fix(google,kiro): strip Codex's Responses-only encrypted marker from tool schemas (#85)

Upstream openai/codex 5f4d06ef stamps encrypted:true on v2 collaboration
tool schemas (spawn_agent/send_message/followup_task message). Gemini/CCA
rejects the whole request with 400 'Unknown name'; Kiro/Bedrock validators
reject an undocumented narrow schema subset, so strip it there too.

- google-tool-schema: add encrypted to DROPPED_SCHEMA_KEYS
- kiro-tools: add encrypted to KIRO_REJECTED_SCHEMA_KEYS (property named
  'encrypted' still survives via SCHEMA_MAP_KEYS)
- regression tests: sanitizer-level, google adapter end-to-end, kiro wire

Author: lidge-jun

src/adapters/google-tool-schema.ts

@@ -4,11 +4,16 @@ type Schema = Record<string, unknown>;
 // emits full JSON-Schema (draft 2020-12) tool definitions, so passing them through verbatim makes
 // CCA reject the whole request with "Request contains an invalid argument" / "Unknown name ...".
 // Every keyword below was confirmed live against the Antigravity backend to trigger a 400.
+// `encrypted` is Codex's Responses-only marker (openai/codex 5f4d06ef, PR #26210) stamped on v2
+// collaboration tool schemas (spawn_agent/send_message/followup_task `message`); CCA rejects it
+// with 400 "Unknown name \"encrypted\"" (issue #85). It is an annotation for the ChatGPT backend
+// only, so dropping it never changes tool behavior.
 const DROPPED_SCHEMA_KEYS = new Set([
   "$schema", "$id", "$comment", "$ref", "$defs", "definitions",
   "examples", "patternProperties", "if", "then", "else",
   "uniqueItems", "additionalItems", "unevaluatedProperties", "unevaluatedItems",
   "dependentRequired", "dependentSchemas", "propertyNames", "contains",
+  "encrypted",
 ]);
 
 const MAX_DEREF_DEPTH = 64;

src/adapters/kiro-tools.ts

@@ -41,6 +41,10 @@ const KIRO_REJECTED_SCHEMA_KEYS = new Set([
   "contains",
   "unevaluatedProperties",
   "unevaluatedItems",
+  // Codex's Responses-only `encrypted: true` marker (openai/codex 5f4d06ef) stamped on v2
+  // collaboration tool schemas. Kiro/Bedrock validators reject a narrower, undocumented schema
+  // subset (issue #85 class); the marker is a ChatGPT-backend annotation with no meaning here.
+  "encrypted",
 ]);
 
 // Keys whose values are maps of *property/definition name -> schema* (not schema keywords). Their

tests/google-adapter.test.ts

@@ -83,6 +83,29 @@ describe("google adapter — tool result images", () => {
 });
 
 describe("google adapter — tool-call ids on the wire", () => {
+  test("v2 collaboration encrypted marker never reaches functionDeclarations (issue #85)", async () => {
+    // Codex Desktop v2 stamps `encrypted: true` on collaboration message properties; CCA/Gemini
+    // rejects the whole request with 400 "Unknown name". The sanitizer must strip it end-to-end.
+    const collabParams = {
+      type: "object",
+      properties: {
+        target: { type: "string", description: "Agent id." },
+        message: { type: "string", description: "Message text.", encrypted: true },
+      },
+      required: ["target", "message"],
+      additionalProperties: false,
+    };
+    const body = await geminiBody(parsedWith(
+      [{ role: "user", content: "hi" }],
+      [{ name: "followup_task", namespace: "collaboration", description: "Send follow-up", parameters: collabParams }],
+    ));
+    const decls = (body.tools as { functionDeclarations: Record<string, unknown>[] }[])[0].functionDeclarations;
+    expect(decls.length).toBe(1);
+    expect(JSON.stringify(decls)).not.toContain("encrypted");
+    const params = decls[0].parameters as { properties: Record<string, Record<string, unknown>> };
+    expect(params.properties.message.type).toBe("string");
+  });
+
   test("systemInstruction includes the non-OpenAI tool catalog nudge when tools are present", async () => {
     const body = await geminiBody(parsedWith(
       [{ role: "user", content: "find files" }],

tests/google-tool-schema.test.ts

@@ -29,6 +29,33 @@ describe("sanitizeGeminiToolParameters", () => {
     expect((props.b.items as Record<string, unknown>).type).toBe("string");
   });
 
+  test("drops Codex's Responses-only encrypted marker recursively (issue #85)", () => {
+    // Upstream codex stamps `encrypted: true` on v2 collaboration tool schemas
+    // (spawn_agent/send_message/followup_task `message`); CCA 400s on the unknown name.
+    const input = {
+      type: "object",
+      properties: {
+        message: { type: "string", description: "...", encrypted: true },
+        nested: {
+          type: "object",
+          properties: { inner: { type: "string", encrypted: false } },
+        },
+        list: { type: "array", items: { type: "string", encrypted: true } },
+      },
+      required: ["message"],
+    };
+    const before = JSON.stringify(input);
+    const out = sanitizeGeminiToolParameters(input);
+    const props = out.properties as Record<string, Record<string, unknown>>;
+    expect(props.message.encrypted).toBeUndefined();
+    expect(props.message.type).toBe("string");
+    const inner = (props.nested.properties as Record<string, Record<string, unknown>>).inner;
+    expect(inner.encrypted).toBeUndefined(); // `encrypted: false` is equally unsupported
+    expect((props.list.items as Record<string, unknown>).encrypted).toBeUndefined();
+    expect(out.required).toEqual(["message"]);
+    expect(JSON.stringify(input)).toBe(before); // input object is never mutated
+  });
+
   test("collapses type arrays to a single nullable type", () => {
     const out = sanitizeGeminiToolParameters({
       type: "object",

tests/kiro-adapter.test.ts

@@ -303,6 +303,31 @@ describe("kiro adapter — buildRequest", () => {
     expect(schema.required).toEqual(["filename", "note"]);
   });
 
+  test("Codex's Responses-only encrypted marker is stripped from v2 collaboration schemas", () => {
+    // openai/codex 5f4d06ef stamps `encrypted: true` on spawn_agent/send_message/followup_task
+    // `message` properties (issue #85 class). Kiro/Bedrock validators reject unknown keywords, and
+    // the marker only means something to the ChatGPT Responses backend.
+    const parameters = {
+      type: "object",
+      properties: {
+        target: { type: "string" },
+        message: { type: "string", description: "Message text.", encrypted: true },
+        // A property literally named "encrypted" must survive as a property.
+        encrypted: { type: "boolean" },
+      },
+      required: ["target", "message"],
+    };
+    const { body } = createKiroAdapter(provider).buildRequest(
+      parsedWith([{ role: "user", content: "hi" }], [{ name: "followup_task", namespace: "collaboration", description: "Send follow-up", parameters }]),
+    );
+    const schema = JSON.parse(body).conversationState.currentMessage.userInputMessage.userInputMessageContext.tools[0].toolSpecification.inputSchema.json;
+
+    expect(schema.properties.message.encrypted).toBeUndefined();
+    expect(schema.properties.message.type).toBe("string");
+    expect(schema.properties.encrypted).toEqual({ type: "boolean" });
+    expect(schema.required).toEqual(["target", "message"]);
+  });
+
   test("validation-only applicator keywords are dropped while $defs are preserved", () => {
     const parameters = {
       type: "object",