fix(identity): name the worker's own model when a sub-agent is spawned

src/adapters/identity.ts

@@ -72,11 +72,107 @@ function safeRoutedModelIdentity(modelName: string): string | null {
  * native template.
  */
 export function identifyRoutedModel(systemText: string, modelName: string): string {
+  const replacement = routedIdentityLine(modelName);
+  return systemText
+    .replace(CODEX_GPT5_IDENTITY_RE, () => replacement)
+    .replace(NEUTRAL_IDENTITY_RE, () => replacement)
+    .replace(ROUTED_IDENTITY_RE, () => replacement);
+}
+
+function routedIdentityLine(modelName: string): string {
   const identity = safeRoutedModelIdentity(modelName);
-  const replacement = identity
+  return identity
     ? `You are a coding agent powered by the ${identity}. If asked which model you are, identify as ${identity}. Do not claim to be a different model or to have a different creator.`
     : "You are a coding agent powered by the configured model. If asked which model you are, identify as configured model. Do not claim to be GPT-5 or made by OpenAI.";
-  return systemText.replace(CODEX_GPT5_IDENTITY_RE, () => replacement);
+}
+
+/**
+ * This proxy's OWN generated identity sentence (both the named and the `configured model`
+ * fallback form). Codex stores a session's instructions once and replays them verbatim when it
+ * spawns a sub-agent on a DIFFERENT model (#5217), so a worker inherits the parent's sentence and
+ * then answers identity questions with the parent's model id.
+ *
+ * The pattern is deliberately anchored on the exact wording this module emits — the leading
+ * "You are a coding agent powered by the " and the matching "If asked which model you are,
+ * identify as " clause — so it can only ever rewrite text the proxy generated. The model id is
+ * matched with the same character class `safeRoutedModelIdentity` allows, never `.*`, so user
+ * prose, fenced code and provider-native identity blocks are out of reach.
+ */
+const ROUTED_IDENTITY_RE =
+  /You are a coding agent powered by the (?:configured model|[A-Za-z0-9._/@:+\-[\]~]+)\. If asked which model you are, identify as (?:configured model|[A-Za-z0-9._/@:+\-[\]~]+)\. Do not claim to be (?:a different model or to have a different creator|GPT-5 or made by OpenAI)\./g;
+
+/**
+ * The model-neutral catalog line. Since #5217 the catalog no longer bakes a model id into
+ * `base_instructions` — a stored instruction block is replayed to sub-agents on other models —
+ * so the id is written at request time instead, where the destination is known.
+ */
+const NEUTRAL_IDENTITY_RE = new RegExp(
+  NEUTRAL_IDENTITY_LINE.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"),
+  "g",
+);
+
+/** True when `text` carries an identity sentence this proxy generated. */
+export function hasRoutedIdentity(text: string): boolean {
+  ROUTED_IDENTITY_RE.lastIndex = 0;
+  return ROUTED_IDENTITY_RE.test(text);
+}
+
+/**
+ * Request-time repair for a routed destination: rewrite an inherited identity sentence so it names
+ * the model this request is actually sent to. Text without one is returned unchanged.
+ */
+export function repairRoutedIdentity(text: string, modelName: string): string {
+  const replacement = routedIdentityLine(modelName);
+  return text.replace(ROUTED_IDENTITY_RE, () => replacement);
+}
+
+/** Apply `repair` to the developer/system text of a Responses request body, in place of nothing. */
+export function repairIdentityInResponsesBody(body: unknown, repair: (text: string) => string): unknown {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
+  const record = body as Record<string, unknown>;
+  let changed = false;
+  const mapText = (text: string): string => {
+    if (!hasRoutedIdentity(text)) return text;
+    const next = repair(text);
+    if (next !== text) changed = true;
+    return next;
+  };
+  const instructions = typeof record.instructions === "string" ? mapText(record.instructions) : record.instructions;
+  const input = Array.isArray(record.input)
+    ? record.input.map((item: unknown) => {
+      if (!item || typeof item !== "object" || Array.isArray(item)) return item;
+      const message = item as Record<string, unknown>;
+      if (message.type !== undefined && message.type !== "message") return item;
+      if (message.role !== "developer" && message.role !== "system") return item;
+      if (typeof message.content === "string") {
+        const next = mapText(message.content);
+        return next === message.content ? item : { ...message, content: next };
+      }
+      if (!Array.isArray(message.content)) return item;
+      let partChanged = false;
+      const content = message.content.map((part: unknown) => {
+        if (!part || typeof part !== "object" || Array.isArray(part)) return part;
+        const record = part as Record<string, unknown>;
+        if (typeof record.text !== "string") return part;
+        const next = mapText(record.text);
+        if (next === record.text) return part;
+        partChanged = true;
+        return { ...record, text: next };
+      });
+      return partChanged ? { ...message, content } : item;
+    })
+    : record.input;
+  return changed ? { ...record, ...(instructions !== undefined ? { instructions } : {}), input } : body;
+}
+
+/**
+ * Request-time repair for a native (Codex/OpenAI) destination: drop an inherited routed identity
+ * sentence instead of rewriting it. A native worker keeps Codex's own identity wording, which the
+ * client already sends in its `model_switch` block; re-stating a routed sentence there would tell
+ * a first-party model it is some third-party model.
+ */
+export function stripRoutedIdentity(text: string): string {
+  return text.replace(ROUTED_IDENTITY_RE, () => "").replace(/\n{3,}/g, "\n\n").trim();
 }
 
 /** The catalog (static, on-disk) replacement for `base_instructions`. Same neutral wording. */

src/adapters/openai-responses/passthrough.ts

@@ -1,4 +1,5 @@
 import { normalizeRoutedAgentMessages } from "../routed-agent-messages";
+import { repairIdentityInResponsesBody, repairRoutedIdentity, stripRoutedIdentity } from "../identity";
 import { stripBracketedModelSuffix } from "../openai-chat";
 import { normalizeOpenCodeGoAdditionalTools } from "../opencode-go-additional-tools";
 import { isXaiResponsesDestination } from "../../providers/xai-transport";
@@ -267,6 +268,16 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       if (!forward) outBody = normalizeRoutedAgentMessages(outBody, {
         allowStringContent: isXaiResponsesDestination(provider),
       });
+      // #5217: a sub-agent inherits the parent session's instruction block, so the identity
+      // sentence this proxy generated for the PARENT's model rides along to a worker running a
+      // different one. On a routed destination it is rewritten to name that destination; on a
+      // native/forward destination it is dropped, because Codex's own identity wording (sent in
+      // the client's model_switch block) is the correct one there. Text the proxy did not
+      // generate — user turns, tool output, fenced code, provider-native blocks — is untouched.
+      outBody = repairIdentityInResponsesBody(
+        outBody,
+        forward ? stripRoutedIdentity : (text: string) => repairRoutedIdentity(text, parsed.modelId),
+      );
       outBody = mapRoutedResponsesReasoningEffort(outBody, provider, parsed.modelId);
       // stripPreviousResponseId() intentionally returns its input on a no-op. Detach before the
       // tier write so a force-fast/default decision can never mutate parsed._rawBody.

src/codex/catalog/derive-entry.ts

@@ -1,6 +1,6 @@
 import type { OcxConfig } from "../../types";
 import { effectiveProviderAlias } from "../../providers/default-aliases";
-import { identifyRoutedModel } from "../../adapters/identity";
+import { neutralizeIdentity } from "../../adapters/identity";
 import { COMBO_NAMESPACE } from "../../combos";
 import {
   CODEX_CUSTOM_MODEL_CATALOG_KIND,
@@ -145,13 +145,13 @@ export function deriveEntry(
         delete e.max_context_window;
         delete e.auto_compact_token_limit;
       }
-      // Native id for identity text + metadata lookups — the slug may be an encoded
-      // alias (`provider/vendor-model`); the model object carries the native id.
-      const modelName = model?.id ?? slug.slice(slug.indexOf("/") + 1);
       if (typeof e.base_instructions === "string") {
         // Proxy-neutral: keep the GPT-5/OpenAI disclaimer but never advertise the opencodex proxy
         // (leaking that into base_instructions is a non-first-party signature → ToS risk).
-        e.base_instructions = identifyRoutedModel(e.base_instructions, modelName);
+        // Model-neutral on disk (#5217): Codex stores this block as the session's instructions and
+        // replays it verbatim into a sub-agent spawned on a DIFFERENT model, so a baked-in model id
+        // follows the worker and misnames it. The destination id is written at request time instead.
+        e.base_instructions = neutralizeIdentity(e.base_instructions);
       }
       applyReasoningLevels(
         e,

src/codex/catalog/metadata.ts

@@ -16,7 +16,7 @@ import { getProviderRegistryEntry, providerCodexAccountMode } from "../../provid
 import { applyProviderContextCap, providerContextCap } from "../../providers/context-cap";
 import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { routedSlug, slugEquals, slugsEquivalent } from "../../providers/slug-codec";
-import { identifyRoutedModel } from "../../adapters/identity";
+import { neutralizeIdentity } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
@@ -550,14 +550,14 @@ function upstreamNativeEntryForSlug(slug: string): RawEntry | undefined {
   alias.display_name = presentation.displayName;
   alias.description = presentation.description;
   if (typeof alias.base_instructions === "string") {
-    alias.base_instructions = identifyRoutedModel(alias.base_instructions, slug);
+    alias.base_instructions = neutralizeIdentity(alias.base_instructions);
   }
   if (alias.model_messages && typeof alias.model_messages === "object" && !Array.isArray(alias.model_messages)) {
     const modelMessages = alias.model_messages as Record<string, unknown>;
     if (typeof modelMessages.instructions_template === "string") {
       alias.model_messages = {
         ...modelMessages,
-        instructions_template: identifyRoutedModel(modelMessages.instructions_template, slug),
+        instructions_template: neutralizeIdentity(modelMessages.instructions_template),
       };
     }
   }

src/responses/parser.ts

@@ -18,6 +18,7 @@ import { lookupReplayThoughtSignature } from "./thought-signature-replay";
 import { compactionItemToText, isCompactionItemType } from "./compaction";
 import { previousResponseReplayPrefixLength } from "./state";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
+import { hasRoutedIdentity, repairRoutedIdentity } from "../adapters/identity";
 import { extractHostedWebSearch, WEB_SEARCH_TOOL_NAME } from "../web-search/synthetic-tool";
 import { buildImageTool, extractHostedImageGeneration, IMAGE_GEN_TOOL_NAME } from "../images/synthetic-tool";
 import { toolSearchDescription, toolSearchParameters } from "./tool-search-compat";
@@ -95,6 +96,27 @@ function attachPendingReasoningToCallOwner(
 const REASONING_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max"]);
 
 
+/**
+ * Rewrite an inherited routed-identity sentence in a developer item so it names the model this
+ * request is destined for. Returns the input unchanged when no such sentence is present, which is
+ * every request that has not gone through a sub-agent spawn.
+ */
+function repairDeveloperIdentity(
+  content: string | OcxContentPart[],
+  modelId: string,
+): string | OcxContentPart[] {
+  if (typeof content === "string") {
+    return hasRoutedIdentity(content) ? repairRoutedIdentity(content, modelId) : content;
+  }
+  let changed = false;
+  const parts = content.map((part) => {
+    if (part.type !== "text" || !hasRoutedIdentity(part.text)) return part;
+    changed = true;
+    return { ...part, text: repairRoutedIdentity(part.text, modelId) };
+  });
+  return changed ? parts : content;
+}
+
 export function parseRequest(
   body: unknown,
   parseOptions?: { replayCacheScope?: OcxReasoningReplayScopeRef },
@@ -253,7 +275,15 @@ export function parseRequest(
           case "developer": {
             pendingReasoning.length = 0;
             const content = inputContentParts(msg.content);
-            messages.push({ role: msg.role, content, timestamp: now });
+            messages.push({
+              role: msg.role,
+              // #5217: Codex replays the PARENT session's instruction block as the worker's
+              // developer message, so a sub-agent on another model inherits an identity sentence
+              // naming the parent. Only this proxy's own sentence is rewritten, and only on a
+              // developer item; user turns are the caller's content and stay byte-identical.
+              content: msg.role === "developer" ? repairDeveloperIdentity(content, data.model) : content,
+              timestamp: now,
+            });
             break;
           }
           case "assistant": {

tests/adapters/identity-subagent.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, test } from "bun:test";
+import {
+  identifyRoutedModel,
+  NEUTRAL_IDENTITY_LINE,
+  repairIdentityInResponsesBody,
+  repairRoutedIdentity,
+  stripRoutedIdentity,
+} from "../../src/adapters/identity";
+import { createOpenAIChatAdapter } from "../../src/adapters/openai-chat";
+import { parseRequest } from "../../src/responses/parser";
+import type { OcxProviderConfig, OcxTextContent } from "../../src/types";
+
+/** The sentence the proxy generated for the PARENT session, which a spawned worker inherits (#5217). */
+const PARENT_IDENTITY = "You are a coding agent powered by the deepseek-v4.1-flash. If asked which model you are, identify as deepseek-v4.1-flash. Do not claim to be a different model or to have a different creator.";
+
+const WORKER_MODEL = "gpt-6-astra";
+
+function developerItem(text: string) {
+  return { type: "message", role: "developer", content: [{ type: "input_text", text }] };
+}
+
+describe("sub-agent identity inheritance (#5217)", () => {
+  test("a stale routed identity sentence is rewritten to the destination model", () => {
+    const out = repairRoutedIdentity(`${PARENT_IDENTITY}\n\nUse tools carefully.`, WORKER_MODEL);
+    expect(out).toContain(`identify as ${WORKER_MODEL}`);
+    expect(out).not.toContain("deepseek-v4.1-flash");
+    expect(out).toContain("Use tools carefully.");
+  });
+
+  test("identifyRoutedModel also repairs a stale sentence and the neutral catalog line", () => {
+    expect(identifyRoutedModel(PARENT_IDENTITY, WORKER_MODEL)).toContain(`identify as ${WORKER_MODEL}`);
+    expect(identifyRoutedModel(NEUTRAL_IDENTITY_LINE, WORKER_MODEL)).toContain(`identify as ${WORKER_MODEL}`);
+  });
+
+  test("a native destination drops the routed sentence instead of renaming it", () => {
+    const out = stripRoutedIdentity(`${PARENT_IDENTITY}\n\nYou and the user share one workspace.`);
+    expect(out).not.toContain("powered by the");
+    expect(out).not.toContain("deepseek-v4.1-flash");
+    expect(out).toBe("You and the user share one workspace.");
+  });
+
+  test("text the proxy did not generate is never rewritten", () => {
+    for (const text of [
+      "The user asked: which model are you?",
+      "```\nYou are a coding agent powered by the thing I wrote myself.\n```",
+      "You are a Claude agent built by Anthropic.",
+    ]) {
+      expect(repairRoutedIdentity(text, WORKER_MODEL)).toBe(text);
+      expect(stripRoutedIdentity(text)).toBe(text.trim());
+    }
+  });
+
+  test("the parser repairs the worker's developer item and leaves user turns alone", () => {
+    const parsed = parseRequest({
+      model: WORKER_MODEL,
+      input: [
+        developerItem(PARENT_IDENTITY),
+        { type: "message", role: "user", content: [{ type: "input_text", text: PARENT_IDENTITY }] },
+      ],
+    });
+    const [developer, user] = parsed.context.messages;
+    const textOf = (content: unknown): string => (typeof content === "string"
+      ? content
+      : (content as OcxTextContent[]).map(part => part.text).join(""));
+    expect(textOf(developer!.content)).toContain(`identify as ${WORKER_MODEL}`);
+    expect(textOf(developer!.content)).not.toContain("deepseek-v4.1-flash");
+    // A user turn is the caller's own content; it stays byte-identical.
+    expect(textOf(user!.content)).toBe(PARENT_IDENTITY);
+  });
+
+  test("a routed chat destination sends the worker's own model in the system message", async () => {
+    const provider = {
+      adapter: "openai-chat",
+      baseUrl: "https://api.example.invalid",
+      apiKey: "key",
+    } as unknown as OcxProviderConfig;
+    const parsed = parseRequest({
+      model: "some/routed-worker",
+      input: [
+        developerItem(PARENT_IDENTITY),
+        { type: "message", role: "user", content: [{ type: "input_text", text: "hi" }] },
+      ],
+    });
+    const { body } = await createOpenAIChatAdapter(provider).buildRequest(parsed);
+    const system = (JSON.parse(body).messages as { role: string; content: string }[])
+      .find(message => message.role === "system")!;
+    expect(system.content).toContain("identify as some/routed-worker");
+    expect(system.content).not.toContain("deepseek-v4.1-flash");
+  });
+
+  test("the Responses body repair covers instructions and developer items only", () => {
+    const body = {
+      model: WORKER_MODEL,
+      instructions: PARENT_IDENTITY,
+      input: [
+        developerItem(PARENT_IDENTITY),
+        { type: "message", role: "user", content: [{ type: "input_text", text: PARENT_IDENTITY }] },
+      ],
+    };
+    const routed = repairIdentityInResponsesBody(body, text => repairRoutedIdentity(text, WORKER_MODEL)) as typeof body;
+    expect(routed.instructions).toContain(`identify as ${WORKER_MODEL}`);
+    expect((routed.input[0]!.content as { text: string }[])[0]!.text).toContain(`identify as ${WORKER_MODEL}`);
+    expect((routed.input[1]!.content as { text: string }[])[0]!.text).toBe(PARENT_IDENTITY);
+
+    const native = repairIdentityInResponsesBody(body, stripRoutedIdentity) as typeof body;
+    expect(native.instructions).toBe("");
+    expect((native.input[0]!.content as { text: string }[])[0]!.text).toBe("");
+  });
+
+  test("a body with no proxy identity is returned unchanged", () => {
+    const body = { model: WORKER_MODEL, input: [developerItem("plain instructions")] };
+    expect(repairIdentityInResponsesBody(body, text => repairRoutedIdentity(text, WORKER_MODEL))).toBe(body);
+  });
+});

tests/codex-integration/codex-catalog-sync-hardening.test.ts

@@ -6,6 +6,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../src/codex/catalog/native-models";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { NEUTRAL_IDENTITY_LINE } from "../../src/adapters/identity";
 
 const repoRoot = dirname(fileURLToPath(new URL("../../package.json", import.meta.url)));
 
@@ -643,7 +644,8 @@ describe("Codex catalog sync hardening", () => {
       multi_agent_version: "v2",
       opencodex_catalog_kind: "custom-model-v1",
     });
-    expect(daybreak?.base_instructions).toContain("powered by the gpt-daybreak-blue-latest");
+    expect(daybreak?.base_instructions).toContain(NEUTRAL_IDENTITY_LINE);
+    expect(daybreak?.base_instructions).not.toContain("powered by the");
     // The explicit custom row is independent of native account entitlement. With no confirmed
     // account roster, the account-gated bare row stays absent instead of collapsing into it.
     expect(rows.filter(row => row.slug === "gpt-daybreak-blue-latest")).toHaveLength(0);