@ai-sdk/harness-codex 1.0.135 → 1.0.137

package/dist/index.js

@@ -1,459 +1,330 @@
-// src/codex-harness.ts
-import { createHash as createHash2 } from "crypto";
-import path from "path";
-import {
-  commonTool,
-  HarnessCapabilityUnsupportedError,
-  harnessV1DiagnosticFromBridgeFrame,
-  harnessStateDirectoryPath,
-  harnessSessionDataDirectoryPath
-} from "@ai-sdk/harness";
-import {
-  applyCredentialForwarding,
-  classifyDiskLog,
-  createBridgeToken,
-  resolveSandboxCredentialEnvironment,
-  createBridgeErrorHandler,
-  createBridgeStartupError,
-  experimental_createBridgeUserMessageSubmitter,
-  drainBridgeProcessStream,
-  forwardBridgeProcessStream,
-  getRestrictedSandboxSession,
-  markBridgeStarting,
-  resolveSandboxHomeDir,
-  SandboxChannel,
-  shellQuote,
-  warnCredentialBrokeringUnavailable,
-  waitForBridgeReady,
-  withBridgeToken,
-  writeSkills
-} from "@ai-sdk/harness/utils";
-import {
-  tool
-} from "@ai-sdk/provider-utils";
+import { createHash } from "node:crypto";
+import path, { dirname, join, resolve } from "node:path";
+import { HarnessCapabilityUnsupportedError, commonTool, harnessSessionDataDirectoryPath, harnessStateDirectoryPath, harnessV1BridgeInboundCommandSchemas, harnessV1BridgeOutboundMessageSchema, harnessV1BridgeStartBaseSchema, harnessV1DiagnosticFromBridgeFrame } from "@ai-sdk/harness";
+import { SandboxChannel, applyCredentialForwarding, classifyDiskLog, createBridgeErrorHandler, createBridgeStartupError, createBridgeToken, createCredentialRequestTransformation, createReadBridgeAsset, drainBridgeProcessStream, experimental_createBridgeUserMessageSubmitter, forwardBridgeProcessStream, getAiGatewayAuthFromEnv, getJwtExpiresAt, getRestrictedSandboxSession, isAccessTokenExpiringSoon, isHarnessAuthenticationEnvironment, isLinux, isMacOS, isWindows, markBridgeStarting, readLinuxSecretServicePassword, readMacOSKeychainPassword, readWindowsCredentialManagerPassword, refreshOAuthAccessToken, resolveSandboxCredentialEnvironment, resolveSandboxHomeDir, shellQuote, shouldResolveNativeSubscription, waitForBridgeReady, warnCredentialBrokeringUnavailable, withBridgeToken, writeSkills } from "@ai-sdk/harness/utils";
+import { isRecord, safeParseJSON, tool } from "@ai-sdk/provider-utils";
 import { WebSocket } from "ws";
-import { z as z2 } from "zod/v4";
-
-// src/codex-bootstrap.ts
-import { createReadBridgeAsset } from "@ai-sdk/harness/utils";
-var readBridgeAsset = createReadBridgeAsset({
-  "package.json": new URL("./bridge/package.json", import.meta.url),
-  "pnpm-lock.yaml": new URL("./bridge/pnpm-lock.yaml", import.meta.url),
-  "index.mjs": new URL("./bridge/index.mjs", import.meta.url)
+import { z } from "zod/v4";
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+//#region src/codex-bootstrap.ts
+const readBridgeAsset = createReadBridgeAsset({
+	"package.json": new URL("./bridge/package.json", import.meta.url),
+	"pnpm-lock.yaml": new URL("./bridge/pnpm-lock.yaml", import.meta.url),
+	"index.mjs": new URL("./bridge/index.mjs", import.meta.url)
 });
-var CODEX_BOOTSTRAP_DIR = ".harness-bootstrap/codex";
-var cachedBootstrap;
+const CODEX_BOOTSTRAP_DIR = ".harness-bootstrap/codex";
+let cachedBootstrap;
 async function getCodexBootstrap() {
-  if (cachedBootstrap != null) return cachedBootstrap;
-  const [pkg, lock, bridge] = await Promise.all([
-    readBridgeAsset("package.json"),
-    readBridgeAsset("pnpm-lock.yaml"),
-    readBridgeAsset("index.mjs")
-  ]);
-  cachedBootstrap = {
-    harnessId: "codex",
-    bootstrapDir: CODEX_BOOTSTRAP_DIR,
-    files: [
-      { path: `${CODEX_BOOTSTRAP_DIR}/package.json`, content: pkg },
-      { path: `${CODEX_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },
-      { path: `${CODEX_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge }
-    ],
-    commands: [
-      {
-        command: "pnpm install --frozen-lockfile --store-dir .pnpm-store"
-      }
-    ]
-  };
-  return cachedBootstrap;
+	if (cachedBootstrap != null) return cachedBootstrap;
+	const [pkg, lock, bridge] = await Promise.all([
+		readBridgeAsset("package.json"),
+		readBridgeAsset("pnpm-lock.yaml"),
+		readBridgeAsset("index.mjs")
+	]);
+	cachedBootstrap = {
+		harnessId: "codex",
+		bootstrapDir: CODEX_BOOTSTRAP_DIR,
+		files: [
+			{
+				path: `${CODEX_BOOTSTRAP_DIR}/package.json`,
+				content: pkg
+			},
+			{
+				path: `${CODEX_BOOTSTRAP_DIR}/pnpm-lock.yaml`,
+				content: lock
+			},
+			{
+				path: `${CODEX_BOOTSTRAP_DIR}/bridge.mjs`,
+				content: bridge
+			}
+		],
+		commands: [{ command: "pnpm install --frozen-lockfile --store-dir .pnpm-store" }]
+	};
+	return cachedBootstrap;
 }
-
-// src/codex-auth.ts
-import {
-  createCredentialRequestTransformation,
-  getAiGatewayAuthFromEnv,
-  isHarnessAuthenticationEnvironment
-} from "@ai-sdk/harness/utils";
-var DEFAULT_AI_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh/v1";
-var DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
-var CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES = [
-  "AI_GATEWAY_API_KEY",
-  "CODEX_API_KEY"
-];
-function createCodexRequestTransformations({
-  env: environment,
-  sandboxEnv: sandboxEnvironment,
-  auth: authenticationMode
-}) {
-  if (!environment.CODEX_API_KEY || !sandboxEnvironment.CODEX_API_KEY) {
-    return [];
-  }
-  return [
-    createCredentialRequestTransformation({
-      matchUrl: environment.OPENAI_BASE_URL ?? (authenticationMode === "ai-gateway" ? DEFAULT_AI_GATEWAY_BASE_URL : DEFAULT_OPENAI_BASE_URL),
-      matchHeaders: {
-        Authorization: `Bearer ${sandboxEnvironment.CODEX_API_KEY}`
-      },
-      transformHeaders: {
-        Authorization: `Bearer ${environment.CODEX_API_KEY}`
-      }
-    })
-  ];
+//#endregion
+//#region src/codex-auth.ts
+const DEFAULT_AI_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh/v1";
+const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
+const CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES = ["AI_GATEWAY_API_KEY", "CODEX_API_KEY"];
+function createCodexRequestTransformations({ env: environment, sandboxEnv: sandboxEnvironment, auth: authenticationMode }) {
+	if (!environment.CODEX_API_KEY || !sandboxEnvironment.CODEX_API_KEY) return [];
+	return [createCredentialRequestTransformation({
+		matchUrl: environment.OPENAI_BASE_URL ?? (authenticationMode === "ai-gateway" ? DEFAULT_AI_GATEWAY_BASE_URL : "https://api.openai.com/v1"),
+		matchHeaders: { Authorization: `Bearer ${sandboxEnvironment.CODEX_API_KEY}` },
+		transformHeaders: { Authorization: `Bearer ${environment.CODEX_API_KEY}` }
+	})];
 }
+/**
+* Resolve the environment-variable blob the codex bridge needs. Precedence:
+*
+*   1. An explicit authentication mode pins the selected route.
+*   2. Auto-detect from the host process env: gateway first
+*      (`AI_GATEWAY_API_KEY` / `VERCEL_OIDC_TOKEN`), then `CODEX_API_KEY` /
+*      `OPENAI_API_KEY`.
+*/
 function resolveCodexEnv(auth, processEnv = process.env) {
-  const suppliedEnvironment = isHarnessAuthenticationEnvironment(auth);
-  const authenticationEnvironment = suppliedEnvironment ? auth : processEnv;
-  if (auth === "direct") {
-    return pickOpenAI({ processEnv: authenticationEnvironment });
-  }
-  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({
-    env: authenticationEnvironment
-  });
-  if (auth === "ai-gateway" || gatewayAuthFromEnv.apiKey) {
-    return pickGateway({ gatewayAuthFromEnv });
-  }
-  return pickOpenAI({ processEnv: authenticationEnvironment });
+	const authenticationEnvironment = isHarnessAuthenticationEnvironment(auth) ? auth : processEnv;
+	if (auth === "direct") return pickOpenAI({ processEnv: authenticationEnvironment });
+	const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env: authenticationEnvironment });
+	if (auth === "ai-gateway" || gatewayAuthFromEnv.apiKey) return pickGateway({ gatewayAuthFromEnv });
+	return pickOpenAI({ processEnv: authenticationEnvironment });
 }
 function resolveCodexAuthenticationMode(auth, processEnv = process.env) {
-  if (isHarnessAuthenticationEnvironment(auth)) {
-    return getAiGatewayAuthFromEnv({ env: auth }).apiKey ? "ai-gateway" : "direct";
-  }
-  if (auth === "direct") {
-    return "direct";
-  }
-  if (auth === "ai-gateway") {
-    return "ai-gateway";
-  }
-  return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey ? "ai-gateway" : "direct";
+	if (isHarnessAuthenticationEnvironment(auth)) return getAiGatewayAuthFromEnv({ env: auth }).apiKey ? "ai-gateway" : "direct";
+	if (auth === "direct") return "direct";
+	if (auth === "ai-gateway") return "ai-gateway";
+	return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey ? "ai-gateway" : "direct";
 }
-function pickOpenAI({
-  processEnv
-}) {
-  const env = {};
-  const apiKey = processEnv.OPENAI_API_KEY ?? processEnv.CODEX_API_KEY;
-  if (apiKey) env.CODEX_API_KEY = apiKey;
-  const baseUrl = processEnv.OPENAI_BASE_URL;
-  if (baseUrl) env.OPENAI_BASE_URL = baseUrl;
-  const organization = processEnv.OPENAI_ORGANIZATION;
-  if (organization) env.OPENAI_ORGANIZATION = organization;
-  const project = processEnv.OPENAI_PROJECT;
-  if (project) env.OPENAI_PROJECT = project;
-  return env;
+function pickOpenAI({ processEnv }) {
+	const env = {};
+	const apiKey = processEnv.OPENAI_API_KEY ?? processEnv.CODEX_API_KEY;
+	if (apiKey) env.CODEX_API_KEY = apiKey;
+	const baseUrl = processEnv.OPENAI_BASE_URL;
+	if (baseUrl) env.OPENAI_BASE_URL = baseUrl;
+	const organization = processEnv.OPENAI_ORGANIZATION;
+	if (organization) env.OPENAI_ORGANIZATION = organization;
+	const project = processEnv.OPENAI_PROJECT;
+	if (project) env.OPENAI_PROJECT = project;
+	return env;
 }
-function pickGateway({
-  gatewayAuthFromEnv
-}) {
-  const apiKey = gatewayAuthFromEnv.apiKey;
-  const baseUrl = toCodexGatewayBaseUrl(gatewayAuthFromEnv.baseUrl);
-  const env = {};
-  if (apiKey) {
-    env.AI_GATEWAY_API_KEY = apiKey;
-    env.CODEX_API_KEY = apiKey;
-  }
-  env.AI_GATEWAY_BASE_URL = baseUrl;
-  env.OPENAI_BASE_URL = baseUrl;
-  return env;
+function pickGateway({ gatewayAuthFromEnv }) {
+	const apiKey = gatewayAuthFromEnv.apiKey;
+	const baseUrl = toCodexGatewayBaseUrl(gatewayAuthFromEnv.baseUrl);
+	const env = {};
+	if (apiKey) {
+		env.AI_GATEWAY_API_KEY = apiKey;
+		env.CODEX_API_KEY = apiKey;
+	}
+	env.AI_GATEWAY_BASE_URL = baseUrl;
+	env.OPENAI_BASE_URL = baseUrl;
+	return env;
 }
 function toCodexGatewayBaseUrl(baseUrl) {
-  const trimmed = baseUrl.replace(/\/+$/, "");
-  return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;
+	const trimmed = baseUrl.replace(/\/+$/, "");
+	return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;
 }
-
-// src/codex-subscription.ts
-import { spawn } from "child_process";
-import { createHash } from "crypto";
-import {
-  chmod,
-  mkdir,
-  readFile,
-  realpath,
-  rename,
-  writeFile
-} from "fs/promises";
-import { homedir } from "os";
-import { dirname, join, resolve } from "path";
-import {
-  getJwtExpiresAt,
-  isAccessTokenExpiringSoon,
-  isHarnessAuthenticationEnvironment as isHarnessAuthenticationEnvironment2,
-  isLinux,
-  isMacOS,
-  isWindows,
-  readLinuxSecretServicePassword,
-  readMacOSKeychainPassword,
-  readWindowsCredentialManagerPassword,
-  refreshOAuthAccessToken,
-  shouldResolveNativeSubscription
-} from "@ai-sdk/harness/utils";
-import { isRecord, safeParseJSON } from "@ai-sdk/provider-utils";
-var CHATGPT_CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex";
-var OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
-var OPENAI_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-function createCodexSubscriptionRequestTransformations({
-  requestHeaders,
-  ...sources
-}) {
-  const transformations = createCodexRequestTransformations(sources);
-  if (requestHeaders == null) return transformations;
-  return transformations.map((transformation) => ({
-    ...transformation,
-    transform: {
-      ...transformation.transform,
-      headers: {
-        ...transformation.transform.headers,
-        ...requestHeaders
-      }
-    }
-  }));
+//#endregion
+//#region src/codex-subscription.ts
+const CHATGPT_CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex";
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const OPENAI_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+function createCodexSubscriptionRequestTransformations({ requestHeaders, ...sources }) {
+	const transformations = createCodexRequestTransformations(sources);
+	if (requestHeaders == null) return transformations;
+	return transformations.map((transformation) => ({
+		...transformation,
+		transform: {
+			...transformation.transform,
+			headers: {
+				...transformation.transform.headers,
+				...requestHeaders
+			}
+		}
+	}));
 }
-async function resolveCodexAuthentication({
-  auth,
-  processEnv = process.env,
-  authCredentialsStoreMode,
-  readSubscription = readCodexSubscription
-}) {
-  const environment = resolveCodexEnv(auth, processEnv);
-  if (isHarnessAuthenticationEnvironment2(auth)) {
-    return { environment };
-  }
-  if (!shouldResolveNativeSubscription({
-    auth,
-    env: environment,
-    hasDirectCredential: environment.CODEX_API_KEY != null
-  })) {
-    return { environment };
-  }
-  return await readSubscription({ authCredentialsStoreMode }) ?? { environment };
+async function resolveCodexAuthentication({ auth, processEnv = process.env, authCredentialsStoreMode, readSubscription = readCodexSubscription }) {
+	const environment = resolveCodexEnv(auth, processEnv);
+	if (isHarnessAuthenticationEnvironment(auth)) return { environment };
+	if (!shouldResolveNativeSubscription({
+		auth,
+		env: environment,
+		hasDirectCredential: environment.CODEX_API_KEY != null
+	})) return { environment };
+	return await readSubscription({ authCredentialsStoreMode }) ?? { environment };
 }
-async function readCodexSubscription({
-  env = process.env,
-  homeDirectory = homedir(),
-  authCredentialsStoreMode,
-  platform = process.platform,
-  keyring,
-  fetch
-} = {}) {
-  const codexHome = resolve(env.CODEX_HOME ?? join(homeDirectory, ".codex"));
-  const authPath = join(codexHome, "auth.json");
-  const storageMode = toCodexAuthCredentialsStoreMode(authCredentialsStoreMode) ?? await readCodexAuthCredentialsStoreMode({ codexHome }) ?? "file";
-  const stored = await readCodexAuthStore({
-    codexHome,
-    authPath,
-    storageMode,
-    keyring: keyring ?? createCodexKeyring({ platform })
-  });
-  if (stored == null) return void 0;
-  const credential = await toCodexCredential(stored.value);
-  if (credential == null) return void 0;
-  let accessToken = credential.accessToken;
-  if (isAccessTokenExpiringSoon({ expiresAt: credential.expiresAt })) {
-    const refreshed = await refreshOAuthAccessToken({
-      tokenUrl: OPENAI_TOKEN_URL,
-      clientId: OPENAI_CLIENT_ID,
-      refreshToken: credential.refreshToken,
-      requestFormat: "json",
-      ...fetch == null ? {} : { fetch }
-    });
-    accessToken = refreshed.accessToken;
-    await stored.write({
-      ...stored.value,
-      last_refresh: (/* @__PURE__ */ new Date()).toISOString(),
-      tokens: {
-        ...stored.value.tokens,
-        access_token: refreshed.accessToken,
-        refresh_token: refreshed.refreshToken ?? credential.refreshToken
-      }
-    });
-  }
-  return {
-    environment: {
-      CODEX_API_KEY: accessToken,
-      OPENAI_BASE_URL: CHATGPT_CODEX_BASE_URL
-    },
-    ...credential.accountId == null ? {} : {
-      requestHeaders: {
-        "ChatGPT-Account-ID": credential.accountId
-      }
-    }
-  };
+async function readCodexSubscription({ env = process.env, homeDirectory = homedir(), authCredentialsStoreMode, platform = process.platform, keyring, fetch } = {}) {
+	const codexHome = resolve(env.CODEX_HOME ?? join(homeDirectory, ".codex"));
+	const stored = await readCodexAuthStore({
+		codexHome,
+		authPath: join(codexHome, "auth.json"),
+		storageMode: toCodexAuthCredentialsStoreMode(authCredentialsStoreMode) ?? await readCodexAuthCredentialsStoreMode({ codexHome }) ?? "file",
+		keyring: keyring ?? createCodexKeyring({ platform })
+	});
+	if (stored == null) return void 0;
+	const credential = await toCodexCredential(stored.value);
+	if (credential == null) return void 0;
+	let accessToken = credential.accessToken;
+	if (isAccessTokenExpiringSoon({ expiresAt: credential.expiresAt })) {
+		const refreshed = await refreshOAuthAccessToken({
+			tokenUrl: OPENAI_TOKEN_URL,
+			clientId: OPENAI_CLIENT_ID,
+			refreshToken: credential.refreshToken,
+			requestFormat: "json",
+			...fetch == null ? {} : { fetch }
+		});
+		accessToken = refreshed.accessToken;
+		await stored.write({
+			...stored.value,
+			last_refresh: (/* @__PURE__ */ new Date()).toISOString(),
+			tokens: {
+				...stored.value.tokens,
+				access_token: refreshed.accessToken,
+				refresh_token: refreshed.refreshToken ?? credential.refreshToken
+			}
+		});
+	}
+	return {
+		environment: {
+			CODEX_API_KEY: accessToken,
+			OPENAI_BASE_URL: CHATGPT_CODEX_BASE_URL
+		},
+		...credential.accountId == null ? {} : { requestHeaders: { "ChatGPT-Account-ID": credential.accountId } }
+	};
 }
-async function readCodexAuthStore({
-  codexHome,
-  authPath,
-  storageMode,
-  keyring
-}) {
-  if (storageMode === "ephemeral") return void 0;
-  const readFileStore = async () => {
-    const value = await readCodexAuthFile(authPath);
-    return value == null ? void 0 : {
-      value,
-      write: (updated) => writeCodexAuthFile({ authPath, value: updated })
-    };
-  };
-  const readKeyringStore = async () => {
-    if (keyring == null) return void 0;
-    const canonicalHome = await realpath(codexHome).catch(() => codexHome);
-    const account = `cli|${createHash("sha256").update(canonicalHome).digest("hex").slice(0, 16)}`;
-    const text = await keyring.read({ service: "Codex Auth", account });
-    if (text == null) return void 0;
-    const value = await parseCodexAuthFile(text);
-    return value == null ? void 0 : {
-      value,
-      write: (updated) => keyring.write({
-        service: "Codex Auth",
-        account,
-        value: JSON.stringify(updated)
-      })
-    };
-  };
-  if (storageMode === "file") return readFileStore();
-  if (storageMode === "keyring") return readKeyringStore();
-  return await readKeyringStore() ?? readFileStore();
+async function readCodexAuthStore({ codexHome, authPath, storageMode, keyring }) {
+	if (storageMode === "ephemeral") return void 0;
+	const readFileStore = async () => {
+		const value = await readCodexAuthFile(authPath);
+		return value == null ? void 0 : {
+			value,
+			write: (updated) => writeCodexAuthFile({
+				authPath,
+				value: updated
+			})
+		};
+	};
+	const readKeyringStore = async () => {
+		if (keyring == null) return void 0;
+		const canonicalHome = await realpath(codexHome).catch(() => codexHome);
+		const account = `cli|${createHash("sha256").update(canonicalHome).digest("hex").slice(0, 16)}`;
+		const text = await keyring.read({
+			service: "Codex Auth",
+			account
+		});
+		if (text == null) return void 0;
+		const value = await parseCodexAuthFile(text);
+		return value == null ? void 0 : {
+			value,
+			write: (updated) => keyring.write({
+				service: "Codex Auth",
+				account,
+				value: JSON.stringify(updated)
+			})
+		};
+	};
+	if (storageMode === "file") return readFileStore();
+	if (storageMode === "keyring") return readKeyringStore();
+	return await readKeyringStore() ?? readFileStore();
 }
-async function readCodexAuthCredentialsStoreMode({
-  codexHome
-}) {
-  const text = await readFile(join(codexHome, "config.toml"), "utf8").catch(
-    () => void 0
-  );
-  if (text == null) return void 0;
-  for (const line of text.split(/\r?\n/)) {
-    if (line.trimStart().startsWith("[")) return void 0;
-    const match = /^\s*cli_auth_credentials_store\s*=\s*["'](file|keyring|auto|ephemeral)["']\s*(?:#.*)?$/.exec(
-      line
-    );
-    if (match != null) {
-      return toCodexAuthCredentialsStoreMode(match[1]);
-    }
-  }
+async function readCodexAuthCredentialsStoreMode({ codexHome }) {
+	const text = await readFile(join(codexHome, "config.toml"), "utf8").catch(() => void 0);
+	if (text == null) return void 0;
+	for (const line of text.split(/\r?\n/)) {
+		if (line.trimStart().startsWith("[")) return void 0;
+		const match = /^\s*cli_auth_credentials_store\s*=\s*["'](file|keyring|auto|ephemeral)["']\s*(?:#.*)?$/.exec(line);
+		if (match != null) return toCodexAuthCredentialsStoreMode(match[1]);
+	}
 }
 function toCodexAuthCredentialsStoreMode(value) {
-  return value === "file" || value === "keyring" || value === "auto" || value === "ephemeral" ? value : void 0;
+	return value === "file" || value === "keyring" || value === "auto" || value === "ephemeral" ? value : void 0;
 }
 async function readCodexAuthFile(authPath) {
-  const text = await readFile(authPath, "utf8").catch(() => void 0);
-  return text == null ? void 0 : parseCodexAuthFile(text);
+	const text = await readFile(authPath, "utf8").catch(() => void 0);
+	return text == null ? void 0 : parseCodexAuthFile(text);
 }
 async function parseCodexAuthFile(text) {
-  const parsed = await safeParseJSON({ text });
-  return parsed.success && isRecord(parsed.value) ? parsed.value : void 0;
+	const parsed = await safeParseJSON({ text });
+	return parsed.success && isRecord(parsed.value) ? parsed.value : void 0;
 }
 async function toCodexCredential(value) {
-  if (value.auth_mode !== "chatgpt" || !isRecord(value.tokens)) {
-    return void 0;
-  }
-  const accessToken = value.tokens.access_token;
-  const refreshToken = value.tokens.refresh_token;
-  if (typeof accessToken !== "string" || typeof refreshToken !== "string") {
-    return void 0;
-  }
-  const expiresAt = await getJwtExpiresAt({ token: accessToken });
-  if (expiresAt == null) return void 0;
-  const accountId = value.tokens.account_id;
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt,
-    ...typeof accountId === "string" ? { accountId } : {}
-  };
+	if (value.auth_mode !== "chatgpt" || !isRecord(value.tokens)) return;
+	const accessToken = value.tokens.access_token;
+	const refreshToken = value.tokens.refresh_token;
+	if (typeof accessToken !== "string" || typeof refreshToken !== "string") return;
+	const expiresAt = await getJwtExpiresAt({ token: accessToken });
+	if (expiresAt == null) return void 0;
+	const accountId = value.tokens.account_id;
+	return {
+		accessToken,
+		refreshToken,
+		expiresAt,
+		...typeof accountId === "string" ? { accountId } : {}
+	};
 }
-async function writeCodexAuthFile({
-  authPath,
-  value
-}) {
-  await mkdir(dirname(authPath), { recursive: true });
-  const temporaryPath = `${authPath}.${process.pid}.tmp`;
-  await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}
-`, {
-    mode: 384
-  });
-  await chmod(temporaryPath, 384);
-  await rename(temporaryPath, authPath);
+async function writeCodexAuthFile({ authPath, value }) {
+	await mkdir(dirname(authPath), { recursive: true });
+	const temporaryPath = `${authPath}.${process.pid}.tmp`;
+	await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+	await chmod(temporaryPath, 384);
+	await rename(temporaryPath, authPath);
 }
-function createCodexKeyring({
-  platform
-}) {
-  if (isMacOS(platform)) {
-    return {
-      async read({ service, account }) {
-        return readMacOSKeychainPassword({ service, account });
-      },
-      async write({ service, account, value }) {
-        const command = `add-generic-password -U -s ${shellQuoteForSecurity(service)} -a ${shellQuoteForSecurity(account)} -X ${Buffer.from(value, "utf8").toString("hex")}
-`;
-        await runCommandWithInput({
-          command: "/usr/bin/security",
-          args: ["-i"],
-          input: command
-        });
-      }
-    };
-  }
-  if (isLinux(platform)) {
-    return {
-      async read({ service, account }) {
-        return readLinuxSecretServicePassword({
-          attributes: {
-            service,
-            username: account,
-            target: "default"
-          }
-        });
-      },
-      async write({ service, account, value }) {
-        await runCommandWithInput({
-          command: "secret-tool",
-          args: [
-            "store",
-            "--label",
-            `${account}@${service}:default`,
-            "service",
-            service,
-            "username",
-            account,
-            "target",
-            "default",
-            "application",
-            "rust-keyring"
-          ],
-          input: value
-        });
-      }
-    };
-  }
-  if (isWindows(platform)) {
-    return createWindowsCodexKeyring();
-  }
+function createCodexKeyring({ platform }) {
+	if (isMacOS(platform)) return {
+		async read({ service, account }) {
+			return readMacOSKeychainPassword({
+				service,
+				account
+			});
+		},
+		async write({ service, account, value }) {
+			await runCommandWithInput({
+				command: "/usr/bin/security",
+				args: ["-i"],
+				input: `add-generic-password -U -s ${shellQuoteForSecurity(service)} -a ${shellQuoteForSecurity(account)} -X ${Buffer.from(value, "utf8").toString("hex")}\n`
+			});
+		}
+	};
+	if (isLinux(platform)) return {
+		async read({ service, account }) {
+			return readLinuxSecretServicePassword({ attributes: {
+				service,
+				username: account,
+				target: "default"
+			} });
+		},
+		async write({ service, account, value }) {
+			await runCommandWithInput({
+				command: "secret-tool",
+				args: [
+					"store",
+					"--label",
+					`${account}@${service}:default`,
+					"service",
+					service,
+					"username",
+					account,
+					"target",
+					"default",
+					"application",
+					"rust-keyring"
+				],
+				input: value
+			});
+		}
+	};
+	if (isWindows(platform)) return createWindowsCodexKeyring();
 }
 function shellQuoteForSecurity(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
-async function runCommandWithInput({
-  command,
-  args,
-  input,
-  env
-}) {
-  await new Promise((resolvePromise, reject) => {
-    const child = spawn(command, args, {
-      stdio: ["pipe", "ignore", "pipe"],
-      ...env == null ? {} : { env }
-    });
-    let stderr = "";
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.once("error", reject);
-    child.once("close", (code) => {
-      if (code === 0) resolvePromise();
-      else reject(new Error(stderr || `${command} exited with code ${code}.`));
-    });
-    child.stdin.end(input);
-  });
+async function runCommandWithInput({ command, args, input, env }) {
+	await new Promise((resolvePromise, reject) => {
+		const child = spawn(command, args, {
+			stdio: [
+				"pipe",
+				"ignore",
+				"pipe"
+			],
+			...env == null ? {} : { env }
+		});
+		let stderr = "";
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		child.once("error", reject);
+		child.once("close", (code) => {
+			if (code === 0) resolvePromise();
+			else reject(new Error(stderr || `${command} exited with code ${code}.`));
+		});
+		child.stdin.end(input);
+	});
 }
 function createWindowsCodexKeyring() {
-  const source = `
+	const source = `
 using System;
 using System.Runtime.InteropServices;
 using System.Text;
@@ -481,968 +352,828 @@ public static class CodexCredentialManager {
     } finally { Marshal.FreeHGlobal(blob); }
   }
 }`;
-  return {
-    async read({ service, account }) {
-      return readWindowsCredentialManagerPassword({
-        targetName: `${account}.${service}`
-      });
-    },
-    async write({ service, account, value }) {
-      const script = `Add-Type -TypeDefinition $env:AI_SDK_CODEX_CREDENTIAL_SOURCE; $value = [Console]::In.ReadToEnd(); [CodexCredentialManager]::Write($env:AI_SDK_CODEX_CREDENTIAL_TARGET, $env:AI_SDK_CODEX_CREDENTIAL_USER, $value)`;
-      await runCommandWithInput({
-        command: "powershell.exe",
-        args: ["-NoProfile", "-NonInteractive", "-Command", script],
-        input: value,
-        env: {
-          ...process.env,
-          AI_SDK_CODEX_CREDENTIAL_SOURCE: source,
-          AI_SDK_CODEX_CREDENTIAL_TARGET: `${account}.${service}`,
-          AI_SDK_CODEX_CREDENTIAL_USER: account
-        }
-      });
-    }
-  };
+	return {
+		async read({ service, account }) {
+			return readWindowsCredentialManagerPassword({ targetName: `${account}.${service}` });
+		},
+		async write({ service, account, value }) {
+			await runCommandWithInput({
+				command: "powershell.exe",
+				args: [
+					"-NoProfile",
+					"-NonInteractive",
+					"-Command",
+					`Add-Type -TypeDefinition $env:AI_SDK_CODEX_CREDENTIAL_SOURCE; $value = [Console]::In.ReadToEnd(); [CodexCredentialManager]::Write($env:AI_SDK_CODEX_CREDENTIAL_TARGET, $env:AI_SDK_CODEX_CREDENTIAL_USER, $value)`
+				],
+				input: value,
+				env: {
+					...process.env,
+					AI_SDK_CODEX_CREDENTIAL_SOURCE: source,
+					AI_SDK_CODEX_CREDENTIAL_TARGET: `${account}.${service}`,
+					AI_SDK_CODEX_CREDENTIAL_USER: account
+				}
+			});
+		}
+	};
 }
-
-// src/codex-bridge-protocol.ts
-import {
-  harnessV1BridgeInboundCommandSchemas,
-  harnessV1BridgeOutboundMessageSchema,
-  harnessV1BridgeReadySchema,
-  harnessV1BridgeStartBaseSchema
-} from "@ai-sdk/harness";
-import { z } from "zod/v4";
-var outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;
-var startMessageSchema = harnessV1BridgeStartBaseSchema.extend({
-  instructions: z.string().optional(),
-  reasoningEffort: z.enum(["low", "medium", "high", "xhigh", "max"]).optional(),
-  webSearch: z.boolean().optional(),
-  codexConfig: z.record(z.string(), z.unknown()).optional(),
-  mcpServers: z.record(z.string(), z.unknown()).optional(),
-  headers: z.record(z.string(), z.string()).optional(),
-  /*
-   * The host carries this app-server thread ID in lifecycle state. Supplying it
-   * makes the bridge call `thread/resume` instead of starting a fresh thread.
-   */
-  resumeThreadId: z.string().optional(),
-  restartThread: z.boolean().optional()
+//#endregion
+//#region src/codex-bridge-protocol.ts
+const outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;
+const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({
+	instructions: z.string().optional(),
+	reasoningEffort: z.enum([
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	]).optional(),
+	webSearch: z.boolean().optional(),
+	codexConfig: z.record(z.string(), z.unknown()).optional(),
+	mcpServers: z.record(z.string(), z.unknown()).optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	resumeThreadId: z.string().optional(),
+	restartThread: z.boolean().optional()
 });
-var inboundMessageSchema = z.discriminatedUnion("type", [
-  startMessageSchema,
-  ...harnessV1BridgeInboundCommandSchemas
-]);
-
-// src/version.ts
-var VERSION = true ? "1.0.135" : "0.0.0-test";
-
-// src/codex-harness.ts
-var DEFAULT_CODEX_MODEL = "gpt-5.5";
-var CODEX_CLIENT_APP = `ai-sdk-harness-codex/${VERSION}`;
-var CODEX_BUILTIN_TOOLS = {
-  bash: commonTool("bash", {
-    nativeName: "shell",
-    toolUseKind: "bash",
-    description: "Execute a shell command",
-    inputSchema: z2.object({ command: z2.string() })
-  }),
-  webSearch: commonTool("webSearch", {
-    nativeName: "web_search",
-    toolUseKind: "readonly",
-    description: "Search the web",
-    inputSchema: z2.object({ query: z2.string() })
-  }),
-  apply_patch: {
-    ...tool({
-      description: "Apply a patch to files",
-      inputSchema: z2.string()
-    }),
-    toolUseKind: "edit"
-  },
-  view_image: {
-    ...tool({
-      description: "View a local image file",
-      inputSchema: z2.object({
-        path: z2.string(),
-        detail: z2.enum(["high", "original"]).optional(),
-        environment_id: z2.string().optional()
-      })
-    }),
-    toolUseKind: "readonly"
-  }
+z.discriminatedUnion("type", [startMessageSchema, ...harnessV1BridgeInboundCommandSchemas]);
+//#endregion
+//#region src/version.ts
+const VERSION = "1.0.137";
+//#endregion
+//#region src/codex-harness.ts
+const DEFAULT_CODEX_MODEL = "gpt-5.5";
+/**
+* Value to use in User-Agent and `x-client-app` headers.
+*/
+const CODEX_CLIENT_APP = `ai-sdk-harness-codex/${VERSION}`;
+const CODEX_BUILTIN_TOOLS = {
+	bash: commonTool("bash", {
+		nativeName: "shell",
+		toolUseKind: "bash",
+		description: "Execute a shell command",
+		inputSchema: z.object({ command: z.string() })
+	}),
+	webSearch: commonTool("webSearch", {
+		nativeName: "web_search",
+		toolUseKind: "readonly",
+		description: "Search the web",
+		inputSchema: z.object({ query: z.string() })
+	}),
+	apply_patch: {
+		...tool({
+			description: "Apply a patch to files",
+			inputSchema: z.string()
+		}),
+		toolUseKind: "edit"
+	},
+	view_image: {
+		...tool({
+			description: "View a local image file",
+			inputSchema: z.object({
+				path: z.string(),
+				detail: z.enum(["high", "original"]).optional(),
+				environment_id: z.string().optional()
+			})
+		}),
+		toolUseKind: "readonly"
+	}
 };
-var codexBridgeCoordsSchema = z2.object({
-  port: z2.number(),
-  token: z2.string(),
-  lastSeenEventId: z2.number(),
-  sandboxId: z2.string().optional()
+/**
+* Live bridge coordinates returned by `doDetach()` and `doSuspendTurn()`. A
+* future process uses them to reopen a socket to the still-running bridge
+* (`attach`) instead of re-spawning it. Absent on a `doStop()` payload.
+*/
+const codexBridgeCoordsSchema = z.object({
+	port: z.number(),
+	token: z.string(),
+	lastSeenEventId: z.number(),
+	sandboxId: z.string().optional()
 });
-var codexResumeStateSchema = z2.object({
-  threadId: z2.string().optional(),
-  turnConfigurationFingerprint: z2.string().optional(),
-  bridge: codexBridgeCoordsSchema.optional(),
-  sandboxCredentialEnvironment: z2.record(z2.string(), z2.string()).optional()
+/**
+* Schema for the adapter-specific lifecycle `data` payload Codex produces.
+* `threadId` is what app-server's `thread/resume` method requires for the replay/rerun
+* rungs; the sandbox lookup is handled separately via
+* `provider.resumeSession({ sessionId })`. `bridge` carries live coordinates
+* for cross-process `attach` (present on `doDetach()` and `doSuspendTurn()`
+* payloads).
+*/
+const codexResumeStateSchema = z.object({
+	threadId: z.string().optional(),
+	turnConfigurationFingerprint: z.string().optional(),
+	bridge: codexBridgeCoordsSchema.optional(),
+	sandboxCredentialEnvironment: z.record(z.string(), z.string()).optional()
 });
 function createCodex(settings = {}) {
-  return {
-    specificationVersion: "harness-v1",
-    harnessId: "codex",
-    builtinTools: CODEX_BUILTIN_TOOLS,
-    supportsBuiltinToolFiltering: true,
-    supportsBuiltinToolApprovals: false,
-    lifecycleStateSchema: codexResumeStateSchema,
-    getBootstrap: getCodexBootstrap,
-    doStart: async (startOpts) => {
-      const model = DEFAULT_CODEX_MODEL;
-      if (startOpts.permissionMode != null && startOpts.permissionMode !== "allow-all") {
-        throw new HarnessCapabilityUnsupportedError({
-          message: "Harness 'codex' does not support built-in tool approval requests; use permissionMode: 'allow-all'.",
-          harnessId: "codex"
-        });
-      }
-      const sandboxSession = startOpts.sandboxSession;
-      const toolSafeSandboxSession = getRestrictedSandboxSession(sandboxSession);
-      const sandboxId = "id" in sandboxSession ? sandboxSession.id : void 0;
-      validateBasicSandboxSettings({
-        sandboxSession,
-        port: settings.port,
-        portEndpoint: settings.portEndpoint
-      });
-      if (settings.mintBridgeToken != null && sandboxId == null) {
-        throw new HarnessCapabilityUnsupportedError({
-          harnessId: "codex",
-          message: "The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id."
-        });
-      }
-      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
-      const isResume = lifecycleState != null;
-      const isContinue = startOpts.continueFrom != null;
-      const resumeData = isResume && typeof lifecycleState?.data === "object" ? lifecycleState.data : void 0;
-      const resumeThreadId = resumeData?.threadId;
-      const resumeThreadIdString = typeof resumeThreadId === "string" && resumeThreadId.length > 0 ? resumeThreadId : void 0;
-      const turnConfigurationFingerprint = typeof resumeData?.turnConfigurationFingerprint === "string" ? resumeData.turnConfigurationFingerprint : void 0;
-      const coords = resumeData?.bridge;
-      const authenticationMode = resolveCodexAuthenticationMode(settings.auth);
-      const resolvedAuthentication = await resolveCodexAuthentication({
-        auth: settings.auth,
-        authCredentialsStoreMode: settings.codexConfig?.cli_auth_credentials_store
-      });
-      const resolvedAuthEnvironment = resolvedAuthentication.environment;
-      let sandboxAuthEnvironment = resolvedAuthEnvironment;
-      let sandboxCredentialEnvironment;
-      let credentialsBrokered = false;
-      if ("addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
-        sandboxCredentialEnvironment = await resolveSandboxCredentialEnvironment({
-          environment: resolvedAuthEnvironment,
-          credentialEnvironmentVariables: CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,
-          credentialForwarding: settings.credentialForwarding,
-          previousSandboxCredentialEnvironment: resumeData?.sandboxCredentialEnvironment
-        });
-        sandboxAuthEnvironment = {
-          ...resolvedAuthEnvironment,
-          ...sandboxCredentialEnvironment
-        };
-        const requestTransformations = createCodexSubscriptionRequestTransformations({
-          env: resolvedAuthEnvironment,
-          sandboxEnv: sandboxAuthEnvironment,
-          auth: authenticationMode,
-          requestHeaders: resolvedAuthentication.requestHeaders
-        });
-        if (requestTransformations.length > 0) {
-          await sandboxSession.addRequestTransformations(
-            requestTransformations
-          );
-        }
-        credentialsBrokered = true;
-        if (requestTransformations.length > 0 && authenticationMode === "direct" && resolvedAuthEnvironment.OPENAI_BASE_URL == null) {
-          sandboxAuthEnvironment.OPENAI_BASE_URL = DEFAULT_OPENAI_BASE_URL;
-        }
-      }
-      const sandboxHomeDir = await resolveSandboxHomeDir({
-        sandbox: toolSafeSandboxSession,
-        abortSignal: startOpts.abortSignal
-      });
-      const stateDir = harnessStateDirectoryPath({ sandboxHomeDir });
-      const bootstrapDir = path.posix.resolve(stateDir, CODEX_BOOTSTRAP_DIR);
-      const workDir = startOpts.sessionWorkDir;
-      const sessionDataDir = harnessSessionDataDirectoryPath({
-        stateDirectory: stateDir,
-        sessionId: startOpts.sessionId
-      });
-      const bridgeStateDir = `${sessionDataDir}/bridge`;
-      const timeoutMs = settings.startupTimeoutMs ?? 12e4;
-      const report = startOpts.observability?.report;
-      const onDiagnostic = report ? (frame) => report(
-        harnessV1DiagnosticFromBridgeFrame(frame, {
-          sessionId: startOpts.sessionId,
-          timestamp: Date.now()
-        })
-      ) : void 0;
-      const onBridgeError = createBridgeErrorHandler({
-        harnessId: "codex",
-        sessionId: startOpts.sessionId
-      });
-      if (coords) {
-        try {
-          const endpoint2 = await resolveBridgeEndpoint({
-            sandboxSession,
-            override: settings.portEndpoint,
-            port: coords.port
-          });
-          const attachEndpoint = withBridgeToken({
-            endpoint: endpoint2,
-            token: coords.token
-          });
-          const attachChannel = new SandboxChannel({
-            connect: ({ abortSignal }) => openWebSocket({ ...attachEndpoint, abortSignal }),
-            outboundSchema: outboundMessageSchema,
-            initialLastSeenEventId: coords.lastSeenEventId,
-            onDiagnostic,
-            onBridgeError,
-            reconnect: settings.reconnect
-          });
-          await attachChannel.open(isContinue ? { resume: true } : void 0);
-          return createSession({
-            sessionId: startOpts.sessionId,
-            channel: attachChannel,
-            // The live bridge was spawned by another process; no process handle.
-            proc: void 0,
-            model,
-            reasoningEffort: settings.reasoningEffort,
-            webSearch: settings.webSearch,
-            builtinToolFiltering: startOpts.builtinToolFiltering,
-            codexConfig: settings.codexConfig,
-            mcpServers: settings.mcpServers,
-            headers: startOpts.headers,
-            resumeThreadId: resumeThreadIdString,
-            isResume: true,
-            seedResumeThreadOnFirstPrompt: false,
-            rerunContinue: false,
-            bridgePort: coords.port,
-            bridgeToken: coords.token,
-            sandboxId,
-            sandboxCredentialEnvironment,
-            debug: startOpts.observability?.debug,
-            permissionMode: startOpts.permissionMode,
-            sandbox: toolSafeSandboxSession,
-            sandboxHomeDir,
-            turnConfigurationFingerprint
-          });
-        } catch {
-        }
-      }
-      let respawnStrategy = isResume ? "rerun" : void 0;
-      if (coords && isContinue) {
-        const logRaw = await Promise.resolve(
-          toolSafeSandboxSession.readTextFile({
-            path: `${bridgeStateDir}/event-log.ndjson`,
-            abortSignal: startOpts.abortSignal
-          })
-        ).catch(() => null);
-        if (await classifyDiskLog(logRaw) === "replay") {
-          respawnStrategy = "replay";
-        }
-      }
-      const port = resolveBridgePort({
-        sandboxSession,
-        override: settings.port
-      });
-      const token = settings.mintBridgeToken == null ? createBridgeToken() : settings.mintBridgeToken(sandboxId);
-      const forwardedAuthEnvironment = credentialsBrokered ? sandboxAuthEnvironment : await applyCredentialForwarding({
-        environment: sandboxAuthEnvironment,
-        credentialEnvironmentVariables: CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,
-        credentialForwarding: settings.credentialForwarding
-      });
-      if (!credentialsBrokered) {
-        warnCredentialBrokeringUnavailable({
-          environment: resolvedAuthEnvironment,
-          forwardedEnvironment: forwardedAuthEnvironment,
-          credentialEnvironmentVariables: CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES
-        });
-      }
-      const env = {
-        ...forwardedAuthEnvironment,
-        AI_SDK_HARNESS_CLIENT_APP: CODEX_CLIENT_APP,
-        BRIDGE_CHANNEL_TOKEN: token,
-        BRIDGE_WS_PORT: String(port),
-        ...respawnStrategy === "replay" ? { BRIDGE_REPLAY_FROM_DISK: "1" } : {}
-      };
-      if (respawnStrategy === void 0) {
-        await toolSafeSandboxSession.run({
-          command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,
-          abortSignal: startOpts.abortSignal
-        });
-      }
-      await markBridgeStarting({
-        sandbox: toolSafeSandboxSession,
-        bridgeStateDir,
-        bridgeType: "codex",
-        abortSignal: startOpts.abortSignal
-      });
-      const proc = await toolSafeSandboxSession.spawn({
-        command: `node ${shellQuote(`${bootstrapDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)}`,
-        env,
-        abortSignal: startOpts.abortSignal
-      });
-      const stderrTail = [];
-      const bridgeStderrDone = forwardBridgeProcessStream({
-        stream: proc.stderr,
-        streamName: "stderr",
-        source: "codex",
-        collectTail: stderrTail
-      });
-      const { port: boundPort } = await waitForBridgeReady({
-        proc,
-        sandbox: toolSafeSandboxSession,
-        bridgeStateDir,
-        bridgeType: "codex",
-        timeoutMs,
-        abortSignal: startOpts.abortSignal,
-        createTimeoutError: ({ proc: proc2, stdoutTail }) => createBridgeStartupError({
-          message: "codex bridge did not become ready in time.",
-          proc: proc2,
-          stdoutTail,
-          stderrTail,
-          stderrDone: bridgeStderrDone
-        }),
-        createExitError: ({ proc: proc2, stdoutTail }) => createBridgeStartupError({
-          message: "codex bridge exited before becoming ready.",
-          proc: proc2,
-          stdoutTail,
-          stderrTail,
-          stderrDone: bridgeStderrDone
-        })
-      });
-      void drainBridgeProcessStream(proc.stdout);
-      const endpoint = await resolveBridgeEndpoint({
-        sandboxSession,
-        override: settings.portEndpoint,
-        port: boundPort
-      });
-      const bridgeEndpoint = withBridgeToken({ endpoint, token });
-      const channel = new SandboxChannel({
-        connect: ({ abortSignal }) => openWebSocket({ ...bridgeEndpoint, abortSignal }),
-        outboundSchema: outboundMessageSchema,
-        onDiagnostic,
-        onBridgeError,
-        reconnect: settings.reconnect,
-        // In replay mode the respawned bridge reloaded the finished turn from
-        // disk; seed the cursor and resume so it streams the tail (incl.
-        // `finish`).
-        ...respawnStrategy === "replay" ? { initialLastSeenEventId: coords?.lastSeenEventId ?? 0 } : {}
-      });
-      await channel.open(
-        respawnStrategy === "replay" ? { resume: true } : void 0
-      );
-      return createSession({
-        sessionId: startOpts.sessionId,
-        channel,
-        proc,
-        model,
-        reasoningEffort: settings.reasoningEffort,
-        webSearch: settings.webSearch,
-        builtinToolFiltering: startOpts.builtinToolFiltering,
-        codexConfig: settings.codexConfig,
-        mcpServers: settings.mcpServers,
-        headers: startOpts.headers,
-        resumeThreadId: resumeThreadIdString,
-        isResume: respawnStrategy !== void 0,
-        seedResumeThreadOnFirstPrompt: respawnStrategy !== void 0,
-        rerunContinue: respawnStrategy === "rerun",
-        bridgePort: boundPort,
-        bridgeToken: token,
-        sandboxId,
-        sandboxCredentialEnvironment,
-        debug: startOpts.observability?.debug,
-        permissionMode: startOpts.permissionMode,
-        sandbox: toolSafeSandboxSession,
-        sandboxHomeDir,
-        turnConfigurationFingerprint
-      });
-    }
-  };
+	return {
+		specificationVersion: "harness-v1",
+		harnessId: "codex",
+		builtinTools: CODEX_BUILTIN_TOOLS,
+		supportsBuiltinToolFiltering: true,
+		supportsBuiltinToolApprovals: false,
+		lifecycleStateSchema: codexResumeStateSchema,
+		getBootstrap: getCodexBootstrap,
+		doStart: async (startOpts) => {
+			const model = DEFAULT_CODEX_MODEL;
+			if (startOpts.permissionMode != null && startOpts.permissionMode !== "allow-all") throw new HarnessCapabilityUnsupportedError({
+				message: "Harness 'codex' does not support built-in tool approval requests; use permissionMode: 'allow-all'.",
+				harnessId: "codex"
+			});
+			const sandboxSession = startOpts.sandboxSession;
+			const toolSafeSandboxSession = getRestrictedSandboxSession(sandboxSession);
+			const sandboxId = "id" in sandboxSession ? sandboxSession.id : void 0;
+			validateBasicSandboxSettings({
+				sandboxSession,
+				port: settings.port,
+				portEndpoint: settings.portEndpoint
+			});
+			if (settings.mintBridgeToken != null && sandboxId == null) throw new HarnessCapabilityUnsupportedError({
+				harnessId: "codex",
+				message: "The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id."
+			});
+			const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
+			const isResume = lifecycleState != null;
+			const isContinue = startOpts.continueFrom != null;
+			const resumeData = isResume && typeof lifecycleState?.data === "object" ? lifecycleState.data : void 0;
+			const resumeThreadId = resumeData?.threadId;
+			const resumeThreadIdString = typeof resumeThreadId === "string" && resumeThreadId.length > 0 ? resumeThreadId : void 0;
+			const turnConfigurationFingerprint = typeof resumeData?.turnConfigurationFingerprint === "string" ? resumeData.turnConfigurationFingerprint : void 0;
+			const coords = resumeData?.bridge;
+			const authenticationMode = resolveCodexAuthenticationMode(settings.auth);
+			const resolvedAuthentication = await resolveCodexAuthentication({
+				auth: settings.auth,
+				authCredentialsStoreMode: settings.codexConfig?.cli_auth_credentials_store
+			});
+			const resolvedAuthEnvironment = resolvedAuthentication.environment;
+			let sandboxAuthEnvironment = resolvedAuthEnvironment;
+			let sandboxCredentialEnvironment;
+			let credentialsBrokered = false;
+			if ("addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
+				sandboxCredentialEnvironment = await resolveSandboxCredentialEnvironment({
+					environment: resolvedAuthEnvironment,
+					credentialEnvironmentVariables: CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,
+					credentialForwarding: settings.credentialForwarding,
+					previousSandboxCredentialEnvironment: resumeData?.sandboxCredentialEnvironment
+				});
+				sandboxAuthEnvironment = {
+					...resolvedAuthEnvironment,
+					...sandboxCredentialEnvironment
+				};
+				const requestTransformations = createCodexSubscriptionRequestTransformations({
+					env: resolvedAuthEnvironment,
+					sandboxEnv: sandboxAuthEnvironment,
+					auth: authenticationMode,
+					requestHeaders: resolvedAuthentication.requestHeaders
+				});
+				if (requestTransformations.length > 0) await sandboxSession.addRequestTransformations(requestTransformations);
+				credentialsBrokered = true;
+				if (requestTransformations.length > 0 && authenticationMode === "direct" && resolvedAuthEnvironment.OPENAI_BASE_URL == null) sandboxAuthEnvironment.OPENAI_BASE_URL = DEFAULT_OPENAI_BASE_URL;
+			}
+			const sandboxHomeDir = await resolveSandboxHomeDir({
+				sandbox: toolSafeSandboxSession,
+				abortSignal: startOpts.abortSignal
+			});
+			const stateDir = harnessStateDirectoryPath({ sandboxHomeDir });
+			const bootstrapDir = path.posix.resolve(stateDir, CODEX_BOOTSTRAP_DIR);
+			const workDir = startOpts.sessionWorkDir;
+			const bridgeStateDir = `${harnessSessionDataDirectoryPath({
+				stateDirectory: stateDir,
+				sessionId: startOpts.sessionId
+			})}/bridge`;
+			const timeoutMs = settings.startupTimeoutMs ?? 12e4;
+			const report = startOpts.observability?.report;
+			const onDiagnostic = report ? (frame) => report(harnessV1DiagnosticFromBridgeFrame(frame, {
+				sessionId: startOpts.sessionId,
+				timestamp: Date.now()
+			})) : void 0;
+			const onBridgeError = createBridgeErrorHandler({
+				harnessId: "codex",
+				sessionId: startOpts.sessionId
+			});
+			if (coords) try {
+				const endpoint = await resolveBridgeEndpoint({
+					sandboxSession,
+					override: settings.portEndpoint,
+					port: coords.port
+				});
+				const attachEndpoint = withBridgeToken({
+					endpoint,
+					token: coords.token
+				});
+				const attachChannel = new SandboxChannel({
+					connect: ({ abortSignal }) => openWebSocket({
+						...attachEndpoint,
+						abortSignal
+					}),
+					outboundSchema: outboundMessageSchema,
+					initialLastSeenEventId: coords.lastSeenEventId,
+					onDiagnostic,
+					onBridgeError,
+					reconnect: settings.reconnect
+				});
+				await attachChannel.open(isContinue ? { resume: true } : void 0);
+				return createSession({
+					sessionId: startOpts.sessionId,
+					channel: attachChannel,
+					proc: void 0,
+					model,
+					reasoningEffort: settings.reasoningEffort,
+					webSearch: settings.webSearch,
+					builtinToolFiltering: startOpts.builtinToolFiltering,
+					codexConfig: settings.codexConfig,
+					mcpServers: settings.mcpServers,
+					headers: startOpts.headers,
+					resumeThreadId: resumeThreadIdString,
+					isResume: true,
+					seedResumeThreadOnFirstPrompt: false,
+					rerunContinue: false,
+					bridgePort: coords.port,
+					bridgeToken: coords.token,
+					sandboxId,
+					sandboxCredentialEnvironment,
+					debug: startOpts.observability?.debug,
+					permissionMode: startOpts.permissionMode,
+					sandbox: toolSafeSandboxSession,
+					sandboxHomeDir,
+					turnConfigurationFingerprint
+				});
+			} catch {}
+			let respawnStrategy = isResume ? "rerun" : void 0;
+			if (coords && isContinue) {
+				const logRaw = await Promise.resolve(toolSafeSandboxSession.readTextFile({
+					path: `${bridgeStateDir}/event-log.ndjson`,
+					abortSignal: startOpts.abortSignal
+				})).catch(() => null);
+				if (await classifyDiskLog(logRaw) === "replay") respawnStrategy = "replay";
+			}
+			const port = resolveBridgePort({
+				sandboxSession,
+				override: settings.port
+			});
+			const token = settings.mintBridgeToken == null ? createBridgeToken() : settings.mintBridgeToken(sandboxId);
+			const forwardedAuthEnvironment = credentialsBrokered ? sandboxAuthEnvironment : await applyCredentialForwarding({
+				environment: sandboxAuthEnvironment,
+				credentialEnvironmentVariables: CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,
+				credentialForwarding: settings.credentialForwarding
+			});
+			if (!credentialsBrokered) warnCredentialBrokeringUnavailable({
+				environment: resolvedAuthEnvironment,
+				forwardedEnvironment: forwardedAuthEnvironment,
+				credentialEnvironmentVariables: CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES
+			});
+			const env = {
+				...forwardedAuthEnvironment,
+				AI_SDK_HARNESS_CLIENT_APP: CODEX_CLIENT_APP,
+				BRIDGE_CHANNEL_TOKEN: token,
+				BRIDGE_WS_PORT: String(port),
+				...respawnStrategy === "replay" ? { BRIDGE_REPLAY_FROM_DISK: "1" } : {}
+			};
+			if (respawnStrategy === void 0) await toolSafeSandboxSession.run({
+				command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,
+				abortSignal: startOpts.abortSignal
+			});
+			await markBridgeStarting({
+				sandbox: toolSafeSandboxSession,
+				bridgeStateDir,
+				bridgeType: "codex",
+				abortSignal: startOpts.abortSignal
+			});
+			const proc = await toolSafeSandboxSession.spawn({
+				command: `node ${shellQuote(`${bootstrapDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)}`,
+				env,
+				abortSignal: startOpts.abortSignal
+			});
+			const stderrTail = [];
+			const bridgeStderrDone = forwardBridgeProcessStream({
+				stream: proc.stderr,
+				streamName: "stderr",
+				source: "codex",
+				collectTail: stderrTail
+			});
+			const { port: boundPort } = await waitForBridgeReady({
+				proc,
+				sandbox: toolSafeSandboxSession,
+				bridgeStateDir,
+				bridgeType: "codex",
+				timeoutMs,
+				abortSignal: startOpts.abortSignal,
+				createTimeoutError: ({ proc, stdoutTail }) => createBridgeStartupError({
+					message: "codex bridge did not become ready in time.",
+					proc,
+					stdoutTail,
+					stderrTail,
+					stderrDone: bridgeStderrDone
+				}),
+				createExitError: ({ proc, stdoutTail }) => createBridgeStartupError({
+					message: "codex bridge exited before becoming ready.",
+					proc,
+					stdoutTail,
+					stderrTail,
+					stderrDone: bridgeStderrDone
+				})
+			});
+			drainBridgeProcessStream(proc.stdout);
+			const endpoint = await resolveBridgeEndpoint({
+				sandboxSession,
+				override: settings.portEndpoint,
+				port: boundPort
+			});
+			const bridgeEndpoint = withBridgeToken({
+				endpoint,
+				token
+			});
+			const channel = new SandboxChannel({
+				connect: ({ abortSignal }) => openWebSocket({
+					...bridgeEndpoint,
+					abortSignal
+				}),
+				outboundSchema: outboundMessageSchema,
+				onDiagnostic,
+				onBridgeError,
+				reconnect: settings.reconnect,
+				...respawnStrategy === "replay" ? { initialLastSeenEventId: coords?.lastSeenEventId ?? 0 } : {}
+			});
+			await channel.open(respawnStrategy === "replay" ? { resume: true } : void 0);
+			return createSession({
+				sessionId: startOpts.sessionId,
+				channel,
+				proc,
+				model,
+				reasoningEffort: settings.reasoningEffort,
+				webSearch: settings.webSearch,
+				builtinToolFiltering: startOpts.builtinToolFiltering,
+				codexConfig: settings.codexConfig,
+				mcpServers: settings.mcpServers,
+				headers: startOpts.headers,
+				resumeThreadId: resumeThreadIdString,
+				isResume: respawnStrategy !== void 0,
+				seedResumeThreadOnFirstPrompt: respawnStrategy !== void 0,
+				rerunContinue: respawnStrategy === "rerun",
+				bridgePort: boundPort,
+				bridgeToken: token,
+				sandboxId,
+				sandboxCredentialEnvironment,
+				debug: startOpts.observability?.debug,
+				permissionMode: startOpts.permissionMode,
+				sandbox: toolSafeSandboxSession,
+				sandboxHomeDir,
+				turnConfigurationFingerprint
+			});
+		}
+	};
 }
-function resolveBridgePort({
-  sandboxSession,
-  override
-}) {
-  if (override !== void 0) return override;
-  if ("ports" in sandboxSession && sandboxSession.ports.length > 0) {
-    return sandboxSession.ports[0];
-  }
-  throw new HarnessCapabilityUnsupportedError({
-    harnessId: "codex",
-    message: "The codex harness needs a TCP port exposed by the sandbox. Create the sandbox with `ports: [<port>]` or pass `createCodex({ port })`."
-  });
+function resolveBridgePort({ sandboxSession, override }) {
+	if (override !== void 0) return override;
+	if ("ports" in sandboxSession && sandboxSession.ports.length > 0) return sandboxSession.ports[0];
+	throw new HarnessCapabilityUnsupportedError({
+		harnessId: "codex",
+		message: "The codex harness needs a TCP port exposed by the sandbox. Create the sandbox with `ports: [<port>]` or pass `createCodex({ port })`."
+	});
 }
-function validateBasicSandboxSettings({
-  sandboxSession,
-  port,
-  portEndpoint
-}) {
-  if ("getPortEndpoint" in sandboxSession) return;
-  if (port == null) {
-    throw new HarnessCapabilityUnsupportedError({
-      harnessId: "codex",
-      message: "The codex harness requires an explicit `port` when using a basic sandbox session."
-    });
-  }
-  if (portEndpoint == null) {
-    throw new HarnessCapabilityUnsupportedError({
-      harnessId: "codex",
-      message: "The codex harness requires an explicit `portEndpoint` when using a basic sandbox session."
-    });
-  }
+function validateBasicSandboxSettings({ sandboxSession, port, portEndpoint }) {
+	if ("getPortEndpoint" in sandboxSession) return;
+	if (port == null) throw new HarnessCapabilityUnsupportedError({
+		harnessId: "codex",
+		message: "The codex harness requires an explicit `port` when using a basic sandbox session."
+	});
+	if (portEndpoint == null) throw new HarnessCapabilityUnsupportedError({
+		harnessId: "codex",
+		message: "The codex harness requires an explicit `portEndpoint` when using a basic sandbox session."
+	});
 }
-async function resolveBridgeEndpoint({
-  sandboxSession,
-  override,
-  port
-}) {
-  if (override != null) return override;
-  if ("getPortEndpoint" in sandboxSession) {
-    return sandboxSession.getPortEndpoint({ port, protocol: "ws" });
-  }
-  throw new HarnessCapabilityUnsupportedError({
-    harnessId: "codex",
-    message: "The codex harness requires an explicit `portEndpoint` when using a basic sandbox session."
-  });
+async function resolveBridgeEndpoint({ sandboxSession, override, port }) {
+	if (override != null) return override;
+	if ("getPortEndpoint" in sandboxSession) return sandboxSession.getPortEndpoint({
+		port,
+		protocol: "ws"
+	});
+	throw new HarnessCapabilityUnsupportedError({
+		harnessId: "codex",
+		message: "The codex harness requires an explicit `portEndpoint` when using a basic sandbox session."
+	});
 }
-function openWebSocket({
-  url,
-  headers,
-  abortSignal
-}) {
-  return new Promise((resolve2, reject) => {
-    if (abortSignal.aborted) {
-      reject(abortSignal.reason ?? new Error("WebSocket connection aborted"));
-      return;
-    }
-    const ws = new WebSocket(url, {
-      headers: headers == null ? void 0 : { ...headers }
-    });
-    let settled = false;
-    const cleanup = () => {
-      abortSignal.removeEventListener("abort", onAbort);
-      ws.off("open", onOpen);
-      ws.off("error", onError);
-    };
-    const rejectWithCleanup = (error) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      ws.once("error", () => {
-      });
-      try {
-        ws.terminate();
-      } catch {
-        try {
-          ws.close();
-        } catch {
-        }
-      }
-      reject(error);
-    };
-    const onOpen = () => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      resolve2(ws);
-    };
-    const onError = (err) => {
-      rejectWithCleanup(err);
-    };
-    const onAbort = () => rejectWithCleanup(
-      abortSignal.reason ?? new Error("WebSocket connection aborted")
-    );
-    ws.once("open", onOpen);
-    ws.once("error", onError);
-    abortSignal.addEventListener("abort", onAbort, { once: true });
-  });
+function openWebSocket({ url, headers, abortSignal }) {
+	return new Promise((resolve, reject) => {
+		if (abortSignal.aborted) {
+			reject(abortSignal.reason ?? /* @__PURE__ */ new Error("WebSocket connection aborted"));
+			return;
+		}
+		const ws = new WebSocket(url, { headers: headers == null ? void 0 : { ...headers } });
+		let settled = false;
+		const cleanup = () => {
+			abortSignal.removeEventListener("abort", onAbort);
+			ws.off("open", onOpen);
+			ws.off("error", onError);
+		};
+		const rejectWithCleanup = (error) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			ws.once("error", () => {});
+			try {
+				ws.terminate();
+			} catch {
+				try {
+					ws.close();
+				} catch {}
+			}
+			reject(error);
+		};
+		const onOpen = () => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(ws);
+		};
+		const onError = (err) => {
+			rejectWithCleanup(err);
+		};
+		const onAbort = () => rejectWithCleanup(abortSignal.reason ?? /* @__PURE__ */ new Error("WebSocket connection aborted"));
+		ws.once("open", onOpen);
+		ws.once("error", onError);
+		abortSignal.addEventListener("abort", onAbort, { once: true });
+	});
 }
-function createSession({
-  sessionId,
-  channel,
-  proc,
-  model,
-  reasoningEffort,
-  webSearch,
-  builtinToolFiltering,
-  codexConfig,
-  mcpServers,
-  headers,
-  resumeThreadId,
-  isResume,
-  seedResumeThreadOnFirstPrompt,
-  rerunContinue,
-  bridgePort,
-  bridgeToken,
-  sandboxId,
-  sandboxCredentialEnvironment,
-  debug,
-  permissionMode,
-  sandbox,
-  sandboxHomeDir,
-  turnConfigurationFingerprint
-}) {
-  let stopped = false;
-  let stopPromise;
-  let pendingResumeThreadId = seedResumeThreadOnFirstPrompt ? resumeThreadId : void 0;
-  let latestThreadId = resumeThreadId;
-  let latestTurnConfigurationFingerprint = turnConfigurationFingerprint;
-  channel.on("bridge-thread", (msg) => {
-    latestThreadId = msg.threadId;
-  });
-  const synchronizeTurnConfiguration = async ({
-    skills,
-    instructions,
-    tools,
-    abortSignal
-  }) => {
-    const skillsResult = await writeSkills({
-      sandbox,
-      homePath: sandboxHomeDir,
-      skillsDir: ".agents/skills",
-      skills,
-      abortSignal,
-      invalidSkillNameMessage: ({ name }) => `Invalid Codex skill name: ${name}`,
-      invalidSkillFilePathMessage: ({ skillName, filePath }) => `Invalid Codex skill file path for ${skillName}: ${filePath}`
-    });
-    const nextFingerprint = fingerprintCodexTurnConfiguration({
-      instructions,
-      tools
-    });
-    const restartThread = latestThreadId != null && (skillsResult.changed || latestTurnConfigurationFingerprint != null && latestTurnConfigurationFingerprint !== nextFingerprint);
-    latestTurnConfigurationFingerprint = nextFingerprint;
-    if (restartThread) {
-      pendingResumeThreadId = void 0;
-    }
-    return { restartThread };
-  };
-  const wireTurn = (turnOpts) => {
-    let pendingResolve;
-    let pendingReject;
-    const done = new Promise((resolve2, reject) => {
-      pendingResolve = resolve2;
-      pendingReject = reject;
-    });
-    const userMessageSubmitter = experimental_createBridgeUserMessageSubmitter({
-      send: (message) => channel.send(message),
-      onResponse: (listener) => channel.on("user-message-response", listener),
-      onReconnect: (listener) => channel.onReconnect(listener)
-    });
-    const unsubs = [];
-    const forward = (event) => {
-      try {
-        turnOpts.emit(event);
-      } catch {
-      }
-    };
-    const eventTypes = [
-      "stream-start",
-      "text-start",
-      "text-delta",
-      "text-end",
-      "reasoning-start",
-      "reasoning-delta",
-      "reasoning-end",
-      "tool-call",
-      "tool-approval-request",
-      "tool-result",
-      "file-change",
-      "finish-step",
-      "raw"
-    ];
-    let isSettled = false;
-    const settleSuccess = () => {
-      if (isSettled) return;
-      isSettled = true;
-      userMessageSubmitter.close();
-      for (const u of unsubs) u();
-      pendingResolve();
-    };
-    const settleError = (err) => {
-      if (isSettled) return;
-      isSettled = true;
-      userMessageSubmitter.close(err);
-      for (const u of unsubs) u();
-      pendingReject(err);
-    };
-    for (const type of eventTypes) {
-      unsubs.push(
-        channel.on(type, (msg) => {
-          forward(msg);
-        })
-      );
-    }
-    unsubs.push(
-      channel.on("finish", (msg) => {
-        forward(msg);
-        settleSuccess();
-      })
-    );
-    unsubs.push(
-      channel.on("error", (msg) => {
-        forward(msg);
-        settleError(msg.error);
-      })
-    );
-    const onClose = (_code, reason) => {
-      if (isSettled) return;
-      if (reason === "suspended") {
-        settleSuccess();
-        return;
-      }
-      settleError(new Error("codex bridge closed before the turn finished."));
-    };
-    channel.onClose(onClose);
-    const onAbort = () => {
-      if (isSettled) return;
-      try {
-        channel.send({ type: "abort" });
-      } catch {
-      }
-      settleError(
-        turnOpts.abortSignal?.reason ?? new DOMException("Aborted", "AbortError")
-      );
-    };
-    if (turnOpts.abortSignal) {
-      if (turnOpts.abortSignal.aborted) {
-        onAbort();
-      } else {
-        turnOpts.abortSignal.addEventListener("abort", onAbort, {
-          once: true
-        });
-      }
-    }
-    const control = {
-      submitToolResult: async (input) => {
-        channel.send({
-          type: "tool-result",
-          toolCallId: input.toolCallId,
-          output: input.output,
-          isError: input.isError
-        });
-      },
-      submitToolApproval: async (input) => {
-        channel.send({
-          type: "tool-approval-response",
-          approvalId: input.approvalId,
-          approved: input.approved,
-          reason: input.reason
-        });
-      },
-      submitUserMessage: async (text) => {
-        await userMessageSubmitter.submit(text);
-      },
-      done
-    };
-    return {
-      control,
-      sendStart: (send) => {
-        const timer = setTimeout(() => {
-          if (isSettled) return;
-          try {
-            send();
-          } catch (err) {
-            settleError(err);
-          }
-        }, 0);
-        timer.unref?.();
-      }
-    };
-  };
-  return {
-    sessionId,
-    isResume,
-    doPromptTurn: async (promptOpts) => {
-      if (promptOpts.responseFormat?.type === "json" && promptOpts.responseFormat.schema == null) {
-        throw new HarnessCapabilityUnsupportedError({
-          message: "Harness 'codex' requires a JSON schema for structured output.",
-          harnessId: "codex"
-        });
-      }
-      const tools = (promptOpts.tools ?? []).map((t) => ({
-        name: t.name,
-        description: t.description,
-        inputSchema: t.inputSchema
-      }));
-      const { restartThread } = await synchronizeTurnConfiguration({
-        skills: promptOpts.skills,
-        instructions: promptOpts.instructions,
-        tools,
-        abortSignal: promptOpts.abortSignal
-      });
-      const turn = wireTurn({
-        emit: promptOpts.emit,
-        abortSignal: promptOpts.abortSignal
-      });
-      const startMessage = {
-        type: "start",
-        prompt: extractUserText(promptOpts.prompt),
-        tools,
-        ...promptOpts.responseFormat == null ? {} : { responseFormat: promptOpts.responseFormat },
-        ...promptOpts.instructions ? { instructions: promptOpts.instructions } : {},
-        model: promptOpts.model ?? model,
-        reasoningEffort,
-        webSearch,
-        ...builtinToolFiltering == null ? {} : { builtinToolFiltering },
-        ...codexConfig == null ? {} : { codexConfig },
-        ...mcpServers == null ? {} : { mcpServers },
-        ...headers == null ? {} : { headers },
-        ...permissionMode ? { permissionMode } : {},
-        ...pendingResumeThreadId ? { resumeThreadId: pendingResumeThreadId } : {},
-        ...restartThread ? { restartThread: true } : {},
-        ...debug ? { debug } : {}
-      };
-      pendingResumeThreadId = void 0;
-      turn.sendStart(() => channel.send(startMessage));
-      return turn.control;
-    },
-    doContinueTurn: async (continueOpts) => {
-      if (continueOpts.responseFormat?.type === "json" && continueOpts.responseFormat.schema == null) {
-        throw new HarnessCapabilityUnsupportedError({
-          message: "Harness 'codex' requires a JSON schema for structured output.",
-          harnessId: "codex"
-        });
-      }
-      const tools = (continueOpts.tools ?? []).map((t) => ({
-        name: t.name,
-        description: t.description,
-        inputSchema: t.inputSchema
-      }));
-      const { restartThread } = await synchronizeTurnConfiguration({
-        skills: continueOpts.skills,
-        instructions: continueOpts.instructions,
-        tools,
-        abortSignal: continueOpts.abortSignal
-      });
-      const turn = wireTurn({
-        emit: continueOpts.emit,
-        abortSignal: continueOpts.abortSignal
-      });
-      if (rerunContinue) {
-        const threadId = pendingResumeThreadId ?? latestThreadId;
-        pendingResumeThreadId = void 0;
-        turn.sendStart(
-          () => channel.send({
-            type: "start",
-            /*
-             * A continuation nudge rather than an empty prompt: `resumeThreadId`
-             * rehydrates the prior thread, and this is the new user turn that
-             * drives it forward. Keeping it non-empty avoids handing the runtime
-             * an empty user message (and mirrors the claude-code adapter, where an
-             * empty text block trips the Anthropic API's `cache_control` rule).
-             */
-            prompt: "Continue.",
-            tools,
-            ...continueOpts.responseFormat == null ? {} : { responseFormat: continueOpts.responseFormat },
-            ...continueOpts.instructions ? { instructions: continueOpts.instructions } : {},
-            model: continueOpts.model ?? model,
-            reasoningEffort,
-            webSearch,
-            ...builtinToolFiltering == null ? {} : { builtinToolFiltering },
-            ...codexConfig == null ? {} : { codexConfig },
-            ...mcpServers == null ? {} : { mcpServers },
-            ...headers == null ? {} : { headers },
-            ...permissionMode ? { permissionMode } : {},
-            ...threadId ? { resumeThreadId: threadId } : {},
-            ...restartThread ? { restartThread: true } : {},
-            ...debug ? { debug } : {}
-          })
-        );
-      }
-      return turn.control;
-    },
-    doCompact: async () => {
-      throw new HarnessCapabilityUnsupportedError({
-        message: "Harness 'codex' does not support manual compaction; Codex auto-compacts its context internally.",
-        harnessId: "codex"
-      });
-    },
-    doDetach: async () => {
-      if (stopped) {
-        throw new Error(
-          `codex session ${sessionId} is already stopped; cannot detach.`
-        );
-      }
-      stopped = true;
-      const lastSeenEventId = await channel.suspend();
-      const payload = {
-        type: "resume-session",
-        harnessId: "codex",
-        specificationVersion: "harness-v1",
-        data: {
-          ...latestThreadId ? { threadId: latestThreadId } : {},
-          ...latestTurnConfigurationFingerprint ? {
-            turnConfigurationFingerprint: latestTurnConfigurationFingerprint
-          } : {},
-          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
-          bridge: {
-            port: bridgePort,
-            token: bridgeToken,
-            lastSeenEventId,
-            ...sandboxId == null ? {} : { sandboxId }
-          }
-        }
-      };
-      return payload;
-    },
-    doDestroy: async () => {
-      if (stopped) return stopPromise;
-      stopped = true;
-      stopPromise = (async () => {
-        channel.beginClose();
-        try {
-          if (!channel.isClosed()) {
-            channel.send({ type: "destroy" });
-          }
-        } catch {
-        }
-        let stopTimer;
-        try {
-          if (proc) {
-            await Promise.race([
-              proc.wait(),
-              new Promise((resolve2) => {
-                stopTimer = setTimeout(resolve2, 5e3);
-                stopTimer.unref?.();
-              })
-            ]);
-          }
-        } finally {
-          if (stopTimer) clearTimeout(stopTimer);
-          try {
-            await proc?.kill();
-          } catch {
-          }
-          channel.close();
-        }
-      })();
-      return stopPromise;
-    },
-    doStop: async () => {
-      if (stopped) {
-        throw new Error(
-          `codex session ${sessionId} is already stopped; cannot stop.`
-        );
-      }
-      stopped = true;
-      channel.beginClose();
-      const data = channel.isClosed() ? {} : await new Promise((resolve2, reject) => {
-        const timer = setTimeout(() => {
-          unsub();
-          reject(
-            new Error(
-              `codex session ${sessionId} did not reply to stop within 5s.`
-            )
-          );
-        }, 5e3);
-        timer.unref?.();
-        const unsub = channel.on("bridge-stop", (msg) => {
-          clearTimeout(timer);
-          unsub();
-          resolve2(msg.data);
-        });
-        try {
-          channel.send({ type: "stop" });
-        } catch (err) {
-          clearTimeout(timer);
-          unsub();
-          reject(err);
-        }
-      });
-      let stopTimer;
-      try {
-        if (proc) {
-          await Promise.race([
-            proc.wait(),
-            new Promise((resolve2) => {
-              stopTimer = setTimeout(resolve2, 5e3);
-              stopTimer.unref?.();
-            })
-          ]);
-        }
-      } finally {
-        if (stopTimer) clearTimeout(stopTimer);
-        try {
-          await proc?.kill();
-        } catch {
-        }
-        channel.close();
-      }
-      const lifecycleData = data != null && typeof data === "object" && !Array.isArray(data) ? { ...data } : {};
-      const payload = {
-        type: "resume-session",
-        harnessId: "codex",
-        specificationVersion: "harness-v1",
-        data: {
-          ...lifecycleData,
-          ...latestTurnConfigurationFingerprint ? {
-            turnConfigurationFingerprint: latestTurnConfigurationFingerprint
-          } : {},
-          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment }
-        }
-      };
-      return payload;
-    },
-    doSuspendTurn: async () => {
-      if (stopped) {
-        throw new Error(
-          `codex session ${sessionId} is stopped; cannot suspend.`
-        );
-      }
-      stopped = true;
-      const lastSeenEventId = await channel.suspend();
-      const payload = {
-        type: "continue-turn",
-        harnessId: "codex",
-        specificationVersion: "harness-v1",
-        data: {
-          ...latestThreadId ? { threadId: latestThreadId } : {},
-          ...latestTurnConfigurationFingerprint ? {
-            turnConfigurationFingerprint: latestTurnConfigurationFingerprint
-          } : {},
-          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
-          bridge: {
-            port: bridgePort,
-            token: bridgeToken,
-            lastSeenEventId,
-            ...sandboxId == null ? {} : { sandboxId }
-          }
-        }
-      };
-      return payload;
-    }
-  };
+function createSession({ sessionId, channel, proc, model, reasoningEffort, webSearch, builtinToolFiltering, codexConfig, mcpServers, headers, resumeThreadId, isResume, seedResumeThreadOnFirstPrompt, rerunContinue, bridgePort, bridgeToken, sandboxId, sandboxCredentialEnvironment, debug, permissionMode, sandbox, sandboxHomeDir, turnConfigurationFingerprint }) {
+	let stopped = false;
+	let stopPromise;
+	let pendingResumeThreadId = seedResumeThreadOnFirstPrompt ? resumeThreadId : void 0;
+	let latestThreadId = resumeThreadId;
+	let latestTurnConfigurationFingerprint = turnConfigurationFingerprint;
+	channel.on("bridge-thread", (msg) => {
+		latestThreadId = msg.threadId;
+	});
+	const synchronizeTurnConfiguration = async ({ skills, instructions, tools, abortSignal }) => {
+		const skillsResult = await writeSkills({
+			sandbox,
+			homePath: sandboxHomeDir,
+			skillsDir: ".agents/skills",
+			skills,
+			abortSignal,
+			invalidSkillNameMessage: ({ name }) => `Invalid Codex skill name: ${name}`,
+			invalidSkillFilePathMessage: ({ skillName, filePath }) => `Invalid Codex skill file path for ${skillName}: ${filePath}`
+		});
+		const nextFingerprint = fingerprintCodexTurnConfiguration({
+			instructions,
+			tools
+		});
+		const restartThread = latestThreadId != null && (skillsResult.changed || latestTurnConfigurationFingerprint != null && latestTurnConfigurationFingerprint !== nextFingerprint);
+		latestTurnConfigurationFingerprint = nextFingerprint;
+		if (restartThread) pendingResumeThreadId = void 0;
+		return { restartThread };
+	};
+	const wireTurn = (turnOpts) => {
+		let pendingResolve;
+		let pendingReject;
+		const done = new Promise((resolve, reject) => {
+			pendingResolve = resolve;
+			pendingReject = reject;
+		});
+		const userMessageSubmitter = experimental_createBridgeUserMessageSubmitter({
+			send: (message) => channel.send(message),
+			onResponse: (listener) => channel.on("user-message-response", listener),
+			onReconnect: (listener) => channel.onReconnect(listener)
+		});
+		const unsubs = [];
+		const forward = (event) => {
+			try {
+				turnOpts.emit(event);
+			} catch {}
+		};
+		const eventTypes = [
+			"stream-start",
+			"text-start",
+			"text-delta",
+			"text-end",
+			"reasoning-start",
+			"reasoning-delta",
+			"reasoning-end",
+			"tool-call",
+			"tool-approval-request",
+			"tool-result",
+			"file-change",
+			"finish-step",
+			"raw"
+		];
+		let isSettled = false;
+		const settleSuccess = () => {
+			if (isSettled) return;
+			isSettled = true;
+			userMessageSubmitter.close();
+			for (const u of unsubs) u();
+			pendingResolve();
+		};
+		const settleError = (err) => {
+			if (isSettled) return;
+			isSettled = true;
+			userMessageSubmitter.close(err);
+			for (const u of unsubs) u();
+			pendingReject(err);
+		};
+		for (const type of eventTypes) unsubs.push(channel.on(type, (msg) => {
+			forward(msg);
+		}));
+		unsubs.push(channel.on("finish", (msg) => {
+			forward(msg);
+			settleSuccess();
+		}));
+		unsubs.push(channel.on("error", (msg) => {
+			forward(msg);
+			settleError(msg.error);
+		}));
+		const onClose = (_code, reason) => {
+			if (isSettled) return;
+			if (reason === "suspended") {
+				settleSuccess();
+				return;
+			}
+			settleError(/* @__PURE__ */ new Error("codex bridge closed before the turn finished."));
+		};
+		channel.onClose(onClose);
+		const onAbort = () => {
+			if (isSettled) return;
+			try {
+				channel.send({ type: "abort" });
+			} catch {}
+			settleError(turnOpts.abortSignal?.reason ?? new DOMException("Aborted", "AbortError"));
+		};
+		if (turnOpts.abortSignal) {
+			if (turnOpts.abortSignal.aborted) onAbort();
+			else turnOpts.abortSignal.addEventListener("abort", onAbort, { once: true });
+		}
+		return {
+			control: {
+				submitToolResult: async (input) => {
+					channel.send({
+						type: "tool-result",
+						toolCallId: input.toolCallId,
+						output: input.output,
+						isError: input.isError
+					});
+				},
+				submitToolApproval: async (input) => {
+					channel.send({
+						type: "tool-approval-response",
+						approvalId: input.approvalId,
+						approved: input.approved,
+						reason: input.reason
+					});
+				},
+				submitUserMessage: async (text) => {
+					await userMessageSubmitter.submit(text);
+				},
+				done
+			},
+			sendStart: (send) => {
+				setTimeout(() => {
+					if (isSettled) return;
+					try {
+						send();
+					} catch (err) {
+						settleError(err);
+					}
+				}, 0).unref?.();
+			}
+		};
+	};
+	return {
+		sessionId,
+		isResume,
+		doPromptTurn: async (promptOpts) => {
+			if (promptOpts.responseFormat?.type === "json" && promptOpts.responseFormat.schema == null) throw new HarnessCapabilityUnsupportedError({
+				message: "Harness 'codex' requires a JSON schema for structured output.",
+				harnessId: "codex"
+			});
+			const tools = (promptOpts.tools ?? []).map((t) => ({
+				name: t.name,
+				description: t.description,
+				inputSchema: t.inputSchema
+			}));
+			const { restartThread } = await synchronizeTurnConfiguration({
+				skills: promptOpts.skills,
+				instructions: promptOpts.instructions,
+				tools,
+				abortSignal: promptOpts.abortSignal
+			});
+			const turn = wireTurn({
+				emit: promptOpts.emit,
+				abortSignal: promptOpts.abortSignal
+			});
+			const startMessage = {
+				type: "start",
+				prompt: extractUserText(promptOpts.prompt),
+				tools,
+				...promptOpts.responseFormat == null ? {} : { responseFormat: promptOpts.responseFormat },
+				...promptOpts.instructions ? { instructions: promptOpts.instructions } : {},
+				model: promptOpts.model ?? model,
+				reasoningEffort,
+				webSearch,
+				...builtinToolFiltering == null ? {} : { builtinToolFiltering },
+				...codexConfig == null ? {} : { codexConfig },
+				...mcpServers == null ? {} : { mcpServers },
+				...headers == null ? {} : { headers },
+				...permissionMode ? { permissionMode } : {},
+				...pendingResumeThreadId ? { resumeThreadId: pendingResumeThreadId } : {},
+				...restartThread ? { restartThread: true } : {},
+				...debug ? { debug } : {}
+			};
+			pendingResumeThreadId = void 0;
+			turn.sendStart(() => channel.send(startMessage));
+			return turn.control;
+		},
+		doContinueTurn: async (continueOpts) => {
+			if (continueOpts.responseFormat?.type === "json" && continueOpts.responseFormat.schema == null) throw new HarnessCapabilityUnsupportedError({
+				message: "Harness 'codex' requires a JSON schema for structured output.",
+				harnessId: "codex"
+			});
+			const tools = (continueOpts.tools ?? []).map((t) => ({
+				name: t.name,
+				description: t.description,
+				inputSchema: t.inputSchema
+			}));
+			const { restartThread } = await synchronizeTurnConfiguration({
+				skills: continueOpts.skills,
+				instructions: continueOpts.instructions,
+				tools,
+				abortSignal: continueOpts.abortSignal
+			});
+			const turn = wireTurn({
+				emit: continueOpts.emit,
+				abortSignal: continueOpts.abortSignal
+			});
+			if (rerunContinue) {
+				const threadId = pendingResumeThreadId ?? latestThreadId;
+				pendingResumeThreadId = void 0;
+				turn.sendStart(() => channel.send({
+					type: "start",
+					prompt: "Continue.",
+					tools,
+					...continueOpts.responseFormat == null ? {} : { responseFormat: continueOpts.responseFormat },
+					...continueOpts.instructions ? { instructions: continueOpts.instructions } : {},
+					model: continueOpts.model ?? model,
+					reasoningEffort,
+					webSearch,
+					...builtinToolFiltering == null ? {} : { builtinToolFiltering },
+					...codexConfig == null ? {} : { codexConfig },
+					...mcpServers == null ? {} : { mcpServers },
+					...headers == null ? {} : { headers },
+					...permissionMode ? { permissionMode } : {},
+					...threadId ? { resumeThreadId: threadId } : {},
+					...restartThread ? { restartThread: true } : {},
+					...debug ? { debug } : {}
+				}));
+			}
+			return turn.control;
+		},
+		doCompact: async () => {
+			throw new HarnessCapabilityUnsupportedError({
+				message: "Harness 'codex' does not support manual compaction; Codex auto-compacts its context internally.",
+				harnessId: "codex"
+			});
+		},
+		doDetach: async () => {
+			if (stopped) throw new Error(`codex session ${sessionId} is already stopped; cannot detach.`);
+			stopped = true;
+			const lastSeenEventId = await channel.suspend();
+			return {
+				type: "resume-session",
+				harnessId: "codex",
+				specificationVersion: "harness-v1",
+				data: {
+					...latestThreadId ? { threadId: latestThreadId } : {},
+					...latestTurnConfigurationFingerprint ? { turnConfigurationFingerprint: latestTurnConfigurationFingerprint } : {},
+					...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
+					bridge: {
+						port: bridgePort,
+						token: bridgeToken,
+						lastSeenEventId,
+						...sandboxId == null ? {} : { sandboxId }
+					}
+				}
+			};
+		},
+		doDestroy: async () => {
+			if (stopped) return stopPromise;
+			stopped = true;
+			stopPromise = (async () => {
+				channel.beginClose();
+				try {
+					if (!channel.isClosed()) channel.send({ type: "destroy" });
+				} catch {}
+				let stopTimer;
+				try {
+					if (proc) await Promise.race([proc.wait(), new Promise((resolve) => {
+						stopTimer = setTimeout(resolve, 5e3);
+						stopTimer.unref?.();
+					})]);
+				} finally {
+					if (stopTimer) clearTimeout(stopTimer);
+					try {
+						await proc?.kill();
+					} catch {}
+					channel.close();
+				}
+			})();
+			return stopPromise;
+		},
+		doStop: async () => {
+			if (stopped) throw new Error(`codex session ${sessionId} is already stopped; cannot stop.`);
+			stopped = true;
+			channel.beginClose();
+			const data = channel.isClosed() ? {} : await new Promise((resolve, reject) => {
+				const timer = setTimeout(() => {
+					unsub();
+					reject(/* @__PURE__ */ new Error(`codex session ${sessionId} did not reply to stop within 5s.`));
+				}, 5e3);
+				timer.unref?.();
+				const unsub = channel.on("bridge-stop", (msg) => {
+					clearTimeout(timer);
+					unsub();
+					resolve(msg.data);
+				});
+				try {
+					channel.send({ type: "stop" });
+				} catch (err) {
+					clearTimeout(timer);
+					unsub();
+					reject(err);
+				}
+			});
+			let stopTimer;
+			try {
+				if (proc) await Promise.race([proc.wait(), new Promise((resolve) => {
+					stopTimer = setTimeout(resolve, 5e3);
+					stopTimer.unref?.();
+				})]);
+			} finally {
+				if (stopTimer) clearTimeout(stopTimer);
+				try {
+					await proc?.kill();
+				} catch {}
+				channel.close();
+			}
+			return {
+				type: "resume-session",
+				harnessId: "codex",
+				specificationVersion: "harness-v1",
+				data: {
+					...data != null && typeof data === "object" && !Array.isArray(data) ? { ...data } : {},
+					...latestTurnConfigurationFingerprint ? { turnConfigurationFingerprint: latestTurnConfigurationFingerprint } : {},
+					...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment }
+				}
+			};
+		},
+		doSuspendTurn: async () => {
+			if (stopped) throw new Error(`codex session ${sessionId} is stopped; cannot suspend.`);
+			stopped = true;
+			const lastSeenEventId = await channel.suspend();
+			return {
+				type: "continue-turn",
+				harnessId: "codex",
+				specificationVersion: "harness-v1",
+				data: {
+					...latestThreadId ? { threadId: latestThreadId } : {},
+					...latestTurnConfigurationFingerprint ? { turnConfigurationFingerprint: latestTurnConfigurationFingerprint } : {},
+					...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
+					bridge: {
+						port: bridgePort,
+						token: bridgeToken,
+						lastSeenEventId,
+						...sandboxId == null ? {} : { sandboxId }
+					}
+				}
+			};
+		}
+	};
 }
-function fingerprintCodexTurnConfiguration({
-  instructions,
-  tools
-}) {
-  return createHash2("sha256").update(JSON.stringify({ instructions: instructions ?? null, tools })).digest("hex");
+function fingerprintCodexTurnConfiguration({ instructions, tools }) {
+	return createHash("sha256").update(JSON.stringify({
+		instructions: instructions ?? null,
+		tools
+	})).digest("hex");
 }
 function extractUserText(prompt) {
-  if (typeof prompt === "string") return prompt;
-  const { content } = prompt;
-  if (typeof content === "string") return content;
-  const parts = [];
-  for (const part of content) {
-    if (part.type !== "text") {
-      throw new HarnessCapabilityUnsupportedError({
-        harnessId: "codex",
-        message: `The codex harness does not yet support user message parts of type '${part.type}'. Pass a string or a user message whose content contains only text parts.`
-      });
-    }
-    parts.push(part.text);
-  }
-  return parts.join("\n\n");
+	if (typeof prompt === "string") return prompt;
+	const { content } = prompt;
+	if (typeof content === "string") return content;
+	const parts = [];
+	for (const part of content) {
+		if (part.type !== "text") throw new HarnessCapabilityUnsupportedError({
+			harnessId: "codex",
+			message: `The codex harness does not yet support user message parts of type '${part.type}'. Pass a string or a user message whose content contains only text parts.`
+		});
+		parts.push(part.text);
+	}
+	return parts.join("\n\n");
 }
+//#endregion
+//#region src/index.ts
+/**
+* Default `codex` harness instance with no overrides — suitable for the
+* common case where the underlying `codex` CLI's defaults are fine.
+* Equivalent to `createCodex()`.
+*/
+const codex = createCodex();
+//#endregion
+export { VERSION, codex, createCodex };
 
-// src/index.ts
-var codex = createCodex();
-export {
-  VERSION,
-  codex,
-  createCodex
-};
 //# sourceMappingURL=index.js.map