[lidge-jun]

Summary

• Carry the remaining native Messages combo behavior from feat(protocols): native Anthropic Messages support for combos #8043: strict failover combos can send eligible key-auth requests to configured Anthropic-compatible endpoints without losing native request fields and cache markers.
• Preserve first-party-only OAuth, provider scope, effort and representability gates, and pre-send rejection when opaque state cannot be safely forwarded. Existing combo alias pin semantics remain unchanged.
• fix(combo): stop the prompt-cache usage leak — replay native Messages on Anthropic children #7374 already delivered the first-party native combo replay foundation; this carries the compatible key-auth endpoint extension.

Verification

• Isolated synthetic upstreams: bun test tests/claude-integration/messages-native-combo.test.ts tests/claude-integration/messages-native-combo-framing.test.ts tests/responses/protocol-envelope.test.ts — 107 pass, 0 fail.
• The real HTTP regression failed on the base because the bridge dropped top_k and changed the cache prefix; it passed after this change. Builder also ran four Messages suites: 178 pass, 0 fail.
• Builder reports typecheck, privacy, structure, layout/ratchet and docs-site build passed on aeed268bd0334a62289a9e6eb9f0da6d9b7a1d19. Fresh independent technical and security reviews passed on that commit; the security reviewer ran 246 focused synthetic tests.
• Full local suite, completed test:changed, native Windows execution and real-provider/cache-hit verification were not run. CI remains separate evidence.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: Andrew Wang andrewwangmail@gmail.com

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T18:23:59.175211Z	aeed268	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[lidge-jun]

Maintainer judgment — aeed268bd0334a62289a9e6eb9f0da6d9b7a1d19

• Value: This carries the compatible key-auth endpoint extension from feat(protocols): native Anthropic Messages support for combos #8043. fix(combo): stop the prompt-cache usage leak — replay native Messages on Anthropic children #7374 already provides the first-party native combo foundation; the extension preserves native Messages fields and cache markers for eligible compatible providers.
• UX: Native forwarding for configured compatible key-auth children is intentional and documented. Existing combo strategy and global pin semantics remain unchanged; OAuth remains first-party-only.
• Existing users: The synthetic HTTP regression failed on the base when the bridge dropped top_k and changed the cache prefix, and passed on this head. I ran the native combo, framing and protocol-envelope suites in an isolated home: 107 pass, 0 fail. The builder also ran focused suites and the typecheck, privacy, structure, layout/ratchet and docs build gates. Fresh independent technical and security/privacy reviews passed on this exact commit. Real-provider cache behavior and a completed test:changed run were not established.
• Windows: No Windows-specific implementation was added; native Windows was not tested. The path is shared TypeScript, so cross-platform behavior is covered only by the synthetic tests and later batch CI.
• Prior maintainer objections: The copy-budget and default-effort/JEV representability concerns in feat(protocols): native Anthropic Messages support for combos #8043 apply to the existing native combo foundation. That foundation is present from fix(combo): stop the prompt-cache usage leak — replay native Messages on Anthropic children #7374; this head retains eligibility-before-copy and strict failover/default-effort/JEV guards. The native-combo suite includes budget, reject-policy and no-send coverage; this carry does not broaden combo strategies or pin semantics.
• CI: Exact-head event and workflow checks are pending and are not claimed as passing. No change-caused exact-head CI failure is known. The full local suite and live provider tests were not run.