@opengeni/codex 0.2.13 → 0.2.16

package/dist/index.js

@@ -326,6 +326,20 @@ function normalizeCodexRequestBody(body, resolveModel) {
   }
   return body;
 }
+function normalizedCodexRequestBody(body, resolveModel) {
+  const projected = { ...body };
+  if (body.reasoning && typeof body.reasoning === "object" && !Array.isArray(body.reasoning)) {
+    projected.reasoning = { ...body.reasoning };
+  }
+  if (Array.isArray(body.input)) {
+    projected.input = body.input.map((item) => {
+      if (!item || typeof item !== "object" || Array.isArray(item)) return item;
+      const record = item;
+      return "id" in record || record.type === "tool_search_call" && typeof record.arguments === "string" ? { ...record } : item;
+    });
+  }
+  return normalizeCodexRequestBody(projected, resolveModel);
+}
 function buildModelResolver(liveSlugs, fallbackSlug) {
   return (requested) => {
     const stripped = requested.includes("/") ? requested.slice(requested.indexOf("/") + 1) : requested;
@@ -808,6 +822,12 @@ function opaqueProviderArtifactFingerprints(input) {
 
 // src/fetch.ts
 var CODEX_TRANSPORT_ERROR_HEADER = "x-opengeni-codex-transport-error";
+var CODEX_REQUEST_BODY_NORMALIZED_HEADER = "x-opengeni-request-body-normalized";
+var REPLAYABLE_REQUEST_BODY_FACTORY = Symbol.for("opengeni.replayable-request-body-factory");
+var CODEX_REQUEST_MODEL_HEADER = "x-opengeni-request-model";
+var CODEX_REQUEST_ID_HEADER = "x-opengeni-request-id";
+var CODEX_REQUEST_CALLER_STREAM_HEADER = "x-opengeni-request-caller-stream";
+var MAX_CODEX_ERROR_BODY_BYTES = 64 * 1024;
 function headersCarryCodexTransportMarker(headers) {
   if (!headers || typeof headers !== "object") return false;
   const getter = headers.get;
@@ -894,15 +914,90 @@ function parseCodexUsageHeaders(headers) {
     checkedAt: new Date(nowMs)
   };
 }
-async function emitRequestEvent(audit, event) {
-  await audit.ctx.onModelRequestEvent?.({
+function classifyCodexSseTerminal(ev) {
+  if (ev.type === "response.failed") {
+    return {
+      phase: "failed",
+      rawError: ev.response?.error,
+      fallbackCode: "response_failed",
+      fallbackMessage: "The Codex response failed"
+    };
+  }
+  if (ev.type === "error" || ev.type === "response.error") {
+    return {
+      phase: "failed",
+      rawError: ev.error ?? ev.response?.error ?? ev,
+      fallbackCode: "response_error",
+      fallbackMessage: "The Codex response stream reported an error"
+    };
+  }
+  if (ev.type === "response.incomplete") {
+    const details = ev.response?.incomplete_details;
+    const reason = details && typeof details === "object" ? details.reason : void 0;
+    return {
+      phase: "failed",
+      rawError: {
+        code: "response_incomplete",
+        message: typeof reason === "string" && reason.length > 0 ? `The Codex response was incomplete (${reason})` : "The Codex response was incomplete"
+      },
+      fallbackCode: "response_incomplete",
+      fallbackMessage: "The Codex response was incomplete"
+    };
+  }
+  if (ev.type !== "response.completed" && ev.type !== "response.done") {
+    return null;
+  }
+  if (!ev.response) {
+    return null;
+  }
+  const responseStatus = ev.response.status;
+  if (responseStatus !== void 0 && responseStatus !== "completed" || ev.response.error !== null && ev.response.error !== void 0) {
+    const incomplete = responseStatus === "incomplete";
+    return {
+      phase: "failed",
+      rawError: ev.response.error,
+      fallbackCode: incomplete ? "response_incomplete" : "response_failed",
+      fallbackMessage: incomplete ? "The Codex response was incomplete" : "The Codex response failed"
+    };
+  }
+  return { phase: "completed" };
+}
+function markSemanticTerminal(state, phase) {
+  if (state.phase === null) {
+    state.phase = phase;
+  }
+}
+function terminalOutcomeForPhase(phase) {
+  if (phase === "completed" || phase === "failed" || phase === "timed_out") {
+    return phase;
+  }
+  return null;
+}
+function requestEventFor(audit, event) {
+  return {
     requestId: audit.requestId,
     transportAttempt: audit.transportAttempt,
     ...audit.model ? { model: audit.model } : {},
-    durationMs: Math.max(0, Date.now() - audit.attemptStartedAt),
+    durationMs: Math.max(0, performance.now() - audit.attemptStartedAtMonotonic),
     timeoutPolicy: audit.policy,
     ...event
-  });
+  };
+}
+async function emitRequestEvent(audit, event) {
+  const terminalOutcome = terminalOutcomeForPhase(event.phase);
+  if (terminalOutcome !== null) {
+    if (audit.terminalOutcome !== null) {
+      return false;
+    }
+    audit.terminalOutcome = terminalOutcome;
+  }
+  const observed = requestEventFor(audit, event);
+  try {
+    audit.ctx.onModelRequestDiagnostic?.(observed);
+  } catch {
+  }
+  await audit.ctx.onModelRequestEvent?.(observed);
+  return true;
 }
 function providerRequestId(headers) {
   return headers.get("x-request-id") ?? headers.get("request-id") ?? void 0;
@@ -943,11 +1038,12 @@ async function fetchBeforeHeaders(base, input, init, audit) {
     externalSignal?.removeEventListener("abort", forwardAbort);
   }
 }
-async function observedResponse(res, audit, externalSignal) {
+async function observedResponse(res, audit, externalSignal, semanticTerminal) {
   const requestId = providerRequestId(res.headers);
   if (!res.body) {
+    if (semanticTerminal) markSemanticTerminal(semanticTerminal, "failed");
     await emitRequestEvent(audit, {
-      phase: res.ok ? "completed" : "failed",
+      phase: semanticTerminal?.phase ?? (res.ok ? "completed" : "failed"),
       responseObserved: true,
       status: res.status,
       ...requestId ? { providerRequestId: requestId } : {}
@@ -972,17 +1068,19 @@ async function observedResponse(res, audit, externalSignal) {
         if (terminal) return;
         terminal = true;
         clearTimers();
+        const semanticPhase = semanticTerminal?.phase;
+        const phase = semanticPhase ?? "timed_out";
         const error = new CodexResponseTimeoutError(klass, audit.requestId, true);
         void reader.cancel(error).catch(() => void 0);
         void emitRequestEvent(audit, {
-          phase: "timed_out",
+          phase,
           responseObserved: true,
-          timeoutClass: klass,
+          ...phase === "timed_out" ? { timeoutClass: klass } : {},
           status: res.status,
           ...requestId ? { providerRequestId: requestId } : {}
         }).then(
-          () => controller.error(error),
-          () => controller.error(error)
+          () => phase === "completed" ? controller.close() : controller.error(error),
+          () => phase === "completed" ? controller.close() : controller.error(error)
         );
       };
       armIdle = () => {
@@ -1002,13 +1100,13 @@ async function observedResponse(res, audit, externalSignal) {
         const reason = externalSignal?.reason ?? new DOMException("Aborted", "AbortError");
         void reader.cancel(reason).catch(() => void 0);
         void emitRequestEvent(audit, {
-          phase: "failed",
+          phase: semanticTerminal?.phase ?? "failed",
           responseObserved: true,
           status: res.status,
           ...requestId ? { providerRequestId: requestId } : {}
         }).then(
-          () => controller.error(reason),
-          () => controller.error(reason)
+          () => semanticTerminal?.phase === "completed" ? controller.close() : controller.error(reason),
+          () => semanticTerminal?.phase === "completed" ? controller.close() : controller.error(reason)
         );
       };
       if (externalSignal?.aborted) {
@@ -1027,45 +1125,67 @@ async function observedResponse(res, audit, externalSignal) {
         if (chunk.done) {
           terminal = true;
           clearTimers();
-          await emitRequestEvent(audit, {
-            phase: res.ok ? "completed" : "failed",
-            responseObserved: true,
-            status: res.status,
-            ...requestId ? { providerRequestId: requestId } : {}
-          });
+          if (semanticTerminal && semanticTerminal.phase === null) {
+            if (!semanticTerminal.deferTransportTerminal) {
+              markSemanticTerminal(semanticTerminal, "failed");
+            }
+          }
+          if (!semanticTerminal?.deferTransportTerminal || semanticTerminal.phase !== null) {
+            await emitRequestEvent(audit, {
+              phase: semanticTerminal?.phase ?? (res.ok ? "completed" : "failed"),
+              responseObserved: true,
+              status: res.status,
+              ...requestId ? { providerRequestId: requestId } : {}
+            });
+          }
           controller.close();
           return;
         }
-        armIdle();
         if (!firstByte) {
           firstByte = true;
+          if (idleTimer) clearTimeout(idleTimer);
+          controller.enqueue(chunk.value);
           await emitRequestEvent(audit, {
             phase: "first_byte",
             responseObserved: true,
             status: res.status,
             ...requestId ? { providerRequestId: requestId } : {}
           });
+          if (!terminal) armIdle();
+          return;
         }
+        armIdle();
         controller.enqueue(chunk.value);
       } catch (error) {
         if (terminal) return;
         terminal = true;
         clearTimers();
+        const semanticPhase = semanticTerminal?.phase;
+        if (semanticTerminal && semanticPhase === null) {
+          markSemanticTerminal(semanticTerminal, "failed");
+        }
         await emitRequestEvent(audit, {
-          phase: "failed",
+          phase: semanticPhase ?? "failed",
           responseObserved: true,
           status: res.status,
           ...requestId ? { providerRequestId: requestId } : {}
         });
-        controller.error(error);
+        if (semanticPhase === "completed") {
+          controller.close();
+        } else {
+          controller.error(error);
+        }
       }
     },
     async cancel(reason) {
       if (!terminal) {
         terminal = true;
         clearTimers();
+        if (semanticTerminal && semanticTerminal.phase === null) {
+          markSemanticTerminal(semanticTerminal, "failed");
+        }
         await emitRequestEvent(audit, {
-          phase: "failed",
+          phase: semanticTerminal?.phase ?? "failed",
           responseObserved: true,
           status: res.status,
           ...requestId ? { providerRequestId: requestId } : {}
@@ -1113,11 +1233,19 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
     const rawUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
     const rewritten = rawUrl.replace(/(?<!\/codex)\/responses(\b|$)/, "/codex/responses$1");
     const policy = resolveCodexResponseTimeoutPolicy(ctx.responseTimeoutPolicy);
-    const requestId = ctx.nextRequestId?.() ?? randomUUID();
+    const handedRequestId = new Headers(init?.headers).get(CODEX_REQUEST_ID_HEADER);
+    const requestId = handedRequestId ?? ctx.nextRequestId?.() ?? randomUUID();
     const logicalStartedAt = Date.now();
     let transportAttempt = 0;
     const attempt = async (auth, authenticationAttempt) => {
       const headers = new Headers(init?.headers);
+      const bodyAlreadyNormalized = headers.get(CODEX_REQUEST_BODY_NORMALIZED_HEADER) === "1";
+      const normalizedModel = headers.get(CODEX_REQUEST_MODEL_HEADER) ?? void 0;
+      const normalizedCallerStream = headers.get(CODEX_REQUEST_CALLER_STREAM_HEADER);
+      headers.delete(CODEX_REQUEST_BODY_NORMALIZED_HEADER);
+      headers.delete(CODEX_REQUEST_MODEL_HEADER);
+      headers.delete(CODEX_REQUEST_ID_HEADER);
+      headers.delete(CODEX_REQUEST_CALLER_STREAM_HEADER);
       headers.set("Authorization", `Bearer ${auth.accessToken}`);
       if (auth.chatgptAccountId) {
         headers.set("ChatGPT-Account-ID", auth.chatgptAccountId);
@@ -1141,11 +1269,16 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
       if (ctx.turnMetadata && Object.keys(ctx.turnMetadata).length > 0) {
         headers.set("x-codex-turn-metadata", JSON.stringify(ctx.turnMetadata));
       }
-      let callerWantsStream = true;
-      let model;
+      let callerWantsStream = bodyAlreadyNormalized ? normalizedCallerStream !== "0" : true;
+      let model = normalizedModel;
       let requestOpaqueArtifacts = [];
-      const nextInit = { ...init, headers };
-      if (typeof init?.body === "string") {
+      const replayableBodyFactory = init?.[REPLAYABLE_REQUEST_BODY_FACTORY];
+      const nextInit = {
+        ...init,
+        headers,
+        ...replayableBodyFactory ? { body: replayableBodyFactory() } : {}
+      };
+      if (!bodyAlreadyNormalized && typeof init?.body === "string") {
         try {
           const parsed = JSON.parse(init.body);
           callerWantsStream = parsed.stream === true;
@@ -1154,9 +1287,14 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
           nextInit.body = JSON.stringify(normalized);
           requestOpaqueArtifacts = opaqueProviderArtifactFingerprints(normalized.input);
         } catch {
+          throw new Error("Model request could not be prepared");
         }
+      } else if (!bodyAlreadyNormalized) {
+        throw new Error("Model request could not be prepared");
+      }
+      if (!bodyAlreadyNormalized) {
+        ctx.onRequestOpaqueArtifacts?.({ requestId, fingerprints: requestOpaqueArtifacts });
       }
-      ctx.onRequestOpaqueArtifacts?.({ requestId, fingerprints: requestOpaqueArtifacts });
       headers.set(
         "Idempotency-Key",
         authenticationAttempt === 0 ? requestId : `${requestId}:auth-${authenticationAttempt}`
@@ -1177,13 +1315,18 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
         transportAttempt,
         ...model ? { model } : {},
         logicalStartedAt,
-        attemptStartedAt: Date.now(),
-        policy
+        attemptStartedAtMonotonic: performance.now(),
+        policy,
+        terminalOutcome: null
       };
       await emitRequestEvent(audit, {
         phase: "started",
         responseObserved: false
       });
+      const semanticTerminal = {
+        phase: null,
+        deferTransportTerminal: !callerWantsStream
+      };
       try {
         res = await fetchBeforeHeaders(base, rewritten, nextInit, audit);
         const upstreamRequestId = providerRequestId(res.headers);
@@ -1193,8 +1336,7 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
           status: res.status,
           ...upstreamRequestId ? { providerRequestId: upstreamRequestId } : {}
         });
-        const observed = await observedResponse(res, audit, nextInit.signal);
-        res = observed;
+        res = await observedResponse(res, audit, nextInit.signal, semanticTerminal);
       } catch (error) {
         if (nextInit.signal?.aborted) {
           await emitRequestEvent(audit, {
@@ -1231,9 +1373,25 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
         });
       }
       if (!res.ok) {
-        return await bufferCodexErrorResponse(res);
+        const buffered = await bufferCodexErrorResponse(res);
+        const upstreamRequestId = providerRequestId(res.headers);
+        markSemanticTerminal(semanticTerminal, "failed");
+        await emitRequestEvent(audit, {
+          phase: "failed",
+          responseObserved: true,
+          status: res.status,
+          ...upstreamRequestId ? { providerRequestId: upstreamRequestId } : {}
+        }).catch(() => void 0);
+        return buffered;
       }
-      return callerWantsStream ? repairCodexStream(res) : await sseToJsonResponse(res);
+      if (callerWantsStream) {
+        res = validateCodexStream(res, (phase) => {
+          markSemanticTerminal(semanticTerminal, phase);
+        });
+      } else {
+        res = await sseToJsonResponse(res, audit, semanticTerminal);
+      }
+      return res;
     };
     try {
       let res = await attempt(await ctx.getToken(), 0);
@@ -1271,28 +1429,77 @@ function classifyCodexUsageLimitError(error) {
   return null;
 }
 async function bufferCodexErrorResponse(res) {
-  const bodyText = await res.text().catch(() => "");
+  const { text: bodyText, truncated } = await readBoundedResponseText(
+    res,
+    MAX_CODEX_ERROR_BODY_BYTES
+  );
   const headers = new Headers(res.headers);
   headers.set("content-type", "application/json");
   headers.set(CODEX_TRANSPORT_ERROR_HEADER, "1");
   headers.delete("content-length");
   headers.delete("content-encoding");
   let errorType;
+  let responseBody = bodyText;
   try {
     const parsed = JSON.parse(bodyText);
     errorType = typeof parsed.error?.type === "string" ? parsed.error.type : void 0;
   } catch {
   }
+  if (truncated) {
+    responseBody = JSON.stringify({
+      error: {
+        type: "provider_error_body_too_large",
+        code: "provider_error_body_too_large",
+        message: `The provider returned an error body larger than ${MAX_CODEX_ERROR_BODY_BYTES} bytes`
+      }
+    });
+    headers.set("x-opengeni-provider-error-truncated", "1");
+  }
   if (errorType === CODEX_USAGE_LIMIT_ERROR_TYPE) {
     headers.set("x-should-retry", "false");
   }
-  return new Response(bodyText, {
+  return new Response(responseBody, {
     status: res.status,
     statusText: res.statusText,
     headers
   });
 }
-async function sseToJsonResponse(res) {
+async function readBoundedResponseText(response, maxBytes) {
+  if (!response.body) return { text: "", truncated: false };
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  const parts = [];
+  let bytes = 0;
+  let truncated = false;
+  try {
+    while (bytes < maxBytes) {
+      const next = await reader.read();
+      if (next.done) {
+        parts.push(decoder.decode());
+        return { text: parts.join(""), truncated };
+      }
+      const remaining = maxBytes - bytes;
+      const accepted = next.value.byteLength > remaining ? next.value.subarray(0, remaining) : next.value;
+      bytes += accepted.byteLength;
+      parts.push(decoder.decode(accepted, { stream: true }));
+      if (accepted.byteLength !== next.value.byteLength) {
+        truncated = true;
+        break;
+      }
+      if (bytes >= maxBytes) {
+        truncated = true;
+        break;
+      }
+    }
+  } catch {
+    truncated = true;
+  } finally {
+    if (truncated) void reader.cancel().catch(() => void 0);
+  }
+  return { text: parts.join(""), truncated };
+}
+async function sseToJsonResponse(res, audit, semanticTerminal) {
+  const upstreamRequestId = providerRequestId(res.headers);
   const text = await res.text();
   let final = null;
   let terminalError = null;
@@ -1305,57 +1512,45 @@ async function sseToJsonResponse(res) {
       const ev = JSON.parse(data);
       if (ev.type === "response.output_item.done" && ev.item !== void 0) {
         items.push(ev.item);
-      } else if (ev.type === "response.failed") {
-        terminalError = codexSseFailureResponse(
-          res,
-          ev.response?.error,
-          "response_failed",
-          "The Codex response failed",
-          {
-            eventType: ev.type,
-            responseId: ev.response?.id,
-            responseStatus: ev.response?.status
-          }
-        );
-      } else if (ev.type === "error" || ev.type === "response.error") {
-        terminalError = codexSseFailureResponse(
-          res,
-          ev.error ?? ev.response?.error ?? ev,
-          "response_error",
-          "The Codex response stream reported an error",
-          {
-            eventType: ev.type,
-            responseId: ev.response?.id,
-            responseStatus: ev.response?.status
-          }
-        );
-      } else if (ev.type === "response.incomplete") {
-        const details = ev.response?.incomplete_details;
-        const reason = details && typeof details === "object" ? details.reason : void 0;
-        terminalError = codexSseFailureResponse(
-          res,
-          {
-            code: "response_incomplete",
-            message: typeof reason === "string" && reason.length > 0 ? `The Codex response was incomplete (${reason})` : "The Codex response was incomplete"
-          },
-          "response_incomplete",
-          "The Codex response was incomplete",
-          {
-            eventType: ev.type,
-            responseId: ev.response?.id,
-            responseStatus: ev.response?.status
-          }
-        );
-      } else if (ev.type === "response.completed" || ev.type === "response.done") {
-        final = ev.response ?? null;
+      } else {
+        const terminal = classifyCodexSseTerminal(ev);
+        if (terminal?.phase === "failed") {
+          terminalError = codexSseFailureResponse(
+            res,
+            terminal.rawError,
+            terminal.fallbackCode,
+            terminal.fallbackMessage,
+            {
+              eventType: ev.type,
+              responseId: ev.response?.id,
+              responseStatus: ev.response?.status
+            }
+          );
+        } else if (terminal?.phase === "completed") {
+          final = ev.response ?? null;
+        }
       }
     } catch {
     }
   }
   if (terminalError) {
+    markSemanticTerminal(semanticTerminal, "failed");
+    await emitRequestEvent(audit, {
+      phase: "failed",
+      responseObserved: true,
+      status: res.status,
+      ...upstreamRequestId ? { providerRequestId: upstreamRequestId } : {}
+    });
     return terminalError;
   }
   if (!final) {
+    markSemanticTerminal(semanticTerminal, "failed");
+    await emitRequestEvent(audit, {
+      phase: "failed",
+      responseObserved: true,
+      status: res.status,
+      ...upstreamRequestId ? { providerRequestId: upstreamRequestId } : {}
+    });
     return codexSseFailureResponse(
       res,
       null,
@@ -1371,6 +1566,13 @@ async function sseToJsonResponse(res) {
       `[codex-debug] sse->json items=${items.length} outputLen=${Array.isArray(final?.output) ? final.output.length : "?"}`
     );
   }
+  markSemanticTerminal(semanticTerminal, "completed");
+  await emitRequestEvent(audit, {
+    phase: "completed",
+    responseObserved: true,
+    status: res.status,
+    ...upstreamRequestId ? { providerRequestId: upstreamRequestId } : {}
+  });
   const headers = new Headers(res.headers);
   headers.set("content-type", "application/json");
   headers.delete("content-length");
@@ -1523,8 +1725,9 @@ function codexSseFailureError(source, rawError, fallbackCode, publicMessage, met
     codexSseFailureProjection(source, rawError, fallbackCode, publicMessage, metadata)
   );
 }
-function repairCodexStream(res) {
+function validateCodexStream(res, onSemanticTerminal) {
   if (!res.body) {
+    onSemanticTerminal?.("failed");
     const error = codexSseFailureError(
       res,
       null,
@@ -1544,7 +1747,6 @@ function repairCodexStream(res) {
       headers: headers2
     });
   }
-  const items = [];
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
   let buffer = "";
@@ -1555,9 +1757,8 @@ function repairCodexStream(res) {
       const block = buffer.slice(0, boundary.start);
       const separator = buffer.slice(boundary.start, boundary.end);
       buffer = buffer.slice(boundary.end);
-      const patched = patchSseBlock(block, items, res);
-      successfulTerminalSeen ||= patched.successfulTerminal;
-      controller.enqueue(encoder.encode(`${patched.block}${separator}`));
+      successfulTerminalSeen ||= inspectCodexSseBlock(block, res, onSemanticTerminal);
+      controller.enqueue(encoder.encode(`${block}${separator}`));
       boundary = findSseBlockBoundary(buffer, final);
     }
   };
@@ -1570,9 +1771,8 @@ function repairCodexStream(res) {
       buffer += decoder.decode();
       emitCompleteBlocks(controller, true);
       if (buffer.length > 0) {
-        const patched = patchSseBlock(buffer, items, res);
-        successfulTerminalSeen ||= patched.successfulTerminal;
-        controller.enqueue(encoder.encode(patched.block));
+        successfulTerminalSeen ||= inspectCodexSseBlock(buffer, res, onSemanticTerminal);
+        controller.enqueue(encoder.encode(buffer));
         buffer = "";
       }
       if (!successfulTerminalSeen) {
@@ -1613,59 +1813,37 @@ function sseLineEndingEnd(value, index, final) {
   }
   return final ? index + 1 : null;
 }
-function patchSseBlock(block, items, source) {
+var CODEX_TERMINAL_TYPE_HINTS = [
+  '"response.completed"',
+  '"response.done"',
+  '"response.failed"',
+  '"response.incomplete"',
+  '"response.error"',
+  '"error"'
+];
+function inspectCodexSseBlock(block, source, onSemanticTerminal) {
   const lines = block.split(/\r\n|\r|\n/);
   const dataStr = lines.filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("\n");
   if (!dataStr || dataStr === "[DONE]") {
-    return { block, successfulTerminal: false };
+    return false;
+  }
+  if (!CODEX_TERMINAL_TYPE_HINTS.some((terminalType) => dataStr.includes(terminalType))) {
+    return false;
   }
   let ev;
   try {
     ev = JSON.parse(dataStr);
   } catch {
-    return { block, successfulTerminal: false };
-  }
-  if (ev.type === "response.output_item.done" && ev.item !== void 0) {
-    items.push(ev.item);
-    return { block, successfulTerminal: false };
-  }
-  if (ev.type === "response.failed") {
-    throw codexSseFailureError(
-      source,
-      ev.response?.error,
-      "response_failed",
-      "The Codex response failed",
-      {
-        eventType: ev.type,
-        responseId: ev.response?.id,
-        responseStatus: ev.response?.status
-      }
-    );
-  }
-  if (ev.type === "error" || ev.type === "response.error") {
-    throw codexSseFailureError(
-      source,
-      ev.error ?? ev.response?.error ?? ev,
-      "response_error",
-      "The Codex response stream reported an error",
-      {
-        eventType: ev.type,
-        responseId: ev.response?.id,
-        responseStatus: ev.response?.status
-      }
-    );
+    return false;
   }
-  if (ev.type === "response.incomplete") {
-    const details = ev.response?.incomplete_details;
-    const reason = details && typeof details === "object" ? details.reason : void 0;
+  const terminal = classifyCodexSseTerminal(ev);
+  if (terminal?.phase === "failed") {
+    onSemanticTerminal?.("failed");
     throw codexSseFailureError(
       source,
-      {
-        code: "response_incomplete",
-        message: typeof reason === "string" && reason.length > 0 ? `The Codex response was incomplete (${reason})` : "The Codex response was incomplete"
-      },
-      "response_incomplete",
-      "The Codex response was incomplete",
+      terminal.rawError,
+      terminal.fallbackCode,
+      terminal.fallbackMessage,
       {
         eventType: ev.type,
         responseId: ev.response?.id,
@@ -1673,33 +1851,11 @@ function patchSseBlock(block, items, source) {
       }
     );
   }
-  if ((ev.type === "response.completed" || ev.type === "response.done") && ev.response) {
-    if (ev.response.status === "failed" || ev.response.status === "incomplete" || ev.response.error !== null && ev.response.error !== void 0) {
-      throw codexSseFailureError(
-        source,
-        ev.response.error,
-        ev.response.status === "incomplete" ? "response_incomplete" : "response_failed",
-        ev.response.status === "incomplete" ? "The Codex response was incomplete" : "The Codex response failed",
-        {
-          eventType: ev.type,
-          responseId: ev.response.id,
-          responseStatus: ev.response.status
-        }
-      );
-    }
-    const out = ev.response.output;
-    if ((!Array.isArray(out) || out.length === 0) && items.length > 0) {
-      ev.response = { ...ev.response, output: items };
-      const nonData = lines.filter((l) => !l.startsWith("data:"));
-      const lineEnding = block.match(/\r\n|\r|\n/)?.[0] ?? "\n";
-      return {
-        block: [...nonData, `data: ${JSON.stringify(ev)}`].join(lineEnding),
-        successfulTerminal: true
-      };
-    }
-    return { block, successfulTerminal: true };
+  if (terminal?.phase === "completed") {
+    onSemanticTerminal?.("completed");
+    return true;
   }
-  return { block, successfulTerminal: false };
+  return false;
 }
 
 // src/mcp-sanitize.ts
@@ -1962,7 +2118,13 @@ function boundModelToolOutputItem(item, policyTokens = DEFAULT_MODEL_TOOL_OUTPUT
   return boundedOutput === item.output ? item : { ...item, output: boundedOutput };
 }
 function boundModelToolOutputItems(items, policyTokens = DEFAULT_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS) {
-  return items.map((item) => boundModelToolOutputItem(item, policyTokens));
+  let bounded = null;
+  for (const [index, item] of items.entries()) {
+    const next = boundModelToolOutputItem(item, policyTokens);
+    if (next !== item && bounded === null) bounded = items.slice(0, index);
+    bounded?.push(next);
+  }
+  return bounded ?? items;
 }
 function boundToolOutputValue(output, budgetTokens) {
   const state = modelOutputBoundState(budgetTokens);
@@ -2277,6 +2439,161 @@ function isImageDataUrl(value) {
   return /^data:image\/[a-z0-9.+-]+;base64,/i.test(value);
 }
 
+// src/images.ts
+import { pinnedFetch, readJsonBase64Field, readResponseTextBounded } from "@opengeni/network";
+var CODEX_IMAGE_MODEL = "gpt-image-2";
+var CODEX_IMAGE_RESPONSE_MAX_BYTES = 90 * 1024 * 1024;
+var CODEX_IMAGE_ERROR_MAX_BYTES = 64 * 1024;
+var CODEX_IMAGE_MAX_BYTES = 64 * 1024 * 1024;
+var CODEX_IMAGE_REQUEST_TIMEOUT_MS = 5 * 6e4;
+var CODEX_IMAGE_MAX_REFERENCES = 5;
+var codexImageFetch = async (input, init) => await pinnedFetch(
+  input,
+  init,
+  {
+    environment: "production",
+    integrationsAllowPrivateNetworkTargets: false
+  },
+  {
+    label: "Codex image generation",
+    requireHttpsOutsideLocalTest: true
+  }
+);
+var CodexImageApiError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "CodexImageApiError";
+  }
+};
+var CodexImageRequestTimeoutError = class extends Error {
+  constructor(timeoutMs) {
+    super(`Codex image generation timed out after ${Math.ceil(timeoutMs / 1e3)} seconds`);
+    this.timeoutMs = timeoutMs;
+    this.name = "CodexImageRequestTimeoutError";
+  }
+};
+async function generateCodexSubscriptionImage(input) {
+  const fetchImpl = input.fetch ?? codexImageFetch;
+  const timeoutMs = input.requestTimeoutMs ?? CODEX_IMAGE_REQUEST_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+    throw new RangeError("Codex image request timeout must be a positive safe integer");
+  }
+  const references = input.references ?? [];
+  if (references.length > CODEX_IMAGE_MAX_REFERENCES) {
+    throw new RangeError(
+      `Codex image editing accepts at most ${CODEX_IMAGE_MAX_REFERENCES} images`
+    );
+  }
+  for (const reference of references) {
+    if (reference.bytes.byteLength === 0) throw new Error("Codex image reference is empty");
+  }
+  const deadline = new AbortController();
+  const timer = setTimeout(
+    () => deadline.abort(new CodexImageRequestTimeoutError(timeoutMs)),
+    timeoutMs
+  );
+  const signal = input.abortSignal ? AbortSignal.any([input.abortSignal, deadline.signal]) : deadline.signal;
+  const request = async (auth) => {
+    const headers = codexImageHeaders(auth, input.context.clientVersion, input.turnId);
+    return await fetchImpl(
+      `${CODEX_RESPONSES_BASE}/${references.length > 0 ? "images/edits" : "images/generations"}`,
+      {
+        method: "POST",
+        redirect: "error",
+        headers,
+        body: JSON.stringify(
+          references.length > 0 ? {
+            images: references.map((reference) => ({
+              image_url: `data:${reference.mediaType};base64,${Buffer.from(reference.bytes).toString("base64")}`
+            })),
+            prompt: input.prompt,
+            background: "auto",
+            model: CODEX_IMAGE_MODEL,
+            quality: "auto",
+            size: "auto"
+          } : {
+            prompt: input.prompt,
+            background: "auto",
+            model: CODEX_IMAGE_MODEL,
+            quality: "auto",
+            size: "auto"
+          }
+        ),
+        signal
+      }
+    );
+  };
+  const operation = (async () => {
+    let response = await request(await input.context.getToken());
+    if (response.status === 401) {
+      await response.body?.cancel().catch(() => void 0);
+      response = await request(await input.context.refresh());
+    }
+    if (!response.ok) {
+      const detail = await readResponseTextBounded(
+        response,
+        CODEX_IMAGE_ERROR_MAX_BYTES,
+        "Codex image error",
+        { signal }
+      ).catch(() => "");
+      throw new CodexImageApiError(
+        response.status,
+        detail ? `Codex image generation failed (${response.status}): ${boundedErrorMessage(detail)}` : `Codex image generation failed (${response.status})`
+      );
+    }
+    const bytes = await readJsonBase64Field(response, {
+      fieldName: "b64_json",
+      shape: "string",
+      maxResponseBytes: CODEX_IMAGE_RESPONSE_MAX_BYTES,
+      maxDecodedBytes: CODEX_IMAGE_MAX_BYTES,
+      label: "Codex image generation",
+      signal
+    });
+    return { bytes, declaredMediaType: "image/png" };
+  })();
+  let removeAbortListener = () => void 0;
+  const aborted = new Promise((_resolve, reject) => {
+    const onAbort = () => reject(signal.reason);
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+    removeAbortListener = () => signal.removeEventListener("abort", onAbort);
+  });
+  try {
+    return await Promise.race([operation, aborted]);
+  } finally {
+    removeAbortListener();
+    clearTimeout(timer);
+  }
+}
+function codexImageHeaders(auth, clientVersion, turnId) {
+  const headers = new Headers({
+    Authorization: `Bearer ${auth.accessToken}`,
+    accept: "application/json",
+    "content-type": "application/json",
+    originator: CODEX_ORIGINATOR,
+    "User-Agent": `${CODEX_ORIGINATOR}/${clientVersion || CODEX_CLIENT_VERSION}`,
+    version: clientVersion || CODEX_CLIENT_VERSION,
+    "x-codex-image-turn-id": turnId
+  });
+  if (auth.chatgptAccountId) headers.set("ChatGPT-Account-ID", auth.chatgptAccountId);
+  if (auth.isFedramp) headers.set("X-OpenAI-Fedramp", "true");
+  return headers;
+}
+function boundedErrorMessage(body) {
+  let message = body;
+  try {
+    const value = JSON.parse(body);
+    const candidate = value.error?.message ?? value.message;
+    if (typeof candidate === "string") message = candidate;
+  } catch {
+  }
+  return message.replace(/\s+/g, " ").trim().slice(0, 1e3);
+}
+
 // src/realtime.ts
 var CODEX_REALTIME_CALL_URL = `${CODEX_RESPONSES_BASE}/realtime/calls?intent=quicksilver&architecture=avas`;
 var MAX_REALTIME_SDP_BYTES = 1024 * 1024;
@@ -2578,6 +2895,10 @@ export {
   CODEX_REALTIME_VOICES,
   CODEX_REFRESH_FALLBACK_MS,
   CODEX_REFRESH_WINDOW_MS,
+  CODEX_REQUEST_BODY_NORMALIZED_HEADER,
+  CODEX_REQUEST_CALLER_STREAM_HEADER,
+  CODEX_REQUEST_ID_HEADER,
+  CODEX_REQUEST_MODEL_HEADER,
   CODEX_RESPONSES_BASE,
   CODEX_RESPONSE_HEADERS_TIMEOUT_MS,
   CODEX_RESPONSE_NO_BYTE_RETRIES,
@@ -2593,6 +2914,8 @@ export {
   CODEX_WEEKLY_WINDOW_SECONDS,
   CODEX_WHAM_BASE,
   CodexDeviceError,
+  CodexImageApiError,
+  CodexImageRequestTimeoutError,
   CodexRealtimeError,
   CodexRefreshTransient,
   CodexReloginRequired,
@@ -2626,12 +2949,14 @@ export {
   fetchCodexModels,
   fetchCodexRateLimitResetCredits,
   fetchCodexUsage,
+  generateCodexSubscriptionImage,
   isCodexBilledModel,
   isCodexTransportError,
   isPreHeadersTimeoutError,
   modelToolOutputSerializationBudgetTokens,
   normalizeCodexRequestBody,
   normalizeCodexUsage,
+  normalizedCodexRequestBody,
   opaqueProviderArtifactFingerprint,
   opaqueProviderArtifactFingerprints,
   parseCodexRateLimitResetConsumeResponse,