@ai-sdk/harness-codex 1.0.139 → 1.0.141

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @ai-sdk/harness-codex
 
+## 1.0.141
+
+### Patch Changes
+
+- 15e9b20: fix(harness-codex): only restart recovered Codex turns once
+- 6cfa30f: fix(harness-codex): preserve Codex threads when persisted tool keys are reordered
+- Updated dependencies [2959d35]
+- Updated dependencies [e7da240]
+- Updated dependencies [59116e6]
+  - @ai-sdk/provider@4.0.22
+  - @ai-sdk/provider-utils@5.0.54
+  - @ai-sdk/harness@1.0.139
+
+## 1.0.140
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.138
+
 ## 1.0.139
 
 ### Patch Changes

package/dist/index.js

@@ -398,7 +398,7 @@ const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({
 z.discriminatedUnion("type", [startMessageSchema, ...harnessV1BridgeInboundCommandSchemas]);
 //#endregion
 //#region src/version.ts
-const VERSION = "1.0.139";
+const VERSION = "1.0.141";
 //#endregion
 //#region src/codex-harness.ts
 const DEFAULT_CODEX_MODEL = "gpt-5.5";
@@ -816,7 +816,7 @@ function createSession({ sessionId, channel, proc, model, reasoningEffort, webSe
 			instructions,
 			tools
 		});
-		const restartThread = latestThreadId != null && (skillsResult.changed || latestTurnConfigurationFingerprint != null && latestTurnConfigurationFingerprint !== nextFingerprint);
+		const restartThread = latestThreadId != null && (skillsResult.changed || latestTurnConfigurationFingerprint?.startsWith("v2:") === true && latestTurnConfigurationFingerprint !== nextFingerprint);
 		latestTurnConfigurationFingerprint = nextFingerprint;
 		if (restartThread) pendingResumeThreadId = void 0;
 		return { restartThread };
@@ -977,6 +977,7 @@ function createSession({ sessionId, channel, proc, model, reasoningEffort, webSe
 				...debug ? { debug } : {}
 			};
 			pendingResumeThreadId = void 0;
+			rerunContinue = false;
 			turn.sendStart(() => channel.send(startMessage));
 			return turn.control;
 		},
@@ -1001,6 +1002,7 @@ function createSession({ sessionId, channel, proc, model, reasoningEffort, webSe
 				abortSignal: continueOpts.abortSignal
 			});
 			if (rerunContinue) {
+				rerunContinue = false;
 				const threadId = pendingResumeThreadId ?? latestThreadId;
 				pendingResumeThreadId = void 0;
 				turn.sendStart(() => channel.send({
@@ -1146,10 +1148,14 @@ function createSession({ sessionId, channel, proc, model, reasoningEffort, webSe
 	};
 }
 function fingerprintCodexTurnConfiguration({ instructions, tools }) {
-	return createHash("sha256").update(JSON.stringify({
+	const canonical = JSON.stringify({
 		instructions: instructions ?? null,
 		tools
-	})).digest("hex");
+	}, (_key, value) => {
+		if (value == null || typeof value !== "object" || Array.isArray(value)) return value;
+		return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0));
+	});
+	return `v2:${createHash("sha256").update(canonical).digest("hex")}`;
 }
 function extractUserText(prompt) {
 	if (typeof prompt === "string") return prompt;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["BOOTSTRAP_DIR"],"sources":["../src/codex-bootstrap.ts","../src/codex-auth.ts","../src/codex-subscription.ts","../src/codex-bridge-protocol.ts","../src/version.ts","../src/codex-harness.ts","../src/index.ts"],"sourcesContent":["import type { HarnessV1Bootstrap } from '@ai-sdk/harness';\nimport { createReadBridgeAsset } from '@ai-sdk/harness/utils';\n\n/*\n * Keep every asset URL literal so bundlers can emit each file separately.\n * Dynamic new URL() paths can collapse multiple assets into one resolution.\n */\nconst readBridgeAsset = createReadBridgeAsset({\n  'package.json': new URL('./bridge/package.json', import.meta.url),\n  'pnpm-lock.yaml': new URL('./bridge/pnpm-lock.yaml', import.meta.url),\n  'index.mjs': new URL('./bridge/index.mjs', import.meta.url),\n});\n\n/*\n * Bootstrap is derived state stored under `$HOME/.ai-sdk-harness`, outside\n * the agent's working directory. Snapshot-capable providers preserve the\n * installed CLI, bridge, and recipe marker there.\n *\n * The session work dir (`startOpts.sessionWorkDir`) lives under the sandbox's\n * default working directory — the provider's persistent mount — so any files\n * the agent edits survive both detach -> attach and stop -> snapshot -> resume\n * cycles. Session-specific harness state lives under\n * `$HOME/.ai-sdk-harness/.agent-runs`, outside the agent workdir.\n */\nexport const CODEX_BOOTSTRAP_DIR = '.harness-bootstrap/codex';\n\nlet cachedBootstrap: HarnessV1Bootstrap | undefined;\n\nexport async function getCodexBootstrap(): Promise<HarnessV1Bootstrap> {\n  if (cachedBootstrap != null) return cachedBootstrap;\n  const [pkg, lock, bridge] = await Promise.all([\n    readBridgeAsset('package.json'),\n    readBridgeAsset('pnpm-lock.yaml'),\n    readBridgeAsset('index.mjs'),\n  ]);\n  cachedBootstrap = {\n    harnessId: 'codex',\n    bootstrapDir: CODEX_BOOTSTRAP_DIR,\n    files: [\n      { path: `${CODEX_BOOTSTRAP_DIR}/package.json`, content: pkg },\n      { path: `${CODEX_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },\n      { path: `${CODEX_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },\n    ],\n    commands: [\n      {\n        command: 'pnpm install --frozen-lockfile --store-dir .pnpm-store',\n      },\n    ],\n  };\n  return cachedBootstrap;\n}\n","import type {\n  HarnessV1Authentication,\n  HarnessV1RequestTransformation,\n  HarnessV1RequestTransformationSources,\n} from '@ai-sdk/harness';\nimport {\n  createCredentialRequestTransformation,\n  getAiGatewayAuthFromEnv,\n  isHarnessAuthenticationEnvironment,\n} from '@ai-sdk/harness/utils';\n\nconst DEFAULT_AI_GATEWAY_BASE_URL = 'https://ai-gateway.vercel.sh/v1';\nexport const DEFAULT_OPENAI_BASE_URL = 'https://api.openai.com/v1';\n\nexport const CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES = [\n  'AI_GATEWAY_API_KEY',\n  'CODEX_API_KEY',\n] as const;\n\nexport function createCodexRequestTransformations({\n  env: environment,\n  sandboxEnv: sandboxEnvironment,\n  auth: authenticationMode,\n}: HarnessV1RequestTransformationSources<CodexResolvedAuthenticationMode>): HarnessV1RequestTransformation[] {\n  if (!environment.CODEX_API_KEY || !sandboxEnvironment.CODEX_API_KEY) {\n    return [];\n  }\n  return [\n    createCredentialRequestTransformation({\n      matchUrl:\n        environment.OPENAI_BASE_URL ??\n        (authenticationMode === 'ai-gateway'\n          ? DEFAULT_AI_GATEWAY_BASE_URL\n          : DEFAULT_OPENAI_BASE_URL),\n      matchHeaders: {\n        Authorization: `Bearer ${sandboxEnvironment.CODEX_API_KEY}`,\n      },\n      transformHeaders: {\n        Authorization: `Bearer ${environment.CODEX_API_KEY}`,\n      },\n    }),\n  ];\n}\n\nexport type CodexResolvedAuthenticationMode = 'direct' | 'ai-gateway';\n\nexport type CodexAuthenticationMode = HarnessV1Authentication;\n\n/**\n * Resolve the environment-variable blob the codex bridge needs. Precedence:\n *\n *   1. An explicit authentication mode pins the selected route.\n *   2. Auto-detect from the host process env: gateway first\n *      (`AI_GATEWAY_API_KEY` / `VERCEL_OIDC_TOKEN`), then `CODEX_API_KEY` /\n *      `OPENAI_API_KEY`.\n */\nexport function resolveCodexEnv(\n  auth: CodexAuthenticationMode | undefined,\n  processEnv: Record<string, string | undefined> = process.env,\n): Record<string, string> {\n  const suppliedEnvironment = isHarnessAuthenticationEnvironment(auth);\n  const authenticationEnvironment = suppliedEnvironment ? auth : processEnv;\n  if (auth === 'direct') {\n    return pickOpenAI({ processEnv: authenticationEnvironment });\n  }\n\n  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({\n    env: authenticationEnvironment,\n  });\n  if (auth === 'ai-gateway' || gatewayAuthFromEnv.apiKey) {\n    return pickGateway({ gatewayAuthFromEnv });\n  }\n  return pickOpenAI({ processEnv: authenticationEnvironment });\n}\n\nexport function resolveCodexAuthenticationMode(\n  auth: CodexAuthenticationMode | undefined,\n  processEnv: Record<string, string | undefined> = process.env,\n): CodexResolvedAuthenticationMode {\n  if (isHarnessAuthenticationEnvironment(auth)) {\n    return getAiGatewayAuthFromEnv({ env: auth }).apiKey\n      ? 'ai-gateway'\n      : 'direct';\n  }\n  if (auth === 'direct') {\n    return 'direct';\n  }\n  if (auth === 'ai-gateway') {\n    return 'ai-gateway';\n  }\n  return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey\n    ? 'ai-gateway'\n    : 'direct';\n}\n\nfunction pickOpenAI({\n  processEnv,\n}: {\n  processEnv: Record<string, string | undefined>;\n}): Record<string, string> {\n  const env: Record<string, string> = {};\n  const apiKey = processEnv.OPENAI_API_KEY ?? processEnv.CODEX_API_KEY;\n  if (apiKey) env.CODEX_API_KEY = apiKey;\n  const baseUrl = processEnv.OPENAI_BASE_URL;\n  if (baseUrl) env.OPENAI_BASE_URL = baseUrl;\n  const organization = processEnv.OPENAI_ORGANIZATION;\n  if (organization) env.OPENAI_ORGANIZATION = organization;\n  const project = processEnv.OPENAI_PROJECT;\n  if (project) env.OPENAI_PROJECT = project;\n  return env;\n}\n\nfunction pickGateway({\n  gatewayAuthFromEnv,\n}: {\n  gatewayAuthFromEnv: ReturnType<typeof getAiGatewayAuthFromEnv>;\n}): Record<string, string> {\n  const apiKey = gatewayAuthFromEnv.apiKey;\n  const baseUrl = toCodexGatewayBaseUrl(gatewayAuthFromEnv.baseUrl);\n  const env: Record<string, string> = {};\n  if (apiKey) {\n    env.AI_GATEWAY_API_KEY = apiKey;\n    env.CODEX_API_KEY = apiKey;\n  }\n  env.AI_GATEWAY_BASE_URL = baseUrl;\n  env.OPENAI_BASE_URL = baseUrl;\n  return env;\n}\n\nfunction toCodexGatewayBaseUrl(baseUrl: string): string {\n  const trimmed = baseUrl.replace(/\\/+$/, '');\n  return trimmed.endsWith('/v1') ? trimmed : `${trimmed}/v1`;\n}\n","import { spawn } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n  chmod,\n  mkdir,\n  readFile,\n  realpath,\n  rename,\n  writeFile,\n} from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport type {\n  HarnessV1RequestTransformation,\n  HarnessV1RequestTransformationSources,\n} from '@ai-sdk/harness';\nimport {\n  getJwtExpiresAt,\n  isAccessTokenExpiringSoon,\n  isHarnessAuthenticationEnvironment,\n  isLinux,\n  isMacOS,\n  isWindows,\n  readLinuxSecretServicePassword,\n  readMacOSKeychainPassword,\n  readWindowsCredentialManagerPassword,\n  refreshOAuthAccessToken,\n  shouldResolveNativeSubscription,\n} from '@ai-sdk/harness/utils';\nimport { isRecord, safeParseJSON } from '@ai-sdk/provider-utils';\nimport {\n  createCodexRequestTransformations,\n  resolveCodexEnv,\n  type CodexAuthenticationMode,\n  type CodexResolvedAuthenticationMode,\n} from './codex-auth';\n\nconst CHATGPT_CODEX_BASE_URL = 'https://chatgpt.com/backend-api/codex';\nconst OPENAI_TOKEN_URL = 'https://auth.openai.com/oauth/token';\nconst OPENAI_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';\n\nexport type CodexResolvedAuthentication = {\n  readonly environment: Record<string, string>;\n  readonly requestHeaders?: Readonly<Record<string, string>>;\n};\n\nexport function createCodexSubscriptionRequestTransformations({\n  requestHeaders,\n  ...sources\n}: HarnessV1RequestTransformationSources<CodexResolvedAuthenticationMode> & {\n  requestHeaders?: Readonly<Record<string, string>>;\n}): HarnessV1RequestTransformation[] {\n  const transformations = createCodexRequestTransformations(sources);\n  if (requestHeaders == null) return transformations;\n\n  return transformations.map(transformation => ({\n    ...transformation,\n    transform: {\n      ...transformation.transform,\n      headers: {\n        ...transformation.transform.headers,\n        ...requestHeaders,\n      },\n    },\n  }));\n}\n\ntype CodexAuthCredentialsStoreMode = 'file' | 'keyring' | 'auto' | 'ephemeral';\n\ntype CodexKeyring = {\n  read(options: {\n    service: string;\n    account: string;\n  }): Promise<string | undefined>;\n  write(options: {\n    service: string;\n    account: string;\n    value: string;\n  }): Promise<void>;\n};\n\ntype CodexAuthFile = {\n  readonly auth_mode?: unknown;\n  readonly tokens?: {\n    readonly access_token?: unknown;\n    readonly refresh_token?: unknown;\n    readonly account_id?: unknown;\n  };\n  readonly [key: string]: unknown;\n};\n\nexport async function resolveCodexAuthentication({\n  auth,\n  processEnv = process.env,\n  authCredentialsStoreMode,\n  readSubscription = readCodexSubscription,\n}: {\n  auth: CodexAuthenticationMode | undefined;\n  processEnv?: Record<string, string | undefined>;\n  authCredentialsStoreMode?: unknown;\n  readSubscription?: (options?: {\n    authCredentialsStoreMode?: unknown;\n  }) => Promise<CodexResolvedAuthentication | undefined>;\n}): Promise<CodexResolvedAuthentication> {\n  const environment = resolveCodexEnv(auth, processEnv);\n  if (isHarnessAuthenticationEnvironment(auth)) {\n    return { environment };\n  }\n  if (\n    !shouldResolveNativeSubscription({\n      auth,\n      env: environment,\n      hasDirectCredential: environment.CODEX_API_KEY != null,\n    })\n  ) {\n    return { environment };\n  }\n\n  return (\n    (await readSubscription({ authCredentialsStoreMode })) ?? { environment }\n  );\n}\n\nexport async function readCodexSubscription({\n  env = process.env,\n  homeDirectory = homedir(),\n  authCredentialsStoreMode,\n  platform = process.platform,\n  keyring,\n  fetch,\n}: {\n  env?: Record<string, string | undefined>;\n  homeDirectory?: string;\n  authCredentialsStoreMode?: unknown;\n  platform?: NodeJS.Platform;\n  keyring?: CodexKeyring;\n  fetch?: typeof globalThis.fetch;\n} = {}): Promise<CodexResolvedAuthentication | undefined> {\n  const codexHome = resolve(env.CODEX_HOME ?? join(homeDirectory, '.codex'));\n  const authPath = join(codexHome, 'auth.json');\n  const storageMode =\n    toCodexAuthCredentialsStoreMode(authCredentialsStoreMode) ??\n    (await readCodexAuthCredentialsStoreMode({ codexHome })) ??\n    'file';\n  const stored = await readCodexAuthStore({\n    codexHome,\n    authPath,\n    storageMode,\n    keyring: keyring ?? createCodexKeyring({ platform }),\n  });\n  if (stored == null) return undefined;\n\n  const credential = await toCodexCredential(stored.value);\n  if (credential == null) return undefined;\n\n  let accessToken = credential.accessToken;\n  if (isAccessTokenExpiringSoon({ expiresAt: credential.expiresAt })) {\n    const refreshed = await refreshOAuthAccessToken({\n      tokenUrl: OPENAI_TOKEN_URL,\n      clientId: OPENAI_CLIENT_ID,\n      refreshToken: credential.refreshToken,\n      requestFormat: 'json',\n      ...(fetch == null ? {} : { fetch }),\n    });\n    accessToken = refreshed.accessToken;\n    await stored.write({\n      ...stored.value,\n      last_refresh: new Date().toISOString(),\n      tokens: {\n        ...stored.value.tokens,\n        access_token: refreshed.accessToken,\n        refresh_token: refreshed.refreshToken ?? credential.refreshToken,\n      },\n    });\n  }\n\n  return {\n    environment: {\n      CODEX_API_KEY: accessToken,\n      OPENAI_BASE_URL: CHATGPT_CODEX_BASE_URL,\n    },\n    ...(credential.accountId == null\n      ? {}\n      : {\n          requestHeaders: {\n            'ChatGPT-Account-ID': credential.accountId,\n          },\n        }),\n  };\n}\n\nasync function readCodexAuthStore({\n  codexHome,\n  authPath,\n  storageMode,\n  keyring,\n}: {\n  codexHome: string;\n  authPath: string;\n  storageMode: CodexAuthCredentialsStoreMode;\n  keyring: CodexKeyring | undefined;\n}): Promise<\n  | {\n      value: CodexAuthFile;\n      write(value: CodexAuthFile): Promise<void>;\n    }\n  | undefined\n> {\n  if (storageMode === 'ephemeral') return undefined;\n\n  const readFileStore = async () => {\n    const value = await readCodexAuthFile(authPath);\n    return value == null\n      ? undefined\n      : {\n          value,\n          write: (updated: CodexAuthFile) =>\n            writeCodexAuthFile({ authPath, value: updated }),\n        };\n  };\n  const readKeyringStore = async () => {\n    if (keyring == null) return undefined;\n    const canonicalHome = await realpath(codexHome).catch(() => codexHome);\n    const account = `cli|${createHash('sha256')\n      .update(canonicalHome)\n      .digest('hex')\n      .slice(0, 16)}`;\n    const text = await keyring.read({ service: 'Codex Auth', account });\n    if (text == null) return undefined;\n    const value = await parseCodexAuthFile(text);\n    return value == null\n      ? undefined\n      : {\n          value,\n          write: (updated: CodexAuthFile) =>\n            keyring.write({\n              service: 'Codex Auth',\n              account,\n              value: JSON.stringify(updated),\n            }),\n        };\n  };\n\n  if (storageMode === 'file') return readFileStore();\n  if (storageMode === 'keyring') return readKeyringStore();\n  return (await readKeyringStore()) ?? readFileStore();\n}\n\nasync function readCodexAuthCredentialsStoreMode({\n  codexHome,\n}: {\n  codexHome: string;\n}): Promise<CodexAuthCredentialsStoreMode | undefined> {\n  const text = await readFile(join(codexHome, 'config.toml'), 'utf8').catch(\n    () => undefined,\n  );\n  if (text == null) return undefined;\n  for (const line of text.split(/\\r?\\n/)) {\n    if (line.trimStart().startsWith('[')) return undefined;\n    const match =\n      /^\\s*cli_auth_credentials_store\\s*=\\s*[\"'](file|keyring|auto|ephemeral)[\"']\\s*(?:#.*)?$/.exec(\n        line,\n      );\n    if (match != null) {\n      return toCodexAuthCredentialsStoreMode(match[1]);\n    }\n  }\n}\n\nfunction toCodexAuthCredentialsStoreMode(\n  value: unknown,\n): CodexAuthCredentialsStoreMode | undefined {\n  return value === 'file' ||\n    value === 'keyring' ||\n    value === 'auto' ||\n    value === 'ephemeral'\n    ? value\n    : undefined;\n}\n\nasync function readCodexAuthFile(\n  authPath: string,\n): Promise<CodexAuthFile | undefined> {\n  const text = await readFile(authPath, 'utf8').catch(() => undefined);\n  return text == null ? undefined : parseCodexAuthFile(text);\n}\n\nasync function parseCodexAuthFile(\n  text: string,\n): Promise<CodexAuthFile | undefined> {\n  const parsed = await safeParseJSON({ text });\n  return parsed.success && isRecord(parsed.value)\n    ? (parsed.value as CodexAuthFile)\n    : undefined;\n}\n\nasync function toCodexCredential(value: CodexAuthFile): Promise<\n  | {\n      accessToken: string;\n      refreshToken: string;\n      expiresAt: number;\n      accountId?: string;\n    }\n  | undefined\n> {\n  if (value.auth_mode !== 'chatgpt' || !isRecord(value.tokens)) {\n    return undefined;\n  }\n  const accessToken = value.tokens.access_token;\n  const refreshToken = value.tokens.refresh_token;\n  if (typeof accessToken !== 'string' || typeof refreshToken !== 'string') {\n    return undefined;\n  }\n  const expiresAt = await getJwtExpiresAt({ token: accessToken });\n  if (expiresAt == null) return undefined;\n  const accountId = value.tokens.account_id;\n  return {\n    accessToken,\n    refreshToken,\n    expiresAt,\n    ...(typeof accountId === 'string' ? { accountId } : {}),\n  };\n}\n\nasync function writeCodexAuthFile({\n  authPath,\n  value,\n}: {\n  authPath: string;\n  value: CodexAuthFile;\n}): Promise<void> {\n  await mkdir(dirname(authPath), { recursive: true });\n  const temporaryPath = `${authPath}.${process.pid}.tmp`;\n  await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\\n`, {\n    mode: 0o600,\n  });\n  await chmod(temporaryPath, 0o600);\n  await rename(temporaryPath, authPath);\n}\n\nfunction createCodexKeyring({\n  platform,\n}: {\n  platform: NodeJS.Platform;\n}): CodexKeyring | undefined {\n  if (isMacOS(platform)) {\n    return {\n      async read({ service, account }) {\n        return readMacOSKeychainPassword({ service, account });\n      },\n      async write({ service, account, value }) {\n        const command = `add-generic-password -U -s ${shellQuoteForSecurity(service)} -a ${shellQuoteForSecurity(account)} -X ${Buffer.from(value, 'utf8').toString('hex')}\\n`;\n        await runCommandWithInput({\n          command: '/usr/bin/security',\n          args: ['-i'],\n          input: command,\n        });\n      },\n    };\n  }\n  if (isLinux(platform)) {\n    return {\n      async read({ service, account }) {\n        return readLinuxSecretServicePassword({\n          attributes: {\n            service,\n            username: account,\n            target: 'default',\n          },\n        });\n      },\n      async write({ service, account, value }) {\n        await runCommandWithInput({\n          command: 'secret-tool',\n          args: [\n            'store',\n            '--label',\n            `${account}@${service}:default`,\n            'service',\n            service,\n            'username',\n            account,\n            'target',\n            'default',\n            'application',\n            'rust-keyring',\n          ],\n          input: value,\n        });\n      },\n    };\n  }\n  if (isWindows(platform)) {\n    return createWindowsCodexKeyring();\n  }\n}\n\nfunction shellQuoteForSecurity(value: string): string {\n  return `\"${value.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"')}\"`;\n}\n\nasync function runCommandWithInput({\n  command,\n  args,\n  input,\n  env,\n}: {\n  command: string;\n  args: string[];\n  input: string;\n  env?: NodeJS.ProcessEnv;\n}): Promise<void> {\n  await new Promise<void>((resolvePromise, reject) => {\n    const child = spawn(command, args, {\n      stdio: ['pipe', 'ignore', 'pipe'],\n      ...(env == null ? {} : { env }),\n    });\n    let stderr = '';\n    child.stderr.setEncoding('utf8');\n    child.stderr.on('data', chunk => {\n      stderr += chunk;\n    });\n    child.once('error', reject);\n    child.once('close', code => {\n      if (code === 0) resolvePromise();\n      else reject(new Error(stderr || `${command} exited with code ${code}.`));\n    });\n    child.stdin.end(input);\n  });\n}\n\nfunction createWindowsCodexKeyring(): CodexKeyring {\n  const source = `\nusing System;\nusing System.Runtime.InteropServices;\nusing System.Text;\npublic static class CodexCredentialManager {\n  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]\n  public struct Credential {\n    public UInt32 Flags; public UInt32 Type; public string TargetName;\n    public string Comment; public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;\n    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob;\n    public UInt32 Persist; public UInt32 AttributeCount; public IntPtr Attributes;\n    public string TargetAlias; public string UserName;\n  }\n  [DllImport(\"advapi32.dll\", EntryPoint = \"CredWriteW\", CharSet = CharSet.Unicode, SetLastError = true)]\n  static extern bool CredWrite(ref Credential credential, UInt32 flags);\n  public static void Write(string target, string userName, string value) {\n    byte[] bytes = Encoding.Unicode.GetBytes(value);\n    IntPtr blob = Marshal.AllocHGlobal(bytes.Length);\n    try {\n      Marshal.Copy(bytes, 0, blob, bytes.Length);\n      Credential credential = new Credential {\n        Type = 1, TargetName = target, CredentialBlobSize = (UInt32)bytes.Length,\n        CredentialBlob = blob, Persist = 3, UserName = userName\n      };\n      if (!CredWrite(ref credential, 0)) throw new System.ComponentModel.Win32Exception();\n    } finally { Marshal.FreeHGlobal(blob); }\n  }\n}`;\n  return {\n    async read({ service, account }) {\n      return readWindowsCredentialManagerPassword({\n        targetName: `${account}.${service}`,\n      });\n    },\n    async write({ service, account, value }) {\n      const script = `Add-Type -TypeDefinition $env:AI_SDK_CODEX_CREDENTIAL_SOURCE; $value = [Console]::In.ReadToEnd(); [CodexCredentialManager]::Write($env:AI_SDK_CODEX_CREDENTIAL_TARGET, $env:AI_SDK_CODEX_CREDENTIAL_USER, $value)`;\n      await runCommandWithInput({\n        command: 'powershell.exe',\n        args: ['-NoProfile', '-NonInteractive', '-Command', script],\n        input: value,\n        env: {\n          ...process.env,\n          AI_SDK_CODEX_CREDENTIAL_SOURCE: source,\n          AI_SDK_CODEX_CREDENTIAL_TARGET: `${account}.${service}`,\n          AI_SDK_CODEX_CREDENTIAL_USER: account,\n        },\n      });\n    },\n  };\n}\n","import {\n  harnessV1BridgeInboundCommandSchemas,\n  harnessV1BridgeOutboundMessageSchema,\n  harnessV1BridgeReadySchema,\n  harnessV1BridgeStartBaseSchema,\n} from '@ai-sdk/harness';\nimport { z } from 'zod/v4';\n\n/*\n * Codex's bridge wire protocol. The outbound events (including `file-change`\n * and the `bridge-thread` resume coordinate), transport frames, shared inbound\n * commands, and `bridge-ready` line all come from the shared `@ai-sdk/harness`\n * protocol — the only Codex-specific piece is the `start` payload.\n */\n\nexport const outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;\nexport type OutboundMessage = z.infer<typeof outboundMessageSchema>;\n\nexport const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({\n  instructions: z.string().optional(),\n  reasoningEffort: z.enum(['low', 'medium', 'high', 'xhigh', 'max']).optional(),\n  webSearch: z.boolean().optional(),\n  codexConfig: z.record(z.string(), z.unknown()).optional(),\n  mcpServers: z.record(z.string(), z.unknown()).optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n  /*\n   * The host carries this app-server thread ID in lifecycle state. Supplying it\n   * makes the bridge call `thread/resume` instead of starting a fresh thread.\n   */\n  resumeThreadId: z.string().optional(),\n  restartThread: z.boolean().optional(),\n});\n\nexport type StartMessage = z.infer<typeof startMessageSchema>;\n\nexport const inboundMessageSchema = z.discriminatedUnion('type', [\n  startMessageSchema,\n  ...harnessV1BridgeInboundCommandSchemas,\n]);\nexport type InboundMessage = z.infer<typeof inboundMessageSchema>;\n\nexport const bridgeReadySchema = harnessV1BridgeReadySchema;\nexport type BridgeReady = z.infer<typeof bridgeReadySchema>;\n","// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { createHash } from 'node:crypto';\nimport path from 'node:path';\nimport {\n  commonTool,\n  HarnessCapabilityUnsupportedError,\n  harnessV1DiagnosticFromBridgeFrame,\n  type HarnessV1,\n  type HarnessV1DebugConfig,\n  type HarnessV1BuiltinTool,\n  type HarnessV1BuiltinToolFiltering,\n  type HarnessV1ContinueTurnState,\n  type HarnessV1CredentialForwarding,\n  type HarnessV1MintBridgeTokenCallback,\n  type HarnessV1Prompt,\n  type HarnessV1PromptControl,\n  type HarnessV1PortEndpoint,\n  type HarnessV1ResumeSessionState,\n  type HarnessV1NetworkSandboxSession,\n  type HarnessV1PermissionMode,\n  type HarnessV1Session,\n  type HarnessV1Skill,\n  type HarnessV1StreamPart,\n  harnessStateDirectoryPath,\n  harnessSessionDataDirectoryPath,\n} from '@ai-sdk/harness';\nimport {\n  applyCredentialForwarding,\n  classifyDiskLog,\n  createBridgeToken,\n  resolveSandboxCredentialEnvironment,\n  createBridgeErrorHandler,\n  createBridgeStartupError,\n  experimental_createBridgeUserMessageSubmitter,\n  drainBridgeProcessStream,\n  forwardBridgeProcessStream,\n  getRestrictedSandboxSession,\n  markBridgeStarting,\n  resolveSandboxHomeDir,\n  SandboxChannel,\n  shellQuote,\n  warnCredentialBrokeringUnavailable,\n  waitForBridgeReady,\n  withBridgeToken,\n  writeSkills,\n  type SandboxChannelReconnectOptions,\n} from '@ai-sdk/harness/utils';\nimport {\n  tool,\n  type Experimental_SandboxProcess,\n  type Experimental_SandboxSession as SandboxSession,\n} from '@ai-sdk/provider-utils';\nimport { WebSocket } from 'ws';\nimport { z } from 'zod/v4';\nimport {\n  CODEX_BOOTSTRAP_DIR as BOOTSTRAP_DIR,\n  getCodexBootstrap,\n} from './codex-bootstrap';\nimport {\n  CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n  DEFAULT_OPENAI_BASE_URL,\n  resolveCodexAuthenticationMode,\n  type CodexAuthenticationMode,\n} from './codex-auth';\nimport {\n  createCodexSubscriptionRequestTransformations,\n  resolveCodexAuthentication,\n} from './codex-subscription';\nimport {\n  outboundMessageSchema,\n  type InboundMessage,\n  type OutboundMessage,\n} from './codex-bridge-protocol';\nimport { VERSION } from './version';\n\ntype CodexChannel = SandboxChannel<OutboundMessage, InboundMessage>;\ntype CodexRespawnStrategy = 'replay' | 'rerun';\n\n/*\n * This intentionally is not the latest Codex model. Newer GPT-5.6 models use\n * Responses Lite, which does not expose their code-mode tools as callable\n * through the custom model provider used by the harness. Keep GPT-5.5 as the\n * default until the upstream bug is resolved:\n * https://github.com/openai/codex/issues/31894\n *\n * Passing the model explicitly keeps the runtime behavior deterministic and\n * the telemetry (`gen_ai.request.model`) accurate.\n */\nconst DEFAULT_CODEX_MODEL = 'gpt-5.5';\n\n/**\n * Value to use in User-Agent and `x-client-app` headers.\n */\nconst CODEX_CLIENT_APP = `ai-sdk-harness-codex/${VERSION}`;\n\nexport type CodexHarnessSettings = {\n  readonly auth?: CodexAuthenticationMode;\n  /**\n   * Customizes each credential value before it is forwarded into a sandbox\n   * process. This does not restrict which credentials the harness adapter can\n   * discover, read, or otherwise access in the host process.\n   */\n  readonly credentialForwarding?: HarnessV1CredentialForwarding;\n  /**\n   * Additional configuration passed through to Codex as-is. Codex config keys\n   * typically use snake_case and must be provided in that form. Values managed\n   * by this adapter take precedence over conflicting entries.\n   */\n  readonly codexConfig?: Record<string, unknown>;\n  /**\n   * MCP server definitions keyed by server name. Each definition uses the\n   * underlying runtime's native MCP server configuration format.\n   */\n  readonly mcpServers?: Record<string, unknown>;\n  /**\n   * Reasoning effort for reasoning-capable models. Leaving this unset\n   * defers to the CLI's default.\n   */\n  readonly reasoningEffort?: 'low' | 'medium' | 'high' | 'xhigh' | 'max';\n  /**\n   * When `true`, allow the underlying runtime to use live web search.\n   */\n  readonly webSearch?: boolean;\n  /**\n   * Override the port the bridge binds inside the sandbox. By default the\n   * adapter uses the first port the sandbox declares via `sandbox.ports`.\n   * Only set this if the sandbox declares multiple ports and the first one\n   * is reserved for something else.\n   */\n  readonly port?: number;\n  /**\n   * Override the host endpoint used to connect to the sandbox bridge. Required\n   * together with `port` when using a basic sandbox session.\n   */\n  readonly portEndpoint?: HarnessV1PortEndpoint;\n  /** Maximum milliseconds to wait for the bridge to advertise its port. Defaults to 120000. */\n  readonly startupTimeoutMs?: number;\n  /**\n   * Configures reconnection attempts after an established bridge connection\n   * drops. The reconnect window includes connection establishment and\n   * backoff delays. Defaults to 30 seconds with exponential backoff from 50\n   * milliseconds up to 2 seconds.\n   */\n  readonly reconnect?: SandboxChannelReconnectOptions;\n  /**\n   * Creates the authentication token used by the sandbox bridge. Defaults to\n   * a random 32-byte hexadecimal token.\n   */\n  readonly mintBridgeToken?: HarnessV1MintBridgeTokenCallback;\n};\n\n/*\n * Every native tool Codex app-server can invoke as a model-callable tool,\n * declared as a `ToolSet` keyed by what the bridge emits as `toolName` on\n * the wire (`commonName ?? nativeName`). Schemas reflect the corresponding\n * app-server item payloads.\n *\n * Other native operations such as todo planning surface as side-effect\n * events and are not model-callable tools.\n */\nconst CODEX_BUILTIN_TOOLS = {\n  bash: commonTool('bash', {\n    nativeName: 'shell',\n    toolUseKind: 'bash',\n    description: 'Execute a shell command',\n    inputSchema: z.object({ command: z.string() }),\n  }),\n  webSearch: commonTool('webSearch', {\n    nativeName: 'web_search',\n    toolUseKind: 'readonly',\n    description: 'Search the web',\n    inputSchema: z.object({ query: z.string() }),\n  }),\n  apply_patch: {\n    ...tool({\n      description: 'Apply a patch to files',\n      inputSchema: z.string(),\n    }),\n    toolUseKind: 'edit',\n  },\n  view_image: {\n    ...tool({\n      description: 'View a local image file',\n      inputSchema: z.object({\n        path: z.string(),\n        detail: z.enum(['high', 'original']).optional(),\n        environment_id: z.string().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n} as const satisfies Record<string, HarnessV1BuiltinTool<any, any>>;\n\n/**\n * Live bridge coordinates returned by `doDetach()` and `doSuspendTurn()`. A\n * future process uses them to reopen a socket to the still-running bridge\n * (`attach`) instead of re-spawning it. Absent on a `doStop()` payload.\n */\nconst codexBridgeCoordsSchema = z.object({\n  port: z.number(),\n  token: z.string(),\n  lastSeenEventId: z.number(),\n  sandboxId: z.string().optional(),\n});\n\n/**\n * Schema for the adapter-specific lifecycle `data` payload Codex produces.\n * `threadId` is what app-server's `thread/resume` method requires for the replay/rerun\n * rungs; the sandbox lookup is handled separately via\n * `provider.resumeSession({ sessionId })`. `bridge` carries live coordinates\n * for cross-process `attach` (present on `doDetach()` and `doSuspendTurn()`\n * payloads).\n */\nconst codexResumeStateSchema = z.object({\n  threadId: z.string().optional(),\n  turnConfigurationFingerprint: z.string().optional(),\n  bridge: codexBridgeCoordsSchema.optional(),\n  sandboxCredentialEnvironment: z.record(z.string(), z.string()).optional(),\n});\n\ntype CodexBridgeCoords = z.infer<typeof codexBridgeCoordsSchema>;\n\nexport function createCodex(\n  settings: CodexHarnessSettings = {},\n): HarnessV1<typeof CODEX_BUILTIN_TOOLS> {\n  return {\n    specificationVersion: 'harness-v1',\n    harnessId: 'codex',\n    builtinTools: CODEX_BUILTIN_TOOLS,\n    supportsBuiltinToolFiltering: true,\n    supportsBuiltinToolApprovals: false,\n    lifecycleStateSchema: codexResumeStateSchema,\n    getBootstrap: getCodexBootstrap,\n    doStart: async startOpts => {\n      const model = DEFAULT_CODEX_MODEL;\n      if (\n        startOpts.permissionMode != null &&\n        startOpts.permissionMode !== 'allow-all'\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'codex' does not support built-in tool approval requests; use permissionMode: 'allow-all'.\",\n          harnessId: 'codex',\n        });\n      }\n      const sandboxSession = startOpts.sandboxSession;\n      const toolSafeSandboxSession =\n        getRestrictedSandboxSession(sandboxSession);\n      const sandboxId = 'id' in sandboxSession ? sandboxSession.id : undefined;\n      validateBasicSandboxSettings({\n        sandboxSession,\n        port: settings.port,\n        portEndpoint: settings.portEndpoint,\n      });\n      if (settings.mintBridgeToken != null && sandboxId == null) {\n        throw new HarnessCapabilityUnsupportedError({\n          harnessId: 'codex',\n          message:\n            'The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id.',\n        });\n      }\n      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;\n      const isResume = lifecycleState != null;\n      const isContinue = startOpts.continueFrom != null;\n      const resumeData =\n        isResume && typeof lifecycleState?.data === 'object'\n          ? (lifecycleState.data as {\n              threadId?: unknown;\n              turnConfigurationFingerprint?: unknown;\n              bridge?: CodexBridgeCoords;\n              sandboxCredentialEnvironment?: Record<string, string>;\n            })\n          : undefined;\n      const resumeThreadId = resumeData?.threadId;\n      const resumeThreadIdString =\n        typeof resumeThreadId === 'string' && resumeThreadId.length > 0\n          ? resumeThreadId\n          : undefined;\n      const turnConfigurationFingerprint =\n        typeof resumeData?.turnConfigurationFingerprint === 'string'\n          ? resumeData.turnConfigurationFingerprint\n          : undefined;\n      const coords = resumeData?.bridge;\n      const authenticationMode = resolveCodexAuthenticationMode(settings.auth);\n      const resolvedAuthentication = await resolveCodexAuthentication({\n        auth: settings.auth,\n        authCredentialsStoreMode:\n          settings.codexConfig?.cli_auth_credentials_store,\n      });\n      const resolvedAuthEnvironment = resolvedAuthentication.environment;\n      let sandboxAuthEnvironment = resolvedAuthEnvironment;\n      let sandboxCredentialEnvironment: Record<string, string> | undefined;\n      let credentialsBrokered = false;\n      if (\n        'addRequestTransformations' in sandboxSession &&\n        sandboxSession.addRequestTransformations != null\n      ) {\n        sandboxCredentialEnvironment =\n          await resolveSandboxCredentialEnvironment({\n            environment: resolvedAuthEnvironment,\n            credentialEnvironmentVariables:\n              CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n            credentialForwarding: settings.credentialForwarding,\n            previousSandboxCredentialEnvironment:\n              resumeData?.sandboxCredentialEnvironment,\n          });\n        sandboxAuthEnvironment = {\n          ...resolvedAuthEnvironment,\n          ...sandboxCredentialEnvironment,\n        };\n        const requestTransformations =\n          createCodexSubscriptionRequestTransformations({\n            env: resolvedAuthEnvironment,\n            sandboxEnv: sandboxAuthEnvironment,\n            auth: authenticationMode,\n            requestHeaders: resolvedAuthentication.requestHeaders,\n          });\n        if (requestTransformations.length > 0) {\n          await sandboxSession.addRequestTransformations(\n            requestTransformations,\n          );\n        }\n        credentialsBrokered = true;\n        if (\n          requestTransformations.length > 0 &&\n          authenticationMode === 'direct' &&\n          resolvedAuthEnvironment.OPENAI_BASE_URL == null\n        ) {\n          /*\n           * Vercel Sandbox request transformations apply only to HTTP traffic.\n           * Materializing Codex's standard OpenAI URL makes the bridge select\n           * its custom provider, where WebSockets are disabled, while keeping\n           * the non-brokered path on Codex's built-in OpenAI provider.\n           */\n          sandboxAuthEnvironment.OPENAI_BASE_URL = DEFAULT_OPENAI_BASE_URL;\n        }\n      }\n      // Harness SDK state (bootstrap, per-session runs) always lives under\n      // the sandbox's own HOME, never the working directory, so it stays\n      // out of a user-owned workspace.\n      const sandboxHomeDir = await resolveSandboxHomeDir({\n        sandbox: toolSafeSandboxSession,\n        abortSignal: startOpts.abortSignal,\n      });\n      const stateDir = harnessStateDirectoryPath({ sandboxHomeDir });\n      const bootstrapDir = path.posix.resolve(stateDir, BOOTSTRAP_DIR);\n\n      const workDir = startOpts.sessionWorkDir;\n      const sessionDataDir = harnessSessionDataDirectoryPath({\n        stateDirectory: stateDir,\n        sessionId: startOpts.sessionId,\n      });\n      const bridgeStateDir = `${sessionDataDir}/bridge`;\n      const timeoutMs = settings.startupTimeoutMs ?? 120_000;\n\n      // Normalize each forwarded bridge diagnostics frame into the general\n      // `HarnessV1Diagnostic` and report it. The adapter does no telemetry work\n      // beyond this transport→emission mapping.\n      const report = startOpts.observability?.report;\n      const onDiagnostic = report\n        ? (frame: Parameters<typeof harnessV1DiagnosticFromBridgeFrame>[0]) =>\n            report(\n              harnessV1DiagnosticFromBridgeFrame(frame, {\n                sessionId: startOpts.sessionId,\n                timestamp: Date.now(),\n              }),\n            )\n        : undefined;\n      const onBridgeError = createBridgeErrorHandler({\n        harnessId: 'codex',\n        sessionId: startOpts.sessionId,\n      });\n\n      /*\n       * Rung 1 — ATTACH. With live coordinates, reopen a socket to the\n       * still-running bridge. Parked between-turn sessions just attach and wait\n       * for the next `start`; suspended in-flight turns request replay of\n       * everything past the persisted cursor. No spawn, no fresh token. If the\n       * bridge is gone the open throws and we fall through to a spawn-based\n       * recovery.\n       */\n      if (coords) {\n        try {\n          const endpoint = await resolveBridgeEndpoint({\n            sandboxSession,\n            override: settings.portEndpoint,\n            port: coords.port,\n          });\n          const attachEndpoint = withBridgeToken({\n            endpoint,\n            token: coords.token,\n          });\n          const attachChannel: CodexChannel = new SandboxChannel({\n            connect: ({ abortSignal }) =>\n              openWebSocket({ ...attachEndpoint, abortSignal }),\n            outboundSchema: outboundMessageSchema,\n            initialLastSeenEventId: coords.lastSeenEventId,\n            onDiagnostic,\n            onBridgeError,\n            reconnect: settings.reconnect,\n          });\n          await attachChannel.open(isContinue ? { resume: true } : undefined);\n          return createSession({\n            sessionId: startOpts.sessionId,\n            channel: attachChannel,\n            // The live bridge was spawned by another process; no process handle.\n            proc: undefined,\n            model,\n            reasoningEffort: settings.reasoningEffort,\n            webSearch: settings.webSearch,\n            builtinToolFiltering: startOpts.builtinToolFiltering,\n            codexConfig: settings.codexConfig,\n            mcpServers: settings.mcpServers,\n            headers: startOpts.headers,\n            resumeThreadId: resumeThreadIdString,\n            isResume: true,\n            seedResumeThreadOnFirstPrompt: false,\n            rerunContinue: false,\n            bridgePort: coords.port,\n            bridgeToken: coords.token,\n            sandboxId,\n            sandboxCredentialEnvironment,\n            debug: startOpts.observability?.debug,\n            permissionMode: startOpts.permissionMode,\n            sandbox: toolSafeSandboxSession,\n            sandboxHomeDir,\n            turnConfigurationFingerprint,\n          });\n        } catch {\n          // Bridge no longer reachable — recover by respawning below.\n        }\n      }\n\n      /*\n       * Rungs 2/3 — REPLAY vs RERUN. Respawn the bridge. `replay` is only sound\n       * for `continueFrom`: those coordinates include the cursor the on-disk\n       * log is replayed *from*. `resumeFrom` is a between-turn resume; even when\n       * it carries bridge coordinates, replaying the previous turn would\n       * re-deliver stale events into the next turn. Those resumes always `rerun`\n       * via app-server's `thread/resume` method when attach is unavailable.\n       */\n      let respawnStrategy: CodexRespawnStrategy | undefined = isResume\n        ? 'rerun'\n        : undefined;\n      if (coords && isContinue) {\n        const logRaw = await Promise.resolve(\n          toolSafeSandboxSession.readTextFile({\n            path: `${bridgeStateDir}/event-log.ndjson`,\n            abortSignal: startOpts.abortSignal,\n          }),\n        ).catch(() => null);\n        if ((await classifyDiskLog(logRaw)) === 'replay') {\n          respawnStrategy = 'replay';\n        }\n      }\n\n      const port = resolveBridgePort({\n        sandboxSession,\n        override: settings.port,\n      });\n      const token =\n        settings.mintBridgeToken == null\n          ? createBridgeToken()\n          : settings.mintBridgeToken(sandboxId!);\n      const forwardedAuthEnvironment = credentialsBrokered\n        ? sandboxAuthEnvironment\n        : await applyCredentialForwarding({\n            environment: sandboxAuthEnvironment,\n            credentialEnvironmentVariables:\n              CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n            credentialForwarding: settings.credentialForwarding,\n          });\n      if (!credentialsBrokered) {\n        warnCredentialBrokeringUnavailable({\n          environment: resolvedAuthEnvironment,\n          forwardedEnvironment: forwardedAuthEnvironment,\n          credentialEnvironmentVariables:\n            CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n        });\n      }\n      const env = {\n        ...forwardedAuthEnvironment,\n        AI_SDK_HARNESS_CLIENT_APP: CODEX_CLIENT_APP,\n        BRIDGE_CHANNEL_TOKEN: token,\n        BRIDGE_WS_PORT: String(port),\n        ...(respawnStrategy === 'replay'\n          ? { BRIDGE_REPLAY_FROM_DISK: '1' }\n          : {}),\n      };\n\n      if (respawnStrategy === undefined) {\n        await toolSafeSandboxSession.run({\n          command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,\n          abortSignal: startOpts.abortSignal,\n        });\n      }\n\n      await markBridgeStarting({\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'codex',\n        abortSignal: startOpts.abortSignal,\n      });\n\n      const proc = await toolSafeSandboxSession.spawn({\n        command: `node ${shellQuote(`${bootstrapDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)}`,\n        env,\n        abortSignal: startOpts.abortSignal,\n      });\n      const stderrTail: string[] = [];\n      const bridgeStderrDone = forwardBridgeProcessStream({\n        stream: proc.stderr,\n        streamName: 'stderr',\n        source: 'codex',\n        collectTail: stderrTail,\n      });\n\n      const { port: boundPort } = await waitForBridgeReady({\n        proc,\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'codex',\n        timeoutMs,\n        abortSignal: startOpts.abortSignal,\n        createTimeoutError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'codex bridge did not become ready in time.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n        createExitError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'codex bridge exited before becoming ready.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n      });\n      void drainBridgeProcessStream(proc.stdout);\n\n      const endpoint = await resolveBridgeEndpoint({\n        sandboxSession,\n        override: settings.portEndpoint,\n        port: boundPort,\n      });\n      const bridgeEndpoint = withBridgeToken({ endpoint, token });\n\n      const channel: CodexChannel = new SandboxChannel({\n        connect: ({ abortSignal }) =>\n          openWebSocket({ ...bridgeEndpoint, abortSignal }),\n        outboundSchema: outboundMessageSchema,\n        onDiagnostic,\n        onBridgeError,\n        reconnect: settings.reconnect,\n        // In replay mode the respawned bridge reloaded the finished turn from\n        // disk; seed the cursor and resume so it streams the tail (incl.\n        // `finish`).\n        ...(respawnStrategy === 'replay'\n          ? { initialLastSeenEventId: coords?.lastSeenEventId ?? 0 }\n          : {}),\n      });\n      await channel.open(\n        respawnStrategy === 'replay' ? { resume: true } : undefined,\n      );\n\n      return createSession({\n        sessionId: startOpts.sessionId,\n        channel,\n        proc,\n        model,\n        reasoningEffort: settings.reasoningEffort,\n        webSearch: settings.webSearch,\n        builtinToolFiltering: startOpts.builtinToolFiltering,\n        codexConfig: settings.codexConfig,\n        mcpServers: settings.mcpServers,\n        headers: startOpts.headers,\n        resumeThreadId: resumeThreadIdString,\n        isResume: respawnStrategy !== undefined,\n        seedResumeThreadOnFirstPrompt: respawnStrategy !== undefined,\n        rerunContinue: respawnStrategy === 'rerun',\n        bridgePort: boundPort,\n        bridgeToken: token,\n        sandboxId,\n        sandboxCredentialEnvironment,\n        debug: startOpts.observability?.debug,\n        permissionMode: startOpts.permissionMode,\n        sandbox: toolSafeSandboxSession,\n        sandboxHomeDir,\n        turnConfigurationFingerprint,\n      });\n    },\n  };\n}\n\nfunction resolveBridgePort({\n  sandboxSession,\n  override,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: number | undefined;\n}): number {\n  if (override !== undefined) return override;\n  if ('ports' in sandboxSession && sandboxSession.ports.length > 0) {\n    return sandboxSession.ports[0];\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'codex',\n    message:\n      'The codex harness needs a TCP port exposed by the sandbox. ' +\n      'Create the sandbox with `ports: [<port>]` or pass `createCodex({ port })`.',\n  });\n}\n\nfunction validateBasicSandboxSettings({\n  sandboxSession,\n  port,\n  portEndpoint,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  port: number | undefined;\n  portEndpoint: HarnessV1PortEndpoint | undefined;\n}): void {\n  if ('getPortEndpoint' in sandboxSession) return;\n  if (port == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'codex',\n      message:\n        'The codex harness requires an explicit `port` when using a basic sandbox session.',\n    });\n  }\n  if (portEndpoint == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'codex',\n      message:\n        'The codex harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n    });\n  }\n}\n\nasync function resolveBridgeEndpoint({\n  sandboxSession,\n  override,\n  port,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: HarnessV1PortEndpoint | undefined;\n  port: number;\n}): Promise<HarnessV1PortEndpoint> {\n  if (override != null) return override;\n  if ('getPortEndpoint' in sandboxSession) {\n    return sandboxSession.getPortEndpoint({ port, protocol: 'ws' });\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'codex',\n    message:\n      'The codex harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n  });\n}\n\nfunction openWebSocket({\n  url,\n  headers,\n  abortSignal,\n}: HarnessV1PortEndpoint & { abortSignal: AbortSignal }): Promise<WebSocket> {\n  return new Promise((resolve, reject) => {\n    if (abortSignal.aborted) {\n      reject(abortSignal.reason ?? new Error('WebSocket connection aborted'));\n      return;\n    }\n\n    const ws = new WebSocket(url, {\n      headers: headers == null ? undefined : { ...headers },\n    });\n\n    let settled = false;\n    const cleanup = () => {\n      abortSignal.removeEventListener('abort', onAbort);\n      ws.off('open', onOpen);\n      ws.off('error', onError);\n    };\n    const rejectWithCleanup = (error: unknown) => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      ws.once('error', () => {});\n      try {\n        ws.terminate();\n      } catch {\n        try {\n          ws.close();\n        } catch {\n          // best-effort\n        }\n      }\n      reject(error);\n    };\n    const onOpen = () => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      resolve(ws);\n    };\n    const onError = (err: Error) => {\n      rejectWithCleanup(err);\n    };\n    const onAbort = () =>\n      rejectWithCleanup(\n        abortSignal.reason ?? new Error('WebSocket connection aborted'),\n      );\n\n    ws.once('open', onOpen);\n    ws.once('error', onError);\n    abortSignal.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\nfunction createSession({\n  sessionId,\n  channel,\n  proc,\n  model,\n  reasoningEffort,\n  webSearch,\n  builtinToolFiltering,\n  codexConfig,\n  mcpServers,\n  headers,\n  resumeThreadId,\n  isResume,\n  seedResumeThreadOnFirstPrompt,\n  rerunContinue,\n  bridgePort,\n  bridgeToken,\n  sandboxId,\n  sandboxCredentialEnvironment,\n  debug,\n  permissionMode,\n  sandbox,\n  sandboxHomeDir,\n  turnConfigurationFingerprint,\n}: {\n  sessionId: string;\n  channel: CodexChannel;\n  /** Undefined on `attach` — the live bridge was spawned by another process. */\n  proc: Experimental_SandboxProcess | undefined;\n  model: string | undefined;\n  reasoningEffort: 'low' | 'medium' | 'high' | 'xhigh' | 'max' | undefined;\n  webSearch: boolean | undefined;\n  builtinToolFiltering: HarnessV1BuiltinToolFiltering | undefined;\n  codexConfig: Record<string, unknown> | undefined;\n  mcpServers: Record<string, unknown> | undefined;\n  headers: Readonly<Record<string, string>> | undefined;\n  resumeThreadId: string | undefined;\n  isResume: boolean;\n  seedResumeThreadOnFirstPrompt: boolean;\n  rerunContinue: boolean;\n  bridgePort: number;\n  bridgeToken: string;\n  sandboxId: string | undefined;\n  sandboxCredentialEnvironment: Record<string, string> | undefined;\n  debug: HarnessV1DebugConfig | undefined;\n  permissionMode: HarnessV1PermissionMode | undefined;\n  sandbox: SandboxSession;\n  sandboxHomeDir: string;\n  turnConfigurationFingerprint: string | undefined;\n}): HarnessV1Session {\n  let stopped = false;\n  let stopPromise: Promise<void> | undefined;\n  /*\n   * Send the persisted threadId on the first prompt only when the bridge was\n   * respawned (rerun/replay) so it takes the app-server `thread/resume` branch.\n   * An `attach`ed bridge already holds its threadState in memory and continues\n   * on its own, so it needs no seed.\n   */\n  let pendingResumeThreadId = seedResumeThreadOnFirstPrompt\n    ? resumeThreadId\n    : undefined;\n  /*\n   * Latest codex thread id, cached from the bridge's `bridge-thread`\n   * announcements. Seeded from lifecycle state so `doDetach()` and `doStop()`\n   * can include a thread id even before this process has run a turn.\n   */\n  let latestThreadId = resumeThreadId;\n  let latestTurnConfigurationFingerprint = turnConfigurationFingerprint;\n  channel.on('bridge-thread', msg => {\n    latestThreadId = msg.threadId;\n  });\n  const synchronizeTurnConfiguration = async ({\n    skills,\n    instructions,\n    tools,\n    abortSignal,\n  }: {\n    skills: ReadonlyArray<HarnessV1Skill>;\n    instructions: string | undefined;\n    tools: ReadonlyArray<{\n      name: string;\n      description?: string;\n      inputSchema: unknown;\n    }>;\n    abortSignal?: AbortSignal;\n  }): Promise<{ restartThread: boolean }> => {\n    const skillsResult = await writeSkills({\n      sandbox,\n      homePath: sandboxHomeDir,\n      skillsDir: '.agents/skills',\n      skills,\n      abortSignal,\n      invalidSkillNameMessage: ({ name }) =>\n        `Invalid Codex skill name: ${name}`,\n      invalidSkillFilePathMessage: ({ skillName, filePath }) =>\n        `Invalid Codex skill file path for ${skillName}: ${filePath}`,\n    });\n    const nextFingerprint = fingerprintCodexTurnConfiguration({\n      instructions,\n      tools,\n    });\n    const restartThread =\n      latestThreadId != null &&\n      (skillsResult.changed ||\n        (latestTurnConfigurationFingerprint != null &&\n          latestTurnConfigurationFingerprint !== nextFingerprint));\n    latestTurnConfigurationFingerprint = nextFingerprint;\n    if (restartThread) {\n      pendingResumeThreadId = undefined;\n    }\n    return { restartThread };\n  };\n\n  /*\n   * Wire the channel into one turn's worth of events and return the control\n   * surface. Shared by `doPromptTurn` (which sends a `start` afterwards) and\n   * `doContinueTurn` (which attaches to an already-running/replayed turn, or sends\n   * a rerun `start`). The only difference between the two entry points is the\n   * `start` message, not the listener/abort/settle plumbing.\n   */\n  const wireTurn = (turnOpts: {\n    emit: (event: HarnessV1StreamPart) => void;\n    abortSignal?: AbortSignal;\n  }): {\n    control: HarnessV1PromptControl;\n    sendStart: (send: () => void) => void;\n  } => {\n    let pendingResolve: (() => void) | undefined;\n    let pendingReject: ((err: unknown) => void) | undefined;\n    const done = new Promise<void>((resolve, reject) => {\n      pendingResolve = resolve;\n      pendingReject = reject;\n    });\n    const userMessageSubmitter = experimental_createBridgeUserMessageSubmitter({\n      send: message => channel.send(message),\n      onResponse: listener => channel.on('user-message-response', listener),\n      onReconnect: listener => channel.onReconnect(listener),\n    });\n\n    const unsubs: Array<() => void> = [];\n    const forward = (event: HarnessV1StreamPart) => {\n      try {\n        turnOpts.emit(event);\n      } catch {}\n    };\n\n    const eventTypes = [\n      'stream-start',\n      'text-start',\n      'text-delta',\n      'text-end',\n      'reasoning-start',\n      'reasoning-delta',\n      'reasoning-end',\n      'tool-call',\n      'tool-approval-request',\n      'tool-result',\n      'file-change',\n      'finish-step',\n      'raw',\n    ] as const;\n    let isSettled = false;\n    const settleSuccess = () => {\n      if (isSettled) return;\n      isSettled = true;\n      userMessageSubmitter.close();\n      for (const u of unsubs) u();\n      pendingResolve!();\n    };\n    const settleError = (err: unknown) => {\n      if (isSettled) return;\n      isSettled = true;\n      userMessageSubmitter.close(err);\n      for (const u of unsubs) u();\n      pendingReject!(err);\n    };\n\n    for (const type of eventTypes) {\n      unsubs.push(\n        channel.on(type, msg => {\n          forward(msg);\n        }),\n      );\n    }\n    unsubs.push(\n      channel.on('finish', msg => {\n        forward(msg);\n        settleSuccess();\n      }),\n    );\n    unsubs.push(\n      channel.on('error', msg => {\n        forward(msg);\n        settleError(msg.error);\n      }),\n    );\n\n    /*\n     * A `'suspended'` close is a graceful slice-boundary freeze the host\n     * initiated (`doSuspendTurn`): the turn keeps running in the bridge and its\n     * tail is replayed to the next process, so wind this turn down cleanly\n     * rather than failing it. Any other close mid-turn is an unexpected drop.\n     */\n    const onClose = (_code?: number, reason?: string) => {\n      if (isSettled) return;\n      if (reason === 'suspended') {\n        settleSuccess();\n        return;\n      }\n      settleError(new Error('codex bridge closed before the turn finished.'));\n    };\n    channel.onClose(onClose);\n\n    const onAbort = () => {\n      if (isSettled) return;\n      try {\n        channel.send({ type: 'abort' });\n      } catch {}\n      settleError(\n        turnOpts.abortSignal?.reason ??\n          new DOMException('Aborted', 'AbortError'),\n      );\n    };\n    if (turnOpts.abortSignal) {\n      if (turnOpts.abortSignal.aborted) {\n        onAbort();\n      } else {\n        turnOpts.abortSignal.addEventListener('abort', onAbort, {\n          once: true,\n        });\n      }\n    }\n\n    const control: HarnessV1PromptControl = {\n      submitToolResult: async input => {\n        channel.send({\n          type: 'tool-result',\n          toolCallId: input.toolCallId,\n          output: input.output,\n          isError: input.isError,\n        });\n      },\n      submitToolApproval: async input => {\n        channel.send({\n          type: 'tool-approval-response',\n          approvalId: input.approvalId,\n          approved: input.approved,\n          reason: input.reason,\n        });\n      },\n      submitUserMessage: async text => {\n        await userMessageSubmitter.submit(text);\n      },\n      done,\n    };\n\n    return {\n      control,\n      sendStart: send => {\n        /*\n         * Codex can complete short turns without using tools. Deferring the\n         * start frame gives the harness runner one event-loop turn to finish\n         * wiring the prompt control and stream output before Codex can settle.\n         */\n        const timer = setTimeout(() => {\n          if (isSettled) return;\n          try {\n            send();\n          } catch (err) {\n            settleError(err);\n          }\n        }, 0);\n        timer.unref?.();\n      },\n    };\n  };\n\n  return {\n    sessionId,\n    isResume,\n    doPromptTurn: async promptOpts => {\n      if (\n        promptOpts.responseFormat?.type === 'json' &&\n        promptOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'codex' requires a JSON schema for structured output.\",\n          harnessId: 'codex',\n        });\n      }\n      const tools = (promptOpts.tools ?? []).map(t => ({\n        name: t.name,\n        description: t.description,\n        inputSchema: t.inputSchema,\n      }));\n      const { restartThread } = await synchronizeTurnConfiguration({\n        skills: promptOpts.skills,\n        instructions: promptOpts.instructions,\n        tools,\n        abortSignal: promptOpts.abortSignal,\n      });\n      const turn = wireTurn({\n        emit: promptOpts.emit,\n        abortSignal: promptOpts.abortSignal,\n      });\n\n      const startMessage = {\n        type: 'start' as const,\n        prompt: extractUserText(promptOpts.prompt),\n        tools,\n        ...(promptOpts.responseFormat == null\n          ? {}\n          : { responseFormat: promptOpts.responseFormat }),\n        ...(promptOpts.instructions\n          ? { instructions: promptOpts.instructions }\n          : {}),\n        model: promptOpts.model ?? model,\n        reasoningEffort,\n        webSearch,\n        ...(builtinToolFiltering == null ? {} : { builtinToolFiltering }),\n        ...(codexConfig == null ? {} : { codexConfig }),\n        ...(mcpServers == null ? {} : { mcpServers }),\n        ...(headers == null ? {} : { headers }),\n        ...(permissionMode ? { permissionMode } : {}),\n        ...(pendingResumeThreadId\n          ? { resumeThreadId: pendingResumeThreadId }\n          : {}),\n        ...(restartThread ? { restartThread: true } : {}),\n        ...(debug ? { debug } : {}),\n      };\n      pendingResumeThreadId = undefined;\n      turn.sendStart(() => channel.send(startMessage));\n\n      return turn.control;\n    },\n    doContinueTurn: async continueOpts => {\n      if (\n        continueOpts.responseFormat?.type === 'json' &&\n        continueOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'codex' requires a JSON schema for structured output.\",\n          harnessId: 'codex',\n        });\n      }\n      const tools = (continueOpts.tools ?? []).map(t => ({\n        name: t.name,\n        description: t.description,\n        inputSchema: t.inputSchema,\n      }));\n      const { restartThread } = await synchronizeTurnConfiguration({\n        skills: continueOpts.skills,\n        instructions: continueOpts.instructions,\n        tools,\n        abortSignal: continueOpts.abortSignal,\n      });\n      const turn = wireTurn({\n        emit: continueOpts.emit,\n        abortSignal: continueOpts.abortSignal,\n      });\n\n      /*\n       * attach / replay: the still-running (or disk-replayed) turn streams into\n       * the wired listeners — `doStart` opened the channel with `{ resume: true }`\n       * so the bridge replays everything past the persisted cursor (including a\n       * `finish` if the turn ended during the gap). No `start` is sent: issuing\n       * one would clear the bridge's replay log and begin a new turn. Lossless.\n       *\n       * rerun: the bridge was respawned with no in-flight turn to attach to, so\n       * re-drive codex's own thread via `resumeThreadId`. Lossy — work in flight\n       * at the suspension is recomputed. This is the rare bridge-died\n       * fallback; the common slice path is `attach`.\n       */\n      if (rerunContinue) {\n        const threadId = pendingResumeThreadId ?? latestThreadId;\n        pendingResumeThreadId = undefined;\n        turn.sendStart(() =>\n          channel.send({\n            type: 'start' as const,\n            /*\n             * A continuation nudge rather than an empty prompt: `resumeThreadId`\n             * rehydrates the prior thread, and this is the new user turn that\n             * drives it forward. Keeping it non-empty avoids handing the runtime\n             * an empty user message (and mirrors the claude-code adapter, where an\n             * empty text block trips the Anthropic API's `cache_control` rule).\n             */\n            prompt: 'Continue.',\n            tools,\n            ...(continueOpts.responseFormat == null\n              ? {}\n              : { responseFormat: continueOpts.responseFormat }),\n            ...(continueOpts.instructions\n              ? { instructions: continueOpts.instructions }\n              : {}),\n            model: continueOpts.model ?? model,\n            reasoningEffort,\n            webSearch,\n            ...(builtinToolFiltering == null ? {} : { builtinToolFiltering }),\n            ...(codexConfig == null ? {} : { codexConfig }),\n            ...(mcpServers == null ? {} : { mcpServers }),\n            ...(headers == null ? {} : { headers }),\n            ...(permissionMode ? { permissionMode } : {}),\n            ...(threadId ? { resumeThreadId: threadId } : {}),\n            ...(restartThread ? { restartThread: true } : {}),\n            ...(debug ? { debug } : {}),\n          }),\n        );\n      }\n\n      return turn.control;\n    },\n    doCompact: async () => {\n      /*\n       * Codex compacts its context automatically inside the core turn loop\n       * (~90% of the model context window). This adapter does not yet expose a\n       * manual compaction trigger or compaction event, so manual `compact()` is\n       * unsupported while Codex's own auto-compaction continues to run.\n       */\n      throw new HarnessCapabilityUnsupportedError({\n        message:\n          \"Harness 'codex' does not support manual compaction; Codex auto-compacts its context internally.\",\n        harnessId: 'codex',\n      });\n    },\n    doDetach: async () => {\n      if (stopped) {\n        throw new Error(\n          `codex session ${sessionId} is already stopped; cannot detach.`,\n        );\n      }\n      stopped = true;\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'codex',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...(latestThreadId ? { threadId: latestThreadId } : {}),\n          ...(latestTurnConfigurationFingerprint\n            ? {\n                turnConfigurationFingerprint:\n                  latestTurnConfigurationFingerprint,\n              }\n            : {}),\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n    doDestroy: async () => {\n      if (stopped) return stopPromise;\n      stopped = true;\n      stopPromise = (async () => {\n        // Tell the channel we are tearing down so the bridge's post-shutdown\n        // socket close finalises instead of triggering a reconnect.\n        channel.beginClose();\n        try {\n          if (!channel.isClosed()) {\n            channel.send({ type: 'destroy' });\n          }\n        } catch {}\n        let stopTimer: ReturnType<typeof setTimeout> | undefined;\n        try {\n          if (proc) {\n            await Promise.race([\n              proc.wait(),\n              new Promise<void>(resolve => {\n                stopTimer = setTimeout(resolve, 5000);\n                stopTimer.unref?.();\n              }),\n            ]);\n          }\n        } finally {\n          if (stopTimer) clearTimeout(stopTimer);\n          try {\n            await proc?.kill();\n          } catch {}\n          channel.close();\n        }\n      })();\n      return stopPromise;\n    },\n    doStop: async () => {\n      if (stopped) {\n        throw new Error(\n          `codex session ${sessionId} is already stopped; cannot stop.`,\n        );\n      }\n      stopped = true;\n      /*\n       * If the bridge's channel already closed (e.g. mid-turn WS drop)\n       * there is no one to acknowledge a `stop` message. Synthesize an empty\n       * payload — the workdir is still captured by the sandbox snapshot\n       * during the subsequent `sandboxSession.stop()`, so the next turn can\n       * resume the filesystem state. The trade-off: we lose\n       * `threadId`, so Codex app-server starts a fresh thread on the\n       * preserved workdir rather than resuming the prior conversation\n       * inside Codex's runtime. Ability to continue beats throwing.\n       */\n      // Tell the channel we are tearing down so the bridge's post-stop\n      // socket close finalises instead of triggering a reconnect.\n      channel.beginClose();\n      const data: unknown = channel.isClosed()\n        ? {}\n        : await new Promise<unknown>((resolve, reject) => {\n            const timer = setTimeout(() => {\n              unsub();\n              reject(\n                new Error(\n                  `codex session ${sessionId} did not reply to stop within 5s.`,\n                ),\n              );\n            }, 5000);\n            timer.unref?.();\n            const unsub = channel.on('bridge-stop', msg => {\n              clearTimeout(timer);\n              unsub();\n              resolve(msg.data);\n            });\n            try {\n              channel.send({ type: 'stop' });\n            } catch (err) {\n              clearTimeout(timer);\n              unsub();\n              reject(err);\n            }\n          });\n\n      let stopTimer: ReturnType<typeof setTimeout> | undefined;\n      try {\n        if (proc) {\n          await Promise.race([\n            proc.wait(),\n            new Promise<void>(resolve => {\n              stopTimer = setTimeout(resolve, 5000);\n              stopTimer.unref?.();\n            }),\n          ]);\n        }\n      } finally {\n        if (stopTimer) clearTimeout(stopTimer);\n        try {\n          await proc?.kill();\n        } catch {}\n        channel.close();\n      }\n\n      const lifecycleData =\n        data != null && typeof data === 'object' && !Array.isArray(data)\n          ? { ...(data as Record<string, unknown>) }\n          : {};\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'codex',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...lifecycleData,\n          ...(latestTurnConfigurationFingerprint\n            ? {\n                turnConfigurationFingerprint:\n                  latestTurnConfigurationFingerprint,\n              }\n            : {}),\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n        } as HarnessV1ResumeSessionState['data'],\n      };\n      return payload;\n    },\n    doSuspendTurn: async () => {\n      if (stopped) {\n        throw new Error(\n          `codex session ${sessionId} is stopped; cannot suspend.`,\n        );\n      }\n      stopped = true;\n      /*\n       * Freeze the host at a precise cursor without stopping the active model\n       * turn. `channel.suspend` stops processing inbound frames, drains what\n       * was already dispatched, then closes the host socket with reason\n       * `'suspended'`. The bridge keeps the turn running and accumulates events\n       * past the cursor for the next slice to replay. The sandbox process is\n       * deliberately left alive.\n       */\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ContinueTurnState = {\n        type: 'continue-turn',\n        harnessId: 'codex',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...(latestThreadId ? { threadId: latestThreadId } : {}),\n          ...(latestTurnConfigurationFingerprint\n            ? {\n                turnConfigurationFingerprint:\n                  latestTurnConfigurationFingerprint,\n              }\n            : {}),\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n  };\n}\n\nfunction fingerprintCodexTurnConfiguration({\n  instructions,\n  tools,\n}: {\n  instructions: string | undefined;\n  tools: ReadonlyArray<{\n    name: string;\n    description?: string;\n    inputSchema: unknown;\n  }>;\n}): string {\n  return createHash('sha256')\n    .update(JSON.stringify({ instructions: instructions ?? null, tools }))\n    .digest('hex');\n}\n\n/*\n * Reduce a `HarnessV1Prompt` to the plain user text the bridge forwards to\n * Codex. The adapter does not yet map file and image parts into app-server\n * turn input, so throw rather than silently dropping them and producing a\n * truncated prompt.\n */\nfunction extractUserText(prompt: HarnessV1Prompt): string {\n  if (typeof prompt === 'string') return prompt;\n  const { content } = prompt;\n  if (typeof content === 'string') return content;\n  const parts: string[] = [];\n  for (const part of content) {\n    if (part.type !== 'text') {\n      throw new HarnessCapabilityUnsupportedError({\n        harnessId: 'codex',\n        message: `The codex harness does not yet support user message parts of type '${part.type}'. Pass a string or a user message whose content contains only text parts.`,\n      });\n    }\n    parts.push(part.text);\n  }\n  return parts.join('\\n\\n');\n}\n","import { createCodex } from './codex-harness';\n\n/**\n * Default `codex` harness instance with no overrides — suitable for the\n * common case where the underlying `codex` CLI's defaults are fine.\n * Equivalent to `createCodex()`.\n */\nexport const codex = createCodex();\n\nexport { createCodex } from './codex-harness';\nexport { VERSION } from './version';\nexport type { CodexHarnessSettings } from './codex-harness';\nexport type { CodexAuthenticationMode } from './codex-auth';\nexport type { JSONObject } from '@ai-sdk/provider';\n"],"mappings":";;;;;;;;;;;AAOA,MAAM,kBAAkB,sBAAsB;CAC5C,gBAAgB,IAAI,IAAI,yBAAyB,YAAY,GAAG;CAChE,kBAAkB,IAAI,IAAI,2BAA2B,YAAY,GAAG;CACpE,aAAa,IAAI,IAAI,sBAAsB,YAAY,GAAG;AAC5D,CAAC;AAaD,MAAa,sBAAsB;AAEnC,IAAI;AAEJ,eAAsB,oBAAiD;CACrE,IAAI,mBAAmB,MAAM,OAAO;CACpC,MAAM,CAAC,KAAK,MAAM,UAAU,MAAM,QAAQ,IAAI;EAC5C,gBAAgB,cAAc;EAC9B,gBAAgB,gBAAgB;EAChC,gBAAgB,WAAW;CAC7B,CAAC;CACD,kBAAkB;EAChB,WAAW;EACX,cAAc;EACd,OAAO;GACL;IAAE,MAAM,GAAG,oBAAoB;IAAgB,SAAS;GAAI;GAC5D;IAAE,MAAM,GAAG,oBAAoB;IAAkB,SAAS;GAAK;GAC/D;IAAE,MAAM,GAAG,oBAAoB;IAAc,SAAS;GAAO;EAC/D;EACA,UAAU,CACR,EACE,SAAS,yDACX,CACF;CACF;CACA,OAAO;AACT;;;ACvCA,MAAM,8BAA8B;AACpC,MAAa,0BAA0B;AAEvC,MAAa,yCAAyC,CACpD,sBACA,eACF;AAEA,SAAgB,kCAAkC,EAChD,KAAK,aACL,YAAY,oBACZ,MAAM,sBACqG;CAC3G,IAAI,CAAC,YAAY,iBAAiB,CAAC,mBAAmB,eACpD,OAAO,CAAC;CAEV,OAAO,CACL,sCAAsC;EACpC,UACE,YAAY,oBACX,uBAAuB,eACpB,8BAAA;EAEN,cAAc,EACZ,eAAe,UAAU,mBAAmB,gBAC9C;EACA,kBAAkB,EAChB,eAAe,UAAU,YAAY,gBACvC;CACF,CAAC,CACH;AACF;;;;;;;;;AAcA,SAAgB,gBACd,MACA,aAAiD,QAAQ,KACjC;CAExB,MAAM,4BADsB,mCAAmC,IACX,IAAI,OAAO;CAC/D,IAAI,SAAS,UACX,OAAO,WAAW,EAAE,YAAY,0BAA0B,CAAC;CAG7D,MAAM,qBAAqB,wBAAwB,EACjD,KAAK,0BACP,CAAC;CACD,IAAI,SAAS,gBAAgB,mBAAmB,QAC9C,OAAO,YAAY,EAAE,mBAAmB,CAAC;CAE3C,OAAO,WAAW,EAAE,YAAY,0BAA0B,CAAC;AAC7D;AAEA,SAAgB,+BACd,MACA,aAAiD,QAAQ,KACxB;CACjC,IAAI,mCAAmC,IAAI,GACzC,OAAO,wBAAwB,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,SAC1C,eACA;CAEN,IAAI,SAAS,UACX,OAAO;CAET,IAAI,SAAS,cACX,OAAO;CAET,OAAO,wBAAwB,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,SAChD,eACA;AACN;AAEA,SAAS,WAAW,EAClB,cAGyB;CACzB,MAAM,MAA8B,CAAC;CACrC,MAAM,SAAS,WAAW,kBAAkB,WAAW;CACvD,IAAI,QAAQ,IAAI,gBAAgB;CAChC,MAAM,UAAU,WAAW;CAC3B,IAAI,SAAS,IAAI,kBAAkB;CACnC,MAAM,eAAe,WAAW;CAChC,IAAI,cAAc,IAAI,sBAAsB;CAC5C,MAAM,UAAU,WAAW;CAC3B,IAAI,SAAS,IAAI,iBAAiB;CAClC,OAAO;AACT;AAEA,SAAS,YAAY,EACnB,sBAGyB;CACzB,MAAM,SAAS,mBAAmB;CAClC,MAAM,UAAU,sBAAsB,mBAAmB,OAAO;CAChE,MAAM,MAA8B,CAAC;CACrC,IAAI,QAAQ;EACV,IAAI,qBAAqB;EACzB,IAAI,gBAAgB;CACtB;CACA,IAAI,sBAAsB;CAC1B,IAAI,kBAAkB;CACtB,OAAO;AACT;AAEA,SAAS,sBAAsB,SAAyB;CACtD,MAAM,UAAU,QAAQ,QAAQ,QAAQ,EAAE;CAC1C,OAAO,QAAQ,SAAS,KAAK,IAAI,UAAU,GAAG,QAAQ;AACxD;;;AC/FA,MAAM,yBAAyB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AAOzB,SAAgB,8CAA8C,EAC5D,gBACA,GAAG,WAGgC;CACnC,MAAM,kBAAkB,kCAAkC,OAAO;CACjE,IAAI,kBAAkB,MAAM,OAAO;CAEnC,OAAO,gBAAgB,KAAI,oBAAmB;EAC5C,GAAG;EACH,WAAW;GACT,GAAG,eAAe;GAClB,SAAS;IACP,GAAG,eAAe,UAAU;IAC5B,GAAG;GACL;EACF;CACF,EAAE;AACJ;AA0BA,eAAsB,2BAA2B,EAC/C,MACA,aAAa,QAAQ,KACrB,0BACA,mBAAmB,yBAQoB;CACvC,MAAM,cAAc,gBAAgB,MAAM,UAAU;CACpD,IAAI,mCAAmC,IAAI,GACzC,OAAO,EAAE,YAAY;CAEvB,IACE,CAAC,gCAAgC;EAC/B;EACA,KAAK;EACL,qBAAqB,YAAY,iBAAiB;CACpD,CAAC,GAED,OAAO,EAAE,YAAY;CAGvB,OACG,MAAM,iBAAiB,EAAE,yBAAyB,CAAC,KAAM,EAAE,YAAY;AAE5E;AAEA,eAAsB,sBAAsB,EAC1C,MAAM,QAAQ,KACd,gBAAgB,QAAQ,GACxB,0BACA,WAAW,QAAQ,UACnB,SACA,UAQE,CAAC,GAAqD;CACxD,MAAM,YAAY,QAAQ,IAAI,cAAc,KAAK,eAAe,QAAQ,CAAC;CAMzE,MAAM,SAAS,MAAM,mBAAmB;EACtC;EACA,UAPe,KAAK,WAAW,WAOxB;EACP,aANA,gCAAgC,wBAAwB,KACvD,MAAM,kCAAkC,EAAE,UAAU,CAAC,KACtD;EAKA,SAAS,WAAW,mBAAmB,EAAE,SAAS,CAAC;CACrD,CAAC;CACD,IAAI,UAAU,MAAM,OAAO,KAAA;CAE3B,MAAM,aAAa,MAAM,kBAAkB,OAAO,KAAK;CACvD,IAAI,cAAc,MAAM,OAAO,KAAA;CAE/B,IAAI,cAAc,WAAW;CAC7B,IAAI,0BAA0B,EAAE,WAAW,WAAW,UAAU,CAAC,GAAG;EAClE,MAAM,YAAY,MAAM,wBAAwB;GAC9C,UAAU;GACV,UAAU;GACV,cAAc,WAAW;GACzB,eAAe;GACf,GAAI,SAAS,OAAO,CAAC,IAAI,EAAE,MAAM;EACnC,CAAC;EACD,cAAc,UAAU;EACxB,MAAM,OAAO,MAAM;GACjB,GAAG,OAAO;GACV,+BAAc,IAAI,KAAK,EAAA,CAAE,YAAY;GACrC,QAAQ;IACN,GAAG,OAAO,MAAM;IAChB,cAAc,UAAU;IACxB,eAAe,UAAU,gBAAgB,WAAW;GACtD;EACF,CAAC;CACH;CAEA,OAAO;EACL,aAAa;GACX,eAAe;GACf,iBAAiB;EACnB;EACA,GAAI,WAAW,aAAa,OACxB,CAAC,IACD,EACE,gBAAgB,EACd,sBAAsB,WAAW,UACnC,EACF;CACN;AACF;AAEA,eAAe,mBAAmB,EAChC,WACA,UACA,aACA,WAYA;CACA,IAAI,gBAAgB,aAAa,OAAO,KAAA;CAExC,MAAM,gBAAgB,YAAY;EAChC,MAAM,QAAQ,MAAM,kBAAkB,QAAQ;EAC9C,OAAO,SAAS,OACZ,KAAA,IACA;GACE;GACA,QAAQ,YACN,mBAAmB;IAAE;IAAU,OAAO;GAAQ,CAAC;EACnD;CACN;CACA,MAAM,mBAAmB,YAAY;EACnC,IAAI,WAAW,MAAM,OAAO,KAAA;EAC5B,MAAM,gBAAgB,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,SAAS;EACrE,MAAM,UAAU,OAAO,WAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;EACd,MAAM,OAAO,MAAM,QAAQ,KAAK;GAAE,SAAS;GAAc;EAAQ,CAAC;EAClE,IAAI,QAAQ,MAAM,OAAO,KAAA;EACzB,MAAM,QAAQ,MAAM,mBAAmB,IAAI;EAC3C,OAAO,SAAS,OACZ,KAAA,IACA;GACE;GACA,QAAQ,YACN,QAAQ,MAAM;IACZ,SAAS;IACT;IACA,OAAO,KAAK,UAAU,OAAO;GAC/B,CAAC;EACL;CACN;CAEA,IAAI,gBAAgB,QAAQ,OAAO,cAAc;CACjD,IAAI,gBAAgB,WAAW,OAAO,iBAAiB;CACvD,OAAQ,MAAM,iBAAiB,KAAM,cAAc;AACrD;AAEA,eAAe,kCAAkC,EAC/C,aAGqD;CACrD,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW,aAAa,GAAG,MAAM,CAAC,CAAC,YAC5D,KAAA,CACR;CACA,IAAI,QAAQ,MAAM,OAAO,KAAA;CACzB,KAAK,MAAM,QAAQ,KAAK,MAAM,OAAO,GAAG;EACtC,IAAI,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,GAAG,OAAO,KAAA;EAC7C,MAAM,QACJ,yFAAyF,KACvF,IACF;EACF,IAAI,SAAS,MACX,OAAO,gCAAgC,MAAM,EAAE;CAEnD;AACF;AAEA,SAAS,gCACP,OAC2C;CAC3C,OAAO,UAAU,UACf,UAAU,aACV,UAAU,UACV,UAAU,cACR,QACA,KAAA;AACN;AAEA,eAAe,kBACb,UACoC;CACpC,MAAM,OAAO,MAAM,SAAS,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;CACnE,OAAO,QAAQ,OAAO,KAAA,IAAY,mBAAmB,IAAI;AAC3D;AAEA,eAAe,mBACb,MACoC;CACpC,MAAM,SAAS,MAAM,cAAc,EAAE,KAAK,CAAC;CAC3C,OAAO,OAAO,WAAW,SAAS,OAAO,KAAK,IACzC,OAAO,QACR,KAAA;AACN;AAEA,eAAe,kBAAkB,OAQ/B;CACA,IAAI,MAAM,cAAc,aAAa,CAAC,SAAS,MAAM,MAAM,GACzD;CAEF,MAAM,cAAc,MAAM,OAAO;CACjC,MAAM,eAAe,MAAM,OAAO;CAClC,IAAI,OAAO,gBAAgB,YAAY,OAAO,iBAAiB,UAC7D;CAEF,MAAM,YAAY,MAAM,gBAAgB,EAAE,OAAO,YAAY,CAAC;CAC9D,IAAI,aAAa,MAAM,OAAO,KAAA;CAC9B,MAAM,YAAY,MAAM,OAAO;CAC/B,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,cAAc,WAAW,EAAE,UAAU,IAAI,CAAC;CACvD;AACF;AAEA,eAAe,mBAAmB,EAChC,UACA,SAIgB;CAChB,MAAM,MAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;CAClD,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,IAAI;CACjD,MAAM,UAAU,eAAe,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,EACpE,MAAM,IACR,CAAC;CACD,MAAM,MAAM,eAAe,GAAK;CAChC,MAAM,OAAO,eAAe,QAAQ;AACtC;AAEA,SAAS,mBAAmB,EAC1B,YAG2B;CAC3B,IAAI,QAAQ,QAAQ,GAClB,OAAO;EACL,MAAM,KAAK,EAAE,SAAS,WAAW;GAC/B,OAAO,0BAA0B;IAAE;IAAS;GAAQ,CAAC;EACvD;EACA,MAAM,MAAM,EAAE,SAAS,SAAS,SAAS;GAEvC,MAAM,oBAAoB;IACxB,SAAS;IACT,MAAM,CAAC,IAAI;IACX,OAAO,8BAJqC,sBAAsB,OAAO,EAAE,MAAM,sBAAsB,OAAO,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,SAAS,KAAK,EAAE;GAKnK,CAAC;EACH;CACF;CAEF,IAAI,QAAQ,QAAQ,GAClB,OAAO;EACL,MAAM,KAAK,EAAE,SAAS,WAAW;GAC/B,OAAO,+BAA+B,EACpC,YAAY;IACV;IACA,UAAU;IACV,QAAQ;GACV,EACF,CAAC;EACH;EACA,MAAM,MAAM,EAAE,SAAS,SAAS,SAAS;GACvC,MAAM,oBAAoB;IACxB,SAAS;IACT,MAAM;KACJ;KACA;KACA,GAAG,QAAQ,GAAG,QAAQ;KACtB;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACF;IACA,OAAO;GACT,CAAC;EACH;CACF;CAEF,IAAI,UAAU,QAAQ,GACpB,OAAO,0BAA0B;AAErC;AAEA,SAAS,sBAAsB,OAAuB;CACpD,OAAO,IAAI,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAK,EAAE;AAC/D;AAEA,eAAe,oBAAoB,EACjC,SACA,MACA,OACA,OAMgB;CAChB,MAAM,IAAI,SAAe,gBAAgB,WAAW;EAClD,MAAM,QAAQ,MAAM,SAAS,MAAM;GACjC,OAAO;IAAC;IAAQ;IAAU;GAAM;GAChC,GAAI,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI;EAC/B,CAAC;EACD,IAAI,SAAS;EACb,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAQ,UAAS;GAC/B,UAAU;EACZ,CAAC;EACD,MAAM,KAAK,SAAS,MAAM;EAC1B,MAAM,KAAK,UAAS,SAAQ;GAC1B,IAAI,SAAS,GAAG,eAAe;QAC1B,OAAO,IAAI,MAAM,UAAU,GAAG,QAAQ,oBAAoB,KAAK,EAAE,CAAC;EACzE,CAAC;EACD,MAAM,MAAM,IAAI,KAAK;CACvB,CAAC;AACH;AAEA,SAAS,4BAA0C;CACjD,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bf,OAAO;EACL,MAAM,KAAK,EAAE,SAAS,WAAW;GAC/B,OAAO,qCAAqC,EAC1C,YAAY,GAAG,QAAQ,GAAG,UAC5B,CAAC;EACH;EACA,MAAM,MAAM,EAAE,SAAS,SAAS,SAAS;GAEvC,MAAM,oBAAoB;IACxB,SAAS;IACT,MAAM;KAAC;KAAc;KAAmB;KAAY;IAAM;IAC1D,OAAO;IACP,KAAK;KACH,GAAG,QAAQ;KACX,gCAAgC;KAChC,gCAAgC,GAAG,QAAQ,GAAG;KAC9C,8BAA8B;IAChC;GACF,CAAC;EACH;CACF;AACF;;;ACldA,MAAa,wBAAwB;AAGrC,MAAa,qBAAqB,+BAA+B,OAAO;CACtE,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,iBAAiB,EAAE,KAAK;EAAC;EAAO;EAAU;EAAQ;EAAS;CAAK,CAAC,CAAC,CAAC,SAAS;CAC5E,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACxD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACvD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAKnD,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS;AACtC,CAAC;AAImC,EAAE,mBAAmB,QAAQ,CAC/D,oBACA,GAAG,oCACL,CAAC;;;ACpCD,MAAa,UAAA;;;ACqFb,MAAM,sBAAsB;;;;AAK5B,MAAM,mBAAmB,wBAAwB;AAmEjD,MAAM,sBAAsB;CAC1B,MAAM,WAAW,QAAQ;EACvB,YAAY;EACZ,aAAa;EACb,aAAa;EACb,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;CAC/C,CAAC;CACD,WAAW,WAAW,aAAa;EACjC,YAAY;EACZ,aAAa;EACb,aAAa;EACb,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;CAC7C,CAAC;CACD,aAAa;EACX,GAAG,KAAK;GACN,aAAa;GACb,aAAa,EAAE,OAAO;EACxB,CAAC;EACD,aAAa;CACf;CACA,YAAY;EACV,GAAG,KAAK;GACN,aAAa;GACb,aAAa,EAAE,OAAO;IACpB,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,CAAC,CAAC,SAAS;IAC9C,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;GACtC,CAAC;EACH,CAAC;EACD,aAAa;CACf;AACF;;;;;;AAOA,MAAM,0BAA0B,EAAE,OAAO;CACvC,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;;;;;;;;AAUD,MAAM,yBAAyB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,8BAA8B,EAAE,OAAO,CAAC,CAAC,SAAS;CAClD,QAAQ,wBAAwB,SAAS;CACzC,8BAA8B,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AAC1E,CAAC;AAID,SAAgB,YACd,WAAiC,CAAC,GACK;CACvC,OAAO;EACL,sBAAsB;EACtB,WAAW;EACX,cAAc;EACd,8BAA8B;EAC9B,8BAA8B;EAC9B,sBAAsB;EACtB,cAAc;EACd,SAAS,OAAM,cAAa;GAC1B,MAAM,QAAQ;GACd,IACE,UAAU,kBAAkB,QAC5B,UAAU,mBAAmB,aAE7B,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;GAEH,MAAM,iBAAiB,UAAU;GACjC,MAAM,yBACJ,4BAA4B,cAAc;GAC5C,MAAM,YAAY,QAAQ,iBAAiB,eAAe,KAAK,KAAA;GAC/D,6BAA6B;IAC3B;IACA,MAAM,SAAS;IACf,cAAc,SAAS;GACzB,CAAC;GACD,IAAI,SAAS,mBAAmB,QAAQ,aAAa,MACnD,MAAM,IAAI,kCAAkC;IAC1C,WAAW;IACX,SACE;GACJ,CAAC;GAEH,MAAM,iBAAiB,UAAU,gBAAgB,UAAU;GAC3D,MAAM,WAAW,kBAAkB;GACnC,MAAM,aAAa,UAAU,gBAAgB;GAC7C,MAAM,aACJ,YAAY,OAAO,gBAAgB,SAAS,WACvC,eAAe,OAMhB,KAAA;GACN,MAAM,iBAAiB,YAAY;GACnC,MAAM,uBACJ,OAAO,mBAAmB,YAAY,eAAe,SAAS,IAC1D,iBACA,KAAA;GACN,MAAM,+BACJ,OAAO,YAAY,iCAAiC,WAChD,WAAW,+BACX,KAAA;GACN,MAAM,SAAS,YAAY;GAC3B,MAAM,qBAAqB,+BAA+B,SAAS,IAAI;GACvE,MAAM,yBAAyB,MAAM,2BAA2B;IAC9D,MAAM,SAAS;IACf,0BACE,SAAS,aAAa;GAC1B,CAAC;GACD,MAAM,0BAA0B,uBAAuB;GACvD,IAAI,yBAAyB;GAC7B,IAAI;GACJ,IAAI,sBAAsB;GAC1B,IACE,+BAA+B,kBAC/B,eAAe,6BAA6B,MAC5C;IACA,+BACE,MAAM,oCAAoC;KACxC,aAAa;KACb,gCACE;KACF,sBAAsB,SAAS;KAC/B,sCACE,YAAY;IAChB,CAAC;IACH,yBAAyB;KACvB,GAAG;KACH,GAAG;IACL;IACA,MAAM,yBACJ,8CAA8C;KAC5C,KAAK;KACL,YAAY;KACZ,MAAM;KACN,gBAAgB,uBAAuB;IACzC,CAAC;IACH,IAAI,uBAAuB,SAAS,GAClC,MAAM,eAAe,0BACnB,sBACF;IAEF,sBAAsB;IACtB,IACE,uBAAuB,SAAS,KAChC,uBAAuB,YACvB,wBAAwB,mBAAmB,MAQ3C,uBAAuB,kBAAkB;GAE7C;GAIA,MAAM,iBAAiB,MAAM,sBAAsB;IACjD,SAAS;IACT,aAAa,UAAU;GACzB,CAAC;GACD,MAAM,WAAW,0BAA0B,EAAE,eAAe,CAAC;GAC7D,MAAM,eAAe,KAAK,MAAM,QAAQ,UAAUA,mBAAa;GAE/D,MAAM,UAAU,UAAU;GAK1B,MAAM,iBAAiB,GAJA,gCAAgC;IACrD,gBAAgB;IAChB,WAAW,UAAU;GACvB,CACuC,EAAE;GACzC,MAAM,YAAY,SAAS,oBAAoB;GAK/C,MAAM,SAAS,UAAU,eAAe;GACxC,MAAM,eAAe,UAChB,UACC,OACE,mCAAmC,OAAO;IACxC,WAAW,UAAU;IACrB,WAAW,KAAK,IAAI;GACtB,CAAC,CACH,IACF,KAAA;GACJ,MAAM,gBAAgB,yBAAyB;IAC7C,WAAW;IACX,WAAW,UAAU;GACvB,CAAC;GAUD,IAAI,QACF,IAAI;IACF,MAAM,WAAW,MAAM,sBAAsB;KAC3C;KACA,UAAU,SAAS;KACnB,MAAM,OAAO;IACf,CAAC;IACD,MAAM,iBAAiB,gBAAgB;KACrC;KACA,OAAO,OAAO;IAChB,CAAC;IACD,MAAM,gBAA8B,IAAI,eAAe;KACrD,UAAU,EAAE,kBACV,cAAc;MAAE,GAAG;MAAgB;KAAY,CAAC;KAClD,gBAAgB;KAChB,wBAAwB,OAAO;KAC/B;KACA;KACA,WAAW,SAAS;IACtB,CAAC;IACD,MAAM,cAAc,KAAK,aAAa,EAAE,QAAQ,KAAK,IAAI,KAAA,CAAS;IAClE,OAAO,cAAc;KACnB,WAAW,UAAU;KACrB,SAAS;KAET,MAAM,KAAA;KACN;KACA,iBAAiB,SAAS;KAC1B,WAAW,SAAS;KACpB,sBAAsB,UAAU;KAChC,aAAa,SAAS;KACtB,YAAY,SAAS;KACrB,SAAS,UAAU;KACnB,gBAAgB;KAChB,UAAU;KACV,+BAA+B;KAC/B,eAAe;KACf,YAAY,OAAO;KACnB,aAAa,OAAO;KACpB;KACA;KACA,OAAO,UAAU,eAAe;KAChC,gBAAgB,UAAU;KAC1B,SAAS;KACT;KACA;IACF,CAAC;GACH,QAAQ,CAER;GAWF,IAAI,kBAAoD,WACpD,UACA,KAAA;GACJ,IAAI,UAAU,YAAY;IACxB,MAAM,SAAS,MAAM,QAAQ,QAC3B,uBAAuB,aAAa;KAClC,MAAM,GAAG,eAAe;KACxB,aAAa,UAAU;IACzB,CAAC,CACH,CAAC,CAAC,YAAY,IAAI;IAClB,IAAK,MAAM,gBAAgB,MAAM,MAAO,UACtC,kBAAkB;GAEtB;GAEA,MAAM,OAAO,kBAAkB;IAC7B;IACA,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,QACJ,SAAS,mBAAmB,OACxB,kBAAkB,IAClB,SAAS,gBAAgB,SAAU;GACzC,MAAM,2BAA2B,sBAC7B,yBACA,MAAM,0BAA0B;IAC9B,aAAa;IACb,gCACE;IACF,sBAAsB,SAAS;GACjC,CAAC;GACL,IAAI,CAAC,qBACH,mCAAmC;IACjC,aAAa;IACb,sBAAsB;IACtB,gCACE;GACJ,CAAC;GAEH,MAAM,MAAM;IACV,GAAG;IACH,2BAA2B;IAC3B,sBAAsB;IACtB,gBAAgB,OAAO,IAAI;IAC3B,GAAI,oBAAoB,WACpB,EAAE,yBAAyB,IAAI,IAC/B,CAAC;GACP;GAEA,IAAI,oBAAoB,KAAA,GACtB,MAAM,uBAAuB,IAAI;IAC/B,SAAS,YAAY,WAAW,OAAO,EAAE,GAAG,WAAW,cAAc;IACrE,aAAa,UAAU;GACzB,CAAC;GAGH,MAAM,mBAAmB;IACvB,SAAS;IACT;IACA,YAAY;IACZ,aAAa,UAAU;GACzB,CAAC;GAED,MAAM,OAAO,MAAM,uBAAuB,MAAM;IAC9C,SAAS,QAAQ,WAAW,GAAG,aAAa,YAAY,EAAE,aAAa,WAAW,OAAO,EAAE,sBAAsB,WAAW,cAAc;IAC1I;IACA,aAAa,UAAU;GACzB,CAAC;GACD,MAAM,aAAuB,CAAC;GAC9B,MAAM,mBAAmB,2BAA2B;IAClD,QAAQ,KAAK;IACb,YAAY;IACZ,QAAQ;IACR,aAAa;GACf,CAAC;GAED,MAAM,EAAE,MAAM,cAAc,MAAM,mBAAmB;IACnD;IACA,SAAS;IACT;IACA,YAAY;IACZ;IACA,aAAa,UAAU;IACvB,qBAAqB,EAAE,MAAM,iBAC3B,yBAAyB;KACvB,SAAS;KACT;KACA;KACA;KACA,YAAY;IACd,CAAC;IACH,kBAAkB,EAAE,MAAM,iBACxB,yBAAyB;KACvB,SAAS;KACT;KACA;KACA;KACA,YAAY;IACd,CAAC;GACL,CAAC;GACD,yBAA8B,KAAK,MAAM;GAEzC,MAAM,WAAW,MAAM,sBAAsB;IAC3C;IACA,UAAU,SAAS;IACnB,MAAM;GACR,CAAC;GACD,MAAM,iBAAiB,gBAAgB;IAAE;IAAU;GAAM,CAAC;GAE1D,MAAM,UAAwB,IAAI,eAAe;IAC/C,UAAU,EAAE,kBACV,cAAc;KAAE,GAAG;KAAgB;IAAY,CAAC;IAClD,gBAAgB;IAChB;IACA;IACA,WAAW,SAAS;IAIpB,GAAI,oBAAoB,WACpB,EAAE,wBAAwB,QAAQ,mBAAmB,EAAE,IACvD,CAAC;GACP,CAAC;GACD,MAAM,QAAQ,KACZ,oBAAoB,WAAW,EAAE,QAAQ,KAAK,IAAI,KAAA,CACpD;GAEA,OAAO,cAAc;IACnB,WAAW,UAAU;IACrB;IACA;IACA;IACA,iBAAiB,SAAS;IAC1B,WAAW,SAAS;IACpB,sBAAsB,UAAU;IAChC,aAAa,SAAS;IACtB,YAAY,SAAS;IACrB,SAAS,UAAU;IACnB,gBAAgB;IAChB,UAAU,oBAAoB,KAAA;IAC9B,+BAA+B,oBAAoB,KAAA;IACnD,eAAe,oBAAoB;IACnC,YAAY;IACZ,aAAa;IACb;IACA;IACA,OAAO,UAAU,eAAe;IAChC,gBAAgB,UAAU;IAC1B,SAAS;IACT;IACA;GACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,kBAAkB,EACzB,gBACA,YAIS;CACT,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,IAAI,WAAW,kBAAkB,eAAe,MAAM,SAAS,GAC7D,OAAO,eAAe,MAAM;CAE9B,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CAEJ,CAAC;AACH;AAEA,SAAS,6BAA6B,EACpC,gBACA,MACA,gBAKO;CACP,IAAI,qBAAqB,gBAAgB;CACzC,IAAI,QAAQ,MACV,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CACJ,CAAC;CAEH,IAAI,gBAAgB,MAClB,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CACJ,CAAC;AAEL;AAEA,eAAe,sBAAsB,EACnC,gBACA,UACA,QAKiC;CACjC,IAAI,YAAY,MAAM,OAAO;CAC7B,IAAI,qBAAqB,gBACvB,OAAO,eAAe,gBAAgB;EAAE;EAAM,UAAU;CAAK,CAAC;CAEhE,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CACJ,CAAC;AACH;AAEA,SAAS,cAAc,EACrB,KACA,SACA,eAC2E;CAC3E,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,YAAY,SAAS;GACvB,OAAO,YAAY,0BAAU,IAAI,MAAM,8BAA8B,CAAC;GACtE;EACF;EAEA,MAAM,KAAK,IAAI,UAAU,KAAK,EAC5B,SAAS,WAAW,OAAO,KAAA,IAAY,EAAE,GAAG,QAAQ,EACtD,CAAC;EAED,IAAI,UAAU;EACd,MAAM,gBAAgB;GACpB,YAAY,oBAAoB,SAAS,OAAO;GAChD,GAAG,IAAI,QAAQ,MAAM;GACrB,GAAG,IAAI,SAAS,OAAO;EACzB;EACA,MAAM,qBAAqB,UAAmB;GAC5C,IAAI,SAAS;GACb,UAAU;GACV,QAAQ;GACR,GAAG,KAAK,eAAe,CAAC,CAAC;GACzB,IAAI;IACF,GAAG,UAAU;GACf,QAAQ;IACN,IAAI;KACF,GAAG,MAAM;IACX,QAAQ,CAER;GACF;GACA,OAAO,KAAK;EACd;EACA,MAAM,eAAe;GACnB,IAAI,SAAS;GACb,UAAU;GACV,QAAQ;GACR,QAAQ,EAAE;EACZ;EACA,MAAM,WAAW,QAAe;GAC9B,kBAAkB,GAAG;EACvB;EACA,MAAM,gBACJ,kBACE,YAAY,0BAAU,IAAI,MAAM,8BAA8B,CAChE;EAEF,GAAG,KAAK,QAAQ,MAAM;EACtB,GAAG,KAAK,SAAS,OAAO;EACxB,YAAY,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC/D,CAAC;AACH;AAEA,SAAS,cAAc,EACrB,WACA,SACA,MACA,OACA,iBACA,WACA,sBACA,aACA,YACA,SACA,gBACA,UACA,+BACA,eACA,YACA,aACA,WACA,8BACA,OACA,gBACA,SACA,gBACA,gCA0BmB;CACnB,IAAI,UAAU;CACd,IAAI;CAOJ,IAAI,wBAAwB,gCACxB,iBACA,KAAA;CAMJ,IAAI,iBAAiB;CACrB,IAAI,qCAAqC;CACzC,QAAQ,GAAG,kBAAiB,QAAO;EACjC,iBAAiB,IAAI;CACvB,CAAC;CACD,MAAM,+BAA+B,OAAO,EAC1C,QACA,cACA,OACA,kBAUyC;EACzC,MAAM,eAAe,MAAM,YAAY;GACrC;GACA,UAAU;GACV,WAAW;GACX;GACA;GACA,0BAA0B,EAAE,WAC1B,6BAA6B;GAC/B,8BAA8B,EAAE,WAAW,eACzC,qCAAqC,UAAU,IAAI;EACvD,CAAC;EACD,MAAM,kBAAkB,kCAAkC;GACxD;GACA;EACF,CAAC;EACD,MAAM,gBACJ,kBAAkB,SACjB,aAAa,WACX,sCAAsC,QACrC,uCAAuC;EAC7C,qCAAqC;EACrC,IAAI,eACF,wBAAwB,KAAA;EAE1B,OAAO,EAAE,cAAc;CACzB;CASA,MAAM,YAAY,aAMb;EACH,IAAI;EACJ,IAAI;EACJ,MAAM,OAAO,IAAI,SAAe,SAAS,WAAW;GAClD,iBAAiB;GACjB,gBAAgB;EAClB,CAAC;EACD,MAAM,uBAAuB,8CAA8C;GACzE,OAAM,YAAW,QAAQ,KAAK,OAAO;GACrC,aAAY,aAAY,QAAQ,GAAG,yBAAyB,QAAQ;GACpE,cAAa,aAAY,QAAQ,YAAY,QAAQ;EACvD,CAAC;EAED,MAAM,SAA4B,CAAC;EACnC,MAAM,WAAW,UAA+B;GAC9C,IAAI;IACF,SAAS,KAAK,KAAK;GACrB,QAAQ,CAAC;EACX;EAEA,MAAM,aAAa;GACjB;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,IAAI,YAAY;EAChB,MAAM,sBAAsB;GAC1B,IAAI,WAAW;GACf,YAAY;GACZ,qBAAqB,MAAM;GAC3B,KAAK,MAAM,KAAK,QAAQ,EAAE;GAC1B,eAAgB;EAClB;EACA,MAAM,eAAe,QAAiB;GACpC,IAAI,WAAW;GACf,YAAY;GACZ,qBAAqB,MAAM,GAAG;GAC9B,KAAK,MAAM,KAAK,QAAQ,EAAE;GAC1B,cAAe,GAAG;EACpB;EAEA,KAAK,MAAM,QAAQ,YACjB,OAAO,KACL,QAAQ,GAAG,OAAM,QAAO;GACtB,QAAQ,GAAG;EACb,CAAC,CACH;EAEF,OAAO,KACL,QAAQ,GAAG,WAAU,QAAO;GAC1B,QAAQ,GAAG;GACX,cAAc;EAChB,CAAC,CACH;EACA,OAAO,KACL,QAAQ,GAAG,UAAS,QAAO;GACzB,QAAQ,GAAG;GACX,YAAY,IAAI,KAAK;EACvB,CAAC,CACH;EAQA,MAAM,WAAW,OAAgB,WAAoB;GACnD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa;IAC1B,cAAc;IACd;GACF;GACA,4BAAY,IAAI,MAAM,+CAA+C,CAAC;EACxE;EACA,QAAQ,QAAQ,OAAO;EAEvB,MAAM,gBAAgB;GACpB,IAAI,WAAW;GACf,IAAI;IACF,QAAQ,KAAK,EAAE,MAAM,QAAQ,CAAC;GAChC,QAAQ,CAAC;GACT,YACE,SAAS,aAAa,UACpB,IAAI,aAAa,WAAW,YAAY,CAC5C;EACF;EACA,IAAI,SAAS,aAAa;GACxB,IAAI,SAAS,YAAY,SACvB,QAAQ;QAER,SAAS,YAAY,iBAAiB,SAAS,SAAS,EACtD,MAAM,KACR,CAAC;EAEL;EAyBA,OAAO;GACL,SAAA;IAvBA,kBAAkB,OAAM,UAAS;KAC/B,QAAQ,KAAK;MACX,MAAM;MACN,YAAY,MAAM;MAClB,QAAQ,MAAM;MACd,SAAS,MAAM;KACjB,CAAC;IACH;IACA,oBAAoB,OAAM,UAAS;KACjC,QAAQ,KAAK;MACX,MAAM;MACN,YAAY,MAAM;MAClB,UAAU,MAAM;MAChB,QAAQ,MAAM;KAChB,CAAC;IACH;IACA,mBAAmB,OAAM,SAAQ;KAC/B,MAAM,qBAAqB,OAAO,IAAI;IACxC;IACA;GAIM;GACN,YAAW,SAAQ;IAcjB,iBAR+B;KAC7B,IAAI,WAAW;KACf,IAAI;MACF,KAAK;KACP,SAAS,KAAK;MACZ,YAAY,GAAG;KACjB;IACF,GAAG,CACC,CAAC,CAAC,QAAQ;GAChB;EACF;CACF;CAEA,OAAO;EACL;EACA;EACA,cAAc,OAAM,eAAc;GAChC,IACE,WAAW,gBAAgB,SAAS,UACpC,WAAW,eAAe,UAAU,MAEpC,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;GAEH,MAAM,SAAS,WAAW,SAAS,CAAC,EAAA,CAAG,KAAI,OAAM;IAC/C,MAAM,EAAE;IACR,aAAa,EAAE;IACf,aAAa,EAAE;GACjB,EAAE;GACF,MAAM,EAAE,kBAAkB,MAAM,6BAA6B;IAC3D,QAAQ,WAAW;IACnB,cAAc,WAAW;IACzB;IACA,aAAa,WAAW;GAC1B,CAAC;GACD,MAAM,OAAO,SAAS;IACpB,MAAM,WAAW;IACjB,aAAa,WAAW;GAC1B,CAAC;GAED,MAAM,eAAe;IACnB,MAAM;IACN,QAAQ,gBAAgB,WAAW,MAAM;IACzC;IACA,GAAI,WAAW,kBAAkB,OAC7B,CAAC,IACD,EAAE,gBAAgB,WAAW,eAAe;IAChD,GAAI,WAAW,eACX,EAAE,cAAc,WAAW,aAAa,IACxC,CAAC;IACL,OAAO,WAAW,SAAS;IAC3B;IACA;IACA,GAAI,wBAAwB,OAAO,CAAC,IAAI,EAAE,qBAAqB;IAC/D,GAAI,eAAe,OAAO,CAAC,IAAI,EAAE,YAAY;IAC7C,GAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW;IAC3C,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,QAAQ;IACrC,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;IAC3C,GAAI,wBACA,EAAE,gBAAgB,sBAAsB,IACxC,CAAC;IACL,GAAI,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;IAC/C,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;GAC3B;GACA,wBAAwB,KAAA;GACxB,KAAK,gBAAgB,QAAQ,KAAK,YAAY,CAAC;GAE/C,OAAO,KAAK;EACd;EACA,gBAAgB,OAAM,iBAAgB;GACpC,IACE,aAAa,gBAAgB,SAAS,UACtC,aAAa,eAAe,UAAU,MAEtC,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;GAEH,MAAM,SAAS,aAAa,SAAS,CAAC,EAAA,CAAG,KAAI,OAAM;IACjD,MAAM,EAAE;IACR,aAAa,EAAE;IACf,aAAa,EAAE;GACjB,EAAE;GACF,MAAM,EAAE,kBAAkB,MAAM,6BAA6B;IAC3D,QAAQ,aAAa;IACrB,cAAc,aAAa;IAC3B;IACA,aAAa,aAAa;GAC5B,CAAC;GACD,MAAM,OAAO,SAAS;IACpB,MAAM,aAAa;IACnB,aAAa,aAAa;GAC5B,CAAC;GAcD,IAAI,eAAe;IACjB,MAAM,WAAW,yBAAyB;IAC1C,wBAAwB,KAAA;IACxB,KAAK,gBACH,QAAQ,KAAK;KACX,MAAM;KAQN,QAAQ;KACR;KACA,GAAI,aAAa,kBAAkB,OAC/B,CAAC,IACD,EAAE,gBAAgB,aAAa,eAAe;KAClD,GAAI,aAAa,eACb,EAAE,cAAc,aAAa,aAAa,IAC1C,CAAC;KACL,OAAO,aAAa,SAAS;KAC7B;KACA;KACA,GAAI,wBAAwB,OAAO,CAAC,IAAI,EAAE,qBAAqB;KAC/D,GAAI,eAAe,OAAO,CAAC,IAAI,EAAE,YAAY;KAC7C,GAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW;KAC3C,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,QAAQ;KACrC,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAC3C,GAAI,WAAW,EAAE,gBAAgB,SAAS,IAAI,CAAC;KAC/C,GAAI,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;KAC/C,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;IAC3B,CAAC,CACH;GACF;GAEA,OAAO,KAAK;EACd;EACA,WAAW,YAAY;GAOrB,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;EACH;EACA,UAAU,YAAY;GACpB,IAAI,SACF,MAAM,IAAI,MACR,iBAAiB,UAAU,oCAC7B;GAEF,UAAU;GACV,MAAM,kBAAkB,MAAM,QAAQ,QAAQ;GAwB9C,OAAO;IAtBL,MAAM;IACN,WAAW;IACX,sBAAsB;IACtB,MAAM;KACJ,GAAI,iBAAiB,EAAE,UAAU,eAAe,IAAI,CAAC;KACrD,GAAI,qCACA,EACE,8BACE,mCACJ,IACA,CAAC;KACL,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;KACnC,QAAQ;MACN,MAAM;MACN,OAAO;MACP;MACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;KAC3C;IACF;GAEW;EACf;EACA,WAAW,YAAY;GACrB,IAAI,SAAS,OAAO;GACpB,UAAU;GACV,eAAe,YAAY;IAGzB,QAAQ,WAAW;IACnB,IAAI;KACF,IAAI,CAAC,QAAQ,SAAS,GACpB,QAAQ,KAAK,EAAE,MAAM,UAAU,CAAC;IAEpC,QAAQ,CAAC;IACT,IAAI;IACJ,IAAI;KACF,IAAI,MACF,MAAM,QAAQ,KAAK,CACjB,KAAK,KAAK,GACV,IAAI,SAAc,YAAW;MAC3B,YAAY,WAAW,SAAS,GAAI;MACpC,UAAU,QAAQ;KACpB,CAAC,CACH,CAAC;IAEL,UAAU;KACR,IAAI,WAAW,aAAa,SAAS;KACrC,IAAI;MACF,MAAM,MAAM,KAAK;KACnB,QAAQ,CAAC;KACT,QAAQ,MAAM;IAChB;GACF,EAAA,CAAG;GACH,OAAO;EACT;EACA,QAAQ,YAAY;GAClB,IAAI,SACF,MAAM,IAAI,MACR,iBAAiB,UAAU,kCAC7B;GAEF,UAAU;GAaV,QAAQ,WAAW;GACnB,MAAM,OAAgB,QAAQ,SAAS,IACnC,CAAC,IACD,MAAM,IAAI,SAAkB,SAAS,WAAW;IAC9C,MAAM,QAAQ,iBAAiB;KAC7B,MAAM;KACN,uBACE,IAAI,MACF,iBAAiB,UAAU,kCAC7B,CACF;IACF,GAAG,GAAI;IACP,MAAM,QAAQ;IACd,MAAM,QAAQ,QAAQ,GAAG,gBAAe,QAAO;KAC7C,aAAa,KAAK;KAClB,MAAM;KACN,QAAQ,IAAI,IAAI;IAClB,CAAC;IACD,IAAI;KACF,QAAQ,KAAK,EAAE,MAAM,OAAO,CAAC;IAC/B,SAAS,KAAK;KACZ,aAAa,KAAK;KAClB,MAAM;KACN,OAAO,GAAG;IACZ;GACF,CAAC;GAEL,IAAI;GACJ,IAAI;IACF,IAAI,MACF,MAAM,QAAQ,KAAK,CACjB,KAAK,KAAK,GACV,IAAI,SAAc,YAAW;KAC3B,YAAY,WAAW,SAAS,GAAI;KACpC,UAAU,QAAQ;IACpB,CAAC,CACH,CAAC;GAEL,UAAU;IACR,IAAI,WAAW,aAAa,SAAS;IACrC,IAAI;KACF,MAAM,MAAM,KAAK;IACnB,QAAQ,CAAC;IACT,QAAQ,MAAM;GAChB;GAuBA,OAAO;IAhBL,MAAM;IACN,WAAW;IACX,sBAAsB;IACtB,MAAM;KACJ,GARF,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,IAC3D,EAAE,GAAI,KAAiC,IACvC,CAAC;KAOH,GAAI,qCACA,EACE,8BACE,mCACJ,IACA,CAAC;KACL,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;IACrC;GAEW;EACf;EACA,eAAe,YAAY;GACzB,IAAI,SACF,MAAM,IAAI,MACR,iBAAiB,UAAU,6BAC7B;GAEF,UAAU;GASV,MAAM,kBAAkB,MAAM,QAAQ,QAAQ;GAwB9C,OAAO;IAtBL,MAAM;IACN,WAAW;IACX,sBAAsB;IACtB,MAAM;KACJ,GAAI,iBAAiB,EAAE,UAAU,eAAe,IAAI,CAAC;KACrD,GAAI,qCACA,EACE,8BACE,mCACJ,IACA,CAAC;KACL,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;KACnC,QAAQ;MACN,MAAM;MACN,OAAO;MACP;MACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;KAC3C;IACF;GAEW;EACf;CACF;AACF;AAEA,SAAS,kCAAkC,EACzC,cACA,SAQS;CACT,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,KAAK,UAAU;EAAE,cAAc,gBAAgB;EAAM;CAAM,CAAC,CAAC,CAAC,CACrE,OAAO,KAAK;AACjB;AAQA,SAAS,gBAAgB,QAAiC;CACxD,IAAI,OAAO,WAAW,UAAU,OAAO;CACvC,MAAM,EAAE,YAAY;CACpB,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,QAAQ,SAAS;EAC1B,IAAI,KAAK,SAAS,QAChB,MAAM,IAAI,kCAAkC;GAC1C,WAAW;GACX,SAAS,sEAAsE,KAAK,KAAK;EAC3F,CAAC;EAEH,MAAM,KAAK,KAAK,IAAI;CACtB;CACA,OAAO,MAAM,KAAK,MAAM;AAC1B;;;;;;;;AC51CA,MAAa,QAAQ,YAAY"}
+{"version":3,"file":"index.js","names":["BOOTSTRAP_DIR"],"sources":["../src/codex-bootstrap.ts","../src/codex-auth.ts","../src/codex-subscription.ts","../src/codex-bridge-protocol.ts","../src/version.ts","../src/codex-harness.ts","../src/index.ts"],"sourcesContent":["import type { HarnessV1Bootstrap } from '@ai-sdk/harness';\nimport { createReadBridgeAsset } from '@ai-sdk/harness/utils';\n\n/*\n * Keep every asset URL literal so bundlers can emit each file separately.\n * Dynamic new URL() paths can collapse multiple assets into one resolution.\n */\nconst readBridgeAsset = createReadBridgeAsset({\n  'package.json': new URL('./bridge/package.json', import.meta.url),\n  'pnpm-lock.yaml': new URL('./bridge/pnpm-lock.yaml', import.meta.url),\n  'index.mjs': new URL('./bridge/index.mjs', import.meta.url),\n});\n\n/*\n * Bootstrap is derived state stored under `$HOME/.ai-sdk-harness`, outside\n * the agent's working directory. Snapshot-capable providers preserve the\n * installed CLI, bridge, and recipe marker there.\n *\n * The session work dir (`startOpts.sessionWorkDir`) lives under the sandbox's\n * default working directory — the provider's persistent mount — so any files\n * the agent edits survive both detach -> attach and stop -> snapshot -> resume\n * cycles. Session-specific harness state lives under\n * `$HOME/.ai-sdk-harness/.agent-runs`, outside the agent workdir.\n */\nexport const CODEX_BOOTSTRAP_DIR = '.harness-bootstrap/codex';\n\nlet cachedBootstrap: HarnessV1Bootstrap | undefined;\n\nexport async function getCodexBootstrap(): Promise<HarnessV1Bootstrap> {\n  if (cachedBootstrap != null) return cachedBootstrap;\n  const [pkg, lock, bridge] = await Promise.all([\n    readBridgeAsset('package.json'),\n    readBridgeAsset('pnpm-lock.yaml'),\n    readBridgeAsset('index.mjs'),\n  ]);\n  cachedBootstrap = {\n    harnessId: 'codex',\n    bootstrapDir: CODEX_BOOTSTRAP_DIR,\n    files: [\n      { path: `${CODEX_BOOTSTRAP_DIR}/package.json`, content: pkg },\n      { path: `${CODEX_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },\n      { path: `${CODEX_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },\n    ],\n    commands: [\n      {\n        command: 'pnpm install --frozen-lockfile --store-dir .pnpm-store',\n      },\n    ],\n  };\n  return cachedBootstrap;\n}\n","import type {\n  HarnessV1Authentication,\n  HarnessV1RequestTransformation,\n  HarnessV1RequestTransformationSources,\n} from '@ai-sdk/harness';\nimport {\n  createCredentialRequestTransformation,\n  getAiGatewayAuthFromEnv,\n  isHarnessAuthenticationEnvironment,\n} from '@ai-sdk/harness/utils';\n\nconst DEFAULT_AI_GATEWAY_BASE_URL = 'https://ai-gateway.vercel.sh/v1';\nexport const DEFAULT_OPENAI_BASE_URL = 'https://api.openai.com/v1';\n\nexport const CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES = [\n  'AI_GATEWAY_API_KEY',\n  'CODEX_API_KEY',\n] as const;\n\nexport function createCodexRequestTransformations({\n  env: environment,\n  sandboxEnv: sandboxEnvironment,\n  auth: authenticationMode,\n}: HarnessV1RequestTransformationSources<CodexResolvedAuthenticationMode>): HarnessV1RequestTransformation[] {\n  if (!environment.CODEX_API_KEY || !sandboxEnvironment.CODEX_API_KEY) {\n    return [];\n  }\n  return [\n    createCredentialRequestTransformation({\n      matchUrl:\n        environment.OPENAI_BASE_URL ??\n        (authenticationMode === 'ai-gateway'\n          ? DEFAULT_AI_GATEWAY_BASE_URL\n          : DEFAULT_OPENAI_BASE_URL),\n      matchHeaders: {\n        Authorization: `Bearer ${sandboxEnvironment.CODEX_API_KEY}`,\n      },\n      transformHeaders: {\n        Authorization: `Bearer ${environment.CODEX_API_KEY}`,\n      },\n    }),\n  ];\n}\n\nexport type CodexResolvedAuthenticationMode = 'direct' | 'ai-gateway';\n\nexport type CodexAuthenticationMode = HarnessV1Authentication;\n\n/**\n * Resolve the environment-variable blob the codex bridge needs. Precedence:\n *\n *   1. An explicit authentication mode pins the selected route.\n *   2. Auto-detect from the host process env: gateway first\n *      (`AI_GATEWAY_API_KEY` / `VERCEL_OIDC_TOKEN`), then `CODEX_API_KEY` /\n *      `OPENAI_API_KEY`.\n */\nexport function resolveCodexEnv(\n  auth: CodexAuthenticationMode | undefined,\n  processEnv: Record<string, string | undefined> = process.env,\n): Record<string, string> {\n  const suppliedEnvironment = isHarnessAuthenticationEnvironment(auth);\n  const authenticationEnvironment = suppliedEnvironment ? auth : processEnv;\n  if (auth === 'direct') {\n    return pickOpenAI({ processEnv: authenticationEnvironment });\n  }\n\n  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({\n    env: authenticationEnvironment,\n  });\n  if (auth === 'ai-gateway' || gatewayAuthFromEnv.apiKey) {\n    return pickGateway({ gatewayAuthFromEnv });\n  }\n  return pickOpenAI({ processEnv: authenticationEnvironment });\n}\n\nexport function resolveCodexAuthenticationMode(\n  auth: CodexAuthenticationMode | undefined,\n  processEnv: Record<string, string | undefined> = process.env,\n): CodexResolvedAuthenticationMode {\n  if (isHarnessAuthenticationEnvironment(auth)) {\n    return getAiGatewayAuthFromEnv({ env: auth }).apiKey\n      ? 'ai-gateway'\n      : 'direct';\n  }\n  if (auth === 'direct') {\n    return 'direct';\n  }\n  if (auth === 'ai-gateway') {\n    return 'ai-gateway';\n  }\n  return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey\n    ? 'ai-gateway'\n    : 'direct';\n}\n\nfunction pickOpenAI({\n  processEnv,\n}: {\n  processEnv: Record<string, string | undefined>;\n}): Record<string, string> {\n  const env: Record<string, string> = {};\n  const apiKey = processEnv.OPENAI_API_KEY ?? processEnv.CODEX_API_KEY;\n  if (apiKey) env.CODEX_API_KEY = apiKey;\n  const baseUrl = processEnv.OPENAI_BASE_URL;\n  if (baseUrl) env.OPENAI_BASE_URL = baseUrl;\n  const organization = processEnv.OPENAI_ORGANIZATION;\n  if (organization) env.OPENAI_ORGANIZATION = organization;\n  const project = processEnv.OPENAI_PROJECT;\n  if (project) env.OPENAI_PROJECT = project;\n  return env;\n}\n\nfunction pickGateway({\n  gatewayAuthFromEnv,\n}: {\n  gatewayAuthFromEnv: ReturnType<typeof getAiGatewayAuthFromEnv>;\n}): Record<string, string> {\n  const apiKey = gatewayAuthFromEnv.apiKey;\n  const baseUrl = toCodexGatewayBaseUrl(gatewayAuthFromEnv.baseUrl);\n  const env: Record<string, string> = {};\n  if (apiKey) {\n    env.AI_GATEWAY_API_KEY = apiKey;\n    env.CODEX_API_KEY = apiKey;\n  }\n  env.AI_GATEWAY_BASE_URL = baseUrl;\n  env.OPENAI_BASE_URL = baseUrl;\n  return env;\n}\n\nfunction toCodexGatewayBaseUrl(baseUrl: string): string {\n  const trimmed = baseUrl.replace(/\\/+$/, '');\n  return trimmed.endsWith('/v1') ? trimmed : `${trimmed}/v1`;\n}\n","import { spawn } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n  chmod,\n  mkdir,\n  readFile,\n  realpath,\n  rename,\n  writeFile,\n} from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport type {\n  HarnessV1RequestTransformation,\n  HarnessV1RequestTransformationSources,\n} from '@ai-sdk/harness';\nimport {\n  getJwtExpiresAt,\n  isAccessTokenExpiringSoon,\n  isHarnessAuthenticationEnvironment,\n  isLinux,\n  isMacOS,\n  isWindows,\n  readLinuxSecretServicePassword,\n  readMacOSKeychainPassword,\n  readWindowsCredentialManagerPassword,\n  refreshOAuthAccessToken,\n  shouldResolveNativeSubscription,\n} from '@ai-sdk/harness/utils';\nimport { isRecord, safeParseJSON } from '@ai-sdk/provider-utils';\nimport {\n  createCodexRequestTransformations,\n  resolveCodexEnv,\n  type CodexAuthenticationMode,\n  type CodexResolvedAuthenticationMode,\n} from './codex-auth';\n\nconst CHATGPT_CODEX_BASE_URL = 'https://chatgpt.com/backend-api/codex';\nconst OPENAI_TOKEN_URL = 'https://auth.openai.com/oauth/token';\nconst OPENAI_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';\n\nexport type CodexResolvedAuthentication = {\n  readonly environment: Record<string, string>;\n  readonly requestHeaders?: Readonly<Record<string, string>>;\n};\n\nexport function createCodexSubscriptionRequestTransformations({\n  requestHeaders,\n  ...sources\n}: HarnessV1RequestTransformationSources<CodexResolvedAuthenticationMode> & {\n  requestHeaders?: Readonly<Record<string, string>>;\n}): HarnessV1RequestTransformation[] {\n  const transformations = createCodexRequestTransformations(sources);\n  if (requestHeaders == null) return transformations;\n\n  return transformations.map(transformation => ({\n    ...transformation,\n    transform: {\n      ...transformation.transform,\n      headers: {\n        ...transformation.transform.headers,\n        ...requestHeaders,\n      },\n    },\n  }));\n}\n\ntype CodexAuthCredentialsStoreMode = 'file' | 'keyring' | 'auto' | 'ephemeral';\n\ntype CodexKeyring = {\n  read(options: {\n    service: string;\n    account: string;\n  }): Promise<string | undefined>;\n  write(options: {\n    service: string;\n    account: string;\n    value: string;\n  }): Promise<void>;\n};\n\ntype CodexAuthFile = {\n  readonly auth_mode?: unknown;\n  readonly tokens?: {\n    readonly access_token?: unknown;\n    readonly refresh_token?: unknown;\n    readonly account_id?: unknown;\n  };\n  readonly [key: string]: unknown;\n};\n\nexport async function resolveCodexAuthentication({\n  auth,\n  processEnv = process.env,\n  authCredentialsStoreMode,\n  readSubscription = readCodexSubscription,\n}: {\n  auth: CodexAuthenticationMode | undefined;\n  processEnv?: Record<string, string | undefined>;\n  authCredentialsStoreMode?: unknown;\n  readSubscription?: (options?: {\n    authCredentialsStoreMode?: unknown;\n  }) => Promise<CodexResolvedAuthentication | undefined>;\n}): Promise<CodexResolvedAuthentication> {\n  const environment = resolveCodexEnv(auth, processEnv);\n  if (isHarnessAuthenticationEnvironment(auth)) {\n    return { environment };\n  }\n  if (\n    !shouldResolveNativeSubscription({\n      auth,\n      env: environment,\n      hasDirectCredential: environment.CODEX_API_KEY != null,\n    })\n  ) {\n    return { environment };\n  }\n\n  return (\n    (await readSubscription({ authCredentialsStoreMode })) ?? { environment }\n  );\n}\n\nexport async function readCodexSubscription({\n  env = process.env,\n  homeDirectory = homedir(),\n  authCredentialsStoreMode,\n  platform = process.platform,\n  keyring,\n  fetch,\n}: {\n  env?: Record<string, string | undefined>;\n  homeDirectory?: string;\n  authCredentialsStoreMode?: unknown;\n  platform?: NodeJS.Platform;\n  keyring?: CodexKeyring;\n  fetch?: typeof globalThis.fetch;\n} = {}): Promise<CodexResolvedAuthentication | undefined> {\n  const codexHome = resolve(env.CODEX_HOME ?? join(homeDirectory, '.codex'));\n  const authPath = join(codexHome, 'auth.json');\n  const storageMode =\n    toCodexAuthCredentialsStoreMode(authCredentialsStoreMode) ??\n    (await readCodexAuthCredentialsStoreMode({ codexHome })) ??\n    'file';\n  const stored = await readCodexAuthStore({\n    codexHome,\n    authPath,\n    storageMode,\n    keyring: keyring ?? createCodexKeyring({ platform }),\n  });\n  if (stored == null) return undefined;\n\n  const credential = await toCodexCredential(stored.value);\n  if (credential == null) return undefined;\n\n  let accessToken = credential.accessToken;\n  if (isAccessTokenExpiringSoon({ expiresAt: credential.expiresAt })) {\n    const refreshed = await refreshOAuthAccessToken({\n      tokenUrl: OPENAI_TOKEN_URL,\n      clientId: OPENAI_CLIENT_ID,\n      refreshToken: credential.refreshToken,\n      requestFormat: 'json',\n      ...(fetch == null ? {} : { fetch }),\n    });\n    accessToken = refreshed.accessToken;\n    await stored.write({\n      ...stored.value,\n      last_refresh: new Date().toISOString(),\n      tokens: {\n        ...stored.value.tokens,\n        access_token: refreshed.accessToken,\n        refresh_token: refreshed.refreshToken ?? credential.refreshToken,\n      },\n    });\n  }\n\n  return {\n    environment: {\n      CODEX_API_KEY: accessToken,\n      OPENAI_BASE_URL: CHATGPT_CODEX_BASE_URL,\n    },\n    ...(credential.accountId == null\n      ? {}\n      : {\n          requestHeaders: {\n            'ChatGPT-Account-ID': credential.accountId,\n          },\n        }),\n  };\n}\n\nasync function readCodexAuthStore({\n  codexHome,\n  authPath,\n  storageMode,\n  keyring,\n}: {\n  codexHome: string;\n  authPath: string;\n  storageMode: CodexAuthCredentialsStoreMode;\n  keyring: CodexKeyring | undefined;\n}): Promise<\n  | {\n      value: CodexAuthFile;\n      write(value: CodexAuthFile): Promise<void>;\n    }\n  | undefined\n> {\n  if (storageMode === 'ephemeral') return undefined;\n\n  const readFileStore = async () => {\n    const value = await readCodexAuthFile(authPath);\n    return value == null\n      ? undefined\n      : {\n          value,\n          write: (updated: CodexAuthFile) =>\n            writeCodexAuthFile({ authPath, value: updated }),\n        };\n  };\n  const readKeyringStore = async () => {\n    if (keyring == null) return undefined;\n    const canonicalHome = await realpath(codexHome).catch(() => codexHome);\n    const account = `cli|${createHash('sha256')\n      .update(canonicalHome)\n      .digest('hex')\n      .slice(0, 16)}`;\n    const text = await keyring.read({ service: 'Codex Auth', account });\n    if (text == null) return undefined;\n    const value = await parseCodexAuthFile(text);\n    return value == null\n      ? undefined\n      : {\n          value,\n          write: (updated: CodexAuthFile) =>\n            keyring.write({\n              service: 'Codex Auth',\n              account,\n              value: JSON.stringify(updated),\n            }),\n        };\n  };\n\n  if (storageMode === 'file') return readFileStore();\n  if (storageMode === 'keyring') return readKeyringStore();\n  return (await readKeyringStore()) ?? readFileStore();\n}\n\nasync function readCodexAuthCredentialsStoreMode({\n  codexHome,\n}: {\n  codexHome: string;\n}): Promise<CodexAuthCredentialsStoreMode | undefined> {\n  const text = await readFile(join(codexHome, 'config.toml'), 'utf8').catch(\n    () => undefined,\n  );\n  if (text == null) return undefined;\n  for (const line of text.split(/\\r?\\n/)) {\n    if (line.trimStart().startsWith('[')) return undefined;\n    const match =\n      /^\\s*cli_auth_credentials_store\\s*=\\s*[\"'](file|keyring|auto|ephemeral)[\"']\\s*(?:#.*)?$/.exec(\n        line,\n      );\n    if (match != null) {\n      return toCodexAuthCredentialsStoreMode(match[1]);\n    }\n  }\n}\n\nfunction toCodexAuthCredentialsStoreMode(\n  value: unknown,\n): CodexAuthCredentialsStoreMode | undefined {\n  return value === 'file' ||\n    value === 'keyring' ||\n    value === 'auto' ||\n    value === 'ephemeral'\n    ? value\n    : undefined;\n}\n\nasync function readCodexAuthFile(\n  authPath: string,\n): Promise<CodexAuthFile | undefined> {\n  const text = await readFile(authPath, 'utf8').catch(() => undefined);\n  return text == null ? undefined : parseCodexAuthFile(text);\n}\n\nasync function parseCodexAuthFile(\n  text: string,\n): Promise<CodexAuthFile | undefined> {\n  const parsed = await safeParseJSON({ text });\n  return parsed.success && isRecord(parsed.value)\n    ? (parsed.value as CodexAuthFile)\n    : undefined;\n}\n\nasync function toCodexCredential(value: CodexAuthFile): Promise<\n  | {\n      accessToken: string;\n      refreshToken: string;\n      expiresAt: number;\n      accountId?: string;\n    }\n  | undefined\n> {\n  if (value.auth_mode !== 'chatgpt' || !isRecord(value.tokens)) {\n    return undefined;\n  }\n  const accessToken = value.tokens.access_token;\n  const refreshToken = value.tokens.refresh_token;\n  if (typeof accessToken !== 'string' || typeof refreshToken !== 'string') {\n    return undefined;\n  }\n  const expiresAt = await getJwtExpiresAt({ token: accessToken });\n  if (expiresAt == null) return undefined;\n  const accountId = value.tokens.account_id;\n  return {\n    accessToken,\n    refreshToken,\n    expiresAt,\n    ...(typeof accountId === 'string' ? { accountId } : {}),\n  };\n}\n\nasync function writeCodexAuthFile({\n  authPath,\n  value,\n}: {\n  authPath: string;\n  value: CodexAuthFile;\n}): Promise<void> {\n  await mkdir(dirname(authPath), { recursive: true });\n  const temporaryPath = `${authPath}.${process.pid}.tmp`;\n  await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\\n`, {\n    mode: 0o600,\n  });\n  await chmod(temporaryPath, 0o600);\n  await rename(temporaryPath, authPath);\n}\n\nfunction createCodexKeyring({\n  platform,\n}: {\n  platform: NodeJS.Platform;\n}): CodexKeyring | undefined {\n  if (isMacOS(platform)) {\n    return {\n      async read({ service, account }) {\n        return readMacOSKeychainPassword({ service, account });\n      },\n      async write({ service, account, value }) {\n        const command = `add-generic-password -U -s ${shellQuoteForSecurity(service)} -a ${shellQuoteForSecurity(account)} -X ${Buffer.from(value, 'utf8').toString('hex')}\\n`;\n        await runCommandWithInput({\n          command: '/usr/bin/security',\n          args: ['-i'],\n          input: command,\n        });\n      },\n    };\n  }\n  if (isLinux(platform)) {\n    return {\n      async read({ service, account }) {\n        return readLinuxSecretServicePassword({\n          attributes: {\n            service,\n            username: account,\n            target: 'default',\n          },\n        });\n      },\n      async write({ service, account, value }) {\n        await runCommandWithInput({\n          command: 'secret-tool',\n          args: [\n            'store',\n            '--label',\n            `${account}@${service}:default`,\n            'service',\n            service,\n            'username',\n            account,\n            'target',\n            'default',\n            'application',\n            'rust-keyring',\n          ],\n          input: value,\n        });\n      },\n    };\n  }\n  if (isWindows(platform)) {\n    return createWindowsCodexKeyring();\n  }\n}\n\nfunction shellQuoteForSecurity(value: string): string {\n  return `\"${value.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"')}\"`;\n}\n\nasync function runCommandWithInput({\n  command,\n  args,\n  input,\n  env,\n}: {\n  command: string;\n  args: string[];\n  input: string;\n  env?: NodeJS.ProcessEnv;\n}): Promise<void> {\n  await new Promise<void>((resolvePromise, reject) => {\n    const child = spawn(command, args, {\n      stdio: ['pipe', 'ignore', 'pipe'],\n      ...(env == null ? {} : { env }),\n    });\n    let stderr = '';\n    child.stderr.setEncoding('utf8');\n    child.stderr.on('data', chunk => {\n      stderr += chunk;\n    });\n    child.once('error', reject);\n    child.once('close', code => {\n      if (code === 0) resolvePromise();\n      else reject(new Error(stderr || `${command} exited with code ${code}.`));\n    });\n    child.stdin.end(input);\n  });\n}\n\nfunction createWindowsCodexKeyring(): CodexKeyring {\n  const source = `\nusing System;\nusing System.Runtime.InteropServices;\nusing System.Text;\npublic static class CodexCredentialManager {\n  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]\n  public struct Credential {\n    public UInt32 Flags; public UInt32 Type; public string TargetName;\n    public string Comment; public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;\n    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob;\n    public UInt32 Persist; public UInt32 AttributeCount; public IntPtr Attributes;\n    public string TargetAlias; public string UserName;\n  }\n  [DllImport(\"advapi32.dll\", EntryPoint = \"CredWriteW\", CharSet = CharSet.Unicode, SetLastError = true)]\n  static extern bool CredWrite(ref Credential credential, UInt32 flags);\n  public static void Write(string target, string userName, string value) {\n    byte[] bytes = Encoding.Unicode.GetBytes(value);\n    IntPtr blob = Marshal.AllocHGlobal(bytes.Length);\n    try {\n      Marshal.Copy(bytes, 0, blob, bytes.Length);\n      Credential credential = new Credential {\n        Type = 1, TargetName = target, CredentialBlobSize = (UInt32)bytes.Length,\n        CredentialBlob = blob, Persist = 3, UserName = userName\n      };\n      if (!CredWrite(ref credential, 0)) throw new System.ComponentModel.Win32Exception();\n    } finally { Marshal.FreeHGlobal(blob); }\n  }\n}`;\n  return {\n    async read({ service, account }) {\n      return readWindowsCredentialManagerPassword({\n        targetName: `${account}.${service}`,\n      });\n    },\n    async write({ service, account, value }) {\n      const script = `Add-Type -TypeDefinition $env:AI_SDK_CODEX_CREDENTIAL_SOURCE; $value = [Console]::In.ReadToEnd(); [CodexCredentialManager]::Write($env:AI_SDK_CODEX_CREDENTIAL_TARGET, $env:AI_SDK_CODEX_CREDENTIAL_USER, $value)`;\n      await runCommandWithInput({\n        command: 'powershell.exe',\n        args: ['-NoProfile', '-NonInteractive', '-Command', script],\n        input: value,\n        env: {\n          ...process.env,\n          AI_SDK_CODEX_CREDENTIAL_SOURCE: source,\n          AI_SDK_CODEX_CREDENTIAL_TARGET: `${account}.${service}`,\n          AI_SDK_CODEX_CREDENTIAL_USER: account,\n        },\n      });\n    },\n  };\n}\n","import {\n  harnessV1BridgeInboundCommandSchemas,\n  harnessV1BridgeOutboundMessageSchema,\n  harnessV1BridgeReadySchema,\n  harnessV1BridgeStartBaseSchema,\n} from '@ai-sdk/harness';\nimport { z } from 'zod/v4';\n\n/*\n * Codex's bridge wire protocol. The outbound events (including `file-change`\n * and the `bridge-thread` resume coordinate), transport frames, shared inbound\n * commands, and `bridge-ready` line all come from the shared `@ai-sdk/harness`\n * protocol — the only Codex-specific piece is the `start` payload.\n */\n\nexport const outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;\nexport type OutboundMessage = z.infer<typeof outboundMessageSchema>;\n\nexport const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({\n  instructions: z.string().optional(),\n  reasoningEffort: z.enum(['low', 'medium', 'high', 'xhigh', 'max']).optional(),\n  webSearch: z.boolean().optional(),\n  codexConfig: z.record(z.string(), z.unknown()).optional(),\n  mcpServers: z.record(z.string(), z.unknown()).optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n  /*\n   * The host carries this app-server thread ID in lifecycle state. Supplying it\n   * makes the bridge call `thread/resume` instead of starting a fresh thread.\n   */\n  resumeThreadId: z.string().optional(),\n  restartThread: z.boolean().optional(),\n});\n\nexport type StartMessage = z.infer<typeof startMessageSchema>;\n\nexport const inboundMessageSchema = z.discriminatedUnion('type', [\n  startMessageSchema,\n  ...harnessV1BridgeInboundCommandSchemas,\n]);\nexport type InboundMessage = z.infer<typeof inboundMessageSchema>;\n\nexport const bridgeReadySchema = harnessV1BridgeReadySchema;\nexport type BridgeReady = z.infer<typeof bridgeReadySchema>;\n","// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { createHash } from 'node:crypto';\nimport path from 'node:path';\nimport {\n  commonTool,\n  HarnessCapabilityUnsupportedError,\n  harnessV1DiagnosticFromBridgeFrame,\n  type HarnessV1,\n  type HarnessV1DebugConfig,\n  type HarnessV1BuiltinTool,\n  type HarnessV1BuiltinToolFiltering,\n  type HarnessV1ContinueTurnState,\n  type HarnessV1CredentialForwarding,\n  type HarnessV1MintBridgeTokenCallback,\n  type HarnessV1Prompt,\n  type HarnessV1PromptControl,\n  type HarnessV1PortEndpoint,\n  type HarnessV1ResumeSessionState,\n  type HarnessV1NetworkSandboxSession,\n  type HarnessV1PermissionMode,\n  type HarnessV1Session,\n  type HarnessV1Skill,\n  type HarnessV1StreamPart,\n  harnessStateDirectoryPath,\n  harnessSessionDataDirectoryPath,\n} from '@ai-sdk/harness';\nimport {\n  applyCredentialForwarding,\n  classifyDiskLog,\n  createBridgeToken,\n  resolveSandboxCredentialEnvironment,\n  createBridgeErrorHandler,\n  createBridgeStartupError,\n  experimental_createBridgeUserMessageSubmitter,\n  drainBridgeProcessStream,\n  forwardBridgeProcessStream,\n  getRestrictedSandboxSession,\n  markBridgeStarting,\n  resolveSandboxHomeDir,\n  SandboxChannel,\n  shellQuote,\n  warnCredentialBrokeringUnavailable,\n  waitForBridgeReady,\n  withBridgeToken,\n  writeSkills,\n  type SandboxChannelReconnectOptions,\n} from '@ai-sdk/harness/utils';\nimport {\n  tool,\n  type Experimental_SandboxProcess,\n  type Experimental_SandboxSession as SandboxSession,\n} from '@ai-sdk/provider-utils';\nimport { WebSocket } from 'ws';\nimport { z } from 'zod/v4';\nimport {\n  CODEX_BOOTSTRAP_DIR as BOOTSTRAP_DIR,\n  getCodexBootstrap,\n} from './codex-bootstrap';\nimport {\n  CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n  DEFAULT_OPENAI_BASE_URL,\n  resolveCodexAuthenticationMode,\n  type CodexAuthenticationMode,\n} from './codex-auth';\nimport {\n  createCodexSubscriptionRequestTransformations,\n  resolveCodexAuthentication,\n} from './codex-subscription';\nimport {\n  outboundMessageSchema,\n  type InboundMessage,\n  type OutboundMessage,\n} from './codex-bridge-protocol';\nimport { VERSION } from './version';\n\ntype CodexChannel = SandboxChannel<OutboundMessage, InboundMessage>;\ntype CodexRespawnStrategy = 'replay' | 'rerun';\n\n/*\n * This intentionally is not the latest Codex model. Newer GPT-5.6 models use\n * Responses Lite, which does not expose their code-mode tools as callable\n * through the custom model provider used by the harness. Keep GPT-5.5 as the\n * default until the upstream bug is resolved:\n * https://github.com/openai/codex/issues/31894\n *\n * Passing the model explicitly keeps the runtime behavior deterministic and\n * the telemetry (`gen_ai.request.model`) accurate.\n */\nconst DEFAULT_CODEX_MODEL = 'gpt-5.5';\n\n/**\n * Value to use in User-Agent and `x-client-app` headers.\n */\nconst CODEX_CLIENT_APP = `ai-sdk-harness-codex/${VERSION}`;\n\nexport type CodexHarnessSettings = {\n  readonly auth?: CodexAuthenticationMode;\n  /**\n   * Customizes each credential value before it is forwarded into a sandbox\n   * process. This does not restrict which credentials the harness adapter can\n   * discover, read, or otherwise access in the host process.\n   */\n  readonly credentialForwarding?: HarnessV1CredentialForwarding;\n  /**\n   * Additional configuration passed through to Codex as-is. Codex config keys\n   * typically use snake_case and must be provided in that form. Values managed\n   * by this adapter take precedence over conflicting entries.\n   */\n  readonly codexConfig?: Record<string, unknown>;\n  /**\n   * MCP server definitions keyed by server name. Each definition uses the\n   * underlying runtime's native MCP server configuration format.\n   */\n  readonly mcpServers?: Record<string, unknown>;\n  /**\n   * Reasoning effort for reasoning-capable models. Leaving this unset\n   * defers to the CLI's default.\n   */\n  readonly reasoningEffort?: 'low' | 'medium' | 'high' | 'xhigh' | 'max';\n  /**\n   * When `true`, allow the underlying runtime to use live web search.\n   */\n  readonly webSearch?: boolean;\n  /**\n   * Override the port the bridge binds inside the sandbox. By default the\n   * adapter uses the first port the sandbox declares via `sandbox.ports`.\n   * Only set this if the sandbox declares multiple ports and the first one\n   * is reserved for something else.\n   */\n  readonly port?: number;\n  /**\n   * Override the host endpoint used to connect to the sandbox bridge. Required\n   * together with `port` when using a basic sandbox session.\n   */\n  readonly portEndpoint?: HarnessV1PortEndpoint;\n  /** Maximum milliseconds to wait for the bridge to advertise its port. Defaults to 120000. */\n  readonly startupTimeoutMs?: number;\n  /**\n   * Configures reconnection attempts after an established bridge connection\n   * drops. The reconnect window includes connection establishment and\n   * backoff delays. Defaults to 30 seconds with exponential backoff from 50\n   * milliseconds up to 2 seconds.\n   */\n  readonly reconnect?: SandboxChannelReconnectOptions;\n  /**\n   * Creates the authentication token used by the sandbox bridge. Defaults to\n   * a random 32-byte hexadecimal token.\n   */\n  readonly mintBridgeToken?: HarnessV1MintBridgeTokenCallback;\n};\n\n/*\n * Every native tool Codex app-server can invoke as a model-callable tool,\n * declared as a `ToolSet` keyed by what the bridge emits as `toolName` on\n * the wire (`commonName ?? nativeName`). Schemas reflect the corresponding\n * app-server item payloads.\n *\n * Other native operations such as todo planning surface as side-effect\n * events and are not model-callable tools.\n */\nconst CODEX_BUILTIN_TOOLS = {\n  bash: commonTool('bash', {\n    nativeName: 'shell',\n    toolUseKind: 'bash',\n    description: 'Execute a shell command',\n    inputSchema: z.object({ command: z.string() }),\n  }),\n  webSearch: commonTool('webSearch', {\n    nativeName: 'web_search',\n    toolUseKind: 'readonly',\n    description: 'Search the web',\n    inputSchema: z.object({ query: z.string() }),\n  }),\n  apply_patch: {\n    ...tool({\n      description: 'Apply a patch to files',\n      inputSchema: z.string(),\n    }),\n    toolUseKind: 'edit',\n  },\n  view_image: {\n    ...tool({\n      description: 'View a local image file',\n      inputSchema: z.object({\n        path: z.string(),\n        detail: z.enum(['high', 'original']).optional(),\n        environment_id: z.string().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n} as const satisfies Record<string, HarnessV1BuiltinTool<any, any>>;\n\n/**\n * Live bridge coordinates returned by `doDetach()` and `doSuspendTurn()`. A\n * future process uses them to reopen a socket to the still-running bridge\n * (`attach`) instead of re-spawning it. Absent on a `doStop()` payload.\n */\nconst codexBridgeCoordsSchema = z.object({\n  port: z.number(),\n  token: z.string(),\n  lastSeenEventId: z.number(),\n  sandboxId: z.string().optional(),\n});\n\n/**\n * Schema for the adapter-specific lifecycle `data` payload Codex produces.\n * `threadId` is what app-server's `thread/resume` method requires for the replay/rerun\n * rungs; the sandbox lookup is handled separately via\n * `provider.resumeSession({ sessionId })`. `bridge` carries live coordinates\n * for cross-process `attach` (present on `doDetach()` and `doSuspendTurn()`\n * payloads).\n */\nconst codexResumeStateSchema = z.object({\n  threadId: z.string().optional(),\n  turnConfigurationFingerprint: z.string().optional(),\n  bridge: codexBridgeCoordsSchema.optional(),\n  sandboxCredentialEnvironment: z.record(z.string(), z.string()).optional(),\n});\n\ntype CodexBridgeCoords = z.infer<typeof codexBridgeCoordsSchema>;\n\nexport function createCodex(\n  settings: CodexHarnessSettings = {},\n): HarnessV1<typeof CODEX_BUILTIN_TOOLS> {\n  return {\n    specificationVersion: 'harness-v1',\n    harnessId: 'codex',\n    builtinTools: CODEX_BUILTIN_TOOLS,\n    supportsBuiltinToolFiltering: true,\n    supportsBuiltinToolApprovals: false,\n    lifecycleStateSchema: codexResumeStateSchema,\n    getBootstrap: getCodexBootstrap,\n    doStart: async startOpts => {\n      const model = DEFAULT_CODEX_MODEL;\n      if (\n        startOpts.permissionMode != null &&\n        startOpts.permissionMode !== 'allow-all'\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'codex' does not support built-in tool approval requests; use permissionMode: 'allow-all'.\",\n          harnessId: 'codex',\n        });\n      }\n      const sandboxSession = startOpts.sandboxSession;\n      const toolSafeSandboxSession =\n        getRestrictedSandboxSession(sandboxSession);\n      const sandboxId = 'id' in sandboxSession ? sandboxSession.id : undefined;\n      validateBasicSandboxSettings({\n        sandboxSession,\n        port: settings.port,\n        portEndpoint: settings.portEndpoint,\n      });\n      if (settings.mintBridgeToken != null && sandboxId == null) {\n        throw new HarnessCapabilityUnsupportedError({\n          harnessId: 'codex',\n          message:\n            'The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id.',\n        });\n      }\n      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;\n      const isResume = lifecycleState != null;\n      const isContinue = startOpts.continueFrom != null;\n      const resumeData =\n        isResume && typeof lifecycleState?.data === 'object'\n          ? (lifecycleState.data as {\n              threadId?: unknown;\n              turnConfigurationFingerprint?: unknown;\n              bridge?: CodexBridgeCoords;\n              sandboxCredentialEnvironment?: Record<string, string>;\n            })\n          : undefined;\n      const resumeThreadId = resumeData?.threadId;\n      const resumeThreadIdString =\n        typeof resumeThreadId === 'string' && resumeThreadId.length > 0\n          ? resumeThreadId\n          : undefined;\n      const turnConfigurationFingerprint =\n        typeof resumeData?.turnConfigurationFingerprint === 'string'\n          ? resumeData.turnConfigurationFingerprint\n          : undefined;\n      const coords = resumeData?.bridge;\n      const authenticationMode = resolveCodexAuthenticationMode(settings.auth);\n      const resolvedAuthentication = await resolveCodexAuthentication({\n        auth: settings.auth,\n        authCredentialsStoreMode:\n          settings.codexConfig?.cli_auth_credentials_store,\n      });\n      const resolvedAuthEnvironment = resolvedAuthentication.environment;\n      let sandboxAuthEnvironment = resolvedAuthEnvironment;\n      let sandboxCredentialEnvironment: Record<string, string> | undefined;\n      let credentialsBrokered = false;\n      if (\n        'addRequestTransformations' in sandboxSession &&\n        sandboxSession.addRequestTransformations != null\n      ) {\n        sandboxCredentialEnvironment =\n          await resolveSandboxCredentialEnvironment({\n            environment: resolvedAuthEnvironment,\n            credentialEnvironmentVariables:\n              CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n            credentialForwarding: settings.credentialForwarding,\n            previousSandboxCredentialEnvironment:\n              resumeData?.sandboxCredentialEnvironment,\n          });\n        sandboxAuthEnvironment = {\n          ...resolvedAuthEnvironment,\n          ...sandboxCredentialEnvironment,\n        };\n        const requestTransformations =\n          createCodexSubscriptionRequestTransformations({\n            env: resolvedAuthEnvironment,\n            sandboxEnv: sandboxAuthEnvironment,\n            auth: authenticationMode,\n            requestHeaders: resolvedAuthentication.requestHeaders,\n          });\n        if (requestTransformations.length > 0) {\n          await sandboxSession.addRequestTransformations(\n            requestTransformations,\n          );\n        }\n        credentialsBrokered = true;\n        if (\n          requestTransformations.length > 0 &&\n          authenticationMode === 'direct' &&\n          resolvedAuthEnvironment.OPENAI_BASE_URL == null\n        ) {\n          /*\n           * Vercel Sandbox request transformations apply only to HTTP traffic.\n           * Materializing Codex's standard OpenAI URL makes the bridge select\n           * its custom provider, where WebSockets are disabled, while keeping\n           * the non-brokered path on Codex's built-in OpenAI provider.\n           */\n          sandboxAuthEnvironment.OPENAI_BASE_URL = DEFAULT_OPENAI_BASE_URL;\n        }\n      }\n      // Harness SDK state (bootstrap, per-session runs) always lives under\n      // the sandbox's own HOME, never the working directory, so it stays\n      // out of a user-owned workspace.\n      const sandboxHomeDir = await resolveSandboxHomeDir({\n        sandbox: toolSafeSandboxSession,\n        abortSignal: startOpts.abortSignal,\n      });\n      const stateDir = harnessStateDirectoryPath({ sandboxHomeDir });\n      const bootstrapDir = path.posix.resolve(stateDir, BOOTSTRAP_DIR);\n\n      const workDir = startOpts.sessionWorkDir;\n      const sessionDataDir = harnessSessionDataDirectoryPath({\n        stateDirectory: stateDir,\n        sessionId: startOpts.sessionId,\n      });\n      const bridgeStateDir = `${sessionDataDir}/bridge`;\n      const timeoutMs = settings.startupTimeoutMs ?? 120_000;\n\n      // Normalize each forwarded bridge diagnostics frame into the general\n      // `HarnessV1Diagnostic` and report it. The adapter does no telemetry work\n      // beyond this transport→emission mapping.\n      const report = startOpts.observability?.report;\n      const onDiagnostic = report\n        ? (frame: Parameters<typeof harnessV1DiagnosticFromBridgeFrame>[0]) =>\n            report(\n              harnessV1DiagnosticFromBridgeFrame(frame, {\n                sessionId: startOpts.sessionId,\n                timestamp: Date.now(),\n              }),\n            )\n        : undefined;\n      const onBridgeError = createBridgeErrorHandler({\n        harnessId: 'codex',\n        sessionId: startOpts.sessionId,\n      });\n\n      /*\n       * Rung 1 — ATTACH. With live coordinates, reopen a socket to the\n       * still-running bridge. Parked between-turn sessions just attach and wait\n       * for the next `start`; suspended in-flight turns request replay of\n       * everything past the persisted cursor. No spawn, no fresh token. If the\n       * bridge is gone the open throws and we fall through to a spawn-based\n       * recovery.\n       */\n      if (coords) {\n        try {\n          const endpoint = await resolveBridgeEndpoint({\n            sandboxSession,\n            override: settings.portEndpoint,\n            port: coords.port,\n          });\n          const attachEndpoint = withBridgeToken({\n            endpoint,\n            token: coords.token,\n          });\n          const attachChannel: CodexChannel = new SandboxChannel({\n            connect: ({ abortSignal }) =>\n              openWebSocket({ ...attachEndpoint, abortSignal }),\n            outboundSchema: outboundMessageSchema,\n            initialLastSeenEventId: coords.lastSeenEventId,\n            onDiagnostic,\n            onBridgeError,\n            reconnect: settings.reconnect,\n          });\n          await attachChannel.open(isContinue ? { resume: true } : undefined);\n          return createSession({\n            sessionId: startOpts.sessionId,\n            channel: attachChannel,\n            // The live bridge was spawned by another process; no process handle.\n            proc: undefined,\n            model,\n            reasoningEffort: settings.reasoningEffort,\n            webSearch: settings.webSearch,\n            builtinToolFiltering: startOpts.builtinToolFiltering,\n            codexConfig: settings.codexConfig,\n            mcpServers: settings.mcpServers,\n            headers: startOpts.headers,\n            resumeThreadId: resumeThreadIdString,\n            isResume: true,\n            seedResumeThreadOnFirstPrompt: false,\n            rerunContinue: false,\n            bridgePort: coords.port,\n            bridgeToken: coords.token,\n            sandboxId,\n            sandboxCredentialEnvironment,\n            debug: startOpts.observability?.debug,\n            permissionMode: startOpts.permissionMode,\n            sandbox: toolSafeSandboxSession,\n            sandboxHomeDir,\n            turnConfigurationFingerprint,\n          });\n        } catch {\n          // Bridge no longer reachable — recover by respawning below.\n        }\n      }\n\n      /*\n       * Rungs 2/3 — REPLAY vs RERUN. Respawn the bridge. `replay` is only sound\n       * for `continueFrom`: those coordinates include the cursor the on-disk\n       * log is replayed *from*. `resumeFrom` is a between-turn resume; even when\n       * it carries bridge coordinates, replaying the previous turn would\n       * re-deliver stale events into the next turn. Those resumes always `rerun`\n       * via app-server's `thread/resume` method when attach is unavailable.\n       */\n      let respawnStrategy: CodexRespawnStrategy | undefined = isResume\n        ? 'rerun'\n        : undefined;\n      if (coords && isContinue) {\n        const logRaw = await Promise.resolve(\n          toolSafeSandboxSession.readTextFile({\n            path: `${bridgeStateDir}/event-log.ndjson`,\n            abortSignal: startOpts.abortSignal,\n          }),\n        ).catch(() => null);\n        if ((await classifyDiskLog(logRaw)) === 'replay') {\n          respawnStrategy = 'replay';\n        }\n      }\n\n      const port = resolveBridgePort({\n        sandboxSession,\n        override: settings.port,\n      });\n      const token =\n        settings.mintBridgeToken == null\n          ? createBridgeToken()\n          : settings.mintBridgeToken(sandboxId!);\n      const forwardedAuthEnvironment = credentialsBrokered\n        ? sandboxAuthEnvironment\n        : await applyCredentialForwarding({\n            environment: sandboxAuthEnvironment,\n            credentialEnvironmentVariables:\n              CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n            credentialForwarding: settings.credentialForwarding,\n          });\n      if (!credentialsBrokered) {\n        warnCredentialBrokeringUnavailable({\n          environment: resolvedAuthEnvironment,\n          forwardedEnvironment: forwardedAuthEnvironment,\n          credentialEnvironmentVariables:\n            CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES,\n        });\n      }\n      const env = {\n        ...forwardedAuthEnvironment,\n        AI_SDK_HARNESS_CLIENT_APP: CODEX_CLIENT_APP,\n        BRIDGE_CHANNEL_TOKEN: token,\n        BRIDGE_WS_PORT: String(port),\n        ...(respawnStrategy === 'replay'\n          ? { BRIDGE_REPLAY_FROM_DISK: '1' }\n          : {}),\n      };\n\n      if (respawnStrategy === undefined) {\n        await toolSafeSandboxSession.run({\n          command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,\n          abortSignal: startOpts.abortSignal,\n        });\n      }\n\n      await markBridgeStarting({\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'codex',\n        abortSignal: startOpts.abortSignal,\n      });\n\n      const proc = await toolSafeSandboxSession.spawn({\n        command: `node ${shellQuote(`${bootstrapDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)}`,\n        env,\n        abortSignal: startOpts.abortSignal,\n      });\n      const stderrTail: string[] = [];\n      const bridgeStderrDone = forwardBridgeProcessStream({\n        stream: proc.stderr,\n        streamName: 'stderr',\n        source: 'codex',\n        collectTail: stderrTail,\n      });\n\n      const { port: boundPort } = await waitForBridgeReady({\n        proc,\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'codex',\n        timeoutMs,\n        abortSignal: startOpts.abortSignal,\n        createTimeoutError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'codex bridge did not become ready in time.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n        createExitError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'codex bridge exited before becoming ready.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n      });\n      void drainBridgeProcessStream(proc.stdout);\n\n      const endpoint = await resolveBridgeEndpoint({\n        sandboxSession,\n        override: settings.portEndpoint,\n        port: boundPort,\n      });\n      const bridgeEndpoint = withBridgeToken({ endpoint, token });\n\n      const channel: CodexChannel = new SandboxChannel({\n        connect: ({ abortSignal }) =>\n          openWebSocket({ ...bridgeEndpoint, abortSignal }),\n        outboundSchema: outboundMessageSchema,\n        onDiagnostic,\n        onBridgeError,\n        reconnect: settings.reconnect,\n        // In replay mode the respawned bridge reloaded the finished turn from\n        // disk; seed the cursor and resume so it streams the tail (incl.\n        // `finish`).\n        ...(respawnStrategy === 'replay'\n          ? { initialLastSeenEventId: coords?.lastSeenEventId ?? 0 }\n          : {}),\n      });\n      await channel.open(\n        respawnStrategy === 'replay' ? { resume: true } : undefined,\n      );\n\n      return createSession({\n        sessionId: startOpts.sessionId,\n        channel,\n        proc,\n        model,\n        reasoningEffort: settings.reasoningEffort,\n        webSearch: settings.webSearch,\n        builtinToolFiltering: startOpts.builtinToolFiltering,\n        codexConfig: settings.codexConfig,\n        mcpServers: settings.mcpServers,\n        headers: startOpts.headers,\n        resumeThreadId: resumeThreadIdString,\n        isResume: respawnStrategy !== undefined,\n        seedResumeThreadOnFirstPrompt: respawnStrategy !== undefined,\n        rerunContinue: respawnStrategy === 'rerun',\n        bridgePort: boundPort,\n        bridgeToken: token,\n        sandboxId,\n        sandboxCredentialEnvironment,\n        debug: startOpts.observability?.debug,\n        permissionMode: startOpts.permissionMode,\n        sandbox: toolSafeSandboxSession,\n        sandboxHomeDir,\n        turnConfigurationFingerprint,\n      });\n    },\n  };\n}\n\nfunction resolveBridgePort({\n  sandboxSession,\n  override,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: number | undefined;\n}): number {\n  if (override !== undefined) return override;\n  if ('ports' in sandboxSession && sandboxSession.ports.length > 0) {\n    return sandboxSession.ports[0];\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'codex',\n    message:\n      'The codex harness needs a TCP port exposed by the sandbox. ' +\n      'Create the sandbox with `ports: [<port>]` or pass `createCodex({ port })`.',\n  });\n}\n\nfunction validateBasicSandboxSettings({\n  sandboxSession,\n  port,\n  portEndpoint,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  port: number | undefined;\n  portEndpoint: HarnessV1PortEndpoint | undefined;\n}): void {\n  if ('getPortEndpoint' in sandboxSession) return;\n  if (port == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'codex',\n      message:\n        'The codex harness requires an explicit `port` when using a basic sandbox session.',\n    });\n  }\n  if (portEndpoint == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'codex',\n      message:\n        'The codex harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n    });\n  }\n}\n\nasync function resolveBridgeEndpoint({\n  sandboxSession,\n  override,\n  port,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: HarnessV1PortEndpoint | undefined;\n  port: number;\n}): Promise<HarnessV1PortEndpoint> {\n  if (override != null) return override;\n  if ('getPortEndpoint' in sandboxSession) {\n    return sandboxSession.getPortEndpoint({ port, protocol: 'ws' });\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'codex',\n    message:\n      'The codex harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n  });\n}\n\nfunction openWebSocket({\n  url,\n  headers,\n  abortSignal,\n}: HarnessV1PortEndpoint & { abortSignal: AbortSignal }): Promise<WebSocket> {\n  return new Promise((resolve, reject) => {\n    if (abortSignal.aborted) {\n      reject(abortSignal.reason ?? new Error('WebSocket connection aborted'));\n      return;\n    }\n\n    const ws = new WebSocket(url, {\n      headers: headers == null ? undefined : { ...headers },\n    });\n\n    let settled = false;\n    const cleanup = () => {\n      abortSignal.removeEventListener('abort', onAbort);\n      ws.off('open', onOpen);\n      ws.off('error', onError);\n    };\n    const rejectWithCleanup = (error: unknown) => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      ws.once('error', () => {});\n      try {\n        ws.terminate();\n      } catch {\n        try {\n          ws.close();\n        } catch {\n          // best-effort\n        }\n      }\n      reject(error);\n    };\n    const onOpen = () => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      resolve(ws);\n    };\n    const onError = (err: Error) => {\n      rejectWithCleanup(err);\n    };\n    const onAbort = () =>\n      rejectWithCleanup(\n        abortSignal.reason ?? new Error('WebSocket connection aborted'),\n      );\n\n    ws.once('open', onOpen);\n    ws.once('error', onError);\n    abortSignal.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\nfunction createSession({\n  sessionId,\n  channel,\n  proc,\n  model,\n  reasoningEffort,\n  webSearch,\n  builtinToolFiltering,\n  codexConfig,\n  mcpServers,\n  headers,\n  resumeThreadId,\n  isResume,\n  seedResumeThreadOnFirstPrompt,\n  rerunContinue,\n  bridgePort,\n  bridgeToken,\n  sandboxId,\n  sandboxCredentialEnvironment,\n  debug,\n  permissionMode,\n  sandbox,\n  sandboxHomeDir,\n  turnConfigurationFingerprint,\n}: {\n  sessionId: string;\n  channel: CodexChannel;\n  /** Undefined on `attach` — the live bridge was spawned by another process. */\n  proc: Experimental_SandboxProcess | undefined;\n  model: string | undefined;\n  reasoningEffort: 'low' | 'medium' | 'high' | 'xhigh' | 'max' | undefined;\n  webSearch: boolean | undefined;\n  builtinToolFiltering: HarnessV1BuiltinToolFiltering | undefined;\n  codexConfig: Record<string, unknown> | undefined;\n  mcpServers: Record<string, unknown> | undefined;\n  headers: Readonly<Record<string, string>> | undefined;\n  resumeThreadId: string | undefined;\n  isResume: boolean;\n  seedResumeThreadOnFirstPrompt: boolean;\n  rerunContinue: boolean;\n  bridgePort: number;\n  bridgeToken: string;\n  sandboxId: string | undefined;\n  sandboxCredentialEnvironment: Record<string, string> | undefined;\n  debug: HarnessV1DebugConfig | undefined;\n  permissionMode: HarnessV1PermissionMode | undefined;\n  sandbox: SandboxSession;\n  sandboxHomeDir: string;\n  turnConfigurationFingerprint: string | undefined;\n}): HarnessV1Session {\n  let stopped = false;\n  let stopPromise: Promise<void> | undefined;\n  /*\n   * Send the persisted threadId on the first prompt only when the bridge was\n   * respawned (rerun/replay) so it takes the app-server `thread/resume` branch.\n   * An `attach`ed bridge already holds its threadState in memory and continues\n   * on its own, so it needs no seed.\n   */\n  let pendingResumeThreadId = seedResumeThreadOnFirstPrompt\n    ? resumeThreadId\n    : undefined;\n  /*\n   * Latest codex thread id, cached from the bridge's `bridge-thread`\n   * announcements. Seeded from lifecycle state so `doDetach()` and `doStop()`\n   * can include a thread id even before this process has run a turn.\n   */\n  let latestThreadId = resumeThreadId;\n  let latestTurnConfigurationFingerprint = turnConfigurationFingerprint;\n  channel.on('bridge-thread', msg => {\n    latestThreadId = msg.threadId;\n  });\n  const synchronizeTurnConfiguration = async ({\n    skills,\n    instructions,\n    tools,\n    abortSignal,\n  }: {\n    skills: ReadonlyArray<HarnessV1Skill>;\n    instructions: string | undefined;\n    tools: ReadonlyArray<{\n      name: string;\n      description?: string;\n      inputSchema: unknown;\n    }>;\n    abortSignal?: AbortSignal;\n  }): Promise<{ restartThread: boolean }> => {\n    const skillsResult = await writeSkills({\n      sandbox,\n      homePath: sandboxHomeDir,\n      skillsDir: '.agents/skills',\n      skills,\n      abortSignal,\n      invalidSkillNameMessage: ({ name }) =>\n        `Invalid Codex skill name: ${name}`,\n      invalidSkillFilePathMessage: ({ skillName, filePath }) =>\n        `Invalid Codex skill file path for ${skillName}: ${filePath}`,\n    });\n    const nextFingerprint = fingerprintCodexTurnConfiguration({\n      instructions,\n      tools,\n    });\n    // Legacy fingerprints used order-sensitive JSON, so replace them once\n    // instead of restarting a thread during the fingerprint format upgrade.\n    const restartThread =\n      latestThreadId != null &&\n      (skillsResult.changed ||\n        (latestTurnConfigurationFingerprint?.startsWith('v2:') === true &&\n          latestTurnConfigurationFingerprint !== nextFingerprint));\n    latestTurnConfigurationFingerprint = nextFingerprint;\n    if (restartThread) {\n      pendingResumeThreadId = undefined;\n    }\n    return { restartThread };\n  };\n\n  /*\n   * Wire the channel into one turn's worth of events and return the control\n   * surface. Shared by `doPromptTurn` (which sends a `start` afterwards) and\n   * `doContinueTurn` (which attaches to an already-running/replayed turn, or sends\n   * a rerun `start`). The only difference between the two entry points is the\n   * `start` message, not the listener/abort/settle plumbing.\n   */\n  const wireTurn = (turnOpts: {\n    emit: (event: HarnessV1StreamPart) => void;\n    abortSignal?: AbortSignal;\n  }): {\n    control: HarnessV1PromptControl;\n    sendStart: (send: () => void) => void;\n  } => {\n    let pendingResolve: (() => void) | undefined;\n    let pendingReject: ((err: unknown) => void) | undefined;\n    const done = new Promise<void>((resolve, reject) => {\n      pendingResolve = resolve;\n      pendingReject = reject;\n    });\n    const userMessageSubmitter = experimental_createBridgeUserMessageSubmitter({\n      send: message => channel.send(message),\n      onResponse: listener => channel.on('user-message-response', listener),\n      onReconnect: listener => channel.onReconnect(listener),\n    });\n\n    const unsubs: Array<() => void> = [];\n    const forward = (event: HarnessV1StreamPart) => {\n      try {\n        turnOpts.emit(event);\n      } catch {}\n    };\n\n    const eventTypes = [\n      'stream-start',\n      'text-start',\n      'text-delta',\n      'text-end',\n      'reasoning-start',\n      'reasoning-delta',\n      'reasoning-end',\n      'tool-call',\n      'tool-approval-request',\n      'tool-result',\n      'file-change',\n      'finish-step',\n      'raw',\n    ] as const;\n    let isSettled = false;\n    const settleSuccess = () => {\n      if (isSettled) return;\n      isSettled = true;\n      userMessageSubmitter.close();\n      for (const u of unsubs) u();\n      pendingResolve!();\n    };\n    const settleError = (err: unknown) => {\n      if (isSettled) return;\n      isSettled = true;\n      userMessageSubmitter.close(err);\n      for (const u of unsubs) u();\n      pendingReject!(err);\n    };\n\n    for (const type of eventTypes) {\n      unsubs.push(\n        channel.on(type, msg => {\n          forward(msg);\n        }),\n      );\n    }\n    unsubs.push(\n      channel.on('finish', msg => {\n        forward(msg);\n        settleSuccess();\n      }),\n    );\n    unsubs.push(\n      channel.on('error', msg => {\n        forward(msg);\n        settleError(msg.error);\n      }),\n    );\n\n    /*\n     * A `'suspended'` close is a graceful slice-boundary freeze the host\n     * initiated (`doSuspendTurn`): the turn keeps running in the bridge and its\n     * tail is replayed to the next process, so wind this turn down cleanly\n     * rather than failing it. Any other close mid-turn is an unexpected drop.\n     */\n    const onClose = (_code?: number, reason?: string) => {\n      if (isSettled) return;\n      if (reason === 'suspended') {\n        settleSuccess();\n        return;\n      }\n      settleError(new Error('codex bridge closed before the turn finished.'));\n    };\n    channel.onClose(onClose);\n\n    const onAbort = () => {\n      if (isSettled) return;\n      try {\n        channel.send({ type: 'abort' });\n      } catch {}\n      settleError(\n        turnOpts.abortSignal?.reason ??\n          new DOMException('Aborted', 'AbortError'),\n      );\n    };\n    if (turnOpts.abortSignal) {\n      if (turnOpts.abortSignal.aborted) {\n        onAbort();\n      } else {\n        turnOpts.abortSignal.addEventListener('abort', onAbort, {\n          once: true,\n        });\n      }\n    }\n\n    const control: HarnessV1PromptControl = {\n      submitToolResult: async input => {\n        channel.send({\n          type: 'tool-result',\n          toolCallId: input.toolCallId,\n          output: input.output,\n          isError: input.isError,\n        });\n      },\n      submitToolApproval: async input => {\n        channel.send({\n          type: 'tool-approval-response',\n          approvalId: input.approvalId,\n          approved: input.approved,\n          reason: input.reason,\n        });\n      },\n      submitUserMessage: async text => {\n        await userMessageSubmitter.submit(text);\n      },\n      done,\n    };\n\n    return {\n      control,\n      sendStart: send => {\n        /*\n         * Codex can complete short turns without using tools. Deferring the\n         * start frame gives the harness runner one event-loop turn to finish\n         * wiring the prompt control and stream output before Codex can settle.\n         */\n        const timer = setTimeout(() => {\n          if (isSettled) return;\n          try {\n            send();\n          } catch (err) {\n            settleError(err);\n          }\n        }, 0);\n        timer.unref?.();\n      },\n    };\n  };\n\n  return {\n    sessionId,\n    isResume,\n    doPromptTurn: async promptOpts => {\n      if (\n        promptOpts.responseFormat?.type === 'json' &&\n        promptOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'codex' requires a JSON schema for structured output.\",\n          harnessId: 'codex',\n        });\n      }\n      const tools = (promptOpts.tools ?? []).map(t => ({\n        name: t.name,\n        description: t.description,\n        inputSchema: t.inputSchema,\n      }));\n      const { restartThread } = await synchronizeTurnConfiguration({\n        skills: promptOpts.skills,\n        instructions: promptOpts.instructions,\n        tools,\n        abortSignal: promptOpts.abortSignal,\n      });\n      const turn = wireTurn({\n        emit: promptOpts.emit,\n        abortSignal: promptOpts.abortSignal,\n      });\n\n      const startMessage = {\n        type: 'start' as const,\n        prompt: extractUserText(promptOpts.prompt),\n        tools,\n        ...(promptOpts.responseFormat == null\n          ? {}\n          : { responseFormat: promptOpts.responseFormat }),\n        ...(promptOpts.instructions\n          ? { instructions: promptOpts.instructions }\n          : {}),\n        model: promptOpts.model ?? model,\n        reasoningEffort,\n        webSearch,\n        ...(builtinToolFiltering == null ? {} : { builtinToolFiltering }),\n        ...(codexConfig == null ? {} : { codexConfig }),\n        ...(mcpServers == null ? {} : { mcpServers }),\n        ...(headers == null ? {} : { headers }),\n        ...(permissionMode ? { permissionMode } : {}),\n        ...(pendingResumeThreadId\n          ? { resumeThreadId: pendingResumeThreadId }\n          : {}),\n        ...(restartThread ? { restartThread: true } : {}),\n        ...(debug ? { debug } : {}),\n      };\n      pendingResumeThreadId = undefined;\n      // Recovery starts a native turn once. Later continuations attach to it.\n      rerunContinue = false;\n      turn.sendStart(() => channel.send(startMessage));\n\n      return turn.control;\n    },\n    doContinueTurn: async continueOpts => {\n      if (\n        continueOpts.responseFormat?.type === 'json' &&\n        continueOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'codex' requires a JSON schema for structured output.\",\n          harnessId: 'codex',\n        });\n      }\n      const tools = (continueOpts.tools ?? []).map(t => ({\n        name: t.name,\n        description: t.description,\n        inputSchema: t.inputSchema,\n      }));\n      const { restartThread } = await synchronizeTurnConfiguration({\n        skills: continueOpts.skills,\n        instructions: continueOpts.instructions,\n        tools,\n        abortSignal: continueOpts.abortSignal,\n      });\n      const turn = wireTurn({\n        emit: continueOpts.emit,\n        abortSignal: continueOpts.abortSignal,\n      });\n\n      /*\n       * attach / replay: the still-running (or disk-replayed) turn streams into\n       * the wired listeners — `doStart` opened the channel with `{ resume: true }`\n       * so the bridge replays everything past the persisted cursor (including a\n       * `finish` if the turn ended during the gap). No `start` is sent: issuing\n       * one would clear the bridge's replay log and begin a new turn. Lossless.\n       *\n       * rerun: the bridge was respawned with no in-flight turn to attach to, so\n       * re-drive codex's own thread via `resumeThreadId`. Lossy — work in flight\n       * at the suspension is recomputed. This is the rare bridge-died\n       * fallback; the common slice path is `attach`.\n       */\n      if (rerunContinue) {\n        rerunContinue = false;\n        const threadId = pendingResumeThreadId ?? latestThreadId;\n        pendingResumeThreadId = undefined;\n        turn.sendStart(() =>\n          channel.send({\n            type: 'start' as const,\n            /*\n             * A continuation nudge rather than an empty prompt: `resumeThreadId`\n             * rehydrates the prior thread, and this is the new user turn that\n             * drives it forward. Keeping it non-empty avoids handing the runtime\n             * an empty user message (and mirrors the claude-code adapter, where an\n             * empty text block trips the Anthropic API's `cache_control` rule).\n             */\n            prompt: 'Continue.',\n            tools,\n            ...(continueOpts.responseFormat == null\n              ? {}\n              : { responseFormat: continueOpts.responseFormat }),\n            ...(continueOpts.instructions\n              ? { instructions: continueOpts.instructions }\n              : {}),\n            model: continueOpts.model ?? model,\n            reasoningEffort,\n            webSearch,\n            ...(builtinToolFiltering == null ? {} : { builtinToolFiltering }),\n            ...(codexConfig == null ? {} : { codexConfig }),\n            ...(mcpServers == null ? {} : { mcpServers }),\n            ...(headers == null ? {} : { headers }),\n            ...(permissionMode ? { permissionMode } : {}),\n            ...(threadId ? { resumeThreadId: threadId } : {}),\n            ...(restartThread ? { restartThread: true } : {}),\n            ...(debug ? { debug } : {}),\n          }),\n        );\n      }\n\n      return turn.control;\n    },\n    doCompact: async () => {\n      /*\n       * Codex compacts its context automatically inside the core turn loop\n       * (~90% of the model context window). This adapter does not yet expose a\n       * manual compaction trigger or compaction event, so manual `compact()` is\n       * unsupported while Codex's own auto-compaction continues to run.\n       */\n      throw new HarnessCapabilityUnsupportedError({\n        message:\n          \"Harness 'codex' does not support manual compaction; Codex auto-compacts its context internally.\",\n        harnessId: 'codex',\n      });\n    },\n    doDetach: async () => {\n      if (stopped) {\n        throw new Error(\n          `codex session ${sessionId} is already stopped; cannot detach.`,\n        );\n      }\n      stopped = true;\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'codex',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...(latestThreadId ? { threadId: latestThreadId } : {}),\n          ...(latestTurnConfigurationFingerprint\n            ? {\n                turnConfigurationFingerprint:\n                  latestTurnConfigurationFingerprint,\n              }\n            : {}),\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n    doDestroy: async () => {\n      if (stopped) return stopPromise;\n      stopped = true;\n      stopPromise = (async () => {\n        // Tell the channel we are tearing down so the bridge's post-shutdown\n        // socket close finalises instead of triggering a reconnect.\n        channel.beginClose();\n        try {\n          if (!channel.isClosed()) {\n            channel.send({ type: 'destroy' });\n          }\n        } catch {}\n        let stopTimer: ReturnType<typeof setTimeout> | undefined;\n        try {\n          if (proc) {\n            await Promise.race([\n              proc.wait(),\n              new Promise<void>(resolve => {\n                stopTimer = setTimeout(resolve, 5000);\n                stopTimer.unref?.();\n              }),\n            ]);\n          }\n        } finally {\n          if (stopTimer) clearTimeout(stopTimer);\n          try {\n            await proc?.kill();\n          } catch {}\n          channel.close();\n        }\n      })();\n      return stopPromise;\n    },\n    doStop: async () => {\n      if (stopped) {\n        throw new Error(\n          `codex session ${sessionId} is already stopped; cannot stop.`,\n        );\n      }\n      stopped = true;\n      /*\n       * If the bridge's channel already closed (e.g. mid-turn WS drop)\n       * there is no one to acknowledge a `stop` message. Synthesize an empty\n       * payload — the workdir is still captured by the sandbox snapshot\n       * during the subsequent `sandboxSession.stop()`, so the next turn can\n       * resume the filesystem state. The trade-off: we lose\n       * `threadId`, so Codex app-server starts a fresh thread on the\n       * preserved workdir rather than resuming the prior conversation\n       * inside Codex's runtime. Ability to continue beats throwing.\n       */\n      // Tell the channel we are tearing down so the bridge's post-stop\n      // socket close finalises instead of triggering a reconnect.\n      channel.beginClose();\n      const data: unknown = channel.isClosed()\n        ? {}\n        : await new Promise<unknown>((resolve, reject) => {\n            const timer = setTimeout(() => {\n              unsub();\n              reject(\n                new Error(\n                  `codex session ${sessionId} did not reply to stop within 5s.`,\n                ),\n              );\n            }, 5000);\n            timer.unref?.();\n            const unsub = channel.on('bridge-stop', msg => {\n              clearTimeout(timer);\n              unsub();\n              resolve(msg.data);\n            });\n            try {\n              channel.send({ type: 'stop' });\n            } catch (err) {\n              clearTimeout(timer);\n              unsub();\n              reject(err);\n            }\n          });\n\n      let stopTimer: ReturnType<typeof setTimeout> | undefined;\n      try {\n        if (proc) {\n          await Promise.race([\n            proc.wait(),\n            new Promise<void>(resolve => {\n              stopTimer = setTimeout(resolve, 5000);\n              stopTimer.unref?.();\n            }),\n          ]);\n        }\n      } finally {\n        if (stopTimer) clearTimeout(stopTimer);\n        try {\n          await proc?.kill();\n        } catch {}\n        channel.close();\n      }\n\n      const lifecycleData =\n        data != null && typeof data === 'object' && !Array.isArray(data)\n          ? { ...(data as Record<string, unknown>) }\n          : {};\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'codex',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...lifecycleData,\n          ...(latestTurnConfigurationFingerprint\n            ? {\n                turnConfigurationFingerprint:\n                  latestTurnConfigurationFingerprint,\n              }\n            : {}),\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n        } as HarnessV1ResumeSessionState['data'],\n      };\n      return payload;\n    },\n    doSuspendTurn: async () => {\n      if (stopped) {\n        throw new Error(\n          `codex session ${sessionId} is stopped; cannot suspend.`,\n        );\n      }\n      stopped = true;\n      /*\n       * Freeze the host at a precise cursor without stopping the active model\n       * turn. `channel.suspend` stops processing inbound frames, drains what\n       * was already dispatched, then closes the host socket with reason\n       * `'suspended'`. The bridge keeps the turn running and accumulates events\n       * past the cursor for the next slice to replay. The sandbox process is\n       * deliberately left alive.\n       */\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ContinueTurnState = {\n        type: 'continue-turn',\n        harnessId: 'codex',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...(latestThreadId ? { threadId: latestThreadId } : {}),\n          ...(latestTurnConfigurationFingerprint\n            ? {\n                turnConfigurationFingerprint:\n                  latestTurnConfigurationFingerprint,\n              }\n            : {}),\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n  };\n}\n\nfunction fingerprintCodexTurnConfiguration({\n  instructions,\n  tools,\n}: {\n  instructions: string | undefined;\n  tools: ReadonlyArray<{\n    name: string;\n    description?: string;\n    inputSchema: unknown;\n  }>;\n}): string {\n  const canonical = JSON.stringify(\n    { instructions: instructions ?? null, tools },\n    (_key, value) => {\n      if (value == null || typeof value !== 'object' || Array.isArray(value)) {\n        return value;\n      }\n      return Object.fromEntries(\n        Object.entries(value).sort(([left], [right]) =>\n          left < right ? -1 : left > right ? 1 : 0,\n        ),\n      );\n    },\n  );\n  return `v2:${createHash('sha256').update(canonical).digest('hex')}`;\n}\n\n/*\n * Reduce a `HarnessV1Prompt` to the plain user text the bridge forwards to\n * Codex. The adapter does not yet map file and image parts into app-server\n * turn input, so throw rather than silently dropping them and producing a\n * truncated prompt.\n */\nfunction extractUserText(prompt: HarnessV1Prompt): string {\n  if (typeof prompt === 'string') return prompt;\n  const { content } = prompt;\n  if (typeof content === 'string') return content;\n  const parts: string[] = [];\n  for (const part of content) {\n    if (part.type !== 'text') {\n      throw new HarnessCapabilityUnsupportedError({\n        harnessId: 'codex',\n        message: `The codex harness does not yet support user message parts of type '${part.type}'. Pass a string or a user message whose content contains only text parts.`,\n      });\n    }\n    parts.push(part.text);\n  }\n  return parts.join('\\n\\n');\n}\n","import { createCodex } from './codex-harness';\n\n/**\n * Default `codex` harness instance with no overrides — suitable for the\n * common case where the underlying `codex` CLI's defaults are fine.\n * Equivalent to `createCodex()`.\n */\nexport const codex = createCodex();\n\nexport { createCodex } from './codex-harness';\nexport { VERSION } from './version';\nexport type { CodexHarnessSettings } from './codex-harness';\nexport type { CodexAuthenticationMode } from './codex-auth';\nexport type { JSONObject } from '@ai-sdk/provider';\n"],"mappings":";;;;;;;;;;;AAOA,MAAM,kBAAkB,sBAAsB;CAC5C,gBAAgB,IAAI,IAAI,yBAAyB,YAAY,GAAG;CAChE,kBAAkB,IAAI,IAAI,2BAA2B,YAAY,GAAG;CACpE,aAAa,IAAI,IAAI,sBAAsB,YAAY,GAAG;AAC5D,CAAC;AAaD,MAAa,sBAAsB;AAEnC,IAAI;AAEJ,eAAsB,oBAAiD;CACrE,IAAI,mBAAmB,MAAM,OAAO;CACpC,MAAM,CAAC,KAAK,MAAM,UAAU,MAAM,QAAQ,IAAI;EAC5C,gBAAgB,cAAc;EAC9B,gBAAgB,gBAAgB;EAChC,gBAAgB,WAAW;CAC7B,CAAC;CACD,kBAAkB;EAChB,WAAW;EACX,cAAc;EACd,OAAO;GACL;IAAE,MAAM,GAAG,oBAAoB;IAAgB,SAAS;GAAI;GAC5D;IAAE,MAAM,GAAG,oBAAoB;IAAkB,SAAS;GAAK;GAC/D;IAAE,MAAM,GAAG,oBAAoB;IAAc,SAAS;GAAO;EAC/D;EACA,UAAU,CACR,EACE,SAAS,yDACX,CACF;CACF;CACA,OAAO;AACT;;;ACvCA,MAAM,8BAA8B;AACpC,MAAa,0BAA0B;AAEvC,MAAa,yCAAyC,CACpD,sBACA,eACF;AAEA,SAAgB,kCAAkC,EAChD,KAAK,aACL,YAAY,oBACZ,MAAM,sBACqG;CAC3G,IAAI,CAAC,YAAY,iBAAiB,CAAC,mBAAmB,eACpD,OAAO,CAAC;CAEV,OAAO,CACL,sCAAsC;EACpC,UACE,YAAY,oBACX,uBAAuB,eACpB,8BAAA;EAEN,cAAc,EACZ,eAAe,UAAU,mBAAmB,gBAC9C;EACA,kBAAkB,EAChB,eAAe,UAAU,YAAY,gBACvC;CACF,CAAC,CACH;AACF;;;;;;;;;AAcA,SAAgB,gBACd,MACA,aAAiD,QAAQ,KACjC;CAExB,MAAM,4BADsB,mCAAmC,IACX,IAAI,OAAO;CAC/D,IAAI,SAAS,UACX,OAAO,WAAW,EAAE,YAAY,0BAA0B,CAAC;CAG7D,MAAM,qBAAqB,wBAAwB,EACjD,KAAK,0BACP,CAAC;CACD,IAAI,SAAS,gBAAgB,mBAAmB,QAC9C,OAAO,YAAY,EAAE,mBAAmB,CAAC;CAE3C,OAAO,WAAW,EAAE,YAAY,0BAA0B,CAAC;AAC7D;AAEA,SAAgB,+BACd,MACA,aAAiD,QAAQ,KACxB;CACjC,IAAI,mCAAmC,IAAI,GACzC,OAAO,wBAAwB,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,SAC1C,eACA;CAEN,IAAI,SAAS,UACX,OAAO;CAET,IAAI,SAAS,cACX,OAAO;CAET,OAAO,wBAAwB,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,SAChD,eACA;AACN;AAEA,SAAS,WAAW,EAClB,cAGyB;CACzB,MAAM,MAA8B,CAAC;CACrC,MAAM,SAAS,WAAW,kBAAkB,WAAW;CACvD,IAAI,QAAQ,IAAI,gBAAgB;CAChC,MAAM,UAAU,WAAW;CAC3B,IAAI,SAAS,IAAI,kBAAkB;CACnC,MAAM,eAAe,WAAW;CAChC,IAAI,cAAc,IAAI,sBAAsB;CAC5C,MAAM,UAAU,WAAW;CAC3B,IAAI,SAAS,IAAI,iBAAiB;CAClC,OAAO;AACT;AAEA,SAAS,YAAY,EACnB,sBAGyB;CACzB,MAAM,SAAS,mBAAmB;CAClC,MAAM,UAAU,sBAAsB,mBAAmB,OAAO;CAChE,MAAM,MAA8B,CAAC;CACrC,IAAI,QAAQ;EACV,IAAI,qBAAqB;EACzB,IAAI,gBAAgB;CACtB;CACA,IAAI,sBAAsB;CAC1B,IAAI,kBAAkB;CACtB,OAAO;AACT;AAEA,SAAS,sBAAsB,SAAyB;CACtD,MAAM,UAAU,QAAQ,QAAQ,QAAQ,EAAE;CAC1C,OAAO,QAAQ,SAAS,KAAK,IAAI,UAAU,GAAG,QAAQ;AACxD;;;AC/FA,MAAM,yBAAyB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AAOzB,SAAgB,8CAA8C,EAC5D,gBACA,GAAG,WAGgC;CACnC,MAAM,kBAAkB,kCAAkC,OAAO;CACjE,IAAI,kBAAkB,MAAM,OAAO;CAEnC,OAAO,gBAAgB,KAAI,oBAAmB;EAC5C,GAAG;EACH,WAAW;GACT,GAAG,eAAe;GAClB,SAAS;IACP,GAAG,eAAe,UAAU;IAC5B,GAAG;GACL;EACF;CACF,EAAE;AACJ;AA0BA,eAAsB,2BAA2B,EAC/C,MACA,aAAa,QAAQ,KACrB,0BACA,mBAAmB,yBAQoB;CACvC,MAAM,cAAc,gBAAgB,MAAM,UAAU;CACpD,IAAI,mCAAmC,IAAI,GACzC,OAAO,EAAE,YAAY;CAEvB,IACE,CAAC,gCAAgC;EAC/B;EACA,KAAK;EACL,qBAAqB,YAAY,iBAAiB;CACpD,CAAC,GAED,OAAO,EAAE,YAAY;CAGvB,OACG,MAAM,iBAAiB,EAAE,yBAAyB,CAAC,KAAM,EAAE,YAAY;AAE5E;AAEA,eAAsB,sBAAsB,EAC1C,MAAM,QAAQ,KACd,gBAAgB,QAAQ,GACxB,0BACA,WAAW,QAAQ,UACnB,SACA,UAQE,CAAC,GAAqD;CACxD,MAAM,YAAY,QAAQ,IAAI,cAAc,KAAK,eAAe,QAAQ,CAAC;CAMzE,MAAM,SAAS,MAAM,mBAAmB;EACtC;EACA,UAPe,KAAK,WAAW,WAOxB;EACP,aANA,gCAAgC,wBAAwB,KACvD,MAAM,kCAAkC,EAAE,UAAU,CAAC,KACtD;EAKA,SAAS,WAAW,mBAAmB,EAAE,SAAS,CAAC;CACrD,CAAC;CACD,IAAI,UAAU,MAAM,OAAO,KAAA;CAE3B,MAAM,aAAa,MAAM,kBAAkB,OAAO,KAAK;CACvD,IAAI,cAAc,MAAM,OAAO,KAAA;CAE/B,IAAI,cAAc,WAAW;CAC7B,IAAI,0BAA0B,EAAE,WAAW,WAAW,UAAU,CAAC,GAAG;EAClE,MAAM,YAAY,MAAM,wBAAwB;GAC9C,UAAU;GACV,UAAU;GACV,cAAc,WAAW;GACzB,eAAe;GACf,GAAI,SAAS,OAAO,CAAC,IAAI,EAAE,MAAM;EACnC,CAAC;EACD,cAAc,UAAU;EACxB,MAAM,OAAO,MAAM;GACjB,GAAG,OAAO;GACV,+BAAc,IAAI,KAAK,EAAA,CAAE,YAAY;GACrC,QAAQ;IACN,GAAG,OAAO,MAAM;IAChB,cAAc,UAAU;IACxB,eAAe,UAAU,gBAAgB,WAAW;GACtD;EACF,CAAC;CACH;CAEA,OAAO;EACL,aAAa;GACX,eAAe;GACf,iBAAiB;EACnB;EACA,GAAI,WAAW,aAAa,OACxB,CAAC,IACD,EACE,gBAAgB,EACd,sBAAsB,WAAW,UACnC,EACF;CACN;AACF;AAEA,eAAe,mBAAmB,EAChC,WACA,UACA,aACA,WAYA;CACA,IAAI,gBAAgB,aAAa,OAAO,KAAA;CAExC,MAAM,gBAAgB,YAAY;EAChC,MAAM,QAAQ,MAAM,kBAAkB,QAAQ;EAC9C,OAAO,SAAS,OACZ,KAAA,IACA;GACE;GACA,QAAQ,YACN,mBAAmB;IAAE;IAAU,OAAO;GAAQ,CAAC;EACnD;CACN;CACA,MAAM,mBAAmB,YAAY;EACnC,IAAI,WAAW,MAAM,OAAO,KAAA;EAC5B,MAAM,gBAAgB,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,SAAS;EACrE,MAAM,UAAU,OAAO,WAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;EACd,MAAM,OAAO,MAAM,QAAQ,KAAK;GAAE,SAAS;GAAc;EAAQ,CAAC;EAClE,IAAI,QAAQ,MAAM,OAAO,KAAA;EACzB,MAAM,QAAQ,MAAM,mBAAmB,IAAI;EAC3C,OAAO,SAAS,OACZ,KAAA,IACA;GACE;GACA,QAAQ,YACN,QAAQ,MAAM;IACZ,SAAS;IACT;IACA,OAAO,KAAK,UAAU,OAAO;GAC/B,CAAC;EACL;CACN;CAEA,IAAI,gBAAgB,QAAQ,OAAO,cAAc;CACjD,IAAI,gBAAgB,WAAW,OAAO,iBAAiB;CACvD,OAAQ,MAAM,iBAAiB,KAAM,cAAc;AACrD;AAEA,eAAe,kCAAkC,EAC/C,aAGqD;CACrD,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW,aAAa,GAAG,MAAM,CAAC,CAAC,YAC5D,KAAA,CACR;CACA,IAAI,QAAQ,MAAM,OAAO,KAAA;CACzB,KAAK,MAAM,QAAQ,KAAK,MAAM,OAAO,GAAG;EACtC,IAAI,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,GAAG,OAAO,KAAA;EAC7C,MAAM,QACJ,yFAAyF,KACvF,IACF;EACF,IAAI,SAAS,MACX,OAAO,gCAAgC,MAAM,EAAE;CAEnD;AACF;AAEA,SAAS,gCACP,OAC2C;CAC3C,OAAO,UAAU,UACf,UAAU,aACV,UAAU,UACV,UAAU,cACR,QACA,KAAA;AACN;AAEA,eAAe,kBACb,UACoC;CACpC,MAAM,OAAO,MAAM,SAAS,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;CACnE,OAAO,QAAQ,OAAO,KAAA,IAAY,mBAAmB,IAAI;AAC3D;AAEA,eAAe,mBACb,MACoC;CACpC,MAAM,SAAS,MAAM,cAAc,EAAE,KAAK,CAAC;CAC3C,OAAO,OAAO,WAAW,SAAS,OAAO,KAAK,IACzC,OAAO,QACR,KAAA;AACN;AAEA,eAAe,kBAAkB,OAQ/B;CACA,IAAI,MAAM,cAAc,aAAa,CAAC,SAAS,MAAM,MAAM,GACzD;CAEF,MAAM,cAAc,MAAM,OAAO;CACjC,MAAM,eAAe,MAAM,OAAO;CAClC,IAAI,OAAO,gBAAgB,YAAY,OAAO,iBAAiB,UAC7D;CAEF,MAAM,YAAY,MAAM,gBAAgB,EAAE,OAAO,YAAY,CAAC;CAC9D,IAAI,aAAa,MAAM,OAAO,KAAA;CAC9B,MAAM,YAAY,MAAM,OAAO;CAC/B,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,cAAc,WAAW,EAAE,UAAU,IAAI,CAAC;CACvD;AACF;AAEA,eAAe,mBAAmB,EAChC,UACA,SAIgB;CAChB,MAAM,MAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;CAClD,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,IAAI;CACjD,MAAM,UAAU,eAAe,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,EACpE,MAAM,IACR,CAAC;CACD,MAAM,MAAM,eAAe,GAAK;CAChC,MAAM,OAAO,eAAe,QAAQ;AACtC;AAEA,SAAS,mBAAmB,EAC1B,YAG2B;CAC3B,IAAI,QAAQ,QAAQ,GAClB,OAAO;EACL,MAAM,KAAK,EAAE,SAAS,WAAW;GAC/B,OAAO,0BAA0B;IAAE;IAAS;GAAQ,CAAC;EACvD;EACA,MAAM,MAAM,EAAE,SAAS,SAAS,SAAS;GAEvC,MAAM,oBAAoB;IACxB,SAAS;IACT,MAAM,CAAC,IAAI;IACX,OAAO,8BAJqC,sBAAsB,OAAO,EAAE,MAAM,sBAAsB,OAAO,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,SAAS,KAAK,EAAE;GAKnK,CAAC;EACH;CACF;CAEF,IAAI,QAAQ,QAAQ,GAClB,OAAO;EACL,MAAM,KAAK,EAAE,SAAS,WAAW;GAC/B,OAAO,+BAA+B,EACpC,YAAY;IACV;IACA,UAAU;IACV,QAAQ;GACV,EACF,CAAC;EACH;EACA,MAAM,MAAM,EAAE,SAAS,SAAS,SAAS;GACvC,MAAM,oBAAoB;IACxB,SAAS;IACT,MAAM;KACJ;KACA;KACA,GAAG,QAAQ,GAAG,QAAQ;KACtB;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACF;IACA,OAAO;GACT,CAAC;EACH;CACF;CAEF,IAAI,UAAU,QAAQ,GACpB,OAAO,0BAA0B;AAErC;AAEA,SAAS,sBAAsB,OAAuB;CACpD,OAAO,IAAI,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAK,EAAE;AAC/D;AAEA,eAAe,oBAAoB,EACjC,SACA,MACA,OACA,OAMgB;CAChB,MAAM,IAAI,SAAe,gBAAgB,WAAW;EAClD,MAAM,QAAQ,MAAM,SAAS,MAAM;GACjC,OAAO;IAAC;IAAQ;IAAU;GAAM;GAChC,GAAI,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI;EAC/B,CAAC;EACD,IAAI,SAAS;EACb,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAQ,UAAS;GAC/B,UAAU;EACZ,CAAC;EACD,MAAM,KAAK,SAAS,MAAM;EAC1B,MAAM,KAAK,UAAS,SAAQ;GAC1B,IAAI,SAAS,GAAG,eAAe;QAC1B,OAAO,IAAI,MAAM,UAAU,GAAG,QAAQ,oBAAoB,KAAK,EAAE,CAAC;EACzE,CAAC;EACD,MAAM,MAAM,IAAI,KAAK;CACvB,CAAC;AACH;AAEA,SAAS,4BAA0C;CACjD,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bf,OAAO;EACL,MAAM,KAAK,EAAE,SAAS,WAAW;GAC/B,OAAO,qCAAqC,EAC1C,YAAY,GAAG,QAAQ,GAAG,UAC5B,CAAC;EACH;EACA,MAAM,MAAM,EAAE,SAAS,SAAS,SAAS;GAEvC,MAAM,oBAAoB;IACxB,SAAS;IACT,MAAM;KAAC;KAAc;KAAmB;KAAY;IAAM;IAC1D,OAAO;IACP,KAAK;KACH,GAAG,QAAQ;KACX,gCAAgC;KAChC,gCAAgC,GAAG,QAAQ,GAAG;KAC9C,8BAA8B;IAChC;GACF,CAAC;EACH;CACF;AACF;;;ACldA,MAAa,wBAAwB;AAGrC,MAAa,qBAAqB,+BAA+B,OAAO;CACtE,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,iBAAiB,EAAE,KAAK;EAAC;EAAO;EAAU;EAAQ;EAAS;CAAK,CAAC,CAAC,CAAC,SAAS;CAC5E,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACxD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACvD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAKnD,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS;AACtC,CAAC;AAImC,EAAE,mBAAmB,QAAQ,CAC/D,oBACA,GAAG,oCACL,CAAC;;;ACpCD,MAAa,UAAA;;;ACqFb,MAAM,sBAAsB;;;;AAK5B,MAAM,mBAAmB,wBAAwB;AAmEjD,MAAM,sBAAsB;CAC1B,MAAM,WAAW,QAAQ;EACvB,YAAY;EACZ,aAAa;EACb,aAAa;EACb,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;CAC/C,CAAC;CACD,WAAW,WAAW,aAAa;EACjC,YAAY;EACZ,aAAa;EACb,aAAa;EACb,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;CAC7C,CAAC;CACD,aAAa;EACX,GAAG,KAAK;GACN,aAAa;GACb,aAAa,EAAE,OAAO;EACxB,CAAC;EACD,aAAa;CACf;CACA,YAAY;EACV,GAAG,KAAK;GACN,aAAa;GACb,aAAa,EAAE,OAAO;IACpB,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,CAAC,CAAC,SAAS;IAC9C,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;GACtC,CAAC;EACH,CAAC;EACD,aAAa;CACf;AACF;;;;;;AAOA,MAAM,0BAA0B,EAAE,OAAO;CACvC,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;;;;;;;;AAUD,MAAM,yBAAyB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,8BAA8B,EAAE,OAAO,CAAC,CAAC,SAAS;CAClD,QAAQ,wBAAwB,SAAS;CACzC,8BAA8B,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AAC1E,CAAC;AAID,SAAgB,YACd,WAAiC,CAAC,GACK;CACvC,OAAO;EACL,sBAAsB;EACtB,WAAW;EACX,cAAc;EACd,8BAA8B;EAC9B,8BAA8B;EAC9B,sBAAsB;EACtB,cAAc;EACd,SAAS,OAAM,cAAa;GAC1B,MAAM,QAAQ;GACd,IACE,UAAU,kBAAkB,QAC5B,UAAU,mBAAmB,aAE7B,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;GAEH,MAAM,iBAAiB,UAAU;GACjC,MAAM,yBACJ,4BAA4B,cAAc;GAC5C,MAAM,YAAY,QAAQ,iBAAiB,eAAe,KAAK,KAAA;GAC/D,6BAA6B;IAC3B;IACA,MAAM,SAAS;IACf,cAAc,SAAS;GACzB,CAAC;GACD,IAAI,SAAS,mBAAmB,QAAQ,aAAa,MACnD,MAAM,IAAI,kCAAkC;IAC1C,WAAW;IACX,SACE;GACJ,CAAC;GAEH,MAAM,iBAAiB,UAAU,gBAAgB,UAAU;GAC3D,MAAM,WAAW,kBAAkB;GACnC,MAAM,aAAa,UAAU,gBAAgB;GAC7C,MAAM,aACJ,YAAY,OAAO,gBAAgB,SAAS,WACvC,eAAe,OAMhB,KAAA;GACN,MAAM,iBAAiB,YAAY;GACnC,MAAM,uBACJ,OAAO,mBAAmB,YAAY,eAAe,SAAS,IAC1D,iBACA,KAAA;GACN,MAAM,+BACJ,OAAO,YAAY,iCAAiC,WAChD,WAAW,+BACX,KAAA;GACN,MAAM,SAAS,YAAY;GAC3B,MAAM,qBAAqB,+BAA+B,SAAS,IAAI;GACvE,MAAM,yBAAyB,MAAM,2BAA2B;IAC9D,MAAM,SAAS;IACf,0BACE,SAAS,aAAa;GAC1B,CAAC;GACD,MAAM,0BAA0B,uBAAuB;GACvD,IAAI,yBAAyB;GAC7B,IAAI;GACJ,IAAI,sBAAsB;GAC1B,IACE,+BAA+B,kBAC/B,eAAe,6BAA6B,MAC5C;IACA,+BACE,MAAM,oCAAoC;KACxC,aAAa;KACb,gCACE;KACF,sBAAsB,SAAS;KAC/B,sCACE,YAAY;IAChB,CAAC;IACH,yBAAyB;KACvB,GAAG;KACH,GAAG;IACL;IACA,MAAM,yBACJ,8CAA8C;KAC5C,KAAK;KACL,YAAY;KACZ,MAAM;KACN,gBAAgB,uBAAuB;IACzC,CAAC;IACH,IAAI,uBAAuB,SAAS,GAClC,MAAM,eAAe,0BACnB,sBACF;IAEF,sBAAsB;IACtB,IACE,uBAAuB,SAAS,KAChC,uBAAuB,YACvB,wBAAwB,mBAAmB,MAQ3C,uBAAuB,kBAAkB;GAE7C;GAIA,MAAM,iBAAiB,MAAM,sBAAsB;IACjD,SAAS;IACT,aAAa,UAAU;GACzB,CAAC;GACD,MAAM,WAAW,0BAA0B,EAAE,eAAe,CAAC;GAC7D,MAAM,eAAe,KAAK,MAAM,QAAQ,UAAUA,mBAAa;GAE/D,MAAM,UAAU,UAAU;GAK1B,MAAM,iBAAiB,GAJA,gCAAgC;IACrD,gBAAgB;IAChB,WAAW,UAAU;GACvB,CACuC,EAAE;GACzC,MAAM,YAAY,SAAS,oBAAoB;GAK/C,MAAM,SAAS,UAAU,eAAe;GACxC,MAAM,eAAe,UAChB,UACC,OACE,mCAAmC,OAAO;IACxC,WAAW,UAAU;IACrB,WAAW,KAAK,IAAI;GACtB,CAAC,CACH,IACF,KAAA;GACJ,MAAM,gBAAgB,yBAAyB;IAC7C,WAAW;IACX,WAAW,UAAU;GACvB,CAAC;GAUD,IAAI,QACF,IAAI;IACF,MAAM,WAAW,MAAM,sBAAsB;KAC3C;KACA,UAAU,SAAS;KACnB,MAAM,OAAO;IACf,CAAC;IACD,MAAM,iBAAiB,gBAAgB;KACrC;KACA,OAAO,OAAO;IAChB,CAAC;IACD,MAAM,gBAA8B,IAAI,eAAe;KACrD,UAAU,EAAE,kBACV,cAAc;MAAE,GAAG;MAAgB;KAAY,CAAC;KAClD,gBAAgB;KAChB,wBAAwB,OAAO;KAC/B;KACA;KACA,WAAW,SAAS;IACtB,CAAC;IACD,MAAM,cAAc,KAAK,aAAa,EAAE,QAAQ,KAAK,IAAI,KAAA,CAAS;IAClE,OAAO,cAAc;KACnB,WAAW,UAAU;KACrB,SAAS;KAET,MAAM,KAAA;KACN;KACA,iBAAiB,SAAS;KAC1B,WAAW,SAAS;KACpB,sBAAsB,UAAU;KAChC,aAAa,SAAS;KACtB,YAAY,SAAS;KACrB,SAAS,UAAU;KACnB,gBAAgB;KAChB,UAAU;KACV,+BAA+B;KAC/B,eAAe;KACf,YAAY,OAAO;KACnB,aAAa,OAAO;KACpB;KACA;KACA,OAAO,UAAU,eAAe;KAChC,gBAAgB,UAAU;KAC1B,SAAS;KACT;KACA;IACF,CAAC;GACH,QAAQ,CAER;GAWF,IAAI,kBAAoD,WACpD,UACA,KAAA;GACJ,IAAI,UAAU,YAAY;IACxB,MAAM,SAAS,MAAM,QAAQ,QAC3B,uBAAuB,aAAa;KAClC,MAAM,GAAG,eAAe;KACxB,aAAa,UAAU;IACzB,CAAC,CACH,CAAC,CAAC,YAAY,IAAI;IAClB,IAAK,MAAM,gBAAgB,MAAM,MAAO,UACtC,kBAAkB;GAEtB;GAEA,MAAM,OAAO,kBAAkB;IAC7B;IACA,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,QACJ,SAAS,mBAAmB,OACxB,kBAAkB,IAClB,SAAS,gBAAgB,SAAU;GACzC,MAAM,2BAA2B,sBAC7B,yBACA,MAAM,0BAA0B;IAC9B,aAAa;IACb,gCACE;IACF,sBAAsB,SAAS;GACjC,CAAC;GACL,IAAI,CAAC,qBACH,mCAAmC;IACjC,aAAa;IACb,sBAAsB;IACtB,gCACE;GACJ,CAAC;GAEH,MAAM,MAAM;IACV,GAAG;IACH,2BAA2B;IAC3B,sBAAsB;IACtB,gBAAgB,OAAO,IAAI;IAC3B,GAAI,oBAAoB,WACpB,EAAE,yBAAyB,IAAI,IAC/B,CAAC;GACP;GAEA,IAAI,oBAAoB,KAAA,GACtB,MAAM,uBAAuB,IAAI;IAC/B,SAAS,YAAY,WAAW,OAAO,EAAE,GAAG,WAAW,cAAc;IACrE,aAAa,UAAU;GACzB,CAAC;GAGH,MAAM,mBAAmB;IACvB,SAAS;IACT;IACA,YAAY;IACZ,aAAa,UAAU;GACzB,CAAC;GAED,MAAM,OAAO,MAAM,uBAAuB,MAAM;IAC9C,SAAS,QAAQ,WAAW,GAAG,aAAa,YAAY,EAAE,aAAa,WAAW,OAAO,EAAE,sBAAsB,WAAW,cAAc;IAC1I;IACA,aAAa,UAAU;GACzB,CAAC;GACD,MAAM,aAAuB,CAAC;GAC9B,MAAM,mBAAmB,2BAA2B;IAClD,QAAQ,KAAK;IACb,YAAY;IACZ,QAAQ;IACR,aAAa;GACf,CAAC;GAED,MAAM,EAAE,MAAM,cAAc,MAAM,mBAAmB;IACnD;IACA,SAAS;IACT;IACA,YAAY;IACZ;IACA,aAAa,UAAU;IACvB,qBAAqB,EAAE,MAAM,iBAC3B,yBAAyB;KACvB,SAAS;KACT;KACA;KACA;KACA,YAAY;IACd,CAAC;IACH,kBAAkB,EAAE,MAAM,iBACxB,yBAAyB;KACvB,SAAS;KACT;KACA;KACA;KACA,YAAY;IACd,CAAC;GACL,CAAC;GACD,yBAA8B,KAAK,MAAM;GAEzC,MAAM,WAAW,MAAM,sBAAsB;IAC3C;IACA,UAAU,SAAS;IACnB,MAAM;GACR,CAAC;GACD,MAAM,iBAAiB,gBAAgB;IAAE;IAAU;GAAM,CAAC;GAE1D,MAAM,UAAwB,IAAI,eAAe;IAC/C,UAAU,EAAE,kBACV,cAAc;KAAE,GAAG;KAAgB;IAAY,CAAC;IAClD,gBAAgB;IAChB;IACA;IACA,WAAW,SAAS;IAIpB,GAAI,oBAAoB,WACpB,EAAE,wBAAwB,QAAQ,mBAAmB,EAAE,IACvD,CAAC;GACP,CAAC;GACD,MAAM,QAAQ,KACZ,oBAAoB,WAAW,EAAE,QAAQ,KAAK,IAAI,KAAA,CACpD;GAEA,OAAO,cAAc;IACnB,WAAW,UAAU;IACrB;IACA;IACA;IACA,iBAAiB,SAAS;IAC1B,WAAW,SAAS;IACpB,sBAAsB,UAAU;IAChC,aAAa,SAAS;IACtB,YAAY,SAAS;IACrB,SAAS,UAAU;IACnB,gBAAgB;IAChB,UAAU,oBAAoB,KAAA;IAC9B,+BAA+B,oBAAoB,KAAA;IACnD,eAAe,oBAAoB;IACnC,YAAY;IACZ,aAAa;IACb;IACA;IACA,OAAO,UAAU,eAAe;IAChC,gBAAgB,UAAU;IAC1B,SAAS;IACT;IACA;GACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,kBAAkB,EACzB,gBACA,YAIS;CACT,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,IAAI,WAAW,kBAAkB,eAAe,MAAM,SAAS,GAC7D,OAAO,eAAe,MAAM;CAE9B,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CAEJ,CAAC;AACH;AAEA,SAAS,6BAA6B,EACpC,gBACA,MACA,gBAKO;CACP,IAAI,qBAAqB,gBAAgB;CACzC,IAAI,QAAQ,MACV,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CACJ,CAAC;CAEH,IAAI,gBAAgB,MAClB,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CACJ,CAAC;AAEL;AAEA,eAAe,sBAAsB,EACnC,gBACA,UACA,QAKiC;CACjC,IAAI,YAAY,MAAM,OAAO;CAC7B,IAAI,qBAAqB,gBACvB,OAAO,eAAe,gBAAgB;EAAE;EAAM,UAAU;CAAK,CAAC;CAEhE,MAAM,IAAI,kCAAkC;EAC1C,WAAW;EACX,SACE;CACJ,CAAC;AACH;AAEA,SAAS,cAAc,EACrB,KACA,SACA,eAC2E;CAC3E,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,YAAY,SAAS;GACvB,OAAO,YAAY,0BAAU,IAAI,MAAM,8BAA8B,CAAC;GACtE;EACF;EAEA,MAAM,KAAK,IAAI,UAAU,KAAK,EAC5B,SAAS,WAAW,OAAO,KAAA,IAAY,EAAE,GAAG,QAAQ,EACtD,CAAC;EAED,IAAI,UAAU;EACd,MAAM,gBAAgB;GACpB,YAAY,oBAAoB,SAAS,OAAO;GAChD,GAAG,IAAI,QAAQ,MAAM;GACrB,GAAG,IAAI,SAAS,OAAO;EACzB;EACA,MAAM,qBAAqB,UAAmB;GAC5C,IAAI,SAAS;GACb,UAAU;GACV,QAAQ;GACR,GAAG,KAAK,eAAe,CAAC,CAAC;GACzB,IAAI;IACF,GAAG,UAAU;GACf,QAAQ;IACN,IAAI;KACF,GAAG,MAAM;IACX,QAAQ,CAER;GACF;GACA,OAAO,KAAK;EACd;EACA,MAAM,eAAe;GACnB,IAAI,SAAS;GACb,UAAU;GACV,QAAQ;GACR,QAAQ,EAAE;EACZ;EACA,MAAM,WAAW,QAAe;GAC9B,kBAAkB,GAAG;EACvB;EACA,MAAM,gBACJ,kBACE,YAAY,0BAAU,IAAI,MAAM,8BAA8B,CAChE;EAEF,GAAG,KAAK,QAAQ,MAAM;EACtB,GAAG,KAAK,SAAS,OAAO;EACxB,YAAY,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC/D,CAAC;AACH;AAEA,SAAS,cAAc,EACrB,WACA,SACA,MACA,OACA,iBACA,WACA,sBACA,aACA,YACA,SACA,gBACA,UACA,+BACA,eACA,YACA,aACA,WACA,8BACA,OACA,gBACA,SACA,gBACA,gCA0BmB;CACnB,IAAI,UAAU;CACd,IAAI;CAOJ,IAAI,wBAAwB,gCACxB,iBACA,KAAA;CAMJ,IAAI,iBAAiB;CACrB,IAAI,qCAAqC;CACzC,QAAQ,GAAG,kBAAiB,QAAO;EACjC,iBAAiB,IAAI;CACvB,CAAC;CACD,MAAM,+BAA+B,OAAO,EAC1C,QACA,cACA,OACA,kBAUyC;EACzC,MAAM,eAAe,MAAM,YAAY;GACrC;GACA,UAAU;GACV,WAAW;GACX;GACA;GACA,0BAA0B,EAAE,WAC1B,6BAA6B;GAC/B,8BAA8B,EAAE,WAAW,eACzC,qCAAqC,UAAU,IAAI;EACvD,CAAC;EACD,MAAM,kBAAkB,kCAAkC;GACxD;GACA;EACF,CAAC;EAGD,MAAM,gBACJ,kBAAkB,SACjB,aAAa,WACX,oCAAoC,WAAW,KAAK,MAAM,QACzD,uCAAuC;EAC7C,qCAAqC;EACrC,IAAI,eACF,wBAAwB,KAAA;EAE1B,OAAO,EAAE,cAAc;CACzB;CASA,MAAM,YAAY,aAMb;EACH,IAAI;EACJ,IAAI;EACJ,MAAM,OAAO,IAAI,SAAe,SAAS,WAAW;GAClD,iBAAiB;GACjB,gBAAgB;EAClB,CAAC;EACD,MAAM,uBAAuB,8CAA8C;GACzE,OAAM,YAAW,QAAQ,KAAK,OAAO;GACrC,aAAY,aAAY,QAAQ,GAAG,yBAAyB,QAAQ;GACpE,cAAa,aAAY,QAAQ,YAAY,QAAQ;EACvD,CAAC;EAED,MAAM,SAA4B,CAAC;EACnC,MAAM,WAAW,UAA+B;GAC9C,IAAI;IACF,SAAS,KAAK,KAAK;GACrB,QAAQ,CAAC;EACX;EAEA,MAAM,aAAa;GACjB;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,IAAI,YAAY;EAChB,MAAM,sBAAsB;GAC1B,IAAI,WAAW;GACf,YAAY;GACZ,qBAAqB,MAAM;GAC3B,KAAK,MAAM,KAAK,QAAQ,EAAE;GAC1B,eAAgB;EAClB;EACA,MAAM,eAAe,QAAiB;GACpC,IAAI,WAAW;GACf,YAAY;GACZ,qBAAqB,MAAM,GAAG;GAC9B,KAAK,MAAM,KAAK,QAAQ,EAAE;GAC1B,cAAe,GAAG;EACpB;EAEA,KAAK,MAAM,QAAQ,YACjB,OAAO,KACL,QAAQ,GAAG,OAAM,QAAO;GACtB,QAAQ,GAAG;EACb,CAAC,CACH;EAEF,OAAO,KACL,QAAQ,GAAG,WAAU,QAAO;GAC1B,QAAQ,GAAG;GACX,cAAc;EAChB,CAAC,CACH;EACA,OAAO,KACL,QAAQ,GAAG,UAAS,QAAO;GACzB,QAAQ,GAAG;GACX,YAAY,IAAI,KAAK;EACvB,CAAC,CACH;EAQA,MAAM,WAAW,OAAgB,WAAoB;GACnD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa;IAC1B,cAAc;IACd;GACF;GACA,4BAAY,IAAI,MAAM,+CAA+C,CAAC;EACxE;EACA,QAAQ,QAAQ,OAAO;EAEvB,MAAM,gBAAgB;GACpB,IAAI,WAAW;GACf,IAAI;IACF,QAAQ,KAAK,EAAE,MAAM,QAAQ,CAAC;GAChC,QAAQ,CAAC;GACT,YACE,SAAS,aAAa,UACpB,IAAI,aAAa,WAAW,YAAY,CAC5C;EACF;EACA,IAAI,SAAS,aAAa;GACxB,IAAI,SAAS,YAAY,SACvB,QAAQ;QAER,SAAS,YAAY,iBAAiB,SAAS,SAAS,EACtD,MAAM,KACR,CAAC;EAEL;EAyBA,OAAO;GACL,SAAA;IAvBA,kBAAkB,OAAM,UAAS;KAC/B,QAAQ,KAAK;MACX,MAAM;MACN,YAAY,MAAM;MAClB,QAAQ,MAAM;MACd,SAAS,MAAM;KACjB,CAAC;IACH;IACA,oBAAoB,OAAM,UAAS;KACjC,QAAQ,KAAK;MACX,MAAM;MACN,YAAY,MAAM;MAClB,UAAU,MAAM;MAChB,QAAQ,MAAM;KAChB,CAAC;IACH;IACA,mBAAmB,OAAM,SAAQ;KAC/B,MAAM,qBAAqB,OAAO,IAAI;IACxC;IACA;GAIM;GACN,YAAW,SAAQ;IAcjB,iBAR+B;KAC7B,IAAI,WAAW;KACf,IAAI;MACF,KAAK;KACP,SAAS,KAAK;MACZ,YAAY,GAAG;KACjB;IACF,GAAG,CACC,CAAC,CAAC,QAAQ;GAChB;EACF;CACF;CAEA,OAAO;EACL;EACA;EACA,cAAc,OAAM,eAAc;GAChC,IACE,WAAW,gBAAgB,SAAS,UACpC,WAAW,eAAe,UAAU,MAEpC,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;GAEH,MAAM,SAAS,WAAW,SAAS,CAAC,EAAA,CAAG,KAAI,OAAM;IAC/C,MAAM,EAAE;IACR,aAAa,EAAE;IACf,aAAa,EAAE;GACjB,EAAE;GACF,MAAM,EAAE,kBAAkB,MAAM,6BAA6B;IAC3D,QAAQ,WAAW;IACnB,cAAc,WAAW;IACzB;IACA,aAAa,WAAW;GAC1B,CAAC;GACD,MAAM,OAAO,SAAS;IACpB,MAAM,WAAW;IACjB,aAAa,WAAW;GAC1B,CAAC;GAED,MAAM,eAAe;IACnB,MAAM;IACN,QAAQ,gBAAgB,WAAW,MAAM;IACzC;IACA,GAAI,WAAW,kBAAkB,OAC7B,CAAC,IACD,EAAE,gBAAgB,WAAW,eAAe;IAChD,GAAI,WAAW,eACX,EAAE,cAAc,WAAW,aAAa,IACxC,CAAC;IACL,OAAO,WAAW,SAAS;IAC3B;IACA;IACA,GAAI,wBAAwB,OAAO,CAAC,IAAI,EAAE,qBAAqB;IAC/D,GAAI,eAAe,OAAO,CAAC,IAAI,EAAE,YAAY;IAC7C,GAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW;IAC3C,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,QAAQ;IACrC,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;IAC3C,GAAI,wBACA,EAAE,gBAAgB,sBAAsB,IACxC,CAAC;IACL,GAAI,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;IAC/C,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;GAC3B;GACA,wBAAwB,KAAA;GAExB,gBAAgB;GAChB,KAAK,gBAAgB,QAAQ,KAAK,YAAY,CAAC;GAE/C,OAAO,KAAK;EACd;EACA,gBAAgB,OAAM,iBAAgB;GACpC,IACE,aAAa,gBAAgB,SAAS,UACtC,aAAa,eAAe,UAAU,MAEtC,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;GAEH,MAAM,SAAS,aAAa,SAAS,CAAC,EAAA,CAAG,KAAI,OAAM;IACjD,MAAM,EAAE;IACR,aAAa,EAAE;IACf,aAAa,EAAE;GACjB,EAAE;GACF,MAAM,EAAE,kBAAkB,MAAM,6BAA6B;IAC3D,QAAQ,aAAa;IACrB,cAAc,aAAa;IAC3B;IACA,aAAa,aAAa;GAC5B,CAAC;GACD,MAAM,OAAO,SAAS;IACpB,MAAM,aAAa;IACnB,aAAa,aAAa;GAC5B,CAAC;GAcD,IAAI,eAAe;IACjB,gBAAgB;IAChB,MAAM,WAAW,yBAAyB;IAC1C,wBAAwB,KAAA;IACxB,KAAK,gBACH,QAAQ,KAAK;KACX,MAAM;KAQN,QAAQ;KACR;KACA,GAAI,aAAa,kBAAkB,OAC/B,CAAC,IACD,EAAE,gBAAgB,aAAa,eAAe;KAClD,GAAI,aAAa,eACb,EAAE,cAAc,aAAa,aAAa,IAC1C,CAAC;KACL,OAAO,aAAa,SAAS;KAC7B;KACA;KACA,GAAI,wBAAwB,OAAO,CAAC,IAAI,EAAE,qBAAqB;KAC/D,GAAI,eAAe,OAAO,CAAC,IAAI,EAAE,YAAY;KAC7C,GAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW;KAC3C,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,QAAQ;KACrC,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAC3C,GAAI,WAAW,EAAE,gBAAgB,SAAS,IAAI,CAAC;KAC/C,GAAI,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;KAC/C,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;IAC3B,CAAC,CACH;GACF;GAEA,OAAO,KAAK;EACd;EACA,WAAW,YAAY;GAOrB,MAAM,IAAI,kCAAkC;IAC1C,SACE;IACF,WAAW;GACb,CAAC;EACH;EACA,UAAU,YAAY;GACpB,IAAI,SACF,MAAM,IAAI,MACR,iBAAiB,UAAU,oCAC7B;GAEF,UAAU;GACV,MAAM,kBAAkB,MAAM,QAAQ,QAAQ;GAwB9C,OAAO;IAtBL,MAAM;IACN,WAAW;IACX,sBAAsB;IACtB,MAAM;KACJ,GAAI,iBAAiB,EAAE,UAAU,eAAe,IAAI,CAAC;KACrD,GAAI,qCACA,EACE,8BACE,mCACJ,IACA,CAAC;KACL,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;KACnC,QAAQ;MACN,MAAM;MACN,OAAO;MACP;MACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;KAC3C;IACF;GAEW;EACf;EACA,WAAW,YAAY;GACrB,IAAI,SAAS,OAAO;GACpB,UAAU;GACV,eAAe,YAAY;IAGzB,QAAQ,WAAW;IACnB,IAAI;KACF,IAAI,CAAC,QAAQ,SAAS,GACpB,QAAQ,KAAK,EAAE,MAAM,UAAU,CAAC;IAEpC,QAAQ,CAAC;IACT,IAAI;IACJ,IAAI;KACF,IAAI,MACF,MAAM,QAAQ,KAAK,CACjB,KAAK,KAAK,GACV,IAAI,SAAc,YAAW;MAC3B,YAAY,WAAW,SAAS,GAAI;MACpC,UAAU,QAAQ;KACpB,CAAC,CACH,CAAC;IAEL,UAAU;KACR,IAAI,WAAW,aAAa,SAAS;KACrC,IAAI;MACF,MAAM,MAAM,KAAK;KACnB,QAAQ,CAAC;KACT,QAAQ,MAAM;IAChB;GACF,EAAA,CAAG;GACH,OAAO;EACT;EACA,QAAQ,YAAY;GAClB,IAAI,SACF,MAAM,IAAI,MACR,iBAAiB,UAAU,kCAC7B;GAEF,UAAU;GAaV,QAAQ,WAAW;GACnB,MAAM,OAAgB,QAAQ,SAAS,IACnC,CAAC,IACD,MAAM,IAAI,SAAkB,SAAS,WAAW;IAC9C,MAAM,QAAQ,iBAAiB;KAC7B,MAAM;KACN,uBACE,IAAI,MACF,iBAAiB,UAAU,kCAC7B,CACF;IACF,GAAG,GAAI;IACP,MAAM,QAAQ;IACd,MAAM,QAAQ,QAAQ,GAAG,gBAAe,QAAO;KAC7C,aAAa,KAAK;KAClB,MAAM;KACN,QAAQ,IAAI,IAAI;IAClB,CAAC;IACD,IAAI;KACF,QAAQ,KAAK,EAAE,MAAM,OAAO,CAAC;IAC/B,SAAS,KAAK;KACZ,aAAa,KAAK;KAClB,MAAM;KACN,OAAO,GAAG;IACZ;GACF,CAAC;GAEL,IAAI;GACJ,IAAI;IACF,IAAI,MACF,MAAM,QAAQ,KAAK,CACjB,KAAK,KAAK,GACV,IAAI,SAAc,YAAW;KAC3B,YAAY,WAAW,SAAS,GAAI;KACpC,UAAU,QAAQ;IACpB,CAAC,CACH,CAAC;GAEL,UAAU;IACR,IAAI,WAAW,aAAa,SAAS;IACrC,IAAI;KACF,MAAM,MAAM,KAAK;IACnB,QAAQ,CAAC;IACT,QAAQ,MAAM;GAChB;GAuBA,OAAO;IAhBL,MAAM;IACN,WAAW;IACX,sBAAsB;IACtB,MAAM;KACJ,GARF,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,IAC3D,EAAE,GAAI,KAAiC,IACvC,CAAC;KAOH,GAAI,qCACA,EACE,8BACE,mCACJ,IACA,CAAC;KACL,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;IACrC;GAEW;EACf;EACA,eAAe,YAAY;GACzB,IAAI,SACF,MAAM,IAAI,MACR,iBAAiB,UAAU,6BAC7B;GAEF,UAAU;GASV,MAAM,kBAAkB,MAAM,QAAQ,QAAQ;GAwB9C,OAAO;IAtBL,MAAM;IACN,WAAW;IACX,sBAAsB;IACtB,MAAM;KACJ,GAAI,iBAAiB,EAAE,UAAU,eAAe,IAAI,CAAC;KACrD,GAAI,qCACA,EACE,8BACE,mCACJ,IACA,CAAC;KACL,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;KACnC,QAAQ;MACN,MAAM;MACN,OAAO;MACP;MACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;KAC3C;IACF;GAEW;EACf;CACF;AACF;AAEA,SAAS,kCAAkC,EACzC,cACA,SAQS;CACT,MAAM,YAAY,KAAK,UACrB;EAAE,cAAc,gBAAgB;EAAM;CAAM,IAC3C,MAAM,UAAU;EACf,IAAI,SAAS,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACnE,OAAO;EAET,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WACnC,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CACzC,CACF;CACF,CACF;CACA,OAAO,MAAM,WAAW,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK;AAClE;AAQA,SAAS,gBAAgB,QAAiC;CACxD,IAAI,OAAO,WAAW,UAAU,OAAO;CACvC,MAAM,EAAE,YAAY;CACpB,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,QAAQ,SAAS;EAC1B,IAAI,KAAK,SAAS,QAChB,MAAM,IAAI,kCAAkC;GAC1C,WAAW;GACX,SAAS,sEAAsE,KAAK,KAAK;EAC3F,CAAC;EAEH,MAAM,KAAK,KAAK,IAAI;CACtB;CACA,OAAO,MAAM,KAAK,MAAM;AAC1B;;;;;;;;AC52CA,MAAa,QAAQ,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-codex",
-  "version": "1.0.139",
+  "version": "1.0.141",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -26,9 +26,9 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/harness": "1.0.137",
-    "@ai-sdk/provider": "4.0.21",
-    "@ai-sdk/provider-utils": "5.0.53",
+    "@ai-sdk/harness": "1.0.139",
+    "@ai-sdk/provider": "4.0.22",
+    "@ai-sdk/provider-utils": "5.0.54",
     "ws": "^8.21.0"
   },
   "peerDependencies": {

package/src/codex-harness.ts

@@ -817,10 +817,12 @@ function createSession({
       instructions,
       tools,
     });
+    // Legacy fingerprints used order-sensitive JSON, so replace them once
+    // instead of restarting a thread during the fingerprint format upgrade.
     const restartThread =
       latestThreadId != null &&
       (skillsResult.changed ||
-        (latestTurnConfigurationFingerprint != null &&
+        (latestTurnConfigurationFingerprint?.startsWith('v2:') === true &&
           latestTurnConfigurationFingerprint !== nextFingerprint));
     latestTurnConfigurationFingerprint = nextFingerprint;
     if (restartThread) {
@@ -1048,6 +1050,8 @@ function createSession({
         ...(debug ? { debug } : {}),
       };
       pendingResumeThreadId = undefined;
+      // Recovery starts a native turn once. Later continuations attach to it.
+      rerunContinue = false;
       turn.sendStart(() => channel.send(startMessage));
 
       return turn.control;
@@ -1092,6 +1096,7 @@ function createSession({
        * fallback; the common slice path is `attach`.
        */
       if (rerunContinue) {
+        rerunContinue = false;
         const threadId = pendingResumeThreadId ?? latestThreadId;
         pendingResumeThreadId = undefined;
         turn.sendStart(() =>
@@ -1351,9 +1356,20 @@ function fingerprintCodexTurnConfiguration({
     inputSchema: unknown;
   }>;
 }): string {
-  return createHash('sha256')
-    .update(JSON.stringify({ instructions: instructions ?? null, tools }))
-    .digest('hex');
+  const canonical = JSON.stringify(
+    { instructions: instructions ?? null, tools },
+    (_key, value) => {
+      if (value == null || typeof value !== 'object' || Array.isArray(value)) {
+        return value;
+      }
+      return Object.fromEntries(
+        Object.entries(value).sort(([left], [right]) =>
+          left < right ? -1 : left > right ? 1 : 0,
+        ),
+      );
+    },
+  );
+  return `v2:${createHash('sha256').update(canonical).digest('hex')}`;
 }
 
 /*