@0xmaxma/claude-gateway 2.0.6 → 2.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xmaxma/claude-gateway",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "Multi-agent gateway for Claude",
   "repository": {
     "type": "git",
@@ -28,7 +28,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node scripts/write-build-provenance.cjs",
     "start": "node --no-warnings=ExperimentalWarning --env-file-if-exists=.env dist/entry.js gateway start",
     "postinstall": "if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi",
     "pretest": "npm run build",
@@ -61,6 +61,7 @@
     "pino": "^10.3.1",
     "qrcode": "^1.5.4",
     "sharp": "^0.35.4",
+    "smol-toml": "^1.8.0",
     "ws": "^8.21.0"
   },
   "devDependencies": {

package/scripts/orchestration/audit-codex-context.cjs

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+// Measure native CLI context metadata with a local Responses fixture, without model billing.
+// This does NOT certify that an upstream provider accepts requests of that size.
+require('ts-node/register/transpile-only');
+const {CodexProcess}=require('../../src/session/codex-process');
+const {resolveCodexRuntime}=require('../../src/session/codex-runtime');
+const {resolveWorkerHarness}=require('../../src/orchestration/worker-harness');
+const fs=require('fs/promises'),path=require('path'),os=require('os'),http=require('http');
+const {execFileSync}=require('child_process'),{once}=require('events');
+const args=process.argv.slice(2);
+function option(name){const i=args.indexOf(name);return i<0?undefined:args[i+1];}
+(async()=>{
+ const runtime=resolveCodexRuntime();
+ const catalog=option('--catalog-json')?JSON.parse(await fs.readFile(option('--catalog-json'),'utf8')).models:JSON.parse(execFileSync(runtime.executable,['debug','models','--bundled'],{encoding:'utf8',timeout:15000,maxBuffer:8*1024*1024})).models;
+ const supplied=option('--models-json')?JSON.parse(await fs.readFile(option('--models-json'),'utf8')):[];
+ const selected=new Map([...catalog.filter(m=>m.slug.includes('gpt')).map(m=>[m.slug,{id:m.slug}]),...supplied.map(m=>[m.id,m])]);
+ const directory=await fs.mkdtemp(path.join(os.tmpdir(),'gateway-context-audit-'));
+ const previous=process.env.GATEWAY_CONTEXT_AUDIT_KEY;
+ process.env.GATEWAY_CONTEXT_AUDIT_KEY='local-fixture-only';
+ const sockets=new Set(),adapters=new Set(),rows=[];
+ const server=http.createServer(async(req,res)=>{
+  try{
+   let raw='';for await(const chunk of req){raw+=chunk;if(raw.length>4*1024*1024)throw Error('Fixture request too large');}
+   const body=JSON.parse(raw),id='resp_fixture',item={type:'message',id:'msg_fixture',role:'assistant',phase:'final_answer',status:'completed',content:[{type:'output_text',text:'Context audit fixture complete.',annotations:[]}]};
+   const response={id,object:'response',created_at:Math.floor(Date.now()/1000),status:'completed',model:body.model,output:[item],usage:{input_tokens:100,input_tokens_details:{cached_tokens:0},output_tokens:5,total_tokens:105}};
+   res.writeHead(200,{'content-type':'text/event-stream'});
+   const emit=(type,payload)=>res.write('event: '+type+'\ndata: '+JSON.stringify({type,...payload})+'\n\n');
+   emit('response.created',{response:{...response,status:'in_progress',output:[]}});
+   emit('response.output_item.added',{output_index:0,item:{...item,status:'in_progress',content:[]}});
+   emit('response.content_part.added',{item_id:item.id,output_index:0,content_index:0,part:{type:'output_text',text:'',annotations:[]}});
+   emit('response.output_text.delta',{item_id:item.id,output_index:0,content_index:0,delta:item.content[0].text});
+   emit('response.output_text.done',{item_id:item.id,output_index:0,content_index:0,text:item.content[0].text});
+   emit('response.content_part.done',{item_id:item.id,output_index:0,content_index:0,part:item.content[0]});
+   emit('response.output_item.done',{output_index:0,item});
+   emit('response.completed',{response});res.end();
+  }catch(error){res.destroy(error);}
+ });
+ server.on('connection',socket=>{sockets.add(socket);socket.on('close',()=>sockets.delete(socket));});
+ try{
+  server.listen(0,'127.0.0.1');await once(server,'listening');
+  await fs.writeFile(path.join(directory,'mcp.json'),'{"mcpServers":{}}');
+  let index=0;
+  async function runNext(){
+   while(index<selected.size){
+    const record=[...selected.values()][index++],model=record.workerModel||record.id.replace(/\[(?:1m|200k)\]$/i,'');
+    const row={selection:record.id,nativeModel:model,advertisedGatewayWindow:record.contextWindow??null,requested:1000000};
+    const known=catalog.find(m=>m.slug===model);
+    row.catalog=known?{default:known.context_window,max:known.max_context_window,usablePercent:known.effective_context_window_percent}:null;
+    row.autoHarness=resolveWorkerHarness({workers:{harness:'auto'}},{gateway:{models:record.workerHarness?[record]:[]}},record.id).harness;
+    const adapter=new CodexProcess({agent:{workspace:directory},gateway:{gateway:{}},profile:{role:'worker',hostExecution:true,connectorsAllowed:false,mcpConfigPath:path.join(directory,'mcp.json'),overlay:'Local metadata audit. Return one short message.'},sessionId:'audit-'+index,stateDirectory:directory,
+      config:{model,contextWindow:1000000,bin:runtime.executable,baseUrl:'http://127.0.0.1:'+server.address().port+'/v1',apiKeyEnv:'GATEWAY_CONTEXT_AUDIT_KEY'}});
+    adapters.add(adapter);
+    const originalEvent=adapter.event.bind(adapter);
+    adapter.event=function(event){if(event.method==='thread/tokenUsage/updated')row.observedUsable=event.params?.tokenUsage?.modelContextWindow??null;return originalEvent(event);};
+    const originalRequest=adapter.request.bind(adapter);
+    adapter.request=async function(method,params){const result=await originalRequest(method,params);if(method==='config/read')row.effectiveConfiguredWindow=result.config?.model_context_window;return result;};
+    let timer;
+    try{
+     const complete=new Promise((resolve,reject)=>{timer=setTimeout(()=>reject(Error('Native audit timed out')),30000);adapter.on('startup-error',reject);adapter.on('output',line=>{const e=JSON.parse(line);if(e.contextWindow)row.context=e.contextWindow;if(e.type==='result')e.is_error?reject(Error(e.result)):resolve();});});
+     await adapter.start();
+     if(option('--catalog-json')){
+       const filename=path.join(adapter.home,'config.toml');
+       const config=await fs.readFile(filename,'utf8');
+       await fs.writeFile(filename,'model_catalog_json = '+JSON.stringify(path.resolve(option('--catalog-json')))+'\n'+config,{mode:0o600});
+     }
+     adapter.sendMessage('Return a short audit completion.');await complete;
+     row.status=typeof row.observedUsable==='number'?'measured':'missing-native-measurement';
+    }catch(error){row.status='error';row.error=error.message;}
+    finally{clearTimeout(timer);await adapter.stop();adapters.delete(adapter);}
+    rows.push(row);console.log(JSON.stringify(row));
+   }
+  }
+  await Promise.all([runNext(),runNext()]);
+  const report={measuredAt:new Date().toISOString(),version:execFileSync(runtime.executable,['--version'],{encoding:'utf8'}).trim(),catalogSource:option('--catalog-json')?'explicit snapshot':'bundled',method:'Real CodexProcess/app-server; explicit 1M request; local fake Responses API; observe native modelContextWindow. No upstream capacity/inference certification.',rows:rows.sort((a,b)=>a.selection.localeCompare(b.selection))};
+  if(option('--output'))await fs.writeFile(option('--output'),JSON.stringify(report,null,2)+'\n');
+  if(rows.some(row=>row.status!=='measured'))process.exitCode=1;
+ }finally{
+  await Promise.allSettled([...adapters].map(a=>a.stop()));
+  for(const socket of sockets)socket.destroy();server.close();
+  if(previous===undefined)delete process.env.GATEWAY_CONTEXT_AUDIT_KEY;else process.env.GATEWAY_CONTEXT_AUDIT_KEY=previous;
+  await fs.rm(directory,{recursive:true,force:true});
+ }
+})().catch(error=>{console.error(error.message);process.exitCode=1;});

package/scripts/orchestration/benchmark-worker-harnesses.cjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+'use strict';
+// Opt-in, billable native CLI smoke benchmark; deliberately not a gateway benchmark.
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawn, spawnSync } = require('node:child_process');
+const args = process.argv.slice(2);
+const option = (name, fallback) => args.includes(name) ? args[args.indexOf(name) + 1] : fallback;
+if (!args.includes('--run')) {
+  console.log('Opt-in real calls: node scripts/orchestration/benchmark-worker-harnesses.cjs --run [--claude-model sonnet] [--codex-model gpt-5.6-luna] [--claude-base-url URL --claude-api-key-env ENV_NAME] [--codex-base-url URL --codex-api-key-env ENV_NAME] [--host-execution] [--output /tmp/worker-benchmark.json]');
+  process.exit(0);
+}
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'gateway-worker-benchmark-'));
+fs.chmodSync(root, 0o700);
+const prompt = 'Implement sumIntegers(values) in sum.cjs, exporting { sumIntegers }. Accept an array of safe integers and return its sum. Throw TypeError for non-arrays or invalid elements and RangeError if any intermediate sum is not a safe integer. Empty arrays return 0. Use built-in Node only. Run a small Node verification. Modify only sum.cjs in this directory; do not inspect parent directories or credentials. Finish with a brief summary.';
+const harness = `const assert=require('node:assert/strict');const {sumIntegers:s}=require(process.argv[1]);assert.equal(s([]),0);assert.equal(s([1,2,-3,4]),4);assert.equal(s([-4,-2]),-6);for(const x of [null,{},'1',[1.2],[NaN],[Infinity],['1'],[Number.MAX_SAFE_INTEGER+1]])assert.throws(()=>s(x),TypeError);assert.throws(()=>s([Number.MAX_SAFE_INTEGER,1]),RangeError);assert.throws(()=>s([-Number.MAX_SAFE_INTEGER,-1]),RangeError);`;
+function execute(bin, argv, cwd, env) {
+  return new Promise(resolve => {
+    const started = Date.now(); let output = '', timedOut = false, spawnError = false;
+    const p = spawn(bin, argv, { cwd, env, detached: process.platform !== 'win32', stdio: ['pipe','pipe','pipe'] });
+    const kill = () => { try { process.platform === 'win32' ? p.kill('SIGKILL') : process.kill(-p.pid, 'SIGKILL'); } catch {} };
+    const timer = setTimeout(() => { timedOut = true; kill(); }, 120000);
+    p.stdout.on('data', b => { if (output.length < 8 * 1024 * 1024) output += b; else kill(); });
+    // Never persist stderr: providers may echo account/endpoint/auth information.
+    p.stderr.resume();
+    p.on('error', () => { spawnError = true; });
+    p.on('close', code => { clearTimeout(timer); kill(); resolve({ code, timedOut, spawnError, wallMs: Date.now() - started, output }); });
+    p.stdin.on('error', () => {}); p.stdin.end(prompt);
+  });
+}
+function metrics(harness, text) {
+  const result = { inputTokens: null, cachedInputTokens: null, cacheCreationTokens: null, outputTokens: null, toolErrors: 0, providerErrors: 0, failureCategory: null, toolCalls: 0 };
+  for (const line of text.split('\n')) {
+    let event; try { event = JSON.parse(line); } catch { continue; }
+    const diagnostic = JSON.stringify(event);
+    if (event.is_error || event.type === 'error' || event.type === 'turn.failed') {
+      result.failureCategory = /auth|token|credential|401|403/i.test(diagnostic) ? 'authentication' : /model.*(not|invalid|unknown)|unsupported.*model/i.test(diagnostic) ? 'model_unavailable' : /permission|sandbox|denied/i.test(diagnostic) ? 'permission' : 'provider_or_cli';
+    }
+    if (harness === 'codex') {
+      if (event.type === 'item.completed' && ['command_execution','mcp_tool_call','file_change'].includes(event.item?.type)) result.toolCalls++;
+      if (event.type === 'turn.completed' && event.usage) {
+        result.inputTokens = event.usage.input_tokens ?? null;
+        result.cachedInputTokens = event.usage.cached_input_tokens ?? null;
+        result.cacheCreationTokens = event.usage.cache_write_input_tokens ?? null;
+        result.outputTokens = event.usage.output_tokens ?? null;
+      }
+      if (event.type === 'item.completed' && (event.item?.status === 'failed' || (typeof event.item?.exit_code === 'number' && event.item.exit_code !== 0))) result.toolErrors++;
+      if (event.type === 'turn.failed' || event.type === 'error') result.providerErrors++;
+    } else {
+      if (event.type === 'result') {
+        const u = event.usage ?? {};
+        result.inputTokens = u.input_tokens ?? null;
+        result.cachedInputTokens = u.cache_read_input_tokens ?? null;
+        result.cacheCreationTokens = u.cache_creation_input_tokens ?? null;
+        result.outputTokens = u.output_tokens ?? null;
+        if (event.is_error) result.providerErrors++;
+      }
+      for (const block of event.message?.content ?? []) if (block.type === 'tool_use') result.toolCalls++;
+      for (const block of event.message?.content ?? []) if (block.type === 'tool_result' && block.is_error) result.toolErrors++;
+    }
+  }
+  // Codex includes reads and writes in input_tokens; Claude reports disjoint categories.
+  result.freshInputTokens = result.inputTokens === null ? null : harness === 'codex'
+    ? Math.max(0, result.inputTokens - (result.cachedInputTokens ?? 0) - (result.cacheCreationTokens ?? 0)) : result.inputTokens;
+  result.totalInputTokens = result.inputTokens === null ? null : harness === 'codex'
+    ? result.inputTokens : result.inputTokens + (result.cachedInputTokens ?? 0) + (result.cacheCreationTokens ?? 0);
+  return result;
+}
+(async () => {
+  let settings = {}; try { settings = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.claude', 'settings.json'), 'utf8')); } catch {}
+  const claudeEnv = { ...process.env };
+  for (const key of ['ANTHROPIC_API_KEY','ANTHROPIC_AUTH_TOKEN','CLAUDE_CODE_OAUTH_TOKEN','ANTHROPIC_BASE_URL']) if (!claudeEnv[key] && typeof settings.env?.[key] === 'string') claudeEnv[key] = settings.env[key];
+  const claudeKeyEnv = option('--claude-api-key-env');
+  if (claudeKeyEnv) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(claudeKeyEnv) || !process.env[claudeKeyEnv]) throw new Error('Missing explicit Claude credential');
+    delete claudeEnv.ANTHROPIC_AUTH_TOKEN;
+    delete claudeEnv.CLAUDE_CODE_OAUTH_TOKEN;
+    claudeEnv.ANTHROPIC_API_KEY = process.env[claudeKeyEnv];
+  }
+  if (option('--claude-base-url')) claudeEnv.ANTHROPIC_BASE_URL = option('--claude-base-url');
+  const codexKeyEnv = option('--codex-api-key-env', 'OPENAI_API_KEY');
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(codexKeyEnv)) throw new Error('Invalid credential environment name');
+  const codexEnv = { ...process.env }; // CLI reads existing auth in-place; never copy it.
+  const routes = [
+    { harness: 'claude', bin: process.env.CLAUDE_BIN || 'claude', model: option('--claude-model','sonnet'), env: claudeEnv,
+      auth: ['ANTHROPIC_API_KEY','ANTHROPIC_AUTH_TOKEN','CLAUDE_CODE_OAUTH_TOKEN'].some(k => claudeEnv[k]) || fs.existsSync(path.join(os.homedir(),'.claude','.credentials.json')) },
+    { harness: 'codex', bin: process.env.CODEX_BIN || 'codex', model: option('--codex-model','gpt-5.6-luna'), env: codexEnv,
+      auth: Boolean(codexEnv[codexKeyEnv]) || (!option('--codex-base-url') && fs.existsSync(path.join(codexEnv.CODEX_HOME || path.join(os.homedir(),'.codex'),'auth.json'))) },
+  ];
+  const report = { kind: 'native-cli-smoke', codexSandbox: args.includes('--host-execution') ? 'danger-full-access' : 'workspace-write', note: 'Different models/provider/account routes may apply. Not a controlled timing/cost A/B, gateway integration test, or quality-parity claim. CLI token accounting differs; null means unavailable.', runs: [] };
+  for (const route of routes) {
+    if (!route.auth) { report.runs.push({ harness: route.harness, model: route.model, status: 'skipped_missing_credentials' }); continue; }
+    const cwd = path.join(root,route.harness); fs.mkdirSync(cwd, {mode:0o700});
+    fs.writeFileSync(path.join(cwd,'sum.cjs'),'module.exports = { sumIntegers() { throw new Error("TODO"); } };\n');
+    const argv = route.harness === 'codex'
+      ? ['exec','--ignore-user-config','--ignore-rules','--skip-git-repo-check','--ephemeral','--json','--sandbox',args.includes('--host-execution') ? 'danger-full-access' : 'workspace-write','-c','project_doc_max_bytes=0','-c','approval_policy="never"','-c','model_reasoning_effort="medium"','--model',route.model,'-']
+      : ['--print',...(claudeKeyEnv ? ['--bare','--setting-sources',''] : []),'--no-session-persistence','--output-format','stream-json','--verbose','--model',route.model,'--permission-mode','bypassPermissions','--tools','Read,Edit,Write,Bash','--strict-mcp-config','--mcp-config','{"mcpServers":{}}'];
+    if (route.harness === 'codex' && option('--codex-base-url')) {
+      const url = new URL(option('--codex-base-url'));
+      if (url.username || url.password || url.search || url.hash || !['https:', 'http:'].includes(url.protocol)) throw new Error('Invalid endpoint');
+      argv.splice(argv.length - 1, 0, '-c', 'model_provider="benchmark"', '-c', 'model_providers.benchmark.name="Benchmark"', '-c', 'model_providers.benchmark.wire_api="responses"', '-c', 'model_providers.benchmark.base_url=' + JSON.stringify(url.href), '-c', 'model_providers.benchmark.env_key=' + JSON.stringify(codexKeyEnv));
+    }
+    const run = await execute(route.bin,argv,cwd,route.env);
+    const checked = spawnSync(process.execPath,['-e',harness,path.join(cwd,'sum.cjs')],{timeout:5000,encoding:'utf8'});
+    report.runs.push({harness:route.harness,model:route.model,status:run.spawnError?'cli_unavailable':run.timedOut?'timeout':run.code===0?'finished':'cli_failed',exitCode:run.code,wallMs:run.wallMs,correctnessPassed:checked.status===0,validationFailure:checked.status===0?null:checked.error?'harness_error':(checked.stderr?.match(/(?:AssertionError|TypeError|RangeError|SyntaxError|ReferenceError|MODULE_NOT_FOUND)/)?.[0] ?? 'test_failed'),...metrics(route.harness,run.output)});
+  }
+  const json = JSON.stringify(report,null,2)+'\n';
+  if (option('--output')) fs.writeFileSync(option('--output'),json,{mode:0o600});
+  process.stdout.write(json);
+  process.exitCode = report.runs.every(r=>r.status==='finished'&&r.correctnessPassed&&r.providerErrors===0) ? 0 : 1;
+})().catch(() => { console.error('Benchmark failed; raw provider output suppressed.'); process.exitCode=1; }).finally(()=>fs.rmSync(root,{recursive:true,force:true}));

package/scripts/orchestration/smoke-codex-extensions.ts

@@ -0,0 +1,29 @@
+// Opt-in local native CLI smoke; no model call, remote provider or real credential.
+import { CodexNativeClient } from '../../src/session/codex-native-mcp-client';
+import { resolveCodexRuntime } from '../../src/session/codex-runtime';
+import { mkdtemp, mkdir, writeFile, rm } from 'fs/promises';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import assert from 'assert/strict';
+const root = await mkdtemp(join(tmpdir(), 'gateway-extension-smoke-'));
+const home = join(root, 'codex'); await mkdir(home);
+const server = join(root, 'mcp.cjs');
+await writeFile(server, String.raw`
+require('readline').createInterface({input:process.stdin}).on('line',line=>{
+ const q=JSON.parse(line);if(q.id===undefined)return;let result={};
+ if(q.method==='initialize')result={protocolVersion:q.params.protocolVersion,capabilities:{tools:{}},serverInfo:{name:'local',version:'1'}};
+ if(q.method==='tools/list')result={tools:['echo','disabled'].map(name=>({name,description:'Fixture '+name,inputSchema:{type:'object',properties:{value:{type:'string'}},required:['value']}}))};
+ if(q.method==='tools/call')result={content:[{type:'text',text:'echo:'+q.params.arguments.value}]};
+ process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:q.id,result})+'\n');
+});`);
+await writeFile(join(home, 'config.toml'), `model="gpt-5.6-luna"\nmodel_provider="fixture"\n[model_providers.fixture]\nname="Fixture"\nwire_api="responses"\nbase_url="http://127.0.0.1:1/v1"\nenv_key="FIXTURE_CODEX_KEY"\n[mcp_servers.fixture]\ncommand=${JSON.stringify(process.execPath)}\nargs=${JSON.stringify([server])}\ndisabled_tools=["disabled"]\n`);
+const client = new CodexNativeClient({ bin: resolveCodexRuntime().executable, cwd: root, home, servers: ['fixture'], env: { FIXTURE_CODEX_KEY: 'local-fixture-not-a-real-key' } });
+try {
+ const listing = await client.listTools();
+ assert(listing.tools.some(tool=>tool.name==='fixture__echo'));
+ assert(!listing.tools.some(tool=>tool.name==='fixture__disabled'),'native disabled tools leaked');
+ const result = await client.callTool({ name:'fixture__echo',arguments:{value:'ok'} });
+ assert.equal(result.content[0].text,'echo:ok');
+ await assert.rejects(client.callTool({name:'fixture__disabled',arguments:{value:'denied'}}));
+ console.log(JSON.stringify({pass:true,toolCount:listing.tools.length,roundtrip:true,disabledToolDenied:true,modelCalls:0}));
+} finally {await client.close();await rm(root,{recursive:true,force:true});}

package/scripts/orchestration/smoke-codex-worker.cjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+// Opt-in native-binary smoke: local fake Responses API, no model billing or real credentials.
+require('ts-node/register/transpile-only');
+const {resolveCodexRuntime}=require('../../src/session/codex-runtime');
+const {CODEX_RUNTIME_LABEL}=require('../../src/session/codex-container-runtime');
+const {CodexProcess} = require('../../src/session/codex-process');
+const {mkdir,mkdtemp,writeFile,rm} = require('fs/promises');
+const {join} = require('path');
+const {homedir} = require('os');
+const http = require('http');
+const assert = require('assert/strict');
+const {once} = require('events');
+const {randomUUID} = require('crypto');
+const {execFileSync} = require('child_process');
+const shellEnvironmentMode = process.argv.includes('--shell-environment');
+const contextWindowMode = process.argv.includes('--context-window');
+const containerMode = process.argv.includes('--container');
+const nativeAuthMode = process.argv.includes('--native-auth');
+const originalCodexHome = process.env.CODEX_HOME;
+const connectorMode = process.argv.includes('--connector');
+const nativeMcpMode = process.argv.includes('--native-mcp');
+const connectorNamespace=nativeMcpMode?'codex_native':containerMode?'claude__fixture':'fixture';
+const MCP = String.raw`
+const fs=require('fs'),readline=require('readline');
+readline.createInterface({input:process.stdin}).on('line',line=>{const q=JSON.parse(line);if(q.id===undefined)return;let result={};
+if(q.method==='initialize')result={protocolVersion:'2024-11-05',capabilities:{tools:{}},serverInfo:{name:'fixture',version:'1'}};
+if(q.method==='tools/list')result={tools:[{name:'fixture_echo',description:'Return the supplied value.',inputSchema:{type:'object',properties:{value:{type:'string'}},required:['value']}}]};
+if(q.method==='tools/call'){if(fs.readFileSync(process.env.FIXTURE_TICKET,'utf8')!=='fixture-ticket')throw Error('ticket missing');fs.appendFileSync(process.env.FIXTURE_CALLS,JSON.stringify(q.params)+'\n');result={content:[{type:'text',text:'MCP roundtrip: '+q.params.arguments.value}]};}
+process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:q.id,result})+'\n');});
+`;
+(async()=>{
+  const cache=join(homedir(),'.cache');await mkdir(cache,{recursive:true});const directory=await mkdtemp(join(cache,'gateway-codex-smoke-'));
+  let bridge; let createContainer;
+  const containerName = containerMode ? 'gateway-codex-smoke-' + randomUUID().slice(0,8) : undefined;
+  await mkdir(join(directory,'.codex'));
+  await writeFile(join(directory,'.codex','config.toml'),'[mcp_servers.unapproved]\ncommand = "node"\nargs = ["-e", "process.exit(91)"]\n');
+  const requests=[];const adapters=[];let sequence=0;let amended=false;let acknowledged=false;let hanging=false;const sockets=new Set();
+  const server=http.createServer(async(req,res)=>{
+    let raw='';for await(const chunk of req)raw+=chunk;
+    if(!req.url.endsWith('/responses')){res.writeHead(404);return res.end();}
+    const body=JSON.parse(raw);requests.push(body);
+    if(hanging)return;
+    if(sequence>0)await new Promise(resolve=>setTimeout(resolve,75));
+    const id='resp_'+(++sequence), messageId='msg_'+sequence;
+    const namespace=shellEnvironmentMode?undefined:body.tools?.find(t=>t.type==='namespace'&&t.name===(connectorMode?'mcp__'+connectorNamespace:'mcp__gateway'));
+    const toolName=shellEnvironmentMode?'exec_command':connectorMode?'tool_call':'fixture_echo';
+    const tool=shellEnvironmentMode?body.tools?.find(t=>t.name==='exec_command'):namespace?.tools.find(t=>t.name===toolName) ?? body.tools?.find(t=>t.name===(connectorMode?'mcp__'+connectorNamespace+'__tool_call':'mcp__gateway__fixture_echo'));
+    const toolArgs=shellEnvironmentMode?{cmd:"worker_fixture_account; printf '%s\\n' \"$WORKER_ENV_TEST\"; pwd",workdir:containerMode?'/workspace/project':join(directory,'project'),max_output_tokens:1000}:connectorMode?{name:nativeMcpMode?'fixture__fixture_echo':'fixture_echo',arguments:{value:'hello'}}:{value:'hello'};
+    const output=sequence===1&&tool?[{type:'function_call',id:'fc_1',call_id:'call_fixture_1',name:tool.name,...(namespace?{namespace:namespace.name}:{}),arguments:JSON.stringify(toolArgs)}]:[{type:'message',id:messageId,role:'assistant',phase:'final_answer',status:'completed',content:[{type:'output_text',text:'Canonical fixture result '+sequence,annotations:[]}]}];
+    const response={id,object:'response',created_at:Math.floor(Date.now()/1000),status:'completed',model:'gpt-test',output,usage:{input_tokens:100,input_tokens_details:{cached_tokens:40,cache_write_tokens:20},output_tokens:20,output_tokens_details:{reasoning_tokens:5},total_tokens:120}};
+    res.writeHead(200,{'content-type':'text/event-stream','cache-control':'no-cache'});
+    const emit=(type,payload)=>res.write('event: '+type+'\ndata: '+JSON.stringify({type,...payload})+'\n\n');
+    emit('response.created',{response:{...response,status:'in_progress',output:[]}});
+    for(const [index,item] of output.entries()){
+      emit('response.output_item.added',{output_index:index,item:item.type==='message'?{...item,status:'in_progress',content:[]}:item});
+      if(item.type==='message'){
+        emit('response.content_part.added',{item_id:item.id,output_index:index,content_index:0,part:{type:'output_text',text:'',annotations:[]}});
+        emit('response.output_text.delta',{item_id:item.id,output_index:index,content_index:0,delta:item.content[0].text});
+        emit('response.output_text.done',{item_id:item.id,output_index:index,content_index:0,text:item.content[0].text});
+        emit('response.content_part.done',{item_id:item.id,output_index:index,content_index:0,part:item.content[0]});
+      }
+      emit('response.output_item.done',{output_index:index,item});
+    }
+    emit('response.completed',{response});res.end();
+  });
+  server.on('connection',socket=>{sockets.add(socket);socket.on('close',()=>sockets.delete(socket));});
+  try {
+  server.listen(0,containerMode?'0.0.0.0':'127.0.0.1');await once(server,'listening');
+  process.env.GATEWAY_CODEX_SMOKE_KEY='fake-local-key';
+  const mcp=join(directory,'mcp.json'), calls=join(directory,'calls.jsonl');
+  await writeFile(join(directory,'mcp.cjs'),MCP);await writeFile(join(directory,'ticket'),'fixture-ticket');
+  await writeFile(mcp,JSON.stringify({mcpServers:{gateway:{command:process.execPath,args:[join(directory,'mcp.cjs')],env:{FIXTURE_TICKET:join(directory,'ticket'),FIXTURE_CALLS:calls}}}}));
+  if(containerMode){
+    const socket=join(directory,'fixture.sock');
+    bridge=http.createServer(async(req,res)=>{let body='';for await(const chunk of req)body+=chunk;await require('fs/promises').appendFile(calls,body+'\n');res.end(JSON.stringify({text:'MCP roundtrip: hello'}));});
+    bridge.listen(socket);await once(bridge,'listening');
+    const ticket=join(directory,'container-ticket.json');await writeFile(ticket,JSON.stringify({socket,token:'fixture-ticket',tools:[{name:'fixture_echo',description:'Return supplied value.',inputSchema:{type:'object',properties:{value:{type:'string'}},required:['value']}}]}));
+    await writeFile(mcp,JSON.stringify({mcpServers:{gateway:{command:'unused',args:[],env:{GATEWAY_ORCHESTRATION_TICKET_FILE:ticket}}}}));
+    const installerHome=homedir();
+    const runtime=resolveCodexRuntime();
+    assert(!runtime.containerError,runtime.containerError);
+    createContainer=()=>execFileSync('docker',['run','-d','--name',containerName,'--cap-drop','ALL','--security-opt','no-new-privileges','--add-host','host.docker.internal:host-gateway',...(nativeMcpMode?['-e','CODEX_HOME=/workspace/container-codex','-e','FIXTURE_CODEX_KEY=local-fixture-key']:[]),'--label',`${CODEX_RUNTIME_LABEL}=${runtime.fingerprint}`,...runtime.mounts.flatMap(m=>['--mount',`type=bind,src=${m.source},dst=${m.target},readonly`]),'--mount',`type=bind,src=${directory},dst=/workspace`,'--mount',`type=bind,src=${process.execPath},dst=/usr/bin/node,readonly`,process.env.GATEWAY_CODEX_SMOKE_IMAGE || 'debian:stable-slim','node','-e',`const fs=require('fs');fs.mkdirSync(${JSON.stringify(installerHome)},{recursive:true,mode:511});fs.chmodSync(${JSON.stringify(installerHome)},511);setInterval(()=>{},10000);`],{stdio:'pipe'});
+  }
+  if(createContainer)createContainer();
+  const options={agent:{workspace:directory,...(containerMode?{type:'app-agent',container:containerName}:{})},gateway:{gateway:{}},profile:{role:'worker',mcpConfigPath:mcp,overlay:'Use fixture_echo once, then return a brief result.',hostExecution:!containerMode,containerExecution:containerMode},sessionId:'fixture-logical-session',stateDirectory:join(directory,'state'),config:{model:'gpt-test',baseUrl:`http://${containerMode?'host.docker.internal':'127.0.0.1'}:${server.address().port}/v1`,apiKeyEnv:'GATEWAY_CODEX_SMOKE_KEY'}};
+  if(contextWindowMode) Object.assign(options.config,{model:"gpt-5.4-mini",contextWindow:1000000});
+  if(nativeAuthMode){
+    const home=join(directory,'native-auth');await mkdir(home,{mode:0o700});
+    await writeFile(join(home,'config.toml'), 'model_provider="fixture"\ncli_auth_credentials_store="file"\n[model_providers.fixture]\nname="Fixture"\nwire_api="responses"\nrequires_openai_auth=true\nbase_url='+JSON.stringify(options.config.baseUrl)+'\n',{mode:0o600});
+    execFileSync(resolveCodexRuntime().executable,['login','--with-api-key'],{env:{...process.env,CODEX_HOME:home},input:process.env.GATEWAY_CODEX_SMOKE_KEY,stdio:['pipe','pipe','pipe'],timeout:10000});
+    process.env.CODEX_HOME=home;delete options.config.baseUrl;delete options.config.apiKeyEnv;
+  }
+  if(connectorMode && !nativeMcpMode && !containerMode) options.gateway.gateway.customConnectors={fixture:{label:'Fixture connector',secretNames:[],credentialOwner:'none',config:{command:process.execPath,args:[join(directory,'mcp.cjs')],env:{FIXTURE_TICKET:join(directory,'ticket'),FIXTURE_CALLS:calls}}}};
+  if(connectorMode && !nativeMcpMode && containerMode){
+    await mkdir(join(directory,'.claude'),{recursive:true});
+    await writeFile(join(directory,'.claude','settings.json'),JSON.stringify({enableAllProjectMcpServers:true}));
+    await writeFile(join(directory,'.mcp.json'),JSON.stringify({mcpServers:{fixture:{command:'node',args:['/workspace/mcp.cjs'],env:{FIXTURE_TICKET:'/workspace/ticket',FIXTURE_CALLS:'/workspace/calls.jsonl'}}}}));
+  }
+  if(nativeMcpMode){
+    assert(nativeAuthMode && connectorMode,'--native-mcp requires --native-auth --connector');
+    const home=containerMode?join(directory,'container-codex'):process.env.CODEX_HOME;
+    await mkdir(home,{recursive:true});
+    const prefix=containerMode?'/workspace':directory;
+    const spec='\n[mcp_servers.fixture]\ncommand='+JSON.stringify(containerMode?'node':process.execPath)+'\nargs='+JSON.stringify([prefix+'/mcp.cjs'])+'\n[mcp_servers.fixture.env]\nFIXTURE_TICKET='+JSON.stringify(prefix+'/ticket')+'\nFIXTURE_CALLS='+JSON.stringify(prefix+'/calls.jsonl')+'\n';
+    if(containerMode)await writeFile(join(home,'config.toml'),'model="gpt-test"\nmodel_provider="fixture"\n[model_providers.fixture]\nname="Fixture"\nwire_api="responses"\nbase_url="http://127.0.0.1:1/v1"\nenv_key="FIXTURE_CODEX_KEY"\n'+spec);
+    else await require('fs/promises').appendFile(join(home,'config.toml'),spec);
+  }
+  if(shellEnvironmentMode){
+    await mkdir(join(directory,'project'));
+    await mkdir(join(directory,'zsh'));
+    await writeFile(join(directory,'hook.sh'),"worker_fixture_account() { case \"$PWD\" in */project) printf 'project-account\\n';; *) printf 'wrong-account\\n';; esac; }\n");
+    const location=containerMode?'/workspace':directory;
+    await writeFile(join(directory,'zsh','.zshenv'),'. '+JSON.stringify(location+'/hook.sh')+'\n');
+    options.gateway.gateway.workers={
+      environment:containerMode?{WORKER_ENV_TEST:'must-not-leak'}:{WORKER_ENV_TEST:'host-setting',BASH_ENV:location+'/hook.sh',ZDOTDIR:location+'/zsh'},
+      ...(containerMode?{containerEnvironment:{WORKER_ENV_TEST:'container-setting',BASH_ENV:location+'/hook.sh',ZDOTDIR:location+'/zsh'}}:{})
+    };
+  }
+  if(!shellEnvironmentMode) options.checkpoint=async()=>{if(amended)return;amended=true;return {text:'Apply the native checkpoint revision before finishing.',kind:'assignment',acknowledge:()=>{acknowledged=true;}};};
+  async function run(){
+    const adapter=new CodexProcess(options);adapters.push(adapter);const events=[];
+    const result=new Promise((resolve,reject)=>{const timeout=setTimeout(()=>reject(new Error('Smoke turn timed out')),45000);adapter.on('startup-error',e=>{clearTimeout(timeout);reject(e);});adapter.on('output',line=>{const e=JSON.parse(line);events.push(e);if(e.type==='result'){clearTimeout(timeout);e.is_error?reject(new Error(e.result)):resolve(e);}});});
+    try { await adapter.start();adapter.sendMessage('Complete the fixture request.'); } catch(error) { adapter.emit('startup-error',error); }
+    const terminal=await result;const schemas=await adapter.flushToolSchemas();await adapter.stop();return {terminal,events,schemas};
+  }
+    const first=await run();assert.match(first.terminal.result,/Canonical fixture result/);
+    if(contextWindowMode){
+      const context=first.events.filter(e=>e.subtype==='native_usage').at(-1)?.contextWindow;
+      assert.equal(context?.requested,1000000);assert.equal(context?.configured,400000);
+      assert(context.observed>0 && context.observed<=400000,'native usable context exceeds configured Mini ceiling');
+      console.log('PASS native context '+JSON.stringify(context));
+      return; // Dedicated context probe; the default smoke exercises MCP/resume separately.
+    }
+    assert(first.schemas.length>0,'actual request tool schemas were not captured');
+    assert(first.schemas.some(s=>s.loaded.some(name=>name.includes('fixture_echo')||name.includes('tool_call'))),'MCP schema absent from actual request capture: '+JSON.stringify(first.schemas.map(s=>s.loaded)));
+    assert(first.events.some(e=>e.type==='assistant'&&e.message.usage?.input_tokens===40&&e.message.usage.cache_read_input_tokens===40&&e.message.usage.cache_creation_input_tokens===20),'per-request trace usage was not normalized');
+    if(shellEnvironmentMode){
+      const outputs=requests.flatMap(r=>r.input).filter(i=>i.type==='function_call_output').map(i=>typeof i.output==='string'?i.output:JSON.stringify(i.output)).join('\n');
+      assert(outputs.includes('project-account'),outputs);
+      assert(outputs.includes(containerMode?'container-setting':'host-setting'),outputs);
+      assert(!outputs.includes('must-not-leak'),outputs);
+      console.log('PASS native Codex '+(containerMode?'container':'host')+': actual default-shell command, explicit startup hook, project cwd and isolated environment');
+      return;
+    }
+    const {readFile}=require('fs/promises');assert.match(await readFile(calls,'utf8'),/hello/);
+    assert(first.events.some(e=>e.type==='assistant'&&e.message.content.some(b=>b.name===(connectorMode?'mcp__'+connectorNamespace+'__tool_call':'mcp__gateway__fixture_echo'))),'native MCP tool was not observed');
+    assert(acknowledged,'native steering was not acknowledged');assert(requests.some(r=>JSON.stringify(r.input).includes('native checkpoint revision')),'native revision never reached Responses input');
+    assert.equal(first.terminal.usage.input_tokens,sequence*40);assert.equal(first.terminal.usage.cache_read_input_tokens,sequence*40);assert.equal(first.terminal.usage.cache_creation_input_tokens,sequence*20);assert.equal(first.terminal.usage.output_tokens,sequence*20);
+    const resumed=await run();assert.equal(resumed.terminal.usage.input_tokens,40);assert.equal(resumed.terminal.usage.cache_read_input_tokens,40);assert.equal(resumed.terminal.usage.cache_creation_input_tokens,20);assert.equal(resumed.terminal.usage.output_tokens,20);
+    assert(requests[requests.length-1].input.some(i=>i.type==='function_call_output'),'resumed transcript lost MCP history');
+    if(containerMode){
+      execFileSync('docker',['rm','-f',containerName],{stdio:'pipe'});createContainer();
+      const recreated=await run();
+      assert.match(recreated.terminal.result,/Canonical fixture result/);
+      assert(recreated.events.some(e=>e.subtype==='native_session_reset'),'recreated container must reset missing native session');
+      assert(!requests[requests.length-1].input.some(i=>i.type==='function_call_output'),'new container must not claim missing native history was resumed');
+      assert.equal(recreated.terminal.usage.input_tokens,40);
+    }
+    hanging=true;const cancelled=new CodexProcess({...options,sessionId:'cancel-fixture'});adapters.push(cancelled);await cancelled.start();cancelled.sendMessage('Wait for cancellation.');
+    const deadline=Date.now()+10000;const before=requests.length;while(requests.length===before&&Date.now()<deadline)await new Promise(r=>setTimeout(r,25));
+    await cancelled.stop();assert(cancelled.managedGroupStopped,'cancelled native process group survived');
+    console.log('PASS native Codex '+(containerMode?'container':connectorMode?'host custom connector':'host')+': local Responses, MCP ticket roundtrip, canonical summary, nonzero cache-write usage, explicit resume, recreation recovery, mid-turn revision, cancellation');
+  }finally{
+    await Promise.allSettled(adapters.map(a=>a.stop()));for(const socket of sockets)socket.destroy();server.close();bridge?.close();if(containerName){try{execFileSync('docker',['rm','-f',containerName],{stdio:'pipe'});}catch{}}delete process.env.GATEWAY_CODEX_SMOKE_KEY;if(originalCodexHome===undefined)delete process.env.CODEX_HOME;else process.env.CODEX_HOME=originalCodexHome;await rm(directory,{recursive:true,force:true});
+  }
+})().catch(error=>{console.error(error.message);process.exitCode=1;});

package/scripts/orchestration/smoke-safemode-codex.cjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// Opt-in native CLI regression: local mock Responses only; no provider credits.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const http = require('http');
+const assert = require('assert/strict');
+const { spawn } = require('child_process');
+const { buildNativeInvocation } = require('../../dist/safemode/native');
+
+(async () => {
+  const cache = path.join(os.homedir(), '.cache');
+  fs.mkdirSync(cache, { recursive: true });
+  const root = fs.mkdtempSync(path.join(cache, 'safemode-policy-'));
+  const cwd = path.join(root, 'workspace');
+  fs.mkdirSync(cwd);
+  const marker = path.join(root, 'unexpected-notify');
+  const hook = path.join(root, 'notify.cjs');
+  fs.writeFileSync(hook, `require('fs').writeFileSync(${JSON.stringify(marker)}, 'ran');`);
+  let requests = 0;
+  const server = http.createServer(async (req, res) => {
+    for await (const chunk of req) { /* Drain local fixture input. */ }
+    if (!req.url.endsWith('/responses')) { res.writeHead(404); res.end(); return; }
+    requests++;
+    const item = { type: 'message', id: 'msg_fixture', role: 'assistant', phase: 'final_answer', status: 'completed', content: [{ type: 'output_text', text: 'Fixture complete', annotations: [] }] };
+    const response = { id: 'resp_fixture', object: 'response', created_at: Math.floor(Date.now() / 1000), status: 'completed', model: 'gpt-test', output: [item], usage: { input_tokens: 10, output_tokens: 3, total_tokens: 13 } };
+    res.writeHead(200, { 'content-type': 'text/event-stream' });
+    for (const [type, payload] of [
+      ['response.created', { response: { ...response, status: 'in_progress', output: [] } }],
+      ['response.output_item.added', { output_index: 0, item }],
+      ['response.output_item.done', { output_index: 0, item }],
+      ['response.completed', { response }],
+    ]) res.write('event: ' + type + '\ndata: ' + JSON.stringify({ type, ...payload }) + '\n\n');
+    res.end();
+  });
+  try {
+    await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+    fs.writeFileSync(path.join(root, 'config.toml'), `model="gpt-test"\nmodel_provider="fixture"\nnotify=[${JSON.stringify(process.execPath)},${JSON.stringify(hook)}]\n[features]\nhooks=true\nplugins=true\napps=true\n[model_providers.fixture]\nname="fixture"\nbase_url="http://127.0.0.1:${server.address().port}/v1"\nwire_api="responses"\nenv_key="FIXTURE_KEY"\n`);
+    const env = { ...process.env, CODEX_HOME: root, FIXTURE_KEY: 'fake-local-only' };
+    async function run(nativeSessionId) {
+      const inv = buildNativeInvocation({ cli: 'codex', mode: 'headless', cwd, env, nativeSessionId, resume: Boolean(nativeSessionId), prompt: 'Reply fixture complete without tools.' });
+      const output = await new Promise((resolve, reject) => {
+        const child = spawn(inv.command, inv.args, { cwd, env: { ...inv.env, FIXTURE_KEY: 'fake-local-only' }, stdio: ['ignore', 'pipe', 'pipe'] });
+        let text = '', error = '';
+        const timer = setTimeout(() => child.kill('SIGKILL'), 30000);
+        child.stdout.on('data', chunk => { text += chunk; });
+        child.stderr.on('data', chunk => { error += chunk; });
+        child.on('error', error => { clearTimeout(timer); reject(error); });
+        child.on('close', code => { clearTimeout(timer); code === 0 ? resolve(text) : reject(new Error(`Native exit ${code}: ${error}`)); });
+      });
+      const events = output.trim().split('\n').map(line => JSON.parse(line));
+      assert(events.some(event => event.type === 'turn.completed'));
+      const id = events.find(event => event.type === 'thread.started')?.thread_id;
+      assert(id); if (nativeSessionId) assert.equal(id, nativeSessionId);
+      await new Promise(resolve => setTimeout(resolve, 200));
+      assert.equal(fs.existsSync(marker), false, 'notify executed outside the read-only workspace');
+      return id;
+    }
+    await run(await run());
+    assert.equal(requests, 2);
+    console.log('PASS native Codex safemode: fresh and resumed turns complete; inherited notify never executes');
+  } finally {
+    server.closeAllConnections(); server.close();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+})().catch(error => { console.error(error.message); process.exitCode = 1; });