### Title ## otel Codex can emit [OpenTelemetry](https://opentelemetry.io/) **log events** that describe each run: outbound API requests, streamed responses, user input, tool-approval decisions, and the result of every tool invocation. Export is **disabled by default** so local runs remain self-contained. Opt in by adding an `[otel]` table and choosing an exporter. ```toml [otel] environment = "staging" # defaults to "dev" exporter = "none" # defaults to "none"; set to otlp-http or otlp-grpc to send events log_user_prompt = false # defaults to false; redact prompt text unless explicitly enabled ``` Codex tags every exported event with `service.name = "codex-cli"`, the CLI version, and an `env` attribute so downstream collectors can distinguish dev/staging/prod traffic. Only telemetry produced inside the `codex_otel` crate—the events listed below—is forwarded to the exporter. ### Event catalog Every event shares a common set of metadata fields: `event.timestamp`, `conversation.id`, `app.version`, `auth_mode` (when available), `user.account_id` (when available), `terminal.type`, `model`, and `slug`. With OTEL enabled Codex emits the following event types (in addition to the metadata above): - `codex.api_request` - `cf_ray` (optional) - `attempt` - `duration_ms` - `http.response.status_code` (optional) - `error.message` (failures) - `codex.sse_event` - `event.kind` - `duration_ms` - `error.message` (failures) - `input_token_count` (completion only) - `output_token_count` (completion only) - `cached_token_count` (completion only, optional) - `reasoning_token_count` (completion only, optional) - `tool_token_count` (completion only) - `codex.user_prompt` - `prompt_length` - `prompt` (redacted unless `log_user_prompt = true`) - `codex.tool_decision` - `tool_name` - `call_id` - `decision` (`approved`, `approved_for_session`, `denied`, or `abort`) - `source` (`config` or `user`) - `codex.tool_result` - `tool_name` - `call_id` - `arguments` - `duration_ms` (execution time for the tool) - `success` (`"true"` or `"false"`) - `output` ### Choosing an exporter Set `otel.exporter` to control where events go: - `none` – leaves instrumentation active but skips exporting. This is the default. - `otlp-http` – posts OTLP log records to an OTLP/HTTP collector. Specify the endpoint, protocol, and headers your collector expects: ```toml [otel] exporter = { otlp-http = { endpoint = "https://otel.example.com/v1/logs", protocol = "binary", headers = { "x-otlp-api-key" = "${OTLP_TOKEN}" } }} ``` - `otlp-grpc` – streams OTLP log records over gRPC. Provide the endpoint and any metadata headers: ```toml [otel] exporter = { otlp-grpc = { endpoint = "https://otel.example.com:4317", headers = { "x-otlp-meta" = "abc123" } }} ``` If the exporter is `none` nothing is written anywhere; otherwise you must run or point to your own collector. All exporters run on a background batch worker that is flushed on shutdown. If you build Codex from source the OTEL crate is still behind an `otel` feature flag; the official prebuilt binaries ship with the feature enabled. When the feature is disabled the telemetry hooks become no-ops so the CLI continues to function without the extra dependencies. --------- Co-authored-by: Anton Panasenko <apanasenko@openai.com>
361 lines
10 KiB
Rust
361 lines
10 KiB
Rust
use std::sync::Arc;
|
|
|
|
use codex_core::ContentItem;
|
|
use codex_core::LocalShellAction;
|
|
use codex_core::LocalShellExecAction;
|
|
use codex_core::LocalShellStatus;
|
|
use codex_core::ModelClient;
|
|
use codex_core::ModelProviderInfo;
|
|
use codex_core::Prompt;
|
|
use codex_core::ReasoningItemContent;
|
|
use codex_core::ResponseItem;
|
|
use codex_core::WireApi;
|
|
use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
|
|
use codex_otel::otel_event_manager::OtelEventManager;
|
|
use codex_protocol::mcp_protocol::AuthMode;
|
|
use codex_protocol::mcp_protocol::ConversationId;
|
|
use core_test_support::load_default_config_for_test;
|
|
use futures::StreamExt;
|
|
use serde_json::Value;
|
|
use tempfile::TempDir;
|
|
use wiremock::Mock;
|
|
use wiremock::MockServer;
|
|
use wiremock::ResponseTemplate;
|
|
use wiremock::matchers::method;
|
|
use wiremock::matchers::path;
|
|
|
|
fn network_disabled() -> bool {
|
|
std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok()
|
|
}
|
|
|
|
async fn run_request(input: Vec<ResponseItem>) -> Value {
|
|
let server = MockServer::start().await;
|
|
|
|
let template = ResponseTemplate::new(200)
|
|
.insert_header("content-type", "text/event-stream")
|
|
.set_body_raw(
|
|
"data: {\"choices\":[{\"delta\":{}}]}\n\ndata: [DONE]\n\n",
|
|
"text/event-stream",
|
|
);
|
|
|
|
Mock::given(method("POST"))
|
|
.and(path("/v1/chat/completions"))
|
|
.respond_with(template)
|
|
.expect(1)
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let provider = ModelProviderInfo {
|
|
name: "mock".into(),
|
|
base_url: Some(format!("{}/v1", server.uri())),
|
|
env_key: None,
|
|
env_key_instructions: None,
|
|
wire_api: WireApi::Chat,
|
|
query_params: None,
|
|
http_headers: None,
|
|
env_http_headers: None,
|
|
request_max_retries: Some(0),
|
|
stream_max_retries: Some(0),
|
|
stream_idle_timeout_ms: Some(5_000),
|
|
requires_openai_auth: false,
|
|
};
|
|
|
|
let codex_home = match TempDir::new() {
|
|
Ok(dir) => dir,
|
|
Err(e) => panic!("failed to create TempDir: {e}"),
|
|
};
|
|
let mut config = load_default_config_for_test(&codex_home);
|
|
config.model_provider_id = provider.name.clone();
|
|
config.model_provider = provider.clone();
|
|
config.show_raw_agent_reasoning = true;
|
|
let effort = config.model_reasoning_effort;
|
|
let summary = config.model_reasoning_summary;
|
|
let config = Arc::new(config);
|
|
|
|
let conversation_id = ConversationId::new();
|
|
|
|
let otel_event_manager = OtelEventManager::new(
|
|
conversation_id,
|
|
config.model.as_str(),
|
|
config.model_family.slug.as_str(),
|
|
None,
|
|
Some(AuthMode::ChatGPT),
|
|
false,
|
|
"test".to_string(),
|
|
);
|
|
|
|
let client = ModelClient::new(
|
|
Arc::clone(&config),
|
|
None,
|
|
otel_event_manager,
|
|
provider,
|
|
effort,
|
|
summary,
|
|
conversation_id,
|
|
);
|
|
|
|
let mut prompt = Prompt::default();
|
|
prompt.input = input;
|
|
|
|
let mut stream = match client.stream(&prompt).await {
|
|
Ok(s) => s,
|
|
Err(e) => panic!("stream chat failed: {e}"),
|
|
};
|
|
while let Some(event) = stream.next().await {
|
|
if let Err(e) = event {
|
|
panic!("stream event error: {e}");
|
|
}
|
|
}
|
|
|
|
let requests = match server.received_requests().await {
|
|
Some(reqs) => reqs,
|
|
None => panic!("request not made"),
|
|
};
|
|
match requests[0].body_json() {
|
|
Ok(v) => v,
|
|
Err(e) => panic!("invalid json body: {e}"),
|
|
}
|
|
}
|
|
|
|
fn user_message(text: &str) -> ResponseItem {
|
|
ResponseItem::Message {
|
|
id: None,
|
|
role: "user".to_string(),
|
|
content: vec![ContentItem::InputText {
|
|
text: text.to_string(),
|
|
}],
|
|
}
|
|
}
|
|
|
|
fn assistant_message(text: &str) -> ResponseItem {
|
|
ResponseItem::Message {
|
|
id: None,
|
|
role: "assistant".to_string(),
|
|
content: vec![ContentItem::OutputText {
|
|
text: text.to_string(),
|
|
}],
|
|
}
|
|
}
|
|
|
|
fn reasoning_item(text: &str) -> ResponseItem {
|
|
ResponseItem::Reasoning {
|
|
id: String::new(),
|
|
summary: Vec::new(),
|
|
content: Some(vec![ReasoningItemContent::ReasoningText {
|
|
text: text.to_string(),
|
|
}]),
|
|
encrypted_content: None,
|
|
}
|
|
}
|
|
|
|
fn function_call() -> ResponseItem {
|
|
ResponseItem::FunctionCall {
|
|
id: None,
|
|
name: "f".to_string(),
|
|
arguments: "{}".to_string(),
|
|
call_id: "c1".to_string(),
|
|
}
|
|
}
|
|
|
|
fn local_shell_call() -> ResponseItem {
|
|
ResponseItem::LocalShellCall {
|
|
id: Some("id1".to_string()),
|
|
call_id: None,
|
|
status: LocalShellStatus::InProgress,
|
|
action: LocalShellAction::Exec(LocalShellExecAction {
|
|
command: vec!["echo".to_string()],
|
|
timeout_ms: Some(1_000),
|
|
working_directory: None,
|
|
env: None,
|
|
user: None,
|
|
}),
|
|
}
|
|
}
|
|
|
|
fn messages_from(body: &Value) -> Vec<Value> {
|
|
match body["messages"].as_array() {
|
|
Some(arr) => arr.clone(),
|
|
None => panic!("messages array missing"),
|
|
}
|
|
}
|
|
|
|
fn first_assistant(messages: &[Value]) -> &Value {
|
|
match messages.iter().find(|msg| msg["role"] == "assistant") {
|
|
Some(v) => v,
|
|
None => panic!("assistant message not present"),
|
|
}
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn omits_reasoning_when_none_present() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![user_message("u1"), assistant_message("a1")]).await;
|
|
let messages = messages_from(&body);
|
|
let assistant = first_assistant(&messages);
|
|
|
|
assert_eq!(assistant["content"], Value::String("a1".into()));
|
|
assert!(assistant.get("reasoning").is_none());
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn attaches_reasoning_to_previous_assistant() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![
|
|
user_message("u1"),
|
|
assistant_message("a1"),
|
|
reasoning_item("rA"),
|
|
])
|
|
.await;
|
|
let messages = messages_from(&body);
|
|
let assistant = first_assistant(&messages);
|
|
|
|
assert_eq!(assistant["content"], Value::String("a1".into()));
|
|
assert_eq!(assistant["reasoning"], Value::String("rA".into()));
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn attaches_reasoning_to_function_call_anchor() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![
|
|
user_message("u1"),
|
|
reasoning_item("rFunc"),
|
|
function_call(),
|
|
])
|
|
.await;
|
|
let messages = messages_from(&body);
|
|
let assistant = first_assistant(&messages);
|
|
|
|
assert_eq!(assistant["reasoning"], Value::String("rFunc".into()));
|
|
let tool_calls = match assistant["tool_calls"].as_array() {
|
|
Some(arr) => arr,
|
|
None => panic!("tool call list missing"),
|
|
};
|
|
assert_eq!(tool_calls.len(), 1);
|
|
assert_eq!(tool_calls[0]["type"], Value::String("function".into()));
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn attaches_reasoning_to_local_shell_call() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![
|
|
user_message("u1"),
|
|
reasoning_item("rShell"),
|
|
local_shell_call(),
|
|
])
|
|
.await;
|
|
let messages = messages_from(&body);
|
|
let assistant = first_assistant(&messages);
|
|
|
|
assert_eq!(assistant["reasoning"], Value::String("rShell".into()));
|
|
assert_eq!(
|
|
assistant["tool_calls"][0]["type"],
|
|
Value::String("local_shell_call".into())
|
|
);
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn drops_reasoning_when_last_role_is_user() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![
|
|
assistant_message("aPrev"),
|
|
reasoning_item("rHist"),
|
|
user_message("uNew"),
|
|
])
|
|
.await;
|
|
let messages = messages_from(&body);
|
|
assert!(messages.iter().all(|msg| msg.get("reasoning").is_none()));
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn ignores_reasoning_before_last_user() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![
|
|
user_message("u1"),
|
|
assistant_message("a1"),
|
|
user_message("u2"),
|
|
reasoning_item("rAfterU1"),
|
|
])
|
|
.await;
|
|
let messages = messages_from(&body);
|
|
assert!(messages.iter().all(|msg| msg.get("reasoning").is_none()));
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn skips_empty_reasoning_segments() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![
|
|
user_message("u1"),
|
|
assistant_message("a1"),
|
|
reasoning_item(""),
|
|
reasoning_item(" "),
|
|
])
|
|
.await;
|
|
let messages = messages_from(&body);
|
|
let assistant = first_assistant(&messages);
|
|
assert!(assistant.get("reasoning").is_none());
|
|
}
|
|
|
|
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
|
async fn suppresses_duplicate_assistant_messages() {
|
|
if network_disabled() {
|
|
println!(
|
|
"Skipping test because it cannot execute when network is disabled in a Codex sandbox."
|
|
);
|
|
return;
|
|
}
|
|
|
|
let body = run_request(vec![assistant_message("dup"), assistant_message("dup")]).await;
|
|
let messages = messages_from(&body);
|
|
let assistant_messages: Vec<_> = messages
|
|
.iter()
|
|
.filter(|msg| msg["role"] == "assistant")
|
|
.collect();
|
|
assert_eq!(assistant_messages.len(), 1);
|
|
assert_eq!(
|
|
assistant_messages[0]["content"],
|
|
Value::String("dup".into())
|
|
);
|
|
}
|