@opengeni/codex 3.3.0 → 3.4.0

package/dist/index.js

@@ -873,234 +873,609 @@ function opaqueProviderArtifactFingerprints(input) {
   });
 }
 
-// src/fetch.ts
-function emitRequestPreparationDiagnostic(ctx, phase) {
+// src/responses-websocket.ts
+var CODEX_RESPONSES_WEBSOCKET_BETA = "responses_websockets=2026-02-06";
+var CODEX_TRANSPORT_HEADER = "x-opengeni-codex-transport";
+var HTTP_REASONS = /* @__PURE__ */ new Set([
+  "not_eligible",
+  "connection_busy",
+  "handshake_backoff",
+  "handshake_failed",
+  "unavailable"
+]);
+function formatCodexRequestTransport(transport) {
+  return transport.kind === "websocket" ? `websocket; connection=${transport.connection}` : `http; reason=${transport.reason}`;
+}
+function parseCodexRequestTransport(value) {
+  if (!value) return null;
+  const [kind, ...parameters] = value.split(";").map((part) => part.trim());
+  const fields = new Map(
+    parameters.map((parameter) => {
+      const index = parameter.indexOf("=");
+      return [parameter.slice(0, index), parameter.slice(index + 1)];
+    })
+  );
+  if (kind === "websocket") {
+    const connection = fields.get("connection");
+    return connection === "new" || connection === "reused" ? { kind: "websocket", connection } : null;
+  }
+  if (kind === "http") {
+    const reason = fields.get("reason");
+    return reason && HTTP_REASONS.has(reason) ? {
+      kind: "http",
+      reason
+    } : null;
+  }
+  return null;
+}
+function withTransport(response, transport) {
+  const value = formatCodexRequestTransport(transport);
   try {
-    ctx.onRequestPreparationDiagnostic?.(phase);
+    response.headers.set(CODEX_TRANSPORT_HEADER, value);
+    return response;
   } catch {
+    const headers = new Headers(response.headers);
+    headers.set(CODEX_TRANSPORT_HEADER, value);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
   }
 }
-var CODEX_TRANSPORT_ERROR_HEADER = "x-opengeni-codex-transport-error";
-var CODEX_REQUEST_BODY_NORMALIZED_HEADER = "x-opengeni-request-body-normalized";
-var REPLAYABLE_REQUEST_BODY_FACTORY = Symbol.for("opengeni.replayable-request-body-factory");
-var CODEX_REQUEST_MODEL_HEADER = "x-opengeni-request-model";
-var CODEX_REQUEST_ID_HEADER = "x-opengeni-request-id";
-var CODEX_REQUEST_CALLER_STREAM_HEADER = "x-opengeni-request-caller-stream";
-var MAX_CODEX_ERROR_BODY_BYTES = 64 * 1024;
-function headersCarryCodexTransportMarker(headers) {
-  if (!headers || typeof headers !== "object") return false;
-  const getter = headers.get;
-  if (typeof getter === "function") {
-    return getter.call(headers, CODEX_TRANSPORT_ERROR_HEADER) === "1";
-  }
-  const record = headers;
-  return record[CODEX_TRANSPORT_ERROR_HEADER] === "1" || record[CODEX_TRANSPORT_ERROR_HEADER.toLowerCase()] === "1";
+var DEFAULT_IDLE_MS = 5 * 6e4;
+var DEFAULT_MAX_AGE_MS = 45 * 6e4;
+var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
+var DEFAULT_HANDSHAKE_BACKOFF_MS = 5 * 6e4;
+var PER_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "content-type",
+  "content-length",
+  "idempotency-key",
+  "openai-beta"
+]);
+var TERMINAL_EVENTS = /* @__PURE__ */ new Set([
+  "response.completed",
+  "response.done",
+  "response.failed",
+  "response.incomplete",
+  "response.error",
+  "error"
+]);
+var RATE_LIMITS_EVENT = "codex.rate_limits";
+var METADATA_EVENT = "codex.response.metadata";
+var TIMING_EVENT = "responsesapi.websocket_timing";
+var HEADER_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function bunWebSocketFactory() {
+  const runtime = globalThis;
+  if (!runtime.Bun || typeof runtime.WebSocket !== "function") return null;
+  const Socket = runtime.WebSocket;
+  return (url, headers) => new Socket(url, { headers });
 }
-function isCodexTransportError(error) {
-  let current = error;
-  for (let depth = 0; depth < 6 && current && typeof current === "object"; depth += 1) {
-    const value = current;
-    if (headersCarryCodexTransportMarker(value.headers)) return true;
-    current = value.cause;
-  }
-  return false;
+function eventData(data) {
+  if (typeof data === "string") return data;
+  if (data instanceof ArrayBuffer) return new TextDecoder().decode(data);
+  if (ArrayBuffer.isView(data)) return new TextDecoder().decode(data);
+  return null;
 }
-var CODEX_ENCRYPTED_CONTENT_REJECTION_CODE = "invalid_encrypted_content";
-function classifyCodexEncryptedArtifactRejection(error) {
-  if (!isCodexTransportError(error)) return null;
-  let current = error;
-  for (let depth = 0; depth < 6 && current && typeof current === "object"; depth += 1) {
-    const value = current;
-    const body = value.error && typeof value.error === "object" ? value.error : null;
-    const status = Number(value.status ?? body?.status);
-    const exactCode = typeof body?.code === "string" ? body.code : typeof value.code === "string" ? value.code : "";
-    if (status === 400 && exactCode === CODEX_ENCRYPTED_CONTENT_REJECTION_CODE) {
-      return { status: 400, kind: "encrypted_content_rejected" };
-    }
-    const message = [
-      typeof value.message === "string" ? value.message : "",
-      typeof body?.message === "string" ? body.message : "",
-      typeof value.code === "string" ? value.code : "",
-      typeof body?.code === "string" ? body.code : "",
-      typeof value.type === "string" ? value.type : "",
-      typeof body?.type === "string" ? body.type : ""
-    ].join(" ").toLowerCase();
-    const unsupportedFieldShape = /(?:invalid value|supported values?|unsupported|unknown (?:field|parameter|value))/.test(
-      message
-    );
-    if (status === 400 && !unsupportedFieldShape && /(?:encrypted[_ ]content|encrypted reasoning|reasoning artifact)/.test(message) && /(?:decrypt(?:ed|ion)?|could not be parsed|cannot be parsed|failed to parse)/.test(message)) {
-      return { status: 400, kind: "encrypted_content_rejected" };
+function codexRateLimitHeaders(event) {
+  const limits = event.rate_limits;
+  if (!limits || typeof limits !== "object") return [];
+  const headers = [];
+  for (const slot of ["primary", "secondary"]) {
+    const window = limits[slot];
+    if (!window || typeof window !== "object") continue;
+    const value = window;
+    const number3 = (field) => typeof value[field] === "number" && Number.isFinite(value[field]) ? Math.round(value[field]) : null;
+    const used = number3("used_percent");
+    const minutes = number3("window_minutes");
+    const resetAfter = number3("reset_after_seconds");
+    const resetAt = number3("reset_at");
+    if (used !== null) headers.push([`x-codex-${slot}-used-percent`, String(used)]);
+    if (minutes !== null) {
+      headers.push([`x-codex-${slot}-window-minutes`, String(minutes)]);
+      headers.push([`x-codex-${slot}-limit-window-seconds`, String(minutes * 60)]);
     }
-    current = value.cause;
+    if (resetAfter !== null)
+      headers.push([`x-codex-${slot}-reset-after-seconds`, String(resetAfter)]);
+    if (resetAt !== null) headers.push([`x-codex-${slot}-reset-at`, String(resetAt)]);
   }
-  return null;
+  return headers;
 }
-function parseIntHeader(value) {
-  if (value === null) {
-    return null;
-  }
-  const n = Number.parseInt(value.trim(), 10);
-  return Number.isFinite(n) ? n : null;
+function metadataHeaders(event) {
+  const headers = event.headers;
+  if (!headers || typeof headers !== "object") return [];
+  return Object.entries(headers).flatMap(
+    ([name, value]) => HEADER_NAME.test(name) && typeof value === "string" && !/[\r\n]/.test(value) ? [[name.toLowerCase(), value]] : []
+  );
 }
-function resolveResetAt(headers, atKey, afterKey, nowMs) {
-  const at = parseIntHeader(headers.get(atKey));
-  if (at !== null) {
-    return new Date(at * 1e3);
-  }
-  const after = parseIntHeader(headers.get(afterKey));
-  if (after !== null) {
-    return new Date(nowMs + after * 1e3);
-  }
+function sseBlock(event) {
+  const type = typeof event.type === "string" ? event.type : "message";
+  return new TextEncoder().encode(`event: ${type}
+data: ${JSON.stringify(event)}
+
+`);
+}
+function requestUrl(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.toString();
   return null;
 }
-function parseCodexUsageHeaders(headers) {
-  const duration = (slot) => {
-    const raw = headers.get(`x-codex-${slot}-limit-window-seconds`);
-    if (raw === null || !/^\d+$/.test(raw.trim())) return null;
-    return Number(raw.trim());
+function codexResponsesTransport(http, options = {}) {
+  const createSocket = options.createSocket === void 0 ? bunWebSocketFactory() : options.createSocket;
+  if (!createSocket) return http;
+  const idleMs = options.idleMs ?? DEFAULT_IDLE_MS;
+  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+  const connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+  const handshakeBackoffMs = options.handshakeBackoffMs ?? DEFAULT_HANDSHAKE_BACKOFF_MS;
+  const now = options.now ?? Date.now;
+  const pool = /* @__PURE__ */ new Map();
+  const backoffUntil = /* @__PURE__ */ new Map();
+  const retire = (connection) => {
+    if (connection.idleTimer) clearTimeout(connection.idleTimer);
+    connection.idleTimer = null;
+    if (pool.get(connection.key) === connection) pool.delete(connection.key);
+    if (!connection.closed) {
+      connection.closed = true;
+      try {
+        connection.socket.close(1e3, "done");
+      } catch {
+      }
+    }
   };
-  const primarySeconds = duration("primary");
-  const secondarySeconds = duration("secondary");
-  if (!(primarySeconds === CODEX_FIVE_HOUR_WINDOW_SECONDS && secondarySeconds === CODEX_WEEKLY_WINDOW_SECONDS || primarySeconds === CODEX_WEEKLY_WINDOW_SECONDS && secondarySeconds === CODEX_FIVE_HOUR_WINDOW_SECONDS)) {
-    return null;
-  }
-  const first = parseIntHeader(headers.get("x-codex-primary-used-percent"));
-  const second = parseIntHeader(headers.get("x-codex-secondary-used-percent"));
-  if (first === null || second === null) return null;
-  const nowMs = Date.now();
-  const primaryResetAt = resolveResetAt(
-    headers,
-    "x-codex-primary-reset-at",
-    "x-codex-primary-reset-after-seconds",
-    nowMs
-  );
-  const secondaryResetAt = resolveResetAt(
-    headers,
-    "x-codex-secondary-reset-at",
-    "x-codex-secondary-reset-after-seconds",
-    nowMs
-  );
-  const firstIsFiveHour = primarySeconds === CODEX_FIVE_HOUR_WINDOW_SECONDS;
-  return {
-    primaryUsedPercent: firstIsFiveHour ? first : second,
-    primaryResetAt: firstIsFiveHour ? primaryResetAt : secondaryResetAt,
-    secondaryUsedPercent: firstIsFiveHour ? second : first,
-    secondaryResetAt: firstIsFiveHour ? secondaryResetAt : primaryResetAt,
-    checkedAt: new Date(nowMs)
+  const release = (connection) => {
+    connection.busy = false;
+    connection.onEvent = null;
+    connection.onClose = null;
+    if (connection.closed) return;
+    if (connection.idleTimer) clearTimeout(connection.idleTimer);
+    connection.idleTimer = setTimeout(() => retire(connection), idleMs);
+    connection.idleTimer.unref?.();
   };
-}
-function settleProviderRequest(audit, outcome) {
-  if (!audit.admitted) return Promise.resolve();
-  if (!audit.settlement) {
-    audit.settlement = (async () => {
-      await audit.ctx.onProviderRequestSettled?.({
-        requestId: audit.requestId,
-        transportAttempt: audit.transportAttempt,
-        outcome
-      });
-    })();
-    void audit.settlement.catch(() => void 0);
-  }
-  return audit.settlement;
-}
-function classifyCodexSseTerminal(ev) {
-  if (ev.type === "response.failed") {
-    return {
-      phase: "failed",
-      rawError: ev.response?.error,
-      fallbackCode: "response_failed",
-      fallbackMessage: "The Codex response failed"
+  const connect = (url, key, headers) => new Promise((resolve, reject) => {
+    let socket;
+    try {
+      socket = createSocket(url, headers);
+    } catch (error) {
+      reject(error);
+      return;
+    }
+    const connection = {
+      key,
+      socket,
+      openedAt: now(),
+      busy: false,
+      closed: false,
+      requests: 0,
+      idleTimer: null,
+      onEvent: null,
+      onClose: null
     };
-  }
-  if (ev.type === "error" || ev.type === "response.error") {
-    return {
-      phase: "failed",
-      rawError: ev.error ?? ev.response?.error ?? ev,
-      fallbackCode: "response_error",
-      fallbackMessage: "The Codex response stream reported an error"
+    let opened = false;
+    const timer = setTimeout(() => {
+      if (opened) return;
+      connection.closed = true;
+      try {
+        socket.close();
+      } catch {
+      }
+      reject(new Error("Codex response WebSocket handshake timed out"));
+    }, connectTimeoutMs);
+    socket.onopen = () => {
+      opened = true;
+      clearTimeout(timer);
+      resolve(connection);
     };
-  }
-  if (ev.type === "response.incomplete") {
-    const details = ev.response?.incomplete_details;
-    const reason = details && typeof details === "object" ? details.reason : void 0;
-    return {
-      phase: "failed",
-      rawError: {
-        code: "response_incomplete",
-        message: typeof reason === "string" && reason.length > 0 ? `The Codex response was incomplete (${reason})` : "The Codex response was incomplete"
-      },
-      fallbackCode: "response_incomplete",
-      fallbackMessage: "The Codex response was incomplete"
+    socket.onerror = () => {
     };
-  }
-  if (ev.type !== "response.completed" && ev.type !== "response.done") {
-    return null;
-  }
-  if (!ev.response) {
-    return null;
-  }
-  const responseStatus = ev.response.status;
-  if (responseStatus !== void 0 && responseStatus !== "completed" || ev.response.error !== null && ev.response.error !== void 0) {
-    const incomplete = responseStatus === "incomplete";
-    return {
-      phase: "failed",
-      rawError: ev.response.error,
-      fallbackCode: incomplete ? "response_incomplete" : "response_failed",
-      fallbackMessage: incomplete ? "The Codex response was incomplete" : "The Codex response failed"
+    socket.onclose = (event) => {
+      clearTimeout(timer);
+      connection.closed = true;
+      if (pool.get(key) === connection) pool.delete(key);
+      if (connection.idleTimer) clearTimeout(connection.idleTimer);
+      if (!opened) {
+        reject(
+          new Error(`Codex response WebSocket handshake failed (${event?.code ?? "closed"})`)
+        );
+        return;
+      }
+      connection.onClose?.(
+        new Error(
+          `Codex response WebSocket closed before the response finished (${event?.code ?? "closed"})`
+        )
+      );
     };
-  }
-  return { phase: "completed" };
-}
-function markSemanticTerminal(state, phase) {
-  if (state.phase === null) {
-    state.phase = phase;
-  }
-}
-function semanticCompletionEvidence(state) {
-  return state?.phase === "completed" ? { meaningfulOutput: state.meaningfulOutput === true } : {};
-}
-function terminalOutcomeForPhase(phase) {
-  if (phase === "completed" || phase === "failed" || phase === "timed_out") {
-    return phase;
-  }
-  return null;
-}
-function requestEventFor(audit, event) {
-  return {
-    requestId: audit.requestId,
-    transportAttempt: audit.transportAttempt,
-    ...audit.model ? { model: audit.model } : {},
-    durationMs: Math.max(0, performance.now() - audit.attemptStartedAtMonotonic),
-    timeoutPolicy: audit.policy,
-    ...event
+    socket.onmessage = (message) => {
+      const text = eventData(message.data);
+      if (text === null) return;
+      let parsed;
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        return;
+      }
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        connection.onEvent?.(parsed);
+      }
+    };
+  });
+  return async (input, init) => {
+    const url = requestUrl(input);
+    const method = (init?.method ?? "GET").toUpperCase();
+    const body = init?.body;
+    if (!url || method !== "POST" || !/^https:\/\/[^/]+\/.*\/codex\/responses(?:\?|$)/.test(url)) {
+      return await http(input, init);
+    }
+    const viaHttp = async (reason) => withTransport(await http(input, init), { kind: "http", reason });
+    if (typeof body !== "string") return await viaHttp("not_eligible");
+    let payload;
+    try {
+      const parsed = JSON.parse(body);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error();
+      payload = parsed;
+    } catch {
+      return await viaHttp("not_eligible");
+    }
+    if (payload.stream !== true) return await viaHttp("not_eligible");
+    const handshake = {};
+    for (const [name, value] of new Headers(init?.headers).entries()) {
+      if (!PER_REQUEST_HEADERS.has(name)) handshake[name] = value;
+    }
+    handshake["openai-beta"] = CODEX_RESPONSES_WEBSOCKET_BETA;
+    const wsUrl = url.replace(/^https:/, "wss:");
+    const key = JSON.stringify([wsUrl, Object.entries(handshake).sort()]);
+    if ((backoffUntil.get(key) ?? 0) > now()) return await viaHttp("handshake_backoff");
+    const signal = init?.signal ?? null;
+    signal?.throwIfAborted();
+    let connection = pool.get(key);
+    if (connection && (connection.closed || now() - connection.openedAt > maxAgeMs)) {
+      if (!connection.busy) retire(connection);
+      connection = void 0;
+    }
+    if (connection?.busy) return await viaHttp("connection_busy");
+    if (!connection) {
+      try {
+        connection = await connect(wsUrl, key, handshake);
+      } catch {
+        backoffUntil.set(key, now() + handshakeBackoffMs);
+        return await viaHttp("handshake_failed");
+      }
+      if (pool.has(key)) {
+        const existing = pool.get(key);
+        if (!existing.busy && !existing.closed) {
+          retire(connection);
+          connection = existing;
+        } else {
+          pool.set(key, connection);
+        }
+      } else {
+        pool.set(key, connection);
+      }
+      if (connection.busy) return await viaHttp("connection_busy");
+    }
+    const active = connection;
+    const transport = {
+      kind: "websocket",
+      connection: active.requests === 0 ? "new" : "reused"
+    };
+    active.requests += 1;
+    active.busy = true;
+    if (active.idleTimer) clearTimeout(active.idleTimer);
+    active.idleTimer = null;
+    return await new Promise((resolve, reject) => {
+      const headers = new Headers({
+        "content-type": "text/event-stream",
+        [CODEX_TRANSPORT_HEADER]: formatCodexRequestTransport(transport)
+      });
+      let controller = null;
+      let started = false;
+      let finished = false;
+      const pending = [];
+      const finish = (error) => {
+        if (finished) return;
+        finished = true;
+        signal?.removeEventListener("abort", onAbort);
+        if (error !== void 0) {
+          retire(active);
+          active.busy = false;
+          if (started) controller?.error(error);
+          else reject(error);
+          return;
+        }
+        release(active);
+        try {
+          controller?.close();
+        } catch {
+        }
+      };
+      const onAbort = () => finish(signal?.reason ?? new Error("Model request aborted"));
+      signal?.addEventListener("abort", onAbort, { once: true });
+      const stream = new ReadableStream({
+        start(streamController) {
+          controller = streamController;
+          for (const block of pending.splice(0)) streamController.enqueue(block);
+          if (finished) streamController.close();
+        },
+        cancel() {
+          if (!finished) finish(new Error("Model response stream cancelled"));
+        }
+      });
+      const begin = (status = 200, errorBody) => {
+        started = true;
+        if (errorBody !== void 0) {
+          headers.set("content-type", "application/json");
+          resolve(new Response(errorBody, { status, headers }));
+          return;
+        }
+        resolve(new Response(stream, { status, headers }));
+      };
+      active.onClose = (error) => finish(error);
+      active.onEvent = (event) => {
+        if (finished) return;
+        const type = typeof event.type === "string" ? event.type : "";
+        if (type === RATE_LIMITS_EVENT) {
+          if (!started)
+            for (const [name, value] of codexRateLimitHeaders(event)) headers.set(name, value);
+          return;
+        }
+        if (type === METADATA_EVENT) {
+          if (!started)
+            for (const [name, value] of metadataHeaders(event)) headers.set(name, value);
+          return;
+        }
+        if (type === TIMING_EVENT) return;
+        if (!started && type === "error" && typeof event.status === "number") {
+          for (const [name, value] of metadataHeaders(event)) headers.set(name, value);
+          const status = event.status >= 400 && event.status < 600 ? event.status : 500;
+          begin(status, JSON.stringify({ error: event.error ?? null }));
+          finished = true;
+          signal?.removeEventListener("abort", onAbort);
+          release(active);
+          return;
+        }
+        if (!started) begin();
+        const block = sseBlock(event);
+        if (controller) controller.enqueue(block);
+        else pending.push(block);
+        if (TERMINAL_EVENTS.has(type)) finish();
+      };
+      try {
+        active.socket.send(JSON.stringify({ ...payload, type: "response.create" }));
+      } catch (error) {
+        finish(error);
+      }
+    });
   };
 }
-async function emitRequestEvent(audit, event) {
-  const terminalOutcome = terminalOutcomeForPhase(event.phase);
-  if (terminalOutcome !== null) {
-    if (audit.terminalOutcome !== null) {
-      await audit.settlement;
-      return false;
-    }
-    audit.terminalOutcome = terminalOutcome;
-    await settleProviderRequest(
-      audit,
-      definiteErrorStatus(event.status) ? "refused" : event.phase === "completed" ? "response_received" : "unknown"
-    );
-  }
-  const observed = requestEventFor(audit, event);
+
+// src/fetch.ts
+function emitRequestPreparationDiagnostic(ctx, phase) {
   try {
-    audit.ctx.onModelRequestDiagnostic?.(observed);
+    ctx.onRequestPreparationDiagnostic?.(phase);
   } catch {
   }
-  await audit.ctx.onModelRequestEvent?.(observed);
-  return true;
-}
-function definiteErrorStatus(status) {
-  return status !== void 0 && status >= 400 && status < 600 && status !== 408 && status !== 409 && status !== 504;
-}
-function providerRequestId(headers) {
-  return headers.get("x-request-id") ?? headers.get("request-id") ?? void 0;
+}
+var CODEX_TRANSPORT_ERROR_HEADER = "x-opengeni-codex-transport-error";
+var CODEX_REQUEST_BODY_NORMALIZED_HEADER = "x-opengeni-request-body-normalized";
+var REPLAYABLE_REQUEST_BODY_FACTORY = Symbol.for("opengeni.replayable-request-body-factory");
+var CODEX_REQUEST_MODEL_HEADER = "x-opengeni-request-model";
+var CODEX_REQUEST_ID_HEADER = "x-opengeni-request-id";
+var CODEX_REQUEST_CALLER_STREAM_HEADER = "x-opengeni-request-caller-stream";
+var MAX_CODEX_ERROR_BODY_BYTES = 64 * 1024;
+function headersCarryCodexTransportMarker(headers) {
+  if (!headers || typeof headers !== "object") return false;
+  const getter = headers.get;
+  if (typeof getter === "function") {
+    return getter.call(headers, CODEX_TRANSPORT_ERROR_HEADER) === "1";
+  }
+  const record = headers;
+  return record[CODEX_TRANSPORT_ERROR_HEADER] === "1" || record[CODEX_TRANSPORT_ERROR_HEADER.toLowerCase()] === "1";
+}
+function isCodexTransportError(error) {
+  let current = error;
+  for (let depth = 0; depth < 6 && current && typeof current === "object"; depth += 1) {
+    const value = current;
+    if (headersCarryCodexTransportMarker(value.headers)) return true;
+    current = value.cause;
+  }
+  return false;
+}
+var CODEX_ENCRYPTED_CONTENT_REJECTION_CODE = "invalid_encrypted_content";
+function classifyCodexEncryptedArtifactRejection(error) {
+  if (!isCodexTransportError(error)) return null;
+  let current = error;
+  for (let depth = 0; depth < 6 && current && typeof current === "object"; depth += 1) {
+    const value = current;
+    const body = value.error && typeof value.error === "object" ? value.error : null;
+    const status = Number(value.status ?? body?.status);
+    const exactCode = typeof body?.code === "string" ? body.code : typeof value.code === "string" ? value.code : "";
+    if (status === 400 && exactCode === CODEX_ENCRYPTED_CONTENT_REJECTION_CODE) {
+      return { status: 400, kind: "encrypted_content_rejected" };
+    }
+    const message = [
+      typeof value.message === "string" ? value.message : "",
+      typeof body?.message === "string" ? body.message : "",
+      typeof value.code === "string" ? value.code : "",
+      typeof body?.code === "string" ? body.code : "",
+      typeof value.type === "string" ? value.type : "",
+      typeof body?.type === "string" ? body.type : ""
+    ].join(" ").toLowerCase();
+    const unsupportedFieldShape = /(?:invalid value|supported values?|unsupported|unknown (?:field|parameter|value))/.test(
+      message
+    );
+    if (status === 400 && !unsupportedFieldShape && /(?:encrypted[_ ]content|encrypted reasoning|reasoning artifact)/.test(message) && /(?:decrypt(?:ed|ion)?|could not be parsed|cannot be parsed|failed to parse)/.test(message)) {
+      return { status: 400, kind: "encrypted_content_rejected" };
+    }
+    current = value.cause;
+  }
+  return null;
+}
+function parseIntHeader(value) {
+  if (value === null) {
+    return null;
+  }
+  const n = Number.parseInt(value.trim(), 10);
+  return Number.isFinite(n) ? n : null;
+}
+function resolveResetAt(headers, atKey, afterKey, nowMs) {
+  const at = parseIntHeader(headers.get(atKey));
+  if (at !== null) {
+    return new Date(at * 1e3);
+  }
+  const after = parseIntHeader(headers.get(afterKey));
+  if (after !== null) {
+    return new Date(nowMs + after * 1e3);
+  }
+  return null;
+}
+function parseCodexUsageHeaders(headers) {
+  const duration = (slot) => {
+    const raw = headers.get(`x-codex-${slot}-limit-window-seconds`);
+    if (raw === null || !/^\d+$/.test(raw.trim())) return null;
+    return Number(raw.trim());
+  };
+  const primarySeconds = duration("primary");
+  const secondarySeconds = duration("secondary");
+  if (!(primarySeconds === CODEX_FIVE_HOUR_WINDOW_SECONDS && secondarySeconds === CODEX_WEEKLY_WINDOW_SECONDS || primarySeconds === CODEX_WEEKLY_WINDOW_SECONDS && secondarySeconds === CODEX_FIVE_HOUR_WINDOW_SECONDS)) {
+    return null;
+  }
+  const first = parseIntHeader(headers.get("x-codex-primary-used-percent"));
+  const second = parseIntHeader(headers.get("x-codex-secondary-used-percent"));
+  if (first === null || second === null) return null;
+  const nowMs = Date.now();
+  const primaryResetAt = resolveResetAt(
+    headers,
+    "x-codex-primary-reset-at",
+    "x-codex-primary-reset-after-seconds",
+    nowMs
+  );
+  const secondaryResetAt = resolveResetAt(
+    headers,
+    "x-codex-secondary-reset-at",
+    "x-codex-secondary-reset-after-seconds",
+    nowMs
+  );
+  const firstIsFiveHour = primarySeconds === CODEX_FIVE_HOUR_WINDOW_SECONDS;
+  return {
+    primaryUsedPercent: firstIsFiveHour ? first : second,
+    primaryResetAt: firstIsFiveHour ? primaryResetAt : secondaryResetAt,
+    secondaryUsedPercent: firstIsFiveHour ? second : first,
+    secondaryResetAt: firstIsFiveHour ? secondaryResetAt : primaryResetAt,
+    checkedAt: new Date(nowMs)
+  };
+}
+function settleProviderRequest(audit, outcome) {
+  if (!audit.admitted) return Promise.resolve();
+  if (!audit.settlement) {
+    audit.settlement = (async () => {
+      await audit.ctx.onProviderRequestSettled?.({
+        requestId: audit.requestId,
+        transportAttempt: audit.transportAttempt,
+        outcome
+      });
+    })();
+    void audit.settlement.catch(() => void 0);
+  }
+  return audit.settlement;
+}
+function classifyCodexSseTerminal(ev) {
+  if (ev.type === "response.failed") {
+    return {
+      phase: "failed",
+      rawError: ev.response?.error,
+      fallbackCode: "response_failed",
+      fallbackMessage: "The Codex response failed"
+    };
+  }
+  if (ev.type === "error" || ev.type === "response.error") {
+    return {
+      phase: "failed",
+      rawError: ev.error ?? ev.response?.error ?? ev,
+      fallbackCode: "response_error",
+      fallbackMessage: "The Codex response stream reported an error"
+    };
+  }
+  if (ev.type === "response.incomplete") {
+    const details = ev.response?.incomplete_details;
+    const reason = details && typeof details === "object" ? details.reason : void 0;
+    return {
+      phase: "failed",
+      rawError: {
+        code: "response_incomplete",
+        message: typeof reason === "string" && reason.length > 0 ? `The Codex response was incomplete (${reason})` : "The Codex response was incomplete"
+      },
+      fallbackCode: "response_incomplete",
+      fallbackMessage: "The Codex response was incomplete"
+    };
+  }
+  if (ev.type !== "response.completed" && ev.type !== "response.done") {
+    return null;
+  }
+  if (!ev.response) {
+    return null;
+  }
+  const responseStatus = ev.response.status;
+  if (responseStatus !== void 0 && responseStatus !== "completed" || ev.response.error !== null && ev.response.error !== void 0) {
+    const incomplete = responseStatus === "incomplete";
+    return {
+      phase: "failed",
+      rawError: ev.response.error,
+      fallbackCode: incomplete ? "response_incomplete" : "response_failed",
+      fallbackMessage: incomplete ? "The Codex response was incomplete" : "The Codex response failed"
+    };
+  }
+  return { phase: "completed" };
+}
+function markSemanticTerminal(state, phase) {
+  if (state.phase === null) {
+    state.phase = phase;
+  }
+}
+function semanticCompletionEvidence(state) {
+  return state?.phase === "completed" ? { meaningfulOutput: state.meaningfulOutput === true } : {};
+}
+function terminalOutcomeForPhase(phase) {
+  if (phase === "completed" || phase === "failed" || phase === "timed_out") {
+    return phase;
+  }
+  return null;
+}
+function requestEventFor(audit, event) {
+  return {
+    requestId: audit.requestId,
+    transportAttempt: audit.transportAttempt,
+    ...audit.model ? { model: audit.model } : {},
+    durationMs: Math.max(0, performance.now() - audit.attemptStartedAtMonotonic),
+    timeoutPolicy: audit.policy,
+    ...event
+  };
+}
+async function emitRequestEvent(audit, event) {
+  const terminalOutcome = terminalOutcomeForPhase(event.phase);
+  if (terminalOutcome !== null) {
+    if (audit.terminalOutcome !== null) {
+      await audit.settlement;
+      return false;
+    }
+    audit.terminalOutcome = terminalOutcome;
+    await settleProviderRequest(
+      audit,
+      definiteErrorStatus(event.status) ? "refused" : event.phase === "completed" ? "response_received" : "unknown"
+    );
+  }
+  const observed = requestEventFor(audit, event);
+  try {
+    audit.ctx.onModelRequestDiagnostic?.(observed);
+  } catch {
+  }
+  await audit.ctx.onModelRequestEvent?.(observed);
+  return true;
+}
+function definiteErrorStatus(status) {
+  return status !== void 0 && status >= 400 && status < 600 && status !== 408 && status !== 409 && status !== 504;
+}
+function providerRequestId(headers) {
+  return headers.get("x-request-id") ?? headers.get("request-id") ?? void 0;
 }
 async function fetchBeforeHeaders(base, input, init, audit) {
   const elapsed = Date.now() - audit.logicalStartedAt;
@@ -1460,7 +1835,12 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
           phase: "headers",
           responseObserved: true,
           status: res.status,
-          ...upstreamRequestId ? { providerRequestId: upstreamRequestId } : {}
+          ...upstreamRequestId ? { providerRequestId: upstreamRequestId } : {},
+          // A response the socket transport did not label never passed through it.
+          transport: parseCodexRequestTransport(res.headers.get(CODEX_TRANSPORT_HEADER)) ?? {
+            kind: "http",
+            reason: "unavailable"
+          }
         });
         res = await observedResponse(res, audit, nextInit.signal, semanticTerminal);
       } catch (error) {
@@ -2037,322 +2417,6 @@ function inspectCodexSseBlock(block, source, onSemanticTerminal, onOutput) {
   return false;
 }
 
-// src/responses-websocket.ts
-var CODEX_RESPONSES_WEBSOCKET_BETA = "responses_websockets=2026-02-06";
-var DEFAULT_IDLE_MS = 5 * 6e4;
-var DEFAULT_MAX_AGE_MS = 45 * 6e4;
-var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
-var DEFAULT_HANDSHAKE_BACKOFF_MS = 5 * 6e4;
-var PER_REQUEST_HEADERS = /* @__PURE__ */ new Set([
-  "accept",
-  "content-type",
-  "content-length",
-  "idempotency-key",
-  "openai-beta"
-]);
-var TERMINAL_EVENTS = /* @__PURE__ */ new Set([
-  "response.completed",
-  "response.done",
-  "response.failed",
-  "response.incomplete",
-  "response.error",
-  "error"
-]);
-var RATE_LIMITS_EVENT = "codex.rate_limits";
-var METADATA_EVENT = "codex.response.metadata";
-var TIMING_EVENT = "responsesapi.websocket_timing";
-var HEADER_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-function bunWebSocketFactory() {
-  const runtime = globalThis;
-  if (!runtime.Bun || typeof runtime.WebSocket !== "function") return null;
-  const Socket = runtime.WebSocket;
-  return (url, headers) => new Socket(url, { headers });
-}
-function eventData(data) {
-  if (typeof data === "string") return data;
-  if (data instanceof ArrayBuffer) return new TextDecoder().decode(data);
-  if (ArrayBuffer.isView(data)) return new TextDecoder().decode(data);
-  return null;
-}
-function codexRateLimitHeaders(event) {
-  const limits = event.rate_limits;
-  if (!limits || typeof limits !== "object") return [];
-  const headers = [];
-  for (const slot of ["primary", "secondary"]) {
-    const window = limits[slot];
-    if (!window || typeof window !== "object") continue;
-    const value = window;
-    const number3 = (field) => typeof value[field] === "number" && Number.isFinite(value[field]) ? Math.round(value[field]) : null;
-    const used = number3("used_percent");
-    const minutes = number3("window_minutes");
-    const resetAfter = number3("reset_after_seconds");
-    const resetAt = number3("reset_at");
-    if (used !== null) headers.push([`x-codex-${slot}-used-percent`, String(used)]);
-    if (minutes !== null) {
-      headers.push([`x-codex-${slot}-window-minutes`, String(minutes)]);
-      headers.push([`x-codex-${slot}-limit-window-seconds`, String(minutes * 60)]);
-    }
-    if (resetAfter !== null)
-      headers.push([`x-codex-${slot}-reset-after-seconds`, String(resetAfter)]);
-    if (resetAt !== null) headers.push([`x-codex-${slot}-reset-at`, String(resetAt)]);
-  }
-  return headers;
-}
-function metadataHeaders(event) {
-  const headers = event.headers;
-  if (!headers || typeof headers !== "object") return [];
-  return Object.entries(headers).flatMap(
-    ([name, value]) => HEADER_NAME.test(name) && typeof value === "string" && !/[\r\n]/.test(value) ? [[name.toLowerCase(), value]] : []
-  );
-}
-function sseBlock(event) {
-  const type = typeof event.type === "string" ? event.type : "message";
-  return new TextEncoder().encode(`event: ${type}
-data: ${JSON.stringify(event)}
-
-`);
-}
-function requestUrl(input) {
-  if (typeof input === "string") return input;
-  if (input instanceof URL) return input.toString();
-  return null;
-}
-function codexResponsesTransport(http, options = {}) {
-  const createSocket = options.createSocket === void 0 ? bunWebSocketFactory() : options.createSocket;
-  if (!createSocket) return http;
-  const idleMs = options.idleMs ?? DEFAULT_IDLE_MS;
-  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
-  const connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
-  const handshakeBackoffMs = options.handshakeBackoffMs ?? DEFAULT_HANDSHAKE_BACKOFF_MS;
-  const now = options.now ?? Date.now;
-  const pool = /* @__PURE__ */ new Map();
-  const backoffUntil = /* @__PURE__ */ new Map();
-  const retire = (connection) => {
-    if (connection.idleTimer) clearTimeout(connection.idleTimer);
-    connection.idleTimer = null;
-    if (pool.get(connection.key) === connection) pool.delete(connection.key);
-    if (!connection.closed) {
-      connection.closed = true;
-      try {
-        connection.socket.close(1e3, "done");
-      } catch {
-      }
-    }
-  };
-  const release = (connection) => {
-    connection.busy = false;
-    connection.onEvent = null;
-    connection.onClose = null;
-    if (connection.closed) return;
-    if (connection.idleTimer) clearTimeout(connection.idleTimer);
-    connection.idleTimer = setTimeout(() => retire(connection), idleMs);
-    connection.idleTimer.unref?.();
-  };
-  const connect = (url, key, headers) => new Promise((resolve, reject) => {
-    let socket;
-    try {
-      socket = createSocket(url, headers);
-    } catch (error) {
-      reject(error);
-      return;
-    }
-    const connection = {
-      key,
-      socket,
-      openedAt: now(),
-      busy: false,
-      closed: false,
-      idleTimer: null,
-      onEvent: null,
-      onClose: null
-    };
-    let opened = false;
-    const timer = setTimeout(() => {
-      if (opened) return;
-      connection.closed = true;
-      try {
-        socket.close();
-      } catch {
-      }
-      reject(new Error("Codex response WebSocket handshake timed out"));
-    }, connectTimeoutMs);
-    socket.onopen = () => {
-      opened = true;
-      clearTimeout(timer);
-      resolve(connection);
-    };
-    socket.onerror = () => {
-    };
-    socket.onclose = (event) => {
-      clearTimeout(timer);
-      connection.closed = true;
-      if (pool.get(key) === connection) pool.delete(key);
-      if (connection.idleTimer) clearTimeout(connection.idleTimer);
-      if (!opened) {
-        reject(
-          new Error(`Codex response WebSocket handshake failed (${event?.code ?? "closed"})`)
-        );
-        return;
-      }
-      connection.onClose?.(
-        new Error(
-          `Codex response WebSocket closed before the response finished (${event?.code ?? "closed"})`
-        )
-      );
-    };
-    socket.onmessage = (message) => {
-      const text = eventData(message.data);
-      if (text === null) return;
-      let parsed;
-      try {
-        parsed = JSON.parse(text);
-      } catch {
-        return;
-      }
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        connection.onEvent?.(parsed);
-      }
-    };
-  });
-  return async (input, init) => {
-    const url = requestUrl(input);
-    const method = (init?.method ?? "GET").toUpperCase();
-    const body = init?.body;
-    if (!url || method !== "POST" || typeof body !== "string" || !/^https:\/\/[^/]+\/.*\/codex\/responses(?:\?|$)/.test(url)) {
-      return await http(input, init);
-    }
-    let payload;
-    try {
-      const parsed = JSON.parse(body);
-      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error();
-      payload = parsed;
-    } catch {
-      return await http(input, init);
-    }
-    if (payload.stream !== true) return await http(input, init);
-    const handshake = {};
-    for (const [name, value] of new Headers(init?.headers).entries()) {
-      if (!PER_REQUEST_HEADERS.has(name)) handshake[name] = value;
-    }
-    handshake["openai-beta"] = CODEX_RESPONSES_WEBSOCKET_BETA;
-    const wsUrl = url.replace(/^https:/, "wss:");
-    const key = JSON.stringify([wsUrl, Object.entries(handshake).sort()]);
-    if ((backoffUntil.get(key) ?? 0) > now()) return await http(input, init);
-    const signal = init?.signal ?? null;
-    signal?.throwIfAborted();
-    let connection = pool.get(key);
-    if (connection && (connection.closed || now() - connection.openedAt > maxAgeMs)) {
-      if (!connection.busy) retire(connection);
-      connection = void 0;
-    }
-    if (connection?.busy) return await http(input, init);
-    if (!connection) {
-      try {
-        connection = await connect(wsUrl, key, handshake);
-      } catch {
-        backoffUntil.set(key, now() + handshakeBackoffMs);
-        return await http(input, init);
-      }
-      if (pool.has(key)) {
-        const existing = pool.get(key);
-        if (!existing.busy && !existing.closed) {
-          retire(connection);
-          connection = existing;
-        } else {
-          pool.set(key, connection);
-        }
-      } else {
-        pool.set(key, connection);
-      }
-      if (connection.busy) return await http(input, init);
-    }
-    const active = connection;
-    active.busy = true;
-    if (active.idleTimer) clearTimeout(active.idleTimer);
-    active.idleTimer = null;
-    return await new Promise((resolve, reject) => {
-      const headers = new Headers({ "content-type": "text/event-stream" });
-      let controller = null;
-      let started = false;
-      let finished = false;
-      const pending = [];
-      const finish = (error) => {
-        if (finished) return;
-        finished = true;
-        signal?.removeEventListener("abort", onAbort);
-        if (error !== void 0) {
-          retire(active);
-          active.busy = false;
-          if (started) controller?.error(error);
-          else reject(error);
-          return;
-        }
-        release(active);
-        try {
-          controller?.close();
-        } catch {
-        }
-      };
-      const onAbort = () => finish(signal?.reason ?? new Error("Model request aborted"));
-      signal?.addEventListener("abort", onAbort, { once: true });
-      const stream = new ReadableStream({
-        start(streamController) {
-          controller = streamController;
-          for (const block of pending.splice(0)) streamController.enqueue(block);
-          if (finished) streamController.close();
-        },
-        cancel() {
-          if (!finished) finish(new Error("Model response stream cancelled"));
-        }
-      });
-      const begin = (status = 200, errorBody) => {
-        started = true;
-        if (errorBody !== void 0) {
-          headers.set("content-type", "application/json");
-          resolve(new Response(errorBody, { status, headers }));
-          return;
-        }
-        resolve(new Response(stream, { status, headers }));
-      };
-      active.onClose = (error) => finish(error);
-      active.onEvent = (event) => {
-        if (finished) return;
-        const type = typeof event.type === "string" ? event.type : "";
-        if (type === RATE_LIMITS_EVENT) {
-          if (!started)
-            for (const [name, value] of codexRateLimitHeaders(event)) headers.set(name, value);
-          return;
-        }
-        if (type === METADATA_EVENT) {
-          if (!started)
-            for (const [name, value] of metadataHeaders(event)) headers.set(name, value);
-          return;
-        }
-        if (type === TIMING_EVENT) return;
-        if (!started && type === "error" && typeof event.status === "number") {
-          for (const [name, value] of metadataHeaders(event)) headers.set(name, value);
-          const status = event.status >= 400 && event.status < 600 ? event.status : 500;
-          begin(status, JSON.stringify({ error: event.error ?? null }));
-          finished = true;
-          signal?.removeEventListener("abort", onAbort);
-          release(active);
-          return;
-        }
-        if (!started) begin();
-        const block = sseBlock(event);
-        if (controller) controller.enqueue(block);
-        else pending.push(block);
-        if (TERMINAL_EVENTS.has(type)) finish();
-      };
-      try {
-        active.socket.send(JSON.stringify({ ...payload, type: "response.create" }));
-      } catch (error) {
-        finish(error);
-      }
-    });
-  };
-}
-
 // src/mcp-sanitize.ts
 var VALID_TOOL_NAME = /^[a-zA-Z0-9_-]+$/;
 var MAX_TOOL_NAME_LEN = 64;
@@ -3788,6 +3852,7 @@ export {
   CODEX_TOKEN_URL,
   CODEX_TOOL_OUTPUT_SERIALIZATION_ALLOWANCE,
   CODEX_TRANSPORT_ERROR_HEADER,
+  CODEX_TRANSPORT_HEADER,
   CODEX_USAGE_LIMIT_ERROR_TYPE,
   CODEX_WEEKLY_WINDOW_SECONDS,
   CODEX_WHAM_BASE,
@@ -3839,6 +3904,7 @@ export {
   fetchCodexRateLimitResetCredits,
   fetchCodexRealtimeProviderConfig,
   fetchCodexUsage,
+  formatCodexRequestTransport,
   generateCodexSubscriptionImage,
   isCodexAppsCredentialUnavailable,
   isCodexBilledModel,
@@ -3857,6 +3923,7 @@ export {
   parseCodexRateLimitResetCreditsDetails,
   parseCodexRateLimitResetCreditsSummary,
   parseCodexRealtimeV3Event,
+  parseCodexRequestTransport,
   parseCodexUsageHeaders,
   parseIdToken,
   pollDeviceCode,