humanish 0.0.1 → 0.15.0

package/dist/codex-app-server.js

@@ -0,0 +1,747 @@
+import { spawn } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import readline from "node:readline";
+import { digestText, publicPathForTrace, redactText, tailText } from "./redaction.js";
+export const CODEX_APP_SERVER_TRACE_SCHEMA = "humanish.codex-app-server-trace.v1";
+const authLikeKey = /(api[_-]?key|access[_-]?token|auth[_-]?url|authorization|bearer|credential|password|secret|token)$/i;
+const pathLikeKey = /^(cwd|path|writableRoots|workspaceRoot)$/i;
+export async function runCodexAppServerSession(options) {
+    const startedAt = new Date();
+    const startedMs = Date.now();
+    const relativeDir = "codex-app-server";
+    const eventsPath = path.join(relativeDir, "events.ndjson");
+    const tracePath = path.join(relativeDir, "summary.json");
+    const transcriptPath = path.join(relativeDir, "transcript.txt");
+    const absoluteEventsPath = path.join(options.runRoot, eventsPath);
+    const absoluteTracePath = path.join(options.runRoot, tracePath);
+    const absoluteTranscriptPath = path.join(options.runRoot, transcriptPath);
+    const commandParts = resolveAppServerCommand(options.actorCommand);
+    const childEnv = resolveCodexAppServerEnv(process.env);
+    const apiKey = appServerApiKeyForLogin(childEnv);
+    const child = spawn(commandParts.command, commandParts.args, {
+        cwd: options.cwd,
+        env: childEnv,
+        stdio: ["pipe", "pipe", "pipe"]
+    });
+    const recorder = new CodexTraceRecorder({
+        commandName: commandParts.name,
+        cwd: options.cwd,
+        experimentalApi: options.experimentalApi === true,
+        promptDigest: digestText(options.prompt),
+        startedAt: startedAt.toISOString()
+    });
+    const envelopes = [];
+    let transcript = "";
+    let nextId = 1;
+    let threadId;
+    let turnId;
+    let completed = false;
+    let timedOut = false;
+    let processError;
+    let stdinError;
+    let exitCode;
+    let signal;
+    let completionStatus;
+    let completionReason = "Codex app-server turn did not complete.";
+    const pending = new Map();
+    await mkdir(path.dirname(absoluteEventsPath), { recursive: true });
+    const appendEnvelope = (direction, message) => {
+        const redacted = redactCodexEnvelope(message, options.cwd);
+        recorder.observeEnvelope(direction, redacted);
+        envelopes.push(JSON.stringify({
+            at: new Date().toISOString(),
+            direction,
+            message: redacted
+        }));
+    };
+    const send = (message) => {
+        appendEnvelope("client", message);
+        if (child.stdin.destroyed || stdinError || processError) {
+            throw stdinError ?? processError ?? new Error("Codex app-server stdin is closed.");
+        }
+        child.stdin.write(`${JSON.stringify(message)}\n`, (error) => {
+            if (error && !stdinError) {
+                stdinError = error;
+                recorder.addWarning("stdin", redactText(error.message).slice(0, 1_000));
+            }
+        });
+    };
+    const request = (method, params) => {
+        const id = nextId;
+        nextId += 1;
+        const message = params === undefined
+            ? { method, id }
+            : { method, id, params };
+        const promise = new Promise((resolve, reject) => {
+            pending.set(id, { resolve, reject });
+        });
+        send(message);
+        return promise;
+    };
+    const respond = (id, result) => {
+        send({ id, result });
+    };
+    const rl = readline.createInterface({ input: child.stdout });
+    const closed = new Promise((resolve) => {
+        child.once("error", (error) => {
+            processError = error;
+            recorder.addError("process", redactText(error.message).slice(0, 1_000));
+        });
+        child.once("close", (code, childSignal) => {
+            exitCode = code === null ? undefined : code;
+            signal = childSignal === null ? undefined : childSignal;
+            resolve();
+        });
+    });
+    child.stdin.on("error", (error) => {
+        stdinError = error;
+        recorder.addWarning("stdin", redactText(error.message).slice(0, 1_000));
+    });
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGTERM");
+        setTimeout(() => child.kill("SIGKILL"), 2_000).unref();
+    }, options.timeoutMs);
+    timeout.unref();
+    child.stderr.on("data", (chunk) => {
+        const text = redactText(chunk.toString("utf8"));
+        if (text.trim()) {
+            recorder.addWarning("stderr", text.trim().slice(0, 1_000));
+            transcript = limitTranscript(`${transcript}${text}`);
+        }
+    });
+    rl.on("line", (line) => {
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            recorder.addWarning("parse", "Received non-JSON app-server output line.");
+            transcript = limitTranscript(`${transcript}${redactText(line)}\n`);
+            return;
+        }
+        appendEnvelope("server", parsed);
+        recorder.observeServerMessage(parsed);
+        const id = parsed.id;
+        if (typeof id === "number" || typeof id === "string") {
+            if (typeof parsed.method === "string") {
+                const result = defaultServerRequestResponse(parsed);
+                recorder.recordApproval(parsed, result);
+                respond(id, result);
+                return;
+            }
+            const pendingRequest = pending.get(id);
+            if (pendingRequest) {
+                pending.delete(id);
+                if (isRecord(parsed.error)) {
+                    pendingRequest.reject(new Error(formatJsonRpcError(parsed.error)));
+                }
+                else {
+                    pendingRequest.resolve(isRecord(parsed.result) ? parsed.result : {});
+                }
+            }
+        }
+        if (parsed.method === "thread/started") {
+            threadId = readNestedString(parsed, ["params", "thread", "id"]) ?? threadId;
+            recorder.threadId = threadId;
+            recorder.sessionId = readNestedString(parsed, ["params", "thread", "sessionId"]) ?? recorder.sessionId;
+            recorder.model = readNestedString(parsed, ["params", "thread", "model"]) ?? recorder.model;
+            recorder.codexCliVersion = readNestedString(parsed, ["params", "thread", "cliVersion"]) ?? recorder.codexCliVersion;
+        }
+        if (parsed.method === "turn/started") {
+            turnId = readNestedString(parsed, ["params", "turn", "id"]) ?? turnId;
+            recorder.turnId = turnId;
+        }
+        if (parsed.method === "turn/completed") {
+            completionStatus = readNestedString(parsed, ["params", "turn", "status"]);
+            completionReason = completionStatus ? `turn completed with status ${completionStatus}` : "turn completed";
+            completed = true;
+            child.kill("SIGTERM");
+        }
+    });
+    const finish = async (status, reason) => {
+        clearTimeout(timeout);
+        for (const pendingRequest of pending.values()) {
+            pendingRequest.reject(new Error(reason));
+        }
+        pending.clear();
+        const completedAt = new Date().toISOString();
+        const durationMs = Date.now() - startedMs;
+        const trace = recorder.buildTrace({
+            completedAt,
+            durationMs,
+            reason,
+            status
+        });
+        const transcriptText = recorder.renderTranscript();
+        await writeFile(absoluteEventsPath, `${envelopes.join("\n")}${envelopes.length > 0 ? "\n" : ""}`, "utf8");
+        await writeFile(absoluteTracePath, `${JSON.stringify(trace, null, 2)}\n`, "utf8");
+        await writeFile(absoluteTranscriptPath, transcriptText.length > 0 ? transcriptText : "No Codex app-server transcript output captured.\n", "utf8");
+        return {
+            status,
+            reason,
+            durationMs,
+            ...(exitCode === undefined ? {} : { exitCode }),
+            ...(signal === undefined ? {} : { signal }),
+            ...(trace.threadId === undefined ? {} : { threadId: trace.threadId }),
+            ...(trace.turnId === undefined ? {} : { turnId: trace.turnId }),
+            ...(trace.sessionId === undefined ? {} : { sessionId: trace.sessionId }),
+            ...(trace.model === undefined ? {} : { model: trace.model }),
+            ...(trace.server.codexCliVersion === undefined ? {} : { codexCliVersion: trace.server.codexCliVersion }),
+            experimentalApi: trace.client.experimentalApi,
+            counts: trace.counts,
+            tail: tailText(transcriptText, 6_000),
+            trace,
+            transcriptPath,
+            tracePath,
+            eventsPath
+        };
+    };
+    const waitForResponse = async (promise, method) => Promise.race([
+        promise,
+        closed.then(() => {
+            const commandName = `${commandParts.command} ${commandParts.args.join(" ")}`.trim();
+            const detail = processError?.message
+                ?? stdinError?.message
+                ?? (exitCode === undefined ? "without an exit code" : `with code ${exitCode}`);
+            throw new Error(`Codex app-server command '${commandName}' exited during ${method} ${detail}.`);
+        })
+    ]);
+    try {
+        const initialize = request("initialize", {
+            clientInfo: {
+                name: "humanish_cli",
+                title: "Humanish CLI",
+                version: "0.1.0"
+            },
+            capabilities: {
+                experimentalApi: options.experimentalApi === true
+            }
+        });
+        send({ method: "initialized", params: {} });
+        await waitForResponse(initialize, "initialize");
+        if (apiKey) {
+            await waitForResponse(request("account/login/start", {
+                type: "apiKey",
+                apiKey
+            }), "account/login/start");
+        }
+        const threadResponse = await waitForResponse(request("thread/start", {
+            cwd: options.cwd,
+            approvalPolicy: normalizeApprovalPolicy(options.approvalPolicy),
+            sandbox: normalizeSandbox(options.sandbox),
+            serviceName: options.serviceName ?? "humanish",
+            ...(options.model === undefined ? {} : { model: options.model })
+        }), "thread/start");
+        threadId = readNestedString(threadResponse, ["thread", "id"]) ?? threadId;
+        recorder.threadId = threadId;
+        recorder.sessionId = readNestedString(threadResponse, ["thread", "sessionId"]) ?? recorder.sessionId;
+        recorder.model = readNestedString(threadResponse, ["thread", "model"]) ?? options.model ?? recorder.model;
+        recorder.codexCliVersion = readNestedString(threadResponse, ["thread", "cliVersion"]) ?? recorder.codexCliVersion;
+        if (!threadId) {
+            throw new Error("thread/start did not return a thread id");
+        }
+        const turnResponse = await waitForResponse(request("turn/start", {
+            threadId,
+            cwd: options.cwd,
+            approvalPolicy: normalizeApprovalPolicy(options.approvalPolicy),
+            sandboxPolicy: normalizeTurnSandbox(options.sandbox, options.cwd),
+            input: [
+                { type: "text", text: options.prompt, text_elements: [] }
+            ]
+        }), "turn/start");
+        turnId = readNestedString(turnResponse, ["turn", "id"]) ?? turnId;
+        recorder.turnId = turnId;
+        while (!completed && !timedOut) {
+            await Promise.race([
+                closed,
+                new Promise((resolve) => setTimeout(resolve, 100))
+            ]);
+            if (exitCode !== undefined || signal !== undefined) {
+                break;
+            }
+        }
+        if (timedOut) {
+            await closed;
+            return finish("timed_out", `Codex app-server turn exceeded ${options.timeoutMs}ms timeout.`);
+        }
+        if (completed) {
+            await closed;
+            const status = completionStatus === "completed"
+                ? "passed"
+                : completionStatus === "failed"
+                    ? "failed"
+                    : "blocked";
+            return finish(status, completionReason);
+        }
+        await closed;
+        return finish(exitCode === 0 ? "passed" : "blocked", `Codex app-server process exited before turn completion${exitCode === undefined ? "" : ` with code ${exitCode}`}.`);
+    }
+    catch (error) {
+        child.kill("SIGTERM");
+        await closed;
+        return finish("blocked", error instanceof Error ? error.message : String(error));
+    }
+}
+function resolveAppServerCommand(overrideCommand) {
+    const commandParts = overrideCommand && overrideCommand.length > 0
+        ? overrideCommand
+        : ["codex", "app-server", "--listen", "stdio://"];
+    const [command, ...args] = commandParts;
+    return {
+        command: command ?? "codex",
+        args,
+        name: path.basename(command ?? "codex")
+    };
+}
+function resolveCodexAppServerEnv(env) {
+    const privateApiKey = env.HUMANISH_PRIVATE_CODEX_API_KEY?.trim();
+    const privateAccessToken = env.HUMANISH_PRIVATE_CODEX_ACCESS_TOKEN?.trim();
+    return {
+        ...env,
+        TERM: env.TERM ?? "xterm-256color",
+        ...(privateApiKey && !env.CODEX_API_KEY ? { CODEX_API_KEY: privateApiKey } : {}),
+        ...(privateApiKey && !env.OPENAI_API_KEY ? { OPENAI_API_KEY: privateApiKey } : {}),
+        ...(privateAccessToken && !env.CODEX_ACCESS_TOKEN ? { CODEX_ACCESS_TOKEN: privateAccessToken } : {})
+    };
+}
+function appServerApiKeyForLogin(env) {
+    return env.HUMANISH_PRIVATE_CODEX_API_KEY?.trim()
+        || env.CODEX_API_KEY?.trim()
+        || env.OPENAI_API_KEY?.trim()
+        || undefined;
+}
+function defaultServerRequestResponse(message) {
+    switch (message.method) {
+        case "item/commandExecution/requestApproval":
+            return { decision: "decline" };
+        case "item/fileChange/requestApproval":
+            return { decision: "decline" };
+        case "applyPatchApproval":
+        case "execCommandApproval":
+            return { decision: "denied" };
+        case "item/tool/requestUserInput":
+            return { answers: {} };
+        case "mcpServer/elicitation/request":
+            return { action: "decline" };
+        default:
+            return {};
+    }
+}
+function normalizeApprovalPolicy(value) {
+    if (value === "on-failure")
+        return "on-failure";
+    if (value === "on-request")
+        return "on-request";
+    if (value === "untrusted")
+        return "untrusted";
+    return "never";
+}
+function normalizeSandbox(value) {
+    if (value === "danger-full-access")
+        return "danger-full-access";
+    if (value === "workspace-write")
+        return "workspace-write";
+    return "read-only";
+}
+function normalizeTurnSandbox(value, cwd) {
+    const mode = normalizeSandbox(value);
+    if (mode === "workspace-write") {
+        return {
+            type: "workspaceWrite",
+            writableRoots: [cwd],
+            networkAccess: false,
+            excludeTmpdirEnvVar: false,
+            excludeSlashTmp: false
+        };
+    }
+    if (mode === "danger-full-access") {
+        return { type: "dangerFullAccess" };
+    }
+    return { type: "readOnly", networkAccess: false };
+}
+class CodexTraceRecorder {
+    commandOutputs = new Map();
+    fileOutputs = new Map();
+    messageDeltas = new Map();
+    reasoningDeltas = new Map();
+    rootCwd;
+    trace;
+    codexCliVersion;
+    model;
+    sessionId;
+    threadId;
+    turnId;
+    constructor(args) {
+        this.rootCwd = args.cwd;
+        this.trace = {
+            schema: CODEX_APP_SERVER_TRACE_SCHEMA,
+            provider: "codex-app-server",
+            protocolVersion: "v2",
+            redaction: {
+                status: "passed",
+                notes: "Trace envelopes and text were redacted before persistence. App-server schemas are version-specific and are not embedded in this run artifact."
+            },
+            client: {
+                name: "humanish_cli",
+                title: "Humanish CLI",
+                experimentalApi: args.experimentalApi
+            },
+            server: {
+                commandName: args.commandName,
+                transport: "stdio"
+            },
+            cwd: publicPathForTrace(args.cwd, args.cwd),
+            promptDigest: args.promptDigest,
+            startedAt: args.startedAt,
+            counts: {
+                approvals: 0,
+                commandOutputs: 0,
+                envelopes: 0,
+                errors: 0,
+                fileChanges: 0,
+                itemCompletions: 0,
+                itemStarts: 0,
+                messages: 0,
+                reasoning: 0,
+                requests: 0,
+                responses: 0,
+                tools: 0,
+                warnings: 0
+            },
+            methods: {},
+            items: [],
+            messages: [],
+            reasoning: [],
+            plans: [],
+            commands: [],
+            fileChanges: [],
+            tools: [],
+            approvals: [],
+            warnings: [],
+            errors: []
+        };
+    }
+    observeEnvelope(direction, message) {
+        this.trace.counts.envelopes += 1;
+        if (direction === "client") {
+            this.trace.counts.requests += isRecord(message) && "id" in message ? 1 : 0;
+        }
+        else if (isRecord(message) && "id" in message && !("method" in message)) {
+            this.trace.counts.responses += 1;
+        }
+        const method = isRecord(message) && typeof message.method === "string" ? message.method : direction === "server" ? "response" : "request";
+        this.trace.methods[method] = (this.trace.methods[method] ?? 0) + 1;
+    }
+    observeServerMessage(message) {
+        const method = typeof message.method === "string" ? message.method : "";
+        if (method === "error") {
+            this.addError(method, readNestedString(message, ["params", "message"]) ?? "App-server emitted an error notification.");
+        }
+        if (method === "warning" || method === "guardianWarning" || method === "configWarning") {
+            this.addWarning(method, readNestedString(message, ["params", "message"]) ?? `App-server emitted ${method}.`);
+        }
+        if (method === "thread/tokenUsage/updated") {
+            if (isRecord(message.params)) {
+                this.trace.tokenUsage = message.params;
+            }
+        }
+        if (method === "item/started" || method === "item/completed") {
+            this.recordItem(message, method === "item/started" ? "started" : "completed");
+        }
+        if (method === "item/agentMessage/delta") {
+            this.appendText(this.messageDeltas, message);
+            this.trace.counts.messages += 1;
+        }
+        if (method === "item/reasoning/summaryTextDelta" || method === "item/reasoning/textDelta") {
+            this.appendText(this.reasoningDeltas, message);
+            this.trace.counts.reasoning += 1;
+        }
+        if (method === "item/commandExecution/outputDelta" || method === "command/exec/outputDelta" || method === "process/outputDelta") {
+            this.appendText(this.commandOutputs, message);
+            this.trace.counts.commandOutputs += 1;
+        }
+        if (method === "item/fileChange/outputDelta") {
+            this.appendText(this.fileOutputs, message);
+        }
+        if (method === "turn/plan/updated") {
+            this.recordPlan(message);
+        }
+    }
+    recordApproval(message, response) {
+        this.trace.counts.approvals += 1;
+        const itemId = readNestedString(message, ["params", "itemId"]);
+        this.trace.approvals.push({
+            id: message.id,
+            method: typeof message.method === "string" ? message.method : "unknown",
+            ...(itemId === undefined ? {} : { itemId }),
+            decision: typeof response.decision === "string" && response.decision === "denied" ? "denied" : typeof response.decision === "string" ? "decline" : "empty",
+            reason: "Humanish records app-server approval requests and declines by default unless a future explicit policy says otherwise."
+        });
+    }
+    addWarning(method, message) {
+        this.trace.counts.warnings += 1;
+        this.trace.warnings.push({ method, message: redactText(message) });
+    }
+    addError(method, message) {
+        this.trace.counts.errors += 1;
+        this.trace.errors.push({ method, message: redactText(message) });
+    }
+    buildTrace(args) {
+        const messages = Array.from(this.messageDeltas.entries())
+            .filter(([, text]) => text.trim() !== "")
+            .map(([itemId, text]) => ({ itemId, text: redactText(text) }));
+        const reasoning = Array.from(this.reasoningDeltas.entries())
+            .filter(([, text]) => text.trim() !== "")
+            .map(([itemId, text]) => ({ itemId, text: redactText(text) }));
+        const commands = this.trace.commands.map((command) => ({
+            ...command,
+            outputTail: tailText(redactText(this.commandOutputs.get(command.itemId) ?? command.outputTail ?? ""), 2_000)
+        }));
+        const fileChanges = this.trace.fileChanges.map((fileChange) => ({
+            ...fileChange,
+            outputTail: tailText(redactText(this.fileOutputs.get(fileChange.itemId) ?? fileChange.outputTail ?? ""), 2_000)
+        }));
+        return {
+            ...this.trace,
+            server: {
+                ...this.trace.server,
+                ...(this.codexCliVersion === undefined ? {} : { codexCliVersion: this.codexCliVersion })
+            },
+            ...(this.threadId === undefined ? {} : { threadId: this.threadId }),
+            ...(this.turnId === undefined ? {} : { turnId: this.turnId }),
+            ...(this.sessionId === undefined ? {} : { sessionId: this.sessionId }),
+            ...(this.model === undefined ? {} : { model: this.model }),
+            completedAt: args.completedAt,
+            durationMs: args.durationMs,
+            status: args.status,
+            reason: redactText(args.reason),
+            messages,
+            reasoning,
+            commands,
+            fileChanges
+        };
+    }
+    renderTranscript() {
+        const trace = this.buildTrace({
+            completedAt: new Date().toISOString(),
+            durationMs: 0,
+            reason: "transcript render",
+            status: "blocked"
+        });
+        const sections = [
+            ["Agent messages", trace.messages.map((message) => message.text).join("\n\n")],
+            ["Reasoning summaries", trace.reasoning.map((entry) => entry.text).join("\n\n")],
+            ["Commands", trace.commands.map((command) => `${command.command ?? "command"}\n${command.outputTail ?? ""}`).join("\n\n")],
+            ["File changes", trace.fileChanges.map((fileChange) => `${fileChange.status ?? "fileChange"} ${fileChange.changeCount ?? 0} change(s)`).join("\n")]
+        ];
+        return sections
+            .filter(([, text]) => text.trim() !== "")
+            .map(([title, text]) => `## ${title}\n\n${text.trim()}`)
+            .join("\n\n");
+    }
+    appendText(target, message) {
+        const itemId = readNestedString(message, ["params", "itemId"]) ?? "unknown";
+        const delta = readNestedString(message, ["params", "delta"]) ?? "";
+        target.set(itemId, limitTranscript(`${target.get(itemId) ?? ""}${redactText(delta)}`));
+    }
+    recordItem(message, lifecycle) {
+        const item = readNestedRecord(message, ["params", "item"]);
+        const id = readString(item, "id") ?? `unknown-${this.trace.items.length + 1}`;
+        const type = readString(item, "type") ?? "unknown";
+        const status = readString(item, "status");
+        this.trace.items.push({
+            id,
+            type,
+            lifecycle,
+            title: itemTitle(item, type),
+            ...(status === undefined ? {} : { status })
+        });
+        if (lifecycle === "started") {
+            this.trace.counts.itemStarts += 1;
+        }
+        else {
+            this.trace.counts.itemCompletions += 1;
+        }
+        if (type === "commandExecution") {
+            this.recordCommand(item, id, status);
+        }
+        if (type === "fileChange") {
+            this.recordFileChange(item, id, status);
+        }
+        if (type === "mcpToolCall" || type === "dynamicToolCall") {
+            this.recordToolCall(item, id, type, status);
+        }
+    }
+    recordCommand(item, itemId, status) {
+        const existingIndex = this.trace.commands.findIndex((command) => command.itemId === itemId);
+        const commandCwd = readString(item, "cwd");
+        const command = {
+            itemId,
+            ...(readString(item, "command") === undefined ? {} : { command: redactText(readString(item, "command") ?? "") }),
+            ...(commandCwd === undefined ? {} : { cwd: publicPathForTrace(commandCwd, this.rootCwd) }),
+            ...(status === undefined ? {} : { status }),
+            ...(typeof item.exitCode === "number" ? { exitCode: item.exitCode } : {}),
+            ...(readString(item, "aggregatedOutput") === undefined ? {} : { outputTail: tailText(redactText(readString(item, "aggregatedOutput") ?? ""), 2_000) })
+        };
+        if (existingIndex === -1) {
+            this.trace.commands.push(command);
+        }
+        else {
+            this.trace.commands[existingIndex] = { ...this.trace.commands[existingIndex], ...command };
+        }
+    }
+    recordFileChange(item, itemId, status) {
+        this.trace.counts.fileChanges += 1;
+        const existingIndex = this.trace.fileChanges.findIndex((fileChange) => fileChange.itemId === itemId);
+        const fileChange = {
+            itemId,
+            ...(status === undefined ? {} : { status }),
+            ...(Array.isArray(item.changes) ? { changeCount: item.changes.length } : {})
+        };
+        if (existingIndex === -1) {
+            this.trace.fileChanges.push(fileChange);
+        }
+        else {
+            this.trace.fileChanges[existingIndex] = { ...this.trace.fileChanges[existingIndex], ...fileChange };
+        }
+    }
+    recordToolCall(item, itemId, type, status) {
+        this.trace.counts.tools += 1;
+        const server = readString(item, "server");
+        const tool = readString(item, "tool");
+        this.trace.tools.push({
+            itemId,
+            kind: type === "mcpToolCall" ? "mcp" : type === "dynamicToolCall" ? "dynamic" : "unknown",
+            ...(server === undefined ? {} : { server }),
+            ...(tool === undefined ? {} : { tool }),
+            ...(status === undefined ? {} : { status })
+        });
+    }
+    recordPlan(message) {
+        const params = isRecord(message.params) ? message.params : {};
+        const explanation = typeof params.explanation === "string" ? params.explanation : undefined;
+        const plan = Array.isArray(params.plan) ? params.plan : [];
+        this.trace.plans.push({
+            ...(explanation === undefined ? {} : { explanation: redactText(explanation) }),
+            steps: plan.map((step) => summarizePlanStep(step))
+        });
+    }
+}
+function readNestedRecord(value, pathParts) {
+    let current = value;
+    for (const part of pathParts) {
+        if (!isRecord(current)) {
+            return {};
+        }
+        current = current[part];
+    }
+    return isRecord(current) ? current : {};
+}
+function readNestedString(value, pathParts) {
+    let current = value;
+    for (const part of pathParts) {
+        if (!isRecord(current)) {
+            return undefined;
+        }
+        current = current[part];
+    }
+    return typeof current === "string" ? current : undefined;
+}
+function readString(value, key) {
+    return typeof value[key] === "string" ? value[key] : undefined;
+}
+function itemTitle(item, type) {
+    if (type === "commandExecution") {
+        return redactText(readString(item, "command") ?? "command execution");
+    }
+    if (type === "agentMessage") {
+        return tailText(redactText(readString(item, "text") ?? "agent message"), 120);
+    }
+    if (type === "mcpToolCall") {
+        return redactText([readString(item, "server"), readString(item, "tool")].filter(Boolean).join("/") || "mcp tool call");
+    }
+    if (type === "dynamicToolCall") {
+        return redactText(readString(item, "tool") ?? "dynamic tool call");
+    }
+    return redactText(type);
+}
+function summarizePlanStep(step) {
+    if (!isRecord(step)) {
+        return redactText(String(step));
+    }
+    const text = readString(step, "step") ?? readString(step, "text") ?? readString(step, "description") ?? JSON.stringify(redactJsonValue(step));
+    const status = readString(step, "status");
+    return status ? `${status}: ${redactText(text)}` : redactText(text);
+}
+function formatJsonRpcError(error) {
+    const code = typeof error.code === "number" ? `${error.code}: ` : "";
+    const message = typeof error.message === "string" ? error.message : JSON.stringify(redactJsonValue(error));
+    return redactText(`${code}${message}`);
+}
+function redactCodexEnvelope(value, rootCwd) {
+    const redacted = redactJsonValue(value, "", rootCwd);
+    if (!isRecord(value) || !isRecord(redacted) || value.method !== "turn/start") {
+        return redacted;
+    }
+    const rawParams = isRecord(value.params) ? value.params : {};
+    const redactedParams = isRecord(redacted.params) ? redacted.params : {};
+    const rawInput = Array.isArray(rawParams.input) ? rawParams.input : null;
+    const redactedInput = Array.isArray(redactedParams.input) ? redactedParams.input : null;
+    if (!rawInput || !redactedInput) {
+        return redacted;
+    }
+    return {
+        ...redacted,
+        params: {
+            ...redactedParams,
+            input: redactedInput.map((entry, index) => redactTurnInputEntry(rawInput[index], entry))
+        }
+    };
+}
+function redactTurnInputEntry(rawEntry, redactedEntry) {
+    if (!isRecord(redactedEntry)) {
+        return redactedEntry;
+    }
+    const rawText = isRecord(rawEntry) && typeof rawEntry.text === "string" ? rawEntry.text : undefined;
+    if (rawText === undefined) {
+        return redactedEntry;
+    }
+    return {
+        ...redactedEntry,
+        text: "[REDACTED_PROMPT_TEXT]",
+        textDigest: digestText(rawText),
+        textLength: rawText.length,
+        ...(Array.isArray(redactedEntry.text_elements) ? { text_elements: [] } : {})
+    };
+}
+function redactJsonValue(value, keyHint = "", rootCwd) {
+    if (typeof value === "string") {
+        if (authLikeKey.test(keyHint)) {
+            return "[REDACTED_SECRET]";
+        }
+        if (rootCwd && pathLikeKey.test(keyHint)) {
+            return publicPathForTrace(value, rootCwd);
+        }
+        return redactText(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactJsonValue(entry, keyHint, rootCwd));
+    }
+    if (isRecord(value)) {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, redactJsonValue(entry, key, rootCwd)]));
+    }
+    return value;
+}
+function limitTranscript(value) {
+    const maxChars = 80_000;
+    if (value.length <= maxChars) {
+        return value;
+    }
+    return `[...sanitized transcript truncated to last ${maxChars} characters...]\n${value.slice(-maxChars)}`;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=codex-app-server.js.map