[jacek4yang]

Implements POST /v1/responses so Grok Build (api_backend = "responses") can run against cline-proxy with Cline as the upstream transport. Closes #41.

What

Ported the verified Responses implementation from codebuddy-proxy and adapted it to cline-proxy's policy and infrastructure:

• src/responses/request.rs - Responses request normalization to the same OpenAI Chat Completions body the Anthropic frontend emits: string/array input, function_call history with preserved call_ids, function_call_output -> role=tool, flat tools -> nested (schemas byte-identical), tool_choice, max_output_tokens -> max_tokens, reasoning.effort mapping, prompt_cache_key forwarding. Hosted backend tools (web_search, x_search, ...) are dropped, never faked. item_reference rejected. Historical reasoning items never replayed.
• src/responses/stream.rs - chat SSE -> Responses SSE converter with exact typed event shapes, monotonic sequence_number, and the invariant Grok Build requires: response.output_item.added (function_call, with call_id + name) always precedes its argument deltas. Terminal frames: response.completed / response.incomplete (length) / response.failed (never a replay). Terminal response object reconstructs full output for next-turn replay. Usage: input_tokens is the FULL prompt count, cached tokens a subset. Reasoning exposed only when reasoning.summary requested.
• src/responses_pump.rs - streaming pump and non-stream aggregation. Same StreamWatch timers, SSE comment keepalive (: ping, never a synthetic frame), bounded buffers, no-replay-after-commit, and client-disconnect cancellation as the Anthropic pump. Non-stream uses ONE upstream streaming generation aggregated locally. Reasoning shadow store bookkeeping with the same epoch rules.
• src/server.rs - /v1/responses route behind the same auth middleware; OpenAI error envelope; model aliases; GLM policy (optimize_request) + prefix telemetry + canonical tool JSON + exact-token telemetry slot; reasoning shadow restore/clear on epoch boundaries.
• src/cache.rs - responses_session_fingerprint (domain-separated HMAC so Responses keys can never collide with Anthropic fingerprints) and responses_session_raw_id (prompt_cache_key -> metadata.session_id/user_id fallback). Raw keys are never logged.
• src/obs.rs - request_id field on StreamSummary so the Responses pump can emit the standard single per-request summary with protocol: "responses".

Safety invariants preserved

• Only effective HTTP 429 rotates keys; all other upstream errors sanitized pass-through.
• Once the downstream stream is committed, no replay on another key.
• No prompt/reasoning/tool content in logs; only sizes, counts, timings, fingerprints.
• Bounded buffers and queues throughout; no new dependencies.

Tests

15 offline integration tests (tests/responses_api.rs) against a scripted loopback mock: non-stream object shape, tool-call id round-trip, typed stream lifecycle, item-added-before-delta ordering, GLM policy application (explicit effort, output cap), hosted-tool drop, tool history replay, shadow restore without wire reasoning, unrequested-reasoning gating, effective-429 failover without replay, non-429 no-rotation, auth, invalid request shapes, length->incomplete, domain-separated fingerprints. Plus unit tests in src/responses/* (usage mapping, ids, conversion, stream lifecycle/tool/reasoning/length/failed).

Gates: fmt OK, check OK, clippy -D warnings OK, 304 tests debug OK, 304 tests release OK.

Docs

README: new "Grok Build (OpenAI Responses API)" section + route list + curl examples. docs/DEVELOPMENT_STATE.md updated with the new current target.