@ckanner/flywheel 0.32.1 → 0.33.0

package/node_modules/dsh-subagent-codex-pro/docs/machine-lifecycle.zh.md

@@ -0,0 +1,98 @@
+# 结构化生命周期与只读恢复（lifecycle 1）
+
+本契约在 **0.9.0 未发布源码候选**中实现。公开
+`dsh-subagent-codex-pro/machine` 结果协议仍为 1；lifecycle 是另行版本化的
+JavaScript 能力。单 JSON 输入的 CLI 与原 DSH Host/tool 输出保持原有方式。
+
+## 显式启用
+
+`runMachine(request, options)` 新增 `onLifecycle(event)` 与
+`recoveryDirectory`。回调是程序持久化确认：Go 等调用者原子保存并 fsync 自己的
+检查点之后才 resolve，失败则 reject；它不增加用户审批步骤。恢复目录必须是
+现存物理父目录下的**全新绝对路径**，不是别名、符号链接或已有目录。每次 engine
+invocation 使用自己的路径，不能按 thread ID 反复复用。目录存在会拒绝执行，
+不会读取其中的 requestId 后自动重放。
+
+任一选项启用后，独立进程组中的 machine supervisor 持有 native runner 与最终
+持久化职责，先建立 IPC lifeline，再开始工作。调用者或其整个进程组被强杀时，
+supervisor 拒绝正在等待的 ACK，取消原调用，等已有 Codex guardian 收束 native
+进程组后保存实际回执。关闭进程本身不证明模型任务成功。
+
+```js
+import { runMachine, recoverMachine } from 'dsh-subagent-codex-pro/machine'
+const receipt = await runMachine(request, {
+  recoveryDirectory,
+  signal: controller.signal,
+  onLifecycle: event => engine.persistCheckpointAndFsync(event),
+})
+// 重启后使用自己已经保存的明确 runId；不扫描“最近一次”历史。
+const recovered = await recoverMachine({
+  protocol: 1, requestId: request.requestId,
+  runId: savedCheckpoint.runId, recoveryDirectory,
+})
+```
+
+`MACHINE_LIFECYCLE_VERSION=1`；公开 capability 为 `{version:1,
+ durableJournal:true, readOnlyRecovery:true, threadReadyBeforeDispatch:true}`。
+能力声明不等于当前账号、历史或机器已通过真实验收。
+
+## 事件与证据强度
+
+每个事件含 `lifecycleVersion:1`、`type:'lifecycle'`、`requestId`、`runId`、
+从 1 连续递增的 `sequence`、`event`、`threadId`、`turnId`、`persistent`、
+`configuration`、`dispatch`、`outcome`、`cleanupConfirmed`。
+`persistent` 表示请求的历史模式，不能证明空 thread 已有可恢复 rollout。
+配置对象保留真实 start/resume 来源、请求与有效配置、完整 sandbox policy 和
+匹配结果。新 thread 的 `ephemeral` 必须由后端显式布尔值证明并与请求匹配；
+resume 则必须被接受且有效 overrides 匹配。历史默认 effort 不冒充本 turn 的实际值。
+
+| 事件 | 实际含义 |
+| --- | --- |
+| `thread-ready` | thread 与有效配置已核对，新 turn 尚未发送；等待调用者持久化 ACK。 |
+| `dispatch-intent` | 准备提交这一明确 turn，仍未发送；等待 ACK。 |
+| `dispatch-possible` | 在实际写入 turn 请求前保存并等待 ACK；发送与确认之间仍可能不确定。 |
+| `turn-accepted` | 匹配的 turn/start 响应给出本次 turn ID；只是接受，不是完成。 |
+| `terminal` | native 结果与清理事实已形成；请求 journal 时，完整原始回执已先 fsync。 |
+| `cleanup-confirmed` | 只有实际确认 native 清理后才发；调用者可保存原调用的候选／guard／报告证据再 ACK。 |
+
+终态通知在 native 收尾后交付，不声称更早的流式 terminal。两个终态事件携带同一
+最终事实。原成功回执保存后，即使终态通知或 ACK 丢失，也不会把已完成的 native
+调用改写成 cancelled。启动失败可以没有 thread-ready 而直接交付失败终态。
+
+`execution.dispatch` 与事件分别表达 not-dispatched、possible、accepted。
+possible 屏障拒绝时，即使测试观察到请求尚未写出，也保留 possible，不能靠错误
+文本认领“零消耗／可重试”。进程清理完成不使 unknown 业务结果变成成功。
+原调用 deadline 仍限制 native 启动和前置屏障；supervisor admission 及每次 ACK
+另有 10 秒上限。调用者断开会立即拒绝 pending waiter，不会让清理无限等回调。
+
+## 持久化与只读核对
+
+supervisor 独占创建 0700 目录；0600 记录写入独占临时文件，fsync 后原子 rename，
+再 fsync 目录。新建目录的父目录也 fsync。记录有精确 request/run 身份和 SHA-256
+完整性校验；它是运行证据，不写 Go 的 state、预算或候选决策。
+
+`recoverMachine` 只读取调用者给定且身份匹配的一个 journal。它不启动 CLI、不发
+网络请求、不 resume、不查账号历史、不杀进程、不写文件、不重跑模型。必须给出
+已知 runId；PID 是否存在不能证明进程所有权、清理或成功。
+
+| status | 可以得出的结论 |
+| --- | --- |
+| terminal | 返回原始完整 receipt。仍须检查配置、业务结果、独立 cleanup 与用量；它可能是失败或 unknown。 |
+| pending | journal 身份正确，但没有持久化终态；不证明 owner 还活着、turn 仍运行或重放安全。 |
+| unknown | 缺失、不可读、损坏或身份不匹配；不猜派发和清理事实。 |
+
+最新 `lifecycle` 在交付调用者**之前**落盘，所以它存在不证明 Go 已 ACK。只有 Go
+自己的检查点能证明原清理边界的 candidate／guard／报告已保存；缺少这个证据时，
+可以核对原消耗，不能重启后重采当前工作区当作旧验证。调用者死亡后通常可读到
+supervisor 后续回执；若 supervisor 也在回执落盘前死亡，guardian 可能完成物理
+清理，但结果仍必须保持未知。未知 runId、双 supervisor 丢失、逃离进程组或断电
+超出 fsync 保证，都不构成 exactly-once。requestId 只是关联标识，不是幂等键。
+
+调用者负责保留期限与删除：先完成一次且仅一次的状态应用／计量并满足审计期限，
+再清理证据。不得通过删 journal 绕过 unknown。插件不自动扫历史或后台删档。
+环境凭证不会被复制到记录中；原始模型输出可能包含用户敏感内容，仍须按任务的
+私有证据和保留策略处理。
+
+离线测试使用真实子进程验证 ACK、拒绝、损坏、独占、只读、整组 SIGKILL、终态
+通知丢失及真实安装包入口；没有把这些测试冒充真实账号、缓存、质量或费用测量。
+详见[验收记录](machine-lifecycle-validation.md)。

package/node_modules/dsh-subagent-codex-pro/docs/machine.md

@@ -0,0 +1,194 @@
+# Machine API and CLI (protocol 1)
+
+Version 0.8.0 introduced a public entry for orchestrators that need the complete outcome
+without a DSH parent Agent. It uses the same app-server runner, configuration
+checks, usage tracker and process guardian as the DSH provider and tool.
+
+The **0.9.0 unreleased source candidate** adds [typed lifecycle and read-only
+recovery](machine-lifecycle.md) ([中文](machine-lifecycle.zh.md)). The result protocol
+remains 1. The single-document CLI remains terminal-only; durable ACKs use the
+JavaScript API. Existing DSH callers do not opt into this additional supervisor.
+
+## Install and inspect
+
+After 0.8.0 is published:
+
+```sh
+npm install dsh-subagent-codex-pro@0.8.0
+npx --no-install codex-pro-machine --capabilities
+```
+
+For a source checkout, build and pack it, then install that tarball in a
+separate test project. A checkout is not evidence that npm has this version.
+Node 22.18+ is required. The Codex executable and its normal authentication must
+already be available; this package neither installs Codex nor copies credentials.
+Use an absolute command path when a desktop process has a different PATH.
+
+`--capabilities` and `--version` are offline and do not spawn Codex. The package
+exports `dsh-subagent-codex-pro/machine`; importing private source files is not a
+supported integration.
+
+## One request, one receipt
+
+Write a single JSON document to stdin and close stdin:
+
+```json
+{
+  "protocol": 1,
+  "requestId": "task-42-attempt-1",
+  "prompt": "Implement the approved task in this worktree and write its required report.",
+  "cwd": "/absolute/path/to/task-worktree",
+  "model": "gpt-6.1-sol",
+  "effort": "high",
+  "permissionMode": "workspace-write",
+  "timeoutMs": 600000
+}
+```
+
+```sh
+npx --no-install codex-pro-machine --json < request.json > receipt.json
+```
+
+The required fields are protocol, requestId, prompt, cwd, model, effort and
+permissionMode. Machine calls always name their model and permission explicitly.
+Optional fields are command, timeoutMs, maxOutputBytes, threadMode, threadId,
+images and outputSchema. Unknown fields fail before a process starts. The CLI
+limits the entire request to 1 MiB. The runner limits stdout and diagnostic bytes
+to 32 MiB by default; exceeding the configured positive maxOutputBytes stops the
+run and sets execution.truncated instead of accepting a partial answer.
+
+Permissions are read-only, workspace-write (approvalPolicy=never), or the
+explicit dangerously-bypass-approvals-and-sandbox mode. The machine API does not
+accept ambiguous legacy never/approve-for-me modes. Cwd is a directory, not proof
+of a sandbox: inspect the complete returned sandboxPolicy, including writable
+roots and network settings, against the caller's requirements.
+
+The default thread is ephemeral. A resumed thread must be persistent; threadId
+never silently changes to a new thread after failure. Execute and independent review must have separate role histories. The owning
+orchestrator may explicitly resume each role within its scope. Orchestrators
+own retries, compatibility, durable task state and current-candidate validation.
+
+The CLI prints exactly one JSON object on stdout. App-server diagnostics may go
+to stderr. Exit 0 means a completed turn and confirmed cleanup; exit 1 means a
+failed run or a consumer that closed stdout; exit 2 an invalid input envelope.
+130/143 can accompany the result-shaped cancellation receipt when a signal is
+observed during the run, or the `type: error` envelope when the signal arrives
+before a request/run exists (for example while reading stdin). Inspect the
+envelope; do not infer success from a text message or exit code alone.
+
+## JavaScript API
+
+```js
+import { runMachine } from 'dsh-subagent-codex-pro/machine'
+
+const controller = new AbortController()
+const receipt = await runMachine(request, { signal: controller.signal })
+if (!receipt.ok) {
+  // Preserve the receipt and report failure to the owning orchestrator.
+}
+```
+
+`parseMachineRequest` validates untrusted input. `runMachine` rejects invalid
+input with MachineInputError; ordinary run failures preserve receipts. A failed
+supervisor or journal can reject without a terminal handoff: callers must recover
+known durable evidence and otherwise remain blocked. Options may supply a trusted
+env override, onProgress, awaitable onLifecycle, and a new recoveryDirectory; environment values and prompts
+are never copied into the receipt's requested-configuration fields.
+
+## Receipt contract
+
+The envelope contains protocol=1, type=result, caller requestId, a per-attempt
+runId, ok, requested, outcome or failure, costUSD=null and costStatus=unknown.
+An invalid CLI input instead produces type=error with INVALID_REQUEST/INPUT_ERROR
+and exit 2. It is not a started run.
+
+| Field | Meaning |
+|---|---|
+| outcome.output / structured | Unmodified model text and separately validated JSON; no persistent-thread marker appended |
+| outcome.configuration | requested/effective, source, missing fields, mismatches, matched and full observed sandboxPolicy |
+| outcome.turnConfiguration | Requested effort and whether turn/start accepted it; effectiveEffort stays null because the protocol does not echo it |
+| outcome.execution | run/thread/turn IDs, timestamps, elapsed duration, direct-child/driver pid (the installed Codex launcher may have a native server child), mirrored exit/signal, supervisor facts, timeout/cancel/truncation/spawn/failure facts |
+| outcome.approvalDiagnostic | Bounded package-generated unattended approval/sandbox note; never raw server output or task text |
+| outcome.cleanup | Confirmation of the owned process range's disappearance, with a reason when unconfirmed |
+| outcome.usage | complete/partial/unknown; attributable run delta and thread totals, never summed cumulative snapshots |
+| outcome.rateLimits | Account limits, separate from token usage and cost |
+| failure | Startup stage/category plus available execution/configuration/usage/cleanup observations |
+
+Missing observations remain null/unknown. A malformed usage event, counter
+rollback or uncertain baseline prevents a complete usage claim. Subscription
+authentication does not establish a dollar price or unlimited quota.
+
+## Cancellation and process ownership
+
+On POSIX the caller starts a guardian as a new process-group leader with an IPC
+lifeline established during spawn. Codex and its ordinary descendants share
+that group; they do not inherit the lifeline. The live caller owns normal
+cleanup and checks that the group is gone. A live caller's SIGTERM/SIGINT stops
+the guardian as soon as the app-server exits, so clean runs do not wait out the
+full dispose grace. If the caller dies, including SIGKILL, IPC disconnect makes
+the guardian retain the full grace and terminate its own group. There is no
+later PID-registration window, name-based kill or ancestor-group kill.
+
+The receipt distinguishes the direct child/driver process from its supervisor.
+The installed Codex launcher may spawn the native app-server as its own child;
+the reported exit/signal are mirrored launcher facts, not a claim that the
+native server is the same PID. A successful turn may be followed by an
+intentional TERM/KILL to close a long-lived app-server. execution.terminationRequested records that cleanup action; it is
+not a caller cancellation. If the last escalation prevents an actual Codex exit
+message from arriving, its exitCode/signal remain null even if the group is gone.
+No supervisor exit is rewritten as a Codex exit 0. An unconfirmed cleanup cannot
+produce a successful outcome, and DSH dispose rejects it.
+
+If the caller cannot signal or confirm its group, it releases its own pipes and
+IPC lifeline after the cleanup deadline so a failed run does not keep the caller
+alive indefinitely. The guardian can then attempt its independent cleanup. The
+receipt retains cleanup.confirmed=false and unknown process facts; that later
+attempt is not evidence that the original cleanup succeeded.
+
+A signal error also does not invalidate a later independent absence check.
+Darwin can return EPERM while a group still exists but its members are being
+reaped; the [XNU implementation](https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/kern/kern_sig.c#L1675-L1721)
+filters zombie members. EPERM remains unknown and is retried within the same
+cleanup budget. Only a later ESRCH confirms the owned group is gone.
+
+Machine execution requires POSIX and rejects Windows before spawning Codex;
+capabilities reports supported=false there. Processes that deliberately escape
+with a new session/group require a stronger external containment boundary. The
+legacy Windows Host adapter controls a direct process and reports owned-process;
+it must not be advertised as the POSIX group guarantee. Without lifecycle/journal options, a killed caller cannot write a final receipt.
+With them, the independent machine supervisor can finish native cleanup and save
+the actual receipt. Losing that supervisor too can still leave unknown facts;
+read-only recovery never guesses them from a PID or starts a replacement turn.
+
+## DSH and Flywheel compatibility
+
+The DSH adapter follows the rc.5 Host result contract: output, structured,
+diagnostic and stopReason. Its diagnostic is bounded metadata, not raw server
+output. Host capabilities are agentOptions, agentPreset=false, outputSchema and
+depthLimit=false. Unsupported provider/maxTokens overrides fail explicitly.
+Host job results remain strings. These narrow Host shapes do not carry the full
+machine receipt; use this public entry when that receipt is required.
+
+DSH Mac rc.5's SDK has no external-subagent/start RPC. Host startActivation needs
+a real live parent Agent. An orchestrator should call this machine entry instead
+of inventing a parent or treating codex-pro as a DSH LLM provider.
+
+The original 0.8.0 integration baseline was Flywheel 0.27.3. A downstream consumer must implement a
+separate driver, pass the worktree/model/effort/permission/deadline/request ID,
+validate the receipt and sandbox policy, preserve unknown usage and physical
+facts, and retain Go ownership of reports, tests, retries, commits and budgets.
+Changing a provider string alone does not implement that consumer.
+
+## Verification and source baselines
+
+The default tests are offline and use real scripted child processes. CI covers
+Ubuntu/macOS with Node 22/24, then installs an actual npm tarball and tests the
+public export, installed CLI and compiled guardian. Live model tests require
+CODEX_SUBAGENT_LIVE=1. The 0.8.0 live app-server cases pass on Codex 0.165.0;
+this is not a claim that the user's DSH Desktop profile has loaded the package.
+
+- [DSH rc.5 Host types](https://github.com/deepseek-ai/deepseek-harness/blob/b830ec950faba0a46dda564be3e2d854afed94f1/packages/subagent/subagent/src/types.ts)
+- [DSH rc.5 SDK requests](https://github.com/deepseek-ai/deepseek-harness/blob/b830ec950faba0a46dda564be3e2d854afed94f1/packages/sdk/protocol/src/types.ts)
+- [Codex 0.166 ThreadStartResponse](https://github.com/openai/codex/blob/rust-v0.166.0/codex-rs/app-server-protocol/schema/typescript/v2/ThreadStartResponse.ts)
+- [Codex 0.166 TurnStartResponse](https://github.com/openai/codex/blob/rust-v0.166.0/codex-rs/app-server-protocol/schema/typescript/v2/TurnStartResponse.ts)
+- [Codex app-server documentation](https://learn.chatgpt.com/docs/app-server)

package/node_modules/dsh-subagent-codex-pro/docs/orchestration.zh.md

@@ -0,0 +1,86 @@
+# Flywheel 接入、需求准备与 Git 交付
+
+本文区分插件能力与下游流程。0.8.0 提供 machine API/CLI；当前 0.9.0 源码候选
+新增[可等待检查点与只读恢复](machine-lifecycle.zh.md)。原始接入分析的下游基线是
+Flywheel 0.27.3；当前 Flywheel 的 driver、范围会话与恢复能力以其对应 PR 为准。
+安装本插件本身不修改下游绑定，也不证明下游已经使用新能力。
+本仓库 PR 不会替下游修改路由、推送业务代码、合并 main 或发布产品。
+
+## 建议的接入方式
+
+Go 引擎 → codex-pro-machine → 本包运行核心 → Codex app-server。
+
+DSH 桌面仍是任务控制面，Go 持有任务状态、重试、预算、worktree、验收和 Git
+交付。完整 Codex harness 由本包复用。复杂实现和需要 Codex 工具链的审查适合
+这条通路；DSH 原生 Flash/GPT 路线仍可保留，不需要统一改成 Codex。
+
+SDK rc.5 没有 external-subagent/start；Host 的 startActivation 要求真实父 Agent。
+为调用 Codex 再启动一个父模型会增加一次模型循环，也不自动补足运行收据。
+正式 machine 入口可以避免这个依赖，同时保留 requested/effective、usage、
+取消、进程终态和清理证据。具体协议、失败行为与限制见 [machine.md](machine.md)。
+
+下游必须实际实现 driver/worker、配置绑定、无推理诊断和跨进程回归，才能宣布
+已经接通。它应校验协议版本、request/run 关联、实际sandbox policy及完成事实，
+不能只判断 exit 0。正常 turn 后关闭长驻 app-server 的信号与调用方取消须分别处理。
+
+## 需求准备选什么模型
+
+这里是工程建议，不是经过本项目实测的模型排名：
+
+| 场景 | 建议起点 | 原因 |
+|---|---|---|
+| 跨模块、架构约束多或需求不清楚 | GPT-6 Astra / high | 需求范围、接口和验收错误会传递到所有执行单元，优先投入判断与推理 |
+| 范围清楚的日常功能或修复 | GPT-6.1 Sol / high | 在代码理解、约束梳理与响应成本之间取折中 |
+| 单文件、小改动、已有清晰验收 | 当前 Flash 或 Sol 的常用配置 | 先验证是否足够，避免所有小任务都承担最高推理开销 |
+
+初始 flywheel-new skill 使用宿主当前会话模型，不会自动切换到 loops.plan。
+先在 DSH 选择支持工具调用的实际 provider/model；只选它实际支持的思考等级。
+需求冻结后的运行中 Plan 仍按 Flywheel 配置，可以继续使用 Kimi CLI/high。
+复杂需求可以让一个不同模型只读评审 Spec、边界和验收矩阵，但不默认反复多模型会审。
+
+high 是建议基线。xhigh/max 应由代表性任务的质量增益、时间和额度决定，不能
+仅凭“更高”就视为更优。API 支持某个等级，不等于当前 DSH adapter 暴露了它。
+账户实际可用模型以本人的模型目录和授权为准；订阅额度也不等于无限调用。
+
+依据：[OpenAI 模型指南](https://developers.openai.com/api/docs/guides/latest-model)、
+[reasoning 与部署检查](https://developers.openai.com/api/docs/guides/deployment-checklist)。
+
+## Worktree 与 PR 的建议时机
+
+1. 从最新目标分支创建一个任务 feature branch 和独立 worktree。一个可独立
+   交付的任务或里程碑对应一个 PR，避免每个内部 packet 都生成一个零碎 PR。
+2. 在这个 worktree 中调研并准备 Spec/packets，审阅范围、测试和保护边界。
+   已有有意义的提交后尽早开 Draft PR，让变更可见并启动远端 CI。
+3. 让 Flywheel 的 cwd 指向该 feature worktree。它内部的 packet worktree
+   提交汇回这个 feature branch；本地“主 checkout”不应被误解为 main 分支。
+4. 持续保存和推送可审查的检查点。全部 L1/L2/L3、独立评审与 Git 持久化完成，
+   并且远端 CI 对应当前提交通过后，再将 PR 标记 Ready。
+5. 默认保留最终合并决策。用户已明确授权该任务自动合并时，可以启用 GitHub
+   auto-merge，让 required checks/reviews 和分支保护决定真正的合并时机。
+   多人频繁合并的仓库可用 merge queue；工作流需要支持 merge_group 事件。
+6. 合并后核对目标分支 CI；发布/部署有自己的门禁与授权，不由本地 completed
+   状态隐式触发。
+
+worktree 解决工作区与 index 相互干扰，不是权限沙箱；仍要设置执行边界。
+Draft、Ready、Merged、Published 是不同状态。模型说完成、某次测试绿灯、
+Flywheel 的 local completed，都不能直接充当“允许合并 main”的判断。
+
+你提到的 [mattpocock/skills](https://github.com/mattpocock/skills) 也可以作为
+准备和审查方法的参考：当前 `to-spec` 整理已知需求与测试边界，`to-tickets`
+按可独立验证的端到端行为拆分任务并明确依赖，`implement-spec` 使用 integration
+branch、独立 worktree 和 Draft PR。Flywheel 可以吸收这些方法；运行时状态与
+提交仍由 Go 持有，避免同时引入第二套编排状态机。
+
+依据：
+
+- [Git worktree](https://git-scm.com/docs/git-worktree)
+- [GitHub Draft PR](https://docs.github.com/en/pull-requests/reference/pull-requests)
+- [GitHub auto-merge](https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/automatically-merging-a-pull-request)
+- [受保护分支](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches)
+
+## 覆盖率与真实验收
+
+要求100%覆盖率时，应在项目实际测试工具里配置门禁，并写进任务包的L1命令。
+覆盖率数值不能证明断言正确，还要审查边界案例、错误路径、集成与用户流程。
+冻结验收不能由执行者削弱；真实模型、账号、桌面UI与系统沙箱的验证独立记录，
+不能用fake app-server、DOM测试或CI runner代替用户机器结果。

package/node_modules/dsh-subagent-codex-pro/lib/codex-exec.js

@@ -0,0 +1,68 @@
+/**
+ * The `codex exec` command line, built and run.
+ *
+ * This module is deliberately free of harness types: the whole probe rests on
+ * whether a plugin can register a subagent provider at all, so the part that
+ * talks to Codex stays independently testable. It also keeps the plugin free of
+ * runtime dependencies — the failure mode we are looking for is the provider
+ * chain, not module resolution.
+ *
+ * @module dsh-subagent-codex-pro/codex-exec
+ */
+/**
+ * Build the argv for one run.
+ *
+ * The prompt goes on stdin (`-`) rather than argv: delegated prompts are long and
+ * routinely contain quotes, newlines, and shell metacharacters.
+ *
+ * @param options - the run's inputs.
+ * @returns the argv to spawn, without the program name.
+ */
+export function buildCodexExecArgv(options) {
+    const argv = ['exec', '-C', options.cwd, '--skip-git-repo-check'];
+    if (options.model !== undefined && options.model !== '')
+        argv.push('-m', options.model);
+    if (options.reasoningEffort !== undefined && options.reasoningEffort !== '') {
+        // `-c` overrides a `config.toml` value for this run only, which is how a
+        // per-call effort reaches the CLI without touching the user's configuration.
+        argv.push('-c', `model_reasoning_effort=${options.reasoningEffort}`);
+    }
+    if (options.bypassApprovals === true)
+        argv.push('--dangerously-bypass-approvals-and-sandbox');
+    else if (options.sandbox !== undefined)
+        argv.push('-s', options.sandbox);
+    argv.push('-o', options.outputFile, '-');
+    return argv;
+}
+/**
+ * Run one `codex exec` and collect its final message.
+ *
+ * @param command - the Codex executable.
+ * @param options - the run's inputs, plus the output file to read back.
+ * @param spawn - the spawn implementation to use.
+ * @param readOutput - reads the output file; returns `undefined` when absent.
+ * @returns the child's answer and status.
+ */
+export async function runCodexExec(command, options, spawn, readOutput) {
+    const argv = buildCodexExecArgv(options);
+    const child = spawn(command, argv, {
+        cwd: options.cwd,
+        env: { ...process.env, ...options.env },
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+    child.stderr?.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+    child.stdin?.end(options.prompt);
+    const code = await new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', resolve);
+    });
+    // The output file is the authoritative answer; stdout carries progress lines
+    // and is only a fallback when the CLI wrote no file.
+    const fromFile = readOutput(options.outputFile);
+    const text = fromFile !== undefined && fromFile !== '' ? fromFile : stdout;
+    return { text, code, stderr };
+}
+//# sourceMappingURL=codex-exec.js.map

package/node_modules/dsh-subagent-codex-pro/lib/codex-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-exec.js","sourceRoot":"","sources":["../src/codex-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAwCH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACvF,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;SACxF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IACxE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,CAAA;AACb,CAAC;AAkBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,OAAyB,EACzB,KAAgB,EAChB,UAAgD;IAEhD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAA;IACF,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACzE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACzE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEhC,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAChE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;IAC1E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAC/B,CAAC"}

package/node_modules/dsh-subagent-codex-pro/lib/dsh-types.js

@@ -0,0 +1,15 @@
+/**
+ * The harness shapes this probe needs, declared locally.
+ *
+ * The plugin imports nothing from `@deepseek-ai/*` at runtime — that is a
+ * deliberate property, so a failure can only mean the wiring and never module
+ * resolution. These are structural types mirroring the harness contracts; they
+ * are erased at build time.
+ *
+ * The tool registration shape mirrors what the LCU plugin does, which is the
+ * proven path for a plugin that registers its own model-facing tools.
+ *
+ * @module dsh-subagent-codex-pro/dsh-types
+ */
+export {};
+//# sourceMappingURL=dsh-types.js.map

package/node_modules/dsh-subagent-codex-pro/lib/dsh-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-types.js","sourceRoot":"","sources":["../src/dsh-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}