[luvs01]

Transferred upstream

The completed fix and regression coverage continue in lidge-jun/opencodex#8146, targeting dev, from this same branch at fdda6036e62c7ef2508ffad3a713b02997374dea. The upstream PR is ready for review and contains the current validation results and resolved source-review findings. This fork-local PR is closed as transferred; the branch remains the upstream PR's source.

---

Motivation

• Prevent a tool-choice narrowing bypass where tool_choice:{"type":"computer_use"} accepted by validation could be translated to auto on a direct Responses→Chat route and thereby leak other declared client-executed tools.

Description

• Add a post-normalization guard in src/server/responses/request-prepare.ts that calls chatCanPreserveMandatoryToolChoice and returns a 400 error when a translated OpenAI Chat destination cannot preserve a mandatory hosted selector.
• Import the helper from ./combo-required-tool-contract and run the check after applyFinalRouteRequestNormalization.
• Add a focused regression test tests/responses/responses-direct-chat-tool-choice.test.ts that exercises a computer_use selector alongside a client function tool and asserts the request is rejected and no upstream send occurs.
• Register the new test in the repository test-layout maps (scripts/test-layout/layout.json and tests/fixtures/test-layout-expected.json).

Testing

• Ran node_modules/.bin/bun test tests/responses/responses-direct-chat-tool-choice.test.ts tests/server/server-combo-required-tool-contract.test.ts and observed all tests passed (121 passed, 0 failed).
• Ran node_modules/.bin/bun run typecheck with no type errors.
• Ran node_modules/.bin/bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts and observed those tooling tests passed.
• Ran node_modules/.bin/bun run structure:check and structure SSOT checks passed.
• Note: node_modules/.bin/bun run test:changed was not runnable in this checkout because no upstream dev comparison ref was available.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes
  • Requests routed through the direct Chat interface now receive a clear 400 error when a mandatory tool choice cannot be preserved. Such requests are stopped before being sent to the upstream service, helping prevent them from proceeding with altered tool-choice behavior.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Walkthrough

Request preparation now rejects mandatory tool choices that the selected provider and model cannot preserve on normalized openai-chat routes. A regression test checks the 400 response and verifies that no upstream request is sent.

Changes: Direct Chat tool-choice validation

Layer / File(s)	Summary
Validate mandatory tool choice during request preparation src/server/responses/request-prepare.ts:71, 1442–1446, tests/responses/responses-direct-chat-tool-choice.test.ts:1–38, scripts/test-layout/layout.json:134, tests/fixtures/test-layout-expected.json:303–304	After route normalization, preparation returns a 400 invalid_request_error when an openai-chat route cannot preserve the mandatory tool choice. The regression test checks the error message and confirms that the upstream fetch is not called. The test-layout configuration and fixture assign the test to the responses group.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: lidge-jun

Merge Risk: Moderate · previous review 8f909

This change rejects direct Chat requests whose mandatory hosted tool choice cannot be preserved. Two gaps remain. A named MCP selector can still resolve to a same-named client function. In routing profiles, the new refusal can stop fallback to a compatible target. Both should be addressed before merge.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately and specifically describes the primary change: rejecting direct Responses-to-Chat routes when a mandatory hosted tool choice cannot be preserved.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: luvs01/opencodex
• Branch: codex/fix-vulnerability-in-computer&#95;use-selection
• File: .coderabbit.yaml
• Commit: 8f909f4
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 980cea0f-4f42-4b98-9f7d-d64a6ca9b07c

Commits

Reviewing files that changed from the base of the PR and between 007dbfd and 8f909f4.

Files selected for processing: 4

• scripts/test-layout/layout.json
• src/server/responses/request-prepare.ts
• tests/fixtures/test-layout-expected.json
• tests/responses/responses-direct-chat-tool-choice.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

No description provided.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Single-candidate policy returns an internal 409 for an invalid tool choice

When a policy has only an incompatible Chat candidate, this branch returns a marked 409. With no fallback candidate, the client receives policy_candidate_unavailable instead of a tool-choice 400.

Learn more

A policy candidate refusal is an in-process marker used to authorize the next policy attempt. handleResponsesWithPolicyFallback returns the original response when no further eligible candidate exists. Thus a policy with one Chat candidate exposes the internal 409, while a direct route reports a client-facing 400 for the same mandatory choice.

Example: A profile containing only chat/model receives tool_choice: {"type":"computer_use"}. No request is sent, but the client receives 409 policy_candidate_unavailable rather than 400 invalid_request_error explaining the incompatible choice.

Recommended fix: Preserve a client-facing tool-choice refusal for exhaustion in handleResponsesWithPolicyFallback, while retaining the local marker to authorize hops. Distinguish this new refusal from other existing policy candidate failures so their behavior does not change.

---

Was this helpful? React with 👍 or 👎 to provide feedback.