pi-openai-toolkit 0.14.7 → 0.14.9

package/src/context-management/window-budget.ts

@@ -1,83 +1,83 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import {
-	CONTEXT_WINDOW_FALLBACK_BUFFER,
-	CONTEXT_WINDOW_FALLBACK_MESSAGE,
-	renderContextWindowReminder,
-	type ContextManagementMessageKind,
-	type ContextWindowIdentity,
-} from "./messages";
-
-export interface ContextRemaining {
-	remainingTokens: number | undefined;
-	windowId: string | undefined;
-	contextWindow: number;
-}
-
-export class ContextWindowBudget {
-	private readonly remindedWindows = new Set<string>();
-	private readonly exhaustedWindows = new Set<string>();
-
-	reset(): void {
-		this.remindedWindows.clear();
-		this.exhaustedWindows.clear();
-	}
-
-	restore(kind: ContextManagementMessageKind, windowId: string): void {
-		if (kind === "reminder") this.remindedWindows.add(windowId);
-		if (kind === "fallback") this.exhaustedWindows.add(windowId);
-	}
-
-	record(
-		ctx: ExtensionContext,
-		identity: ContextWindowIdentity,
-		contextTokens: number | undefined,
-		contextReminderThresholdPercent: number,
-	): { content: string; kind: "fallback" | "reminder" } | undefined {
-		const remaining = this.remaining(ctx, identity, contextTokens);
-		if (remaining.remainingTokens === undefined) return undefined;
-		const windowId = identity.currentWindowId;
-		if (remaining.remainingTokens <= 0 && !this.exhaustedWindows.has(windowId)) {
-			this.exhaustedWindows.add(windowId);
-			return { content: CONTEXT_WINDOW_FALLBACK_MESSAGE, kind: "fallback" };
-		}
-		const reminderThreshold =
-			contextReminderThresholdPercent > 0
-				? Math.floor((remaining.contextWindow * contextReminderThresholdPercent) / 100)
-				: 0;
-		if (
-			contextReminderThresholdPercent > 0 &&
-			remaining.remainingTokens <= reminderThreshold &&
-			!this.remindedWindows.has(windowId)
-		) {
-			this.remindedWindows.add(windowId);
-			return { content: renderContextWindowReminder(remaining.remainingTokens), kind: "reminder" };
-		}
-		return undefined;
-	}
-
-	remaining(
-		ctx: ExtensionContext,
-		identity: ContextWindowIdentity | undefined,
-		contextTokens?: number,
-	): ContextRemaining {
-		const usage = ctx.getContextUsage();
-		const contextWindow = usage?.contextWindow ?? ctx.model?.contextWindow ?? 0;
-		const limit = Math.max(0, contextWindow - CONTEXT_WINDOW_FALLBACK_BUFFER);
-		if (usage === undefined && contextTokens === undefined) {
-			return {
-				remainingTokens: undefined,
-				windowId: identity?.currentWindowId,
-				contextWindow: limit,
-			};
-		}
-		const used = contextTokens ?? usage?.tokens;
-		return {
-			remainingTokens:
-				used === null || used === undefined
-					? undefined
-					: Math.max(0, limit - used),
-			windowId: identity?.currentWindowId,
-			contextWindow: limit,
-		};
-	}
-}
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import {
+	CONTEXT_WINDOW_FALLBACK_BUFFER,
+	CONTEXT_WINDOW_FALLBACK_MESSAGE,
+	renderContextWindowReminder,
+	type ContextManagementMessageKind,
+	type ContextWindowIdentity,
+} from "./messages";
+
+export interface ContextRemaining {
+	remainingTokens: number | undefined;
+	windowId: string | undefined;
+	contextWindow: number;
+}
+
+export class ContextWindowBudget {
+	private readonly remindedWindows = new Set<string>();
+	private readonly exhaustedWindows = new Set<string>();
+
+	reset(): void {
+		this.remindedWindows.clear();
+		this.exhaustedWindows.clear();
+	}
+
+	restore(kind: ContextManagementMessageKind, windowId: string): void {
+		if (kind === "reminder") this.remindedWindows.add(windowId);
+		if (kind === "fallback") this.exhaustedWindows.add(windowId);
+	}
+
+	record(
+		ctx: ExtensionContext,
+		identity: ContextWindowIdentity,
+		contextTokens: number | undefined,
+		contextReminderThresholdPercent: number,
+	): { content: string; kind: "fallback" | "reminder" } | undefined {
+		const remaining = this.remaining(ctx, identity, contextTokens);
+		if (remaining.remainingTokens === undefined) return undefined;
+		const windowId = identity.currentWindowId;
+		if (remaining.remainingTokens <= 0 && !this.exhaustedWindows.has(windowId)) {
+			this.exhaustedWindows.add(windowId);
+			return { content: CONTEXT_WINDOW_FALLBACK_MESSAGE, kind: "fallback" };
+		}
+		const reminderThreshold =
+			contextReminderThresholdPercent > 0
+				? Math.floor((remaining.contextWindow * contextReminderThresholdPercent) / 100)
+				: 0;
+		if (
+			contextReminderThresholdPercent > 0 &&
+			remaining.remainingTokens <= reminderThreshold &&
+			!this.remindedWindows.has(windowId)
+		) {
+			this.remindedWindows.add(windowId);
+			return { content: renderContextWindowReminder(remaining.remainingTokens), kind: "reminder" };
+		}
+		return undefined;
+	}
+
+	remaining(
+		ctx: ExtensionContext,
+		identity: ContextWindowIdentity | undefined,
+		contextTokens?: number,
+	): ContextRemaining {
+		const usage = ctx.getContextUsage();
+		const contextWindow = usage?.contextWindow ?? ctx.model?.contextWindow ?? 0;
+		const limit = Math.max(0, contextWindow - CONTEXT_WINDOW_FALLBACK_BUFFER);
+		if (usage === undefined && contextTokens === undefined) {
+			return {
+				remainingTokens: undefined,
+				windowId: identity?.currentWindowId,
+				contextWindow: limit,
+			};
+		}
+		const used = contextTokens ?? usage?.tokens;
+		return {
+			remainingTokens:
+				used === null || used === undefined
+					? undefined
+					: Math.max(0, limit - used),
+			windowId: identity?.currentWindowId,
+			contextWindow: limit,
+		};
+	}
+}

package/src/context-management/window-manager.ts

@@ -55,12 +55,23 @@ type WindowBoundaryEntry = Extract<SessionEntry, { type: "custom_message" }> & {
 	details: CodexContextManagementMessageDetails;
 };
 
+/**
+ * In-process duplicate guard for one scheduled rollover. It is anchored to the
+ * session that scheduled it and to the exact target window id, so it can never
+ * be satisfied by an older or foreign marker. It is not checkpoint evidence:
+ * only a persisted notes result unlocks the gate.
+ */
+type PendingRollover = {
+	sessionId?: string;
+	targetWindowId: string;
+};
+
 export class CodexContextWindowManager {
 	private identity: ContextWindowIdentity | undefined;
 	private sessionId: string | undefined;
 	private restoredMarkerId: string | undefined;
 	private readonly budget = new ContextWindowBudget();
-	private rolloverPending = false;
+	private pendingRollover: PendingRollover | undefined;
 	private trimPendingWindowId: string | undefined;
 	private readonly loadThreadHint: ThreadHintLoader;
 
@@ -69,20 +80,26 @@ export class CodexContextWindowManager {
 	}
 
 	reset(): void {
+		this.resetWindowState();
+		this.pendingRollover = undefined;
+	}
+
+	currentIdentity(): ContextWindowIdentity | undefined {
+		return this.identity ? { ...this.identity } : undefined;
+	}
+
+	private resetWindowState(): void {
 		this.identity = undefined;
 		this.sessionId = undefined;
 		this.restoredMarkerId = undefined;
 		this.budget.reset();
-		this.rolloverPending = false;
 		this.trimPendingWindowId = undefined;
 	}
 
-	currentIdentity(): ContextWindowIdentity | undefined {
-		return this.identity ? { ...this.identity } : undefined;
-	}
-
 	restore(entries: readonly SessionEntry[], sessionId?: string): void {
-		this.reset();
+		// A rebuild of derived state must not drop an outstanding rollover guard;
+		// only a changed session or an observed target marker retires it below.
+		this.resetWindowState();
 		this.sessionId = sessionId;
 		for (const entry of entries) {
 			if (entry.type === "compaction") {
@@ -103,21 +120,43 @@ export class CodexContextWindowManager {
 			}
 			this.budget.restore(details.kind, details.currentWindowId);
 		}
+		this.retireSatisfiedOrStalePending(entries, sessionId);
 	}
 
 	/** Rebuild state when Pi navigates to a different session/branch. */
 	synchronize(ctx: Pick<ExtensionContext, "sessionManager">): void {
 		const entries = ctx.sessionManager.getBranch();
 		const sessionId = ctx.sessionManager.getSessionId();
+		this.retireSatisfiedOrStalePending(entries, sessionId);
 		const latestMarkerId = findLatestContextMarkerId(entries, sessionId);
 		if (this.sessionId !== sessionId || this.restoredMarkerId !== latestMarkerId) {
 			this.restore(entries, sessionId);
 		}
 	}
 
+	/**
+	 * Drop a pending rollover only for durable reasons: the target window marker
+	 * is now persisted in this session, or the session changed. A queued marker
+	 * visible in an in-memory message list is not durable evidence.
+	 */
+	private retireSatisfiedOrStalePending(
+		entries: readonly SessionEntry[],
+		sessionId: string | undefined,
+	): void {
+		const pending = this.pendingRollover;
+		if (!pending) return;
+		if (pending.sessionId !== undefined && pending.sessionId !== sessionId) {
+			this.pendingRollover = undefined;
+			return;
+		}
+		if (hasPersistedWindowBoundary(entries, sessionId, pending.targetWindowId)) {
+			this.pendingRollover = undefined;
+		}
+	}
+
 	ensureInitialized(pi: ExtensionAPI, ctx: ExtensionContext, active: boolean): void {
 		if (!active) return;
-		this.restore(ctx.sessionManager.getBranch(), ctx.sessionManager.getSessionId());
+		this.synchronize(ctx);
 		if (this.identity) return;
 		const windowId = randomUUID();
 		this.sendWindowMessage(
@@ -160,7 +199,8 @@ export class CodexContextWindowManager {
 			this.budget.reset();
 			this.trimPendingWindowId = undefined;
 		}
-		this.rolloverPending = false;
+		// Projection observes the request view, never durable session state. A
+		// queued rollover marker must not clear the duplicate guard here.
 		const projected = boundaryIndex < 0 ? [...messages] : [...messages.slice(boundaryIndex)];
 		return mode === "remote" ? projectEncryptedToolResults(projected) : projected;
 	}
@@ -171,13 +211,25 @@ export class CodexContextWindowManager {
 		options: StartContextWindowOptions,
 	): Promise<boolean> {
 		this.synchronize(ctx);
-		if (this.rolloverPending) return false;
+		// A same-session rollover whose target marker is not persisted yet is
+		// still in flight: report it instead of scheduling a second window.
+		if (this.hasPendingRollover(ctx)) return false;
 		if (options.signal?.aborted) throw new Error("Remote context rollover was aborted");
-		this.rolloverPending = true;
+		const current = this.identity;
+		const liveSessionId = ctx.sessionManager.getSessionId();
+		const currentWindowId = randomUUID();
+		const next: ContextWindowIdentity = current
+			? {
+				firstWindowId: current.firstWindowId,
+				currentWindowId,
+				previousWindowId: current.currentWindowId,
+				windowNumber: current.windowNumber + 1,
+			}
+			: { firstWindowId: currentWindowId, currentWindowId, windowNumber: 0 };
+		this.pendingRollover = { sessionId: liveSessionId, targetWindowId: currentWindowId };
 		try {
-			const current = this.identity;
 			const checkpoint = current
-				? findLatestNotesCheckpointSinceBoundary(ctx.sessionManager.getBranch(), this.sessionId)
+				? findLatestNotesCheckpointSinceBoundary(ctx.sessionManager.getBranch(), liveSessionId)
 				: undefined;
 			let threadHint: string | undefined;
 			if (current) {
@@ -188,19 +240,10 @@ export class CodexContextWindowManager {
 				}
 			}
 			if (options.signal?.aborted) throw new Error("Remote context rollover was aborted");
-			const currentWindowId = randomUUID();
-			const next: ContextWindowIdentity = current
-				? {
-					firstWindowId: current.firstWindowId,
-					currentWindowId,
-					previousWindowId: current.currentWindowId,
-					windowNumber: current.windowNumber + 1,
-				}
-				: { firstWindowId: currentWindowId, currentWindowId, windowNumber: 0 };
 			this.sendWindowMessage(pi, ctx, next, options, threadHint, checkpoint);
 			return true;
 		} catch (error) {
-			this.rolloverPending = false;
+			this.pendingRollover = undefined;
 			throw error;
 		}
 	}
@@ -234,11 +277,30 @@ export class CodexContextWindowManager {
 		return this.budget.remaining(ctx, this.identity, contextTokens);
 	}
 
-	/** True when a notes checkpoint succeeded in the current window (after the latest boundary). */
+	/**
+	 * True when a notes checkpoint succeeded in the current window (after the
+	 * latest boundary). The scan always uses the live session id: a cached id can
+	 * belong to a session Pi already navigated away from, which would filter the
+	 * current window's marker and result out as foreign.
+	 */
 	hasNotesCheckpointSinceBoundary(
 		ctx: Pick<ExtensionContext, "sessionManager">,
 	): boolean {
-		return findNotesCheckpointSinceBoundary(ctx.sessionManager.getBranch(), this.sessionId);
+		return findNotesCheckpointSinceBoundary(
+			ctx.sessionManager.getBranch(),
+			ctx.sessionManager.getSessionId(),
+		);
+	}
+
+	/**
+	 * True while a rollover scheduled for the current session is awaiting its
+	 * persisted target marker. Call `synchronize()` first so a marker that has
+	 * already been persisted or a session switch retires the guard.
+	 */
+	hasPendingRollover(ctx: Pick<ExtensionContext, "sessionManager">): boolean {
+		const pending = this.pendingRollover;
+		if (!pending) return false;
+		return pending.sessionId === undefined || pending.sessionId === ctx.sessionManager.getSessionId();
 	}
 
 	prepareCompaction(
@@ -311,9 +373,9 @@ export class CodexContextWindowManager {
 		this.sessionId = ctx.sessionManager.getSessionId();
 		this.restoredMarkerId = undefined;
 		this.trimPendingWindowId = options.trimPreviousWindow ? identity.currentWindowId : undefined;
-		// sendMessage has accepted the marker synchronously; clear only the
-		// in-flight guard so a later turn can roll over again.
-		this.rolloverPending = false;
+		// sendMessage() acceptance is not persistence. The pending rollover stays
+		// armed until synchronize() observes this target window in the persisted
+		// branch (or the session changes).
 	}
 }
 
@@ -443,6 +505,26 @@ export function findLatestWindowBoundaryEntry(
 	return undefined;
 }
 
+/**
+ * Whether this exact window boundary is already persisted for the session.
+ * Only durable entries count; a queued/visible marker does not.
+ */
+function hasPersistedWindowBoundary(
+	entries: readonly SessionEntry[],
+	sessionId: string | undefined,
+	windowId: string,
+): boolean {
+	for (const entry of entries) {
+		if (entry.type !== "custom_message" || entry.customType !== CODEX_CONTEXT_WINDOW_MESSAGE_TYPE) continue;
+		if (!couldBelongToSession(entry.details, sessionId)) continue;
+		if (!isCodexContextManagementMessageDetails(entry.details)) continue;
+		if (!matchesSession(entry.details.sessionId, sessionId)) continue;
+		const details = entry.details.contextManagement;
+		if (details.kind === "window" && details.currentWindowId === windowId) return true;
+	}
+	return false;
+}
+
 function findLatestContextMarkerId(
 	entries: readonly SessionEntry[],
 	sessionId?: string,

package/src/context-management/window-request.ts

@@ -1,125 +1,125 @@
-import type { ProviderHeaders } from "@earendil-works/pi-ai";
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ContextWindowIdentity } from "./types";
-import { CODEX_ENCRYPTED_OUTPUT_CONTEXT_MARKER } from "./history-notes";
-import { rewriteContextNamespaceCalls } from "./namespace-tools";
-
-export type ContextWindowRequestMetadata = {
-	session_id: string;
-	thread_id: string;
-	agent_name: "/root";
-	window_id: string;
-	window_number: number;
-	context_window_id: string;
-	request_kind: "turn";
-	history_ingest_requested: true;
-};
-
-export function buildContextWindowRequestMetadata(
-	ctx: Pick<ExtensionContext, "sessionManager">,
-	identity: ContextWindowIdentity,
-): ContextWindowRequestMetadata {
-	const sessionId = ctx.sessionManager.getSessionId();
-	return {
-		session_id: sessionId,
-		thread_id: sessionId,
-		agent_name: "/root",
-		window_id: `${sessionId}:${identity.windowNumber}`,
-		window_number: identity.windowNumber,
-		context_window_id: identity.currentWindowId,
-		request_kind: "turn",
-		history_ingest_requested: true,
-	};
-}
-
-export function rewriteWindowPayload(
-	payload: unknown,
-	ctx: Pick<ExtensionContext, "sessionManager">,
-	identity: ContextWindowIdentity | undefined,
-): unknown {
-	if (!identity || !isResponsesPayload(payload)) return payload;
-	const clientMetadata = payload.client_metadata;
-	if (clientMetadata !== undefined && !isRecord(clientMetadata)) return payload;
-	const existingTurnMetadata = parseTurnMetadata(clientMetadata?.["x-codex-turn-metadata"]);
-	if (clientMetadata?.["x-codex-turn-metadata"] !== undefined && !existingTurnMetadata) return payload;
-	const metadata = buildContextWindowRequestMetadata(ctx, identity);
-	const turnMetadata = { ...existingTurnMetadata, ...metadata };
-	const rewritten: Record<string, unknown> = {
-		...payload,
-		client_metadata: {
-			...(clientMetadata ?? {}),
-			"x-codex-window-id": metadata.window_id,
-			"x-codex-turn-metadata": JSON.stringify(turnMetadata),
-		},
-	};
-	return rewriteEncryptedToolOutputs(rewriteContextNamespaceCalls(rewritten));
-}
-
-export function rewriteEncryptedToolOutputs(payload: unknown): unknown {
-	if (!isRecord(payload) || !Array.isArray(payload.input)) return payload;
-	let changed = false;
-	const input = payload.input.map((item) => {
-		if (!isRecord(item) || item.type !== "function_call_output") return item;
-		const output = item.output;
-		if (typeof output === "string") {
-			const encrypted = decodeEncryptedOutputContext(output);
-			if (encrypted === undefined) return item;
-			changed = true;
-			return { ...item, output: [{ type: "encrypted_content", encrypted_content: encrypted }] };
-		}
-		if (!Array.isArray(output)) return item;
-		let outputChanged = false;
-		const rewrittenOutput = output.map((part) => {
-			if (!isRecord(part) || part.type !== "input_text" || typeof part.text !== "string") return part;
-			const encrypted = decodeEncryptedOutputContext(part.text);
-			if (encrypted === undefined) return part;
-			outputChanged = true;
-			return { type: "encrypted_content", encrypted_content: encrypted };
-		});
-		if (!outputChanged) return item;
-		changed = true;
-		return { ...item, output: rewrittenOutput };
-	});
-	return changed ? { ...payload, input } : payload;
-}
-
-function decodeEncryptedOutputContext(value: string): string | undefined {
-	if (!value.startsWith(CODEX_ENCRYPTED_OUTPUT_CONTEXT_MARKER)) return undefined;
-	try {
-		const decoded: unknown = JSON.parse(value.slice(CODEX_ENCRYPTED_OUTPUT_CONTEXT_MARKER.length));
-		if (typeof decoded !== "string" || decoded.length === 0) throw new Error("invalid encrypted output marker");
-		return decoded;
-	} catch {
-		throw new Error("Malformed encrypted history/notes output marker");
-	}
-}
-
-function parseTurnMetadata(value: unknown): Record<string, unknown> | undefined {
-	if (value === undefined) return {};
-	if (typeof value !== "string") return undefined;
-	try {
-		const parsed: unknown = JSON.parse(value);
-		return isRecord(parsed) ? parsed : undefined;
-	} catch {
-		return undefined;
-	}
-}
-
-function isResponsesPayload(value: unknown): value is Record<string, unknown> & { model: string; input: unknown[] } {
-	return isRecord(value) && typeof value.model === "string" && Array.isArray(value.input);
-}
-
-export function rewriteWindowHeaders(
-	headers: ProviderHeaders,
-	ctx: Pick<ExtensionContext, "sessionManager">,
-	identity: ContextWindowIdentity | undefined,
-): void {
-	if (!identity) return;
-	const metadata = buildContextWindowRequestMetadata(ctx, identity);
-	headers["x-codex-window-id"] = metadata.window_id;
-	headers["x-codex-turn-metadata"] = JSON.stringify(metadata);
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
+import type { ProviderHeaders } from "@earendil-works/pi-ai";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ContextWindowIdentity } from "./types";
+import { CODEX_ENCRYPTED_OUTPUT_CONTEXT_MARKER } from "./history-notes";
+import { rewriteContextNamespaceCalls } from "./namespace-tools";
+
+export type ContextWindowRequestMetadata = {
+	session_id: string;
+	thread_id: string;
+	agent_name: "/root";
+	window_id: string;
+	window_number: number;
+	context_window_id: string;
+	request_kind: "turn";
+	history_ingest_requested: true;
+};
+
+export function buildContextWindowRequestMetadata(
+	ctx: Pick<ExtensionContext, "sessionManager">,
+	identity: ContextWindowIdentity,
+): ContextWindowRequestMetadata {
+	const sessionId = ctx.sessionManager.getSessionId();
+	return {
+		session_id: sessionId,
+		thread_id: sessionId,
+		agent_name: "/root",
+		window_id: `${sessionId}:${identity.windowNumber}`,
+		window_number: identity.windowNumber,
+		context_window_id: identity.currentWindowId,
+		request_kind: "turn",
+		history_ingest_requested: true,
+	};
+}
+
+export function rewriteWindowPayload(
+	payload: unknown,
+	ctx: Pick<ExtensionContext, "sessionManager">,
+	identity: ContextWindowIdentity | undefined,
+): unknown {
+	if (!identity || !isResponsesPayload(payload)) return payload;
+	const clientMetadata = payload.client_metadata;
+	if (clientMetadata !== undefined && !isRecord(clientMetadata)) return payload;
+	const existingTurnMetadata = parseTurnMetadata(clientMetadata?.["x-codex-turn-metadata"]);
+	if (clientMetadata?.["x-codex-turn-metadata"] !== undefined && !existingTurnMetadata) return payload;
+	const metadata = buildContextWindowRequestMetadata(ctx, identity);
+	const turnMetadata = { ...existingTurnMetadata, ...metadata };
+	const rewritten: Record<string, unknown> = {
+		...payload,
+		client_metadata: {
+			...(clientMetadata ?? {}),
+			"x-codex-window-id": metadata.window_id,
+			"x-codex-turn-metadata": JSON.stringify(turnMetadata),
+		},
+	};
+	return rewriteEncryptedToolOutputs(rewriteContextNamespaceCalls(rewritten));
+}
+
+export function rewriteEncryptedToolOutputs(payload: unknown): unknown {
+	if (!isRecord(payload) || !Array.isArray(payload.input)) return payload;
+	let changed = false;
+	const input = payload.input.map((item) => {
+		if (!isRecord(item) || item.type !== "function_call_output") return item;
+		const output = item.output;
+		if (typeof output === "string") {
+			const encrypted = decodeEncryptedOutputContext(output);
+			if (encrypted === undefined) return item;
+			changed = true;
+			return { ...item, output: [{ type: "encrypted_content", encrypted_content: encrypted }] };
+		}
+		if (!Array.isArray(output)) return item;
+		let outputChanged = false;
+		const rewrittenOutput = output.map((part) => {
+			if (!isRecord(part) || part.type !== "input_text" || typeof part.text !== "string") return part;
+			const encrypted = decodeEncryptedOutputContext(part.text);
+			if (encrypted === undefined) return part;
+			outputChanged = true;
+			return { type: "encrypted_content", encrypted_content: encrypted };
+		});
+		if (!outputChanged) return item;
+		changed = true;
+		return { ...item, output: rewrittenOutput };
+	});
+	return changed ? { ...payload, input } : payload;
+}
+
+function decodeEncryptedOutputContext(value: string): string | undefined {
+	if (!value.startsWith(CODEX_ENCRYPTED_OUTPUT_CONTEXT_MARKER)) return undefined;
+	try {
+		const decoded: unknown = JSON.parse(value.slice(CODEX_ENCRYPTED_OUTPUT_CONTEXT_MARKER.length));
+		if (typeof decoded !== "string" || decoded.length === 0) throw new Error("invalid encrypted output marker");
+		return decoded;
+	} catch {
+		throw new Error("Malformed encrypted history/notes output marker");
+	}
+}
+
+function parseTurnMetadata(value: unknown): Record<string, unknown> | undefined {
+	if (value === undefined) return {};
+	if (typeof value !== "string") return undefined;
+	try {
+		const parsed: unknown = JSON.parse(value);
+		return isRecord(parsed) ? parsed : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function isResponsesPayload(value: unknown): value is Record<string, unknown> & { model: string; input: unknown[] } {
+	return isRecord(value) && typeof value.model === "string" && Array.isArray(value.input);
+}
+
+export function rewriteWindowHeaders(
+	headers: ProviderHeaders,
+	ctx: Pick<ExtensionContext, "sessionManager">,
+	identity: ContextWindowIdentity | undefined,
+): void {
+	if (!identity) return;
+	const metadata = buildContextWindowRequestMetadata(ctx, identity);
+	headers["x-codex-window-id"] = metadata.window_id;
+	headers["x-codex-turn-metadata"] = JSON.stringify(metadata);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}