fix: always replace reasoning.encrypted with skip_thought_signature_validator for Gemini

[daniel-lxs]

Summary

Fix "Thought signature is not valid" error for Gemini 3 models via OpenRouter.

PostHog Error: https://us.posthog.com/project/135196/error_tracking/019bc2a3-6975-7fb2-b140-c06babfb57ae

Problem

Users were encountering ApiProviderError: "Unable to submit request because Thought signature is not valid" when using Gemini 3 models (like google/gemini-3-flash-preview) via OpenRouter with native tool protocol.

Root Cause

The OpenRouter handler was only injecting skip_thought_signature_validator when NO existing reasoning.encrypted blocks were present. However, signatures from previous API sessions are always invalid - they're tied to the specific session that generated them.

When conversation history contained old reasoning.encrypted blocks from a previous Gemini response, the code skipped injection and sent the old (invalid) signature to Gemini, causing the 400 error.

Solution

Changed the logic in openrouter.ts to always replace existing reasoning.encrypted blocks with skip_thought_signature_validator instead of only injecting when missing:

// Filter out any existing reasoning.encrypted blocks - they have invalid signatures
const filteredDetails = existingDetails?.filter((d) => d.type !== "reasoning.encrypted") ?? []
// Always inject fresh skip_thought_signature_validator
return { ...msg, reasoning_details: [...filteredDetails, fakeEncrypted] }

Related

• Similar issue in Cline: Gemini 3.0 Pro Preview returns 400 INVALID_ARGUMENT error when used via OpenRouter or Cline account cline/cline#7551
• Google thought signatures doc: https://ai.google.dev/gemini-api/docs/thought-signatures#faqs
• Cline fix PR: fix: handle invalid signature fields for Anthropic and Gemini providers [ENG-1349] cline/cline#8122

Tests Added

4 new tests covering:

1. Injecting skip_thought_signature_validator for Gemini with tool_calls history
2. Replacing existing invalid signatures with the skip validator
3. Preserving non-encrypted reasoning_details while replacing encrypted ones
4. Not injecting for non-Gemini models

---

Closes COM-493

---

Important

Fixes invalid thought signature errors in Gemini 3 models by replacing reasoning.encrypted with skip_thought_signature_validator.

• Behavior:
  • In openrouter.ts, always replace reasoning.encrypted with skip_thought_signature_validator for Gemini models to prevent invalid signature errors.
  • Handles cases with existing reasoning.encrypted blocks, ensuring they are replaced.
  • Preserves non-encrypted reasoning_details while replacing encrypted ones.
  • Does not inject for non-Gemini models.
• Tests:
  • Added tests in openrouter.spec.ts for injecting skip_thought_signature_validator with tool_calls history.
  • Tests for replacing existing invalid signatures and preserving non-encrypted details.
  • Tests to ensure no injection for non-Gemini models.

^{This description was created by for 7059bdb. You can customize this summary. It will automatically update as commits are pushed.}

[roomote]

Rooviewer   See task on Roo Cloud

Review complete. No issues found.

The fix correctly addresses the root cause of the "Thought signature is not valid" error for Gemini 3 models by always replacing existing reasoning.encrypted blocks with skip_thought_signature_validator instead of only injecting when missing. Tests are comprehensive and all pass.

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}