[ranxianglei]

Fixes #1106

What

Inverts instructionsFingerprintExempt (#1104's trust list) into instructionsFingerprintApplies — an allowlist. The instructions fingerprint now participates in the compression-session key ONLY for:

1. codex traffic — x-codex-turn-metadata present (any thread incl. root) or user-agent matches codex (Codex 集成：guardian 审批请求进入压缩管线，导致明确授权无法被识别 #150: task-level ids reused across tasks; modern subagent threads already isolate via thread-id verbatim, which bypasses this predicate)
2. claude over Responses — x-claude-code-session-id wins the header walk (Subagent first token stalls 1-2min: withSessionLock covers full forward + slow flash upstream first byte #970: subagents share the main id; the Anthropic path splits them via claudeSubagentSplit, untouched)

Everyone else keys verbatim: opencode (#1102 — now covered by the default), grok/mcode, plugin conversation lanes, generic x-session-id / body session_id (the relay-station majority, #1106). For them, instructions drift mid-id = same conversation evolved (upgrade / plugin / AGENTS.md edit), and the old default forked an orphan |sub:<fp> session resetting all compression state.

The x-bili-plugin-instructions-mutable declaration is now vestigial — hosts keep stamping it for protocol compatibility with older proxies; PLUGIN.md updated to say so.

Why an allowlist, not a config knob

Same reasoning as #1104, inverted: the fingerprint only ever defended two verified id-sharing personas (codex, claude). A generic client that shares one id across personas and separates them ONLY by instructions is not known; if one appears, it joins the allowlist with evidence (issue documents this residual risk).

Changes

• src/session-id.ts — instructionsFingerprintApplies() (codex turn-metadata header / codex UA / claude header → true; everything else false)
• src/server.ts — responses keying branch swapped to the inverse
• src/plugin.ts / PLUGIN.md — mutable-flag comment/doc updated (vestigial, protocol-stable)
• tests/responses-instructions-drift.test.ts — unit tests rewritten for the allowlist; new e2e: generic relay client + instructions drift → ONE session (the Responses instructions fingerprint should be an allowlist (codex/claude only), not a default — generic relay clients fork on every system-prompt change #1106 regression), plugin lane without the mutable flag → ONE session (flag no longer required); kept the [Bug] opencode system-context reconcile：每次 AGENTS.md 编辑使 Responses 会话 key 里的 instructions 指纹漂移，压缩状态被重置（master 现存） #1102 opencode e2e unchanged
• tests/subagent-namespace.test.ts — Codex 集成：guardian 审批请求进入压缩管线，导致明确授权无法被识别 #150 guardian e2e now sends a codex user-agent (metadata-less codex_cli_rs/0.146.0, matching the real client); asserts the split still fires for codex

Pre-flight

• npm run typecheck ✅
• npm test ✅ 2172 pass / 0 fail (2 pre-existing E2E skips)
• npm run build ✅

Review note

This flips a default on the identity path (wire/session keying, both modes reasoned) — per repo policy it stays human-merge.

[github-actions]

📦 Built Package Artifact

Branch: 2026-09-22_fingerprint-allowlist (a5d9173)

Option A — Install from npm PR tag (recommended)

npm install -g billion-context@pr-1107

Each push to this PR publishes a new version under the pr-1107 npm tag.

Option B — Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf billion-context-pr1107.tgz
npm install -g package

---

Install instructions are refreshed on each push.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 Reviewed this PR (it's already-open work, not redoing it). Findings so far:

Code review — logic verified correct

• src/session-id.ts instructionsFingerprintApplies(): true iff x-codex-turn-metadata present (non-empty) or user-agent matches /codex/i or the winning conversation header is x-claude-code-session-id; false for everything else. Inversion of the fix(responses): keep persona-scoped sessions stable across instruction drift #1104 trust list is faithful — the two defended personas (codex Codex 集成：guardian 审批请求进入压缩管线，导致明确授权无法被识别 #150, claude-over-Responses Subagent first token stalls 1-2min: withSessionLock covers full forward + slow flash upstream first byte #970) map exactly onto the allowlist entries.
• src/server.ts:1348 branch swap is the exact inverse of the old exempt ? verbatim : fingerprinted chain; both compression modes reasoned (keying happens identically in plugin and proxy mode — plugin lanes key verbatim via x-bili-plugin-conversation, which is correct since the agent owns compression there).
• Codex path checked end-to-end: modern subagent threads key by thread-id verbatim through codexTurnIdentity (bypasses the predicate, as claimed); root threads (thread_source: "user" → undefined) and unparseable/malformed metadata fall through to the legacy chain and still hit the allowlist via the turn-metadata header; older builds are caught by the UA. The Codex 集成：guardian 审批请求进入压缩管线，导致明确授权无法被识别 #150 guardian e2e in tests/subagent-namespace.test.ts now sends codex_cli_rs/0.146.0 (metadata-less), so the split assertion genuinely exercises the allowlist instead of riding the old default — good catch, that test would have silently passed under an over-inverted predicate without it.
• No stale references to instructionsFingerprintExempt remain anywhere (grep clean across src/ + tests/).
• Residual risk is honestly documented in both the issue body and the code comment (an unknown client sharing one id across personas, separated only by instructions, would now merge instead of fork; the /codex/i UA heuristic could match a non-codex client whose UA contains "codex" — conservative direction, keeps isolation). Accepted as-is: same evidence-per-client discipline as fix(responses): keep persona-scoped sessions stable across instruction drift #1104, inverted.

Diff hygiene — clean: 6 files, every line on-purpose, no whitespace churn, no version bump, no generated/lock-file noise.

Rebase + local gate on current master — the branch was behind by the persist-zstd merge (#1083). I rebased it onto baf6a53 (clean, zero file overlap) and re-ran the full gate locally on the rebased head ed38270:

• npm run typecheck ✅
• npm test ✅ 2189 pass / 0 fail / 2 skipped (the pre-existing E2E skips; count is higher than the PR body's 2172 because master gained tests after the branch point — persist-zstd suite)
• npm run build ✅

Rebased head pushed to the PR branch (f68cb23 → ed38270, force-with-lease on the feature branch only).

CI — original head f68cb23: all 8 checks green (ubuntu/windows × node 22/24, version-guard, build-artifact, fake-codex e2e). CI on the rebased head ed38270 is running now — I'll confirm the final state in a follow-up comment.

Per repo policy (§7.4) this flips a default on the identity/session-keying path, so it stays human-merge regardless of gate results.

中文摘要:审核通过——instructions 指纹从豁免清单反转为 codex/claude 白名单的逻辑正确、diff 干净,已 rebase 到最新 master 并本地全量复验(typecheck/test/build 全绿),等 rebase 后 CI 跑完即可合并。

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 CI now fully green on the rebased head (ed38270): all 8 checks pass — test ubuntu/windows × node 22/24, version-guard, build-artifact, zero-token fake-codex e2e, CODEX_HOME-overlay check. No further changes needed from the review; nothing was found that requires a code fix in this round.

Two notes for whoever merges:

• mergeable_state: blocked — this is branch protection asking for a human review/approval, not a failing check. Per repo policy (§7.4) this flips an identity-path default so it stays human-merge regardless: fix: invert the Responses instructions fingerprint into a codex/claude-only allowlist #1107
• Hot-file contention: six other open PRs (feat: content-addressed message store + acp_retrieve (built-in CCR) #1099, feat: output-side compression (verbosity steering + effort routing) #1096, feat: stable head-system anchor for prefix-cache preservation (#1085) #1092, fix: chain-detection content fallback exempts this instance's own sessions (#1086) #1090, feat: session-file GC — sweep stale small state files (#1082) #1084, fix: resolve audited defects from #1064 #1072) also touch src/server.ts. None touch src/session-id.ts, so there's no direct semantic clash with this PR's core change, but if any of them lands first, rebase this onto the new master before merging (the keying branch at src/server.ts:1348 is a small region, but the file is heavily contended).

中文摘要：rebase 到最新 master 后本地与 CI 全绿（typecheck / 2189 tests / build / 8 项 CI），代码审查无遗留问题，等待人工 review + 合并即可。