@aitne/daemon 0.1.8 → 0.1.9

package/dist/core/backends/cli-utils.js

@@ -1,6 +1,6 @@
 import { execFileSync, spawn } from "node:child_process";
 import { accessSync, constants, existsSync, readFileSync, unlinkSync } from "node:fs";
-import { delimiter, join } from "node:path";
+import { delimiter, join, normalize } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";
 /**
@@ -17,7 +17,15 @@ export async function runLineCommand(options) {
     const stdoutLines = [];
     const stderrLines = [];
     return await new Promise((resolve, reject) => {
-        const child = spawn(options.command, options.args, {
+        // Windows: resolve bare names via PATHEXT and route `.cmd`/`.bat` batch
+        // shims through an explicit, hand-escaped `cmd.exe` wrapper. POSIX is left
+        // exactly as-is. `win` is null when no rewrite is needed (POSIX always, or
+        // an unresolvable bare name that should ENOENT naturally). See
+        // {@link resolveWin32Invocation}.
+        const win = process.platform === "win32"
+            ? resolveWin32Invocation(options.command, options.args)
+            : null;
+        const child = spawn(win?.command ?? options.command, win?.args ?? options.args, {
             cwd: options.cwd,
             env: options.env,
             stdio: ["pipe", "pipe", "pipe"],
@@ -29,11 +37,14 @@ export async function runLineCommand(options) {
             // (`auth-recovery` device-auth/login flows go through bespoke
             // spawn calls, not this helper), so the new process-group identity
             // is invisible to them. Windows has no process groups; we rely on
-            // taskkill /T below to walk the parent-pid chain instead, and
-            // hide the helper console window so background CLI calls don't
-            // flash one on screen.
+            // taskkill /T below to walk the parent-pid chain instead (the chain
+            // includes the cmd.exe wrapper above), and hide the helper console
+            // window so background CLI calls don't flash one on screen.
             detached: process.platform !== "win32",
             windowsHide: true,
+            // The cmd.exe wrapper's args are already escaped for cmd.exe; tell Node
+            // not to re-quote them. Inert/false on POSIX and the direct-.exe path.
+            windowsVerbatimArguments: win?.windowsVerbatimArguments ?? false,
         });
         let timedOut = false;
         let settled = false;
@@ -191,10 +202,10 @@ export async function runLineCommand(options) {
  *   escalate to SIGKILL — without this, a Gemini subprocess (or a
  *   grandchild) that catches SIGTERM and is mid-network-call leaves
  *   `runLineCommand` hanging on `child.once("close")` indefinitely.
- *   Observed 2026-04-29: an 18m delegated_proxy.invoke that should have
- *   timed out at 240s (cli-utils.ts:99) because the abort signal landed
- *   but the gemini grandchild ignored SIGTERM until the upstream HTTP
- *   request unblocked.
+ *   Observed: a long-running delegated_proxy.invoke that should have
+ *   timed out at its abort deadline kept going because the gemini
+ *   grandchild ignored SIGTERM until the upstream HTTP request
+ *   unblocked.
  * - **Windows**: no process groups; `taskkill /T /F /PID <pid>` walks
  *   the parent-pid chain to terminate descendants. `/F` is forced
  *   because Windows console apps don't honor a graceful close — Node
@@ -209,10 +220,9 @@ export async function runLineCommand(options) {
  * stdio EOF arrives — so a surviving grandchild leaves runLineCommand's
  * Promise stuck indefinitely. Forcibly destroying our read ends EOFs the
  * readline interfaces locally so close fires as soon as the kernel reaps
- * the (already-SIGKILLed) parent. Observed 2026-05-01: 5×
- * delegated_proxy.invoke rows in the 10–18m range despite the 240s wall
- * clock — every one was Gemini's google-workspace extension grandchild
- * outliving the parent.
+ * the (already-SIGKILLed) parent. Observed: long-running
+ * delegated_proxy.invoke rows despite the wall-clock — Gemini's
+ * google-workspace extension grandchild outlives the parent.
  *
  * The fall-through to `child.kill("SIGTERM")` covers two narrow races:
  * (1) the process already exited between our pid check and the syscall,
@@ -308,7 +318,6 @@ function killTree(child) {
  * but if the child catches and ignores SIGTERM, escalate to SIGKILL after
  * `gracePeriodMs` so the parent's `child.once("close")` listener actually
  * fires. Same hang motivation as {@link killTree}'s SIGKILL escalation
- * (see file-history note for the 2026-04-29 18m delegated_proxy.invoke).
  *
  * Note on `subprocess.killed` semantics: Node sets `killed=true` as soon
  * as `child.kill()` *sends* a signal — even if the child ignores it. So
@@ -366,6 +375,116 @@ export function findExecutable(command) {
     }
     return null;
 }
+// ── Windows `.cmd`/`.bat` shim launching ─────────────────────────────────
+//
+// On Windows with Node ≥ 22, spawning a resolved `.cmd`/`.bat` with the
+// default `shell: false` throws EINVAL (the CVE-2024-27980 "BatBadBut"
+// mitigation), and spawning a bare command name never consults PATHEXT (throws
+// ENOENT). npm-installed CLIs ship exactly these batch shims (`codex.cmd`,
+// `gemini.cmd`, `npm.cmd`, …), so every Codex/Gemini turn, auth-recovery probe,
+// and in-dashboard CLI install/verify that flows through `runLineCommand`
+// would crash on a Windows host.
+//
+// We therefore (win32-only) resolve a bare name to its absolute shim via
+// `findExecutable()` and, when the target is a batch shim, launch it through an
+// explicit `cmd.exe /d /s /c` wrapper. The naive `shell: true` shortcut is
+// UNSAFE here: callers pass arbitrary LLM prompts as discrete argv elements,
+// and under `shell: true` Node hands the joined line to cmd.exe whose metachar
+// parsing (`%VAR%`, `&`, `|`, `<`, `>`, `^`, embedded `"`, newlines) is NOT
+// neutralized by Node's quoting — turning a crash into prompt corruption and a
+// command-injection surface. Instead we escape every element for cmd.exe
+// ourselves and pass the pre-escaped line with `windowsVerbatimArguments: true`
+// so Node does not re-quote on top.
+//
+// The escaping below is replicated faithfully from the battle-tested
+// `cross-spawn` package (MIT, v7.0.6) and https://qntm.org/cmd: each argument
+// is first made safe for the MS C runtime argv parser (backslash / double-
+// quote rules, using cross-spawn's ReDoS-hardened regexes — our args are
+// arbitrary LLM prompts), then cmd.exe metacharacters are caret-escaped. The
+// caret-escaping is applied a *second* time only for `node_modules/.bin/*.cmd`
+// shims, whose extra cmd.exe re-invocation layer consumes one level of escaping
+// (a plain global shim like `npm.cmd` must NOT be double-escaped or its args
+// would be corrupted).
+/** cmd.exe metacharacters (space included) that require caret-escaping. */
+const WIN_CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/**
+ * Matches a `node_modules/.bin/<name>.cmd` shim — the only case that needs
+ * double-escaped metachars (mirrors cross-spawn's `isCmdShimRegExp`).
+ */
+const WIN_CMD_BIN_SHIM = /node_modules[\\/]\.bin[\\/][^\\/]+\.cmd$/i;
+function escapeCmdCommand(command) {
+    // Command path: caret-escape metachars (spaces included) but do NOT wrap in
+    // quotes — matches cross-spawn, which relies on caret-escaped spaces here.
+    return command.replace(WIN_CMD_META, "^$1");
+}
+function escapeCmdArgument(arg, doubleEscapeMetaChars) {
+    let s = `${arg}`;
+    // 1. MS C runtime argv quoting (qntm.org/cmd, ReDoS-hardened): double up a
+    //    backslash run that precedes a double quote and escape the quote; double
+    //    up a trailing run (it ends up before the closing quote); wrap in quotes.
+    s = s.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"').replace(/(?=(\\+?)?)\1$/, "$1$1");
+    s = `"${s}"`;
+    // 2. Caret-escape cmd.exe metachars; a second pass only for node_modules/.bin
+    //    shims (their extra cmd layer consumes one level of ^-escaping).
+    s = s.replace(WIN_CMD_META, "^$1");
+    if (doubleEscapeMetaChars) {
+        s = s.replace(WIN_CMD_META, "^$1");
+    }
+    return s;
+}
+/**
+ * Build the `cmd.exe` argv that launches a `.cmd`/`.bat` shim with the given
+ * arguments, fully escaped against cmd.exe re-parsing. Pure (no filesystem),
+ * exported for unit testing of the escaping. Pair with
+ * `windowsVerbatimArguments: true` so Node passes the line verbatim.
+ */
+export function buildCmdShimArgs(shimPath, args) {
+    const doubleEscape = WIN_CMD_BIN_SHIM.test(shimPath);
+    const line = [
+        escapeCmdCommand(shimPath),
+        ...args.map((a) => escapeCmdArgument(a, doubleEscape)),
+    ].join(" ");
+    return ["/d", "/s", "/c", `"${line}"`];
+}
+/**
+ * Windows-only spawn rewrite for {@link runLineCommand}. Returns the
+ * substitute `{ command, args, windowsVerbatimArguments }`, or `null` when no
+ * rewrite is needed (so the caller spawns the original command unchanged, and
+ * an unresolvable bare name still ENOENTs naturally as before).
+ *
+ * - Bare name → resolved to its absolute path via PATHEXT (`findExecutable`).
+ * - Resolved `.cmd`/`.bat` → launched through a hand-escaped
+ *   `cmd.exe /d /s /c` wrapper (verbatim args).
+ * - Resolved `.exe`/`.com`/extensionless → spawned directly (`shell:false` is
+ *   safe for these); the only change vs. today is bare-name → absolute
+ *   resolution, which also closes the bare-name PATHEXT ENOENT.
+ */
+export function resolveWin32Invocation(command, args) {
+    const hasPathSeparator = /[\\/]/.test(command);
+    // A pathed command is normalized (forward slashes → native, matching
+    // cross-spawn, which otherwise ENOENTs on posix-style paths); a bare name is
+    // resolved through PATH/PATHEXT.
+    const resolved = hasPathSeparator ? normalize(command) : findExecutable(command);
+    if (!resolved) {
+        // Unresolvable bare name: leave it to spawn so the ENOENT surfaces as the
+        // child "error" event exactly as it does today.
+        return null;
+    }
+    if (/\.(?:cmd|bat)$/i.test(resolved)) {
+        return {
+            command: process.env.ComSpec || "cmd.exe",
+            args: buildCmdShimArgs(resolved, args),
+            windowsVerbatimArguments: true,
+        };
+    }
+    if (resolved === command) {
+        // Already an absolute/pathed non-batch target; nothing to rewrite.
+        return null;
+    }
+    // Bare name resolved to an absolute .exe/.com (or extensionless): spawn it
+    // directly. Node's standard argv quoting is correct for non-batch targets.
+    return { command: resolved, args, windowsVerbatimArguments: false };
+}
 /**
  * Lazy CLI path resolver with TTL-based revalidation (roadmap §9.4).
  *
@@ -461,4 +580,3 @@ export function isPlausibleAnthropicApiKey(raw) {
     // charset but strict on the prefix to reject environmental garbage.
     return /^sk-ant-[A-Za-z0-9_-]{20,}$/.test(key);
 }
-//# sourceMappingURL=cli-utils.js.map

package/dist/core/backends/codex-core.d.ts

@@ -136,4 +136,3 @@ export declare const CODEX_ARGV_BUDGET_BYTES = 120000;
  * Pure function — unit-testable without a CLI subprocess.
  */
 export declare function buildCodexImageArgs(staged: StagedAttachment[] | undefined, budgetBytes: number): string[];
-//# sourceMappingURL=codex-core.d.ts.map

package/dist/core/backends/codex-core.js

@@ -4,7 +4,8 @@ import { join } from "node:path";
 import { INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isMessageEvent, isPlausibleOpenAiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
 import { getContextDir } from "../../config.js";
 import { cleanupSessionWorkdir, createSessionWorkdir } from "../workdir.js";
-import { BackendDecisiveFailure, BackendQuotaError, DelegatedProxyTimeoutError, classifyAbortReason, } from "../agent-core.js";
+import { resolveUserSkillsRoot } from "../user-skills-root.js";
+import { BackendDecisiveFailure, DelegatedProxyTimeoutError, classifyAbortReason, } from "../agent-core.js";
 import { IdleWatchdog } from "./idle-watchdog.js";
 import { DELEGATED_PROXY_DEFAULTS } from "../../services/delegated-proxy-config.js";
 import { buildDelegatedToolPrompt, emptyCost, flattenToolResultContent, tryParseToolResult, withDurationMs, } from "../../services/delegated-tool-runtime.js";
@@ -15,10 +16,10 @@ import { buildDaemonApiCliEnv } from "../daemon-api-cli.js";
 import { noteNativeSkillToolIfPresent, probeCliNativeSkillSubcommand, } from "./native-skill-discovery-probe.js";
 import { createOutputCapturePath, CliPathCache, parseJsonLine, readFileIfExists, removeFileIfExists, runLineCommand, } from "./cli-utils.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
-import { extractGenericQuotaResetHint } from "./quota-reset-hints.js";
+import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, } from "./cli-quota-guards.js";
 import { auditStreamObservation, extractCodexShellCall, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
-import { estimateTextInputTokens, findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
+import { findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
 import { PriceFetcher } from "./price-fetcher.js";
 import { buildExecutionPrompt, buildSummaryPrompt } from "./prompt-utils.js";
 import { createLogger } from "../../logging.js";
@@ -39,10 +40,10 @@ const EMPTY_USAGE = {
  * stream events) well before `executeTimeoutMinutes` (default 30 min)
  * fires; healthy turns rarely go 5 min silent end-to-end.
  *
- * Audit 2026-05-17: the delegated path already had this guard (see the
- * `runDelegatedTool` wiring lower in this file); the reactive path was
- * unprotected and a single hung subprocess could pin a session for the
- * full 30-min wall-clock, blocking morning-routine / hourly-check
+ * The delegated path already had this guard (see the `runDelegatedTool`
+ * wiring lower in this file); the reactive path needs it explicitly
+ * because a single hung subprocess can pin a session for the full
+ * executeTimeoutMinutes wall-clock, blocking morning-routine / hourly-check
  * dispatch downstream.
  */
 const REACTIVE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
@@ -196,6 +197,10 @@ export class CodexCore {
             eventCorrelationId: params.event.correlationId,
             webSearchEnabled: params.webSearchEnabled ?? false,
             ...(isMessageEvent(params.event) ? { messageText: params.event.content } : {}),
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         }, streamCallbacks);
     }
     async executeResume(params, streamCallbacks) {
@@ -424,9 +429,14 @@ export class CodexCore {
             logger.warn({ reason: auth.reason }, "Codex auth check failed");
             throw new BackendDecisiveFailure(this.backendId, "auth", new Error(auth.reason));
         }
+        // checkAuth() returns {ok:false} when cliPath is null, so reaching here
+        // proves it is a resolved absolute path. Pin it to a local const — TS
+        // cannot narrow `this.cliPath` (a getter) through the await above, and
+        // we avoid a non-null assertion. Used as the spawn `command` below.
+        const cliPath = this.cliPath;
         this.assertPromptWithinMaxBudget(params.prompt, params.maxBudgetUsd, params.modelId);
         const startMs = Date.now();
-        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, `${this.config.dataDir}/skills`, {
+        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, resolveUserSkillsRoot(this.config), {
             backendId: this.backendId,
             processKey: params.processKey,
             character: this.config.character,
@@ -441,6 +451,12 @@ export class CodexCore {
             ...(this.mcpContext?.db ? { db: this.mcpContext.db } : {}),
             ...(typeof params.messageText === "string" ? { messageText: params.messageText } : {}),
             ...(params.wikiWorkspaceName ? { wikiWorkspaceName: params.wikiWorkspaceName } : {}),
+            // AGENT_DEFINITIONS_DESIGN.md §4.2 — see ClaudeCodeCore. No-op for
+            // non-Agent executes.
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         });
         const ownsSessionDir = !params.sessionDir;
         const outputPath = createOutputCapturePath(sessionDir, "codex-last-message");
@@ -457,10 +473,10 @@ export class CodexCore {
         // like `setup.initial` look frozen for minutes when the model finally
         // returned a single multi-block response in one chunk.
         let streamed = false;
-        // Reactive idle watchdog (audit 2026-05-17 C1). Declared outside the
-        // outer try so the outer finally below can always call stop() — even
-        // if a setup line between here and runLineCommand throws. Mirrors the
-        // delegated-path wiring in `runDelegatedTool` (~line 1350): each
+        // Reactive idle watchdog. Declared outside the outer try so the
+        // outer finally below can always call stop() — even if a setup line
+        // between here and runLineCommand throws. Mirrors the delegated-path
+        // wiring in `runDelegatedTool`: each
         // arrived stream event resets the timer, and when the gap exceeds
         // REACTIVE_IDLE_TIMEOUT_MS the aborter fires — runLineCommand reaps
         // the subprocess via its existing kill-tree path. Distinct from
@@ -507,7 +523,13 @@ export class CodexCore {
             let observedReasoning = false;
             idleWatchdog.start();
             const runResult = await runLineCommand({
-                command: "codex",
+                // Resolved absolute CLI path, not a bare name — on Windows with
+                // shell:false, spawn does no PATHEXT resolution, so a bare "codex"
+                // would never match an npm `codex.cmd` or native `codex.exe`. The
+                // checkAuth() pre-flight above guarantees cliPath is non-null
+                // (checkAuth returns {ok:false} when it is, and the gate throws).
+                // Matches the delegated/probe sibling call sites.
+                command: cliPath,
                 args: this.buildArgs(params, outputPath),
                 cwd: sessionDir,
                 env: {
@@ -774,8 +796,7 @@ export class CodexCore {
         // agent to reach the daemon API at http://localhost:${apiPort}/... under
         // the workspace-write sandbox. Without it, Seatbelt/sandbox-exec blocks
         // ALL network egress and `curl http://localhost:8321/api/health` fails
-        // with a connection-refused sandbox denial (verified 2026-04-11, Codex
-        // v0.118.0).
+        // with a connection-refused sandbox denial.
         //
         // HOWEVER: this flag is a binary on/off switch in Codex's sandbox model.
         // There is no host-scoped allowlist. Once enabled, the agent can reach
@@ -845,9 +866,8 @@ export class CodexCore {
         // (per-integration)` block in AGENTS.md (rendered by
         // `skills-compiler.buildSameBackendDenyBlock`). Cross-backend
         // delegation provides hard enforcement at the
-        // `/api/integrations/:key/exec` task-mode chokepoint (the legacy
-        // `/invoke` RPC was retired 2026-05-01), so users requiring strict
-        // deny should pick a non-Codex DM backend.
+        // `/api/integrations/:key/exec` task-mode chokepoint, so users
+        // requiring strict deny should pick a non-Codex DM backend.
         //
         const sandboxArgs = allowMode
             ? ["--dangerously-bypass-approvals-and-sandbox"]
@@ -919,61 +939,38 @@ export class CodexCore {
             return anyFromRegistry;
         throw new Error(`pickSummaryModel: no models registered for backend ${this.backendId}`);
     }
+    // Failure classification + budget enforcement share a skeleton with the
+    // Gemini CLI core; the logic lives in `cli-quota-guards.ts` (single source
+    // of truth) and each backend passes its own regexes / label. See that
+    // module for the full ordering rationale.
     classifyFailure(message) {
-        if (isMaxBudgetMessage(message)) {
-            return new BackendQuotaError(this.backendId, "max_budget_usd", null, message);
-        }
-        if (/rate limit|usage limit|quota/i.test(message)) {
-            // Best-effort reset-time extraction so the dashboard can surface
-            // "quota resets at HH:MM (TZ)" instead of a bare "rate_limited" tag.
-            // OpenAI rate-limit messages typically carry "try again in Xm" or
-            // an ISO retry-after; the helper falls through to null when neither
-            // pattern matches, preserving the original behaviour.
-            return new BackendQuotaError(this.backendId, "rate_limited", extractGenericQuotaResetHint(message), message);
-        }
-        if (/unauthorized|forbidden|api key|login/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "auth", new Error(message));
-        }
-        if (/timed out|timeout/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "timeout", new Error(message));
-        }
-        return new BackendDecisiveFailure(this.backendId, "other_non_retryable", new Error(message));
+        return classifyCliFailure({
+            backendId: this.backendId,
+            message,
+            // OpenAI surfaces quota exhaustion as "rate limit" / "usage limit" / "quota".
+            rateLimitPattern: /rate limit|usage limit|quota/i,
+            authPattern: /unauthorized|forbidden|api key|login/i,
+        });
     }
-    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, 
-    /**
-     * Spend metadata for the just-completed turn. Codex enforces
-     * `max_budget_usd` post-hoc — by the time we reject here OpenAI has
-     * already consumed tokens — so we hand the actual usage to the
-     * BackendQuotaError so the dispatcher's error path can write a
-     * `result='failed'` agent_actions row with `cost_usd` populated.
-     * Without this the dashboard silently misses budget-rejected spend.
-     */
-    spend) {
-        if (maxBudgetUsd === undefined || costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Codex estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`, spend ? { ...spend, modelId, costUsd } : null);
+    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, spend) {
+        assertCostWithinMaxBudget({
+            backendId: this.backendId,
+            label: "Codex",
+            costUsd,
+            maxBudgetUsd,
+            modelId,
+            spend,
+        });
     }
     assertPromptWithinMaxBudget(prompt, maxBudgetUsd, modelId) {
-        if (maxBudgetUsd === undefined) {
-            return;
-        }
-        const estimatedUsage = {
-            inputTokens: estimateTextInputTokens(prompt),
-            outputTokens: 0,
-            cacheCreationInputTokens: 0,
-            cacheReadInputTokens: 0,
-        };
-        const { costUsd } = this.priceFetcher.estimateUsageCost({
+        assertPromptCostWithinMaxBudget({
             backendId: this.backendId,
+            label: "Codex",
+            prompt,
+            maxBudgetUsd,
             modelId,
-            usage: estimatedUsage,
-            fallbackModel: findRegisteredModel(this.backendId, modelId),
+            priceFetcher: this.priceFetcher,
         });
-        if (costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Codex estimated prompt cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
     }
     /**
      * Delegated proxy invocation — Codex CLI path.
@@ -1868,9 +1865,6 @@ function collectItemOutput(bag) {
     }
     return null;
 }
-function isMaxBudgetMessage(message) {
-    return /max(?:imum)? budget|max_budget_usd|budget limit|per-turn budget/i.test(message);
-}
 /**
  * Codex argv byte budget. macOS `ARG_MAX` is ~1 MB and the kernel counts
  * env vars too, so we cap our contribution at 120 KB to leave plenty of
@@ -1959,10 +1953,10 @@ function nonCachedInputTokens(totalInputTokens, cacheReadInputTokens, cacheCreat
 // **Verified shapes** (covered by existing tests, observed in the
 // wild): `reasoning` (codex 0.121+), `agent_reasoning` (older builds).
 //
-// **Defensive entries** (added by the file-fallback hardening,
-// 2026-05-16, not yet confirmed from codex-rs source — additions are
-// safe because the names are reasoning-specific enough that a false
-// positive is implausible): `reasoning_summary` — plausible naming if
+// **Defensive entries** (not yet confirmed from codex-rs source —
+// additions are safe because the names are reasoning-specific enough
+// that a false positive is implausible): `reasoning_summary` —
+// plausible naming if
 // codex-rs ever differentiates the summary item from the in-progress
 // reasoning stream. Drop this entry if a future codex release
 // repurposes the name for something else.
@@ -1979,10 +1973,10 @@ const CODEX_REASONING_ITEM_TYPES = new Set([
 // `agent_reasoning_section_break` — emitted by older codex builds and
 // covered by the existing reasoning-filter regression tests.
 //
-// **Defensive entries** (added 2026-05-16 — NOT confirmed against
-// codex-rs source, included because the bug surface is real and the
-// false-positive risk is near-zero given how reasoning-specific the
-// names are): the `response.reasoning_summary_*` family follows
+// **Defensive entries** (NOT confirmed against codex-rs source,
+// included because the bug surface is real and the false-positive risk
+// is near-zero given how reasoning-specific the names are): the
+// `response.reasoning_summary_*` family follows
 // OpenAI's Responses API streaming schema, which codex CLI is known
 // to relay verbatim in some configurations (GPT-5 / o-series models
 // against certain backends). The bare `reasoning_*` short forms hedge
@@ -2140,4 +2134,3 @@ function firstFailureLine(lines) {
 function readNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
-//# sourceMappingURL=codex-core.js.map

package/dist/core/backends/gemini-cli-core.d.ts

@@ -408,4 +408,3 @@ export declare function collectMcpServerNames(filePath: string, out: Set<string>
  * Exported for unit testing.
  */
 export declare function extractGeminiServerName(toolNamespace: string): string | null;
-//# sourceMappingURL=gemini-cli-core.d.ts.map