codex-copilot-dx 0.6.13 → 0.6.15

package/src/responses-handler.mjs

@@ -1,4 +1,5 @@
 import { getCachedModelEndpoints } from "./copilot.mjs";
+import { applyCopilotResponsesRequestPolicies } from "./copilot-responses-policy.mjs";
 import {
   createRequestAbort,
   logRequestFailure,
@@ -20,10 +21,13 @@ import { clearResponsesToolOutputPartsCache } from "./responses-content.mjs";
 import { proxyCopilotResponses } from "./responses-proxy.mjs";
 import { responseHistoryMaterializedBytes } from "./response-history.mjs";
 import {
+  applyResponseHistoryRoutePlan,
   dropMaterializedResponseHistory,
   prepareResponsesRequest,
   rememberResponseHistory,
+  responseHistoryPressureRootId,
 } from "./responses-request.mjs";
+import { createRoutePlan } from "./route-plan.mjs";
 import { status } from "./status.mjs";
 import { endStreamWithError } from "./stream-errors.mjs";
 import { safeUpstreamResponseHeaders } from "./upstream-headers.mjs";
@@ -141,7 +145,7 @@ export function createResponsesHandler(options) {
     };
     const markAdaptiveHttpTimeout = (statusCode) => {
       if (statusCode !== 408) return false;
-      return imagePressure?.markTimeout?.(prepared?.historyRootId, {
+      return imagePressure?.markTimeout?.(responseHistoryPressureRootId(prepared), {
         eligible: imagePressureResult?.pressureEligible === true,
       }) || false;
     };
@@ -172,7 +176,11 @@ export function createResponsesHandler(options) {
         }
         assertPrepareActive();
       }
-      prepared = prepareResponsesRequest(parsed, { assertActive: assertPrepareActive, mutate: true });
+      prepared = prepareResponsesRequest(parsed, {
+        assertActive: assertPrepareActive,
+        copilotBoundary: false,
+        mutate: true,
+      });
       parsed = null;
       assertPrepareActive();
       imagePressureResult = imagePressure?.apply?.(prepared, { assertActive: assertPrepareActive }) || null;
@@ -192,7 +200,17 @@ export function createResponsesHandler(options) {
         || isResponsesOnlyModel(upstreamModel, getCachedModelEndpointsFn)
         || (usesCustomTools && cachedModelSupportsResponses(upstreamModel, getCachedModelEndpointsFn));
       if (usesCustomTools && !useNativeResponses) throw unsupportedCustomToolsError(upstreamModel);
-      if (useNativeResponses) {
+      const routePlan = createRoutePlan({
+        disposition: "relay",
+        origin: "ccdx",
+        profile: "codex",
+        protocol: useNativeResponses ? "openai-responses" : "openai-chat-completions",
+        model: upstreamModel,
+        surface: "responses",
+      });
+      prepared = applyResponseHistoryRoutePlan(prepared, routePlan);
+      applyCopilotResponsesRequestPolicies(prepared.body);
+      if (routePlan.protocol === "openai-responses") {
         const result = await proxyCopilotResponses(prepared, req, res, responsesFn, {
           assertPrepareActive,
           signal: abort.signal,
@@ -201,9 +219,9 @@ export function createResponsesHandler(options) {
           releaseRequest: releaseUpstreamPayload,
           streamIdleTimeoutMs,
         });
-        if (result?.successful) imagePressure?.markSuccess?.(prepared.historyRootId);
+        if (result?.successful) imagePressure?.markSuccess?.(responseHistoryPressureRootId(prepared));
         else markAdaptiveHttpTimeout(result?.upstreamStatus);
-      } else {
+      } else if (routePlan.protocol === "openai-chat-completions") {
         let { chatReq, bodyText } = await prepareResponsesChatPayload(prepared, {
           assertActive: assertPrepareActive,
           payloadOptions: responsesPayloadOptions,
@@ -254,7 +272,7 @@ export function createResponsesHandler(options) {
               });
             },
           });
-          if (successful) imagePressure?.markSuccess?.(prepared.historyRootId);
+          if (successful) imagePressure?.markSuccess?.(responseHistoryPressureRootId(prepared));
         } else {
           try {
             startUpstreamTimeout();
@@ -272,7 +290,7 @@ export function createResponsesHandler(options) {
             }
             const response = chatToResponses(JSON.parse(data), model);
             rememberResponseHistory(prepared, response);
-            imagePressure?.markSuccess?.(prepared.historyRootId);
+            imagePressure?.markSuccess?.(responseHistoryPressureRootId(prepared));
             recordResponsesUsage({ surface: prepared.surface, mode: "json", model, response, event: response });
             res.writeHead(200, safeUpstreamResponseHeaders(upstream.headers, {
               contentType: "application/json",
@@ -284,6 +302,8 @@ export function createResponsesHandler(options) {
             sendJsonError(res, responseError, 502);
           }
         }
+      } else {
+        throw new Error(`Unsupported Responses target protocol: ${routePlan.protocol}`);
       }
     } catch (error) {
       const responseError = applyAdaptiveTimeout(error);
@@ -351,7 +371,11 @@ export function createResponsesCompactHandler(options) {
         assertPrepareActive();
       }
       prepared = prepareResponsesCompactionRequest(
-        prepareResponsesRequest(parsed, { assertActive: assertPrepareActive, mutate: true }),
+        prepareResponsesRequest(parsed, {
+          assertActive: assertPrepareActive,
+          copilotBoundary: false,
+          mutate: true,
+        }),
       );
       assertPrepareActive();
       prepared.surface = "responses_compact";
@@ -360,6 +384,15 @@ export function createResponsesCompactHandler(options) {
       if (upstreamModel !== requestedModel) prepared.body.model = upstreamModel;
       const upstreamLog = upstreamModel === requestedModel ? "" : ` upstream_model=${upstreamModel}`;
       console.log(status("info", `responses compact model=${requestedModel}${upstreamLog} stream=false`));
+      prepared = applyResponseHistoryRoutePlan(prepared, createRoutePlan({
+        disposition: "relay",
+        origin: "ccdx",
+        profile: "codex",
+        protocol: "openai-responses",
+        model: upstreamModel,
+        surface: "responses-compact",
+      }));
+      applyCopilotResponsesRequestPolicies(prepared.body);
       const result = await proxyCopilotResponses(prepared, req, res, responsesCompactFn, {
         assertPrepareActive,
         signal: abort.signal,
@@ -367,7 +400,7 @@ export function createResponsesCompactHandler(options) {
         onUpstreamStart: startUpstreamTimeout,
         releaseRequest: releaseUpstreamPayload,
       });
-      if (result?.compacted) imagePressure?.clear?.(prepared.historyRootId);
+      if (result?.compacted) imagePressure?.clear?.(responseHistoryPressureRootId(prepared));
     } catch (error) {
       logRequestFailure("Responses compact", error, abort);
       sendJsonError(res, error, 502);

package/src/responses-proxy.mjs

@@ -5,7 +5,8 @@ import {
   sendUpstreamError,
   writeOrDrain,
 } from "./http-transport.mjs";
-import { openCopilotResponse, rememberResponseHistory } from "./responses-request.mjs";
+import { openCopilotResponse } from "./copilot-responses-compat.mjs";
+import { rememberResponseHistory } from "./responses-request.mjs";
 import {
   compactionInputWithoutTrigger,
   parseResponsesCompactionResult,
@@ -81,15 +82,38 @@ function inspectResponseSseEvent(state, eventName, data) {
   state.completed = { response, event };
 }
 
-function readSseEvents(buffer, onEvent) {
-  while (true) {
-    const match = buffer.match(/\r?\n\r?\n/);
-    if (!match) return buffer;
-    const chunk = buffer.slice(0, match.index);
-    if (Buffer.byteLength(chunk) > MAX_SSE_BUFFER_BYTES) {
+function createResponseSseInspector(state) {
+  let eventBuffer = Buffer.allocUnsafe(Math.min(4096, MAX_SSE_BUFFER_BYTES + 4));
+  let eventLength = 0;
+  let previous1 = -1;
+  let previous2 = -1;
+  let previous3 = -1;
+
+  const ensureCapacity = (required) => {
+    if (required > MAX_SSE_BUFFER_BYTES + 4) {
+      throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
+    }
+    if (required <= eventBuffer.length) return;
+    let capacity = eventBuffer.length;
+    while (capacity < required) capacity = Math.min(MAX_SSE_BUFFER_BYTES + 4, Math.max(capacity * 2, required));
+    const next = Buffer.allocUnsafe(capacity);
+    eventBuffer.copy(next, 0, 0, eventLength);
+    eventBuffer = next;
+  };
+
+  const append = (bytes) => {
+    if (!bytes.byteLength) return;
+    ensureCapacity(eventLength + bytes.byteLength);
+    eventBuffer.set(bytes, eventLength);
+    eventLength += bytes.byteLength;
+  };
+
+  const inspectEvent = (delimiterLength) => {
+    const contentLength = eventLength - delimiterLength;
+    if (contentLength > MAX_SSE_BUFFER_BYTES) {
       throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
     }
-    buffer = buffer.slice(match.index + match[0].length);
+    const chunk = eventBuffer.subarray(0, contentLength).toString("utf8");
     const lines = chunk.split(/\r?\n/);
     const eventName = lines
       .find((line) => line.startsWith("event:"))
@@ -99,8 +123,73 @@ function readSseEvents(buffer, onEvent) {
       .filter((line) => line.startsWith("data:"))
       .map((line) => line.slice(5).trimStart())
       .join("\n");
-    if (data) onEvent(eventName, data);
+    if (data) inspectResponseSseEvent(state, eventName, data);
+    eventLength = 0;
+    previous1 = -1;
+    previous2 = -1;
+    previous3 = -1;
+  };
+
+  return {
+    push(value) {
+      let segmentStart = 0;
+      for (let index = 0; index < value.byteLength; index += 1) {
+        const byte = value[index];
+        let delimiterLength = 0;
+        if (byte === 0x0a && previous1 === 0x0a) {
+          delimiterLength = previous2 === 0x0d ? 3 : 2;
+        } else if (byte === 0x0a && previous1 === 0x0d && previous2 === 0x0a) {
+          delimiterLength = previous3 === 0x0d ? 4 : 3;
+        }
+        if (delimiterLength) {
+          append(value.subarray(segmentStart, index + 1));
+          inspectEvent(delimiterLength);
+          segmentStart = index + 1;
+          if (state.sawTerminal) return index + 1;
+          continue;
+        }
+        previous3 = previous2;
+        previous2 = previous1;
+        previous1 = byte;
+      }
+      append(value.subarray(segmentStart));
+      if (eventLength > MAX_SSE_BUFFER_BYTES + 3) {
+        throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
+      }
+      return null;
+    },
+  };
+}
+
+function invalidResponsesResponse(message) {
+  const error = httpError(message, 502);
+  error.code = "ccdx_invalid_responses_response";
+  error.jsonBody = {
+    error: {
+      message,
+      type: "upstream_error",
+      code: error.code,
+    },
+  };
+  return error;
+}
+
+function parseSuccessfulResponsesResult(text) {
+  let response;
+  try {
+    response = JSON.parse(text);
+  } catch {
+    throw invalidResponsesResponse("Copilot Responses returned invalid JSON");
+  }
+  if (!response
+    || typeof response !== "object"
+    || Array.isArray(response)
+    || typeof response.id !== "string"
+    || response.id.length === 0
+    || !Array.isArray(response.output)) {
+    throw invalidResponsesResponse("Copilot Responses returned an invalid response envelope");
   }
+  return response;
 }
 
 function storeCompletedResponse(reqContext, completed) {
@@ -138,35 +227,26 @@ export async function proxyCopilotResponses(reqContext, req, res, upstream = cop
       Connection: "keep-alive",
     });
     const reader = resp.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
     const streamState = {
       completed: null,
       sawTerminal: false,
       sawOutput: false,
       toolArgumentGuard: new ToolArgumentDeltaGuard(),
     };
+    const inspector = createResponseSseInspector(streamState);
     try {
       while (true) {
         const { done, value } = await reader.read();
         if (done) {
-          buffer += decoder.decode();
-          if (Buffer.byteLength(buffer) > MAX_SSE_BUFFER_BYTES) {
-            throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
-          }
-          readSseEvents(buffer, (eventName, data) => inspectResponseSseEvent(streamState, eventName, data));
           if (!streamState.sawTerminal) throw incompleteUpstreamStream("a terminal Responses event");
           storeCompletedResponse(reqContext, streamState.completed);
           res.end();
           return { successful: Boolean(streamState.completed), compacted: false };
         }
         options.abort?.setTimeout(options.streamIdleTimeoutMs, "stream_idle_timeout");
-        buffer += decoder.decode(value, { stream: true });
-        buffer = readSseEvents(buffer, (eventName, data) => inspectResponseSseEvent(streamState, eventName, data));
-        if (Buffer.byteLength(buffer) > MAX_SSE_BUFFER_BYTES) {
-          throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
-        }
-        if (!await writeOrDrain(res, value)) return;
+        const terminalOffset = inspector.push(value);
+        const forwarded = terminalOffset === null ? value : value.subarray(0, terminalOffset);
+        if (forwarded.byteLength > 0 && !await writeOrDrain(res, forwarded)) return;
         if (streamState.sawTerminal) {
           storeCompletedResponse(reqContext, streamState.completed);
           res.end();
@@ -202,24 +282,26 @@ export async function proxyCopilotResponses(reqContext, req, res, upstream = cop
       res.end(JSON.stringify(response));
       return { successful: true, compacted: true };
     }
+    if (resp.ok) {
+      const response = parseSuccessfulResponsesResult(data);
+      rememberResponseHistory(reqContext, response);
+      recordResponsesUsage({
+        surface: reqContext.surface,
+        mode: "json",
+        model: reqContext.body?.model,
+        response,
+        event: response,
+      });
+      res.writeHead(resp.status, safeUpstreamResponseHeaders(resp.headers, {
+        contentType: "application/json",
+      }));
+      res.end(data);
+      return { successful: true, compacted: false };
+    }
     res.writeHead(resp.status, safeUpstreamResponseHeaders(resp.headers, {
       contentType: "application/json",
     }));
     res.end(data);
-    if (resp.ok) {
-      try {
-        const response = JSON.parse(data);
-        rememberResponseHistory(reqContext, response);
-        recordResponsesUsage({
-          surface: reqContext.surface,
-          mode: "json",
-          model: reqContext.body?.model,
-          response,
-          event: response,
-        });
-        return { successful: true, compacted: false };
-      } catch {}
-    }
     return { successful: false, compacted: false };
   }
 }

package/src/responses-request.mjs

@@ -1,5 +1,4 @@
-import { responses as copilotResponses } from "./copilot.mjs";
-import { httpError } from "./http-transport.mjs";
+import { applyCopilotResponsesRequestPolicies } from "./copilot-responses-policy.mjs";
 import { debugLog } from "./log.mjs";
 import {
   materializeResponseHistory,
@@ -8,7 +7,20 @@ import {
 } from "./response-history.mjs";
 import { isResponsesToolOutputItem, readResponsesToolOutputParts } from "./responses-content.mjs";
 import { enforceResponsesImageLimit } from "./responses-image-limit.mjs";
-import { status } from "./status.mjs";
+import { routePlanAffinity, sameRoutePlanAffinity } from "./route-plan.mjs";
+
+export {
+  isEncryptedContentVerificationError,
+  isImageNamespaceCollisionError,
+  sanitizeImageNamespaceCollisionRequest,
+} from "./copilot-responses-policy.mjs";
+
+// Compatibility export for consumers that imported this helper before the
+// Copilot retry boundary moved into its provider-owned module.
+export async function openCopilotResponse(...args) {
+  const compatibility = await import("./copilot-responses-compat.mjs");
+  return compatibility.openCopilotResponse(...args);
+}
 
 function cloneJson(value) {
   return value === undefined ? undefined : structuredClone(value);
@@ -46,7 +58,7 @@ export function stripInternalResponsesInputFields(inputItems, { assertActive } =
 
 function responsesOutputItems(output) {
   if (!Array.isArray(output)) return [];
-  return output.filter((item) => ["message", "function_call", "custom_tool_call"].includes(item?.type));
+  return output.filter((item) => item && typeof item === "object");
 }
 
 function isCompactedResponsesOutput(output) {
@@ -62,8 +74,7 @@ function isSuccessfulCompactionResponse(response) {
 }
 
 function replayableResponsesOutputItems(output) {
-  if (!Array.isArray(output)) return [];
-  return output.filter((item) => item && typeof item === "object");
+  return responsesOutputItems(output);
 }
 
 function isEncryptedContentPart(value) {
@@ -72,6 +83,8 @@ function isEncryptedContentPart(value) {
 
 const OMIT_ENCRYPTED_CONTENT = Symbol("omit-encrypted-content");
 const ENCRYPTED_HISTORY_REBASE = Symbol("encrypted-history-rebase");
+const RELEASE_HISTORY_INPUT = Symbol("release-history-input");
+const HISTORY_PRESSURE_ROOT = Symbol("history-pressure-root");
 const ENCRYPTED_TOOL_OUTPUT_MARKER = "[CCDX: encrypted tool output omitted because upstream could not decrypt it.]";
 
 function stripEncryptedReasoningValue(value, state) {
@@ -160,7 +173,21 @@ function isEncryptedReasoningInputItem(item) {
   return keys.length === 1 && keys[0] === "encrypted_content";
 }
 
-export function sanitizeEncryptedReasoningRequest(reqContext) {
+function responseValueHasOpaqueState(value) {
+  if (Array.isArray(value)) return value.some(responseValueHasOpaqueState);
+  if (!value || typeof value !== "object") return false;
+  if (isEncryptedReasoningInputItem(value)
+    || Object.prototype.hasOwnProperty.call(value, "encrypted_content")) {
+    return true;
+  }
+  if (isResponsesToolOutputItem(value) && typeof value.output === "string") {
+    const parsed = readResponsesToolOutputParts(value);
+    if (parsed?.parts.some(responseValueHasOpaqueState)) return true;
+  }
+  return Object.values(value).some(responseValueHasOpaqueState);
+}
+
+export function sanitizeEncryptedReasoningRequest(reqContext, { historicalOnly = false } = {}) {
   const state = { changed: false };
   let body = cloneJson(reqContext.body);
   let currentInputStart = reqContext.currentInputStart;
@@ -171,6 +198,10 @@ export function sanitizeEncryptedReasoningRequest(reqContext) {
     for (let index = 0; index < body.input.length; index += 1) {
       const item = body.input[index];
       const historical = Number.isFinite(currentInputStart) && index < currentInputStart;
+      if (historicalOnly && !historical) {
+        input.push(item);
+        continue;
+      }
       if (isEncryptedReasoningInputItem(item)) {
         state.changed = true;
         if (historical) historicalInputChanged = true;
@@ -189,11 +220,13 @@ export function sanitizeEncryptedReasoningRequest(reqContext) {
     }
     body.input = input;
     if (Number.isFinite(currentInputStart)) currentInputStart = retainedBeforeCurrent;
-  } else {
+  } else if (!historicalOnly) {
     body = stripEncryptedReasoningValue(body, state);
   }
   if (!state.changed) return null;
-  const historyInputItems = Array.isArray(reqContext.historyInputItems)
+  const historyInputItems = historicalOnly
+    ? reqContext.historyInputItems
+    : Array.isArray(reqContext.historyInputItems)
     ? reqContext.historyInputItems.flatMap((item) => {
       if (isEncryptedReasoningInputItem(item)) return [];
       const stripped = stripEncryptedReasoningInputValue(item, { changed: false });
@@ -211,10 +244,13 @@ export function sanitizeEncryptedReasoningRequest(reqContext) {
     currentInputStart,
     inputItems: Array.isArray(body.input) ? body.input : reqContext.inputItems,
     historyInputItems,
+    [RELEASE_HISTORY_INPUT]: historicalOnly
+      ? reqContext[RELEASE_HISTORY_INPUT]
+      : historyInputItems,
   };
 }
 
-function finalizeEncryptedHistoryRebase(reqContext) {
+export function finalizeEncryptedHistoryRebase(reqContext) {
   if (!reqContext[ENCRYPTED_HISTORY_REBASE]) return reqContext;
   const finalized = {
     ...reqContext,
@@ -227,98 +263,43 @@ function finalizeEncryptedHistoryRebase(reqContext) {
   return finalized;
 }
 
-export function isEncryptedContentVerificationError(statusCode, text) {
-  if (statusCode < 400 || !text) return false;
-  const lower = String(text).toLowerCase();
-  const reasoningFailure = lower.includes("encrypted content")
-    && lower.includes("could not be verified")
-    && (lower.includes("could not be decrypted") || lower.includes("could not be parsed"));
-  const functionOutputFailure = lower.includes("encrypted function output content")
-    && lower.includes("could not be decrypted or decoded");
-  const missingEncryptedContent = statusCode < 500
-    && /missing required parameter:\s*(['"]?)input\[\d+\](?:\.[a-z0-9_]+|\[\d+\])*\.encrypted_content\1(?=\.?(?:\s|$|["},\]]))/.test(lower);
-  return reasoningFailure || functionOutputFailure || missingEncryptedContent;
-}
-
-export function isImageNamespaceCollisionError(statusCode, text) {
-  if (statusCode < 400 || !text) return false;
-  const lower = String(text).toLowerCase();
-  return lower.includes("namespace")
-    && lower.includes("image_gen")
-    && lower.includes("collid");
-}
-
-function isImageNamespaceTool(tool, { collisionFallback = false } = {}) {
-  if (!tool || typeof tool !== "object") return false;
-  const type = String(tool.type || "").toLowerCase();
-  const name = String(tool.name || tool.function?.name || "").toLowerCase();
-  const namespace = String(tool.namespace || "").toLowerCase();
-  if (["image_gen", "image_generation"].includes(type)) return true;
-  if (["image_gen", "image_generation"].includes(name)) return true;
-  if (namespace === "image_gen" || namespace === "image_generation") return true;
-  return collisionFallback && [type, name, namespace].some((value) => value.startsWith("image_gen"));
-}
-
-export function sanitizeImageNamespaceCollisionRequest(reqContext) {
-  if (!Array.isArray(reqContext?.body?.tools)) return null;
-  const body = cloneJson(reqContext.body);
-  const filtered = body.tools.filter((tool) => !isImageNamespaceTool(tool, { collisionFallback: true }));
-  if (filtered.length === body.tools.length) return null;
-  if (filtered.length) body.tools = filtered;
-  else delete body.tools;
-  return { ...reqContext, body };
-}
-
-export async function openCopilotResponse(reqContext, upstream = copilotResponses, options = {}) {
-  let encryptedRetried = false;
-  let imageNamespaceRetried = false;
-  let payloadPrepared = false;
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    options.assertPrepareActive?.();
-    const resp = await upstream(reqContext.body, {
-      assertActive: options.assertPrepareActive,
-      signal: options.signal,
-      currentInputStart: reqContext.currentInputStart,
-      onUpstreamStart: options.onUpstreamStart,
-      payloadPrepared,
-    });
-    options.assertPrepareActive?.();
-    payloadPrepared = true;
-    if (resp.ok) {
-      reqContext = finalizeEncryptedHistoryRebase(reqContext);
-      return { resp, reqContext };
-    }
-
-    const errorText = await resp.text();
-    options.assertPrepareActive?.();
-    if (!imageNamespaceRetried && isImageNamespaceCollisionError(resp.status, errorText)) {
-      const retryContext = sanitizeImageNamespaceCollisionRequest(reqContext);
-      if (retryContext) {
-        imageNamespaceRetried = true;
-        reqContext = retryContext;
-        console.warn(status("warn", "image_gen namespace rejected by upstream; retrying without the conflicting image tool"));
-        continue;
-      }
-    }
-    if (!encryptedRetried && isEncryptedContentVerificationError(resp.status, errorText)) {
-      const retryContext = sanitizeEncryptedReasoningRequest(reqContext);
-      if (retryContext) {
-        encryptedRetried = true;
-        reqContext = retryContext;
-        console.warn(status("warn", "encrypted replay content rejected by upstream; retrying without unavailable encrypted content"));
-        continue;
-      }
-    }
-    return { resp, reqContext, errorText };
+export function applyResponseHistoryRoutePlan(reqContext, routePlan) {
+  const next = reqContext;
+  next.routePlan = routePlan;
+  if (!next.historyParentId) return next;
+  const currentAffinity = routePlanAffinity(routePlan);
+  const historyMetadata = next.historyRouteMetadata;
+  if (!currentAffinity
+    || !Array.isArray(historyMetadata)
+    || historyMetadata.length === 0
+    || historyMetadata.some((metadata) => metadata.affinity === null)) {
+    return next;
   }
-  throw httpError("Responses compatibility retry limit exceeded", 502);
+  const hasMismatchedOpaqueState = historyMetadata.some((metadata) => (
+    metadata.hasOpaque && !sameRoutePlanAffinity(metadata.affinity, currentAffinity)
+  ));
+  if (!hasMismatchedOpaqueState) {
+    return next;
+  }
+
+  const sanitized = sanitizeEncryptedReasoningRequest(next, { historicalOnly: true });
+  if (!sanitized) return next;
+  sanitized.routePlan = routePlan;
+  const historyRootId = next.historyRootId;
+  const rebased = finalizeEncryptedHistoryRebase(sanitized);
+  if (historyRootId) rebased[HISTORY_PRESSURE_ROOT] = historyRootId;
+  return rebased;
 }
 
-function isBuiltinImageTool(tool) {
-  return isImageNamespaceTool(tool);
+export function responseHistoryPressureRootId(reqContext) {
+  return reqContext?.[HISTORY_PRESSURE_ROOT] || reqContext?.historyRootId || null;
 }
 
-export function prepareResponsesRequest(reqBody, { assertActive, mutate = false } = {}) {
+export function prepareResponsesRequest(reqBody, {
+  assertActive,
+  copilotBoundary = true,
+  mutate = false,
+} = {}) {
   assertActive?.();
   const body = mutate ? reqBody : cloneJson(reqBody);
   assertActive?.();
@@ -329,9 +310,13 @@ export function prepareResponsesRequest(reqBody, { assertActive, mutate = false
   const previousId = body.previous_response_id;
   let historyItems = [];
   let historyRootId = null;
+  const historyRouteMetadata = [];
 
   if (previousId !== undefined && previousId !== null) {
-    historyItems = materializeResponseHistory(previousId, { assertActive });
+    historyItems = materializeResponseHistory(previousId, {
+      assertActive,
+      routeMetadata: historyRouteMetadata,
+    });
     historyRootId = responseHistoryRootId(previousId);
     body.input = [...historyItems, ...currentInputItems];
   } else {
@@ -352,10 +337,10 @@ export function prepareResponsesRequest(reqBody, { assertActive, mutate = false
 
   delete body.previous_response_id;
   delete body.store;
-  if (Array.isArray(body.tools)) {
-    body.tools = body.tools.filter((tool) => !isBuiltinImageTool(tool));
-    if (!body.tools.length) delete body.tools;
-  }
+  // Preserve the historical helper contract for embedders. Runtime handlers
+  // pass copilotBoundary:false and apply the policy only after selecting a
+  // concrete Copilot RoutePlan.
+  if (copilotBoundary) applyCopilotResponsesRequestPolicies(body);
   stripInternalResponsesInputFields(body.input, { assertActive });
   stripInternalResponsesInputFields(historyInputItems, { assertActive });
   assertActive?.();
@@ -367,15 +352,21 @@ export function prepareResponsesRequest(reqBody, { assertActive, mutate = false
     currentInputStart: retainedCurrentInputStart < 0 ? body.input.length : retainedCurrentInputStart,
     historyParentId: previousId ?? null,
     historyRootId,
+    historyRouteMetadata,
     historyInputItems,
+    ...(previousId !== undefined && previousId !== null
+      ? { [RELEASE_HISTORY_INPUT]: historyInputItems }
+      : {}),
     takeHistoryOwnership: mutate,
   };
 }
 
 export function dropMaterializedResponseHistory(reqContext) {
-  if (!reqContext?.historyParentId || !Array.isArray(reqContext.historyInputItems)) return false;
-  reqContext.body = { ...reqContext.body, input: reqContext.historyInputItems };
-  reqContext.inputItems = reqContext.historyInputItems;
+  const releaseInput = reqContext?.[RELEASE_HISTORY_INPUT];
+  if (!Array.isArray(releaseInput)) return false;
+  reqContext.body = { ...reqContext.body, input: releaseInput };
+  reqContext.inputItems = releaseInput;
+  delete reqContext[RELEASE_HISTORY_INPUT];
   reqContext.currentInputStart = 0;
   return true;
 }
@@ -392,6 +383,8 @@ export function rememberResponseHistory(reqContext, responseJson) {
     parentId: compacted ? null : reqContext.historyParentId,
     inputItems: sourceInputItems,
     outputItems: sourceOutputItems,
+    hasOpaque: responseValueHasOpaqueState([sourceInputItems, sourceOutputItems]),
+    routeAffinity: routePlanAffinity(reqContext.routePlan),
     takeOwnership: reqContext.takeHistoryOwnership,
   });
 }