fix(runtime): bound overflow parsing and batch replay scrubs by luvs01 · Pull Request #725 · luvs01/opencodex

luvs01 · 2026-10-12T07:29:48Z

Summary

Repeated context-limit prefixes could make overflow normalization rescan a large message, while rejecting many native reasoning blobs repeatedly walked and parsed the same history.

Examine at most 64 Ki characters of an overflow message and find the context limit and subsequent request count in separate forward scans.
Collect rejected native reasoning blobs into one set, then scrub raw and parsed history in one pass. Preserve visible reasoning and valid replay until the route or credential identity changes.
Cover repeated prefixes, bounded native SSE errors, many distinct blobs, route rebinding, and bounded signature reads. Update the runtime and Responses contracts.

Verification

Current head: 33b3c99e015d747a5d77e4e4bd88cc186a8b692b.

Current-head cross-platform CI and its aggregate ci check passed.
The current-head target-branch gate passed. No unresolved review threads or requested changes remain.
Implementation-stage focused validation ran tests/claude-integration/claude-native-reasoning-provenance.test.ts and tests/claude-integration/claude-prompt-too-long.test.ts: 31 passed, 0 failed. Typecheck, privacy scan, structure check, and git diff --check also passed during implementation. These local results are historical; the CI links above are tied to the current head.
A full local repository suite was not repeated across the concurrent candidate worktrees. Focused regressions cover the changed paths; current-head hosted CI supplies broader validation.
The upstream comparison at 6da2774369aa32552e318e333902499683d053bc found one release-version commit beyond the shared base, with no file overlap.

Checklist

Scope stays focused and avoids unrelated cleanup.
Runtime and Responses contract documentation is updated.
Focused validation and current-head CI evidence are documented.
Existing review findings are addressed and resolved.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Summary by CodeRabbit

Bug Fixes
- Oversized Claude prompt-limit errors are now bounded and reported more consistently, including during streaming.
- Reasoning details are better protected when switching routes or credentials: only details matching the active route are retained, while visible reasoning text remains available.
Documentation
- Updated Runtime and Responses guides with information about prompt-limit handling and reasoning behavior across routes.

Preserve bounded runtime ownership and failure behavior, with focused regression coverage and the owning architecture contract. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

coderabbitai · 2026-10-12T07:29:57Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: ad153e1e-f2ae-4d1b-8964-730e2f96e4cc

📥 Commits

Reviewing files that changed from the base of the PR and between f0b60f4 and 33b3c99.

📒 Files selected for processing (1)

structure/transports/responses.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The change bounds Claude overflow-message processing and extracts token counts in order. It also batches removal of rejected native reasoning blobs during route binding and adds integration coverage for both behaviors.

Changes: Claude overflow-message normalization

Layer / File(s)	Summary
Bound and test overflow normalization `src/claude/outbound.ts`, `structure/runtime.md`, `tests/claude-integration/claude-prompt-too-long.test.ts`	The normalizer truncates input to 64 KiB and extracts the context limit before searching for a requested-token count. Tests cover truncation, count ordering, and the managed native SSE response. The runtime overview documents the normalization contract.

Native reasoning replay provenance

Layer / File(s)	Summary
Collect and scrub rejected reasoning blobs `src/server/responses/core-replay.ts`, `structure/transports/responses.md`, `tests/claude-integration/claude-native-reasoning-provenance.test.ts`	Route binding collects blobs with mismatched tags and strips matching encrypted content and IDs from raw reasoning inputs and serialized assistant signatures. Tests cover replay tracking, signature reads, route changes, and preservation of visible reasoning text.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: lidge-jun

Merge Risk: ⚪ Minimal · up to 33b3c

The reviewed changes bound overflow-message processing and scrub rejected reasoning data during route binding. The inspected paths reveal no concrete introduced failure that blocks merging.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 4 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately summarizes the two primary changes: bounded overflow parsing in src/claude/outbound.ts and batched replay scrubs in src/server/responses/core-replay.ts.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 4 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-12T07:48:13Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-12T07:52:01.473142Z	`f0b60f4`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

devin-ai-integration · 2026-10-12T08:07:04Z

Review-triage sweep at head f0b60f4: no unresolved threads or findings from any bot.

Devin Review: reported no issues.
Codex connector: security review completed; no findings posted.
CodeRabbit: did not run (repo below the auto-review star threshold; its comment is a manual trigger prompt, not a finding).

Fixed: none required. Dismissed: none. No code changes pushed.

devin-ai-integration · 2026-10-12T08:07:17Z

Done — PR #725 (fix(runtime): bound overflow parsing and batch replay scrubs) has zero unresolved review threads or findings.

Checked everything, not just this pass:

GraphQL reviewThreads: 0 total
REST inline review comments: 0
Devin Review: "No Issues Found" (the review that triggered this run)
Codex connector: security review completed at head f0b60f4, no findings posted
CodeRabbit: never ran — repo is below its auto-review star threshold; its only comment is a manual trigger prompt, not a finding

Nothing to fix or dismiss, so no code changes and no checkout needed. Posted a summary comment on the PR documenting the sweep: #725 (comment)

luvs01 · 2026-10-12T08:42:18Z

@coderabbitai review

coderabbitai · 2026-10-12T08:42:26Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

# Conflicts: # structure/transports/responses.md

github-actions · 2026-10-13T00:50:10Z

✅ Deterministic PR hygiene checks passed.

luvs01 · 2026-10-13T03:20:58Z

@coderabbitai review

coderabbitai · 2026-10-13T03:21:06Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

luvs01 · 2026-10-13T08:16:42Z

Closing duplicate tracking after verified preservation of source HEAD 33b3c99e015d747a5d77e4e4bd88cc186a8b692b in integration commit ec5cd638d74516891b02870d6a2c7a6e677b393d. All six changed runtime, documentation and regression files were compared byte for byte and are retained unchanged. This is a change-inclusion check, not a merge claim. The source branch is retained.

fix(runtime): bound overflow parsing and batch reasoning replay scrubs

f0b60f4

Preserve bounded runtime ownership and failure behavior, with focused regression coverage and the owning architecture contract. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

luvs01 marked this pull request as ready for review October 12, 2026 07:48

devin-ai-integration Bot reviewed Oct 12, 2026

View reviewed changes

luvs01 mentioned this pull request Oct 12, 2026

security: harden filesystem, routing, and request resource boundaries #719

Closed

3 tasks done

luvs01 added 2 commits October 12, 2026 23:09

Merge fork dev dc45bb2 into PR #725

a2c7c6b

Merge remote-tracking branch 'fork/dev' into merge725-dev-20261013

33b3c99

# Conflicts: # structure/transports/responses.md

github-actions Bot added the bug Something isn't working label Oct 13, 2026

luvs01 closed this Oct 13, 2026

Navigation Menu

Repository navigation

fix(runtime): bound overflow parsing and batch replay scrubs - #725

fix(runtime): bound overflow parsing and batch replay scrubs#725
luvs01 wants to merge 3 commits into
devfrom
codex/split719-bounded-replay-20261012

luvs01 commented Oct 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot commented Oct 12, 2026

Uh oh!

devin-ai-integration Bot commented Oct 12, 2026

Uh oh!

luvs01 commented Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

luvs01 commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

luvs01 commented Oct 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

luvs01 commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

devin-ai-integration Bot commented Oct 12, 2026

Uh oh!

devin-ai-integration Bot commented Oct 12, 2026

Uh oh!

luvs01 commented Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

luvs01 commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luvs01 commented Oct 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

luvs01 commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading