fix(routing): bound reasoning-effort trace hydration

[luvs01]

Summary

• inspect at most the first eight persisted reasoningEfforts values during route-trace hydration;
• materialize that retained prefix densely so sparse arrays are rejected instead of preserving holes;
• apply string-length checks and normalization only to the bounded retained prefix;
• add regressions for a million-entry array with a throwing discarded getter and for sparse retained input.

Why

parseCapability() previously validated raw.reasoningEfforts.slice(0, 8) but then called some() on the original array before slicing again. A large hand-edited or persisted trace row could therefore force an unbounded scan even though the normalized trace retains only eight values.

A simple slice() replacement is not sufficient because JavaScript preserves sparse holes and every()/map() skip them. The bounded prefix is now copied through explicit indexed reads, producing undefined for a hole so validation fails closed.

Verification

• Bun 1.3.14: tests/route-decision-trace.test.ts 22/22 passed.
• Bun 1.4.0-canary.1 (b22e0e6d0): the same suite 22/22 passed.
• bun x tsc --noEmit: passed.
• bun scripts/privacy-scan.ts: passed.
• git diff --check: passed.

Checklist

• Scope stays within trace hydration and its focused tests.
• Oversized and sparse persisted input are both covered.
• No routing selection or user-facing configuration semantics change.

Ready for review; upstream CI and maintainer review remain pending.

Summary by CodeRabbit

• Bug Fixes

  • Improved trace data normalization for reasoning effort values.
  • Limited processing to the first eight entries and consistently handled overly long strings.
  • Correctly handled sparse reasoning effort arrays without retaining invalid data.
  • Prevented inspection of entries beyond the retained limit, improving consistency and reliability.

• Tests

  • Added coverage for bounded processing, string truncation, and sparse array handling.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

📝 Walkthrough

Walkthrough

parseCapability limits reasoningEfforts processing to eight entries, validates retained values, truncates long strings, and records truncation. Tests cover bounded access and sparse arrays.

Changes

Trace capability normalization

Layer / File(s)	Summary
Bounded reasoning-effort validation src/routing/trace.ts, tests/route-decision-trace.test.ts	parseCapability copies at most eight reasoningEfforts entries before validation. It retains only dense string values, truncates oversized strings, and records truncation. Tests verify that entries beyond the retained range are not read and that sparse arrays are omitted.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• lidge-jun/opencodex#1003: Both changes update src/routing/trace.ts and parseCapability reasoning-effort normalization.

Suggested reviewers: lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: bounding reasoning-effort trace hydration during routing.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/route-decision-trace.test.ts`:
- Around line 229-231: Update the throwing getter in the reasoningEfforts
boundary test to target index 8 instead of the final index, while preserving the
million-entry length, so any inspection beyond the eight retained entries fails
immediately.
- Around line 274-275: Update the test around normalizeRouteDecisionTrace to
first capture its result, assert that normalization succeeds and retains exactly
one candidate, then assert that the candidate capability’s reasoningEfforts is
undefined. Avoid optional chaining in the omission assertion so the test cannot
pass when the trace or candidate is missing.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 59dd0bd9-26cd-4d22-bb63-f8447d6480f7

📥 Commits

Reviewing files that changed from the base of the PR and between d55b903 and 4240da3.

📒 Files selected for processing (2)

• src/routing/trace.ts
• tests/route-decision-trace.test.ts

[Ingwannu]

The implementation is directionally correct, but the regression test does not prove the 8-item read bound. Its throwing getter is installed at index 999,999, so an implementation that accidentally inspects indices 8 through 999,998 would still pass. Please install the throwing getter at index 8 (the first excluded element). Also assert that normalization succeeded and preserved the expected candidate count before checking the capability, and avoid optional chaining in the sparse-case omission assertion; otherwise an unrelated normalization failure can satisfy toBeUndefined(). The current head also has a failing test 3/4 CI job, so this is not ready to approve yet.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/route-decision-trace.test.ts`:
- Around line 226-251: Extend the test “normalization only inspects retained
reasoning efforts” with an overlong string at one of the retained indices (0–7),
then assert normalization caps that string and sets the expected trace
truncation metadata. Keep the existing out-of-range getter and eight-entry
boundary assertions intact.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 57d16d06-3692-4b06-90a7-480878dc70f9

📥 Commits

Reviewing files that changed from the base of the PR and between 4240da3 and 6668711.

📒 Files selected for processing (1)

• tests/route-decision-trace.test.ts

[Ingwannu]

Re-reviewed exact head 66687114. The prior request is fully addressed: the throwing getter is now at index 8 (the first excluded element), and the sparse-array omission test proves normalization succeeded and retained one candidate before asserting the field is absent. The PR diff is again limited to the routing trace implementation and its regression file. Exact-head focused tests passed locally (22/22), typecheck passed, and git diff --check passed. Remote workflow execution has been approved but is still pending; do not merge until exact-head CI is green.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.