npm - @kodelyth/codex - Versions diffs - 2026.5.40 → 2026.5.42 - Mend

@kodelyth/codex 2026.5.40 → 2026.5.42

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (178) hide show

package/dist/client-ChMX13_o.js +642 -0
package/dist/client-factory-D3dIsp4Y.js +9 -0
package/dist/command-formatters-BRW7_Nu7.js +519 -0
package/dist/command-handlers-P2IqtXaZ.js +1462 -0
package/dist/compact-baos5flR.js +329 -0
package/dist/computer-use-VfLvTMaa.js +367 -0
package/dist/config-CezENx_E.js +510 -0
package/dist/doctor-contract-api.js +53 -0
package/dist/harness.js +51 -0
package/dist/index.js +1133 -0
package/dist/media-understanding-provider.js +335 -0
package/dist/models-B9DhrIwD.js +110 -0
package/dist/node-cli-sessions-De4_DuFw.js +1216 -0
package/dist/plugin-activation-BlMuJeXz.js +452 -0
package/dist/prompt-overlay.js +12 -0
package/dist/protocol-C9UWI98H.js +9 -0
package/dist/protocol-validators-BGBspNmF.js +5988 -0
package/dist/provider-catalog.js +84 -0
package/dist/provider-discovery.js +33 -0
package/dist/provider.js +150 -0
package/dist/rate-limit-cache-CHuacE27.js +24 -0
package/dist/request-CTQKUxaa.js +89 -0
package/dist/rolldown-runtime-DUslC3ob.js +14 -0
package/dist/run-attempt-DqV2OU1R.js +5366 -0
package/dist/session-binding-3PzU7ZTW.js +222 -0
package/dist/shared-client-Cnyr9dyT.js +631 -0
package/dist/side-question-CP5XlA0U.js +667 -0
package/dist/test-api.js +45 -0
package/dist/thread-lifecycle-DBJetBuV.js +1561 -0
package/dist/vision-tools-Cl_5a93K.js +1379 -0
package/doctor-contract-api.test.ts +44 -0
package/doctor-contract-api.ts +68 -0
package/harness.ts +72 -0
package/index.test.ts +230 -0
package/index.ts +66 -0
package/klaw.plugin.json +24 -85
package/media-understanding-provider.test.ts +486 -0
package/media-understanding-provider.ts +521 -0
package/package.json +3 -3
package/prompt-overlay-runtime-contract.test.ts +48 -0
package/prompt-overlay.ts +21 -0
package/provider-catalog.ts +83 -0
package/provider-discovery.ts +45 -0
package/provider.test.ts +384 -0
package/provider.ts +243 -0
package/src/app-server/app-inventory-cache.test.ts +176 -0
package/src/app-server/app-inventory-cache.ts +324 -0
package/src/app-server/approval-bridge.test.ts +1471 -0
package/src/app-server/approval-bridge.ts +1211 -0
package/src/app-server/auth-bridge.test.ts +1449 -0
package/src/app-server/auth-bridge.ts +614 -0
package/src/app-server/auth-profile-runtime-contract.test.ts +239 -0
package/src/app-server/capabilities.ts +27 -0
package/src/app-server/client-factory.ts +24 -0
package/src/app-server/client.test.ts +563 -0
package/src/app-server/client.ts +715 -0
package/src/app-server/compact.test.ts +710 -0
package/src/app-server/compact.ts +500 -0
package/src/app-server/computer-use.test.ts +788 -0
package/src/app-server/computer-use.ts +683 -0
package/src/app-server/config.test.ts +879 -0
package/src/app-server/config.ts +1038 -0
package/src/app-server/context-engine-projection.test.ts +252 -0
package/src/app-server/context-engine-projection.ts +403 -0
package/src/app-server/delivery-no-reply-runtime-contract.test.ts +80 -0
package/src/app-server/dynamic-tool-diagnostics.ts +73 -0
package/src/app-server/dynamic-tool-profile.ts +69 -0
package/src/app-server/dynamic-tools.test.ts +1302 -0
package/src/app-server/dynamic-tools.ts +623 -0
package/src/app-server/elicitation-bridge.test.ts +1056 -0
package/src/app-server/elicitation-bridge.ts +783 -0
package/src/app-server/event-projector.test.ts +2668 -0
package/src/app-server/event-projector.ts +2057 -0
package/src/app-server/image-payload-sanitizer.test.ts +49 -0
package/src/app-server/image-payload-sanitizer.ts +167 -0
package/src/app-server/klaw-owned-tool-runtime-contract.test.ts +456 -0
package/src/app-server/local-runtime-attribution.ts +39 -0
package/src/app-server/managed-binary.test.ts +139 -0
package/src/app-server/managed-binary.ts +193 -0
package/src/app-server/models.test.ts +246 -0
package/src/app-server/models.ts +172 -0
package/src/app-server/native-hook-relay.test.ts +271 -0
package/src/app-server/native-hook-relay.ts +150 -0
package/src/app-server/native-subagent-task-mirror.test.ts +573 -0
package/src/app-server/native-subagent-task-mirror.ts +497 -0
package/src/app-server/outcome-fallback-runtime-contract.test.ts +404 -0
package/src/app-server/plugin-activation.test.ts +336 -0
package/src/app-server/plugin-activation.ts +283 -0
package/src/app-server/plugin-app-cache-key.ts +74 -0
package/src/app-server/plugin-approval-roundtrip.ts +122 -0
package/src/app-server/plugin-inventory.test.ts +355 -0
package/src/app-server/plugin-inventory.ts +357 -0
package/src/app-server/plugin-thread-config.test.ts +865 -0
package/src/app-server/plugin-thread-config.ts +455 -0
package/src/app-server/protocol-generated/json/DynamicToolCallParams.json +33 -0
package/src/app-server/protocol-generated/json/v2/ErrorNotification.json +199 -0
package/src/app-server/protocol-generated/json/v2/GetAccountResponse.json +102 -0
package/src/app-server/protocol-generated/json/v2/ModelListResponse.json +227 -0
package/src/app-server/protocol-generated/json/v2/ThreadResumeResponse.json +2630 -0
package/src/app-server/protocol-generated/json/v2/ThreadStartResponse.json +2630 -0
package/src/app-server/protocol-generated/json/v2/TurnCompletedNotification.json +1659 -0
package/src/app-server/protocol-generated/json/v2/TurnStartResponse.json +1655 -0
package/src/app-server/protocol-validators.test.ts +75 -0
package/src/app-server/protocol-validators.ts +203 -0
package/src/app-server/protocol.ts +520 -0
package/src/app-server/rate-limit-cache.ts +48 -0
package/src/app-server/rate-limits.test.ts +202 -0
package/src/app-server/rate-limits.ts +583 -0
package/src/app-server/request.ts +73 -0
package/src/app-server/run-attempt.context-engine.test.ts +1004 -0
package/src/app-server/run-attempt.test.ts +9477 -0
package/src/app-server/run-attempt.ts +4683 -0
package/src/app-server/run-attempt.vision-tools.test.ts +35 -0
package/src/app-server/schema-normalization-runtime-contract.test.ts +206 -0
package/src/app-server/session-binding.test.ts +303 -0
package/src/app-server/session-binding.ts +398 -0
package/src/app-server/session-history.ts +44 -0
package/src/app-server/shared-client.test.ts +589 -0
package/src/app-server/shared-client.ts +289 -0
package/src/app-server/side-question.test.ts +1175 -0
package/src/app-server/side-question.ts +1007 -0
package/src/app-server/test-support.ts +48 -0
package/src/app-server/thread-lifecycle.test.ts +447 -0
package/src/app-server/thread-lifecycle.ts +939 -0
package/src/app-server/thread-lifecycle.user-mcp-servers.test.ts +442 -0
package/src/app-server/timeout.ts +9 -0
package/src/app-server/tool-progress-normalization.ts +77 -0
package/src/app-server/trajectory.test.ts +205 -0
package/src/app-server/trajectory.ts +365 -0
package/src/app-server/transcript-mirror.test.ts +524 -0
package/src/app-server/transcript-mirror.ts +208 -0
package/src/app-server/transcript-repair-runtime-contract.test.ts +44 -0
package/src/app-server/transport-stdio.test.ts +171 -0
package/src/app-server/transport-stdio.ts +107 -0
package/src/app-server/transport-websocket.test.ts +69 -0
package/src/app-server/transport-websocket.ts +90 -0
package/src/app-server/transport.ts +117 -0
package/src/app-server/user-input-bridge.test.ts +249 -0
package/src/app-server/user-input-bridge.ts +316 -0
package/src/app-server/version.ts +4 -0
package/src/app-server/vision-tools.ts +12 -0
package/src/command-account.ts +544 -0
package/src/command-formatters.ts +425 -0
package/src/command-handlers.ts +2004 -0
package/src/command-rpc.test.ts +16 -0
package/src/command-rpc.ts +142 -0
package/src/commands.test.ts +3312 -0
package/src/commands.ts +65 -0
package/src/conversation-binding-data.ts +124 -0
package/src/conversation-binding.test.ts +599 -0
package/src/conversation-binding.ts +561 -0
package/src/conversation-control.test.ts +126 -0
package/src/conversation-control.ts +303 -0
package/src/conversation-turn-collector.test.ts +191 -0
package/src/conversation-turn-collector.ts +186 -0
package/src/conversation-turn-input.test.ts +141 -0
package/src/conversation-turn-input.ts +106 -0
package/src/manifest.test.ts +20 -0
package/src/migration/apply.ts +501 -0
package/src/migration/helpers.ts +55 -0
package/src/migration/plan.ts +461 -0
package/src/migration/provider.test.ts +1741 -0
package/src/migration/provider.ts +41 -0
package/src/migration/source.ts +643 -0
package/src/migration/targets.ts +25 -0
package/src/node-cli-sessions.test.ts +180 -0
package/src/node-cli-sessions.ts +711 -0
package/test-api.ts +82 -0
package/tsconfig.json +16 -0
package/doctor-contract-api.js +0 -7
package/harness.js +0 -7
package/index.js +0 -7
package/media-understanding-provider.js +0 -7
package/prompt-overlay.js +0 -7
package/provider-catalog.js +0 -7
package/provider-discovery.js +0 -7
package/provider.js +0 -7
package/test-api.js +0 -7

package/src/app-server/app-inventory-cache.test.ts ADDED Viewed

@@ -0,0 +1,176 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  CodexAppInventoryCache,
+  buildCodexAppInventoryCacheKey,
+  serializeCodexAppInventoryError,
+} from "./app-inventory-cache.js";
+import type { v2 } from "./protocol.js";
+describe("Codex app inventory cache", () => {
+  it("returns missing while scheduling one coalesced app/list refresh", async () => {
+    const cache = new CodexAppInventoryCache({ ttlMs: 100 });
+    const request = vi.fn(async (_method: "app/list", params: v2.AppsListParams) => {
+      return {
+        data: [app(params.cursor ? "app-2" : "app-1")],
+        nextCursor: params.cursor ? null : "next",
+      } satisfies v2.AppsListResponse;
+    });
+    const key = buildCodexAppInventoryCacheKey({ codexHome: "/codex", authProfileId: "work" });
+    const read = cache.read({ key, request, nowMs: 0 });
+    expect(read.state).toBe("missing");
+    expect(read.refreshScheduled).toBe(true);
+    const snapshot = await cache.refreshNow({ key, request, nowMs: 0 });
+    expect(snapshot.apps.map((item) => item.id)).toEqual(["app-1", "app-2"]);
+    expect(request).toHaveBeenCalledTimes(2);
+    const fresh = cache.read({ key, request, nowMs: 50 });
+    expect(fresh.state).toBe("fresh");
+    expect(fresh.refreshScheduled).toBe(false);
+    expect(fresh.snapshot?.apps.map((item) => item.id)).toEqual(["app-1", "app-2"]);
+  });
+  it("can read missing inventory without scheduling app/list", async () => {
+    const cache = new CodexAppInventoryCache({ ttlMs: 100 });
+    const request = vi.fn(async () => {
+      return {
+        data: [app("app-1")],
+        nextCursor: null,
+      } satisfies v2.AppsListResponse;
+    });
+    const read = cache.read({
+      key: "runtime",
+      request,
+      suppressRefresh: true,
+    });
+    expect(read.state).toBe("missing");
+    expect(read.refreshScheduled).toBe(false);
+    expect(request).not.toHaveBeenCalled();
+  });
+  it("uses stale inventory for the current read while still refreshing asynchronously", async () => {
+    const cache = new CodexAppInventoryCache({ ttlMs: 10 });
+    const request = vi.fn(async () => {
+      return {
+        data: [app(`app-${request.mock.calls.length}`)],
+        nextCursor: null,
+      } satisfies v2.AppsListResponse;
+    });
+    const key = "runtime";
+    await cache.refreshNow({ key, request, nowMs: 0 });
+    const stale = cache.read({ key, request, nowMs: 11, suppressRefresh: true });
+    expect(stale.state).toBe("stale");
+    expect(stale.snapshot?.apps.map((item) => item.id)).toEqual(["app-1"]);
+    expect(stale.refreshScheduled).toBe(true);
+    const refreshed = await cache.refreshNow({ key, request, nowMs: 11 });
+    expect(refreshed.apps.map((item) => item.id)).toEqual(["app-2"]);
+  });
+  it("records refresh errors without discarding the last successful snapshot", async () => {
+    const cache = new CodexAppInventoryCache({ ttlMs: 1 });
+    const key = "runtime";
+    await cache.refreshNow({
+      key,
+      nowMs: 0,
+      request: async () => ({ data: [app("app-1")], nextCursor: null }),
+    });
+    await expect(
+      cache.refreshNow({
+        key,
+        nowMs: 2,
+        request: async () => {
+          throw new Error("app list failed");
+        },
+      }),
+    ).rejects.toThrow("app list failed");
+    const read = cache.read({
+      key,
+      nowMs: 2,
+      request: async () => ({ data: [app("app-2")], nextCursor: null }),
+    });
+    expect(read.snapshot?.apps.map((item) => item.id)).toEqual(["app-1"]);
+    expect(read.diagnostic?.message).toBe("app list failed");
+  });
+  it("omits challenge HTML when serializing app/list errors", () => {
+    const error = new Error(
+      'failed to list apps: Request failed with status 403 Forbidden: <html><script src="/backend-api/connectors/directory/list?__cf_chl_tk=secret-token"></script></html>',
+    );
+    const serialized = serializeCodexAppInventoryError(error);
+    expect(serialized.message).toBe(
+      "failed to list apps: Request failed with status 403 Forbidden: [HTML response body omitted]",
+    );
+  });
+  it("forces a post-install refresh past an older in-flight app/list", async () => {
+    const cache = new CodexAppInventoryCache({ ttlMs: 1_000 });
+    const key = "runtime";
+    let resolveStale: ((response: v2.AppsListResponse) => void) | undefined;
+    let resolveFresh: ((response: v2.AppsListResponse) => void) | undefined;
+    const request = vi.fn(
+      async (_method: "app/list", params: v2.AppsListParams): Promise<v2.AppsListResponse> => {
+        expect(params.forceRefetch).toBe(request.mock.calls.length === 2);
+        return await new Promise((resolve) => {
+          if (request.mock.calls.length === 1) {
+            resolveStale = resolve;
+          } else {
+            resolveFresh = resolve;
+          }
+        });
+      },
+    );
+    const staleRead = cache.read({ key, request, nowMs: 0 });
+    expect(staleRead.state).toBe("missing");
+    expect(staleRead.refreshScheduled).toBe(true);
+    cache.invalidate(key, "plugin installed", 1);
+    const forcedRead = cache.read({ key, request, nowMs: 1, forceRefetch: true });
+    expect(forcedRead.state).toBe("missing");
+    expect(forcedRead.refreshScheduled).toBe(true);
+    expect(request).toHaveBeenCalledTimes(2);
+    const forced = cache.refreshNow({ key, request, nowMs: 1 });
+    resolveFresh?.({ data: [app("fresh-app")], nextCursor: null });
+    await expect(forced).resolves.toStrictEqual({
+      key,
+      apps: [app("fresh-app")],
+      fetchedAtMs: 1,
+      expiresAtMs: 1_001,
+      revision: 2,
+    });
+    resolveStale?.({ data: [app("stale-app")], nextCursor: null });
+    await Promise.resolve();
+    const freshRead = cache.read({ key, request, nowMs: 2 });
+    expect(freshRead.state).toBe("fresh");
+    expect(freshRead.snapshot?.apps.map((item) => item.id)).toEqual(["fresh-app"]);
+  });
+});
+function app(id: string): v2.AppInfo {
+  return {
+    id,
+    name: id,
+    description: null,
+    logoUrl: null,
+    logoUrlDark: null,
+    distributionChannel: null,
+    branding: null,
+    appMetadata: null,
+    labels: null,
+    installUrl: null,
+    isAccessible: true,
+    isEnabled: true,
+    pluginDisplayNames: [],
+  };
+}

package/src/app-server/app-inventory-cache.ts ADDED Viewed

@@ -0,0 +1,324 @@
+import { embeddedAgentLog } from "klaw/plugin-sdk/agent-harness-runtime";
+import type { JsonValue, v2 } from "./protocol.js";
+export const CODEX_APP_INVENTORY_CACHE_TTL_MS = 60 * 60 * 1_000;
+const MAX_SERIALIZED_ERROR_MESSAGE_LENGTH = 500;
+export type CodexAppInventoryRequest = (
+  method: "app/list",
+  params: v2.AppsListParams,
+) => Promise<v2.AppsListResponse>;
+export type CodexAppInventoryCacheKeyInput = {
+  codexHome?: string;
+  endpoint?: string;
+  authProfileId?: string;
+  accountId?: string;
+  envApiKeyFingerprint?: string;
+  appServerVersion?: string;
+};
+export type CodexAppInventoryCacheDiagnostic = {
+  message: string;
+  atMs: number;
+};
+export type CodexAppInventorySnapshot = {
+  key: string;
+  apps: v2.AppInfo[];
+  fetchedAtMs: number;
+  expiresAtMs: number;
+  revision: number;
+  lastError?: CodexAppInventoryCacheDiagnostic;
+};
+export type CodexAppInventoryReadState = "fresh" | "stale" | "missing";
+export type CodexAppInventoryCacheRead = {
+  state: CodexAppInventoryReadState;
+  key: string;
+  revision: number;
+  snapshot?: CodexAppInventorySnapshot;
+  refreshScheduled: boolean;
+  diagnostic?: CodexAppInventoryCacheDiagnostic;
+};
+type CacheEntry = CodexAppInventorySnapshot & {
+  invalidated: boolean;
+};
+type RefreshParams = {
+  key: string;
+  request: CodexAppInventoryRequest;
+  nowMs?: number;
+  forceRefetch?: boolean;
+  suppressRefresh?: boolean;
+};
+export class CodexAppInventoryCache {
+  private readonly ttlMs: number;
+  private readonly entries = new Map<string, CacheEntry>();
+  private readonly inFlight = new Map<string, Promise<CodexAppInventorySnapshot>>();
+  // Per-key refresh generation. Each refresh attempt claims the next token so
+  // an older request that finishes late cannot overwrite a newer snapshot.
+  private readonly refreshTokens = new Map<string, number>();
+  private readonly diagnostics = new Map<string, CodexAppInventoryCacheDiagnostic>();
+  private revision = 0;
+  constructor(options: { ttlMs?: number } = {}) {
+    this.ttlMs = options.ttlMs ?? CODEX_APP_INVENTORY_CACHE_TTL_MS;
+  }
+  read(params: RefreshParams): CodexAppInventoryCacheRead {
+    const nowMs = params.nowMs ?? Date.now();
+    const entry = this.entries.get(params.key);
+    if (!entry) {
+      const refreshScheduled = params.suppressRefresh ? false : this.scheduleRefresh(params);
+      return {
+        state: "missing",
+        key: params.key,
+        revision: this.revision,
+        refreshScheduled,
+        ...(this.diagnostics.get(params.key)
+          ? { diagnostic: this.diagnostics.get(params.key) }
+          : {}),
+      };
+    }
+    const state: CodexAppInventoryReadState =
+      entry.invalidated || entry.expiresAtMs <= nowMs ? "stale" : "fresh";
+    const refreshScheduled =
+      state === "fresh" && !params.forceRefetch ? false : this.scheduleRefresh(params);
+    return {
+      state,
+      key: params.key,
+      revision: entry.revision,
+      snapshot: stripEntryState(entry),
+      refreshScheduled,
+      ...(entry.lastError ? { diagnostic: entry.lastError } : {}),
+    };
+  }
+  refreshNow(params: RefreshParams): Promise<CodexAppInventorySnapshot> {
+    return this.refresh(params);
+  }
+  invalidate(key: string, reason: string, nowMs = Date.now()): number {
+    this.revision += 1;
+    const diagnostic = { message: reason, atMs: nowMs };
+    const entry = this.entries.get(key);
+    if (entry) {
+      entry.invalidated = true;
+      entry.lastError = diagnostic;
+      entry.revision = this.revision;
+    } else {
+      this.diagnostics.set(key, diagnostic);
+    }
+    return this.revision;
+  }
+  clear(): void {
+    this.entries.clear();
+    this.inFlight.clear();
+    this.refreshTokens.clear();
+    this.diagnostics.clear();
+    this.revision = 0;
+  }
+  getRevision(): number {
+    return this.revision;
+  }
+  private scheduleRefresh(params: RefreshParams): boolean {
+    if (this.inFlight.has(params.key) && !params.forceRefetch) {
+      return true;
+    }
+    const promise = this.refresh(params);
+    this.inFlight.set(params.key, promise);
+    promise.catch(() => undefined);
+    return true;
+  }
+  private async refresh(params: RefreshParams): Promise<CodexAppInventorySnapshot> {
+    const existing = this.inFlight.get(params.key);
+    if (existing && !params.forceRefetch) {
+      return existing;
+    }
+    const refreshToken = (this.refreshTokens.get(params.key) ?? 0) + 1;
+    this.refreshTokens.set(params.key, refreshToken);
+    const promise = this.refreshUncoalesced(params, refreshToken);
+    this.inFlight.set(params.key, promise);
+    try {
+      return await promise;
+    } finally {
+      if (this.inFlight.get(params.key) === promise) {
+        this.inFlight.delete(params.key);
+      }
+    }
+  }
+  private async refreshUncoalesced(
+    params: RefreshParams,
+    refreshToken: number,
+  ): Promise<CodexAppInventorySnapshot> {
+    const nowMs = params.nowMs ?? Date.now();
+    try {
+      const apps = await listAllApps(params.request, params.forceRefetch ?? false);
+      this.revision += 1;
+      const snapshot: CodexAppInventorySnapshot = {
+        key: params.key,
+        apps,
+        fetchedAtMs: nowMs,
+        expiresAtMs: nowMs + this.ttlMs,
+        revision: this.revision,
+      };
+      // Only publish this snapshot if no newer refresh started for the same key
+      // while this request was in flight.
+      if (this.refreshTokens.get(params.key) === refreshToken) {
+        this.entries.set(params.key, { ...snapshot, invalidated: false });
+        this.diagnostics.delete(params.key);
+      }
+      return snapshot;
+    } catch (error) {
+      const diagnostic = {
+        message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+        atMs: nowMs,
+      };
+      this.diagnostics.set(params.key, diagnostic);
+      const entry = this.entries.get(params.key);
+      if (entry) {
+        entry.lastError = diagnostic;
+      }
+      embeddedAgentLog.warn("codex app inventory refresh failed", {
+        forceRefetch: params.forceRefetch === true,
+        keyFingerprint: fingerprintInventoryCacheKey(params.key),
+        error: serializeCodexAppInventoryError(error),
+      });
+      throw error;
+    }
+  }
+}
+export function serializeCodexAppInventoryError(error: unknown): Record<string, unknown> {
+  const record = isRecord(error) ? error : undefined;
+  const data = record && "data" in record ? redactErrorData(record.data) : undefined;
+  return {
+    name:
+      error instanceof Error
+        ? error.name
+        : typeof record?.name === "string"
+          ? record.name
+          : undefined,
+    message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+    ...(typeof record?.code === "number" ? { code: record.code } : {}),
+    ...(data !== undefined ? { data } : {}),
+  };
+}
+export const defaultCodexAppInventoryCache = new CodexAppInventoryCache();
+export function buildCodexAppInventoryCacheKey(input: CodexAppInventoryCacheKeyInput): string {
+  return JSON.stringify({
+    codexHome: input.codexHome ?? null,
+    endpoint: input.endpoint ?? null,
+    authProfileId: input.authProfileId ?? null,
+    accountId: input.accountId ?? null,
+    envApiKeyFingerprint: input.envApiKeyFingerprint ?? null,
+    appServerVersion: input.appServerVersion ?? null,
+  });
+}
+async function listAllApps(
+  request: CodexAppInventoryRequest,
+  forceRefetch: boolean,
+): Promise<v2.AppInfo[]> {
+  const apps: v2.AppInfo[] = [];
+  let cursor: string | null | undefined;
+  do {
+    const response = await request("app/list", {
+      cursor,
+      limit: 100,
+      forceRefetch,
+    });
+    apps.push(...response.data);
+    cursor = response.nextCursor;
+  } while (cursor);
+  return apps;
+}
+function stripEntryState(entry: CacheEntry): CodexAppInventorySnapshot {
+  const { invalidated: _invalidated, ...snapshot } = entry;
+  return snapshot;
+}
+function fingerprintInventoryCacheKey(key: string): string {
+  let hash = 0;
+  for (let index = 0; index < key.length; index += 1) {
+    hash = (hash * 31 + key.charCodeAt(index)) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function redactErrorData(value: unknown, depth = 0): JsonValue | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+  if (value === null || typeof value === "boolean" || typeof value === "number") {
+    return value;
+  }
+  if (depth > 6) {
+    return "[truncated]";
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => redactErrorData(entry, depth + 1) ?? null);
+  }
+  if (isRecord(value)) {
+    const redacted: Record<string, JsonValue> = {};
+    for (const [key, entry] of Object.entries(value)) {
+      redacted[key] = isSensitiveErrorDataKey(key)
+        ? "<redacted>"
+        : (redactErrorData(entry, depth + 1) ?? null);
+    }
+    return redacted;
+  }
+  if (typeof value === "string" && value.length > 500) {
+    return `${value.slice(0, 500)}...`;
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  if (typeof value === "symbol") {
+    return value.description ? `Symbol(${value.description})` : "Symbol()";
+  }
+  if (typeof value === "function") {
+    return value.name ? `[function ${value.name}]` : "[function]";
+  }
+  return "[unserializable]";
+}
+function sanitizeErrorMessage(message: string): string {
+  const htmlStart = message.search(/<html[\s>]/i);
+  const withoutHtml =
+    htmlStart >= 0
+      ? `${message.slice(0, htmlStart).trimEnd()} [HTML response body omitted]`
+      : message;
+  const redacted = withoutHtml.replace(
+    /([?&][^=\s"'<>]*(?:api[_-]?key|authorization|cookie|credential|password|secret|token|tk)[^=\s"'<>]*=)[^&\s"'<>]+/gi,
+    "$1<redacted>",
+  );
+  return redacted.length > MAX_SERIALIZED_ERROR_MESSAGE_LENGTH
+    ? `${redacted.slice(0, MAX_SERIALIZED_ERROR_MESSAGE_LENGTH)}...`
+    : redacted;
+}
+function isSensitiveErrorDataKey(key: string): boolean {
+  return /api[_-]?key|authorization|cookie|credential|password|secret|token/i.test(key);
+}