", thinking: reasoning } } });
             }
             if (typeof delta.content === "string" && delta.content) {
                 if (!this.open || this.open.kind !== "text") {
-                    this.content.push({ type: "text", text: "" });
-                    out.push(...this.openBlock("text", { type: "text", text: "" }));
+                    out.push(...this.openBlock("text", { type: "text", text: "" }, undefined, { type: "text", text: "" }));
                 }
-                const last = this.content[this.content.length - 1];
-                if (last?.type === "text")
-                    last.text += delta.content;
+                const block = this.open?.block;
+                if (block)
+                    block.text += delta.content;
                 out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "text_delta", text: delta.content } } });
             }
             if (Array.isArray(delta.tool_calls)) {
@@ -417,6 +538,42 @@ export class OpenAiStreamMapper {
         }
         return out;
     }
+    /**
+     * Seal a closing thinking block of our own: a Chat block into the envelope that names the field to
+     * replay its text under (see `feedChat`).
+     */
+    signatureForChat(block) {
+        if (this.wire !== "chat" || block?.type !== "thinking" || block.thinking.length === 0)
+            return undefined;
+        const signature = encodeEnvelope({ w: "chat", p: this.env.p, m: this.env.m, f: this.chatReasoningField });
+        block.signature = signature;
+        this.reasoningCount++;
+        return signature;
+    }
+    /**
+     * Put the finished Responses reasoning item into the envelope its block carries: the wire, this
+     * provider and model, and the item itself — type, id, summary and the backend's sealed blob,
+     * untouched (reasoning.ts). An item the backend did not seal has nothing to resume, so its block
+     * stays unsigned and only its summary survives, as display text.
+     */
+    sealReasoningItem(item) {
+        const held = this.reasoningItems.get(item.id);
+        const block = item.block;
+        block.thinking = held?.text.trim() || block.thinking.trim() || (typeof held?.summary === "string" ? held.summary.trim() : "");
+        if (!held?.encrypted) {
+            // An item the backend did not seal has nothing to resume. The block stays unsigned, so the
+            // client treats it as display text and never replays it (reasoning.ts).
+            block.signature = "";
+            return;
+        }
+        const reasoning = { type: "reasoning", encrypted_content: held.encrypted };
+        if (item.id)
+            reasoning.id = item.id;
+        if (Array.isArray(held.summary))
+            reasoning.summary = held.summary;
+        block.signature = encodeEnvelope({ w: "responses", p: this.env.p, m: this.env.m, r: reasoning });
+        this.reasoningCount++;
+    }
     responseItem(id, kind) {
         if (typeof id === "string")
             return this.responseItemsById.get(id);
@@ -452,6 +609,24 @@ export class OpenAiStreamMapper {
                 item.closed = true;
                 continue;
             }
+            if (item.kind === "reasoning") {
+                // Emitted only once the item is done, because the block is handed over whole: the sealed
+                // reasoning is what goes in the envelope, and it may only arrive with the completed item.
+                // `sealReasoningItem` has already put the envelope on the block by then.
+                if (!item.done)
+                    break;
+                const reasoning = item.block;
+                out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
+                if (reasoning.signature !== undefined)
+                    this.open = { ...this.open, signature: reasoning.signature };
+                if (reasoning.thinking)
+                    out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "thinking_delta", thinking: reasoning.thinking } } });
+                item.emitted = true;
+                item.emittedText = reasoning.thinking.length;
+                out.push(...this.closeBlock());
+                item.closed = true;
+                continue;
+            }
             const tool = item.block;
             out.push(...this.openBlock("tool", { type: "tool_use", id: tool.id, name: tool.name, input: {} }, tool.index));
             if (tool.args) {
@@ -480,12 +655,28 @@ export class OpenAiStreamMapper {
                 this.responseItemsById.set(id, responseItem);
             }
             else if (id && item?.type === "function_call") {
+                this.lastCallId = item.call_id === undefined || item.call_id === null ? id : String(item.call_id);
                 const index = this.content.filter((block) => block.type === "tool_use").length;
                 const tool = this.toolFor(index, { id: item.call_id ?? item.id, function: { name: item.name } });
                 const responseItem = { id, kind: "tool", block: tool, done: false, emitted: false, closed: false, emittedText: 0 };
                 this.responseItems.push(responseItem);
                 this.responseItemsById.set(id, responseItem);
             }
+            else if (id && item?.type === "reasoning") {
+                // The item's sealed reasoning and summary, held until the item is done: the block handed over
+                // carries both, and a half-assembled one must not reach the client (reasoning.ts).
+                const reasoning = {
+                    ...(typeof item.encrypted_content === "string" && item.encrypted_content ? { encrypted: item.encrypted_content } : {}),
+                    summary: item.summary,
+                    text: "",
+                };
+                this.reasoningItems.set(id, reasoning);
+                const block = { type: "thinking", thinking: "" };
+                this.content.push(block);
+                const responseItem = { id, kind: "reasoning", block, done: false, emitted: false, closed: false, emittedText: 0 };
+                this.responseItems.push(responseItem);
+                this.responseItemsById.set(id, responseItem);
+            }
         }
         else if (type === "response.output_text.delta") {
             const text = typeof ev.delta === "string" ? ev.delta : "";
@@ -511,10 +702,40 @@ export class OpenAiStreamMapper {
                 }
             }
         }
+        else if (type === "response.reasoning_summary_text.delta" || type === "response.reasoning_text.delta") {
+            // The summary, shown as the thinking block's text. When there is none — which is the usual
+            // shape — nothing arrives and the block stays empty, exactly as the item was measured.
+            const text = typeof ev.delta === "string" ? ev.delta : "";
+            const item = this.responseItem(ev.item_id, "reasoning");
+            if (item?.kind === "reasoning" && text) {
+                const block = item.block;
+                block.thinking += text;
+                if (this.reasoningItems.get(item.id))
+                    this.reasoningItems.get(item.id).text += text;
+                if (item.emitted && this.open?.kind === "thinking") {
+                    out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "thinking_delta", thinking: text } } });
+                    item.emittedText += text.length;
+                }
+            }
+        }
         else if (type === "response.output_item.done") {
-            const item = this.responseItem(ev.item_id ?? ev.item?.id);
-            if (item)
+            const done = ev.item;
+            const item = this.responseItem(ev.item_id ?? done?.id);
+            if (done?.encrypted_content !== undefined || done?.summary !== undefined) {
+                // The backend may seal the reasoning only when the item completes; take it from there too.
+                const held = this.reasoningItems.get(typeof (ev.item_id ?? done?.id) === "string" ? String(ev.item_id ?? done?.id) : "");
+                if (held) {
+                    if (typeof done.encrypted_content === "string" && done.encrypted_content)
+                        held.encrypted = done.encrypted_content;
+                    if (done.summary !== undefined)
+                        held.summary = done.summary;
+                }
+            }
+            if (item) {
                 item.done = true;
+                if (item.kind === "reasoning")
+                    this.sealReasoningItem(item);
+            }
         }
         else if (type === "response.completed" || type === "response.incomplete") {
             const response = ev.response;
@@ -535,6 +756,7 @@ export class OpenAiStreamMapper {
     feed(ev, wire) {
         if (this.finished)
             return [];
+        this.wire = wire;
         // Some OpenAI-compatible servers emit an ordinary `{error:{...}}` JSON SSE payload
         // instead of the Responses `error` event shape. Do not finish it as a successful answer.
         if (ev.error && typeof ev.error === "object") {

package/dist/router/src/providers/retry.js

@@ -22,7 +22,22 @@
 // any status or byte is sent, so a retry cannot splice two answers together. Once the first byte is
 // out the turn is committed and this must not be used.
 import { setTimeout as sleep } from "node:timers/promises";
+import { Agent, setGlobalDispatcher } from "undici";
 import { classify } from "../pool.js";
+/**
+ * How long a translated provider's response may stay silent. Node's `fetch` gives up after 300s
+ * without a byte (`UND_ERR_BODY_TIMEOUT`, reproduced 2026-10-14: an SSE response that went quiet was
+ * cut at 300.98s). A reasoning model says nothing while it thinks: Muse Spark 1.3 at xhigh on a
+ * 100k+ context thought for minutes per step, and every one of its 529s that day ended at 303–305s,
+ * while every step that finished did so under 280s — the whole step thrown away and asked again.
+ * OpenCode's own CLI has no such limit. Fifteen minutes is past Claude Code's own request timeout,
+ * so the client, not this, decides when a turn has taken too long.
+ */
+export const UPSTREAM_SILENCE_MS = 15 * 60_000;
+/** Every `fetch` in this process waits `ms` for headers and between body bytes. Called at startup. */
+export function allowLongSilences(ms = UPSTREAM_SILENCE_MS) {
+    setGlobalDispatcher(new Agent({ bodyTimeout: ms, headersTimeout: ms }));
+}
 /** Attempts in total — one ask plus nine retries, matching the CLI's own ceiling (2026-09-21). */
 export const DEFAULT_ATTEMPTS = 10;
 const RETRY_BASE_MS = 250;

package/dist/router/src/reasoning.js

@@ -0,0 +1,157 @@
+// A translated reasoning model's own turn, carried through Claude Code's transcript.
+//
+// The Responses wire hands its model an opaque reasoning item — `{type:"reasoning", id, summary,
+// encrypted_content}` — and expects it back, byte for byte, in the position it came from, beside the
+// function calls of that same turn. That is not an optimisation: measured 2026-10-14 with Muse Spark
+// 1.3 at xhigh on a real tool loop, runs whose previous reasoning was not returned spent
+// 9.5k–24.5k reasoning tokens each (2,197 per step past 80k context) and one of three ran out of
+// context without ever answering, where the same loop with the items returned spent 3.2k–4.3k per
+// run (725 per step past 80k), answered in all three, and read 94% prompt cache. Dropping the reasoning is why a routed worker "thinks from
+// scratch on every tool call" and then dies. DeepSeek's own Chat API states the same rule for
+// `reasoning_content`: with `tools` present it "must be fully passed back to the API in all
+// subsequent requests", even for turns that made no tool call, and the API answers a 400 otherwise
+// (https://api-docs.deepseek.com/guides/thinking_mode/, read 2026-10-14).
+//
+// The router keeps no state of its own here. Claude Code resends the whole conversation every turn,
+// so the transcript is the storage. The carrier is a `thinking` block's `signature`, which is a
+// free-form string on the wire and is replayed with the block [measured 2026-10-14 against a fake
+// upstream: a thinking block carrying our signature comes back on the next request of a tool loop
+// with the signature byte-identical, and an *empty* thinking text is kept too — which is what a
+// Responses reasoning item with no summary looks like]. Anthropic's own signature is opaque base64
+// this router cannot forge; ours is a small envelope that names the wire, the provider, the model
+// and the vendor's own reasoning, and it is decoded and dropped by `thinking.ts` before a request
+// reaches Anthropic.
+//
+// opencodex (github.com/lidge-jun/opencodex, devlog/_fin/260711_claude_inbound/003_evidence.md
+// lines 93-118) reached the same conclusion and the same carrier — a signature on a thinking block,
+// read back out of the client's own conversation — and we rely on that as a behavioral
+// specification only; no code was copied.
+//
+// `encrypted_content` is the vendor's own sealed blob. It goes in the envelope untouched and comes
+// back untouched: re-encoding or re-signing it would be the "re-signed reasoning" mistake that cost
+// an earlier translator 12–20% cache hit (ARCHITECTURE §4, "Cache-safety decisions").
+//
+// `include:["reasoning.encrypted_content"]` is asked for on every turn where the vendor is known to
+// take it — the ChatGPT backend, as Codex asks, and a preset marked `sealedReasoning` (presets.ts),
+// as OpenCode's own client asks. A `store: false` backend that is not asked hands back nothing, so
+// waiting until a conversation already carried reasoning would never start one. For any other
+// Responses vendor it is asked for only once the conversation already carries that vendor's
+// reasoning, so a vendor never measured keeps the request it had. Measured 2026-10-14 against
+// OpenCode Go (`muse-spark-1.3-contributor`, one tool-bearing turn): the sealed item came back with
+// `include` and without it, both 1426 bytes, and replaying it in place answered 200. The same vendor
+// also accepted a tampered blob and a turn with the item dropped entirely (both 200), so the 4xx
+// retry below is a safety net for a vendor or an account that is stricter.
+/** Names an envelope as ours. Anthropic's own signatures never start with it. */
+export const ENVELOPE_PREFIX = "clauderipple.v1:";
+/** Thrown when a signature looks like ours and does not decode. */
+export class UndecodableEnvelope extends Error {
+}
+/**
+ * Our marker on a block, without decoding it: the cheap test `thinking.ts` and the request builders
+ * need before doing any work. Anthropic's own signatures are base64 and never carry this prefix.
+ */
+export function isOurSignature(signature) {
+    return typeof signature === "string" && signature.startsWith(ENVELOPE_PREFIX);
+}
+/** The `signature` of a block of ours: the envelope, base64url so it survives any signature field. */
+export function encodeEnvelope(envelope) {
+    return ENVELOPE_PREFIX + Buffer.from(JSON.stringify(envelope), "utf8").toString("base64url");
+}
+function envelope(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const e = value;
+    if (typeof e.p !== "string" || typeof e.m !== "string")
+        return null;
+    if (e.w === "chat")
+        return typeof e.f === "string" && e.f.length > 0 ? { w: "chat", p: e.p, m: e.m, f: e.f } : null;
+    if (e.w === "responses")
+        return e.r && typeof e.r === "object" ? { w: "responses", p: e.p, m: e.m, r: e.r } : null;
+    return null;
+}
+/**
+ * The envelope on a signature, or null when it is not ours. A signature that carries our prefix and
+ * does not decode is a broken carrier, not a foreign one, so it throws rather than passing silently
+ * as someone else's — the caller logs it and moves on.
+ */
+export function decodeEnvelope(signature) {
+    if (!isOurSignature(signature))
+        return null;
+    const text = signature.slice(ENVELOPE_PREFIX.length);
+    // Guard the decode: a signature is attacker-visible text and a gigabyte of base64 must not become
+    // a gigabyte of JSON. A sealed reasoning blob runs a few KB.
+    if (text.length > 512 * 1024)
+        throw new UndecodableEnvelope("envelope too large");
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(text, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new UndecodableEnvelope("envelope did not decode");
+    }
+    const decoded = envelope(parsed);
+    if (!decoded)
+        throw new UndecodableEnvelope("envelope was not a recognizable shape");
+    return decoded;
+}
+/**
+ * Whether a stored item is worth replaying at all. A reasoning item with no `encrypted_content`
+ * carries nothing the backend can resume — the summary is text it thinks in, not state — so it is
+ * not carried and never replayed. Measured 2026-10-14 (Codex records, 161 items across one day):
+ * every item the CLI replayed had the sealed blob, and most had an empty summary.
+ */
+export function replayableReasoning(stored) {
+    if (stored.type !== "reasoning")
+        return null;
+    const encrypted = stored.encrypted_content;
+    if (typeof encrypted !== "string" || encrypted.length === 0)
+        return null;
+    // Only the fields the wire defines are forwarded: a vendor's item may carry bookkeeping
+    // (`internal_chat_message_metadata_passthrough`) that is meaningless and unverified to send back.
+    const out = { type: "reasoning", encrypted_content: encrypted };
+    if (typeof stored.id === "string" && stored.id.length > 0)
+        out.id = stored.id;
+    if (Array.isArray(stored.summary))
+        out.summary = stored.summary;
+    return out;
+}
+/**
+ * The envelope on an assistant block, when it is ours *and* usable here: the right wire, and the
+ * same provider and model that made it. Anything else returns null as if the block were foreign —
+ * reasoning is state, and state from another model is not merely useless, it is the thing a vendor
+ * refuses. A signature that is ours but broken, or names another model, reports through `onDrop` so
+ * the caller can count it; neither is an error worth failing a turn over.
+ */
+export function envelopeFor(block, wire, env, onDrop) {
+    const b = block;
+    if (!b || typeof b !== "object" || b.type !== "thinking" || !isOurSignature(b.signature))
+        return null;
+    let decoded;
+    try {
+        const got = decodeEnvelope(b.signature);
+        if (!got)
+            return null;
+        decoded = got;
+    }
+    catch {
+        onDrop("the envelope did not decode");
+        return null;
+    }
+    if (decoded.w !== wire)
+        return null;
+    if (env && (decoded.p !== env.p || decoded.m !== env.m)) {
+        onDrop(`reasoning came from ${decoded.p}/${decoded.m}`);
+        return null;
+    }
+    return decoded;
+}
+/** `type` matters as much as the wording: a vendor that says "reasoning" is answering about this. */
+const REASONING_REFUSAL = /reasoning|encrypted|\binput\[\d+\]|\bitem\b|signature/i;
+/**
+ * Whether a 4xx refusal is about the reasoning that was replayed, and so is worth one retry without
+ * it. Only a request that carried replayed reasoning can be refused for carrying it, and a sealed
+ * blob minted on one account or one model is the thing most likely to be refused on another.
+ */
+export function refusesReplayedReasoning(status, message) {
+    return status >= 400 && status < 500 && (status === 422 || REASONING_REFUSAL.test(message));
+}

package/dist/router/src/thinking.js

@@ -1,16 +1,27 @@
 // Thinking blocks another model left in a conversation that is now going to Anthropic.
 //
-// The translated providers hand the CLI their reasoning as `thinking` blocks with no signature —
-// there is no Anthropic signature to give — and an empty `thinking` when the upstream sent a
-// reasoning item without a summary. The CLI keeps them in the transcript, so a session switched
-// from such a model to a Claude model replays them, and Anthropic refuses the whole request:
-// "messages.2.content.0.thinking: each thinking block must contain thinking" (measured 2026-09-28,
-// gpt-6-astra → claude-opus-5-5, every retry of the turn). A block Anthropic wrote always carries a
-// signature, so an unsigned one is foreign and goes; the translated providers drop thinking from
-// replayed history for the same reason (ARCHITECTURE §4, "Cache-safety decisions").
+// The translated providers hand the CLI their reasoning as `thinking` blocks, and an empty `thinking`
+// when the upstream sent a reasoning item without a summary. The CLI keeps them in the transcript, so
+// a session switched from such a model to a Claude model replays them, and Anthropic refuses the
+// whole request: "messages.2.content.0.thinking: each thinking block must contain thinking" (measured
+// 2026-09-28, gpt-6-astra → claude-opus-5-5, every retry of the turn).
+//
+// A block Anthropic wrote always carries a signature of Anthropic's own, a base64 string this router
+// cannot produce. A translation provider cannot produce one either, so it signs with an envelope of
+// its own naming where the reasoning came from (reasoning.ts) — which Anthropic would refuse just as
+// fast, and which is why those go too. What is left that is signed is Anthropic's.
+//
+// The translated adapters themselves keep their own replayed reasoning (that is the point of the
+// envelope), so this is the one place a translated provider's thinking must still be dropped: a
+// CLI-side switch to a Claude model. Gemini and the other translators drop `thinking` on their own.
+import { isOurSignature } from "./reasoning.js";
 function foreign(block) {
     const b = block;
-    return !!b && typeof b === "object" && b.type === "thinking" && !(typeof b.signature === "string" && b.signature.length > 0);
+    if (!b || typeof b !== "object" || b.type !== "thinking")
+        return false;
+    // Unsigned: a translated provider's reasoning with nothing to carry, or an empty reasoning item.
+    // Ours: a translated provider's envelope, which only its own adapter can read back.
+    return !(typeof b.signature === "string" && b.signature.length > 0) || isOurSignature(b.signature);
 }
 /**
  * Removes unsigned thinking blocks from assistant turns, in place, and returns how many went.