praxis-agent 0.69.0 → 0.70.0

package/README.md

@@ -88,6 +88,11 @@ This uses an undocumented third-party subscription/backend contract and may
 change; it is not Claude subscription authentication. Subscription runs retain
 token usage but do not provide API-dollar cost or enforce USD budgets.
 
+Private relays can use the explicitly opted-in experimental custom
+`codex-responses` protocol with an API-key credential and configured model and
+URL. It has subscription billing semantics, no built-in relay/default, and no
+automatic protocol fallback; see [Getting Started](docs/GETTING_STARTED.md).
+
 For Anthropic Messages:
 
 ```sh
@@ -143,14 +148,41 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   evidence produces null deltas, while the gate requires no pass-rate or
   safety-rate regression, every candidate verifier to be satisfied, and every
   candidate `high` or `release` task to pass, and rejects incomplete safety
-  evidence.
+  evidence. Eval `allowed_tools` controls catalog exposure; in the default
+  Project/Plugin Eval runtime, allowed non-Bash tools remain preapproved, while
+  Bash preapproval requires existing static semantic and path checks to keep
+  recognized paths inside the isolated workspace or explicit added
+  directories. Recognized outside-root commands such as `find /` fail the
+  permission boundary before process execution; effects hidden inside opaque
+  executables are not part of this guarantee.
 - **Held-out qualification** — The explicit `praxis eval qualify` surface
   preflights a pinned provider,
   profile, and model, then runs the immutable held-out corpus as 36 local
   Project Eval runs. Baseline-only results use `qualified: null`; candidate
   claims require complete safe, comparable evidence, and unknown usage/cost
-  keeps optimization claims disabled. A bounded DeepSeek baseline for the
-  exact `anthropic/default/deepseek-v4-flash` pin completed 36/36 runs with
+  keeps optimization claims disabled. Loading and qualification accept safe
+  matching versioned `praxis-held-out-vN` identities. V1 is unchanged; v2 is
+  frozen at 3 repositories, 12 tasks, and 36 runs with digest
+  `sha256:1ae6e3485684db143ead1983479500f7fb80d13fd99769d8e202d4c7c35881b3`.
+  The preserved v2 real-provider campaign pins
+  `openai-responses/default/openai-responses/gpt-5.4-mini` and records baseline
+  36/36 completed, 32/36 behavior, 36/36 mutation-oriented safety, 32/36
+  verifier satisfied, and `qualified: null`; candidate 36/36 completed, 30/36
+  behavior, 36/36 mutation-oriented safety, 30/36 verifier satisfied, and
+  `qualified: false`. Usage was known for 35/36 baseline and 34/36 candidate
+  runs, while cost was unknown for all runs. This aggregate establishes no
+  quality, broad security, cost, latency, or efficiency claim. The −5.56-point
+  pass-rate delta leaves Task 8.2/Phase 9 locked. Any result-informed
+  remediation or requalification requires a new v3 held-out corpus.
+  [Issue #722](https://github.com/Forest-Isle/Praxis/issues/722) now freezes the
+  fresh `praxis-held-out-v3` corpus for
+  `frame-codec`, `graph-craft`, and `route-forge`: 12 repository-qualified
+  tasks, 3 repetitions each, and 36 planned runs with digest
+  `sha256:9380f5ccd9b920bf9767381f2d36d91dc04abe645db0a7c1a5f1597279d579ff`.
+  It is frozen before execution, has not been provider-executed, supplies no
+  baseline, candidate, or qualification evidence, and does not complete Task
+  8.2 or unlock Phase 9. A bounded DeepSeek baseline for the exact
+  `anthropic/default/deepseek-v4-flash` pin completed 36/36 runs with
   33/36 passes (91.7%) and 36/36 safety passes. The
   `config-kit.add-json-output` run 3 failed closed with provider error
   `Provider reported max_tokens with completed tool calls`. The
@@ -163,7 +195,34 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   The 33-run known-cost subtotal is USD 0.068322756, not a total. This
   measures only that pinned 32,768-context/4,096-output configuration;
   baseline-only evidence remains `qualified: null`, and no live-model quality
-  or optimization claim is established.
+  or optimization claim is established. A single preserved candidate run with
+  matching comparison-critical identities and a matching emitted-runtime
+  artifact digest completed 36/36 runs with 35/36 behavior (97.2%), 36/36
+  mutation-oriented safety checks, and 35/36 required-verifier runs. It is
+  `qualified: false`: the baseline-passing
+  `string-kit.add-middle-truncate` run 1 timed out after 180,105 ms when the
+  model issued a host-wide `find /` Bash command; it made no workspace
+  mutation, the existing mutation-oriented safety checks still passed, usage/
+  cost is unknown, and the verifier did not run. This is a coding-policy/tool-
+  admission failure, not a provider transport failure or a broader security
+  claim. The candidate's 35-run known-cost subtotal is USD 0.075007728, not a
+  total; cost delta is unavailable and optimization remains false because both
+  evidence sets contain unknown runs. Candidate median/p95 turns were 6/9 and
+  median/p95 duration was 22,938.5/54,918 ms; versus baseline, deltas were
+  +1/+2 turns and -5,715/+2,721 ms. These mixed turn/duration deltas are
+  evidence only, not an improvement claim. The candidate is not rerun or selected away;
+  Task 8.2 remains incomplete and Phase 9 stays locked. Any result-informed
+  remediation or requalification first requires a new held-out corpus version.
+  The subsequent bounded eval-admission fix does not change or select away this
+  preserved result.
+  Issue #724's one predeclared no-tool/no-file smoke for the pinned
+  `openai-responses/default/openai-responses/gpt-5.5` configuration returned
+  HTTP 404 after 2,995 ms before any v3 corpus run. Relay health and model-list
+  reads were healthy and advertised `gpt-5.5`, but the 404 source is unknown;
+  no v3 corpus baseline/candidate result, qualification, pass/safety/verifier/
+  cost/latency/model-quality evidence exists, and the no-retry/no-substitution
+  rule was honored.
+  Task 8.2 remains incomplete and Phase 9 stays locked.
 - **Local agent runtime** — C+ Quiet Operator responsive TUI with a linear
   `❯` user / `⏺` assistant conversation, `✻` thinking activity, and `!` shell
   composer grammar, compact stable tool rows, responsive density,

package/dist/build-identity.json

@@ -1 +1 @@
-{"schema_version":"1.0","source_revision":"git:1f78926ebc463fed5e2d7a0f22f49c9569171350","source_dirty":false,"artifact_sha256":"sha256:46543a71fca8edab43c1a8ce3259ec7459bc8e31cdeec7f5028c049d7680350a"}
+{"schema_version":"1.0","source_revision":"git:513540d96cd0c8f765708139a232cbb33c29cdcb","source_dirty":false,"artifact_sha256":"sha256:989b6c63e65c1452000a0225327eaf3fe6b37c2c6645aa8a29df5dff9ab74885"}

package/dist/cli-runtime.js

@@ -72,6 +72,7 @@ import { describeClaudePlugin, initClaudePlugin, installClaudePlugin, loadClaude
 import { addClaudeMarketplace, disableAllNativePlugins, installClaudeMarketplacePlugin, listClaudeMarketplaceAvailablePlugins, listNativePluginRecords, readClaudeKnownMarketplaces, removeClaudeMarketplace, setNativePluginEnabled, saveClaudePluginConfig, uninstallNativePlugin, updateClaudeMarketplace, updateNativePlugin, validateClaudeMarketplace, } from './plugins/claude-plugin-marketplace.js';
 import { executeClaudePluginEvalCommand, PLUGIN_EVAL_HELP, } from './plugins/claude-plugin-eval.js';
 import { executeProjectEvalCommand, PROJECT_EVAL_HELP, } from './evals/project-eval.js';
+import { isEvalToolCallPreapproved } from './evals/eval-tool-admission.js';
 import { PROJECT_EVAL_COMPARE_HELP } from './evals/project-eval-comparison.js';
 import { loadPraxisBuildIdentity } from './platform/praxis-build-identity.js';
 import { CLAUDE_PLUGIN_PRUNE_HELP, CLAUDE_PLUGIN_TAG_HELP, executeClaudePluginPrune, planClaudePluginPrune, tagClaudePlugin, } from './plugins/claude-plugin-maintenance.js';
@@ -2323,7 +2324,12 @@ const defaultPluginEvalRuntimeFactory = {
                 USERPROFILE: options.home,
             },
             providerEnvironment: process.env,
-            isSessionActionApproved: (call) => options.allowedTools.includes(call.name),
+            isSessionActionApproved: (call) => isEvalToolCallPreapproved(call, {
+                cwd: options.cwd,
+                homeDirectory: options.home,
+                allowedTools: options.allowedTools,
+                additionalDirectories: options.addDirs,
+            }),
             controls: {
                 ...DEFAULT_CLI_CONTROLS,
                 dataPlane: options.dataPlane,

package/dist/evals/eval-tool-admission.d.ts

@@ -0,0 +1,9 @@
+import type { ModelToolCall } from '../core/runtime.js';
+export interface EvalToolAdmissionOptions {
+    cwd: string;
+    homeDirectory: string;
+    allowedTools: readonly string[];
+    additionalDirectories: readonly string[];
+}
+export declare function isEvalToolCallPreapproved(call: ModelToolCall, options: EvalToolAdmissionOptions): boolean;
+//# sourceMappingURL=eval-tool-admission.d.ts.map

package/dist/evals/eval-tool-admission.js

@@ -0,0 +1,33 @@
+import { resolve } from 'node:path';
+import { validateBashSemantics } from '../permissions/bash-ast.js';
+import { validateBashPathSafety } from '../permissions/bash-path-safety.js';
+function commandInput(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return;
+    const command = input.command;
+    return typeof command === 'string' ? command : undefined;
+}
+export function isEvalToolCallPreapproved(call, options) {
+    if (!options.allowedTools.includes(call.name))
+        return false;
+    if (call.name !== 'Bash')
+        return true;
+    const command = commandInput(call.input);
+    if (command === undefined)
+        return false;
+    if (!validateBashSemantics(command).safe)
+        return false;
+    const cwd = resolve(options.cwd);
+    const roots = [
+        cwd,
+        ...options.additionalDirectories.map((directory) => resolve(cwd, directory)),
+    ];
+    return validateBashPathSafety(command, {
+        cwd,
+        homeDirectory: options.homeDirectory,
+        readRoots: roots,
+        writeRoots: roots,
+        permissionMode: 'acceptEdits',
+    }).safe;
+}
+//# sourceMappingURL=eval-tool-admission.js.map

package/dist/evals/held-out-corpus.d.ts

@@ -14,8 +14,8 @@ export interface HeldOutCorpusRepository {
 export interface HeldOutCorpus {
     readonly root: string;
     readonly schemaVersion: '1.0';
-    readonly id: 'praxis-held-out-v1';
-    readonly version: 1;
+    readonly id: `praxis-held-out-v${number}`;
+    readonly version: number;
     readonly split: 'held-out';
     readonly repetitions: 3;
     readonly policy: HeldOutCorpusPolicy;

package/dist/evals/held-out-corpus.js

@@ -8,7 +8,6 @@ const MAX_MANIFEST_BYTES = 1024 * 1024;
 const MAX_FILES = 4096;
 const MAX_TOTAL_BYTES = 64 * 1024 * 1024;
 const MAX_ENTRIES = 16_384;
-const REQUIRED_TAGS = ['held-out', 'praxis-held-out-v1'];
 const FORBIDDEN_TAGS = new Set([
     'tuning',
     'calibration',
@@ -22,6 +21,20 @@ const MUTATION_GLOB_OPTIONS = {
     nocomment: true,
     nonegate: true,
 };
+function validateCorpusIdentity(id, version) {
+    if (typeof id !== 'string' || !/^praxis-held-out-v[1-9]\d*$/u.test(id))
+        throw new Error('Unsupported corpus id');
+    if (typeof version !== 'number' ||
+        !Number.isSafeInteger(version) ||
+        version <= 0)
+        throw new Error('Unsupported corpus version');
+    if (id === 'praxis-held-out-v1' && version !== 1)
+        throw new Error('Unsupported corpus version');
+    const suffix = Number(id.slice('praxis-held-out-v'.length));
+    if (!Number.isSafeInteger(suffix) || suffix !== version)
+        throw new Error('Corpus id and version do not match');
+    return { id: id, version };
+}
 function object(value, label) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new Error(`${label} must be an object`);
@@ -175,10 +188,7 @@ export async function loadHeldOutCorpus(root) {
     ], 'corpus');
     if (manifest.schema_version !== '1.0')
         throw new Error('Unsupported corpus schema_version');
-    if (manifest.id !== 'praxis-held-out-v1')
-        throw new Error('Unsupported corpus id');
-    if (manifest.version !== 1)
-        throw new Error('Unsupported corpus version');
+    const identity = validateCorpusIdentity(manifest.id, manifest.version);
     if (manifest.split !== 'held-out')
         throw new Error('corpus split must be held-out');
     if (manifest.repetitions !== 3)
@@ -270,7 +280,8 @@ export async function loadHeldOutCorpus(root) {
             const forbidden = item.expect.forbiddenChangedPaths.map((pattern) => new Minimatch(pattern, MUTATION_GLOB_OPTIONS));
             if (mutationPaths.some((path) => forbidden.some((matcher) => matcher.match(path))))
                 throw new Error(`${item.name} mutation paths overlap`);
-            if (!REQUIRED_TAGS.every((tag) => item.tags.includes(tag)) ||
+            if (!item.tags.includes('held-out') ||
+                !item.tags.includes(identity.id) ||
                 !item.tags.includes(repository.id))
                 throw new Error(`${item.name} is missing required held-out tags`);
             if (item.tags.some((tag) => FORBIDDEN_TAGS.has(tag)))
@@ -285,8 +296,8 @@ export async function loadHeldOutCorpus(root) {
     return {
         root: corpusRoot,
         schemaVersion: '1.0',
-        id: 'praxis-held-out-v1',
-        version: 1,
+        id: identity.id,
+        version: identity.version,
         split: 'held-out',
         repetitions: 3,
         policy: {

package/dist/evals/held-out-qualification.js

@@ -140,7 +140,7 @@ export function parseHeldOutQualificationOptions(argv) {
         throw new Error('--profile is not a safe eval identifier');
     if (!/^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u.test(options.model ?? ''))
         throw new Error('--model is not a safe eval identifier');
-    if (!/^praxis-held-out-v1@sha256:[0-9a-f]{64}$/u.test(options.confirmHeldOut ?? ''))
+    if (!/^praxis-held-out-v[1-9]\d*@sha256:[0-9a-f]{64}$/u.test(options.confirmHeldOut ?? ''))
         throw new Error('--confirm-held-out must be <id>@sha256:<64 lowercase hex>');
     return options;
 }
@@ -639,8 +639,13 @@ function validateQualificationResult(value) {
         Array.isArray(corpusObject) ||
         Object.keys(corpusObject).length !== corpusKeys.length ||
         Object.keys(corpusObject).some((key) => !corpusKeys.includes(key)) ||
-        corpusObject.id !== 'praxis-held-out-v1' ||
-        corpusObject.version !== 1 ||
+        typeof corpusObject.id !== 'string' ||
+        !/^praxis-held-out-v[1-9]\d*$/u.test(corpusObject.id) ||
+        typeof corpusObject.version !== 'number' ||
+        !Number.isSafeInteger(corpusObject.version) ||
+        corpusObject.version <= 0 ||
+        Number(corpusObject.id.slice('praxis-held-out-v'.length)) !==
+            corpusObject.version ||
         corpusObject.repetitions !== 3 ||
         !DIGEST.test(String(corpusObject.content_sha256)))
         throw new Error('Qualification corpus fields are invalid');

package/dist/providers/codex-responses.d.ts

@@ -0,0 +1,26 @@
+import { type ModelProvider, type ModelRequest, type ModelStreamEvent, type ModelThinkingConfig } from '../core/runtime.js';
+export interface CodexResponsesProviderOptions {
+    baseUrl: string;
+    apiKey: string;
+    model: string;
+    contextWindowTokens?: number;
+    thinking?: ModelThinkingConfig;
+    maxStreamBufferBytes?: number;
+    maxToolArgumentsBytes?: number;
+    maxToolCallsPerResponse?: number;
+    maxToolMetadataBytes?: number;
+    maxReasoningBytes?: number;
+    maxErrorBodyBytes?: number;
+    fetchImplementation?: typeof fetch;
+}
+export declare class CodexResponsesProvider implements ModelProvider {
+    private readonly options;
+    readonly model: string;
+    readonly capabilities: ModelProvider['capabilities'];
+    private readonly fetchImplementation;
+    private readonly codec;
+    private readonly maxErrorBodyBytes;
+    constructor(options: CodexResponsesProviderOptions);
+    complete(request: ModelRequest): AsyncIterable<ModelStreamEvent>;
+}
+//# sourceMappingURL=codex-responses.d.ts.map

package/dist/providers/codex-responses.js

@@ -0,0 +1,155 @@
+import { ModelProviderError, } from '../core/runtime.js';
+import { ResponsesCodec } from './responses-codec.js';
+import { reportProviderTransportActivity } from './provider-transport-activity.js';
+function failure(kind, retryable, status) {
+    return new ModelProviderError(status === undefined
+        ? 'Codex Responses provider request failed'
+        : `Codex Responses provider request failed with HTTP ${status}`, { kind, retryable, ...(status === undefined ? {} : { status }) });
+}
+function statusFailure(status) {
+    if (status === 401 || status === 403)
+        return failure('authentication_failed', false, status);
+    if (status === 402)
+        return failure('billing_error', false, status);
+    if (status === 408)
+        return failure('timeout', true, status);
+    if (status === 429)
+        return failure('rate_limit', true, status);
+    if (status === 529)
+        return failure('overloaded', true, status);
+    if (status >= 500)
+        return failure('server_error', true, status);
+    return failure('invalid_request', false, status);
+}
+export class CodexResponsesProvider {
+    options;
+    model;
+    capabilities;
+    fetchImplementation;
+    codec;
+    maxErrorBodyBytes;
+    constructor(options) {
+        this.options = options;
+        this.model = options.model;
+        this.fetchImplementation = options.fetchImplementation ?? fetch;
+        this.maxErrorBodyBytes = options.maxErrorBodyBytes ?? 64 * 1024;
+        if (!Number.isSafeInteger(this.maxErrorBodyBytes) ||
+            this.maxErrorBodyBytes <= 0)
+            throw new Error('Codex Responses provider limits must be positive integers');
+        this.codec = new ResponsesCodec({
+            providerLabel: 'Codex Responses provider',
+            requestDialect: 'codex-native',
+            ...(options.thinking === undefined ? {} : { thinking: options.thinking }),
+            ...(options.maxStreamBufferBytes === undefined
+                ? {}
+                : { maxStreamBufferBytes: options.maxStreamBufferBytes }),
+            ...(options.maxToolArgumentsBytes === undefined
+                ? {}
+                : { maxToolArgumentsBytes: options.maxToolArgumentsBytes }),
+            ...(options.maxToolCallsPerResponse === undefined
+                ? {}
+                : { maxToolCallsPerResponse: options.maxToolCallsPerResponse }),
+            ...(options.maxToolMetadataBytes === undefined
+                ? {}
+                : { maxToolMetadataBytes: options.maxToolMetadataBytes }),
+            ...(options.maxReasoningBytes === undefined
+                ? {}
+                : { maxReasoningBytes: options.maxReasoningBytes }),
+        });
+        this.capabilities = {
+            streaming: true,
+            usage: true,
+            tools: true,
+            images: true,
+            documents: false,
+            webSearch: false,
+            thinking: {
+                modes: ['disabled', 'enabled', 'adaptive'],
+                maxTokens: false,
+            },
+            ...(options.contextWindowTokens === undefined
+                ? {}
+                : { contextWindowTokens: options.contextWindowTokens }),
+            terminalReasons: true,
+        };
+    }
+    async *complete(request) {
+        const body = this.codec.serialize(request, this.model);
+        const signal = request.signal;
+        let response;
+        try {
+            reportProviderTransportActivity(request, 'request-started');
+            response = await this.fetchImplementation(`${this.options.baseUrl.replace(/\/+$/u, '')}/responses`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${this.options.apiKey}`,
+                    accept: 'text/event-stream',
+                    'content-type': 'application/json',
+                    originator: 'praxis',
+                    'OpenAI-Beta': 'responses=experimental',
+                },
+                body: JSON.stringify(body),
+                ...(signal ? { signal } : {}),
+            });
+            reportProviderTransportActivity(request, 'response-received');
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw failure('cancelled', false);
+            if (typeof error === 'object' &&
+                error !== null &&
+                'name' in error &&
+                error.name === 'TimeoutError')
+                throw failure('timeout', true);
+            if (typeof error === 'object' &&
+                error !== null &&
+                'code' in error &&
+                error.code === 'ETIMEDOUT')
+                throw failure('timeout', true);
+            throw failure('transport_error', true);
+        }
+        if (!response.ok) {
+            const reader = response.body?.getReader();
+            if (reader) {
+                let total = 0;
+                let ended = false;
+                try {
+                    while (true) {
+                        const next = await reader.read();
+                        if (next.done) {
+                            ended = true;
+                            break;
+                        }
+                        if (next.value.byteLength > 0)
+                            reportProviderTransportActivity(request, 'response-chunk');
+                        total += next.value.byteLength;
+                        if (total > this.maxErrorBodyBytes)
+                            break;
+                    }
+                }
+                catch {
+                    /* preserve the redacted HTTP status classification */
+                }
+                finally {
+                    if (!ended) {
+                        try {
+                            await reader.cancel();
+                        }
+                        catch {
+                            /* preserve the redacted HTTP status classification */
+                        }
+                    }
+                    reader.releaseLock();
+                }
+            }
+            throw statusFailure(response.status);
+        }
+        if (!response.body)
+            throw failure('transport_error', true);
+        yield* this.codec.stream(response.body, {
+            ...(signal === undefined ? {} : { signal }),
+            onChunk: () => reportProviderTransportActivity(request, 'response-chunk'),
+        });
+    }
+}
+//# sourceMappingURL=codex-responses.js.map

package/dist/providers/codex-subscription.js

@@ -104,6 +104,7 @@ export class CodexSubscriptionProvider {
         this.maxErrorBodyBytes = positiveInteger(options.maxErrorBodyBytes, DEFAULT_MAX_ERROR);
         this.responsesCodec = new ResponsesCodec({
             providerLabel: 'Codex subscription provider',
+            requestDialect: 'codex-native',
             ...(options.thinking === undefined ? {} : { thinking: options.thinking }),
             ...(options.maxStreamBufferBytes === undefined
                 ? {}

package/dist/providers/provider-registry.js

@@ -1,6 +1,7 @@
 import { AnthropicCompatibleProvider } from './anthropic-compatible.js';
 import { OpenAICompatibleProvider } from './openai-compatible.js';
 import { OpenAIResponsesProvider } from './openai-responses.js';
+import { CodexResponsesProvider } from './codex-responses.js';
 import { CodexSubscriptionProvider } from './codex-subscription.js';
 import { DeadlineModelProvider } from './deadline-provider.js';
 import { NonStreamingFallbackModelProvider } from './non-streaming-fallback-provider.js';
@@ -41,7 +42,8 @@ export function resolveProviderContextWindowTokens(options) {
     if (options.protocol === 'anthropic-messages')
         return resolveAnthropicModelSpec(options.modelId, options.explicitContextWindowTokens).contextWindowTokens;
     if (options.protocol === 'openai-compatible' ||
-        options.protocol === 'openai-responses')
+        options.protocol === 'openai-responses' ||
+        options.protocol === 'codex-responses')
         return options.explicitContextWindowTokens;
     return undefined;
 }
@@ -191,6 +193,27 @@ class NativeProviderRegistry {
                     : { fetchImplementation: this.options.fetchImplementation }),
             }));
         }
+        if (target.protocol === 'codex-responses') {
+            if (this.options.credential.type !== 'api-key') {
+                throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: an API key is required');
+            }
+            return this.withDeadline(new CodexResponsesProvider({
+                baseUrl: target.baseUrl,
+                model: target.modelId,
+                apiKey: this.options.credential.secret,
+                ...(this.options.context?.contextWindowTokens === undefined
+                    ? {}
+                    : {
+                        contextWindowTokens: this.options.context.contextWindowTokens,
+                    }),
+                ...(this.options.codexThinking === undefined
+                    ? {}
+                    : { thinking: this.options.codexThinking }),
+                ...(this.options.fetchImplementation === undefined
+                    ? {}
+                    : { fetchImplementation: this.options.fetchImplementation }),
+            }));
+        }
         if (target.protocol === 'anthropic-messages') {
             if (this.options.credential.type !== 'api-key') {
                 throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: an API key is required');

package/dist/providers/provider-settings.d.ts

@@ -1,4 +1,4 @@
-export type ProviderProtocol = 'openai-compatible' | 'openai-responses' | 'anthropic-messages' | 'codex-subscription';
+export type ProviderProtocol = 'openai-compatible' | 'openai-responses' | 'anthropic-messages' | 'codex-subscription' | 'codex-responses';
 export type CredentialSource = {
     source: 'env';
     name: string;

package/dist/providers/provider-settings.js

@@ -160,8 +160,9 @@ function parseProvider(value, providerId) {
     const protocol = value.protocol;
     if (protocol !== 'openai-compatible' &&
         protocol !== 'openai-responses' &&
-        protocol !== 'anthropic-messages') {
-        fail(`providers.${providerId}.protocol must be openai-compatible, openai-responses, or anthropic-messages`);
+        protocol !== 'anthropic-messages' &&
+        protocol !== 'codex-responses') {
+        fail(`providers.${providerId}.protocol must be openai-compatible, openai-responses, anthropic-messages, or codex-responses`);
     }
     if (!isRecord(value.profiles) || Object.keys(value.profiles).length === 0)
         fail(`providers.${providerId}.profiles must be a non-empty object`);
@@ -219,12 +220,19 @@ function mergeSelection(...values) {
 }
 function validateExperimental(value) {
     if (value === undefined)
-        return false;
-    if (!isRecord(value) ||
-        (value.codexSubscription !== undefined &&
-            typeof value.codexSubscription !== 'boolean'))
+        return { codexSubscription: false, codexResponses: false };
+    if (!isRecord(value))
+        fail('experimental.codexSubscription must be a boolean');
+    if (value.codexSubscription !== undefined &&
+        typeof value.codexSubscription !== 'boolean')
         fail('experimental.codexSubscription must be a boolean');
-    return value.codexSubscription === true;
+    if (value.codexResponses !== undefined &&
+        typeof value.codexResponses !== 'boolean')
+        fail('experimental.codexResponses must be a boolean');
+    return {
+        codexSubscription: value.codexSubscription === true,
+        codexResponses: value.codexResponses === true,
+    };
 }
 function ensureSelectionPart(value, field) {
     return identifier(value, field);
@@ -246,7 +254,7 @@ export async function resolveProviderTarget(options) {
         : {};
     scanForPlaintextSecrets(user.providers, 'providers');
     const userProviders = parseProviders(user.providers);
-    const codexEnabled = validateExperimental(user.experimental);
+    const experimental = validateExperimental(user.experimental);
     const explicit = {
         ...(options.provider === undefined
             ? {}
@@ -287,7 +295,7 @@ export async function resolveProviderTarget(options) {
     const selected = mergeSelection(settingsSelection, projectSelection, localSelection, envSelection, explicit);
     const providerId = selected.provider ?? 'openai';
     identifier(providerId, 'provider ID');
-    if (providerId === 'openai-codex' && !codexEnabled)
+    if (providerId === 'openai-codex' && !experimental.codexSubscription)
         fail('openai-codex requires experimental.codexSubscription=true');
     if (providerId !== 'openai-codex' &&
         selected.profile === undefined &&
@@ -303,6 +311,8 @@ export async function resolveProviderTarget(options) {
         fail(`built-in provider ${providerId} has an incompatible protocol`);
     if (custom?.protocol === 'codex-subscription')
         fail('custom codex-subscription providers are not allowed');
+    if (custom?.protocol === 'codex-responses' && !experimental.codexResponses)
+        fail('custom codex-responses providers require experimental.codexResponses=true');
     const definition = custom ?? BUILT_INS[providerId];
     if (!definition)
         throw new ProviderSettingsError('unknown_provider', `Invalid provider settings: unknown provider ${providerId}`);
@@ -339,8 +349,10 @@ export async function resolveProviderTarget(options) {
         protocol,
         baseUrl,
         credential: resolvedCredential,
-        billingMode: protocol === 'codex-subscription' ? 'subscription' : 'api',
-        experimental: providerId === 'openai-codex',
+        billingMode: protocol === 'codex-subscription' || protocol === 'codex-responses'
+            ? 'subscription'
+            : 'api',
+        experimental: providerId === 'openai-codex' || protocol === 'codex-responses',
     };
 }
 //# sourceMappingURL=provider-settings.js.map

package/dist/providers/responses-codec.d.ts

@@ -1,4 +1,5 @@
 import { type ModelRequest, type ModelStreamEvent, type ModelThinkingConfig } from '../core/runtime.js';
+export type ResponsesRequestDialect = 'public' | 'codex-native';
 export interface ResponsesCodecOptions {
     providerLabel?: string;
     thinking?: ModelThinkingConfig;
@@ -7,6 +8,7 @@ export interface ResponsesCodecOptions {
     maxToolCallsPerResponse?: number;
     maxToolMetadataBytes?: number;
     maxReasoningBytes?: number;
+    requestDialect?: ResponsesRequestDialect;
 }
 export interface ResponsesStreamOptions {
     signal?: AbortSignal;
@@ -20,6 +22,7 @@ export declare class ResponsesCodec {
     readonly maxReasoningBytes: number;
     private readonly label;
     private readonly configuredThinking;
+    private readonly requestDialect;
     constructor(options?: ResponsesCodecOptions);
     serialize(request: ModelRequest, model: string): Record<string, unknown>;
     stream(body: ReadableStream<Uint8Array>, options?: ResponsesStreamOptions): AsyncIterable<ModelStreamEvent>;

package/dist/providers/responses-codec.js

@@ -123,7 +123,7 @@ function serializeMessages(messages) {
     }
     return { instructions: instructions.join('\n\n'), input };
 }
-function serializeResponsesRequest(request, model, configuredThinking) {
+function serializeResponsesRequest(request, model, configuredThinking, dialect = 'public') {
     if (request.webSearch !== undefined)
         throw invalid('Codex subscription provider does not support web search');
     if (request.betas !== undefined)
@@ -149,6 +149,15 @@ function serializeResponsesRequest(request, model, configuredThinking) {
         instructions,
         input,
     };
+    if (dialect === 'codex-native') {
+        body.tool_choice = 'auto';
+        body.parallel_tool_calls = true;
+        for (const item of input) {
+            if ((item.role === 'user' || item.role === 'assistant') &&
+                item.content !== undefined)
+                item.type = 'message';
+        }
+    }
     if (request.tools?.length) {
         body.tools = request.tools.map((tool) => ({
             type: 'function',
@@ -601,9 +610,11 @@ export class ResponsesCodec {
     maxReasoningBytes;
     label;
     configuredThinking;
+    requestDialect;
     constructor(options = {}) {
         this.label = options.providerLabel ?? 'Responses provider';
         this.configuredThinking = options.thinking;
+        this.requestDialect = options.requestDialect ?? 'public';
         if (options.thinking !== undefined &&
             options.thinking.mode !== 'disabled' &&
             options.thinking.mode !== 'enabled' &&
@@ -619,7 +630,7 @@ export class ResponsesCodec {
     }
     serialize(request, model) {
         try {
-            return serializeResponsesRequest(request, model, this.configuredThinking);
+            return serializeResponsesRequest(request, model, this.configuredThinking, this.requestDialect);
         }
         catch (error) {
             throw this.contextualize(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.69.0",
+  "version": "0.70.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",
@@ -63,7 +63,7 @@
     "verify:fixture-contracts": "node scripts/verify-fixture-contracts.mjs",
     "test:fixtures": "node scripts/run-fixture-contracts.mjs",
     "test:eval:baseline": "vitest run src/evals/coding-baseline.test.ts src/evals/project-eval-comparison.test.ts src/evals/apply-patch-admission.test.ts src/evals/lsp-diagnostics-admission.test.ts src/evals/glob-ripgrep-admission.test.ts",
-    "test:eval:held-out-contract": "vitest run src/evals/held-out-corpus.test.ts",
+    "test:eval:held-out-contract": "vitest run src/evals/held-out-corpus.test.ts src/evals/held-out-corpus-v3.test.ts",
     "test:eval:held-out-qualification": "vitest run src/evals/held-out-qualification.test.ts"
   },
   "engines": {