Add provider audit envelopes and user-input audit metadata

[Savid]

Summary

Major feature additions, protocol fixes, and schema enforcement across the SDK.

Provider Audit Envelopes

• Add AuditEnvelope type (event_type, subtype, payload) attached to all message types (UserMessage, AssistantMessage, SystemMessage, ResultMessage, StreamEvent, TaskStartedMessage, TaskCompleteMessage, ThreadRolledBackMessage)
• Preserve raw JSON bytes in audit envelopes for wire-fidelity via AnnotateRawJSON / extractRawJSON helpers (internal/message/raw_json.go)
• Add public NewAuditEnvelope(eventType, subtype, payload) constructor for cross-SDK consistency
• Propagate audit metadata through requestUserInput parsing and response serialization
• Propagate audit metadata through MCP elicitation request parsing

MCP Elicitation Callback

• Add WithOnElicitation option and typed elicitation.Request / elicitation.Response types (internal/elicitation/elicitation.go)
• Support form and url elicitation modes with optional fields (ElicitationID, URL, RequestedSchema, TurnID)
• Register mcpServer_elicitation/request handler in session; auto-declines when no callback is set
• Full test coverage: callback invocation, URL mode, nil response handling, audit attachment

Permissions Approval Wire Format Fix

• Fix HandlePermissionsApproval response format from {"decision": "accept"} to {"permissions": {...}, "scope": "turn"} matching current Codex app-server protocol
• Register item_permissions/requestApproval handler (previously unregistered)
• Deny returns empty permissions map instead of "decline" string

Reasoning / Thinking Delta Support

• Distinguish reasoning deltas as thinking_delta (not text_delta) in StreamEvent during partial message streaming
• Accumulate reasoning text into ThinkingBlock content blocks on completed AssistantMessage
• Rewrite reasoning summary tracking in appserver_adapter.go to map Codex reasoning items into SDK thinking types
• Update extended_thinking and include_partial_messages examples to handle thinking_delta events
• Add integration test TestPartialMessages_ThinkingDeltaDistinguished

ResultMessage Enrichment

• Add stop_reason, duration_ms, num_turns, and total_cost_usd fields to ResultMessage
• Parse these fields from both Claude-style result and Codex-style response.completed events

WithMaxTurns Option

• Add WithMaxTurns(n) option to limit conversation turns
• Wire through exec backend (--max-turns CLI flag) and app-server backend (maxTurns init payload)
• Add capability mapping (supported on both backends)

MultiSelect Support for User Input

• Parse multiSelect / multi_select field on user input questions
• Add MultiSelect field to userinput.Question type

Schema Enforcement (Structured Output)

• Add internal/schema/enforce.go with EnforceStrictMode and EnforceAdditionalProperties
• Recursively set additionalProperties: false and ensure required lists all property keys on every object node (OpenAI strict structured-output compliance)
• Handle nested properties, $defs, anyOf, and array items
• Apply enforcement in extractOutputSchema during session initialization

Fixes & Maintenance

• Fix .gitignore: scope extended_thinking to root-only match (/extended_thinking)
• Increase integration test timeout from 240s to 600s
• Fix data race in budget_stderr_test.go stderr callback with mutex
• Fix test_examples.sh to handle examples with their own go.mod (nested modules)
• Remove stale negative proof test TestSessionRegisterHandlers_DoesNotRegisterRequestTypesMissingFromCurrentCodexSchema
• Add mcpServer/elicitation/request and item/permissions/requestApproval to positive handler coverage test

Files Changed (30 files, +1867 / -120)

Area	Files
Public API	options.go, types.go, sessions.go
Message parsing	internal/message/message.go, internal/message/parse.go, internal/message/raw_json.go, internal/message/parse_test.go
Elicitation	internal/elicitation/elicitation.go
Protocol	internal/protocol/session.go, internal/protocol/session_test.go, internal/protocol/session_integration_test.go
Schema	internal/schema/enforce.go, internal/schema/enforce_test.go
Config	internal/config/options.go, internal/config/capability.go
CLI	internal/cli/command.go, internal/cli/cli_test.go
User Input	internal/userinput/userinput.go
Subprocess	internal/subprocess/appserver.go, internal/subprocess/appserver_adapter.go, internal/subprocess/appserver_adapter_test.go, internal/subprocess/cli.go, internal/subprocess/jsonrpc.go
Examples	examples/extended_thinking/main.go, examples/include_partial_messages/main.go
Integration	integration/budget_stderr_test.go, integration/streaming_test.go
Build	Makefile, .gitignore, scripts/test_examples.sh

Test plan

• go test ./... passes
• go test -race ./... passes
• Audit envelope tests verify attachment on all message types
• Raw wire data preservation test confirms unknown fields survive in payload
• Public NewAuditEnvelope constructor round-trip and marshal error tests
• ResultMessage direct fields parsed from both result and response.completed events
• WithMaxTurns CLI flag and init payload tests
• MultiSelect question parsing test
• MCP elicitation callback, URL mode, nil response, and audit tests
• Permissions approval wire format tests (no-callback, with-callback, allowed-write-policy)
• Schema EnforceStrictMode / EnforceAdditionalProperties unit tests (nested, $defs, anyOf, items)
• Thinking delta appserver adapter unit tests
• Integration test for thinking_delta stream events
• Stderr callback race fix with mutex

🤖 Generated with Claude Code