@salesforce/sfdx-agent-harness-openai 0.0.1

package/dist/openai-tool-mapper.js

@@ -0,0 +1,231 @@
+/*
+ * Copyright 2026, Salesforce, Inc. All rights reserved.
+ * See LICENSE.txt for license terms.
+ */
+import { tool } from '@openai/agents';
+import { AgentSDKError, AgentSDKErrorType } from '@salesforce/sfdx-agent-sdk';
+import { applyRedaction } from './openai-tool-redaction.js';
+/**
+ * Per-turn registry for consumer-executed (client-side) tools — those declared
+ * in `AgentConfig.tools` with no `execute`. The harness registers them with the
+ * model so it can call them, but never runs them: the mapped tool's `execute`
+ * PARKS on a promise this registry hands out, and the consumer resolves it
+ * out-of-band via `submitToolResult`. A parked `execute` resolved later lets the
+ * `@openai/agents` run loop continue on the same run — no in-process MCP bridge
+ * needed.
+ *
+ * Keyed by `toolCallId`, read directly off `details.toolCall.callId` at execute
+ * entry (the SDK populates it before invoking the tool), so binding is a direct
+ * map insert — no FIFO-by-name matching.
+ *
+ * Idempotent settle (#589): a second `settle` on the same id, or a settle after
+ * teardown rejected it, is a silent no-op; a `toolCallId` that never parked is
+ * genuine misuse and throws `TOOL_CALL_NOT_FOUND`.
+ */
+export class ConsumerToolRegistry {
+    toolNames;
+    /** Parked calls awaiting a consumer result, by `toolCallId`. */
+    pending = new Map();
+    /**
+     * Outcomes the consumer submitted BEFORE the tool's `execute` parked, by
+     * `toolCallId`. The harness emits the `tool-call` ChatEvent the moment the SDK
+     * enqueues `tool_called` — which is BEFORE it awaits `execute` — so a consumer
+     * iterating the stream can call `submitToolResult` before the parker
+     * registers. Buffer it here; `park` drains it immediately so the result is
+     * never lost to the race.
+     */
+    preSubmitted = new Map();
+    /** Ids already settled (by consumer or teardown), so a repeat settle is a no-op. */
+    settled = new Set();
+    /**
+     * Consumer-tool call ids the consumer settled with `isError: true`. The run
+     * loop persists the resulting `function_call_result` with no `isError` field
+     * (the OpenAI item shape can't carry it), so the coordinator reads this after
+     * the turn settles and stamps `isError` onto those records out-of-band,
+     * satisfying the #647 "isError survives to history" contract.
+     */
+    erroredIds = new Set();
+    /**
+     * Consumer-tool call ids the coordinator has surfaced as a `tool-call`
+     * ChatEvent this turn. A `settle` for a not-yet-parked id is buffered only
+     * when the id is here (an early-arriving result); an id never seen is genuine
+     * misuse and throws.
+     */
+    emitted = new Set();
+    /** Whether the turn has torn down — a park after teardown resolves immediately as an error. */
+    tornDown = false;
+    /** Error to resolve late parks with after teardown. */
+    teardownError;
+    /** The bare names of the consumer tools registered this turn (for dual-enforcement checks). */
+    constructor(toolNames) {
+        this.toolNames = toolNames;
+    }
+    /**
+     * Called by a mapped tool's `execute` at invocation. Returns a promise that
+     * settles when the consumer calls `submitToolResult` for `toolCallId`. It
+     * REJECTS only on teardown (so the run loop unblocks rather than hanging on a
+     * promise that will never settle); a normal settle — including an
+     * `isError: true` one — RESOLVES with the outcome, because a consumer-reported
+     * tool failure must reach the model as a recoverable tool output, not throw
+     * out of the run loop (the {@link ToolResultInfo.isError} contract). The
+     * mapper's `execute` turns the outcome into the model-visible value. A park
+     * after teardown rejects immediately.
+     */
+    park(toolCallId) {
+        if (this.tornDown)
+            return Promise.reject(this.teardownError ?? new Error('Turn ended.'));
+        // Drain a pre-submitted outcome (consumer settled before execute parked).
+        const early = this.preSubmitted.get(toolCallId);
+        if (early !== undefined) {
+            this.preSubmitted.delete(toolCallId);
+            return Promise.resolve(early);
+        }
+        return new Promise((resolve, reject) => {
+            this.pending.set(toolCallId, { resolve, reject });
+        });
+    }
+    /**
+     * Record that the coordinator surfaced `toolCallId` as a `tool-call`
+     * ChatEvent — so a `submitToolResult` that races ahead of the parker (the
+     * SDK emits `tool_called` before awaiting `execute`) is buffered rather than
+     * rejected.
+     */
+    markEmitted(toolCallId) {
+        this.emitted.add(toolCallId);
+    }
+    /**
+     * Settle a consumer tool call with the consumer's result. Resolves the parked
+     * `execute` if it has registered; otherwise buffers the outcome for the
+     * imminent `park` (the emit-before-await race) when the id was surfaced this
+     * turn. Idempotent (#589); throws `TOOL_CALL_NOT_FOUND` for an id the
+     * coordinator never surfaced.
+     */
+    settle(toolCallId, outcome) {
+        if (this.settled.has(toolCallId))
+            return;
+        const parked = this.pending.get(toolCallId);
+        if (parked !== undefined) {
+            this.settled.add(toolCallId);
+            if (outcome.isError)
+                this.erroredIds.add(toolCallId);
+            this.pending.delete(toolCallId);
+            parked.resolve(outcome);
+            return;
+        }
+        // Not parked yet. Buffer for the imminent `park` iff the coordinator
+        // surfaced this id this turn; a never-seen id is genuine misuse.
+        if (this.emitted.has(toolCallId)) {
+            this.settled.add(toolCallId);
+            if (outcome.isError)
+                this.erroredIds.add(toolCallId);
+            this.preSubmitted.set(toolCallId, outcome);
+            return;
+        }
+        throw new AgentSDKError(`No parked consumer tool call for id "${toolCallId}".`, AgentSDKErrorType.TOOL_CALL_NOT_FOUND);
+    }
+    /**
+     * The consumer-tool call ids settled with `isError: true` this turn — the
+     * records the coordinator stamps `isError` on after the run settles, since
+     * the run loop persists the `function_call_result` without it.
+     */
+    erroredToolCallIds() {
+        return [...this.erroredIds];
+    }
+    /**
+     * Reject every parked call on teardown so the run loop unblocks instead of
+     * hanging on a promise that will never settle. Marks all pending ids settled
+     * so a late consumer `submitToolResult` is a silent no-op (#589).
+     */
+    rejectAll(error) {
+        this.tornDown = true;
+        this.teardownError = error;
+        for (const [toolCallId, parked] of this.pending) {
+            this.settled.add(toolCallId);
+            // Reject the parked execute so the SDK run loop unblocks and the pump's
+            // catch synthesizes the terminal error + finish pair. (A normal settle
+            // resolves; only teardown rejects.)
+            parked.reject(error);
+        }
+        this.pending.clear();
+    }
+}
+/**
+ * Map an agent's consumer-tool `ToolDefinition[]` to `@openai/agents` function
+ * tools whose `execute` parks on the shared {@link ConsumerToolRegistry}. Every
+ * tool gets `needsApproval: false` — consumer tools are the consumer's
+ * responsibility via `submitToolResult` and are NEVER approval-gated (the
+ * dual-enforcement contract: the coordinator also short-circuits them by name
+ * before consulting the policy resolver).
+ *
+ * The mapped `execute` reads its own `toolCallId` from `details.toolCall.callId`
+ * (populated by the SDK before invocation) and parks under it; the returned
+ * value becomes the tool's output the model sees.
+ *
+ * When `redaction` is supplied (the agent has an `onToolResult` hook), the
+ * parked result passes through the redactor at this seam — before it becomes the
+ * model-visible output — with full fidelity (`agentId` / `threadId` /
+ * `toolCallId` / `toolName` / `serverName` all known). A redactor throw
+ * propagates out of `execute` (the pump's `catch` synthesizes the terminal
+ * error + finish pair), per the SDK's throws-propagate contract.
+ */
+export function mapConsumerTools(defs, registry, redaction) {
+    return defs.map((def) => {
+        const execute = async (_input, _context, details) => {
+            const toolCallId = details?.toolCall?.callId;
+            if (toolCallId === undefined) {
+                // Without a callId the harness can't pair a `submitToolResult`, so
+                // fail the call rather than park forever.
+                throw new AgentSDKError(`Consumer tool "${def.name}" was invoked without a tool call id.`, AgentSDKErrorType.TOOL_CALL_NOT_FOUND);
+            }
+            const { result, isError } = await registry.park(toolCallId);
+            // A consumer-reported failure must reach the model as a recoverable
+            // tool output (the `isError` contract), not throw. The gateway's
+            // `function_call_result` has no `isError` field, so the signal rides
+            // in the output text; the harness persists the structured `isError`
+            // on the session record for history (#647).
+            const modelVisible = isError ? errorOutput(result) : result;
+            if (redaction === undefined)
+                return modelVisible;
+            // Redact the model-visible value in place. `output` is what the model
+            // would otherwise see (error-prefixed on the failure path), so the
+            // redactor scrubs the same string that reaches the transcript.
+            return applyRedaction(redaction, {
+                toolCallId,
+                toolName: def.name,
+                output: modelVisible,
+                isError: isError === true,
+            });
+        };
+        // A consumer `inputSchema` is an arbitrary JSON schema. `strict: false`
+        // selects the non-strict tool branch (Zod-only schemas need `strict: true`);
+        // the options are cast as one object because a consumer's free-form schema
+        // won't structurally match the SDK's `JsonObjectSchemaNonStrict` generic and
+        // the execute arg is `unknown` on the non-strict branch. Consumer tools are
+        // never gated (`needsApproval: false`) — they run client-side by definition.
+        return tool({
+            name: def.name,
+            description: def.description ?? '',
+            parameters: def.inputSchema,
+            strict: false,
+            needsApproval: false,
+            execute,
+        });
+    });
+}
+/**
+ * Shape a consumer-reported error outcome into a model-visible tool output. The
+ * consumer's `result` is passed through when it is already a string/serializable
+ * value; an `Error` becomes its message. Prefixed so the model reads it as a
+ * failure it can recover from rather than a normal result.
+ */
+function errorOutput(result) {
+    const detail = result instanceof Error
+        ? result.message
+        : typeof result === 'string'
+            ? result
+            : result === undefined
+                ? 'unknown error'
+                : JSON.stringify(result);
+    return `Tool execution failed: ${detail}`;
+}
+//# sourceMappingURL=openai-tool-mapper.js.map

package/dist/openai-tool-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-tool-mapper.js","sourceRoot":"","sources":["../src/openai-tool-mapper.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAa,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAuB,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,cAAc,EAAyB,MAAM,4BAA4B,CAAC;AAKnF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IAsCR;IArCrB,gEAAgE;IAC/C,OAAO,GAAG,IAAI,GAAG,EAG/B,CAAC;IACJ;;;;;;;OAOG;IACc,YAAY,GAAG,IAAI,GAAG,EAA+B,CAAC;IACvE,oFAAoF;IACnE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C;;;;;;OAMG;IACc,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD;;;;;OAKG;IACc,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,+FAA+F;IACvF,QAAQ,GAAG,KAAK,CAAC;IACzB,uDAAuD;IAC/C,aAAa,CAAS;IAE9B,+FAA+F;IAC/F,YAAqB,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAEvD;;;;;;;;;;OAUG;IACH,IAAI,CAAC,UAAkB;QACnB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,UAAkB;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,UAAkB,EAAE,OAA4B;QACnD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxB,OAAO;QACX,CAAC;QACD,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO;QACX,CAAC;QACD,MAAM,IAAI,aAAa,CACnB,wCAAwC,UAAU,IAAI,EACtD,iBAAiB,CAAC,mBAAmB,CACxC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAY;QAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7B,wEAAwE;YACxE,uEAAuE;YACvE,oCAAoC;YACpC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CACJ;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAC5B,IAAsB,EACtB,QAA8B,EAC9B,SAA4B;IAE5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,KAAK,EACjB,MAAe,EACf,QAAiB,EACjB,OAA4C,EAC5B,EAAE;YAClB,MAAM,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3B,mEAAmE;gBACnE,0CAA0C;gBAC1C,MAAM,IAAI,aAAa,CACnB,kBAAkB,GAAG,CAAC,IAAI,uCAAuC,EACjE,iBAAiB,CAAC,mBAAmB,CACxC,CAAC;YACN,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5D,oEAAoE;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,4CAA4C;YAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5D,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,YAAY,CAAC;YACjD,sEAAsE;YACtE,mEAAmE;YACnE,+DAA+D;YAC/D,OAAO,cAAc,CAAC,SAAS,EAAE;gBAC7B,UAAU;gBACV,QAAQ,EAAE,GAAG,CAAC,IAAI;gBAClB,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,OAAO,KAAK,IAAI;aAC5B,CAAC,CAAC;QACP,CAAC,CAAC;QACF,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,IAAI,CAAC;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,KAAK;YACpB,OAAO;SAC+B,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAe;IAChC,MAAM,MAAM,GACR,MAAM,YAAY,KAAK;QACnB,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,KAAK,SAAS;gBACpB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,0BAA0B,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/dist/openai-tool-redaction.d.ts

@@ -0,0 +1,55 @@
+import { type MCPServer, type Tool } from '@openai/agents';
+import type { ToolResultRedactor } from '@salesforce/sfdx-agent-sdk';
+import type { McpCatalogEntry } from './openai-mcp-state.js';
+/**
+ * Everything a redaction seam needs to call the consumer's
+ * {@link ToolResultRedactor} with a faithful {@link ToolResultRedactionInput}.
+ * Built per-turn in `stream()` (so `threadId` is stable across approval
+ * resumes) and threaded into both the consumer-tool `execute` seam and the MCP
+ * `invoke`-wrap seam. `undefined` when the agent has no `onToolResult` hook —
+ * both seams then take their pass-through path with zero overhead.
+ */
+export type RedactionContext = {
+    readonly redactor: ToolResultRedactor;
+    readonly agentId: string;
+    readonly threadId: string;
+    /** Bare-tool-name → `{ serverName, annotations }`; supplies `serverName` for MCP tools. */
+    readonly mcpCatalog: ReadonlyMap<string, McpCatalogEntry>;
+};
+/**
+ * Run the consumer's redactor over one tool result and return the value the
+ * model should see. `{ output }` replaces; `undefined` (or a malformed return)
+ * passes the original through. **Throws propagate** — the SDK contract requires
+ * a redactor exception to ride the harness's native error path so the original
+ * value never reaches the model; callers MUST NOT catch it.
+ *
+ * `serverName` is looked up from the catalog (populated for MCP tools, absent
+ * for consumer / built-in tools, matching the cross-harness `tool-result`
+ * enrichment shape).
+ */
+export declare function applyRedaction(ctx: RedactionContext, args: {
+    toolCallId: string;
+    toolName: string;
+    output: unknown;
+    isError: boolean;
+}): Promise<unknown>;
+/**
+ * Materialize an agent's MCP tools as function tools (via {@link getAllMcpTools},
+ * the same call the SDK makes internally for a native `Agent({ mcpServers })`
+ * attach) and wrap each one's `invoke` with a redaction shim. Used only when the
+ * agent has an `onToolResult` hook — otherwise the harness keeps the native
+ * `mcpServers` attach unchanged (the #541-proven path).
+ *
+ * The `@openai/agents` MCP attach exposes no per-result rewrite hook, so owning
+ * the function-tool `invoke` is the only model-visible seam that also carries
+ * the `toolCallId` (`details.toolCall.callId`). The shim closure-captures the
+ * {@link RedactionContext}, so `threadId` / `agentId` need no `RunContext`
+ * plumbing.
+ *
+ * **#541 is preserved:** `getAllMcpTools` calls `listTools()` per server, which
+ * returns the warm instance cache (`cacheToolsList: true`) with no network
+ * `tools/list`. **`isError` caveat:** the wrapped `invoke` sees only the
+ * model-visible string output, not the SDK's internal error flag, so MCP
+ * `isError` is best-effort (duck-typed) — matching Claude's `PostToolUse`.
+ */
+export declare function buildRedactedMcpTools(servers: MCPServer[], ctx: RedactionContext): Promise<Tool[]>;

package/dist/openai-tool-redaction.js

@@ -0,0 +1,82 @@
+/*
+ * Copyright 2026, Salesforce, Inc. All rights reserved.
+ * See LICENSE.txt for license terms.
+ */
+import { getAllMcpTools } from '@openai/agents';
+/**
+ * Run the consumer's redactor over one tool result and return the value the
+ * model should see. `{ output }` replaces; `undefined` (or a malformed return)
+ * passes the original through. **Throws propagate** — the SDK contract requires
+ * a redactor exception to ride the harness's native error path so the original
+ * value never reaches the model; callers MUST NOT catch it.
+ *
+ * `serverName` is looked up from the catalog (populated for MCP tools, absent
+ * for consumer / built-in tools, matching the cross-harness `tool-result`
+ * enrichment shape).
+ */
+export async function applyRedaction(ctx, args) {
+    const serverName = ctx.mcpCatalog.get(args.toolName)?.serverName;
+    const result = await ctx.redactor({
+        agentId: ctx.agentId,
+        threadId: ctx.threadId,
+        toolCallId: args.toolCallId,
+        toolName: args.toolName,
+        ...(serverName !== undefined ? { serverName } : {}),
+        output: args.output,
+        isError: args.isError,
+    });
+    // `{ output }` replaces; anything else (incl. `undefined`) passes through.
+    return result && typeof result === 'object' && 'output' in result ? result.output : args.output;
+}
+/**
+ * Materialize an agent's MCP tools as function tools (via {@link getAllMcpTools},
+ * the same call the SDK makes internally for a native `Agent({ mcpServers })`
+ * attach) and wrap each one's `invoke` with a redaction shim. Used only when the
+ * agent has an `onToolResult` hook — otherwise the harness keeps the native
+ * `mcpServers` attach unchanged (the #541-proven path).
+ *
+ * The `@openai/agents` MCP attach exposes no per-result rewrite hook, so owning
+ * the function-tool `invoke` is the only model-visible seam that also carries
+ * the `toolCallId` (`details.toolCall.callId`). The shim closure-captures the
+ * {@link RedactionContext}, so `threadId` / `agentId` need no `RunContext`
+ * plumbing.
+ *
+ * **#541 is preserved:** `getAllMcpTools` calls `listTools()` per server, which
+ * returns the warm instance cache (`cacheToolsList: true`) with no network
+ * `tools/list`. **`isError` caveat:** the wrapped `invoke` sees only the
+ * model-visible string output, not the SDK's internal error flag, so MCP
+ * `isError` is best-effort (duck-typed) — matching Claude's `PostToolUse`.
+ */
+export async function buildRedactedMcpTools(servers, ctx) {
+    const tools = await getAllMcpTools({ mcpServers: servers });
+    return tools.map((tool) => (tool.type === 'function' ? wrapFunctionToolInvoke(tool, ctx) : tool));
+}
+/** Wrap a function tool's `invoke` so its result passes through the redactor before the model sees it. */
+function wrapFunctionToolInvoke(tool, ctx) {
+    const originalInvoke = tool.invoke.bind(tool);
+    return {
+        ...tool,
+        invoke: async (runContext, input, details) => {
+            const output = await originalInvoke(runContext, input, details);
+            const toolCallId = details?.toolCall?.callId;
+            // Without a callId the redaction input can't be faithfully attributed;
+            // still redact (the redactor keys on toolName/output), passing an empty
+            // id rather than dropping the hook.
+            const redacted = await applyRedaction(ctx, {
+                toolCallId: toolCallId ?? '',
+                toolName: tool.name,
+                output,
+                isError: isErrorOutput(output),
+            });
+            // `invoke` must return `string | Result`; a redactor may return any
+            // shape (the consumer owns matching the tool's expected shape, per the
+            // ToolResultRedactor contract — the harness does not validate it).
+            return redacted;
+        },
+    };
+}
+/** Best-effort MCP error detection: the model-visible output carries no structured flag, so duck-type it. */
+function isErrorOutput(output) {
+    return typeof output === 'object' && output !== null && output.isError === true;
+}
+//# sourceMappingURL=openai-tool-redaction.js.map

package/dist/openai-tool-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-tool-redaction.js","sourceRoot":"","sources":["../src/openai-tool-redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAA6B,MAAM,gBAAgB,CAAC;AAoB3E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,GAAqB,EACrB,IAAiF;IAEjF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;QAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,2EAA2E;IAC3E,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAoB,EAAE,GAAqB;IACnF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,0GAA0G;AAC1G,SAAS,sBAAsB,CAAC,IAAyC,EAAE,GAAqB;IAC5F,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO;QACH,GAAG,IAAI;QACP,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC7C,uEAAuE;YACvE,wEAAwE;YACxE,oCAAoC;YACpC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACvC,UAAU,EAAE,UAAU,IAAI,EAAE;gBAC5B,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM;gBACN,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;aACjC,CAAC,CAAC;YACH,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,QAAkB,CAAC;QAC9B,CAAC;KACJ,CAAC;AACN,CAAC;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,MAAe;IAClC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAgC,CAAC,OAAO,KAAK,IAAI,CAAC;AAC/G,CAAC"}