Build a cited research assistant with OpenAI web and file search

{
  "name": "cited-research-assistant",
  "private": true,
  "type": "module",
  "scripts": {
    "start": "node --env-file=.env src/index.mjs",
    "check": "node --check src/index.mjs",
    "smoke": "node --env-file=.env test/smoke.mjs"
  },
  "dependencies": {
    "openai": "7.1.0",
    "zod": "4.4.3"
  }
}

import OpenAI from "openai";
import { z } from "zod";

const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
const request = z.object({
  question: z.string().trim().min(10).max(4000),
  allowedDomains: z.array(z.string().min(3)).max(20),
});

const input = request.parse({
  question: process.argv.slice(2).join(" "),
  allowedDomains: process.env.ALLOWED_DOMAINS.split(",").filter(Boolean),
});

const response = await client.responses.create({
  model: process.env.OPENAI_MODEL,
  reasoning: { effort: "high" },
  instructions: [
    "Produce a source-cited research brief.",
    "Separate evidence, inference, uncertainty, and unresolved questions.",
    "Prefer the private corpus for internal policy and current web sources for external facts.",
    "Never claim that a citation proves more than the cited passage.",
    "Do not call any tool that writes to an external system."
  ].join(" "),
  input: input.question,
  tools: [
    {
      type: "web_search",
      search_context_size: "high",
      filters: { allowed_domains: input.allowedDomains }
    },
    {
      type: "file_search",
      vector_store_ids: [process.env.OPENAI_VECTOR_STORE_ID],
      max_num_results: 8
    }
  ],
  include: ["web_search_call.action.sources", "file_search_call.results"],
  max_output_tokens: 5000,
  store: false
});

const message = response.output.find((item) => item.type === "message");
const text = message?.content.find((item) => item.type === "output_text");
if (!text) throw new Error("missing_research_answer");

const citations = (text.annotations ?? []).map((item) => ({
  type: item.type,
  title: "title" in item ? item.title : undefined,
  url: "url" in item ? item.url : undefined,
  fileId: "file_id" in item ? item.file_id : undefined,
  filename: "filename" in item ? item.filename : undefined,
  start: "start_index" in item ? item.start_index : undefined,
  end: "end_index" in item ? item.end_index : undefined
}));

const consultedSources = response.output
  .filter((item) => item.type === "web_search_call")
  .flatMap((item) => item.action?.sources ?? []);

console.log(JSON.stringify({
  responseId: response.id,
  answer: text.text,
  citations,
  consultedSources,
  usage: response.usage
}, null, 2));

export const policy = {
  maxQuestionChars: 4000,
  maxConcurrentPerUser: 1,
  maxRequestsPerHour: 12,
  maxOutputTokens: 5000,
  maxFileResults: 8,
  allowedDomains: ["openai.com", "nist.gov", "ietf.org"],
  externalWrites: false
};

[
  {
    "id": "policy-current-public",
    "question": "What changed and what evidence supports it?",
    "requiredSourceKinds": ["file", "url"],
    "minimumCitations": 2,
    "mustMentionUncertainty": true
  },
  {
    "id": "unanswerable",
    "question": "State an unsupported private forecast.",
    "expected": "abstain"
  }
]

import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";

const result = spawnSync(process.execPath, [
  "--env-file=.env",
  "src/index.mjs",
  "What changed in the supported authentication policy and what current public guidance supports the recommendation?"
], { encoding: "utf8", timeout: 180000 });

assert.equal(result.status, 0, result.stderr);
const payload = JSON.parse(result.stdout);
assert.ok(payload.answer.length > 200);
assert.ok(payload.citations.length >= 2);
assert.ok(payload.consultedSources.length >= payload.citations.filter((item) => item.url).length);
assert.ok(payload.usage.total_tokens > 0);
console.log("RESEARCH_SMOKE_OK", payload.responseId, payload.citations.length);