fix(responses): consolidate native control bounds, authorization and Lite catalogs

[lidge-jun]

Summary

• Consolidate fix(responses): combine native steering route restriction with memory and body limits #5479, fix(responses): enforce native injection tool authorization #5470 and fix(subagents): recognize Responses Lite plaintext V2 catalogs #5492, all by @luvs01, in three ordered commits on current dev. Coverage is complete for the source changes in those three PRs; runtime and cross-platform verification remain pending. Original PR closure is reserved for the coordinator after verified dev inclusion.
• Restrict single-agent native steering to the canonical subscription route, enforce configured body limits and bounded shared replay memory, and retain corrected continuation retries after known pre-send refusals. Preserve existing negative route regressions and document injection memory limits.
• Apply the request-local tool catalog to native injection events before relay, preserving structured rejection codes and declared rich-result continuations. Recognize the first developer Responses Lite catalog only when top-level tools is absent, with existing plaintext opt-in, destination, conflict and restoration boundaries preserved.

Original	Source head	Carry
#5479 by @luvs01	a750e95d37a1e2103f4f4ae71207be87f12313c6	Complete combined route/body/memory patch, including its latest paced-continuation fix; incorporated earlier source patches are not applied twice.
#5470 by @luvs01	b24bfeddfc885a4ef96342a2f08d7bf71d792a1b	Complete authorization and error-identity patch, reconciled with the same native-control owners.
#5492 by @luvs01	2095ba1c0689d359c969b1eb6696e77a6301b25e	Complete Lite catalog patch; Chinese wording clarified.

Verification

• Local checks: NOT RUN by explicit instruction, including tests, typecheck, builds, installation and runtime execution. Commit/push hooks are bypassed to honor that restriction.
• Static inspection: git diff --check, combined interface/constructor/call-site review, contributor provenance, native-stack API, changed-file intersection with feat(desktop): native macOS usage panel and release regression fixes #5490, and tracked file-size baseline comparison. No cap raised; no test layout or CI policy changes are introduced by this bundle.
• Bounded independent source reviews found no demonstrated blocker in the carried patches. Source assessment is separate from runtime verification and maintainer approval.
• Existing source-head CI: #5479 run (attempt 2), #5470 run (attempt 1), #5492 run (attempt 1). Each is a completed successful pull_request run at the source SHA above, but Windows and macOS control jobs were skipped; fix(responses): enforce native injection tool authorization #5470 docs were also skipped. These are not bundle or complete all-platform proof.
• New exact-head hosted CI is required before integration. No merge, original-PR closure, release or deployment is performed by this lane.

Security review

Explicit maintainer security review is required before merge. The technical source review does not replace that decision.

Permissions

Review request-local tool authorization through native continuation/replay, route eligibility, terminal delivery, and the opt-in plaintext catalog boundary. Both native size checks and authorization hooks survive the union. No workflow permissions or release automation are changed by the lane.

Secrets

No credentials or destination configuration are added. Review retained-body lifetime and error projection; security working notes remain outside tracked files.

Publication order

The bundle includes the current dev integration of #5490. Merge only after the final bundle head has the required hosted evidence and security review. Close superseded originals only after proving their behavior is present on dev; release promotion remains separate.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: luvs01 27862058+luvs01@users.noreply.github.com
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Summary by CodeRabbit

• New Features

  • Plaintext V2 agent messages now recognize collaboration tools supplied in the first developer input item.
  • Native injection validates declared tools and preserves connections after oversized outbound frames are refused.
  • Native control replay memory is tracked with per-journal and aggregate limits.

• Bug Fixes

  • Oversized inbound and reconstructed outbound frames now receive structured errors before processing.
  • Failed continuations roll back cleanly, allowing corrected submissions.

• Documentation

  • Updated guidance for route eligibility, tool catalogs, body-size limits, and replay-memory limits.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8851e9ba-4877-42d2-98be-121a50d6fe3f

📥 Commits

Reviewing files that changed from the base of the PR and between 74490ee and 887b9a3.

📒 Files selected for processing (27)

• docs-site/src/content/docs/guides/codex-integration.md
• docs-site/src/content/docs/reference/configuration/agents.md
• docs-site/src/content/docs/reference/configuration/server.md
• docs-site/src/content/docs/zh-cn/reference/configuration/agents.md
• src/lib/app-owned-memory-stores.ts
• src/lib/app-owned-memory.ts
• src/responses/plaintext-v2-agent-messages.ts
• src/server/index/websocket-handler.ts
• src/server/responses/codex-ws-exchange.ts
• src/server/responses/native-injection-replay.ts
• src/server/responses/native-injection.ts
• src/server/responses/native-response-control.ts
• src/server/responses/native-steering-replay.ts
• src/server/responses/native-steering.ts
• src/server/responses/passthrough-dispatch.ts
• src/server/responses/ws-upstream.ts
• src/server/ws-bridge.ts
• structure/subagents.md
• structure/transports/streaming-health.md
• tests/codex-integration/app-owned-memory.test.ts
• tests/responses/plaintext-v2-agent-messages.test.ts
• tests/responses/ws-native-injection.test.ts
• tests/responses/ws-native-result-continuations.test.ts
• tests/responses/ws-native-steering.test.ts
• tests/responses/ws-steering-completion.test.ts
• tests/server/memory-watchdog.test.ts
• tests/server/plaintext-v2-agent-messages-server.test.ts

 _______________________________________
< Nullus Bugus Maximus. No bug too big. >
 ---------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 68 / 80

이 PR은 @luvs01이 만든 세 개 PR(#5479, #5470, #5492)을 현재 dev 위에 순서대로 한데 묶은 묶음입니다. 하는 일은 크게 세 가지입니다. 첫째, 단일 에이전트 네이티브 조향(steering)을 ChatGPT 구독 정본 경로만 쓰게 막고, 조향·주입 재생 일지(replay journal)에 32MiB/연결·합산 128MiB·앱 소유 메모리 예산 한도를 겁니다. 둘째, 네이티브 주입(injection)이 요청에 선언되지 않은 도구를 중계하기 전에 거절하고, 거절 코드를 SSE 경로와 같게 남기며, 본문 한도 거절처럼 “보내기 전 알려진 거절”이면 채널을 살린 채 다시 시도할 수 있게 롤백합니다. 셋째, Responses Lite처럼 맨 위 tools가 없을 때만 첫 developer additional_tools 목록을 평문 V2 카탈로그로 인정합니다. 문서·중국어 문장·구조 문서도 같이 맞춰 두었고, 관련 단위/서버 경계 테스트가 많이 늘어났습니다. 다만 PR 본문 그대로 이 묶음 헤드에서는 테스트·타입체크·빌드를 돌리지 않았고, 초안(draft)이며 hosted CI도 아직 대기 중입니다.

라인 - Verification 체크리스트: 로컬 검사 NOT RUN이 명시되어 있어, 이 헤드 SHA에 대한 증거는 아직 소스 PR CI 성공 기록과 정적 검토뿐입니다. Windows/macOS control 잡은 소스 쪽에서도 스킵되었습니다.
라인 - nativeResponseControlEligible / ws-upstream.ts: 공개 API-key WebSocket에서 조향이 더 이상 허용되지 않습니다. 예전 설정(codexNativeSteering + API 경로)을 쓰는 운영자가 있으면 의도된 깨짐인지 한 번 더 확인할 필요가 있습니다.
라인 - native-steering-replay.ts evictOldest: () => 0: 조향·주입 일지는 핀으로만 잡히고 예산 압박 때 내보낼 수 없습니다. 합산·admission 거절은 테스트로 덮였지만, 장기 연결이 많은 환경에서는 “캐시는 비워도 새 일지는 거절”되는 동작이 운영 체감에 남을 수 있습니다.
라인 - 원본 #5479 / #5470 / #5492: 아직 OPEN입니다. 이 묶음이 dev에 들어온 뒤 동작이 같은지 확인한 다음에만 닫아야 합니다. 지금 단계에서 원본을 먼저 닫으면 안 됩니다.

메인테이너의 판단이 필요한 지점

보안 리뷰를 머지 전에 꼭 할지입니다. 요청 로컬 도구 인가가 네이티브 continuation/replay·라우트·터미널 전달·평문 카탈로그 opt-in 경계를 지나고, 본문/재생 메모리 lifetime도 바뀝니다. PR이 이미 “보안 리뷰 필요”를 체크리스트에 열어 두었으니, 그 게이트를 실제 승인으로 닫을지 정해야 합니다. 또한 공개 API 조향 제거가 제품 의도인지, 이 묶음을 ready로 올린 뒤 어떤 hosted CI 증거를 최소로 볼지도 정해야 합니다.

너의 추천

초안은 유지한 채, 이 헤드에서 hosted CI(최소 Linux 핵심 + 가능하면 control 관련)를 통과시키고 보안 리뷰를 받은 뒤에만 ready/머지하세요. 머지·검증 후에는 #5479·#5470·#5492를 무효/중복으로 닫고, 같은 주제가 남은 open PR이 있으면 같이 정리하세요. 로컬 NOT RUN은 그대로 두지 말고, 머지 전에라도 영향 suites(ws-native-steering / ws-native-injection / plaintext-v2 / app-owned-memory)를 한 번 돌린 증거를 남기는 편이 안전합니다.

이 댓글은 grok-bot이 작성했습니다

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[lidge-jun]

Security review (maintainer, static)

Read-only security review of #5508 at b9d94d6: queued-injection refusal confirmed (assertOutboundFrame runs before capacity check/queue push; typed outbound_body_too_large; rollback on send-time and continuation paths; socket stays open with corrected retry). Inbound control frames are byte-checked before parse; aggregate pinned journal ceiling 128 MiB fail-closed; steering eligibility limited to canonical routes; undeclared-tool guard mirrored at added/done. No request-body, credential, or account-identifier logging added. Non-blockers: test-only cap setter exported from a prod module; redundant post-parse size check (defense in depth); NativeInjectionReplay.dispose lacks an idempotency guard (unregister is repeat-safe). Verdict: pass.

Reviewed at b9d94d6; the later head only adds a merge of current dev.