praxis-agent 0.69.1 → 0.70.1

package/README.md

@@ -88,6 +88,11 @@ This uses an undocumented third-party subscription/backend contract and may
 change; it is not Claude subscription authentication. Subscription runs retain
 token usage but do not provide API-dollar cost or enforce USD budgets.
 
+Private relays can use the explicitly opted-in experimental custom
+`codex-responses` protocol with an API-key credential and configured model and
+URL. It has subscription billing semantics, no built-in relay/default, and no
+automatic protocol fallback; see [Getting Started](docs/GETTING_STARTED.md).
+
 For Anthropic Messages:
 
 ```sh
@@ -159,8 +164,49 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   matching versioned `praxis-held-out-vN` identities. V1 is unchanged; v2 is
   frozen at 3 repositories, 12 tasks, and 36 runs with digest
   `sha256:1ae6e3485684db143ead1983479500f7fb80d13fd99769d8e202d4c7c35881b3`.
-  V2 has no real-provider evidence, and Task 8.2/Phase 9 remain locked. A
-  bounded DeepSeek baseline for the exact
+  The preserved v2 real-provider campaign pins
+  `openai-responses/default/openai-responses/gpt-5.4-mini` and records baseline
+  36/36 completed, 32/36 behavior, 36/36 mutation-oriented safety, 32/36
+  verifier satisfied, and `qualified: null`; candidate 36/36 completed, 30/36
+  behavior, 36/36 mutation-oriented safety, 30/36 verifier satisfied, and
+  `qualified: false`. Usage was known for 35/36 baseline and 34/36 candidate
+  runs, while cost was unknown for all runs. This aggregate establishes no
+  quality, broad security, cost, latency, or efficiency claim. The −5.56-point
+  pass-rate delta leaves Task 8.2/Phase 9 locked. Any result-informed
+  remediation or requalification requires a new v3 held-out corpus.
+  [Issue #722](https://github.com/Forest-Isle/Praxis/issues/722) now freezes the
+  fresh `praxis-held-out-v3` corpus for
+  `frame-codec`, `graph-craft`, and `route-forge`: 12 repository-qualified
+  tasks, 3 repetitions each, and 36 planned runs with digest
+  `sha256:9380f5ccd9b920bf9767381f2d36d91dc04abe645db0a7c1a5f1597279d579ff`.
+  The corpus is frozen before execution. The corrected Issue #731 no-tool/no-file smoke selected
+  `codex-relay/default/codex-responses/gpt-5.6-sol` on the pinned runtime and
+  returned terminal success in one turn with zero configured tools, zero stderr,
+  and no isolated-cwd mutation; this is provider smoke evidence, not v3 corpus
+  evidence. The exactly-once v3 baseline then exited 1 after 810 ms during
+  first-case provider identity preflight with `Invalid provider settings: unknown
+provider codex-relay`. Project Eval creates an empty per-case
+  `workspace.config` and passes it to the production runtime factory, so the
+  custom provider definition in campaign `PRAXIS_HOME` was not visible. The
+  baseline completed 0/36 runs, emitted no qualification result or run
+  artifacts, and no candidate was admitted or run, so no baseline/candidate
+  regression comparison exists. The no-retry/no-substitution contract was
+  honored; there is no v3 behavior, mutation-oriented safety,
+  verifier, usage, subscription-cost, duration/latency, quality, security,
+  compatibility, efficiency, optimization, baseline, candidate, or
+  qualification conclusion. The settings-forwarding gap must be resolved under
+  a new change before any separately authorized future campaign. Task 8.2
+  remains incomplete and Phase 9 stays locked. Issue #733 now fixes only this
+  configuration admission path: the default Project Eval factory preserves the
+  explicitly selected caller native config root for provider definitions,
+  selection, and credentials consistently across identity and runtime
+  construction. The per-case root remains authoritative for runtime settings,
+  state, transcripts, hooks, plugins, MCP, memory, artifacts, tools, and
+  verifier behavior; no settings file is copied into the case root. This removes
+  the configuration blocker only; it does not retry #731, create v3 evidence,
+  complete Task 8.2, unlock Phase 9, or authorize a future provider request. A
+  bounded DeepSeek baseline for
+  the exact
   `anthropic/default/deepseek-v4-flash` pin completed 36/36 runs with
   33/36 passes (91.7%) and 36/36 safety passes. The
   `config-kit.add-json-output` run 3 failed closed with provider error
@@ -193,7 +239,15 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   Task 8.2 remains incomplete and Phase 9 stays locked. Any result-informed
   remediation or requalification first requires a new held-out corpus version.
   The subsequent bounded eval-admission fix does not change or select away this
-  preserved result, and v2 still has no real-provider run.
+  preserved result.
+  Issue #724's one predeclared no-tool/no-file smoke for the pinned
+  `openai-responses/default/openai-responses/gpt-5.5` configuration returned
+  HTTP 404 after 2,995 ms before any v3 corpus run. Relay health and model-list
+  reads were healthy and advertised `gpt-5.5`, but the 404 source is unknown;
+  no v3 corpus baseline/candidate result, qualification, pass/safety/verifier/
+  cost/latency/model-quality evidence exists, and the no-retry/no-substitution
+  rule was honored.
+  Task 8.2 remains incomplete and Phase 9 stays locked.
 - **Local agent runtime** — C+ Quiet Operator responsive TUI with a linear
   `❯` user / `⏺` assistant conversation, `✻` thinking activity, and `!` shell
   composer grammar, compact stable tool rows, responsive density,

package/dist/build-identity.json

@@ -1 +1 @@
-{"schema_version":"1.0","source_revision":"git:12b1ee6385af5b44620dacf57a70067018a1d5c6","source_dirty":false,"artifact_sha256":"sha256:7667434c7ce48becd3905fd7ba20b81c8b62e9d49dec911e122cbadf672fb5c1"}
+{"schema_version":"1.0","source_revision":"git:c3f2038fee80e4d969eb6c95918cb4cabbbd7108","source_dirty":false,"artifact_sha256":"sha256:f6e99df40f107902d2670c0e6d6a783f980371cbc464ff8e0f90483c7bd56c41"}

package/dist/cli-runtime.js

@@ -967,7 +967,7 @@ export function resolveUnknownCostSidecarPath(dataPlane, configRoot) {
     assertNativeDataPlane(dataPlane);
     return join(configRoot, 'state', 'unknown-cost-sidecar.json');
 }
-const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, approveWorkspaceTrust, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
+const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, approveWorkspaceTrust, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, providerConfigRoot: requestedProviderConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
     const runtimeEnvironment = requestedProviderEnvironment ?? process.env;
     const sandboxEnvironment = { ...runtimeEnvironment, ...environment };
     const claudeVersion = VERIFIED_CLAUDE_SCHEMA_VERSION;
@@ -980,6 +980,12 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         ...(requestedConfigRoot === undefined ? {} : { root: requestedConfigRoot }),
         environment: runtimeEnvironment,
     });
+    const providerConfigRoot = resolveDataPlaneRoot({
+        ...(requestedProviderConfigRoot === undefined
+            ? { root: configRoot }
+            : { root: requestedProviderConfigRoot }),
+        environment: runtimeEnvironment,
+    });
     const claudeStatePath = join(configRoot, 'state.json');
     const simpleMode = controls.bare ||
         truthyEnvironmentValue(runtimeEnvironment.CLAUDE_CODE_SIMPLE);
@@ -1108,7 +1114,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
     let workspaceProviderSettingsTrusted = false;
     if (!hooksOnly && !cli.safeMode && !simpleMode) {
         const assessment = await assessCurrentWorkspaceProviderSelection({
-            configRoot,
+            configRoot: providerConfigRoot,
             statePath: claudeStatePath,
             cwd,
             environment: runtimeEnvironment,
@@ -1123,7 +1129,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
     if (!hooksOnly) {
         try {
             const registry = await resolveProviderRegistry({
-                configRoot,
+                configRoot: providerConfigRoot,
                 cwd,
                 environment: runtimeEnvironment,
                 ...((interactiveModel ?? controls.model) === undefined
@@ -1139,7 +1145,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
                 includeProjectSettings: workspaceProviderSettingsTrusted,
                 context,
                 vault: new ProviderCredentialVault({
-                    configRoot,
+                    configRoot: providerConfigRoot,
                     environment: runtimeEnvironment,
                 }),
                 anthropicThinking: {
@@ -2273,108 +2279,108 @@ const createDefaultAutoModeCritic = async ({ model, provider, providerProfile, d
     });
     return registry.create(model ?? registry.target.modelId);
 };
-const defaultPluginEvalRuntimeFactory = {
-    create: async (options) => {
-        let turns = 0;
-        let historySessionId;
-        if (options.historyFile) {
-            const source = await readFile(options.historyFile, 'utf8');
-            for (const line of source.split(/\r?\n/u)) {
-                if (!line.trim())
-                    continue;
-                let entry;
-                try {
-                    entry = JSON.parse(line);
-                }
-                catch (error) {
-                    throw new Error(`Invalid history_file JSONL: ${options.historyFile}`, {
-                        cause: error,
-                    });
-                }
-                if (!entry || typeof entry !== 'object' || Array.isArray(entry))
-                    throw new Error(`Invalid history_file entry: ${options.historyFile}`);
-                const candidate = entry.sessionId;
-                if (typeof candidate === 'string' && isClaudeSessionId(candidate)) {
-                    historySessionId ??= candidate;
-                }
+const createDefaultEvalRuntime = async (options, providerConfigRoot = options.configRoot) => {
+    let turns = 0;
+    let historySessionId;
+    if (options.historyFile) {
+        const source = await readFile(options.historyFile, 'utf8');
+        for (const line of source.split(/\r?\n/u)) {
+            if (!line.trim())
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(line);
             }
-            if (!historySessionId)
-                throw new Error('history_file must contain a Claude sessionId');
-            const sessionFile = resolveDataPlanePaths({
-                dataPlane: 'native',
-                root: options.configRoot,
-                cwd: options.cwd,
-                sessionId: historySessionId,
-            }).sessionFile;
-            await mkdir(dirname(sessionFile), { recursive: true });
-            await copyFile(options.historyFile, sessionFile);
-        }
-        const service = await createDefaultService({
-            eventSink: (event) => {
-                if (event.type === 'state' && event.state === 'awaiting-model')
-                    turns += 1;
-                options.eventSink(event);
-            },
-            requireProvider: true,
+            catch (error) {
+                throw new Error(`Invalid history_file JSONL: ${options.historyFile}`, {
+                    cause: error,
+                });
+            }
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                throw new Error(`Invalid history_file entry: ${options.historyFile}`);
+            const candidate = entry.sessionId;
+            if (typeof candidate === 'string' && isClaudeSessionId(candidate)) {
+                historySessionId ??= candidate;
+            }
+        }
+        if (!historySessionId)
+            throw new Error('history_file must contain a Claude sessionId');
+        const sessionFile = resolveDataPlanePaths({
+            dataPlane: 'native',
+            root: options.configRoot,
             cwd: options.cwd,
-            configRoot: options.configRoot,
-            environment: {
-                ...options.env,
-                HOME: options.home,
-                USERPROFILE: options.home,
-            },
-            providerEnvironment: process.env,
-            isSessionActionApproved: (call) => isEvalToolCallPreapproved(call, {
-                cwd: options.cwd,
-                homeDirectory: options.home,
-                allowedTools: options.allowedTools,
-                additionalDirectories: options.addDirs,
-            }),
-            controls: {
-                ...DEFAULT_CLI_CONTROLS,
-                dataPlane: options.dataPlane,
-                sessionPersistence: false,
-                maxTurns: options.maxTurns,
-                pluginDirectories: [...(options.pluginDirectories ?? [])],
-                addDirectories: [...options.addDirs],
-                allowedTools: [...options.allowedTools],
-                disallowedTools: [],
-                tools: [...options.allowedTools],
-                permissionMode: 'dontAsk',
-                ...(options.model ? { model: options.model } : {}),
-                ...(options.provider ? { provider: options.provider } : {}),
-                ...(options.providerProfile
-                    ? { providerProfile: options.providerProfile }
-                    : {}),
-                ...(options.appendSystemPrompt
-                    ? { appendSystemPrompt: options.appendSystemPrompt }
-                    : {}),
-            },
-        });
-        return {
-            run: async (prompt, signal) => {
-                const result = historySessionId
-                    ? await service.resume(historySessionId, prompt || 'Continue from the provided conversation history.', signal)
-                    : await service.run(prompt, signal);
-                return {
-                    text: result.text,
-                    turns,
-                    ...(result.costUsd === undefined
-                        ? {}
-                        : { costUsd: result.costUsd }),
-                    usage: result.usage,
-                };
-            },
-            close: () => service.close?.() ?? Promise.resolve(),
-        };
-    },
+            sessionId: historySessionId,
+        }).sessionFile;
+        await mkdir(dirname(sessionFile), { recursive: true });
+        await copyFile(options.historyFile, sessionFile);
+    }
+    const service = await createDefaultService({
+        eventSink: (event) => {
+            if (event.type === 'state' && event.state === 'awaiting-model')
+                turns += 1;
+            options.eventSink(event);
+        },
+        requireProvider: true,
+        cwd: options.cwd,
+        configRoot: options.configRoot,
+        providerConfigRoot,
+        environment: {
+            ...options.env,
+            HOME: options.home,
+            USERPROFILE: options.home,
+        },
+        providerEnvironment: process.env,
+        isSessionActionApproved: (call) => isEvalToolCallPreapproved(call, {
+            cwd: options.cwd,
+            homeDirectory: options.home,
+            allowedTools: options.allowedTools,
+            additionalDirectories: options.addDirs,
+        }),
+        controls: {
+            ...DEFAULT_CLI_CONTROLS,
+            dataPlane: options.dataPlane,
+            sessionPersistence: false,
+            maxTurns: options.maxTurns,
+            pluginDirectories: [...(options.pluginDirectories ?? [])],
+            addDirectories: [...options.addDirs],
+            allowedTools: [...options.allowedTools],
+            disallowedTools: [],
+            tools: [...options.allowedTools],
+            permissionMode: 'dontAsk',
+            ...(options.model ? { model: options.model } : {}),
+            ...(options.provider ? { provider: options.provider } : {}),
+            ...(options.providerProfile
+                ? { providerProfile: options.providerProfile }
+                : {}),
+            ...(options.appendSystemPrompt
+                ? { appendSystemPrompt: options.appendSystemPrompt }
+                : {}),
+        },
+    });
+    return {
+        run: async (prompt, signal) => {
+            const result = historySessionId
+                ? await service.resume(historySessionId, prompt || 'Continue from the provided conversation history.', signal)
+                : await service.run(prompt, signal);
+            return {
+                text: result.text,
+                turns,
+                ...(result.costUsd === undefined ? {} : { costUsd: result.costUsd }),
+                usage: result.usage,
+            };
+        },
+        close: () => service.close?.() ?? Promise.resolve(),
+    };
+};
+const defaultPluginEvalRuntimeFactory = {
+    create: (options) => createDefaultEvalRuntime(options),
 };
-const defaultProjectEvalRuntimeFactory = {
-    create: (options) => defaultPluginEvalRuntimeFactory.create(options),
+const createDefaultProjectEvalRuntimeFactory = (providerConfigRoot) => ({
+    create: (options) => createDefaultEvalRuntime(options, providerConfigRoot),
     identify: async (options) => {
         const environment = process.env;
         const target = await resolveProviderRuntimeTarget({
-            configRoot: options.configRoot,
+            configRoot: providerConfigRoot,
             cwd: options.cwd,
             environment,
             ...(options.model === undefined ? {} : { model: options.model }),
@@ -2393,7 +2399,7 @@ const defaultProjectEvalRuntimeFactory = {
             modelId: target.modelId,
         };
     },
-};
+});
 const defaultPluginEvalJudge = {
     vote: async ({ criteria, focus, baseline, model, signal }) => {
         const environment = process.env;
@@ -2628,6 +2634,7 @@ export async function resolveInteractiveProviderStartup(options) {
     };
 }
 export function createDefaultDependencies(entrypoint = fileURLToPath(import.meta.url)) {
+    const projectEvalConfigRoot = resolveDataPlaneRoot();
     const dependencies = {
         createService: createDefaultService,
         createAutoModeCritic: createDefaultAutoModeCritic,
@@ -2636,10 +2643,10 @@ export function createDefaultDependencies(entrypoint = fileURLToPath(import.meta
             judge: defaultPluginEvalJudge,
         },
         projectEval: {
-            runtimeFactory: defaultProjectEvalRuntimeFactory,
+            runtimeFactory: createDefaultProjectEvalRuntimeFactory(projectEvalConfigRoot),
             loadBuildIdentity: () => loadPraxisBuildIdentity(),
             version: VERSION,
-            configRoot: resolveDataPlaneRoot(),
+            configRoot: projectEvalConfigRoot,
         },
         cliPath: entrypoint,
         runInteractive: async ({ agent, controls, initialPrompt, resume, signal, }) => {

package/dist/providers/codex-responses.d.ts

@@ -0,0 +1,26 @@
+import { type ModelProvider, type ModelRequest, type ModelStreamEvent, type ModelThinkingConfig } from '../core/runtime.js';
+export interface CodexResponsesProviderOptions {
+    baseUrl: string;
+    apiKey: string;
+    model: string;
+    contextWindowTokens?: number;
+    thinking?: ModelThinkingConfig;
+    maxStreamBufferBytes?: number;
+    maxToolArgumentsBytes?: number;
+    maxToolCallsPerResponse?: number;
+    maxToolMetadataBytes?: number;
+    maxReasoningBytes?: number;
+    maxErrorBodyBytes?: number;
+    fetchImplementation?: typeof fetch;
+}
+export declare class CodexResponsesProvider implements ModelProvider {
+    private readonly options;
+    readonly model: string;
+    readonly capabilities: ModelProvider['capabilities'];
+    private readonly fetchImplementation;
+    private readonly codec;
+    private readonly maxErrorBodyBytes;
+    constructor(options: CodexResponsesProviderOptions);
+    complete(request: ModelRequest): AsyncIterable<ModelStreamEvent>;
+}
+//# sourceMappingURL=codex-responses.d.ts.map

package/dist/providers/codex-responses.js

@@ -0,0 +1,155 @@
+import { ModelProviderError, } from '../core/runtime.js';
+import { ResponsesCodec } from './responses-codec.js';
+import { reportProviderTransportActivity } from './provider-transport-activity.js';
+function failure(kind, retryable, status) {
+    return new ModelProviderError(status === undefined
+        ? 'Codex Responses provider request failed'
+        : `Codex Responses provider request failed with HTTP ${status}`, { kind, retryable, ...(status === undefined ? {} : { status }) });
+}
+function statusFailure(status) {
+    if (status === 401 || status === 403)
+        return failure('authentication_failed', false, status);
+    if (status === 402)
+        return failure('billing_error', false, status);
+    if (status === 408)
+        return failure('timeout', true, status);
+    if (status === 429)
+        return failure('rate_limit', true, status);
+    if (status === 529)
+        return failure('overloaded', true, status);
+    if (status >= 500)
+        return failure('server_error', true, status);
+    return failure('invalid_request', false, status);
+}
+export class CodexResponsesProvider {
+    options;
+    model;
+    capabilities;
+    fetchImplementation;
+    codec;
+    maxErrorBodyBytes;
+    constructor(options) {
+        this.options = options;
+        this.model = options.model;
+        this.fetchImplementation = options.fetchImplementation ?? fetch;
+        this.maxErrorBodyBytes = options.maxErrorBodyBytes ?? 64 * 1024;
+        if (!Number.isSafeInteger(this.maxErrorBodyBytes) ||
+            this.maxErrorBodyBytes <= 0)
+            throw new Error('Codex Responses provider limits must be positive integers');
+        this.codec = new ResponsesCodec({
+            providerLabel: 'Codex Responses provider',
+            requestDialect: 'codex-native',
+            ...(options.thinking === undefined ? {} : { thinking: options.thinking }),
+            ...(options.maxStreamBufferBytes === undefined
+                ? {}
+                : { maxStreamBufferBytes: options.maxStreamBufferBytes }),
+            ...(options.maxToolArgumentsBytes === undefined
+                ? {}
+                : { maxToolArgumentsBytes: options.maxToolArgumentsBytes }),
+            ...(options.maxToolCallsPerResponse === undefined
+                ? {}
+                : { maxToolCallsPerResponse: options.maxToolCallsPerResponse }),
+            ...(options.maxToolMetadataBytes === undefined
+                ? {}
+                : { maxToolMetadataBytes: options.maxToolMetadataBytes }),
+            ...(options.maxReasoningBytes === undefined
+                ? {}
+                : { maxReasoningBytes: options.maxReasoningBytes }),
+        });
+        this.capabilities = {
+            streaming: true,
+            usage: true,
+            tools: true,
+            images: true,
+            documents: false,
+            webSearch: false,
+            thinking: {
+                modes: ['disabled', 'enabled', 'adaptive'],
+                maxTokens: false,
+            },
+            ...(options.contextWindowTokens === undefined
+                ? {}
+                : { contextWindowTokens: options.contextWindowTokens }),
+            terminalReasons: true,
+        };
+    }
+    async *complete(request) {
+        const body = this.codec.serialize(request, this.model);
+        const signal = request.signal;
+        let response;
+        try {
+            reportProviderTransportActivity(request, 'request-started');
+            response = await this.fetchImplementation(`${this.options.baseUrl.replace(/\/+$/u, '')}/responses`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${this.options.apiKey}`,
+                    accept: 'text/event-stream',
+                    'content-type': 'application/json',
+                    originator: 'praxis',
+                    'OpenAI-Beta': 'responses=experimental',
+                },
+                body: JSON.stringify(body),
+                ...(signal ? { signal } : {}),
+            });
+            reportProviderTransportActivity(request, 'response-received');
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw failure('cancelled', false);
+            if (typeof error === 'object' &&
+                error !== null &&
+                'name' in error &&
+                error.name === 'TimeoutError')
+                throw failure('timeout', true);
+            if (typeof error === 'object' &&
+                error !== null &&
+                'code' in error &&
+                error.code === 'ETIMEDOUT')
+                throw failure('timeout', true);
+            throw failure('transport_error', true);
+        }
+        if (!response.ok) {
+            const reader = response.body?.getReader();
+            if (reader) {
+                let total = 0;
+                let ended = false;
+                try {
+                    while (true) {
+                        const next = await reader.read();
+                        if (next.done) {
+                            ended = true;
+                            break;
+                        }
+                        if (next.value.byteLength > 0)
+                            reportProviderTransportActivity(request, 'response-chunk');
+                        total += next.value.byteLength;
+                        if (total > this.maxErrorBodyBytes)
+                            break;
+                    }
+                }
+                catch {
+                    /* preserve the redacted HTTP status classification */
+                }
+                finally {
+                    if (!ended) {
+                        try {
+                            await reader.cancel();
+                        }
+                        catch {
+                            /* preserve the redacted HTTP status classification */
+                        }
+                    }
+                    reader.releaseLock();
+                }
+            }
+            throw statusFailure(response.status);
+        }
+        if (!response.body)
+            throw failure('transport_error', true);
+        yield* this.codec.stream(response.body, {
+            ...(signal === undefined ? {} : { signal }),
+            onChunk: () => reportProviderTransportActivity(request, 'response-chunk'),
+        });
+    }
+}
+//# sourceMappingURL=codex-responses.js.map

package/dist/providers/codex-subscription.js

@@ -104,6 +104,7 @@ export class CodexSubscriptionProvider {
         this.maxErrorBodyBytes = positiveInteger(options.maxErrorBodyBytes, DEFAULT_MAX_ERROR);
         this.responsesCodec = new ResponsesCodec({
             providerLabel: 'Codex subscription provider',
+            requestDialect: 'codex-native',
             ...(options.thinking === undefined ? {} : { thinking: options.thinking }),
             ...(options.maxStreamBufferBytes === undefined
                 ? {}

package/dist/providers/provider-registry.js

@@ -1,6 +1,7 @@
 import { AnthropicCompatibleProvider } from './anthropic-compatible.js';
 import { OpenAICompatibleProvider } from './openai-compatible.js';
 import { OpenAIResponsesProvider } from './openai-responses.js';
+import { CodexResponsesProvider } from './codex-responses.js';
 import { CodexSubscriptionProvider } from './codex-subscription.js';
 import { DeadlineModelProvider } from './deadline-provider.js';
 import { NonStreamingFallbackModelProvider } from './non-streaming-fallback-provider.js';
@@ -41,7 +42,8 @@ export function resolveProviderContextWindowTokens(options) {
     if (options.protocol === 'anthropic-messages')
         return resolveAnthropicModelSpec(options.modelId, options.explicitContextWindowTokens).contextWindowTokens;
     if (options.protocol === 'openai-compatible' ||
-        options.protocol === 'openai-responses')
+        options.protocol === 'openai-responses' ||
+        options.protocol === 'codex-responses')
         return options.explicitContextWindowTokens;
     return undefined;
 }
@@ -191,6 +193,27 @@ class NativeProviderRegistry {
                     : { fetchImplementation: this.options.fetchImplementation }),
             }));
         }
+        if (target.protocol === 'codex-responses') {
+            if (this.options.credential.type !== 'api-key') {
+                throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: an API key is required');
+            }
+            return this.withDeadline(new CodexResponsesProvider({
+                baseUrl: target.baseUrl,
+                model: target.modelId,
+                apiKey: this.options.credential.secret,
+                ...(this.options.context?.contextWindowTokens === undefined
+                    ? {}
+                    : {
+                        contextWindowTokens: this.options.context.contextWindowTokens,
+                    }),
+                ...(this.options.codexThinking === undefined
+                    ? {}
+                    : { thinking: this.options.codexThinking }),
+                ...(this.options.fetchImplementation === undefined
+                    ? {}
+                    : { fetchImplementation: this.options.fetchImplementation }),
+            }));
+        }
         if (target.protocol === 'anthropic-messages') {
             if (this.options.credential.type !== 'api-key') {
                 throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: an API key is required');

package/dist/providers/provider-settings.d.ts

@@ -1,4 +1,4 @@
-export type ProviderProtocol = 'openai-compatible' | 'openai-responses' | 'anthropic-messages' | 'codex-subscription';
+export type ProviderProtocol = 'openai-compatible' | 'openai-responses' | 'anthropic-messages' | 'codex-subscription' | 'codex-responses';
 export type CredentialSource = {
     source: 'env';
     name: string;

package/dist/providers/provider-settings.js

@@ -160,8 +160,9 @@ function parseProvider(value, providerId) {
     const protocol = value.protocol;
     if (protocol !== 'openai-compatible' &&
         protocol !== 'openai-responses' &&
-        protocol !== 'anthropic-messages') {
-        fail(`providers.${providerId}.protocol must be openai-compatible, openai-responses, or anthropic-messages`);
+        protocol !== 'anthropic-messages' &&
+        protocol !== 'codex-responses') {
+        fail(`providers.${providerId}.protocol must be openai-compatible, openai-responses, anthropic-messages, or codex-responses`);
     }
     if (!isRecord(value.profiles) || Object.keys(value.profiles).length === 0)
         fail(`providers.${providerId}.profiles must be a non-empty object`);
@@ -219,12 +220,19 @@ function mergeSelection(...values) {
 }
 function validateExperimental(value) {
     if (value === undefined)
-        return false;
-    if (!isRecord(value) ||
-        (value.codexSubscription !== undefined &&
-            typeof value.codexSubscription !== 'boolean'))
+        return { codexSubscription: false, codexResponses: false };
+    if (!isRecord(value))
+        fail('experimental.codexSubscription must be a boolean');
+    if (value.codexSubscription !== undefined &&
+        typeof value.codexSubscription !== 'boolean')
         fail('experimental.codexSubscription must be a boolean');
-    return value.codexSubscription === true;
+    if (value.codexResponses !== undefined &&
+        typeof value.codexResponses !== 'boolean')
+        fail('experimental.codexResponses must be a boolean');
+    return {
+        codexSubscription: value.codexSubscription === true,
+        codexResponses: value.codexResponses === true,
+    };
 }
 function ensureSelectionPart(value, field) {
     return identifier(value, field);
@@ -246,7 +254,7 @@ export async function resolveProviderTarget(options) {
         : {};
     scanForPlaintextSecrets(user.providers, 'providers');
     const userProviders = parseProviders(user.providers);
-    const codexEnabled = validateExperimental(user.experimental);
+    const experimental = validateExperimental(user.experimental);
     const explicit = {
         ...(options.provider === undefined
             ? {}
@@ -287,7 +295,7 @@ export async function resolveProviderTarget(options) {
     const selected = mergeSelection(settingsSelection, projectSelection, localSelection, envSelection, explicit);
     const providerId = selected.provider ?? 'openai';
     identifier(providerId, 'provider ID');
-    if (providerId === 'openai-codex' && !codexEnabled)
+    if (providerId === 'openai-codex' && !experimental.codexSubscription)
         fail('openai-codex requires experimental.codexSubscription=true');
     if (providerId !== 'openai-codex' &&
         selected.profile === undefined &&
@@ -303,6 +311,8 @@ export async function resolveProviderTarget(options) {
         fail(`built-in provider ${providerId} has an incompatible protocol`);
     if (custom?.protocol === 'codex-subscription')
         fail('custom codex-subscription providers are not allowed');
+    if (custom?.protocol === 'codex-responses' && !experimental.codexResponses)
+        fail('custom codex-responses providers require experimental.codexResponses=true');
     const definition = custom ?? BUILT_INS[providerId];
     if (!definition)
         throw new ProviderSettingsError('unknown_provider', `Invalid provider settings: unknown provider ${providerId}`);
@@ -339,8 +349,10 @@ export async function resolveProviderTarget(options) {
         protocol,
         baseUrl,
         credential: resolvedCredential,
-        billingMode: protocol === 'codex-subscription' ? 'subscription' : 'api',
-        experimental: providerId === 'openai-codex',
+        billingMode: protocol === 'codex-subscription' || protocol === 'codex-responses'
+            ? 'subscription'
+            : 'api',
+        experimental: providerId === 'openai-codex' || protocol === 'codex-responses',
     };
 }
 //# sourceMappingURL=provider-settings.js.map

package/dist/providers/responses-codec.d.ts

@@ -1,4 +1,5 @@
 import { type ModelRequest, type ModelStreamEvent, type ModelThinkingConfig } from '../core/runtime.js';
+export type ResponsesRequestDialect = 'public' | 'codex-native';
 export interface ResponsesCodecOptions {
     providerLabel?: string;
     thinking?: ModelThinkingConfig;
@@ -7,6 +8,7 @@ export interface ResponsesCodecOptions {
     maxToolCallsPerResponse?: number;
     maxToolMetadataBytes?: number;
     maxReasoningBytes?: number;
+    requestDialect?: ResponsesRequestDialect;
 }
 export interface ResponsesStreamOptions {
     signal?: AbortSignal;
@@ -20,6 +22,7 @@ export declare class ResponsesCodec {
     readonly maxReasoningBytes: number;
     private readonly label;
     private readonly configuredThinking;
+    private readonly requestDialect;
     constructor(options?: ResponsesCodecOptions);
     serialize(request: ModelRequest, model: string): Record<string, unknown>;
     stream(body: ReadableStream<Uint8Array>, options?: ResponsesStreamOptions): AsyncIterable<ModelStreamEvent>;

package/dist/providers/responses-codec.js

@@ -123,7 +123,7 @@ function serializeMessages(messages) {
     }
     return { instructions: instructions.join('\n\n'), input };
 }
-function serializeResponsesRequest(request, model, configuredThinking) {
+function serializeResponsesRequest(request, model, configuredThinking, dialect = 'public') {
     if (request.webSearch !== undefined)
         throw invalid('Codex subscription provider does not support web search');
     if (request.betas !== undefined)
@@ -149,6 +149,15 @@ function serializeResponsesRequest(request, model, configuredThinking) {
         instructions,
         input,
     };
+    if (dialect === 'codex-native') {
+        body.tool_choice = 'auto';
+        body.parallel_tool_calls = true;
+        for (const item of input) {
+            if ((item.role === 'user' || item.role === 'assistant') &&
+                item.content !== undefined)
+                item.type = 'message';
+        }
+    }
     if (request.tools?.length) {
         body.tools = request.tools.map((tool) => ({
             type: 'function',
@@ -601,9 +610,11 @@ export class ResponsesCodec {
     maxReasoningBytes;
     label;
     configuredThinking;
+    requestDialect;
     constructor(options = {}) {
         this.label = options.providerLabel ?? 'Responses provider';
         this.configuredThinking = options.thinking;
+        this.requestDialect = options.requestDialect ?? 'public';
         if (options.thinking !== undefined &&
             options.thinking.mode !== 'disabled' &&
             options.thinking.mode !== 'enabled' &&
@@ -619,7 +630,7 @@ export class ResponsesCodec {
     }
     serialize(request, model) {
         try {
-            return serializeResponsesRequest(request, model, this.configuredThinking);
+            return serializeResponsesRequest(request, model, this.configuredThinking, this.requestDialect);
         }
         catch (error) {
             throw this.contextualize(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.69.1",
+  "version": "0.70.1",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",
@@ -63,7 +63,7 @@
     "verify:fixture-contracts": "node scripts/verify-fixture-contracts.mjs",
     "test:fixtures": "node scripts/run-fixture-contracts.mjs",
     "test:eval:baseline": "vitest run src/evals/coding-baseline.test.ts src/evals/project-eval-comparison.test.ts src/evals/apply-patch-admission.test.ts src/evals/lsp-diagnostics-admission.test.ts src/evals/glob-ripgrep-admission.test.ts",
-    "test:eval:held-out-contract": "vitest run src/evals/held-out-corpus.test.ts",
+    "test:eval:held-out-contract": "vitest run src/evals/held-out-corpus.test.ts src/evals/held-out-corpus-v3.test.ts",
     "test:eval:held-out-qualification": "vitest run src/evals/held-out-qualification.test.ts"
   },
   "engines": {