@wix/pathgrade 1.0.17 → 1.0.19

package/dist/sdk/agent-result-log.js

@@ -1,4 +1,6 @@
 import { getTurnResultLogMetadata, getVisibleAssistantMessage } from './visible-turn.js';
+import { sanitizePersistenceValue } from '../tool-event-results.js';
+import { getTurnResultSensitiveValues } from './turn-result-secrets.js';
 function getOutputMetrics(message) {
     return {
         output_lines: message.split('\n').length,
@@ -7,7 +9,7 @@ function getOutputMetrics(message) {
 }
 export function buildModelAgentResultLogEntry(params) {
     const assistantMessage = params.assistantMessage ?? getVisibleAssistantMessage(params.turnResult);
-    return {
+    return sanitizePersistenceValue({
         type: 'agent_result',
         timestamp: params.timestamp,
         ...(params.turnNumber === undefined ? {} : { turn_number: params.turnNumber }),
@@ -30,7 +32,7 @@ export function buildModelAgentResultLogEntry(params) {
             ? { error_subtype: params.turnResult.errorSubtype }
             : {}),
         ...getOutputMetrics(assistantMessage),
-    };
+    }, getTurnResultSensitiveValues(params.turnResult));
 }
 /**
  * Build one `ask_batch` LogEntry per AskBus batch emitted in the given turn.

package/dist/sdk/agent.js

@@ -17,6 +17,7 @@ import fs from 'fs-extra';
 import * as path from 'path';
 import { cleanDebugRuns, DEFAULT_DEBUG_RETAIN_RUNS, prepareManagedDebugRun, } from '../providers/debug-runs.js';
 import { collectOpenCodeMcpToolNames, validateOpenCodeDeclaration } from '../agents/opencode/contract.js';
+import { collectSensitiveEnvValues } from '../tool-event-results.js';
 import { compileMcpMockApprovalSession, } from './mcp-mock-approvals.js';
 /**
  * Test-only injection point: override the sink used by the next emitter
@@ -49,6 +50,7 @@ class AgentImpl {
     opencodeMcpToolNames;
     activeChatSession;
     scriptedMcp;
+    sensitiveValues;
     constructor(opts) {
         this.ws = opts.workspace;
         this.agentName = opts.agentName;
@@ -65,6 +67,7 @@ class AgentImpl {
         this.opencodeExecutable = opts.opencodeExecutable;
         this.opencodeMcpToolNames = opts.opencodeMcpToolNames;
         this.scriptedMcp = opts.scriptedMcp;
+        this.sensitiveValues = opts.sensitiveValues;
     }
     get messages() {
         return this._messages;
@@ -110,6 +113,7 @@ class AgentImpl {
             ...(this.opencodeExecutable !== undefined ? { opencodeExecutable: this.opencodeExecutable } : {}),
             ...(this.opencodeMcpToolNames !== undefined ? { opencodeMcpToolNames: this.opencodeMcpToolNames } : {}),
             ...(this.scriptedMcp !== undefined ? { scriptedMcp: this.scriptedMcp } : {}),
+            sensitiveValues: this.sensitiveValues,
         });
     }
     resolveTimeoutSec(mode, maxTurns) {
@@ -349,6 +353,7 @@ class AgentImpl {
                         log: this._log,
                         conversationResult: this.lastConversationResult,
                         workspace: dest,
+                        sensitiveValues: this.sensitiveValues,
                     });
                     await fs.writeJSON(path.join(dest, 'run-snapshot.json'), snapshot, { spaces: 2 });
                 }
@@ -425,6 +430,7 @@ export async function createAgent(opts) {
     const workspace = await prepareWorkspace({
         ...rest,
         agent: agentName,
+        transport,
         mcp: scriptedMcp
             ? undefined
             : mcpConfigFile ? { configFile: mcpConfigFile } : mcpMock ? { mock: mcpMock } : undefined,
@@ -457,6 +463,7 @@ export async function createAgent(opts) {
         opencodeExecutable,
         opencodeMcpToolNames: agentName === 'opencode' ? collectOpenCodeMcpToolNames(mcpMock) : undefined,
         scriptedMcp,
+        sensitiveValues: workspace.sensitiveValues ?? collectSensitiveEnvValues(workspace.env),
     });
     lifecycleCore.registerAgent(agent);
     return agent;

package/dist/sdk/judge-tools.js

@@ -69,10 +69,21 @@ async function checkFinalContainment(workspace, absolutePath) {
         return false;
     }
 }
+async function resolveExistingInWorkspace(workspace, relPath) {
+    const resolved = await resolveInWorkspace(workspace, relPath);
+    const [workspaceReal, targetReal] = await Promise.all([
+        fs.realpath(workspace),
+        fs.realpath(resolved),
+    ]);
+    if (!isInside(workspaceReal, targetReal)) {
+        throw new Error(`Path "${relPath}" is outside workspace`);
+    }
+    return targetReal;
+}
 export async function readFile(ctx, relPath) {
-    const resolved = await resolveInWorkspace(ctx.workspace, relPath);
     let content;
     try {
+        const resolved = await resolveExistingInWorkspace(ctx.workspace, relPath);
         content = await fs.readFile(resolved, 'utf8');
     }
     catch (err) {
@@ -88,9 +99,9 @@ export async function readFile(ctx, relPath) {
     return content;
 }
 export async function listDir(ctx, relPath) {
-    const resolved = await resolveInWorkspace(ctx.workspace, relPath);
     let entries;
     try {
+        const resolved = await resolveExistingInWorkspace(ctx.workspace, relPath);
         entries = await fs.readdir(resolved, { withFileTypes: true });
     }
     catch (err) {
@@ -107,7 +118,7 @@ export async function listDir(ctx, relPath) {
 }
 export async function grep(ctx, pattern, relPath) {
     const rootRel = relPath ?? '.';
-    const root = await resolveInWorkspace(ctx.workspace, rootRel);
+    const root = await resolveExistingInWorkspace(ctx.workspace, rootRel);
     const workspaceReal = await fs.realpath(ctx.workspace);
     const regex = new RegExp(pattern);
     const matches = [];

package/dist/sdk/managed-session.d.ts

@@ -36,6 +36,8 @@ export interface ManagedSessionDeps {
     opencodeMcpToolNames?: string[];
     /** Trusted pre-workspace compiled generated-MCP declaration. */
     scriptedMcp?: CompiledMcpMockSession;
+    /** Runtime-only values that must not enter session logs or persisted results. */
+    sensitiveValues?: readonly string[];
 }
 export interface ManagedSession {
     /** Full lifecycle: log start/result, push messages, check exit code. */

package/dist/sdk/managed-session.js

@@ -6,6 +6,9 @@ import { buildToolEventLogEntry } from './tool-event-log.js';
 import { planRuntimePolicies } from './runtime-policy.js';
 import { getVisibleAssistantMessage } from './visible-turn.js';
 import { createAskBus } from './ask-bus/bus.js';
+import { attachTurnResultSensitiveValues, cloneTurnResultWithSensitiveValues, getTurnResultSensitiveValues, } from './turn-result-secrets.js';
+import { attachToolEventSensitiveValues, getToolEventSensitiveValues } from './tool-event-secrets.js';
+import { sanitizePersistenceValue } from '../tool-event-results.js';
 import { startScriptedMcpMockHost, } from '../providers/scripted-mcp-mock-host.js';
 export function createManagedSession(deps) {
     const { ws, agentName, timeoutSec, messages, log, model, conversationWindow, llm } = deps;
@@ -28,6 +31,7 @@ export function createManagedSession(deps) {
         ...(deps.mcpSafety !== undefined ? { mcpSafety: deps.mcpSafety } : {}),
         ...(deps.opencodeExecutable !== undefined ? { opencodeExecutable: deps.opencodeExecutable } : {}),
         ...(deps.opencodeMcpToolNames !== undefined ? { opencodeMcpToolNames: deps.opencodeMcpToolNames } : {}),
+        ...(deps.sensitiveValues !== undefined ? { sensitiveValues: deps.sensitiveValues } : {}),
         getAbortSignal: () => currentSignal,
         getRemainingMs: () => Math.max(0, deadlineMs - Date.now()),
     };
@@ -40,14 +44,14 @@ export function createManagedSession(deps) {
     let disposePromise;
     const runCommand = async (cmd) => {
         const result = await ws.exec(cmd, { signal: currentSignal });
-        log.push({
+        log.push(sanitizePersistenceValue({
             type: 'command',
             timestamp: new Date().toISOString(),
             command: cmd,
             stdout: result.stdout,
             stderr: result.stderr,
             exitCode: result.exitCode,
-        });
+        }, deps.sensitiveValues));
         return result;
     };
     const executeTurn = async (message) => {
@@ -94,17 +98,30 @@ export function createManagedSession(deps) {
                 }
                 const turnNumber = ++nextTurnNumber;
                 scriptedHost?.beginTurn(turnNumber);
-                const result = turnNumber === 1
+                let result = turnNumber === 1
                     ? await session.start({ message })
                     : await session.reply({ message });
                 if (scriptedHost) {
                     const settled = scriptedHost.settleEvents(result.toolEvents);
                     result.toolEvents = settled.events;
                     if (settled.error) {
-                        return { ...result, exitCode: 1, rawOutput: settled.error.message };
+                        result = cloneTurnResultWithSensitiveValues(result, {
+                            exitCode: 1,
+                            rawOutput: settled.error.message,
+                        });
                     }
                 }
-                return result;
+                const sensitiveValues = [...new Set([
+                        ...(deps.sensitiveValues ?? []),
+                        ...getTurnResultSensitiveValues(result),
+                    ])];
+                for (const event of result.toolEvents) {
+                    attachToolEventSensitiveValues(event, [...new Set([
+                            ...sensitiveValues,
+                            ...getToolEventSensitiveValues(event),
+                        ])]);
+                }
+                return attachTurnResultSensitiveValues(result, sensitiveValues);
             }, remaining, label);
         }
         finally {

package/dist/sdk/mcp-safety.js

@@ -1,4 +1,4 @@
-const SECRET_KEY_PATTERN = /(^|[_-])(api[_-]?key|token|secret|password|authorization|auth|bearer)([_-]|$)|authorization/i;
+import { sanitizePersistenceValue } from '../tool-event-results.js';
 export function decideMcpToolCall(options, request) {
     const runMode = options?.runMode ?? 'mock';
     if (runMode === 'mock')
@@ -31,7 +31,7 @@ export function decideMcpToolCall(options, request) {
     return { action: 'allow' };
 }
 export function redactMcpSecrets(value) {
-    return redactValue(value, '');
+    return sanitizePersistenceValue(value);
 }
 function ruleMatches(rule, request) {
     if (rule.serverName !== undefined && rule.serverName !== request.serverName)
@@ -43,19 +43,3 @@ function ruleMatches(rule, request) {
 function deny(reason, message) {
     return { action: 'deny', reason, message };
 }
-function redactValue(value, key) {
-    if (SECRET_KEY_PATTERN.test(key))
-        return '<redacted>';
-    if (Array.isArray(value))
-        return value.map((entry) => redactValue(entry, key));
-    if (isRecord(value)) {
-        return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [
-            entryKey,
-            redactValue(entryValue, entryKey),
-        ]));
-    }
-    return value;
-}
-function isRecord(value) {
-    return !!value && typeof value === 'object' && !Array.isArray(value);
-}

package/dist/sdk/snapshots.d.ts

@@ -25,6 +25,7 @@ export declare function buildRunSnapshot(params: {
     conversationResult: ConversationResult;
     workspace: string | null;
     timestamp?: string;
+    sensitiveValues?: readonly string[];
 }): RunSnapshot;
 export declare class SnapshotParseError extends Error {
     constructor(message: string, options?: {

package/dist/sdk/snapshots.js

@@ -1,3 +1,4 @@
+import { sanitizePersistenceValue } from '../tool-event-results.js';
 import fs from 'fs-extra';
 export const RUN_SNAPSHOT_VERSION = 2;
 export function buildRunSnapshot(params) {
@@ -5,7 +6,7 @@ export function buildRunSnapshot(params) {
     const toolEvents = log
         .filter((entry) => entry.type === 'tool_event' && entry.tool_event)
         .map((entry) => entry.tool_event);
-    return {
+    return sanitizePersistenceValue({
         version: agent === 'opencode' ? 2 : 1,
         timestamp: timestamp ?? new Date().toISOString(),
         agent,
@@ -20,7 +21,7 @@ export function buildRunSnapshot(params) {
             turnTimings: [...conversationResult.turnTimings],
         },
         workspace,
-    };
+    }, params.sensitiveValues);
 }
 export class SnapshotParseError extends Error {
     constructor(message, options) {

package/dist/sdk/tool-event-log.js

@@ -1,7 +1,10 @@
+import { sanitizePersistenceValue } from '../tool-event-results.js';
+import { getToolEventSensitiveValues } from './tool-event-secrets.js';
 export function buildToolEventLogEntry(toolEvent, fallbackTimestamp) {
+    const persistedEvent = sanitizePersistenceValue(toolEvent, getToolEventSensitiveValues(toolEvent));
     return {
         type: 'tool_event',
-        timestamp: toolEvent.startedAt ?? fallbackTimestamp,
-        tool_event: toolEvent,
+        timestamp: persistedEvent.startedAt ?? fallbackTimestamp,
+        tool_event: persistedEvent,
     };
 }

package/dist/sdk/tool-event-secrets.d.ts

@@ -0,0 +1,4 @@
+import type { ToolEvent } from '../tool-events.js';
+export declare function attachToolEventSensitiveValues(event: ToolEvent, sensitiveValues: readonly string[]): ToolEvent;
+export declare function getToolEventSensitiveValues(event: ToolEvent): readonly string[];
+export declare function cloneToolEventWithRuntimeMetadata(source: ToolEvent, overrides: Partial<ToolEvent>): ToolEvent;

package/dist/sdk/tool-event-secrets.js

@@ -0,0 +1,14 @@
+import { attachOriginalMcpInput, getOriginalMcpInput } from './mcp-event-input.js';
+const sensitiveValuesByEvent = new WeakMap();
+export function attachToolEventSensitiveValues(event, sensitiveValues) {
+    sensitiveValuesByEvent.set(event, [...sensitiveValues]);
+    return event;
+}
+export function getToolEventSensitiveValues(event) {
+    return sensitiveValuesByEvent.get(event) ?? [];
+}
+export function cloneToolEventWithRuntimeMetadata(source, overrides) {
+    const clone = attachToolEventSensitiveValues({ ...source, ...overrides }, getToolEventSensitiveValues(source));
+    const originalInput = getOriginalMcpInput(source);
+    return originalInput ? attachOriginalMcpInput(clone, originalInput) : clone;
+}

package/dist/sdk/turn-result-secrets.d.ts

@@ -0,0 +1,5 @@
+import type { AgentTurnResult } from '../types.js';
+/** Attach runtime-only redaction context without changing the serialized result contract. */
+export declare function attachTurnResultSensitiveValues(result: AgentTurnResult, sensitiveValues: readonly string[]): AgentTurnResult;
+export declare function getTurnResultSensitiveValues(result: AgentTurnResult): readonly string[];
+export declare function cloneTurnResultWithSensitiveValues(source: AgentTurnResult, overrides: Partial<AgentTurnResult>): AgentTurnResult;

package/dist/sdk/turn-result-secrets.js

@@ -0,0 +1,12 @@
+const sensitiveValuesByResult = new WeakMap();
+/** Attach runtime-only redaction context without changing the serialized result contract. */
+export function attachTurnResultSensitiveValues(result, sensitiveValues) {
+    sensitiveValuesByResult.set(result, [...sensitiveValues]);
+    return result;
+}
+export function getTurnResultSensitiveValues(result) {
+    return sensitiveValuesByResult.get(result) ?? [];
+}
+export function cloneTurnResultWithSensitiveValues(source, overrides) {
+    return attachTurnResultSensitiveValues({ ...source, ...overrides }, getTurnResultSensitiveValues(source));
+}

package/dist/tool-event-results.d.ts

@@ -0,0 +1,10 @@
+import type { ToolEventResult } from './tool-events.js';
+export declare const TOOL_RESULT_MAX_CHARS: number;
+export declare function collectSensitiveEnvValues(env?: Readonly<Record<string, string>>): string[];
+/**
+ * Clone a persistence payload while removing secrets from both structured
+ * containers and any other strings that repeat their values. The second pass
+ * is important for summaries, snippets, traces, and provider error text.
+ */
+export declare function sanitizePersistenceValue<T>(source: T, explicitSensitiveValues?: readonly string[]): T;
+export declare function sanitizeToolEventResult(source: Readonly<ToolEventResult>, sensitiveValues: readonly string[]): ToolEventResult;

package/dist/tool-event-results.js

@@ -0,0 +1,171 @@
+export const TOOL_RESULT_MAX_CHARS = 64 * 1024;
+const SECRET_KEY_NAMES = [
+    'apikey',
+    'accesskey',
+    'accesskeyid',
+    'accesstoken',
+    'refreshtoken',
+    'idtoken',
+    'sessiontoken',
+    'token',
+    'secret',
+    'clientsecret',
+    'password',
+    'passwd',
+    'authorization',
+    'auth',
+    'bearer',
+    'cookie',
+    'setcookie',
+    'privatekey',
+    'signingkey',
+    'serviceaccount',
+    'databaseurl',
+    'connectionstring',
+    'credentials',
+    'credential',
+];
+export function collectSensitiveEnvValues(env) {
+    return [...new Set(Object.entries(env ?? {})
+            .filter(([key, value]) => isSecretKey(key) && value.length > 0)
+            .map(([, value]) => value))]
+        .sort((a, b) => b.length - a.length);
+}
+/**
+ * Clone a persistence payload while removing secrets from both structured
+ * containers and any other strings that repeat their values. The second pass
+ * is important for summaries, snippets, traces, and provider error text.
+ */
+export function sanitizePersistenceValue(source, explicitSensitiveValues = []) {
+    const sensitiveValues = [...new Set([
+            ...explicitSensitiveValues.filter((value) => value.length > 0),
+            ...collectStructuredSensitiveValues(source),
+        ])].sort((a, b) => b.length - a.length);
+    return sanitizeValue(source, '', sensitiveValues);
+}
+export function sanitizeToolEventResult(source, sensitiveValues) {
+    const result = {};
+    let truncated = source.truncated === true;
+    const addBounded = (key, value) => {
+        if (typeof value !== 'string')
+            return;
+        const bounded = boundText(sanitizePersistenceValue(value, sensitiveValues));
+        result[key] = bounded.value;
+        truncated ||= bounded.truncated;
+    };
+    addBounded('content', source.content);
+    addBounded('stdout', source.stdout);
+    addBounded('stderr', source.stderr);
+    if (typeof source.exitCode === 'number' && Number.isFinite(source.exitCode)) {
+        result.exitCode = source.exitCode;
+    }
+    if (truncated)
+        result.truncated = true;
+    return result;
+}
+function redactSensitiveValues(value, sensitiveValues) {
+    let redacted = value;
+    for (const secret of sensitiveValues) {
+        if (secret.length > 0)
+            redacted = redacted.split(secret).join('<redacted>');
+    }
+    return redacted;
+}
+function collectStructuredSensitiveValues(source) {
+    const values = new Set();
+    const visit = (value, key) => {
+        if (typeof value === 'string' && isSecretKey(key) && value.length > 0) {
+            values.add(value);
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                visit(entry, key);
+            return;
+        }
+        if (isRecord(value)) {
+            for (const [entryKey, entryValue] of Object.entries(value))
+                visit(entryValue, entryKey);
+        }
+    };
+    visit(source, '');
+    return [...values];
+}
+function sanitizeValue(value, key, sensitiveValues) {
+    if (isSecretKey(key))
+        return '<redacted>';
+    if (typeof value === 'string')
+        return redactCredentialShapes(redactSensitiveValues(value, sensitiveValues));
+    if (Array.isArray(value))
+        return value.map((entry) => sanitizeValue(entry, key, sensitiveValues));
+    if (isRecord(value)) {
+        return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [
+            entryKey,
+            sanitizeValue(entryValue, entryKey, sensitiveValues),
+        ]));
+    }
+    return value;
+}
+function redactCredentialShapes(value) {
+    let redacted = value;
+    const structured = parseStructuredJson(redacted);
+    if (structured !== undefined) {
+        redacted = JSON.stringify(sanitizePersistenceValue(structured));
+    }
+    if (redacted.includes('PRIVATE KEY-----')) {
+        redacted = redacted.replace(/-----BEGIN [^-\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\n]*PRIVATE KEY-----/g, '<redacted>');
+    }
+    if (/\b(?:bearer|basic)\s/i.test(redacted)) {
+        redacted = redacted.replace(/(\b(?:bearer|basic)\s+)[^\s,;"']+/gi, '$1<redacted>');
+    }
+    if (redacted.includes('://')) {
+        redacted = redacted.replace(/([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s/@]+(@)/gi, '$1<redacted>$2');
+    }
+    if (redacted.includes('=') || redacted.includes(':')) {
+        redacted = redacted.replace(/(\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|passwd|session(?:id)?|cookie)\s*[=:]\s*)[^\s,;"'}]+/gi, '$1<redacted>');
+    }
+    return redacted;
+}
+function isSecretKey(key) {
+    const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+    if (SECRET_KEY_NAMES.some((name) => normalized === name))
+        return true;
+    const compoundNames = SECRET_KEY_NAMES.filter((name) => name !== 'auth');
+    if (compoundNames.some((name) => normalized.startsWith(name) || normalized.endsWith(name)))
+        return true;
+    const segments = key.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+    for (let start = 0; start < segments.length; start++) {
+        let candidate = '';
+        for (let end = start; end < segments.length; end++) {
+            candidate += segments[end];
+            if (SECRET_KEY_NAMES.some((name) => candidate === name))
+                return true;
+        }
+    }
+    return false;
+}
+function parseStructuredJson(value) {
+    const trimmed = value.trim();
+    if (!(trimmed.startsWith('{') && trimmed.endsWith('}'))
+        && !(trimmed.startsWith('[') && trimmed.endsWith(']')))
+        return undefined;
+    try {
+        const parsed = JSON.parse(trimmed);
+        return isRecord(parsed) || Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function boundText(value) {
+    if (value.length <= TOOL_RESULT_MAX_CHARS)
+        return { value, truncated: false };
+    const marker = '\n[truncated by PathGrade]';
+    return {
+        value: `${value.slice(0, TOOL_RESULT_MAX_CHARS - marker.length)}${marker}`,
+        truncated: true,
+    };
+}

package/dist/types.d.ts

@@ -387,6 +387,8 @@ export interface AgentSessionOptions {
     opencodeMcpToolNames?: string[];
     /** Managed-session-owned runtime for scripted generated MCP. */
     scriptedMcpHost?: import('./providers/scripted-mcp-mock-host.js').ScriptedMcpMockHost;
+    /** Runtime-only values inherited by drivers and persistence sinks for redaction. */
+    sensitiveValues?: readonly string[];
 }
 export declare abstract class BaseAgent {
     createSession(runtime: EnvironmentHandle, runCommand: AgentCommandRunner, options?: AgentSessionOptions): Promise<AgentSession>;

package/dist/utils/llm.js

@@ -1,3 +1,5 @@
+import { resolveCodexModel } from '../agents/codex-model.js';
+import { createChatGptOAuthJudgeLLM } from '../openai-oauth/chatgpt-oauth-llm.js';
 import { cliProvider } from './llm-providers/cli.js';
 import { anthropicProvider } from './llm-providers/anthropic.js';
 import { openaiProvider } from './llm-providers/openai.js';
@@ -191,6 +193,15 @@ export async function callLLM(prompt, opts = {}) {
  * the agent's env propagates to persona/judge/summarization calls.
  */
 export function createAgentLLM(agentName, agentEnv, agentModel) {
+    const effectiveAgentEnv = agentEnv ?? process.env;
+    if (agentName === 'codex'
+        && !effectiveAgentEnv.OPENAI_API_KEY
+        && !effectiveAgentEnv.OPENAI_BASE_URL) {
+        return createChatGptOAuthJudgeLLM({
+            model: resolveCodexModel(agentModel),
+            reasoningEffort: 'high',
+        });
+    }
     // Tool-using judges need a provider that implements callWithTools.
     // For claude, anthropicProvider is added as a tool-use-capable fallback
     // alongside the CLI. The CLI still wins for plain call() when available.

package/docs/OPENAI_OAUTH_JUDGE.md

@@ -0,0 +1,91 @@
+# Experimental Codex-authenticated ChatGPT judge
+
+Status: **experimental**. W0b passed for the direct
+`@openai-oauth/core@2.0.0` Responses mapping, and W0c passed for acquiring a
+managed ChatGPT access session from Codex App Server.
+
+## Install and authenticate
+
+Install the exact optional peer and sign in once with Codex:
+
+```bash
+yarn add -D @wix/pathgrade @openai-oauth/core@2.0.0
+codex login
+```
+
+Pathgrade starts a short-lived `codex app-server` child over stdio, calls only
+the auth-status RPC, then closes it before making the direct judge request. It
+does not read, copy, or write `~/.codex/auth.json`, receive a refresh token,
+open a local port, or start a Codex model thread. After a real upstream 401 it
+asks Codex to refresh, retries once, and otherwise fails closed.
+
+## Inject explicitly
+
+Codex agents select this judge automatically when neither `OPENAI_API_KEY` nor
+`OPENAI_BASE_URL` is present. The judge uses the resolved Codex model (Luna by
+default) with high reasoning effort. Passing `evaluate(agent, scorers, { llm })`
+remains the highest-precedence override. Explicit construction is available for
+other agents and custom flows:
+
+```typescript
+import { createChatGptOAuthJudgeLLM } from '@wix/pathgrade/openai-oauth';
+import { evaluate, judge } from '@wix/pathgrade';
+
+const llm = createChatGptOAuthJudgeLLM({
+    model: 'gpt-5.6-sol',
+    reasoningEffort: 'high',
+    requestTimeoutMs: 60_000,
+});
+
+const result = await evaluate(agent, [
+    judge('quality', { rubric: 'Apply the frozen rubric.', model: 'gpt-5.6-sol' }),
+], { llm });
+```
+
+The scorer model must exactly equal the factory model. There is no auth-file,
+API-key, base-URL, login callback, provider fallback, model rewrite, or default
+provider registration. Plain calls expose zero tools. Tool judges expose only
+their declared Pathgrade schemas through the existing bounded tool registry.
+
+## Stable public failures
+
+- `OAUTH_CONFIG_INVALID`
+- `OAUTH_DEPENDENCY_UNAVAILABLE`
+- `OAUTH_CODEX_UNAVAILABLE`
+- `OAUTH_CODEX_LOGIN_REQUIRED`
+- `OAUTH_AUTH_TIMEOUT`
+- `OAUTH_MODEL_MISMATCH`
+- `OAUTH_MODEL_UNAVAILABLE`
+- `OAUTH_REQUEST_TIMEOUT`
+- `OAUTH_UPSTREAM_RATE_LIMITED`
+- `OAUTH_UPSTREAM_FAILED`
+- `OAUTH_PROTOCOL_RESPONSE_INVALID`
+
+Tokens, Codex paths, auth JSON, prompts, App Server stderr/RPC text, upstream
+bodies, and tool results are never included in public errors. Failures never
+fall back to another provider.
+
+## Repository-only verification
+
+These maintainer probes run from a source checkout and are not included in the
+published npm package. Run them from the repository root.
+
+The no-cost installed-binary probe reports only version, auth-mode booleans,
+and its ADAPT/STOP verdict:
+
+```bash
+yarn smoke:codex-auth
+```
+
+The explicit paid live suite uses only the active Codex login. It exercises
+direct plain and bounded `readFile` judges, then a real keyless Codex app-server
+agent followed by automatically selected plain and `readFile` judges:
+
+```bash
+yarn test:evals:judge-oauth:live
+```
+
+It writes redacted reports to `.pathgrade/judge-oauth-live-smoke.{json,md}` and
+`.pathgrade/codex-oauth-agent-judge-e2e.json`.
+Any `@openai-oauth/core` or Codex protocol upgrade must rerun W0b, W0c, and
+the live smoke.