@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/engines/codex.js

@@ -1,862 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CodexEngine = void 0;
-exports.registerNewFilesWithTracker = registerNewFilesWithTracker;
-const fs_1 = require("fs");
-const path = __importStar(require("path"));
-const mcp_1 = require("../mcp");
-const interfaces_1 = require("../runtime/interfaces");
-const base_1 = require("./base");
-const utils_1 = require("../utils");
-const permissions_1 = require("../permissions");
-const session_1 = require("../session");
-const agentpack_1 = require("../agentpack");
-const credential_context_1 = require("../cli/credential-context");
-const runtime_1 = require("../cli/runtime");
-const types_1 = require("../sandbox/types");
-// Note: HTTP edit server removed - file changes are now handled directly via file_change events
-// -----------------------------------------------------------------------------
-// Constants
-// -----------------------------------------------------------------------------
-const AGENTIDE_CODEX_PROVIDER_ID = 'agentide-litellm';
-const AGENTIDE_CODEX_CUSTOM_PROVIDER_ID = 'agentide-custom';
-// Analytics metadata env vars for session/user/project (used by x-litellm-metadata-* and Langfuse passthrough headers)
-const AGENTIDE_CODEX_SESSION_ENV_VAR = 'AGENTIDE_ANALYTICS_SESSION_ID';
-const AGENTIDE_CODEX_USER_ENV_VAR = 'AGENTIDE_ANALYTICS_USER_ID';
-const AGENTIDE_CODEX_PROJECT_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_PROJECT_ID';
-// Analytics metadata env vars for enriched OTEL traces (see PLAN/analytics-design.md)
-const AGENTIDE_CODEX_AGENT_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_AGENT_ID';
-const AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_AGENT_VERSION';
-const AGENTIDE_CODEX_SOURCE_ENV_VAR = 'AGENTIDE_ANALYTICS_SOURCE';
-const AGENTIDE_CODEX_ENGINE_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE';
-const AGENTIDE_CODEX_REQUEST_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_REQUEST_ID';
-const AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_POLICY_VERSION';
-const AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR = 'AGENTIDE_ANALYTICS_PACK_DIGEST';
-const AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE_VERSION';
-const AGENTIDE_CODEX_TIER_ENV_VAR = 'AGENTIDE_ANALYTICS_TIER';
-const AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_INSTANCE_ID';
-// Bump when we change generated config semantics so long-lived sessions regenerate config.toml.
-const AGENTIDE_CODEX_CONFIG_VERSION = 21; // v21: sandbox_mode "danger-full-access" now requires tier 2, not merely being inside a sandbox — a tier-0 home written by v20 must be rewritten
-// Per-process runtime context for agents (not analytics): lets the agent locate its per-session context export.
-const AGENTIDE_CONTEXT_EXPORT_PATH_ENV_VAR = 'AGENTIDE_CONTEXT_EXPORT_PATH';
-const AGENTIDE_TERMINAL_LOG_PATH_ENV_VAR = 'AGENTIDE_TERMINAL_LOG_PATH';
-/**
- * Hand files codex just CREATED to the edit tracker so the IDE can render them against an empty
- * original — without ever risking the agent's work.
- *
- * The IDE trick is read → delete → `applyEdit`. That delete caused live data loss: headless
- * (`serve`/`ask`/`chat` and every sandbox) gets `NoOpEditTracker`, whose `applyEdit` does nothing, so
- * every new file codex created was silently destroyed. The command exited 0, the file was there
- * during the command, and it was gone by the next one — while standalone `codex exec` wrote it
- * fine. Two guards now: skip trackers that do not write back, and restore the file if it is
- * missing when we are done, whatever the tracker did or threw.
- *
- * Exported so the invariant "a file the agent created still exists after the turn" is testable.
- */
-async function registerNewFilesWithTracker(files, editTracker, sessionId) {
-    // A tracker that does not write the file back must never see a delete.
-    if (editTracker.appliesEdits === false) {
-        return;
-    }
-    for (const f of files) {
-        try {
-            if ((0, utils_1.isBinaryFile)(f)) {
-                continue; // Binary would be corrupted by the UTF-8 read/write round trip.
-            }
-            if (!(await (0, utils_1.pathExists)(f))) {
-                continue;
-            }
-            const code = await fs_1.promises.readFile(f, 'utf-8');
-            try {
-                await fs_1.promises.unlink(f);
-                await editTracker.applyEdit(sessionId, f, code, true);
-            }
-            finally {
-                if (!(await (0, utils_1.pathExists)(f))) {
-                    await fs_1.promises.writeFile(f, code, 'utf-8');
-                }
-            }
-        }
-        catch { /* ignore — never fail a turn over edit-diff bookkeeping */ }
-    }
-}
-function isCodexItemEvent(event) {
-    return event.type === 'item.started' || event.type === 'item.updated' || event.type === 'item.completed';
-}
-// -----------------------------------------------------------------------------
-// Codex Engine
-// -----------------------------------------------------------------------------
-class CodexEngine {
-    config;
-    getSkillsSignature;
-    getBundledBasePromptsDir;
-    id = 'codex';
-    displayName = 'Codex';
-    lastWrittenConfigSignature;
-    lastCodexSkillsSignatureByWorkspaceRoot = new Map();
-    constructor(config, getSkillsSignature, getBundledBasePromptsDir) {
-        this.config = config;
-        this.getSkillsSignature = getSkillsSignature;
-        this.getBundledBasePromptsDir = getBundledBasePromptsDir;
-    }
-    async stream(message, options, emitter, runtime, signal) {
-        // Use logger from runtime context
-        const logger = runtime.logger;
-        // Edit tracker from runtime context (optional)
-        const editTracker = runtime.editTracker;
-        const { Codex } = await import('@openai/codex-sdk');
-        if (!options.modelId) {
-            throw new Error('Codex modelId not provided for streaming request');
-        }
-        // IMPORTANT: Do NOT strip the `litellm/` prefix. In LiteLLM deployments, the model identifier
-        // is often an alias that must match exactly (e.g. `litellm/gpt-4o-mini`).
-        const threadModelId = options.modelId;
-        // Resolve API routing (LiteLLM proxy vs direct OpenAI)
-        // Use openaiBaseUrl which has overrideOpenAIBaseUrl applied
-        // codex routes to OpenAI when direct (or the LiteLLM proxy when configured) — never Anthropic.
-        const routing = (0, utils_1.resolveApiRouting)(options, this.config, 'openai');
-        const apiKey = routing.apiKey;
-        const baseUrl = routing.openaiBaseUrl; // Use OpenAI-specific URL
-        const useLiteLLM = routing.useLiteLLM;
-        const sessionId = options.sessionId;
-        const analyticsUserId = options.analyticsUserId;
-        const analyticsProjectId = (0, base_1.resolveAnalyticsProjectId)(options.analyticsProjectId, options.workspaceRoot);
-        // Detect if this is a custom endpoint (not direct OpenAI API).
-        // The default OpenAI endpoint is https://api.openai.com/v1 - don't treat as custom for that.
-        const DEFAULT_OPENAI_ENDPOINT = 'https://api.openai.com/v1';
-        const isCustomEndpoint = baseUrl && baseUrl !== DEFAULT_OPENAI_ENDPOINT;
-        const routingDescription = useLiteLLM ? 'LiteLLM proxy' : (isCustomEndpoint ? 'custom provider' : 'direct OpenAI');
-        logger.info(`[AgentIDE] Codex routing: ${routingDescription}, baseUrl=${baseUrl || 'default'}, workspaceRoot=${options.workspaceRoot}`);
-        const isClaudeModel = threadModelId.toLowerCase().includes('claude');
-        // Codex CLI no longer supports wire_api=chat (see openai/codex#7782); always use responses.
-        const wireApi = 'responses';
-        logger.info(`[AgentIDE] Codex wire_api=${wireApi} (model=${threadModelId})`);
-        if (isClaudeModel && (useLiteLLM || isCustomEndpoint)) {
-            logger.info('[AgentIDE] Codex note: selected model appears to be Claude via proxy; reasoning summaries depend on provider support over the Responses API.');
-        }
-        // Build environment for Codex SDK (spawns internal CLI binary)
-        const codexEnv = {
-            ...process.env,
-            ...(runtime.cliEnvPatch ?? {}),
-            OPENAI_LOG: 'debug',
-        };
-        // The OpenClaw gateway token must never enter the agent's trust domain (secure-obo-design
-        // §7.6 / §7.4 gap 1). UNCONDITIONALLY (serve-v4 §10 hole 2): the scrub used to depend on
-        // the egress broker being up, so a deployment without --gateway-bridge re-inherited the
-        // token — and buildCliEnvPatch can bake it in from the host's ~/.openclaw config, not just
-        // process.env. This engine never needs it: outbound goes through the broker's turn nonce,
-        // and the openclaw CLI reads its own config file on single-tenant hosts.
-        delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
-        // Data-plane sidecar control token: the engine only needs the gateway URL + its per-turn
-        // nonce, never the register token — scrub it so a compromised agent can't forge a turn as
-        // another user (secure-obo-design §7.6). Harmless when absent (in-process/no data plane).
-        delete codexEnv['AGENTHIPPO_DATA_PLANE_TOKEN'];
-        // Always expose the VS Code chat session id to the agent process so it can locate:
-        //   .agentide/sessions/<sessionId>/context.md
-        const rawChatSessionId = sessionId?.trim();
-        const contextSessionId = options.contextSessionId?.trim() || rawChatSessionId;
-        if (contextSessionId) {
-            codexEnv[AGENTIDE_CONTEXT_EXPORT_PATH_ENV_VAR] = path.join(options.workspaceRoot, agentpack_1.AGENT_CONSTANTS.AGENTIDE_DIR_NAME, 'sessions', contextSessionId, 'context.md');
-            codexEnv[AGENTIDE_TERMINAL_LOG_PATH_ENV_VAR] = path.join(options.workspaceRoot, agentpack_1.AGENT_CONSTANTS.AGENTIDE_DIR_NAME, 'sessions', contextSessionId, 'terminal.md');
-        }
-        // Note: With full permissions, Codex writes files directly to disk.
-        // File changes are detected via the file_change event stream and
-        // routed through VS Code's edit session automatically.
-        // Resolve runtime paths for config directories (agent-isolated)
-        // Note: workingDirectory is ALWAYS workspaceRoot - active agent content is synced to workspace's .codex/
-        const agentId = options.agentPackId ?? 'default';
-        const runtimePaths = (0, agentpack_1.resolveRuntimePaths)(options.workspaceRoot, this.config.storagePath, agentId, options.agentPackVersion);
-        // Use agent-isolated CODEX_HOME (for session/state isolation). In multi-tenant serve,
-        // additionally key it by the verified request user: config.toml is rewritten per turn,
-        // and a shared per-agent home lets concurrent turns of different users race it
-        // (secure-obo-design §1 defect 1 / §8 Phase 0). No credential frame (IDE,
-        // single-tenant CLI) ⇒ unchanged per-agent path.
-        const codexHome = (0, agentpack_1.userScopedEngineHome)(runtimePaths.codexHome, (0, credential_context_1.currentCredential)()?.userId);
-        codexEnv['CODEX_HOME'] = codexHome;
-        await fs_1.promises.mkdir(codexHome, { recursive: true });
-        // Always set AGENT_ID for agent to know its identity
-        codexEnv['AGENT_ID'] = agentId;
-        if (options.agentPackVersion) {
-            codexEnv['AGENTIDE_AGENT_VERSION'] = options.agentPackVersion;
-        }
-        if (agentId !== 'default') {
-            logger.info(`[AgentIDE] Codex using agent: ${agentId}, CODEX_HOME=${codexHome} (agent-isolated)`);
-        }
-        else {
-            logger.info(`[AgentIDE] Codex using default agent, CODEX_HOME=${codexHome}`);
-        }
-        // Only pass baseUrl to config when using a custom endpoint (not default OpenAI)
-        const customBaseUrl = isCustomEndpoint ? baseUrl : undefined;
-        await this.ensureCodexConfig(useLiteLLM, customBaseUrl, threadModelId, 
-        // Always use workspaceRoot - pack content is synced to workspace's .codex/
-        options.workspaceRoot, options.additionalDirectories ?? [], logger, codexHome, // Pass explicit codexHome for pack support
-        agentId, // Pass agent ID for correct skills path
-        runtime.permissionHandler instanceof interfaces_1.AutoApprovePermissionHandler);
-        // LiteLLM analytics metadata (enriched - see PLAN/analytics-design.md)
-        //
-        // Gate on the codexHome actually in use (resolved above), NOT `this.config.codexHome`:
-        // headless/index.ts passes `codexHome: undefined`, so under serve/ask/chat and inside
-        // every sandbox this block was skipped and codex sent NO metadata headers at all — no
-        // session-id, user-id, agent-id, source, request-id, or engine. Spotlight lost codex
-        // attribution outside the IDE, and the gateway could not see `x-litellm-metadata-engine`,
-        // so engine-conditional ah-auto routing never fired. config.toml was written correctly
-        // the whole time (it uses this same resolved home) — only the env vars it reads were missing.
-        if (useLiteLLM && codexHome) {
-            if (analyticsUserId?.trim()) {
-                codexEnv[AGENTIDE_CODEX_USER_ENV_VAR] = analyticsUserId.trim();
-            }
-            if (sessionId?.trim()) {
-                codexEnv[AGENTIDE_CODEX_SESSION_ENV_VAR] = sessionId.trim();
-            }
-            if (analyticsProjectId?.trim()) {
-                codexEnv[AGENTIDE_CODEX_PROJECT_ID_ENV_VAR] = analyticsProjectId.trim();
-            }
-            codexEnv[AGENTIDE_CODEX_AGENT_ID_ENV_VAR] = agentId;
-            codexEnv[AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR] = options.agentPackVersion ?? 'workspace';
-            codexEnv[AGENTIDE_CODEX_SOURCE_ENV_VAR] = 'agenthippo';
-            codexEnv[AGENTIDE_CODEX_ENGINE_ENV_VAR] = 'codex';
-            // Use requestId from options (generated by caller) for Layer 1/Layer 2 correlation
-            if (options.requestId) {
-                codexEnv[AGENTIDE_CODEX_REQUEST_ID_ENV_VAR] = options.requestId;
-            }
-            if (options.policyVersion?.trim()) {
-                codexEnv[AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR] = options.policyVersion.trim();
-            }
-            if (options.packDigest?.trim()) {
-                codexEnv[AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR] = options.packDigest.trim();
-            }
-            if (options.engineVersion?.trim()) {
-                codexEnv[AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR] = options.engineVersion.trim();
-            }
-            if (options.tier !== undefined) {
-                codexEnv[AGENTIDE_CODEX_TIER_ENV_VAR] = String(options.tier);
-            }
-            if (options.instanceId?.trim()) {
-                codexEnv[AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR] = options.instanceId.trim();
-            }
-        }
-        // For custom providers (OpenRouter, LiteLLM), set API key in CODEX_API_KEY.
-        // The config.toml's `env_key = "CODEX_API_KEY"` tells the CLI to read from this variable.
-        if (isCustomEndpoint && apiKey) {
-            codexEnv['CODEX_API_KEY'] = apiKey;
-        }
-        // Only set OPENAI_BASE_URL for custom endpoints (not direct OpenAI API)
-        if (isCustomEndpoint) {
-            codexEnv['OPENAI_BASE_URL'] = baseUrl;
-            logger.info(`[AgentIDE] Using custom OpenAI base URL: ${baseUrl}`);
-            if ((0, utils_1.applyLocalTlsBypass)(codexEnv, baseUrl)) {
-                logger.info('[AgentIDE] Disabling TLS verification for local HTTPS (Codex)');
-            }
-        }
-        const convo = (0, session_1.buildConversationKey)('codex', options);
-        logger.info(`[AgentIDE] Codex conversationKey=${convo.key} (chatSessionId=${convo.chatSessionId}, signature=${convo.signatureHash}${convo.isEphemeral ? ', ephemeral' : ''})`);
-        await (0, session_1.withConversationLock)(convo.key, async () => {
-            await emitter.progress('Thinking...');
-            // Resolve unified permissions (from manifest via options, or defaults)
-            const effectivePerms = options.permissions ?? permissions_1.DEFAULT_PERMISSIONS;
-            logger.info(`[AgentIDE] Codex permissions: fileAccess=${effectivePerms.fileAccess}`);
-            // Build workspace folders list for permission mapping
-            const workspaceFolders = [
-                options.workspaceRoot,
-                ...(options.additionalDirectories ?? []),
-            ];
-            // Map unified permissions to Codex SDK options
-            const codexPermOpts = (0, permissions_1.toCodexOptions)(effectivePerms, workspaceFolders);
-            // One boundary, not two — but only when the OTHER boundary is real. Inside a tier-2
-            // container Codex's own bubblewrap sandbox cannot start (it needs a user namespace
-            // `--cap-drop ALL` + `no-new-privileges` deny), so standing it down is the difference
-            // between working shell commands and silent failures. The tier-0 process driver
-            // provides NO boundary — same uid, same filesystem as serve — so there Codex's own
-            // sandbox is the only thing between the agent and the host and must stay on.
-            // The SDK's ThreadOptions.sandboxMode overrides config.toml, so force it here too.
-            if ((0, types_1.isContainerSandbox)()) {
-                codexPermOpts.sandboxMode = 'danger-full-access';
-            }
-            logger.info(`[AgentIDE] Codex mapped: sandboxMode=${codexPermOpts.sandboxMode}, approvalPolicy=${codexPermOpts.approvalPolicy}`);
-            // Build thread options
-            // workingDirectory is ALWAYS workspaceRoot - pack content is synced to workspace's .codex/
-            const threadWorkingDir = options.workspaceRoot;
-            const threadOptions = {
-                model: threadModelId,
-                // Use mapped permissions from unified AgentPermissions
-                sandboxMode: codexPermOpts.sandboxMode,
-                approvalPolicy: codexPermOpts.approvalPolicy,
-                additionalDirectories: codexPermOpts.additionalDirectories,
-                workingDirectory: threadWorkingDir,
-                // Allow running in non-git directories (e.g., new projects, ephemeral environments)
-                skipGitRepoCheck: true,
-                modelReasoningEffort: 'medium',
-            };
-            logger.info(`[AgentIDE] Codex modelReasoningEffort=${threadOptions.modelReasoningEffort ?? 'default'}`);
-            // For custom providers (OpenRouter, LiteLLM), the API key is read from
-            // CODEX_API_KEY env var via config.toml's env_key. Only pass apiKey
-            // directly to the constructor for direct OpenAI mode.
-            const codexApiKey = isCustomEndpoint ? undefined : apiKey;
-            const codex = new Codex({
-                apiKey: codexApiKey,
-                env: codexEnv,
-                ...(this.config.codexExecutablePath ? { codexPathOverride: this.config.codexExecutablePath } : {}),
-            });
-            // const codex = new Codex({
-            // 	apiKey: codexApiKey,
-            // 	env: codexEnv,
-            // 	// Override Codex binary path for bundled CLI distribution
-            // 	...(this.config.codexExecutablePath ? { codexPathOverride: this.config.codexExecutablePath } : {}),
-            // });
-            const threadIdToResume = (0, base_1.getPersistedSessionId)('codex', convo.key);
-            let thread;
-            if (threadIdToResume) {
-                try {
-                    // Resume with the current model -- thread history persists across model changes
-                    thread = codex.resumeThread(threadIdToResume, threadOptions);
-                    logger.info(`[AgentIDE] Codex resuming thread: ${threadIdToResume} (model: ${threadModelId})`);
-                }
-                catch (e) {
-                    logger.warn(`[AgentIDE] Failed to resume Codex thread (${threadIdToResume}): ${e instanceof Error ? e.message : String(e)}. Starting new thread.`);
-                    thread = codex.startThread(threadOptions);
-                }
-            }
-            else {
-                thread = codex.startThread(threadOptions);
-                logger.info(`[AgentIDE] Codex starting new thread (model: ${threadModelId})`);
-            }
-            if (signal?.aborted) {
-                logger.info('[AgentIDE] Codex stream cancelled before starting turn');
-                return;
-            }
-            let events;
-            try {
-                ({ events } = await thread.runStreamed(message, { signal }));
-            }
-            catch (e) {
-                if (signal?.aborted) {
-                    logger.info('[AgentIDE] Codex stream aborted while starting turn');
-                    return;
-                }
-                throw e;
-            }
-            const textTracker = new Map();
-            const pendingOperations = new Map(); // command item.id → operationId
-            const pendingNewFiles = new Map(); // command item.id → new file paths
-            let reasoningDeltaCount = 0;
-            let reasoningCharCount = 0;
-            let reasoningItemSeen = 0;
-            let loggedEmptyReasoningOnce = false;
-            const preview = (s) => s.replace(/\r/g, '').replace(/\n/g, '\\n').slice(0, 160);
-            try {
-                for await (const event of events) {
-                    if (signal?.aborted) {
-                        logger.info('[AgentIDE] Codex stream aborted; stopping event loop');
-                        return;
-                    }
-                    const itemType = isCodexItemEvent(event) ? event.item.type : undefined;
-                    logger.debug(`[AgentIDE] Codex event: ${event.type}${itemType ? ` (item: ${itemType})` : ''}`);
-                    if (event.type === 'thread.started') {
-                        const started = event;
-                        const threadId = started.thread_id;
-                        logger.info(`[AgentIDE] Codex thread started: ${threadId}`);
-                        await (0, base_1.persistSessionIfNeeded)('codex', convo, threadId, options);
-                        continue;
-                    }
-                    if (event.type === 'turn.failed') {
-                        await emitter.error(event.error?.message || 'Codex turn failed');
-                        throw new Error(event.error?.message || 'Codex turn failed');
-                    }
-                    if (event.type === 'error') {
-                        await emitter.error(event.message || 'Codex stream error');
-                        throw new Error(event.message || 'Codex stream error');
-                    }
-                    if (event.type === 'turn.completed') {
-                        logger.info(`[AgentIDE] Codex usage: input=${event.usage.input_tokens}, cached=${event.usage.cached_input_tokens}, output=${event.usage.output_tokens}`);
-                        continue;
-                    }
-                    if (isCodexItemEvent(event)) {
-                        const { item } = event;
-                        if (item.type === 'reasoning') {
-                            reasoningItemSeen++;
-                            const full = item.text ?? '';
-                            const delta = (0, utils_1.computeTextDelta)(item.id, item.text ?? '', textTracker);
-                            if (delta) {
-                                reasoningDeltaCount++;
-                                reasoningCharCount += delta.length;
-                                if (reasoningDeltaCount <= 3) {
-                                    logger.debug(`[AgentIDE] Codex reasoning delta #${reasoningDeltaCount} (${delta.length} chars): ${preview(delta)}`);
-                                }
-                                await emitter.thinking(delta);
-                            }
-                            else if (!loggedEmptyReasoningOnce && full.length === 0) {
-                                loggedEmptyReasoningOnce = true;
-                                logger.debug('[AgentIDE] Codex reasoning item observed but text is empty so far.');
-                            }
-                        }
-                        else if (item.type === 'agent_message') {
-                            const delta = (0, utils_1.computeTextDelta)(item.id, item.text ?? '', textTracker);
-                            if (delta) {
-                                await emitter.text(delta);
-                            }
-                        }
-                        else if (item.type === 'command_execution') {
-                            if (event.type === 'item.started') {
-                                // Emit command as thinking so users can see what's being executed
-                                await emitter.thinking(`**Running command**\n\`\`\`bash\n${item.command}\n\`\`\`\n`);
-                                await emitter.toolStart('terminal', item.command, item.id, {
-                                    kind: 'terminal',
-                                    language: 'bash',
-                                });
-                                // Set up edit tracking for files in command
-                                // Filter out binary files - they can't be diffed as text
-                                if (rawChatSessionId && item.command && editTracker) {
-                                    const files = (0, utils_1.extractFilePaths)(item.command, options.workspaceRoot).filter(f => !(0, utils_1.isBinaryFile)(f));
-                                    if (files.length > 0) {
-                                        if ((0, utils_1.isCreateCommand)(item.command)) {
-                                            // Create command: all files are new
-                                            pendingNewFiles.set(item.id, files);
-                                        }
-                                        else {
-                                            // Modify command: partition by existence (parallel check)
-                                            const checks = await Promise.all(files.map(async (f) => [f, await (0, utils_1.pathExists)(f)]));
-                                            const existing = checks.filter(([, exists]) => exists).map(([f]) => f);
-                                            const created = checks.filter(([, exists]) => !exists).map(([f]) => f);
-                                            if (created.length > 0) {
-                                                pendingNewFiles.set(item.id, created);
-                                            }
-                                            if (existing.length > 0) {
-                                                try {
-                                                    const r = await editTracker.startTracking(rawChatSessionId, existing);
-                                                    if (r?.operationId !== undefined) {
-                                                        pendingOperations.set(item.id, r.operationId);
-                                                    }
-                                                }
-                                                catch { /* ignore */ }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                            // Stream command output as thinking content
-                            if (event.type === 'item.updated' || event.type === 'item.completed') {
-                                const outputDelta = (0, utils_1.computeTextDelta)(`${item.id}-output`, item.aggregated_output ?? '', textTracker);
-                                if (outputDelta) {
-                                    await emitter.thinking(outputDelta);
-                                }
-                            }
-                            if (event.type === 'item.completed') {
-                                const exitMsg = item.exit_code !== undefined
-                                    // allow-any-unicode-next-line
-                                    ? (item.exit_code === 0 ? '✓ Command completed' : `✗ Exited with code ${item.exit_code}`)
-                                    : '✓ Command completed';
-                                await emitter.thinking(`\n${exitMsg}\n`);
-                                await emitter.toolEnd('terminal', item.id, item.exit_code !== undefined ? `Exited with code ${item.exit_code}` : 'Completed', item.exit_code !== undefined ? item.exit_code !== 0 : false, { exitCode: item.exit_code });
-                                // Finalize edit tracking
-                                if (rawChatSessionId && editTracker) {
-                                    // Existing files: stop edit tracking to compute diffs
-                                    const opId = pendingOperations.get(item.id);
-                                    if (opId !== undefined) {
-                                        try {
-                                            await editTracker.stopTracking(rawChatSessionId, opId);
-                                        }
-                                        catch { /* ignore */ }
-                                        pendingOperations.delete(item.id);
-                                    }
-                                    await registerNewFilesWithTracker(pendingNewFiles.get(item.id) ?? [], editTracker, rawChatSessionId);
-                                    pendingNewFiles.delete(item.id);
-                                }
-                            }
-                        }
-                        else if (item.type === 'mcp_tool_call') {
-                            if (event.type === 'item.started') {
-                                // Emit MCP tool call as thinking
-                                const argsStr = item.arguments ? `\n\`\`\`json\n${JSON.stringify(item.arguments, null, 2)}\n\`\`\`` : '';
-                                await emitter.thinking(`**Calling MCP tool** \`${item.server}.${item.tool}\`${argsStr}\n`);
-                                const argsPreview = item.arguments
-                                    ? JSON.stringify(item.arguments, null, 2).slice(0, 400)
-                                    : '';
-                                await emitter.toolStart(`${item.server}.${item.tool}`, argsPreview, item.id, { arguments: item.arguments });
-                            }
-                            if (event.type === 'item.completed') {
-                                // Show MCP result or error
-                                if (item.error?.message) {
-                                    // allow-any-unicode-next-line
-                                    await emitter.thinking(`\n✗ MCP error: ${item.error.message}\n`);
-                                    await emitter.toolEnd(`${item.server}.${item.tool}`, item.id, item.error.message, true, { error: item.error });
-                                }
-                                else if (item.result) {
-                                    const resultStr = JSON.stringify(item.result.structured_content ?? item.result.content, null, 2);
-                                    const truncated = resultStr.length > 500 ? resultStr.slice(0, 500) + '...' : resultStr;
-                                    await emitter.thinking(`\n✓ MCP result:\n\`\`\`json\n${truncated}\n\`\`\`\n`);
-                                    await emitter.toolEnd(`${item.server}.${item.tool}`, item.id, 'MCP call completed', false, { result: item.result });
-                                }
-                                else {
-                                    await emitter.toolEnd(`${item.server}.${item.tool}`, item.id, 'MCP call completed', false);
-                                }
-                            }
-                        }
-                        else if (item.type === 'file_change') {
-                            if (event.type === 'item.started') {
-                                const files = item.changes.map(c => `${c.kind} ${c.path}`).join(', ');
-                                await emitter.thinking(`**File changes:** ${files}\n`);
-                                await emitter.progress(`[Files] ${files}`);
-                                // Start edit tracking BEFORE files are modified (snapshot current state)
-                                // Filter out binary files - they can't be diffed as text
-                                if (!rawChatSessionId) {
-                                    logger.debug(`[AgentIDE] Codex file_change: skipping edit tracking (no session ID)`);
-                                }
-                                else if (!editTracker) {
-                                    logger.warn(`[AgentIDE] Codex file_change: skipping edit tracking (no editTracker)`);
-                                }
-                                if (rawChatSessionId && editTracker) {
-                                    const filePaths = item.changes
-                                        .filter(c => {
-                                        const normalizedKind = (0, utils_1.normalizeFileChangeKind)(String(c.kind));
-                                        return (normalizedKind === 'create' || normalizedKind === 'modify') && !(0, utils_1.isBinaryFile)(c.path);
-                                    })
-                                        .map(c => {
-                                        // Resolve relative paths to absolute using workspaceRoot
-                                        return path.isAbsolute(c.path) ? c.path : path.join(options.workspaceRoot, c.path);
-                                    });
-                                    if (filePaths.length > 0) {
-                                        logger.info(`[AgentIDE] Codex file_change: starting edit tracking for ${filePaths.length} files: ${filePaths.join(', ')}`);
-                                        try {
-                                            const result = await editTracker.startTracking(rawChatSessionId, filePaths);
-                                            if (result?.operationId !== undefined) {
-                                                pendingOperations.set(item.id, result.operationId);
-                                                logger.info(`[AgentIDE] Codex file_change: edit tracking started (op=${result.operationId})`);
-                                            }
-                                            else {
-                                                logger.warn(`[AgentIDE] Codex file_change: startTracking returned no operationId`);
-                                            }
-                                        }
-                                        catch (e) {
-                                            logger.warn(`[AgentIDE] Codex file_change: failed to start edit tracking: ${e}`);
-                                        }
-                                    }
-                                    else {
-                                        logger.debug(`[AgentIDE] Codex file_change: no trackable files (all filtered out)`);
-                                    }
-                                }
-                            }
-                            if (event.type === 'item.completed') {
-                                // allow-any-unicode-next-line
-                                const statusEmoji = item.status === 'completed' ? '✓' : '✗';
-                                await emitter.thinking(`${statusEmoji} File changes ${item.status}\n`);
-                                // Stop edit tracking AFTER files are modified (compute diffs from disk)
-                                const operationId = pendingOperations.get(item.id);
-                                if (rawChatSessionId && operationId !== undefined && editTracker) {
-                                    try {
-                                        await editTracker.stopTracking(rawChatSessionId, operationId);
-                                        logger.debug(`[AgentIDE] Stopped edit tracking (op=${operationId})`);
-                                    }
-                                    catch (e) {
-                                        logger.warn(`[AgentIDE] Failed to stop edit tracking: ${e}`);
-                                    }
-                                    finally {
-                                        pendingOperations.delete(item.id);
-                                    }
-                                }
-                            }
-                        }
-                        else if (item.type === 'web_search') {
-                            if (event.type === 'item.started') {
-                                await emitter.thinking(`**Web search:** ${item.query}\n`);
-                                await emitter.toolStart('web_search', item.query, item.id, { query: item.query });
-                            }
-                            if (event.type === 'item.completed') {
-                                await emitter.toolEnd('web_search', item.id, 'Search completed', false, { query: item.query });
-                            }
-                        }
-                        else if (item.type === 'todo_list') {
-                            // Codex often does not emit "reasoning" text; stream the plan into Thinking as a useful transparency fallback.
-                            if (event.type === 'item.started') {
-                                const lines = item.items.map(i => `- [${i.completed ? 'x' : ' '}] ${i.text}`);
-                                await emitter.thinking(`**Plan**\n${lines.join('\n')}\n`);
-                            }
-                            if (event.type === 'item.updated') {
-                                // Update plan progress as thinking
-                                const lines = item.items.map(i => `- [${i.completed ? 'x' : ' '}] ${i.text}`);
-                                await emitter.thinking(`**Plan update**\n${lines.join('\n')}\n`);
-                            }
-                            if (event.type === 'item.started' || event.type === 'item.completed') {
-                                const completed = item.items.filter(i => i.completed).length;
-                                await emitter.progress(`[Plan] ${completed}/${item.items.length} steps complete`);
-                            }
-                        }
-                        else if (item.type === 'error') {
-                            // NOTE: Codex CLI surfaces non-fatal warnings as `ErrorItem`s in the event stream
-                            const msg = item.message || 'Codex warning';
-                            logger.warn(`[AgentIDE] Codex warning: ${msg}`);
-                            await emitter.thinking(`**Warning:** ${msg}\n`);
-                        }
-                    }
-                }
-            }
-            catch (e) {
-                if (signal?.aborted) {
-                    logger.info(`[AgentIDE] Codex stream aborted: ${e instanceof Error ? e.message : String(e)}`);
-                    return;
-                }
-                throw e;
-            }
-            logger.info(`[AgentIDE] Codex reasoning summary: items=${reasoningItemSeen}, deltas=${reasoningDeltaCount}, chars=${reasoningCharCount}`);
-            if (reasoningItemSeen === 0) {
-                logger.debug('[AgentIDE] Codex emitted no reasoning items. This SDK only exposes a reasoning *summary* when available; many runs may have none.');
-            }
-            (0, base_1.touchSessionIfNeeded)(convo);
-        }, {
-            signal,
-            // Agent turns may run for hours; keep this high as a safety net only.
-            timeoutMs: session_1.DEFAULT_CONVERSATION_LOCK_TIMEOUT_MS,
-            label: 'codex.stream'
-        });
-        await emitter.done();
-        logger.info('[AgentIDE] Codex streaming complete');
-    }
-    dispose() {
-        this.lastWrittenConfigSignature = undefined;
-        this.lastCodexSkillsSignatureByWorkspaceRoot.clear();
-    }
-    onMaintenance(_logger) {
-        // No-op for Codex currently.
-        // Future: could prune stale thread references, clean temp files, etc.
-    }
-    // ---------------------------------------------------------------------------
-    // Config Management
-    // ---------------------------------------------------------------------------
-    /**
-     * Ensure Codex CLI config.toml is written with the correct provider settings.
-     * @param useLiteLLM Whether routing through LiteLLM proxy
-     * @param customBaseUrl Custom endpoint URL (undefined for direct OpenAI API)
-     * @param modelId Target model ID
-     * @param workspaceRoot Workspace root path
-     * @param additionalDirectories Additional directories for Codex
-     * @param logger Logger for output
-     */
-    async ensureCodexConfig(useLiteLLM, customBaseUrl, modelId, workspaceRoot, additionalDirectories, logger, explicitCodexHome, // For pack support
-    agentId = 'default', // Active agent ID for skills path
-    autoApproveMcp = false) {
-        const codexHome = explicitCodexHome ?? this.config.codexHome;
-        if (!codexHome) {
-            return;
-        }
-        // Sync project skills into $CODEX_HOME/skills
-        try {
-            const skillsSig = this.getSkillsSignature(workspaceRoot);
-            await this.syncCodexSkillsToCodexHome(codexHome, workspaceRoot, agentId, logger, skillsSig);
-        }
-        catch (e) {
-            logger.warn(`[AgentIDE] Warning: failed to sync skills into $CODEX_HOME: ${e instanceof Error ? e.message : String(e)}`);
-        }
-        const codexInstructionsFile = await this.updateCodexRuntimeInstructionsFile(codexHome, workspaceRoot, additionalDirectories, agentId, logger);
-        // Codex CLI requires wire_api=responses (chat wire was removed in newer Codex releases).
-        const wireApi = 'responses';
-        const routingType = useLiteLLM ? 'litellm' : (customBaseUrl ? 'custom' : 'openai');
-        // No per-turn component in this signature: config.toml must be byte-identical across
-        // turns (per-turn auth rides the process env via bearer_token_env_var, never the file),
-        // so concurrent same-home turns write identical bytes and the old cross-turn race is
-        // gone by construction (secure-obo-design §3.2).
-        const signature = `${AGENTIDE_CODEX_CONFIG_VERSION}:${routingType}:${customBaseUrl ?? ''}:${wireApi}:${agentId}:${codexInstructionsFile ?? ''}`;
-        if (this.lastWrittenConfigSignature === signature) {
-            return;
-        }
-        await fs_1.promises.mkdir(codexHome, { recursive: true });
-        // Build config.toml with common settings and optional custom provider section
-        const lines = [
-            `# AgentIDE Codex config (generated) - ${routingType} mode`,
-            'model_reasoning_summary = "detailed"',
-            'hide_agent_reasoning = false',
-            // Surface raw reasoning content when the model emits it (improves streaming visibility)
-            // 'show_raw_agent_reasoning = true',
-            // Force Codex to send reasoning metadata even for unknown models
-            // 'model_supports_reasoning_summaries = true',
-            // Codex CLI loads a single "model instructions" file that acts like a system/developer prompt overlay.
-            // Note: experimental_instructions_file is deprecated and ignored by newer Codex CLI versions.
-            codexInstructionsFile ? `model_instructions_file = ${JSON.stringify(codexInstructionsFile)}` : undefined,
-            // Inside a TIER-2 sandbox the container is the boundary, so Codex's own sandbox is not
-            // just redundant — it cannot start. It shells out to bubblewrap, which needs to create
-            // a user namespace and scratch space under /tmp; a container drops those capabilities by
-            // design (`--cap-drop ALL`, `no-new-privileges`), so every shell command and file
-            // write failed while still reporting exit 0. One boundary, not two — but the tier-0
-            // process driver is not a boundary at all, so it never earns this. Keyed on the tier
-            // the driver reports, not on merely being inside a sandbox.
-            ...((0, types_1.isContainerSandbox)()
-                ? ['sandbox_mode = "danger-full-access"']
-                : []),
-        ];
-        // Add custom provider section for LiteLLM or custom providers (e.g., OpenRouter)
-        if (customBaseUrl) {
-            const providerId = useLiteLLM ? AGENTIDE_CODEX_PROVIDER_ID : AGENTIDE_CODEX_CUSTOM_PROVIDER_ID;
-            const providerName = useLiteLLM ? 'AgentIDE LiteLLM' : 'AgentIDE Custom Provider';
-            lines.push('', `model_provider = "${providerId}"`, '', `[model_providers.${providerId}]`, `name = "${providerName}"`, `base_url = ${JSON.stringify(customBaseUrl)}`, 'env_key = "CODEX_API_KEY"', `wire_api = "${wireApi}"`, 'query_params = {}');
-            // LiteLLM-specific analytics headers (enriched - see PLAN/analytics-design.md)
-            if (useLiteLLM) {
-                lines.push(`env_http_headers = { ` +
-                    `"x-litellm-metadata-session-id" = "${AGENTIDE_CODEX_SESSION_ENV_VAR}", ` +
-                    `"x-litellm-metadata-user-id" = "${AGENTIDE_CODEX_USER_ENV_VAR}", ` +
-                    `"x-litellm-metadata-project-id" = "${AGENTIDE_CODEX_PROJECT_ID_ENV_VAR}", ` +
-                    `"langfuse_session_id" = "${AGENTIDE_CODEX_SESSION_ENV_VAR}", ` +
-                    `"langfuse_trace_user_id" = "${AGENTIDE_CODEX_USER_ENV_VAR}", ` +
-                    `"x-litellm-metadata-agent-id" = "${AGENTIDE_CODEX_AGENT_ID_ENV_VAR}", ` +
-                    `"x-litellm-metadata-agent-version" = "${AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR}", ` +
-                    `"x-litellm-metadata-source" = "${AGENTIDE_CODEX_SOURCE_ENV_VAR}", ` +
-                    `"x-litellm-metadata-engine" = "${AGENTIDE_CODEX_ENGINE_ENV_VAR}", ` +
-                    `"x-litellm-metadata-request-id" = "${AGENTIDE_CODEX_REQUEST_ID_ENV_VAR}", ` +
-                    `"x-litellm-metadata-policy-version" = "${AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR}", ` +
-                    `"x-litellm-metadata-pack-digest" = "${AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR}", ` +
-                    `"x-litellm-metadata-engine-version" = "${AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR}", ` +
-                    `"x-litellm-metadata-tier" = "${AGENTIDE_CODEX_TIER_ENV_VAR}", ` +
-                    `"x-litellm-metadata-instance-id" = "${AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR}" }`);
-            }
-        }
-        // Add MCP servers section (pack-aware)
-        const basePromptsDir = this.getBundledBasePromptsDir();
-        const servers = await (0, mcp_1.loadMcpServers)(agentId, workspaceRoot, basePromptsDir);
-        const mcpSection = (0, mcp_1.generateCodexMcpConfig)(servers, { autoApprove: autoApproveMcp });
-        if (servers.length > 0) {
-            const source = agentId === 'default' ? 'bundled' : `pack:${agentId}`;
-            logger.debug(`[AgentIDE] Codex MCP config (${source}): ${servers.length} server(s)`);
-        }
-        const configToml = lines.filter(Boolean).join('\n') + mcpSection;
-        await fs_1.promises.writeFile(path.join(codexHome, 'config.toml'), configToml, 'utf8');
-        this.lastWrittenConfigSignature = signature;
-        logger.info(`[AgentIDE] Codex configured (${routingType}) at ${codexHome}${customBaseUrl ? `, baseUrl=${customBaseUrl}, wire_api=${wireApi}` : ''}, model=${modelId ?? 'unknown'}`);
-    }
-    async updateCodexRuntimeInstructionsFile(codexHome, workspaceRoot, additionalDirectories, agentId, logger) {
-        // Read AGENTS.md from the active pack's source directory
-        // The source of truth is <BRAND_FOLDER>/agents/<agentId>/AGENTS.md
-        const packAgentsFile = path.join(workspaceRoot, agentpack_1.AGENT_CONSTANTS.AGENTIDE_DIR_NAME, 'agents', agentId, 'AGENTS.md');
-        let baseRules = '';
-        if (await (0, utils_1.pathExists)(packAgentsFile)) {
-            baseRules = await fs_1.promises.readFile(packAgentsFile, 'utf8');
-            logger.debug(`[AgentIDE] Codex instructions from pack: ${agentId}/AGENTS.md`);
-        }
-        else {
-            // Fall back to bundled templates if pack's AGENTS.md doesn't exist
-            const bundledDir = this.getBundledBasePromptsDir();
-            if (bundledDir) {
-                const bundledAgentsFile = path.join(bundledDir, 'rules', 'AGENTS.md');
-                if (await (0, utils_1.pathExists)(bundledAgentsFile)) {
-                    baseRules = await fs_1.promises.readFile(bundledAgentsFile, 'utf8');
-                    logger.debug(`[AgentIDE] Codex instructions from bundled templates (pack ${agentId} has no AGENTS.md)`);
-                }
-            }
-            if (!baseRules) {
-                logger.warn(`[AgentIDE] Warning: no AGENTS.md found for agent ${agentId} and no bundled fallback`);
-            }
-        }
-        // Also read pack's context.md if it exists (combined with AGENTS.md like sync service does)
-        const packContextFile = path.join(workspaceRoot, agentpack_1.AGENT_CONSTANTS.AGENTIDE_DIR_NAME, 'agents', agentId, 'context.md');
-        let contextContent = '';
-        if (await (0, utils_1.pathExists)(packContextFile)) {
-            contextContent = await fs_1.promises.readFile(packContextFile, 'utf8');
-        }
-        const stableDirs = additionalDirectories.slice().filter(Boolean).sort();
-        const runtimeContext = {
-            workspaceRoot,
-            additionalDirectories: stableDirs,
-        };
-        const runtimeBlock = [
-            '## AgentIDE Runtime Context (managed)',
-            '',
-            '### Workspace Information',
-            '',
-            '```json',
-            JSON.stringify(runtimeContext, null, 2),
-            '```',
-        ].join('\n');
-        // Combine: AGENTS.md + context.md + runtime block (mirrors sync service's combined rules format)
-        const parts = [baseRules.trimEnd()];
-        if (contextContent.trim()) {
-            parts.push(contextContent.trimEnd());
-        }
-        parts.push(runtimeBlock.trimEnd());
-        const combined = parts
-            .filter(Boolean)
-            .join('\n\n---\n\n')
-            .trimEnd()
-            .concat('\n');
-        const runtimeFile = path.join(codexHome, 'agentide.runtime.md');
-        await (0, utils_1.writeFileIfChanged)(runtimeFile, combined);
-        return runtimeFile;
-    }
-    async syncCodexSkillsToCodexHome(codexHome, workspaceRoot, agentId, logger, skillsSignature) {
-        // Skills are stored under the agent's directory: <BRAND_FOLDER>/agents/<agentId>/skills/
-        const srcSkillsRoot = path.join(workspaceRoot, agentpack_1.AGENT_CONSTANTS.AGENTIDE_DIR_NAME, 'agents', agentId, 'skills');
-        const dstSkillsRoot = path.join(codexHome, 'skills');
-        if (skillsSignature) {
-            const last = this.lastCodexSkillsSignatureByWorkspaceRoot.get(workspaceRoot);
-            const dstExists = await (0, utils_1.pathExists)(dstSkillsRoot);
-            if (last === skillsSignature && dstExists) {
-                logger.debug(`[AgentIDE] Codex skills unchanged (sig=${skillsSignature}), skipping $CODEX_HOME sync`);
-                return;
-            }
-        }
-        // Ensure destination is fully overwritten (AgentIDE-managed).
-        try {
-            await fs_1.promises.rm(dstSkillsRoot, { recursive: true, force: true });
-        }
-        catch {
-            // ignore
-        }
-        if (!(await (0, utils_1.pathExists)(srcSkillsRoot))) {
-            return;
-        }
-        await fs_1.promises.mkdir(dstSkillsRoot, { recursive: true });
-        let copied = 0;
-        const entries = await fs_1.promises.readdir(srcSkillsRoot, { withFileTypes: true });
-        for (const entry of entries) {
-            if (!entry.isDirectory()) {
-                continue;
-            }
-            if (entry.name.startsWith('.')) {
-                continue;
-            }
-            const srcSkill = path.join(srcSkillsRoot, entry.name);
-            const skillFile = path.join(srcSkill, 'SKILL.md');
-            if (!(await (0, utils_1.pathExists)(skillFile))) {
-                continue;
-            }
-            await (0, utils_1.copyDirRecursive)(srcSkill, path.join(dstSkillsRoot, entry.name));
-            copied++;
-        }
-        if (skillsSignature) {
-            this.lastCodexSkillsSignatureByWorkspaceRoot.set(workspaceRoot, skillsSignature);
-        }
-        logger.info(`[AgentIDE] Codex skills synced to $CODEX_HOME: ${copied} skill(s)`);
-    }
-}
-exports.CodexEngine = CodexEngine;