promptfoo 0.125.0 → 0.125.1

package/dist/src/agents-api-IWHEwp8i.js

@@ -1,710 +0,0 @@
-import { E as sanitizeUrlForLogging, d as isNonCredentialHeader, l as REDACTED, m as looksLikeSecret, o as logger, p as isSecretField, x as sanitizeObject } from "./logger-Gff7RMNF.js";
-import { n as fetchWithRetries, s as readBoundedText } from "./fetch-BCwjoIFd.js";
-import { r as sleepWithAbort } from "./time-Db5rO0GY.js";
-import { c as extractProviderResponseAttributes, h as withGenAISpan, i as buildChatSpanContext } from "./genaiTracer-CuSjHi4t.js";
-import { n as renderVarsInObject, r as analyzeTemplateReference } from "./render-DuOHcYot.js";
-import { d as appendOpenAiApiPath, f as assertOpenAiApiModel } from "./util-CsTD_ROg.js";
-import { r as calculateOpenAIUsageCost } from "./billing-Gg_jbkR9.js";
-import "./tracing-CfUes1dH.js";
-import { n as OpenAiGenericProvider } from "./openai-TU3iAci7.js";
-import { m as decodeUrlComponent } from "./server/index.js";
-//#region src/providers/openai/agents-api.ts
-const MAX_TIMER_MS = 2147483647;
-const MAX_LIST_PAGES = 100;
-const MAX_SESSION_LIST_PAGES = 1e3;
-const MAX_LIST_ITEMS = 1e4;
-const MAX_ERROR_DETAIL_LENGTH = 1024;
-const MAX_RESPONSE_BODY_BYTES = 16777216;
-const TRANSIENT_STATUS_CODES = /* @__PURE__ */ new Set([
-	500,
-	502,
-	503,
-	504
-]);
-const MESSAGE_ITEM_TYPES = /* @__PURE__ */ new Set([
-	"message",
-	"agent_message",
-	"reasoning"
-]);
-const RETRY_BASE_DELAY_MS = 1e3;
-const RETRY_MAX_DELAY_MS = 8e3;
-const CLEANUP_RETRY_MAX_DELAY_MS = 5e3;
-const TURN_USAGE_GRACE_MS = 5e3;
-const MIN_CREDENTIAL_LENGTH = 8;
-const MIN_TOKEN_CREDENTIAL_LENGTH = 2;
-const CREDENTIAL_NAME = /(?:authorization|api[-_]?key|token|secret|signature|credential|cookie|password|(?:^|[-_])key$)/i;
-var AgentsApiHttpError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.status = status;
-		this.name = "AgentsApiHttpError";
-	}
-};
-function isCredentialName(name) {
-	return isSecretField(name) || CREDENTIAL_NAME.test(name);
-}
-function isCredentialHeader(name, value) {
-	return isCredentialName(name) || /(?:^|[-_])auth(?:$|[-_])/i.test(name) || getUrlCredentials(value).length > 0 || sanitizeObject({ headers: { [name]: value } }).headers[name] === "[REDACTED]";
-}
-function addCredential(credentials, value) {
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	const candidates = [trimmed, trimmed.replace(/^(?:Bearer|Basic|Token)\s+/i, "")];
-	const basic = /^Basic\s+([a-z\d+/]+={0,2})$/i.exec(trimmed);
-	if (basic) {
-		const bytes = Buffer.from(basic[1], "base64");
-		const decoded = bytes.toString("utf8");
-		const separator = decoded.indexOf(":");
-		if (separator !== -1 && bytes.toString("base64").replace(/=+$/, "") === basic[1].replace(/=+$/, "")) candidates.push(decoded, decoded.slice(0, separator), decoded.slice(separator + 1));
-	}
-	for (const candidate of candidates) if (candidate.length >= MIN_TOKEN_CREDENTIAL_LENGTH) {
-		credentials.add(candidate);
-		credentials.add(encodeURIComponent(candidate));
-	}
-}
-/** Decode URL userinfo as Node's HTTP client does, keeping a malformed escape as written. */
-function decodeUserinfo(url) {
-	return url.username || url.password ? `${decodeUrlComponent(url.username)}:${decodeUrlComponent(url.password)}` : void 0;
-}
-function basicCredential(userinfo) {
-	return `Basic ${Buffer.from(userinfo).toString("base64")}`;
-}
-/**
-* Promptfoo's fetch helper would Base64-encode URL userinfo while it is still percent-encoded, so
-* request URLs omit it and the provider sends a decoded Basic credential instead.
-*/
-function splitUserinfo(apiUrl) {
-	let url;
-	try {
-		url = new URL(apiUrl);
-	} catch {
-		return { url: apiUrl };
-	}
-	const userinfo = decodeUserinfo(url);
-	if (!userinfo) return { url: apiUrl };
-	url.username = "";
-	url.password = "";
-	return {
-		url: url.toString(),
-		userinfo
-	};
-}
-/**
-* Credential values carried by a URL: userinfo, including the decoded pair and the Basic
-* credential derived from it, and credential-named query parameters. Raw and decoded spellings
-* are both returned for redaction.
-*/
-function getUrlCredentials(value, includeFragment = true) {
-	const trimmed = value.trim();
-	if (!/^[a-z][a-z\d+.-]*:\/\//i.test(trimmed)) return [];
-	let url;
-	try {
-		url = new URL(trimmed);
-	} catch {
-		return sanitizeUrlForLogging(value) === value ? [] : [value];
-	}
-	const found = [url.username, url.password].flatMap((part) => [part, decodeUrlComponent(part)]);
-	const userinfo = decodeUserinfo(url);
-	if (userinfo) found.push(userinfo, basicCredential(userinfo));
-	const sanitizedSegments = sanitizeUrlForLogging(url.pathname).split("/");
-	for (const [index, segment] of url.pathname.split("/").entries()) if (sanitizedSegments[index] === "%5BREDACTED%5D") found.push(segment, decodeUrlComponent(segment));
-	const parameterParts = includeFragment ? [url.search, url.hash] : [url.search];
-	for (const segment of parameterParts.flatMap((part) => part.slice(1).split(/[&;]/))) {
-		const separator = segment.indexOf("=");
-		const [param] = new URLSearchParams(segment);
-		if (separator !== -1 && param && (isCredentialName(param[0]) || looksLikeSecret(param[1]) || looksLikeSecret(segment.slice(separator + 1)))) found.push(segment.slice(separator + 1), param[1]);
-	}
-	return found.filter((credential) => credential.trim().length > 0);
-}
-/**
-* Collect credential values from credential-named keys, credential-bearing URLs, and every value in
-* a `headers` map, such as provider or remote MCP tool headers, except non-credential headers.
-*/
-function collectConfigCredentials(value, credentials, key = "", inHeaders = false) {
-	if (typeof value === "string") {
-		if (key && isCredentialName(key) || inHeaders && !isNonCredentialHeader(key)) addCredential(credentials, value);
-		for (const credential of getUrlCredentials(value)) addCredential(credentials, credential);
-		return;
-	}
-	if (Array.isArray(value)) {
-		for (const item of value) collectConfigCredentials(item, credentials, key, inHeaders);
-		return;
-	}
-	if (value && typeof value === "object") {
-		const childInHeaders = inHeaders || key.toLowerCase() === "headers";
-		for (const [childKey, item] of Object.entries(value)) collectConfigCredentials(item, credentials, childKey, childInHeaders);
-	}
-}
-/**
-* Credential-named header values are redacted and satisfy the credential requirement. Any custom
-* header outside the non-credential allowlist may authenticate a gateway.
-*/
-function scanRequestHeaders(headers, credentials) {
-	let hasHeaderCredential = false;
-	let hasCustomHeader = false;
-	headers.forEach((value, name) => {
-		const present = value.trim().length > 0;
-		if (isCredentialName(name)) {
-			hasHeaderCredential ||= present;
-			addCredential(credentials, value);
-		}
-		hasCustomHeader ||= present && name !== "authorization" && !isNonCredentialHeader(name);
-	});
-	return {
-		hasHeaderCredential,
-		hasCustomHeader
-	};
-}
-/** Credentials a call can send or echo: its resolved key, effective base URL, and config values. */
-function collectCallCredentials(provider, credentials) {
-	addCredential(credentials, provider.getApiKey());
-	for (const credential of getUrlCredentials(provider.getApiUrl())) addCredential(credentials, credential);
-	collectConfigCredentials(provider.config, credentials);
-}
-function sortCredentials(credentials) {
-	return [...credentials].sort((left, right) => right.length - left.length);
-}
-/**
-* Match a short credential only as a separate token, not next to a character that continues one.
-* `=` may precede a value, as in `api-key=s3cr3t`, but continues a token when it follows.
-*/
-function shortCredentialPattern(credential) {
-	const escaped = credential.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	return new RegExp(`(?<![\\w.~+/-])${escaped}(?![\\w.~+/=-])`, "g");
-}
-function redactCredentials(text, credentials) {
-	let redacted = text;
-	for (const credential of credentials) redacted = credential.length >= MIN_CREDENTIAL_LENGTH ? redacted.split(credential).join(REDACTED) : redacted.replace(shortCredentialPattern(credential), REDACTED);
-	return redacted.replace(/\bsk-[\w-]{16,}/g, REDACTED).replace(/\b(Bearer|Basic)\s+[\w.~+/=-]{8,}/gi, `$1 ${REDACTED}`);
-}
-function isNonNegativeSafeInteger(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
-function isUsage(value) {
-	const usage = value;
-	const cached = usage?.input_tokens_details?.cached_tokens;
-	const reasoning = usage?.output_tokens_details?.reasoning_tokens;
-	return isNonNegativeSafeInteger(usage?.input_tokens) && isNonNegativeSafeInteger(usage.output_tokens) && isNonNegativeSafeInteger(usage.total_tokens) && (cached == null || isNonNegativeSafeInteger(cached)) && (reasoning == null || isNonNegativeSafeInteger(reasoning));
-}
-function toTokenUsage(usage) {
-	return {
-		prompt: usage.input_tokens,
-		completion: usage.output_tokens,
-		total: usage.total_tokens,
-		cached: usage.input_tokens_details?.cached_tokens ?? void 0,
-		completionDetails: { reasoning: usage.output_tokens_details?.reasoning_tokens ?? void 0 }
-	};
-}
-function addUsage(left, right) {
-	return {
-		input_tokens: left.input_tokens + right.input_tokens,
-		output_tokens: left.output_tokens + right.output_tokens,
-		total_tokens: left.total_tokens + right.total_tokens,
-		input_tokens_details: { cached_tokens: (left.input_tokens_details?.cached_tokens ?? 0) + (right.input_tokens_details?.cached_tokens ?? 0) },
-		output_tokens_details: { reasoning_tokens: (left.output_tokens_details?.reasoning_tokens ?? 0) + (right.output_tokens_details?.reasoning_tokens ?? 0) }
-	};
-}
-function referencesVariable(template, names) {
-	return names.some((name) => {
-		const reference = analyzeTemplateReference(template, name);
-		return reference.parsed && reference.referenced;
-	});
-}
-/** Render only strings that reference test vars, preserving literal braces in commands and code. */
-function renderConfigTemplates(value, vars, names) {
-	if (typeof value === "string") return (value.includes("{{") || value.includes("{%")) && referencesVariable(value, names) ? renderVarsInObject(value, vars) : value;
-	if (Array.isArray(value)) return value.map((item) => renderConfigTemplates(item, vars, names));
-	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, renderConfigTemplates(item, vars, names)]));
-	return typeof value === "function" ? renderVarsInObject(value, vars) : value;
-}
-/** Managed Codex sessions, distinct from the local @openai/agents SDK provider. */
-var OpenAiAgentsApiProvider = class OpenAiAgentsApiProvider extends OpenAiGenericProvider {
-	modelOverride;
-	credentials = [];
-	listBudget = {
-		pages: MAX_SESSION_LIST_PAGES,
-		items: MAX_LIST_ITEMS,
-		bytes: MAX_RESPONSE_BODY_BYTES
-	};
-	listItemPeaks = /* @__PURE__ */ new Map();
-	listBytePeaks = /* @__PURE__ */ new Map();
-	inheritedCredentials = /* @__PURE__ */ new Set();
-	constructor(modelName = "", options = {}) {
-		const config = options.config ?? {};
-		super(modelName || config.agent?.model || config.model || (config.agent_id ? "" : "gpt-6-astra"), options);
-		this.modelOverride = modelName;
-		for (const key of [
-			"timeoutMs",
-			"pollIntervalMs",
-			"cleanupTimeoutMs"
-		]) {
-			const value = config[key];
-			if (value !== void 0 && (!Number.isSafeInteger(value) || value <= 0 || value > MAX_TIMER_MS)) throw new Error(`Agents API ${key} must be a positive integer no greater than ${MAX_TIMER_MS}`);
-		}
-		const { usageTimeoutMs } = config;
-		if (usageTimeoutMs !== void 0 && (!Number.isSafeInteger(usageTimeoutMs) || usageTimeoutMs < 0 || usageTimeoutMs > MAX_TIMER_MS)) throw new Error(`Agents API usageTimeoutMs must be a non-negative integer no greater than ${MAX_TIMER_MS}`);
-		if (config.environment && !["none", "openai_hosted"].includes(config.environment.type)) throw new Error("Agents API environment.type must be \"none\" or \"openai_hosted\"");
-		if (this.modelName) assertOpenAiApiModel(this.modelName, this.getApiUrl());
-	}
-	id() {
-		return this.modelName ? `openai:agents-api:${this.modelName}` : "openai:agents-api";
-	}
-	/** Validate credentials per call, after merging prompt settings and gateway authentication. */
-	requiresApiKey() {
-		return false;
-	}
-	redact(text) {
-		return redactCredentials(text, this.credentials);
-	}
-	async request(endpoint, method, headers, signal, body, query, idempotent = method !== "POST") {
-		const maxRetries = Math.max(0, this.config.maxRetries ?? 4);
-		for (let attempt = 0;; attempt++) {
-			signal.throwIfAborted();
-			const response = await fetchWithRetries(appendOpenAiApiPath(splitUserinfo(this.getApiUrl()).url, endpoint, query), {
-				method,
-				headers,
-				signal,
-				...body === void 0 ? {} : { body: JSON.stringify(body) }
-			}, 3e4, idempotent ? this.config.maxRetries : 0);
-			logger.debug("[OpenAI Agents API] Response", {
-				method,
-				endpoint,
-				status: response.status
-			});
-			if (idempotent && TRANSIENT_STATUS_CODES.has(response.status) && attempt < maxRetries) {
-				await response.body?.cancel();
-				await sleepWithAbort(Math.min(RETRY_BASE_DELAY_MS * 2 ** attempt, RETRY_MAX_DELAY_MS), signal);
-				continue;
-			}
-			if (method === "DELETE" && response.status === 404) {
-				await response.body?.cancel();
-				return;
-			}
-			if (!response.ok) {
-				let detail = "";
-				try {
-					const parsed = JSON.parse(await readBoundedText(response, 8192));
-					const message = typeof parsed?.error === "string" ? parsed.error : parsed?.error?.message;
-					if (typeof message === "string") detail = this.redact(message).slice(0, MAX_ERROR_DETAIL_LENGTH);
-				} catch {
-					signal.throwIfAborted();
-				}
-				throw new AgentsApiHttpError(`Agents API ${method} failed: HTTP ${response.status} ${response.statusText}${detail ? `: ${detail}` : ""}`, response.status);
-			}
-			if (response.status === 204) return;
-			const text = await readBoundedText(response, MAX_RESPONSE_BODY_BYTES);
-			return text ? JSON.parse(text) : void 0;
-		}
-	}
-	async list(endpoint, headers, signal) {
-		const items = [];
-		const cursors = /* @__PURE__ */ new Set();
-		let after;
-		let bytes = 0;
-		for (let pageCount = 0; pageCount < MAX_LIST_PAGES; pageCount++) {
-			if (this.listBudget.pages === 0) throw new Error(`Agents API session pagination limit exceeded (${MAX_SESSION_LIST_PAGES} pages)`);
-			this.listBudget.pages--;
-			const query = new URLSearchParams({
-				order: "asc",
-				limit: "100"
-			});
-			if (after) query.set("after", after);
-			const page = await this.request(endpoint, "GET", headers, signal, void 0, query.toString());
-			if (!Array.isArray(page?.data)) throw new Error("Agents API returned an invalid list response");
-			const previousPeak = this.listItemPeaks.get(endpoint) ?? 0;
-			const nextPeak = Math.max(previousPeak, items.length + page.data.length);
-			const growth = nextPeak - previousPeak;
-			if (growth > this.listBudget.items) throw new Error(`Agents API session pagination limit exceeded (${MAX_LIST_ITEMS} items)`);
-			this.listBudget.items -= growth;
-			this.listItemPeaks.set(endpoint, nextPeak);
-			bytes += Buffer.byteLength(JSON.stringify(page.data));
-			const previousBytePeak = this.listBytePeaks.get(endpoint) ?? 0;
-			const byteGrowth = Math.max(previousBytePeak, bytes) - previousBytePeak;
-			if (byteGrowth > this.listBudget.bytes) throw new Error(`Agents API session pagination limit exceeded (${MAX_RESPONSE_BODY_BYTES} bytes)`);
-			this.listBudget.bytes -= byteGrowth;
-			this.listBytePeaks.set(endpoint, Math.max(previousBytePeak, bytes));
-			items.push(...page.data);
-			if (!page.has_more) return items;
-			if (!page.last_id || cursors.has(page.last_id)) throw new Error("Agents API returned an invalid pagination cursor");
-			after = page.last_id;
-			cursors.add(after);
-		}
-		throw new Error(`Agents API pagination limit exceeded (${MAX_LIST_PAGES} pages)`);
-	}
-	async listSubagentIds(endpoint, headers, signal) {
-		return (await this.list(`${endpoint}/subagents`, headers, signal)).map(({ id }) => {
-			if (typeof id !== "string" || !id) throw new Error("Agents API returned an invalid subagent");
-			return id;
-		});
-	}
-	/**
-	* In live multi-agent sessions, session totals equaled the root turn's usage while each subagent
-	* turn reported its own. The API does not say whether session totals include subagent turns, so
-	* their usage is recorded beside the totals, never added, and the totals are marked.
-	*/
-	async getSubagentUsageMetadata(endpoint, headers, signal, evalSignal) {
-		try {
-			const subagentIds = await this.listSubagentIds(endpoint, headers, signal);
-			if (!subagentIds.length) return {};
-			let sum;
-			for (const id of subagentIds) {
-				const turns = await this.list(`${endpoint}/subagents/${encodeURIComponent(id)}/turns`, headers, signal);
-				for (const turn of turns) {
-					if (!isUsage(turn.usage)) return { usageMayExcludeSubagents: true };
-					sum = sum ? addUsage(sum, turn.usage) : turn.usage;
-				}
-			}
-			return {
-				usageMayExcludeSubagents: true,
-				...isUsage(sum) ? { subagentUsage: toTokenUsage(sum) } : {}
-			};
-		} catch (error) {
-			evalSignal?.throwIfAborted();
-			logger.debug("[OpenAI Agents API] Subagent turn usage unavailable", {
-				endpoint,
-				error: this.redact(error instanceof Error ? error.message : String(error))
-			});
-			return { usageMayExcludeSubagents: true };
-		}
-	}
-	/**
-	* Session items cover only the root agent; each subagent keeps its own item history.
-	* Returns undefined when those histories cannot be read so the gap is reported, not hidden.
-	*/
-	async listSubagentItems(endpoint, headers, signal, evalSignal) {
-		try {
-			const items = [];
-			for (const id of await this.listSubagentIds(endpoint, headers, signal)) items.push(...await this.list(`${endpoint}/subagents/${encodeURIComponent(id)}/items`, headers, signal));
-			return items;
-		} catch (error) {
-			evalSignal?.throwIfAborted();
-			logger.debug("[OpenAI Agents API] Subagent tool items unavailable", {
-				endpoint,
-				error: this.redact(error instanceof Error ? error.message : String(error))
-			});
-			return;
-		}
-	}
-	/** Summarize root and subagent tool activity; messages between agents are not tool calls. */
-	async summarizeToolCalls(endpoint, sessionItems, hasSubagents, headers, signal, evalSignal) {
-		const subagentItems = hasSubagents ? await this.listSubagentItems(endpoint, headers, signal, evalSignal) : [];
-		const toolCalls = [...sessionItems, ...subagentItems ?? []].filter((item) => !MESSAGE_ITEM_TYPES.has(item.type)).map((item) => ({
-			id: item.id,
-			type: item.type,
-			name: item.name,
-			status: item.status,
-			turnId: item.turn_id
-		}));
-		return subagentItems ? { toolCalls } : {
-			toolCalls,
-			subagentToolCallsUnavailable: true
-		};
-	}
-	getFinalAnswer(items) {
-		const messages = items.filter((item) => item.type === "message" && item.role === "assistant" && item.status === "completed");
-		const finalMessages = messages.filter((item) => item.phase === "final_answer");
-		const textParts = (finalMessages.length ? finalMessages : messages.filter((item) => !item.phase)).flatMap((item) => item.content ?? []).filter((part) => part.type === "output_text" && typeof part.text === "string");
-		if (!textParts.length) throw new Error("Agents API turn completed without a final assistant answer");
-		return textParts.map((part) => part.text).join("\n");
-	}
-	async callApi(prompt, context, options) {
-		options?.abortSignal?.throwIfAborted();
-		const promptConfig = context?.prompt?.config;
-		const endpointOverride = promptConfig?.apiBaseUrl !== void 0 || promptConfig?.apiHost !== void 0;
-		const mergedConfig = {
-			...this.config,
-			...endpointOverride && { headers: void 0 },
-			...promptConfig?.apiBaseUrl !== void 0 && { apiHost: void 0 },
-			...promptConfig?.apiHost !== void 0 && { apiBaseUrl: void 0 },
-			...promptConfig?.apiKeyEnvar !== void 0 && { apiKey: void 0 },
-			...promptConfig?.apiKey !== void 0 && { apiKeyEnvar: void 0 },
-			...promptConfig
-		};
-		delete mergedConfig.provider;
-		let config = mergedConfig;
-		const removedHeaderCredentials = /* @__PURE__ */ new Set();
-		try {
-			let removedInheritedHeaders = false;
-			const vars = context?.vars;
-			if (vars) config = renderConfigTemplates(mergedConfig, vars, Object.keys(vars));
-			if (endpointOverride && this.config.headers) {
-				const replacesHeaders = promptConfig?.headers !== void 0;
-				const { hasHeaderCredential, hasCustomHeader } = scanRequestHeaders(new Headers(config.headers), /* @__PURE__ */ new Set());
-				const hasReplacementCredential = replacesHeaders && (config.apiKey || config.apiKeyEnvar || hasHeaderCredential || hasCustomHeader);
-				const safeHeaders = {};
-				for (const [name, originalValue] of Object.entries(this.config.headers)) {
-					let value = String(originalValue);
-					try {
-						if (vars) value = String(renderConfigTemplates(originalValue, vars, Object.keys(vars)));
-					} catch (error) {
-						if (!replacesHeaders && !isCredentialHeader(name, value)) throw error;
-					}
-					if (isCredentialHeader(name, value)) {
-						removedInheritedHeaders ||= !hasReplacementCredential && value.trim().length > 0;
-						addCredential(removedHeaderCredentials, value);
-						collectConfigCredentials(value, removedHeaderCredentials);
-					} else safeHeaders[name] = value;
-				}
-				if (!replacesHeaders) config.headers = safeHeaders;
-			}
-			const callProvider = new OpenAiAgentsApiProvider(this.modelOverride, {
-				config,
-				env: this.env
-			});
-			if (removedInheritedHeaders && !callProvider.sendsToOpenAiApi()) {
-				const { hasCustomHeader } = scanRequestHeaders(new Headers(callProvider.getOpenAiRequestHeaders()), /* @__PURE__ */ new Set());
-				if (!hasCustomHeader) callProvider.config.useDefaultApiKey = false;
-			}
-			collectCallCredentials(this, callProvider.inheritedCredentials);
-			for (const credential of removedHeaderCredentials) callProvider.inheritedCredentials.add(credential);
-			const spanContext = buildChatSpanContext({
-				system: "openai",
-				model: callProvider.modelName,
-				providerId: this.id(),
-				prompt,
-				context
-			});
-			return await withGenAISpan({
-				...spanContext,
-				operationName: "invoke_agent",
-				agentId: config.agent_id
-			}, () => callProvider.runSession(prompt, options), (response) => ({
-				...extractProviderResponseAttributes(response),
-				responseModel: typeof response.metadata?.model === "string" ? response.metadata.model : void 0
-			}));
-		} catch (error) {
-			options?.abortSignal?.throwIfAborted();
-			const credentials = new Set(removedHeaderCredentials);
-			collectCallCredentials(this, credentials);
-			for (const callConfig of /* @__PURE__ */ new Set([mergedConfig, config])) collectCallCredentials(new OpenAiGenericProvider("", {
-				config: callConfig,
-				env: this.env
-			}), credentials);
-			return {
-				cached: false,
-				error: redactCredentials(error instanceof Error ? error.message : String(error), sortCredentials(credentials))
-			};
-		}
-	}
-	sendsToOpenAiApi() {
-		try {
-			return new URL(this.getApiUrl()).hostname.toLowerCase() === "api.openai.com";
-		} catch {
-			return false;
-		}
-	}
-	/**
-	* A configured Authorization header takes precedence over this value. An explicit key, or any
-	* key sent to the OpenAI API, uses Bearer auth; otherwise URL userinfo uses decoded Basic auth.
-	* An ambient OPENAI_API_KEY never reaches another host that has URL credentials or any custom
-	* header outside the non-credential allowlist, because such a header may authenticate a gateway.
-	*/
-	getAuthorization(apiKey, hasGatewayCredential) {
-		const sendApiKey = Boolean(this.config.apiKey || this.config.apiKeyEnvar) || !hasGatewayCredential || this.sendsToOpenAiApi();
-		if (apiKey && sendApiKey) return `Bearer ${apiKey}`;
-		const { userinfo } = splitUserinfo(this.getApiUrl());
-		return userinfo && basicCredential(userinfo);
-	}
-	async runSession(prompt, options) {
-		options?.abortSignal?.throwIfAborted();
-		const headers = new Headers(this.getOpenAiRequestHeaders());
-		const apiKey = this.getApiKey();
-		const credentials = new Set(this.inheritedCredentials);
-		collectCallCredentials(this, credentials);
-		const hasUrlCredential = getUrlCredentials(this.getApiUrl(), false).length > 0;
-		const { hasHeaderCredential, hasCustomHeader } = scanRequestHeaders(headers, credentials);
-		this.credentials = sortCredentials(credentials);
-		if (!apiKey && !hasHeaderCredential && !hasUrlCredential && (this.config.apiKeyRequired ?? true)) return { error: this.getMissingApiKeyErrorMessage() };
-		const authorization = this.getAuthorization(apiKey, hasUrlCredential || hasCustomHeader);
-		if (authorization && !headers.has("Authorization")) headers.set("Authorization", authorization);
-		headers.set("Content-Type", "application/json");
-		headers.set("OpenAI-Beta", "agents=v1");
-		headers.set("x-promptfoo-silent", "true");
-		const timeoutMs = this.config.timeoutMs ?? 3e5;
-		const deadline = Date.now() + timeoutMs;
-		const controller = new AbortController();
-		const timer = setTimeout(() => controller.abort(), timeoutMs);
-		const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;
-		let endpoint;
-		let completed = false;
-		const result = { cached: false };
-		const metadata = {};
-		try {
-			const session = await this.request("agents/sessions", "POST", headers, signal, {
-				agent_id: this.config.agent_id,
-				agent: {
-					...this.config.agent,
-					...this.modelName ? { model: this.modelName } : {}
-				},
-				environment: this.config.environment ?? { type: "none" },
-				input: prompt,
-				metadata: this.config.metadata,
-				vault_ids: this.config.vault_ids,
-				stream: false
-			});
-			if (!session?.id || typeof session.id !== "string") throw new Error("Agents API did not return a session ID");
-			endpoint = `agents/sessions/${encodeURIComponent(session.id)}`;
-			metadata.sessionId = session.id;
-			const { session: completedSession, turn } = await this.waitForTurn(session, endpoint, headers, signal);
-			const sessionItems = await this.list(`${endpoint}/items`, headers, signal);
-			const output = this.getFinalAnswer(sessionItems.filter((item) => item.turn_id === turn.id));
-			const hasSubagents = completedSession.agent.multi_agent?.enabled || sessionItems.some((item) => item.type === "create_subagent_call");
-			const toolActivity = await this.summarizeToolCalls(endpoint, sessionItems, hasSubagents, headers, signal, options?.abortSignal);
-			const { session: finished, usage, usageMetadata } = await this.waitForFinalUsage(completedSession, turn, endpoint, headers, signal, deadline, hasSubagents, options?.abortSignal);
-			const subagentUsageMetadata = hasSubagents ? await this.getSubagentUsageMetadata(endpoint, headers, signal, options?.abortSignal) : {};
-			const model = finished.agent.model;
-			result.output = output;
-			result.tokenUsage = usage ? toTokenUsage(usage) : void 0;
-			if (!hasSubagents) result.cost = calculateOpenAIUsageCost(model, this.config, usage, {
-				apiUrl: this.getApiUrl(),
-				serviceTier: finished.agent.service_tier ?? this.config.agent?.service_tier
-			});
-			Object.assign(metadata, {
-				turnId: turn.id,
-				model,
-				costScope: hasSubagents ? "unavailable for aggregate subagent usage" : "model tokens only; excludes tools and sandbox charges",
-				...toolActivity,
-				...usageMetadata,
-				...subagentUsageMetadata
-			});
-			completed = true;
-		} catch (error) {
-			options?.abortSignal?.throwIfAborted();
-			result.error = controller.signal.aborted ? `Agents API request timed out after ${timeoutMs}ms` : this.redact(error instanceof Error ? error.message : String(error));
-		} finally {
-			clearTimeout(timer);
-			if (endpoint && (!completed || !this.config.retainSession)) await this.cleanupSession(endpoint, headers, !completed, metadata);
-		}
-		options?.abortSignal?.throwIfAborted();
-		if (Object.keys(metadata).length) result.metadata = metadata;
-		return result;
-	}
-	async waitForTurn(initialSession, endpoint, headers, signal) {
-		let session = initialSession;
-		while (true) {
-			if (session.status === "failed") {
-				const error = this.redact(session.error ?? "unknown error");
-				throw new Error(`Agents API session failed: ${error.slice(0, MAX_ERROR_DETAIL_LENGTH)}`);
-			}
-			if (session.status === "requires_action") {
-				const actions = session.required_actions?.map((action) => action.type).join(", ");
-				throw new Error(`Agents API requires client-side actions (${actions || "unknown"}). Use hosted tools or MCP servers; function callbacks and self-hosted executors are not supported.`);
-			}
-			const turn = (await this.list(`${endpoint}/turns`, headers, signal)).find((candidate) => candidate.subagent_id === null);
-			if (turn?.status === "failed" || turn?.status === "cancelled") {
-				const error = this.redact(turn.error?.message ?? turn.id);
-				throw new Error(`Agents API turn ${turn.status}: ${error.slice(0, MAX_ERROR_DETAIL_LENGTH)}`);
-			}
-			if (turn?.status === "completed") {
-				session = await this.request(endpoint, "GET", headers, signal);
-				if (session.status !== "idle") {
-					await sleepWithAbort(this.config.pollIntervalMs ?? 1e3, signal);
-					continue;
-				}
-				return {
-					session,
-					turn
-				};
-			}
-			await sleepWithAbort(this.config.pollIntervalMs ?? 1e3, signal);
-			session = await this.request(endpoint, "GET", headers, signal);
-		}
-	}
-	/**
-	* Usage is attached shortly after the root turn completes; deleting the session sooner loses it.
-	* Session totals are preferred. A single-agent run accepts root-turn usage after a short grace
-	* period, while a run with subagents waits until the usage deadline for session totals.
-	*/
-	async waitForFinalUsage(session, turn, endpoint, headers, signal, deadline, hasSubagents, evalSignal) {
-		const waitUntil = Math.min(Date.now() + (this.config.usageTimeoutMs ?? 15e3), deadline);
-		const pollIntervalMs = Math.min(this.config.pollIntervalMs ?? 1e3, 1e3);
-		const turnEndpoint = `${endpoint}/turns/${encodeURIComponent(turn.id)}`;
-		const latest = {
-			session,
-			turn
-		};
-		let turnUsageSeenAt;
-		try {
-			while (!isUsage(latest.session.usage) && Date.now() < waitUntil) {
-				if (isUsage(latest.turn.usage) && !hasSubagents) {
-					turnUsageSeenAt ??= Date.now();
-					if (Date.now() - turnUsageSeenAt >= TURN_USAGE_GRACE_MS) break;
-				}
-				await sleepWithAbort(Math.min(pollIntervalMs, waitUntil - Date.now()), signal);
-				const [nextSession, nextTurn] = await Promise.all([this.request(endpoint, "GET", headers, signal), this.request(turnEndpoint, "GET", headers, signal).catch((error) => {
-					signal.throwIfAborted();
-					logger.debug("[OpenAI Agents API] Root turn usage read failed", {
-						sessionId: session.id,
-						error: this.redact(error instanceof Error ? error.message : String(error))
-					});
-				})]);
-				latest.session = nextSession;
-				latest.turn = nextTurn ?? latest.turn;
-			}
-		} catch (error) {
-			evalSignal?.throwIfAborted();
-			logger.debug("[OpenAI Agents API] Final session usage unavailable", {
-				sessionId: session.id,
-				error: this.redact(error instanceof Error ? error.message : String(error))
-			});
-		}
-		const sessionUsage = isUsage(latest.session.usage) ? latest.session.usage : void 0;
-		const usage = sessionUsage ?? (isUsage(latest.turn.usage) ? latest.turn.usage : void 0);
-		if (!usage) return {
-			session: latest.session,
-			usageMetadata: { usageUnavailable: true }
-		};
-		return {
-			session: latest.session,
-			usage,
-			usageMetadata: hasSubagents && !sessionUsage ? { usageFromRootTurn: true } : {}
-		};
-	}
-	/** Cancel unfinished work, then delete the session once the API allows it. */
-	async cleanupSession(endpoint, headers, cancel, metadata) {
-		const cleanupTimeoutMs = this.config.cleanupTimeoutMs ?? 6e4;
-		const controller = new AbortController();
-		const timer = setTimeout(() => controller.abort(), cleanupTimeoutMs);
-		let lastError;
-		try {
-			if (cancel) try {
-				await this.request(`${endpoint}/events`, "POST", headers, controller.signal, { events: [{ type: "agent.session.input.cancel" }] }, void 0, true);
-				metadata.sessionCancelled = true;
-			} catch (error) {
-				controller.signal.throwIfAborted();
-				logger.debug("[OpenAI Agents API] Session cancellation was not accepted", {
-					sessionId: metadata.sessionId,
-					error: this.redact(error instanceof Error ? error.message : String(error))
-				});
-			}
-			for (let attempt = 0;; attempt++) try {
-				await this.request(endpoint, "DELETE", headers, controller.signal);
-				metadata.sessionDeleted = true;
-				return;
-			} catch (error) {
-				if (!controller.signal.aborted) lastError = error;
-				if (!(error instanceof AgentsApiHttpError) || error.status !== 409) throw error;
-				await sleepWithAbort(Math.min(RETRY_BASE_DELAY_MS * 2 ** attempt, CLEANUP_RETRY_MAX_DELAY_MS), controller.signal);
-			}
-		} catch (error) {
-			const reason = lastError ?? error;
-			const message = reason instanceof Error ? reason.message : String(reason);
-			const cleanupError = this.redact(controller.signal.aborted ? `Agents API session cleanup timed out after ${cleanupTimeoutMs}ms${lastError ? `: ${message}` : ""}` : message);
-			Object.assign(metadata, {
-				sessionDeleted: false,
-				cleanupError
-			});
-			logger.warn("[OpenAI Agents API] Failed to delete session", {
-				sessionId: metadata.sessionId,
-				error: cleanupError
-			});
-		} finally {
-			clearTimeout(timer);
-		}
-	}
-};
-//#endregion
-export { OpenAiAgentsApiProvider };
-
-//# sourceMappingURL=agents-api-IWHEwp8i.js.map