[WRONG BRANCH] fix(proxy): preserve foreground Luna routing

[luvs01]

Motivation

• A previous change made shadow-call interception depend only on the model slug, which caused explicit foreground turns (marked request_kind: "turn" in x-codex-turn-metadata) to be rewritten to the configured shadow provider and leak user prompts to the replacement provider.
• The intent of this change is to restore the metadata-aware decision so explicitly-identified foreground turns remain on the operator-selected provider while still intercepting maintenance, headerless, or malformed-metadata helper calls.

Description

• Reintroduced metadata-aware interception by extending shouldInterceptShadowCall to accept Headers and to return false when x-codex-turn-metadata parses to request_kind: "turn", while preserving legacy prefix behavior for headerless or malformed metadata (src/lib/shadow-call.ts).
• Passed the incoming req.headers into the decision site so the Responses handler evaluates headers before rewriting model/effort (src/server/responses/core.ts).
• Added and updated focused unit and request-path regression tests covering foreground-turn bypass, maintenance/headerless/malformed cases, non-source models, and configured sourceModels overrides (tests/responses-shadow-intercept.test.ts).
• Files changed: src/lib/shadow-call.ts, src/server/responses/core.ts, tests/responses-shadow-intercept.test.ts.

Testing

• Ran the focused regression suite with ./node_modules/.bin/bun test tests/responses-shadow-intercept.test.ts and it passed 16 tests (all green).
• Ran type checking with bun run typecheck and it completed successfully.
• Ran the repository privacy scan with ./node_modules/.bin/bun scripts/privacy-scan.ts and it passed.
• Executed the broader ./node_modules/.bin/bun scripts/test.ts suite which exercised unrelated subsystems and encountered pre-existing timeouts/failures; the focused changes and their tests remain green.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes
  • Shadow model requests now respect turn metadata when deciding whether to intercept.
  • Explicit foreground turns bypass shadow interception and continue normally.
  • Maintenance, missing-metadata, and malformed-metadata requests continue to be handled as shadow calls.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b82de7a9-1bb2-4f3f-b330-bd1e2eed94fa

📥 Commits

Reviewing files that changed from the base of the PR and between 161c09f and f428ea3.

📒 Files selected for processing (3)

• src/lib/shadow-call.ts
• src/server/responses/core.ts
• tests/responses-shadow-intercept.test.ts

---

📝 Walkthrough

Walkthrough

Shadow-call interception now receives request headers. Explicit foreground "turn" requests bypass interception, while missing, malformed, and non-"turn" metadata retain interception. Tests cover helper and request-path behavior.

Changes

Shadow-call interception

Layer / File(s)	Summary
Header-aware interception decision src/lib/shadow-call.ts, src/server/responses/core.ts, tests/responses-shadow-intercept.test.ts	shouldInterceptShadowCall parses x-codex-turn-metadata and bypasses explicit normal turns. The response handler passes req.headers. Tests cover foreground, maintenance, headerless, malformed, configured-source, and request-path behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to f428e

This PR keeps explicitly identified foreground turns on the selected provider while preserving interception for helper calls. The localized change has passing focused validation, and no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: lidge-j

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: preserving foreground Luna routing by updating shadow-call interception behavior.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-vulnerability-in-shadow-call-interception

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f428ea3e27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Distinguish Codex 0.147 helper turns before bypassing

When shadow interception is enabled with Codex 0.147, background helper requests can also carry request_kind: "turn" (the preceding implementation explicitly handled lidge-jun#1684 for this case), so this condition now returns false for both genuine foreground requests and helpers. Title, commit-message, and skill-orchestration calls therefore remain on Luna instead of using the configured low-effort replacement, regressing the opt-in feature for that client version. Use an additional foreground discriminator rather than treating request_kind alone as authoritative.

AGENTS.md reference: src/AGENTS.md:L10-L10

Useful? React with 👍 / 👎.