@evalguard/openai 1.1.1 → 1.2.1

package/dist/index.js

@@ -1,8 +1,8 @@
-// ── evalguardai-openai ───────────────────────────────────────────────────────
+// ── @evalguard/openai ─────────────────────────────────────────────────────────
 // Drop-in OpenAI SDK wrapper that auto-intercepts chat.completions.create()
 // to enforce guardrails, log traces, and track costs via EvalGuard.
 import { GuardrailClient } from "./guardrail-client.js";
-import { estimateCost, newTraceId, injectTraceHeader, resolveIdempotencyKey, runPostResponseEval, } from "@evalguard/wrapper-core";
+import { estimateCostDetailed, normalizeOpenAIUsage, newTraceId, injectTraceHeader, resolveIdempotencyKey, runPostResponseEval, } from "@evalguard/wrapper-core";
 // ── Re-exports ──────────────────────────────────────────────────────────────
 // Public surface of v1.1.0:
 //   - EvalGuardConfig now widens `apiKey` to `ByokKeyResolver` (was `string`)
@@ -12,8 +12,9 @@ import { estimateCost, newTraceId, injectTraceHeader, resolveIdempotencyKey, run
 //     output score falls below failOnScore).
 //   - estimateCost / GuardrailClient / newTraceId etc. are unchanged shape.
 export { GuardrailClient } from "./guardrail-client.js";
-export { EvalGuardViolationError, EvalGuardOutputViolationError, estimateCost, } from "@evalguard/wrapper-core";
+export { EvalGuardViolationError, EvalGuardOutputViolationError, estimateCost, estimateCostDetailed, isModelPriced, } from "@evalguard/wrapper-core";
 import { EvalGuardViolationError } from "@evalguard/wrapper-core";
+import { isSafePassthrough, extractModelInputText, extractModelId, } from "./surface.js";
 // ── Helper: extract text from messages ──────────────────────────────────────
 function extractPromptText(messages) {
     return messages
@@ -33,6 +34,36 @@ function extractPromptText(messages) {
     })
         .join("\n");
 }
+/**
+ * Scan text for an entry point that is ALWAYS gated (chat.completions.create /
+ * .stream / .parse, responses.create / .stream / .parse).
+ *
+ * B6 round 2. The GATE decision for these does not depend on extraction — they
+ * are gated unconditionally — but WHAT THE FIREWALL SEES did.
+ * `extractPromptText` reads `messages[].content` and nothing else, so
+ *
+ *     chat.completions.create({ model, messages: [...], extra_context: { doc } })
+ *
+ * was gated while `extra_context` — model-visible, since the SDK forwards
+ * unknown body keys verbatim — never reached the scanner. That is the same
+ * "the inner check still enumerates known-good names" defect as the surface
+ * gate, inside the enumerated path. The whole-body walk is unioned on top of
+ * the original extraction, never in place of it, so nothing previously scanned
+ * is lost.
+ *
+ * Propagates `ScanBoundExceededError` — every caller of this is async, so it
+ * surfaces as a rejection and the call never reaches the provider.
+ */
+function fullScanText(headText, args) {
+    const walked = extractModelInputText(args);
+    if (!walked)
+        return headText;
+    if (!headText)
+        return walked;
+    const seen = new Set(headText.split("\n"));
+    const extra = walked.split("\n").filter((line) => line && !seen.has(line));
+    return extra.length > 0 ? `${headText}\n${extra.join("\n")}` : headText;
+}
 // ── Main wrapper ────────────────────────────────────────────────────────────
 /**
  * Wrap an existing OpenAI client to add EvalGuard guardrails, logging, and
@@ -41,7 +72,7 @@ function extractPromptText(messages) {
  *
  * ```ts
  * import OpenAI from "openai";
- * import { wrapOpenAI } from "evalguardai-openai";
+ * import { wrapOpenAI } from "@evalguard/openai";
  *
  * const openai = wrapOpenAI(new OpenAI(), {
  *   apiKey: "eg_...",
@@ -66,21 +97,317 @@ export function wrapOpenAI(client, config) {
     // exposes this as a deeply nested property chain. We use a Proxy on the
     // top-level client that intercepts property access to build a chain of
     // proxies down to the `create` method.
+    // B6 (audit 2026-07-29): shared context for the default-deny surface guard
+    // that backs every resource without a dedicated proxy. See surface.ts.
+    const ctx = { guardrail, blockOnViolation, enableLogging, config };
     return new Proxy(client, {
         get(target, prop, receiver) {
             if (prop === "chat") {
                 return createChatProxy(target.chat, guardrail, blockOnViolation, enableLogging, config);
             }
+            // 2026-07-29 (audit A279): `client.responses` — the Responses API,
+            // which OpenAI now documents as the default surface for new work and
+            // which the Agents SDK uses — was NOT intercepted. Every
+            // `responses.create/stream/parse` call skipped the firewall, the
+            // trace log and cost tracking, silently. Verified against
+            // openai@6.44.0: `typeof client.responses.create === "function"`,
+            // `.stream` and `.parse` likewise.
+            if (prop === "responses") {
+                const responses = Reflect.get(target, prop, receiver);
+                if (responses && typeof responses === "object") {
+                    return createResponsesProxy(responses, guardrail, blockOnViolation, enableLogging, config);
+                }
+                return responses;
+            }
+            // B6 (audit 2026-07-29): everything else USED TO land on
+            // `Reflect.get(target, prop, receiver)` — i.e. straight at the raw SDK.
+            // `client.completions.create` (legacy /v1/completions), embeddings,
+            // images, audio.speech, videos, beta.assistants, vectorStores.search and
+            // conversations.items.create all reached the model ungated, and so did
+            // `client.post("/chat/completions", …)`. The branch list was a denylist
+            // of guarded resources; it is now a default-deny surface guard with an
+            // explicit passthrough allowlist. See surface.ts for the inventory.
+            if (typeof prop === "string") {
+                // A derived client is still our client. `withOptions()` returns a NEW
+                // OpenAI instance built from the raw target — handing that back
+                // unwrapped silently sheds the guard for every call made through it.
+                if (prop === "withOptions") {
+                    const original = Reflect.get(target, prop, target);
+                    if (typeof original === "function") {
+                        const bound = original.bind(target);
+                        return (...args) => wrapOpenAI(bound(...args), config);
+                    }
+                    return original;
+                }
+                return guardSurfaceProp(target, prop, ctx);
+            }
             return Reflect.get(target, prop, receiver);
         },
     });
 }
+/**
+ * Resolve one property on a resource under the default-deny rule.
+ *
+ * Passthrough happens for exactly two reasons, both of them provable:
+ *   - the name is on `KNOWN_SAFE_PASSTHROUGH` (explicit, justified), or
+ *   - the value is a primitive (nothing to guard).
+ * Functions are gated, nested resources are recursively guarded.
+ */
+function guardSurfaceProp(target, prop, ctx) {
+    // `target` is the receiver on purpose: OpenAI resources read private fields
+    // (`#client`), which throws when the receiver is the Proxy.
+    const value = Reflect.get(target, prop, target);
+    if (isSafePassthrough(prop, value)) {
+        return typeof value === "function"
+            ? value.bind(target)
+            : value;
+    }
+    if (typeof value === "function") {
+        return gateSurfaceMethod(value.bind(target), prop, ctx);
+    }
+    if (value && typeof value === "object") {
+        return createSurfaceProxy(value, ctx);
+    }
+    return value;
+}
+/** Recursively guard a nested resource (`audio` → `speech` → `create`). */
+function createSurfaceProxy(resource, ctx) {
+    return new Proxy(resource, {
+        get(target, prop, receiver) {
+            if (typeof prop !== "string")
+                return Reflect.get(target, prop, target);
+            return guardSurfaceProp(target, prop, ctx);
+        },
+    });
+}
+/**
+ * Wrap one resource method with the firewall gate.
+ *
+ * When the call carries no model-visible text the ORIGINAL function is
+ * returned unchanged — not an async shim — so management calls keep the SDK's
+ * `APIPromise` and its `.withResponse()` / `.asResponse()` helpers. Only a
+ * call that actually carries a prompt pays the async wrapper, which is the
+ * same trade the dedicated chat/responses proxies already make.
+ */
+function gateSurfaceMethod(original, label, ctx) {
+    return function gatedSurfaceMethod(...args) {
+        let promptText;
+        try {
+            promptText = extractModelInputText(args);
+        }
+        catch (err) {
+            // ScanBoundExceededError: the body could not be read in full. Refuse the
+            // call. Deliberately NOT routed through `blockOnViolation` — a
+            // report-only caller still must not forward a payload we never scanned.
+            return Promise.reject(err);
+        }
+        if (promptText === null) {
+            // No model-visible text in the body — structurally incapable of
+            // carrying a prompt. Pass through untouched.
+            return original(...args);
+        }
+        const model = extractModelId(args);
+        const traceId = newTraceId();
+        const upstreamArgs = injectTraceHeader(args, traceId);
+        return (async () => {
+            const guardrailResult = await gateInput(promptText, model, traceId, ctx.guardrail, ctx.blockOnViolation, ctx.config);
+            const startTime = performance.now();
+            const result = await original(...upstreamArgs);
+            if (ctx.enableLogging) {
+                logSurfaceTrace(result, model, promptText, label, startTime, ctx, guardrailResult, traceId);
+            }
+            return result;
+        })();
+    };
+}
+/** Fire-and-forget trace for a generically-guarded resource call. */
+function logSurfaceTrace(result, model, promptText, label, startTime, ctx, guardrailResult, traceId) {
+    const latencyMs = Math.round(performance.now() - startTime);
+    const usage = normalizeOpenAIUsage(result?.usage);
+    const { costUsd: cost, pricingSource: costPricingSource } = estimateCostDetailed(model, usage.input, usage.output, { cachedInputTokens: usage.cached });
+    void ctx.guardrail
+        .logTrace({
+        model,
+        provider: "openai",
+        input: promptText,
+        output: null,
+        latencyMs,
+        tokenUsage: usage,
+        cost,
+        costPricingSource,
+        projectId: ctx.config.projectId,
+        metadata: { ...ctx.config.metadata, api: label },
+        guardrailResult,
+        traceId,
+    })
+        .catch(() => {
+        /* logging must never throw */
+    });
+}
+// ── Shared input gate ───────────────────────────────────────────────────────
+/**
+ * Run the pre-request firewall check and enforce `blockOnViolation`.
+ *
+ * Extracted 2026-07-29 (audit A279). This block was previously copy-pasted
+ * at three call sites in this file; adding two more entry points would have
+ * made five drifting copies. One implementation means an entry point cannot
+ * quietly get a weaker gate than its neighbours.
+ *
+ * Throws `EvalGuardViolationError` when the request must not proceed.
+ */
+async function gateInput(promptText, model, traceId, guardrail, blockOnViolation, config) {
+    let guardrailResult;
+    try {
+        guardrailResult = await guardrail.checkInput(promptText, { model, provider: "openai", projectId: config.projectId, ...config.metadata }, traceId);
+    }
+    catch (err) {
+        // An unreachable guardrail is itself a high-severity violation
+        // (fail-closed by default).
+        const unavailable = {
+            allowed: false,
+            violations: [
+                {
+                    type: "guardrail_unavailable",
+                    severity: "high",
+                    message: err instanceof Error ? err.message : "guardrail check failed",
+                },
+            ],
+        };
+        config.onViolation?.(unavailable);
+        if (blockOnViolation)
+            throw new EvalGuardViolationError(unavailable);
+        return { allowed: true, violations: [] };
+    }
+    if (!guardrailResult.allowed) {
+        config.onViolation?.(guardrailResult);
+        if (blockOnViolation)
+            throw new EvalGuardViolationError(guardrailResult);
+    }
+    return guardrailResult;
+}
+/**
+ * Collapse a Responses-API request body into scannable text.
+ *
+ * `input` is `string | ResponseInputItem[]`; items carry `content` that is
+ * itself `string | Array<{type, text}>`. `instructions` is a top-level
+ * system-prompt string. Both are model-visible, so both are scanned —
+ * and so are tool-output items, which is the channel an attacker controls
+ * in an Agents-SDK loop.
+ */
+function extractResponsesPromptText(body) {
+    const parts = [];
+    if (typeof body.instructions === "string" && body.instructions) {
+        parts.push(body.instructions);
+    }
+    const input = body.input;
+    if (typeof input === "string") {
+        if (input)
+            parts.push(input);
+    }
+    else if (Array.isArray(input)) {
+        parts.push(extractPromptText(input));
+        // Tool-output items have no `content` — their payload is on `output`.
+        for (const item of input) {
+            if (item && typeof item === "object" && item.content == null) {
+                if (typeof item.output === "string" && item.output)
+                    parts.push(item.output);
+                else if (item.output != null) {
+                    try {
+                        parts.push(JSON.stringify(item.output));
+                    }
+                    catch {
+                        /* unserialisable */
+                    }
+                }
+            }
+        }
+    }
+    return parts.filter(Boolean).join("\n");
+}
+/**
+ * A279: proxy `client.responses`, gating `create` / `stream` / `parse`.
+ *
+ * Every method that reaches the model is gated — not a subset. A cap or a
+ * gate added to some entry points and not others is the failure this repo
+ * has already shipped once (firewall input cap, 2 of 4 entry points).
+ */
+function createResponsesProxy(responses, guardrail, blockOnViolation, enableLogging, config) {
+    const GATED = new Set(["create", "stream", "parse"]);
+    return new Proxy(responses, {
+        get(target, prop, receiver) {
+            const value = Reflect.get(target, prop, target);
+            if (typeof prop === "string" && GATED.has(prop) && typeof value === "function") {
+                const original = value.bind(target);
+                return async function gatedResponsesMethod(...args) {
+                    const body = (args[0] ?? {});
+                    const model = body.model ?? "unknown";
+                    const traceId = newTraceId();
+                    const upstreamArgs = injectTraceHeader(args, traceId);
+                    const guardrailResult = await gateInput(fullScanText(extractResponsesPromptText(body), args), model, traceId, guardrail, blockOnViolation, config);
+                    const startTime = performance.now();
+                    const result = await original(...upstreamArgs);
+                    if (!enableLogging)
+                        return result;
+                    logResponsesTrace(result, model, body, startTime, guardrail, config, guardrailResult, traceId);
+                    return result;
+                };
+            }
+            // B6: the same default-deny rule one level down. `responses` carries
+            // sub-resources (`inputItems`, `inputTokens` on openai@6.44.0) that the
+            // GATED set does not name; they must not fall through raw.
+            if (typeof prop === "string") {
+                return guardSurfaceProp(target, prop, {
+                    guardrail,
+                    blockOnViolation,
+                    enableLogging,
+                    config,
+                });
+            }
+            return Reflect.get(target, prop, receiver);
+        },
+    });
+}
+/** Fire-and-forget trace for a Responses-API call. */
+function logResponsesTrace(result, model, body, startTime, guardrail, config, guardrailResult, traceId) {
+    const latencyMs = Math.round(performance.now() - startTime);
+    const res = (result ?? {});
+    // `usage` on a Response is { input_tokens, output_tokens, ... } — not the
+    // chat-completions { prompt_tokens, completion_tokens } shape.
+    const usage = (res.usage ?? {});
+    const inputTokens = typeof usage.input_tokens === "number" ? usage.input_tokens : 0;
+    const outputTokens = typeof usage.output_tokens === "number" ? usage.output_tokens : 0;
+    const outputText = typeof res.output_text === "string" ? res.output_text : null;
+    const { costUsd: cost, pricingSource: costPricingSource } = estimateCostDetailed(model, inputTokens, outputTokens);
+    void guardrail.logTrace({
+        model,
+        provider: "openai",
+        input: extractResponsesPromptText(body),
+        output: outputText,
+        latencyMs,
+        tokenUsage: { input: inputTokens, output: outputTokens },
+        cost,
+        costPricingSource,
+        projectId: config.projectId,
+        metadata: { ...config.metadata, api: "responses" },
+        guardrailResult,
+        traceId,
+    });
+}
 function createChatProxy(chat, guardrail, blockOnViolation, enableLogging, config) {
     return new Proxy(chat, {
         get(target, prop, receiver) {
             if (prop === "completions") {
                 return createCompletionsProxy(target.completions, guardrail, blockOnViolation, enableLogging, config);
             }
+            // B6: default-deny the rest of `chat` rather than returning it raw.
+            if (typeof prop === "string") {
+                return guardSurfaceProp(target, prop, {
+                    guardrail,
+                    blockOnViolation,
+                    enableLogging,
+                    config,
+                });
+            }
             return Reflect.get(target, prop, receiver);
         },
     });
@@ -99,6 +426,29 @@ function createCompletionsProxy(completions, guardrail, blockOnViolation, enable
             if (prop === "stream") {
                 return createInterceptedStream(target, guardrail, blockOnViolation, enableLogging, config);
             }
+            // 2026-07-29 (audit A279): `chat.completions.parse()` — the structured-
+            // outputs helper (`zodResponseFormat`) — is a THIRD entry point to the
+            // same endpoint and was ungated. Verified `typeof
+            // client.chat.completions.parse === "function"` on openai@6.44.0.
+            // It resolves to a ParsedChatCompletion, so the non-streaming handler
+            // applies unchanged.
+            if (prop === "parse") {
+                const original = Reflect.get(target, prop, target);
+                if (typeof original === "function") {
+                    return createInterceptedCreate(original.bind(target), guardrail, blockOnViolation, enableLogging, config);
+                }
+                return original;
+            }
+            // B6: default-deny the rest of `chat.completions` rather than returning
+            // it raw.
+            if (typeof prop === "string") {
+                return guardSurfaceProp(target, prop, {
+                    guardrail,
+                    blockOnViolation,
+                    enableLogging,
+                    config,
+                });
+            }
             return Reflect.get(target, prop, receiver);
         },
     });
@@ -120,47 +470,13 @@ function createInterceptedCreate(originalCreate, guardrail, blockOnViolation, en
         const traceId = newTraceId();
         const upstreamArgs = injectTraceHeader(args, traceId);
         // ── Pre-request guardrail check ─────────────────────────────────────
-        const promptText = extractPromptText(messages);
-        let guardrailResult;
-        try {
-            guardrailResult = await guardrail.checkInput(promptText, {
-                model,
-                provider: "openai",
-                projectId: config.projectId,
-                ...config.metadata,
-            }, traceId);
-        }
-        catch (err) {
-            // 2026-05-28: previously this catch silently set
-            // `{ allowed: true, violations: [] }` — meaning any guardrail
-            // outage (network blip, EvalGuard 5xx, DNS hiccup) became a
-            // free pass for the prompt. Per check.txt audit P1 finding.
-            //
-            // New contract: an unreachable guardrail is itself a
-            // "guardrail_unavailable" violation. Honor blockOnViolation —
-            // true (default) → throw; false → onViolation callback + allow.
-            const unavailable = {
-                allowed: false,
-                violations: [
-                    {
-                        type: "guardrail_unavailable",
-                        severity: "high",
-                        message: err instanceof Error ? err.message : "guardrail check failed",
-                    },
-                ],
-            };
-            config.onViolation?.(unavailable);
-            if (blockOnViolation) {
-                throw new EvalGuardViolationError(unavailable);
-            }
-            guardrailResult = { allowed: true, violations: [] };
-        }
-        if (!guardrailResult.allowed) {
-            config.onViolation?.(guardrailResult);
-            if (blockOnViolation) {
-                throw new EvalGuardViolationError(guardrailResult);
-            }
-        }
+        // 2026-07-29 (A279): shared with responses.create / responses.stream /
+        // responses.parse / chat.completions.stream via gateInput() so no entry
+        // point can drift to a weaker gate. Contract (unchanged from 2026-05-28):
+        // an unreachable guardrail is itself a "guardrail_unavailable" violation
+        // — blockOnViolation true (default) → throw; false → onViolation + allow.
+        const promptText = fullScanText(extractPromptText(messages), args);
+        const guardrailResult = await gateInput(promptText, model, traceId, guardrail, blockOnViolation, config);
         // ── Execute LLM call ────────────────────────────────────────────────
         const startTime = performance.now();
         if (isStreaming) {
@@ -173,10 +489,10 @@ function createInterceptedCreate(originalCreate, guardrail, blockOnViolation, en
 async function handleNonStreamingResponse(originalCreate, args, model, messages, startTime, guardrail, enableLogging, config, guardrailResult, traceId) {
     const response = await originalCreate(...args);
     const latencyMs = Math.round(performance.now() - startTime);
-    const usage = response.usage;
-    const inputTokens = usage?.prompt_tokens ?? 0;
-    const outputTokens = usage?.completion_tokens ?? 0;
-    const cost = estimateCost(model, inputTokens, outputTokens);
+    const usageBreakdown = normalizeOpenAIUsage(response.usage);
+    const inputTokens = usageBreakdown.input;
+    const outputTokens = usageBreakdown.output;
+    const { costUsd: cost, pricingSource: costPricingSource } = estimateCostDetailed(model, inputTokens, outputTokens, { cachedInputTokens: usageBreakdown.cached });
     const outputContent = response.choices?.[0]
         ?.message ?? null;
     const idempotencyKey = resolveIdempotencyKey(config);
@@ -201,8 +517,9 @@ async function handleNonStreamingResponse(originalCreate, args, model, messages,
                 input: messages,
                 output: outputContent,
                 latencyMs,
-                tokenUsage: { input: inputTokens, output: outputTokens },
+                tokenUsage: usageBreakdown,
                 cost,
+                costPricingSource,
                 projectId: config.projectId,
                 metadata: config.metadata,
                 guardrailResult,
@@ -225,8 +542,9 @@ async function handleNonStreamingResponse(originalCreate, args, model, messages,
             input: messages,
             output: outputContent,
             latencyMs,
-            tokenUsage: { input: inputTokens, output: outputTokens },
+            tokenUsage: usageBreakdown,
             cost,
+            costPricingSource,
             projectId: config.projectId,
             metadata: config.metadata,
             guardrailResult,
@@ -251,9 +569,15 @@ async function handleStreamingResponse(originalCreate, args, model, messages, st
     return wrapAsyncIterable(stream, model, messages, startTime, guardrail, config, guardrailResult, traceId);
 }
 function finalizeOpenAIStream(state) {
-    const { assembledContent, inputTokens, outputTokens, model, messages, startTime, guardrail, config, guardrailResult, traceId, } = state;
+    const { assembledContent, inputTokens, outputTokens, cachedTokens, reasoningTokens, model, messages, startTime, guardrail, config, guardrailResult, traceId, } = state;
     const latencyMs = Math.round(performance.now() - startTime);
-    const cost = estimateCost(model, inputTokens, outputTokens);
+    const { costUsd: cost, pricingSource: costPricingSource } = estimateCostDetailed(model, inputTokens, outputTokens, { cachedInputTokens: cachedTokens });
+    const usageBreakdown = {
+        input: inputTokens,
+        output: outputTokens,
+        ...(cachedTokens ? { cached: cachedTokens } : {}),
+        ...(reasoningTokens ? { reasoning: reasoningTokens } : {}),
+    };
     const idempotencyKey = resolveIdempotencyKey(config);
     runPostResponseEval(guardrail, config, assembledContent, { model, provider: "openai", projectId: config.projectId, ...config.metadata }, traceId, idempotencyKey)
         .catch((err) => {
@@ -277,8 +601,9 @@ function finalizeOpenAIStream(state) {
             input: messages,
             output: assembledContent,
             latencyMs,
-            tokenUsage: { input: inputTokens, output: outputTokens },
+            tokenUsage: usageBreakdown,
             cost,
+            costPricingSource,
             projectId: config.projectId,
             metadata: config.metadata,
             guardrailResult,
@@ -295,6 +620,8 @@ function wrapAsyncIterable(stream, model, messages, startTime, guardrail, config
     let assembledContent = "";
     let inputTokens = 0;
     let outputTokens = 0;
+    let cachedTokens;
+    let reasoningTokens;
     const originalIterator = Symbol.asyncIterator in stream
         ? stream[Symbol.asyncIterator]()
         : stream;
@@ -309,6 +636,8 @@ function wrapAsyncIterable(stream, model, messages, startTime, guardrail, config
                     assembledContent,
                     inputTokens,
                     outputTokens,
+                    cachedTokens,
+                    reasoningTokens,
                     model,
                     messages,
                     startTime,
@@ -325,11 +654,17 @@ function wrapAsyncIterable(stream, model, messages, startTime, guardrail, config
             if (choices?.[0]?.delta?.content) {
                 assembledContent += choices[0].delta.content;
             }
-            // Capture usage if present (some models report on final chunk)
-            const usage = chunk.usage;
-            if (usage) {
-                inputTokens = usage.prompt_tokens ?? inputTokens;
-                outputTokens = usage.completion_tokens ?? outputTokens;
+            // Capture usage if present (some models report on final chunk, only when
+            // the caller set stream_options.include_usage). Normalize to pick up the
+            // cached/reasoning detail for FinOps-accurate cost.
+            if (chunk.usage) {
+                const u = normalizeOpenAIUsage(chunk.usage);
+                inputTokens = u.input || inputTokens;
+                outputTokens = u.output || outputTokens;
+                if (u.cached)
+                    cachedTokens = u.cached;
+                if (u.reasoning)
+                    reasoningTokens = u.reasoning;
             }
             return result;
         },
@@ -395,36 +730,9 @@ function createInterceptedStream(completions, guardrail, blockOnViolation, enabl
         const traceId = newTraceId();
         const upstreamArgs = injectTraceHeader(args, traceId);
         // ── Pre-request guardrail check ─────────────────────────────────────
-        const promptText = extractPromptText(messages);
-        let guardrailResult;
-        try {
-            guardrailResult = await guardrail.checkInput(promptText, { model, provider: "openai", projectId: config.projectId, ...config.metadata }, traceId);
-        }
-        catch (err) {
-            // Unreachable guardrail is itself a high-severity violation
-            // (fail-closed by default) — symmetric with the create() path.
-            const unavailable = {
-                allowed: false,
-                violations: [
-                    {
-                        type: "guardrail_unavailable",
-                        severity: "high",
-                        message: err instanceof Error ? err.message : "guardrail check failed",
-                    },
-                ],
-            };
-            config.onViolation?.(unavailable);
-            if (blockOnViolation) {
-                throw new EvalGuardViolationError(unavailable);
-            }
-            guardrailResult = { allowed: true, violations: [] };
-        }
-        if (!guardrailResult.allowed) {
-            config.onViolation?.(guardrailResult);
-            if (blockOnViolation) {
-                throw new EvalGuardViolationError(guardrailResult);
-            }
-        }
+        // Same gate as create() / responses.* — see gateInput().
+        const promptText = fullScanText(extractPromptText(messages), args);
+        const guardrailResult = await gateInput(promptText, model, traceId, guardrail, blockOnViolation, config);
         const startTime = performance.now();
         const stream = originalStream(...upstreamArgs);
         const resolved = stream instanceof Promise ? await stream : stream;
@@ -444,6 +752,8 @@ function wrapChatCompletionStream(stream, model, messages, startTime, guardrail,
     let assembledContent = "";
     let inputTokens = 0;
     let outputTokens = 0;
+    let cachedTokens;
+    let reasoningTokens;
     let settled = false;
     const finalizeOnce = (content, inTok, outTok) => {
         if (settled)
@@ -453,6 +763,8 @@ function wrapChatCompletionStream(stream, model, messages, startTime, guardrail,
             assembledContent: content,
             inputTokens: inTok,
             outputTokens: outTok,
+            cachedTokens,
+            reasoningTokens,
             model,
             messages,
             startTime,
@@ -477,10 +789,14 @@ function wrapChatCompletionStream(stream, model, messages, startTime, guardrail,
             if (choices?.[0]?.delta?.content) {
                 assembledContent += choices[0].delta.content;
             }
-            const usage = chunk.usage;
-            if (usage) {
-                inputTokens = usage.prompt_tokens ?? inputTokens;
-                outputTokens = usage.completion_tokens ?? outputTokens;
+            if (chunk.usage) {
+                const u = normalizeOpenAIUsage(chunk.usage);
+                inputTokens = u.input || inputTokens;
+                outputTokens = u.output || outputTokens;
+                if (u.cached)
+                    cachedTokens = u.cached;
+                if (u.reasoning)
+                    reasoningTokens = u.reasoning;
             }
             return result;
         },
@@ -512,8 +828,17 @@ function wrapChatCompletionStream(stream, model, messages, startTime, guardrail,
                     const completion = (await stream.finalChatCompletion(...a));
                     const choice = completion.choices?.[0];
                     const text = String(choice?.message?.content ?? "");
-                    const u = completion.usage;
-                    finalizeOnce(text, u?.prompt_tokens ?? inputTokens, u?.completion_tokens ?? outputTokens);
+                    if (completion.usage) {
+                        const u = normalizeOpenAIUsage(completion.usage);
+                        if (u.cached)
+                            cachedTokens = u.cached;
+                        if (u.reasoning)
+                            reasoningTokens = u.reasoning;
+                        finalizeOnce(text, u.input || inputTokens, u.output || outputTokens);
+                    }
+                    else {
+                        finalizeOnce(text, inputTokens, outputTokens);
+                    }
                     return completion;
                 };
             }