@wix/pathgrade 1.0.17 → 1.0.19

package/dist/agents/codex-app-server/agent.js

@@ -1,133 +1,22 @@
 import { BaseAgent, getRuntimeEnv, getWorkspacePath, } from '../../types.js';
 import { mountMcpForCodexAppServer } from '../../providers/mcp-runtime-mounting.js';
 import { assertMcpSecretReferencesReady } from '../../providers/mcp-config.js';
-import { buildSummary, enrichSkillEvents, extractSkillNameFromPath, inferCodexExecAction, } from '../../tool-events.js';
+import { enrichSkillEvents, } from '../../tool-events.js';
+import { collectSensitiveEnvValues, sanitizePersistenceValue, } from '../../tool-event-results.js';
 import { requireAskBusForLiveBatches } from '../../sdk/ask-bus/bus.js';
+import { attachTurnResultSensitiveValues } from '../../sdk/turn-result-secrets.js';
+import { attachToolEventSensitiveValues } from '../../sdk/tool-event-secrets.js';
 import { toAskUserToolEvent } from '../../sdk/ask-bus/projection.js';
 import { decideMcpToolCall } from '../../sdk/mcp-safety.js';
-import { attachOriginalMcpInput } from '../../sdk/mcp-event-input.js';
 import { spawnAppServerTransport, } from './transport.js';
 import { normalizeUpstreamQuestion, toWireAnswerMap, } from './wire-translators.js';
 import { extractTurnCompletionFailure } from './turn-completion.js';
 import { resolveCodexModel } from '../codex-model.js';
 import { CodexMcpApprovalCorrelator, extractMcpToolApprovalRequest, hasScriptedApprovalPolicy, isMcpToolCallApprovalRequest, recordPolicyDeniedMcpToolCall } from './mcp-approval-correlator.js';
+import { projectItemIntoTurn } from './item-projection.js';
+import { CodexItemLifecycle, } from './item-lifecycle.js';
+import { createCodexManagedAuth } from './managed-auth.js';
 const TURN_COMPLETED_METHOD = 'turn/completed';
-function recordFromUnknown(value) {
-    if (value && typeof value === 'object' && !Array.isArray(value)) {
-        return value;
-    }
-    return {};
-}
-function extractCommandActionSkillName(action) {
-    if (typeof action.path === 'string') {
-        const direct = extractSkillNameFromPath(action.path);
-        if (direct)
-            return direct;
-        const embedded = extractSkillNameFromText(action.path);
-        if (embedded)
-            return embedded;
-    }
-    return typeof action.command === 'string' ? extractSkillNameFromText(action.command) : undefined;
-}
-function extractSkillNameFromText(value) {
-    if (!value)
-        return undefined;
-    return value.match(/(?:^|[/\s"'])\.(?:agents|claude)\/skills\/([^/\s"']+)\/SKILL\.md(?:$|[\s"'])/)?.[1];
-}
-function extractSkillPathFromText(value) {
-    if (!value)
-        return undefined;
-    return value.match(/(?:^|[\s"'])(?<path>(?:\/|\.{1,2}\/)?[^\s"']*(?:\.agents|\.claude)\/skills\/[^/\s"']+\/SKILL\.md)(?:$|[\s"'])/)?.groups?.path;
-}
-function projectItemIntoTurn(item, turn) {
-    if (item.type === 'agentMessage') {
-        const msg = item;
-        if (msg.text) {
-            turn.assistantMessageParts.push(msg.text);
-        }
-        return;
-    }
-    if (item.type === 'commandExecution') {
-        const cmd = item;
-        const action = inferCodexExecAction(cmd.command);
-        const skillPath = extractSkillPathFromText(cmd.command);
-        const args = {
-            command: cmd.command,
-            ...(skillPath ? { path: skillPath } : {}),
-        };
-        turn.nonAskToolEvents.push({
-            action,
-            provider: 'codex',
-            providerToolName: 'commandExecution',
-            turnNumber: turn.turnNumber,
-            arguments: args,
-            summary: buildSummary(action, 'commandExecution', args),
-            confidence: 'high',
-            rawSnippet: JSON.stringify(cmd),
-        });
-        const recordedSkills = new Set();
-        for (const action of cmd.commandActions ?? []) {
-            const skillName = extractCommandActionSkillName(action) ?? extractSkillNameFromText(cmd.command);
-            if (!skillName || recordedSkills.has(skillName))
-                continue;
-            recordedSkills.add(skillName);
-            turn.nonAskToolEvents.push({
-                action: 'use_skill',
-                provider: 'codex',
-                providerToolName: `commandExecution.commandActions.${action.type ?? 'unknown'}`,
-                turnNumber: turn.turnNumber,
-                arguments: { path: action.path, name: action.name },
-                summary: `use_skill ${skillName}`,
-                confidence: 'high',
-                rawSnippet: JSON.stringify(action),
-                skillName,
-            });
-        }
-        return;
-    }
-    if (item.type === 'fileChange') {
-        const fc = item;
-        for (const change of fc.changes ?? []) {
-            turn.nonAskToolEvents.push({
-                action: 'edit_file',
-                provider: 'codex',
-                providerToolName: 'fileChange',
-                turnNumber: turn.turnNumber,
-                arguments: { file_path: change.path },
-                summary: `edit_file: ${change.path}`,
-                confidence: 'high',
-                rawSnippet: JSON.stringify(change),
-            });
-        }
-        return;
-    }
-    if (item.type === 'mcpToolCall') {
-        const call = item;
-        if (turn.nonAskToolEvents.some((event) => event.action === 'mcp_tool_call'
-            && event.toolUseId === call.id && event.mcp?.invocation === 'not_invoked'))
-            return;
-        const args = recordFromUnknown(call.arguments);
-        const providerToolName = `${call.server}.${call.tool}`;
-        turn.nonAskToolEvents.push(attachOriginalMcpInput({
-            action: 'mcp_tool_call',
-            provider: 'codex',
-            providerToolName,
-            toolUseId: call.id,
-            turnNumber: turn.turnNumber,
-            arguments: {
-                ...args,
-                server: call.server,
-                tool: call.tool,
-                status: call.status ?? 'unknown',
-            },
-            summary: `MCP tool ${providerToolName} ${call.status ?? 'unknown'}`,
-            confidence: 'high',
-            rawSnippet: JSON.stringify(call),
-            ...(call.result !== undefined ? { result: { content: JSON.stringify(call.result) } } : {}),
-        }, args));
-        return;
-    }
-}
 function projectMcpStartupStatusIntoTurn(params, turn) {
     const name = params.name ?? 'unknown';
     const status = params.status ?? 'unknown';
@@ -156,6 +45,18 @@ function failTurn(turn, message) {
     turn.failureMessage = message;
     turn.signalFailure?.(message);
 }
+function extractTurnCompletionIdentity(params) {
+    if (!params || typeof params !== 'object' || Array.isArray(params))
+        return {};
+    const record = params;
+    const turnId = typeof record.turn?.id === 'string'
+        ? record.turn.id
+        : typeof record.turnId === 'string' ? record.turnId : undefined;
+    return {
+        ...(typeof record.threadId === 'string' ? { threadId: record.threadId } : {}),
+        ...(turnId ? { turnId } : {}),
+    };
+}
 function isLiveMcpSafetyMode(options) {
     const runMode = options?.runMode ?? 'mock';
     return runMode === 'live-readonly' || runMode === 'live-sandbox' || runMode === 'live';
@@ -170,6 +71,7 @@ export class CodexAppServerAgent extends BaseAgent {
         const askBus = requireAskBusForLiveBatches(options, 'CodexAppServerAgent');
         const workspacePath = getWorkspacePath(runtime);
         const runtimeEnv = getRuntimeEnv(runtime);
+        const sensitiveValues = collectSensitiveEnvValues(runtimeEnv);
         const model = resolveCodexModel(options?.model);
         const sandboxMode = this.deps.sandboxMode ?? 'workspace-write';
         let handle = null;
@@ -179,6 +81,12 @@ export class CodexAppServerAgent extends BaseAgent {
         let activeTurn = null;
         let disposed = false;
         let codexUserAgent = 'unknown';
+        const managedAuth = createCodexManagedAuth({
+            enabled: !runtimeEnv.OPENAI_API_KEY && !runtimeEnv.OPENAI_BASE_URL
+                && (this.deps.authBroker !== undefined || this.deps.createTransport === undefined),
+            ...(this.deps.authBroker ? { broker: this.deps.authBroker } : {}),
+            ...(runtimeEnv.CODEX_HOME ? { codexHome: runtimeEnv.CODEX_HOME } : {}),
+        });
         const scriptedHost = options?.scriptedMcpHost;
         const correlator = scriptedHost
             ? new CodexMcpApprovalCorrelator(scriptedHost, () => turnCounter, () => threadId, () => options?.getRemainingMs?.() ?? Number.POSITIVE_INFINITY)
@@ -191,8 +99,9 @@ export class CodexAppServerAgent extends BaseAgent {
             const factory = this.deps.createTransport
                 ?? (async (ctx) => spawnAppServerTransport({ cwd: ctx.workspacePath, env: ctx.env,
                     args: scriptedHost ? ['--enable', 'tool_call_mcp_elicitation'] : [] }));
-            handle = await factory({ workspacePath, env: runtimeEnv });
-            const transport = handle.transport;
+            const spawnedHandle = await factory({ workspacePath, env: runtimeEnv });
+            handle = spawnedHandle;
+            const transport = spawnedHandle.transport;
             transport.onServerRequest((req) => this.dispatchServerRequest(req, {
                 transport,
                 askBus,
@@ -201,13 +110,15 @@ export class CodexAppServerAgent extends BaseAgent {
                 mcpSafety: options?.mcpSafety,
                 scriptedHost,
                 correlator,
+                managedAuth,
             }));
             transport.onClose((info) => {
                 closeInfo = info;
             });
             transport.onNotification((n) => {
                 if (process.env.PATHGRADE_CODEX_DEBUG) {
-                    console.error(`[codex app-server] notification method=${n.method} params=${JSON.stringify(n.params).slice(0, 300)}`);
+                    const debugParams = sanitizePersistenceValue(n.params, sensitiveValues);
+                    console.error(`[codex app-server] notification method=${n.method} params=${JSON.stringify(debugParams).slice(0, 300)}`);
                 }
                 if (n.method === 'mcpServer/startupStatus/updated') {
                     const turn = activeTurn;
@@ -221,37 +132,36 @@ export class CodexAppServerAgent extends BaseAgent {
                     return;
                 const params = n.params;
                 if (n.method === 'item/started') {
-                    try {
-                        correlator?.started(n.params);
-                    }
-                    catch (error) {
-                        failTurn(turn, error instanceof Error ? error.message : String(error));
-                    }
+                    if (params)
+                        turn.itemLifecycle?.receiveStarted(params);
                     return;
                 }
                 if (n.method !== 'item/completed')
                     return;
-                if (!params?.item)
-                    return;
-                try {
-                    if (correlator?.completed(params) !== false)
-                        projectItemIntoTurn(params.item, turn);
-                }
-                catch (error) {
-                    failTurn(turn, error instanceof Error ? error.message : String(error));
-                }
+                if (params)
+                    turn.itemLifecycle?.receiveCompleted(params);
             });
-            const initialized = await transport.sendRequest('initialize', {
-                clientInfo: { name: 'pathgrade', version: '0.5.0', title: null },
-                capabilities: { experimentalApi: true, optOutNotificationMethods: null },
+            const initialize = async () => {
+                const initialized = await transport.sendRequest('initialize', {
+                    clientInfo: { name: 'pathgrade', version: '0.5.0', title: null },
+                    capabilities: { experimentalApi: true, optOutNotificationMethods: null },
+                });
+                if (typeof initialized.userAgent === 'string') {
+                    codexUserAgent = initialized.userAgent.slice(0, 200);
+                }
+                // Upstream ClientNotification = { method: "initialized" }: send it
+                // before any thread/start so the handshake matches the v0.124
+                // contract and is forward-compatible with servers that enforce it.
+                transport.sendNotification('initialized', null);
+                await managedAuth.login(transport);
+                return transport;
+            };
+            return initialize().catch(async (error) => {
+                if (handle === spawnedHandle)
+                    handle = null;
+                await spawnedHandle.close().catch(() => undefined);
+                throw error;
             });
-            if (typeof initialized.userAgent === 'string')
-                codexUserAgent = initialized.userAgent.slice(0, 200);
-            // Upstream ClientNotification = { method: "initialized" }: send it
-            // before any thread/start so the handshake matches the v0.124
-            // contract and is forward-compatible with servers that enforce it.
-            transport.sendNotification('initialized', null);
-            return transport;
         };
         const runTurn = async (message) => {
             const t = await ensureTransport();
@@ -262,6 +172,7 @@ export class CodexAppServerAgent extends BaseAgent {
                 nonAskToolEvents: [],
                 assistantMessageParts: [],
                 turnFailed: false,
+                pendingTurnCompletions: [],
             };
             activeTurn = turn;
             correlator?.beginTurn();
@@ -286,6 +197,31 @@ export class CodexAppServerAgent extends BaseAgent {
                     }
                     threadId = resp.thread.id;
                 }
+                const authoritativeThreadId = threadId;
+                turn.authoritativeThreadId = authoritativeThreadId;
+                turn.itemLifecycle = new CodexItemLifecycle({
+                    threadId: authoritativeThreadId,
+                    clock: this.deps.clock,
+                    onFailure: (message) => failTurn(turn, message),
+                    onStarted: (params) => {
+                        try {
+                            correlator?.started(params);
+                        }
+                        catch (error) {
+                            failTurn(turn, error instanceof Error ? error.message : String(error));
+                        }
+                    },
+                    onCompleted: (item, timing, params) => {
+                        try {
+                            if (correlator?.completed(params) !== false) {
+                                projectItemIntoTurn(item, turn, sensitiveValues, timing);
+                            }
+                        }
+                        catch (error) {
+                            failTurn(turn, error instanceof Error ? error.message : String(error));
+                        }
+                    },
+                });
                 // Wait for TurnCompleted OR subprocess crash OR dispatcher failure.
                 const turnCompletion = new Promise((resolve, reject) => {
                     let settled = false;
@@ -293,15 +229,30 @@ export class CodexAppServerAgent extends BaseAgent {
                         if (settled)
                             return;
                         if (n.method === TURN_COMPLETED_METHOD) {
-                            settled = true;
-                            off();
-                            closeOff();
-                            const failure = extractTurnCompletionFailure(n.params);
-                            if (failure)
-                                Object.assign(turn, { turnFailed: true, failureMessage: failure });
-                            resolve();
+                            turn.acceptTurnCompletion?.(n.params);
                         }
                     });
+                    const acceptTurnCompletion = (params) => {
+                        if (settled)
+                            return;
+                        const identity = extractTurnCompletionIdentity(params);
+                        if (identity.threadId && identity.threadId !== turn.authoritativeThreadId)
+                            return;
+                        if (identity.turnId && !turn.authoritativeTurnId) {
+                            turn.pendingTurnCompletions.push(params);
+                            return;
+                        }
+                        if (identity.turnId && identity.turnId !== turn.authoritativeTurnId)
+                            return;
+                        settled = true;
+                        off();
+                        closeOff();
+                        const failure = extractTurnCompletionFailure(params);
+                        if (failure)
+                            Object.assign(turn, { turnFailed: true, failureMessage: failure });
+                        resolve();
+                    };
+                    turn.acceptTurnCompletion = acceptTurnCompletion;
                     const closeOff = t.onClose((info) => {
                         if (settled)
                             return;
@@ -339,9 +290,25 @@ export class CodexAppServerAgent extends BaseAgent {
                         }
                     }
                 });
-                const startTurnResp = t.sendRequest('turn/start', {
+                const authoritativeTurn = t.sendRequest('turn/start', {
                     threadId,
                     input: [{ type: 'text', text: message, text_elements: [] }],
+                })
+                    .then((started) => {
+                    const authoritativeTurnId = started.turn?.id ?? started.turnId;
+                    if (!authoritativeTurnId) {
+                        scriptedHost?.failProtocol('turn/start did not return an authoritative turn id');
+                        turn.signalFailure?.('turn/start did not return an authoritative turn id');
+                        return;
+                    }
+                    turn.itemLifecycle?.setAuthoritativeTurn(authoritativeTurnId);
+                    turn.authoritativeTurnId = authoritativeTurnId;
+                    if (correlator?.setAuthoritativeTurn(authoritativeThreadId, authoritativeTurnId) === false) {
+                        turn.signalFailure?.('MCP lifecycle did not match the authoritative turn');
+                    }
+                    for (const pending of turn.pendingTurnCompletions.splice(0)) {
+                        turn.acceptTurnCompletion?.(pending);
+                    }
                 })
                     .catch((err) => {
                     // A JSON-RPC error on turn/start means the server will
@@ -355,18 +322,6 @@ export class CodexAppServerAgent extends BaseAgent {
                             : 'turn/start failed';
                     turn.signalFailure?.(msg);
                 });
-                if (scriptedHost) {
-                    const started = await startTurnResp;
-                    if (!started?.turn?.id || !threadId) {
-                        scriptedHost.failProtocol('turn/start did not return an authoritative turn id');
-                        turn.signalFailure?.('turn/start did not return an authoritative turn id');
-                    }
-                    else {
-                        if (correlator?.setAuthoritativeTurn(threadId, started.turn.id) === false) {
-                            turn.signalFailure?.('MCP lifecycle did not match the authoritative turn');
-                        }
-                    }
-                }
                 try {
                     await turnCompletion;
                 }
@@ -379,16 +334,25 @@ export class CodexAppServerAgent extends BaseAgent {
                         message: info.message ?? 'app-server exited',
                         pid: info.pid,
                         signal: info.signal,
+                        sensitiveValues,
                     });
                 }
-                if (!scriptedHost)
-                    void startTurnResp;
                 if (turn.turnFailed) {
                     return assembleTurnResult({
                         askBus,
                         activeTurn: turn,
                         exitCode: 1,
                         message: turn.failureMessage ?? 'turn failed',
+                        sensitiveValues,
+                    });
+                }
+                // Ensure pre-response lifecycle notifications have been correlated
+                // and projected before exposing the successful turn result.
+                await authoritativeTurn;
+                if (turn.turnFailed) {
+                    return assembleTurnResult({
+                        askBus, activeTurn: turn, exitCode: 1,
+                        message: turn.failureMessage ?? 'turn failed', sensitiveValues,
                     });
                 }
                 return assembleTurnResult({
@@ -396,6 +360,7 @@ export class CodexAppServerAgent extends BaseAgent {
                     activeTurn: turn,
                     exitCode: 0,
                     message: turn.assistantMessageParts.join('\n\n'),
+                    sensitiveValues,
                 });
             }
             finally {
@@ -516,11 +481,11 @@ export class CodexAppServerAgent extends BaseAgent {
                 }
                 return;
             case 'account/chatgptAuthTokens/refresh': {
-                const message = 'codex app-server requires OPENAI_API_KEY for pathgrade and honors OPENAI_BASE_URL when set; ChatGPT/cached auth unsupported under transport=app-server';
-                transport.sendErrorResponse(req.id, -32001, message);
-                const turn = activeTurn();
-                if (turn)
-                    failTurn(turn, message);
+                ctx.managedAuth.respondToRefresh(req.id, transport, (message) => {
+                    const turn = activeTurn();
+                    if (turn)
+                        failTurn(turn, message);
+                });
                 return;
             }
             default:
@@ -577,14 +542,15 @@ function buildThreadStartParams(opts) {
     };
 }
 function assembleTurnResult(args) {
-    const { askBus, activeTurn, exitCode, message, pid, signal } = args;
+    const { askBus, activeTurn, exitCode, message, pid, signal, sensitiveValues = [] } = args;
     const askBatchIds = new Set(activeTurn.askBatchIds);
     const askEvents = askBus
         .snapshot()
         .filter((s) => askBatchIds.has(s.batchId))
         .map((s) => toAskUserToolEvent(s));
-    const toolEvents = enrichSkillEvents([...askEvents, ...activeTurn.nonAskToolEvents]);
-    const rawOutput = exitCode === 0
+    const toolEvents = enrichSkillEvents([...askEvents, ...activeTurn.nonAskToolEvents])
+        .map((event) => attachToolEventSensitiveValues(event, sensitiveValues));
+    const rawOutput = sanitizePersistenceValue(exitCode === 0
         ? message
         : [
             message,
@@ -593,8 +559,8 @@ function assembleTurnResult(args) {
             `exitCode=${exitCode}`,
         ]
             .filter(Boolean)
-            .join(' ');
-    return {
+            .join(' '), sensitiveValues);
+    return attachTurnResultSensitiveValues({
         rawOutput,
         assistantMessage: exitCode === 0 ? message : '',
         visibleAssistantMessage: exitCode === 0 ? message : '',
@@ -611,5 +577,5 @@ function assembleTurnResult(args) {
                 },
             }
             : {}),
-    };
+    }, sensitiveValues);
 }

package/dist/agents/codex-app-server/item-lifecycle.d.ts

@@ -0,0 +1,30 @@
+import type { CodexItem, ItemTiming } from './item-projection.js';
+export interface ItemLifecycleParams {
+    item?: CodexItem;
+    threadId?: string;
+    turnId?: string;
+}
+export interface LifecycleClock {
+    wallNow(): number;
+    monotonicNow(): number;
+}
+export declare class CodexItemLifecycle {
+    private readonly options;
+    private turnId?;
+    private readonly pending;
+    private readonly started;
+    private readonly completed;
+    constructor(options: {
+        threadId: string;
+        clock?: LifecycleClock;
+        onStarted?: (params: ItemLifecycleParams) => void;
+        onCompleted: (item: CodexItem, timing: ItemTiming, params: ItemLifecycleParams) => void;
+        onFailure: (message: string) => void;
+    });
+    receiveStarted(params: ItemLifecycleParams): void;
+    receiveCompleted(params: ItemLifecycleParams): void;
+    setAuthoritativeTurn(turnId: string): boolean;
+    private receive;
+    private validateEnvelope;
+    private process;
+}

package/dist/agents/codex-app-server/item-lifecycle.js

@@ -0,0 +1,95 @@
+import { performance } from 'node:perf_hooks';
+import { canonicalizeJson } from '../../core/canonical-json.js';
+export class CodexItemLifecycle {
+    options;
+    turnId;
+    pending = [];
+    started = new Map();
+    completed = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    receiveStarted(params) {
+        this.receive('started', params);
+    }
+    receiveCompleted(params) {
+        this.receive('completed', params);
+    }
+    setAuthoritativeTurn(turnId) {
+        if (!turnId) {
+            this.options.onFailure('turn/start did not return an authoritative turn id');
+            return false;
+        }
+        if (this.turnId && this.turnId !== turnId) {
+            this.options.onFailure('turn/start returned conflicting authoritative turn ids');
+            return false;
+        }
+        this.turnId = turnId;
+        for (const entry of this.pending.splice(0))
+            this.process(entry.phase, entry.receipt);
+        return true;
+    }
+    receive(phase, params) {
+        const clock = this.options.clock ?? DEFAULT_CLOCK;
+        const receipt = { params, wallMs: clock.wallNow(), monotonicMs: clock.monotonicNow() };
+        if (!this.validateEnvelope(params))
+            return;
+        if (!this.turnId) {
+            this.pending.push({ phase, receipt });
+            return;
+        }
+        this.process(phase, receipt);
+    }
+    validateEnvelope(params) {
+        if (!params.item || typeof params.item.id !== 'string' || !params.item.id
+            || typeof params.threadId !== 'string' || !params.threadId
+            || typeof params.turnId !== 'string' || !params.turnId) {
+            this.options.onFailure('Codex item lifecycle notification is missing threadId, turnId, or item.id');
+            return false;
+        }
+        // Notifications for an earlier thread are stale, not failures of this turn.
+        return params.threadId === this.options.threadId;
+    }
+    process(phase, receipt) {
+        const { params } = receipt;
+        if (params.turnId !== this.turnId || !params.item || typeof params.item.id !== 'string')
+            return;
+        const itemId = params.item.id;
+        const fingerprint = canonicalizeJson(params.item);
+        if (phase === 'started') {
+            const prior = this.started.get(itemId);
+            if (prior) {
+                if (prior.fingerprint !== fingerprint) {
+                    this.options.onFailure(`Conflicting item/started notification for item ${itemId}`);
+                }
+                return;
+            }
+            if (this.completed.has(itemId)) {
+                this.options.onFailure(`item/started arrived after item/completed for item ${itemId}`);
+                return;
+            }
+            this.started.set(itemId, { ...receipt, fingerprint });
+            this.options.onStarted?.(params);
+            return;
+        }
+        const priorTerminal = this.completed.get(itemId);
+        if (priorTerminal !== undefined) {
+            if (priorTerminal !== fingerprint) {
+                this.options.onFailure(`Conflicting item/completed notification for item ${itemId}`);
+            }
+            return;
+        }
+        this.completed.set(itemId, fingerprint);
+        const start = this.started.get(itemId);
+        this.started.delete(itemId);
+        this.options.onCompleted(params.item, {
+            ...(start ? { startedAtWallMs: start.wallMs } : {}),
+            completedAtWallMs: receipt.wallMs,
+            ...(start ? { observedDurationMs: Math.max(0, receipt.monotonicMs - start.monotonicMs) } : {}),
+        }, params);
+    }
+}
+const DEFAULT_CLOCK = {
+    wallNow: () => Date.now(),
+    monotonicNow: () => performance.now(),
+};

package/dist/agents/codex-app-server/item-projection.d.ts

@@ -0,0 +1,62 @@
+import { type ToolEvent } from '../../tool-events.js';
+export interface CodexTurnProjection {
+    turnNumber: number;
+    nonAskToolEvents: ToolEvent[];
+    assistantMessageParts: string[];
+}
+interface CodexCommandExecutionAction {
+    type?: string;
+    name?: string;
+    path?: string;
+    command?: string;
+}
+interface CodexCommandExecutionItem {
+    type: 'commandExecution';
+    id: string;
+    command: string;
+    status?: 'inProgress' | 'completed' | 'failed' | 'declined';
+    cwd?: string;
+    commandActions?: CodexCommandExecutionAction[];
+    aggregatedOutput?: string | null;
+    exitCode?: number | null;
+    durationMs?: number | null;
+}
+interface CodexMcpToolCallItem {
+    type: 'mcpToolCall';
+    id: string;
+    server: string;
+    tool: string;
+    status?: string;
+    arguments?: unknown;
+    result?: unknown;
+    error?: {
+        message?: string;
+    } | null;
+    durationMs?: number | null;
+}
+export type CodexItem = {
+    type: 'agentMessage';
+    id: string;
+    text: string;
+    phase?: string;
+} | CodexCommandExecutionItem | {
+    type: 'fileChange';
+    id: string;
+    changes: Array<{
+        path: string;
+        kind?: unknown;
+        diff?: string;
+    }>;
+} | CodexMcpToolCallItem | {
+    type: string;
+    id?: string;
+};
+export interface ItemTiming {
+    startedAtWallMs?: number;
+    completedAtWallMs?: number;
+    observedDurationMs?: number;
+}
+export declare function projectItemIntoTurn(item: CodexItem, turn: CodexTurnProjection, sensitiveValues: readonly string[], timing?: ItemTiming): void;
+/** Provider duration is authoritative; observed monotonic duration is the fallback. */
+export declare function projectToolTiming(timing: ItemTiming, providerDurationMs: number | undefined): Pick<ToolEvent, 'startedAt' | 'completedAt' | 'durationMs'>;
+export {};