@wix/pathgrade 1.0.21 → 1.0.23

package/dist/agents/codex-app-server/agent.js

@@ -15,6 +15,7 @@ import { buildLiveMcpProtocolErrorEvent, buildPolicyDeniedMcpToolEvent, CodexMcp
 import { projectItemIntoTurn } from './item-projection.js';
 import { CodexItemLifecycle, } from './item-lifecycle.js';
 import { createCodexManagedAuth } from './managed-auth.js';
+import { clearTurnAuthorityDeadline, closeUncorrelatedTurnTransport, establishAuthoritativeTurn, isAbortError, isAuthoritativeTurnCompletion, rememberAuthoritativeTurnId, shouldRetireAuthoritativeTurnTransport, } from './turn-authority.js';
 const TURN_COMPLETED_METHOD = 'turn/completed';
 function projectMcpStartupStatusIntoTurn(params, turn) {
     const name = params.name ?? 'unknown';
@@ -64,18 +65,6 @@ function projectCompletedItem(item, timing, params, turn, correlator, sensitiveV
     }
     turn.nonAskToolEvents.push(buildPolicyDeniedMcpToolEvent(turn.turnNumber, pendingDenial, mcpItem));
 }
-function extractTurnCompletionIdentity(params) {
-    if (!params || typeof params !== 'object' || Array.isArray(params))
-        return {};
-    const record = params;
-    const turnId = typeof record.turn?.id === 'string'
-        ? record.turn.id
-        : typeof record.turnId === 'string' ? record.turnId : undefined;
-    return {
-        ...(typeof record.threadId === 'string' ? { threadId: record.threadId } : {}),
-        ...(turnId ? { turnId } : {}),
-    };
-}
 function isLiveMcpSafetyMode(options) {
     const runMode = options?.runMode ?? 'mock';
     return runMode === 'live-readonly' || runMode === 'live-sandbox' || runMode === 'live';
@@ -102,9 +91,11 @@ export class CodexAppServerAgent extends BaseAgent {
         let handle = null;
         let threadId = null;
         let turnCounter = 0;
+        const authoritativeTurnIds = new Set();
         let closeInfo = null;
         let activeTurn = null;
         let disposed = false;
+        let sessionRetired = false;
         let codexUserAgent = 'unknown';
         const managedAuth = createCodexManagedAuth({
             enabled: !runtimeEnv.OPENAI_API_KEY && !runtimeEnv.OPENAI_BASE_URL
@@ -137,7 +128,8 @@ export class CodexAppServerAgent extends BaseAgent {
                 managedAuth,
             }));
             transport.onClose((info) => {
-                closeInfo = info;
+                if (handle === spawnedHandle)
+                    closeInfo = info;
             });
             transport.onNotification((n) => {
                 if (process.env.PATHGRADE_CODEX_DEBUG) {
@@ -173,9 +165,6 @@ export class CodexAppServerAgent extends BaseAgent {
                 if (typeof initialized.userAgent === 'string') {
                     codexUserAgent = initialized.userAgent.slice(0, 200);
                 }
-                // Upstream ClientNotification = { method: "initialized" }: send it
-                // before any thread/start so the handshake matches the v0.149
-                // contract and is forward-compatible with servers that enforce it.
                 transport.sendNotification('initialized', null);
                 await managedAuth.login(transport);
                 return transport;
@@ -189,6 +178,7 @@ export class CodexAppServerAgent extends BaseAgent {
         };
         const runTurn = async (message) => {
             const t = await ensureTransport();
+            const turnHandle = handle;
             turnCounter += 1;
             const turn = {
                 turnNumber: turnCounter,
@@ -199,6 +189,8 @@ export class CodexAppServerAgent extends BaseAgent {
                 turnFailed: false,
                 pendingTurnCompletions: [],
             };
+            const turnStartController = new AbortController();
+            let turnStartCanReuseTransport = false;
             activeTurn = turn;
             correlator?.beginTurn();
             try {
@@ -251,7 +243,18 @@ export class CodexAppServerAgent extends BaseAgent {
                         }
                     },
                 });
-                // Wait for TurnCompleted OR subprocess crash OR dispatcher failure.
+                let resolveAuthoritativeTurn;
+                const authoritativeTurnReady = new Promise((resolve) => {
+                    resolveAuthoritativeTurn = resolve;
+                });
+                const markAuthoritativeTurn = (candidateTurnId) => establishAuthoritativeTurn({
+                    turn,
+                    candidateTurnId,
+                    authoritativeThreadId,
+                    authoritativeTurnIds,
+                    correlator,
+                    onReady: () => resolveAuthoritativeTurn?.(),
+                });
                 const turnCompletion = new Promise((resolve, reject) => {
                     let settled = false;
                     const off = t.onNotification((n) => {
@@ -264,14 +267,13 @@ export class CodexAppServerAgent extends BaseAgent {
                     const acceptTurnCompletion = (params) => {
                         if (settled)
                             return;
-                        const identity = extractTurnCompletionIdentity(params);
-                        if (identity.threadId && identity.threadId !== turn.authoritativeThreadId)
-                            return;
-                        if (identity.turnId && !turn.authoritativeTurnId) {
-                            turn.pendingTurnCompletions.push(params);
-                            return;
-                        }
-                        if (identity.turnId && identity.turnId !== turn.authoritativeTurnId)
+                        if (!isAuthoritativeTurnCompletion({
+                            params,
+                            turn,
+                            authoritativeTurnIds,
+                            markAuthoritativeTurn,
+                            getRemainingMs: () => options?.getRemainingMs?.() ?? Number.POSITIVE_INFINITY,
+                        }))
                             return;
                         settled = true;
                         off();
@@ -295,13 +297,14 @@ export class CodexAppServerAgent extends BaseAgent {
                         }));
                     });
                     turn.signalFailure = (msg) => {
+                        turn.turnFailed = true;
+                        turn.failureMessage = msg;
+                        resolveAuthoritativeTurn?.();
                         if (settled)
                             return;
                         settled = true;
                         off();
                         closeOff();
-                        turn.turnFailed = true;
-                        turn.failureMessage = msg;
                         resolve();
                     };
                     if (turn.turnFailed) {
@@ -319,31 +322,31 @@ export class CodexAppServerAgent extends BaseAgent {
                         }
                     }
                 });
-                const authoritativeTurn = t.sendRequest('turn/start', {
+                void t.sendRequest('turn/start', {
                     threadId,
                     input: [{ type: 'text', text: message, text_elements: [] }],
-                })
+                }, { signal: turnStartController.signal })
                     .then((started) => {
-                    const authoritativeTurnId = started.turn?.id ?? started.turnId;
-                    if (!authoritativeTurnId) {
-                        scriptedHost?.failProtocol('turn/start did not return an authoritative turn id');
-                        turn.signalFailure?.('turn/start did not return an authoritative turn id');
+                    const authoritativeTurnId = started?.turn?.id ?? started?.turnId;
+                    if (activeTurn !== turn) {
+                        if (authoritativeTurnId)
+                            rememberAuthoritativeTurnId(authoritativeTurnIds, authoritativeTurnId);
                         return;
                     }
-                    turn.itemLifecycle?.setAuthoritativeTurn(authoritativeTurnId);
-                    turn.authoritativeTurnId = authoritativeTurnId;
-                    if (correlator?.setAuthoritativeTurn(authoritativeThreadId, authoritativeTurnId) === false) {
-                        turn.signalFailure?.('MCP lifecycle did not match the authoritative turn');
-                    }
-                    for (const pending of turn.pendingTurnCompletions.splice(0)) {
-                        turn.acceptTurnCompletion?.(pending);
+                    if (!authoritativeTurnId) {
+                        if (!turn.authoritativeTurnId) {
+                            scriptedHost?.failProtocol('turn/start did not return an authoritative turn id');
+                            turn.signalFailure?.('turn/start did not return an authoritative turn id');
+                        }
+                        return;
                     }
+                    turnStartCanReuseTransport = true;
+                    markAuthoritativeTurn(authoritativeTurnId);
                 })
                     .catch((err) => {
-                    // A JSON-RPC error on turn/start means the server will
-                    // never send turn/completed — short-circuit the turn
-                    // through the existing signalFailure path instead of
-                    // waiting for an outer timeout.
+                    if (isAbortError(err) || activeTurn !== turn)
+                        return;
+                    turnStartCanReuseTransport = true;
                     const msg = err instanceof Error
                         ? err.message
                         : typeof err === 'string'
@@ -375,9 +378,7 @@ export class CodexAppServerAgent extends BaseAgent {
                         sensitiveValues,
                     });
                 }
-                // Ensure pre-response lifecycle notifications have been correlated
-                // and projected before exposing the successful turn result.
-                await authoritativeTurn;
+                await authoritativeTurnReady;
                 if (turn.turnFailed) {
                     return assembleTurnResult({
                         askBus, activeTurn: turn, exitCode: 1,
@@ -393,8 +394,25 @@ export class CodexAppServerAgent extends BaseAgent {
                 });
             }
             finally {
+                turnStartController.abort();
+                clearTurnAuthorityDeadline(turn);
                 activeTurn = null;
                 correlator?.endTurn();
+                const retireTransport = shouldRetireAuthoritativeTurnTransport(authoritativeTurnIds);
+                await closeUncorrelatedTurnTransport({
+                    turnStartCanReuseTransport,
+                    authoritativeTurnId: turn.authoritativeTurnId,
+                    retireTransport,
+                    currentHandle: handle,
+                    turnHandle,
+                    reset: () => {
+                        sessionRetired ||= retireTransport;
+                        handle = null;
+                        threadId = null;
+                        authoritativeTurnIds.clear();
+                        closeInfo = null;
+                    },
+                });
             }
         };
         const dispose = async () => {
@@ -419,6 +437,9 @@ export class CodexAppServerAgent extends BaseAgent {
             if (disposed) {
                 throw new Error('CodexAppServerAgent session disposed');
             }
+            if (sessionRetired) {
+                throw new Error('CodexAppServerAgent session reached its safe turn-history limit; create a new session');
+            }
         };
         return {
             start: async ({ message }) => {

package/dist/agents/codex-app-server/transport.d.ts

@@ -15,7 +15,9 @@ export interface TransportCloseInfo {
     readonly pid?: number;
 }
 export interface AppServerTransport {
-    sendRequest<T = unknown>(method: string, params: unknown): Promise<T>;
+    sendRequest<T = unknown>(method: string, params: unknown, options?: {
+        signal?: AbortSignal;
+    }): Promise<T>;
     sendNotification(method: string, params: unknown): void;
     sendResponse(id: number | string, result: unknown): void;
     sendErrorResponse(id: number | string, code: number, message: string): void;

package/dist/agents/codex-app-server/transport.js

@@ -80,18 +80,31 @@ function createNdjsonTransportInternal(cfg) {
         pendingRequests.clear();
     };
     return {
-        sendRequest(method, params) {
+        sendRequest(method, params, options) {
             if (closed)
                 return Promise.reject(new Error('AppServerTransport closed'));
             const id = nextId++;
             return new Promise((resolve, reject) => {
+                const abort = () => {
+                    if (!pendingRequests.delete(id))
+                        return;
+                    const error = new Error('AppServerTransport request aborted');
+                    error.name = 'AbortError';
+                    reject(error);
+                };
                 pendingRequests.set(id, (env) => {
+                    options?.signal?.removeEventListener('abort', abort);
                     if (env.error) {
                         reject(new Error(`codex app-server '${method}' failed (${env.error.code}): ${env.error.message}`));
                         return;
                     }
                     resolve(env.result);
                 });
+                options?.signal?.addEventListener('abort', abort, { once: true });
+                if (options?.signal?.aborted) {
+                    abort();
+                    return;
+                }
                 writeLine({ jsonrpc: '2.0', id, method, params });
             });
         },

package/dist/agents/codex-app-server/turn-authority.d.ts

@@ -0,0 +1,42 @@
+import type { CodexMcpApprovalCorrelator } from './mcp-approval-correlator.js';
+import type { CodexItemLifecycle } from './item-lifecycle.js';
+import type { AppServerSessionHandle } from './transport.js';
+interface TurnAuthorityState {
+    authoritativeThreadId?: string;
+    authoritativeTurnId?: string;
+    pendingTurnCompletions: unknown[];
+    acceptTurnCompletion?: (params: unknown) => void;
+    itemLifecycle?: CodexItemLifecycle;
+    turnFailed: boolean;
+    failureMessage?: string;
+    signalFailure?: (message: string) => void;
+    authorityDeadlineTimer?: ReturnType<typeof setTimeout>;
+}
+export declare function isAbortError(error: unknown): boolean;
+export declare function closeUncorrelatedTurnTransport(args: {
+    turnStartCanReuseTransport: boolean;
+    authoritativeTurnId?: string;
+    retireTransport: boolean;
+    currentHandle: AppServerSessionHandle | null;
+    turnHandle: AppServerSessionHandle | null;
+    reset(): void;
+}): Promise<void>;
+export declare function rememberAuthoritativeTurnId(turnIds: Set<string>, turnId: string): void;
+export declare function shouldRetireAuthoritativeTurnTransport(turnIds: ReadonlySet<string>): boolean;
+export declare function establishAuthoritativeTurn(args: {
+    turn: TurnAuthorityState;
+    candidateTurnId: string;
+    authoritativeThreadId: string;
+    authoritativeTurnIds: Set<string>;
+    correlator?: CodexMcpApprovalCorrelator;
+    onReady(): void;
+}): boolean;
+export declare function isAuthoritativeTurnCompletion(args: {
+    params: unknown;
+    turn: TurnAuthorityState;
+    authoritativeTurnIds: ReadonlySet<string>;
+    markAuthoritativeTurn(turnId: string): boolean;
+    getRemainingMs(): number;
+}): boolean;
+export declare function clearTurnAuthorityDeadline(turn: TurnAuthorityState): void;
+export {};

package/dist/agents/codex-app-server/turn-authority.js

@@ -0,0 +1,96 @@
+const MAX_RECENT_AUTHORITATIVE_TURN_IDS = 256;
+export function isAbortError(error) {
+    return error instanceof Error && error.name === 'AbortError';
+}
+export async function closeUncorrelatedTurnTransport(args) {
+    const { turnStartCanReuseTransport, authoritativeTurnId, retireTransport, currentHandle, turnHandle, reset } = args;
+    if ((!retireTransport && (turnStartCanReuseTransport || authoritativeTurnId))
+        || currentHandle !== turnHandle || !turnHandle)
+        return;
+    reset();
+    await turnHandle.close().catch(() => undefined);
+}
+export function rememberAuthoritativeTurnId(turnIds, turnId) {
+    turnIds.add(turnId);
+}
+export function shouldRetireAuthoritativeTurnTransport(turnIds) {
+    return turnIds.size >= MAX_RECENT_AUTHORITATIVE_TURN_IDS;
+}
+export function establishAuthoritativeTurn(args) {
+    const { turn, candidateTurnId, authoritativeThreadId, authoritativeTurnIds, correlator, onReady } = args;
+    if (turn.authoritativeTurnId) {
+        if (turn.authoritativeTurnId === candidateTurnId)
+            return true;
+        failTurn(turn, 'turn lifecycle reported conflicting authoritative turn ids');
+        return false;
+    }
+    if (turn.itemLifecycle?.setAuthoritativeTurn(candidateTurnId) === false)
+        return false;
+    turn.authoritativeTurnId = candidateTurnId;
+    clearTurnAuthorityDeadline(turn);
+    rememberAuthoritativeTurnId(authoritativeTurnIds, candidateTurnId);
+    if (correlator?.setAuthoritativeTurn(authoritativeThreadId, candidateTurnId) === false) {
+        failTurn(turn, 'MCP lifecycle did not match the authoritative turn');
+        return false;
+    }
+    onReady();
+    for (const pending of turn.pendingTurnCompletions.splice(0)) {
+        turn.acceptTurnCompletion?.(pending);
+    }
+    return true;
+}
+export function isAuthoritativeTurnCompletion(args) {
+    const { params, turn, authoritativeTurnIds, markAuthoritativeTurn, getRemainingMs } = args;
+    const identity = extractTurnCompletionIdentity(params);
+    if (identity.threadId && identity.threadId !== turn.authoritativeThreadId)
+        return false;
+    if (!identity.turnId && !turn.authoritativeTurnId) {
+        if (turn.pendingTurnCompletions.length === 0) {
+            const remainingMs = getRemainingMs();
+            if (Number.isFinite(remainingMs))
+                turn.authorityDeadlineTimer = setTimeout(() => {
+                    if (!turn.authoritativeTurnId && !turn.turnFailed) {
+                        failTurn(turn, 'turn/completed did not identify the authoritative turn');
+                    }
+                }, Math.max(0, remainingMs));
+        }
+        turn.pendingTurnCompletions.push(params);
+        return false;
+    }
+    if (identity.turnId && !turn.authoritativeTurnId) {
+        if (authoritativeTurnIds.has(identity.turnId))
+            return false;
+        if (identity.threadId === turn.authoritativeThreadId) {
+            if (!markAuthoritativeTurn(identity.turnId))
+                return false;
+        }
+        else {
+            turn.pendingTurnCompletions.push(params);
+            return false;
+        }
+    }
+    return !identity.turnId || identity.turnId === turn.authoritativeTurnId;
+}
+function extractTurnCompletionIdentity(params) {
+    if (!params || typeof params !== 'object' || Array.isArray(params))
+        return {};
+    const record = params;
+    const turnId = typeof record.turn?.id === 'string'
+        ? record.turn.id
+        : typeof record.turnId === 'string' ? record.turnId : undefined;
+    return {
+        ...(typeof record.threadId === 'string' ? { threadId: record.threadId } : {}),
+        ...(turnId ? { turnId } : {}),
+    };
+}
+function failTurn(turn, message) {
+    clearTurnAuthorityDeadline(turn);
+    turn.turnFailed = true;
+    turn.failureMessage = message;
+    turn.signalFailure?.(message);
+}
+export function clearTurnAuthorityDeadline(turn) {
+    if (turn.authorityDeadlineTimer)
+        clearTimeout(turn.authorityDeadlineTimer);
+    turn.authorityDeadlineTimer = undefined;
+}

package/dist/agents/opencode/runtime-policy.js

@@ -130,11 +130,14 @@ export class OpenCodeRuntimePolicy {
         if (this.authWatcher)
             throw new Error('OpenCode auth monitor is already active');
         this.authMutationObserved = false;
-        const expectedName = path.basename(this.authPath);
-        this.authWatcher = watch(path.dirname(this.authPath), { persistent: false }, (_event, filename) => {
-            if (filename === null || filename.toString() === expectedName)
+        try {
+            this.authWatcher = watch(this.authPath, { persistent: false }, () => {
                 this.authMutationObserved = true;
-        });
+            });
+        }
+        catch {
+            throw poisonedAuthError();
+        }
         this.authWatcher.on('error', () => {
             this.authMutationObserved = true;
         });

package/dist/tool-event-results.js

@@ -24,10 +24,24 @@ const SECRET_KEY_NAMES = [
     'connectionstring',
     'credentials',
     'credential',
+    'svsession',
+    'smsession',
+    'wixsession',
+    'wixsession2',
 ];
+const EXACT_ONLY_SECRET_KEY_NAMES = new Set([
+    'auth',
+    'token',
+    'svsession',
+    'smsession',
+    'wixsession',
+    'wixsession2',
+]);
+const NON_SECRET_ENVIRONMENT_KEY_NAMES = new Set(['tokencount', 'tokenizersparallelism', 'tokenusage']);
+const BOUNDARY_ONLY_SENSITIVE_VALUE_MAX_LENGTH = 1;
 export function collectSensitiveEnvValues(env) {
     return [...new Set(Object.entries(env ?? {})
-            .filter(([key, value]) => isSecretKey(key) && value.length > 0)
+            .filter(([key, value]) => isSecretEnvironmentKey(key) && value.length > 0)
             .map(([, value]) => value))]
         .sort((a, b) => b.length - a.length);
 }
@@ -37,11 +51,13 @@ export function collectSensitiveEnvValues(env) {
  * is important for summaries, snippets, traces, and provider error text.
  */
 export function sanitizePersistenceValue(source, explicitSensitiveValues = []) {
+    const explicitValues = [...new Set(explicitSensitiveValues.filter((value) => value.length > 0))]
+        .sort((a, b) => b.length - a.length);
     const sensitiveValues = [...new Set([
-            ...explicitSensitiveValues.filter((value) => value.length > 0),
+            ...explicitValues,
             ...collectStructuredSensitiveValues(source),
         ])].sort((a, b) => b.length - a.length);
-    return sanitizeValue(source, '', sensitiveValues);
+    return sanitizeValue(source, '', sensitiveValues, new Set(explicitValues));
 }
 export function sanitizeToolEventResult(source, sensitiveValues) {
     const result = {};
@@ -63,18 +79,27 @@ export function sanitizeToolEventResult(source, sensitiveValues) {
         result.truncated = true;
     return result;
 }
-function redactSensitiveValues(value, sensitiveValues) {
+function redactSensitiveValues(value, sensitiveValues, explicitSensitiveValues) {
     let redacted = value;
     for (const secret of sensitiveValues) {
-        if (secret.length > 0)
+        if (secret.length === 0)
+            continue;
+        if (explicitSensitiveValues.has(secret) || secret.length > BOUNDARY_ONLY_SENSITIVE_VALUE_MAX_LENGTH) {
             redacted = redacted.split(secret).join('<redacted>');
+            continue;
+        }
+        const escaped = secret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const leftBoundary = /^[a-z0-9]/i.test(secret) ? '(^|[^a-z0-9])' : '()';
+        const rightBoundary = /[a-z0-9]$/i.test(secret) ? '(?=$|[^a-z0-9])' : '';
+        redacted = redacted.replace(new RegExp(`${leftBoundary}${escaped}${rightBoundary}`, 'g'), '$1<redacted>');
     }
     return redacted;
 }
 function collectStructuredSensitiveValues(source) {
     const values = new Set();
     const visit = (value, key) => {
-        if (typeof value === 'string' && isSecretKey(key) && value.length > 0) {
+        if (typeof value === 'string' && !isNumericTokenTelemetry(key, value)
+            && isSecretKey(key) && value.length > 0) {
             values.add(value);
             return;
         }
@@ -91,26 +116,32 @@ function collectStructuredSensitiveValues(source) {
     visit(source, '');
     return [...values];
 }
-function sanitizeValue(value, key, sensitiveValues) {
-    if (isSecretKey(key))
+function sanitizeValue(value, key, sensitiveValues, explicitSensitiveValues) {
+    if (!isNumericTokenTelemetry(key, value) && isSecretKey(key))
         return '<redacted>';
-    if (typeof value === 'string')
-        return redactCredentialShapes(redactSensitiveValues(value, sensitiveValues));
-    if (Array.isArray(value))
-        return value.map((entry) => sanitizeValue(entry, key, sensitiveValues));
+    if (typeof value === 'string') {
+        return redactCredentialShapes(redactSensitiveValues(value, sensitiveValues, explicitSensitiveValues), sensitiveValues, explicitSensitiveValues);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => sanitizeValue(entry, key, sensitiveValues, explicitSensitiveValues));
+    }
     if (isRecord(value)) {
         return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [
             entryKey,
-            sanitizeValue(entryValue, entryKey, sensitiveValues),
+            sanitizeValue(entryValue, entryKey, sensitiveValues, explicitSensitiveValues),
         ]));
     }
     return value;
 }
-function redactCredentialShapes(value) {
+function redactCredentialShapes(value, sensitiveValues, explicitSensitiveValues) {
     let redacted = value;
     const structured = parseStructuredJson(redacted);
     if (structured !== undefined) {
-        redacted = JSON.stringify(sanitizePersistenceValue(structured));
+        const nestedSensitiveValues = [...new Set([
+                ...sensitiveValues,
+                ...collectStructuredSensitiveValues(structured),
+            ])].sort((a, b) => b.length - a.length);
+        redacted = JSON.stringify(sanitizeValue(structured, '', nestedSensitiveValues, explicitSensitiveValues));
     }
     if (redacted.includes('PRIVATE KEY-----')) {
         redacted = redacted.replace(/-----BEGIN [^-\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\n]*PRIVATE KEY-----/g, '<redacted>');
@@ -128,12 +159,20 @@ function redactCredentialShapes(value) {
 }
 function isSecretKey(key) {
     const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+    if (normalized === 'tokens')
+        return true;
     if (SECRET_KEY_NAMES.some((name) => normalized === name))
         return true;
-    const compoundNames = SECRET_KEY_NAMES.filter((name) => name !== 'auth');
+    if (normalized !== 'tokens'
+        && (normalized.endsWith('token') || /token(?:value|id|key|payload|secret)$/.test(normalized)))
+        return true;
+    if (/^(?:svsession|smsession|wixsession2?)(?:id|token|cookie|value)$/.test(normalized))
+        return true;
+    const compoundNames = SECRET_KEY_NAMES.filter((name) => !EXACT_ONLY_SECRET_KEY_NAMES.has(name));
     if (compoundNames.some((name) => normalized.startsWith(name) || normalized.endsWith(name)))
         return true;
-    const segments = key.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+    const segments = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
     for (let start = 0; start < segments.length; start++) {
         let candidate = '';
         for (let end = start; end < segments.length; end++) {
@@ -144,6 +183,36 @@ function isSecretKey(key) {
     }
     return false;
 }
+function isNumericTokenTelemetry(key, value) {
+    const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+    if (normalized === 'tokencount') {
+        return (typeof value === 'number' && Number.isFinite(value))
+            || (typeof value === 'string' && /^\d+$/.test(value));
+    }
+    if (!isRecord(value))
+        return false;
+    const entries = Object.entries(value);
+    if (normalized === 'tokenusage') {
+        return entries.length > 0 && entries.every(([entryKey, entryValue]) => (entryKey === 'inputTokens' || entryKey === 'outputTokens')
+            && typeof entryValue === 'number' && Number.isFinite(entryValue));
+    }
+    if (normalized !== 'tokens' || entries.length === 0)
+        return false;
+    return entries.every(([entryKey, entryValue]) => {
+        if (entryKey === 'input' || entryKey === 'output' || entryKey === 'reasoning') {
+            return typeof entryValue === 'number' && Number.isFinite(entryValue);
+        }
+        return entryKey === 'cache' && isRecord(entryValue)
+            && Object.entries(entryValue).every(([cacheKey, cacheValue]) => (cacheKey === 'write' || cacheKey === 'read')
+                && typeof cacheValue === 'number' && Number.isFinite(cacheValue));
+    });
+}
+function isSecretEnvironmentKey(key) {
+    const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+    if (NON_SECRET_ENVIRONMENT_KEY_NAMES.has(normalized))
+        return false;
+    return isSecretKey(key);
+}
 function parseStructuredJson(value) {
     const trimmed = value.trim();
     if (!(trimmed.startsWith('{') && trimmed.endsWith('}'))

package/docs/OPENAI_OAUTH_JUDGE.md

@@ -6,10 +6,11 @@ managed ChatGPT access session from Codex App Server.
 
 ## Install and authenticate
 
-Install the exact optional peer and sign in once with Codex:
+Install Pathgrade and sign in once with Codex. Pathgrade installs its pinned
+OAuth runtime dependency automatically:
 
 ```bash
-yarn add -D @wix/pathgrade @openai-oauth/core@2.0.0
+yarn add -D @wix/pathgrade
 codex login
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/pathgrade",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "packageManager": "yarn@4.12.0",
   "description": "Evaluate whether AI agents discover and use your skills correctly",
   "exports": {
@@ -107,14 +107,10 @@
     "node": ">=20.19.0"
   },
   "peerDependencies": {
-    "@openai-oauth/core": "2.0.0",
     "jest": "^30.0.0",
     "vitest": "^4.0.0"
   },
   "peerDependenciesMeta": {
-    "@openai-oauth/core": {
-      "optional": true
-    },
     "jest": {
       "optional": true
     },
@@ -123,7 +119,6 @@
     }
   },
   "devDependencies": {
-    "@openai-oauth/core": "2.0.0",
     "@types/fs-extra": "^11.0.4",
     "@types/jest": "^30.0.0",
     "@types/picomatch": "^4.0.2",
@@ -135,6 +130,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.141",
     "@modelcontextprotocol/sdk": "1.30.0",
+    "@openai-oauth/core": "2.0.0",
     "@types/node": "25.6.0",
     "ajv": "8.20.0",
     "fs-extra": "11.3.3",
@@ -144,5 +140,5 @@
     "typescript": "^5.9.3",
     "zod": "4.3.6"
   },
-  "falconPackageHash": "20beff94d0506c770c82c813225aca2ab4c0b4785199afb176f72286"
+  "falconPackageHash": "0debc4519da71de54bc8ca58c57f1ddbf0899cc2b06cbf908371e1e8"
 }