fix(codex): harden routed apply_patch contracts

src/adapters/azure.ts

@@ -2,15 +2,17 @@ import type { IncomingMeta, ProviderAdapter } from "./base";
 import type { OcxParsedRequest, OcxProviderConfig } from "../types";
 import { createResponsesPassthroughAdapter } from "./openai-responses";
 
-export function createAzureAdapter(provider: OcxProviderConfig): ProviderAdapter & { passthrough: true } {
-  const inner = createResponsesPassthroughAdapter({
+export function createAzureAdapter(
+  provider: OcxProviderConfig,
+  inner: ProviderAdapter = createResponsesPassthroughAdapter({
     ...provider,
     baseUrl: provider.baseUrl,
-  });
-
+  }),
+): ProviderAdapter & { passthrough: true } {
   return {
     ...inner,
     name: "azure-openai",
+    passthrough: true,
 
     async buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta) {
       if (provider.authMode === "forward") {

src/adapters/contracts.ts

@@ -0,0 +1,98 @@
+import type { OcxProviderConfig } from "../types";
+import type { ProviderAdapter } from "./base";
+
+export const REQUIRED_ROUTED_TOOL_CONTRACTS = [
+  "tools.code-mode-nested-helper",
+  "tools.freeform-exact-roundtrip",
+  "tools.tool-choice-final-catalog",
+  "tools.continuation-replay",
+] as const;
+
+export type RequiredRoutedToolContract = typeof REQUIRED_ROUTED_TOOL_CONTRACTS[number];
+
+export type MutationContract =
+  | "mutation.codex-owned"
+  | "mutation.codex-owned-with-gated-native-fallback";
+
+export type AdapterWire =
+  | "openai-chat"
+  | "anthropic"
+  | "google"
+  | "command-code"
+  | "kiro"
+  | "openai-responses"
+  | "cursor";
+
+export type AdapterCacheRetention = "none" | "short" | "long";
+
+export interface AdapterFactoryContext {
+  cacheRetention?: AdapterCacheRetention;
+}
+
+export type AdapterFactory = (
+  provider: OcxProviderConfig,
+  context: AdapterFactoryContext,
+) => ProviderAdapter;
+
+export type AdapterWrapperFactory = (
+  parent: ProviderAdapter,
+  provider: OcxProviderConfig,
+  context: AdapterFactoryContext,
+) => ProviderAdapter;
+
+export interface DirectAdapterDefinitionInput {
+  kind: "direct";
+  wire: AdapterWire;
+  mutation: MutationContract;
+  create: AdapterFactory;
+}
+
+export interface WrappedAdapterDefinitionInput {
+  kind: "wrapper";
+  extends: string;
+  wrap: AdapterWrapperFactory;
+}
+
+export type AdapterDefinitionInput = DirectAdapterDefinitionInput | WrappedAdapterDefinitionInput;
+
+export type AdapterDefinition<T extends AdapterDefinitionInput = AdapterDefinitionInput> = Readonly<
+  T & { requiredToolContracts: typeof REQUIRED_ROUTED_TOOL_CONTRACTS }
+>;
+
+type ValidAdapterRegistry<T extends Record<string, AdapterDefinitionInput>> = {
+  [K in keyof T]: T[K] extends WrappedAdapterDefinitionInput
+    ? T[K]["extends"] extends Exclude<keyof T, K>
+      ? T[K]
+      : never
+    : T[K];
+};
+
+type AssertNever<T extends never> = T;
+type _UnknownWrapperParentIsRejected = AssertNever<
+  ValidAdapterRegistry<{
+    base: DirectAdapterDefinitionInput;
+    broken: WrappedAdapterDefinitionInput & { extends: "not-registered" };
+  }>["broken"]
+>;
+type _SelfWrapperParentIsRejected = AssertNever<
+  ValidAdapterRegistry<{
+    self: WrappedAdapterDefinitionInput & { extends: "self" };
+  }>["self"]
+>;
+
+export function defineAdapterRegistry<const T extends Record<string, AdapterDefinitionInput>>(
+  definitions: T & ValidAdapterRegistry<T>,
+): { readonly [K in keyof T]: AdapterDefinition<T[K]> } {
+  const registered = Object.fromEntries(
+    Object.entries(definitions).map(([id, definition]) => [
+      id,
+      Object.freeze({
+        ...definition,
+        requiredToolContracts: REQUIRED_ROUTED_TOOL_CONTRACTS,
+      }),
+    ]),
+  );
+  return Object.freeze(registered) as unknown as {
+    readonly [K in keyof T]: AdapterDefinition<T[K]>;
+  };
+}

src/adapters/mimo-free.ts

@@ -191,10 +191,20 @@ export function injectMimoSystemMarker(body: unknown): unknown {
  *   1. JWT from the bootstrap endpoint (cached, auto-refreshed).
  *   2. Anti-abuse system marker in the request body.
  *   3. Required headers (User-Agent, X-Mimo-Source, x-session-affinity).
- * On 401/403, flushes the JWT cache and retries once via fetchResponse.
+ * On 401, flushes the JWT cache and retries once via fetchResponse.
  */
-export function createMimoFreeAdapter(provider: OcxProviderConfig): ProviderAdapter {
-  const base = createOpenAIChatAdapter(provider);
+export interface MimoFreeAdapterDeps {
+  getJwt?: (signal?: AbortSignal) => Promise<string>;
+  resetJwt?: () => void;
+}
+
+export function createMimoFreeAdapter(
+  provider: OcxProviderConfig,
+  deps: MimoFreeAdapterDeps = {},
+  base: ProviderAdapter = createOpenAIChatAdapter(provider),
+): ProviderAdapter {
+  const getJwt = deps.getJwt ?? getMimoJwt;
+  const resetJwt = deps.resetJwt ?? resetMimoJwtCache;
   // Per-adapter session-affinity id (random, per process instance).
   const sessionId = `ses_${Math.random().toString(36).slice(2, 26)}`;
 
@@ -203,7 +213,7 @@ export function createMimoFreeAdapter(provider: OcxProviderConfig): ProviderAdap
     name: "mimo-free",
 
     async buildRequest(parsed: OcxParsedRequest, incoming: IncomingMeta): Promise<AdapterRequest> {
-      const jwt = await getMimoJwt();
+      const jwt = await getJwt(incoming?.abortSignal);
 
       // Let the base adapter build the wire body (handles reasoning, tools, etc.)
       // but override the URL and headers after.
@@ -243,8 +253,8 @@ export function createMimoFreeAdapter(provider: OcxProviderConfig): ProviderAdap
       if (response.status === 401) {
         // Drain the first response body before issuing the retry.
         try { await response.body?.cancel(); } catch { /* already consumed */ }
-        resetMimoJwtCache();
-        const freshJwt = await getMimoJwt(ctx?.abortSignal);
+        resetJwt();
+        const freshJwt = await getJwt(ctx?.abortSignal);
         const retryHeaders = {
           ...(request.headers as Record<string, string>),
           "Authorization": `Bearer ${freshJwt}`,

src/adapters/registry.ts

@@ -0,0 +1,166 @@
+import { createAnthropicAdapter } from "./anthropic";
+import { createAzureAdapter } from "./azure";
+import type { ProviderAdapter } from "./base";
+import { createCursorAdapter, type CursorAdapterDeps } from "./cursor";
+import { createGoogleAdapter } from "./google";
+import { createKiroAdapter } from "./kiro";
+import { createMimoFreeAdapter, type MimoFreeAdapterDeps } from "./mimo-free";
+import { createOpenAIChatAdapter } from "./openai-chat";
+import { createCommandCodeAdapter } from "./command-code";
+import { createResponsesPassthroughAdapter } from "./openai-responses";
+import type { OcxProviderConfig } from "../types";
+import {
+  defineAdapterRegistry,
+  type AdapterDefinition,
+  type AdapterFactoryContext,
+  type DirectAdapterDefinitionInput,
+} from "./contracts";
+
+type RegistryFactoryContext = AdapterFactoryContext & {
+  cursorDeps?: CursorAdapterDeps;
+  mimoDeps?: MimoFreeAdapterDeps;
+};
+
+function createRegisteredCursorAdapter(provider: OcxProviderConfig, context: AdapterFactoryContext) {
+  return createCursorAdapter(provider, (context as RegistryFactoryContext).cursorDeps);
+}
+
+function wrapRegisteredMimoFreeAdapter(
+  parent: ProviderAdapter,
+  provider: OcxProviderConfig,
+  context: AdapterFactoryContext,
+) {
+  return createMimoFreeAdapter(
+    provider,
+    (context as RegistryFactoryContext).mimoDeps,
+    parent,
+  );
+}
+
+export const ADAPTER_REGISTRY = defineAdapterRegistry({
+  "command-code": {
+    kind: "direct",
+    wire: "command-code",
+    mutation: "mutation.codex-owned",
+    create: provider => createCommandCodeAdapter(provider),
+  },
+  "openai-chat": {
+    kind: "direct",
+    wire: "openai-chat",
+    mutation: "mutation.codex-owned",
+    create: provider => createOpenAIChatAdapter(provider),
+  },
+  anthropic: {
+    kind: "direct",
+    wire: "anthropic",
+    mutation: "mutation.codex-owned",
+    create: (provider, context) => createAnthropicAdapter(provider, context.cacheRetention),
+  },
+  "openai-responses": {
+    kind: "direct",
+    wire: "openai-responses",
+    mutation: "mutation.codex-owned",
+    create: provider => createResponsesPassthroughAdapter(provider),
+  },
+  google: {
+    kind: "direct",
+    wire: "google",
+    mutation: "mutation.codex-owned",
+    create: provider => createGoogleAdapter(provider),
+  },
+  kiro: {
+    kind: "direct",
+    wire: "kiro",
+    mutation: "mutation.codex-owned",
+    create: provider => createKiroAdapter(provider),
+  },
+  azure: {
+    kind: "wrapper",
+    extends: "openai-responses",
+    wrap: (parent, provider) => createAzureAdapter(provider, parent),
+  },
+  "azure-openai": {
+    kind: "wrapper",
+    extends: "openai-responses",
+    wrap: (parent, provider) => createAzureAdapter(provider, parent),
+  },
+  cursor: {
+    kind: "direct",
+    wire: "cursor",
+    mutation: "mutation.codex-owned-with-gated-native-fallback",
+    create: createRegisteredCursorAdapter,
+  },
+  "mimo-free": {
+    kind: "wrapper",
+    extends: "openai-chat",
+    wrap: wrapRegisteredMimoFreeAdapter,
+  },
+});
+
+export type AdapterId = keyof typeof ADAPTER_REGISTRY;
+export type RegisteredAdapterDefinition = typeof ADAPTER_REGISTRY[AdapterId];
+export type EffectiveAdapterContract = AdapterDefinition<DirectAdapterDefinitionInput>;
+
+export function adapterDefinitions(): Array<[AdapterId, RegisteredAdapterDefinition]> {
+  return Object.entries(ADAPTER_REGISTRY) as Array<[AdapterId, RegisteredAdapterDefinition]>;
+}
+
+export function getAdapterDefinition(adapterId: string): RegisteredAdapterDefinition | undefined {
+  return ADAPTER_REGISTRY[adapterId as AdapterId];
+}
+
+export function effectiveAdapterContract(adapterId: string): EffectiveAdapterContract {
+  const visited = new Set<string>();
+  let current = adapterId;
+
+  while (true) {
+    if (visited.has(current)) {
+      throw new Error(`Adapter wrapper cycle detected at ${current}`);
+    }
+    visited.add(current);
+
+    const definition = getAdapterDefinition(current);
+    if (!definition) throw new Error(`Unknown adapter: ${current}`);
+    if (definition.kind === "direct") return definition;
+    current = definition.extends;
+  }
+}
+
+function createRegisteredAdapterById(
+  adapterId: string,
+  provider: OcxProviderConfig,
+  context: RegistryFactoryContext,
+  visited: ReadonlySet<string>,
+): ProviderAdapter {
+  if (visited.has(adapterId)) {
+    throw new Error(`Adapter wrapper cycle detected at ${adapterId}`);
+  }
+
+  const definition = getAdapterDefinition(adapterId);
+  if (!definition) throw new Error(`Unknown adapter: ${adapterId}`);
+
+  const adapterProvider = provider.adapter === adapterId
+    ? provider
+    : { ...provider, adapter: adapterId };
+
+  if (definition.kind === "direct") {
+    return definition.create(adapterProvider, context);
+  }
+
+  const nextVisited = new Set(visited);
+  nextVisited.add(adapterId);
+  const parent = createRegisteredAdapterById(
+    definition.extends,
+    adapterProvider,
+    context,
+    nextVisited,
+  );
+  return definition.wrap(parent, adapterProvider, context);
+}
+
+export function createRegisteredAdapter(
+  provider: OcxProviderConfig,
+  context: RegistryFactoryContext = {},
+): ProviderAdapter {
+  return createRegisteredAdapterById(provider.adapter, provider, context, new Set());
+}

src/lab/conformance/executor.ts

@@ -1,5 +1,4 @@
-import { createOpenAIChatAdapter } from "../../adapters/openai-chat";
-import { createResponsesPassthroughAdapter } from "../../adapters/openai-responses";
+import { createRegisteredAdapter } from "../../adapters/registry";
 import { bridgeToResponsesSSE, buildResponseJSON } from "../../bridge";
 import { anthropicToResponsesTranslation } from "../../claude/inbound";
 import { responsesSseToAnthropicSse } from "../../claude/outbound";
@@ -25,6 +24,14 @@ import {
 import { normalizeSseBytes } from "./sse-normalize";
 import type { CaseRecord, NormalizedObservation, ScenarioRunResult, ProtocolExecutionContextV1 } from "./types";
 
+function createOpenAIChatAdapter(provider: OcxProviderConfig) {
+  return createRegisteredAdapter({ ...provider, adapter: "openai-chat" });
+}
+
+function createResponsesPassthroughAdapter(provider: OcxProviderConfig) {
+  return createRegisteredAdapter({ ...provider, adapter: "openai-responses" });
+}
+
 export function resolveProtocolExecutionContext(caseRecord: CaseRecord): ProtocolExecutionContextV1 {
   const inbound = caseRecord.requirements.inboundProtocols[0] ?? "openai-responses";
   const upstream = caseRecord.requirements.upstreamProtocols[0] ?? "openai-chat";