@byok-sdk/client 0.13.0 → 0.15.0

package/dist/adapters/index.js

@@ -1,10 +1,136 @@
-import { execFile, spawn } from 'child_process';
+import { execFile, spawn, spawnSync } from 'child_process';
 import { promises, existsSync, readFileSync, realpathSync } from 'fs';
 import os from 'os';
 import path5, { isAbsolute } from 'path';
 import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import 'readline';
+import { randomBytes } from 'crypto';
+
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/adapters/win32-job-object.ts
+var win32_job_object_exports = {};
+__export(win32_job_object_exports, {
+  Win32JobObjectFailure: () => Win32JobObjectFailure,
+  assignOwnedProcessToJob: () => assignOwnedProcessToJob,
+  isWin32JobObjectFailure: () => isWin32JobObjectFailure,
+  loadBindings: () => loadBindings
+});
+function isWin32JobObjectFailure(value) {
+  return value instanceof Error && value.name === "Win32JobObjectFailure";
+}
+function isNullHandle(value) {
+  return value === null || value === void 0 || value === 0n || value === 0;
+}
+async function loadBindings() {
+  if (cachedBindings !== void 0) return cachedBindings;
+  let koffi;
+  try {
+    const imported = await import('koffi');
+    koffi = imported.default ?? imported;
+  } catch (cause) {
+    throw new Win32JobObjectFailure({
+      step: "loadKoffi",
+      reason: "win32 runtime process ownership requires the koffi optional dependency, which could not be loaded"
+    }, { cause });
+  }
+  const kernel32 = koffi.load("kernel32.dll");
+  const PVOID = koffi.pointer("void");
+  const bind = (name, result, args) => kernel32.func("__stdcall", name, result, args);
+  cachedBindings = {
+    createJobObjectW: bind("CreateJobObjectW", PVOID, [PVOID, "str16"]),
+    setInformationJobObject: bind("SetInformationJobObject", "int", [PVOID, "int", PVOID, "uint32"]),
+    openProcess: bind("OpenProcess", PVOID, ["uint32", "int", "uint32"]),
+    assignProcessToJobObject: bind("AssignProcessToJobObject", "int", [PVOID, PVOID]),
+    closeHandle: bind("CloseHandle", "int", [PVOID]),
+    getLastError: bind("GetLastError", "uint32", [])
+  };
+  return cachedBindings;
+}
+function killOnCloseLimitInformation() {
+  const information = Buffer.alloc(JOBOBJECT_EXTENDED_LIMIT_SIZE);
+  information.writeUInt32LE(JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET);
+  return information;
+}
+function daemonJob(bindings) {
+  const existing = jobsByBindings.get(bindings);
+  if (existing !== void 0) return existing;
+  const job = bindings.createJobObjectW(null, null);
+  if (isNullHandle(job)) {
+    throw new Win32JobObjectFailure({
+      step: "CreateJobObjectW",
+      reason: "win32 runtime process ownership could not create the daemon kill-on-close job object",
+      win32Code: bindings.getLastError()
+    });
+  }
+  const information = killOnCloseLimitInformation();
+  if (bindings.setInformationJobObject(job, JobObjectExtendedLimitInformation, information, information.length) === 0) {
+    const win32Code = bindings.getLastError();
+    bindings.closeHandle(job);
+    throw new Win32JobObjectFailure({
+      step: "SetInformationJobObject",
+      reason: "win32 runtime process ownership could not make the daemon job object kill-on-close",
+      win32Code
+    });
+  }
+  jobsByBindings.set(bindings, job);
+  return job;
+}
+async function assignOwnedProcessToJob(pid, options) {
+  const bindings = options?.bindings ?? await loadBindings();
+  const job = daemonJob(bindings);
+  const processHandle = bindings.openProcess(OWNED_PROCESS_ACCESS, 0, pid);
+  if (isNullHandle(processHandle)) {
+    throw new Win32JobObjectFailure({
+      step: "OpenProcess",
+      reason: `win32 runtime process ownership could not open process ${pid} for job assignment`,
+      win32Code: bindings.getLastError()
+    });
+  }
+  try {
+    if (bindings.assignProcessToJobObject(job, processHandle) === 0) {
+      throw new Win32JobObjectFailure({
+        step: "AssignProcessToJobObject",
+        reason: `win32 runtime process ownership could not assign process ${pid} to the daemon kill-on-close job object`,
+        win32Code: bindings.getLastError()
+      });
+    }
+  } finally {
+    bindings.closeHandle(processHandle);
+  }
+}
+var JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, JobObjectExtendedLimitInformation, JOBOBJECT_EXTENDED_LIMIT_SIZE, JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET, PROCESS_SET_QUOTA, PROCESS_TERMINATE, OWNED_PROCESS_ACCESS, Win32JobObjectFailure, cachedBindings, jobsByBindings;
+var init_win32_job_object = __esm({
+  "src/adapters/win32-job-object.ts"() {
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 8192;
+    JobObjectExtendedLimitInformation = 9;
+    JOBOBJECT_EXTENDED_LIMIT_SIZE = 144;
+    JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET = 16;
+    PROCESS_SET_QUOTA = 256;
+    PROCESS_TERMINATE = 1;
+    OWNED_PROCESS_ACCESS = PROCESS_SET_QUOTA | PROCESS_TERMINATE;
+    Win32JobObjectFailure = class extends Error {
+      step;
+      win32Code;
+      constructor(input, options) {
+        super(input.reason, options);
+        this.name = "Win32JobObjectFailure";
+        this.step = input.step;
+        this.win32Code = input.win32Code;
+      }
+    };
+    jobsByBindings = /* @__PURE__ */ new WeakMap();
+  }
+});
 
 // src/runtime-failure.ts
 var RUNTIME_EXECUTION_FAILURE_BRAND = /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeExecutionFailure/v1");
@@ -56,6 +182,48 @@ function isRuntimeExecutionFailure(value) {
   const candidate = value;
   return candidate[RUNTIME_EXECUTION_FAILURE_BRAND] === true && isRuntimeFailurePhase(candidate.phase) && isRuntimeFailureCategory(candidate.category) && isRuntimeRetryDisposition(candidate.retry) && typeof candidate.message === "string" && candidate.message.length > 0;
 }
+var RuntimeStartupDisposalFailure = class extends Error {
+  retryDisposal;
+  constructor(retryDisposal, options) {
+    super("runtime startup failed and process ownership remains quarantined", options);
+    this.name = "RuntimeStartupDisposalFailure";
+    this.retryDisposal = retryDisposal;
+    Object.defineProperty(this, /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeStartupDisposalFailure/v1"), { value: true });
+    Object.freeze(this);
+  }
+};
+function classifyDetectError(error) {
+  const code = error !== null && typeof error === "object" ? error.code : void 0;
+  if (code === "ENOENT") return { kind: "not-found" };
+  if (code === "EACCES" || code === "EPERM" || code === "ENOEXEC") return { kind: "not-executable" };
+  return { kind: "probe-failed" };
+}
+async function probeRuntimeVersion(command, timeoutMs) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new TypeError("invalid runtime probe timeout");
+  return new Promise((resolve) => {
+    let timer;
+    let timedOut = false;
+    try {
+      const child = execFile(command, ["--version"], { encoding: "utf8" }, (error, stdout, stderr) => {
+        if (timer) clearTimeout(timer);
+        if (error?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") resolve({ kind: "probe-failed" });
+        else if (timedOut) resolve({ kind: "timeout" });
+        else if (error) resolve(classifyDetectError(error));
+        else resolve({ kind: "available", stdout, stderr });
+      });
+      timer = setTimeout(() => {
+        timedOut = true;
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        child.kill("SIGKILL");
+      }, timeoutMs);
+      timer.unref?.();
+    } catch (error) {
+      if (timer) clearTimeout(timer);
+      resolve(classifyDetectError(error));
+    }
+  });
+}
 
 // src/types.ts
 function frozenStrings(values) {
@@ -436,6 +604,55 @@ function withOwnedProcessTree(options) {
     ...process.platform === "win32" ? { windowsHide: true } : { detached: true }
   };
 }
+var hostExitTargets = /* @__PURE__ */ new Map();
+var hostExitHandlerInstalled = false;
+function terminateOwnedTreesForHostExit() {
+  for (const target of hostExitTargets.values()) {
+    try {
+      if (target.platform === "win32") {
+        target.spawnSyncFn("taskkill", ["/PID", String(target.pid), "/T", "/F"], {
+          stdio: "ignore",
+          windowsHide: true
+        });
+      } else {
+        target.kill(-target.pid, "SIGKILL");
+      }
+    } catch {
+    }
+  }
+  hostExitTargets.clear();
+}
+function ensureHostExitHandler() {
+  if (hostExitHandlerInstalled) return;
+  hostExitHandlerInstalled = true;
+  process.prependListener("exit", terminateOwnedTreesForHostExit);
+}
+var defaultJobObject = {
+  async assign(pid) {
+    const { assignOwnedProcessToJob: assignOwnedProcessToJob2 } = await Promise.resolve().then(() => (init_win32_job_object(), win32_job_object_exports));
+    await assignOwnedProcessToJob2(pid);
+  }
+};
+async function adoptOwnedProcessTree(options) {
+  const pid = positivePid(options.child, options.label);
+  if (pid === void 0) return;
+  const platform = options.platform ?? process.platform;
+  ensureHostExitHandler();
+  hostExitTargets.set(options.child, {
+    pid,
+    label: options.label,
+    platform,
+    kill: options.killFn ?? defaultKill,
+    spawnSyncFn: options.spawnSyncFn ?? spawnSync
+  });
+  const forget = () => {
+    hostExitTargets.delete(options.child);
+  };
+  options.child.once("close", forget);
+  options.child.once("exit", forget);
+  if (platform !== "win32") return;
+  await (options.jobObject ?? defaultJobObject).assign(pid);
+}
 function positivePid(child, label) {
   const pid = child.pid;
   if (pid === void 0) return void 0;
@@ -647,21 +864,8 @@ async function disposeOwnedProcessTree(options) {
 var STDERR_RING_CAPACITY = 20;
 var DIALOG_UI_METHODS = /* @__PURE__ */ new Set(["select", "confirm", "input", "editor"]);
 var PiRpcClient = class {
-  child;
-  buffer = "";
-  nextId = 1;
-  pending = /* @__PURE__ */ new Map();
-  eventQueue = new AsyncQueue();
-  closed = false;
-  exitError;
-  closedPromise;
-  resolveClosed;
-  disposalAttempt;
-  /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
-  stderrRing = [];
-  /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
-  unmappedFrameCounts = /* @__PURE__ */ new Map();
   constructor(options) {
+    this.options = options;
     const spawnFn = options.spawnFn ?? spawn;
     this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
@@ -671,6 +875,9 @@ var PiRpcClient = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -682,10 +889,37 @@ var PiRpcClient = class {
       this.onClosed(err);
     });
   }
-  /** Send a command, resolved with its correlated `response` message. */
-  send(command) {
+  options;
+  child;
+  buffer = "";
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  eventQueue = new AsyncQueue();
+  closed = false;
+  exitError;
+  closedPromise;
+  resolveClosed;
+  disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts, so it — not the exit code of the kill we ourselves requested — becomes this client's exit error. */
+  adoptionFailure;
+  /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
+  stderrRing = [];
+  /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
+  unmappedFrameCounts = /* @__PURE__ */ new Map();
+  /**
+   * Send a command, resolved with its correlated `response` message.
+   *
+   * Adoption is awaited FIRST — this is `PiAdapter.start()`'s first awaited
+   * operation, so an unbackstopped tree never receives the initial prompt and
+   * never yields a session. The wait costs one settled-promise turn once the
+   * tree is adopted; every later command sees it already resolved.
+   */
+  async send(command) {
+    await this.adopted;
     if (this.closed) {
-      return Promise.reject(this.exitError ?? new Error("pi process is closed"));
+      throw this.exitError ?? new Error("pi process is closed");
     }
     const id = command.id ?? `req-${this.nextId++}`;
     const full = { ...command, id };
@@ -758,6 +992,32 @@ var PiRpcClient = class {
       label: "pi"
     };
   }
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority and the failure is re-thrown, which is what makes the
+   * first `send()` — and therefore `PiAdapter.start()` — fail before any
+   * session is published. Both cleanup attempts are best-effort because the
+   * adoption failure, not a terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "pi",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+  }
   onData(chunk) {
     this.buffer += chunk;
     let newlineIndex = this.buffer.indexOf("\n");
@@ -776,6 +1036,7 @@ var PiRpcClient = class {
     } catch {
       return;
     }
+    this.options.onFrame?.(msg);
     if (msg.type === "response" && typeof msg.id === "string" && this.pending.has(msg.id)) {
       const waiter = this.pending.get(msg.id);
       this.pending.delete(msg.id);
@@ -783,11 +1044,20 @@ var PiRpcClient = class {
       return;
     }
     if (msg.type === "extension_ui_request" && typeof msg.id === "string" && typeof msg.method === "string") {
-      this.respondToExtensionUiRequest(msg.id, msg.method);
+      if (this.options.extensionUi?.mode === "hold") this.options.extensionUi.onRequest(msg);
+      else this.respondToExtensionUiRequest(msg.id, msg.method);
       return;
     }
     this.eventQueue.push(msg);
   }
+  /** Write an explicit host-owned response; completion is a transport receipt only. */
+  async respondExtensionUi(response) {
+    if (this.options.extensionUi?.mode !== "hold") throw new Error("Pi interactions are not host-owned");
+    await this.adopted;
+    if (this.closed) throw new Error("Pi process is closed");
+    await new Promise((resolve, reject) => this.child.stdin.write(`${JSON.stringify({ type: "extension_ui_response", ...response })}
+`, (error) => error ? reject(error) : resolve()));
+  }
   /**
    * Answer pi's extension-UI blocking protocol headlessly (rpc.md's
    * "Extension UI Protocol"). Fail-closed policy, stated explicitly because
@@ -841,9 +1111,10 @@ var PiRpcClient = class {
   onClosed(err) {
     if (this.closed) return;
     this.closed = true;
-    this.exitError = err;
+    const terminal = this.adoptionFailure ?? err;
+    this.exitError = terminal;
     this.resolveClosed();
-    for (const [, waiter] of this.pending) waiter.reject(err);
+    for (const [, waiter] of this.pending) waiter.reject(terminal);
     this.pending.clear();
     this.eventQueue.end();
   }
@@ -877,6 +1148,8 @@ var PROVIDER_CREDENTIAL_ENV_DENY_NAMES = [
   "TOGETHER_API_KEY",
   "BASETEN_API_KEY",
   "KIMI_API_KEY",
+  "HF_TOKEN",
+  "MOONSHOT_API_KEY",
   "MINIMAX_API_KEY",
   "MINIMAX_CN_API_KEY",
   "QWEN_TOKEN_PLAN_API_KEY",
@@ -1001,12 +1274,13 @@ var PiAdapter = class {
   async detect() {
     try {
       const bin = this.resolveBin();
-      const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
-      const version = stdout.trim() || stderr.trim();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim() || probe.stderr.trim();
       const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   async prepare(input) {
@@ -1427,7 +1701,8 @@ var DIST_SCRIPT_BY_KIND = Object.freeze({
   "agent-message-mcp": "byok-agent-message-mcp.js",
   "agent-memory-mcp": "byok-agent-memory-mcp.js",
   "approval-mcp": "byok-approval-mcp.js",
-  "agent-team-mcp": "byok-agent-team-mcp.js"
+  "agent-team-mcp": "byok-agent-team-mcp.js",
+  "mcp-env": "byok-mcp-env.js"
 });
 function assertExecutable(executable) {
   if (!path5.isAbsolute(executable) || /[\u0000\r\n]/u.test(executable)) {
@@ -1445,8 +1720,11 @@ function resolveSdkReservedHelperBin(kind, host) {
       source: "self-executable"
     });
   }
+  const entryDir = path5.dirname(fileURLToPath(import.meta.url));
+  const entryKind = path5.basename(entryDir);
+  const distDir = entryKind === "adapters" || entryKind === "bin" ? path5.dirname(entryDir) : entryDir;
   const script = path5.join(
-    path5.dirname(fileURLToPath(import.meta.url)),
+    distDir,
     "bin",
     DIST_SCRIPT_BY_KIND[kind]
   );
@@ -1753,6 +2031,10 @@ var ClaudeProcessClient = class {
   closedPromise;
   resolveClosed;
   disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts, so it — not the exit code of the kill we ourselves requested — becomes this client's exit error. */
+  adoptionFailure;
   stderrRing = [];
   unmappedFrameCounts = /* @__PURE__ */ new Map();
   sessionId;
@@ -1767,6 +2049,9 @@ var ClaudeProcessClient = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -1810,9 +2095,10 @@ var ClaudeProcessClient = class {
    * same id; if the process already closed before init ever arrived,
    * every call rejects with that same exit error.
    */
-  waitForInit() {
-    if (this.sessionId !== void 0) return Promise.resolve(this.sessionId);
-    if (this.closed) return Promise.reject(this.exitError ?? new Error("claude process is closed"));
+  async waitForInit() {
+    await this.adopted;
+    if (this.sessionId !== void 0) return this.sessionId;
+    if (this.closed) throw this.exitError ?? new Error("claude process is closed");
     return new Promise((resolve, reject) => {
       this.initWaiter = { resolve, reject };
     });
@@ -1876,6 +2162,32 @@ var ClaudeProcessClient = class {
       label: "claude"
     };
   }
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority and the failure is re-thrown, which is what makes
+   * `waitForInit()` — and therefore `ClaudeAdapter.start()` — fail before any
+   * session is published. Both cleanup attempts are best-effort because the
+   * adoption failure, not a terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "claude",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+  }
   onData(chunk) {
     this.buffer += chunk;
     let newlineIndex = this.buffer.indexOf("\n");
@@ -1924,9 +2236,10 @@ var ClaudeProcessClient = class {
   onClosed(err) {
     if (this.closed) return;
     this.closed = true;
-    this.exitError = err;
+    const terminal = this.adoptionFailure ?? err;
+    this.exitError = terminal;
     this.resolveClosed();
-    this.initWaiter?.reject(err);
+    this.initWaiter?.reject(terminal);
     this.initWaiter = void 0;
     this.eventQueue.end();
   }
@@ -2025,14 +2338,15 @@ var ClaudeAdapter = class {
     environmentRequirements: { credentialNames: [] }
   });
   async detect() {
-    const bin = this.resolveBin();
     try {
-      const { stdout } = await execFileAsync2(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS2 });
-      const version = stdout.trim();
+      const bin = this.resolveBin();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS2);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim();
       const authPresent = await this.probeAuthPresent(bin.command);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   async prepare(input) {
@@ -2651,10 +2965,18 @@ function unmappedFrameKey(evt) {
   return evt.type;
 }
 var STDERR_RING_CAPACITY3 = 20;
+var CODEX_MAX_FRAME_BYTES = 1024 * 1024;
+var CODEX_MAX_DEFERRED_BYTES = 4 * 1024 * 1024;
+var CODEX_MAX_STDERR_BYTES = 64 * 1024;
 var CodexProcessRunner = class {
   child;
   onEvent;
-  buffer = "";
+  frameChunks = [];
+  frameBytes = 0;
+  deferredBytes = 0;
+  stderrBytes = 0;
+  transportFailure;
+  onFailure;
   stderrRing = [];
   closed = false;
   exitCode = null;
@@ -2662,18 +2984,34 @@ var CodexProcessRunner = class {
   closedPromise;
   resolveClosed;
   disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts; `buildExitError` reports it instead of the exit status of the kill we ourselves requested. */
+  adoptionFailure;
+  adoption = "pending";
+  /**
+   * Lines parsed before adoption settled. Unlike pi and claude, this runner has
+   * no first awaited operation of its own to gate on — its caller reads the
+   * FIRST event as the authoritative thread id. Holding events until the tree
+   * is backstopped is what keeps that caller from publishing a session for a
+   * tree the job object never took.
+   */
+  deferredEvents = [];
   constructor(options) {
     this.onEvent = options.onEvent;
+    this.onFailure = options.onFailure;
     const spawnFn = options.spawnFn ?? spawn;
     this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: [options.instruction === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
     }));
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
-    this.child.stdout.setEncoding("utf8");
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
     this.child.stderr.on("data", (chunk) => this.onStderr(chunk));
@@ -2682,6 +3020,12 @@ var CodexProcessRunner = class {
       this.exitSignal = signal;
       this.finishClosing();
     });
+    if (options.instruction !== void 0) {
+      this.child.stdin.on("error", () => {
+        this.failTransport("codex prompt stdin failed before delivery");
+      });
+      this.child.stdin.end(options.instruction, "utf8");
+    }
     this.child.on("error", () => {
       this.finishClosing();
     });
@@ -2738,26 +3082,111 @@ var CodexProcessRunner = class {
       label: "codex"
     };
   }
-  /** Builds a descriptive error folding in the exit code/signal and the stderr tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a failed start/resume should never need separately re-running codex by hand with a raw JSONL logger to learn why. */
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority, every parsed line is dropped instead of delivered, and
+   * the resulting close makes the caller's own `waitClosed()` race reject with
+   * the adoption failure (`buildExitError`) before a thread id is published.
+   * Both cleanup attempts are best-effort because the adoption failure, not a
+   * terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "codex",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      this.adoption = "failed";
+      this.deferredEvents.length = 0;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+    this.adoption = "adopted";
+    this.deferredBytes = 0;
+    for (const evt of this.deferredEvents.splice(0)) this.onEvent(evt);
+  }
+  /** Arrival-order delivery, held back until the tree is backstopped (see `deferredEvents`). */
+  deliver(evt, bytes) {
+    if (this.transportFailure) return;
+    if (this.adoption === "failed") return;
+    if (this.adoption === "pending") {
+      if (this.deferredBytes + bytes > CODEX_MAX_DEFERRED_BYTES) {
+        this.failTransport("codex pre-adoption event buffer exceeded its byte budget");
+        return;
+      }
+      this.deferredBytes += bytes;
+      this.deferredEvents.push(evt);
+      return;
+    }
+    this.onEvent(evt);
+  }
+  /**
+   * Builds a descriptive error folding in the exit code/signal and the stderr
+   * tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a
+   * failed start/resume should never need separately re-running codex by hand
+   * with a raw JSONL logger to learn why.
+   *
+   * A tree this runner could not backstop is the one exception: that process
+   * exited because THIS runner killed it, so `exit code=null, signal=SIGKILL`
+   * plus an empty stderr tail would bury the only reason anyone can act on.
+   */
   buildExitError(context) {
+    if (this.transportFailure) return this.transportFailure;
+    if (this.adoptionFailure !== void 0) return this.adoptionFailure;
     const parts = [`${context} (exit code=${this.exitCode}, signal=${this.exitSignal})`];
     if (this.stderrRing.length > 0) {
       parts.push(`stderr: ${this.stderrRing.join(" | ")}`);
     }
     return new Error(parts.join("; "));
   }
-  onData(chunk) {
-    this.buffer += chunk;
-    let newlineIndex = this.buffer.indexOf("\n");
-    while (newlineIndex !== -1) {
-      let line = this.buffer.slice(0, newlineIndex);
-      this.buffer = this.buffer.slice(newlineIndex + 1);
-      if (line.endsWith("\r")) line = line.slice(0, -1);
-      if (line.length > 0) this.parseLine(line);
-      newlineIndex = this.buffer.indexOf("\n");
-    }
+  failTransport(reason) {
+    if (this.transportFailure) return;
+    this.transportFailure = new RuntimeExecutionFailure({
+      phase: "run",
+      category: "infrastructure",
+      retry: "non-retryable",
+      reason
+    });
+    this.frameChunks.length = 0;
+    this.frameBytes = 0;
+    this.deferredEvents.length = 0;
+    this.deferredBytes = 0;
+    this.onFailure?.(this.transportFailure);
+    this.kill();
   }
-  parseLine(line) {
+  onData(chunk) {
+    if (this.transportFailure) return;
+    let offset = 0;
+    while (offset < chunk.length) {
+      const newline = chunk.indexOf(10, offset);
+      const end = newline === -1 ? chunk.length : newline;
+      const bytes = end - offset;
+      if (this.frameBytes + bytes > CODEX_MAX_FRAME_BYTES) {
+        this.failTransport("codex raw JSONL frame exceeded its byte budget");
+        return;
+      }
+      if (bytes > 0) this.frameChunks.push(Buffer.from(chunk.subarray(offset, end)));
+      this.frameBytes += bytes;
+      if (newline === -1) return;
+      const frame = Buffer.concat(this.frameChunks, this.frameBytes);
+      this.frameChunks.length = 0;
+      this.frameBytes = 0;
+      const line = frame.toString("utf8").replace(/\r$/, "");
+      if (line.length > 0) this.parseLine(line, frame.length);
+      if (this.transportFailure) return;
+      offset = newline + 1;
+    }
+  }
+  parseLine(line, bytes) {
     let parsed;
     try {
       parsed = JSON.parse(line);
@@ -2767,14 +3196,18 @@ var CodexProcessRunner = class {
     if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
       return;
     }
-    this.onEvent(parsed);
+    this.deliver(parsed, bytes);
   }
   onStderr(chunk) {
-    for (const rawLine of chunk.split("\n")) {
+    const bounded = Buffer.from(chunk).subarray(-CODEX_MAX_STDERR_BYTES).toString("utf8");
+    for (const rawLine of bounded.split("\n")) {
       const line = rawLine.trim();
       if (line.length === 0) continue;
       this.stderrRing.push(line);
-      if (this.stderrRing.length > STDERR_RING_CAPACITY3) this.stderrRing.shift();
+      this.stderrBytes += Buffer.byteLength(line);
+      while (this.stderrRing.length > STDERR_RING_CAPACITY3 || this.stderrBytes > CODEX_MAX_STDERR_BYTES) {
+        this.stderrBytes -= Buffer.byteLength(this.stderrRing.shift());
+      }
     }
   }
 };
@@ -2807,14 +3240,15 @@ var CodexAdapter = class {
     environmentRequirements: { credentialNames: [] }
   });
   async detect() {
-    const bin = this.resolveBin();
     try {
-      const versionResult = await execFileAsync3(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS3 });
-      const version = versionResult.stdout.trim() || versionResult.stderr.trim();
+      const bin = this.resolveBin();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS3);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim() || probe.stderr.trim();
       const authPresent = await this.probeAuthPresent(bin);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   /**
@@ -2957,7 +3391,7 @@ ${withStreams.stderr ?? ""}`);
         reason: "prepared codex operation received a manifest with different runtime selection"
       });
     }
-    const mcpConfigArgs = codexMcpConfigArgs(startInput.mcpServers, preparedMcpGrants);
+    const mcpConfigArgs = codexMcpConfigArgs(startInput.mcpServers, runtimeEnv, this.options.sdkHelperHost, preparedMcpGrants);
     const { sessionRef, runner } = await runCodexTurn({
       command,
       resumeRef: startInput.manifest.sessionRef,
@@ -2973,6 +3407,7 @@ ${withStreams.stderr ?? ""}`);
       expectedSessionRef: startInput.manifest.sessionRef,
       preparedGit: startInput.manifest.workspace.workspaceId !== void 0,
       failurePhase: "start",
+      signal: startInput.signal,
       terminal
     });
     return new CodexSession({
@@ -2980,6 +3415,7 @@ ${withStreams.stderr ?? ""}`);
       command,
       workspaceDir,
       env: startInput.env,
+      mcpEnvironment: Object.fromEntries(Object.entries(runtimeEnv).filter(([key]) => key.startsWith("BYOK_MCP_PAYLOAD_"))),
       spawnFn: this.options.spawnFn,
       queue,
       recordUnmapped,
@@ -3032,16 +3468,18 @@ function codexMcpToolApprovalArgs(name, tools) {
   }
   return args;
 }
-function codexMcpConfigArgs(servers, grants = []) {
+function codexMcpConfigArgs(servers, env, helperHost, grants = []) {
   if (servers === void 0 || Object.keys(servers).length === 0) return [];
   const grantedTools = new Map(grants.map((grant) => [grant.server, grant.tools]));
   const args = ["--ignore-user-config"];
   for (const [name, server] of Object.entries(servers).sort(([left], [right]) => left.localeCompare(right))) {
-    args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(server.command)}`);
-    if (server.args !== void 0) args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...server.args])}`);
-    for (const [key, value] of Object.entries(server.env ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
-      args.push("-c", `mcp_servers.${name}.env.${key}=${JSON.stringify(value)}`);
-    }
+    const key = `BYOK_MCP_PAYLOAD_${randomBytes(16).toString("hex").toUpperCase()}`;
+    env[key] = JSON.stringify(server);
+    const helper = resolveSdkReservedHelperBin("mcp-env", helperHost);
+    args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(helper.command)}`);
+    args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...helper.args])}`);
+    args.push("-c", `mcp_servers.${name}.env.BYOK_MCP_ENV_KEY=${JSON.stringify(key)}`);
+    args.push("-c", `mcp_servers.${name}.env_vars=${JSON.stringify([key])}`);
     const granted = grantedTools.get(name);
     if (granted !== void 0) args.push(...codexMcpToolApprovalArgs(name, granted));
   }
@@ -3069,7 +3507,7 @@ function buildArgv(resumeRef, policyArgs, instruction, modelId, preparedGit = fa
     ...modelId ? ["--model", modelId] : [],
     ...preparedGit ? [] : ["--skip-git-repo-check"],
     ...policyArgs,
-    instruction
+    "-"
   ];
 }
 async function runCodexTurn(params) {
@@ -3093,9 +3531,18 @@ async function runCodexTurn(params) {
     runner = new CodexProcessRunner({
       command: params.command,
       args: argv,
+      instruction: params.instruction,
       cwd: params.cwd,
       env: params.env,
       spawnFn: params.spawnFn,
+      onFailure: (failure) => {
+        if (!firstLineSettled) {
+          firstLineSettled = true;
+          rejectFirstLine(failure);
+        }
+        params.terminal.failure = failure;
+        params.queue.end();
+      },
       onEvent: (evt) => {
         if (!firstLineSettled) {
           firstLineSettled = true;
@@ -3162,6 +3609,16 @@ async function runCodexTurn(params) {
     params.queue.end();
   });
   let sessionRef;
+  const abortStartup = () => rejectFirstLine(new RuntimeExecutionFailure({
+    phase: params.failurePhase,
+    category: "infrastructure",
+    retry: "non-retryable",
+    reason: "codex startup cancelled or exceeded its deadline"
+  }));
+  const startupTimer = setTimeout(abortStartup, 3e4);
+  startupTimer.unref?.();
+  params.signal?.addEventListener("abort", abortStartup, { once: true });
+  if (params.signal?.aborted) abortStartup();
   try {
     sessionRef = await new Promise((resolve, reject) => {
       let settled = false;
@@ -3193,20 +3650,31 @@ async function runCodexTurn(params) {
       });
     });
   } catch (err) {
-    runner.kill();
+    await disposeFailedStartup(runner, err);
     throw err;
+  } finally {
+    clearTimeout(startupTimer);
+    params.signal?.removeEventListener("abort", abortStartup);
   }
   if (params.expectedSessionRef !== void 0 && sessionRef !== params.expectedSessionRef) {
-    runner.kill();
-    throw new RuntimeExecutionFailure({
+    const failure = new RuntimeExecutionFailure({
       phase: params.failurePhase,
       category: "authority",
       retry: "non-retryable",
       reason: `codex exec resume echoed a different thread id than requested (requested ${params.expectedSessionRef}, got ${sessionRef})`
     });
+    await disposeFailedStartup(runner, failure);
+    throw failure;
   }
   return { sessionRef, runner };
 }
+async function disposeFailedStartup(runner, cause) {
+  try {
+    await runner.dispose();
+  } catch (disposalFailure) {
+    throw new RuntimeStartupDisposalFailure(() => runner.dispose(), { cause: new AggregateError([cause, disposalFailure]) });
+  }
+}
 var CodexSession = class {
   /**
    * NOT `readonly` (cross-model review finding): `followUp()` below
@@ -3242,6 +3710,7 @@ var CodexSession = class {
    * recomputed from anything a later turn supplies, so a follow-up can never
    * widen this session's MCP authority.
    */
+  mcpEnvironment;
   mcpConfigArgs;
   terminal;
   currentRunner;
@@ -3261,6 +3730,7 @@ var CodexSession = class {
     this.modelId = options.modelId;
     this.terminal = options.terminal;
     this.mcpConfigArgs = options.mcpConfigArgs;
+    this.mcpEnvironment = Object.freeze({ ...options.mcpEnvironment });
     this.currentRunner = options.initialRunner;
     this.ownedRunners.add(options.initialRunner);
     void this.forgetRunnerOnceClosed(options.initialRunner);
@@ -3373,7 +3843,7 @@ var CodexSession = class {
         // frozen MCP config replayed verbatim — see `mcpConfigArgs`.
         policyArgs: [...mapping.args, ...this.mcpConfigArgs],
         cwd: this.workspaceDir,
-        env: withoutProviderCredentials(this.env),
+        env: { ...withoutProviderCredentials(this.env), ...this.mcpEnvironment },
         spawnFn: this.spawnFn,
         workspaceDir: this.workspaceDir,
         queue: this.queue,
@@ -3472,6 +3942,6 @@ function subscriptionModel2(selection) {
   return selection.modelId;
 }
 
-export { ClaudeAdapter, CodexAdapter, PI_PACKAGE_NAME, PiAdapter, RuntimeDisposalFailure, RuntimeExecutionFailure };
+export { ClaudeAdapter, CodexAdapter, PI_PACKAGE_NAME, PiAdapter, RuntimeDisposalFailure, RuntimeExecutionFailure, RuntimeStartupDisposalFailure };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map