@boxes-dev/dvb-runtime 1.0.297 → 1.0.299

package/dist/devbox/commands/init/codex/local.js

@@ -1,1381 +0,0 @@
-import { spawn } from "node:child_process";
-import { createWriteStream } from "node:fs";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { cancel, isCancel, log } from "@clack/prompts";
-import { loadLocalEnvSecretsScanPrompt, loadLocalExternalScanPrompt, loadLocalExtraArtifactsScanPrompt, loadLocalShellHistoryScanPrompt, loadLocalServicesScanPrompt, } from "./prompts.js";
-import { buildCodexProxyAuthorizationHeader, buildCodexProxyConfig, } from "./proxy.js";
-import { mergeCodexInitConfig } from "./config.js";
-import { buildCodexInitExecArgs } from "./execConfig.js";
-import { extractBoldText, extractProgressUpdateFromJsonLine, extractTurnCompletedFromJsonLine, extractThreadIdFromJsonLine, extractTurnFailureFromJsonLine, normalizeProgressMessage, stripAnsi, } from "./events.js";
-import { DEFAULT_CODEX_EXEC_MAX_ATTEMPTS, RetryableCodexExecError, computeCodexExecRetryDelayMs, delay, } from "./retry.js";
-import { DEFAULT_LOCAL_SCAN_SANDBOX_MODE, buildCodexExecAttemptArgs, buildLocalStructuredOutputExecArgs, } from "./localExecArgs.js";
-import { DEFAULT_SHELL_HISTORY_COMMAND_LIMIT, writeShellHistorySummary, } from "./shellHistory.js";
-import { formatRetryReason } from "./scanStatus.js";
-import { multiselectWithHelp } from "../clack.js";
-const CODEX_REQUEST_URL_REGEX = /error sending request for url \(([^)]+)\)/i;
-const extractRequestUrl = (value) => {
-    const match = value.match(CODEX_REQUEST_URL_REGEX);
-    const url = match?.[1]?.trim();
-    return url && url.length > 0 ? url : null;
-};
-const isHostedAtBoxesRelay = (requestUrl) => {
-    try {
-        return new URL(requestUrl).hostname === "relay.boxes.dev";
-    }
-    catch {
-        return false;
-    }
-};
-const isRelayUsageLimitExceeded = (value) => {
-    const requestUrl = extractRequestUrl(value);
-    return (/usage limit exceeded/i.test(value) &&
-        ((requestUrl !== null && isHostedAtBoxesRelay(requestUrl)) ||
-            /https?:\/\/relay\.boxes\.dev\/v1\/responses/i.test(value)));
-};
-const isRelayForbidden = (value) => {
-    const requestUrl = extractRequestUrl(value);
-    return (/(unexpected status 403 Forbidden|403 Forbidden: forbidden)/i.test(value) &&
-        requestUrl !== null &&
-        (isHostedAtBoxesRelay(requestUrl) || isLoopbackRelayUrl(requestUrl)));
-};
-const isRelayMissingOpenAiProxyConfiguration = (value) => {
-    const requestUrl = extractRequestUrl(value);
-    return (/unexpected status 503 Service Unavailable/i.test(value) &&
-        /missing OpenAI proxy configuration/i.test(value) &&
-        requestUrl !== null &&
-        (isHostedAtBoxesRelay(requestUrl) || isLoopbackRelayUrl(requestUrl)));
-};
-const isStreamDisconnected = (value) => /stream disconnected before completion/i.test(value) &&
-    /error sending request for url \([^)]+\)/i.test(value);
-const isLoopbackRelayUrl = (requestUrl) => {
-    try {
-        const url = new URL(requestUrl);
-        return (url.hostname === "127.0.0.1" ||
-            url.hostname === "localhost" ||
-            url.hostname === "::1");
-    }
-    catch {
-        return false;
-    }
-};
-const LOOPBACK_RELAY_HEALTH_TIMEOUT_MS = 3_000;
-const CODEX_EXEC_INACTIVITY_TIMEOUT_MS = 180_000;
-const CODEX_EXEC_FORCE_KILL_GRACE_MS = 5_000;
-const loopbackRelayHealthChecks = new Map();
-const resolveEffectiveCodexHome = () => {
-    const configured = (process.env.CODEX_HOME ?? "").trim();
-    return configured.length > 0 ? configured : path.join(os.homedir(), ".codex");
-};
-const HTTP_STATUS_REGEX = /unexpected status (\d{3})(?: ([^:\n]+))?/i;
-const toObjectRecord = (value) => typeof value === "object" && value !== null
-    ? value
-    : null;
-const truncateDiagnosticText = (value, maxChars = 4_000) => {
-    const trimmed = stripAnsi(value ?? "").trim();
-    if (!trimmed)
-        return null;
-    if (trimmed.length <= maxChars)
-        return trimmed;
-    return `...${trimmed.slice(-maxChars)}`;
-};
-const writeMetaLogBestEffort = async (metaLogPath, update) => {
-    if (!metaLogPath)
-        return;
-    try {
-        await fs.mkdir(path.dirname(metaLogPath), { recursive: true });
-        await update(metaLogPath);
-    }
-    catch {
-        // best effort diagnostics only
-    }
-};
-const serializeErrorLike = (error) => {
-    if (error instanceof Error) {
-        const nodeError = error;
-        return {
-            name: error.name,
-            message: error.message,
-            code: nodeError.code ?? null,
-            stack: truncateDiagnosticText(error.stack ?? error.message),
-        };
-    }
-    return {
-        name: null,
-        message: truncateDiagnosticText(String(error)) ?? String(error),
-        code: null,
-        stack: null,
-    };
-};
-const updateMetaLogFile = async (metaLogPath, update) => {
-    let current = {};
-    try {
-        const raw = await fs.readFile(metaLogPath, "utf8");
-        const parsed = JSON.parse(raw);
-        current = toObjectRecord(parsed) ?? {};
-    }
-    catch {
-        current = {};
-    }
-    const next = update(current);
-    await fs.writeFile(metaLogPath, JSON.stringify(next, null, 2), "utf8");
-};
-const appendCodexExecAttemptMeta = async ({ metaLogPath, attempt, patch, }) => {
-    await updateMetaLogFile(metaLogPath, (current) => {
-        const currentCodexExec = toObjectRecord(current.codexExec) ?? {};
-        const currentAttempts = Array.isArray(currentCodexExec.attempts)
-            ? currentCodexExec.attempts
-            : [];
-        const nextAttempts = [...currentAttempts];
-        const existingIndex = nextAttempts.findIndex((entry) => {
-            const record = toObjectRecord(entry);
-            return record?.attempt === attempt;
-        });
-        const existing = existingIndex >= 0
-            ? (toObjectRecord(nextAttempts[existingIndex]) ?? {})
-            : {};
-        const nextEntry = {
-            ...existing,
-            attempt,
-            ...patch,
-        };
-        if (existingIndex >= 0) {
-            nextAttempts[existingIndex] = nextEntry;
-        }
-        else {
-            nextAttempts.push(nextEntry);
-        }
-        return {
-            ...current,
-            codexExec: {
-                ...currentCodexExec,
-                attempts: nextAttempts,
-            },
-        };
-    });
-};
-const updateCodexExecMeta = async ({ metaLogPath, patch, }) => {
-    await updateMetaLogFile(metaLogPath, (current) => {
-        const currentCodexExec = toObjectRecord(current.codexExec) ?? {};
-        return {
-            ...current,
-            codexExec: {
-                ...currentCodexExec,
-                ...patch,
-            },
-        };
-    });
-};
-const collectCodexFailureSignals = (value) => {
-    const requestUrl = extractRequestUrl(value);
-    const isLoopbackRequestUrl = requestUrl !== null && isLoopbackRelayUrl(requestUrl);
-    let requestHost = null;
-    let requestPath = null;
-    let requestProtocol = null;
-    if (requestUrl) {
-        try {
-            const parsed = new URL(requestUrl);
-            requestHost = parsed.host;
-            requestPath = parsed.pathname;
-            requestProtocol = parsed.protocol.replace(/:$/, "");
-        }
-        catch {
-            requestHost = null;
-            requestPath = null;
-            requestProtocol = null;
-        }
-    }
-    const statusMatch = value.match(HTTP_STATUS_REGEX);
-    const parsedStatusCode = statusMatch?.[1]
-        ? Number.parseInt(statusMatch[1], 10)
-        : Number.NaN;
-    return {
-        requestUrl,
-        requestHost,
-        requestPath,
-        requestProtocol,
-        httpStatusCode: Number.isFinite(parsedStatusCode) ? parsedStatusCode : null,
-        httpStatusText: statusMatch?.[2]?.trim() || null,
-        isLoopbackRequestUrl,
-        isStreamDisconnected: isStreamDisconnected(value),
-        isRelayUsageLimitExceeded: isRelayUsageLimitExceeded(value),
-        isRelayForbidden: isRelayForbidden(value),
-        isRelayMissingOpenAiProxyConfiguration: isRelayMissingOpenAiProxyConfiguration(value),
-    };
-};
-const buildRetryPrompt = (basePrompt, retryFeedback) => retryFeedback
-    ? [
-        basePrompt,
-        "",
-        "Retry feedback:",
-        retryFeedback.trim(),
-        "",
-        "Re-run the scan and return corrected JSON.",
-    ]
-        .filter((line) => line.length > 0)
-        .join("\n")
-    : basePrompt;
-const formatCodexRetryProgress = ({ attempt, maxAttempts, delayMs, sessionId, reason, }) => {
-    const nextAttempt = attempt + 1;
-    const delaySeconds = Math.max(1, Math.ceil(delayMs / 1000));
-    const mode = sessionId
-        ? "continuing existing session"
-        : "starting a fresh session";
-    return `retry ${nextAttempt}/${maxAttempts} in ${delaySeconds}s (${mode}): ${formatRetryReason(reason)}`;
-};
-const describeLoopbackRelayHealthError = (error) => {
-    if (error instanceof DOMException && error.name === "TimeoutError") {
-        return "timed out";
-    }
-    const code = error?.code ??
-        error?.cause?.code;
-    if (code === "ECONNREFUSED")
-        return "was refused";
-    if (code === "ENOTFOUND" || code === "EAI_AGAIN" || code === "ETIMEDOUT") {
-        return "was unreachable";
-    }
-    return error instanceof Error ? error.message : String(error);
-};
-const createLoopbackRelayHealthError = ({ healthUrl, detail, }) => new Error(`Codex scan failed: local relay health check ${detail} at ${healthUrl}. Start or restart it with \`just dev\` and retry with \`dvb init --resume\`.`);
-const createCodexExecInactivityError = (inactivityTimeoutMs) => new Error(`Codex scan failed: Codex session produced no output for ${Math.ceil(inactivityTimeoutMs / 1000)}s and did not complete. Retry with \`dvb init --resume\`.`);
-const summarizeLocalCodexFailureDetail = ({ detail, turnFailedMessage, }) => {
-    const candidate = turnFailedMessage?.trim() || detail.trim();
-    if (!candidate)
-        return null;
-    return candidate.length <= 500 ? candidate : `${candidate.slice(0, 500)}...`;
-};
-const ensureLoopbackRelayHealthy = async (relayBaseUrl) => {
-    if (!isLoopbackRelayUrl(relayBaseUrl))
-        return;
-    const normalizedRelayBaseUrl = new URL(relayBaseUrl).toString();
-    const inFlight = loopbackRelayHealthChecks.get(normalizedRelayBaseUrl);
-    if (inFlight) {
-        return await inFlight;
-    }
-    const healthUrl = new URL("/health", normalizedRelayBaseUrl).toString();
-    const check = (async () => {
-        try {
-            const response = await fetch(healthUrl, {
-                method: "GET",
-                signal: AbortSignal.timeout(LOOPBACK_RELAY_HEALTH_TIMEOUT_MS),
-            });
-            if (!response.ok) {
-                throw createLoopbackRelayHealthError({
-                    healthUrl,
-                    detail: `returned HTTP ${response.status}`,
-                });
-            }
-        }
-        catch (error) {
-            if (error instanceof Error &&
-                error.message.includes("local relay health check")) {
-                throw error;
-            }
-            throw createLoopbackRelayHealthError({
-                healthUrl,
-                detail: describeLoopbackRelayHealthError(error),
-            });
-        }
-    })();
-    loopbackRelayHealthChecks.set(normalizedRelayBaseUrl, check);
-    try {
-        await check;
-    }
-    catch (error) {
-        if (loopbackRelayHealthChecks.get(normalizedRelayBaseUrl) === check) {
-            loopbackRelayHealthChecks.delete(normalizedRelayBaseUrl);
-        }
-        throw error;
-    }
-};
-const classifyCodexExecFailure = ({ combinedOutput, detail, exitCode, turnCompleted, turnFailedMessage, }) => {
-    const failureOutput = turnFailedMessage
-        ? `${combinedOutput}\n${turnFailedMessage}`
-        : combinedOutput;
-    const signals = collectCodexFailureSignals(failureOutput);
-    const requestUrl = signals.requestUrl;
-    const failureDetail = summarizeLocalCodexFailureDetail({
-        detail,
-        turnFailedMessage,
-    });
-    const detailSuffix = failureDetail ? ` Detail: ${failureDetail}` : "";
-    if (exitCode === 0 && turnCompleted && !turnFailedMessage) {
-        return null;
-    }
-    if (signals.isRelayUsageLimitExceeded) {
-        const requestTarget = requestUrl ?? "https://relay.boxes.dev/v1/responses";
-        return {
-            error: new Error(`Codex scan failed: relay proxy usage limit exceeded while calling ${requestTarget}. Run \`dvb setup --codex-auth byo\` to use your own Codex auth, then retry with \`dvb init --resume\`.${detailSuffix}`),
-            retryable: false,
-            classifier: "relay_usage_limit",
-            signals,
-        };
-    }
-    if (signals.isRelayForbidden) {
-        return {
-            error: new Error("Codex scan failed: relay proxy returned 403 forbidden. If you're using a dev/local relay config, keep local scans on that relay or run `dvb setup --codex-auth byo`, then retry with `dvb init --resume`."),
-            retryable: false,
-            classifier: "relay_forbidden",
-            signals,
-        };
-    }
-    if (signals.isRelayMissingOpenAiProxyConfiguration) {
-        return {
-            error: new Error("Codex scan failed: relay proxy is missing OPENAI_API_KEY configuration. Re-run `just dev` so the relay tunnel deploy includes OPENAI_API_KEY, then retry with `dvb init --resume`."),
-            retryable: false,
-            classifier: "relay_missing_openai_proxy_configuration",
-            signals,
-        };
-    }
-    if (signals.isStreamDisconnected) {
-        if (requestUrl && signals.isLoopbackRequestUrl) {
-            return {
-                error: new Error(`Codex scan failed: local relay is unreachable at ${requestUrl}. This dev CLI is configured for a local relay; start it with \`just dev\` and retry with \`dvb init --resume\`.`),
-                retryable: false,
-                classifier: "stream_disconnected_loopback",
-                signals,
-            };
-        }
-        const requestTarget = requestUrl ?? "relay /v1/responses endpoint";
-        return {
-            error: new Error(`Codex scan failed: transport disconnected while calling ${requestTarget}. Check relay health/auth and retry with \`dvb init --resume\`.`),
-            retryable: true,
-            classifier: "stream_disconnected_transport",
-            signals,
-        };
-    }
-    if (/no last agent message/i.test(failureOutput)) {
-        return {
-            error: new Error("Codex scan failed: Codex session ended without a final response. Retry with `dvb init --resume`."),
-            retryable: true,
-            classifier: "no_last_agent_message",
-            signals,
-        };
-    }
-    if (turnFailedMessage) {
-        const normalized = turnFailedMessage.trim();
-        return {
-            error: new Error(normalized
-                ? `Codex scan failed: ${normalized}`
-                : "Codex scan failed: Codex turn failed."),
-            retryable: true,
-            classifier: "turn_failed",
-            signals,
-        };
-    }
-    if (exitCode === null) {
-        return {
-            error: new Error("Codex scan failed: Codex session ended before reporting an exit status. Retry with `dvb init --resume`."),
-            retryable: true,
-            classifier: "missing_exit_status",
-            signals,
-        };
-    }
-    if (exitCode === 0) {
-        return null;
-    }
-    const suffix = detail ? `: ${detail}` : "";
-    return {
-        error: new Error(`codex exec failed (exit ${exitCode})${suffix}`),
-        retryable: false,
-        classifier: "nonzero_exit",
-        signals,
-    };
-};
-const runCodexExec = async (cwd, commandArgs, onProgress, logOptions = {}) => {
-    const { stdoutLogPath, stderrLogPath, metaLogPath, proxyOptions, trustedPaths = [], onRetry, inactivityTimeoutMs = CODEX_EXEC_INACTIVITY_TIMEOUT_MS, forceKillGraceMs = CODEX_EXEC_FORCE_KILL_GRACE_MS, } = logOptions;
-    let stdoutStream = null;
-    let stderrStream = null;
-    let tempCodexHome = null;
-    let childEnv = process.env;
-    try {
-        if (stdoutLogPath) {
-            await fs.mkdir(path.dirname(stdoutLogPath), { recursive: true });
-            stdoutStream = createWriteStream(stdoutLogPath, { flags: "a" });
-        }
-        if (stderrLogPath) {
-            await fs.mkdir(path.dirname(stderrLogPath), { recursive: true });
-            stderrStream = createWriteStream(stderrLogPath, { flags: "a" });
-        }
-    }
-    catch {
-        stdoutStream = null;
-        stderrStream = null;
-    }
-    if (proxyOptions || trustedPaths.length > 0) {
-        try {
-            tempCodexHome = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-codex-"));
-            const configPath = path.join(tempCodexHome, "config.toml");
-            const configContent = proxyOptions
-                ? buildCodexProxyConfig({
-                    relayBaseUrl: proxyOptions.relayBaseUrl,
-                    trustedPaths,
-                })
-                : mergeCodexInitConfig({
-                    existingContent: await (async () => {
-                        try {
-                            return await fs.readFile(path.join(resolveEffectiveCodexHome(), "config.toml"), "utf8");
-                        }
-                        catch {
-                            return null;
-                        }
-                    })(),
-                    trustedPaths,
-                });
-            await fs.writeFile(configPath, configContent, {
-                encoding: "utf8",
-                mode: 0o600,
-            });
-            try {
-                await fs.chmod(configPath, 0o600);
-            }
-            catch {
-                // best effort on filesystems that do not support chmod
-            }
-            if (!proxyOptions) {
-                const sourceAuthPath = path.join(resolveEffectiveCodexHome(), "auth.json");
-                const targetAuthPath = path.join(tempCodexHome, "auth.json");
-                try {
-                    await fs.copyFile(sourceAuthPath, targetAuthPath);
-                    try {
-                        await fs.chmod(targetAuthPath, 0o600);
-                    }
-                    catch {
-                        // best effort on filesystems that do not support chmod
-                    }
-                }
-                catch {
-                    // Missing local auth is handled by Codex itself if direct scans need it.
-                }
-            }
-            childEnv = {
-                ...process.env,
-                CODEX_HOME: tempCodexHome,
-                ...(proxyOptions
-                    ? {
-                        DEVBOX_TOKEN: buildCodexProxyAuthorizationHeader(proxyOptions.controlPlaneToken),
-                    }
-                    : {}),
-            };
-        }
-        catch (error) {
-            if (tempCodexHome) {
-                await fs.rm(tempCodexHome, { recursive: true, force: true });
-            }
-            throw error;
-        }
-    }
-    const closeStream = async (stream) => {
-        if (!stream)
-            return;
-        await new Promise((resolve) => stream.end(() => resolve()));
-    };
-    try {
-        const relayBaseUrl = proxyOptions?.relayBaseUrl ?? null;
-        const relayHealthUrl = relayBaseUrl && isLoopbackRelayUrl(relayBaseUrl)
-            ? new URL("/health", relayBaseUrl).toString()
-            : null;
-        await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-            await updateCodexExecMeta({
-                metaLogPath: resolvedMetaLogPath,
-                patch: {
-                    startedAt: new Date().toISOString(),
-                    status: "running",
-                    executionPath: proxyOptions ? "proxy" : "direct",
-                    proxyConfigured: Boolean(proxyOptions),
-                    relayBaseUrl,
-                    relayBaseUrlIsLoopback: relayBaseUrl !== null && isLoopbackRelayUrl(relayBaseUrl),
-                    relayHealthCheck: relayHealthUrl === null
-                        ? {
-                            status: proxyOptions ? "not_required" : "not_configured",
-                            url: null,
-                            checkedAt: null,
-                            error: null,
-                        }
-                        : {
-                            status: "pending",
-                            url: relayHealthUrl,
-                            checkedAt: null,
-                            error: null,
-                        },
-                    trustedPaths,
-                    stdoutLogPath: stdoutLogPath ?? null,
-                    stderrLogPath: stderrLogPath ?? null,
-                    tempCodexHome,
-                    initialArgs: commandArgs.initialArgs,
-                    resumeExecArgs: commandArgs.resumeExecArgs,
-                    resumeSubcommandArgs: commandArgs.resumeSubcommandArgs,
-                    maxAttempts: DEFAULT_CODEX_EXEC_MAX_ATTEMPTS,
-                },
-            });
-        });
-        if (proxyOptions) {
-            try {
-                await ensureLoopbackRelayHealthy(proxyOptions.relayBaseUrl);
-                if (relayHealthUrl) {
-                    await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                        await updateCodexExecMeta({
-                            metaLogPath: resolvedMetaLogPath,
-                            patch: {
-                                relayHealthCheck: {
-                                    status: "ok",
-                                    url: relayHealthUrl,
-                                    checkedAt: new Date().toISOString(),
-                                    error: null,
-                                },
-                            },
-                        });
-                    });
-                }
-            }
-            catch (error) {
-                if (relayHealthUrl) {
-                    await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                        await updateCodexExecMeta({
-                            metaLogPath: resolvedMetaLogPath,
-                            patch: {
-                                relayHealthCheck: {
-                                    status: "failed",
-                                    url: relayHealthUrl,
-                                    checkedAt: new Date().toISOString(),
-                                    error: serializeErrorLike(error),
-                                },
-                                status: "failed",
-                                finishedAt: new Date().toISOString(),
-                                finalError: serializeErrorLike(error),
-                            },
-                        });
-                    });
-                }
-                throw error;
-            }
-        }
-        let resumeThreadId = commandArgs.resumeThreadId;
-        let prompt = commandArgs.prompt;
-        const runAttempt = async (attempt, attemptArgs, attemptResumeThreadId) => {
-            const codexArgs = [
-                "-a",
-                "never",
-                "exec",
-                ...buildCodexInitExecArgs(),
-                ...attemptArgs,
-            ];
-            await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                await appendCodexExecAttemptMeta({
-                    metaLogPath: resolvedMetaLogPath,
-                    attempt,
-                    patch: {
-                        startedAt: new Date().toISOString(),
-                        status: "running",
-                        mode: attemptResumeThreadId ? "resume" : "initial",
-                        resumeThreadId: attemptResumeThreadId,
-                        codexArgs: codexArgs.slice(0, -1),
-                        promptStrategy: attemptResumeThreadId ? "continue" : "initial",
-                    },
-                });
-            });
-            return await new Promise((resolve, reject) => {
-                const child = spawn("codex", codexArgs, {
-                    cwd,
-                    env: childEnv,
-                    stdio: ["ignore", "pipe", "pipe"],
-                });
-                let stdout = "";
-                let stderr = "";
-                let stdoutBuffer = "";
-                let stderrBuffer = "";
-                let lastProgressKey = null;
-                let threadId = null;
-                let turnCompleted = false;
-                let turnFailedMessage = null;
-                let inactivityTimedOut = false;
-                let inactivityTimer = null;
-                let forceKillTimer = null;
-                const clearInactivityTimers = () => {
-                    if (inactivityTimer) {
-                        clearTimeout(inactivityTimer);
-                        inactivityTimer = null;
-                    }
-                    if (forceKillTimer) {
-                        clearTimeout(forceKillTimer);
-                        forceKillTimer = null;
-                    }
-                };
-                const scheduleInactivityTimeout = () => {
-                    if (inactivityTimeoutMs <= 0 || inactivityTimedOut)
-                        return;
-                    if (inactivityTimer) {
-                        clearTimeout(inactivityTimer);
-                    }
-                    inactivityTimer = setTimeout(() => {
-                        inactivityTimedOut = true;
-                        onProgress?.({
-                            kind: "command",
-                            message: `codex exec idle for ${Math.ceil(inactivityTimeoutMs / 1000)}s; restarting session`,
-                        });
-                        try {
-                            child.kill();
-                        }
-                        catch {
-                            // best effort
-                        }
-                        forceKillTimer = setTimeout(() => {
-                            try {
-                                child.kill("SIGKILL");
-                            }
-                            catch {
-                                // best effort
-                            }
-                        }, forceKillGraceMs);
-                        forceKillTimer.unref?.();
-                    }, inactivityTimeoutMs);
-                    inactivityTimer.unref?.();
-                };
-                const handleLine = (line) => {
-                    const clean = stripAnsi(line);
-                    if (!threadId) {
-                        const parsedThreadId = extractThreadIdFromJsonLine(clean);
-                        if (parsedThreadId) {
-                            threadId = parsedThreadId;
-                        }
-                    }
-                    if (!turnCompleted && extractTurnCompletedFromJsonLine(clean)) {
-                        turnCompleted = true;
-                    }
-                    const parsedTurnFailure = extractTurnFailureFromJsonLine(clean);
-                    if (parsedTurnFailure && !turnFailedMessage) {
-                        turnFailedMessage = parsedTurnFailure;
-                    }
-                    if (!onProgress)
-                        return;
-                    const parsed = extractProgressUpdateFromJsonLine(clean);
-                    if (parsed) {
-                        const progressKey = `${parsed.kind}:${parsed.message}`;
-                        if (progressKey === lastProgressKey)
-                            return;
-                        lastProgressKey = progressKey;
-                        onProgress(parsed);
-                        return;
-                    }
-                    if (clean.trimStart().startsWith("{"))
-                        return;
-                    const bold = normalizeProgressMessage(extractBoldText(clean));
-                    if (!bold)
-                        return;
-                    const progressKey = `reasoning:${bold}`;
-                    if (progressKey === lastProgressKey)
-                        return;
-                    lastProgressKey = progressKey;
-                    onProgress({ kind: "reasoning", message: bold });
-                };
-                const consume = (chunk, buffer, update) => {
-                    let next = buffer + chunk.toString();
-                    let idx = next.indexOf("\n");
-                    while (idx !== -1) {
-                        const line = next.slice(0, idx);
-                        handleLine(line);
-                        next = next.slice(idx + 1);
-                        idx = next.indexOf("\n");
-                    }
-                    update(next);
-                };
-                child.stdout?.on("data", (chunk) => {
-                    scheduleInactivityTimeout();
-                    stdout += chunk.toString();
-                    stdoutStream?.write(chunk);
-                    consume(chunk, stdoutBuffer, (next) => {
-                        stdoutBuffer = next;
-                    });
-                });
-                child.stderr?.on("data", (chunk) => {
-                    scheduleInactivityTimeout();
-                    stderr += chunk.toString();
-                    stderrStream?.write(chunk);
-                    consume(chunk, stderrBuffer, (next) => {
-                        stderrBuffer = next;
-                    });
-                });
-                scheduleInactivityTimeout();
-                child.on("error", (error) => {
-                    clearInactivityTimers();
-                    void (async () => {
-                        await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                            await appendCodexExecAttemptMeta({
-                                metaLogPath: resolvedMetaLogPath,
-                                attempt,
-                                patch: {
-                                    finishedAt: new Date().toISOString(),
-                                    status: "spawn_error",
-                                    error: serializeErrorLike(error),
-                                },
-                            });
-                        });
-                        reject(error);
-                    })();
-                });
-                child.on("close", (code) => {
-                    void (async () => {
-                        clearInactivityTimers();
-                        if (stdoutBuffer)
-                            handleLine(stdoutBuffer);
-                        if (stderrBuffer)
-                            handleLine(stderrBuffer);
-                        const combinedOutput = `${stderr}\n${stdout}`;
-                        const detail = stderr.trim() || stdout.trim();
-                        const sessionId = threadId ?? attemptResumeThreadId;
-                        const baseAttemptPatch = {
-                            finishedAt: new Date().toISOString(),
-                            exitCode: code,
-                            threadId,
-                            sessionId,
-                            turnFailedMessage: turnFailedMessage?.trim() || null,
-                            stdoutTail: truncateDiagnosticText(stdout),
-                            stderrTail: truncateDiagnosticText(stderr),
-                            combinedOutputTail: truncateDiagnosticText(combinedOutput),
-                            detailTail: truncateDiagnosticText(detail),
-                        };
-                        if (inactivityTimedOut) {
-                            const inactivityError = createCodexExecInactivityError(inactivityTimeoutMs);
-                            await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                                await appendCodexExecAttemptMeta({
-                                    metaLogPath: resolvedMetaLogPath,
-                                    attempt,
-                                    patch: {
-                                        ...baseAttemptPatch,
-                                        status: "retryable_failure",
-                                        failureMode: "inactivity_timeout",
-                                        retryable: true,
-                                        errorMessage: inactivityError.message,
-                                    },
-                                });
-                            });
-                            reject(new RetryableCodexExecError(inactivityError.message, sessionId));
-                            return;
-                        }
-                        const failure = classifyCodexExecFailure({
-                            combinedOutput,
-                            detail,
-                            exitCode: code,
-                            turnCompleted,
-                            turnFailedMessage,
-                        });
-                        if (!failure) {
-                            await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                                await appendCodexExecAttemptMeta({
-                                    metaLogPath: resolvedMetaLogPath,
-                                    attempt,
-                                    patch: {
-                                        ...baseAttemptPatch,
-                                        status: "success",
-                                    },
-                                });
-                            });
-                            resolve({ threadId: sessionId });
-                            return;
-                        }
-                        await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                            await appendCodexExecAttemptMeta({
-                                metaLogPath: resolvedMetaLogPath,
-                                attempt,
-                                patch: {
-                                    ...baseAttemptPatch,
-                                    status: failure.retryable ? "retryable_failure" : "failed",
-                                    classifier: failure.classifier,
-                                    retryable: failure.retryable,
-                                    errorMessage: failure.error.message,
-                                    signals: failure.signals,
-                                },
-                            });
-                        });
-                        if (failure.retryable) {
-                            reject(new RetryableCodexExecError(failure.error.message, sessionId));
-                            return;
-                        }
-                        reject(failure.error);
-                    })();
-                });
-            });
-        };
-        for (let attempt = 1; attempt <= DEFAULT_CODEX_EXEC_MAX_ATTEMPTS; attempt += 1) {
-            const attemptArgs = buildCodexExecAttemptArgs({
-                ...commandArgs,
-                prompt,
-                resumeThreadId,
-            });
-            try {
-                const result = await runAttempt(attempt, attemptArgs, resumeThreadId);
-                await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                    await updateCodexExecMeta({
-                        metaLogPath: resolvedMetaLogPath,
-                        patch: {
-                            status: "success",
-                            finishedAt: new Date().toISOString(),
-                            finalThreadId: result.threadId,
-                            attemptsRun: attempt,
-                        },
-                    });
-                });
-                return result;
-            }
-            catch (error) {
-                if (!(error instanceof RetryableCodexExecError) ||
-                    attempt >= DEFAULT_CODEX_EXEC_MAX_ATTEMPTS) {
-                    throw error;
-                }
-                resumeThreadId = error.sessionId ?? resumeThreadId;
-                const delayMs = computeCodexExecRetryDelayMs(attempt);
-                await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-                    await appendCodexExecAttemptMeta({
-                        metaLogPath: resolvedMetaLogPath,
-                        attempt,
-                        patch: {
-                            retryDelayMs: delayMs,
-                            retryScheduledAt: new Date().toISOString(),
-                            retrySessionId: resumeThreadId,
-                            retryReason: error.message,
-                        },
-                    });
-                    await updateCodexExecMeta({
-                        metaLogPath: resolvedMetaLogPath,
-                        patch: {
-                            status: "retrying",
-                            attemptsRun: attempt,
-                            nextAttempt: attempt + 1,
-                            retrySessionId: resumeThreadId,
-                            retryReason: error.message,
-                        },
-                    });
-                });
-                await onRetry?.({
-                    attempt,
-                    maxAttempts: DEFAULT_CODEX_EXEC_MAX_ATTEMPTS,
-                    delayMs,
-                    sessionId: resumeThreadId,
-                    reason: error.message,
-                });
-                await delay(delayMs);
-                prompt = resumeThreadId ? "continue" : commandArgs.prompt;
-            }
-        }
-        throw new Error("Codex exec failed after retries.");
-    }
-    catch (error) {
-        await writeMetaLogBestEffort(metaLogPath, async (resolvedMetaLogPath) => {
-            await updateCodexExecMeta({
-                metaLogPath: resolvedMetaLogPath,
-                patch: {
-                    status: "failed",
-                    finishedAt: new Date().toISOString(),
-                    finalError: serializeErrorLike(error),
-                },
-            });
-        });
-        throw error;
-    }
-    finally {
-        await Promise.all([closeStream(stdoutStream), closeStream(stderrStream)]);
-        if (tempCodexHome) {
-            await fs.rm(tempCodexHome, { recursive: true, force: true });
-        }
-    }
-};
-const runLocalSetupEnvSecretsScan = async ({ cwd, logDir, schemaPath, outputPath, sandboxMode = DEFAULT_LOCAL_SCAN_SANDBOX_MODE, proxyOptions, onProgress, resumeThreadId, retryFeedback, }) => {
-    const localScanPrompt = await loadLocalEnvSecretsScanPrompt();
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const stdoutLogPath = path.join(logDir, `codex-local-setup-env-secrets-scan-${stamp}.jsonl`);
-    const stderrLogPath = path.join(logDir, `codex-local-setup-env-secrets-scan-${stamp}.stderr.log`);
-    const metaLogPath = path.join(logDir, `codex-local-setup-env-secrets-scan-${stamp}.meta.json`);
-    await fs.mkdir(logDir, { recursive: true, mode: 0o700 });
-    try {
-        await fs.chmod(logDir, 0o700);
-    }
-    catch {
-        // best effort on filesystems that do not support chmod
-    }
-    await fs.mkdir(path.dirname(outputPath), { recursive: true });
-    await fs.writeFile(metaLogPath, JSON.stringify({
-        kind: "local-setup-env-secrets-scan",
-        createdAt: new Date().toISOString(),
-        cwd,
-        logDir,
-        schemaPath,
-        outputPath,
-        sandboxMode,
-        prompt: localScanPrompt,
-        resumedFromThreadId: resumeThreadId ?? null,
-        retryFeedback: retryFeedback ?? null,
-    }, null, 2), "utf8");
-    const prompt = buildRetryPrompt(localScanPrompt, retryFeedback);
-    const result = await runCodexExec(cwd, {
-        ...buildLocalStructuredOutputExecArgs({
-            schemaPath,
-            outputPath,
-            sandboxMode,
-        }),
-        prompt,
-        resumeThreadId: resumeThreadId ?? null,
-    }, onProgress, {
-        stdoutLogPath,
-        stderrLogPath,
-        metaLogPath,
-        ...(proxyOptions ? { proxyOptions } : {}),
-        trustedPaths: [cwd],
-        ...(onProgress
-            ? {
-                onRetry: (info) => {
-                    onProgress({
-                        kind: "command",
-                        message: formatCodexRetryProgress(info),
-                    });
-                },
-            }
-            : {}),
-    });
-    return result.threadId;
-};
-const runLocalSetupExternalScan = async ({ cwd, logDir, schemaPath, outputPath, homeDir, sandboxMode = DEFAULT_LOCAL_SCAN_SANDBOX_MODE, proxyOptions, onProgress, resumeThreadId, retryFeedback, }) => {
-    const localScanPrompt = await loadLocalExternalScanPrompt();
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const stdoutLogPath = path.join(logDir, `codex-local-setup-external-scan-${stamp}.jsonl`);
-    const stderrLogPath = path.join(logDir, `codex-local-setup-external-scan-${stamp}.stderr.log`);
-    const metaLogPath = path.join(logDir, `codex-local-setup-external-scan-${stamp}.meta.json`);
-    await fs.mkdir(logDir, { recursive: true, mode: 0o700 });
-    try {
-        await fs.chmod(logDir, 0o700);
-    }
-    catch {
-        // best effort on filesystems that do not support chmod
-    }
-    await fs.mkdir(path.dirname(outputPath), { recursive: true });
-    await fs.writeFile(metaLogPath, JSON.stringify({
-        kind: "local-setup-external-scan",
-        createdAt: new Date().toISOString(),
-        cwd,
-        logDir,
-        schemaPath,
-        outputPath,
-        sandboxMode,
-        prompt: localScanPrompt,
-        resumedFromThreadId: resumeThreadId ?? null,
-        retryFeedback: retryFeedback ?? null,
-    }, null, 2), "utf8");
-    const prompt = buildRetryPrompt(localScanPrompt, retryFeedback);
-    const structuredArgs = buildLocalStructuredOutputExecArgs({
-        schemaPath,
-        outputPath,
-        sandboxMode,
-        addDirs: homeDir ? [homeDir] : [],
-    });
-    const result = await runCodexExec(cwd, {
-        ...structuredArgs,
-        prompt,
-        resumeThreadId: resumeThreadId ?? null,
-    }, onProgress, {
-        stdoutLogPath,
-        stderrLogPath,
-        metaLogPath,
-        ...(proxyOptions ? { proxyOptions } : {}),
-        trustedPaths: homeDir ? [cwd, homeDir] : [cwd],
-        ...(onProgress
-            ? {
-                onRetry: (info) => {
-                    onProgress({
-                        kind: "command",
-                        message: formatCodexRetryProgress(info),
-                    });
-                },
-            }
-            : {}),
-    });
-    return result.threadId;
-};
-const runLocalShellHistoryScan = async ({ cwd, logDir, schemaPath, outputPath, homeDir, sandboxMode = DEFAULT_LOCAL_SCAN_SANDBOX_MODE, proxyOptions, onProgress, resumeThreadId, retryFeedback, }) => {
-    const historySummaryPath = path.join(path.dirname(outputPath), "shell-history-summary.json");
-    const historySummary = await writeShellHistorySummary({
-        outputPath: historySummaryPath,
-        ...(homeDir ? { homeDir } : {}),
-        limit: DEFAULT_SHELL_HISTORY_COMMAND_LIMIT,
-    });
-    const localScanPrompt = await loadLocalShellHistoryScanPrompt(historySummaryPath);
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const stdoutLogPath = path.join(logDir, `codex-local-shell-history-scan-${stamp}.jsonl`);
-    const stderrLogPath = path.join(logDir, `codex-local-shell-history-scan-${stamp}.stderr.log`);
-    const metaLogPath = path.join(logDir, `codex-local-shell-history-scan-${stamp}.meta.json`);
-    await fs.mkdir(logDir, { recursive: true, mode: 0o700 });
-    try {
-        await fs.chmod(logDir, 0o700);
-    }
-    catch {
-        // best effort on filesystems that do not support chmod
-    }
-    await fs.mkdir(path.dirname(outputPath), { recursive: true });
-    await fs.writeFile(metaLogPath, JSON.stringify({
-        kind: "local-shell-history-scan",
-        createdAt: new Date().toISOString(),
-        cwd,
-        logDir,
-        schemaPath,
-        outputPath,
-        historySummaryPath,
-        sandboxMode,
-        historySummary: {
-            sourceShell: historySummary.sourceShell,
-            collectionMethod: historySummary.collectionMethod,
-            collectedCommandCount: historySummary.collectedCommandCount,
-            commandCounts: historySummary.commandCounts.slice(0, 20),
-        },
-        prompt: localScanPrompt,
-        resumedFromThreadId: resumeThreadId ?? null,
-        retryFeedback: retryFeedback ?? null,
-    }, null, 2), "utf8");
-    const prompt = buildRetryPrompt(localScanPrompt, retryFeedback);
-    const trustedPathSet = new Set([cwd]);
-    const addDirPaths = new Set([path.dirname(historySummaryPath)]);
-    const scanCwd = path.dirname(historySummaryPath);
-    if (homeDir) {
-        trustedPathSet.add(homeDir);
-        addDirPaths.add(homeDir);
-    }
-    const structuredArgs = buildLocalStructuredOutputExecArgs({
-        schemaPath,
-        outputPath,
-        sandboxMode,
-        addDirs: [...addDirPaths],
-        skipGitRepoCheck: true,
-    });
-    const result = await runCodexExec(scanCwd, {
-        ...structuredArgs,
-        prompt,
-        resumeThreadId: resumeThreadId ?? null,
-    }, onProgress, {
-        stdoutLogPath,
-        stderrLogPath,
-        metaLogPath,
-        ...(proxyOptions ? { proxyOptions } : {}),
-        trustedPaths: [...trustedPathSet, path.dirname(historySummaryPath)],
-        ...(onProgress
-            ? {
-                onRetry: (info) => {
-                    onProgress({
-                        kind: "command",
-                        message: formatCodexRetryProgress(info),
-                    });
-                },
-            }
-            : {}),
-    });
-    return result.threadId;
-};
-const runLocalSetupExtraArtifactsScan = async ({ cwd, logDir, schemaPath, outputPath, sandboxMode = DEFAULT_LOCAL_SCAN_SANDBOX_MODE, proxyOptions, onProgress, resumeThreadId, retryFeedback, }) => {
-    const localScanPrompt = await loadLocalExtraArtifactsScanPrompt();
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const stdoutLogPath = path.join(logDir, `codex-local-setup-extra-artifacts-scan-${stamp}.jsonl`);
-    const stderrLogPath = path.join(logDir, `codex-local-setup-extra-artifacts-scan-${stamp}.stderr.log`);
-    const metaLogPath = path.join(logDir, `codex-local-setup-extra-artifacts-scan-${stamp}.meta.json`);
-    await fs.mkdir(logDir, { recursive: true, mode: 0o700 });
-    try {
-        await fs.chmod(logDir, 0o700);
-    }
-    catch {
-        // best effort on filesystems that do not support chmod
-    }
-    await fs.mkdir(path.dirname(outputPath), { recursive: true });
-    await fs.writeFile(metaLogPath, JSON.stringify({
-        kind: "local-setup-extra-artifacts-scan",
-        createdAt: new Date().toISOString(),
-        cwd,
-        logDir,
-        schemaPath,
-        outputPath,
-        sandboxMode,
-        prompt: localScanPrompt,
-        resumedFromThreadId: resumeThreadId ?? null,
-        retryFeedback: retryFeedback ?? null,
-    }, null, 2), "utf8");
-    const prompt = buildRetryPrompt(localScanPrompt, retryFeedback);
-    const result = await runCodexExec(cwd, {
-        ...buildLocalStructuredOutputExecArgs({
-            schemaPath,
-            outputPath,
-            sandboxMode,
-        }),
-        prompt,
-        resumeThreadId: resumeThreadId ?? null,
-    }, onProgress, {
-        stdoutLogPath,
-        stderrLogPath,
-        metaLogPath,
-        ...(proxyOptions ? { proxyOptions } : {}),
-        trustedPaths: [cwd],
-        ...(onProgress
-            ? {
-                onRetry: (info) => {
-                    onProgress({
-                        kind: "command",
-                        message: formatCodexRetryProgress(info),
-                    });
-                },
-            }
-            : {}),
-    });
-    return result.threadId;
-};
-const runLocalServicesScan = async ({ cwd, logDir, schemaPath, outputPath, homeDir, sandboxMode = DEFAULT_LOCAL_SCAN_SANDBOX_MODE, proxyOptions, onProgress, resumeThreadId, retryFeedback, }) => {
-    const servicesScanPrompt = await loadLocalServicesScanPrompt();
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const stdoutLogPath = path.join(logDir, `codex-local-services-scan-${stamp}.jsonl`);
-    const stderrLogPath = path.join(logDir, `codex-local-services-scan-${stamp}.stderr.log`);
-    const metaLogPath = path.join(logDir, `codex-local-services-scan-${stamp}.meta.json`);
-    await fs.mkdir(logDir, { recursive: true, mode: 0o700 });
-    await fs.mkdir(path.dirname(outputPath), { recursive: true, mode: 0o700 });
-    try {
-        await fs.chmod(logDir, 0o700);
-    }
-    catch {
-        // best effort on filesystems that do not support chmod
-    }
-    await fs.writeFile(metaLogPath, JSON.stringify({
-        kind: "local-services-scan",
-        createdAt: new Date().toISOString(),
-        cwd,
-        logDir,
-        schemaPath,
-        outputPath,
-        sandboxMode,
-        prompt: servicesScanPrompt,
-        resumedFromThreadId: resumeThreadId ?? null,
-        retryFeedback: retryFeedback ?? null,
-    }, null, 2), "utf8");
-    const prompt = buildRetryPrompt(servicesScanPrompt, retryFeedback);
-    const structuredArgs = buildLocalStructuredOutputExecArgs({
-        schemaPath,
-        outputPath,
-        sandboxMode,
-        addDirs: homeDir ? [homeDir] : [],
-    });
-    const result = await runCodexExec(cwd, {
-        ...structuredArgs,
-        prompt,
-        resumeThreadId: resumeThreadId ?? null,
-    }, onProgress, {
-        stdoutLogPath,
-        stderrLogPath,
-        metaLogPath,
-        ...(proxyOptions ? { proxyOptions } : {}),
-        trustedPaths: homeDir ? [cwd, homeDir] : [cwd],
-        ...(onProgress
-            ? {
-                onRetry: (info) => {
-                    onProgress({
-                        kind: "command",
-                        message: formatCodexRetryProgress(info),
-                    });
-                },
-            }
-            : {}),
-    });
-    return result.threadId;
-};
-const toPosixPath = (value) => value.split(path.sep).join(path.posix.sep);
-const toRepoRelativePath = (repoRoot, filePath) => {
-    const resolved = path.isAbsolute(filePath)
-        ? filePath
-        : path.resolve(repoRoot, filePath);
-    const relative = path.relative(repoRoot, resolved) || filePath;
-    return toPosixPath(relative);
-};
-const countSecretVars = (vars) => vars.reduce((count, entry) => count + (entry.isSecret ? 1 : 0), 0);
-const buildEnvFileHint = (entry) => {
-    const usageText = entry.usage?.trim() || "none";
-    const secrets = countSecretVars(entry.vars);
-    const varsText = `${entry.vars.length} var${entry.vars.length === 1 ? "" : "s"}`;
-    const secretsText = `${secrets} secret${secrets === 1 ? "" : "s"}`;
-    return `${varsText}\n${secretsText}\n${usageText}`;
-};
-const buildExternalDependencyLabel = (entry) => entry.version ? `${entry.name}@${entry.version}` : entry.name;
-const setupApprovalPrefaceLines = [
-    "We scanned this repo and your machine, and built an inventory of what's needed to recreate this dev environment on the devbox.",
-    "",
-    "You'll be able to approve which files we'll send to the remote, which external dependencies we'll install, and what entry point the remote coding agent will use to run your app to make sure it can run.",
-];
-const setupApprovalSectionExplainers = {
-    envFiles: "Selected .env files will be copied to the devbox repo so your app can run with the same environment values as your local machine.",
-    secretFiles: "Selected secret and config files will be copied to the devbox.",
-    extraArtifacts: "Selected .gitignored files and directories will be copied into the devbox workspace unchanged.",
-    externalDependencies: "Selected external dependencies will be installed on the devbox so the remote environment matches your local setup.",
-    externalConfigs: "Selected files from outside the repo will be staged on the devbox so remote setup can place them where Linux expects them.",
-    appEntrypoints: "Selected app commands will be run on the devbox during setup to verify the app starts cleanly there.",
-    backgroundServices: "Selected background services will be written into devbox service config and enabled on the devbox.",
-};
-const showApprovalExplainer = (message) => {
-    log.message(message, { withGuide: false });
-};
-const promptForPlanApproval = async ({ plan, repoRoot, initialPlan, }) => {
-    log.step("Review setup findings");
-    const envFileOptions = plan.envFiles.map((entry) => ({
-        value: entry.path,
-        label: toRepoRelativePath(repoRoot, entry.path),
-        hint: buildEnvFileHint(entry),
-    }));
-    const secretFileOptions = plan.secretFiles.map((entry) => ({
-        value: entry.path,
-        label: toRepoRelativePath(repoRoot, entry.path),
-        hint: entry.description,
-    }));
-    const extraArtifactOptions = plan.extraArtifacts.map((entry) => ({
-        value: entry.path,
-        label: toRepoRelativePath(repoRoot, entry.path),
-        hint: entry.description,
-    }));
-    const externalDependencyOptions = plan.externalDependencies.map((entry) => ({
-        value: entry.name,
-        label: buildExternalDependencyLabel(entry),
-        hint: entry.evidence ? `Evidence: ${entry.evidence}` : "Evidence: none",
-    }));
-    const externalConfigOptions = plan.externalConfigs.map((entry) => ({
-        value: entry.path,
-        label: toRepoRelativePath(repoRoot, entry.path),
-        hint: entry.description,
-    }));
-    let envFileSelection = [];
-    if (plan.envFiles.length > 0) {
-        showApprovalExplainer(setupApprovalSectionExplainers.envFiles);
-        envFileSelection = await multiselectWithHelp({
-            message: "Select .env files to copy to the devbox",
-            options: envFileOptions,
-            initialValues: initialPlan?.envFiles.map((entry) => entry.path) ??
-                plan.envFiles.map((entry) => entry.path),
-            required: false,
-        });
-    }
-    if (isCancel(envFileSelection)) {
-        cancel("Init canceled.");
-        throw new Error("Init canceled.");
-    }
-    let secretFileSelection = [];
-    if (plan.secretFiles.length > 0) {
-        showApprovalExplainer(setupApprovalSectionExplainers.secretFiles);
-        secretFileSelection = await multiselectWithHelp({
-            message: "Select secret/config files to copy to the devbox",
-            options: secretFileOptions,
-            initialValues: initialPlan?.secretFiles.map((entry) => entry.path) ??
-                plan.secretFiles.map((entry) => entry.path),
-            required: false,
-        });
-    }
-    if (isCancel(secretFileSelection)) {
-        cancel("Init canceled.");
-        throw new Error("Init canceled.");
-    }
-    let extraArtifactSelection = [];
-    if (plan.extraArtifacts.length > 0) {
-        showApprovalExplainer(setupApprovalSectionExplainers.extraArtifacts);
-        extraArtifactSelection = await multiselectWithHelp({
-            message: "Select other artifacts to copy to the devbox",
-            options: extraArtifactOptions,
-            initialValues: initialPlan?.extraArtifacts.map((entry) => entry.path) ??
-                plan.extraArtifacts.map((entry) => entry.path),
-            required: false,
-        });
-    }
-    if (isCancel(extraArtifactSelection)) {
-        cancel("Init canceled.");
-        throw new Error("Init canceled.");
-    }
-    let externalDependencySelection = [];
-    if (plan.externalDependencies.length > 0) {
-        showApprovalExplainer(setupApprovalSectionExplainers.externalDependencies);
-        externalDependencySelection = await multiselectWithHelp({
-            message: "Select external dependencies to install on the devbox",
-            options: externalDependencyOptions,
-            initialValues: initialPlan?.externalDependencies.map((entry) => entry.name) ??
-                plan.externalDependencies.map((entry) => entry.name),
-            required: false,
-        });
-    }
-    if (isCancel(externalDependencySelection)) {
-        cancel("Init canceled.");
-        throw new Error("Init canceled.");
-    }
-    let externalConfigSelection = [];
-    if (plan.externalConfigs.length > 0) {
-        showApprovalExplainer(setupApprovalSectionExplainers.externalConfigs);
-        externalConfigSelection = await multiselectWithHelp({
-            message: "Select external config/secret files to copy to the devbox",
-            options: externalConfigOptions,
-            initialValues: initialPlan?.externalConfigs.map((entry) => entry.path) ??
-                plan.externalConfigs.map((entry) => entry.path),
-            required: false,
-        });
-    }
-    if (isCancel(externalConfigSelection)) {
-        cancel("Init canceled.");
-        throw new Error("Init canceled.");
-    }
-    const envFileSet = new Set(envFileSelection);
-    const secretFileSet = new Set(secretFileSelection);
-    const extraArtifactSet = new Set(extraArtifactSelection);
-    const externalDependencySet = new Set(externalDependencySelection);
-    const externalConfigSet = new Set(externalConfigSelection);
-    return {
-        schemaVersion: plan.schemaVersion,
-        envFiles: plan.envFiles.filter((entry) => envFileSet.has(entry.path)),
-        secretFiles: plan.secretFiles.filter((entry) => secretFileSet.has(entry.path)),
-        extraArtifacts: plan.extraArtifacts.filter((entry) => extraArtifactSet.has(entry.path)),
-        externalDependencies: plan.externalDependencies.filter((entry) => externalDependencySet.has(entry.name)),
-        externalConfigs: plan.externalConfigs.filter((entry) => externalConfigSet.has(entry.path)),
-        services: initialPlan?.services ?? plan.services,
-    };
-};
-const promptForServicesApproval = async ({ plan, initialSelection, }) => {
-    log.step("Review run services findings");
-    const appEntrypointOptions = plan.appEntrypoints.map((entry) => ({
-        value: entry.command,
-        label: entry.command,
-        hint: entry.description?.trim() || "no description",
-    }));
-    const backgroundServiceOptions = plan.backgroundServices.map((entry) => ({
-        value: entry.name,
-        label: entry.name,
-        hint: `${entry.command}; HTTP port: ${entry.httpPort ?? "none"}`,
-    }));
-    let appEntrypointSelection = [];
-    if (plan.appEntrypoints.length > 0) {
-        showApprovalExplainer(setupApprovalSectionExplainers.appEntrypoints);
-        appEntrypointSelection = await multiselectWithHelp({
-            message: "Select app entrypoints to validate setup",
-            options: appEntrypointOptions,
-            initialValues: initialSelection?.appEntrypoints.map((entry) => entry.command) ??
-                plan.appEntrypoints.map((entry) => entry.command),
-            required: false,
-        });
-    }
-    if (isCancel(appEntrypointSelection)) {
-        cancel("Init canceled.");
-        throw new Error("Init canceled.");
-    }
-    let backgroundServiceSelection = [];
-    if (plan.backgroundServices.length > 0) {
-        showApprovalExplainer(setupApprovalSectionExplainers.backgroundServices);
-        backgroundServiceSelection = await multiselectWithHelp({
-            message: "Select background services to run in the devbox",
-            options: backgroundServiceOptions,
-            initialValues: initialSelection?.backgroundServices.map((entry) => entry.name) ??
-                plan.backgroundServices.map((entry) => entry.name),
-            required: false,
-        });
-    }
-    if (isCancel(backgroundServiceSelection)) {
-        cancel("Init canceled.");
-        throw new Error("Init canceled.");
-    }
-    const appEntrypointSet = new Set(appEntrypointSelection);
-    const backgroundServiceSet = new Set(backgroundServiceSelection);
-    return {
-        appEntrypoints: plan.appEntrypoints.filter((entry) => appEntrypointSet.has(entry.command)),
-        backgroundServices: plan.backgroundServices.filter((entry) => backgroundServiceSet.has(entry.name)),
-    };
-};
-export { classifyCodexExecFailure, promptForPlanApproval, promptForServicesApproval, runCodexExec, runLocalShellHistoryScan, runLocalServicesScan, runLocalSetupEnvSecretsScan, runLocalSetupExternalScan, runLocalSetupExtraArtifactsScan, setupApprovalPrefaceLines, setupApprovalSectionExplainers, };
-//# sourceMappingURL=local.js.map