@byok-sdk/client 0.1.0 → 0.1.1

package/dist/adapters/index.js

@@ -0,0 +1,1921 @@
+import { execFile, spawn, spawnSync } from 'child_process';
+import { promisify } from 'util';
+import { promises, realpathSync } from 'fs';
+import os from 'os';
+import path2 from 'path';
+import { fileURLToPath } from 'url';
+import 'readline';
+
+// src/adapters/pi/pi-adapter.ts
+
+// src/types.ts
+var PolicyUnsupportedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PolicyUnsupportedError";
+  }
+};
+var SteerUnsupportedError = class extends Error {
+  /** The `RuntimeAdapter.id` that cannot steer (e.g. `claude`, `codex`). */
+  runtimeId;
+  constructor(runtimeId, message) {
+    super(message);
+    this.name = "SteerUnsupportedError";
+    this.runtimeId = runtimeId;
+  }
+};
+
+// src/adapters/pi/resolve-bin.ts
+var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
+function resolvePiBin() {
+  const override = process.env.BYOK_PI_BIN;
+  if (override) {
+    return { command: override, source: "path" };
+  }
+  return { command: "pi", source: "path" };
+}
+
+// src/adapters/pi/permission-mapping.ts
+var READONLY_TOOLS = ["read", "grep", "find", "ls"];
+var DEFAULT_ACTIVE_TOOLS = ["read", "bash", "edit", "write"];
+function mapPermissionPolicyToPiArgs(policy) {
+  if (policy.network === false) {
+    return {
+      ok: false,
+      args: [],
+      reason: "policy requires network:false, which the pi adapter cannot enforce (pi has no network sandbox)"
+    };
+  }
+  if (policy.mode === "confirm" || policy.mode === "plan") {
+    return {
+      ok: false,
+      args: [],
+      reason: `pi adapter cannot express permission mode "${policy.mode}" (no built-in per-call approval gate or plan-only mode without a custom extension)`
+    };
+  }
+  const denyTools = policy.denyTools ?? [];
+  if (policy.mode === "readonly") {
+    const base = policy.allowTools ? policy.allowTools.filter((tool) => READONLY_TOOLS.includes(tool)) : [...READONLY_TOOLS];
+    const effective = subtractDenied(base, denyTools);
+    return { ok: true, args: effective.length === 0 ? ["--no-tools"] : ["--tools", effective.join(",")] };
+  }
+  if (denyTools.length > 0) {
+    const base = policy.allowTools && policy.allowTools.length > 0 ? policy.allowTools : [...DEFAULT_ACTIVE_TOOLS];
+    const effective = subtractDenied(base, denyTools);
+    return { ok: true, args: effective.length === 0 ? ["--no-tools"] : ["--tools", effective.join(",")] };
+  }
+  if (policy.allowTools && policy.allowTools.length > 0) {
+    return { ok: true, args: ["--tools", policy.allowTools.join(",")] };
+  }
+  return { ok: true, args: [] };
+}
+function subtractDenied(tools, denyTools) {
+  const denied = new Set(denyTools);
+  return tools.filter((tool) => !denied.has(tool));
+}
+
+// src/adapters/pi/events.ts
+function mapPiMessageToAgentEvent(msg) {
+  switch (msg.type) {
+    case "message_update": {
+      const delta = msg.assistantMessageEvent;
+      if (delta?.type === "text_delta" && typeof delta.delta === "string") {
+        return { type: "progress", text: delta.delta };
+      }
+      return void 0;
+    }
+    case "tool_execution_start": {
+      if (typeof msg.toolName !== "string") return void 0;
+      return { type: "tool_use", tool: msg.toolName, input: msg.args };
+    }
+    case "tool_execution_end": {
+      if (typeof msg.toolName !== "string") return void 0;
+      return {
+        type: "tool_result",
+        tool: msg.toolName,
+        output: { result: msg.result, isError: msg.isError === true }
+      };
+    }
+    case "agent_end":
+      return { type: "turn_end" };
+    /**
+     * `artifact` is NOT a real pi RPC message — pi's own `write` tool only
+     * ever surfaces as `tool_execution_start`/`tool_execution_end` (see
+     * `docs/tools/write.js` in the installed package), and neither carries
+     * enough on its own at the `_end` message (no `path`) for this stateless,
+     * one-message-at-a-time mapper to correlate back to a written file
+     * without introducing per-toolCallId state. This case exists purely so
+     * the `fake-pi.mjs` test/e2e fixture (M1-4 blob-path acceptance run) has
+     * a way to simulate "the runtime wrote a file and is reporting it as an
+     * artifact" — real pi emits nothing today that reaches this branch, so
+     * production traffic through this adapter never takes it. Revisit if a
+     * future pi release adds a native artifact-producing message, or if this
+     * needs correlating to a real `write` tool call.
+     */
+    case "artifact": {
+      if (typeof msg.name !== "string" || typeof msg.contentType !== "string") return void 0;
+      return { type: "artifact", name: msg.name, contentType: msg.contentType };
+    }
+    case "extension_error":
+      return { type: "error", message: typeof msg.error === "string" ? msg.error : "pi extension error" };
+    case "auto_retry_end":
+      if (msg.success === false) {
+        return {
+          type: "error",
+          message: typeof msg.finalError === "string" ? msg.finalError : "pi auto-retry exhausted"
+        };
+      }
+      return void 0;
+    // Routine pi session/turn/streaming bookkeeping with no `AgentEvent`
+    // equivalent — see `ROUTINE_PI_EVENT_TYPES` below, which mirrors this
+    // list so `PiSession`'s unmapped-frame accounting (rpc-client.ts's
+    // `recordUnmappedFrame`) can tell "known, expected, silently ignored"
+    // apart from "genuinely never seen before" (falls to `default` below).
+    case "agent_start":
+    case "turn_start":
+    case "turn_end":
+    // pi's own per-LLM-turn boundary, not ours — see `agent_end` above
+    case "message_start":
+    case "message_end":
+    case "tool_execution_update":
+    case "queue_update":
+    case "compaction_start":
+    case "compaction_end":
+    case "auto_retry_start":
+    case "session_info_changed":
+    case "thinking_level_changed":
+      return void 0;
+    default:
+      return void 0;
+  }
+}
+var ROUTINE_PI_EVENT_TYPES = /* @__PURE__ */ new Set([
+  "agent_start",
+  "turn_start",
+  "turn_end",
+  "message_start",
+  "message_end",
+  "tool_execution_update",
+  "queue_update",
+  "compaction_start",
+  "compaction_end",
+  "auto_retry_start",
+  "session_info_changed",
+  "thinking_level_changed"
+]);
+
+// src/util/async-queue.ts
+var AsyncQueueOverflowError = class extends Error {
+  constructor(capacity) {
+    super(
+      `AsyncQueue exceeded its capacity of ${capacity} buffered item(s) \u2014 failing fast rather than growing unbounded, silently dropping events, or blocking push()`
+    );
+    this.capacity = capacity;
+    this.name = "AsyncQueueOverflowError";
+  }
+  capacity;
+};
+var DEFAULT_ASYNC_QUEUE_CAPACITY = 1e4;
+var AsyncQueue = class {
+  constructor(capacity = DEFAULT_ASYNC_QUEUE_CAPACITY) {
+    this.capacity = capacity;
+  }
+  capacity;
+  buffered = [];
+  waiters = [];
+  ended = false;
+  failure;
+  push(item) {
+    if (this.ended || this.failure) return;
+    const waiter = this.waiters.shift();
+    if (waiter) {
+      waiter.resolve({ value: item, done: false });
+      return;
+    }
+    if (this.buffered.length >= this.capacity) {
+      this.fail(new AsyncQueueOverflowError(this.capacity));
+      return;
+    }
+    this.buffered.push(item);
+  }
+  end() {
+    if (this.ended || this.failure) return;
+    this.ended = true;
+    for (const waiter of this.waiters.splice(0)) {
+      waiter.resolve({ value: void 0, done: true });
+    }
+  }
+  /** Transitions the queue into its permanent overflow state: rejects every currently-pending waiter and, from then on, every `next()` call (checked ahead of `ended` — see the class doc comment on why the error must win). */
+  fail(error) {
+    if (this.ended || this.failure) return;
+    this.failure = error;
+    for (const waiter of this.waiters.splice(0)) {
+      waiter.reject(error);
+    }
+  }
+  [Symbol.asyncIterator]() {
+    return {
+      next: () => {
+        if (this.failure) {
+          return Promise.reject(this.failure);
+        }
+        if (this.buffered.length > 0) {
+          return Promise.resolve({ value: this.buffered.shift(), done: false });
+        }
+        if (this.ended) {
+          return Promise.resolve({ value: void 0, done: true });
+        }
+        return new Promise((resolve, reject) => this.waiters.push({ resolve, reject }));
+      }
+    };
+  }
+};
+
+// src/adapters/pi/rpc-client.ts
+var STDERR_RING_CAPACITY = 20;
+var DIALOG_UI_METHODS = /* @__PURE__ */ new Set(["select", "confirm", "input", "editor"]);
+var PiRpcClient = class {
+  child;
+  buffer = "";
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  eventQueue = new AsyncQueue();
+  closed = false;
+  exitError;
+  /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
+  stderrRing = [];
+  /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
+  unmappedFrameCounts = /* @__PURE__ */ new Map();
+  constructor(options) {
+    const spawnFn = options.spawnFn ?? spawn;
+    this.child = spawnFn(options.command, options.args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    this.child.stdout.setEncoding("utf8");
+    this.child.stdout.on("data", (chunk) => this.onData(chunk));
+    this.child.stderr.setEncoding("utf8");
+    this.child.stderr.on("data", (chunk) => this.onStderr(chunk));
+    this.child.on("close", (code, signal) => {
+      this.onClosed(this.buildExitError(code, signal));
+    });
+    this.child.on("error", (err) => {
+      this.onClosed(err);
+    });
+  }
+  /** Send a command, resolved with its correlated `response` message. */
+  send(command) {
+    if (this.closed) {
+      return Promise.reject(this.exitError ?? new Error("pi process is closed"));
+    }
+    const id = command.id ?? `req-${this.nextId++}`;
+    const full = { ...command, id };
+    return new Promise((resolve, reject) => {
+      this.pending.set(id, { resolve, reject });
+      this.child.stdin.write(`${JSON.stringify(full)}
+`, (err) => {
+        if (err) {
+          this.pending.delete(id);
+          reject(err);
+        }
+      });
+    });
+  }
+  /** Every non-response, non-`extension_ui_request` line — the latter is answered directly by this client (see `respondToExtensionUiRequest`) and never enqueued. */
+  get events() {
+    return this.eventQueue;
+  }
+  /**
+   * Record a pi RPC message `type` that `PiSession` (pi-adapter.ts) decided
+   * has no `AgentEvent` mapping and isn't routine bookkeeping (see
+   * `events.ts`'s `ROUTINE_PI_EVENT_TYPES`) — i.e. genuinely unexpected
+   * traffic. Logs once per distinct type (not per occurrence, so a
+   * repeating unmapped type can't spam stdout); the running tally is also
+   * folded into this client's exit-time error message (`buildExitError`) so
+   * a post-mortem on a failed/hung task has it without needing separate log
+   * scraping. This is the exact mechanism that would have turned this
+   * task's root-cause hang (`agent_end` arriving with no mapping) into a
+   * one-line, immediate warning instead of a silent stall.
+   */
+  recordUnmappedFrame(type) {
+    const next = (this.unmappedFrameCounts.get(type) ?? 0) + 1;
+    this.unmappedFrameCounts.set(type, next);
+    if (next === 1) {
+      console.warn(
+        `[byok/pi-adapter] pi emitted a frame type with no AgentEvent mapping: "${type}" (further occurrences of this type won't be logged individually)`
+      );
+    }
+  }
+  /** Best-effort teardown. SIGTERM on POSIX; `taskkill /T /F` on Windows to also reap child processes pi itself spawned (e.g. bash). */
+  kill() {
+    if (this.closed) return;
+    const pid = this.child.pid;
+    if (process.platform === "win32" && pid !== void 0) {
+      spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"]);
+    } else {
+      this.child.kill("SIGTERM");
+    }
+  }
+  onData(chunk) {
+    this.buffer += chunk;
+    let newlineIndex = this.buffer.indexOf("\n");
+    while (newlineIndex !== -1) {
+      let line = this.buffer.slice(0, newlineIndex);
+      this.buffer = this.buffer.slice(newlineIndex + 1);
+      if (line.endsWith("\r")) line = line.slice(0, -1);
+      if (line.length > 0) this.onLine(line);
+      newlineIndex = this.buffer.indexOf("\n");
+    }
+  }
+  onLine(line) {
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (msg.type === "response" && typeof msg.id === "string" && this.pending.has(msg.id)) {
+      const waiter = this.pending.get(msg.id);
+      this.pending.delete(msg.id);
+      waiter?.resolve(msg);
+      return;
+    }
+    if (msg.type === "extension_ui_request" && typeof msg.id === "string" && typeof msg.method === "string") {
+      this.respondToExtensionUiRequest(msg.id, msg.method);
+      return;
+    }
+    this.eventQueue.push(msg);
+  }
+  /**
+   * Answer pi's extension-UI blocking protocol headlessly (rpc.md's
+   * "Extension UI Protocol"). Fail-closed policy, stated explicitly because
+   * it's a security-relevant default, not an incidental one: this NEVER
+   * approves or picks a value on the caller's behalf — every dialog method
+   * (`select`/`confirm`/`input`/`editor`) gets `{cancelled: true}`, the one
+   * response shape rpc.md documents as valid for all four uniformly
+   * ("Dismiss any dialog method... the extension receives `undefined` (for
+   * select/input/editor) or `false` (for confirm)"). An extension asking
+   * e.g. `confirm("Delete everything?")` gets a firm decline, never a
+   * guessed approval — this adapter has no human in the loop to ask, and
+   * silently approving would defeat any extension that uses these dialogs
+   * specifically as a permission gate. Fire-and-forget methods
+   * (`notify`/`setStatus`/`setWidget`/`setTitle`/`set_editor_text`) get no
+   * reply at all — sending one would itself violate rpc.md ("Responses are
+   * sent for dialog methods only").
+   */
+  respondToExtensionUiRequest(id, method) {
+    if (!DIALOG_UI_METHODS.has(method)) return;
+    this.child.stdin.write(`${JSON.stringify({ type: "extension_ui_response", id, cancelled: true })}
+`);
+  }
+  onStderr(chunk) {
+    for (const rawLine of chunk.split("\n")) {
+      const line = rawLine.trim();
+      if (line.length === 0) continue;
+      this.stderrRing.push(line);
+      if (this.stderrRing.length > STDERR_RING_CAPACITY) this.stderrRing.shift();
+    }
+  }
+  /**
+   * finding #1 ("bad flag → instant exit", e.g. the `--session-id`/
+   * `--exclude-tools` bugs this task fixes): the daemon used to report only
+   * `pi process exited (code=1, signal=null)` — accurate but useless for
+   * diagnosing *why* without re-running pi by hand with a raw JSONL logger,
+   * exactly as this task's own root-cause investigation had to. Folding in
+   * the stderr tail and any unmapped-frame tally makes that self-diagnosing
+   * from the thrown error alone.
+   */
+  buildExitError(code, signal) {
+    const parts = [`pi process exited (code=${code}, signal=${signal})`];
+    if (this.stderrRing.length > 0) {
+      parts.push(`stderr: ${this.stderrRing.join(" | ")}`);
+    }
+    if (this.unmappedFrameCounts.size > 0) {
+      const summary = [...this.unmappedFrameCounts.entries()].map(([type, count]) => `${type}\xD7${count}`).join(", ");
+      parts.push(`unmapped frame types seen: ${summary}`);
+    }
+    return new Error(parts.join("; "));
+  }
+  onClosed(err) {
+    if (this.closed) return;
+    this.closed = true;
+    this.exitError = err;
+    for (const [, waiter] of this.pending) waiter.reject(err);
+    this.pending.clear();
+    this.eventQueue.end();
+  }
+};
+
+// src/adapters/pi/pi-adapter.ts
+var execFileAsync = promisify(execFile);
+var DETECT_TIMEOUT_MS = 5e3;
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+var KNOWN_PROVIDER_ENV_VARS = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_OAUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "GEMINI_API_KEY",
+  "AZURE_OPENAI_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "GROQ_API_KEY",
+  "MISTRAL_API_KEY",
+  "OPENROUTER_API_KEY",
+  "XAI_API_KEY",
+  // Confirmed against the installed pi's own docs/providers.md ("ZAI |
+  // `ZAI_API_KEY` | `zai`") and exercised live against real GLM traffic
+  // during this task's acceptance run — omitting it made `authPresent`
+  // silently false for a perfectly valid, working z.ai/GLM setup.
+  "ZAI_API_KEY"
+];
+var PiAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  options;
+  id = "pi";
+  async detect() {
+    const bin = this.resolveBin();
+    try {
+      const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
+      const version = stdout.trim() || stderr.trim();
+      const authPresent = KNOWN_PROVIDER_ENV_VARS.some((name) => process.env[name] !== void 0);
+      return { present: true, version, authPresent };
+    } catch {
+      return { present: false };
+    }
+  }
+  capabilities() {
+    return { steer: true, resume: true, approvalInteractive: false, permissionModes: ["auto", "readonly"] };
+  }
+  /**
+   * M5: pi authenticates to its ~30 supported providers via env-var API
+   * keys — `detect()`'s own `authPresent` probe above checks this identical
+   * list — so these MUST keep flowing into pi's spawned process or pi auth
+   * breaks entirely. `KNOWN_PROVIDER_ENV_VARS` above is the single source
+   * of truth, reused here rather than duplicated. No `baseNames`: nothing
+   * in this adapter or `rpc-client.ts` reads a pi-specific config-discovery
+   * variable beyond the platform baseline (`daemon/environment.ts`).
+   */
+  environmentRequirements() {
+    return { credentialNames: KNOWN_PROVIDER_ENV_VARS };
+  }
+  async start(task, ctx) {
+    if (typeof task.instruction !== "string") {
+      throw new PolicyUnsupportedError("pi adapter only supports string instructions in M0 (no blob-ref fetch yet)");
+    }
+    const mapping = mapPermissionPolicyToPiArgs(ctx.policy);
+    if (!mapping.ok) {
+      throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by pi adapter");
+    }
+    const bin = this.resolveBin();
+    const resumeSessionId = task.sessionRef;
+    const args = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+    const rpc = new PiRpcClient({
+      command: bin.command,
+      args,
+      cwd: ctx.workspaceDir,
+      env: ctx.env,
+      spawnFn: this.options.spawnFn
+    });
+    const response = await rpc.send({ type: "prompt", message: task.instruction });
+    if (response.success === false) {
+      rpc.kill();
+      throw new Error(typeof response.error === "string" ? response.error : "pi rejected the initial prompt");
+    }
+    let sessionRef;
+    if (resumeSessionId) {
+      sessionRef = resumeSessionId;
+    } else {
+      try {
+        sessionRef = await resolveFreshSessionId(rpc);
+      } catch (err) {
+        rpc.kill();
+        throw err;
+      }
+    }
+    return new PiSession(sessionRef, rpc);
+  }
+  resolveBin() {
+    return (this.options.resolveBin ?? resolvePiBin)();
+  }
+};
+async function resolveFreshSessionId(rpc) {
+  let state;
+  try {
+    state = await rpc.send({ type: "get_state" });
+  } catch (err) {
+    throw new Error(`pi did not yield an authoritative session id (get_state failed): ${errorMessage(err)}`, {
+      cause: err
+    });
+  }
+  if (state.success === false) {
+    const reason = typeof state.error === "string" ? state.error : "get_state reported failure";
+    throw new Error(`pi did not yield an authoritative session id (get_state failed): ${reason}`);
+  }
+  const data = state.data;
+  if (typeof data?.sessionId === "string" && data.sessionId.length > 0) {
+    return data.sessionId;
+  }
+  throw new Error(
+    "pi did not yield an authoritative session id (get_state succeeded but reported no sessionId) \u2014 cannot mint a resumable session"
+  );
+}
+var PiSession = class {
+  constructor(sessionRef, rpc) {
+    this.sessionRef = sessionRef;
+    this.rpc = rpc;
+  }
+  sessionRef;
+  rpc;
+  get events() {
+    const rpc = this.rpc;
+    return {
+      [Symbol.asyncIterator]() {
+        const inner = rpc.events[Symbol.asyncIterator]();
+        return {
+          async next() {
+            for (; ; ) {
+              const { value, done } = await inner.next();
+              if (done) return { value: void 0, done: true };
+              const mapped = mapPiMessageToAgentEvent(value);
+              if (mapped) return { value: mapped, done: false };
+              if (!ROUTINE_PI_EVENT_TYPES.has(value.type)) {
+                rpc.recordUnmappedFrame(value.type);
+              }
+            }
+          }
+        };
+      }
+    };
+  }
+  async steer(text) {
+    await this.rpc.send({ type: "steer", message: text });
+  }
+  async followUp(task) {
+    if (typeof task.instruction !== "string") {
+      throw new PolicyUnsupportedError("pi adapter only supports string instructions in M0 (no blob-ref fetch yet)");
+    }
+    await this.rpc.send({ type: "prompt", message: task.instruction, streamingBehavior: "followUp" });
+  }
+  async interrupt() {
+    await this.rpc.send({ type: "abort" });
+  }
+  async close() {
+    this.rpc.kill();
+  }
+  async resolveApproval() {
+    throw new Error("pi adapter does not support approval resume: pi never emits needs_approval in M0/M1");
+  }
+};
+
+// src/adapters/claude/resolve-bin.ts
+function resolveClaudeBin() {
+  const override = process.env.BYOK_CLAUDE_BIN;
+  if (override) {
+    return { command: override, source: "env" };
+  }
+  return { command: "claude", source: "path" };
+}
+function resolveApprovalMcpBin() {
+  const override = process.env.BYOK_APPROVAL_MCP_BIN;
+  if (override) {
+    return { command: override, args: [], source: "env" };
+  }
+  const distBin = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  return { command: process.execPath, args: [distBin], source: "dist" };
+}
+
+// src/adapters/claude/permission-mapping.ts
+var READONLY_TOOLS2 = ["Read", "Glob", "Grep"];
+function mapPermissionPolicyToClaudeArgs(policy) {
+  if (policy.network === false) {
+    return {
+      ok: false,
+      args: [],
+      reason: "policy requires network:false, which the claude adapter cannot enforce (claude has no network sandbox for its Bash tool)"
+    };
+  }
+  const denyTools = policy.denyTools ?? [];
+  if (policy.mode === "confirm") {
+    if (denyTools.length > 0) {
+      return {
+        ok: false,
+        args: [],
+        reason: `claude adapter cannot reliably enforce denyTools ([${denyTools.join(", ")}]) under confirm mode: its only trustworthy tool-restriction mechanism (--tools) replaces the whole active set rather than subtracting from it, and this adapter has no reliable way to learn a target installation's full default tool set to compute "default minus denied" (this dev machine's own installed build exposes a non-vanilla, bespoke tool list) \u2014 refusing rather than risking a denial that silently doesn't hold`
+      };
+    }
+    const confirmArgs = ["--permission-mode", "default"];
+    if (policy.allowTools && policy.allowTools.length > 0) {
+      confirmArgs.push("--tools", policy.allowTools.join(","));
+    }
+    return { ok: true, args: confirmArgs, needsApprovalMcp: true };
+  }
+  if (policy.mode === "readonly") {
+    const base = policy.allowTools ? policy.allowTools.filter((tool) => READONLY_TOOLS2.includes(tool)) : [...READONLY_TOOLS2];
+    const effective = subtractDenied2(base, denyTools);
+    return { ok: true, args: ["--permission-mode", "default", "--tools", effective.join(",")] };
+  }
+  if (denyTools.length > 0) {
+    return {
+      ok: false,
+      args: [],
+      reason: `claude adapter cannot reliably enforce denyTools ([${denyTools.join(", ")}]): its only trustworthy tool-restriction mechanism (--tools) replaces the whole active set rather than subtracting from it, and this adapter has no reliable way to learn a target installation's full default tool set to compute "default minus denied" (this dev machine's own installed build exposes a non-vanilla, bespoke tool list) \u2014 refusing rather than risking a denial that silently doesn't hold`
+    };
+  }
+  const permissionMode = policy.mode === "plan" ? "plan" : "acceptEdits";
+  const args = ["--permission-mode", permissionMode];
+  if (policy.allowTools && policy.allowTools.length > 0) {
+    args.push("--tools", policy.allowTools.join(","));
+  }
+  return { ok: true, args };
+}
+function subtractDenied2(tools, denyTools) {
+  const denied = new Set(denyTools);
+  return tools.filter((tool) => !denied.has(tool));
+}
+function createToolUseCorrelation() {
+  return { toolNameByUseId: /* @__PURE__ */ new Map() };
+}
+var ROUTINE_CLAUDE_SYSTEM_SUBTYPES = /* @__PURE__ */ new Set([
+  "init",
+  "hook_started",
+  "hook_response",
+  "thinking_tokens"
+]);
+var FILE_WRITING_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "NotebookEdit"]);
+var EXTENSION_CONTENT_TYPES = {
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".json": "application/json",
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".cjs": "text/javascript",
+  ".ts": "text/plain",
+  ".tsx": "text/plain",
+  ".jsx": "text/plain",
+  ".html": "text/html",
+  ".css": "text/css",
+  ".csv": "text/csv",
+  ".py": "text/x-python",
+  ".yaml": "application/yaml",
+  ".yml": "application/yaml"
+};
+function guessContentType(filePath) {
+  const ext = path2.extname(filePath).toLowerCase();
+  return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
+}
+function mapAssistant(msg, correlation) {
+  const message = msg.message;
+  const content = message?.content;
+  if (!Array.isArray(content)) return { events: [] };
+  const events = [];
+  let unmappedLabel;
+  for (const raw of content) {
+    const block = raw;
+    switch (block.type) {
+      case "text":
+        if (typeof block.text === "string") {
+          events.push({ type: "progress", text: block.text });
+        }
+        break;
+      case "tool_use":
+        if (typeof block.id === "string" && typeof block.name === "string") {
+          correlation.toolNameByUseId.set(block.id, block.name);
+          events.push({ type: "tool_use", tool: block.name, input: block.input });
+        }
+        break;
+      // Deliberately NOT mapped to `progress` — mirrors pi's own choice to
+      // ignore `thinking_delta` sub-events (see `../pi/events.ts`). Two
+      // independent reasons: (1) the daemon's `task-runner.ts` folds every
+      // `progress` event's text into `task.complete.summary` verbatim —
+      // surfacing raw model reasoning there would leak internal
+      // chain-of-thought to whatever SaaS embeds this SDK; (2) on several
+      // current-generation models this content is empty by design anyway
+      // (`display: "omitted"` is the default — see the claude-api skill's
+      // "Thinking & Effort" reference) even though it was NOT empty in this
+      // task's own live captures against `claude-haiku-4-5`. `redacted_thinking`
+      // is a documented Anthropic Messages API block type never observed
+      // live here; treated identically for the same reasoning.
+      case "thinking":
+      case "redacted_thinking":
+        break;
+      default:
+        unmappedLabel = unmappedLabel ?? `assistant-block:${String(block.type)}`;
+    }
+  }
+  return { events, unmappedLabel };
+}
+function mapUser(msg, correlation, options) {
+  const message = msg.message;
+  const content = message?.content;
+  if (!Array.isArray(content)) return { events: [] };
+  const events = [];
+  let unmappedLabel;
+  for (const raw of content) {
+    const block = raw;
+    if (block.type !== "tool_result") {
+      unmappedLabel = unmappedLabel ?? `user-block:${String(block.type)}`;
+      continue;
+    }
+    const toolUseId = typeof block.tool_use_id === "string" ? block.tool_use_id : void 0;
+    const tool = toolUseId && correlation.toolNameByUseId.get(toolUseId) || "unknown";
+    const isError = block.is_error === true;
+    events.push({ type: "tool_result", tool, output: { content: block.content, isError } });
+    if (!isError && FILE_WRITING_TOOLS.has(tool)) {
+      const artifact = tryBuildArtifactEvent(msg, options.workspaceDir);
+      if (artifact) events.push(artifact);
+    }
+  }
+  return { events, unmappedLabel };
+}
+function tryBuildArtifactEvent(msg, workspaceDir) {
+  const toolUseResult = msg.tool_use_result;
+  const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
+  if (!filePath) return void 0;
+  const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
+  const fileDir = path2.dirname(filePath);
+  const realFileDir = tryRealpath(fileDir) ?? fileDir;
+  const realFilePath = path2.join(realFileDir, path2.basename(filePath));
+  const relative = path2.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path2.isAbsolute(relative)) {
+    return void 0;
+  }
+  return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
+}
+function tryRealpath(candidate) {
+  try {
+    return realpathSync(candidate);
+  } catch {
+    return void 0;
+  }
+}
+function mapResult(msg) {
+  const usageEvent = extractClaudeUsageEvent(msg.usage);
+  if (msg.is_error === false) {
+    const events2 = usageEvent ? [usageEvent, { type: "turn_end" }] : [{ type: "turn_end" }];
+    return { events: events2 };
+  }
+  const errors = Array.isArray(msg.errors) ? msg.errors.filter((e) => typeof e === "string") : [];
+  const diagnostic = errors.length > 0 ? errors.join("; ") : typeof msg.result === "string" && msg.result.length > 0 ? msg.result : void 0;
+  const message = msg.is_error === true ? diagnostic ?? "claude reported an error result" : (
+    // M4 hardening: a missing/invalid `is_error` is already fail-closed
+    // (treated as failure, never inferred as success — see above), but
+    // this branch used to report ONLY the generic fallback string, even
+    // when the frame actually carried a perfectly usable `result`/
+    // `errors` payload (real diagnostic content is only read above when
+    // `is_error === true` EXACTLY, so a malformed-but-otherwise-populated
+    // frame silently lost it). Appending `diagnostic` here (when
+    // present) preserves the fail-closed verdict — this is still always
+    // an `error` AgentEvent — while no longer discarding whatever the
+    // frame actually said. Truncated defensively: this is an
+    // unexpected/malformed frame shape, not the normal error path, so
+    // the content could in principle be arbitrarily large.
+    diagnostic ? `claude result frame had a missing/invalid is_error flag (got ${JSON.stringify(msg.is_error)}) \u2014 treating as failure, fail-closed; diagnostic content on the frame: ${truncateResultDiagnostic(diagnostic)}` : `claude result frame had a missing/invalid is_error flag (got ${JSON.stringify(msg.is_error)}) \u2014 treating as failure, fail-closed`
+  );
+  const events = usageEvent ? [usageEvent, { type: "error", message }] : [{ type: "error", message }];
+  return { events };
+}
+var RESULT_DIAGNOSTIC_MAX_CHARS = 2e3;
+function truncateResultDiagnostic(text) {
+  return text.length > RESULT_DIAGNOSTIC_MAX_CHARS ? `${text.slice(0, RESULT_DIAGNOSTIC_MAX_CHARS)}\u2026 [truncated]` : text;
+}
+function extractClaudeUsageEvent(rawUsage) {
+  if (!rawUsage || typeof rawUsage !== "object") return void 0;
+  const usage = rawUsage;
+  const inputTokens = toNonNegativeInt(usage.input_tokens);
+  const cachedInputTokens = toNonNegativeInt(usage.cache_read_input_tokens);
+  const outputTokens = toNonNegativeInt(usage.output_tokens);
+  if (inputTokens === void 0 && cachedInputTokens === void 0 && outputTokens === void 0) {
+    return void 0;
+  }
+  const event = { type: "usage" };
+  if (inputTokens !== void 0) event.inputTokens = inputTokens;
+  if (cachedInputTokens !== void 0) event.cachedInputTokens = cachedInputTokens;
+  if (outputTokens !== void 0) event.outputTokens = outputTokens;
+  return event;
+}
+function toNonNegativeInt(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
+}
+function mapClaudeMessageToAgentEvents(msg, correlation, options) {
+  switch (msg.type) {
+    case "assistant":
+      return mapAssistant(msg, correlation);
+    case "user":
+      return mapUser(msg, correlation, options);
+    case "result":
+      return mapResult(msg);
+    case "system": {
+      const subtype = typeof msg.subtype === "string" ? msg.subtype : void 0;
+      if (subtype && ROUTINE_CLAUDE_SYSTEM_SUBTYPES.has(subtype)) return { events: [] };
+      return { events: [], unmappedLabel: `system:${subtype ?? "unknown"}` };
+    }
+    // Per-turn rate-limit-window bookkeeping, unconditionally emitted
+    // alongside every result — no `AgentEvent` equivalent, routine.
+    case "rate_limit_event":
+      return { events: [] };
+    default:
+      return { events: [], unmappedLabel: `top-level:${String(msg.type)}` };
+  }
+}
+var STDERR_RING_CAPACITY2 = 20;
+var ClaudeProcessClient = class {
+  child;
+  buffer = "";
+  eventQueue = new AsyncQueue();
+  closed = false;
+  exitError;
+  stderrRing = [];
+  unmappedFrameCounts = /* @__PURE__ */ new Map();
+  sessionId;
+  initWaiter;
+  constructor(options) {
+    const spawnFn = options.spawnFn ?? spawn;
+    this.child = spawnFn(options.command, options.args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    this.child.stdout.setEncoding("utf8");
+    this.child.stdout.on("data", (chunk) => this.onData(chunk));
+    this.child.stderr.setEncoding("utf8");
+    this.child.stderr.on("data", (chunk) => this.onStderr(chunk));
+    this.child.on("close", (code, signal) => {
+      this.onClosed(this.buildExitError(code, signal));
+    });
+    this.child.on("error", (err) => {
+      this.onClosed(err);
+    });
+  }
+  /**
+   * Write a new user turn onto stdin (`--input-format stream-json`'s wire
+   * shape: `{"type":"user","message":{"role":"user","content":[{"type":
+   * "text","text":...}]}}`). Used identically for the very first turn
+   * (`ClaudeAdapter.start()`) and any later same-session turn
+   * (`ClaudeSession.followUp()`) — empirically confirmed live that claude
+   * keeps a `--input-format stream-json` process alive across multiple
+   * sequential turns on ONE persistent process/session (same `session_id`
+   * reported on each turn's own `system/init` and `result` frames), only
+   * exiting when stdin is closed or the process is killed. This is the
+   * mechanism `followUp()` relies on instead of spawning a fresh
+   * `--resume`'d process per follow-up.
+   */
+  writeUserMessage(text) {
+    if (this.closed) {
+      throw this.exitError ?? new Error("claude process is closed");
+    }
+    const line = `${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text }] } })}
+`;
+    this.child.stdin.write(line, (err) => {
+      if (err) {
+        console.error(`[byok/claude-adapter] failed to write to claude stdin: ${err.message}`);
+      }
+    });
+  }
+  /**
+   * Resolves with claude's own `session_id` once its `system/init` frame
+   * arrives (see this class's doc comment for why this exists at all).
+   * Idempotent: once resolved, further calls resolve immediately with the
+   * same id; if the process already closed before init ever arrived,
+   * every call rejects with that same exit error.
+   */
+  waitForInit() {
+    if (this.sessionId !== void 0) return Promise.resolve(this.sessionId);
+    if (this.closed) return Promise.reject(this.exitError ?? new Error("claude process is closed"));
+    return new Promise((resolve, reject) => {
+      this.initWaiter = { resolve, reject };
+    });
+  }
+  /** Every parsed stream-json line — `system/init` is consumed internally (see `waitForInit`) but is also forwarded here like any other frame, so routine-frame accounting in `ClaudeSession`'s mapper stays uniform. */
+  get events() {
+    return this.eventQueue;
+  }
+  /**
+   * Record a claude stream-json frame/subtype/content-block label that
+   * `ClaudeSession`'s event iterator (`../claude-adapter.ts`) decided has
+   * no `AgentEvent` mapping and isn't routine bookkeeping (see
+   * `events.ts`'s `MapClaudeMessageResult.unmappedLabel` doc comment) —
+   * i.e. genuinely unexpected traffic. Mirrors pi's
+   * `PiRpcClient.recordUnmappedFrame` exactly: logs once per distinct
+   * label, folds the running tally into a later exit error for a
+   * post-mortem without separate log scraping.
+   */
+  recordUnmappedFrame(label) {
+    const next = (this.unmappedFrameCounts.get(label) ?? 0) + 1;
+    this.unmappedFrameCounts.set(label, next);
+    if (next === 1) {
+      console.warn(
+        `[byok/claude-adapter] claude emitted a frame with no AgentEvent mapping: "${label}" (further occurrences of this label won't be logged individually)`
+      );
+    }
+  }
+  /** Best-effort teardown. SIGTERM on POSIX; `taskkill /T /F` on Windows to also reap child processes claude itself spawned (e.g. Bash) — mirrors pi's cross-platform `kill()` exactly. Empirically confirmed on this (POSIX) machine: a running claude process exits cleanly within ~1s of SIGTERM (observed exit code 143 = 128+SIGTERM, i.e. claude catches and handles the signal itself rather than needing a harder kill). */
+  kill() {
+    if (this.closed) return;
+    const pid = this.child.pid;
+    if (process.platform === "win32" && pid !== void 0) {
+      spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"]);
+    } else {
+      this.child.kill("SIGTERM");
+    }
+  }
+  onData(chunk) {
+    this.buffer += chunk;
+    let newlineIndex = this.buffer.indexOf("\n");
+    while (newlineIndex !== -1) {
+      let line = this.buffer.slice(0, newlineIndex);
+      this.buffer = this.buffer.slice(newlineIndex + 1);
+      if (line.endsWith("\r")) line = line.slice(0, -1);
+      if (line.length > 0) this.onLine(line);
+      newlineIndex = this.buffer.indexOf("\n");
+    }
+  }
+  onLine(line) {
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (this.sessionId === void 0 && msg.type === "system" && msg.subtype === "init" && typeof msg.session_id === "string" && msg.session_id.length > 0) {
+      this.sessionId = msg.session_id;
+      this.initWaiter?.resolve(this.sessionId);
+      this.initWaiter = void 0;
+    }
+    this.eventQueue.push(msg);
+  }
+  onStderr(chunk) {
+    for (const rawLine of chunk.split("\n")) {
+      const line = rawLine.trim();
+      if (line.length === 0) continue;
+      this.stderrRing.push(line);
+      if (this.stderrRing.length > STDERR_RING_CAPACITY2) this.stderrRing.shift();
+    }
+  }
+  /** Mirrors pi's `buildExitError` exactly — stderr tail + unmapped-frame tally folded into one self-diagnosing message. */
+  buildExitError(code, signal) {
+    const parts = [`claude process exited (code=${code}, signal=${signal})`];
+    if (this.stderrRing.length > 0) {
+      parts.push(`stderr: ${this.stderrRing.join(" | ")}`);
+    }
+    if (this.unmappedFrameCounts.size > 0) {
+      const summary = [...this.unmappedFrameCounts.entries()].map(([label, count]) => `${label}\xD7${count}`).join(", ");
+      parts.push(`unmapped frame labels seen: ${summary}`);
+    }
+    return new Error(parts.join("; "));
+  }
+  onClosed(err) {
+    if (this.closed) return;
+    this.closed = true;
+    this.exitError = err;
+    this.initWaiter?.reject(err);
+    this.initWaiter = void 0;
+    this.eventQueue.end();
+  }
+};
+var APPROVAL_TOOL_NAME = "approval_prompt";
+
+// src/adapters/claude/claude-adapter.ts
+var APPROVAL_MCP_SERVER_NAME = "byokapproval";
+var execFileAsync2 = promisify(execFile);
+var DETECT_TIMEOUT_MS2 = 5e3;
+async function cleanupApprovalMcpConfigDir(dir) {
+  if (!dir) return;
+  await promises.rm(dir, { recursive: true, force: true }).catch(() => {
+  });
+}
+var ClaudeAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  options;
+  id = "claude";
+  async detect() {
+    const bin = this.resolveBin();
+    try {
+      const { stdout } = await execFileAsync2(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS2 });
+      const version = stdout.trim();
+      const authPresent = await this.probeAuthPresent(bin.command);
+      return { present: true, version, authPresent };
+    } catch {
+      return { present: false };
+    }
+  }
+  capabilities() {
+    return { steer: false, resume: true, approvalInteractive: true, permissionModes: ["auto", "readonly", "plan", "confirm"] };
+  }
+  /**
+   * M5: deliberate product-boundary decision, not an oversight — byok's
+   * current ToS posture for claude is login-state-only (`claude auth
+   * login`'s own OAuth session — see `probeAuthPresent` below), so this
+   * adapter declares NO credential env vars at all; env-based API-key
+   * passthrough for claude is a separate, still-pending product decision.
+   * A product that genuinely needs it can opt in locally per-device via
+   * `DaemonConfig.runtimeEnvironment.claude.allow` (`create-daemon.ts`).
+   * `baseNames` is empty too: nothing in this adapter reads a
+   * claude-specific config-discovery variable (e.g. `CLAUDE_CONFIG_DIR`)
+   * today — if a future version of this adapter starts reading one, it
+   * belongs here, not left to rely on the platform baseline alone.
+   */
+  environmentRequirements() {
+    return { credentialNames: [] };
+  }
+  async start(task, ctx) {
+    if (typeof task.instruction !== "string") {
+      throw new PolicyUnsupportedError("claude adapter only supports string instructions in M2 (no blob-ref fetch yet)");
+    }
+    const mapping = mapPermissionPolicyToClaudeArgs(ctx.policy);
+    if (!mapping.ok) {
+      throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by claude adapter");
+    }
+    let approvalMcpConfigDir;
+    if (mapping.needsApprovalMcp) {
+      if (!ctx.approvalChannel) {
+        throw new PolicyUnsupportedError(
+          'claude adapter requires policy.mode "confirm" to be started with an approval channel (TaskContext.approvalChannel) \u2014 none was provided'
+        );
+      }
+      const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
+      approvalMcpConfigDir = await promises.mkdtemp(path2.join(os.tmpdir(), "byok-approval-mcp-"));
+      await promises.chmod(approvalMcpConfigDir, 448).catch(() => {
+      });
+      const mcpConfigPath = path2.join(approvalMcpConfigDir, "mcp-config.json");
+      const mcpConfig = {
+        mcpServers: {
+          [APPROVAL_MCP_SERVER_NAME]: {
+            command: approvalMcpBin.command,
+            args: approvalMcpBin.args,
+            env: {
+              BYOK_STORE_DIR: ctx.approvalChannel.storeDir,
+              BYOK_PRODUCT_ID: ctx.approvalChannel.productId,
+              BYOK_TASK_ID: ctx.approvalChannel.taskId,
+              BYOK_APPROVAL_TIMEOUT_MS: String(ctx.approvalChannel.timeoutMs)
+            }
+          }
+        }
+      };
+      await promises.writeFile(mcpConfigPath, JSON.stringify(mcpConfig), { mode: 384 });
+      mapping.args = [
+        ...mapping.args,
+        "--permission-prompt-tool",
+        `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`,
+        "--mcp-config",
+        mcpConfigPath,
+        // Never let this task's confirm-mode run pick up some OTHER MCP
+        // server from ambient project/user config — the approval channel is
+        // the only MCP server this invocation should ever see.
+        "--strict-mcp-config"
+      ];
+    }
+    const bin = this.resolveBin();
+    const resumeSessionId = task.sessionRef;
+    const args = [
+      "-p",
+      "--input-format",
+      "stream-json",
+      "--output-format",
+      "stream-json",
+      // REQUIRED alongside `--output-format stream-json` in `--print` mode —
+      // empirically confirmed: omitting this exits 1 immediately with
+      // "Error: When using --print, --output-format=stream-json requires
+      // --verbose", before spawning any model call.
+      "--verbose",
+      ...resumeSessionId ? ["--resume", resumeSessionId] : [],
+      ...mapping.args
+    ];
+    const client = new ClaudeProcessClient({
+      command: bin.command,
+      args,
+      cwd: ctx.workspaceDir,
+      env: ctx.env,
+      spawnFn: this.options.spawnFn
+    });
+    client.writeUserMessage(task.instruction);
+    let sessionRef;
+    try {
+      sessionRef = await client.waitForInit();
+    } catch (err) {
+      client.kill();
+      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      throw err;
+    }
+    if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
+      client.kill();
+      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      throw new Error(
+        `claude --resume echoed a different session id than requested (requested ${resumeSessionId}, got ${sessionRef}) \u2014 refusing to continue in a possibly-wrong session (fail-closed)`
+      );
+    }
+    return new ClaudeSession(sessionRef, client, ctx.workspaceDir, ctx.approvalChannel, approvalMcpConfigDir);
+  }
+  /**
+   * `claude auth status --json` is claude's OWN non-secret login-state
+   * signal (see the credential-isolation rule on `RuntimeAdapter` in
+   * `../../types.ts`) — empirically confirmed live on this logged-in
+   * machine to report `{"loggedIn":true,"authMethod":"claude.ai",
+   * "apiProvider":"firstParty","email":"...","orgId":"...","orgName":"...",
+   * "subscriptionType":"max"}`, with no token/key material anywhere in it.
+   * This spawns the binary and parses ONLY its own reported status — it
+   * never reads `~/.claude` or any credential file itself, matching pi's
+   * `authPresent` computation being limited to environment-variable
+   * *names* (`../pi/pi-adapter.ts`'s `KNOWN_PROVIDER_ENV_VARS`), just via
+   * claude's own equivalent non-secret probe instead (claude's auth is
+   * OAuth-session-based via `claude auth login`, not primarily an env var,
+   * so pi's env-var-presence approach doesn't apply here the same way).
+   * A failed/unparseable probe (binary present but not logged in, a future
+   * claude release changing this output shape, etc.) fails closed to
+   * `false` — this never affects `present`, which is solely about whether
+   * `--version` itself succeeded.
+   */
+  async probeAuthPresent(command) {
+    try {
+      const { stdout } = await execFileAsync2(command, ["auth", "status", "--json"], { timeout: DETECT_TIMEOUT_MS2 });
+      const parsed = JSON.parse(stdout);
+      return parsed.loggedIn === true;
+    } catch {
+      return false;
+    }
+  }
+  resolveBin() {
+    return (this.options.resolveBin ?? resolveClaudeBin)();
+  }
+};
+var ClaudeSession = class {
+  constructor(sessionRef, client, workspaceDir, approvalChannel, approvalMcpConfigDir) {
+    this.sessionRef = sessionRef;
+    this.client = client;
+    this.workspaceDir = workspaceDir;
+    this.approvalChannel = approvalChannel;
+    this.approvalMcpConfigDir = approvalMcpConfigDir;
+  }
+  sessionRef;
+  client;
+  workspaceDir;
+  approvalChannel;
+  approvalMcpConfigDir;
+  correlation = createToolUseCorrelation();
+  get events() {
+    const client = this.client;
+    const correlation = this.correlation;
+    const workspaceDir = this.workspaceDir;
+    return {
+      [Symbol.asyncIterator]() {
+        const inner = client.events[Symbol.asyncIterator]();
+        let pending = [];
+        let turnSettled = false;
+        return {
+          async next() {
+            for (; ; ) {
+              const buffered = pending.shift();
+              if (buffered) return { value: buffered, done: false };
+              if (turnSettled) return { value: void 0, done: true };
+              const { value, done } = await inner.next();
+              if (done) return { value: void 0, done: true };
+              if (value.type === "result") turnSettled = true;
+              const mapped = mapClaudeMessageToAgentEvents(value, correlation, { workspaceDir });
+              if (mapped.unmappedLabel) {
+                client.recordUnmappedFrame(mapped.unmappedLabel);
+              }
+              if (mapped.events.length > 0) {
+                pending = mapped.events;
+              }
+            }
+          }
+        };
+      }
+    };
+  }
+  /**
+   * Not supported — see the class-level doc comment on `ClaudeAdapter` for
+   * the full empirical basis (a message written to stdin mid-turn was
+   * proven to queue as a follow-up turn, not redirect the running one).
+   * `capabilities().steer` reports `false` for exactly this reason; this
+   * throws rather than silently behaving like `followUp()` under the
+   * `steer()` name, which would promise live redirection it cannot deliver.
+   */
+  async steer() {
+    throw new SteerUnsupportedError(
+      "claude",
+      "claude adapter does not support mid-turn steering: writing to claude's stdin while a turn is in flight queues as a separate subsequent turn rather than redirecting the running one (empirically confirmed) \u2014 see capabilities().steer"
+    );
+  }
+  async followUp(task) {
+    if (typeof task.instruction !== "string") {
+      throw new PolicyUnsupportedError("claude adapter only supports string instructions in M2 (no blob-ref fetch yet)");
+    }
+    this.client.writeUserMessage(task.instruction);
+  }
+  /**
+   * Real claude has no distinct "abort but stay alive" primitive the way
+   * pi's RPC mode does (`{type:'abort'}`, after which pi keeps running and
+   * stays queryable) — nothing in `claude --help` exposes one, and this
+   * task's probes found none. SIGTERM (via `ClaudeProcessClient.kill()`)
+   * is the only verified way to stop an in-flight turn, so `interrupt()`
+   * and `close()` both resolve to the same underlying action here. This is
+   * consistent with how they are actually used together: `task-runner.ts`'s
+   * `handleCancel` always calls `interrupt()` immediately followed by
+   * `close()` on the same task, never `interrupt()` alone expecting the
+   * session to remain usable afterward.
+   */
+  async interrupt() {
+    this.client.kill();
+  }
+  async close() {
+    this.client.kill();
+    await cleanupApprovalMcpConfigDir(this.approvalMcpConfigDir);
+  }
+  /**
+   * M4 Phase 3: routes into the out-of-band approval channel `start()`
+   * threaded through from `TaskContext.approvalChannel` — see that type's
+   * own doc comment (`../../types.ts`) for the full design, and
+   * `permission-mapping.ts`'s `confirm`-mode doc comment for the empirical
+   * basis. `approved`/`reason` map directly onto `ApprovalChannel.resolve`'s
+   * own parameters, which in turn resolve the SAME `ApprovalRegistry` entry
+   * `bin/byok-approval-mcp.ts`'s pending `approvals.request` control call is
+   * awaiting — answering that call is what lets claude's own blocked
+   * `tools/call` (and therefore the paused turn) proceed.
+   *
+   * Still throws when no channel is present — every adapter/session that
+   * ISN'T running under `confirm` mode (the overwhelming majority) has
+   * nothing to resolve, and a caller receiving `task.approve`/`task.reject`
+   * for one of those implies something upstream expected approval support
+   * that isn't there, exactly as this method's doc comment always said.
+   * `ApprovalChannel.resolve` itself throws the equally-descriptive "no
+   * pending approval" error for the narrower case (confirm mode, but nothing
+   * currently pending) — this method doesn't need its own separate check for
+   * that.
+   */
+  async resolveApproval(approved, reason) {
+    if (!this.approvalChannel) {
+      throw new Error(
+        'claude adapter has no approval channel for this session (not running under policy.mode "confirm") \u2014 under every other mode, claude resolves every permission decision synchronously (auto-denied under a restrictive --permission-mode, auto-granted under a permissive one) before this adapter ever sees the corresponding frame, so there is nothing to resume later'
+      );
+    }
+    await this.approvalChannel.resolve(approved, reason);
+  }
+};
+
+// src/adapters/codex/resolve-bin.ts
+function resolveCodexBin() {
+  const override = process.env.BYOK_CODEX_BIN;
+  if (override) {
+    return { command: override, source: "env" };
+  }
+  return { command: "codex", source: "path" };
+}
+
+// src/adapters/codex/permission-mapping.ts
+function mapPermissionPolicyToCodexArgs(policy) {
+  if (policy.mode === "confirm" || policy.mode === "plan") {
+    return {
+      ok: false,
+      args: [],
+      reason: `codex adapter cannot express permission mode "${policy.mode}" (codex exec has no interactive approval channel \u2014 sandbox-denied actions resolve internally with no needs_approval-equivalent wire signal, and -a/--ask-for-approval is rejected outright by codex exec's real arg parser despite being documented in --help)`
+    };
+  }
+  if (policy.network === true) {
+    return {
+      ok: false,
+      args: [],
+      reason: "codex adapter cannot guarantee network:true (empirically, -c sandbox_workspace_write.network_access=true did not restore real network access on the installed codex build \u2014 see this file's module doc comment) \u2014 never silently proceeds without the requested grant"
+    };
+  }
+  if (policy.allowTools && policy.allowTools.length > 0 || policy.denyTools && policy.denyTools.length > 0) {
+    return {
+      ok: false,
+      args: [],
+      reason: "codex adapter cannot express allowTools/denyTools (codex exec has no verified per-tool allow/deny surface, only the coarse sandbox_mode) \u2014 never silently ignores a requested tool restriction"
+    };
+  }
+  const sandboxMode = policy.mode === "readonly" ? "read-only" : "workspace-write";
+  return { ok: true, args: ["-c", `sandbox_mode=${sandboxMode}`, "-c", "approval_policy=never"] };
+}
+function mapCodexEventToAgentEvents(evt, workspaceDir) {
+  switch (evt.type) {
+    case "turn.completed": {
+      const usageEvent = extractCodexUsageEvent(evt.usage);
+      return usageEvent ? [usageEvent, { type: "turn_end" }] : [{ type: "turn_end" }];
+    }
+    case "turn.failed":
+      return [{ type: "error", message: extractErrorMessage(evt.error) ?? "codex turn failed" }];
+    case "error":
+      return [{ type: "error", message: typeof evt.message === "string" ? evt.message : "codex reported an error" }];
+    case "item.started":
+      return mapItem(evt.item, "started", workspaceDir);
+    case "item.completed":
+      return mapItem(evt.item, "completed", workspaceDir);
+    // `thread.started`/`turn.started` carry no AgentEvent-mappable content —
+    // see the module doc comment above for why `thread.started` is handled
+    // upstream instead. Both are also listed in ROUTINE_CODEX_EVENT_TYPES.
+    case "thread.started":
+    case "turn.started":
+      return [];
+    default:
+      return [];
+  }
+}
+function extractCodexUsageEvent(rawUsage) {
+  if (!rawUsage || typeof rawUsage !== "object") return void 0;
+  const usage = rawUsage;
+  const inputTokens = toNonNegativeInt2(usage.input_tokens);
+  const cachedInputTokens = toNonNegativeInt2(usage.cached_input_tokens);
+  const outputTokens = toNonNegativeInt2(usage.output_tokens);
+  const reasoningTokens = toNonNegativeInt2(usage.reasoning_output_tokens);
+  if (inputTokens === void 0 && cachedInputTokens === void 0 && outputTokens === void 0 && reasoningTokens === void 0) {
+    return void 0;
+  }
+  const event = { type: "usage" };
+  if (inputTokens !== void 0) event.inputTokens = inputTokens;
+  if (cachedInputTokens !== void 0) event.cachedInputTokens = cachedInputTokens;
+  if (outputTokens !== void 0) event.outputTokens = outputTokens;
+  if (reasoningTokens !== void 0) event.reasoningTokens = reasoningTokens;
+  return event;
+}
+function toNonNegativeInt2(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
+}
+function mapItem(rawItem, phase, workspaceDir) {
+  if (!rawItem || typeof rawItem !== "object") return [];
+  const item = rawItem;
+  const itemType = item.type;
+  switch (itemType) {
+    case "agent_message": {
+      if (phase !== "completed") return [];
+      return typeof item.text === "string" ? [{ type: "progress", text: item.text }] : [];
+    }
+    case "command_execution": {
+      const command = typeof item.command === "string" ? item.command : void 0;
+      if (phase === "started") {
+        return command !== void 0 ? [{ type: "tool_use", tool: "command_execution", input: { command } }] : [];
+      }
+      return [
+        {
+          type: "tool_result",
+          tool: "command_execution",
+          output: {
+            command,
+            aggregatedOutput: item.aggregated_output,
+            exitCode: item.exit_code,
+            status: item.status
+          }
+        }
+      ];
+    }
+    case "file_change": {
+      const changes = Array.isArray(item.changes) ? item.changes : [];
+      if (phase === "started") {
+        return [{ type: "tool_use", tool: "file_change", input: { changes } }];
+      }
+      return [
+        { type: "tool_result", tool: "file_change", output: { changes, status: item.status } },
+        ...extractArtifactEvents(changes, workspaceDir)
+      ];
+    }
+    case "error": {
+      return typeof item.message === "string" ? [{ type: "error", message: item.message }] : [];
+    }
+    default:
+      return [];
+  }
+}
+function extractArtifactEvents(changes, workspaceDir) {
+  const events = [];
+  for (const rawChange of changes) {
+    if (!rawChange || typeof rawChange !== "object") continue;
+    const change = rawChange;
+    const absolutePath = typeof change.path === "string" ? change.path : void 0;
+    const kind = typeof change.kind === "string" ? change.kind : void 0;
+    if (!absolutePath || kind === "delete") continue;
+    const relative = path2.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path2.isAbsolute(relative)) continue;
+    events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
+  }
+  return events;
+}
+var CONTENT_TYPE_BY_EXTENSION = {
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".json": "application/json",
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".cjs": "text/javascript",
+  ".ts": "text/plain",
+  ".html": "text/html",
+  ".css": "text/css",
+  ".py": "text/x-python",
+  ".yml": "application/yaml",
+  ".yaml": "application/yaml",
+  ".csv": "text/csv"
+};
+function guessContentType2(relativePath) {
+  return CONTENT_TYPE_BY_EXTENSION[path2.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+}
+function extractErrorMessage(rawError) {
+  if (typeof rawError === "string") return rawError;
+  if (!rawError || typeof rawError !== "object") return void 0;
+  const message = rawError.message;
+  return typeof message === "string" ? message : void 0;
+}
+var ROUTINE_CODEX_EVENT_TYPES = /* @__PURE__ */ new Set(["thread.started", "turn.started"]);
+function isRoutineCodexEvent(evt) {
+  return ROUTINE_CODEX_EVENT_TYPES.has(evt.type);
+}
+function unmappedFrameKey(evt) {
+  if (evt.type === "item.started" || evt.type === "item.completed") {
+    const item = evt.item;
+    const itemType = item && typeof item === "object" && typeof item.type === "string" ? item.type : "unknown";
+    return `${evt.type}:${String(itemType)}`;
+  }
+  return evt.type;
+}
+var STDERR_RING_CAPACITY3 = 20;
+var CodexProcessRunner = class {
+  child;
+  onEvent;
+  buffer = "";
+  stderrRing = [];
+  closed = false;
+  exitCode = null;
+  exitSignal = null;
+  closedPromise;
+  resolveClosed;
+  constructor(options) {
+    this.onEvent = options.onEvent;
+    const spawnFn = options.spawnFn ?? spawn;
+    this.child = spawnFn(options.command, options.args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    this.closedPromise = new Promise((resolve) => {
+      this.resolveClosed = resolve;
+    });
+    this.child.stdout.setEncoding("utf8");
+    this.child.stdout.on("data", (chunk) => this.onData(chunk));
+    this.child.stderr.setEncoding("utf8");
+    this.child.stderr.on("data", (chunk) => this.onStderr(chunk));
+    this.child.on("close", (code, signal) => {
+      this.exitCode = code;
+      this.exitSignal = signal;
+      this.finishClosing();
+    });
+    this.child.on("error", () => {
+      this.finishClosing();
+    });
+  }
+  finishClosing() {
+    if (this.closed) return;
+    this.closed = true;
+    this.resolveClosed();
+  }
+  /** Resolves once the child process has fully exited (both exit and stdio-flush guaranteed — see the `close` listener above). Never rejects. */
+  waitClosed() {
+    return this.closedPromise;
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  /**
+   * Best-effort teardown. SIGTERM on POSIX: SIGINT was empirically confirmed
+   * to be silently ignored by `codex exec` (a real, direct test — a 60s
+   * shell `sleep` ran to full, unaffected completion despite SIGINT sent at
+   * t=4s) — a genuine, evidence-based correction to this task's own initial
+   * assumption ("interrupt: SIGINT — POSIX here"). SIGTERM was separately
+   * confirmed to terminate the process immediately (exit code 143) with no
+   * orphaned child processes left behind (the shell command it was running
+   * died with it), and — critically — the underlying codex thread remained
+   * cleanly resumable afterward via `codex exec resume` (no corruption from
+   * killing mid-turn). `taskkill /T /F` on Windows, mirroring
+   * `../pi/rpc-client.ts`'s own cross-platform convention.
+   */
+  kill() {
+    if (this.closed) return;
+    const pid = this.child.pid;
+    if (process.platform === "win32" && pid !== void 0) {
+      spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"]);
+    } else {
+      this.child.kill("SIGTERM");
+    }
+  }
+  /** Builds a descriptive error folding in the exit code/signal and the stderr tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a failed start/resume should never need separately re-running codex by hand with a raw JSONL logger to learn why. */
+  buildExitError(context) {
+    const parts = [`${context} (exit code=${this.exitCode}, signal=${this.exitSignal})`];
+    if (this.stderrRing.length > 0) {
+      parts.push(`stderr: ${this.stderrRing.join(" | ")}`);
+    }
+    return new Error(parts.join("; "));
+  }
+  onData(chunk) {
+    this.buffer += chunk;
+    let newlineIndex = this.buffer.indexOf("\n");
+    while (newlineIndex !== -1) {
+      let line = this.buffer.slice(0, newlineIndex);
+      this.buffer = this.buffer.slice(newlineIndex + 1);
+      if (line.endsWith("\r")) line = line.slice(0, -1);
+      if (line.length > 0) this.parseLine(line);
+      newlineIndex = this.buffer.indexOf("\n");
+    }
+  }
+  parseLine(line) {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
+      return;
+    }
+    this.onEvent(parsed);
+  }
+  onStderr(chunk) {
+    for (const rawLine of chunk.split("\n")) {
+      const line = rawLine.trim();
+      if (line.length === 0) continue;
+      this.stderrRing.push(line);
+      if (this.stderrRing.length > STDERR_RING_CAPACITY3) this.stderrRing.shift();
+    }
+  }
+};
+
+// src/adapters/codex/codex-adapter.ts
+var execFileAsync3 = promisify(execFile);
+var DETECT_TIMEOUT_MS3 = 5e3;
+var CodexAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  options;
+  id = "codex";
+  async detect() {
+    const bin = this.resolveBin();
+    try {
+      const versionResult = await execFileAsync3(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS3 });
+      const version = versionResult.stdout.trim() || versionResult.stderr.trim();
+      const authPresent = await this.probeAuthPresent(bin);
+      return { present: true, version, authPresent };
+    } catch {
+      return { present: false };
+    }
+  }
+  /**
+   * `authPresent` without ever reading `~/.codex/auth.json` (credential-
+   * isolation rule, `../../types.ts`): spawns codex's OWN `login status`
+   * subcommand and interprets its human-readable report — the exact
+   * "non-secret signal" this adapter is required to use, and cleaner than
+   * pi's env-var-name check since codex's real credential model (on the
+   * reference machine) is a ChatGPT OAuth session, not an env var.
+   *
+   * Two independently-verified channel gotchas apply here, the "pi lesson"
+   * yet again:
+   *   - `codex login status`'s human-readable "Logged in using ChatGPT"
+   *     message prints on STDERR, not stdout (the opposite-channel
+   *     counterpart of pi's own `--version`-goes-to-stderr surprise) — both
+   *     streams are checked here for exactly that reason.
+   *   - The NOT-logged-in message/exit-code shape was deliberately never
+   *     empirically tested: this machine has a real, live ChatGPT login, and
+   *     running `codex logout` to observe the negative case would have
+   *     broken that login for the rest of this session/machine. The match
+   *     below is intentionally conservative (`/logged in (using|with)/i`,
+   *     not a bare `"logged in"` substring) specifically because a bare
+   *     substring check would false-positive on a plausible negative message
+   *     like "Not logged in" (itself containing the substring "logged in").
+   *     This is a documented, known gap — flagged for M2-c / a follow-up
+   *     empirical pass on a logged-out machine, not asserted as verified.
+   */
+  async probeAuthPresent(bin) {
+    try {
+      const result = await execFileAsync3(bin.command, ["login", "status"], { timeout: DETECT_TIMEOUT_MS3 });
+      return /logged in (using|with)/i.test(`${result.stdout}
+${result.stderr}`);
+    } catch (err) {
+      const withStreams = err;
+      return /logged in (using|with)/i.test(`${withStreams.stdout ?? ""}
+${withStreams.stderr ?? ""}`);
+    }
+  }
+  capabilities() {
+    return { steer: false, resume: true, approvalInteractive: false, permissionModes: ["auto", "readonly"] };
+  }
+  /**
+   * M5: same deliberate posture as the claude adapter (see its own doc
+   * comment) — codex authenticates via its own `codex login`-managed
+   * ChatGPT OAuth session (`probeAuthPresent` above), not an env var, so
+   * there is no credential env var this adapter needs forwarded; env-based
+   * API-key passthrough remains a separate, pending product decision. No
+   * `baseNames` either: nothing in this adapter reads a codex-specific
+   * config-discovery variable (e.g. `CODEX_HOME`) today.
+   */
+  environmentRequirements() {
+    return { credentialNames: [] };
+  }
+  async start(task, ctx) {
+    if (typeof task.instruction !== "string") {
+      throw new PolicyUnsupportedError("codex adapter only supports string instructions in M2 (no blob-ref fetch yet)");
+    }
+    const mapping = mapPermissionPolicyToCodexArgs(ctx.policy);
+    if (!mapping.ok) {
+      throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
+    }
+    const bin = this.resolveBin();
+    const queue = new AsyncQueue();
+    const recordUnmapped = makeUnmappedFrameRecorder(/* @__PURE__ */ new Map());
+    const workspaceDir = await resolveRealWorkspaceDir(ctx.workspaceDir);
+    const { sessionRef, runner } = await runCodexTurn({
+      command: bin.command,
+      resumeRef: task.sessionRef,
+      instruction: task.instruction,
+      policyArgs: mapping.args,
+      cwd: ctx.workspaceDir,
+      env: ctx.env,
+      spawnFn: this.options.spawnFn,
+      workspaceDir,
+      queue,
+      recordUnmapped,
+      expectedSessionRef: task.sessionRef,
+      preparedGit: ctx.gitWorkspace !== void 0
+    });
+    return new CodexSession({
+      sessionRef,
+      command: bin.command,
+      workspaceDir,
+      env: ctx.env,
+      spawnFn: this.options.spawnFn,
+      queue,
+      recordUnmapped,
+      initialRunner: runner,
+      preparedGit: ctx.gitWorkspace !== void 0
+    });
+  }
+  resolveBin() {
+    return (this.options.resolveBin ?? resolveCodexBin)();
+  }
+};
+async function resolveRealWorkspaceDir(workspaceDir) {
+  return promises.realpath(workspaceDir).catch(() => workspaceDir);
+}
+function makeUnmappedFrameRecorder(counts) {
+  return (key) => {
+    const next = (counts.get(key) ?? 0) + 1;
+    counts.set(key, next);
+    if (next === 1) {
+      console.warn(
+        `[byok/codex-adapter] codex emitted a frame with no AgentEvent mapping: "${key}" (further occurrences of this type won't be logged individually)`
+      );
+    }
+  };
+}
+function buildArgv(resumeRef, policyArgs, instruction, preparedGit = false) {
+  const base = resumeRef !== void 0 ? ["exec", "resume", resumeRef] : ["exec"];
+  return [...base, "--json", ...preparedGit ? [] : ["--skip-git-repo-check"], ...policyArgs, instruction];
+}
+async function runCodexTurn(params) {
+  const argv = buildArgv(params.resumeRef, params.policyArgs, params.instruction, params.preparedGit);
+  let firstLineSettled = false;
+  let resolveFirstLine;
+  let rejectFirstLine;
+  const firstLine = new Promise((resolve, reject) => {
+    resolveFirstLine = resolve;
+    rejectFirstLine = reject;
+  });
+  let turnEnded = false;
+  const runner = new CodexProcessRunner({
+    command: params.command,
+    args: argv,
+    cwd: params.cwd,
+    env: params.env,
+    spawnFn: params.spawnFn,
+    onEvent: (evt) => {
+      if (!firstLineSettled) {
+        firstLineSettled = true;
+        if (evt.type === "thread.started" && typeof evt.thread_id === "string" && evt.thread_id.length > 0) {
+          resolveFirstLine(evt.thread_id);
+        } else {
+          rejectFirstLine(
+            new Error(`codex did not yield thread.started as its first event (got ${JSON.stringify(evt).slice(0, 200)})`)
+          );
+        }
+        return;
+      }
+      const mapped = mapCodexEventToAgentEvents(evt, params.workspaceDir);
+      for (const agentEvent of mapped) {
+        if (agentEvent.type === "turn_end") turnEnded = true;
+        params.queue.push(agentEvent);
+      }
+      if (mapped.length === 0 && !isRoutineCodexEvent(evt)) {
+        params.recordUnmapped(unmappedFrameKey(evt));
+      }
+    }
+  });
+  void runner.waitClosed().then(() => {
+    if (turnEnded) return;
+    params.queue.push({ type: "error", message: runner.buildExitError("codex exited without completing the turn").message });
+    params.queue.end();
+  });
+  let sessionRef;
+  try {
+    sessionRef = await new Promise((resolve, reject) => {
+      let settled = false;
+      firstLine.then(
+        (ref) => {
+          if (!settled) {
+            settled = true;
+            resolve(ref);
+          }
+        },
+        (err) => {
+          if (!settled) {
+            settled = true;
+            reject(err instanceof Error ? err : new Error(String(err)));
+          }
+        }
+      );
+      void runner.waitClosed().then(() => {
+        if (!settled) {
+          settled = true;
+          reject(runner.buildExitError("codex exited before yielding an authoritative thread id"));
+        }
+      });
+    });
+  } catch (err) {
+    runner.kill();
+    throw err;
+  }
+  if (params.expectedSessionRef !== void 0 && sessionRef !== params.expectedSessionRef) {
+    runner.kill();
+    throw new Error(
+      `codex exec resume echoed a different thread id than requested (requested ${params.expectedSessionRef}, got ${sessionRef}) \u2014 refusing to continue in a possibly-wrong session (fail-closed)`
+    );
+  }
+  return { sessionRef, runner };
+}
+var CodexSession = class {
+  /**
+   * NOT `readonly` (cross-model review finding): `followUp()` below
+   * re-assigns this from the runtime's own CONFIRMED reflected id on each
+   * resume — see its own doc comment. Silently keeping the value captured at
+   * construction time was the original bug (the NEW id `runCodexTurn`
+   * returns was discarded, so every later `followUp()` kept resuming the
+   * OLD, potentially stale, id); that stays fixed here. A LATER cross-model
+   * re-review found the fix above was itself incomplete: `followUp()` now
+   * also verifies the reflected id matches what it asked to resume BEFORE
+   * this field is touched — a mismatch throws (fail-closed) instead of ever
+   * reaching this assignment, so `sessionRef` only ever advances to an id
+   * codex has proven it actually resumed, never one it silently swapped in.
+   */
+  sessionRef;
+  command;
+  workspaceDir;
+  env;
+  spawnFn;
+  queue;
+  recordUnmapped;
+  preparedGit;
+  currentRunner;
+  closed = false;
+  constructor(options) {
+    this.sessionRef = options.sessionRef;
+    this.command = options.command;
+    this.workspaceDir = options.workspaceDir;
+    this.env = options.env;
+    this.spawnFn = options.spawnFn;
+    this.queue = options.queue;
+    this.recordUnmapped = options.recordUnmapped;
+    this.preparedGit = options.preparedGit;
+    this.currentRunner = options.initialRunner;
+    void this.forgetRunnerOnceClosed(options.initialRunner);
+  }
+  get events() {
+    return this.queue;
+  }
+  async forgetRunnerOnceClosed(runner) {
+    await runner.waitClosed();
+    if (this.currentRunner === runner) this.currentRunner = void 0;
+  }
+  /**
+   * New turn, same session, via the real resume mechanism (`codex exec
+   * resume <sessionRef> ...`). Maps `task.policy` FRESH on every call — a
+   * deliberate, evidence-based divergence from pi's own `followUp()`
+   * (`../pi/pi-adapter.ts`), which ignores `task.policy` entirely and relies
+   * on argv baked in once at `start()`. That's safe for pi only because pi
+   * reuses one already-running RPC process for its whole session lifetime,
+   * so there is nothing to re-apply. codex has no such invariant: a resume
+   * spawns a BRAND NEW process, and empirically that new process does NOT
+   * inherit the sandbox mode the session originally started with (see this
+   * file's module doc comment) — omitting a fresh, explicit mapping here
+   * would silently run the follow-up turn under this machine's ambient codex
+   * config default instead of the policy this specific follow-up was
+   * offered under, exactly the silent-widen failure mode this adapter exists
+   * to prevent.
+   *
+   * Cross-model RE-review finding (this corrects the previous wave's own
+   * reasoning, quoted below for context): `expectedSessionRef` IS now passed
+   * to `runCodexTurn`, set to the exact id this call asked to resume
+   * (`resumeRef`, captured up front before the call). The previous version
+   * of this method deliberately omitted it — "this resume targets OUR OWN
+   * previously-recorded `sessionRef`, not an externally supplied server
+   * expectation crossing a trust boundary... whatever id codex reports back
+   * for THIS resume is unambiguously the current, authoritative id for this
+   * session" — but that reasoning let a resume-A/reports-B mismatch silently
+   * MIGRATE this session's identity instead of failing closed: codex has no
+   * documented contract for re-keying a thread on resume, so a mismatch here
+   * must be treated as an error, exactly like `start()`'s own
+   * `task.sessionRef` comparison (see `runCodexTurn`'s doc comment on that
+   * check) — never silently adopted. `runCodexTurn` kills the (failed) new
+   * runner and throws on a mismatch, BEFORE `sessionRef`/`currentRunner`
+   * below are ever touched — so a thrown mismatch leaves this session in its
+   * previous, still-good state rather than partially migrated. The
+   * `sessionRef` return value is still captured and re-assigned below (the
+   * ORIGINAL bug this fixes, one wave further back: the return value used to
+   * be discarded entirely, so every later `followUp()` kept resuming a
+   * stale id even after codex had moved on) — it just can now only ever be
+   * the SAME id this call asked to resume, never a silently-different one.
+   */
+  async followUp(task) {
+    if (typeof task.instruction !== "string") {
+      throw new PolicyUnsupportedError("codex adapter only supports string instructions in M2 (no blob-ref fetch yet)");
+    }
+    if (this.closed) {
+      throw new Error("cannot follow up on a closed codex session");
+    }
+    const mapping = mapPermissionPolicyToCodexArgs(task.policy);
+    if (!mapping.ok) {
+      throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
+    }
+    const resumeRef = this.sessionRef;
+    let sessionRef;
+    let runner;
+    try {
+      ({ sessionRef, runner } = await runCodexTurn({
+        command: this.command,
+        resumeRef,
+        instruction: task.instruction,
+        policyArgs: mapping.args,
+        cwd: this.workspaceDir,
+        env: this.env,
+        spawnFn: this.spawnFn,
+        workspaceDir: this.workspaceDir,
+        queue: this.queue,
+        recordUnmapped: this.recordUnmapped,
+        expectedSessionRef: resumeRef,
+        preparedGit: this.preparedGit
+      }));
+    } catch (err) {
+      this.queue.end();
+      throw err;
+    }
+    this.sessionRef = sessionRef;
+    this.currentRunner = runner;
+    void this.forgetRunnerOnceClosed(runner);
+  }
+  /** Best-effort abort of the current turn. SIGTERM's the currently-running child, if any — see `process-runner.ts`'s `kill()` doc comment for why SIGTERM (not SIGINT) and why this is safe: the underlying codex thread survives and stays resumable, confirmed empirically. A no-op when no turn is currently in flight. */
+  async interrupt() {
+    this.currentRunner?.kill();
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.currentRunner?.kill();
+    this.queue.end();
+  }
+  /**
+   * `codex exec` has no in-band channel to inject text into an already-
+   * running turn — confirmed empirically, not assumed: there is no stdin
+   * protocol (stdin is never even piped to the child — see
+   * `process-runner.ts`'s module doc comment), SIGINT (a plausible
+   * interrupt-and-redirect signal) is silently ignored outright, and `codex
+   * exec resume` only ever starts a brand NEW turn strictly after the
+   * current one has fully finished — it cannot inject into one still in
+   * flight. Throws honestly rather than silently no-op-ing, matching this
+   * task's explicit instruction and `capabilities().steer === false` above.
+   */
+  async steer() {
+    throw new SteerUnsupportedError(
+      "codex",
+      "codex adapter does not support steer: codex exec has no in-band channel to inject text into a running turn (no stdin protocol, SIGINT is ignored, and resume only starts a new turn after the current one finishes)"
+    );
+  }
+  /**
+   * `codex exec` never emits a `needs_approval`-equivalent event on the wire
+   * — confirmed empirically (see `events.ts`'s module doc comment): a
+   * sandbox-denied action resolves the approval decision internally with no
+   * pause an external caller could ever observe or answer, regardless of
+   * `approval_policy`. Since this session can therefore never have emitted a
+   * `needs_approval` `AgentEvent` in the first place, a caller reaching this
+   * method implies something upstream expected approval support that isn't
+   * there — thrown as a descriptive error rather than a silent no-op,
+   * mirroring `../pi/pi-adapter.ts`'s identical `resolveApproval`.
+   */
+  async resolveApproval() {
+    throw new Error(
+      "codex adapter does not support approval resume: codex exec never emits a needs_approval-equivalent event (sandbox-denied actions resolve internally with no wire-visible pause)"
+    );
+  }
+};
+
+export { ClaudeAdapter, CodexAdapter, PI_PACKAGE_NAME, PiAdapter };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map