@opengeni/codex 0.2.10 → 0.2.11

package/dist/mcp-sanitize.d.ts

@@ -25,9 +25,10 @@ export declare function remapToolCallRequestBody(body: string, mapper: ToolNameM
  * to the MCP server's original. Only the POST request/response is buffered; the
  * long-lived GET notification SSE stream is passed through untouched.
  *
- * P4 (Part B.1): an optional `namespaceSink` Set accumulates the ORIGINAL-dotted
+ * An optional `namespaceSink` Set accumulates the ORIGINAL-dotted
  * connector namespaces seen across every tools/list this turn (captured before the
- * dot is sanitized away). The worker reads the (live, by-reference) Set after the
- * turn to cache the serving account's connector set — packages/codex stays db-free.
+ * dot is sanitized away). The runtime reads the live by-reference Set only to keep
+ * this turn's `tool_search` description accurate; it is never persisted or used
+ * for inference selection.
  */
 export declare function codexAppsSanitizingFetch(base?: FetchLike, namespaceSink?: Set<string>): FetchLike;

package/dist/opaque-artifact.d.ts

@@ -0,0 +1,4 @@
+/** Stable, content-hiding identity for one opaque provider artifact. */
+export declare function opaqueProviderArtifactFingerprint(item: unknown): string | null;
+/** Exact opaque artifacts present in one normalized provider input array. */
+export declare function opaqueProviderArtifactFingerprints(input: unknown): string[];

package/dist/request-context.d.ts

@@ -49,6 +49,10 @@ export type CodexModelRequestEvent = {
     status?: number;
     willRetry?: boolean;
 };
+export type CodexRequestOpaqueArtifacts = {
+    requestId: string;
+    fingerprints: readonly string[];
+};
 export type CodexRequestContext = {
     clientVersion: string;
     /**
@@ -81,6 +85,8 @@ export type CodexRequestContext = {
     responseTimeoutPolicy?: Partial<CodexResponseTimeoutPolicy>;
     /** Worker-owned durable audit sink; payloads never contain request bodies or auth. */
     onModelRequestEvent?: (event: CodexModelRequestEvent) => Promise<void> | void;
+    /** Exact opaque artifacts on the normalized wire request, never their ciphertext. */
+    onRequestOpaqueArtifacts?: (artifacts: CodexRequestOpaqueArtifacts) => void;
     /** Stable request identity supplied by the owning durable execution. */
     nextRequestId?: () => string;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/codex",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "ChatGPT/Codex subscription auth + transport: device-code login, token refresh, and the Responses-backend fetch. Pure HTTP + transforms; no database dependency.",
   "license": "Apache-2.0",
   "repository": {

package/src/fetch.ts

@@ -13,6 +13,7 @@
 import { randomUUID } from "node:crypto";
 import { CODEX_ORIGINATOR } from "./constants";
 import { normalizeCodexRequestBody } from "./normalize";
+import { opaqueProviderArtifactFingerprints } from "./opaque-artifact";
 import {
   codexRequestStorage,
   type CodexModelRequestEvent,
@@ -489,6 +490,7 @@ export function codexSubscriptionFetch(base: FetchLike = globalThis.fetch): Fetc
       // summarizer) still gets a single JSON Response back.
       let callerWantsStream = true;
       let model: string | undefined;
+      let requestOpaqueArtifacts: string[] = [];
       const nextInit: RequestInit = { ...init, headers };
       if (typeof init?.body === "string") {
         try {
@@ -497,10 +499,12 @@ export function codexSubscriptionFetch(base: FetchLike = globalThis.fetch): Fetc
           const normalized = normalizeCodexRequestBody(parsed, ctx.resolveModel);
           model = typeof normalized.model === "string" ? normalized.model : undefined;
           nextInit.body = JSON.stringify(normalized);
+          requestOpaqueArtifacts = opaqueProviderArtifactFingerprints(normalized.input);
         } catch {
           /* leave unparseable bodies untouched (already copied from init) */
         }
       }
+      ctx.onRequestOpaqueArtifacts?.({ requestId, fingerprints: requestOpaqueArtifacts });
       headers.set(
         "Idempotency-Key",
         authenticationAttempt === 0 ? requestId : `${requestId}:auth-${authenticationAttempt}`,

package/src/index.ts

@@ -11,5 +11,6 @@ export * from "./response-timeout";
 export * from "./fetch";
 export * from "./mcp-sanitize";
 export * from "./model-output-truncation";
+export * from "./opaque-artifact";
 export * from "./realtime";
 export * from "./realtime-v3";

package/src/mcp-sanitize.ts

@@ -105,7 +105,7 @@ export class ToolNameMapper {
 /**
  * Drop bad outputSchemas + sanitize tool names on a JSON-RPC tools/list result, in place.
  *
- * P4 (Part B.1): when `namespaceSink` is provided, accumulate each tool's ORIGINAL
+ * When `namespaceSink` is provided, accumulate each tool's ORIGINAL
  * connector namespace (the segment BEFORE the first dot, e.g. `github` from
  * `github.create_issue`) into it — captured HERE because this pass sees the original
  * dotted name BEFORE mapper.sanitize rewrites the dot away. Only dotted names carry a
@@ -264,10 +264,11 @@ export function remapToolCallRequestBody(body: string, mapper: ToolNameMapper):
  * to the MCP server's original. Only the POST request/response is buffered; the
  * long-lived GET notification SSE stream is passed through untouched.
  *
- * P4 (Part B.1): an optional `namespaceSink` Set accumulates the ORIGINAL-dotted
+ * An optional `namespaceSink` Set accumulates the ORIGINAL-dotted
  * connector namespaces seen across every tools/list this turn (captured before the
- * dot is sanitized away). The worker reads the (live, by-reference) Set after the
- * turn to cache the serving account's connector set — packages/codex stays db-free.
+ * dot is sanitized away). The runtime reads the live by-reference Set only to keep
+ * this turn's `tool_search` description accurate; it is never persisted or used
+ * for inference selection.
  */
 export function codexAppsSanitizingFetch(
   base: FetchLike = globalThis.fetch,

package/src/normalize.ts

@@ -69,7 +69,7 @@ export function normalizeCodexRequestBody(
   // strip every item id; PRESERVE call_id. spec §1.6 / verdict §0(b)
   // (This also covers tool_search items: the backend accepts an id-less
   // tool_search_call/output pair correlated by call_id — verified live — and
-  // stripping the account-bound `tsc_…` id here sanitizes BOTH replay paths.)
+  // stripping the provider-stored `tsc_…` id here sanitizes BOTH replay paths.)
   if (Array.isArray(body.input)) {
     for (const item of body.input as unknown[]) {
       if (!item || typeof item !== "object") {

package/src/opaque-artifact.ts

@@ -0,0 +1,29 @@
+import { createHash } from "node:crypto";
+
+/** Stable, content-hiding identity for one opaque provider artifact. */
+export function opaqueProviderArtifactFingerprint(item: unknown): string | null {
+  if (!item || typeof item !== "object") return null;
+  const record = item as Record<string, unknown>;
+  if (record.type !== "reasoning" && record.type !== "compaction") return null;
+  const providerData =
+    record.providerData && typeof record.providerData === "object"
+      ? (record.providerData as Record<string, unknown>)
+      : null;
+  const ciphertext =
+    (typeof record.encrypted_content === "string" && record.encrypted_content) ||
+    (typeof record.encryptedContent === "string" && record.encryptedContent) ||
+    (typeof providerData?.encrypted_content === "string" && providerData.encrypted_content) ||
+    (typeof providerData?.encryptedContent === "string" && providerData.encryptedContent) ||
+    null;
+  if (!ciphertext) return null;
+  return `${record.type}:${createHash("sha256").update(ciphertext).digest("hex")}`;
+}
+
+/** Exact opaque artifacts present in one normalized provider input array. */
+export function opaqueProviderArtifactFingerprints(input: unknown): string[] {
+  if (!Array.isArray(input)) return [];
+  return input.flatMap((item) => {
+    const fingerprint = opaqueProviderArtifactFingerprint(item);
+    return fingerprint ? [fingerprint] : [];
+  });
+}

package/src/request-context.ts

@@ -62,6 +62,11 @@ export type CodexModelRequestEvent = {
   willRetry?: boolean;
 };
 
+export type CodexRequestOpaqueArtifacts = {
+  requestId: string;
+  fingerprints: readonly string[];
+};
+
 export type CodexRequestContext = {
   clientVersion: string;
   /**
@@ -94,6 +99,8 @@ export type CodexRequestContext = {
   responseTimeoutPolicy?: Partial<CodexResponseTimeoutPolicy>;
   /** Worker-owned durable audit sink; payloads never contain request bodies or auth. */
   onModelRequestEvent?: (event: CodexModelRequestEvent) => Promise<void> | void;
+  /** Exact opaque artifacts on the normalized wire request, never their ciphertext. */
+  onRequestOpaqueArtifacts?: (artifacts: CodexRequestOpaqueArtifacts) => void;
   /** Stable request identity supplied by the owning durable execution. */
   nextRequestId?: () => string;
   /**