@oh-my-pi/pi-coding-agent 17.0.9 → 17.1.1

package/src/extensibility/extensions/wrapper.ts

@@ -8,10 +8,11 @@ import type {
 	AgentToolUpdateCallback,
 	ToolLoadMode,
 } from "@oh-my-pi/pi-agent-core";
-import type { ImageContent, Static, TextContent, TSchema } from "@oh-my-pi/pi-ai";
+import type { ComputerSafetyCheck, ImageContent, Static, TextContent, TSchema } from "@oh-my-pi/pi-ai";
+import { sanitizeText } from "@oh-my-pi/pi-utils";
 import type { Settings } from "../../config/settings";
 import type { Theme } from "../../modes/theme/theme";
-import { type ApprovalMode, formatApprovalPrompt, resolveApproval } from "../../tools/approval";
+import { type ApprovalMode, formatApprovalPrompt, resolveApproval, truncateForPrompt } from "../../tools/approval";
 import { defaultLoadModeForToolName } from "../../tools/essential-tools";
 import { normalizeToolEventInput, resolveToolEventInput } from "../tool-event-input";
 import { applyToolProxy } from "../tool-proxy";
@@ -83,6 +84,42 @@ export function wrapRegisteredTools(registeredTools: RegisteredTool[], runner: E
 	return registeredTools.map(rt => wrapRegisteredTool(rt, runner));
 }
 
+function computerSafetyChecks(context: AgentToolContext | undefined): ComputerSafetyCheck[] {
+	const metadata = context?.toolCall?.providerMetadata;
+	return metadata?.type === "computer" ? metadata.pendingSafetyChecks : [];
+}
+
+function approvalArgs(params: unknown, context: AgentToolContext | undefined): unknown {
+	const metadata = context?.toolCall?.providerMetadata;
+	return metadata?.type === "computer" ? { actions: metadata.actions } : params;
+}
+
+function toolEventArgs(params: unknown, context: AgentToolContext | undefined): Record<string, unknown> {
+	const metadata = context?.toolCall?.providerMetadata;
+	if (metadata?.type === "computer") {
+		return {
+			actions: metadata.actions,
+			pendingSafetyChecks: metadata.pendingSafetyChecks,
+		};
+	}
+	return params as Record<string, unknown>;
+}
+
+function approvalData(value: string): string {
+	const sanitized = sanitizeText(value)
+		.replace(/[\r\n\t]+/g, " ")
+		.trim();
+	const truncated = truncateForPrompt(sanitized, 500);
+	return truncated.replace(/([\\`*_{}[\]()<>#+\-.!|])/g, "\\$1");
+}
+
+function safetyCheckLines(checks: readonly ComputerSafetyCheck[]): string[] {
+	return checks.map((check, index) => {
+		const value = check.message || check.code || check.id;
+		return `${index + 1}. ${approvalData(value)}`;
+	});
+}
+
 /**
  * Wraps a tool with extension callbacks for interception.
  * - Emits tool_call event before execution (can block)
@@ -128,19 +165,25 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 		const configuredMode = (settings?.get("tools.approvalMode") ?? "yolo") as ApprovalMode;
 		const approvalMode: ApprovalMode = cliAutoApprove ? "yolo" : configuredMode;
 		const userPolicies = (settings?.get("tools.approval") ?? {}) as Record<string, unknown>;
-		const resolved = resolveApproval(this.tool, params, approvalMode, userPolicies);
+		const resolvedArgs = approvalArgs(params, context);
+		const resolved = resolveApproval(this.tool, resolvedArgs, approvalMode, userPolicies);
 		if (resolved.policy === "deny") {
 			throw new Error(
 				`Tool "${this.tool.name}" is blocked by user policy.\n` +
 					`To allow: remove "tools.approval.${this.tool.name}: deny" from config.`,
 			);
 		}
+		const pendingSafetyChecks = computerSafetyChecks(context);
 		// An xd:// device dispatch already cleared the write tool's outer gate at
 		// this tool's tier — re-prompting would double-ask for one action. Explicit
 		// per-tool "prompt" policies and tool-demanded overrides still prompt.
+		// Provider safety checks are stronger: yolo, per-tool allow, and xdev approval
+		// never acknowledge them on the user's behalf.
 		const explicitPrompt = resolved.override || Object.hasOwn(userPolicies, this.tool.name);
 		const approvalCheck = {
-			required: resolved.policy === "prompt" && (explicitPrompt || context?.xdevApproved !== true),
+			required:
+				pendingSafetyChecks.length > 0 ||
+				(resolved.policy === "prompt" && (explicitPrompt || context?.xdevApproved !== true)),
 			reason: resolved.reason,
 		};
 
@@ -171,10 +214,16 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 				});
 			};
 
-			// Check if UI is available
+			// Provider safety checks fail closed without an interactive prompt. Unlike
+			// ordinary tier approval, no setting or yolo mode may bypass this gate.
 			if (!this.runner.hasUI()) {
 				const reason = "no interactive UI available";
 				await resolveApproval(false, reason);
+				if (pendingSafetyChecks.length > 0) {
+					throw new Error(
+						`Tool "${this.tool.name}" has pending provider safety checks but no interactive UI is available.`,
+					);
+				}
 				throw new Error(
 					`Tool "${this.tool.name}" requires approval but no interactive UI available.\n` +
 						`Options:\n` +
@@ -185,12 +234,14 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 			}
 
 			const uiContext = this.runner.getUIContext();
+			const basePrompt = formatApprovalPrompt(this.tool, resolvedArgs, approvalCheck.reason);
+			const safetyPrompt =
+				pendingSafetyChecks.length > 0
+					? `${basePrompt}\nProvider safety checks:\n${safetyCheckLines(pendingSafetyChecks).join("\n")}`
+					: basePrompt;
 			let choice: string | undefined;
 			try {
-				choice = await uiContext.select(formatApprovalPrompt(this.tool, params, approvalCheck.reason), [
-					"Approve",
-					"Deny",
-				]);
+				choice = await uiContext.select(safetyPrompt, ["Approve", "Deny"]);
 			} catch (err) {
 				await resolveApproval(false, err instanceof Error ? err.message : "approval aborted");
 				throw err;
@@ -200,6 +251,10 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 			if (!approved) {
 				throw new Error(`Tool call denied by user: ${this.tool.name}`);
 			}
+			if (pendingSafetyChecks.length > 0) {
+				if (!context) throw new Error("Provider safety approval context is unavailable");
+				context.providerSafetyApproved = true;
+			}
 		}
 
 		// 2. Emit tool_call event - extensions can block execution
@@ -211,7 +266,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 					toolCallId,
 					input: normalizeToolEventInput(
 						this.tool.name,
-						resolveToolEventInput(this.tool, params as Record<string, unknown>),
+						resolveToolEventInput(this.tool, toolEventArgs(params, context)),
 					),
 				})) as ToolCallEventResult | undefined;
 
@@ -228,7 +283,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 		}
 
 		// Execute the actual tool
-		let result: { content: any; details?: TDetails };
+		let result: AgentToolResult<TDetails, TParameters>;
 		let executionError: Error | undefined;
 
 		try {
@@ -249,7 +304,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 				toolCallId,
 				input: normalizeToolEventInput(
 					this.tool.name,
-					resolveToolEventInput(this.tool, params as Record<string, unknown>),
+					resolveToolEventInput(this.tool, toolEventArgs(params, context)),
 				),
 				content: result.content,
 				details: result.details,
@@ -275,6 +330,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 				return {
 					content: modifiedContent,
 					details: modifiedDetails,
+					providerMetadata: result.providerMetadata,
 					...(effectiveError ? { isError: true } : {}),
 				};
 			}

package/src/extensibility/legacy-pi-coding-agent-shim.ts

@@ -17,7 +17,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { AgentToolResult, AgentToolUpdateCallback } from "@oh-my-pi/pi-agent-core";
 import { type AuthCredential, SqliteAuthCredentialStore, type TSchema } from "@oh-my-pi/pi-ai";
-import { Text } from "@oh-my-pi/pi-tui";
+import { getKeybindings, type Keybinding, Text } from "@oh-my-pi/pi-tui";
 import {
 	getAgentDbPath,
 	getAgentDir,
@@ -26,6 +26,7 @@ import {
 	parseFrontmatter as parseOmpFrontmatter,
 } from "@oh-my-pi/pi-utils";
 import { getPackageDir as getOmpPackageDir } from "../config";
+import { formatKeyHints } from "../config/keybindings";
 import type { PromptTemplate } from "../config/prompt-templates";
 import { type SettingPath, Settings } from "../config/settings";
 import { EditTool } from "../edit";
@@ -373,6 +374,11 @@ async function executeLegacyBashOperations(
 	}
 }
 
+/** Format the active shortcut for legacy extensions that render keybinding hints. */
+export function keyText(action: Keybinding): string {
+	return formatKeyHints(getKeybindings().getKeys(action));
+}
+
 /** Parse frontmatter using the historical Pi package-root helper. */
 export interface ParsedFrontmatter<T extends Record<string, unknown> = Record<string, unknown>> {
 	frontmatter: T;

package/src/extensibility/plugins/legacy-pi-compat.ts

@@ -1504,7 +1504,25 @@ function evaluateGraphCommonJs(modulePath: string): unknown {
 	}
 }
 
-Reflect.set(globalThis, COMMONJS_REQUIRE_GLOBAL, evaluateGraphCommonJs);
+/**
+ * Register {@link evaluateGraphCommonJs} as the graph-owned CommonJS require
+ * bridge on `globalThis`, first-wins.
+ *
+ * On source-link installs the `@(scope)/pi-coding-agent` root shim is served
+ * from `src/`, so an extension import can evaluate a second instance of this
+ * module with empty graph state. An unconditional set would let that empty
+ * instance clobber the host bundle's populated bridge and break transitive
+ * CommonJS resolution (#6449); guarding preserves the first (host-owned)
+ * registration. Idempotent: a subsequent call with a value already present is a
+ * no-op.
+ */
+export function ensureGraphCommonJsRequireRegistered(): void {
+	if (!Reflect.get(globalThis, COMMONJS_REQUIRE_GLOBAL)) {
+		Reflect.set(globalThis, COMMONJS_REQUIRE_GLOBAL, evaluateGraphCommonJs);
+	}
+}
+
+ensureGraphCommonJsRequireRegistered();
 
 let legacyPiLoadTag = 0;
 

package/src/hindsight/state.ts

@@ -187,6 +187,17 @@ export class HindsightRetainQueue {
 	}
 }
 
+/** Rolling hash of messages[0, count) for retention-cache validation (see #lastRetainedPrefixKey). */
+function retentionPrefixKey(messages: HindsightMessage[], count: number): string {
+	let key = "";
+	for (let i = 0; i < count; i++) {
+		const m = messages[i];
+		if (m === undefined) break;
+		key = Bun.hash(`${key}\u0000${m.role}\u0000${m.content}`).toString(36);
+	}
+	return key;
+}
+
 /** Per-session Hindsight runtime state owned by its AgentSession. */
 export class HindsightSessionState {
 	/** Session id used for retain-queue metadata. */
@@ -202,6 +213,17 @@ export class HindsightSessionState {
 	session: AgentSession;
 	banksSet: Set<string>;
 	lastRetainedTurn: number;
+	#lastRetainedMessageIndex: number = 0;
+	#cachedTranscript: string = "";
+	// Rolling hash of ALL messages in [0, #lastRetainedMessageIndex) at cache
+	// time. The incremental full-session cache assumes the branch is append-only;
+	// a rewind, branch switch, compaction, or in-place edit rewrites the prefix
+	// without changing the session id. Re-hashing the current prefix at use time
+	// makes the cache self-healing: on ANY prefix change (not just the boundary
+	// message) we rebuild the full transcript instead of retaining stale content
+	// or silently retaining nothing forever. Hashing is orders of magnitude
+	// cheaper than the re-formatting this cache avoids.
+	#lastRetainedPrefixKey: string = "";
 	hasRecalledForFirstTurn: boolean;
 	lastRecallSnippet?: string;
 	/** Cached `<mental_models>` block injected into developer instructions. */
@@ -236,6 +258,9 @@ export class HindsightSessionState {
 		this.session = options.session;
 		this.banksSet = options.banksSet;
 		this.lastRetainedTurn = options.lastRetainedTurn ?? 0;
+		this.#lastRetainedMessageIndex = 0;
+		this.#cachedTranscript = "";
+		this.#lastRetainedPrefixKey = "";
 		this.hasRecalledForFirstTurn = options.hasRecalledForFirstTurn ?? false;
 		this.aliasOf = options.aliasOf;
 		this.retainQueue = new HindsightRetainQueue(this);
@@ -243,12 +268,18 @@ export class HindsightSessionState {
 
 	setSessionId(sessionId: string): void {
 		this.sessionId = sessionId;
+		this.#lastRetainedMessageIndex = 0;
+		this.#cachedTranscript = "";
+		this.#lastRetainedPrefixKey = "";
 	}
 
 	resetConversationTracking(): void {
 		this.lastRetainedTurn = 0;
 		this.hasRecalledForFirstTurn = false;
 		this.lastRecallSnippet = undefined;
+		this.#lastRetainedMessageIndex = 0;
+		this.#cachedTranscript = "";
+		this.#lastRetainedPrefixKey = "";
 	}
 
 	enqueueRetain(content: string, context?: string): void {
@@ -285,21 +316,35 @@ export class HindsightSessionState {
 	async retainSession(messages: HindsightMessage[]): Promise<void> {
 		const retainedAt = new Date();
 		const retainFullWindow = this.config.retainMode === "full-session";
-		let target: HindsightMessage[];
 		let documentId: string;
+		let transcript: string;
+		let nextCachedTranscript: string | undefined;
 
 		if (retainFullWindow) {
-			target = messages;
 			documentId = this.sessionId;
+			const boundary = this.#lastRetainedMessageIndex;
+			if (boundary > messages.length || retentionPrefixKey(messages, boundary) !== this.#lastRetainedPrefixKey) {
+				this.#lastRetainedMessageIndex = 0;
+				this.#cachedTranscript = "";
+				this.#lastRetainedPrefixKey = "";
+			}
+			const newMessages = messages.slice(this.#lastRetainedMessageIndex);
+			const { transcript: newPart } = prepareRetentionTranscript(newMessages, true);
+			if (!newPart) return;
+			nextCachedTranscript = this.#cachedTranscript ? `${this.#cachedTranscript}\n\n${newPart}` : newPart;
+			transcript = nextCachedTranscript;
 		} else {
 			const windowTurns = this.config.retainEveryNTurns + this.config.retainOverlapTurns;
-			target = sliceLastTurnsByUserBoundary(messages, windowTurns);
+			const target = sliceLastTurnsByUserBoundary(messages, windowTurns);
 			documentId = `${this.sessionId}-${retainedAt.getTime()}`;
+			this.#lastRetainedMessageIndex = 0;
+			this.#cachedTranscript = "";
+			this.#lastRetainedPrefixKey = "";
+			const { transcript: windowTranscript } = prepareRetentionTranscript(target, true);
+			if (!windowTranscript) return;
+			transcript = windowTranscript;
 		}
 
-		const { transcript } = prepareRetentionTranscript(target, true);
-		if (!transcript) return;
-
 		await ensureBankExists(this.client, this.bankId, this.config, this.banksSet);
 		await this.client.retain(this.bankId, transcript, {
 			documentId,
@@ -309,6 +354,11 @@ export class HindsightSessionState {
 			timestamp: retainedAt,
 			async: true,
 		});
+		if (nextCachedTranscript !== undefined) {
+			this.#cachedTranscript = nextCachedTranscript;
+			this.#lastRetainedMessageIndex = messages.length;
+			this.#lastRetainedPrefixKey = retentionPrefixKey(messages, messages.length);
+		}
 	}
 
 	async maybeRetainOnAgentEnd(): Promise<void> {
@@ -341,6 +391,14 @@ export class HindsightSessionState {
 	async forceRetainCurrentSession(): Promise<void> {
 		const messages = extractMessages(this.session.sessionManager);
 		if (messages.length === 0) return;
+		// Forced retains are user-initiated rebuilds (`/memory enqueue`): drop the
+		// incremental cache so the full transcript is reformatted and resent even
+		// when no new messages arrived since the last auto-retain — otherwise a
+		// rebuild could never recover an upstream document that was deleted or a
+		// previous async retain that never materialized.
+		this.#lastRetainedMessageIndex = 0;
+		this.#cachedTranscript = "";
+		this.#lastRetainedPrefixKey = "";
 		try {
 			await this.retainSession(messages);
 			this.lastRetainedTurn = messages.filter(m => m.role === "user").length;

package/src/internal-urls/local-protocol.ts

@@ -3,6 +3,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { isEnoent } from "@oh-my-pi/pi-utils";
 import { AgentRegistry } from "../registry/agent-registry";
+import { isMarkdownPath } from "../utils/lang-from-path";
 import { buildDirectoryResource } from "./filesystem-resource";
 import { parseInternalUrl } from "./parse";
 import { validateRelativePath } from "./skill-protocol";
@@ -43,8 +44,8 @@ function shortLocalRoot(options: LocalProtocolOptions): string {
 }
 
 function getContentType(filePath: string): InternalResource["contentType"] {
+	if (isMarkdownPath(filePath)) return "text/markdown";
 	const ext = path.extname(filePath).toLowerCase();
-	if (ext === ".md") return "text/markdown";
 	if (ext === ".json") return "application/json";
 	return "text/plain";
 }

package/src/internal-urls/memory-protocol.ts

@@ -4,6 +4,7 @@ import { getAgentDir, isEnoent } from "@oh-my-pi/pi-utils";
 import { getMemoryRoot } from "../memories";
 import { getMnemopiSessionState, type MnemopiScopedMemoryHit, type MnemopiSessionState } from "../mnemopi/state";
 import { AgentRegistry } from "../registry/agent-registry";
+import { isMarkdownPath } from "../utils/lang-from-path";
 import { buildDirectoryResource } from "./filesystem-resource";
 import { validateRelativePath } from "./skill-protocol";
 import type { InternalResource, InternalUrl, ProtocolHandler, ResolveContext, UrlCompletion } from "./types";
@@ -117,8 +118,7 @@ async function tryResolveInRoot(url: InternalUrl, memoryRoot: string): Promise<I
 	}
 
 	const content = await Bun.file(realTargetPath).text();
-	const ext = path.extname(realTargetPath).toLowerCase();
-	const contentType: InternalResource["contentType"] = ext === ".md" ? "text/markdown" : "text/plain";
+	const contentType: InternalResource["contentType"] = isMarkdownPath(realTargetPath) ? "text/markdown" : "text/plain";
 
 	return {
 		url: url.href,

package/src/internal-urls/skill-protocol.ts

@@ -12,12 +12,12 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isEnoent } from "@oh-my-pi/pi-utils";
 import { getActiveSkills } from "../extensibility/skills";
+import { isMarkdownPath } from "../utils/lang-from-path";
 import { buildDirectoryResource } from "./filesystem-resource";
 import type { InternalResource, InternalUrl, ProtocolHandler, ResolveContext, UrlCompletion } from "./types";
 
 function getContentType(filePath: string): InternalResource["contentType"] {
-	const ext = path.extname(filePath).toLowerCase();
-	if (ext === ".md") return "text/markdown";
+	if (isMarkdownPath(filePath)) return "text/markdown";
 	return "text/plain";
 }
 

package/src/internal-urls/ssh-protocol.ts

@@ -30,6 +30,7 @@ import {
 	statRemotePath,
 	writeRemoteFile,
 } from "../ssh/file-transfer";
+import { isMarkdownPath } from "../utils/lang-from-path";
 import type {
 	InternalResource,
 	InternalUrl,
@@ -44,11 +45,11 @@ const SSH_TEXT_MAX_BYTES = 1024 * 1024;
 
 /** POSIX-aware content type from the last path segment's extension. */
 function contentTypeFor(remotePath: string): InternalResource["contentType"] {
+	if (isMarkdownPath(remotePath)) return "text/markdown";
 	const slash = remotePath.lastIndexOf("/");
 	const base = slash === -1 ? remotePath : remotePath.slice(slash + 1);
 	const dot = base.lastIndexOf(".");
 	const ext = dot <= 0 ? "" : base.slice(dot).toLowerCase();
-	if (ext === ".md") return "text/markdown";
 	if (ext === ".json") return "application/json";
 	return "text/plain";
 }

package/src/internal-urls/vault-protocol.ts

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import { $which, isEnoent } from "@oh-my-pi/pi-utils";
 import { isSettingsInitialized, settings } from "../config/settings";
 import { getDefault } from "../config/settings-schema";
+import { isMarkdownPath } from "../utils/lang-from-path";
 import { parseInternalUrl } from "./parse";
 import { validateRelativePath } from "./skill-protocol";
 import type { InternalResource, InternalUrl, ProtocolHandler, ResolveContext, WriteContext } from "./types";
@@ -114,8 +115,8 @@ function toVaultValidationError(error: unknown): Error {
 }
 
 function getContentType(filePath: string): ContentType {
+	if (isMarkdownPath(filePath)) return "text/markdown";
 	const ext = path.extname(filePath).toLowerCase();
-	if (ext === ".md") return "text/markdown";
 	if (ext === ".json") return "application/json";
 	return "text/plain";
 }

package/src/live/attestation.ts

@@ -0,0 +1,91 @@
+import { deviceCheckGenerateToken } from "@oh-my-pi/pi-natives";
+
+const CHATGPT_BUNDLE_ID = "com.openai.codex";
+const APP_SESSION_ID = crypto.randomUUID();
+
+type DeviceCheckResult = {
+	supported: boolean;
+	tokenBase64?: string | null;
+	latencyMs?: number | null;
+};
+
+function cborHeader(major: number, value: number): Buffer {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`Invalid CBOR length: ${value}`);
+	if (value < 24) return Buffer.from([major + value]);
+	if (value <= 0xff) return Buffer.from([major + 24, value]);
+	if (value <= 0xffff) {
+		const output = Buffer.allocUnsafe(3);
+		output[0] = major + 25;
+		output.writeUInt16BE(value, 1);
+		return output;
+	}
+	if (value <= 0xffff_ffff) {
+		const output = Buffer.allocUnsafe(5);
+		output[0] = major + 26;
+		output.writeUInt32BE(value, 1);
+		return output;
+	}
+	throw new Error(`CBOR length is too large: ${value}`);
+}
+
+function cborUnsigned(value: number): Buffer {
+	return cborHeader(0, value);
+}
+
+function cborText(value: string): Buffer {
+	const text = Buffer.from(value, "utf8");
+	return Buffer.concat([cborHeader(96, text.length), text]);
+}
+
+function cborMap(entries: ReadonlyArray<readonly [Buffer, Buffer]>): Buffer {
+	const values: Buffer[] = [cborHeader(160, entries.length)];
+	for (const [key, value] of entries) values.push(key, value);
+	return Buffer.concat(values);
+}
+
+function attestationSignals(): Buffer {
+	const resolved = Intl.DateTimeFormat().resolvedOptions();
+	const locale = (resolved.locale || "unknown").slice(0, 64);
+	const timezone = (resolved.timeZone || "unknown").slice(0, 64);
+	const preferredLanguages = Buffer.concat([cborHeader(128, 1), cborText(locale)]);
+	return cborMap([
+		[cborUnsigned(0), cborUnsigned(1)],
+		[cborUnsigned(1), preferredLanguages],
+		[cborUnsigned(2), cborText(locale)],
+		[cborUnsigned(3), cborText(timezone)],
+		[cborUnsigned(4), cborUnsigned(0)],
+		[cborUnsigned(5), cborUnsigned(1)],
+		[cborUnsigned(6), cborText(APP_SESSION_ID.slice(0, 128))],
+	]);
+}
+
+function buildClientAttestation(result: DeviceCheckResult): string {
+	const entries: Array<readonly [Buffer, Buffer]> = [];
+	if (result.supported && result.tokenBase64) {
+		entries.push([cborText("token"), cborText(result.tokenBase64)]);
+	} else {
+		entries.push([cborText("error_code"), cborUnsigned(result.supported ? 4 : 3)]);
+	}
+	entries.push([cborText("bundle_id"), cborText(CHATGPT_BUNDLE_ID)]);
+	const signals = attestationSignals();
+	entries.push([cborText("f"), Buffer.concat([cborHeader(64, signals.length), signals])]);
+	if (result.latencyMs !== undefined && result.latencyMs !== null) {
+		const latency = Buffer.allocUnsafe(9);
+		latency[0] = 0xfb;
+		latency.writeDoubleBE(result.latencyMs, 1);
+		entries.push([cborText("t"), latency]);
+	}
+	return `v1.${cborMap(entries).toString("base64url")}`;
+}
+
+/** Generates the Codex DeviceCheck attestation envelope sent as `x-oai-attestation` on ChatGPT-OAuth requests. */
+export async function generateCodexAttestation(): Promise<string | undefined> {
+	if (process.platform !== "darwin" || process.arch !== "arm64") return undefined;
+	let result: DeviceCheckResult;
+	try {
+		result = await deviceCheckGenerateToken();
+	} catch {
+		return undefined;
+	}
+	return JSON.stringify({ v: 1, s: 0, t: buildClientAttestation(result) });
+}