@wix/pathgrade 1.0.17 → 1.0.19

package/dist/openai-oauth/chatgpt-oauth-llm.js

@@ -0,0 +1,398 @@
+import { CodexAuthBrokerError, createCodexAuthBroker, } from './codex-auth-broker.js';
+const CORE_VERSION = '2.0.0';
+const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
+export class ChatGptOAuthJudgeError extends Error {
+    code;
+    constructor(code, message = code) {
+        super(message);
+        this.code = code;
+        this.name = 'ChatGptOAuthJudgeError';
+    }
+}
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const oauthError = (code) => new ChatGptOAuthJudgeError(code);
+const mapBrokerError = (error) => {
+    if (error instanceof ChatGptOAuthJudgeError)
+        return error;
+    if (error instanceof CodexAuthBrokerError)
+        return oauthError(error.code);
+    if (error instanceof Error && error.name === 'AbortError')
+        return oauthError('OAUTH_REQUEST_TIMEOUT');
+    return oauthError('OAUTH_CODEX_UNAVAILABLE');
+};
+const normalizeProfile = (options) => {
+    if (options.model.trim().length === 0 ||
+        !['low', 'medium', 'high'].includes(options.reasoningEffort)) {
+        throw oauthError('OAUTH_CONFIG_INVALID');
+    }
+    const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    if (!Number.isFinite(requestTimeoutMs) || !Number.isInteger(requestTimeoutMs) || requestTimeoutMs <= 0) {
+        throw oauthError('OAUTH_CONFIG_INVALID');
+    }
+    return Object.freeze({
+        model: options.model,
+        reasoningEffort: options.reasoningEffort,
+        requestTimeoutMs,
+    });
+};
+const loadCore = async () => {
+    try {
+        return await import('@openai-oauth/core');
+    }
+    catch {
+        throw new ChatGptOAuthJudgeError('OAUTH_DEPENDENCY_UNAVAILABLE', `OAUTH_DEPENDENCY_UNAVAILABLE: install @openai-oauth/core@${CORE_VERSION}`);
+    }
+};
+const createBoundedFetch = (timeoutMs, sourceFetch = globalThis.fetch) => async (input, init) => {
+    if (typeof sourceFetch !== 'function') {
+        throw oauthError('OAUTH_UPSTREAM_FAILED');
+    }
+    const timeoutController = new AbortController();
+    const timeout = setTimeout(() => timeoutController.abort(), timeoutMs);
+    timeout.unref?.();
+    const signal = init?.signal
+        ? AbortSignal.any([init.signal, timeoutController.signal])
+        : timeoutController.signal;
+    try {
+        return await sourceFetch(input, { ...init, signal });
+    }
+    catch (error) {
+        if (error instanceof ChatGptOAuthJudgeError ||
+            (error instanceof Error && error.name === 'AbortError')) {
+            throw error;
+        }
+        throw oauthError('OAUTH_UPSTREAM_FAILED');
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+};
+const classifyStatus = (status) => {
+    if (status === 401 || status === 403)
+        return oauthError('OAUTH_CODEX_LOGIN_REQUIRED');
+    if (status === 429)
+        return oauthError('OAUTH_UPSTREAM_RATE_LIMITED');
+    return oauthError('OAUTH_UPSTREAM_FAILED');
+};
+const assertModel = (profile, requested) => {
+    if (requested !== undefined && requested !== profile.model) {
+        throw oauthError('OAUTH_MODEL_MISMATCH');
+    }
+};
+const requestBody = (profile, input, instructions, tools) => ({
+    model: profile.model,
+    reasoning: { effort: profile.reasoningEffort },
+    instructions,
+    input,
+    ...(tools === undefined ? {} : {
+        tools,
+        tool_choice: tools.length === 0 ? 'none' : 'auto',
+        parallel_tool_calls: true,
+    }),
+});
+const toResponsesInput = (messages) => {
+    const input = [];
+    for (const message of messages) {
+        if (typeof message.content === 'string') {
+            input.push({
+                role: message.role,
+                content: [{
+                        type: message.role === 'assistant' ? 'output_text' : 'input_text',
+                        text: message.content,
+                    }],
+            });
+            continue;
+        }
+        let text = [];
+        const flushText = () => {
+            if (text.length === 0)
+                return;
+            input.push({
+                role: message.role,
+                content: text.map((block) => ({
+                    type: message.role === 'assistant' ? 'output_text' : 'input_text',
+                    text: block.text,
+                })),
+            });
+            text = [];
+        };
+        for (const block of message.content) {
+            if (block.type === 'text') {
+                text.push(block);
+                continue;
+            }
+            flushText();
+            if (block.type === 'tool_use') {
+                if (message.role !== 'assistant' || block.id.length === 0 || block.name.length === 0 ||
+                    !isRecord(block.input)) {
+                    throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+                }
+                input.push({
+                    type: 'function_call', call_id: block.id,
+                    name: block.name, arguments: JSON.stringify(block.input),
+                });
+            }
+            else if (block.type === 'tool_result') {
+                if (message.role !== 'user' || block.tool_use_id.length === 0) {
+                    throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+                }
+                input.push({
+                    type: 'function_call_output', call_id: block.tool_use_id,
+                    output: block.content,
+                });
+            }
+        }
+        flushText();
+    }
+    return input;
+};
+const safeToken = (value) => Number.isInteger(value) && value >= 0 ? value : undefined;
+const parseResponse = async (response) => {
+    if (!response.ok)
+        throw classifyStatus(response.status);
+    try {
+        const parsed = await response.json();
+        if (!isRecord(parsed) || parsed.status !== 'completed' || !Array.isArray(parsed.output)) {
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        }
+        for (const item of parsed.output)
+            validateOutputItem(item);
+        return parsed;
+    }
+    catch (error) {
+        if (error instanceof ChatGptOAuthJudgeError)
+            throw error;
+        throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+    }
+};
+const validateOutputItem = (value) => {
+    if (!isRecord(value) || !['reasoning', 'message', 'function_call'].includes(String(value.type))) {
+        throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+    }
+    if (value.type === 'function_call') {
+        if (value.status !== undefined && value.status !== 'completed') {
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        }
+        return;
+    }
+    if (value.type === 'reasoning')
+        return;
+    if (value.role !== 'assistant' || !Array.isArray(value.content)) {
+        throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+    }
+    for (const content of value.content) {
+        if (!isRecord(content) || content.type !== 'output_text' || typeof content.text !== 'string') {
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        }
+    }
+};
+const outputText = (result) => (result.output ?? []).flatMap((item) => Array.isArray(item.content) ? item.content : [])
+    .filter((item) => isRecord(item) && item.type === 'output_text')
+    .map((item) => typeof item.text === 'string' ? item.text : '')
+    .join('');
+const toolBlocks = (result, allowedNames) => {
+    const seenIds = new Set();
+    return (result.output ?? [])
+        .filter((item) => item.type === 'function_call')
+        .map((item) => {
+        if (typeof item.call_id !== 'string' || item.call_id.length === 0 ||
+            typeof item.name !== 'string' || item.name.length === 0 ||
+            !allowedNames.has(item.name) || typeof item.arguments !== 'string' ||
+            seenIds.has(item.call_id)) {
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        }
+        seenIds.add(item.call_id);
+        let input;
+        try {
+            input = JSON.parse(item.arguments);
+        }
+        catch {
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        }
+        if (!isRecord(input))
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        return { type: 'tool_use', id: item.call_id, name: item.name, input };
+    });
+};
+export function createChatGptOAuthJudgeLLM(options) {
+    return createChatGptOAuthJudgeLLMWithDependencies(options);
+}
+/** Internal deterministic seam; intentionally omitted from the package subpath exports. */
+export function createChatGptOAuthJudgeLLMWithDependencies(options, dependencies = {}) {
+    const profile = normalizeProfile(options);
+    const boundedFetch = createBoundedFetch(profile.requestTimeoutMs, dependencies.fetch);
+    let corePromise;
+    let brokerPromise;
+    let session;
+    let sessionGeneration = 0;
+    let acquirePromise;
+    let refreshPromise;
+    let transportPromise;
+    let preflight;
+    let inputTokens = 0;
+    let outputTokens = 0;
+    const core = () => corePromise ??= (dependencies.loadCore ?? loadCore)();
+    const broker = () => brokerPromise ??= dependencies.broker
+        ? Promise.resolve(dependencies.broker)
+        : core().then((loaded) => createCodexAuthBroker({
+            ...(dependencies.codexBinary !== undefined ? { binary: dependencies.codexBinary } : {}),
+            ...(dependencies.codexEnv !== undefined ? { env: dependencies.codexEnv } : {}),
+            ...(dependencies.authTimeoutMs !== undefined ? { authTimeoutMs: dependencies.authTimeoutMs } : {}),
+            deriveAccountId: loaded.deriveAccountId,
+            deriveIsFedRamp: loaded.deriveChatGptAccountIsFedRamp,
+        }));
+    const getSession = async () => {
+        if (session)
+            return session;
+        acquirePromise ??= broker()
+            .then((value) => value.acquireAccessSession({ refresh: false }))
+            .then((value) => {
+            session = value;
+            sessionGeneration += 1;
+            return value;
+        })
+            .catch((error) => { throw mapBrokerError(error); })
+            .finally(() => { acquirePromise = undefined; });
+        return acquirePromise;
+    };
+    const refreshAfterUnauthorized = async (staleGeneration) => {
+        if (session && sessionGeneration !== staleGeneration)
+            return session;
+        refreshPromise ??= broker()
+            .then((value) => value.acquireAccessSession({ refresh: true }))
+            .then((value) => {
+            session = value;
+            sessionGeneration += 1;
+            // The core transport caches its model catalog by account. A catalog
+            // request made with an expired token can therefore cache the failure;
+            // rebuild it after refresh so the retry uses both the new token and a
+            // fresh catalog resolver.
+            transportPromise = undefined;
+            return value;
+        })
+            .catch((error) => { throw mapBrokerError(error); })
+            .finally(() => { refreshPromise = undefined; });
+        return refreshPromise;
+    };
+    const transport = () => transportPromise ??= core().then((loaded) => loaded.createOpenAIOAuthTransport({
+        auth: getSession,
+        codexVersion: '0.144.1',
+        fetch: boundedFetch,
+        responsesState: false,
+    }));
+    const requestWithAuthRetry = async (path, init, refreshStatuses = [401]) => {
+        await getSession();
+        const generation = sessionGeneration;
+        let response = await (await transport()).request(path, init);
+        if (!refreshStatuses.includes(response.status))
+            return response;
+        await refreshAfterUnauthorized(generation);
+        response = await (await transport()).request(path, init);
+        return response;
+    };
+    const ensurePreflight = () => preflight ??= (async () => {
+        const response = await requestWithAuthRetry('/v1/models', {
+            method: 'GET',
+            signal: AbortSignal.timeout(profile.requestTimeoutMs),
+        }, [401, 502]);
+        if (!response.ok)
+            throw classifyStatus(response.status);
+        let parsed;
+        try {
+            parsed = await response.json();
+        }
+        catch {
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        }
+        // @openai-oauth/core normalizes the upstream Codex `models[].slug`
+        // catalog into this OpenAI-compatible `data[].id` response.
+        const compatibleModels = isRecord(parsed) && Array.isArray(parsed.data) ? parsed.data : [];
+        if (!compatibleModels.some((entry) => isRecord(entry) && entry.id === profile.model)) {
+            throw oauthError('OAUTH_MODEL_UNAVAILABLE');
+        }
+    })().catch((error) => {
+        preflight = undefined;
+        if (error instanceof ChatGptOAuthJudgeError)
+            throw error;
+        if (error instanceof Error && error.name === 'AbortError') {
+            throw oauthError('OAUTH_REQUEST_TIMEOUT');
+        }
+        throw oauthError('OAUTH_UPSTREAM_FAILED');
+    });
+    const send = async (body) => {
+        await ensurePreflight();
+        try {
+            const response = await requestWithAuthRetry('/v1/responses', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(profile.requestTimeoutMs),
+            });
+            const result = await parseResponse(response);
+            inputTokens += safeToken(result.usage?.input_tokens) ?? 0;
+            outputTokens += safeToken(result.usage?.output_tokens) ?? 0;
+            return result;
+        }
+        catch (error) {
+            if (error instanceof ChatGptOAuthJudgeError)
+                throw error;
+            if (error instanceof Error && error.name === 'AbortError') {
+                throw oauthError('OAUTH_REQUEST_TIMEOUT');
+            }
+            throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+        }
+    };
+    const port = {
+        get tokenUsage() { return { inputTokens, outputTokens }; },
+        get supportsToolUse() { return true; },
+        async measure(fn) {
+            const beforeInput = inputTokens;
+            const beforeOutput = outputTokens;
+            const result = await fn();
+            return {
+                result,
+                tokens: {
+                    inputTokens: inputTokens - beforeInput,
+                    outputTokens: outputTokens - beforeOutput,
+                },
+                costUsd: 0,
+            };
+        },
+        async call(prompt, callOptions = {}) {
+            assertModel(profile, callOptions.model);
+            const result = await send(requestBody(profile, [{
+                    role: 'user', content: [{ type: 'input_text', text: prompt }],
+                }], ''));
+            if ((result.output ?? []).some((item) => item.type === 'function_call')) {
+                throw oauthError('OAUTH_PROTOCOL_RESPONSE_INVALID');
+            }
+            return {
+                text: outputText(result),
+                inputTokens: safeToken(result.usage?.input_tokens),
+                outputTokens: safeToken(result.usage?.output_tokens),
+                provider: 'openai',
+                model: profile.model,
+            };
+        },
+        async callWithTools(messages, callOptions) {
+            assertModel(profile, callOptions.model);
+            const tools = callOptions.tools.map((tool) => ({
+                type: 'function',
+                name: tool.name,
+                description: tool.description,
+                parameters: tool.input_schema,
+            }));
+            const result = await send(requestBody(profile, toResponsesInput(messages), callOptions.system ?? '', tools));
+            const blocks = toolBlocks(result, new Set(callOptions.tools.map((tool) => tool.name)));
+            const text = outputText(result);
+            const usage = {
+                inputTokens: safeToken(result.usage?.input_tokens),
+                outputTokens: safeToken(result.usage?.output_tokens),
+            };
+            return blocks.length > 0
+                ? { kind: 'tool_use', blocks, text: text || undefined, ...usage }
+                : { kind: 'final', text, ...usage };
+        },
+    };
+    return Object.freeze(port);
+}

package/dist/openai-oauth/codex-auth-broker.d.ts

@@ -0,0 +1,32 @@
+import type { OpenAIOAuthSession } from '@openai-oauth/core';
+import { type AppServerSessionHandle } from '../agents/codex-app-server/transport.js';
+export type CodexAuthBrokerErrorCode = 'OAUTH_CODEX_UNAVAILABLE' | 'OAUTH_CODEX_LOGIN_REQUIRED' | 'OAUTH_AUTH_TIMEOUT';
+export declare class CodexAuthBrokerError extends Error {
+    readonly code: CodexAuthBrokerErrorCode;
+    constructor(code: CodexAuthBrokerErrorCode);
+}
+export interface CodexAuthBroker {
+    acquireAccessSession(input: {
+        refresh: boolean;
+        signal?: AbortSignal;
+    }): Promise<OpenAIOAuthSession>;
+}
+export interface CodexAuthBrokerDependencies {
+    binary?: string;
+    env?: NodeJS.ProcessEnv;
+    authTimeoutMs?: number;
+    spawn?: (input: {
+        binary?: string;
+        env: NodeJS.ProcessEnv;
+    }) => AppServerSessionHandle;
+    deriveAccountId: (token: string | undefined) => string | undefined;
+    deriveIsFedRamp: (token: string | undefined) => boolean;
+}
+export declare const sanitizeCodexAuthEnvironment: (source?: NodeJS.ProcessEnv) => NodeJS.ProcessEnv;
+export declare function createCodexAuthBroker(deps: CodexAuthBrokerDependencies): CodexAuthBroker;
+/** Build the production broker lazily so @openai-oauth/core stays an optional runtime dependency. */
+export declare function createDefaultCodexAuthBroker(input?: {
+    binary?: string;
+    env?: NodeJS.ProcessEnv;
+    authTimeoutMs?: number;
+}): Promise<CodexAuthBroker>;

package/dist/openai-oauth/codex-auth-broker.js

@@ -0,0 +1,110 @@
+import { spawnAppServerTransport, } from '../agents/codex-app-server/transport.js';
+const DEFAULT_AUTH_TIMEOUT_MS = 10_000;
+const AUTH_ENV_ALLOWLIST = new Set([
+    'PATH', 'HOME', 'CODEX_HOME', 'SHELL', 'USER', 'LOGNAME',
+    'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'TMPDIR', 'TMP', 'TEMP',
+    'SYSTEMROOT', 'WINDIR', 'COMSPEC', 'PATHEXT',
+]);
+export class CodexAuthBrokerError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'CodexAuthBrokerError';
+    }
+}
+const brokerError = (code) => new CodexAuthBrokerError(code);
+export const sanitizeCodexAuthEnvironment = (source = process.env) => Object.fromEntries(Object.entries(source).filter(([name]) => AUTH_ENV_ALLOWLIST.has(name.toUpperCase())));
+const abortError = () => new DOMException('Aborted', 'AbortError');
+async function withDeadline(promise, timeoutMs, signal) {
+    if (signal?.aborted)
+        throw abortError();
+    let timeout;
+    let onAbort;
+    const deadline = new Promise((_resolve, reject) => {
+        timeout = setTimeout(() => reject(brokerError('OAUTH_AUTH_TIMEOUT')), timeoutMs);
+        timeout.unref?.();
+        if (signal) {
+            onAbort = () => reject(abortError());
+            signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+    try {
+        return await Promise.race([promise, deadline]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+        if (signal && onAbort)
+            signal.removeEventListener('abort', onAbort);
+    }
+}
+export function createCodexAuthBroker(deps) {
+    const timeoutMs = deps.authTimeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+    const spawn = deps.spawn ?? ((input) => spawnAppServerTransport({
+        ...input,
+        logStderrOnExit: false,
+    }));
+    return {
+        async acquireAccessSession({ refresh, signal }) {
+            let session;
+            try {
+                session = spawn({
+                    ...(deps.binary !== undefined ? { binary: deps.binary } : {}),
+                    env: sanitizeCodexAuthEnvironment(deps.env),
+                });
+                const operation = (async () => {
+                    await session.transport.sendRequest('initialize', {
+                        clientInfo: { name: 'pathgrade-auth', version: '1.0.0', title: null },
+                        capabilities: { experimentalApi: true, optOutNotificationMethods: null },
+                    });
+                    session.transport.sendNotification('initialized', null);
+                    const status = await session.transport.sendRequest('getAuthStatus', {
+                        includeToken: true,
+                        refreshToken: refresh,
+                    });
+                    if (status?.authMethod !== 'chatgpt') {
+                        throw brokerError('OAUTH_CODEX_LOGIN_REQUIRED');
+                    }
+                    if (typeof status.authToken !== 'string' || status.authToken.length === 0) {
+                        throw brokerError('OAUTH_CODEX_LOGIN_REQUIRED');
+                    }
+                    const accountId = deps.deriveAccountId(status.authToken);
+                    if (!accountId)
+                        throw brokerError('OAUTH_CODEX_LOGIN_REQUIRED');
+                    return {
+                        accessToken: status.authToken,
+                        accountId,
+                        isFedRamp: deps.deriveIsFedRamp(status.authToken),
+                    };
+                })();
+                return await withDeadline(operation, timeoutMs, signal);
+            }
+            catch (error) {
+                if (error instanceof CodexAuthBrokerError ||
+                    (error instanceof Error && error.name === 'AbortError')) {
+                    throw error;
+                }
+                throw brokerError('OAUTH_CODEX_UNAVAILABLE');
+            }
+            finally {
+                await session?.close().catch(() => undefined);
+            }
+        },
+    };
+}
+/** Build the production broker lazily so @openai-oauth/core stays an optional runtime dependency. */
+export async function createDefaultCodexAuthBroker(input = {}) {
+    let core;
+    try {
+        core = await import('@openai-oauth/core');
+    }
+    catch {
+        throw brokerError('OAUTH_CODEX_UNAVAILABLE');
+    }
+    return createCodexAuthBroker({
+        ...input,
+        deriveAccountId: core.deriveAccountId,
+        deriveIsFedRamp: core.deriveChatGptAccountIsFedRamp,
+    });
+}

package/dist/openai-oauth/index.d.ts

@@ -0,0 +1,2 @@
+export { ChatGptOAuthJudgeError, createChatGptOAuthJudgeLLM, } from './chatgpt-oauth-llm.js';
+export type { ChatGptOAuthJudgeErrorCode, ChatGptOAuthJudgeOptions, } from './chatgpt-oauth-llm.js';

package/dist/openai-oauth/index.js

@@ -0,0 +1 @@
+export { ChatGptOAuthJudgeError, createChatGptOAuthJudgeLLM, } from './chatgpt-oauth-llm.js';

package/dist/providers/credentials.d.ts

@@ -1,4 +1,4 @@
-import type { AgentName } from '../sdk/types.js';
+import type { AgentName, AgentTransport } from '../sdk/types.js';
 export interface CredentialPorts {
     /** Read a host environment variable. */
     hostEnv(key: string): string | undefined;
@@ -39,10 +39,13 @@ export interface CredentialResult {
     linkFromHome?: string[];
     /** Filtered sensitive files to create inside the isolated HOME. */
     sensitiveHomeFiles?: SensitiveHomeFile[];
+    /** Runtime-only values that persistence sinks must redact. */
+    sensitiveValues?: string[];
 }
 /** Default ports using real process.env, Keychain, and filesystem. */
 export declare function defaultPorts(): CredentialPorts;
 export interface CredentialContext {
     model?: string;
+    transport?: AgentTransport;
 }
 export declare function resolveCredentials(agent: AgentName, userEnv: Record<string, string>, ports?: CredentialPorts, context?: CredentialContext): Promise<CredentialResult>;

package/dist/providers/credentials.js

@@ -61,7 +61,7 @@ export async function resolveCredentials(agent, userEnv, ports, context = {}) {
         case 'claude':
             return resolveClaude(userEnv, p);
         case 'codex':
-            return resolveCodex(userEnv, p);
+            return resolveCodex(userEnv, p, context.transport);
         case 'cursor':
             return resolveCursor(userEnv, p);
         case 'opencode':
@@ -152,6 +152,7 @@ function filterOpenCodeOAuthRecord(raw) {
     const sanitized = { ...record, refresh: OPENCODE_DISABLED_REFRESH_TOKEN };
     return {
         env: {}, setupCommands: [], copyFromHome: [],
+        sensitiveValues: [record.access],
         sensitiveHomeFiles: [{
                 relativePath: path.join('.local', 'share', 'opencode', 'auth.json'),
                 content: JSON.stringify({ openai: sanitized }),
@@ -259,7 +260,7 @@ async function resolveCursor(userEnv, ports) {
     }
     return { env, setupCommands: [], copyFromHome: [], linkFromHome };
 }
-async function resolveCodex(userEnv, ports) {
+async function resolveCodex(userEnv, ports, transport) {
     const env = {};
     const setupCommands = [];
     const copyFromHome = [];
@@ -294,7 +295,7 @@ async function resolveCodex(userEnv, ports) {
             setupCommands.push('if [ ! -d "$HOME/.codex" ] && [ -n "${OPENAI_API_KEY:-}" ]; then printenv OPENAI_API_KEY | codex login --with-api-key >/dev/null 2>&1; fi');
         }
     }
-    else {
+    else if (transport !== 'app-server') {
         // No key — check for cached auth.json
         const authCachePath = path.join(ports.homedir, '.codex', 'auth.json');
         if (await ports.fileExists(authCachePath)) {

package/dist/providers/sandbox.d.ts

@@ -2,6 +2,8 @@ export interface SandboxConfig {
     agent: import('../sdk/types.js').AgentName;
     /** Internal provider/model context; ignored by sandbox creation itself. */
     model?: string;
+    /** Internal Codex transport context used while resolving credentials. */
+    transport?: import('../sdk/types.js').AgentTransport;
     workspace?: string;
     skillDir?: string;
     copyFromHome?: string[];

package/dist/providers/scripted-mcp-mock-host.js

@@ -7,6 +7,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprot
 import { compileScriptedMcpSchemaForProvider } from '../core/mcp-schema-profile.js';
 import { MCP_ANNOTATION_PROTOCOL_FLOOR } from '../core/generated-mcp-protocol.js';
 import { getOriginalMcpInput } from '../sdk/mcp-event-input.js';
+import { cloneToolEventWithRuntimeMetadata } from '../sdk/tool-event-secrets.js';
 import { createMcpArgumentDigest, createMcpReceiptKey, matchesMcpApprovalArguments, } from '../sdk/mcp-mock-approvals.js';
 let testObserver = null;
 /** Non-public acceptance seam. It observes only authenticated manifest-member calls. */
@@ -332,9 +333,11 @@ function eventInput(event) {
 }
 function withInvocation(event, identity, invocation) {
     const status = String(event.arguments?.status ?? 'unknown').toLowerCase();
-    return invocation === 'confirmed'
-        ? { ...event, mcp: { ...identity, invocation, outcome: status.includes('fail') || status.includes('error') ? 'tool_error' : 'completed' } }
-        : { ...event, mcp: { ...identity, invocation, outcome: 'unknown' } };
+    return cloneToolEventWithRuntimeMetadata(event, {
+        mcp: invocation === 'confirmed'
+            ? { ...identity, invocation, outcome: status.includes('fail') || status.includes('error') ? 'tool_error' : 'completed' }
+            : { ...identity, invocation, outcome: 'unknown' },
+    });
 }
 async function readJsonBody(req) {
     const chunks = [];

package/dist/providers/workspace.d.ts

@@ -6,6 +6,7 @@ export interface Workspace {
     readonly mcpConfigPath: string | undefined;
     readonly env: Record<string, string>;
     readonly setupCommands: string[];
+    readonly sensitiveValues?: readonly string[];
     exec(command: string, opts?: {
         signal?: AbortSignal;
     }): Promise<CommandResult>;

package/dist/providers/workspace.js

@@ -7,6 +7,7 @@ import { stageMcpConfig } from './mcp-config.js';
 import { sandboxExec } from './sandbox-exec.js';
 import { resolveCredentials } from './credentials.js';
 import { isPortableCopyEntry } from './copy-filter.js';
+import { collectSensitiveEnvValues } from '../tool-event-results.js';
 async function copyPathsFromHostHome(pathsToCopy, sandboxHomePath) {
     const realHome = os.homedir();
     for (const relPath of pathsToCopy) {
@@ -47,7 +48,10 @@ export async function prepareWorkspace(spec) {
     try {
         // Resolve credentials: pass user's original env (not sandboxEnv) so
         // the resolver can distinguish explicit user intent from auto-resolved values.
-        const creds = await resolveCredentials(spec.agent, spec.env ?? {}, undefined, { model: spec.model });
+        const creds = await resolveCredentials(spec.agent, spec.env ?? {}, undefined, {
+            model: spec.model,
+            transport: spec.transport,
+        });
         Object.assign(sandboxEnv, creds.env);
         await copyPathsFromHostHome(creds.copyFromHome, homePath);
         await linkPathsFromHostHome(creds.linkFromHome ?? [], homePath);
@@ -59,6 +63,10 @@ export async function prepareWorkspace(spec) {
             mcpConfigPath,
             env: sandboxEnv,
             setupCommands: creds.setupCommands,
+            sensitiveValues: [...new Set([
+                    ...collectSensitiveEnvValues(sandboxEnv),
+                    ...(creds.sensitiveValues ?? []),
+                ])],
             exec: (command, opts) => sandboxExec(command, { cwd: workspacePath, env: sandboxEnv }, opts),
             async dispose() {
                 if (disposed)