fix(responses): strip max_output_tokens and metadata in forward mode

[elppaaa]

Summary

The ChatGPT backend (authMode: "forward") enforces a strict parameter allowlist and rejects unknown top-level fields with HTTP 400 {"detail":"Unsupported parameter: …"}.

The stripPreviousResponseId doc-comment (line 452) already documents that the backend also rejects metadata and max_output_tokens, but only previous_response_id was actually stripped. Third-party Responses API clients (e.g. GJC, SDK wrappers) send max_output_tokens per the public OpenAI /v1/responses spec, causing every request through a forward-mode provider to fail with 400.

Codex CLI never sends these fields — it controls output length via reasoning.effort — so the strip is a no-op for the primary client. Claude Code uses the anthropic.ts adapter and is unaffected. Key-auth mode preserves both fields (the platform API supports them).

Change: add stripUnsupportedForwardParams() inside the existing if (forward) block in buildRequest(), removing both max_output_tokens and metadata before the wire request is serialized.

Verification

• bun test tests/openai-responses-passthrough.test.ts — 29/29 pass (3 new tests)
• bun run typecheck — clean
• Live reproduction: the exact request shape that returned 400 (max_output_tokens: 32000, reasoning.effort: "low", store: false) now returns HTTP 200 with response.completed through a forward-mode provider
• New tests cover: forward strips both fields, forward no-op when absent, key-auth preserves both fields

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes

  • Improved forwarding compatibility by removing unsupported max_output_tokens and metadata request parameters before submission.
  • Preserved supported request fields and ensured parameters remain unchanged when using key-based authentication.

• Tests

  • Added coverage for parameter removal, no-op behavior when fields are absent, and preservation in key-authenticated requests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f2704ee7-8279-425f-ad81-70229dde7488

📥 Commits

Reviewing files that changed from the base of the PR and between 2f3fa58 and 112b8c6.

📒 Files selected for processing (2)

• src/adapters/openai-responses.ts
• tests/openai-responses-passthrough.test.ts

---

📝 Walkthrough

Walkthrough

The Responses passthrough adapter now strips max_output_tokens and metadata from forward-mode requests. Tests cover removal, no-op behavior, and preservation of both fields in key-auth mode.

Changes

Forward request sanitization

Layer / File(s)	Summary
Forward-mode parameter sanitizer src/adapters/openai-responses.ts	Adds a helper that removes top-level max_output_tokens and metadata and applies it during forward-mode request construction.
Mode-specific request tests tests/openai-responses-passthrough.test.ts	Verifies forward-mode stripping and no-op behavior, while confirming key-auth requests preserve both fields.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• lidge-jun/opencodex#293: Modifies forward-mode request shaping by enforcing stream and store values.
• lidge-jun/opencodex#360: Modifies the same forward-mode sanitization pipeline for replay call_id repair.

Suggested reviewers: ingwannu, lidge-jun, alexanderxcmo

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: stripping max_output_tokens and metadata in Responses forward mode.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Ingwannu]

Reviewed exact head 112b8c6. The change is correctly limited to forward-mode Responses requests; persisted configuration reserves that mode for the canonical built-in ChatGPT backend, while key-auth providers retain max_output_tokens and metadata. The sanitizer is top-level only, allocation-free when absent, and covered by forward-strip/no-op/key-preserve regressions. All 29 focused tests and TypeScript typecheck pass locally. Approved pending required CI.