zevairouter 1.0.0

package/open-sse/executors/base.js

@@ -0,0 +1,185 @@
+import { HTTP_STATUS, RETRY_CONFIG, DEFAULT_RETRY_CONFIG, resolveRetryEntry, FETCH_CONNECT_TIMEOUT_MS } from "../config/runtimeConfig.js";
+import { shouldRefreshCredentials } from "../services/oauthCredentialManager.js";
+import { proxyAwareFetch } from "../utils/proxyFetch.js";
+import { dbg } from "../utils/debugLog.js";
+
+/**
+ * BaseExecutor - Base class for provider executors
+ */
+export class BaseExecutor {
+  constructor(provider, config) {
+    this.provider = provider;
+    this.config = config;
+    this.noAuth = config?.noAuth || false;
+  }
+
+  getProvider() {
+    return this.provider;
+  }
+
+  getBaseUrls() {
+    return this.config.baseUrls || (this.config.baseUrl ? [this.config.baseUrl] : []);
+  }
+
+  getFallbackCount() {
+    return this.getBaseUrls().length || 1;
+  }
+
+  buildUrl(model, stream, urlIndex = 0, credentials = null) {
+    if (this.provider?.startsWith?.("openai-compatible-")) {
+      const baseUrl = credentials?.providerSpecificData?.baseUrl || "https://api.openai.com/v1";
+      const normalized = baseUrl.replace(/\/$/, "");
+      const path = this.provider.includes("responses") ? "/responses" : "/chat/completions";
+      return `${normalized}${path}`;
+    }
+    if (this.provider?.startsWith?.("anthropic-compatible-")) {
+      const baseUrl = credentials?.providerSpecificData?.baseUrl || "https://api.anthropic.com/v1";
+      const normalized = baseUrl.replace(/\/$/, "");
+      return `${normalized}/messages`;
+    }
+    const baseUrls = this.getBaseUrls();
+    return baseUrls[urlIndex] || baseUrls[0] || this.config.baseUrl;
+  }
+
+  buildHeaders(credentials, stream = true) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...this.config.headers
+    };
+
+    if (this.provider?.startsWith?.("anthropic-compatible-")) {
+      // Anthropic-compatible providers use x-api-key header
+      if (credentials.apiKey) {
+        headers["x-api-key"] = credentials.apiKey;
+      } else if (credentials.accessToken) {
+        headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+      }
+      if (!headers["anthropic-version"]) {
+        headers["anthropic-version"] = "2023-06-01";
+      }
+    } else {
+      // Standard Bearer token auth for other providers
+      if (credentials.accessToken) {
+        headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+      } else if (credentials.apiKey) {
+        headers["Authorization"] = `Bearer ${credentials.apiKey}`;
+      }
+    }
+
+    if (stream) {
+      headers["Accept"] = "text/event-stream";
+    }
+
+    return headers;
+  }
+
+  // Override in subclass for provider-specific transformations
+  transformRequest(model, body, stream, credentials) {
+    return body;
+  }
+
+  // Override in subclass for providers that need encoded/binary request bodies.
+  prepareRequestBody(transformedBody, headers) {
+    return JSON.stringify(transformedBody);
+  }
+
+  shouldRetry(status, urlIndex) {
+    return status === HTTP_STATUS.RATE_LIMITED && urlIndex + 1 < this.getFallbackCount();
+  }
+
+  // Override in subclass for provider-specific refresh
+  async refreshCredentials(credentials, log, proxyOptions = null) {
+    return null;
+  }
+
+  needsRefresh(credentials) {
+    return shouldRefreshCredentials(this.provider, credentials);
+  }
+
+  parseError(response, bodyText) {
+    return { status: response.status, message: bodyText || `HTTP ${response.status}` };
+  }
+
+  async execute({ model, body, stream, credentials, signal, log, proxyOptions = null }) {
+    const fallbackCount = this.getFallbackCount();
+    let lastError = null;
+    let lastStatus = 0;
+    const retryAttemptsByUrl = {};
+
+    // Merge default retry config with provider-specific config
+    const retryConfig = { ...DEFAULT_RETRY_CONFIG, ...this.config.retry };
+
+    // Schedule retry via retryConfig[statusKey]. Returns true when caller should `urlIndex--; continue`
+    const tryRetry = async (urlIndex, statusKey, reason) => {
+      const { attempts, delayMs } = resolveRetryEntry(retryConfig[statusKey]);
+      if (attempts <= 0 || retryAttemptsByUrl[urlIndex] >= attempts) return false;
+      retryAttemptsByUrl[urlIndex]++;
+      log?.debug?.("RETRY", `${reason} retry ${retryAttemptsByUrl[urlIndex]}/${attempts} after ${delayMs / 1000}s`);
+      await new Promise(resolve => setTimeout(resolve, delayMs));
+      return true;
+    };
+
+    for (let urlIndex = 0; urlIndex < fallbackCount; urlIndex++) {
+      const url = this.buildUrl(model, stream, urlIndex, credentials);
+      const transformedBody = this.transformRequest(model, body, stream, credentials);
+      const headers = this.buildHeaders(credentials, stream);
+
+      if (!retryAttemptsByUrl[urlIndex]) retryAttemptsByUrl[urlIndex] = 0;
+
+      // Abort if upstream doesn't return response headers within connection timeout
+      const connectCtrl = new AbortController();
+      const timeoutMs = this.config?.timeoutMs || FETCH_CONNECT_TIMEOUT_MS;
+      const connectTimer = setTimeout(() => connectCtrl.abort(new Error("fetch connect timeout")), timeoutMs);
+      const mergedSignal = signal ? AbortSignal.any([signal, connectCtrl.signal]) : connectCtrl.signal;
+
+      try {
+        const requestBody = this.prepareRequestBody(transformedBody, headers);
+        const requestBodySize = typeof requestBody === "string"
+          ? requestBody.length
+          : requestBody?.byteLength ?? requestBody?.length ?? "?";
+        const fetchT0 = Date.now();
+        dbg("FETCH", `${this.provider.toUpperCase()} → ${url} | body=${requestBodySize}B | connectTimeout=${timeoutMs}ms`);
+        const response = await proxyAwareFetch(url, {
+          method: "POST",
+          headers,
+          body: requestBody,
+          signal: mergedSignal
+        }, proxyOptions);
+        clearTimeout(connectTimer);
+        const ct = response.headers?.get?.("content-type") || "";
+        const cl = response.headers?.get?.("content-length") || "?";
+        dbg("FETCH", `${this.provider.toUpperCase()} ← ${response.status} | ttft=${Date.now() - fetchT0}ms | ct=${ct} | cl=${cl}`);
+
+        if (await tryRetry(urlIndex, response.status, `status ${response.status}`)) { urlIndex--; continue; }
+
+        if (this.shouldRetry(response.status, urlIndex)) {
+          log?.debug?.("RETRY", `${response.status} on ${url}, trying fallback ${urlIndex + 1}`);
+          lastStatus = response.status;
+          continue;
+        }
+
+        return { response, url, headers, transformedBody };
+      } catch (error) {
+        clearTimeout(connectTimer);
+        lastError = error;
+        const isConnectTimeout = connectCtrl.signal.aborted && error.name === "AbortError";
+        dbg("FETCH", `${this.provider.toUpperCase()} ✖ ${error.name}: ${error.message}${isConnectTimeout ? " (connect timeout)" : ""}`);
+        // Connect timeout is internal — convert to retryable network error, don't propagate AbortError
+        if (error.name === "AbortError" && !isConnectTimeout) throw error;
+
+        // Map network/fetch exceptions to 502 retry config
+        if (await tryRetry(urlIndex, HTTP_STATUS.BAD_GATEWAY, `network "${error.message}"`)) { urlIndex--; continue; }
+
+        if (urlIndex + 1 < fallbackCount) {
+          log?.debug?.("RETRY", `Error on ${url}, trying fallback ${urlIndex + 1}`);
+          continue;
+        }
+        throw error;
+      }
+    }
+
+    throw lastError || new Error(`All ${fallbackCount} URLs failed with status ${lastStatus}`);
+  }
+}
+
+export default BaseExecutor;

package/open-sse/executors/codex.js

@@ -0,0 +1,469 @@
+import { createHash } from "crypto";
+import { BaseExecutor } from "./base.js";
+import { CODEX_DEFAULT_INSTRUCTIONS } from "../config/codexInstructions.js";
+import { PROVIDERS } from "../config/providers.js";
+import {
+  refreshProviderCredentials,
+  shouldRefreshCredentials,
+} from "../services/oauthCredentialManager.js";
+import { normalizeResponsesInput } from "../translator/helpers/responsesApiHelper.js";
+import { fetchImageAsBase64 } from "../translator/helpers/imageHelper.js";
+import { getModelUpstreamId } from "../config/providerModels.js";
+import { getConsistentMachineId } from "../../src/shared/utils/machineId.js";
+import { DEFAULT_RETRY_CONFIG, resolveRetryEntry } from "../config/runtimeConfig.js";
+import { dbg } from "../utils/debugLog.js";
+
+// SSE error patterns inside 200-OK body that should trigger retry as if 503
+const CODEX_SSE_OVERLOADED_PATTERNS = ["server_is_overloaded", "service_unavailable_error"];
+const CODEX_SSE_PEEK_BYTES = 4096;
+
+// In-memory map: hash(machineId + first assistant content) → { sessionId, lastUsed }
+const SESSION_TTL_MS = 60 * 60 * 1000; // 1 hour
+const assistantSessionMap = new Map();
+
+// Server-generated item id prefixes that Codex /responses cannot resolve when store=false
+const SERVER_ID_PATTERN = /^(rs|fc|resp|msg)_/;
+
+// Hosted tool types that Codex/OpenAI Responses executes server-side
+const CODEX_HOSTED_TOOL_TYPES = new Set([
+  "image_generation", "web_search", "web_search_preview", "file_search",
+  "computer", "computer_use_preview", "code_interpreter", "mcp", "local_shell"
+]);
+
+// Allowlist of fields accepted by Codex Responses API — anything else is stripped
+const RESPONSES_API_ALLOWLIST = new Set([
+  "model", "input", "instructions", "tools", "tool_choice", "stream", "store",
+  "reasoning", "service_tier", "include", "prompt_cache_key", "client_metadata"
+]);
+
+// Convert role=system → role=developer in body.input (keeps content in cacheable prefix)
+function convertSystemToDeveloperRole(body) {
+  if (!Array.isArray(body.input)) return;
+  for (const item of body.input) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const isSystemMsg = item.role === "system" && (!item.type || item.type === "message");
+    if (isSystemMsg) item.role = "developer";
+  }
+}
+
+// Strip server-generated item IDs (rs_/fc_/resp_/msg_) from input — avoids 404 with store=false
+function stripStoredItemReferences(body) {
+  if (!Array.isArray(body.input)) return;
+  body.input = body.input.filter((item) => {
+    if (typeof item === "string" && SERVER_ID_PATTERN.test(item)) return false;
+    if (item && typeof item === "object" && !Array.isArray(item)) {
+      if (item.type === "item_reference") return false;
+      if (typeof item.id === "string" && SERVER_ID_PATTERN.test(item.id)) delete item.id;
+    }
+    return true;
+  });
+}
+
+// Flatten Chat-Completions tool shape into Responses flat format + filter unsupported tools
+function normalizeCodexTools(body) {
+  if (!Array.isArray(body.tools)) return;
+  const validNames = new Set();
+  body.tools = body.tools.filter((tool) => {
+    if (!tool || typeof tool !== "object" || Array.isArray(tool)) return false;
+    const type = typeof tool.type === "string" ? tool.type : "";
+    if (type === "namespace") {
+      if (Array.isArray(tool.tools)) {
+        for (const st of tool.tools) {
+          const n = typeof st?.name === "string" ? st.name.trim().slice(0, 128) : "";
+          if (n) validNames.add(n);
+        }
+      }
+      return true;
+    }
+    if (type !== "function") {
+      if (!type || tool.function || typeof tool.name === "string") return false;
+      return CODEX_HOSTED_TOOL_TYPES.has(type);
+    }
+    const fn = tool.function && typeof tool.function === "object" && !Array.isArray(tool.function) ? tool.function : null;
+    const rawName = typeof tool.name === "string" ? tool.name : (typeof fn?.name === "string" ? fn.name : "");
+    const name = rawName.trim();
+    if (!name) return false;
+    const description = typeof tool.description === "string" ? tool.description : (typeof fn?.description === "string" ? fn.description : "");
+    const parameters = (tool.parameters && typeof tool.parameters === "object" && !Array.isArray(tool.parameters))
+      ? tool.parameters
+      : (fn?.parameters && typeof fn.parameters === "object" && !Array.isArray(fn.parameters) ? fn.parameters : { type: "object", properties: {} });
+    for (const k of Object.keys(tool)) delete tool[k];
+    tool.type = "function";
+    tool.name = name.slice(0, 128);
+    if (description) tool.description = description;
+    tool.parameters = parameters;
+    validNames.add(name);
+    return true;
+  });
+  // Drop tool_choice if it references an unknown function name
+  if (body.tool_choice && typeof body.tool_choice === "object" && !Array.isArray(body.tool_choice)) {
+    if (body.tool_choice.type === "function") {
+      const n = typeof body.tool_choice.name === "string" ? body.tool_choice.name.trim() : "";
+      if (!n || !validNames.has(n)) delete body.tool_choice;
+    }
+  }
+}
+
+// Cache machine ID at module level (resolved once)
+let cachedMachineId = null;
+getConsistentMachineId().then(id => { cachedMachineId = id; });
+
+function hashContent(text) {
+  return createHash("sha256").update(text).digest("hex").slice(0, 16);
+}
+
+function generateSessionId() {
+  return `sess_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 9)}`;
+}
+
+// Extract text content from an input item
+function extractItemText(item) {
+  if (!item) return "";
+  if (typeof item.content === "string") return item.content;
+  if (Array.isArray(item.content)) {
+    return item.content.map(c => c.text || c.output || "").filter(Boolean).join("");
+  }
+  return "";
+}
+
+// Normalize a session id candidate (trim, length cap)
+function normalizeSessionId(value) {
+  if (typeof value !== "string") return null;
+  const v = value.trim();
+  if (!v || v.length > 256) return null;
+  return v;
+}
+
+// Resolve prompt-cache session id with priority: body → assistant-text-hash → workspaceId → machineId
+function resolveCacheSessionId(body, credentials, machineId) {
+  // 1. Client-provided session/conversation id (highest priority — stable per conversation)
+  const fromBody =
+    normalizeSessionId(body?.prompt_cache_key) ||
+    normalizeSessionId(body?.session_id) ||
+    normalizeSessionId(body?.conversation_id);
+  if (fromBody) return fromBody;
+
+  // 2. Hash accumulated assistant text (≥50 chars) — sticky session across turns
+  if (Array.isArray(body?.input) && body.input.length > 0) {
+    let text = "";
+    const MIN_LEN = 50;
+    const CAP_LEN = 200;
+    for (const item of body.input) {
+      if (item?.role !== "assistant") continue;
+      const t = extractItemText(item);
+      if (!t) continue;
+      text += t;
+      if (text.length >= CAP_LEN) break;
+    }
+    if (text.length >= MIN_LEN) {
+      const hash = hashContent((machineId || "") + text.slice(0, CAP_LEN));
+      const entry = assistantSessionMap.get(hash);
+      if (entry) {
+        entry.lastUsed = Date.now();
+        return entry.sessionId;
+      }
+      const sessionId = generateSessionId();
+      assistantSessionMap.set(hash, { sessionId, lastUsed: Date.now() });
+      return sessionId;
+    }
+  }
+
+  // 3. Account-wide fallback (workspaceId from connection)
+  const workspaceId = normalizeSessionId(credentials?.providerSpecificData?.workspaceId);
+  if (workspaceId) return workspaceId;
+
+  // 4. Last resort — stable per-machine id
+  return machineId ? `sess_${hashContent(machineId)}` : generateSessionId();
+}
+
+// Cleanup expired entries periodically
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, entry] of assistantSessionMap) {
+    if (now - entry.lastUsed > SESSION_TTL_MS) assistantSessionMap.delete(key);
+  }
+}, 10 * 60 * 1000);
+
+/**
+ * Codex Executor - handles OpenAI Codex API (Responses API format)
+ * Automatically injects default instructions if missing
+ */
+export class CodexExecutor extends BaseExecutor {
+  constructor() {
+    super("codex", PROVIDERS.codex);
+    this._currentSessionId = null;
+  }
+
+  /**
+   * Override headers to add codex-specific identity headers.
+   * transformRequest runs BEFORE buildHeaders, sets this._currentSessionId.
+   */
+  buildHeaders(credentials, stream = true) {
+    const headers = super.buildHeaders(credentials, stream);
+    headers["session_id"] = this._currentSessionId || credentials?.connectionId || "default";
+    // Identify client type to Codex backend (matches official codex CLI)
+    if (!headers["originator"]) headers["originator"] = "codex_cli_rs";
+    // Workspace binding header — improves account scope + cache affinity
+    const workspaceId = credentials?.providerSpecificData?.workspaceId;
+    if (typeof workspaceId === "string" && workspaceId && !headers["chatgpt-account-id"]) {
+      headers["chatgpt-account-id"] = workspaceId;
+    }
+    return headers;
+  }
+
+  buildUrl(model, stream, urlIndex = 0, credentials = null) {
+    const base = super.buildUrl(model, stream, urlIndex, credentials);
+    return this._isCompact ? `${base}/compact` : base;
+  }
+
+  async refreshCredentials(credentials, log) {
+    if (!credentials?.refreshToken) return null;
+    return refreshProviderCredentials("codex", credentials, log);
+  }
+
+  needsRefresh(credentials) {
+    return shouldRefreshCredentials("codex", credentials);
+  }
+
+  /**
+   * Prefetch remote image URLs and inline them as base64 data URIs.
+   * Runs before execute() because Codex backend cannot fetch remote images.
+   * Mutates body.input in place.
+   */
+  async prefetchImages(body) {
+    if (!Array.isArray(body?.input)) return;
+    for (const item of body.input) {
+      if (!Array.isArray(item.content)) continue;
+      const pending = item.content.map(async (c) => {
+        if (c.type !== "image_url") return c;
+        const url = typeof c.image_url === "string" ? c.image_url : c.image_url?.url;
+        const detail = c.image_url?.detail || "auto";
+        if (!url) return c;
+        if (url.startsWith("data:")) return { type: "input_image", image_url: url, detail };
+        const fetched = await fetchImageAsBase64(url, { timeoutMs: 15000 });
+        return { type: "input_image", image_url: fetched?.url || url, detail };
+      });
+      item.content = await Promise.all(pending);
+    }
+  }
+
+  async execute(args) {
+    const imgCount = Array.isArray(args.body?.input) ? args.body.input.reduce((n, it) => n + (Array.isArray(it.content) ? it.content.filter(c => c.type === "image_url").length : 0), 0) : 0;
+    const inputLen = Array.isArray(args.body?.input) ? args.body.input.length : 0;
+    dbg("CODEX", `execute start | inputItems=${inputLen} | images=${imgCount} | sessionId=${this._currentSessionId || "pending"}`);
+    if (imgCount > 0) {
+      const t0 = Date.now();
+      await this.prefetchImages(args.body);
+      dbg("CODEX", `prefetchImages done | ${Date.now() - t0}ms`);
+    } else {
+      await this.prefetchImages(args.body);
+    }
+
+    // Retry loop for SSE-level overloaded errors (200 OK body contains event: error)
+    // Reuses 503 retry config — same semantic: upstream temporarily unavailable
+    const retryConfig = { ...DEFAULT_RETRY_CONFIG, ...this.config.retry };
+    const { attempts, delayMs } = resolveRetryEntry(retryConfig[503]);
+    let attempt = 0;
+    while (true) {
+      const result = await super.execute(args);
+      const peek = await this._peekSseOverloaded(result.response);
+      if (!peek.matched) {
+        // Replace body with re-assembled stream (prefix bytes already read + rest)
+        if (peek.replacementBody) {
+          result.response = new Response(peek.replacementBody, {
+            status: result.response.status,
+            statusText: result.response.statusText,
+            headers: result.response.headers,
+          });
+        }
+        return result;
+      }
+      if (attempt >= attempts) {
+        args.log?.warn?.("RETRY", `CODEX | SSE overloaded "${peek.matched}" — retries exhausted (${attempt}/${attempts})`);
+        // Out of retries → return with replacement body so client gets the error
+        if (peek.replacementBody) {
+          result.response = new Response(peek.replacementBody, {
+            status: result.response.status,
+            statusText: result.response.statusText,
+            headers: result.response.headers,
+          });
+        }
+        return result;
+      }
+      attempt++;
+      args.log?.debug?.("RETRY", `CODEX | SSE "${peek.matched}" retry ${attempt}/${attempts} after ${delayMs / 1000}s`);
+      dbg("CODEX", `SSE overloaded "${peek.matched}" → retry ${attempt}/${attempts} in ${delayMs}ms`);
+      try { await result.response.body?.cancel?.(); } catch { /* noop */ }
+      await new Promise(r => setTimeout(r, delayMs));
+    }
+  }
+
+  // Peek first N bytes of SSE body to detect upstream "overloaded" errors.
+  // Returns { matched: string|null, replacementBody: ReadableStream|null }.
+  // Caller MUST use replacementBody (original body has been read).
+  async _peekSseOverloaded(response) {
+    if (!response || !response.ok || !response.body) return { matched: null, replacementBody: null };
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const chunks = [];
+    let text = "";
+    let matched = null;
+    try {
+      while (text.length < CODEX_SSE_PEEK_BYTES) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        chunks.push(value);
+        text += decoder.decode(value, { stream: true });
+        const hit = CODEX_SSE_OVERLOADED_PATTERNS.find(p => text.includes(p));
+        if (hit) { matched = hit; break; }
+      }
+    } catch (e) {
+      dbg("CODEX", `peek read error: ${e.message}`);
+    }
+    reader.releaseLock();
+
+    // Re-assemble stream: prefix chunks + remaining upstream body
+    const upstream = response.body;
+    let upstreamReader = null;
+    const replacementBody = new ReadableStream({
+      start(controller) {
+        for (const c of chunks) controller.enqueue(c);
+        upstreamReader = upstream.getReader();
+      },
+      async pull(controller) {
+        try {
+          const { done, value } = await upstreamReader.read();
+          if (done) { controller.close(); return; }
+          controller.enqueue(value);
+        } catch (e) { controller.error(e); }
+      },
+      cancel(reason) {
+        try { upstreamReader?.cancel(reason); } catch { /* noop */ }
+      },
+    });
+    return { matched, replacementBody };
+  }
+
+  // Parse Codex usage_limit_reached to extract precise resetsAtMs; fallback to default otherwise
+  parseError(response, bodyText) {
+    if (response.status === 429 && bodyText) {
+      try {
+        const json = JSON.parse(bodyText);
+        const err = json?.error;
+        if (err?.type === "usage_limit_reached") {
+          const now = Date.now();
+          let resetsAtMs = null;
+          if (typeof err.resets_at === "number" && err.resets_at > 0) {
+            const ms = err.resets_at * 1000;
+            if (ms > now) resetsAtMs = ms;
+          }
+          if (!resetsAtMs && typeof err.resets_in_seconds === "number" && err.resets_in_seconds > 0) {
+            resetsAtMs = now + err.resets_in_seconds * 1000;
+          }
+          if (resetsAtMs) {
+            return { status: 429, message: err.message || bodyText, resetsAtMs };
+          }
+        }
+      } catch { /* fall through to default */ }
+    }
+    return super.parseError(response, bodyText);
+  }
+
+  /**
+   * Transform request before sending - inject default instructions if missing.
+   * Image fetching is handled separately in prefetchImages() so this stays sync.
+   */
+  transformRequest(model, body, stream, credentials) {
+    this._isCompact = !!body._compact;
+    delete body._compact;
+    // Resolve conversation-stable session_id (priority: body → assistant-text → workspace → machine)
+    this._currentSessionId = resolveCacheSessionId(body, credentials, cachedMachineId);
+    // Convert string input to array format (Codex API requires input as array)
+    const normalized = normalizeResponsesInput(body.input);
+    if (normalized) body.input = normalized;
+
+    // Ensure input is present and non-empty (Codex API rejects empty input)
+    if (!body.input || (Array.isArray(body.input) && body.input.length === 0)) {
+      body.input = [{ type: "message", role: "user", content: [{ type: "input_text", text: "..." }] }];
+    }
+
+    // Keep system prompts in body.input as role=developer so they stay in the cacheable prefix
+    convertSystemToDeveloperRole(body);
+    // Strip server-generated item IDs (rs_/fc_/resp_/msg_) — Codex /responses can't resolve when store=false
+    stripStoredItemReferences(body);
+    // Flatten function tools + drop unsupported types
+    normalizeCodexTools(body);
+
+    // Ensure streaming is enabled (Codex API requires it)
+    body.stream = true;
+
+    // If no instructions provided, inject default Codex instructions
+    if (!body.instructions || body.instructions.trim() === "") {
+      body.instructions = CODEX_DEFAULT_INSTRUCTIONS;
+    }
+
+    // Ensure store is false (Codex requirement)
+    body.store = false;
+
+    // Inject prompt_cache_key for stable Codex prompt caching
+    if (!body.prompt_cache_key && this._currentSessionId) {
+      body.prompt_cache_key = this._currentSessionId;
+    }
+
+    // Map virtual Codex review models to the upstream Codex model before suffix parsing.
+    body.model = getModelUpstreamId("cx", body.model || model);
+
+    // Extract thinking level from model name suffix
+    // e.g., gpt-5.3-codex-high → high, gpt-5.3-codex → medium (default)
+    const effortLevels = ['none', 'low', 'medium', 'high', 'xhigh'];
+    let modelEffort = null;
+    for (const level of effortLevels) {
+      if (body.model.endsWith(`-${level}`)) {
+        modelEffort = level;
+        // Strip suffix from model name for actual API call
+        body.model = body.model.replace(`-${level}`, '');
+        break;
+      }
+    }
+
+    // Priority: explicit reasoning.effort > reasoning_effort param > model suffix > default (medium)
+    if (!body.reasoning) {
+      const effort = body.reasoning_effort || modelEffort || 'low';
+      body.reasoning = { effort, summary: "auto" };
+    } else if (!body.reasoning.summary) {
+      body.reasoning.summary = "auto";
+    }
+    delete body.reasoning_effort;
+
+    // Include reasoning encrypted content (required by Codex backend for reasoning models)
+    if (body.reasoning && body.reasoning.effort && body.reasoning.effort !== 'none') {
+      body.include = ["reasoning.encrypted_content"];
+    }
+
+    // Remove unsupported parameters for Codex API
+    delete body.temperature;
+    delete body.top_p;
+    delete body.frequency_penalty;
+    delete body.presence_penalty;
+    delete body.logprobs;
+    delete body.top_logprobs;
+    delete body.n;
+    delete body.seed;
+    delete body.max_tokens;
+    delete body.max_completion_tokens;
+    delete body.max_output_tokens; // Responses API clients send this but Codex rejects it
+    delete body.user; // Cursor sends this but Codex doesn't support it
+    delete body.prompt_cache_retention; // Cursor sends this but Codex doesn't support it
+    delete body.metadata; // Cursor sends this but Codex doesn't support it
+    delete body.stream_options; // Cursor sends this but Codex doesn't support it
+    delete body.safety_identifier; // Droid CLI sends this but Codex doesn't support it
+    delete body.previous_response_id; // store=false → backend can't resolve previous resp; avoid 404
+
+    // Final allowlist filter — strip any unknown field that could trigger upstream "routing_unsupported"
+    for (const k of Object.keys(body)) {
+      if (!RESPONSES_API_ALLOWLIST.has(k)) delete body[k];
+    }
+
+    return body;
+  }
+}