📦 fix: Surface Code API Artifact Truncation

[lia-by-librechat]

Summary

Surface Code API artifact truncation for every execution path so agents and hosts can tell when generated files were omitted from delivery (fixes #556).

• Validate the optional artifact_truncation response with bounded paths and known reasons. Require safe integer counts and reason totals equal to the positive omission count; discard malformed or contradictory markers.
• Warn about omitted files before the generated-file summary, including when no files arrived. Advise against automatically rerunning code that may have had side effects.
• Carry the normalized marker in the artifact for execute_code, direct Bash, and both plain and tool-backed Bash/Python programmatic execution.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• Nine focused suites: 481 tests passed, including reason-total consistency, numeric boundaries, all execution formatters, metadata isolation, and local/Cloudflare compatibility.
• tsc --noEmit, touched-file ESLint, import-order check, and npm run build passed.
• Live Code API reproduction was not run; HTTP responses were exercised through regression tests.

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T03:50:27.645733Z	147386f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d83897d4e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lia-by-librechat]

Review handoff for head 94db63972b6ec4ab7937944fd64f01437c141f78: Codex’s truncation finding is addressed across direct Bash and plain/tool-backed Bash/Python execution. Seven focused suites passed (264 tests); typecheck, touched-file lint, import order, and package build passed. Live Code API reproduction was not run.

[danny-avila]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 94db63972b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lia-by-librechat]

Review handoff for head a05906bf5a56758c18d39804b9375413efefe182: the new Codex count-consistency finding is fixed in the shared artifact-truncation validator. Seven focused suites pass (268 tests); typecheck, touched-file lint, import order, and build pass. CI for this head is running. Live Code API reproduction was not run.

[danny-avila]

@codex review the latest head

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a05906bf5a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lia-by-librechat]

Review handoff for head 147386f8c1389a5db10e8d4495c2b3c86bd0fcb9.

The reason-total finding is fixed. The validator now requires safe integer counts, a positive omission total, and reason counts summing to that total. Empty/all-zero reason maps and contradictory totals are discarded.

Subsystem invariant review

• Producer: at indexed Code API commit cf0e6683ccad320c7467a10d55cf7090a1bbfb88, each recorded omission increments one reason and the total synchronously. Scanning resets the marker per execution, and the response awaits scanning. Capped path lists remain valid.
• Readers: direct Code/Bash and plain/tool-backed Bash/Python normalize before emitting warnings and host artifacts. Local/Cloudflare callers omit the optional marker and retain their existing output.
• Isolation/persistence: normalization copies the mutable fields. Tests cover independent responses and preservation of delivery warnings, files, deletion echoes, runtime identity, stdout, and stderr.
• Failure/retry/auth: this synchronous response-only change does not alter authorization, workspace bindings, retries, cancellation, or cleanup. Existing error branches still throw; no automatic rerun is introduced.
• Compatibility: absent markers preserve old-server behavior; malformed/unknown-reason markers are omitted. No persisted schema or migration changes.

Verification

Nine focused suites passed: 481 tests. Suites: ArtifactTruncation, ArtifactDelivery, CodeApiAuthHeaders, ProgrammaticToolCalling, ProgrammaticPlainExecution, BashExecutor, CodeExecutor.stateful, LocalExecutionTools, CloudflareSandboxExecution.

Typecheck (npx --no-install tsc --noEmit), touched-file ESLint with zero warnings, import order, whitespace checks, and package build passed. Regression tests failed before the fix across the validator and three formatter paths.

Not run: live Code API reproduction, full local test suite, or transitive codegraph selection closure. Graph evidence used agents head a05906bf; source inspection supplemented missing alias edges.

CI passed all 13 checks on this head. All three reported review threads are resolved. A maintainer-triggered Codex review is still needed for this exact SHA; prior reviews do not cover it.

[danny-avila]

@codex review the latest head

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 147386f8c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".