fix(devin): carry reasoning signatures across turns - #6116

Summary

On Devin, reasoning from one turn did not carry into the next for GPT and Gemini models. Every tool call in a Codex tool loop made them re-derive their reasoning from scratch. SWE-2 was affected differently: its reasoning signature was never replayed.

Cause. Cognition returns a turn's reasoning attestation as delta_signature (#10), with its delta_signature_type (#21) in the same frame. The native client replays both on the assistant prompt as #12 and #18. Two things broke that here:

• The signature arrives after the answer. Live on swe-2-high the order is reasoning → visible text → signature frame, and the type is sealed. By then the Responses layer has closed the reasoning item, so the signature becomes a separate signature-only reasoning item. On the next turn, the Devin replay mapping kept only thinking blocks with text, so the signature was discarded.
• GPT and Gemini have no thinking text. They stream only the signature (types openai and gemini), so their reasoning was dropped entirely and nothing was replayed.
• [codex] add native Umans provider #21 was never decoded, so Streaming text duplicates and code-edit turns can stall before fileChange events under opencodex #18 was never sent.

Change (src/adapters/devin/reasoning-signature.ts, plus small edits in devin.ts and cloud-direct/chat.ts):

• [codex] add native Umans provider #21 is decoded with [codex] fix passthrough stream idle disconnects #10. The type travels inside the stored signature, because the reasoning envelope that round-trips through the client holds a single signature string. A signature stored before this change replays without a type.
• When a signature is replayed: only when it covers exactly the replayed thinking text.
  • A single signed thinking block keeps its own signature, and a stray signature-only block doesn't replace it.
  • One unsigned thinking block plus exactly one signature-only block (the late-frame split) replays as one signed prompt: Bug: 注入 opencodex 后 Codex App 左侧 Project 线程列表消失 #11 text, Add configurable context window caps #12 signature, Streaming text duplicates and code-edit turns can stall before fileChange events under opencodex #18 type.
  • A turn with a signature and no text (GPT, Gemini) is replayed instead of dropped.
• Unchanged: two signed blocks, or a signed block next to unsigned text, still replay unsigned.
• Claude signatures are replayed, and a refused Claude turn is retried once without them. Cognition streams Claude's thinking as a summary, and the signature covers the original, so a signed replay is sometimes refused with invalid_argument. dev already fails this way intermittently: 3 of 6 turn-2 failures on a visible-thinking tool loop, because it pairs a single signed block. Withholding the signature avoids the refusal but also stops Claude recalling its earlier reasoning (0/10 below). So the adapter sends it, and when Cognition refuses before any visible output (text or tool call), it retries once with Anthropic signatures withheld and the thinking text kept. Live, the refusal usually arrives after the model has streamed reasoning, its signature and a finish frame, so reasoning alone doesn't block the retry, Other signature types, and refusals after visible output, are not retried. While a fallback is possible, the signed attempt's events are held until its first visible output or a clean finish, so a refused attempt's reasoning and signature never reach the client, and its signature is never replayed next turn. A signature stored before its type was recorded falls back to the model name (claude-*).
• Not changed: the assistant message id. Replaying Cognition's own message id (docs: record OpenCode Go official contract retry #1) showed no measurable effect.

Verification

The test (reasoning-continuation benchmark). A three-turn tool loop through the real proxy, Codex style: stateless input replay with include: ["reasoning.encrypted_content"], both builds running side by side on the same account (dev 24b2f39b7 against this branch).

1. The model picks a random 6-digit number and stores it with store_secret(secret).
2. The transcript redacts it: the replayed call shows {"secret":"[REDACTED]"}, and the tool answers "Stored. The value is redacted from this transcript by design." The history stays coherent, and the number survives only in the model's own reasoning.
3. The model calls get_time, then must reply NUMBER=<the number>.

A match means turn 1's reasoning reached turn 3. The stripped column is a control: the same loop with the reasoning items removed from the replay, which measures what guessing gets. Each run is also classified (mismatch, refused, re-stored a different number, error). Results are recorded in SQLite.

• Across all runs: 39 matches on this PR against 30 on dev; the control got 3 of 34.
• Grok: inconclusive. It repeats the same two numbers, which is why the control scores 2/5, so its matches are near chance on both builds.
• GLM and Kimi: they issue no signature, so this PR changes nothing for them, and the differences are noise.
• Why not 100%: the misses on this PR are mostly honest refusals ("I can't see the number I stored"). The model decides whether to use the reasoning it gets back.

Claude stress case (the visible-thinking tool loop that already fails on dev), through the proxy:

Tests

• New tests/providers/devin-reasoning-continuation.test.ts (6 tests) and tests/providers/devin-anthropic-signature-fallback.test.ts (4 adapter-level tests driving runTurn against a fake Cognition stream: a refused signed Claude turn is retried once without the signature; a refusal after reasoning alone is still retried; an accepted turn is sent once; no retry for other signature types or after visible output). Both are registered in the layout files. It covers:
  • [codex] add native Umans provider #21 decoded with [codex] fix passthrough stream idle disconnects #10;
  • the stored-type round trip, and older stored signatures without a type;
  • the SWE-2 split shape through the real Responses parser, down to Bug: 注入 opencodex 后 Codex App 左侧 Project 线程列表消失 #11/Add configurable context window caps #12/Streaming text duplicates and code-edit turns can stall before fileChange events under opencodex #18 on the wire;
  • a signature-only turn replayed;
  • two late signatures left unsigned.
• Three of the tests fail without the source change.
• The existing replay rules in devin-hardening.test.ts are unchanged and pass.
• bun test ./tests/providers/devin-*.test.ts ./tests/test-layout.test.ts ./tests/test-layout-tooling.test.ts: 301 pass, 0 fail.
• bun run typecheck, bun run structure:check, bun run privacy:scan and the file-size ratchet pass.
• Full suite, at c483502fb, compared with untouched dev (24b2f39b7, 40 pre-existing failures): 8 failures are not in the baseline (cli-connect-readiness, cli-help ×4, cli-config-command ×2, and the test-layout guard). All of them pass when rerun alone (19/0, 17/0, 6/0, 2/0), so there are no regressions against dev. The run shared the machine with the live probes. An earlier bun run test:changed hit its 900 s limit under load and isn't counted.
• bun test ./tests/providers/devin-*.test.ts plus the layout guards and file-size ratchet on the final head (bfc56f516): all pass. The retry test fails with the retry removed.

Overlap: #6091 and #6092 also edit src/adapters/devin.ts and src/adapters/devin/cloud-direct/chat.ts. #6092 adds is_error to mapOneMessage's tool-result branch, and an output counter in the stream loop, right next to this change. It also edits the same Devin row in structure/providers-and-adapters.md. Whichever lands later needs a real rebase of mapOneMessage, the stream loop and the frame decoding, not just the doc line. I'll do it and re-run the Devin suites.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved Devin conversation continuity by preserving assistant reasoning and associated signatures when continuing a conversation, including signature-only turns.
  • Reasoning split across multiple blocks is replayed together, and signature details are retained when available while older stored signatures remain supported.
  • If Devin rejects a replay containing an Anthropic signature before producing text or tool-call output, the request is retried once without that signature. Other signatures are preserved.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.