fix(responses): scope combo continuation replay - #1888

sequenceDiagram
  participant Client
  participant ParentResponseRouter
  participant ContinuationState
  participant ChildResponseRouter
  participant ProviderAdapter
  Client->>ParentResponseRouter: Send continuation request
  ParentResponseRouter->>ContinuationState: Validate thread scope and provider owner
  ContinuationState-->>ParentResponseRouter: Return valid continuation snapshot
  ParentResponseRouter->>ChildResponseRouter: Pass comboReplaySnapshot
  ChildResponseRouter->>ContinuationState: Copy replay provenance
  ChildResponseRouter->>ProviderAdapter: Send sanitized continuation payload
  ProviderAdapter-->>ChildResponseRouter: Return response and continuation state
  ChildResponseRouter->>ContinuationState: Persist state with provider owner

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

✅ Deterministic PR hygiene checks passed.

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/index.ts.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

@coderabbitai review

Exact head is now 6764de3331da57798f4c5d2b19b80b1dfe6c3bda, based on current dev@aa9df919a524ac6bf53888779b9144471a2a4769.

Author validation: Bun 1.3.14 and Bun 1.4 owner/replay matrix 11/11 on each runtime; the broader Responses-state + Combo suite passed 164 tests on Bun 1.3.14; typecheck, privacy scan, and diff check passed. The same-slot OAuth account-isolation regression is covered. The exact-head follow-up also validates reserved __ocxOwner spill metadata separately from provider payloads; its focused regression and typecheck pass on Bun 1.3.14 and Bun 1.4.0-canary.1. All current review threads are resolved, and the checklist is 4/4.

Because this head touches src/oauth/index.ts, maintainer action requested: security-review the auth-surface change and apply maintainer-sponsored, then approve fork-gated Cross-platform CI run 32046128926 and React Doctor run 32046128902.

@coderabbitai full review

@Wibias Please re-review exact head 6764de3331da57798f4c5d2b19b80b1dfe6c3bda.

The four regressions requested in the prior review remain covered: same-target Kiro + credential continuation, same-target Cursor without a parent-thread header, different-provider failover isolation, and different account/credential isolation. Identityless or email-only same-slot OAuth replacement also fails closed, while identity-bearing token refresh/reload remains continuous.

The latest CodeRabbit finding is addressed in 6764de3: reserved __ocxOwner spill metadata is now validated separately with the same owner rules used by runtime restore, and all review threads are resolved. Owner/replay regressions pass 11/11 on Bun 1.3.14 and Bun 1.4; the reserved-owner regression and typecheck pass on Bun 1.3.14 and Bun 1.4.0-canary.1.

@coderabbitai review exact head 6764de3

@coderabbitai review

@Wibias Please re-review exact head 3b04d3f817644d60e10f7addeb3d3b86e4574c80. The earlier same-target Kiro/Cursor blocker and the later Cursor parent-thread P1 are both addressed:

• continuation restore is bound to provider, destination, adapter, model, and credential/account owner;
• Cursor deterministic IDs and recovered thread overrides use that same final route namespace;
• ownerless/local Cursor routes add the effective bearer-token digest without persisting or logging the token;
• exact OAuth account subjects remain distinct, while stable identity-bearing refreshes keep continuity;
• regressions cover same Kiro/Cursor owner, cross-provider and cross-credential rejection, destination rekey, token rekey, and same-scope reuse.

Exact-head focused validation is 69/69 on Bun 1.3.14 and Bun 1.4.0-canary.1; typecheck, privacy scan, and diff check pass on both. All current inline threads are resolved and the readiness checklist is 4/4.

@lidge-jun Maintainer action is still needed for security review and the maintainer-sponsored label on src/oauth/index.ts, plus approval of the fork-gated Cross-platform CI and React Doctor runs.

#!/bin/bash
set -euo pipefail

target='3b04d3f817644d60e10f7addeb3d3b86e4574c80'
printf '%s\n' '== checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== target commit =='
git cat-file -t "$target"
printf '%s\n' '== target parents =='
git show -s --format='%H%n%P%n%s' "$target"
printf '%s\n' '== changed files from first parent =='
git diff-tree --no-commit-id --name-status -r "$target"
printf '%s\n' '== changed-symbol outlines =='
for f in src/server/responses/core.ts src/oauth/index.ts src/responses/state.ts src/responses/reasoning-replay-cache.ts src/types.ts tests/server-combo-failover-e2e.test.ts tests/responses-state.test.ts; do
  if [ -f "$f" ]; then
    echo "--- $f"
    ast-grep outline "$f" --items all || true
  fi
done
printf '%s\n' '== exact diff, relevant files =='
git diff --find-renames --unified=50 "${target}^" "$target" -- \
  src/server/responses/core.ts src/oauth/index.ts src/responses/state.ts \
  src/responses/reasoning-replay-cache.ts src/types.ts \
  tests/server-combo-failover-e2e.test.ts tests/responses-state.test.ts

#!/bin/bash
set -euo pipefail

printf '%s\n' '== continuation ownership and route binding =='
sed -n '285,455p' src/server/responses/core.ts
printf '%s\n' '== final route normalization and its call sites =='
sed -n '1240,1415p' src/server/responses/core.ts
rg -n -C 5 '\bbindRouteReasoningReplayScope\s*\(|\bapplyFinalRouteRequestNormalization\s*\(' src/server/responses/core.ts

printf '%s\n' '== Cursor token resolver =='
cursor_transport=$(fd -a '^live-transport\.ts$' src)
printf '%s\n' "$cursor_transport"
sed -n '1,240p' "$cursor_transport"

printf '%s\n' '== Cursor identity scope consumers =='
rg -n -C 8 '_cursorIdentityScope|conversationId|thread continuity|threadContinuity' src/adapters src/responses src/server --glob '*.ts'

printf '%s\n' '== state storage of provider continuation =='
sed -n '960,1100p' src/responses/state.ts
sed -n '1150,1230p' src/responses/state.ts

printf '%s\n' '== OAuth account store identity normalization =='
store_file=$(fd -a '^store\.ts$' src/oauth)
printf '%s\n' "$store_file"
rg -n -C 6 'function saveCredential|export async function saveCredential|accountId|trim\(' "$store_file"

printf '%s\n' '== focused Cursor test remainder =='
sed -n '2660,2920p' tests/server-combo-failover-e2e.test.ts

#!/bin/bash
set -euo pipefail

printf '%s\n' '== initial binding, selected headers, and adapter dispatch =='
sed -n '2180,2380p' src/server/responses/core.ts
sed -n '2380,2490p' src/server/responses/core.ts

printf '%s\n' '== all later scope rebind contexts =='
for range in '720,785' '3380,3455' '3460,3535' '3890,3960' '3970,4035' '4260,4340'; do
  echo "--- src/server/responses/core.ts:$range"
  sed -n "${range}p" src/server/responses/core.ts
done

printf '%s\n' '== active adapter runTurn input construction =='
rg -n -C 12 '\.runTurn\s*\(|incoming:|headers: selectedForwardHeaders|selectedForwardHeaders|forwardHeaders' \
  src/server/responses/core.ts --glob '*.ts'

printf '%s\n' '== scope-binding test coverage and retry test coverage =='
rg -n -C 5 'cursor.*(retry|rekey|bearer|token|scope)|bindRouteReasoningReplayScope|_cursorIdentityScope' \
  tests src --glob '*.test.ts' --glob '*.ts'

printf '%s\n' '== commit parent comparison of retry binding contexts =='
git diff --unified=20 '3b04d3f817644d60e10f7addeb3d3b86e4574c80^' \
  '3b04d3f817644d60e10f7addeb3d3b86e4574c80' -- src/server/responses/core.ts

@luvs01 Reviewed exact head 3b04d3f817644d60e10f7addeb3d3b86e4574c80.

I found no new actionable issues.

Key checks completed:

• src/server/responses/core.ts binds the Cursor route namespace after final route and authentication resolution.
• The namespace includes provider, destination, adapter, final model, and credential identity.
• Ownerless local Cursor routes include a digest of the effective resolved Cursor token.
• src/adapters/cursor/request-builder.ts applies _cursorIdentityScope before it derives or recovers a thread conversation ID.
• Stored provider continuation restores only after exact owner equality validation.
• src/oauth/index.ts now keeps exact stored OAuth account IDs distinct. This matches the exact identity matching in src/oauth/store.ts.

I did not rerun the reported Bun test matrix in this sandbox.

Closing with a redesign directive rather than merging. Owner-scoped combo continuation replay is still missing on dev and the matrix tests you added are valuable, but this head is 1233 lines with a src/server/responses/core.ts conflict against a file that changed four times today, an unresolved CHANGES_REQUESTED, and unsponsored OAuth identity hashing. Redesign guidance: (1) restack on current dev in two PRs — the replay-scope contract + tests first, the identity-hashing half separately behind the sponsored-surface path; (2) the core.ts integration point moved (backfillResponsesFieldsJson + summary rewrite now compose at the bounded-JSON return) — rebase against that shape; (3) keep the matrix tests, they land with PR 1. Happy to review the restack.