@pure01fx/dsh-openai-codex-auth 0.13.1 → 0.13.2

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 0.13.2
+
+- Stops putting `is_error` on a replayed `function_call_output`. The Responses wire has no such field (Codex reports a failed tool through the output text and keeps its own `success` flag internal), one Lite model answers the unknown item field with a 400 `INVALID_REQUEST`, and because the item is replayed from durable history, a single failed tool call then fails every later request in that session.
+- Logs the provider's own rejection code, message, status and request id when an HTTP/SSE failure cannot be classified into a known code, matching the existing WebSocket diagnostic, so an opaque `INVALID_REQUEST` names its cause in the operator log.
+
 ## 0.13.1
 
 - Serves a concurrent or pool-saturated request over HTTP/SSE instead of failing the turn.

package/lib/native-http.js

@@ -6,7 +6,7 @@ import { nativeCodexAuthorityHash } from './catalog.js';
 import { nativeCodexEndpoint } from './endpoint.js';
 import { retryAfterMs, retryError, remainingRetryDelay, sleepRetry, inheritRetryDeadline } from './retry-after.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, NATIVE_CODEX_STREAM_INTERRUPTED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
-import { boundedCodexTurnState, codexRequestBody, codexResponseTurnState, streamResponses, responsesFailure, } from './responses.js';
+import { boundedCodexTurnState, codexRequestBody, codexResponseTurnState, rejectionDiagnostic, streamResponses, responsesFailure, } from './responses.js';
 import { hasNativeCodexReplayKind } from './replay.js';
 import { parseCodexResponseUsageMetadata, publishCodexResponseUsage, } from './response-usage.js';
 import { parseCodexRateLimitEvent, parseCodexRateLimitHeaders, publishCodexRateLimits, } from './rate-limits.js';
@@ -246,7 +246,7 @@ function errorFacts(response) {
             : { requestId: ProviderRequestId(requestId) },
     };
 }
-async function httpFailure(response, signal, telemetry) {
+async function httpFailure(response, signal, telemetry, warn) {
     const facts = errorFacts(response);
     const advice = retryError('native Codex HTTP retry advice', 'SERVER', facts);
     const fail = (message, code, options) => inheritRetryDeadline(fixedFailure(message, code, options), advice);
@@ -271,6 +271,15 @@ async function httpFailure(response, signal, telemetry) {
     if (response.status >= 500) {
         return fail('native Codex server request failed', 'SERVER', facts);
     }
+    // Every classified refusal above names itself. This branch is the only place
+    // where the provider's own reason would otherwise be discarded, so record it
+    // for the operator without turning it into the provider-neutral message.
+    warn?.(rejectionDiagnostic('HTTP', {
+        status: response.status,
+        ...detail.code === undefined ? {} : { code: detail.code },
+        ...detail.message === undefined ? {} : { message: detail.message },
+        ...facts?.requestId === undefined ? {} : { requestId: String(facts.requestId) },
+    }));
     return fail('native Codex request was rejected', 'INVALID_REQUEST', facts);
 }
 function mappedFailure(error, watchdog, parent) {
@@ -520,7 +529,7 @@ export class NativeCodexHttpTransport {
                 }
             }
             if (!response.ok) {
-                let failure = await httpFailure(response, watchdog.signal, telemetry);
+                let failure = await httpFailure(response, watchdog.signal, telemetry, this.options.warn);
                 if (generation.signal?.aborted || watchdog.timedOut()) {
                     failure = mappedFailure(failure, watchdog, generation.signal);
                 }

package/lib/native-websocket.js

@@ -9,7 +9,7 @@ import { NativeCodexHttpTransport, } from './native-http.js';
 import { replayableItemId } from './replay.js';
 import { parseCodexResponseUsageMetadata, publishCodexResponseUsage, } from './response-usage.js';
 import { parseCodexRateLimitEvent, parseCodexRateLimitHeaders, publishCodexRateLimits, } from './rate-limits.js';
-import { ResponsesStreamTranslator, responsesFailure, codexResponseTurnState, } from './responses.js';
+import { ResponsesStreamTranslator, rejectionDiagnostic, responsesFailure, codexResponseTurnState, } from './responses.js';
 import { NodeNativeCodexWebSocketFactory, } from './native-websocket-socket.js';
 import { NativeCodexWebSocketSessionState } from './native-websocket-session.js';
 const WS_BETA = 'responses_websockets=2026-02-06';
@@ -191,21 +191,17 @@ function eventFailure(event) {
     }
     return retryError('native Codex WebSocket request was rejected', 'INVALID_REQUEST', facts);
 }
-/**
- * One bounded log line naming the provider's own rejection, so an operator can
- * see why the socket refused a request. The provider's free-form text stays in
- * the log; it never becomes the provider-neutral error message.
- */
-function rejectionDiagnostic(event) {
+/** Adapt one raw socket failure event to the shared operator-facing rejection line. */
+function socketRejectionDiagnostic(event) {
     const error = typeof event.error === 'object' && event.error !== null
         ? event.error : event;
-    const code = typeof error.code === 'string' && error.code.length > 0 ? error.code : undefined;
-    const raw = typeof error.message === 'string' ? error.message : '';
-    const message = raw.replace(/\s+/g, ' ').trim().slice(0, 300);
-    const status = typeof event.status === 'number' ? ` status=${String(event.status)}` : '';
-    const detail = [code, message.length === 0 ? undefined : message]
-        .filter((part) => part !== undefined).join(': ');
-    return `native Codex WebSocket rejected the request${status}${detail.length === 0 ? '' : ` (${detail})`}`;
+    const requestId = eventHeader(event, 'x-request-id');
+    return rejectionDiagnostic('WebSocket', {
+        ...typeof event.status === 'number' ? { status: event.status } : {},
+        ...typeof error.code === 'string' ? { code: error.code } : {},
+        ...typeof error.message === 'string' ? { message: error.message } : {},
+        ...requestId === undefined ? {} : { requestId },
+    });
 }
 /** Prefer WebSocket v2; once safe retries exhaust, keep that DSH session on HTTP. */
 export class NativeCodexWebSocketTransport {
@@ -416,7 +412,7 @@ export class NativeCodexWebSocketTransport {
                 ? rawEvent.headers : undefined), this.options.onRateLimits, this.options.warn);
             const wrapped = eventFailure(rawEvent);
             if (wrapped !== undefined) {
-                this.options.warn?.(rejectionDiagnostic(rawEvent));
+                this.options.warn?.(socketRejectionDiagnostic(rawEvent));
                 throw wrapped;
             }
             if (entry.turnState === undefined) {

package/lib/responses.d.ts

@@ -54,6 +54,19 @@ export interface ResponsesUsage {
 export declare function mapResponsesUsage(usage: ResponsesUsage): TokenUsage;
 /** Classify in-band failure data without reflecting provider text. */
 export declare function responsesFailure(code?: string, message?: string, headers?: unknown): LlmError;
+export interface ProviderRejectionFacts {
+    status?: number;
+    code?: string;
+    message?: string;
+    requestId?: string;
+}
+/**
+ * One bounded operator-facing line naming the provider's own rejection, so a
+ * transport that cannot classify a refusal still records why it happened. The
+ * provider's free-form text stays in the log; it never becomes the
+ * provider-neutral error message.
+ */
+export declare function rejectionDiagnostic(transport: 'HTTP' | 'WebSocket', facts: ProviderRejectionFacts): string;
 interface ResponsesOutputItem {
     type?: string;
     id?: string;

package/lib/responses.js

@@ -77,7 +77,12 @@ export function toResponsesInput(messages, system) {
                 type: 'function_call_output',
                 call_id: String(message.toolCallId),
                 output: toolOutput(message.content),
-                ...message.isError === true ? { is_error: true } : {},
+                // The Responses wire has no error flag on a function call output: Codex
+                // keeps its own `success` metadata off the wire and reports a failed tool
+                // only through the output text. A Lite model rejects the unknown item
+                // field with a 400 INVALID_REQUEST, and because the item is replayed from
+                // durable history, every later request in that session fails the same way.
+                // `message.isError` stays DSH-side provenance for cloud context only.
             });
             continue;
         }
@@ -326,6 +331,23 @@ export function responsesFailure(code, message, headers) {
         ...delay === undefined ? {} : { providerRetryAfterMs: delay },
     });
 }
+/**
+ * One bounded operator-facing line naming the provider's own rejection, so a
+ * transport that cannot classify a refusal still records why it happened. The
+ * provider's free-form text stays in the log; it never becomes the
+ * provider-neutral error message.
+ */
+export function rejectionDiagnostic(transport, facts) {
+    const code = facts.code !== undefined && facts.code.length > 0 ? facts.code : undefined;
+    const message = (facts.message ?? '').replace(/\s+/g, ' ').trim().slice(0, 300);
+    const status = facts.status === undefined ? '' : ` status=${String(facts.status)}`;
+    const requestId = facts.requestId === undefined || facts.requestId.length === 0
+        ? '' : ` request_id=${facts.requestId}`;
+    const detail = [code, message.length === 0 ? undefined : message]
+        .filter((part) => part !== undefined).join(': ');
+    return `native Codex ${transport} rejected the request${status}${requestId}`
+        + `${detail.length === 0 ? '' : ` (${detail})`}`;
+}
 function eventItemId(event) {
     if (typeof event.item_id === 'string' && event.item_id.length > 0)
         return event.item_id;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pure01fx/dsh-openai-codex-auth",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Native ChatGPT Codex provider, device-code-first login, and same-origin Web integration for DeepSeek Harness",
   "license": "MIT",
   "publishConfig": {