fix(chat): isolate Anthropic reasoning state from native passthrough - #7504

Summary

When a client echoes Anthropic reasoning_details into Chat history, the native openai-chat passthrough currently forwards the complete message to the next provider. Decline that lane for Anthropic-marked details and legacy unmarked signed thinking that the existing inbound replay accepts, then use the existing Responses bridge.

The bridge keeps the readable projection according to the destination's reasoning policy and excludes Anthropic signatures and redacted-thinking ciphertext from unrelated providers. First-party Anthropic replay remains intact. Explicit foreign formats and unsigned reasoning retain their existing native eligibility.

Share the signed-text predicate between ingress replay and native eligibility so the two boundaries recognize the same legacy carrier. No new credential storage, authentication behavior, or provider call is added.

Verification

Current head: cd6dc144004152386ad78429eb4775ab26ce6a4d, normally merging dev@c4d4bb2da2162e23c314befafc5ec104292902a0 into 1260a67a5c1851f31a7ecbd838dbc33603253843. The six-file PR scope is preserved; production and test blobs are unchanged, and the shared inbound documentation retains both contracts.

Official Bun 1.4.4+38afee6c8, Windows: the relevant reasoning/ingress selection passed 69 cases. TypeScript, structure, privacy, file-size ratchet and PR-relative diff checks passed. Only missing tracked sparse inputs were materialized; no dependencies or live services were changed. Current-head CI passed.

The following Bun 1.4.3 evidence belongs to the previous 1260a67a head and was not rerun unchanged:

• Repository-pinned Bun 1.4.3: 32 passed, 0 failed; 189 assertions across the native-decline and Anthropic Chat reasoning suites.
• The new integration cases drive real Chat ingress against a captured openai-chat transport. Marked and legacy signed history retain plaintext reasoning and exclude signatures/encrypted data. A foreign-format control keeps native passthrough.
• The role-agnostic boundary is intentional: native passthrough preserves message fields for every role. New cases confirm Anthropic state on non-assistant messages is excluded from the upstream wire while foreign-format details retain native passthrough. Temporarily restricting the predicate to assistant messages makes both protection tests fail; the production predicate is unchanged.
• The captured-wire case includes a valid assistant tool call and matching tool result carrying Anthropic state. The signature and redacted payload are absent upstream, while the result's call ID and content are preserved.
• Existing first-party Anthropic tool-loop, streaming/direct-encoder, and redacted-thinking round trips pass with stubbed endpoints. No live provider was contacted.
• TypeScript, structure SSOT, privacy scan, file-size ratchet, and dev-relative whitespace passed.
• A Windows --changed=origin/dev run was attempted, then explicitly stopped after more than ten minutes under the repository's resource exception. Its exact owned process tree was confirmed stopped; it is not reported as passing. Broader/full-suite coverage is left to hosted CI.

OCX_TEST_RUNNER_BUN=<verified-bun-1.4.3> bun scripts/test.ts --timeout 30000 \
  tests/responses/chat-native-decline-reason.test.ts \
  tests/responses/chat-anthropic-reasoning-details.test.ts
bun x tsc --noEmit
bun scripts/structure-ssot.ts
bun scripts/privacy-scan.ts
bun scripts/file-size-ratchet.ts
git diff --check a4f335c075f84b721f0122ae0534a4af81e86294 HEAD

Checklist

• Scope stays focused and avoids unrelated cleanup.
• The owned transport/ingress contract documentation is updated.
• Focused privacy and compatibility regressions pass.
• Required local validation passed with the focused scope and resource exception documented.
• The branch includes the current dev base.
• Valid review findings are fixed; the assistant-only suggestion was evaluated, explained, and covered by regression tests.
• Ready for review.

Required CI on this PR and independent privacy-boundary review remain conditions for merge.

Summary by CodeRabbit

• Bug Fixes

  • Chat requests containing Anthropic reasoning state, including qualifying signed reasoning text without a format marker, now use a compatible processing route. For non-Anthropic destinations, readable reasoning text is retained while signatures and other opaque reasoning data are excluded.
  • Reasoning details from other providers continue to pass through in their existing format, including on messages that are not from the assistant.

• Documentation

  • Clarified how chat routing handles Anthropic reasoning state and preserves other providers’ reasoning formats.