promptfoo 0.121.1 → 0.121.3

package/dist/src/{codex-sdk-C6UMlxwV.js → codex-sdk-C_07GuVS.js}

@@ -1,5 +1,5 @@
-import { b as getEnvString, i as logger, w as state } from "./logger-CT3IKMKA.js";
-import { i as resolvePackageEntryPoint, r as importModule } from "./esm-Cd1AjG1D.js";
+import { C as getEnvString, D as state, a as logger, c as REDACTED, l as normalizeFieldName, u as sanitizeObject } from "./logger-DO8_zM18.js";
+import { i as resolvePackageEntryPoint, r as importModule } from "./esm-SUNIX1x3.js";
 import { n as withGenAISpan, t as getTraceparent } from "./genaiTracer-D3fD9dNV.js";
 import fs from "fs";
 import path from "path";
@@ -7,12 +7,43 @@ import dedent from "dedent";
 import crypto from "crypto";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/providers/openai/codex-sdk.ts
+const MINIMAL_CLI_ENV_KEYS = [
+	"PATH",
+	"Path",
+	"HOME",
+	"USER",
+	"USERNAME",
+	"USERPROFILE",
+	"TMPDIR",
+	"TMP",
+	"TEMP",
+	"SHELL",
+	"COMSPEC",
+	"SystemRoot",
+	"PATHEXT",
+	"LANG",
+	"LC_ALL",
+	"TERM"
+];
+function getMinimalProcessEnv() {
+	const env = {};
+	for (const key of MINIMAL_CLI_ENV_KEYS) {
+		const value = process.env[key];
+		if (typeof value === "string" && value.length > 0) env[key] = value;
+	}
+	return env;
+}
 /**
 * Helper to load the OpenAI Codex SDK ESM module
 * Uses resolvePackageEntryPoint to handle ESM-only packages with restrictive exports
 */
 async function loadCodexSDK() {
-	const codexPath = resolvePackageEntryPoint("@openai/codex-sdk", state.basePath && path.isAbsolute(state.basePath) ? state.basePath : process.cwd());
+	const basePaths = [state.basePath && path.isAbsolute(state.basePath) ? state.basePath : void 0, process.cwd()].filter((candidate) => Boolean(candidate));
+	let codexPath = null;
+	for (const basePath of new Set(basePaths)) {
+		codexPath = resolvePackageEntryPoint("@openai/codex-sdk", basePath);
+		if (codexPath) break;
+	}
 	if (!codexPath) throw new Error(dedent`The @openai/codex-sdk package is required but not installed.
 
       To use the OpenAI Codex SDK provider, install it with:
@@ -163,7 +194,10 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		}
 	}
 	prepareEnvironment(config, traceparent) {
-		const env = config.cli_env ? { ...config.cli_env } : { ...process.env };
+		const env = {
+			...config.cli_env === void 0 || config.inherit_process_env === true ? process.env : getMinimalProcessEnv(),
+			...config.cli_env ?? {}
+		};
 		const sortedEnv = {};
 		for (const key of Object.keys(env).sort()) if (env[key] !== void 0) sortedEnv[key] = env[key];
 		if (this.apiKey) {
@@ -192,6 +226,83 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		} else delete sortedEnv.TRACEPARENT;
 		return sortedEnv;
 	}
+	getSkillRootPrefixes(env) {
+		const prefixes = /* @__PURE__ */ new Set();
+		const addPrefix = (candidate) => {
+			if (!candidate) return;
+			const normalized = candidate.replace(/\\/g, "/").replace(/\/+$/g, "");
+			if (normalized) prefixes.add(normalized);
+		};
+		addPrefix(env.CODEX_HOME);
+		addPrefix("/etc/codex");
+		const homeDir = env.HOME || process.env.HOME;
+		if (homeDir) addPrefix(path.posix.join(homeDir.replace(/\\/g, "/"), ".codex"));
+		return Array.from(prefixes);
+	}
+	isValidCodexSkillName(name) {
+		return /^[A-Za-z0-9._:-]+$/.test(name);
+	}
+	extractSkillPathCandidates(text, skillRootPrefixes = []) {
+		const matches = /* @__PURE__ */ new Map();
+		for (const rawToken of text.split(/\s+/)) {
+			const token = rawToken.replace(/^[`"'([{<]+|[`"',;:)\]}>]+$/g, "").trim();
+			if (!token) continue;
+			const normalizedPath = token.replace(/\\/g, "/");
+			const repoMatch = normalizedPath.match(/^\.agents\/skills\/([^/\s]+)\/SKILL\.md$/);
+			if (repoMatch) {
+				if (this.isValidCodexSkillName(repoMatch[1])) matches.set(normalizedPath, {
+					name: repoMatch[1],
+					path: normalizedPath
+				});
+				continue;
+			}
+			const matchingRoot = skillRootPrefixes.find((prefix) => normalizedPath.startsWith(`${prefix}/skills/`));
+			if (!matchingRoot) continue;
+			const customRootMatch = normalizedPath.slice(matchingRoot.length + 1).match(/^skills\/([^/\s]+)\/SKILL\.md$/);
+			if (customRootMatch && this.isValidCodexSkillName(customRootMatch[1])) matches.set(normalizedPath, {
+				name: customRootMatch[1],
+				path: normalizedPath
+			});
+		}
+		return Array.from(matches.values());
+	}
+	extractSkillCallsFromItems(items, skillRootPrefixes = [], options = {}) {
+		const skillCalls = /* @__PURE__ */ new Map();
+		for (const item of items) {
+			if (item?.type !== "command_execution") continue;
+			if (options.requireSuccessfulCommand && !this.isSuccessfulCommandExecution(item)) continue;
+			const command = typeof item.command === "string" && item.command.trim() ? item.command : void 0;
+			if (!command) continue;
+			for (const skillPath of this.extractSkillPathCandidates(command, skillRootPrefixes)) {
+				const existing = skillCalls.get(skillPath.path) ?? {
+					name: skillPath.name,
+					path: skillPath.path
+				};
+				skillCalls.set(skillPath.path, existing);
+			}
+		}
+		return Array.from(skillCalls.values()).map((skillCall) => ({
+			name: skillCall.name,
+			path: skillCall.path,
+			source: "heuristic"
+		}));
+	}
+	buildSkillMetadata(items, skillRootPrefixes = []) {
+		if (!Array.isArray(items) || items.length === 0) return;
+		const attemptedSkillCalls = this.extractSkillCallsFromItems(items, skillRootPrefixes);
+		const skillCalls = this.extractSkillCallsFromItems(items, skillRootPrefixes, { requireSuccessfulCommand: true });
+		if (skillCalls.length === 0 && attemptedSkillCalls.length <= skillCalls.length) return;
+		return {
+			attemptedSkillCalls,
+			skillCalls
+		};
+	}
+	isSuccessfulCommandExecution(item) {
+		if (item?.type !== "command_execution") return false;
+		if (typeof item.status === "string" && item.status !== "completed") return false;
+		if (typeof item.exit_code === "number" && item.exit_code !== 0) return false;
+		return true;
+	}
 	validateWorkingDirectory(workingDir, skipGitCheck = false) {
 		let stats;
 		try {
@@ -230,7 +341,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 			...config.additional_directories?.length ? { additionalDirectories: config.additional_directories } : {},
 			...config.sandbox_mode ? { sandboxMode: config.sandbox_mode } : {},
 			...config.model_reasoning_effort ? { modelReasoningEffort: config.model_reasoning_effort } : {},
-			...config.network_access_enabled !== void 0 ? { networkAccessEnabled: config.network_access_enabled } : {},
+			...config.network_access_enabled === void 0 ? {} : { networkAccessEnabled: config.network_access_enabled },
 			...config.web_search_mode ? { webSearchMode: config.web_search_mode } : {},
 			...config.web_search_enabled !== void 0 && !config.web_search_mode ? { webSearchEnabled: config.web_search_enabled } : {},
 			...config.approval_policy ? { approvalPolicy: config.approval_policy } : {}
@@ -259,7 +370,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		if (config.persist_threads && cacheKey) this.threads.set(cacheKey, thread);
 		return thread;
 	}
-	async runStreaming(thread, prompt, runOptions, callOptions) {
+	async runStreaming(thread, prompt, runOptions, callOptions, skillRootPrefixes = []) {
 		const { events } = await thread.runStreamed(prompt, runOptions);
 		const items = [];
 		let usage = void 0;
@@ -338,7 +449,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 								}
 							});
 						}
-						const completionAttrs = this.getCompletionAttributesForItem(item);
+						const completionAttrs = this.getCompletionAttributesForItem(item, skillRootPrefixes);
 						for (const [key, value] of Object.entries(completionAttrs)) span.setAttribute(key, value);
 						const durationMs = eventTime - (itemStartTimes.get(itemId) || lastEventTime);
 						span.setAttribute("codex.duration_ms", durationMs);
@@ -367,7 +478,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 							const itemId = String(item.id);
 							const span = activeSpans.get(itemId);
 							if (span) {
-								const updatedAttrs = this.getCompletionAttributesForItem(item);
+								const updatedAttrs = this.getCompletionAttributesForItem(item, skillRootPrefixes);
 								for (const [key, value] of Object.entries(updatedAttrs)) span.setAttribute(key, value);
 							}
 						}
@@ -434,6 +545,25 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 	/**
 	* Get attributes for a Codex item at start
 	*/
+	getSkillTraceAttributes(item, skillRootPrefixes = [], options = {}) {
+		if (item?.type !== "command_execution") return {};
+		if (options.requireSuccessfulCommand && !this.isSuccessfulCommandExecution(item)) return {};
+		const command = typeof item.command === "string" && item.command.trim() ? item.command : void 0;
+		const skillCandidates = /* @__PURE__ */ new Map();
+		if (command) for (const skill of this.extractSkillPathCandidates(command, skillRootPrefixes)) skillCandidates.set(skill.path, skill);
+		if (skillCandidates.size === 0) return {};
+		const skills = Array.from(skillCandidates.values());
+		const attrs = {
+			"promptfoo.skill.count": skills.length,
+			"promptfoo.skill.names": skills.map((skill) => skill.name).join(","),
+			"promptfoo.skill.paths": skills.map((skill) => skill.path).join(",")
+		};
+		if (skills.length === 1) {
+			attrs["promptfoo.skill.name"] = skills[0].name;
+			attrs["promptfoo.skill.path"] = skills[0].path;
+		}
+		return attrs;
+	}
 	getAttributesForItem(item) {
 		const attrs = {};
 		switch (item.type) {
@@ -443,6 +573,10 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 			case "mcp_tool_call":
 				if (typeof item.server === "string") attrs["codex.mcp.server"] = item.server;
 				if (typeof item.tool === "string") attrs["codex.mcp.tool"] = item.tool;
+				{
+					const serializedArgs = this.serializeItemValue(item.arguments ?? item.args ?? item.input);
+					if (serializedArgs) attrs["codex.mcp.input"] = serializedArgs;
+				}
 				break;
 			case "web_search":
 				if (typeof item.query === "string") attrs["codex.search.query"] = item.query;
@@ -461,16 +595,40 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		}
 		return attrs;
 	}
+	serializeItemValue(value) {
+		if (typeof value === "string") {
+			const trimmed = value.trim();
+			if (!trimmed) return;
+			try {
+				return JSON.stringify(this.redactTracePii(sanitizeObject(JSON.parse(trimmed))));
+			} catch {
+				return this.redactTracePii(sanitizeObject(trimmed, { context: "Codex MCP trace input" }));
+			}
+		}
+		if (value === void 0 || value === null) return;
+		try {
+			return JSON.stringify(this.redactTracePii(sanitizeObject(value, { context: "Codex MCP trace input" })));
+		} catch {
+			return;
+		}
+	}
+	redactTracePii(value) {
+		if (typeof value === "string" && /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i.test(value)) return REDACTED;
+		if (Array.isArray(value)) return value.map((item) => this.redactTracePii(item));
+		if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeFieldName(key).includes("email") ? REDACTED : this.redactTracePii(entryValue)]));
+		return value;
+	}
 	/**
 	* Get attributes for a Codex item at completion
 	*/
-	getCompletionAttributesForItem(item) {
+	getCompletionAttributesForItem(item, skillRootPrefixes = []) {
 		const attrs = {};
 		switch (item.type) {
 			case "command_execution":
 				if (typeof item.exit_code === "number") attrs["codex.exit_code"] = item.exit_code;
 				if (typeof item.status === "string") attrs["codex.status"] = item.status;
 				if (typeof item.aggregated_output === "string") attrs["codex.output"] = item.aggregated_output;
+				Object.assign(attrs, this.getSkillTraceAttributes(item, skillRootPrefixes, { requireSuccessfulCommand: true }));
 				break;
 			case "file_change":
 				if (typeof item.status === "string") attrs["codex.status"] = item.status;
@@ -482,6 +640,10 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 			case "mcp_tool_call":
 				if (typeof item.status === "string") attrs["codex.status"] = item.status;
 				if (typeof item.error?.message === "string") attrs["codex.error"] = item.error.message;
+				{
+					const serializedArgs = this.serializeItemValue(item.arguments ?? item.args ?? item.input);
+					if (serializedArgs) attrs["codex.mcp.input"] = serializedArgs;
+				}
 				break;
 			case "agent_message":
 				if (typeof item.text === "string") attrs["codex.message"] = item.text;
@@ -571,6 +733,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 	async callApiInternal(prompt, _context, callOptions, config) {
 		const currentTraceparent = getTraceparent();
 		const env = this.prepareEnvironment(config, currentTraceparent);
+		const skillRootPrefixes = this.getSkillRootPrefixes(env);
 		if (!this.apiKey && !env.OPENAI_API_KEY && !env.CODEX_API_KEY) throw new Error("OpenAI API key is not set. Set OPENAI_API_KEY or CODEX_API_KEY environment variable or add \"apiKey\" to provider config.");
 		if (config.working_dir) this.validateWorkingDirectory(config.working_dir, config.skip_git_repo_check);
 		if (callOptions?.abortSignal?.aborted) return { error: "OpenAI Codex SDK call aborted before it started" };
@@ -610,9 +773,14 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		if (config.output_schema) runOptions.outputSchema = config.output_schema;
 		if (callOptions?.abortSignal) runOptions.signal = callOptions.abortSignal;
 		try {
-			const turn = config.enable_streaming ? await this.runStreaming(thread, prompt, runOptions, callOptions) : await thread.run(prompt, runOptions);
+			const turn = config.enable_streaming ? await this.runStreaming(thread, prompt, runOptions, callOptions, skillRootPrefixes) : await thread.run(prompt, runOptions);
 			const output = turn.finalResponse || "";
 			const raw = JSON.stringify(turn);
+			const skillMetadata = this.buildSkillMetadata(turn.items, skillRootPrefixes);
+			const metadata = skillMetadata ? {
+				...skillMetadata.skillCalls.length > 0 ? { skillCalls: skillMetadata.skillCalls } : {},
+				...skillMetadata.attemptedSkillCalls.length > skillMetadata.skillCalls.length ? { attemptedSkillCalls: skillMetadata.attemptedSkillCalls } : {}
+			} : void 0;
 			const tokenUsage = turn.usage ? {
 				prompt: turn.usage.input_tokens,
 				completion: turn.usage.output_tokens,
@@ -638,6 +806,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 				output,
 				tokenUsage,
 				cost,
+				metadata,
 				raw,
 				sessionId: thread.id || "unknown"
 			};
@@ -662,4 +831,4 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 //#endregion
 export { OpenAICodexSDKProvider };
 
-//# sourceMappingURL=codex-sdk-C6UMlxwV.js.map
+//# sourceMappingURL=codex-sdk-C_07GuVS.js.map

package/dist/src/{codex-sdk-GGAw0qbD.js → codex-sdk-DE5G18dx.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as getEnvString, O as state, o as logger } from "./logger-KkObSCzq.js";
-import { i as resolvePackageEntryPoint, r as importModule } from "./esm-C03C-mv3.js";
+import { E as getEnvString, d as normalizeFieldName, f as sanitizeObject, j as state, s as logger, u as REDACTED } from "./logger-BcJBzSSA.js";
+import { i as resolvePackageEntryPoint, r as importModule } from "./esm-7UIl0pPM.js";
 import { n as withGenAISpan, t as getTraceparent } from "./genaiTracer-C1rxGO8Q.js";
 import fs from "fs";
 import path from "path";
@@ -8,12 +8,43 @@ import dedent from "dedent";
 import crypto from "crypto";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/providers/openai/codex-sdk.ts
+const MINIMAL_CLI_ENV_KEYS = [
+	"PATH",
+	"Path",
+	"HOME",
+	"USER",
+	"USERNAME",
+	"USERPROFILE",
+	"TMPDIR",
+	"TMP",
+	"TEMP",
+	"SHELL",
+	"COMSPEC",
+	"SystemRoot",
+	"PATHEXT",
+	"LANG",
+	"LC_ALL",
+	"TERM"
+];
+function getMinimalProcessEnv() {
+	const env = {};
+	for (const key of MINIMAL_CLI_ENV_KEYS) {
+		const value = process.env[key];
+		if (typeof value === "string" && value.length > 0) env[key] = value;
+	}
+	return env;
+}
 /**
 * Helper to load the OpenAI Codex SDK ESM module
 * Uses resolvePackageEntryPoint to handle ESM-only packages with restrictive exports
 */
 async function loadCodexSDK() {
-	const codexPath = resolvePackageEntryPoint("@openai/codex-sdk", state.basePath && path.isAbsolute(state.basePath) ? state.basePath : process.cwd());
+	const basePaths = [state.basePath && path.isAbsolute(state.basePath) ? state.basePath : void 0, process.cwd()].filter((candidate) => Boolean(candidate));
+	let codexPath = null;
+	for (const basePath of new Set(basePaths)) {
+		codexPath = resolvePackageEntryPoint("@openai/codex-sdk", basePath);
+		if (codexPath) break;
+	}
 	if (!codexPath) throw new Error(dedent`The @openai/codex-sdk package is required but not installed.
 
       To use the OpenAI Codex SDK provider, install it with:
@@ -164,7 +195,10 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		}
 	}
 	prepareEnvironment(config, traceparent) {
-		const env = config.cli_env ? { ...config.cli_env } : { ...process.env };
+		const env = {
+			...config.cli_env === void 0 || config.inherit_process_env === true ? process.env : getMinimalProcessEnv(),
+			...config.cli_env ?? {}
+		};
 		const sortedEnv = {};
 		for (const key of Object.keys(env).sort()) if (env[key] !== void 0) sortedEnv[key] = env[key];
 		if (this.apiKey) {
@@ -193,6 +227,83 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		} else delete sortedEnv.TRACEPARENT;
 		return sortedEnv;
 	}
+	getSkillRootPrefixes(env) {
+		const prefixes = /* @__PURE__ */ new Set();
+		const addPrefix = (candidate) => {
+			if (!candidate) return;
+			const normalized = candidate.replace(/\\/g, "/").replace(/\/+$/g, "");
+			if (normalized) prefixes.add(normalized);
+		};
+		addPrefix(env.CODEX_HOME);
+		addPrefix("/etc/codex");
+		const homeDir = env.HOME || process.env.HOME;
+		if (homeDir) addPrefix(path.posix.join(homeDir.replace(/\\/g, "/"), ".codex"));
+		return Array.from(prefixes);
+	}
+	isValidCodexSkillName(name) {
+		return /^[A-Za-z0-9._:-]+$/.test(name);
+	}
+	extractSkillPathCandidates(text, skillRootPrefixes = []) {
+		const matches = /* @__PURE__ */ new Map();
+		for (const rawToken of text.split(/\s+/)) {
+			const token = rawToken.replace(/^[`"'([{<]+|[`"',;:)\]}>]+$/g, "").trim();
+			if (!token) continue;
+			const normalizedPath = token.replace(/\\/g, "/");
+			const repoMatch = normalizedPath.match(/^\.agents\/skills\/([^/\s]+)\/SKILL\.md$/);
+			if (repoMatch) {
+				if (this.isValidCodexSkillName(repoMatch[1])) matches.set(normalizedPath, {
+					name: repoMatch[1],
+					path: normalizedPath
+				});
+				continue;
+			}
+			const matchingRoot = skillRootPrefixes.find((prefix) => normalizedPath.startsWith(`${prefix}/skills/`));
+			if (!matchingRoot) continue;
+			const customRootMatch = normalizedPath.slice(matchingRoot.length + 1).match(/^skills\/([^/\s]+)\/SKILL\.md$/);
+			if (customRootMatch && this.isValidCodexSkillName(customRootMatch[1])) matches.set(normalizedPath, {
+				name: customRootMatch[1],
+				path: normalizedPath
+			});
+		}
+		return Array.from(matches.values());
+	}
+	extractSkillCallsFromItems(items, skillRootPrefixes = [], options = {}) {
+		const skillCalls = /* @__PURE__ */ new Map();
+		for (const item of items) {
+			if (item?.type !== "command_execution") continue;
+			if (options.requireSuccessfulCommand && !this.isSuccessfulCommandExecution(item)) continue;
+			const command = typeof item.command === "string" && item.command.trim() ? item.command : void 0;
+			if (!command) continue;
+			for (const skillPath of this.extractSkillPathCandidates(command, skillRootPrefixes)) {
+				const existing = skillCalls.get(skillPath.path) ?? {
+					name: skillPath.name,
+					path: skillPath.path
+				};
+				skillCalls.set(skillPath.path, existing);
+			}
+		}
+		return Array.from(skillCalls.values()).map((skillCall) => ({
+			name: skillCall.name,
+			path: skillCall.path,
+			source: "heuristic"
+		}));
+	}
+	buildSkillMetadata(items, skillRootPrefixes = []) {
+		if (!Array.isArray(items) || items.length === 0) return;
+		const attemptedSkillCalls = this.extractSkillCallsFromItems(items, skillRootPrefixes);
+		const skillCalls = this.extractSkillCallsFromItems(items, skillRootPrefixes, { requireSuccessfulCommand: true });
+		if (skillCalls.length === 0 && attemptedSkillCalls.length <= skillCalls.length) return;
+		return {
+			attemptedSkillCalls,
+			skillCalls
+		};
+	}
+	isSuccessfulCommandExecution(item) {
+		if (item?.type !== "command_execution") return false;
+		if (typeof item.status === "string" && item.status !== "completed") return false;
+		if (typeof item.exit_code === "number" && item.exit_code !== 0) return false;
+		return true;
+	}
 	validateWorkingDirectory(workingDir, skipGitCheck = false) {
 		let stats;
 		try {
@@ -231,7 +342,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 			...config.additional_directories?.length ? { additionalDirectories: config.additional_directories } : {},
 			...config.sandbox_mode ? { sandboxMode: config.sandbox_mode } : {},
 			...config.model_reasoning_effort ? { modelReasoningEffort: config.model_reasoning_effort } : {},
-			...config.network_access_enabled !== void 0 ? { networkAccessEnabled: config.network_access_enabled } : {},
+			...config.network_access_enabled === void 0 ? {} : { networkAccessEnabled: config.network_access_enabled },
 			...config.web_search_mode ? { webSearchMode: config.web_search_mode } : {},
 			...config.web_search_enabled !== void 0 && !config.web_search_mode ? { webSearchEnabled: config.web_search_enabled } : {},
 			...config.approval_policy ? { approvalPolicy: config.approval_policy } : {}
@@ -260,7 +371,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		if (config.persist_threads && cacheKey) this.threads.set(cacheKey, thread);
 		return thread;
 	}
-	async runStreaming(thread, prompt, runOptions, callOptions) {
+	async runStreaming(thread, prompt, runOptions, callOptions, skillRootPrefixes = []) {
 		const { events } = await thread.runStreamed(prompt, runOptions);
 		const items = [];
 		let usage = void 0;
@@ -339,7 +450,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 								}
 							});
 						}
-						const completionAttrs = this.getCompletionAttributesForItem(item);
+						const completionAttrs = this.getCompletionAttributesForItem(item, skillRootPrefixes);
 						for (const [key, value] of Object.entries(completionAttrs)) span.setAttribute(key, value);
 						const durationMs = eventTime - (itemStartTimes.get(itemId) || lastEventTime);
 						span.setAttribute("codex.duration_ms", durationMs);
@@ -368,7 +479,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 							const itemId = String(item.id);
 							const span = activeSpans.get(itemId);
 							if (span) {
-								const updatedAttrs = this.getCompletionAttributesForItem(item);
+								const updatedAttrs = this.getCompletionAttributesForItem(item, skillRootPrefixes);
 								for (const [key, value] of Object.entries(updatedAttrs)) span.setAttribute(key, value);
 							}
 						}
@@ -435,6 +546,25 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 	/**
 	* Get attributes for a Codex item at start
 	*/
+	getSkillTraceAttributes(item, skillRootPrefixes = [], options = {}) {
+		if (item?.type !== "command_execution") return {};
+		if (options.requireSuccessfulCommand && !this.isSuccessfulCommandExecution(item)) return {};
+		const command = typeof item.command === "string" && item.command.trim() ? item.command : void 0;
+		const skillCandidates = /* @__PURE__ */ new Map();
+		if (command) for (const skill of this.extractSkillPathCandidates(command, skillRootPrefixes)) skillCandidates.set(skill.path, skill);
+		if (skillCandidates.size === 0) return {};
+		const skills = Array.from(skillCandidates.values());
+		const attrs = {
+			"promptfoo.skill.count": skills.length,
+			"promptfoo.skill.names": skills.map((skill) => skill.name).join(","),
+			"promptfoo.skill.paths": skills.map((skill) => skill.path).join(",")
+		};
+		if (skills.length === 1) {
+			attrs["promptfoo.skill.name"] = skills[0].name;
+			attrs["promptfoo.skill.path"] = skills[0].path;
+		}
+		return attrs;
+	}
 	getAttributesForItem(item) {
 		const attrs = {};
 		switch (item.type) {
@@ -444,6 +574,10 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 			case "mcp_tool_call":
 				if (typeof item.server === "string") attrs["codex.mcp.server"] = item.server;
 				if (typeof item.tool === "string") attrs["codex.mcp.tool"] = item.tool;
+				{
+					const serializedArgs = this.serializeItemValue(item.arguments ?? item.args ?? item.input);
+					if (serializedArgs) attrs["codex.mcp.input"] = serializedArgs;
+				}
 				break;
 			case "web_search":
 				if (typeof item.query === "string") attrs["codex.search.query"] = item.query;
@@ -462,16 +596,40 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		}
 		return attrs;
 	}
+	serializeItemValue(value) {
+		if (typeof value === "string") {
+			const trimmed = value.trim();
+			if (!trimmed) return;
+			try {
+				return JSON.stringify(this.redactTracePii(sanitizeObject(JSON.parse(trimmed))));
+			} catch {
+				return this.redactTracePii(sanitizeObject(trimmed, { context: "Codex MCP trace input" }));
+			}
+		}
+		if (value === void 0 || value === null) return;
+		try {
+			return JSON.stringify(this.redactTracePii(sanitizeObject(value, { context: "Codex MCP trace input" })));
+		} catch {
+			return;
+		}
+	}
+	redactTracePii(value) {
+		if (typeof value === "string" && /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i.test(value)) return REDACTED;
+		if (Array.isArray(value)) return value.map((item) => this.redactTracePii(item));
+		if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeFieldName(key).includes("email") ? REDACTED : this.redactTracePii(entryValue)]));
+		return value;
+	}
 	/**
 	* Get attributes for a Codex item at completion
 	*/
-	getCompletionAttributesForItem(item) {
+	getCompletionAttributesForItem(item, skillRootPrefixes = []) {
 		const attrs = {};
 		switch (item.type) {
 			case "command_execution":
 				if (typeof item.exit_code === "number") attrs["codex.exit_code"] = item.exit_code;
 				if (typeof item.status === "string") attrs["codex.status"] = item.status;
 				if (typeof item.aggregated_output === "string") attrs["codex.output"] = item.aggregated_output;
+				Object.assign(attrs, this.getSkillTraceAttributes(item, skillRootPrefixes, { requireSuccessfulCommand: true }));
 				break;
 			case "file_change":
 				if (typeof item.status === "string") attrs["codex.status"] = item.status;
@@ -483,6 +641,10 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 			case "mcp_tool_call":
 				if (typeof item.status === "string") attrs["codex.status"] = item.status;
 				if (typeof item.error?.message === "string") attrs["codex.error"] = item.error.message;
+				{
+					const serializedArgs = this.serializeItemValue(item.arguments ?? item.args ?? item.input);
+					if (serializedArgs) attrs["codex.mcp.input"] = serializedArgs;
+				}
 				break;
 			case "agent_message":
 				if (typeof item.text === "string") attrs["codex.message"] = item.text;
@@ -572,6 +734,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 	async callApiInternal(prompt, _context, callOptions, config) {
 		const currentTraceparent = getTraceparent();
 		const env = this.prepareEnvironment(config, currentTraceparent);
+		const skillRootPrefixes = this.getSkillRootPrefixes(env);
 		if (!this.apiKey && !env.OPENAI_API_KEY && !env.CODEX_API_KEY) throw new Error("OpenAI API key is not set. Set OPENAI_API_KEY or CODEX_API_KEY environment variable or add \"apiKey\" to provider config.");
 		if (config.working_dir) this.validateWorkingDirectory(config.working_dir, config.skip_git_repo_check);
 		if (callOptions?.abortSignal?.aborted) return { error: "OpenAI Codex SDK call aborted before it started" };
@@ -611,9 +774,14 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 		if (config.output_schema) runOptions.outputSchema = config.output_schema;
 		if (callOptions?.abortSignal) runOptions.signal = callOptions.abortSignal;
 		try {
-			const turn = config.enable_streaming ? await this.runStreaming(thread, prompt, runOptions, callOptions) : await thread.run(prompt, runOptions);
+			const turn = config.enable_streaming ? await this.runStreaming(thread, prompt, runOptions, callOptions, skillRootPrefixes) : await thread.run(prompt, runOptions);
 			const output = turn.finalResponse || "";
 			const raw = JSON.stringify(turn);
+			const skillMetadata = this.buildSkillMetadata(turn.items, skillRootPrefixes);
+			const metadata = skillMetadata ? {
+				...skillMetadata.skillCalls.length > 0 ? { skillCalls: skillMetadata.skillCalls } : {},
+				...skillMetadata.attemptedSkillCalls.length > skillMetadata.skillCalls.length ? { attemptedSkillCalls: skillMetadata.attemptedSkillCalls } : {}
+			} : void 0;
 			const tokenUsage = turn.usage ? {
 				prompt: turn.usage.input_tokens,
 				completion: turn.usage.output_tokens,
@@ -639,6 +807,7 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 				output,
 				tokenUsage,
 				cost,
+				metadata,
 				raw,
 				sessionId: thread.id || "unknown"
 			};
@@ -663,4 +832,4 @@ var OpenAICodexSDKProvider = class OpenAICodexSDKProvider {
 //#endregion
 export { OpenAICodexSDKProvider };
 
-//# sourceMappingURL=codex-sdk-GGAw0qbD.js.map
+//# sourceMappingURL=codex-sdk-DE5G18dx.js.map