[codex] add harness engineering guardrails (#284)

* refactor: add harness engineering guardrails

* fix: address harness review feedback

---------

Co-authored-by: apple <apple@appledeMacBook-Pro.local>

src/server/proxy-core/executors/types.ts

@@ -119,9 +119,13 @@ function decodeRuntimeResponseBuffer(buffer: Buffer, contentEncoding: string | n
 export async function readRuntimeResponseText(
   response: RuntimeResponse,
 ): Promise<string> {
-  const contentEncoding = response.headers.get('content-encoding');
+  const contentEncoding = typeof response.headers?.get === 'function'
+    ? response.headers.get('content-encoding')
+    : null;
   if (!hasZstdContentEncoding(contentEncoding)) {
-    return response.text().catch(() => '');
+    return typeof response.text === 'function'
+      ? response.text().catch(() => '')
+      : '';
   }
 
   const rawBuffer = Buffer.from(await response.arrayBuffer());

src/server/proxy-core/surfaces/chatSurface.ts

@@ -872,7 +872,7 @@ export async function handleClaudeCountTokensSurfaceRequest(
 
       const latency = Date.now() - startTime;
       const contentType = upstream.headers.get('content-type') || 'application/json';
-      const text = await upstream.text();
+      const text = await readRuntimeResponseText(upstream);
       let payload: unknown = text;
       try {
         payload = JSON.parse(text);

src/server/proxy-core/surfaces/sharedSurface.ts

@@ -18,6 +18,7 @@ import { buildUpstreamUrl } from '../../routes/proxy/upstreamUrl.js';
 import { recordOauthQuotaResetHint } from '../../services/oauth/quota.js';
 import { refreshOauthAccessTokenSingleflight } from '../../services/oauth/refreshSingleflight.js';
 import { proxyChannelCoordinator } from '../../services/proxyChannelCoordinator.js';
+import { readRuntimeResponseText } from '../executors/types.js';
 
 type SelectedChannel = Awaited<ReturnType<typeof tokenRouter.selectChannel>>;
 type SurfaceWarningScope = 'chat' | 'responses';
@@ -333,7 +334,8 @@ export async function trySurfaceOauthRefreshRecovery<TRequest extends BuiltEndpo
     input.ctx.request = refreshedRequest;
     input.ctx.response = refreshedResponse;
     if (input.captureFailureBody !== false) {
-      input.ctx.rawErrText = await refreshedResponse.text().catch(() => 'unknown error');
+      const failureBody = await readRuntimeResponseText(refreshedResponse).catch(() => '');
+      input.ctx.rawErrText = failureBody.trim() || 'unknown error';
     }
   } catch {
     return null;

src/server/transformers/final-hard-cut.architecture.test.ts

@@ -61,14 +61,10 @@ describe('final transformer hard-cut architecture', () => {
 
     for (const file of files) {
       const source = readFileSync(file, 'utf8');
-      expect(source).not.toContain("from '../../routes/proxy/");
-      expect(source).not.toContain("from '../routes/proxy/");
-      expect(source).not.toContain("from '../../services/oauth/");
-      expect(source).not.toContain("from '../services/oauth/");
-      expect(source).not.toContain("from '../../services/tokenRouter.js'");
-      expect(source).not.toContain("from '../services/tokenRouter.js'");
-      expect(source).not.toContain("from '../../routes/proxy/runtimeExecutor.js'");
-      expect(source).not.toContain("from '../routes/proxy/runtimeExecutor.js'");
+      expect(source).not.toMatch(/(?:^|\n)\s*(?:import|export)\s+(?:type\s+)?(?:[^'"\n]*?\s+from\s+)?['"][^'"]*routes\/proxy\//m);
+      expect(source).not.toMatch(/(?:^|\n)\s*(?:import|export)\s+(?:type\s+)?(?:[^'"\n]*?\s+from\s+)?['"][^'"]*services\/oauth\//m);
+      expect(source).not.toMatch(/(?:^|\n)\s*(?:import|export)\s+(?:type\s+)?(?:[^'"\n]*?\s+from\s+)?['"][^'"]*services\/tokenRouter\.js['"]/m);
+      expect(source).not.toMatch(/(?:^|\n)\s*(?:import|export)\s+(?:type\s+)?(?:[^'"\n]*?\s+from\s+)?['"][^'"]*routes\/proxy\/runtimeExecutor\.js['"]/m);
       expect(source).not.toContain("from 'fastify'");
     }
   });

src/server/transformers/openai/responses/routeCompatibility.ts

@@ -1,10 +1,10 @@
+import type { Response as UndiciResponse } from 'undici';
 import {
   buildMinimalJsonHeadersForCompatibility,
   isEndpointDowngradeError,
   isUnsupportedMediaTypeError,
   type CompatibilityEndpoint,
 } from '../../shared/endpointCompatibility.js';
-import type { EndpointAttemptContext, EndpointRecoverResult } from '../../../routes/proxy/endpointFlow.js';
 import {
   buildResponsesCompatibilityBodies,
   buildResponsesCompatibilityHeaderCandidates,
@@ -19,6 +19,20 @@ type CompatibilityRequest = {
   body: Record<string, unknown>;
 };
 
+type EndpointAttemptContext = {
+  request: CompatibilityRequest;
+  targetUrl: string;
+  response: UndiciResponse;
+  rawErrText: string;
+};
+
+type EndpointRecoverResult = {
+  upstream: UndiciResponse;
+  upstreamPath: string;
+  request?: CompatibilityRequest;
+  targetUrl?: string;
+} | null;
+
 type UpstreamResponse = Exclude<EndpointRecoverResult, null>['upstream'];
 
 type CreateResponsesEndpointStrategyInput = {