feat(responses): configure native reasoning retention across model and account switches

[yuanyuanlove]

Summary

Adds two independent, default-off opt-ins, nativeReasoningRetention.modelSwitch and nativeReasoningRetention.accountSwitch. They let reasoning encrypted_content be replayed when the serving model or account changes on the canonical ChatGPT forward destination (same provider, adapter and durable endpoint), including concrete Combo candidates and account-pool retries. A simultaneous model and account change needs both switches. Everything else is unchanged: native compaction blobs are still stripped on any serving-identity change through a separate internal flag, continuation ids and uploaded-file refusals stay account-bound, and an upstream rejection still strips and rebuilds once. The settings are exposed in the dashboard (overview panel), GET/PUT /api/native-reasoning-retention, and docs (EN/zh-CN), with dashboard strings in every locale.

Original work by @yuanyuanlove (head ef4645f71). Maintainer follow-up on this branch:

• dev integrated at 7640a942b with a regular merge commit (no rebase or force push). The retention snapshot is now applied after the Antigravity direct-request decode, which replaces parsed. The new desktopCompatibility config, the compaction-request scrub argument, locales, test-layout shards and the rewrapped responses transport doc were resolved alongside it.
• Streamed refusal recovery for retained ciphertext. ChatGPT can refuse a retained foreign blob inside a 200 stream (a Codex WebSocket error frame or response.failed) instead of an HTTP 4xx, and that path skipped the single sanitized rebuild. For requests whose ciphertext was actually kept across a change, the passthrough now inspects the zero-output prelude for a self-identified ciphertext refusal and routes it through the existing one-shot opaque-blob recovery and rejection memo. The preflight is armed only while the rebuild is still allowed, so after a spent ambiguous replacement the original stream reaches the client unchanged. Ordinary turns keep the existing path.
• Behavior note: on an account change, foreign reasoning item ids are now dropped even when no continuation state needs scrubbing. With both switches off this can only remove an rs_* id the new account cannot resolve; it never forwards more.

Before (origin/dev 7640a942b) and after (8a7bceb7c), real GUI builds served by sandboxed proxies; both switches default off:

Verification

All results below are from head 8a7bceb7c (macOS, Bun 1.4.3), run with throwaway OPENCODEX_HOME/CODEX_HOME.

• bun scripts/test.ts --parallel=1 on 20 files: 492 pass, 0 fail (3,673 assertions). Files: tests/config/config-native-reasoning-retention, config-load-degrade, tests/server/server-native-reasoning-retention, server-native-reasoning-retention-merge, server-combo-reasoning-replay-eligibility, tests/adapters/reasoning-replay-identity, tests/responses/responses-account-change-scrub, responses-core-modules, responses-opaque-blob-recovery, responses-retained-reasoning-stream-recovery (new), responses-compaction-override, responses-compaction-recovery-policy, tests/claude-integration/claude-native-reasoning-continuity, tests/providers/deepseek-reasoning-replay, tests/cli/cli-headless-parity, tests/test-layout, tests/test-layout-tooling, tests/ci-workflows/file-size-ratchet, repo-hygiene, structure-ssot.
• The new responses-retained-reasoning-stream-recovery.test.ts (4 cases) covers both stream shapes recovering once, a repeated refusal surfacing after one rebuild, and a spent ambiguous replacement leaving the stream untouched. Each case failed without its source change.
• cd gui && bun test tests/native-reasoning-retention-panel.test.tsx tests/i18n-locales.test.ts tests/locale-parity.test.ts: 30 pass, 0 fail. bun run lint:i18n and bun run build:gui passed (existing large-chunk warning only).
• bun run typecheck, bun run structure:check, bun run privacy:scan, git diff origin/dev --check: passed.
• Live management API on a sandboxed proxy: GET returns both false; a partial PUT {"modelSwitch":true} keeps accountSwitch false; an unknown key returns 400; an unauthenticated request returns 401; null resets to defaults and removes the block from config.json.
• An independent review (two rounds) covered the default-off parity, the account and model boundaries, separation from compaction state, rejection recovery, the management route and the merge. Round-one findings (a stale source oracle and the streamed refusal gap) and the round-two finding (synthetic status after a withheld rebuild) are fixed above.
• Not run: the full bun run test and test:changed suites (about 20 concurrent worktrees on the host). Cross-platform CI is dispatched on the exact head: https://github.com/lidge-jun/opencodex/actions/runs/38715681961. Whether the backend accepts or reuses another account's reasoning has not been tested live; the account switch only permits forwarding.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Independent boundary review done; the maintainer-sponsored decision for src/server/management-api.ts is still open.

Review readiness checklist

• Required local validation passed; commands, results, and any full-suite exception are documented.
• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• I resolved all correct Codex and CodeRabbit findings.
• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/server/management-api.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/server/management-api.ts.
• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@yuanyuanlove Tick the boxes once required local validation has passed with commands, results, and any full-suite exception documented, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[yuanyuanlove]

Follow-up to the UI screenshot gate and hygiene finding:

• Integrated dev at fd2032050 with a merge commit, preserving both sides of locale/test-layout additions. Current head: 1a2296568bc2032f668b88fbc29b2c5874d6f846.
• Added English and Chinese screenshots to the description from the actual component and stylesheet, using simulated settings only. Verified default-off, independent model/account saves, and reset. No account data or credentials are included.
• Passed 204 focused runtime/config/API/layout tests, 122 CLI/hygiene/size guards, 30 GUI/locale tests, typecheck, privacy scan, structure check, i18n lint, and GUI build. Exact commands and limitations are in Verification.
• Broad changed-mode validation was interrupted and is not passing evidence. The 24 failure-bearing files were then compared on head and clean dev: both 818 pass / 3 skip / 23 fail, with identical failures and no head-only failures. No full-suite or live-account pass is claimed.

@lidge-jun @Ingwannu, could a maintainer review the management API security surface and apply maintainer-sponsored if approved, and approve the fork's Cross-platform CI / React Doctor workflows for this head? Those are maintainer gates; I have not approved workflows or changed labels/security settings. The PR remains a draft and has not been merged.

[yuanyuanlove]

Integrated dev at 32abcc363d99dd0945b3b483790e9c11c035d59e with a regular merge commit. Current head: 973fb72b220a21202e1b3b9a5fe9ef6168faef3d. The remote tree and ordered parents were verified after publication; GitHub now reports the PR as mergeable.

The conflict resolution preserves both retention-policy initialization and upstream Claude replay/mint metadata, both test-layout registrations, and the transport docs. Upstream hosted-search portable-compaction behavior is retained. Added 7 local regression cases proving that strict Claude per-blob tag/account/generation ownership still overrides both retention opt-ins, already-stripped ciphertext is never restored, and search metadata remains assistant reference data.

Validation on the merged tree, using Bun 1.4.0 in the isolated cloud checkout:

• 113 existing focused backend tests, 0 failures; 7 new merge regressions, 0 failures.
• 30 GUI/locale tests, 0 failures; i18n lint and GUI build passed. The existing large-chunk warning remains.
• Typecheck, privacy scan and structure check passed.
• git diff --check origin/dev passed. The whole integration diff has four EOF blank-line notices in upstream devlog files that are byte-identical to dev.
• Independent read-only merge review found no merge-induced regression.

Exact backend commands:

bun test --isolate tests/config/config-native-reasoning-retention.test.ts tests/server/server-native-reasoning-retention.test.ts tests/server/server-combo-reasoning-replay-eligibility.test.ts tests/adapters/reasoning-replay-identity.test.ts tests/responses/responses-account-change-scrub.test.ts tests/responses/responses-core-modules.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/claude-integration/claude-native-reasoning-continuity.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/repo-hygiene.test.ts
bun test --isolate tests/server/server-native-reasoning-retention-merge.test.ts

In gui/: bun test tests/native-reasoning-retention-panel.test.tsx tests/i18n-locales.test.ts tests/locale-parity.test.ts, bun run lint:i18n, and bun run build.

This is scoped validation. The full backend/GUI suites and changed-mode suite were not run. The network-mocked compaction/opaque-blob suites were not rerun because of the previously observed inherited-proxy fixture limitation in this cloud environment; no proxy or security settings were changed. No live-account ciphertext-acceptance or reasoning-reuse result is claimed.

Exact-head Cross-platform CI and React Doctor still require maintainer approval (action_required). The existing management API security/sponsorship gate remains. Target/label checks are still queued at this observation; CodeRabbit skipped the draft. The PR remains a draft.

[Ingwannu]

Acknowledging the review/CI request against the current head 77189cfe62c8e67c1a76f7798555365f13534385, rather than the older 1a229656 checkpoint. The per-model/account retention management surface still has the unsponsored_surface hold. I have not completed its explicit boundary review and will not infer sponsorship from the screenshots, independent-review claim or base/head failure attribution alone.

Current-head Cross-platform CI 38014732772 and React Doctor 38014733012 remain action_required. The unfinished broader validation stays a documented coverage limit, and the PR should remain Draft. No fork-workflow authorization, sponsorship waiver, approval or merge was performed in this pass.

[Ingwannu]

Correctness/coverage follow-up at c88bc61. I inspected the retention runtime delta, partial/null management update and publication/rollback handling, replay identity and recovery precedence, and selected backend/GUI regression fixtures. The current structure/docs correctly distinguish forwarding permission from demonstrated upstream acceptance; I am not treating synthetic ciphertext success as live cross-account acceptance.

The Verification section still names 1a22965. Later merges add seven cases in tests/server/server-native-reasoning-retention-merge.test.ts (including a source-oracle wiring assertion, not seven equivalent end-to-end proofs) and four invalid retention still warns while WS reuse honors ... cases in tests/config/config-native-reasoning-retention.test.ts. Those are relevant to the intervening Claude per-blob ownership and WS config merges and are not covered merely by quoting the old 204-pass receipt.

Please record validation for these post-1a229 cases against the current candidate, plus the affected retention/replay and GUI scope, with commands/results and any carried unchanged-tree evidence clearly separated. The 818-pass/23-fail baseline comparison remains attribution, not a green suite. I did not execute these files because another project's Cargo builds are active under the shared host's serial-workload rule, and I am not substituting source assertions for execution.

Current Cross-platform run 38093698634, Catalog 38093698643 and React Doctor 38093698635 are action_required. The current target/hygiene failure annotations both say unsponsored_surface; this is not a request to weaken them or repeat an already-addressed runtime fix. Draft, required independent review and sponsorship remain separate. No scan, fork-workflow authorization, sponsorship or approval was performed.

Update after the author's current-candidate receipt (2026-10-11): the requested Verification update is now supplied. I independently checked that published head c88bc61 has tree aa36b10e28532ecabb03634d5122067f75a08a39, the stated ordered parents 77189cf / 433764e, and 12,015 recursive tree entries. The revised description records the author's 287 backend / 30 GUI test passes, named commands and the post-1a229 cases, with helper/source-oracle scope and historical receipts separated. These are author-reported executions, not tests I ran or an independent verification of their runtime results. The earlier request to document this current-candidate evidence is addressed; it should not remain an outstanding stale-head-documentation objection.

The excluded opaque-blob recovery and compaction-override files still leave the current-candidate opt-in/rejection matrix unverified here. Full suites, current browser rendering and live cross-account acceptance/reuse remain unverified. I did not run a scan or alter proxy settings. Draft, independent boundary review, unsponsored-surface and workflow-authorization requirements are unchanged; this update is not approval or sponsorship.

[yuanyuanlove]

Updated the Verification section for this review against c88bc61af5591322b300283a378e32266acb61bb.

The 2026-10-10 cloud run executed 287 backend tests (16 files), 0 failures, 2,332 assertions, and 30 GUI/locale tests, 0 failures, 4,234 assertions, using Bun 1.4.0. The full executed commands are now recorded in Verification. Typecheck, privacy scan, structure check, i18n lint, GUI build, and the diff check against integrated dev also passed.

• All seven post-1a229656 merge cases passed: one source-oracle wiring assertion and six local ownership/helper/projection cases, not seven end-to-end proofs.
• All four WS/config warning cases (true, false, absent, invalid) passed. They verify schema/helper handling and the process-local flag; they do not establish socket reuse or a full disk-load/socket end-to-end flow.
• The GUI run includes 12 retention-panel component cases, plus i18n and locale parity.
• These were fresh executions on resolved tree aa36b10e28532ecabb03634d5122067f75a08a39, then verified identical to the published head's complete tree. No older receipt is counted in these totals.

The old macOS 204-pass/122-pass receipts, the 818-pass/23-fail failure-attribution comparison, and the simulated screenshots are now explicitly historical. The full backend/GUI and changed-mode suites were not run on the current candidate; the blocked inherited-proxy mocked-network paths were not retried, and no proxy/security settings were changed. No current browser rendering, live cross-account ciphertext acceptance, or reasoning reuse is claimed.

Current-head Cross-platform CI, Catalog async contracts, and React Doctor still require maintainer approval. The unsponsored_surface boundary review/sponsorship hold and draft status remain; this validation record does not grant approval or sponsorship.

[yuanyuanlove]

Integrated dev at dc45bb2ca92e9a4f841a73d70177bfec04722d47 with a regular merge commit. Current head: 2dba4d534572ba8287cd1117959a45f0a9005db5.

Fetch verification confirms the published complete tree 4cb25bf52e6154c0b334f113c119e7813375b761 (12,072 recursive entries) is identical to the tested candidate. Its ordered parents are c88bc61af5591322b300283a378e32266acb61bb and dc45bb2ca92e9a4f841a73d70177bfec04722d47. GitHub now reports this head as mergeable; the PR remains a draft.

The only textual conflict was tests/fixtures/test-layout-expected.json. Both the three retention registrations and four upstream service-health-sentinel registrations are preserved. The structure index was regenerated. Independent static merge review found no merge-induced findings in the overlapping configuration, management dispatch/trusted-hub propagation, shadow provenance, per-blob ownership/recovery, locale, layout and structure contracts. That review did not execute tests or grant security approval.

Fresh validation on this merged candidate in the isolated cloud checkout with Bun 1.4.0:

• Retention/replay/config/API/layout and related guards: 287 pass, 0 fail, 2,332 assertions across 16 files.
• Upstream guarded live-save/topology and pure sentinel-policy coverage: 23 pass, 0 fail, 319 assertions across two files.
• GUI retention panel, i18n and locale parity: 30 pass, 0 fail, 4,250 assertions across three files.
• Typecheck, privacy scan, structure check, GUI i18n lint, GUI build and git diff --cached origin/dev --check passed. The existing GUI large-chunk warning remains.

Exact backend commands:

bun test --isolate tests/config/config-native-reasoning-retention.test.ts tests/config/config-load-degrade.test.ts tests/server/server-native-reasoning-retention.test.ts tests/server/server-native-reasoning-retention-merge.test.ts tests/server/server-combo-reasoning-replay-eligibility.test.ts tests/adapters/reasoning-replay-identity.test.ts tests/responses/responses-account-change-scrub.test.ts tests/responses/responses-core-modules.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/claude-integration/claude-native-reasoning-continuity.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/repo-hygiene.test.ts tests/cli/cli-headless-parity.test.ts tests/providers/deepseek-reasoning-replay.test.ts tests/responses/responses-compaction-recovery-policy.test.ts
bun test --isolate tests/config/hub-disable-live-save.test.ts tests/service/service-health-sentinel-policy.test.ts
bun run typecheck
bun run privacy:scan
bun run structure:check
git diff --cached origin/dev --check

In gui/:

bun test tests/native-reasoning-retention-panel.test.tsx tests/i18n-locales.test.ts tests/locale-parity.test.ts
bun run lint:i18n
bun run build

The seven merge cases and four WS/config-warning cases were executed again within the 287-pass run. Their documented helper/source-oracle and process-local scope is unchanged; this does not prove end-to-end socket reuse. The prior c88bc61a receipt and older macOS/baseline/screenshot receipts are historical and are not counted in this run.

This is scoped validation. Full backend/GUI suites and changed-mode validation were not run. The previously blocked inherited-proxy mocked-network opaque-blob/compaction-override and SOCKS-sensitive WS paths were not retried, and no proxy/security settings were changed. The comprehensive opt-in/rejection matrix, current browser rendering, and live cross-account ciphertext acceptance/reuse remain unverified.

Exact-head Cross-platform CI, Catalog async contracts, and React Doctor remain action_required. The existing unsponsored_surface hold and unfinished management-boundary review remain. No workflow authorization, sponsorship, approval, readiness or merge is claimed.

[yuanyuanlove]

Integrated the subsequent dev commit 3e58c2ce3ee5433901ed467fe87c32fb4b5c5e77 (#6962) with a regular merge commit after it introduced a new test-layout conflict. Current head: ef4645f716cfd974d1d3212f33bed6f424924db0.

Fetch verification confirms the complete published tree bab75d33083e63f3d841e48e127f47d9aee6404d (12,084 recursive entries) equals the resolved candidate, with ordered parents 2dba4d534572ba8287cd1117959a45f0a9005db5 and 3e58c2ce3ee5433901ed467fe87c32fb4b5c5e77. GitHub reports this head as mergeable; the PR remains a draft.

The only textual conflict was scripts/test-layout/layout.json. All three retention and six Anthropic-billing registrations are preserved. The layout and expected oracle retain all 2,231 mappings from both parents, without duplicate keys. The structure index was regenerated. Independent static review found no merge-induced findings; canonical ChatGPT retention and Anthropic physical-send/retry ownership remain separate, with per-blob ownership, compaction cleanup, rejection precedence and output/continuation boundaries preserved.

Validation in the isolated cloud checkout with Bun 1.4.0:

• The initial 19-file backend run returned 324 pass / 1 fail, 2,723 assertions. The sole failure was the file-size ratchet: the merged layout reached 2,002 lines.
• Fixed only grouped-key formatting, using the file's existing style. The parsed 2,231-entry map is unchanged and the final layout is 1,998 lines. No ratchet, baseline or threshold was changed.
• Reran all three affected layout/tooling/ratchet files on the final tree: 28 pass / 0 fail, 643 assertions. The other 297 cases had passed on the same merged runtime and were unaffected by this formatting-only edit. These cover 325 distinct passing backend cases across the two executions, with the initial failure and retry kept separate. The complete 19-file invocation was not repeated after the formatting-only fix.
• Typecheck, privacy scan and structure check passed on the merged runtime/doc inputs, which are unchanged by the final formatting fix. The final diff check against integrated dev passed.

Initial backend command:

bun test --isolate tests/config/config-native-reasoning-retention.test.ts tests/config/config-load-degrade.test.ts tests/server/server-native-reasoning-retention.test.ts tests/server/server-native-reasoning-retention-merge.test.ts tests/server/server-combo-reasoning-replay-eligibility.test.ts tests/adapters/reasoning-replay-identity.test.ts tests/responses/responses-account-change-scrub.test.ts tests/responses/responses-core-modules.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/claude-integration/claude-native-reasoning-continuity.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/ci-workflows/repo-hygiene.test.ts tests/cli/cli-headless-parity.test.ts tests/providers/deepseek-reasoning-replay.test.ts tests/responses/responses-compaction-recovery-policy.test.ts tests/config/hub-disable-live-save.test.ts tests/service/service-health-sentinel-policy.test.ts tests/adapters/anthropic/anthropic-billing-refusal.test.ts

Final affected-file rerun and gates:

bun test --isolate tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts
bun run typecheck
bun run privacy:scan
bun run structure:check
git diff --cached origin/dev --check

The typecheck/privacy/structure commands ran before the final formatting-only edit; the affected tests and diff check ran afterward.

Carried GUI evidence: the complete gui/ subtree remains byte-identical to the validated 2dba4d53 parent (tree ab970cb83e97673d96ba6b9d463c225ebaaa7f4d), and root package.json / bun.lock also match. Its 2026-10-12 receipt has 30 GUI/locale passes, 0 failures, 4,250 assertions, plus passing i18n lint and GUI build. Those unchanged-input results are carried; no fresh GUI execution or browser rendering is claimed for this second merge. The description retains the earlier 2dba4d53 snapshot; this comment records the latest head.

This remains scoped validation. Full backend/GUI and changed-mode suites, broader network-mocked Anthropic billing integration, current browser rendering, and live cross-account ciphertext acceptance/reuse were not run. The blocked opaque-blob/compaction-override/mock-network/SOCKS-sensitive WS paths were not retried or bypassed, and no proxy/security settings were changed. The safe refusal tests use local Response bodies and do not establish live account behavior.

Exact-head Cross-platform CI, Catalog async contracts, and React Doctor remain action_required. The existing unsponsored_surface hold and unfinished management-boundary review remain. No sponsorship, workflow authorization, security approval, review readiness or merge is claimed.

[Ingwannu]

Freshness follow-up at ef4645f716cfd974d1d3212f33bed6f424924db0: fetched and verified the two merge parents are 2dba4d53 and current dev 3e58c2ce. The conflict-resolution diff preserves the three retention registrations and the six incoming billing registrations in both layout/oracle; the grouped layout formatting is not a raised size baseline.

Your latest receipt correctly distinguishes the initial 324/1 invocation from the final 28/0 affected-gate rerun and carries unchanged GUI inputs rather than claiming a fresh GUI execution. Those remain author-reported results here; I did not rerun that 19-file suite or complete the outstanding management-boundary review.

Keep Draft. Exact-head executable CI remains action_required, and the existing unsponsored-surface/independent-boundary hold is not waived by integrating dev or a focused fixture receipt. No scan, workflow approval, sponsorship, technical approval or merge was performed.

[lidge-jun]

Thanks @yuanyuanlove! I merged current dev into your branch and pushed two follow-up fixes (streamed refusal recovery for retained ciphertext, and keeping a withheld refusal unprojected); details and validation are in the updated description.

[lidge-jun]

Being carried into #7217 with your authorship preserved; this PR will be closed when the bundle lands.

[lidge-jun]

Landed on dev in 65ef8b3 via #7217 (your change is its own commit in that bundle, and the squash keeps your authorship as Co-authored-by). Thank you!