Fix the real defect #1 site: replay-sanitizer strips model-less turns too

sanitizeReplayTurns runs before the adapter's own buildRequest via
withReplaySanitizer, and its stripForeignBlocks gate had the identical
undefined-model-is-foreign bug as signatureForModel, deleting the
signature before the adapter ever saw it. The vendored transformMessages
has the same same-model check and is not ours to change, so a model-less
assistant turn is now stamped with the target model before either stage
runs, instead of loosening either stage's foreign check directly.

Genuine cross-provider turns (a turn with a real, different model) are
untouched -- still stripped, still fail closed.

Author: TheGreatAxios

src/provider/replay-sanitizer.test.ts

@@ -2,6 +2,11 @@ import { describe, expect, it } from "bun:test";
 import type { AdapterRegistry } from "@intx/inference";
 import { createBuiltinRegistry } from "@intx/inference/providers";
 import type { ConversationTurn, LastCycleSource } from "@intx/types/runtime";
+import {
+  CODEX_RESPONSES_PROVIDER,
+  createCodexResponsesAdapter,
+  tagSignature,
+} from "./codex-responses-adapter.js";
 import { createGrokResponsesAdapter } from "./grok-responses-adapter.js";
 import { createOpenAICompatibleAdapter } from "./openai-compatible-adapter.js";
 import {
@@ -57,6 +62,13 @@ function corbitsRegistry(): AdapterRegistry {
   };
 }
 
+function codexRegistry(): AdapterRegistry {
+  return {
+    has: (provider) => provider === CODEX_RESPONSES_PROVIDER,
+    resolve: (source) => createCodexResponsesAdapter(source),
+  };
+}
+
 function thinkingOnlyHistory(): ConversationTurn[] {
   return [
     {
@@ -357,4 +369,35 @@ describe("withReplaySanitizer", () => {
     expect(() => adapter.buildRequest(thinkingOnlyHistory(), "claude-opus-4", {})).not.toThrow();
     expect(() => adapter.buildRequest(leftoverHistory, "claude-opus-4", {})).not.toThrow();
   });
+
+  // Regression for CL-6912: sanitizeReplayTurns runs INSIDE buildRequest,
+  // before the adapter's own toResponsesItems ever sees a turn. A turn
+  // missing `model` must survive stripForeignBlocks's foreign-turn gate, not
+  // just signatureForModel's gate inside the adapter — otherwise the
+  // signature never reaches the adapter's own (correctly fixed) check.
+  it("carries a reasoning signature through the real buildRequest path when the turn has no model", () => {
+    const adapter = withReplaySanitizer(codexRegistry()).resolve({
+      sourceId: "s1",
+      provider: CODEX_RESPONSES_PROVIDER,
+      model: "gpt-5.1-codex",
+    });
+    const signature = tagSignature(CODEX_RESPONSES_PROVIDER, "cipher");
+    const turns: ConversationTurn[] = [
+      { role: "user", content: [{ type: "text", text: "hi" }], timestamp: 1 },
+      {
+        role: "assistant",
+        content: [
+          { type: "thinking", thinking: "ponder", signature },
+          { type: "tool_call", id: "call_1", name: "shell", arguments: {} },
+        ],
+        timestamp: 2,
+      } as unknown as ConversationTurn,
+    ];
+
+    const request = adapter.buildRequest(turns, "gpt-5.1-codex", {});
+    const body = JSON.parse(request.body) as { input: { type: string }[] };
+
+    expect(body.input.some((item) => item.type === "reasoning")).toBe(true);
+    expect(body.input.some((item) => item.type === "function_call")).toBe(true);
+  });
 });

src/provider/replay-sanitizer.ts

@@ -69,7 +69,20 @@ export function sanitizeReplayTurns(
   turns: ConversationTurn[],
   targetModel: string,
 ): ConversationTurn[] {
-  const stripped = turns.map((turn) =>
+  // A turn with no `model` recorded (an optional field on the persisted
+  // schema) is not evidence it came from a foreign provider. Both this
+  // module's own foreign-turn gate below AND the vendored transformMessages'
+  // same-model check key off exact `model` equality — transformMessages is
+  // not ours to change, so a model-less turn is stamped with the target
+  // model before either stage runs. That reads as "this model", not
+  // "foreign", to both stages; without it transformMessages strips the
+  // turn's thinking blocks outright regardless of what this module decides.
+  const modelFilled = turns.map((turn) =>
+    turn.role === "assistant" && turn.model === undefined
+      ? { ...turn, model: targetModel }
+      : turn,
+  );
+  const stripped = modelFilled.map((turn) =>
     turn.role === "assistant" && turn.model !== targetModel ? stripForeignBlocks(turn) : turn,
   );
   const marked = stripped.map(replaceUnusableAssistantTurn);