@use-lattice/litmus 0.121.3

package/dist/src/codex-sdk-Dl9D4k5B.cjs

@@ -0,0 +1,1060 @@
+const require_logger = require("./logger-DyfK9PBt.cjs");
+const require_esm = require("./esm-C62Zofr1.cjs");
+const require_genaiTracer = require("./genaiTracer-CyZrmaK0.cjs");
+const require_providerRegistry = require("./providerRegistry-DhV4rJIc.cjs");
+let fs = require("fs");
+fs = require_logger.__toESM(fs);
+let path = require("path");
+path = require_logger.__toESM(path);
+let dedent = require("dedent");
+dedent = require_logger.__toESM(dedent);
+let zod = require("zod");
+let crypto = require("crypto");
+crypto = require_logger.__toESM(crypto);
+let _opentelemetry_api = require("@opentelemetry/api");
+//#region src/providers/openai/codex-sdk.ts
+const MINIMAL_CLI_ENV_KEYS = [
+	"PATH",
+	"Path",
+	"HOME",
+	"USER",
+	"USERNAME",
+	"USERPROFILE",
+	"TMPDIR",
+	"TMP",
+	"TEMP",
+	"SHELL",
+	"COMSPEC",
+	"SystemRoot",
+	"PATHEXT",
+	"LANG",
+	"LC_ALL",
+	"TERM"
+];
+const COMMON_OPTIONAL_PROCESS_ENV_KEYS = [
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"SSH_AUTH_SOCK",
+	"GIT_SSH_COMMAND"
+];
+const CodexCliEnvValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean()
+]).transform(String);
+const OpenAICodexSDKConfigShape = {
+	basePath: zod.z.string().optional(),
+	prefix: zod.z.string().optional(),
+	suffix: zod.z.string().optional(),
+	provider: zod.z.unknown().optional(),
+	linkedTargetId: zod.z.string().optional(),
+	apiKey: zod.z.string().min(1).optional(),
+	base_url: zod.z.string().min(1).optional(),
+	working_dir: zod.z.string().min(1).optional(),
+	additional_directories: zod.z.array(zod.z.string().min(1)).optional(),
+	skip_git_repo_check: zod.z.boolean().optional(),
+	codex_path_override: zod.z.string().min(1).optional(),
+	model: zod.z.string().min(1).optional(),
+	sandbox_mode: zod.z.enum([
+		"read-only",
+		"workspace-write",
+		"danger-full-access"
+	]).optional(),
+	model_reasoning_effort: zod.z.enum([
+		"minimal",
+		"low",
+		"medium",
+		"high",
+		"xhigh"
+	]).optional(),
+	network_access_enabled: zod.z.boolean().optional(),
+	web_search_enabled: zod.z.boolean().optional(),
+	web_search_mode: zod.z.enum([
+		"disabled",
+		"cached",
+		"live"
+	]).optional(),
+	collaboration_mode: zod.z.enum(["coding", "plan"]).optional(),
+	approval_policy: zod.z.enum([
+		"never",
+		"on-request",
+		"on-failure",
+		"untrusted"
+	]).optional(),
+	thread_id: zod.z.string().min(1).optional(),
+	persist_threads: zod.z.boolean().optional(),
+	thread_pool_size: zod.z.number().int().positive().optional(),
+	output_schema: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	cli_env: zod.z.record(zod.z.string(), CodexCliEnvValueSchema).optional(),
+	inherit_process_env: zod.z.boolean().optional(),
+	enable_streaming: zod.z.boolean().optional(),
+	deep_tracing: zod.z.boolean().optional(),
+	cli_config: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+};
+const OpenAICodexSDKConfigSchema = zod.z.object(OpenAICodexSDKConfigShape).strict();
+const OpenAICodexSDKMergedPromptConfigSchema = zod.z.object(OpenAICodexSDKConfigShape).strip();
+function parseCodexConfig(config, options = {}) {
+	const schema = options.stripUnknownKeys ? OpenAICodexSDKMergedPromptConfigSchema : OpenAICodexSDKConfigSchema;
+	try {
+		return schema.parse(config ?? {});
+	} catch (error) {
+		if (error instanceof zod.z.ZodError) {
+			const issues = error.issues.map((issue) => {
+				return `${issue.path.length > 0 ? issue.path.join(".") : "(root)"}: ${issue.message}`;
+			}).join("; ");
+			throw new Error(`Invalid OpenAI Codex SDK config: ${issues}`);
+		}
+		throw error;
+	}
+}
+function getMinimalProcessEnv() {
+	const env = {};
+	for (const key of MINIMAL_CLI_ENV_KEYS) {
+		const value = process.env[key];
+		if (typeof value === "string" && value.length > 0) env[key] = value;
+	}
+	return env;
+}
+/**
+* Helper to load the OpenAI Codex SDK ESM module
+* Uses resolvePackageEntryPoint to handle ESM-only packages with restrictive exports
+*/
+async function loadCodexSDK() {
+	const basePaths = [
+		require_logger.state.basePath ? path.default.resolve(require_logger.state.basePath) : void 0,
+		process.cwd(),
+		path.default.resolve(require_esm.getDirectory(), ".."),
+		path.default.resolve(require_esm.getDirectory(), "../..")
+	].filter((candidate) => Boolean(candidate));
+	let codexPath = null;
+	for (const basePath of new Set(basePaths)) {
+		codexPath = require_esm.resolvePackageEntryPoint("@openai/codex-sdk", basePath);
+		if (codexPath) break;
+	}
+	if (!codexPath) throw new Error(dedent.default`The @openai/codex-sdk package is required but not installed.
+
+      To use the OpenAI Codex SDK provider, install it with:
+        npm install @openai/codex-sdk
+
+      Requires Node.js 20.20+ or 22.22+.
+
+      For more information, see: https://www.promptfoo.dev/docs/providers/openai-codex-sdk/`);
+	try {
+		return await require_esm.importModule(codexPath);
+	} catch (err) {
+		require_logger.logger.error(`Failed to load OpenAI Codex SDK: ${err}`);
+		if (err.stack) require_logger.logger.error(err.stack);
+		throw new Error(dedent.default`Failed to load @openai/codex-sdk.
+
+      The package was found but could not be loaded. This may be due to:
+      - Incompatible Node.js version (requires Node.js 20.20+ or 22.22+)
+      - Corrupted installation
+
+      Try reinstalling:
+        npm install @openai/codex-sdk
+
+      For more information, see: https://www.promptfoo.dev/docs/providers/openai-codex-sdk/`);
+	}
+}
+const CODEX_MODEL_PRICING = {
+	"gpt-5.4": {
+		input: 2.5,
+		output: 15,
+		cache_read: .25
+	},
+	"gpt-5.4-pro": {
+		input: 30,
+		output: 180,
+		cache_read: 30
+	},
+	"gpt-5.3-codex": {
+		input: 1.75,
+		output: 14,
+		cache_read: .175
+	},
+	"gpt-5.3-codex-spark": {
+		input: .5,
+		output: 4,
+		cache_read: .05
+	},
+	"gpt-5.2": {
+		input: 1.75,
+		output: 14,
+		cache_read: .175
+	},
+	"gpt-5.2-codex": {
+		input: 1.75,
+		output: 14,
+		cache_read: .175
+	},
+	"gpt-5.1-codex": {
+		input: 2,
+		output: 8,
+		cache_read: .2
+	},
+	"gpt-5.1-codex-max": {
+		input: 3,
+		output: 12,
+		cache_read: .3
+	},
+	"gpt-5.1-codex-mini": {
+		input: .5,
+		output: 2,
+		cache_read: .05
+	},
+	"gpt-5-codex": {
+		input: 2,
+		output: 8,
+		cache_read: .2
+	},
+	"gpt-5-codex-mini": {
+		input: .5,
+		output: 2,
+		cache_read: .05
+	},
+	"gpt-5": {
+		input: 2,
+		output: 8,
+		cache_read: .2
+	}
+};
+var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
+	static OPENAI_MODELS = [
+		"gpt-5.4",
+		"gpt-5.4-pro",
+		"gpt-5.3-codex",
+		"gpt-5.3-codex-spark",
+		"gpt-5.2",
+		"gpt-5.2-codex",
+		"gpt-5.1-codex",
+		"gpt-5.1-codex-max",
+		"gpt-5.1-codex-mini",
+		"gpt-5-codex",
+		"gpt-5-codex-mini",
+		"gpt-5"
+	];
+	config;
+	env;
+	apiKey;
+	providerId = "openai:codex-sdk";
+	codexModule;
+	codexInstances = /* @__PURE__ */ new Map();
+	threads = /* @__PURE__ */ new Map();
+	threadRunQueues = /* @__PURE__ */ new Map();
+	deepTracingWarningShown = false;
+	ignoredProviderEnvWarningShown = false;
+	omittedProcessEnvWarningShown = false;
+	constructor(options = {}) {
+		const { config, env, id } = options;
+		this.config = parseCodexConfig(config);
+		this.env = env;
+		this.apiKey = this.getApiKey();
+		this.providerId = id ?? this.providerId;
+		require_providerRegistry.providerRegistry.register(this);
+		if (this.config.model && !OpenAICodexSDKProvider.OPENAI_MODELS.includes(this.config.model)) require_logger.logger.warn(`Using unknown model for OpenAI Codex SDK: ${this.config.model}`);
+	}
+	id() {
+		return this.providerId;
+	}
+	getApiKey(config = this.config) {
+		return config?.apiKey || this.env?.OPENAI_API_KEY || this.env?.CODEX_API_KEY || require_logger.getEnvString("OPENAI_API_KEY") || require_logger.getEnvString("CODEX_API_KEY");
+	}
+	requiresApiKey() {
+		return false;
+	}
+	toString() {
+		return "[OpenAI Codex SDK Provider]";
+	}
+	/**
+	* Safely tear down a Codex instance by calling its cleanup method
+	* (destroy, cleanup, or close -- whichever is available).
+	*/
+	async destroyInstance(instance) {
+		if (typeof instance.destroy === "function") await instance.destroy();
+		else if (typeof instance.cleanup === "function") await instance.cleanup();
+		else if (typeof instance.close === "function") await instance.close();
+	}
+	async cleanup() {
+		this.threads.clear();
+		this.threadRunQueues.clear();
+		for (const instance of this.codexInstances.values()) try {
+			await this.destroyInstance(instance);
+		} catch (error) {
+			require_logger.logger.warn("[CodexSDK] Error during cleanup", { error });
+		}
+		this.codexInstances.clear();
+	}
+	async shutdown() {
+		try {
+			await this.cleanup();
+		} finally {
+			require_providerRegistry.providerRegistry.unregister(this);
+		}
+	}
+	prepareEnvironment(config, traceparent, apiKey = this.getApiKey(config)) {
+		const inheritProcessEnv = config.inherit_process_env === true;
+		const cliEnv = Object.fromEntries(Object.entries(config.cli_env ?? {}).map(([key, value]) => [key, String(value)]));
+		const env = {
+			...inheritProcessEnv ? process.env : getMinimalProcessEnv(),
+			...cliEnv
+		};
+		const ignoredProviderEnvKeys = Object.keys(this.env ?? {}).filter((key) => key !== "OPENAI_API_KEY" && key !== "CODEX_API_KEY" && !(key in (config.cli_env ?? {}))).sort();
+		if (ignoredProviderEnvKeys.length > 0 && !this.ignoredProviderEnvWarningShown) {
+			require_logger.logger.warn("[CodexSDK] Ignoring promptfoo-level env overrides for the Codex CLI process. Move these keys into config.cli_env if Codex shell commands need them.", { envKeys: ignoredProviderEnvKeys });
+			this.ignoredProviderEnvWarningShown = true;
+		}
+		if (!inheritProcessEnv && !this.omittedProcessEnvWarningShown) {
+			const omittedProcessEnvKeys = COMMON_OPTIONAL_PROCESS_ENV_KEYS.filter((key) => typeof process.env[key] === "string" && !(key in env));
+			if (omittedProcessEnvKeys.length > 0) {
+				require_logger.logger.warn("[CodexSDK] Common proxy/SSH/certificate process env vars are not inherited by default. Move these keys into config.cli_env or set inherit_process_env: true if Codex CLI commands need them.", { envKeys: omittedProcessEnvKeys });
+				this.omittedProcessEnvWarningShown = true;
+			}
+		}
+		const sortedEnv = {};
+		for (const key of Object.keys(env).sort()) if (env[key] !== void 0) sortedEnv[key] = env[key];
+		if (apiKey) {
+			sortedEnv.OPENAI_API_KEY = apiKey;
+			sortedEnv.CODEX_API_KEY = apiKey;
+		}
+		if (config.deep_tracing) {
+			if (!sortedEnv.OTEL_EXPORTER_OTLP_ENDPOINT) sortedEnv.OTEL_EXPORTER_OTLP_ENDPOINT = "http://127.0.0.1:4318";
+			if (!sortedEnv.OTEL_EXPORTER_OTLP_PROTOCOL) sortedEnv.OTEL_EXPORTER_OTLP_PROTOCOL = "http/json";
+			if (!sortedEnv.OTEL_SERVICE_NAME) sortedEnv.OTEL_SERVICE_NAME = "codex-cli";
+			if (!sortedEnv.OTEL_TRACES_EXPORTER) sortedEnv.OTEL_TRACES_EXPORTER = "otlp";
+			if (traceparent) sortedEnv.TRACEPARENT = traceparent;
+			require_logger.logger.debug("[CodexSDK] Injecting OTEL config for deep tracing", {
+				traceparent: traceparent || "(none - CLI will start own trace)",
+				endpoint: sortedEnv.OTEL_EXPORTER_OTLP_ENDPOINT,
+				userConfigured: {
+					endpoint: !!env.OTEL_EXPORTER_OTLP_ENDPOINT,
+					protocol: !!env.OTEL_EXPORTER_OTLP_PROTOCOL,
+					serviceName: !!env.OTEL_SERVICE_NAME
+				}
+			});
+		} else delete sortedEnv.TRACEPARENT;
+		return sortedEnv;
+	}
+	getResolvedCliConfig(config) {
+		if (!config.cli_config && !config.collaboration_mode) return;
+		return {
+			...config.cli_config ?? {},
+			...config.collaboration_mode ? { collaboration_mode: config.collaboration_mode } : {}
+		};
+	}
+	getSkillRootPrefixes(env, workingDir) {
+		const prefixes = /* @__PURE__ */ new Set();
+		const addPrefix = (candidate) => {
+			if (!candidate) return;
+			const normalized = candidate.replace(/\\/g, "/").replace(/\/+$/g, "");
+			if (normalized) prefixes.add(normalized);
+		};
+		addPrefix(env.CODEX_HOME);
+		addPrefix("/etc/codex");
+		if (workingDir) {
+			const resolvedWorkingDir = path.default.resolve(workingDir).replace(/\\/g, "/");
+			addPrefix(path.default.posix.join(resolvedWorkingDir, ".agents"));
+			const gitRoot = this.findGitRepositoryRoot(resolvedWorkingDir);
+			if (gitRoot) addPrefix(path.default.posix.join(gitRoot.replace(/\\/g, "/"), ".agents"));
+		}
+		const homeDir = env.HOME || env.USERPROFILE || process.env.HOME || process.env.USERPROFILE;
+		if (homeDir) addPrefix(path.default.posix.join(homeDir.replace(/\\/g, "/"), ".codex"));
+		return Array.from(prefixes);
+	}
+	isValidCodexSkillName(name) {
+		return /^[A-Za-z0-9._:-]+$/.test(name);
+	}
+	extractSkillPathCandidates(text, skillRootPrefixes = []) {
+		const matches = /* @__PURE__ */ new Map();
+		for (const rawToken of text.split(/\s+/)) {
+			const token = rawToken.replace(/^[`"'([{<]+|[`"',;:)\]}>]+$/g, "").trim();
+			if (!token) continue;
+			const normalizedPath = token.replace(/\\/g, "/");
+			const repoMatch = normalizedPath.match(/^\.agents\/skills\/([^/\s]+)\/SKILL\.md$/);
+			if (repoMatch) {
+				if (this.isValidCodexSkillName(repoMatch[1])) matches.set(normalizedPath, {
+					name: repoMatch[1],
+					path: normalizedPath
+				});
+				continue;
+			}
+			const matchingRoot = skillRootPrefixes.find((prefix) => normalizedPath.startsWith(`${prefix}/skills/`));
+			if (!matchingRoot) continue;
+			const customRootMatch = normalizedPath.slice(matchingRoot.length + 1).match(/^skills\/([^/\s]+)\/SKILL\.md$/);
+			if (customRootMatch && this.isValidCodexSkillName(customRootMatch[1])) matches.set(normalizedPath, {
+				name: customRootMatch[1],
+				path: normalizedPath
+			});
+		}
+		return Array.from(matches.values());
+	}
+	extractSkillCallsFromItems(items, skillRootPrefixes = [], options = {}) {
+		const skillCalls = /* @__PURE__ */ new Map();
+		for (const item of items) {
+			if (item?.type !== "command_execution") continue;
+			if (options.requireSuccessfulCommand && !this.isSuccessfulCommandExecution(item)) continue;
+			const command = typeof item.command === "string" && item.command.trim() ? item.command : void 0;
+			if (!command) continue;
+			for (const skillPath of this.extractSkillPathCandidates(command, skillRootPrefixes)) {
+				const existing = skillCalls.get(skillPath.path) ?? {
+					name: skillPath.name,
+					path: skillPath.path
+				};
+				skillCalls.set(skillPath.path, existing);
+			}
+		}
+		return Array.from(skillCalls.values()).map((skillCall) => ({
+			name: skillCall.name,
+			path: skillCall.path,
+			source: "heuristic"
+		}));
+	}
+	buildSkillMetadata(items, skillRootPrefixes = []) {
+		if (!Array.isArray(items) || items.length === 0) return;
+		const attemptedSkillCalls = this.extractSkillCallsFromItems(items, skillRootPrefixes);
+		const skillCalls = this.extractSkillCallsFromItems(items, skillRootPrefixes, { requireSuccessfulCommand: true });
+		if (skillCalls.length === 0 && attemptedSkillCalls.length <= skillCalls.length) return;
+		return {
+			attemptedSkillCalls,
+			skillCalls
+		};
+	}
+	isSuccessfulCommandExecution(item) {
+		if (item?.type !== "command_execution") return false;
+		if (typeof item.status === "string" && item.status !== "completed") return false;
+		if (typeof item.exit_code === "number" && item.exit_code !== 0) return false;
+		return true;
+	}
+	validateWorkingDirectory(workingDir, skipGitCheck = false) {
+		let stats;
+		try {
+			stats = fs.default.statSync(workingDir);
+		} catch (err) {
+			throw new Error(`Working directory ${workingDir} does not exist or isn't accessible: ${err.message}`);
+		}
+		if (!stats.isDirectory()) throw new Error(`Working directory ${workingDir} is not a directory`);
+		if (!skipGitCheck && !this.isInsideGitRepository(workingDir)) throw new Error(dedent.default`Working directory ${workingDir} is not inside a Git repository.
+
+        Codex requires a Git repository by default to prevent unrecoverable errors.
+
+        To bypass this check, set skip_git_repo_check: true in your provider config.`);
+	}
+	isInsideGitRepository(workingDir) {
+		return this.findGitRepositoryRoot(workingDir) !== void 0;
+	}
+	findGitRepositoryRoot(workingDir) {
+		let currentDir = path.default.resolve(workingDir);
+		while (true) {
+			if (fs.default.existsSync(path.default.join(currentDir, ".git"))) return currentDir;
+			const parentDir = path.default.dirname(currentDir);
+			if (parentDir === currentDir) return;
+			currentDir = parentDir;
+		}
+	}
+	/**
+	* Build Codex constructor options from provider config.
+	* Used when creating both local (deep-tracing) and cached instances.
+	*/
+	buildCodexOptions(env, config, apiKey = this.getApiKey(config)) {
+		const cliConfig = this.getResolvedCliConfig(config);
+		return {
+			env,
+			...apiKey ? { apiKey } : {},
+			...config.codex_path_override ? { codexPathOverride: config.codex_path_override } : {},
+			...config.base_url ? { baseUrl: config.base_url } : {},
+			...cliConfig ? { config: cliConfig } : {}
+		};
+	}
+	buildThreadOptions(config) {
+		return {
+			workingDirectory: config.working_dir,
+			skipGitRepoCheck: config.skip_git_repo_check ?? false,
+			...config.model ? { model: config.model } : {},
+			...config.additional_directories?.length ? { additionalDirectories: config.additional_directories } : {},
+			...config.sandbox_mode ? { sandboxMode: config.sandbox_mode } : {},
+			...config.model_reasoning_effort ? { modelReasoningEffort: config.model_reasoning_effort } : {},
+			...config.network_access_enabled === void 0 ? {} : { networkAccessEnabled: config.network_access_enabled },
+			...config.web_search_mode ? { webSearchMode: config.web_search_mode } : {},
+			...config.web_search_enabled !== void 0 && !config.web_search_mode ? { webSearchEnabled: config.web_search_enabled } : {},
+			...config.approval_policy ? { approvalPolicy: config.approval_policy } : {}
+		};
+	}
+	async getOrCreateThread(config, cacheKey, instanceKey, instance) {
+		const threadOptions = this.buildThreadOptions(config);
+		if (config.deep_tracing) return instance.startThread(threadOptions);
+		if (config.thread_id) {
+			const threadIdCacheKey = `${instanceKey}:${config.thread_id}`;
+			const cached = this.threads.get(threadIdCacheKey);
+			if (cached) return cached;
+			const thread = instance.resumeThread(config.thread_id, threadOptions);
+			if (config.persist_threads) this.threads.set(threadIdCacheKey, thread);
+			return thread;
+		}
+		if (config.persist_threads && cacheKey) {
+			const cached = this.threads.get(cacheKey);
+			if (cached) return cached;
+			const poolSize = config.thread_pool_size ?? 1;
+			if (this.threads.size >= poolSize) {
+				const oldestKey = this.threads.keys().next().value;
+				if (oldestKey) this.threads.delete(oldestKey);
+			}
+		}
+		const thread = instance.startThread(threadOptions);
+		if (config.persist_threads && cacheKey) this.threads.set(cacheKey, thread);
+		return thread;
+	}
+	async runStreaming(thread, prompt, runOptions, callOptions, skillRootPrefixes = []) {
+		const { events } = await thread.runStreamed(prompt, runOptions);
+		const items = [];
+		let usage = void 0;
+		const tracer = _opentelemetry_api.trace.getTracer("promptfoo.codex-sdk");
+		const activeSpans = /* @__PURE__ */ new Map();
+		const itemStartTimes = /* @__PURE__ */ new Map();
+		let lastEventTime = Date.now();
+		const reasoningTexts = [];
+		const conversationMessages = [];
+		conversationMessages.push({
+			role: "user",
+			content: prompt
+		});
+		try {
+			for await (const event of events) {
+				const eventTime = Date.now();
+				if (callOptions?.abortSignal?.aborted) {
+					const abortError = /* @__PURE__ */ new Error("AbortError");
+					abortError.name = "AbortError";
+					throw abortError;
+				}
+				switch (event.type) {
+					case "item.started": {
+						const item = event.item;
+						if (!item) {
+							require_logger.logger.warn("Codex item.started event missing item", { event });
+							break;
+						}
+						if (!item.id) {
+							require_logger.logger.debug("Codex item.started without id, will create span at completion", { type: item.type });
+							break;
+						}
+						const itemId = String(item.id);
+						const spanName = this.getSpanNameForItem(item);
+						const span = tracer.startSpan(spanName, {
+							kind: _opentelemetry_api.SpanKind.INTERNAL,
+							attributes: {
+								"codex.item.id": itemId,
+								"codex.item.type": item.type,
+								...this.getAttributesForItem(item)
+							}
+						});
+						activeSpans.set(itemId, span);
+						itemStartTimes.set(itemId, eventTime);
+						require_logger.logger.debug("Codex item started", {
+							itemId,
+							type: item.type
+						});
+						break;
+					}
+					case "item.completed": {
+						const item = event.item;
+						if (!item) {
+							require_logger.logger.warn("Codex item.completed event missing item", { event });
+							break;
+						}
+						const itemId = item.id ? String(item.id) : crypto.default.randomUUID();
+						items.push(item);
+						if (item.type === "reasoning" && typeof item.text === "string") {
+							const sanitizedReasoning = this.sanitizeTraceText(item.text, "Codex reasoning trace event");
+							if (sanitizedReasoning) reasoningTexts.push(sanitizedReasoning);
+						}
+						if (item.type === "agent_message" && typeof item.text === "string") conversationMessages.push({
+							role: "assistant",
+							content: this.sanitizeTraceText(item.text, "Codex agent message trace event") ?? ""
+						});
+						let span = activeSpans.get(itemId);
+						const hadStartEvent = span !== void 0;
+						if (!span) {
+							const spanName = this.getSpanNameForItem(item);
+							span = tracer.startSpan(spanName, {
+								kind: _opentelemetry_api.SpanKind.INTERNAL,
+								startTime: lastEventTime,
+								attributes: {
+									"codex.item.id": itemId,
+									"codex.item.type": item.type,
+									"codex.timing.estimated": true,
+									...this.getAttributesForItem(item)
+								}
+							});
+						}
+						const completionAttrs = this.getCompletionAttributesForItem(item, skillRootPrefixes);
+						for (const [key, value] of Object.entries(completionAttrs)) span.setAttribute(key, value);
+						const durationMs = eventTime - (itemStartTimes.get(itemId) || lastEventTime);
+						span.setAttribute("codex.duration_ms", durationMs);
+						span.setAttribute("codex.had_start_event", hadStartEvent);
+						if (item.type === "reasoning" && typeof item.text === "string") {
+							const reasoningText = this.sanitizeTraceText(item.text, "Codex reasoning span event");
+							span.addEvent("reasoning", { "codex.reasoning.text": reasoningText ?? "" });
+						}
+						if (item.type === "agent_message" && typeof item.text === "string") {
+							const messageText = this.sanitizeTraceText(item.text, "Codex agent message span event");
+							span.addEvent("message", { "codex.message.text": messageText ?? "" });
+						}
+						if (item.type === "command_execution" && typeof item.aggregated_output === "string") {
+							const commandOutput = this.sanitizeTraceText(item.aggregated_output, "Codex command output span event");
+							span.addEvent("output", { "codex.command.output": commandOutput ?? "" });
+						}
+						if (item.status === "failed" || item.type === "error" || item.error !== void 0 || item.type === "command_execution" && typeof item.exit_code === "number" && item.exit_code !== 0) span.setStatus({
+							code: _opentelemetry_api.SpanStatusCode.ERROR,
+							message: (typeof item.message === "string" ? item.message : null) || (typeof item.error?.message === "string" ? item.error.message : null) || (item.type === "command_execution" && item.exit_code !== 0 ? `Command exited with code ${item.exit_code}` : null) || "Item failed"
+						});
+						else span.setStatus({ code: _opentelemetry_api.SpanStatusCode.OK });
+						span.end();
+						activeSpans.delete(itemId);
+						itemStartTimes.delete(itemId);
+						require_logger.logger.debug("Codex item completed", {
+							itemId,
+							type: item.type,
+							durationMs
+						});
+						break;
+					}
+					case "item.updated": {
+						const item = event.item;
+						if (item?.id) {
+							const itemId = String(item.id);
+							const span = activeSpans.get(itemId);
+							if (span) {
+								const updatedAttrs = this.getCompletionAttributesForItem(item, skillRootPrefixes);
+								for (const [key, value] of Object.entries(updatedAttrs)) span.setAttribute(key, value);
+							}
+						}
+						require_logger.logger.debug("Codex item updated", {
+							itemId: item?.id,
+							type: item?.type
+						});
+						break;
+					}
+					case "turn.completed":
+						usage = event.usage;
+						require_logger.logger.debug("Codex turn completed", { usage });
+						break;
+					case "turn.failed": {
+						const errorMsg = event.error?.message || "Turn failed";
+						require_logger.logger.error("Codex turn failed", { error: errorMsg });
+						throw new Error(`Codex turn failed: ${errorMsg}`);
+					}
+					default: require_logger.logger.debug("Codex unknown event type", { type: event.type });
+				}
+				lastEventTime = eventTime;
+			}
+		} finally {
+			for (const [itemId, span] of activeSpans) {
+				require_logger.logger.warn("Codex item span not properly closed", { itemId });
+				span.setStatus({
+					code: _opentelemetry_api.SpanStatusCode.ERROR,
+					message: "Span not properly closed"
+				});
+				span.end();
+			}
+			activeSpans.clear();
+			itemStartTimes.clear();
+		}
+		const agentMessages = items.filter((i) => i.type === "agent_message");
+		return {
+			finalResponse: agentMessages.length > 0 ? agentMessages.map((i) => i.text).join("\n") : "",
+			items,
+			usage,
+			reasoningTexts,
+			conversationMessages
+		};
+	}
+	/**
+	* Get a descriptive span name for a Codex item
+	*/
+	getSpanNameForItem(item) {
+		switch (item.type) {
+			case "command_execution": return `exec ${typeof item.command === "string" ? item.command.split(" ")[0] || "command" : "command"}`;
+			case "file_change": return `file ${item.changes?.[0]?.kind || "change"}`;
+			case "mcp_tool_call": return `mcp ${typeof item.server === "string" ? item.server : "unknown"}/${typeof item.tool === "string" ? item.tool : "unknown"}`;
+			case "agent_message": return "agent response";
+			case "reasoning": return "reasoning";
+			case "web_search": return `search "${typeof item.query === "string" ? (this.sanitizeTraceText(item.query, "Codex web search span name") ?? "").slice(0, 30) : ""}"`;
+			case "todo_list": return "todo update";
+			case "error": return "error";
+			case "collaboration_tool_call": return `collab ${typeof item.tool === "string" ? item.tool : "unknown"}`;
+			case "spawn_agent": return `spawn ${typeof item.role === "string" ? item.role : "agent"}`;
+			case "send_input": return "send input";
+			case "agent_wait": return "wait";
+			default: return `codex.${item.type || "unknown"}`;
+		}
+	}
+	/**
+	* Get attributes for a Codex item at start
+	*/
+	getSkillTraceAttributes(item, skillRootPrefixes = [], options = {}) {
+		if (item?.type !== "command_execution") return {};
+		if (options.requireSuccessfulCommand && !this.isSuccessfulCommandExecution(item)) return {};
+		const command = typeof item.command === "string" && item.command.trim() ? item.command : void 0;
+		const skillCandidates = /* @__PURE__ */ new Map();
+		if (command) for (const skill of this.extractSkillPathCandidates(command, skillRootPrefixes)) skillCandidates.set(skill.path, skill);
+		if (skillCandidates.size === 0) return {};
+		const skills = Array.from(skillCandidates.values());
+		const attrs = {
+			"promptfoo.skill.count": skills.length,
+			"promptfoo.skill.names": skills.map((skill) => skill.name).join(","),
+			"promptfoo.skill.paths": skills.map((skill) => skill.path).join(",")
+		};
+		if (skills.length === 1) {
+			attrs["promptfoo.skill.name"] = skills[0].name;
+			attrs["promptfoo.skill.path"] = skills[0].path;
+		}
+		return attrs;
+	}
+	getAttributesForItem(item) {
+		const attrs = {};
+		switch (item.type) {
+			case "command_execution":
+				if (typeof item.command === "string") attrs["codex.command"] = this.sanitizeTraceText(item.command, "Codex command trace attribute") ?? "";
+				break;
+			case "mcp_tool_call":
+				if (typeof item.server === "string") attrs["codex.mcp.server"] = item.server;
+				if (typeof item.tool === "string") attrs["codex.mcp.tool"] = item.tool;
+				{
+					const serializedArgs = this.serializeItemValue(item.arguments ?? item.args ?? item.input);
+					if (serializedArgs) attrs["codex.mcp.input"] = serializedArgs;
+				}
+				break;
+			case "web_search":
+				if (typeof item.query === "string") attrs["codex.search.query"] = this.sanitizeTraceText(item.query, "Codex web search query trace attribute") ?? "";
+				break;
+			case "collaboration_tool_call":
+				if (typeof item.tool === "string") attrs["codex.collab.tool"] = item.tool;
+				if (typeof item.target_thread_id === "string") attrs["codex.collab.target_thread"] = item.target_thread_id;
+				break;
+			case "spawn_agent":
+				if (typeof item.role === "string") attrs["codex.collab.role"] = item.role;
+				if (typeof item.thread_id === "string") attrs["codex.collab.spawned_thread"] = item.thread_id;
+				break;
+			case "send_input":
+				if (typeof item.target_thread_id === "string") attrs["codex.collab.target_thread"] = item.target_thread_id;
+				break;
+		}
+		return attrs;
+	}
+	serializeItemValue(value) {
+		if (typeof value === "string") {
+			const trimmed = value.trim();
+			if (!trimmed) return;
+			try {
+				return JSON.stringify(this.redactTracePii(require_logger.sanitizeObject(JSON.parse(trimmed))));
+			} catch {
+				return this.redactTracePii(require_logger.sanitizeObject(trimmed, { context: "Codex MCP trace input" }));
+			}
+		}
+		if (value === void 0 || value === null) return;
+		try {
+			return JSON.stringify(this.redactTracePii(require_logger.sanitizeObject(value, { context: "Codex MCP trace input" })));
+		} catch {
+			return;
+		}
+	}
+	sanitizeTraceText(value, context) {
+		const sanitized = this.redactTracePii(require_logger.sanitizeObject(value, { context }));
+		if (typeof sanitized === "string") return sanitized;
+		if (sanitized === void 0 || sanitized === null) return;
+		try {
+			return JSON.stringify(sanitized);
+		} catch {
+			return;
+		}
+	}
+	redactTracePii(value) {
+		if (typeof value === "string") return value.replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, require_logger.REDACTED).replace(/\b(?:sk-(?:proj-)?[A-Za-z0-9_-]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|AKIA[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}|Bearer\s+[A-Za-z0-9._~+/-]{20,}|Basic\s+[A-Za-z0-9+/=]{20,})\b/g, require_logger.REDACTED).replace(/\b(api[_-]?key|token|password|secret|authorization|auth)\s*([=:])(\s*)(["']?)[^\s"'`]+(\4)/gi, (_match, key, separator, spacing, quote) => `${key}${separator}${spacing}${quote}${require_logger.REDACTED}${quote}`);
+		if (Array.isArray(value)) return value.map((item) => this.redactTracePii(item));
+		if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, require_logger.normalizeFieldName(key).includes("email") ? require_logger.REDACTED : this.redactTracePii(entryValue)]));
+		return value;
+	}
+	/**
+	* Get attributes for a Codex item at completion
+	*/
+	getCompletionAttributesForItem(item, skillRootPrefixes = []) {
+		const attrs = {};
+		switch (item.type) {
+			case "command_execution":
+				if (typeof item.exit_code === "number") attrs["codex.exit_code"] = item.exit_code;
+				if (typeof item.status === "string") attrs["codex.status"] = item.status;
+				if (typeof item.aggregated_output === "string") attrs["codex.output"] = this.sanitizeTraceText(item.aggregated_output, "Codex command output trace attribute") ?? "";
+				Object.assign(attrs, this.getSkillTraceAttributes(item, skillRootPrefixes, { requireSuccessfulCommand: true }));
+				break;
+			case "file_change":
+				if (typeof item.status === "string") attrs["codex.status"] = item.status;
+				if (Array.isArray(item.changes) && item.changes.length) {
+					attrs["codex.files_changed"] = item.changes.length;
+					attrs["codex.files"] = item.changes.map((c) => typeof c?.path === "string" ? c.path : "").filter(Boolean).join(", ");
+				}
+				break;
+			case "mcp_tool_call":
+				if (typeof item.status === "string") attrs["codex.status"] = item.status;
+				if (typeof item.error?.message === "string") attrs["codex.error"] = this.sanitizeTraceText(item.error.message, "Codex MCP error trace attribute") ?? "";
+				{
+					const serializedArgs = this.serializeItemValue(item.arguments ?? item.args ?? item.input);
+					if (serializedArgs) attrs["codex.mcp.input"] = serializedArgs;
+				}
+				break;
+			case "agent_message":
+				if (typeof item.text === "string") attrs["codex.message"] = this.sanitizeTraceText(item.text, "Codex agent message trace attribute") ?? "";
+				break;
+			case "reasoning":
+				if (typeof item.text === "string") attrs["codex.reasoning"] = this.sanitizeTraceText(item.text, "Codex reasoning trace attribute") ?? "";
+				break;
+			case "error":
+				if (typeof item.message === "string") attrs["codex.error"] = this.sanitizeTraceText(item.message, "Codex error trace attribute") ?? "";
+				break;
+		}
+		return attrs;
+	}
+	generateInstanceKey(env, config) {
+		const keyData = {
+			env,
+			base_url: config.base_url,
+			cli_config: this.getResolvedCliConfig(config),
+			codex_path_override: config.codex_path_override
+		};
+		return `openai:codex-sdk:instance:${crypto.default.createHash("sha256").update(JSON.stringify(keyData)).digest("hex")}`;
+	}
+	generateCacheKey(config, prompt, instanceKey) {
+		const keyData = {
+			instanceKey,
+			working_dir: config.working_dir,
+			additional_directories: config.additional_directories,
+			model: config.model,
+			output_schema: config.output_schema,
+			sandbox_mode: config.sandbox_mode,
+			model_reasoning_effort: config.model_reasoning_effort,
+			network_access_enabled: config.network_access_enabled,
+			web_search_enabled: config.web_search_enabled,
+			web_search_mode: config.web_search_mode,
+			approval_policy: config.approval_policy,
+			prompt
+		};
+		return `openai:codex-sdk:${crypto.default.createHash("sha256").update(JSON.stringify(keyData)).digest("hex")}`;
+	}
+	getThreadRunQueueKey(config, cacheKey, instanceKey) {
+		if (config.deep_tracing) return;
+		if (config.thread_id) return `${instanceKey}:${config.thread_id}`;
+		if (config.persist_threads && cacheKey) return cacheKey;
+	}
+	async runSerializedThreadTurn(queueKey, abortSignal, executeTurn) {
+		if (!queueKey) return executeTurn();
+		const previousRun = this.threadRunQueues.get(queueKey) ?? Promise.resolve();
+		let releaseCurrentRun = () => {};
+		const currentRun = new Promise((resolve) => {
+			releaseCurrentRun = resolve;
+		});
+		const queuedRun = previousRun.catch(() => void 0).then(() => currentRun);
+		this.threadRunQueues.set(queueKey, queuedRun);
+		queuedRun.finally(() => {
+			if (this.threadRunQueues.get(queueKey) === queuedRun) this.threadRunQueues.delete(queueKey);
+		});
+		try {
+			await this.waitForPreviousThreadRun(previousRun, abortSignal);
+			return await executeTurn();
+		} finally {
+			releaseCurrentRun();
+		}
+	}
+	async waitForPreviousThreadRun(previousRun, abortSignal) {
+		const previousRunDone = previousRun.catch(() => void 0);
+		if (!abortSignal) {
+			await previousRunDone;
+			return;
+		}
+		if (abortSignal.aborted) throw this.createAbortError("Codex thread turn wait aborted");
+		let onAbort;
+		const abortPromise = new Promise((_, reject) => {
+			onAbort = () => reject(this.createAbortError("Codex thread turn wait aborted"));
+			abortSignal.addEventListener("abort", onAbort, { once: true });
+		});
+		try {
+			await Promise.race([previousRunDone, abortPromise]);
+		} finally {
+			if (onAbort) abortSignal.removeEventListener("abort", onAbort);
+		}
+	}
+	createAbortError(message) {
+		const error = new Error(message);
+		error.name = "AbortError";
+		return error;
+	}
+	async callApi(prompt, context, callOptions) {
+		const config = {
+			...this.config,
+			...context?.prompt?.config
+		};
+		const modelName = typeof config.model === "string" && config.model ? config.model : "codex";
+		const spanContext = {
+			system: "openai",
+			operationName: "chat",
+			model: modelName,
+			providerId: this.id(),
+			evalId: context?.evaluationId || context?.test?.metadata?.evaluationId,
+			testIndex: typeof context?.test?.vars?.__testIdx === "number" ? context.test.vars.__testIdx : void 0,
+			promptLabel: context?.prompt?.label,
+			traceparent: context?.traceparent,
+			requestBody: prompt
+		};
+		const resultExtractor = (response) => {
+			const result = {};
+			if (response.tokenUsage) result.tokenUsage = response.tokenUsage;
+			if (response.sessionId) result.responseId = response.sessionId;
+			if (response.cached !== void 0) result.cacheHit = response.cached;
+			result.responseModel = modelName;
+			if (response.output !== void 0) try {
+				result.responseBody = typeof response.output === "string" ? response.output : JSON.stringify(response.output);
+			} catch {
+				result.responseBody = "[unable to serialize output]";
+			}
+			if (response.raw) try {
+				const rawData = typeof response.raw === "string" ? JSON.parse(response.raw) : response.raw;
+				if (rawData.reasoningTexts?.length > 0) result.additionalAttributes = {
+					"codex.reasoning.count": rawData.reasoningTexts.length,
+					"codex.reasoning.summary": rawData.reasoningTexts.join("\n---\n").slice(0, 2e3)
+				};
+				if (rawData.conversationMessages?.length > 0) result.additionalAttributes = {
+					...result.additionalAttributes,
+					"codex.conversation.message_count": rawData.conversationMessages.length
+				};
+				if (rawData.items?.length > 0) {
+					const itemCounts = {};
+					for (const item of rawData.items) itemCounts[item.type] = (itemCounts[item.type] || 0) + 1;
+					result.additionalAttributes = {
+						...result.additionalAttributes,
+						"codex.items.total": rawData.items.length,
+						"codex.items.breakdown": JSON.stringify(itemCounts)
+					};
+				}
+			} catch {}
+			return result;
+		};
+		return require_genaiTracer.withGenAISpan(spanContext, () => this.callApiInternal(prompt, context, callOptions, config), resultExtractor);
+	}
+	/**
+	* Internal implementation of callApi without tracing wrapper.
+	* Context is available for future use (e.g., _context?.vars for template rendering,
+	* _context?.bustCache for cache control, _context?.debug for debug mode).
+	*/
+	async callApiInternal(prompt, context, callOptions, rawConfig) {
+		let config;
+		try {
+			config = parseCodexConfig(rawConfig, { stripUnknownKeys: true });
+		} catch (error) {
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			require_logger.logger.error("Error calling OpenAI Codex SDK", { error: errorMessage });
+			return { error: `Error calling OpenAI Codex SDK: ${errorMessage}` };
+		}
+		const currentTraceparent = require_genaiTracer.getTraceparent();
+		const apiKey = this.getApiKey(config);
+		const env = this.prepareEnvironment(config, currentTraceparent, apiKey);
+		const skillRootPrefixes = this.getSkillRootPrefixes(env, config.working_dir);
+		if (apiKey) require_logger.logger.debug("[CodexSDK] Using explicit API credentials from promptfoo config/environment");
+		else require_logger.logger.debug("[CodexSDK] No explicit API credentials configured; deferring auth resolution to Codex SDK login state");
+		if (callOptions?.abortSignal?.aborted) return { error: "OpenAI Codex SDK call aborted before it started" };
+		let localInstance = void 0;
+		const useLocalInstance = config.deep_tracing;
+		let activeInstance = void 0;
+		let cacheKey = void 0;
+		const runOptions = {};
+		if (config.output_schema) runOptions.outputSchema = config.output_schema;
+		if (callOptions?.abortSignal) runOptions.signal = callOptions.abortSignal;
+		try {
+			if (config.working_dir) this.validateWorkingDirectory(config.working_dir, config.skip_git_repo_check);
+			if (!this.codexModule) this.codexModule = await loadCodexSDK();
+			const stableEnv = { ...env };
+			delete stableEnv.TRACEPARENT;
+			const instanceKey = this.generateInstanceKey(stableEnv, config);
+			if (useLocalInstance) {
+				if ((config.persist_threads || config.thread_id || (config.thread_pool_size ?? 0) > 1) && !this.deepTracingWarningShown) {
+					require_logger.logger.warn("[CodexSDK] deep_tracing is incompatible with thread persistence. Thread options (persist_threads, thread_id, thread_pool_size) are ignored when deep_tracing is enabled.");
+					this.deepTracingWarningShown = true;
+				}
+				localInstance = new this.codexModule.Codex(this.buildCodexOptions(env, config, apiKey));
+				activeInstance = localInstance;
+			} else {
+				activeInstance = this.codexInstances.get(instanceKey);
+				if (!activeInstance) {
+					activeInstance = new this.codexModule.Codex(this.buildCodexOptions(env, config, apiKey));
+					this.codexInstances.set(instanceKey, activeInstance);
+				}
+			}
+			const promptCacheBasis = context?.prompt?.raw ?? prompt;
+			cacheKey = this.generateCacheKey(config, promptCacheBasis, instanceKey);
+			const queueKey = this.getThreadRunQueueKey(config, cacheKey, instanceKey);
+			const { turn, sessionId } = await this.runSerializedThreadTurn(queueKey, callOptions?.abortSignal, async () => {
+				const thread = await this.getOrCreateThread(config, cacheKey, instanceKey, activeInstance);
+				return {
+					turn: config.enable_streaming ? await this.runStreaming(thread, prompt, runOptions, callOptions, skillRootPrefixes) : await thread.run(prompt, runOptions),
+					sessionId: thread.id || "unknown"
+				};
+			});
+			const output = turn.finalResponse || "";
+			const raw = JSON.stringify(turn);
+			const skillMetadata = this.buildSkillMetadata(turn.items, skillRootPrefixes);
+			const metadata = skillMetadata ? {
+				...skillMetadata.skillCalls.length > 0 ? { skillCalls: skillMetadata.skillCalls } : {},
+				...skillMetadata.attemptedSkillCalls.length > skillMetadata.skillCalls.length ? { attemptedSkillCalls: skillMetadata.attemptedSkillCalls } : {}
+			} : void 0;
+			const tokenUsage = turn.usage ? {
+				prompt: turn.usage.input_tokens,
+				completion: turn.usage.output_tokens,
+				total: turn.usage.input_tokens + turn.usage.output_tokens,
+				cached: turn.usage.cached_input_tokens || 0
+			} : void 0;
+			let cost = 0;
+			if (tokenUsage && config.model) {
+				const pricing = CODEX_MODEL_PRICING[config.model];
+				if (pricing) {
+					const cachedTokens = tokenUsage.cached || 0;
+					const inputCost = ((tokenUsage.prompt || 0) - cachedTokens) * (pricing.input / 1e6);
+					const cacheReadCost = cachedTokens * (pricing.cache_read / 1e6);
+					const outputCost = (tokenUsage.completion || 0) * (pricing.output / 1e6);
+					cost = inputCost + cacheReadCost + outputCost;
+				}
+			}
+			require_logger.logger.debug("OpenAI Codex SDK response", {
+				output,
+				usage: turn.usage
+			});
+			return {
+				output,
+				tokenUsage,
+				cost,
+				metadata,
+				raw,
+				sessionId
+			};
+		} catch (error) {
+			if (error instanceof Error && error.name === "AbortError" || callOptions?.abortSignal?.aborted) {
+				require_logger.logger.warn("OpenAI Codex SDK call aborted");
+				return { error: "OpenAI Codex SDK call aborted" };
+			}
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			require_logger.logger.error("Error calling OpenAI Codex SDK", { error: errorMessage });
+			return { error: `Error calling OpenAI Codex SDK: ${errorMessage}` };
+		} finally {
+			if (!config.deep_tracing && !config.persist_threads && !config.thread_id && cacheKey) this.threads.delete(cacheKey);
+			if (useLocalInstance && localInstance) try {
+				await this.destroyInstance(localInstance);
+			} catch (cleanupError) {
+				require_logger.logger.debug("[CodexSDK] Error cleaning up local instance", { error: cleanupError });
+			}
+		}
+	}
+};
+//#endregion
+exports.OpenAICodexSDKProvider = OpenAICodexSDKProvider;
+
+//# sourceMappingURL=codex-sdk-Dl9D4k5B.cjs.map