Key reasoning-signature replay on the issuing provider

signatureForModel compared only turn.model against the current
request's model, but provider is a fixed adapter tag while model is
arbitrary catalog/user-supplied text — two distinct backends can
declare the same literal model name (proxy aliases, two
OpenAI-compatible endpoints both configured as gpt-4o), and the
equality check would treat a foreign signature as safe to replay,
reproducing the original decrypt-failure bug.

ConversationTurn carries no field recording which provider produced
it, so provenance now rides inside the signature string itself:
capture tags it provider:ciphertext, and replay only unwraps the
ciphertext when both the tagged provider and the model match. Keying
on provider rather than the per-account source id means a live
account switch on the same backend (two ChatGPT accounts through the
same Codex service) still preserves reasoning continuity, since the
decrypting backend is shared across accounts.

Author: TheGreatAxios

src/provider/codex-responses-adapter.ts

@@ -57,15 +57,44 @@ type ResponsesInputItem =
   | { type: "reasoning"; summary: never[]; encrypted_content: string };
 
 // A thinking block's `signature` is opaque ciphertext a specific backend
-// issued for a specific model; only that backend can decrypt it. `turn.model`
-// records which model produced the turn, so comparing it against the model
-// this request is being built for is enough provenance to tell whether a
-// signature is safe to replay — no separate provenance field is needed.
-// Switching models means turns from the old model simply stop qualifying, so
-// a poisoned history self-heals on the very next request instead of being
-// replayed forever.
-export function signatureForModel(turn: ConversationTurn, requestModel: string, signature: string): string | undefined {
-  return turn.model === requestModel ? signature : undefined;
+// issued for a specific model; only that backend can decrypt it. `model` is
+// arbitrary catalog/user-supplied text — nothing stops two distinct backends
+// (proxy aliases, two OpenAI-compatible endpoints) from declaring the same
+// literal model name, so comparing `turn.model` alone treats a foreign
+// signature as safe to replay. `ConversationTurn` carries no field for which
+// provider produced it, so provenance rides inside the signature string
+// itself: capture tags it `<provider>:<ciphertext>` (see `tagSignature`),
+// and replay only unwraps the ciphertext when both the tagged provider and
+// the model match the current request.
+//
+// Provider, not the per-account source id, is the unit of decrypt
+// capability — a Codex backend shared across ChatGPT accounts can decrypt a
+// signature issued to any of them, so keying on provider (rather than source
+// id) is what lets an account switch keep reasoning continuity while a
+// genuine cross-provider collision still gets dropped. A poisoned history
+// self-heals on the next request instead of being replayed forever.
+const SIGNATURE_TAG_SEPARATOR = ":";
+
+export function tagSignature(provider: string, encryptedContent: string): string {
+  return `${provider}${SIGNATURE_TAG_SEPARATOR}${encryptedContent}`;
+}
+
+function untagSignature(tagged: string): { provider: string; encryptedContent: string } | undefined {
+  const idx = tagged.indexOf(SIGNATURE_TAG_SEPARATOR);
+  if (idx === -1) return undefined;
+  return { provider: tagged.slice(0, idx), encryptedContent: tagged.slice(idx + 1) };
+}
+
+export function signatureForModel(
+  turn: ConversationTurn,
+  requestModel: string,
+  requestProvider: string,
+  signature: string,
+): string | undefined {
+  if (turn.model !== requestModel) return undefined;
+  const tagged = untagSignature(signature);
+  if (tagged === undefined) return undefined;
+  return tagged.provider === requestProvider ? tagged.encryptedContent : undefined;
 }
 
 // Map one internal turn to zero or more Responses items. Assistant text uses
@@ -76,7 +105,7 @@ export function signatureForModel(turn: ConversationTurn, requestModel: string,
 // (held in a thinking block's signature) AND that backend is the one this
 // request is going to — replaying it to a different provider gets a 400 it
 // cannot recover from.
-function toResponsesItems(turn: ConversationTurn, requestModel: string): ResponsesInputItem[] {
+function toResponsesItems(turn: ConversationTurn, requestModel: string, requestProvider: string): ResponsesInputItem[] {
   const items: ResponsesInputItem[] = [];
   const textKind: "input_text" | "output_text" = turn.role === "assistant" ? "output_text" : "input_text";
   const textParts: ResponsesContentPart[] = [];
@@ -112,7 +141,7 @@ function toResponsesItems(turn: ConversationTurn, requestModel: string): Respons
       items.push({ type: "function_call_output", call_id: block.callId, output: toolResultText(block) });
     } else if (block.type === "thinking" && typeof block.signature === "string" && block.signature.length > 0) {
       flushText();
-      const encryptedContent = signatureForModel(turn, requestModel, block.signature);
+      const encryptedContent = signatureForModel(turn, requestModel, requestProvider, block.signature);
       if (encryptedContent !== undefined) {
         items.push({ type: "reasoning", summary: [], encrypted_content: encryptedContent });
       }
@@ -169,8 +198,9 @@ function buildRequest(
   messages: ConversationTurn[],
   model: string,
   options: InferenceOptions,
+  requestProvider: string,
 ): BuiltRequest {
-  const conversation = messages.flatMap((turn) => toResponsesItems(turn, model));
+  const conversation = messages.flatMap((turn) => toResponsesItems(turn, model, requestProvider));
   // Corbits Code's prompt cannot live in `instructions` (the backend pins that to
   // the official Codex prompt), so it leads the input as a developer message.
   const input =
@@ -377,7 +407,7 @@ export function parseResponse(
         events.push({
           type: "inference.thinking.signature",
           seq,
-          data: { signature: item["encrypted_content"], index },
+          data: { signature: tagSignature(source.provider, item["encrypted_content"] as string), index },
         });
       }
       return events;
@@ -457,7 +487,7 @@ export function createCodexResponsesAdapter(source: LastCycleSource): ProviderAd
     items: new Map<string, { index: number; kind: CodexBlockKind }>(),
   };
   return {
-    buildRequest,
+    buildRequest: (messages, model, options) => buildRequest(messages, model, options, source.provider),
     parseResponse: (sseData) => parseResponse(sseData, indexer, source),
     isStreamTerminal: isResponsesStreamTerminal,
   };

src/provider/grok-responses-adapter.ts

@@ -52,7 +52,7 @@ function toolResultText(block: Extract<ContentBlock, { type: "tool_result" }>):
 // Map one internal turn to Responses items. Text-only messages keep the string
 // shape grok sends; messages with image blocks switch to Responses content parts
 // so the model receives the actual pixels instead of only a text placeholder.
-function toResponsesItems(turn: ConversationTurn, requestModel: string): ResponsesInputItem[] {
+function toResponsesItems(turn: ConversationTurn, requestModel: string, requestProvider: string): ResponsesInputItem[] {
   const items: ResponsesInputItem[] = [];
   const role = turn.role;
   const parts: ResponsesInputContentPart[] = [];
@@ -95,7 +95,7 @@ function toResponsesItems(turn: ConversationTurn, requestModel: string): Respons
       items.push({ type: "function_call_output", call_id: block.callId, output: toolResultText(block) });
     } else if (block.type === "thinking" && typeof block.signature === "string" && block.signature.length > 0) {
       flushMessage();
-      const encryptedContent = signatureForModel(turn, requestModel, block.signature);
+      const encryptedContent = signatureForModel(turn, requestModel, requestProvider, block.signature);
       if (encryptedContent !== undefined) {
         items.push({ type: "reasoning", summary: [], encrypted_content: encryptedContent });
       }
@@ -137,8 +137,9 @@ function buildRequest(
   messages: ConversationTurn[],
   model: string,
   options: InferenceOptions,
+  requestProvider: string,
 ): BuiltRequest {
-  const conversation = dedupeToolOutputs(messages.flatMap((turn) => toResponsesItems(turn, model)));
+  const conversation = dedupeToolOutputs(messages.flatMap((turn) => toResponsesItems(turn, model, requestProvider)));
   const systemMessage: ResponsesInputItem | undefined =
     options.systemPrompt !== undefined
       ? { type: "message", role: "system", content: options.systemPrompt }
@@ -177,7 +178,7 @@ function buildRequest(
 export function createGrokResponsesAdapter(source: LastCycleSource): ProviderAdapter {
   const indexer = createResponsesBlockIndexer();
   return {
-    buildRequest,
+    buildRequest: (messages, model, options) => buildRequest(messages, model, options, source.provider),
     parseResponse: (sseData) => parseResponse(sseData, indexer, source, GROK_RESPONSES_PROVIDER),
   };
 }

src/provider/openai-responses-adapter.ts

@@ -42,7 +42,7 @@ function toolResultText(block: Extract<ContentBlock, { type: "tool_result" }>):
   return parts.join("");
 }
 
-function toResponsesItems(turn: ConversationTurn, requestModel: string): ResponsesInputItem[] {
+function toResponsesItems(turn: ConversationTurn, requestModel: string, requestProvider: string): ResponsesInputItem[] {
   const items: ResponsesInputItem[] = [];
   const role = turn.role;
   const parts: ResponsesInputContentPart[] = [];
@@ -91,7 +91,7 @@ function toResponsesItems(turn: ConversationTurn, requestModel: string): Respons
       items.push({ type: "function_call_output", call_id: block.callId, output: toolResultText(block) });
     } else if (block.type === "thinking" && typeof block.signature === "string" && block.signature.length > 0) {
       flushMessage();
-      const encryptedContent = signatureForModel(turn, requestModel, block.signature);
+      const encryptedContent = signatureForModel(turn, requestModel, requestProvider, block.signature);
       if (encryptedContent !== undefined) {
         items.push({ type: "reasoning", summary: [], encrypted_content: encryptedContent });
       }
@@ -128,8 +128,9 @@ function buildRequest(
   messages: ConversationTurn[],
   model: string,
   options: InferenceOptions,
+  requestProvider: string,
 ): BuiltRequest {
-  const conversation = dedupeToolOutputs(messages.flatMap((turn) => toResponsesItems(turn, model)));
+  const conversation = dedupeToolOutputs(messages.flatMap((turn) => toResponsesItems(turn, model, requestProvider)));
   const systemMessage: ResponsesInputItem | undefined =
     options.systemPrompt !== undefined
       ? { type: "message", role: "system", content: options.systemPrompt }
@@ -166,7 +167,7 @@ function buildRequest(
 export function createOpenAIResponsesAdapter(source: LastCycleSource): ProviderAdapter {
   const indexer = createResponsesBlockIndexer();
   return {
-    buildRequest,
+    buildRequest: (messages, model, options) => buildRequest(messages, model, options, source.provider),
     parseResponse: (sseData) => parseResponse(sseData, indexer, source, OPENAI_RESPONSES_PROVIDER),
     isStreamTerminal: isResponsesStreamTerminal,
   };

tests/unit/codex-responses-adapter.test.ts

@@ -2,6 +2,7 @@ import { test, expect, describe } from "bun:test";
 import {
   createCodexResponsesAdapter,
   tagSignature,
+  signatureForModel,
   CODEX_ACCOUNT_ID_OPTION,
   CODEX_SESSION_ID_OPTION,
   CODEX_RESPONSES_PROVIDER,
@@ -220,6 +221,43 @@ describe("codex-responses buildRequest", () => {
     }
   });
 
+  test("drops a bare, untagged legacy signature instead of misparsing it as ciphertext", () => {
+    // Signatures captured before this change carry no "<provider>:" prefix.
+    // untagSignature must recognize the absence of a separator and refuse to
+    // treat any part of the raw string as ciphertext, rather than replaying
+    // a truncated or garbled blob the backend cannot decrypt.
+    const turns: ConversationTurn[] = [
+      userTurn("solve the hard problem"),
+      {
+        role: "assistant",
+        model: "gpt-5-codex",
+        timestamp: 0,
+        content: [
+          { type: "thinking", thinking: "internal steps...", signature: "QUJDREVGRzEyMzQ1Njc4OTAtXy8rPQ==" },
+          { type: "text", text: "The answer is 42." },
+        ],
+      },
+    ];
+    const body = JSON.parse(adapter().buildRequest(turns, "gpt-5-codex", baseOptions).body) as Record<string, unknown>;
+    const input = body["input"] as Array<Record<string, unknown>>;
+    expect(input.some((item) => item["type"] === "reasoning")).toBe(false);
+  });
+
+  test("signatureForModel returns undefined for an untagged signature", () => {
+    const turn: ConversationTurn = { role: "assistant", model: "gpt-5-codex", timestamp: 0, content: [] };
+    expect(signatureForModel(turn, "gpt-5-codex", CODEX_RESPONSES_PROVIDER, "QUJDREVGRzEyMzQ1Njc4OTAtXy8rPQ==")).toBeUndefined();
+  });
+
+  test("tagSignature/signatureForModel round-trips ciphertext containing embedded colons byte-exact", () => {
+    // untagSignature splits on the FIRST colon (indexOf, not split(":")),
+    // so ciphertext that itself contains colons must survive intact. A
+    // naive split(":")[1] would truncate this to "part2".
+    const ciphertext = "part1:part2:part3==";
+    const turn: ConversationTurn = { role: "assistant", model: "gpt-5-codex", timestamp: 0, content: [] };
+    const tagged = tagSignature(CODEX_RESPONSES_PROVIDER, ciphertext);
+    expect(signatureForModel(turn, "gpt-5-codex", CODEX_RESPONSES_PROVIDER, tagged)).toBe(ciphertext);
+  });
+
   test("omits the account-id header when no account id is supplied", () => {
     const req = adapter().buildRequest([userTurn("x")], "gpt-5-codex", { providerOptions: { [CODEX_SESSION_ID_OPTION]: "s" } });
     expect(req.headers["chatgpt-account-id"]).toBeUndefined();
@@ -285,7 +323,10 @@ describe("codex-responses parseResponse", () => {
       { type: "response.output_item.done", item: { type: "reasoning", id: "rs_1", encrypted_content: "ENC_BLOB" } },
     ]);
     expect(out[0]).toMatchObject({ type: "inference.thinking.delta", data: { index: 0 } });
-    expect(out[1]).toMatchObject({ type: "inference.thinking.signature", data: { signature: "ENC_BLOB", index: 0 } });
+    expect(out[1]).toMatchObject({
+      type: "inference.thinking.signature",
+      data: { signature: tagSignature(CODEX_RESPONSES_PROVIDER, "ENC_BLOB"), index: 0 },
+    });
   });
 
   test("emits empty thinking delta + signature when done provides encrypted_content with no prior delta (pure-encrypted reasoning)", () => {
@@ -297,7 +338,10 @@ describe("codex-responses parseResponse", () => {
     ]);
     expect(out).toHaveLength(2);
     expect(out[0]).toMatchObject({ type: "inference.thinking.delta", data: { token: "", index: 0 } });
-    expect(out[1]).toMatchObject({ type: "inference.thinking.signature", data: { signature: "ENC", index: 0 } });
+    expect(out[1]).toMatchObject({
+      type: "inference.thinking.signature",
+      data: { signature: tagSignature(CODEX_RESPONSES_PROVIDER, "ENC"), index: 0 },
+    });
   });
 
   test("keys blocks by item_id so interleaved reasoning and tool calls keep distinct indices", () => {

tests/unit/codex-sse-fixtures.test.ts

@@ -10,6 +10,7 @@ import { join } from "node:path";
 import {
   createCodexResponsesAdapter,
   isResponsesStreamTerminal,
+  tagSignature,
 } from "../../src/provider/codex-responses-adapter.js";
 import type { InferenceEvent, LastCycleSource } from "@intx/types/runtime";
 import { ProtocolMismatchError } from "@intx/inference";
@@ -95,7 +96,7 @@ describe("codex-sse fixtures (golden parse)", () => {
     });
     expect(out[3]).toMatchObject({
       type: "inference.thinking.signature",
-      data: { signature: "ENC_FIXTURE_BLOB_NOT_REAL", index: 0 },
+      data: { signature: tagSignature(SOURCE.provider, "ENC_FIXTURE_BLOB_NOT_REAL"), index: 0 },
     });
     expect(out[4]).toMatchObject({
       type: "inference.text.delta",