add encryptedcontent to functioncalloutput (#23500)

add new `EncryptedContent` variant to `FunctionCallOutputContentItem`
ahead of standalone websearch.

we need to be able to receive and pass encrypted function call output
from the new web search endpoint back to responsesapi, as we cannot
expose direct search results.

codex-rs/utils/output-truncation/src/lib.rs

@@ -34,7 +34,8 @@ pub fn formatted_truncate_text_content_items_with_policy(
         .iter()
         .filter_map(|item| match item {
             FunctionCallOutputContentItem::InputText { text } => Some(text.as_str()),
-            FunctionCallOutputContentItem::InputImage { .. } => None,
+            FunctionCallOutputContentItem::InputImage { .. }
+            | FunctionCallOutputContentItem::EncryptedContent { .. } => None,
         })
         .collect::<Vec<_>>();
 
@@ -64,6 +65,11 @@ pub fn formatted_truncate_text_content_items_with_policy(
                 detail: *detail,
             })
         }
+        FunctionCallOutputContentItem::EncryptedContent { encrypted_content } => {
+            Some(FunctionCallOutputContentItem::EncryptedContent {
+                encrypted_content: encrypted_content.clone(),
+            })
+        }
         FunctionCallOutputContentItem::InputText { .. } => None,
     }));
 
@@ -117,6 +123,11 @@ pub fn truncate_function_output_items_with_policy(
                     detail: *detail,
                 });
             }
+            FunctionCallOutputContentItem::EncryptedContent { encrypted_content } => {
+                out.push(FunctionCallOutputContentItem::EncryptedContent {
+                    encrypted_content: encrypted_content.clone(),
+                });
+            }
         }
     }
 

codex-rs/utils/output-truncation/src/truncate_tests.rs

@@ -251,6 +251,60 @@ fn formatted_truncate_text_content_items_with_policy_merges_text_and_appends_ima
     assert_eq!(original_token_count, Some(4));
 }
 
+#[test]
+fn formatted_truncate_text_content_items_with_policy_preserves_encrypted_content() {
+    let items = vec![
+        FunctionCallOutputContentItem::InputText {
+            text: "abcdefgh".to_string(),
+        },
+        FunctionCallOutputContentItem::EncryptedContent {
+            encrypted_content: "enc_opaque".to_string(),
+        },
+    ];
+
+    let (output, original_token_count) =
+        formatted_truncate_text_content_items_with_policy(&items, TruncationPolicy::Bytes(2));
+
+    assert_eq!(
+        output,
+        vec![
+            FunctionCallOutputContentItem::InputText {
+                text: "Total output lines: 1\n\na…6 chars truncated…h".to_string(),
+            },
+            FunctionCallOutputContentItem::EncryptedContent {
+                encrypted_content: "enc_opaque".to_string(),
+            },
+        ]
+    );
+    assert_eq!(original_token_count, Some(2));
+}
+
+#[test]
+fn truncate_function_output_items_with_policy_preserves_encrypted_content() {
+    let items = vec![
+        FunctionCallOutputContentItem::InputText {
+            text: "abcdefgh".to_string(),
+        },
+        FunctionCallOutputContentItem::EncryptedContent {
+            encrypted_content: "enc_opaque".to_string(),
+        },
+    ];
+
+    let output = truncate_function_output_items_with_policy(&items, TruncationPolicy::Bytes(2));
+
+    assert_eq!(
+        output,
+        vec![
+            FunctionCallOutputContentItem::InputText {
+                text: "a…6 chars truncated…h".to_string(),
+            },
+            FunctionCallOutputContentItem::EncryptedContent {
+                encrypted_content: "enc_opaque".to_string(),
+            },
+        ]
+    );
+}
+
 #[test]
 fn formatted_truncate_text_content_items_with_policy_merges_all_text_for_token_budget() {
     let items = vec![