@wix/pathgrade 1.0.17 → 1.0.19

package/README.md

@@ -35,7 +35,8 @@ By default, Pathgrade tries to reuse the agent CLI's native auth before falling
 - **Codex**
   - forwards `OPENAI_API_KEY` when present
   - or runs `codex login --with-api-key` inside the sandbox when an API key is present
-  - `codex exec` can reuse cached `~/.codex/auth.json` when no key is available; `app-server` may reject cached ChatGPT-token refreshes, so prefer `OPENAI_API_KEY` for the default transport
+  - without API credentials, the default `app-server` transport reuses the active Codex login through short-lived auth-only stdio sessions; `codex exec` retains its cached `~/.codex/auth.json` behavior
+  - keyless Codex evals automatically use that managed login for plain and tool-using judges; an explicit `evaluate(..., { llm })` still wins
 - **Cursor**
   - forwards `CURSOR_API_KEY` when set
   - macOS: reuses `cursor-agent login` OAuth tokens from the login Keychain
@@ -47,7 +48,9 @@ By default, Pathgrade tries to reuse the agent CLI's native auth before falling
 
 If you set `ANTHROPIC_BASE_URL`, `OPENAI_BASE_URL`, or `CURSOR_API_BASE_URL`, set the matching API key too.
 
-Do not add `copyFromHome: ['.codex']` just to reuse Codex authentication. When no OpenAI API key is available, Pathgrade automatically stages only `~/.codex/auth.json`. A deliberate full `.codex` copy remains supported, but it also imports host config, MCP definitions, plugins, caches, sessions, and other potentially large or sensitive state; Pathgrade prints a warning when requested.
+An [experimental ChatGPT judge that reuses Codex-managed authentication](docs/OPENAI_OAUTH_JUDGE.md) is also available. It requires no API key, auth-file option, or second login and is selected automatically for keyless Codex evals.
+
+Do not add `copyFromHome: ['.codex']` just to reuse Codex authentication. Keyless app-server runs stage no credential file; the legacy exec transport stages only `~/.codex/auth.json`. A deliberate full `.codex` copy remains supported, but it also imports host config, MCP definitions, plugins, caches, sessions, and other potentially large or sensitive state; Pathgrade prints a warning when requested.
 
 Override credentials per test with `env`:
 
@@ -64,7 +67,7 @@ const agent = await createAgent({
 
 Codex supports two transports and Pathgrade defaults to `app-server`:
 
-- `app-server` (default) — uses `codex app-server` and keeps native thread state. Required for `AskUserReaction` handshakes (`request_user_input` reaches the model). Prefer `OPENAI_API_KEY`; cached ChatGPT auth can fail if the app-server asks Pathgrade to refresh tokens.
+- `app-server` (default) — uses `codex app-server` and keeps native thread state. Required for `AskUserReaction` handshakes (`request_user_input` reaches the model). Without API credentials it acquires and refreshes access sessions through the active Codex login.
 - `exec` — uses `codex exec` and re-injects the transcript every turn. Kept for stateless CI matrices that don't need the handshake.
 
 Precedence: `createAgent({ transport })` > `PATHGRADE_CODEX_TRANSPORT` env > default (`app-server`). An invalid env value throws at `createAgent` time.
@@ -80,7 +83,7 @@ If `transport: 'exec'` is resolved and any `AskUserReaction` is present in `Conv
 
 Migrating from `exec` to `app-server`:
 
-- Export `OPENAI_API_KEY`, or set `transport: 'exec'` / `PATHGRADE_CODEX_TRANSPORT=exec` to stay on the old transport and its cached-auth behavior.
+- Sign in with `codex login` for subscription-backed app-server and judge calls, export `OPENAI_API_KEY` for API billing, or select `transport: 'exec'` for the old cached-auth behavior.
 - The `noninteractive-user-question` runtime policy no longer attaches under `app-server`. Snapshots that captured model output influenced by that policy text may need re-recording.
 - `MAX_TURN_RETRIES` does not apply under `app-server` — a crashed turn ends the conversation with `completionReason: 'agent_crashed'`.
 

package/dist/agents/claude/sdk-message-projector.js

@@ -22,6 +22,9 @@ const SDK_ERROR_SUBTYPES = [
     'error_max_structured_output_retries',
 ];
 import { TOOL_NAME_MAP, buildSummary, enrichSkillEvents } from '../../tool-events.js';
+import { sanitizePersistenceValue } from '../../tool-event-results.js';
+import { attachTurnResultSensitiveValues } from '../../sdk/turn-result-secrets.js';
+import { attachToolEventSensitiveValues } from '../../sdk/tool-event-secrets.js';
 import { attachOriginalMcpInput } from '../../sdk/mcp-event-input.js';
 import { parseClaudeSdkMcpToolName } from './mcp-tool-name.js';
 import { applyObservedToolResult, extractObservedToolResults, } from './tool-results.js';
@@ -132,13 +135,15 @@ export function projectSdkMessages(input) {
     const trimmedAssistant = assistantText.trim();
     const trimmedResult = resultText.trim();
     const visible = isError ? '' : (trimmedAssistant || trimmedResult);
-    const rawOutput = resultText || assistantText;
+    const rawOutput = sanitizePersistenceValue(resultText || assistantText, input.sensitiveValues);
     const enriched = enrichSkillEvents([
         ...toolEvents,
         ...(input.deniedMcpEvents?.all() ?? []),
     ]);
-    const finalToolEvents = prependSlashCommandSkillEvent(enriched, input.firstMessage, initSkills);
-    const traceOutput = input.messages.map((m) => JSON.stringify(m)).join('\n');
+    const finalToolEvents = prependSlashCommandSkillEvent(enriched, input.firstMessage, initSkills).map((event) => attachToolEventSensitiveValues(event, input.sensitiveValues ?? []));
+    const traceOutput = sanitizePersistenceValue(input.messages, input.sensitiveValues)
+        .map((message) => JSON.stringify(message))
+        .join('\n');
     const result = {
         rawOutput,
         assistantMessage: visible,
@@ -155,7 +160,10 @@ export function projectSdkMessages(input) {
         ...(costUsd !== undefined ? { costUsd } : {}),
         ...(errorSubtype !== undefined ? { errorSubtype } : {}),
     };
-    return { result, sessionId };
+    return {
+        result: attachTurnResultSensitiveValues(result, input.sensitiveValues ?? []),
+        sessionId,
+    };
 }
 /**
  * If the first user message of the turn is `/<name>` and `<name>` is one of

package/dist/agents/claude/tool-results.d.ts

@@ -1,6 +1,6 @@
 import type { SDKMessage } from '@anthropic-ai/claude-agent-sdk';
 import type { ToolEvent } from '../../tool-events.js';
-export declare const TOOL_RESULT_MAX_CHARS: number;
+export { collectSensitiveEnvValues, TOOL_RESULT_MAX_CHARS } from '../../tool-event-results.js';
 export interface ClaudeSdkMessageTiming {
     receivedAt: string;
     receivedMonotonicMs: number;
@@ -16,4 +16,3 @@ export interface ObservedToolResult {
 export declare function hasToolLifecycleBoundary(message: SDKMessage): boolean;
 export declare function extractObservedToolResults(message: SDKMessage, timing?: ClaudeSdkMessageTiming): ObservedToolResult[];
 export declare function applyObservedToolResult(event: ToolEvent, observed: ObservedToolResult, startedMonotonicMs?: number, sensitiveValues?: readonly string[]): void;
-export declare function collectSensitiveEnvValues(env: Readonly<Record<string, string>>): string[];

package/dist/agents/claude/tool-results.js

@@ -1,5 +1,5 @@
-export const TOOL_RESULT_MAX_CHARS = 64 * 1024;
-const SECRET_ENV_KEY_PATTERN = /(^|[_-])(api[_-]?key|token|secret|password|authorization|auth|bearer)([_-]|$)/i;
+import { sanitizeToolEventResult, } from '../../tool-event-results.js';
+export { collectSensitiveEnvValues, TOOL_RESULT_MAX_CHARS } from '../../tool-event-results.js';
 export function hasToolLifecycleBoundary(message) {
     if (message.type !== 'assistant' && message.type !== 'user')
         return false;
@@ -52,50 +52,19 @@ export function applyObservedToolResult(event, observed, startedMonotonicMs, sen
         event.arguments.status = event.status;
     }
 }
-export function collectSensitiveEnvValues(env) {
-    return [...new Set(Object.entries(env)
-            .filter(([key, value]) => SECRET_ENV_KEY_PATTERN.test(key) && value.length > 0)
-            .map(([, value]) => value))]
-        .sort((a, b) => b.length - a.length);
-}
 function buildBoundedToolResult(observed, sensitiveValues) {
     const raw = observed.structuredResult;
-    const result = {};
-    let truncated = false;
-    const addBounded = (key, value) => {
-        if (typeof value !== 'string')
-            return;
-        const bounded = boundText(redactSensitiveValues(value, sensitiveValues));
-        result[key] = bounded.value;
-        truncated ||= bounded.truncated;
+    const result = {
+        ...(typeof raw?.stdout === 'string' ? { stdout: raw.stdout } : {}),
+        ...(typeof raw?.stderr === 'string' ? { stderr: raw.stderr } : {}),
+        ...(typeof observed.content === 'string' && observed.content !== raw?.stdout
+            ? { content: observed.content }
+            : {}),
     };
-    addBounded('stdout', raw?.stdout);
-    addBounded('stderr', raw?.stderr);
-    if (observed.content !== raw?.stdout)
-        addBounded('content', observed.content);
     const exitCode = raw?.exitCode ?? raw?.exit_code;
     if (typeof exitCode === 'number' && Number.isFinite(exitCode))
         result.exitCode = exitCode;
-    if (truncated)
-        result.truncated = true;
-    return result;
-}
-function redactSensitiveValues(value, sensitiveValues) {
-    let redacted = value;
-    for (const secret of sensitiveValues) {
-        if (secret.length > 0)
-            redacted = redacted.split(secret).join('<redacted>');
-    }
-    return redacted;
-}
-function boundText(value) {
-    if (value.length <= TOOL_RESULT_MAX_CHARS)
-        return { value, truncated: false };
-    const marker = '\n[truncated by PathGrade]';
-    return {
-        value: `${value.slice(0, TOOL_RESULT_MAX_CHARS - marker.length)}${marker}`,
-        truncated: true,
-    };
+    return sanitizeToolEventResult(result, sensitiveValues);
 }
 function extractTextContent(content) {
     if (typeof content === 'string')

package/dist/agents/claude.js

@@ -28,6 +28,8 @@ import { createSandboxedClaudeSpawn } from '../providers/sandboxed-claude-spawn.
 import { assertClaudeLiveMcpSafetyPreflight, assertStdioMcpServersStartForClaudeSdk, mountMcpForClaudeSdk, } from '../providers/mcp-runtime-mounting.js';
 import { buildClaudeSdkOptions, resolveClaudeCodeExecutable, } from './claude/sdk-options.js';
 import { projectSdkMessages } from './claude/sdk-message-projector.js';
+import { attachToolEventSensitiveValues } from '../sdk/tool-event-secrets.js';
+import { cloneTurnResultWithSensitiveValues } from '../sdk/turn-result-secrets.js';
 import { collectSensitiveEnvValues, hasToolLifecycleBoundary, } from './claude/tool-results.js';
 import { createAskUserAnswerStore } from './claude/ask-user-answer-store.js';
 import { createClaudeToolPermissionBridge } from './claude/tool-permission-bridge.js';
@@ -195,7 +197,8 @@ export class ClaudeAgent extends BaseAgent {
                 deniedMcpEvents,
                 sensitiveValues,
             });
-            projected.result.toolEvents = [...scriptedEvents, ...projected.result.toolEvents];
+            projected.result.toolEvents = [...scriptedEvents, ...projected.result.toolEvents]
+                .map((event) => attachToolEventSensitiveValues(event, sensitiveValues));
             // Capture the SDK-reported session id BEFORE checking for a bus
             // rejection so the next turn's `Options.resume` points at this
             // turn's session even when the turn ended in an ask-bus error.
@@ -214,12 +217,11 @@ export class ClaudeAgent extends BaseAgent {
                 const errorMessage = bridgeError instanceof Error
                     ? bridgeError.message
                     : String(bridgeError);
-                return {
-                    ...projected.result,
+                return cloneTurnResultWithSensitiveValues(projected.result, {
                     exitCode: 1,
                     errorSubtype: 'bus_rejection',
                     rawOutput: errorMessage,
-                };
+                });
             }
             return projected.result;
         };

package/dist/agents/codex-app-server/agent.d.ts

@@ -1,5 +1,6 @@
 import { AgentCommandRunner, AgentSession, AgentSessionOptions, BaseAgent, EnvironmentHandle } from '../../types.js';
 import { type AppServerSessionHandle } from './transport.js';
+import { type LifecycleClock } from './item-lifecycle.js';
 type SandboxMode = 'workspace-write' | 'danger-full-access';
 export interface PermissionGrantLogEntry {
     type: 'permissions_granted';
@@ -25,6 +26,10 @@ export interface CodexAppServerAgentDeps {
     sandboxMode?: SandboxMode;
     /** Observer for per-grant audit entries (§7 of design decisions). */
     onPermissionGrant?: (entry: PermissionGrantLogEntry) => void;
+    /** Injectable clocks keep wall timestamps and monotonic durations independently testable. */
+    clock?: LifecycleClock;
+    /** Inject Codex-managed ChatGPT access sessions for deterministic tests. */
+    authBroker?: import('../../openai-oauth/codex-auth-broker.js').CodexAuthBroker;
 }
 export declare class CodexAppServerAgent extends BaseAgent {
     private deps;