fix(codex-link): omit opaque execution state on provider switches

Preserve visible history with omission notes and original encrypted state on native return. Ship IDE beta.45.

apps/desktop/assets/codex-bridge/test_gecis_context.py

@@ -68,7 +68,7 @@ class History(unittest.TestCase):
         self.assertNotIn("OPAQUE_", json.dumps(result))
         self.assertEqual(req, before)
         self.assertLessEqual(gc.tokens(result), gc.input_budget(req, 32768))
-        self.assertEqual(result["input"][-1], {"role": "user", "content": "Latest"})
+        self.assertIn({"role": "user", "content": "Latest"}, result["input"])
 
     def test_legacy_summary_and_tool_ids_repaired_without_mutating_source(self):
         req = {"input": [ozet_kopru.ozet_ogesi("KARAR-4827 korunacak"),
@@ -259,19 +259,18 @@ class PreparationService(unittest.TestCase):
         self.assertNotIn("OPAQUE_REASONING", json.dumps(result))
         self.assertEqual(req, before)
 
-    def test_large_native_return_summarizes_visible_history_without_ciphertext(self):
-        req = {"model": "gpt-6-astra", "input": [
-            {"role": "user", "content": "KARAR-4827 " + "x" * 190000},
-            {"type": "reasoning", "encrypted_content": "OPAQUE_NATIVE"},
-            {"role": "user", "content": "Latest"}]}
-        before = copy.deepcopy(req)
-        result = self.service._prepare_transfer({"request": req, "source_model": "ide/test"})["request"]
-        self.assertEqual(result["model"], "gpt-6-astra")
-        self.assertIn("KARAR-4827", json.dumps(result))
-        self.assertLessEqual(gc.tokens(result), gc.input_budget(req, 128000))
-        self.assertEqual(req, before)
-        self.assertTrue(self.server.gelen)
-        self.assertTrue(all(b"OPAQUE_NATIVE" not in call["govde"] for call in self.server.gelen))
+    def test_large_native_return_keeps_original_encrypted_execution_state(self):
+        for opaque in ({"type": "reasoning", "encrypted_content": "OPAQUE_NATIVE"},
+                       {"type": "agent_message", "content": [
+                           {"type": "encrypted_content", "encrypted_content": "OPAQUE_PEER"}]}):
+            req = {"model": "gpt-6-astra", "input": [
+                {"role": "user", "content": "KARAR-4827 " + "x" * 190000},
+                opaque, {"role": "user", "content": "Latest"}]}
+            before = copy.deepcopy(req)
+            result = self.service._prepare_transfer({"request": req, "source_model": "ide/test"})["request"]
+            self.assertEqual(result, before)
+            self.assertEqual(req, before)
+            self.assertEqual(self.server.gelen, [])
 
     def test_external_compaction_uses_external_summary_not_subscription(self):
         req = {"model": "ide/test", "input": [{"role": "assistant", "content": "KARAR-4827"}, {"role": "user", "content": "KARAR-4827"}, {"type": "compaction_trigger"}]}
@@ -281,30 +280,38 @@ class PreparationService(unittest.TestCase):
 
 
 class SocketMigration(fixtures.Ayirici):
-    def test_opaque_peer_transfer_fails_as_http_400_before_sse_or_upstream(self):
+    def test_opaque_peer_transfer_succeeds_without_ciphertext_or_transfer_error(self):
         req = {"model": "ide/agy-gemini-3.8-flash-high", "prompt_cache_key": "opaque-peer",
-               "input": [{"type": "agent_message", "author": "/root", "recipient": "/root/peer",
-                          "content": [{"type": "input_text", "text": "Message Type: NEW_TASK\nPayload:\n"},
-                                      {"type": "encrypted_content", "encrypted_content": "gAAAA_synthetic_opaque"}]}]}
+               "input": [{"role": "user", "content": "USER_DECISION"},
+                         {"type": "agent_message", "author": "/root", "recipient": "/root/peer",
+                          "content": [{"type": "input_text", "text": "VISIBLE_PEER_HEADER"},
+                                      {"type": "encrypted_content", "encrypted_content": "gAAAA_synthetic_opaque"}]},
+                         {"role": "assistant", "content": "VISIBLE_ANSWER"},
+                         {"type": "function_call", "id": "fc_1", "call_id": "c1", "name": "read", "arguments": "{}"},
+                         {"type": "function_call_output", "id": "fco_1", "call_id": "c1", "output": "VISIBLE_RESULT"}]}
         original = copy.deepcopy(req)
-        raw = json.dumps(req).encode()
-        # Identical retries must receive the same permanent error without a
-        # preparation request, a stream heartbeat, or provider inference.
-        for _ in range(2):
-            status, body, headers = self.iste("POST", "/backend-api/codex/responses", raw)
-            self.assertEqual(status, 400)
-            self.assertEqual(headers["Content-Type"].split(";")[0], "application/json")
-            self.assertNotIn("Transfer-Encoding", headers)
-            error = json.loads(body)["error"]
-            self.assertEqual(error["code"], "aiturk_transfer_failed")
-            self.assertEqual(error["type"], "invalid_request_error")
-            self.assertFalse(error["retryable"])
-            self.assertIn("görev eksik gönderilmedi", error["message"])
-            self.assertNotIn(b"response.failed", body)
-        self.assertEqual(req, original)
+        for model in (req["model"], "ide/another-provider"):
+            req["model"] = model
+            status, body, _ = self.iste("POST", "/backend-api/codex/responses", json.dumps(req).encode())
+            self.assertEqual(status, 200)
+            self.assertNotIn(b"aiturk_transfer_failed", body)
+            sent = json.loads(self.kopru.gelen[-1]["govde"])
+            wire = json.dumps(sent, ensure_ascii=False)
+            self.assertNotIn("gAAAA_synthetic_opaque", wire)
+            self.assertNotIn("encrypted_content", wire)
+            self.assertIn(gc.PEER_OMITTED, wire)
+            self.assertIn("VISIBLE_PEER_HEADER", wire)
+            for item in original["input"][:1] + original["input"][2:]:
+                self.assertIn(item, sent["input"])
+        self.assertEqual(req["input"], original["input"])
         self.assertEqual(self.ozgun.gelen, [])
-        self.assertEqual(self.kopru.gelen, [])
-        self.assertEqual(bridge.TRANSFERS, {})
+        # Returning uses the client's original transcript, including opaque peer
+        # state. Projection never rewrites the persisted source or a native turn.
+        req["model"] = "gpt-6-astra"
+        raw = zstd(json.dumps(req).encode())
+        status, _, _ = self.iste("POST", "/backend-api/codex/responses", raw, {"Content-Encoding": "zstd"})
+        self.assertEqual(status, 200)
+        self.assertEqual(self.ozgun.gelen[-1]["govde"], raw)
 
     def test_native_opaque_peer_history_remains_byte_identical_on_owner_route(self):
         req = {"model": "gpt-6-astra", "input": [{"type": "agent_message", "author": "/root",