@opengeni/codex 0.2.24 → 0.2.25-canary.35916963870001

package/dist/model-output-truncation.d.ts

@@ -18,6 +18,7 @@
  * runtime request seam and the database history boundary call the same pure
  * function, so replayed conversation truth is identical to live model input.
  */
+import { type HostedCallStatusItemType } from "./hosted-call-status.js";
 export { MODEL_TOOL_OUTPUT_OVERSIZED_IMAGE_CARD_DATA_URL } from "./oversized-image-card.js";
 export type ModelHistoryItem = Record<string, unknown>;
 type WithoutOutputOnlyProviderDataFields<T> = T extends ModelHistoryItem ? Omit<T, "status"> : T;
@@ -28,15 +29,18 @@ type WithoutOutputOnlyProviderDataField<T extends ModelHistoryItem> = "providerD
 } : {
     providerData: WithoutOutputOnlyProviderDataFields<T["providerData"]>;
 } : object;
-type WithoutOutputOnlyHistoryItemFields<T extends ModelHistoryItem> = T extends unknown ? Omit<T, "status" | "providerData"> & WithoutOutputOnlyProviderDataField<T> : never;
+type WithoutOutputOnlyHistoryItemFields<T extends ModelHistoryItem> = T extends unknown ? T extends {
+    type: HostedCallStatusItemType;
+} ? T : Omit<T, "status" | "providerData"> & WithoutOutputOnlyProviderDataField<T> : never;
 /**
  * Responses output items carry `status` (`in_progress` / `completed` /
  * `incomplete`). That field is not conversation meaning — pairing is `call_id`
  * — and Codex's input schema 400s it (`Unknown parameter: 'input[N].status'`).
  * SuperGrok accepts items with or without it. The SDK also nests `status` on
  * `providerData` (reasoning items) and flattens it back onto the request.
- * Canonical history therefore omits both at persist so portable sessions can
- * cross Responses providers.
+ * Canonical history omits both for those items so portable sessions can cross
+ * Responses providers. Hosted tool calls are different: the provider requires
+ * their status on replay, and the SDK reads it to reconstruct the wire item.
  */
 export declare function omitOutputOnlyHistoryItemFields<T extends ModelHistoryItem>(item: T): WithoutOutputOnlyHistoryItemFields<T>;
 /** Persist/replay boundary: drop output-only fields, then bound tool output. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/codex",
-  "version": "0.2.24",
+  "version": "0.2.25-canary.35916963870001",
   "description": "ChatGPT/Codex subscription auth + transport: device-code login, token refresh, and the Responses-backend fetch. Pure HTTP + transforms; no database dependency.",
   "license": "Apache-2.0",
   "repository": {
@@ -41,7 +41,8 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/network": "^0.3.1",
+    "@opengeni/contracts": "^5.1.0-canary.35916963870001",
+    "@opengeni/network": "^0.3.1-canary.35916963870001",
     "zod": "^4.2.1"
   },
   "engines": {

package/src/constants.ts

@@ -25,16 +25,10 @@ export const CODEX_PROVIDER_ID = "codex-subscription";
 export const CODEX_PROVIDER_BASE_URL = "https://chatgpt.com/backend-api";
 export const CODEX_MODEL_ID_PREFIX = "codex/";
 
-// The only Codex subscription models OpenGeni exposes. Astra is deliberately
-// pre-advertised before an account receives provider rollout access so the
-// picker becomes runnable without another OpenGeni release once access arrives.
-// Older or internal live models never broaden this product allowlist.
-export const CODEX_FALLBACK_MODEL_SLUGS = [
-  "gpt-5.6-sol",
-  "gpt-5.6-terra",
-  "gpt-5.6-luna",
-  "gpt-6-astra",
-] as const;
+// The only Codex subscription models OpenGeni exposes. Older families are not
+// advertised. A slug stays in this list before every account has rollout access
+// so the picker can offer it without another OpenGeni release.
+export const CODEX_FALLBACK_MODEL_SLUGS = ["gpt-6-astra", "gpt-6-sol", "gpt-6-luna"] as const;
 
 // Live Codex model-catalog values for every exposed subscription slug.
 // Verified 2026-09-04 against Codex CLI 0.153.2's bundled model catalog:
@@ -57,7 +51,7 @@ export const CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT = Math.floor(
 // 2026-07-09: 0.142.4 filtered every GPT-5.6 slug out of GET /models. Keep this
 // pinned to the latest stable Codex release whose bundled catalog and transport
 // contract have been reviewed here.
-export const CODEX_CLIENT_VERSION = "0.153.2";
+export const CODEX_CLIENT_VERSION = "0.156.0";
 
 // Public OpenGeni selector for native ChatGPT/Codex subscription WebRTC. This
 // remains stable for persisted sessions; the provider's remotely configured

package/src/hosted-call-status.ts

@@ -0,0 +1,17 @@
+/** Hosted Responses calls require status on replay, unlike function/message annotations. */
+export type HostedCallStatusItemType =
+  | "hosted_tool_call"
+  | "web_search_call"
+  | "file_search_call"
+  | "code_interpreter_call"
+  | "image_generation_call";
+
+export function preservesHostedCallStatus(type: unknown): type is HostedCallStatusItemType {
+  return (
+    type === "hosted_tool_call" ||
+    type === "web_search_call" ||
+    type === "file_search_call" ||
+    type === "code_interpreter_call" ||
+    type === "image_generation_call"
+  );
+}

package/src/model-output-truncation.ts

@@ -20,6 +20,8 @@
  */
 
 import { MODEL_TOOL_OUTPUT_OVERSIZED_IMAGE_CARD_DATA_URL } from "./oversized-image-card";
+import { RetainedArtifactMetadataSchema } from "@opengeni/contracts";
+import { preservesHostedCallStatus, type HostedCallStatusItemType } from "./hosted-call-status";
 
 export { MODEL_TOOL_OUTPUT_OVERSIZED_IMAGE_CARD_DATA_URL } from "./oversized-image-card";
 
@@ -42,7 +44,9 @@ type WithoutOutputOnlyProviderDataField<T extends ModelHistoryItem> = "providerD
   : object;
 
 type WithoutOutputOnlyHistoryItemFields<T extends ModelHistoryItem> = T extends unknown
-  ? Omit<T, "status" | "providerData"> & WithoutOutputOnlyProviderDataField<T>
+  ? T extends { type: HostedCallStatusItemType }
+    ? T
+    : Omit<T, "status" | "providerData"> & WithoutOutputOnlyProviderDataField<T>
   : never;
 
 /**
@@ -51,8 +55,9 @@ type WithoutOutputOnlyHistoryItemFields<T extends ModelHistoryItem> = T extends
  * — and Codex's input schema 400s it (`Unknown parameter: 'input[N].status'`).
  * SuperGrok accepts items with or without it. The SDK also nests `status` on
  * `providerData` (reasoning items) and flattens it back onto the request.
- * Canonical history therefore omits both at persist so portable sessions can
- * cross Responses providers.
+ * Canonical history omits both for those items so portable sessions can cross
+ * Responses providers. Hosted tool calls are different: the provider requires
+ * their status on replay, and the SDK reads it to reconstruct the wire item.
  */
 export function omitOutputOnlyHistoryItemFields<T extends ModelHistoryItem>(
   item: T,
@@ -60,6 +65,9 @@ export function omitOutputOnlyHistoryItemFields<T extends ModelHistoryItem>(
   if (!item || typeof item !== "object") {
     return item as unknown as WithoutOutputOnlyHistoryItemFields<T>;
   }
+  if (preservesHostedCallStatus(item.type)) {
+    return item as unknown as WithoutOutputOnlyHistoryItemFields<T>;
+  }
   const providerData =
     item.providerData && typeof item.providerData === "object"
       ? (item.providerData as Record<string, unknown>)
@@ -402,6 +410,16 @@ function boundTextLeaves(
     return bounded;
   }
   if (!value || typeof value !== "object") return value;
+  // Screenshot receipts are image protocol, not model-visible text. They are
+  // compact, schema-bounded references whose fields must survive a zero text
+  // budget so a resumed turn can materialize the image from durable storage.
+  if (
+    !Array.isArray(value) &&
+    (value as Record<string, unknown>).type === "retained_artifact" &&
+    RetainedArtifactMetadataSchema.safeParse((value as Record<string, unknown>).artifact).success
+  ) {
+    return value;
+  }
   if (depth >= MODEL_TOOL_OUTPUT_MAX_DEPTH) return DEPTH_OMISSION_MARKER;
   if (state.seen.has(value)) return CYCLE_OMISSION_MARKER;
   state.seen.add(value);

package/src/normalize.ts

@@ -7,7 +7,8 @@
 //   - strip max_output_tokens / max_completion_tokens
 //   - reasoning effort minimal -> low
 //   - normalize the model slug (longest-prefix against the live catalog)
-//   - strip every item `id` and `status` but PRESERVE `call_id`
+//   - strip every item `id` and output-only `status` but PRESERVE `call_id`
+//     and the required status of hosted tool calls
 // We do NOT filter item_reference (the SDK never emits it) and do NOT convert
 // orphaned tool outputs (the SDK's runner already prunes by call_id).
 //
@@ -16,6 +17,8 @@
 // schema 400s `Unknown parameter: 'input[N].status'` — observed live on a
 // portable SuperGrok → Codex switch. Pairing uses `call_id`, never `status`.
 
+import { preservesHostedCallStatus } from "./hosted-call-status";
+
 const MINIMAL = "minimal";
 
 // The ChatGPT/Codex backend is a STRICT ALLOWLIST: it 400s on ANY top-level field
@@ -71,13 +74,13 @@ export function normalizeCodexRequestBody(
     body.model = resolveModel(body.model);
   }
 
-  // strip every item id and status; PRESERVE call_id. spec §1.6 / verdict §0(b)
+  // Strip item ids and output-only status; preserve call_id and hosted status.
   // (This also covers tool_search items: the backend accepts an id-less
   // tool_search_call/output pair correlated by call_id — verified live — and
   // stripping the provider-stored `tsc_…` id here sanitizes BOTH replay paths.)
-  // `status` is output-only on Codex input items. New rows omit it at persist;
-  // this wire strip remains defense for already-stored SuperGrok rows and
-  // mid-turn SDK items.
+  // Hosted web/file search, code interpreter and image-generation items require
+  // their actual status on replay. Never turn an absent status into a fabricated
+  // completion. Other items retain the portable-history compatibility strip.
   if (Array.isArray(body.input)) {
     for (const item of body.input as unknown[]) {
       if (!item || typeof item !== "object") {
@@ -87,7 +90,7 @@ export function normalizeCodexRequestBody(
       if ("id" in record) {
         delete record.id;
       }
-      if ("status" in record) {
+      if ("status" in record && !preservesHostedCallStatus(record.type)) {
         delete record.status;
       }
       // A replayed tool_search_call must carry `arguments` as an OBJECT — the

package/dist/chunk-OJCCJBUL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/constants.ts"],"sourcesContent":["// Wire constants for the ChatGPT/Codex subscription backend.\n// Source: CODEX-SUBSCRIPTION-SPEC.md (verified against openai/codex codex-rs).\n\nexport const CODEX_ISSUER = \"https://auth.openai.com\";\nexport const CODEX_CLIENT_ID = \"app_EMoamEEZ73f0CkXaXp7hrann\"; // spec §1.1 (manager.rs:1444)\nexport const CODEX_AUTH_BASE = `${CODEX_ISSUER}/api/accounts`; // device endpoints (device_code_auth.rs:164)\nexport const CODEX_TOKEN_URL = `${CODEX_ISSUER}/oauth/token`; // exchange (form) + refresh (json)\nexport const CODEX_DEVICE_VERIFICATION_URL = `${CODEX_ISSUER}/codex/device`;\nexport const CODEX_DEVICE_REDIRECT_URI = `${CODEX_ISSUER}/deviceauth/callback`;\n\n// Model requests: base already includes /codex; client appends /responses, /models.\nexport const CODEX_RESPONSES_BASE = \"https://chatgpt.com/backend-api/codex\";\n// Usage lives on the WHAM base — NOT under /codex (verified, spec §1.8a).\nexport const CODEX_WHAM_BASE = \"https://chatgpt.com/backend-api\";\n\nexport const CODEX_ORIGINATOR = \"codex_cli_rs\"; // whitelisted originator (spec §1.2)\nexport const CODEX_ID_TOKEN_AUTH_CLAIM = \"https://api.openai.com/auth\";\n\n// Synthetic registry-provider identity. The provider's baseURL is the bare\n// /backend-api (NOT /codex) — codexSubscriptionFetch rewrites /responses ->\n// /codex/responses. Codex model ids are namespaced `codex/<slug>` so they never\n// collide with the built-in OpenAI provider's model ids; the fetch's resolveModel\n// strips the prefix before the slug reaches the backend.\nexport const CODEX_PROVIDER_ID = \"codex-subscription\";\nexport const CODEX_PROVIDER_BASE_URL = \"https://chatgpt.com/backend-api\";\nexport const CODEX_MODEL_ID_PREFIX = \"codex/\";\n\n// The only Codex subscription models OpenGeni exposes. Astra is deliberately\n// pre-advertised before an account receives provider rollout access so the\n// picker becomes runnable without another OpenGeni release once access arrives.\n// Older or internal live models never broaden this product allowlist.\nexport const CODEX_FALLBACK_MODEL_SLUGS = [\n  \"gpt-5.6-sol\",\n  \"gpt-5.6-terra\",\n  \"gpt-5.6-luna\",\n  \"gpt-6-astra\",\n] as const;\n\n// Live Codex model-catalog values for every exposed subscription slug.\n// Verified 2026-09-04 against Codex CLI 0.153.2's bundled model catalog:\n//   raw context window                = 272,000\n//   effective input window (95%)      = 258,400\n//   automatic compaction limit (90%)  = 244,800\n// Keep all three explicit: the effective ceiling is a hard input guard while\n// the lower auto-compact limit is the proactive checkpoint trigger.\nexport const CODEX_MODEL_CONTEXT_WINDOW_TOKENS = 272_000;\nexport const CODEX_EFFECTIVE_CONTEXT_WINDOW_PERCENT = 95;\nexport const CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS = Math.floor(\n  (CODEX_MODEL_CONTEXT_WINDOW_TOKENS * CODEX_EFFECTIVE_CONTEXT_WINDOW_PERCENT) / 100,\n);\nexport const CODEX_AUTO_COMPACTION_PERCENT = 90;\nexport const CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT = Math.floor(\n  (CODEX_MODEL_CONTEXT_WINDOW_TOKENS * CODEX_AUTO_COMPACTION_PERCENT) / 100,\n);\n\n// Sent as the `version` header and inside the User-Agent. Staging-proven on\n// 2026-07-09: 0.142.4 filtered every GPT-5.6 slug out of GET /models. Keep this\n// pinned to the latest stable Codex release whose bundled catalog and transport\n// contract have been reviewed here.\nexport const CODEX_CLIENT_VERSION = \"0.153.2\";\n\n// Public OpenGeni selector for native ChatGPT/Codex subscription WebRTC. This\n// remains stable for persisted sessions; the provider's remotely configured\n// model is resolved separately before call creation.\nexport const CODEX_REALTIME_MODEL = \"gpt-live-1-boulder-alpha\";\nexport const CODEX_REALTIME_VERSION = \"v3\";\nexport const CODEX_REALTIME_DEFAULT_VOICE = \"cove\";\nexport const CODEX_REALTIME_CALL_TIMEOUT_MS = 15_000;\nexport const CODEX_REALTIME_CONFIG_TIMEOUT_MS = 5_000;\nexport const CODEX_REALTIME_CONFIG_ID = \"3566525122\";\n// Verified live on 2026-08-23. Used only when the authenticated remote config\n// is transiently unavailable or malformed; it is not the persisted model id.\nexport const CODEX_REALTIME_PROVIDER_MODEL_FALLBACK = \"gpt-live-1-codex\";\nexport const CODEX_REALTIME_PROVIDER_ARCHITECTURE_FALLBACK = \"avas\";\n\nexport const CODEX_REFRESH_WINDOW_MS = 5 * 60 * 1000; // proactive refresh when within 5 min of exp (spec §1.1)\nexport const CODEX_REFRESH_FALLBACK_MS = 8 * 24 * 60 * 60 * 1000; // 8 days when exp is unparseable\n\n// Codex Responses transport deadlines. The OpenAI SDK's own timeout only covers\n// the wait for response headers and erases the underlying timeout class into the\n// bare `Request timed out.` error. Keep the provider-specific budgets here so\n// the transport can enforce and durably report them without enabling the SDK's\n// blind request replay.\nexport const CODEX_RESPONSE_HEADERS_TIMEOUT_MS = 4 * 60_000;\nexport const CODEX_RESPONSE_STREAM_IDLE_TIMEOUT_MS = 5 * 60_000;\nexport const CODEX_RESPONSE_WHOLE_TIMEOUT_MS = 30 * 60_000;\n// Kept as a compatibility-shaped policy field, but automatic replay is disabled\n// until a provider-specific operation receipt can prove non-acceptance or resume\n// the same operation identity. An absent response does not prove that the\n// provider never accepted the request.\nexport const CODEX_RESPONSE_NO_BYTE_RETRIES = 0;\nexport const CODEX_RESPONSE_RETRY_BACKOFF_MS = 1_000;\n// Must exceed the transport-owned whole-response deadline. This SDK guard is a\n// last-resort envelope; the inner transport emits the typed/durable failure.\nexport const CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS = 35 * 60_000;\n\n// ── Apps / connectors MCP (spec §1.10, §E) ───────────────────────────────────\n// One server-side MCP exposes ALL the user's ChatGPT/Codex connectors\n// (gmail/github/linear/slack/sentry/drive/calendar/…). Streamable HTTP, always.\nexport const CODEX_APPS_MCP_SERVER_ID = \"codex_apps\"; // tools surface as mcp__codex_apps__<tool>\nexport const CODEX_APPS_MCP_SERVER_NAME = \"codex_apps\"; // MCP `name` — MUST equal the id so the SDK namespaces tools as mcp__codex_apps__*\nexport const CODEX_APPS_MCP_URL = \"https://chatgpt.com/backend-api/ps/mcp\"; // live URL (NOT /codex, NOT the legacy /wham/apps)\nexport const CODEX_APPS_STARTUP_TIMEOUT_MS = 30_000; // startup_timeout 30s (spec §1.10) — maps to timeoutMs on this server only\n// Connector scopes that the apps MCP requires. Present ONLY when granted at\n// browser-authorize time; the device-code path CANNOT be confirmed to grant\n// them, so treat connector availability as runtime-discovered (spec §1.10 / §E).\nexport const CODEX_APPS_REQUIRED_SCOPES = [\"api.connectors.read\", \"api.connectors.invoke\"] as const;\n"],"mappings":";AAGO,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,kBAAkB,GAAG,YAAY;AACvC,IAAM,kBAAkB,GAAG,YAAY;AACvC,IAAM,gCAAgC,GAAG,YAAY;AACrD,IAAM,4BAA4B,GAAG,YAAY;AAGjD,IAAM,uBAAuB;AAE7B,IAAM,kBAAkB;AAExB,IAAM,mBAAmB;AACzB,IAAM,4BAA4B;AAOlC,IAAM,oBAAoB;AAC1B,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAM9B,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,oCAAoC;AAC1C,IAAM,yCAAyC;AAC/C,IAAM,8CAA8C,KAAK;AAAA,EAC7D,oCAAoC,yCAA0C;AACjF;AACO,IAAM,gCAAgC;AACtC,IAAM,uCAAuC,KAAK;AAAA,EACtD,oCAAoC,gCAAiC;AACxE;AAMO,IAAM,uBAAuB;AAK7B,IAAM,uBAAuB;AAC7B,IAAM,yBAAyB;AAC/B,IAAM,+BAA+B;AACrC,IAAM,iCAAiC;AACvC,IAAM,mCAAmC;AACzC,IAAM,2BAA2B;AAGjC,IAAM,yCAAyC;AAC/C,IAAM,gDAAgD;AAEtD,IAAM,0BAA0B,IAAI,KAAK;AACzC,IAAM,4BAA4B,IAAI,KAAK,KAAK,KAAK;AAOrD,IAAM,oCAAoC,IAAI;AAC9C,IAAM,wCAAwC,IAAI;AAClD,IAAM,kCAAkC,KAAK;AAK7C,IAAM,iCAAiC;AACvC,IAAM,kCAAkC;AAGxC,IAAM,sCAAsC,KAAK;AAKjD,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,qBAAqB;AAC3B,IAAM,gCAAgC;AAItC,IAAM,6BAA6B,CAAC,uBAAuB,uBAAuB;","names":[]}