fix(codex): sanitize raw responses input

[dhaern]

Summary

• Extend the Codex Responses sanitization added in fix(codex): sanitize Responses replay state #1868 to the raw request input path.
• Drop only assistant message items explicitly marked with a non-final phase before sending requests upstream.
• Keep final assistant history, assistant messages without phase, reasoning items, tool calls, tool outputs, streaming, transport, and fingerprint behavior unchanged.

Why

#1868 fixed the replay/cache edge by preventing locally remembered assistant commentary from being re-injected into future Codex Responses requests.

A separate edge remained: some clients can send the current /v1/responses request with raw input items shaped like:

{
  "role": "assistant",
  "phase": "commentary",
  "content": [{ "type": "output_text", "text": "...internal orchestration note..." }]
}

Those frames are local runtime state, not durable assistant conversation turns. Because they arrive in the current request body, they bypass the replay-only sanitizer from #1868 and can be forwarded upstream.

Scope

This PR keeps the filter deliberately narrow:

• Filter only Responses message items where:
  • role === "assistant"
  • phase is a string
  • normalized phase !== "final"
• Preserve:
  • assistant messages with no phase
  • assistant messages with phase: "final"
  • user/system/developer messages
  • function_call
  • function_call_output
  • formal type: "reasoning" items
  • request reasoning params
  • Codex transport, streaming, and CLI fingerprint behavior

The same helper is now used for remembered replay state and raw Codex Responses input so the two paths cannot drift again.

Validation

• node --import tsx/esm --test tests/unit/executor-codex.test.ts tests/unit/translator-openai-responses-req.test.ts tests/unit/responses-translation-fixes.test.ts tests/unit/codex-stream-false.test.ts tests/unit/t19-codex-responses-empty-content.test.ts
• npm run typecheck:core
• npx eslint open-sse/executors/codex.ts open-sse/services/responsesToolCallState.ts open-sse/services/responsesInputSanitizer.ts tests/unit/executor-codex.test.ts
• git diff --check

[gemini-code-assist]

Code Review

This pull request introduces a centralized responsesInputSanitizer service to filter out internal assistant commentary—specifically messages with a non-final phase—from conversation histories. The CodexExecutor and responsesToolCallState services have been refactored to utilize this shared logic, and new unit tests verify the sanitization behavior. The review feedback identifies an opportunity to optimize performance by making deep cloning optional within the sanitizer, preventing redundant cloning operations when the caller has already performed a deep clone of the request body.

[gemini-code-assist]

The sanitizeResponsesInputItems function performs a structuredClone on every item it processes. While this ensures isolation for the cache in responsesToolCallState.ts, it results in redundant deep cloning when called from CodexExecutor.transformRequest, where the entire body has already been deep-cloned at the start of the function (line 1165). For requests with large conversation histories, this double deep-cloning can introduce unnecessary latency. Consider adding an optional parameter to skip cloning when the caller already owns a unique copy of the data.

Suggested change

	export function sanitizeResponsesInputItems(items: readonly unknown[]): unknown[] {
	const sanitized: unknown[] = [];
	for (const item of items) {
	const record = toRecord(item);
	if (record && isInternalAssistantMessage(record)) {
	continue;
	}
	sanitized.push(structuredClone(item));
	}
	return sanitized;
	}
	export function sanitizeResponsesInputItems(items: readonly unknown[], clone = true): unknown[] {
	const sanitized: unknown[] = [];
	for (const item of items) {
	const record = toRecord(item);
	if (record && isInternalAssistantMessage(record)) {
	continue;
	}
	sanitized.push(clone ? structuredClone(item) : item);
	}
	return sanitized;
	}

[dhaern]

@gemini-code-assist fixed in eddc3d6. sanitizeResponsesInputItems now keeps cloning enabled by default for replay/cache callers, and CodexExecutor.transformRequest passes false because it already owns a deep-cloned request body. Revalidated the Codex/Responses focused suite (80/80), typecheck, eslint, and diff check.

[gemini-code-assist]

Thank you for the update and for confirming the validation steps. The implementation in eddc3d63 correctly addresses the performance concern by allowing callers to control the cloning behavior, which is appropriate for CodexExecutor.transformRequest.

[gemini-code-assist]

Since the body object was already deep-cloned at the beginning of transformRequest (line 1165), performing another deep clone of each item in body.input inside sanitizeResponsesInputItems is redundant. If you apply the suggested change to sanitizeResponsesInputItems to make cloning optional, you can call it here with false to improve performance.

Suggested change

	if (Array.isArray(body.input)) {
	body.input = sanitizeResponsesInputItems(body.input);
	}
	if (Array.isArray(body.input)) {
	body.input = sanitizeResponsesInputItems(body.input, false);
	}

[dhaern]

@gemini-code-assist fixed in eddc3d6. The Codex path now calls sanitizeResponsesInputItems(body.input, false) to avoid a second deep clone after transformRequest has already cloned the whole request body.

[gemini-code-assist]

Thank you for the update, @dhaern. That change correctly addresses the redundancy while maintaining the necessary sanitization logic.

[diegosouzapw]

Thanks @dhaern for this excellent contribution! 🎉 The shared responsesInputSanitizer extraction is a clean DRY refactor, and the test coverage is thorough. Merged into release/v3.7.9 — it will be part of the next release. Great work!