clauderipple 0.9.4 → 0.9.5

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.9.5 — 2026-10-14
+
+### Fixed
+
+- **Routed reasoning models keep their train of thought between tool calls.** The router dropped
+  every translated model's previous reasoning, so on each tool call Muse, GPT and DeepSeek reasoned
+  the whole task again from scratch. Workers took minutes per step, kept re-deriving the same plan,
+  and sometimes stopped with no answer. The model's own reasoning now travels in Claude Code's
+  transcript and goes back to it unchanged, the way OpenCode's and Codex's own clients do it. On four
+  real fixes graded by their hidden tests, Muse Spark 1.3 at xhigh finished in 90–584 seconds, where
+  0.9.4 took up to 13 minutes and twice ran past 30 minutes without finishing. Switching a session
+  to a Claude model still works: the carried reasoning is left out of requests to Anthropic.
+
 ## 0.9.4 — 2026-10-14
 
 ### Fixed

package/dist/app/package.json

@@ -1,5 +1,5 @@
 {
   "private": true,
-  "version": "0.9.4",
+  "version": "0.9.5",
   "type": "commonjs"
 }

package/dist/router/src/presets.js

@@ -199,6 +199,9 @@ export const PRESETS = [
         authHeader: "authorization-bearer",
         wire: "responses",
         sessionHeader: "x-opencode-session",
+        // Measured 2026-10-14 on muse-spark-1.3-contributor: `include` and `summary` are accepted, the
+        // sealed item comes back on a tool-bearing turn, and replaying it in place answers 200.
+        sealedReasoning: true,
         modelsUrl: "https://opencode.ai/zen/go/v1/models",
         modelsAuthHeader: "authorization-bearer",
         // Every wire below is from the endpoint table OpenCode publishes per model

package/dist/router/src/providers/chatgpt/index.js

@@ -8,6 +8,7 @@ import { SseParser } from "./sse.js";
 import { fetchWithRetry } from "../retry.js";
 import { looksLikeAuth } from "../openai/index.js";
 import { StreamMapper, conversationKey, estimateTokens, formatSse, serverToolNames, toResponsesRequest, toolNameRestoreMap } from "./translate.js";
+import { refusesReplayedReasoning } from "../../reasoning.js";
 import { providerExhaustion } from "../../health.js";
 import { credentialHeaderValues, redactErrorText } from "../../redact.js";
 import { codexClientVersion, latestCodexVersion, parseCodexCatalog } from "./catalog.js";
@@ -963,6 +964,27 @@ export class ChatGptAdapter {
             res.end();
         return { status: upstream.status, bytes, ...(usage ? { usage } : {}), note: `codex passthrough account=${owner ? owner.slice(0, 8) : "caller"}` };
     }
+    /**
+     * The options one turn is translated with. The conversation is the storage (reasoning.ts), so what
+     * to replay is read out of the request itself; `carried` is filled in as the input is built and the
+     * outcome lands in the request log. `replay: false` is the retry after the backend refused that
+     * carrier, and it puts back exactly the request this adapter sent before any of this existed.
+     */
+    responsesOptions(carried, model, effort, replay = true) {
+        return {
+            model,
+            effort: effort ?? this.cfg.defaultEffort ?? "high",
+            identity: this.cfg.identity ?? true,
+            ...(this.cfg.instructionsAppend ? { instructionsAppend: this.cfg.instructionsAppend } : {}),
+            replay,
+            // The envelope names this provider and this model, and the request builder refuses anything
+            // else: reasoning outlives the turn that made it, and a conversation moved to another model
+            // must not carry the old one's sealed state with it (reasoning.ts).
+            env: { p: this.name, m: model },
+            carried,
+            log: (line) => this.log.info(`chatgpt ${this.name}: ${line} (${model})`),
+        };
+    }
     /** Handle a fully-read Messages request. `model`/`effort` already resolved by routing. */
     async handle(req, res, path, json, model, effort) {
         if (path.startsWith("/v1/messages/count_tokens")) {
@@ -975,13 +997,9 @@ export class ChatGptAdapter {
         const serverTools = serverToolNames(json.tools);
         if (serverTools.size > 0)
             this.log.warn(`chatgpt ${this.name}: dropped server tools for ${model}: ${[...serverTools].join(", ")} (Anthropic runs these; this provider cannot)`);
-        const upstreamReq = toResponsesRequest(json, {
-            model,
-            effort: effort ?? this.cfg.defaultEffort ?? "high",
-            identity: this.cfg.identity ?? true,
-            ...(this.cfg.instructionsAppend ? { instructionsAppend: this.cfg.instructionsAppend } : {}),
-        });
-        const body = JSON.stringify(upstreamReq);
+        const carried = { replayed: 0, undecodable: 0 };
+        let upstreamReq = toResponsesRequest(json, this.responsesOptions(carried, model, effort));
+        let body = JSON.stringify(upstreamReq);
         const cacheKey = upstreamReq.prompt_cache_key;
         // Input estimate for message_start: a conversation only grows, so the last measured total is a floor.
         const startInput = Math.max(estimateTokens(json), this.lastInputByKey.get(cacheKey) ?? 0);
@@ -991,7 +1009,7 @@ export class ChatGptAdapter {
         // One account answers the turn. Which one is decided here, and a refusal before any byte has
         // reached the client moves the same turn to the next account, so the client is answered on its
         // first ask. The conversation stays on the account that answered: moving it costs the cache.
-        const sent = await this.sendToAnAccount({
+        const ask = () => this.sendToAnAccount({
             conversation: cacheKey,
             path: "/codex/responses",
             body,
@@ -1014,6 +1032,18 @@ export class ChatGptAdapter {
                 };
             },
         });
+        let sent = await ask();
+        // A 4xx that names reasoning is the backend refusing the sealed reasoning we replayed — the blob
+        // was minted by the model that is no longer answering, or by another account. The summary is
+        // worth nothing without it, so the turn is asked once without: replaying is an optimisation and
+        // must never be the reason a user's turn fails (reasoning.ts).
+        if (carried.replayed > 0 && sent.kind === "refused" && refusesReplayedReasoning(sent.status, sent.text)) {
+            this.log.warn(`chatgpt ${this.name}: upstream ${sent.status} refused ${carried.replayed} replayed reasoning item(s) for ${model}; asking again without them: ${sent.text.slice(0, 200)}`);
+            upstreamReq = toResponsesRequest(json, this.responsesOptions({ replayed: 0, undecodable: 0 }, model, effort, false));
+            body = JSON.stringify(upstreamReq);
+            carried.replayed = 0;
+            sent = await ask();
+        }
         if (sent.kind !== "ok") {
             res.off("close", onClose);
             if (sent.kind === "aborted")
@@ -1061,7 +1091,7 @@ export class ChatGptAdapter {
         if (this.cfg.debugDump === "all")
             this.dump(upstream.status, json, upstreamReq, "");
         const wantStream = json.stream === true;
-        const mapper = new StreamMapper(model, startInput, toolNameRestoreMap(json));
+        const mapper = new StreamMapper(model, startInput, toolNameRestoreMap(json), this.name);
         const parser = new SseParser();
         let bytes = 0;
         let ping = null;
@@ -1179,8 +1209,8 @@ export class ChatGptAdapter {
             exhaustion,
             bytes,
             note: failure
-                ? `${wantStream ? "mid-stream " : ""}${failure.type}: ${failure.message} (in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens})`
-                : `in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens} stop=${mapper.stopReason}${upstreamReq.service_tier ? " fast" : ""}`,
+                ? `${wantStream ? "mid-stream " : ""}${failure.type}: ${failure.message} (in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens} replayed=${carried.replayed} reasoning=${mapper.reasoningCount})`
+                : `in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens} stop=${mapper.stopReason} replayed=${carried.replayed} reasoning=${mapper.reasoningCount}${upstreamReq.service_tier ? " fast" : ""}`,
             usage: {
                 input: u.input_tokens,
                 cached: u.cache_read_input_tokens,

package/dist/router/src/providers/chatgpt/translate.js

@@ -3,11 +3,15 @@
 // Prompt-cache rule: the Responses `input` we build must be a byte-stable prefix of the
 // next turn's `input`. Claude Code resends the whole history every turn, so the mapping
 // has to be deterministic and must not inject anything that varies (timestamps, salts,
-// re-signed reasoning). Thinking blocks from earlier assistant turns are dropped for the
-// same reason. `prompt_cache_key` is derived from the conversation's first user message — or,
+// re-signed reasoning). A reasoning item that came back from the backend is the exception
+// that proves the rule: it is put back exactly as it arrived, so the bytes are the
+// backend's own, and a turn that carried one maps the same way every time. Thinking
+// blocks with no stored item still have nothing to put back and are dropped as before.
+// `prompt_cache_key` is derived from the conversation's first user message — or,
 // for a request that is not a conversation at all, from its system prompt (see `conversationKey`).
 import crypto from "node:crypto";
 import { identityLine } from "../../identity.js";
+import { encodeEnvelope, envelopeFor, isOurSignature, replayableReasoning } from "../../reasoning.js";
 function blockText(c) {
     if (typeof c === "string")
         return c;
@@ -235,6 +239,7 @@ export function toResponsesRequest(req, opts) {
     // whose call_id has no function_call in the same input ("No tool call found…", measured 2026-09-13).
     // Such results are sent as plain user text instead.
     const knownCalls = new Set();
+    let lastCallId;
     for (const m of req.messages) {
         const role = m.role === "assistant" ? "assistant" : "user";
         if (typeof m.content === "string") {
@@ -251,6 +256,32 @@ export function toResponsesRequest(req, opts) {
             pending = [];
         };
         for (const b of m.content) {
+            // The reasoning this turn came back with, put back exactly where it was: the CLI replays the
+            // block in front of the function calls it belongs to, so iterating in order reproduces the
+            // original positions, parallel calls included. `lastCallId` is the call the carrier arrived
+            // after — the response path addresses the next turn's summary to it (see `onArrival`) — and is
+            // undefined for a lead-in item, which is where such a summary belongs.
+            const decoded = envelopeFor(b, "responses", opts.env, (reason) => {
+                (opts.carried ?? (opts.carried = { replayed: 0, undecodable: 0 })).undecodable++;
+                if (opts.replay !== false)
+                    opts.log?.(`dropped a reasoning carrier: ${reason}`);
+            });
+            // A carrier for the other wire is not ours to touch and falls through to the drop below.
+            if (decoded) {
+                if (opts.replay !== false) {
+                    const item = replayableReasoning(decoded.r);
+                    if (item) {
+                        flush();
+                        input.push(item);
+                        (opts.carried ?? (opts.carried = { replayed: 0, undecodable: 0 })).replayed++;
+                        opts.onArrival?.(item, lastCallId);
+                    }
+                    else {
+                        (opts.carried ?? (opts.carried = { replayed: 0, undecodable: 0 })).undecodable++;
+                    }
+                }
+                continue;
+            }
             switch (b.type) {
                 case "text": {
                     const t = b.text;
@@ -272,6 +303,7 @@ export function toResponsesRequest(req, opts) {
                     flush();
                     const tu = b;
                     knownCalls.add(tu.id);
+                    lastCallId = tu.id;
                     input.push({ type: "function_call", call_id: tu.id, name: toolNameForResponses(tu.name), arguments: typeof tu.input === "string" ? tu.input : JSON.stringify(tu.input ?? {}) });
                     break;
                 }
@@ -293,7 +325,8 @@ export function toResponsesRequest(req, opts) {
                     break;
                 }
                 default:
-                    // thinking / redacted_thinking / unknown: dropped on purpose (see header comment)
+                    // thinking, an unmarked redacted_thinking, anything unknown: no stored item to put back,
+                    // so dropped as before (see header comment)
                     break;
             }
         }
@@ -327,6 +360,11 @@ export function toResponsesRequest(req, opts) {
         prompt_cache_key: conversationId(req),
         client_metadata: { session_id: conversationId(req), thread_id: conversationId(req), turn_id: crypto.randomUUID(), "x-codex-window-id": `${conversationId(req)}:0` },
     };
+    // On every turn, as Codex asks. With `store: false` the backend keeps nothing, and without
+    // `include` it hands back no sealed item either — so a conversation that waited until it already
+    // carried reasoning before asking would never carry any. Only the retry after a refusal leaves it off.
+    if (opts.replay !== false)
+        out.include = ["reasoning.encrypted_content"];
     if (tools.length > 0) {
         out.tools = tools;
         out.parallel_tool_calls = !(tc?.disable_parallel_tool_use ?? false);
@@ -348,6 +386,7 @@ export function estimateTokens(req) {
 export class StreamMapper {
     started = false;
     blockIndex = -1;
+    /** `signed` marks a thinking block that already carries its signature — the envelope we wrote. */
     open = null;
     sawToolCall = false;
     finished = false;
@@ -360,14 +399,30 @@ export class StreamMapper {
     /** Accumulated content for non-streaming responses. */
     content = [];
     stopReason = "end_turn";
+    /**
+     * How many reasoning items this response carried whole — the ones the client will replay. The
+     * `reasoning=` figure the request log shows next to `replayed=`.
+     */
+    reasoningCount = 0;
+    /** The reasoning item being assembled: its identity so far and the call it followed. */
+    pendingReasoning = null;
+    /** The most recent function_call item added, which is what a following reasoning item describes. */
+    lastCallId;
     /** Input-token figure announced in message_start (the real one only arrives with response.completed). */
     startInput;
     /** Mangled tool name → the name Claude Code knows, from `toolNameRestoreMap`. */
     toolNames;
-    constructor(model, startInput = 0, toolNames = new Map()) {
+    /**
+     * The provider name that goes in each reasoning envelope (see reasoning.ts). A blob sealed here is
+     * only sent back here: reasoning outlives the request that made it, and a conversation moved to
+     * another provider must not carry this one's sealed state with it.
+     */
+    provider;
+    constructor(model, startInput = 0, toolNames = new Map(), provider = "") {
         this.model = model;
         this.startInput = startInput;
         this.toolNames = toolNames;
+        this.provider = provider;
         this.messageId = `msg_${crypto.randomBytes(12).toString("hex")}`;
     }
     get isFinished() {
@@ -393,11 +448,17 @@ export class StreamMapper {
             },
         ];
     }
+    /**
+     * A thinking block must carry a signature even when there is none to give — an unsigned one is
+     * refused the moment the session moves to a Claude model (`thinking.ts`) — so a block that was
+     * opened without one gets an empty `signature_delta` as it closes. A block that already carries
+     * the envelope is left alone: a second, empty delta would replace it on the client.
+     */
     closeBlock() {
         if (!this.open)
             return [];
         const evs = [];
-        if (this.open.kind === "thinking")
+        if (this.open.kind === "thinking" && !this.open.signed)
             evs.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "signature_delta", signature: "" } } });
         evs.push({ event: "content_block_stop", data: { type: "content_block_stop", index: this.blockIndex } });
         this.open = null;
@@ -410,6 +471,56 @@ export class StreamMapper {
         evs.push({ event: "content_block_start", data: { type: "content_block_start", index: this.blockIndex, content_block: block } });
         return evs;
     }
+    /**
+     * Finish the reasoning item being assembled and hand the client the block that carries it: a
+     * thinking block whose text is the summary (empty when the backend sent none — measured
+     * 2026-10-14: Claude Code keeps and replays such a block, signature and all) and whose signature
+     * is the envelope around the sealed reasoning.
+     *
+     * An item with nothing sealed is only worth its summary, and then only if it has one: there is
+     * nothing to replay, and an empty thinking block is refused by Anthropic the moment the session
+     * switches to a Claude model (`thinking.ts`).
+     */
+    sealReasoning() {
+        const pending = this.pendingReasoning;
+        if (!pending)
+            return [];
+        this.pendingReasoning = null;
+        const text = pending.text.trim() || (typeof pending.summary === "string" ? pending.summary.trim() : "");
+        const events = [];
+        if (!pending.encrypted) {
+            if (text) {
+                events.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
+                events.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "thinking_delta", thinking: text } } });
+                events.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "signature_delta", signature: "" } } });
+                events.push(...this.closeBlock());
+                this.content.push({ type: "thinking", thinking: text, signature: "" });
+            }
+            return events;
+        }
+        const item = { type: "reasoning", encrypted_content: pending.encrypted };
+        if (pending.id)
+            item.id = pending.id;
+        if (Array.isArray(pending.summary))
+            item.summary = pending.summary;
+        const signature = encodeEnvelope(this.envelopeFor(item));
+        events.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
+        if (text)
+            events.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "thinking_delta", thinking: text } } });
+        // The signature must arrive on this very block: it is the carrier, and the client keeps the block
+        // whole or not at all. It goes last, after the text, which is the order Anthropic's own blocks use.
+        events.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "signature_delta", signature } } });
+        if (this.open)
+            this.open.signed = true;
+        events.push(...this.closeBlock());
+        this.content.push({ type: "thinking", thinking: text, signature });
+        this.reasoningCount++;
+        return events;
+    }
+    /** Where this item's envelope says it came from — this adapter's own provider and model. */
+    envelopeFor(item) {
+        return { w: "responses", p: this.provider, m: this.model, r: item };
+    }
     /** Map one upstream event. Returns Anthropic events to emit (possibly none). */
     feed(ev) {
         const type = ev.type;
@@ -426,12 +537,23 @@ export class StreamMapper {
                     // The model echoes the mangled name; Claude Code only recognises the original.
                     const called = item.name ?? "tool";
                     const name = this.toolNames.get(called) ?? called;
+                    this.lastCallId = id;
                     this.content.push({ type: "tool_use", id, name, input: {}, _args: "" });
                     out.push(...this.openBlock("tool", { type: "tool_use", id, name, input: {} }, item.id));
                 }
                 else if (item.type === "reasoning") {
-                    this.content.push({ type: "thinking", thinking: "", signature: "" });
-                    out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }, item.id));
+                    // The item's reasoning is held until it is complete and handed over whole (see
+                    // `sealReasoning`): one thinking block whose signature carries the envelope. The summary,
+                    // when the backend sends one, is that block's text — and the summary deltas below fill it
+                    // in. Passing the summary through `openBlock` here as well would split one item across two
+                    // blocks, so this opens nothing.
+                    this.pendingReasoning = {
+                        ...(item.id ? { id: item.id } : {}),
+                        ...(typeof item.encrypted_content === "string" && item.encrypted_content ? { encrypted: item.encrypted_content } : {}),
+                        ...(item.summary !== undefined ? { summary: item.summary } : {}),
+                        text: "",
+                        callId: this.lastCallId,
+                    };
                 }
                 else if (item.type === "message") {
                     this.content.push({ type: "text", text: "" });
@@ -454,6 +576,13 @@ export class StreamMapper {
             case "response.reasoning_summary_text.delta":
             case "response.reasoning_text.delta": {
                 const delta = String(ev.delta ?? "");
+                // The summary is the text of the reasoning item's block, and that block also carries the
+                // envelope — both are written when the item is done, so the block is not opened here. One
+                // item is one block; streaming the text into a block of its own would hand the client two.
+                if (this.pendingReasoning) {
+                    this.pendingReasoning.text += delta;
+                    break;
+                }
                 if (!this.open || this.open.kind !== "thinking") {
                     this.content.push({ type: "thinking", thinking: "", signature: "" });
                     out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
@@ -488,7 +617,18 @@ export class StreamMapper {
                 break;
             }
             case "response.output_item.done": {
+                const done = ev.item;
+                // The backend may put `encrypted_content` only on the completed item, so the seal is taken
+                // here as well as from `response.output_item.added`, and the item is only handed over now
+                // anyway — a half-assembled reasoning block must not reach the client.
+                if (done?.type === "reasoning" && this.pendingReasoning) {
+                    if (typeof done.encrypted_content === "string" && done.encrypted_content)
+                        this.pendingReasoning.encrypted = done.encrypted_content;
+                    if (done.summary !== undefined)
+                        this.pendingReasoning.summary = done.summary;
+                }
                 out.push(...this.closeBlock());
+                out.push(...this.sealReasoning());
                 break;
             }
             case "response.completed":

package/dist/router/src/providers/openai/index.js

@@ -8,6 +8,8 @@ import { credentialHeaderValues, redactErrorText } from "../../redact.js";
 import { SseParser } from "../chatgpt/sse.js";
 import { fetchWithRetry } from "../retry.js";
 import { estimateTokens, formatSse, OpenAiStreamMapper, toOpenAiRequest } from "./translate.js";
+import { refusesReplayedReasoning } from "../../reasoning.js";
+import { PRESETS } from "../../presets.js";
 import { conversationKey, serverToolNames, toolNameRestoreMap } from "../chatgpt/translate.js";
 const PING_MS = 15_000;
 function anthropicError(status, type, message) {
@@ -110,15 +112,25 @@ export class OpenAiCompatibleAdapter {
         const serverTools = serverToolNames(json.tools);
         if (serverTools.size > 0)
             this.log.warn(`${this.tag} ${this.name}: dropped server tools for ${model}: ${[...serverTools].join(", ")} (Anthropic runs these; this provider cannot)`);
-        const upstreamRequest = toOpenAiRequest(json, {
+        // The conversation is the storage for a reasoning model's reasoning (reasoning.ts), so what to
+        // replay is read out of the request itself and the tally is reported in the request log. `env`
+        // names this provider and model: reasoning sealed by another model is never replayed here.
+        const carried = { replayed: 0, undecodable: 0 };
+        const translate = (replay = true) => toOpenAiRequest(json, {
             model,
             wire,
             ...(effort ? { effort } : {}),
             caps,
+            replay,
+            env: { p: this.name, m: model },
+            ...(PRESETS.find((entry) => entry.id === this.cfg.preset)?.sealedReasoning ? { sealedReasoning: true } : {}),
+            carried,
+            log: (line) => this.log.info(`${this.tag} ${this.name}: ${line} (${model})`),
             ...(this.cfg.identity === undefined ? {} : { identity: this.cfg.identity }),
             ...(this.cfg.instructionsAppend ? { instructionsAppend: this.cfg.instructionsAppend } : {}),
         });
-        const requestBody = JSON.stringify(upstreamRequest);
+        const upstreamRequest = translate();
+        let requestBody = JSON.stringify(upstreamRequest);
         // Some vendors key their prompt cache on a session header rather than on the request's own
         // shape, and hand a cold cache to anyone who does not send one. `conversationKey` is the value
         // this codebase already trusts to be stable for one conversation and different between two.
@@ -173,6 +185,17 @@ export class OpenAiCompatibleAdapter {
                     upstream = new Response(refusal, { status: 401 });
                 }
             }
+            // A 4xx that names reasoning is this vendor refusing the reasoning the conversation carried
+            // back — a field it does not take, or a value from another model. The turn goes again without
+            // it: replaying is an optimisation the user's turn must never depend on (reasoning.ts).
+            if (carried.replayed > 0 && refusesReplayedReasoning(upstream.status, await upstream.clone().text().catch(() => ""))) {
+                const refusal = await upstream.text().catch(() => "");
+                this.log.warn(`${this.tag} ${this.name}: upstream ${upstream.status} refused ${carried.replayed} replayed reasoning turn(s) for ${model}; asking again without them: ${refusal.replace(/\s+/g, " ").slice(0, 200)}`);
+                carried.replayed = 0;
+                carried.undecodable = 0;
+                requestBody = JSON.stringify(translate(false));
+                upstream = await ask();
+            }
         }
         catch (error) {
             res.off("close", onClose);
@@ -202,7 +225,8 @@ export class OpenAiCompatibleAdapter {
             return { status: out.status, bytes: Buffer.byteLength(out.body), note: `upstream ${upstream.status}`, exhaustion: providerExhaustion(upstream.status, text, retryAfterMs(Object.fromEntries(upstream.headers))) };
         }
         const wantStream = json.stream === true;
-        const mapper = new OpenAiStreamMapper(model, startInput, toolNameRestoreMap(json));
+        const mapper = new OpenAiStreamMapper(model, startInput, toolNameRestoreMap(json), { p: this.name, m: model });
+        mapper.wire = wire;
         mapper.redactError = redact;
         const parser = new SseParser();
         const reader = upstream.body.getReader();
@@ -283,8 +307,8 @@ export class OpenAiCompatibleAdapter {
             exhaustion: failure ? providerExhaustion(429, `${failure.code ?? ""} ${failure.message}`, retryAfterMs(Object.fromEntries(upstream.headers))) : undefined,
             bytes,
             note: failure
-                ? `${wantStream ? "mid-stream " : ""}${failure.type}: ${failure.message} (in=${usage.input_tokens} cached=${usage.cache_read_input_tokens} out=${usage.output_tokens})`
-                : `in=${usage.input_tokens} cached=${usage.cache_read_input_tokens} out=${usage.output_tokens} stop=${mapper.stopReason}`,
+                ? `${wantStream ? "mid-stream " : ""}${failure.type}: ${failure.message} (in=${usage.input_tokens} cached=${usage.cache_read_input_tokens} out=${usage.output_tokens} replayed=${carried.replayed} reasoning=${mapper.reasoningCount})`
+                : `in=${usage.input_tokens} cached=${usage.cache_read_input_tokens} out=${usage.output_tokens} stop=${mapper.stopReason} replayed=${carried.replayed} reasoning=${mapper.reasoningCount}`,
             usage: { input: usage.input_tokens, cached: usage.cache_read_input_tokens, output: usage.output_tokens },
             stopReason: mapper.stopReason,
             ...(wantStream || !failure ? { messageId: mapper.messageId } : {}),

package/dist/router/src/providers/openai/translate.js

@@ -5,6 +5,14 @@ import crypto from "node:crypto";
 import { clampEffort } from "../../compat.js";
 import { conversationKey, estimateTokens, normalizeSchema, serverToolNames, systemWithDroppedToolNote, toolNameForResponses } from "../chatgpt/translate.js";
 import { identityPrefix, instructionsSuffix } from "../../identity.js";
+import { encodeEnvelope, envelopeFor, replayableReasoning } from "../../reasoning.js";
+/** Counts a replay outcome, creating the tally the adapter reports from when it is the first. */
+function bump(opts, kind, by = 1) {
+    if (!opts)
+        return;
+    const carried = opts.carried ?? (opts.carried = { replayed: 0, undecodable: 0 });
+    carried[kind] += by;
+}
 function textOf(content) {
     if (typeof content === "string")
         return content;
@@ -104,6 +112,14 @@ export function toChatMessages(req, opts) {
         if (role === "assistant") {
             const text = [];
             const calls = [];
+            // The reasoning this turn came back with, rejoined into one string and sent as
+            // `reasoning_content` on the same assistant message — the shape DeepSeek's own example builds
+            // by appending the whole response message, and the only shape its API documents. The field
+            // name is the one the vendor sent it under, carried in the envelope: a model heard on
+            // `reasoning` is answered on `reasoning` (reasoning.ts).
+            const reasoning = [];
+            let field = "reasoning_content";
+            let carriedHere = 0;
             for (const block of message.content) {
                 if (block.type === "text")
                     text.push(String(block.text ?? ""));
@@ -112,9 +128,31 @@ export function toChatMessages(req, opts) {
                     knownCalls.add(call.id);
                     calls.push({ id: call.id, type: "function", function: { name: toolNameForResponses(call.name), arguments: typeof call.input === "string" ? call.input : JSON.stringify(call.input ?? {}) } });
                 }
+                const envelope = envelopeFor(block, "chat", opts?.env, (reason) => {
+                    bump(opts, "undecodable");
+                    if (opts?.replay !== false)
+                        opts?.log?.(`dropped a reasoning carrier: ${reason}`);
+                });
+                if (!envelope || opts?.replay === false)
+                    continue;
+                const held = block.thinking;
+                if (typeof held === "string" && held.length > 0)
+                    reasoning.push(held);
+                field = envelope.f === "reasoning" ? "reasoning" : "reasoning_content";
+                carriedHere++;
+            }
+            if (carriedHere > 0)
+                bump(opts, "replayed", carriedHere);
+            // A turn whose only content was reasoning is still a turn the model had: it goes out with the
+            // reasoning alone rather than vanishing, which is what dropping thinking did before.
+            if (text.some(Boolean) || calls.length || reasoning.length) {
+                messages.push({
+                    role: "assistant",
+                    content: text.join("\n") || null,
+                    ...(calls.length ? { tool_calls: calls } : {}),
+                    ...(reasoning.length ? (field === "reasoning" ? { reasoning: reasoning.join("\n\n") } : { reasoning_content: reasoning.join("\n\n") }) : {}),
+                });
             }
-            if (text.some(Boolean) || calls.length)
-                messages.push({ role: "assistant", content: text.join("\n") || null, ...(calls.length ? { tool_calls: calls } : {}) });
             continue;
         }
         let parts = [];
@@ -158,9 +196,16 @@ export function toChatMessages(req, opts) {
     return messages;
 }
 /** Translate to the stateless OpenAI Responses input grammar. */
-export function toResponsesInput(req) {
+export function toResponsesInput(req, opts) {
     const input = [];
     const knownCalls = new Set();
+    let lastCallId;
+    // A translation with no options is a translation with nothing to say about reasoning: there is no
+    // provider to name in an envelope and no model to check it against, so nothing is carried either
+    // way. `opts` is only consulted when it is there.
+    const carried = (count) => {
+        bump(opts, count);
+    };
     for (const message of req.messages) {
         const role = message.role === "assistant" ? "assistant" : "user";
         if (typeof message.content === "string") {
@@ -177,6 +222,27 @@ export function toResponsesInput(req) {
             parts = [];
         };
         for (const block of message.content) {
+            // A reasoning item this conversation came back with, in the position it was replayed from —
+            // beside the function calls of that turn, and never for the other wire's carrier (reasoning.ts).
+            const envelope = envelopeFor(block, "responses", opts?.env, (reason) => {
+                carried("undecodable");
+                if (opts?.replay !== false)
+                    opts?.log?.(`dropped a reasoning carrier: ${reason}`);
+            });
+            if (envelope) {
+                if (opts?.replay !== false) {
+                    const item = replayableReasoning(envelope.r);
+                    if (item) {
+                        flush();
+                        input.push(item);
+                        carried("replayed");
+                        opts?.onArrival?.(item, lastCallId);
+                    }
+                    else
+                        carried("undecodable");
+                }
+                continue;
+            }
             if (block.type === "text") {
                 const text = String(block.text ?? "");
                 if (text)
@@ -191,6 +257,7 @@ export function toResponsesInput(req) {
                 flush();
                 const call = block;
                 knownCalls.add(call.id);
+                lastCallId = call.id;
                 input.push({ type: "function_call", call_id: call.id, name: toolNameForResponses(call.name), arguments: typeof call.input === "string" ? call.input : JSON.stringify(call.input ?? {}) });
             }
             else if (block.type === "tool_result") {
@@ -243,11 +310,18 @@ export function toOpenAiRequest(req, opts) {
         return out;
     }
     const responseTools = tools.map(({ function: fn }) => ({ type: "function", ...fn }));
+    const input = toResponsesInput(req, opts);
     const out = {
         model: opts.model,
-        input: toResponsesInput(req),
+        input,
         stream: true,
     };
+    // A vendor marked `sealedReasoning` is asked for its reasoning on every turn, the way OpenCode's own
+    // client asks: asking only once a conversation already carried some would never start one on a
+    // vendor that seals nothing unasked. Anyone else is asked only when the conversation is already
+    // carrying its reasoning, so a request for a vendor never measured stays as it was.
+    if (opts.replay !== false && (opts.sealedReasoning || input.some((item) => item.type === "reasoning")))
+        out.include = ["reasoning.encrypted_content"];
     const instructions = systemWithIdentity(systemWithDroppedToolNote(req), opts);
     if (instructions)
         out.instructions = instructions;
@@ -268,7 +342,7 @@ export function toOpenAiRequest(req, opts) {
     if (typeof req.temperature === "number")
         out.temperature = req.temperature;
     if (effort)
-        out.reasoning = { effort };
+        out.reasoning = opts.sealedReasoning && opts.replay !== false ? { effort, summary: "auto" } : { effort };
     return out;
 }
 export { conversationKey, estimateTokens };
@@ -277,26 +351,43 @@ export class OpenAiStreamMapper {
     started = false;
     finished = false;
     blockIndex = -1;
+    /** `block` is the content entry this block writes into; `signature` seals a Responses item. */
     open = null;
     sawTool = false;
     finishReason;
     responseItems = [];
     responseItemsById = new Map();
+    /** Reasoning items of a Responses stream, by item id, until the item that carries one is done. */
+    reasoningItems = new Map();
+    /** The item id of the most recent function_call, which is what a following reasoning describes. */
+    lastCallId;
+    /** The field a Chat vendor's reasoning arrived under; the same one it is replayed under. */
+    chatReasoningField = "reasoning_content";
     messageId = `msg_${crypto.randomBytes(12).toString("hex")}`;
     servedTier;
     content = [];
     usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 };
     stopReason = "end_turn";
+    /** How many reasoning items this response handed over whole. The `reasoning=` figure in the log. */
+    reasoningCount = 0;
     model;
     startInput;
     /** Mangled tool name → the name Claude Code knows, from `toolNameRestoreMap`. */
     toolNames;
+    /** What goes in each envelope: the provider and model this stream is going to (reasoning.ts). */
+    env;
+    /**
+     * The wire this stream is on. It is fixed for the mapper's life — the adapter knows it before the
+     * first event. Decides what a closing block does: on Chat the block itself is the carrier.
+     */
+    wire = "chat";
     /** Applied to every error message before it is stored or sent. */
     redactError = (message) => message;
-    constructor(model, startInput = 0, toolNames = new Map()) {
+    constructor(model, startInput = 0, toolNames = new Map(), env = { p: "", m: "" }) {
         this.model = model;
         this.startInput = startInput;
         this.toolNames = toolNames;
+        this.env = { p: env.p, m: env.m || model };
     }
     get isFinished() { return this.finished; }
     /**
@@ -315,17 +406,40 @@ export class OpenAiStreamMapper {
         this.started = true;
         return [{ event: "message_start", data: { type: "message_start", message: { id: this.messageId, type: "message", role: "assistant", model: this.model, content: [], stop_reason: null, stop_sequence: null, usage: { input_tokens: this.startInput, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 } } } }];
     }
+    /**
+     * Close the block that is open, writing any envelope it carries as a `signature_delta` first — last
+     * in the block, after all of its text, the order Anthropic's own thinking blocks use.
+     *
+     * A Chat reasoning block is sealed here, because only now is its text whole; a Responses one was
+     * sealed by its item (see `sealReasoningItem`) before this is reached, so it never gets here
+     * unsigned.
+     */
     closeBlock() {
         if (!this.open)
             return [];
-        const index = this.open.index;
+        const { index, kind, block } = this.open;
+        let signature = this.open.signature;
+        if (signature === undefined && kind === "thinking" && this.wire === "chat") {
+            signature = this.signatureForChat(block);
+        }
         this.open = null;
-        return [{ event: "content_block_stop", data: { type: "content_block_stop", index } }];
+        const out = [];
+        if (signature !== undefined)
+            out.push({ event: "content_block_delta", data: { type: "content_block_delta", index, delta: { type: "signature_delta", signature } } });
+        out.push({ event: "content_block_stop", data: { type: "content_block_stop", index } });
+        return out;
     }
-    openBlock(kind, contentBlock, toolIndex) {
+    /**
+     * `block` is the caller's entry in `this.content` for this block, when it has one. It is held here
+     * rather than found as the last entry, because a Chat caller pushes the entry it is about to open
+     * *before* calling this — which would close the block against the wrong entry.
+     */
+    openBlock(kind, contentBlock, toolIndex, block) {
         const out = this.closeBlock();
         const index = ++this.blockIndex;
-        this.open = { kind, index, ...(toolIndex === undefined ? {} : { toolIndex }) };
+        if (block !== undefined)
+            this.content.push(block);
+        this.open = { kind, index, ...(toolIndex === undefined ? {} : { toolIndex }), ...(block === undefined ? {} : { block }) };
         out.push({ event: "content_block_start", data: { type: "content_block_start", index, content_block: contentBlock } });
         return out;
     }
@@ -371,27 +485,34 @@ export class OpenAiStreamMapper {
         for (const choice of choices) {
             const delta = choice.delta ?? {};
             // Thinking arrives before the answer, so it opens the first block of the turn. `reasoning` is
-            // accepted alongside `reasoning_content` because vendors on this wire disagree on the name.
-            const reasoning = typeof delta.reasoning_content === "string" && delta.reasoning_content ? delta.reasoning_content
-                : typeof delta.reasoning === "string" && delta.reasoning ? delta.reasoning : "";
+            // accepted alongside `reasoning_content` because vendors on this wire disagree on the name;
+            // the name it arrived under is remembered, because the same name is what the reasoning has to
+            // be replayed under on the next turn (reasoning.ts).
+            const field = typeof delta.reasoning_content === "string" && delta.reasoning_content ? "reasoning_content"
+                : typeof delta.reasoning === "string" && delta.reasoning ? "reasoning" : null;
+            const reasoning = field === "reasoning_content" ? delta.reasoning_content : field === "reasoning" ? delta.reasoning : "";
+            if (field)
+                this.chatReasoningField = field;
             if (reasoning) {
                 if (!this.open || this.open.kind !== "thinking") {
-                    this.content.push({ type: "thinking", thinking: "" });
-                    out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
+                    // A Chat model's reasoning has no sealed blob to resume from, so the carrier is the block
+                    // itself: the block's text is the reasoning to replay, and its signature is the envelope
+                    // naming the field to replay it under (reasoning.ts). It is sealed when the block closes,
+                    // so the envelope is built once the whole string has arrived (see `signatureForChat`).
+                    out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }, undefined, { type: "thinking", thinking: "" }));
                 }
-                const last = this.content[this.content.length - 1];
-                if (last?.type === "thinking")
-                    last.thinking += reasoning;
+                const block = this.open?.block;
+                if (block)
+                    block.thinking += reasoning;
                 out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "thinking_delta", thinking: reasoning } } });
             }
             if (typeof delta.content === "string" && delta.content) {
                 if (!this.open || this.open.kind !== "text") {
-                    this.content.push({ type: "text", text: "" });
-                    out.push(...this.openBlock("text", { type: "text", text: "" }));
+                    out.push(...this.openBlock("text", { type: "text", text: "" }, undefined, { type: "text", text: "" }));
                 }
-                const last = this.content[this.content.length - 1];
-                if (last?.type === "text")
-                    last.text += delta.content;
+                const block = this.open?.block;
+                if (block)
+                    block.text += delta.content;
                 out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "text_delta", text: delta.content } } });
             }
             if (Array.isArray(delta.tool_calls)) {
@@ -417,6 +538,42 @@ export class OpenAiStreamMapper {
         }
         return out;
     }
+    /**
+     * Seal a closing thinking block of our own: a Chat block into the envelope that names the field to
+     * replay its text under (see `feedChat`).
+     */
+    signatureForChat(block) {
+        if (this.wire !== "chat" || block?.type !== "thinking" || block.thinking.length === 0)
+            return undefined;
+        const signature = encodeEnvelope({ w: "chat", p: this.env.p, m: this.env.m, f: this.chatReasoningField });
+        block.signature = signature;
+        this.reasoningCount++;
+        return signature;
+    }
+    /**
+     * Put the finished Responses reasoning item into the envelope its block carries: the wire, this
+     * provider and model, and the item itself — type, id, summary and the backend's sealed blob,
+     * untouched (reasoning.ts). An item the backend did not seal has nothing to resume, so its block
+     * stays unsigned and only its summary survives, as display text.
+     */
+    sealReasoningItem(item) {
+        const held = this.reasoningItems.get(item.id);
+        const block = item.block;
+        block.thinking = held?.text.trim() || block.thinking.trim() || (typeof held?.summary === "string" ? held.summary.trim() : "");
+        if (!held?.encrypted) {
+            // An item the backend did not seal has nothing to resume. The block stays unsigned, so the
+            // client treats it as display text and never replays it (reasoning.ts).
+            block.signature = "";
+            return;
+        }
+        const reasoning = { type: "reasoning", encrypted_content: held.encrypted };
+        if (item.id)
+            reasoning.id = item.id;
+        if (Array.isArray(held.summary))
+            reasoning.summary = held.summary;
+        block.signature = encodeEnvelope({ w: "responses", p: this.env.p, m: this.env.m, r: reasoning });
+        this.reasoningCount++;
+    }
     responseItem(id, kind) {
         if (typeof id === "string")
             return this.responseItemsById.get(id);
@@ -452,6 +609,24 @@ export class OpenAiStreamMapper {
                 item.closed = true;
                 continue;
             }
+            if (item.kind === "reasoning") {
+                // Emitted only once the item is done, because the block is handed over whole: the sealed
+                // reasoning is what goes in the envelope, and it may only arrive with the completed item.
+                // `sealReasoningItem` has already put the envelope on the block by then.
+                if (!item.done)
+                    break;
+                const reasoning = item.block;
+                out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
+                if (reasoning.signature !== undefined)
+                    this.open = { ...this.open, signature: reasoning.signature };
+                if (reasoning.thinking)
+                    out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "thinking_delta", thinking: reasoning.thinking } } });
+                item.emitted = true;
+                item.emittedText = reasoning.thinking.length;
+                out.push(...this.closeBlock());
+                item.closed = true;
+                continue;
+            }
             const tool = item.block;
             out.push(...this.openBlock("tool", { type: "tool_use", id: tool.id, name: tool.name, input: {} }, tool.index));
             if (tool.args) {
@@ -480,12 +655,28 @@ export class OpenAiStreamMapper {
                 this.responseItemsById.set(id, responseItem);
             }
             else if (id && item?.type === "function_call") {
+                this.lastCallId = item.call_id === undefined || item.call_id === null ? id : String(item.call_id);
                 const index = this.content.filter((block) => block.type === "tool_use").length;
                 const tool = this.toolFor(index, { id: item.call_id ?? item.id, function: { name: item.name } });
                 const responseItem = { id, kind: "tool", block: tool, done: false, emitted: false, closed: false, emittedText: 0 };
                 this.responseItems.push(responseItem);
                 this.responseItemsById.set(id, responseItem);
             }
+            else if (id && item?.type === "reasoning") {
+                // The item's sealed reasoning and summary, held until the item is done: the block handed over
+                // carries both, and a half-assembled one must not reach the client (reasoning.ts).
+                const reasoning = {
+                    ...(typeof item.encrypted_content === "string" && item.encrypted_content ? { encrypted: item.encrypted_content } : {}),
+                    summary: item.summary,
+                    text: "",
+                };
+                this.reasoningItems.set(id, reasoning);
+                const block = { type: "thinking", thinking: "" };
+                this.content.push(block);
+                const responseItem = { id, kind: "reasoning", block, done: false, emitted: false, closed: false, emittedText: 0 };
+                this.responseItems.push(responseItem);
+                this.responseItemsById.set(id, responseItem);
+            }
         }
         else if (type === "response.output_text.delta") {
             const text = typeof ev.delta === "string" ? ev.delta : "";
@@ -511,10 +702,40 @@ export class OpenAiStreamMapper {
                 }
             }
         }
+        else if (type === "response.reasoning_summary_text.delta" || type === "response.reasoning_text.delta") {
+            // The summary, shown as the thinking block's text. When there is none — which is the usual
+            // shape — nothing arrives and the block stays empty, exactly as the item was measured.
+            const text = typeof ev.delta === "string" ? ev.delta : "";
+            const item = this.responseItem(ev.item_id, "reasoning");
+            if (item?.kind === "reasoning" && text) {
+                const block = item.block;
+                block.thinking += text;
+                if (this.reasoningItems.get(item.id))
+                    this.reasoningItems.get(item.id).text += text;
+                if (item.emitted && this.open?.kind === "thinking") {
+                    out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.open.index, delta: { type: "thinking_delta", thinking: text } } });
+                    item.emittedText += text.length;
+                }
+            }
+        }
         else if (type === "response.output_item.done") {
-            const item = this.responseItem(ev.item_id ?? ev.item?.id);
-            if (item)
+            const done = ev.item;
+            const item = this.responseItem(ev.item_id ?? done?.id);
+            if (done?.encrypted_content !== undefined || done?.summary !== undefined) {
+                // The backend may seal the reasoning only when the item completes; take it from there too.
+                const held = this.reasoningItems.get(typeof (ev.item_id ?? done?.id) === "string" ? String(ev.item_id ?? done?.id) : "");
+                if (held) {
+                    if (typeof done.encrypted_content === "string" && done.encrypted_content)
+                        held.encrypted = done.encrypted_content;
+                    if (done.summary !== undefined)
+                        held.summary = done.summary;
+                }
+            }
+            if (item) {
                 item.done = true;
+                if (item.kind === "reasoning")
+                    this.sealReasoningItem(item);
+            }
         }
         else if (type === "response.completed" || type === "response.incomplete") {
             const response = ev.response;
@@ -535,6 +756,7 @@ export class OpenAiStreamMapper {
     feed(ev, wire) {
         if (this.finished)
             return [];
+        this.wire = wire;
         // Some OpenAI-compatible servers emit an ordinary `{error:{...}}` JSON SSE payload
         // instead of the Responses `error` event shape. Do not finish it as a successful answer.
         if (ev.error && typeof ev.error === "object") {

package/dist/router/src/reasoning.js

@@ -0,0 +1,157 @@
+// A translated reasoning model's own turn, carried through Claude Code's transcript.
+//
+// The Responses wire hands its model an opaque reasoning item — `{type:"reasoning", id, summary,
+// encrypted_content}` — and expects it back, byte for byte, in the position it came from, beside the
+// function calls of that same turn. That is not an optimisation: measured 2026-10-14 with Muse Spark
+// 1.3 at xhigh on a real tool loop, runs whose previous reasoning was not returned spent
+// 9.5k–24.5k reasoning tokens each (2,197 per step past 80k context) and one of three ran out of
+// context without ever answering, where the same loop with the items returned spent 3.2k–4.3k per
+// run (725 per step past 80k), answered in all three, and read 94% prompt cache. Dropping the reasoning is why a routed worker "thinks from
+// scratch on every tool call" and then dies. DeepSeek's own Chat API states the same rule for
+// `reasoning_content`: with `tools` present it "must be fully passed back to the API in all
+// subsequent requests", even for turns that made no tool call, and the API answers a 400 otherwise
+// (https://api-docs.deepseek.com/guides/thinking_mode/, read 2026-10-14).
+//
+// The router keeps no state of its own here. Claude Code resends the whole conversation every turn,
+// so the transcript is the storage. The carrier is a `thinking` block's `signature`, which is a
+// free-form string on the wire and is replayed with the block [measured 2026-10-14 against a fake
+// upstream: a thinking block carrying our signature comes back on the next request of a tool loop
+// with the signature byte-identical, and an *empty* thinking text is kept too — which is what a
+// Responses reasoning item with no summary looks like]. Anthropic's own signature is opaque base64
+// this router cannot forge; ours is a small envelope that names the wire, the provider, the model
+// and the vendor's own reasoning, and it is decoded and dropped by `thinking.ts` before a request
+// reaches Anthropic.
+//
+// opencodex (github.com/lidge-jun/opencodex, devlog/_fin/260711_claude_inbound/003_evidence.md
+// lines 93-118) reached the same conclusion and the same carrier — a signature on a thinking block,
+// read back out of the client's own conversation — and we rely on that as a behavioral
+// specification only; no code was copied.
+//
+// `encrypted_content` is the vendor's own sealed blob. It goes in the envelope untouched and comes
+// back untouched: re-encoding or re-signing it would be the "re-signed reasoning" mistake that cost
+// an earlier translator 12–20% cache hit (ARCHITECTURE §4, "Cache-safety decisions").
+//
+// `include:["reasoning.encrypted_content"]` is asked for on every turn where the vendor is known to
+// take it — the ChatGPT backend, as Codex asks, and a preset marked `sealedReasoning` (presets.ts),
+// as OpenCode's own client asks. A `store: false` backend that is not asked hands back nothing, so
+// waiting until a conversation already carried reasoning would never start one. For any other
+// Responses vendor it is asked for only once the conversation already carries that vendor's
+// reasoning, so a vendor never measured keeps the request it had. Measured 2026-10-14 against
+// OpenCode Go (`muse-spark-1.3-contributor`, one tool-bearing turn): the sealed item came back with
+// `include` and without it, both 1426 bytes, and replaying it in place answered 200. The same vendor
+// also accepted a tampered blob and a turn with the item dropped entirely (both 200), so the 4xx
+// retry below is a safety net for a vendor or an account that is stricter.
+/** Names an envelope as ours. Anthropic's own signatures never start with it. */
+export const ENVELOPE_PREFIX = "clauderipple.v1:";
+/** Thrown when a signature looks like ours and does not decode. */
+export class UndecodableEnvelope extends Error {
+}
+/**
+ * Our marker on a block, without decoding it: the cheap test `thinking.ts` and the request builders
+ * need before doing any work. Anthropic's own signatures are base64 and never carry this prefix.
+ */
+export function isOurSignature(signature) {
+    return typeof signature === "string" && signature.startsWith(ENVELOPE_PREFIX);
+}
+/** The `signature` of a block of ours: the envelope, base64url so it survives any signature field. */
+export function encodeEnvelope(envelope) {
+    return ENVELOPE_PREFIX + Buffer.from(JSON.stringify(envelope), "utf8").toString("base64url");
+}
+function envelope(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const e = value;
+    if (typeof e.p !== "string" || typeof e.m !== "string")
+        return null;
+    if (e.w === "chat")
+        return typeof e.f === "string" && e.f.length > 0 ? { w: "chat", p: e.p, m: e.m, f: e.f } : null;
+    if (e.w === "responses")
+        return e.r && typeof e.r === "object" ? { w: "responses", p: e.p, m: e.m, r: e.r } : null;
+    return null;
+}
+/**
+ * The envelope on a signature, or null when it is not ours. A signature that carries our prefix and
+ * does not decode is a broken carrier, not a foreign one, so it throws rather than passing silently
+ * as someone else's — the caller logs it and moves on.
+ */
+export function decodeEnvelope(signature) {
+    if (!isOurSignature(signature))
+        return null;
+    const text = signature.slice(ENVELOPE_PREFIX.length);
+    // Guard the decode: a signature is attacker-visible text and a gigabyte of base64 must not become
+    // a gigabyte of JSON. A sealed reasoning blob runs a few KB.
+    if (text.length > 512 * 1024)
+        throw new UndecodableEnvelope("envelope too large");
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(text, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new UndecodableEnvelope("envelope did not decode");
+    }
+    const decoded = envelope(parsed);
+    if (!decoded)
+        throw new UndecodableEnvelope("envelope was not a recognizable shape");
+    return decoded;
+}
+/**
+ * Whether a stored item is worth replaying at all. A reasoning item with no `encrypted_content`
+ * carries nothing the backend can resume — the summary is text it thinks in, not state — so it is
+ * not carried and never replayed. Measured 2026-10-14 (Codex records, 161 items across one day):
+ * every item the CLI replayed had the sealed blob, and most had an empty summary.
+ */
+export function replayableReasoning(stored) {
+    if (stored.type !== "reasoning")
+        return null;
+    const encrypted = stored.encrypted_content;
+    if (typeof encrypted !== "string" || encrypted.length === 0)
+        return null;
+    // Only the fields the wire defines are forwarded: a vendor's item may carry bookkeeping
+    // (`internal_chat_message_metadata_passthrough`) that is meaningless and unverified to send back.
+    const out = { type: "reasoning", encrypted_content: encrypted };
+    if (typeof stored.id === "string" && stored.id.length > 0)
+        out.id = stored.id;
+    if (Array.isArray(stored.summary))
+        out.summary = stored.summary;
+    return out;
+}
+/**
+ * The envelope on an assistant block, when it is ours *and* usable here: the right wire, and the
+ * same provider and model that made it. Anything else returns null as if the block were foreign —
+ * reasoning is state, and state from another model is not merely useless, it is the thing a vendor
+ * refuses. A signature that is ours but broken, or names another model, reports through `onDrop` so
+ * the caller can count it; neither is an error worth failing a turn over.
+ */
+export function envelopeFor(block, wire, env, onDrop) {
+    const b = block;
+    if (!b || typeof b !== "object" || b.type !== "thinking" || !isOurSignature(b.signature))
+        return null;
+    let decoded;
+    try {
+        const got = decodeEnvelope(b.signature);
+        if (!got)
+            return null;
+        decoded = got;
+    }
+    catch {
+        onDrop("the envelope did not decode");
+        return null;
+    }
+    if (decoded.w !== wire)
+        return null;
+    if (env && (decoded.p !== env.p || decoded.m !== env.m)) {
+        onDrop(`reasoning came from ${decoded.p}/${decoded.m}`);
+        return null;
+    }
+    return decoded;
+}
+/** `type` matters as much as the wording: a vendor that says "reasoning" is answering about this. */
+const REASONING_REFUSAL = /reasoning|encrypted|\binput\[\d+\]|\bitem\b|signature/i;
+/**
+ * Whether a 4xx refusal is about the reasoning that was replayed, and so is worth one retry without
+ * it. Only a request that carried replayed reasoning can be refused for carrying it, and a sealed
+ * blob minted on one account or one model is the thing most likely to be refused on another.
+ */
+export function refusesReplayedReasoning(status, message) {
+    return status >= 400 && status < 500 && (status === 422 || REASONING_REFUSAL.test(message));
+}

package/dist/router/src/thinking.js

@@ -1,16 +1,27 @@
 // Thinking blocks another model left in a conversation that is now going to Anthropic.
 //
-// The translated providers hand the CLI their reasoning as `thinking` blocks with no signature —
-// there is no Anthropic signature to give — and an empty `thinking` when the upstream sent a
-// reasoning item without a summary. The CLI keeps them in the transcript, so a session switched
-// from such a model to a Claude model replays them, and Anthropic refuses the whole request:
-// "messages.2.content.0.thinking: each thinking block must contain thinking" (measured 2026-09-28,
-// gpt-6-astra → claude-opus-5-5, every retry of the turn). A block Anthropic wrote always carries a
-// signature, so an unsigned one is foreign and goes; the translated providers drop thinking from
-// replayed history for the same reason (ARCHITECTURE §4, "Cache-safety decisions").
+// The translated providers hand the CLI their reasoning as `thinking` blocks, and an empty `thinking`
+// when the upstream sent a reasoning item without a summary. The CLI keeps them in the transcript, so
+// a session switched from such a model to a Claude model replays them, and Anthropic refuses the
+// whole request: "messages.2.content.0.thinking: each thinking block must contain thinking" (measured
+// 2026-09-28, gpt-6-astra → claude-opus-5-5, every retry of the turn).
+//
+// A block Anthropic wrote always carries a signature of Anthropic's own, a base64 string this router
+// cannot produce. A translation provider cannot produce one either, so it signs with an envelope of
+// its own naming where the reasoning came from (reasoning.ts) — which Anthropic would refuse just as
+// fast, and which is why those go too. What is left that is signed is Anthropic's.
+//
+// The translated adapters themselves keep their own replayed reasoning (that is the point of the
+// envelope), so this is the one place a translated provider's thinking must still be dropped: a
+// CLI-side switch to a Claude model. Gemini and the other translators drop `thinking` on their own.
+import { isOurSignature } from "./reasoning.js";
 function foreign(block) {
     const b = block;
-    return !!b && typeof b === "object" && b.type === "thinking" && !(typeof b.signature === "string" && b.signature.length > 0);
+    if (!b || typeof b !== "object" || b.type !== "thinking")
+        return false;
+    // Unsigned: a translated provider's reasoning with nothing to carry, or an empty reasoning item.
+    // Ours: a translated provider's envelope, which only its own adapter can read back.
+    return !(typeof b.signature === "string" && b.signature.length > 0) || isOurSignature(b.signature);
 }
 /**
  * Removes unsigned thinking blocks from assistant turns, in place, and returns how many went.

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.9.4";
+export const VERSION = "0.9.5";

package/docs/ARCHITECTURE.md

@@ -731,8 +731,13 @@ must preserve **Data: Artificial Analysis (artificialanalysis.ai)** attribution.
   - `WebFetch` needs none of this: the CLI fetches the URL itself (its own transport, cache and
     preflight; there is no `web_fetch` server tool in the binary) and has the session's model read
     the text. It works on any provider.
-  - Cache-safety decisions: thinking blocks are dropped from replayed history;
-    no reasoning `include`; identity line and `instructionsAppend` are constant
+  - Cache-safety decisions: a translated provider's own reasoning that comes back with the
+    request is sent back **byte-identically, in its original position** — that is what the
+    vendor's native clients do, and it is not a `cache_control` breakpoint; the forbidden
+    thing is *altering or re-signing* reasoning, which is what cost 12–20% cache (2026-09-20).
+    A thinking block of ours that names no vendor model, or another model than this request's,
+    is dropped (§5, "Muse workers"); foreign thinking of any other kind is dropped from
+    replayed history; identity line and `instructionsAppend` are constant
     text; `prompt_cache_key` = sha256(metadata.user_id + first user message),
     and sha256(system prompt) for a request that carries no `metadata.user_id`
     and one lone user turn — see the conversation-key note in §4.
@@ -1061,9 +1066,11 @@ what we do not have yet — so that adding a provider does not start with readin
   config still written as three providers is folded on the way in and its `direct` and
   `routes` references follow; nothing is rewritten on disk, so it stays readable by an
   older router until the GUI saves it.
-- Translation deliberately strips `thinking`, `context_management`, `thread`,
+- Translation deliberately strips `context_management`, `thread`,
   `diagnostics`, and `container`; `thread:continue` is refused exactly as in §4a so
-  the CLI resends a full stateless history. The per-turn
+  the CLI resends a full stateless history. Thinking is stripped by default too —
+  except the reasoning this adapter itself handed out, which returns as the vendor's
+  own item (see the reasoning-replay note below). The per-turn
   `x-anthropic-billing-header` system block is also stripped because its changing
   value breaks every vendor's stable-prefix cache opportunity. Orphan tool results
   are sent as user text, not a tool result with no antecedent call.
@@ -1085,6 +1092,50 @@ what we do not have yet — so that adding a provider does not start with readin
   before (`catalog.ts`, `capabilities.ts`). Chat wire
   forwards Anthropic `stop_sequences` as `stop`; Responses wire deliberately omits
   them because its common stateless schema has no corresponding universal field.
+- **Reasoning replay (both wires, 2026-10-14).** A reasoning model on either wire
+  expects its own previous reasoning back on the next turn of a tool loop, and does
+  badly without it. Measured on OpenCode Go's Muse at `xhigh`, same task, 3 runs
+  each: with no replay 9.5k–24.5k reasoning tokens per run (2,197 per step past 80k
+  context) and one run exhausted the context with no answer; with replay 3.2k–4.3k
+  per run (725 per step past 80k) and all three answered, 94% cached.
+  Native clients (OpenCode, the Codex CLI) do this by carrying the vendor's item in
+  their own transcript and putting it back byte-for-byte where it was.
+  Claude Code's transcript is the same medium, so the carrier is the **signature of a
+  thinking block**: `reasoning.ts` encodes `clauderipple.v1:` + base64url JSON
+  naming the wire, provider and model and the thing to restore — the vendor's whole
+  Responses item for the Responses wire, or just the field name
+  (`reasoning_content` / `reasoning`) for Chat. On the Responses wire the item is
+  `{type:"reasoning", id, summary, encrypted_content}` and the request asks for it
+  with `include:["reasoning.encrypted_content"]` (with `store:false` and
+  `reasoning.summary:"auto"`, both of which the chatgpt adapter already sent); the
+  block's text is the summary, or empty when the item had none. `include` is sent on
+  every turn to the ChatGPT backend (as Codex sends it) and to a preset marked
+  `sealedReasoning` (OpenCode Go, as OpenCode's own client sends it): a `store:false`
+  backend that is not asked hands back nothing, so asking only once a conversation
+  already carried reasoning would never start one. Any other Responses vendor is asked
+  only once its own reasoning is already being carried, so an unmeasured vendor keeps
+  its old request. Measured 2026-10-14 against OpenCode Go: the sealed item came back
+  with `include` and without it (1426 bytes either way), replaying it in place
+  answered 200, and the vendor tolerated both a tampered blob and a dropped item. On Chat the
+  block's own text *is* the reasoning and it is reassembled into the field it arrived
+  under on that assistant message — DeepSeek's docs make that mandatory whenever
+  `tools` is present (`https://api-docs.deepseek.com/guides/thinking_mode/`), and it
+  is harmless where a vendor ignores it, so this is not gated by an allowlist.
+  Restore happens only when the envelope names this request's provider and model
+  (model scope validation): another model's or account's `encrypted_content` is a
+  400, and the envelope says whose it is. This is not exposed as a setting, and it
+  does not weaken the cache lesson above — the vendor's bytes are re-sent unchanged,
+  never re-signed or edited. `opencodex` (github.com/lidge-jun/opencodex,
+  `devlog/_fin/260711_claude_inbound/003_evidence.md:93-118`) uses the same
+  envelope-in-the-transcript approach and measured that Claude Code replays thinking
+  blocks with their signature and does not validate it client-side; no code was
+  copied from it. A 4xx that names reasoning/encrypted/item is answered by asking
+  **once more without any replayed reasoning**, so an account switch that invalidates
+  `encrypted_content` costs a little cache and not the turn. `router.log` and
+  `requests.jsonl` carry `replayed=<n>` (items put back) and `reasoning=<n>` (items
+  handed to the client). Gemini and the other translators strip these blocks; a
+  conversation switched to a Claude model does too (`thinking.ts`), since Anthropic
+  would reject a foreign signature.
 - We do not assert a provider-wide cache hit rate: the adapter records
   `prompt_tokens_details.cached_tokens` / `input_tokens_details.cached_tokens` when
   a vendor returns it, and otherwise logs zero cache read. The byte-stable
@@ -1386,6 +1437,7 @@ plan unless marked otherwise.
 | Adding a provider in the settings window restored three OpenCode effort ladders realigned by hand five hours earlier, so the app's effort menus for DeepSeek and GLM never narrowed (2026-10-02 23:13, found 10-05). `PUT /api/config` takes the whole config, and the screen built it from the copy it loaded at open and never re-read; the router itself also writes `config.json` (a measurement's results), so any of those was undone by the next unrelated save | Every GUI save fetches the router's config first and applies its own change to that. A provider form, which holds per-model fields (wire, ladder, window) from when it opened and has no control for them, takes a saved model's values from the router's copy. The provider and client screens re-read the config whenever they load. |
 | In picker mode, claude.ai requests failed as `502 … ECONNRESET` in under a second — 259 times in four days (2026-10-03..06), mostly `current_user_access`, `desktop/features` and `event_logging`. The kept-alive upstream socket had been closed by claude.ai as the next request was written on it, and Node does not resend | A GET/HEAD/OPTIONS whose reused socket resets before any response is sent again (twice at most), logged `STALE`. A POST is never resent: a reset does not prove the upstream did not act on it. Not yet shown to be the cause of the Windows "chat history loads forever" report (DC, 2026-10-06). |
 | An API-key provider with no declared effort ladder — DeepSeek, Kimi, GLM, MiniMax, Qwen, Groq, Mistral, a key and a URL — stripped every effort the user picked (`effort high→removed`) and the Claude app showed no effort menu for its models (DC reports, 2026-10-06). Declaring nothing was meant as "do not guess", but DeepSeek's API, for one, validates `output_config.effort` and maps it onto low/high/max | When nothing declares a ladder (no config ladder, no preset ladder, OpenAI-compatible `reasoning` not `effort` — the form writes `none` by default), a measurement sends a level no vendor defines first: accepted means the field is ignored (no effort, `[]`); refused means it is validated, and the levels the refusal names (else every known one) are sent one by one and the accepted ones become the model's ladder. A 429/5xx concludes nothing. The router runs this a minute after start for unsettled models, so existing providers need no re-save. The DeepSeek preset now declares low/high/max from its docs. |
+| Muse workers spent minutes per tool call, repeated the same reasoning every step, and one ended with no answer at all (2026-10-14). A reasoning model on a translated wire was getting its own previous reasoning dropped, so each step reasoned the whole problem again from scratch: measured at `xhigh` on OpenCode Go, 9.5k–24.5k reasoning tokens per run without replay against 3.2k–4.3k with it (3 runs each; 2,197 against 725 per step past 80k context; one no-replay run exhausted the context) | The vendor's reasoning is carried in the client's transcript and put back byte-identically at its original position: the Responses item whole, under `include:["reasoning.encrypted_content"]`, and on Chat its text as `reasoning_content`. `reasoning.ts` states the envelope; a block whose envelope names another provider or model is dropped, and a 4xx naming the reasoning is retried once without it. |
 | ChatGPT accounts that had bought Codex credits were rested by the router the moment a window read 100%, though OpenAI serves them from credits past the window | `exhaustedForMs` ignores a full window while `credits.has_credits` or `unlimited` holds (and `overage_limit_reached` does not); an actual 429 still rests the account until the window resets. |
 
 ## 6. Blocked paths (measured, do not retry)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clauderipple",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs out, in Codex too.",
   "license": "GPL-3.0-only",
   "workspaces": [