@bjoernrochel/sevro 1.0.0 → 1.1.1

package/dist/src/hosts/codex-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-state.js","sourceRoot":"","sources":["codex-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,6BAA0B;AAChF,OAAO,EAAE,UAAU,EAAE,oBAAiB;AACtC,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,kCAA+B;AAChC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,oCAAiC;AAClC,OAAO,EAAE,UAAU,EAAE,oBAAoB;AACzC,OAAO,EAAE,UAAU,EAAE,gBAAgB;AACrC,OAAO,EAAE,aAAa,EAAE,6BAA0B;AAClD,OAAO,EACL,EAAE,EACF,KAAK,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,EAAE,EACF,IAAI,EACJ,OAAO,EACP,SAAS,GACV,yBAAyB;AAC1B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,kBAAkB;AAE1D,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,iCAA8B;AAC/B,OAAO,EAAE,iBAAiB,EAAE,4BAAyB;AACrD,OAAO,EAAE,sBAAsB,EAAE,sCAAmC;AACpE,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,4BAAyB;AAC1B,OAAO,EAAE,mBAAmB,EAAE,4BAAyB;AACvD,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GACjB,mCAAgC;AACjC,OAAO,EAAE,sBAAsB,EAAE,2BAAwB;AACzD,OAAO,EAAE,wBAAwB,EAAE,6BAA0B;AAG7D,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAkBnC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,MAAc;IACpD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,cAAc;YAC5C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE;YAC5D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,cAAc;QACnC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,KAAiB,EACjB,oBAA8B;IAE9B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,SAAS;QAC5B,WAAW,EAAE,oBAAoB;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI;YAC/B,MAAM,EAAE,kBAAkB;YAC1B,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,EAAE;SAClB;KACF,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,mBAAmB,CAChC,KAAiB,EACjB,KAAe;IAEf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,KAAK,CAAC,SAAS,gBAAgB,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK;SACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;SACnD,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE;QAC7D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,SAAiB;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAC7C,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EACpC,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EACnC,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAC7C,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC/C,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACzE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAC7B,CACF,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;YAC1C,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,OAAO;QACL,SAAS;QACT,UAAU;QACV,UAAU;QACV,WAAW;QACX,WAAW;QACX,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,SAAmB,EACnB,cAAwB;IAExB,IACE,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CACpE,CACF;QAED,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoB;IACpD,OAAO,KAAK,KAAK,IAAI;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oDAAoD,KAAK,IAAI,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA0D,EAC1D,SAAiB,EACjB,OAAgB,EAChB,SAAmB,EACnB,cAAwB,EACxB,KAAoB,EACpB,kBAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,WAAW,EACvD,gBAAoC,EACpC,kBAA4B;IAE5B,MAAM,OAAO,GAAG,sBAAsB,CAAC;QACrC,SAAS,EAAE,uBAAuB,CAChC,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,WAAW,IAAI,WAAW,CACnC;QACD,kBAAkB,EAAE,uBAAuB,CACzC,OAAO,EACP,KAAK,EACL,kBAAkB,CACnB;QACD,gBAAgB;QAChB,gBAAgB,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa;QACtD,eAAe,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;QAC/D,gBAAgB,EAAE;YAChB,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC;YACvC,GAAG,kBAAkB;SACtB;QACD,EAAE,EAAE,SAAS;QACb,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,SAAS;QAC9B,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC;QACtD,cAAc;KACf,CAAC,CAAC;IACH,MAAM,SAAS,CACb,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,EACpC,OAAO;QACL,wBAAwB,CAAC,KAAK,CAAC;QAC/B,yBAAyB,CAAC,OAAO,CAAC,EACpC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IACjD,OAAO,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,gCAAgC,CAAC;AAC1F,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,KAA0D,EAC1D,WAA+C;IAE/C,OAAO;QACL,GAAG,uBAAuB,CAAC,OAAO,EAAE,WAAW,CAAC;QAChD,GAAG,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;QACvD,GAAG,8BAA8B,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAClE,GAAG,4BAA4B,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAC/D,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,KAAK,IAAI;YAC5C,CAAC,CAAC;gBACE,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;aACtE;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgB,EAChB,IAAY;IAEZ,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,iBAAiB,KAAK,IAAI;YACnD,CAAC,CAAC;gBACE,UAAU,EAAE,IAAI;gBAChB,4BAA4B,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;aACrD;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,IAAY;IAC1D,OAAO;QACL,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,KAAK,IAAI;YAC5C,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC;QACtC,GAAG,wBAAwB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC5D,GAAG,0BAA0B,CAAC,OAAO,CAAC,sBAAsB,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,IAAY;IAC1D,OAAO,OAAO,CAAC,aAAa,EAAE,iBAAiB,KAAK,IAAI;QACtD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1B,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,IAAY;IACzD,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAyB,EAAE,aAAqB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,CACL,OAAO,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,WAA+C;IAE/C,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,IAAI,GACR,WAAW,CAAC,IAAI;QAChB,gEAAgE,CAAC;IACnE,OAAO;QACL,GAAG,WAAW;QACd,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,UAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,CACb,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC3B,eAAe,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAC5D,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,UAA8B;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,CAAC;IACjD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA0D,EAC1D,OAAgB,EAChB,SAAiB;IAEjB,OAAO;QACL,GAAG,OAAO,CAAC,aAAa,EAAE,WAAW;QACrC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;QAC7B,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,MAAM,EAAE,KAAK,CAAC,UAAU;QACxB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,QAAQ,EAAE,GAAG;QACb,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YACxD,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE;YACxB,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CACL,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,KAA0D,EAC1D,SAAiB;IAEjB,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,WAAW,IAAI,WAAW,EAClC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAC3D,CAAC;IACF,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IACjC,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAiD,EACjD,GAA2B,EAC3B,KAA0D;IAE1D,IAAI,OAAO;QACT,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE;YACtC,IAAI,EAAE,KAAK,CAAC,UAAU;YACtB,MAAM,EAAE,KAAK,CAAC,UAAU;SACzB,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAiD;IAEjD,OAAO;QACL,WAAW,EAAE,OAAO,EAAE,WAAW;QACjC,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,IAAI,EAAE;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAiB,EACjB,OAAyB,EACzB,KAAoB,EACpB,OAAgB,EAChB,UAAmB;IAEnB,MAAM,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC;QACpD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,eAAe,EAAE;YACf,GAAG,OAAO,CAAC,wBAAwB;YACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpD,GAAG,gBAAgB,CAAC,OAAO,CAAC;SAC7B;KACF,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAC9D,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,UAAU;QACZ,MAAM,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAChE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;KAC/B,CAAC,CACH,CAAC;IACF,IAAI,UAAU;QAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,4BAA4B,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,gBAAgB,CACpB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,WAAW,EACnB,cAAc,CACf,CAAC;IACF,cAAc,CAAC,IAAI,CACjB,GAAG,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CACpE,CAAC;IACF,6BAA6B,CAC3B,SAAS,EACT,2BAA2B,CACzB,SAAS,EACT,cAAc,EACd,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAC/B,CACF,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,iBAAiB,CACrB,KAAK,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,cAAc,EACd,KAAK,EACL,cAAc,CAAC,WAAW,EAC1B,cAAc,CAAC,IAAI,EACnB,cAAc,CAAC,kBAAkB,CAClC,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,yBAAyB,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAgB,EAChB,KAA0D;IAE1D,OAAO,iBAAiB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC;YACE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC;SAC5C;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,OAAgB,EAChB,SAAiB,EACjB,KAA0D;IAE1D,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO;IACtD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CACxE,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,yBAAyB,CAC7B,OAAO,CAAC,oBAAoB,EAC5B,SAAS,EACT,KAAK,CACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,SAAiB;IACzD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YACvD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,OAAgB,EAChB,cAAwB;IAExB,uBAAuB,CACrB,OAAO,CAAC,aAAa,EAAE,aAAa,IAAI,EAAE,EAC1C,cAAc,CACf,CAAC;AACJ,CAAC","sourcesContent":["import { runtimeLocalHttpEnabled, runtimeSeedSources } from \"../runtime/config\";\nimport { shellQuote } from \"../shell\";\nimport {\n  candidateArtifactEnvironment,\n  candidateArtifactReadRoots,\n} from \"../candidate-artifacts\";\nimport {\n  codexStateEnabled,\n  retainCandidateCodexState,\n} from \"../candidate-codex-state\";\nimport { randomUUID } from \"node:crypto\";\nimport { existsSync } from \"node:fs\";\nimport { isMissingFile } from \"../fixtures/tools\";\nimport {\n  cp,\n  lstat,\n  mkdir,\n  readFile,\n  realpath,\n  rm,\n  stat,\n  symlink,\n  writeFile,\n} from \"node:fs/promises\";\nimport { delimiter, dirname, join, sep } from \"node:path\";\nimport type { HostAdapter } from \"../engine\";\nimport {\n  candidateTranscriptEnvironment,\n  candidateTranscriptRoots,\n} from \"../native-transcripts\";\nimport { prepareHookMounts } from \"../runtime/hooks\";\nimport { requireNativeHookRoots } from \"../native-transcript-state\";\nimport {\n  requireRuntimeReadRoots,\n  runtimeExecutableProtection,\n} from \"../runtime/paths\";\nimport { prepareRuntimeState } from \"../runtime/state\";\nimport {\n  sharedCacheDenyRoots,\n  sharedCacheRoots,\n} from \"../runtime/shared-cache\";\nimport { codexPermissionProfile } from \"./codex-profile\";\nimport { evaluationProtectedRoots } from \"./isolation-roots\";\ntype Request = Parameters<HostAdapter[\"run\"]>[0];\ntype CodexState = Awaited<ReturnType<typeof prepareCodexState>>;\nconst MAX_AUTH_BYTES = 1024 * 1024;\n\nexport interface CodexHostOptions {\n  binary: string;\n  authFile: string;\n  model: string;\n  effort: string;\n  projectRoot: string;\n  resultsRoot: string;\n  additionalProtectedRoots: string[];\n  agentConcurrencyLimit?: number | null;\n  timeoutMs?: number;\n  entrypoint?: \"exec\" | \"app-server\";\n  retainHostDiagnostics?: boolean;\n  /** Integration-test seam; production uses the same CLI for execution and preflight. */\n  sandboxBinary?: string;\n}\n\nasync function copyAuth(source: string, target: string): Promise<void> {\n  let bytes: Buffer;\n  try {\n    if ((await stat(source)).size > MAX_AUTH_BYTES)\n      throw new Error(\"Codex auth file exceeds the size limit\");\n    bytes = await readFile(source);\n  } catch (error) {\n    throw new Error(\"Codex auth file is unreadable or oversized\", {\n      cause: error,\n    });\n  }\n  if (bytes.byteLength > MAX_AUTH_BYTES)\n    throw new Error(\"Codex auth file exceeds the size limit\");\n  await writeFile(target, bytes, { flag: \"wx\", mode: 0o600 });\n}\n\nexport async function codexHookMounts(\n  request: Request,\n  state: CodexState,\n  installedPluginRoots: string[],\n) {\n  const hooks = await prepareHookMounts({\n    workspace: request.workspace,\n    stateRoot: state.stateRoot,\n    privateRoot: state.codexHome,\n    pluginRoots: installedPluginRoots,\n    protectedRoots: state.protectedRoots,\n    policy: request.runtimePolicy ?? {\n      format: \"sevro.runtime.v1\",\n      environment: {},\n      readOnlyRoots: [],\n    },\n  });\n  for (const [index, root] of installedPluginRoots.entries()) {\n    const curated = hooks.directories[index];\n    if (!curated) throw new Error(\"Codex hook projection is incomplete\");\n    await rm(root, { recursive: true });\n    await cp(curated, root, { recursive: true });\n  }\n  await grantCodexHookReads(state, hooks.directories);\n  return hooks;\n}\n\n/** Hooks advertise paths relative to these curated copies, not the install cache. */\nasync function grantCodexHookReads(\n  state: CodexState,\n  roots: string[],\n): Promise<void> {\n  if (roots.length === 0) return;\n  await requireNativeHookRoots(roots, state.codexHome);\n  const path = join(state.codexHome, \"config.toml\");\n  const config = await readFile(path, \"utf8\");\n  const header = `[permissions.${state.profileId}.filesystem]\\n`;\n  const grants = roots\n    .map((root) => `${JSON.stringify(root)} = \"read\"\\n`)\n    .join(\"\");\n  await writeFile(path, config.replace(header, header + grants), {\n    mode: 0o600,\n  });\n}\n\nasync function privateCodexDirectories(stateRoot: string) {\n  const codexHome = join(stateRoot, \"codex-home\"),\n    parentHome = join(stateRoot, \"home\"),\n    parentTemp = join(stateRoot, \"tmp\"),\n    commandHome = join(stateRoot, \"command-home\"),\n    commandTemp = join(stateRoot, \"command-tmp\");\n  await Promise.all(\n    [codexHome, parentHome, parentTemp, commandHome, commandTemp].map((path) =>\n      mkdir(path, { mode: 0o700 }),\n    ),\n  );\n  if (process.platform === \"linux\")\n    await mkdir(join(codexHome, \"tmp\", \"arg0\"), {\n      recursive: true,\n      mode: 0o700,\n    });\n  return {\n    codexHome,\n    parentHome,\n    parentTemp,\n    commandHome,\n    commandTemp,\n    pluginCacheRoot: join(codexHome, \"plugins\", \"cache\"),\n  };\n}\n\nfunction requireUnprotectedExecutables(\n  readRoots: string[],\n  protectedRoots: string[],\n): void {\n  if (\n    readRoots.some((readRoot) =>\n      protectedRoots.some(\n        (root) => readRoot === root || readRoot.startsWith(`${root}${sep}`),\n      ),\n    )\n  )\n    throw new Error(\"Codex executable resides inside a protected root\");\n}\n\nfunction concurrencyConfiguration(limit: number | null): string {\n  return limit === null\n    ? \"\"\n    : `\\n[agents]\\nmax_concurrent_threads_per_session = ${limit}\\n`;\n}\n\nasync function writeCodexProfile(\n  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,\n  profileId: string,\n  request: Request,\n  readRoots: string[],\n  protectedRoots: string[],\n  limit: number | null,\n  commandEnvironment = request.runtimePolicy?.environment,\n  runtimeWriteRoot: string | undefined,\n  writableCacheRoots: string[],\n): Promise<void> {\n  const profile = codexPermissionProfile({\n    localHttp: runtimeLocalHttpEnabled(\n      request.runtimePolicy,\n      request.runtimeRole ?? \"candidate\",\n    ),\n    commandEnvironment: codexProfileEnvironment(\n      request,\n      paths,\n      commandEnvironment,\n    ),\n    runtimeWriteRoot,\n    runtimeReadRoots: request.runtimePolicy?.readOnlyRoots,\n    nativeReadRoots: codexNativeReadRoots(request, paths.codexHome),\n    nativeWriteRoots: [\n      ...codexStateWriteRoots(request, paths),\n      ...writableCacheRoots,\n    ],\n    id: profileId,\n    workspace: request.workspace,\n    commandHome: paths.commandHome,\n    commandTemp: paths.commandTemp,\n    executableReadRoots: readRoots,\n    ...codexPluginReadRoot(request, paths.pluginCacheRoot),\n    protectedRoots,\n  });\n  await writeFile(\n    join(paths.codexHome, \"config.toml\"),\n    profile +\n      concurrencyConfiguration(limit) +\n      fixtureTrustConfiguration(request),\n    { flag: \"wx\", mode: 0o600 },\n  );\n}\n\nfunction fixtureTrustConfiguration(request: Request): string {\n  return `\\n[projects.${JSON.stringify(request.workspace)}]\\ntrust_level = \"untrusted\"\\n`;\n}\n\nfunction codexProfileEnvironment(\n  request: Request,\n  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,\n  environment: Record<string, string> | undefined,\n) {\n  return {\n    ...codexCommandEnvironment(request, environment),\n    ...codexTranscriptEnvironment(request, paths.codexHome),\n    ...candidateTranscriptEnvironment(request.candidateTranscriptRoot),\n    ...candidateArtifactEnvironment(request.candidateArtifactRoots),\n    ...(request.runtimePolicy?.codexState === true\n      ? {\n          SEVRO_CODEX_AGENT_SKILLS: join(paths.parentHome, \".agents\", \"skills\"),\n        }\n      : {}),\n  };\n}\n\nfunction codexTranscriptEnvironment(\n  request: Request,\n  home: string,\n): Record<string, string> {\n  return {\n    ...(request.runtimePolicy?.codexState === true ? { CODEX_HOME: home } : {}),\n    ...(request.runtimePolicy?.nativeTranscripts === true\n      ? {\n          CODEX_HOME: home,\n          SEVRO_NATIVE_TRANSCRIPT_ROOT: join(home, \"sessions\"),\n        }\n      : {}),\n  };\n}\n\nfunction codexNativeReadRoots(request: Request, home: string) {\n  return [\n    ...linuxArg0ReadRoots(home),\n    ...(request.runtimePolicy?.codexState === true\n      ? [join(home, \"config.toml\"), join(home, \"skills\", \".system\")]\n      : []),\n    ...codexTranscriptRoots(request, home),\n    ...candidateTranscriptRoots(request.candidateTranscriptRoot),\n    ...candidateArtifactReadRoots(request.candidateArtifactRoots),\n  ];\n}\n\nfunction codexTranscriptRoots(request: Request, home: string) {\n  return request.runtimePolicy?.nativeTranscripts === true\n    ? [join(home, \"sessions\")]\n    : [];\n}\n\nfunction linuxArg0ReadRoots(codexHome: string): string[] {\n  return process.platform === \"linux\" ? [join(codexHome, \"tmp\", \"arg0\")] : [];\n}\n\nfunction codexPluginReadRoot(request: Request, root: string) {\n  return request.codexMarketplace ? { pluginReadRoot: root } : {};\n}\n\nfunction codexHelperBinary(options: CodexHostOptions, sandboxBinary: string) {\n  const sibling = join(dirname(options.binary), \"codex-linux-sandbox\");\n  return (\n    options.sandboxBinary ?? (existsSync(sibling) ? sibling : sandboxBinary)\n  );\n}\n\nfunction codexCommandEnvironment(\n  request: Request,\n  environment: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!environment) return undefined;\n  const path =\n    environment.PATH ??\n    \"/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin\";\n  return {\n    ...environment,\n    PATH: [request.fixtureBinDir, path].filter(Boolean).join(delimiter),\n  };\n}\n\nasync function fixtureShellRoot(\n  request: Request,\n  parentHome: string,\n): Promise<string> {\n  const root = join(request.workspace, \".git\", \"sevro-shell\");\n  if (request.fixtureBinDir) {\n    await mkdir(root, { mode: 0o700 });\n    await writeFile(\n      process.platform === \"linux\"\n        ? join(parentHome, \".bash_profile\")\n        : join(root, \".zprofile\"),\n      `export PATH=${shellQuote(request.fixtureBinDir)}:\"$PATH\"\\n`,\n      { flag: \"wx\", mode: 0o600 },\n    );\n  }\n  return root;\n}\n\nfunction codexPath(fixtureBin: string | undefined): string {\n  const path = process.env.PATH ?? \"/usr/bin:/bin\";\n  return fixtureBin ? `${fixtureBin}${delimiter}${path}` : path;\n}\n\nfunction codexEnvironment(\n  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,\n  request: Request,\n  shellRoot: string,\n): Record<string, string> {\n  return {\n    ...request.runtimePolicy?.environment,\n    PATH: declaredCodexPath(request),\n    LANG: process.env.LANG ?? \"C\",\n    HOME: paths.parentHome,\n    TMPDIR: paths.parentTemp,\n    CODEX_HOME: paths.codexHome,\n    NO_COLOR: \"1\",\n    ...(request.fixtureBinDir && process.platform === \"darwin\"\n      ? { ZDOTDIR: shellRoot }\n      : {}),\n  };\n}\n\nfunction declaredCodexPath(request: Request): string {\n  return (\n    request.runtimePolicy?.environment.PATH ?? codexPath(request.fixtureBinDir)\n  );\n}\n\nfunction codexSeedSources(request: Request): string[] {\n  return runtimeSeedSources(request.runtimePolicy);\n}\n\nasync function codexRuntime(\n  request: Request,\n  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,\n  stateRoot: string,\n) {\n  if (!request.runtimePolicy) return undefined;\n  const runtime = await prepareRuntimeState(\n    request.workspace,\n    request.runtimePolicy,\n    request.runtimeRole ?? \"candidate\",\n    request.candidateRuntimeRoot ?? join(stateRoot, \"runtime\"),\n  );\n  paths.commandHome = runtime.home;\n  paths.commandTemp = runtime.temp;\n  return runtime;\n}\n\nfunction applyCodexRuntime(\n  runtime: Awaited<ReturnType<typeof codexRuntime>>,\n  env: Record<string, string>,\n  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,\n): void {\n  if (runtime)\n    Object.assign(env, runtime.environment, {\n      HOME: paths.parentHome,\n      TMPDIR: paths.parentTemp,\n    });\n}\n\nfunction codexRuntimeProfile(\n  runtime: Awaited<ReturnType<typeof codexRuntime>>,\n) {\n  return {\n    environment: runtime?.environment,\n    root: runtime?.root,\n    writableCacheRoots: runtime?.writableCacheRoots ?? [],\n  };\n}\n\nexport async function prepareCodexState(\n  stateRoot: string,\n  options: CodexHostOptions,\n  limit: number | null,\n  request: Request,\n  helperRoot?: string,\n) {\n  await requireIsolatedGitMetadata(request.workspace);\n  const paths = await privateCodexDirectories(stateRoot);\n  const runtime = await codexRuntime(request, paths, stateRoot);\n  await copyAuth(options.authFile, join(paths.codexHome, \"auth.json\"));\n  const protectedRoots = await evaluationProtectedRoots({\n    workspace: request.workspace,\n    projectRoot: options.projectRoot,\n    resultsRoot: options.resultsRoot,\n    additionalRoots: [\n      ...options.additionalProtectedRoots,\n      ...(process.platform === \"linux\" ? [] : [stateRoot]),\n      ...codexSeedSources(request),\n    ],\n  });\n  const sandboxBinary = options.sandboxBinary ?? options.binary;\n  const helperBinary = codexHelperBinary(options, sandboxBinary);\n  if (helperRoot)\n    await symlink(helperBinary, join(helperRoot, \"codex-linux-sandbox\"));\n  const readRoots = await Promise.all(\n    [options.binary, sandboxBinary, helperBinary].flatMap((binary) => [\n      realpath(dirname(binary)),\n      realpath(binary).then(dirname),\n    ]),\n  );\n  if (helperRoot) readRoots.push(helperRoot);\n  requireCodexRuntimeReadRoots(request, protectedRoots);\n  await sharedCacheRoots(\n    request.runtimePolicy,\n    request.runtimeRole,\n    protectedRoots,\n  );\n  protectedRoots.push(\n    ...sharedCacheDenyRoots(request.runtimePolicy, request.runtimeRole),\n  );\n  requireUnprotectedExecutables(\n    readRoots,\n    runtimeExecutableProtection(\n      readRoots,\n      protectedRoots,\n      Boolean(request.runtimePolicy),\n    ),\n  );\n  const profileId = `sevro_${randomUUID().replaceAll(\"-\", \"\")}`;\n  const runtimeProfile = codexRuntimeProfile(runtime);\n  await writeCodexProfile(\n    paths,\n    profileId,\n    request,\n    readRoots,\n    protectedRoots,\n    limit,\n    runtimeProfile.environment,\n    runtimeProfile.root,\n    runtimeProfile.writableCacheRoots,\n  );\n  const shellRoot = await fixtureShellRoot(request, paths.parentHome);\n  const env = codexEnvironment(paths, request, shellRoot);\n  applyCodexRuntime(runtime, env, paths);\n  await prepareCodexStateEvidence(request, stateRoot, paths);\n  return { ...paths, stateRoot, sandboxBinary, profileId, env, protectedRoots };\n}\n\nfunction codexStateWriteRoots(\n  request: Request,\n  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,\n): string[] {\n  return codexStateEnabled(request.runtimePolicy)\n    ? [\n        join(paths.codexHome, \"skills\"),\n        join(paths.parentHome, \".agents\", \"skills\"),\n        join(paths.commandHome, \".agents\", \"skills\"),\n        join(paths.commandHome, \".codex\", \"skills\"),\n      ]\n    : [];\n}\n\nasync function prepareCodexStateEvidence(\n  request: Request,\n  stateRoot: string,\n  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,\n): Promise<void> {\n  if (!codexStateEnabled(request.runtimePolicy)) return;\n  const skillRoots = codexStateWriteRoots(request, paths);\n  await Promise.all(\n    skillRoots.map((root) => mkdir(root, { recursive: true, mode: 0o700 })),\n  );\n  await mkdir(join(paths.codexHome, \"skills\", \".system\"), { mode: 0o700 });\n  await retainCandidateCodexState(\n    request.candidateRuntimeRoot,\n    stateRoot,\n    paths,\n  );\n}\n\nasync function requireIsolatedGitMetadata(workspace: string): Promise<void> {\n  try {\n    if (!(await lstat(join(workspace, \".git\"))).isDirectory())\n      throw new Error(\"Codex Git metadata must be an isolated directory\");\n  } catch (cause) {\n    if (!isMissingFile(cause)) throw cause;\n  }\n}\n\nfunction requireCodexRuntimeReadRoots(\n  request: Request,\n  protectedRoots: string[],\n): void {\n  requireRuntimeReadRoots(\n    request.runtimePolicy?.readOnlyRoots ?? [],\n    protectedRoots,\n  );\n}\n"]}

package/dist/src/hosts/codex.js

@@ -0,0 +1,527 @@
+import { existsSync } from "node:fs";
+import { candidateCodexStateRetained } from "../candidate-codex-state.js";
+import { lstat, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { allocateNativeState } from "../native-transcript-state.js";
+import { failedNativeTranscripts, retainEnabledNativeTranscripts, } from "../native-transcripts.js";
+import { runtimeNativeGoalEnabled } from "../runtime/config.js";
+import { releaseRuntimeHooks, runtimeHookObservation, } from "../runtime/hooks.js";
+import { runtimeObservations } from "../runtime/state.js";
+import { validateNativeHostRequest, validHostTimeout } from "./native-request.js";
+import { runCodexAppServer } from "./codex-app-server.js";
+import { summarizeCodexEvents } from "./codex-events.js";
+import { verifyCodexInvocation } from "./codex-invocation.js";
+import { installCodexPlugins } from "./codex-marketplace.js";
+import { codexNativeCallObservation, codexNativeSessionLastOrdinal, } from "./codex-native-calls.js";
+import { runCodexProcess, CodexProcessFailure } from "./codex-process.js";
+import { codexHookMounts, prepareCodexState, } from "./codex-state.js";
+import { codexNativeControls } from "./native-controls.js";
+import { workspaceFingerprint } from "./workspace-fingerprint.js";
+import { codexSkillCatalogRoots } from "./skill-hook-catalog.js";
+import { prepareSkillTracking, skillTrackingObservation, skillActivationClaims, skillExposureClaims, } from "./skill-hooks.js";
+import { cleanupNativeState, createHostDiagnostics, diagnoseHostRequest, diagnosticConfiguration, } from "../host-diagnostics.js";
+const DEFAULT_TIMEOUT_MS = 10 * 60_000;
+function validCodexPaths(options) {
+    return ([
+        options.binary,
+        options.authFile,
+        options.projectRoot,
+        options.resultsRoot,
+        ...options.additionalProtectedRoots,
+    ].every(isAbsolute) &&
+        (options.sandboxBinary === undefined || isAbsolute(options.sandboxBinary)));
+}
+function validConcurrencyLimit(limit) {
+    return limit === null || (Number.isSafeInteger(limit) && limit >= 1);
+}
+function validEntrypoint(entrypoint) {
+    return (entrypoint === undefined || ["exec", "app-server"].includes(entrypoint));
+}
+function validCodexIdentity(options, limit, timeoutMs) {
+    return (!!options.model &&
+        !!options.effort &&
+        validEntrypoint(options.entrypoint) &&
+        validConcurrencyLimit(limit) &&
+        validHostTimeout(timeoutMs));
+}
+function codexCapabilities(entrypoint) {
+    return [
+        "sevro.host.continuation",
+        "sevro.host.runtime",
+        "sevro.host.native-transcripts",
+        "sevro.host.hooks",
+        "sevro.host.skill-activations",
+        "sevro.host.skill-activation-claims",
+        "sevro.host.skill-exposure-claims",
+        ...(entrypoint === "app-server" ? ["sevro.host.native-goal"] : []),
+        "sevro.codex.plugin-marketplace",
+        "sevro.codex.explicit-invocation",
+        "sevro.codex.repository-invocation",
+        "sevro.codex.native-calls",
+        "sevro.host.native-controls",
+    ];
+}
+function codexConfiguration(limit, entrypoint, retainDiagnostics) {
+    return {
+        ...diagnosticConfiguration(retainDiagnostics),
+        "sevro.codex.agent-concurrency-limit": limit,
+        ...(entrypoint === "app-server"
+            ? { "sevro.codex.entrypoint": "app-server" }
+            : {}),
+    };
+}
+/** Construct one Codex route without inheriting user settings or credentials. */
+export function createCodexHost(options) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const limit = options.agentConcurrencyLimit ?? null;
+    if (!validCodexPaths(options) ||
+        !validCodexIdentity(options, limit, timeoutMs))
+        throw new Error("invalid Codex host configuration");
+    return {
+        id: "sevro.host.codex",
+        hostCapabilities: codexCapabilities(options.entrypoint),
+        model: options.model,
+        effort: options.effort,
+        configuration: codexConfiguration(limit, options.entrypoint, options.retainHostDiagnostics),
+        run(request) {
+            return runCodexRequest(options, timeoutMs, limit, request);
+        },
+    };
+}
+function allocateCodexRequestState(request) {
+    return allocateNativeState("codex-", request.runtimePolicy ? request.workspace : undefined);
+}
+async function runCodexRequest(options, timeoutMs, limit, request) {
+    const diagnostics = createHostDiagnostics("codex", options.retainHostDiagnostics, request);
+    return diagnoseHostRequest(diagnostics, async () => {
+        diagnostics.stage = "request-validation";
+        await diagnostics.readCredentials(options.authFile);
+        return executeCodexRequest(options, timeoutMs, limit, request, diagnostics);
+    });
+}
+async function executeCodexRequest(options, timeoutMs, limit, request, diagnostics) {
+    await validateCodexRequest(options, request);
+    diagnostics.stage = "state-allocation";
+    const stateRoot = await allocateCodexRequestState(request);
+    const helperRoot = process.platform === "linux"
+        ? await mkdtemp(join(tmpdir(), "sevro-codex-helper-"))
+        : undefined;
+    let activeHooks;
+    try {
+        diagnostics.stage = "state-preparation";
+        const state = await prepareCodexState(stateRoot, options, limit, request, helperRoot);
+        const installedPluginRoots = await installCodexPlugins({
+            binary: options.binary,
+            env: state.env,
+            pluginCacheRoot: state.pluginCacheRoot,
+            request,
+            diagnostics,
+        });
+        diagnostics.stage = "hooks-preparation";
+        const hooks = await codexHookMounts(request, state, installedPluginRoots);
+        activeHooks = hooks;
+        const skillTracking = await prepareCodexSkillTracking(state, request, installedPluginRoots);
+        await codexPreflight(options, request, state, diagnostics);
+        const context = {
+            options,
+            request,
+            state,
+            timeoutMs,
+            hooks,
+            skillTracking,
+            diagnostics,
+        };
+        const turns = await new CodexTurnExecution(context).run();
+        if (turns.summary.complete)
+            diagnostics.stage = "result-processing";
+        return await retainCodexResult(context, turns);
+    }
+    catch (cause) {
+        return await failedNativeTranscripts(cause, request.runtimePolicy, join(stateRoot, "codex-home", "sessions"), "codex", request.runtimeRole, diagnostics);
+    }
+    finally {
+        await cleanupNativeState(diagnostics, async () => {
+            await releaseRuntimeHooks(activeHooks);
+            if (!candidateCodexStateRetained(request.candidateRuntimeRoot, stateRoot))
+                await rm(stateRoot, { recursive: true, force: true });
+            if (helperRoot)
+                await rm(helperRoot, { recursive: true, force: true });
+        });
+    }
+}
+async function retainCodexResult(context, turns) {
+    const result = await codexHostResult(context, turns);
+    await context.diagnostics.retainFailure(result, "Codex host execution did not complete");
+    await retainEnabledNativeTranscripts(result, context.request.runtimePolicy, join(context.state.codexHome, "sessions"), "codex", context.request.runtimeRole, turns.summary.threadId);
+    return result;
+}
+async function prepareCodexSkillTracking(state, request, pluginRoots) {
+    const roots = await codexSkillCatalogRoots(request.workspace, pluginRoots, [
+        { directory: join(state.codexHome, "skills"), boundary: state.codexHome },
+        {
+            directory: join(state.parentHome, ".agents/skills"),
+            boundary: state.parentHome,
+        },
+        {
+            directory: join(state.commandHome, ".agents/skills"),
+            boundary: state.commandHome,
+        },
+        {
+            directory: join(state.commandHome, ".codex/skills"),
+            boundary: state.commandHome,
+        },
+    ]);
+    const tracking = await prepareSkillTracking({
+        privateRoot: state.codexHome,
+        host: "codex",
+        roots,
+    });
+    await writeFile(join(state.codexHome, "hooks.json"), JSON.stringify({ hooks: tracking.hooks }), {
+        flag: "wx",
+        mode: 0o600,
+    });
+    return tracking;
+}
+async function validateCodexRequest(options, request) {
+    await validateNativeHostRequest(request, "Codex");
+    requireCodexGoalRoute(request, options);
+    await verifyCodexInvocation(request);
+    await requireCodexFixtureConfiguration(request);
+}
+async function requireCodexFixtureConfiguration(request) {
+    const path = join(request.workspace, ".codex");
+    if (!existsSync(path))
+        return;
+    if (request.runtimePolicy?.codexState !== true)
+        throw new Error("fixture Codex configuration is unsupported");
+    if (!(await lstat(path)).isDirectory())
+        throw new Error("fixture Codex configuration must be a physical directory");
+}
+function requireCodexGoalRoute(request, options) {
+    if (runtimeNativeGoalEnabled(request.runtimePolicy) &&
+        options.entrypoint !== "app-server")
+        throw new Error("native-goal runtime policy requires Codex app-server");
+}
+function sandboxArgs(state, request, command) {
+    return [
+        state.sandboxBinary,
+        "sandbox",
+        "-P",
+        state.profileId,
+        "-C",
+        request.workspace,
+        ...command,
+    ];
+}
+async function sandboxPreflight(state, request, command, diagnostics) {
+    return runCodexProcess({
+        diagnostics,
+        argv: sandboxArgs(state, request, command),
+        cwd: request.workspace,
+        env: state.env,
+        timeoutMs: 60_000,
+        phase: "isolation-preflight",
+        signal: request.signal,
+    });
+}
+async function codexPreflight(options, request, state, diagnostics) {
+    diagnostics.stage = "isolation-preflight";
+    const probe = join(state.commandTemp, "isolation-probe");
+    await writeFile(probe, "probe\n", { flag: "wx", mode: 0o600 });
+    const checked = await sandboxPreflight(state, request, [
+        "/bin/sh",
+        "-c",
+        '/bin/cat "$1" >/dev/null && ! /bin/ls "$2" >/dev/null 2>&1 && ! /bin/cat "$3" >/dev/null 2>&1 && ! /bin/cat "$4" >/dev/null 2>&1 || exit 70; "$5" --version >/dev/null 2>&1 || exit 71',
+        "sevro-probe",
+        probe,
+        options.projectRoot,
+        join(state.codexHome, "auth.json"),
+        // The opt-in config read is tested separately; credentials always stay denied.
+        join(state.codexHome, request.runtimePolicy?.codexState === true
+            ? "auth.json"
+            : "config.toml"),
+        state.sandboxBinary,
+    ], diagnostics);
+    if (checked.code === 71)
+        throw new CodexProcessFailure("executable-preflight", checked);
+    if (checked.code !== 0)
+        throw new CodexProcessFailure("isolation-preflight", checked);
+    await rm(probe);
+}
+function routeArgs(context) {
+    return [
+        "-m",
+        context.options.model,
+        "-c",
+        `model_reasoning_effort=${JSON.stringify(context.options.effort)}`,
+        "-c",
+        `default_permissions=${JSON.stringify(context.state.profileId)}`,
+        "-c",
+        'approval_policy="never"',
+        "-c",
+        "features.hooks=true",
+    ];
+}
+function initialTurnArgs(context) {
+    return [
+        context.options.binary,
+        "exec",
+        "--json",
+        "--strict-config",
+        "--skip-git-repo-check",
+        ...(context.request.followUpPrompt ||
+            context.request.runtimePolicy?.nativeTranscripts
+            ? []
+            : ["--ephemeral"]),
+        "--ignore-rules",
+        "--dangerously-bypass-hook-trust",
+        "-C",
+        context.request.workspace,
+        ...routeArgs(context),
+        "-",
+    ];
+}
+function followUpTurnArgs(context, threadId) {
+    return [
+        context.options.binary,
+        "exec",
+        "resume",
+        "--json",
+        "--strict-config",
+        "--skip-git-repo-check",
+        "--ignore-rules",
+        "--dangerously-bypass-hook-trust",
+        ...routeArgs(context),
+        threadId,
+        "-",
+    ];
+}
+async function codexProcessTurn(context, argv, input) {
+    context.diagnostics.stage = "exec";
+    const result = await runCodexProcess({
+        diagnostics: context.diagnostics,
+        argv,
+        cwd: context.request.workspace,
+        env: context.state.env,
+        input,
+        timeoutMs: context.timeoutMs,
+        signal: context.request.signal,
+    });
+    return result;
+}
+async function initialFingerprint(request) {
+    return request.followUpPrompt
+        ? workspaceFingerprint(request.workspace)
+        : null;
+}
+async function continuationBoundary(context, threadId, originalFingerprint, goal = {}) {
+    const boundary = await workspaceFingerprint(context.request.workspace);
+    const measured = originalFingerprint !== null && boundary !== null;
+    return {
+        id: "sevro.codex.continuation",
+        completeness: measured ? "complete" : "partial",
+        data: {
+            method: "same_thread_resume",
+            ...goal,
+            threadId,
+            nativeAfterOrdinal: await codexNativeSessionLastOrdinal(context.state.codexHome, threadId),
+            preFollowUpWorktreeUnchanged: measured
+                ? originalFingerprint === boundary
+                : null,
+        },
+    };
+}
+function requireInitialCompletion(summary, appServer) {
+    if (!summary.complete && !appServer)
+        throw new Error("Codex turn did not complete");
+}
+function requireFollowUpCompletion(followUp, original) {
+    if (!followUp.complete || followUp.threadId !== original.threadId)
+        throw new Error("Codex follow-up turn did not complete in the original thread");
+}
+function appServerSummary(result) {
+    return {
+        threadId: result.evidence.threadId ?? "",
+        complete: result.code === 0,
+        finalMessage: result.finalMessage,
+        // App-server reports cumulative thread totals, not per-turn usage. Keep
+        // usage unknown rather than count continuations or feedback more than once.
+        inputTokens: null,
+        outputTokens: null,
+        usageComplete: false,
+    };
+}
+function initialSummary(appServer, execution) {
+    return appServer
+        ? appServerSummary(appServer)
+        : summarizeCodexEvents(execution.out, execution.code);
+}
+class CodexTurnExecution {
+    context;
+    appServerContinuation;
+    constructor(context) {
+        this.context = context;
+    }
+    async run() {
+        const fingerprint = await initialFingerprint(this.context.request);
+        const appServer = await this.maybeAppServer(fingerprint);
+        const execution = appServer ??
+            (await codexProcessTurn(this.context, initialTurnArgs(this.context), this.context.request.prompt));
+        const summary = initialSummary(appServer, execution);
+        requireInitialCompletion(summary, appServer);
+        const follow = await this.maybeFollowUp(summary, appServer, fingerprint);
+        return {
+            execution,
+            summary,
+            appServer,
+            ...follow,
+        };
+    }
+    async maybeAppServer(fingerprint) {
+        const { options, request, state, timeoutMs } = this.context;
+        if (options.entrypoint !== "app-server")
+            return null;
+        this.context.diagnostics.stage = "app-server";
+        return runCodexAppServer({
+            diagnostics: this.context.diagnostics,
+            argv: [
+                options.binary,
+                "app-server",
+                "--stdio",
+                "--strict-config",
+                "-c",
+                `default_permissions=${JSON.stringify(state.profileId)}`,
+                "-c",
+                "features.hooks=true",
+            ],
+            env: state.env,
+            permissionProfile: state.profileId,
+            vettedHooks: true,
+            request: {
+                repoDir: request.workspace,
+                prompt: request.prompt,
+                model: options.model,
+                effort: options.effort,
+                signal: request.signal,
+                control: {
+                    appServerTimeoutMs: timeoutMs,
+                    ...(request.followUpPrompt
+                        ? { followUpPrompt: request.followUpPrompt }
+                        : {}),
+                },
+            },
+            followUpBoundary: async (threadId, goal) => {
+                this.appServerContinuation = await continuationBoundary(this.context, threadId, fingerprint, goal);
+                return JSON.stringify({
+                    type: "sevro.codex.feedback-boundary",
+                    ...this.appServerContinuation.data,
+                });
+            },
+        });
+    }
+    async maybeFollowUp(summary, appServer, fingerprint) {
+        const prompt = this.context.request.followUpPrompt;
+        if (!prompt || appServer)
+            return {
+                followUp: null,
+                followUpSummary: null,
+                continuation: this.appServerContinuation,
+            };
+        const continuation = await continuationBoundary(this.context, summary.threadId, fingerprint);
+        const followUp = await codexProcessTurn(this.context, followUpTurnArgs(this.context, summary.threadId), prompt);
+        const followUpSummary = summarizeCodexEvents(followUp.out, followUp.code);
+        requireFollowUpCompletion(followUpSummary, summary);
+        return { followUp, followUpSummary, continuation };
+    }
+}
+function explicitInvocationReceipt(selected, completed) {
+    if (!selected)
+        return null;
+    return {
+        id: "sevro.codex.explicit-invocation",
+        completeness: completed ? "complete" : "partial",
+        data: {
+            method: "explicit_invocation",
+            primarySkill: selected.skillName,
+        },
+    };
+}
+function appServerObservation(result) {
+    return result
+        ? [
+            {
+                id: "sevro.host.native-goal",
+                completeness: result.code === 0 ? "complete" : "partial",
+                data: { ...result.evidence },
+            },
+        ]
+        : [];
+}
+async function codexObservations(context, turns) {
+    const tracking = await skillTrackingObservation(context.skillTracking, turns.summary.threadId, turns.summary.complete);
+    const native = await codexNativeCallObservation(context.state.codexHome, turns.summary.threadId, { followUpPrompt: context.request.followUpPrompt });
+    const explicit = explicitInvocationReceipt(context.request.explicitSkillInvocation, turns.summary.complete);
+    return [
+        ...(await codexHookObservations(context)),
+        ...runtimeObservations(context.request.runtimePolicy, context.request.runtimeRole),
+        ...appServerObservation(turns.appServer),
+        native,
+        codexNativeControls(native),
+        ...(turns.continuation ? [turns.continuation] : []),
+        ...(explicit ? [explicit] : []),
+        tracking,
+        ...skillActivationClaims(tracking),
+        ...skillExposureClaims(tracking),
+    ];
+}
+async function codexHookObservations(context) {
+    if (!context.request.runtimePolicy)
+        return [];
+    return [await runtimeHookObservation(context.hooks)];
+}
+function codexArtifacts(turns) {
+    return [
+        {
+            id: "sevro.codex.events",
+            bytes: Buffer.from(turns.execution.out, "utf8"),
+        },
+        ...(turns.followUp
+            ? [
+                {
+                    id: "sevro.codex.follow-up-events",
+                    bytes: Buffer.from(turns.followUp.out, "utf8"),
+                },
+            ]
+            : []),
+    ];
+}
+function tokenCount(initial, followUp) {
+    if (followUp === undefined)
+        return initial;
+    return initial !== null && followUp !== null ? initial + followUp : null;
+}
+function codexUsageComplete(summary, followUp) {
+    return summary.usageComplete && (followUp?.usageComplete ?? true);
+}
+function codexUsage(turns) {
+    return {
+        inputTokens: tokenCount(turns.summary.inputTokens, turns.followUpSummary?.inputTokens),
+        outputTokens: tokenCount(turns.summary.outputTokens, turns.followUpSummary?.outputTokens),
+        usageComplete: codexUsageComplete(turns.summary, turns.followUpSummary),
+        costUsd: null,
+    };
+}
+async function codexHostResult(context, turns) {
+    const final = turns.followUpSummary ?? turns.summary;
+    return {
+        finalMessage: final.finalMessage,
+        ...(turns.appServer ? { executionFailed: !turns.summary.complete } : {}),
+        complete: final.finalMessage !== null,
+        observations: await codexObservations(context, turns),
+        artifacts: codexArtifacts(turns),
+        actualCondition: "passive",
+        ...codexUsage(turns),
+    };
+}
+//# sourceMappingURL=codex.js.map