fix(responses): normalize hosted search history for Codex-native continuations

[yuanyuanlove]

Summary

• Narrow ordinary canonical ChatGPT Codex /responses hosted-search projection to explicitly selected Responses Lite requests, independently of model names. Non-Lite and unknown requests retain structural hosted history. Native /responses/compact, public OpenAI API requests and other destination URLs keep their existing behavior.
• Read the final outgoing protocol intent after destination selection and existing repairs: literal true/false in x-openai-internal-codex-responses-lite wins; otherwise exact true in valid string-map client_metadata.ws_request_header_x_openai_internal_codex_responses_lite is the fallback, matching existing WS preparation. No header, metadata, model, authentication or transport behavior is changed to select Lite. The same final body feeds HTTP/SSE and WS preparation, including existing HTTP fallback.
• Within that Lite boundary, scoped bridge memo hits restore the original function call/result first; only unreferenced remaining hosted cells become labeled untrusted metadata notes. Same-input item_reference.id targets remain structural; existing store:false normalization removes references earlier. A cache miss, ID prefix, model switch, fork or restart does not establish provenance.
• Preserve client-owned raw history, non-hosted order, declarations/Lite catalogs, tool choices, schemas, call/result pairs and opaque reasoning under their existing policies. Keep the earlier bounded renderer enhancement for allowlisted top-level web_search_call.sources, including portable/routed summaries; their existing triggers and default projection are unchanged by this follow-up.
• Draft / policy review: Lite still defaults to a lossy compatibility policy, with 2,048 UTF-16 units per string, 20 entries per list and 65,536 serialized bytes of projected notes including the omission note. Converted cells lose item identity and unknown fields; notes are not fetched page content or reconstructed tool results. The bound is not a limit on original history or deliberately retained referenced cells. Explicit project-owner acceptance remains outstanding.
• Record the contributor's rationale, alternatives and evidence limits in ADR-6930, owned by the existing hosted-search continuation section. Official Codex 0.161.0 omits hosted model-tool declarations for Lite and still accepts hosted history items in its serializer. openai/codex#51962 reports restored hosted-history compaction failure and successful controls; it does not prove all ordinary Lite requests fail or hosted schema is invalid. The narrower protocol boundary preserves non-Lite/unknown continuations rather than applying universal canonical projection.
• The portable/routed summarizer renderer already present in this PR's upstream dev base originated in fix(compaction): preserve hosted search metadata as text #6746 by @yuanyuanlove and was integrated through fix(compaction): keep hosted search history as bounded reference notes in portable summaries (carry #6746) #6799 by @lidge-jun, whose amendments made the notes assistant reference text and bounded their fields, lists, and total size. Those commits are already ancestors of this PR's base; this PR extends the existing renderer for ordinary Codex continuations and preserves those bounds. It does not claim that the working native compact endpoint was missing a required repair.
• No Kimi empty-assistant fix (fix(kimi): omit explicit empty assistant history on native Responses #6931), native reasoning-retention patch, local runtime diagnostics, request captures, deployment scripts, credential or proxy/security change is included.

Verification for the Lite-only follow-up (231b848bbf448a04dae747108768f28d1a5bee9b)

• Baseline: f9bcaefcaf6214567e54a73dae101a2c51ce16f4, a one-line docs correction over the previously reviewed f093002f5caff80203e83f44250c621891101cab. Upstream base remains 9b6f4b2632492b3df637dccc009d6a01ed47c85d; no merge/rebase was needed. This follow-up changes one production file, two test files and related documentation; the shared renderer, native compact implementation and transport marker handling have no diff from that baseline.
• Published as an ordinary update with the original-head lease and no force. Refetched the fork branch and verified the complete tree 32b51b94c0aa340b294fc2f14eaa63c5f9189ff0, sole parent f9bcaefcaf6214567e54a73dae101a2c51ce16f4, and exact equality with the staged/working files.
• Test-first: the universal baseline failed nine new non-Lite/unknown boundary cases before the Lite gate; final focused tests pass with pinned Bun 1.4.0:
  • bun test --isolate tests/adapters/openai/openai-native-hosted-search-history.test.ts: 41 pass / 0 fail, 392 assertions.
  • bun test --isolate tests/responses/openai-responses-passthrough.test.ts -t 'strips invalid type-specific ids from serialized input items': 1 pass / 0 fail, 16 assertions; restores the non-Lite structural hosted-ID control.
  • bun test --isolate tests/codex-integration/codex-metadata-integrity.test.ts -t 'Codex request transport metadata|Lite follows the serialized wire model': 12 pass / 0 fail, 224 assertions. Filters exclude the separate listening/network test.
• These 54 tests / 632 assertions cover HTTP true/false/absent and mixed-case names, exact flag values, valid/invalid/absent WS metadata, conflicts and configured-header precedence, malformed metadata with explicit HTTP true, other destinations/public API, native-compaction flags, existing portable builder behavior, bridge restoration/misses, same-input reference exemptions, raw/cipher preservation, bounded sources and 190 client call/result pairs. They are adapter/WS-preparation fixtures, not live HTTP/WS E2E or backend acceptance evidence.
• bun run typecheck, bun run privacy:scan, bun run structure:check, bun scripts/file-size-ratchet.ts, and working/staged git diff --check passed.
• In docs-site/, bun install --frozen-lockfile and bun run build passed using a workspace-local XDG config directory with Astro telemetry disabled: 569 pages / 79,294 internal links. Existing large-chunk and missing i18n/404-entry warnings remain; there is no lockfile/dependency change.
• Independent read-only source review checked the gate against existing HTTP/WS precedence, endpoint/compaction exclusions, restoration order, references, tests and documentation. It provides no project-owner approval, CI authorization or live acceptance evidence.
• Exact-head GitHub status: Cross-platform CI 38123897992, React Doctor 38123897991, and Catalog async contracts 38123898071 are action_required. Metadata checks: enforce-target: success; hygiene: success; resolve-pr: success; label: success. These are not runtime CI passes; no workflow authorization was granted.
• Full-suite and mock-network server suites were not rerun in this restricted cloud environment. The previously denied fixture/raw-proxy path was not retried or bypassed; no proxy/security settings were changed. Sustained recovery of the original conversation, live ordinary HTTP/WS, public API and cross-platform acceptance remain outstanding.
• Official OpenAI documentation treats hosted search as valid output and describes manually replaying response output: web search, conversation state. These public API contracts do not independently establish private Codex backend behavior. The PR remains Draft.

Prior revision receipts

The earlier author-reported broad import-connected run (3,939 pass / 1 skip; 157 files), focused 313-test and 224-test runs, and mocked native-compact send guards describe the superseded universal-gate revision f093002f5caff80203e83f44250c621891101cab. They were not rerun for this Lite-only follow-up and are not presented as current-head full-suite or live acceptance results.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. (No credential/auth/workflow/dependency policy change; untrusted metadata only, synthetic fixtures, no invented replay scope.)

Co-authored-by: JUN jun@lidgeai.com

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[Ingwannu]

Source review of exact head f093002f5caff80203e83f44250c621891101cab against 9b6f4b2632492b3df637dccc009d6a01ed47c85d (16 files). This is not approval or CI authorization.

The ordinary projection is selected by the exact canonical Codex /responses URL, after bridge restoration and existing repair, and excludes native/portable compaction. Same-input referenced hosted cells stay structural; the shared note renderer bounds only converted notes, not all request input. Top-level sources gain the same allowlist/bounds as action sources. The new fixtures explicitly exercise public-API exclusion, reference handling, memo hits/misses, raw-input immutability, ordering, Lite declarations, repeated turns, and native compact preservation. I also checked the changed existing expectations rather than treating them as unchanged regression evidence.

The important acceptance decision is behavioral: every ordinary canonical Codex request opts into lossy conversion, including valid native hosted history, not just a diagnosed invalid cell or an operator-enabled workaround. OpenAI's web-search guide documents structural web_search_call output, and its conversation-state guide describes replaying complete output. Those public API contracts do not independently prove what the private Codex backend accepts. The PR correctly avoids calling this schema rejection, but fixture success cannot establish the universal live compatibility/quality outcome. The project owner needs to explicitly accept this default loss policy before readiness; do not infer source provenance from a cache miss or ID prefix.

One factual docs correction is needed: docs-site/src/content/docs/zh-cn/reference/proxy-formats.md calls this a policy explicitly chosen by the user (用户明确选择). There is no user opt-in in this patch. Please describe it as the implementation's explicit/default lossy policy, or actually add an owner-approved opt-in design; do not imply a control that does not exist. Keep the rationale for universal projection versus an opt-in or narrower repair recorded in the appropriate existing decision documentation.

I have not run these new tests or live Codex conversations; the large test/typecheck/docs receipts in the description remain author evidence. Current-head Cross-platform 38115457766, Catalog 38115457751 and React Doctor 38115457777 are action_required. Latest target/hygiene checks pass, superseding earlier metadata failures, but they are not runtime CI. Please retain Draft and the stated coverage limits. No scan, workflow authorization, sponsorship, native/provider call or contributor-branch change.

[yuanyuanlove]

Follow-up to this review: corrected the Chinese reference wording in f9bcaef to “当前实现默认采用的有损历史策略”. It now describes the implementation default without implying an end-user opt-in. The commit changes only that sentence; runtime behavior and defaults are unchanged.

For this docs-only follow-up, Bun 1.4.0 bun install --frozen-lockfile passed, and bun run build passed with a workspace-local XDG config directory and telemetry disabled: 569 pages and 79,294 internal links checked. The first build attempt stopped at an unavailable global telemetry config directory. Working/staged git diff --check passed. After publication, I fetched the branch and verified the full tree, the single original-head parent, and the exact one-line delta. No runtime or live conversation tests were rerun for this wording-only change.

Explicit project-owner acceptance of the default lossy policy and an owner-confirmed decision record explaining universal projection versus an opt-in or narrower repair remain outstanding. The PR remains Draft, with the existing coverage limits. Exact-head target/hygiene checks pass, while Cross-platform CI (38120058888), Catalog async contracts (38120058867), and React Doctor (38120058819) are action_required. This correction provides no new evidence of live Codex acceptance, sustained recovery of the original conversation, or resolution of all 502s.

[yuanyuanlove]

Follow-up to this review: narrowed the ordinary history policy in 231b848bbf448a04dae747108768f28d1a5bee9b. Only exact canonical Codex /responses requests with explicit Responses Lite intent project remaining unreferenced hosted-search cells. Non-Lite and unknown requests retain structural hosted history.

The final HTTP Lite header's literal true/false is authoritative; otherwise exact true in valid string-map frame metadata is the fallback, matching existing WS preparation. This reads current protocol intent without changing headers, metadata or transport behavior. It also preserves the existing HTTP fallback semantics. Models, subscription authentication, missing hosted declarations and additional_tools alone do not select the policy. Bridge restoration still runs first, same-input references retain their exemption, and native compact, public API and portable/routed summary triggers are unchanged.

The rationale and alternatives are now recorded in ADR-6930, linked from the existing contract owner. Official Codex 0.161.0 omits hosted model-tool declarations for Lite but still replays hosted history. openai/codex#51962 supplies restored-history compaction and control observations, not proof that every ordinary Lite request fails. The protocol-specific narrowing therefore avoids the previous universal canonical policy without pretending to classify historical issuers. The record states the contributor's implementation rationale; explicit project-owner acceptance of the remaining default Lite loss policy is still outstanding.

Current follow-up validation: 54 passing fixture tests, 632 assertions, covering protocol precedence/conflicts, missing/malformed markers, mixed-case headers, configured headers, WS preparation and preserved boundaries. TypeScript, privacy, structure, file-size and diff checks passed; English/Chinese docs build passed with 569 pages and 79,294 internal links. Independent read-only source review found no blocking code inconsistency. I refetched the published branch and verified the full tree and sole original-head parent.

The updated description separates these results from the earlier superseded revision's broad test receipts. No full-suite, denied mock-network path or live HTTP/WS/backend acceptance test was rerun; no proxy/security settings were changed. All four exact-head metadata checks pass, while Cross-platform CI (38123897992), React Doctor (38123897991) and Catalog async contracts (38123898071) remain action_required. The PR remains Draft; this is not readiness, owner acceptance or evidence that all 502s are resolved.