@cocorograph/hub-agent 0.8.49 → 0.8.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.49",
+  "version": "0.8.50",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",

package/src/codex-artifact-template-picker.mjs

@@ -0,0 +1,198 @@
+import path from "node:path"
+import { lstat } from "node:fs/promises"
+
+import { resolveCodexWorkspaceDependencies } from "./codex-workspace-dependencies.mjs"
+
+export const ARTIFACT_TEMPLATE_CATALOG_MAX_ITEMS = 100
+export const ARTIFACT_TEMPLATE_CATALOG_MAX_BYTES = 24_000
+export const ARTIFACT_TEMPLATE_DESCRIPTION_MAX_CODEPOINTS = 600
+
+const TEMPLATE_NAME_RE = /^(?:[^:]+:)?artifact-template-[a-z0-9][a-z0-9._-]*$/
+const PICKER_CONFIG_KEY = "mcp_servers.openai_artifact_template_picker"
+const DARWIN_RESOURCES_PATH = "/Applications/ChatGPT.app/Contents/Resources"
+
+export class CodexArtifactTemplatePickerError extends Error {
+  constructor(code, message, options = {}) {
+    super(message, options)
+    this.name = "CodexArtifactTemplatePickerError"
+    this.code = code
+  }
+}
+
+function fail(code, message, cause) {
+  throw new CodexArtifactTemplatePickerError(code, message, cause ? { cause } : undefined)
+}
+
+function diagnostic(code, detail = {}) {
+  return { code, ...detail }
+}
+
+function priorityOf(skillName) {
+  if (skillName.startsWith("openai-templates:")) return 2
+  return skillName.includes(":") ? 1 : 0
+}
+
+function normalizedPathKey(skillPath, platform) {
+  // Desktop does not establish case-folding as part of its contract. Normalize separators and
+  // dot segments only, preserving case and the original path carried in the catalog.
+  return platform === "win32" ? path.win32.normalize(skillPath) : path.posix.normalize(skillPath)
+}
+
+function codepointPrefix(value, limit) {
+  return Array.from(value).slice(0, limit).join("")
+}
+
+function optionalTrimmed(value) {
+  return typeof value === "string" ? value.trim() : ""
+}
+
+function catalogCandidate(record) {
+  if (
+    !record ||
+    typeof record !== "object" ||
+    Array.isArray(record) ||
+    typeof record.name !== "string"
+  ) {
+    return { error: diagnostic("ARTIFACT_TEMPLATE_SKILL_METADATA_INVALID") }
+  }
+  if (!TEMPLATE_NAME_RE.test(record.name)) return { unrelated: true }
+  if (typeof record.path !== "string" || typeof record.enabled !== "boolean") {
+    return { error: diagnostic("ARTIFACT_TEMPLATE_SKILL_METADATA_INVALID") }
+  }
+  if (record.enabled !== true) return { disabled: true }
+  // skills/list is authoritative. Do not reinterpret, normalize, or derive this SKILL.md path.
+  if (!path.isAbsolute(record.path)) {
+    return { error: diagnostic("ARTIFACT_TEMPLATE_SKILL_PATH_INVALID", { skillName: record.name }) }
+  }
+  const description = optionalTrimmed(record.description)
+    || optionalTrimmed(record.interface?.shortDescription)
+    || optionalTrimmed(record.interface?.displayName)
+    || record.name
+  return {
+    candidate: {
+      skillName: record.name,
+      skillPath: record.path,
+      description: codepointPrefix(description, ARTIFACT_TEMPLATE_DESCRIPTION_MAX_CODEPOINTS),
+      priority: priorityOf(record.name),
+    },
+  }
+}
+
+/**
+ * Convert app-server skills/list SkillMetadata records to the Desktop-compatible picker catalog.
+ * The caller supplies the exact response records; this module deliberately does not scan plugin
+ * caches, personal skill directories, or config.toml to second-guess Codex enablement.
+ */
+export function collectCodexArtifactTemplateCatalog({ skills = [], platform = process.platform } = {}) {
+  const diagnostics = []
+  if (!Array.isArray(skills)) {
+    return {
+      catalog: [],
+      diagnostics: [diagnostic("ARTIFACT_TEMPLATE_SKILLS_LIST_INVALID")],
+    }
+  }
+
+  const rawCandidates = []
+  for (const record of skills) {
+    const result = catalogCandidate(record)
+    if (result.error) diagnostics.push(result.error)
+    else if (result.candidate) rawCandidates.push(result.candidate)
+  }
+  rawCandidates.sort((a, b) => b.priority - a.priority)
+
+  const catalog = []
+  let catalogBytes = 2 // JSON array brackets: []
+  const names = new Set()
+  const paths = new Set()
+  for (const { priority: _priority, ...candidate } of rawCandidates) {
+    const pathKey = normalizedPathKey(candidate.skillPath, platform)
+    if (names.has(candidate.skillName) || paths.has(pathKey)) {
+      diagnostics.push(diagnostic("ARTIFACT_TEMPLATE_SKILL_DUPLICATE", {
+        skillName: candidate.skillName,
+        skillPath: candidate.skillPath,
+      }))
+      continue
+    }
+    if (catalog.length >= ARTIFACT_TEMPLATE_CATALOG_MAX_ITEMS) {
+      diagnostics.push(diagnostic("ARTIFACT_TEMPLATE_CATALOG_ITEM_LIMIT", { skillName: candidate.skillName }))
+      continue
+    }
+    const candidateBytes = Buffer.byteLength(JSON.stringify(candidate), "utf8")
+    const nextBytes = catalogBytes + (catalog.length > 0 ? 1 : 0) + candidateBytes
+    if (nextBytes > ARTIFACT_TEMPLATE_CATALOG_MAX_BYTES) {
+      diagnostics.push(diagnostic("ARTIFACT_TEMPLATE_CATALOG_BYTE_LIMIT", { skillName: candidate.skillName }))
+      continue
+    }
+    catalog.push(candidate)
+    catalogBytes = nextBytes
+    names.add(candidate.skillName)
+    paths.add(pathKey)
+  }
+  return { catalog, diagnostics }
+}
+
+async function isFile(candidate, lstatImpl) {
+  try {
+    const value = await lstatImpl(candidate)
+    return value.isFile() && !value.isSymbolicLink()
+  } catch {
+    return false
+  }
+}
+
+async function resolveResourcesPath({ env, platform, lstatImpl }) {
+  const explicit = env.CODEX_ELECTRON_RESOURCES_PATH
+  if (explicit) {
+    if (!path.isAbsolute(explicit)) {
+      fail("CODEX_ARTIFACT_RESOURCES_PATH_INVALID", "CODEX_ELECTRON_RESOURCES_PATH must be absolute")
+    }
+    return path.normalize(explicit)
+  }
+  if (platform === "darwin") {
+    const server = path.join(DARWIN_RESOURCES_PATH, "artifact-template-picker", "server.mjs")
+    if (await isFile(server, lstatImpl)) return DARWIN_RESOURCES_PATH
+  }
+  fail("CODEX_ARTIFACT_RESOURCES_PATH_UNAVAILABLE", "Codex Electron resources path is unavailable")
+}
+
+export async function preflightCodexArtifactTemplatePicker({
+  env = process.env,
+  platform = process.platform,
+  lstatImpl = lstat,
+} = {}) {
+  const resourcesPath = await resolveResourcesPath({ env, platform, lstatImpl })
+  const serverPath = path.join(resourcesPath, "artifact-template-picker", "server.mjs")
+  if (!await isFile(serverPath, lstatImpl)) {
+    fail("CODEX_ARTIFACT_TEMPLATE_PICKER_MISSING", "Codex artifact template picker server is missing")
+  }
+  return { resourcesPath, serverPath }
+}
+
+/** Return the dotted thread/start config shape consumed by Codex app-server. */
+export async function buildCodexArtifactTemplatePickerConfig({
+  env = process.env,
+  platform = process.platform,
+  skills = [],
+  resolveWorkspaceDependencies = resolveCodexWorkspaceDependencies,
+  lstatImpl = lstat,
+  preflight,
+  onDiagnostic,
+} = {}) {
+  const verified = preflight || await preflightCodexArtifactTemplatePicker({ env, platform, lstatImpl })
+  const { serverPath } = verified
+  const runtime = await resolveWorkspaceDependencies()
+  if (typeof runtime?.nodePath !== "string" || !path.isAbsolute(runtime.nodePath)) {
+    fail("CODEX_ARTIFACT_RUNTIME_NODE_INVALID", "Codex primary runtime did not return an absolute nodePath")
+  }
+  const { catalog, diagnostics } = collectCodexArtifactTemplateCatalog({ skills, platform })
+  for (const item of diagnostics) onDiagnostic?.(item)
+  return {
+    [PICKER_CONFIG_KEY]: {
+      command: runtime.nodePath,
+      args: [serverPath],
+      env: {
+        CODEX_ARTIFACT_TEMPLATE_SKILLS: JSON.stringify(catalog),
+      },
+    },
+  }
+}

package/src/codex-dynamic-tools.mjs

@@ -0,0 +1,191 @@
+import path from "node:path"
+
+import { resolveCodexWorkspaceDependencies } from "./codex-workspace-dependencies.mjs"
+
+const NAMESPACE = "codex_app"
+const LOAD_WORKSPACE_DEPENDENCIES = "load_workspace_dependencies"
+const COMPLETED_CALL_LEDGER_MAX = 256
+
+const EMPTY_OBJECT_SCHEMA = Object.freeze({
+  type: "object",
+  properties: {},
+  additionalProperties: false,
+})
+
+export const CODEX_DYNAMIC_TOOLS = Object.freeze([
+  Object.freeze({
+    type: "namespace",
+    name: NAMESPACE,
+    description: "Codex standard runtime tools provided by the Cockpit host.",
+    tools: Object.freeze([
+      Object.freeze({
+        type: "function",
+        name: LOAD_WORKSPACE_DEPENDENCIES,
+        description: "Resolve the verified Codex primary runtime dependencies for artifact skills.",
+        inputSchema: EMPTY_OBJECT_SCHEMA,
+      }),
+    ]),
+  }),
+])
+
+function inputText(text) {
+  return { contentItems: [{ type: "inputText", text }], success: true }
+}
+
+const REQUIRED_INVENTORY_FIELDS = Object.freeze([
+  ["bundleVersion", "Bundle version", false],
+  ["gitPath", "Git executable", true],
+  ["nodePath", "Node.js executable", false],
+  ["nodeModulesPath", "Node.js packages", false],
+  ["pnpmPath", "pnpm executable", true],
+  ["pythonPath", "Python executable", false],
+  ["pythonLibrariesPath", "Python packages", false],
+  ["overrideBinPath", "Override binaries", false],
+  ["fallbackBinPath", "Fallback binaries", false],
+])
+
+function invalidInventory() {
+  const error = new Error("Codex workspace dependency inventory is invalid")
+  error.code = "CODEX_DYNAMIC_TOOL_INVENTORY_INVALID"
+  throw error
+}
+
+function inventoryValue(inventory, field, optional) {
+  const value = inventory[field]
+  if (optional && (value === null || value === undefined)) return null
+  if (!isNonEmptyString(value) || /[\r\n`]/.test(value)) invalidInventory()
+  if (field !== "bundleVersion" && !path.isAbsolute(value)) invalidInventory()
+  return value
+}
+
+function inlineCode(value) {
+  return `\`${value}\``
+}
+
+/** Format only the canonical resolver inventory; compatibility aliases are never substituted. */
+export function formatCodexWorkspaceDependencies(inventory) {
+  if (!inventory || typeof inventory !== "object" || Array.isArray(inventory)) invalidInventory()
+  const lines = [
+    "Workspace dependencies are available for this local desktop thread.",
+    "",
+    "### Workspace Dependencies",
+    "",
+    "Use these bundled paths for sheets, slides, documents, PDFs, images, or browser automation:",
+    "",
+  ]
+  for (const [field, label, optional] of REQUIRED_INVENTORY_FIELDS) {
+    const value = inventoryValue(inventory, field, optional)
+    if (value !== null) lines.push(`- ${label}: ${inlineCode(value)}`)
+  }
+  return lines.join("\n")
+}
+
+function failure(text) {
+  return { contentItems: [{ type: "inputText", text }], success: false }
+}
+
+export function codexDynamicToolFailure(code) {
+  const safeCode = sanitizeCodexDynamicErrorCode(code)
+  return failure(`Dynamic tool call failed (${safeCode})`)
+}
+
+export function sanitizeCodexDynamicErrorCode(value, fallback = "CODEX_DYNAMIC_TOOL_ERROR") {
+  return typeof value === "string" && value.length <= 128 && /^[A-Z0-9_]+$/.test(value)
+    ? value
+    : fallback
+}
+
+export function sanitizeCodexDynamicToolName(value) {
+  return typeof value === "string"
+    && value.length >= 1
+    && value.length <= 128
+    && /^[A-Za-z0-9_.:-]+$/.test(value)
+    ? value
+    : "unknown"
+}
+
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0
+}
+
+function validateCall(params) {
+  if (!params || typeof params !== "object" || Array.isArray(params)) {
+    return { ok: false, code: "INVALID_CALL", tool: "unknown" }
+  }
+  const tool = sanitizeCodexDynamicToolName(params.tool)
+  if (
+    !isNonEmptyString(params.threadId) ||
+    !isNonEmptyString(params.callId) ||
+    !isNonEmptyString(params.turnId)
+  ) {
+    return { ok: false, code: "INVALID_CALL", tool }
+  }
+  if (params.namespace !== NAMESPACE) {
+    return { ok: false, code: "UNKNOWN_NAMESPACE", tool }
+  }
+  if (params.tool !== LOAD_WORKSPACE_DEPENDENCIES) {
+    return { ok: false, code: "UNKNOWN_TOOL", tool }
+  }
+  if (
+    !params.arguments ||
+    typeof params.arguments !== "object" ||
+    Array.isArray(params.arguments) ||
+    Object.keys(params.arguments).length !== 0
+  ) {
+    return { ok: false, code: "INVALID_ARGUMENTS", tool }
+  }
+  return { ok: true, tool }
+}
+
+/**
+ * A per-session executor for host-provided Codex dynamic tools.
+ * Recent results are retained in a bounded replay window so transport retries cannot execute a
+ * resolver twice without allowing an unbounded session-lifetime ledger.
+ */
+export function createCodexDynamicToolExecutor({
+  resolveWorkspaceDependencies = resolveCodexWorkspaceDependencies,
+  logger,
+} = {}) {
+  const calls = new Map()
+
+  const executeOnce = async (params) => {
+    const validation = validateCall(params)
+    if (!validation.ok) {
+      logger?.warn?.(
+        { tool: validation.tool, error_code: validation.code },
+        "codex dynamic tool call rejected",
+      )
+      return failure(`Dynamic tool call rejected (${validation.code})`)
+    }
+
+    try {
+      const dependencies = await resolveWorkspaceDependencies()
+      return inputText(formatCodexWorkspaceDependencies(dependencies))
+    } catch (error) {
+      const code = sanitizeCodexDynamicErrorCode(error?.code)
+      logger?.warn?.(
+        { tool: validation.tool, error_code: code },
+        "codex dynamic tool call failed",
+      )
+      return failure(`Workspace dependency resolution failed (${code})`)
+    }
+  }
+
+  return {
+    definitions: CODEX_DYNAMIC_TOOLS,
+    execute(params) {
+      const threadId = isNonEmptyString(params?.threadId) ? params.threadId : null
+      const callId = isNonEmptyString(params?.callId) ? params.callId : null
+      if (!threadId || !callId) return executeOnce(params)
+      const key = JSON.stringify([threadId, callId])
+      const existing = calls.get(key)
+      if (existing) return existing
+      const pending = executeOnce(params)
+      calls.set(key, pending)
+      if (calls.size > COMPLETED_CALL_LEDGER_MAX) {
+        calls.delete(calls.keys().next().value)
+      }
+      return pending
+    },
+  }
+}

package/src/codex-stream-bridge.mjs

@@ -47,6 +47,17 @@ import { recordInjectSourcePersistent } from "./inject-source-store.mjs"
 
 import { AsyncTtlCache } from "./async-ttl-cache.mjs"
 import { CodexAppServerClient } from "./codex-appserver-client.mjs"
+import {
+  buildCodexArtifactTemplatePickerConfig,
+  preflightCodexArtifactTemplatePicker,
+} from "./codex-artifact-template-picker.mjs"
+import {
+  codexDynamicToolFailure,
+  createCodexDynamicToolExecutor,
+  sanitizeCodexDynamicErrorCode,
+  sanitizeCodexDynamicToolName,
+} from "./codex-dynamic-tools.mjs"
+import { resolveCodexWorkspaceDependencies } from "./codex-workspace-dependencies.mjs"
 import {
   snapshotCodexDeliveryAudit,
   verifyCodexDeliveryAudit,
@@ -61,6 +72,120 @@ function parseTurnMismatch(reason) {
   return mismatch ? { expected: mismatch[1], found: mismatch[2] } : null
 }
 
+function codexHostCapabilityErrorCode(error, fallback) {
+  return sanitizeCodexDynamicErrorCode(error?.code, fallback)
+}
+
+function flattenCodexSkillsList(result) {
+  if (!result || !Array.isArray(result.data)) {
+    const error = new Error("invalid skills/list response")
+    error.code = "CODEX_SKILLS_LIST_RESPONSE_INVALID"
+    throw error
+  }
+  const skills = []
+  for (const entry of result.data) {
+    if (!entry || !Array.isArray(entry.skills)) {
+      const error = new Error("invalid skills/list response")
+      error.code = "CODEX_SKILLS_LIST_RESPONSE_INVALID"
+      throw error
+    }
+    // SkillMetadata は Codex が正本。未知 field を選別・再構築せず、そのまま picker へ渡す。
+    skills.push(...entry.skills)
+  }
+  return skills
+}
+
+function deadlineError(code) {
+  const error = new Error(code)
+  error.code = code
+  return error
+}
+
+async function withDeadline(promise, timeoutMs, code) {
+  let timer
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(deadlineError(code)), timeoutMs)
+    timer.unref?.()
+  })
+  try {
+    return await Promise.race([Promise.resolve(promise), timeout])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+async function buildCodexHostCapabilities({
+  client,
+  cwd,
+  artifactTemplatePickerConfigBuilder,
+  artifactTemplatePickerPreflight,
+  resolveWorkspaceDependencies,
+}) {
+  let preflight
+  try {
+    preflight = await artifactTemplatePickerPreflight()
+  } catch (error) {
+    return {
+      config: null,
+      warning: {
+        error_code: codexHostCapabilityErrorCode(
+          error,
+          "CODEX_ARTIFACT_TEMPLATE_PICKER_PREFLIGHT_FAILED",
+        ),
+        skill_count: 0,
+      },
+    }
+  }
+  let skills
+  try {
+    skills = flattenCodexSkillsList(await client.request("skills/list", { cwds: [cwd] }))
+  } catch (error) {
+    return {
+      config: null,
+      warning: {
+        error_code: codexHostCapabilityErrorCode(error, "CODEX_SKILLS_LIST_FAILED"),
+        skill_count: 0,
+      },
+    }
+  }
+
+  const diagnosticCounts = new Map()
+  try {
+    const config = await artifactTemplatePickerConfigBuilder({
+      skills,
+      preflight,
+      resolveWorkspaceDependencies,
+      onDiagnostic: (item) => {
+        const code = codexHostCapabilityErrorCode(
+          item,
+          "CODEX_ARTIFACT_TEMPLATE_PICKER_DIAGNOSTIC",
+        )
+        diagnosticCounts.set(code, (diagnosticCounts.get(code) || 0) + 1)
+      },
+    })
+    return {
+      config: config && typeof config === "object" && !Array.isArray(config) ? config : null,
+      warning: diagnosticCounts.size > 0
+        ? { diagnostic_counts: Object.fromEntries(diagnosticCounts), skill_count: skills.length }
+        : null,
+    }
+  } catch (error) {
+    return {
+      config: null,
+      warning: {
+        error_code: codexHostCapabilityErrorCode(
+          error,
+          "CODEX_ARTIFACT_TEMPLATE_PICKER_CONFIG_FAILED",
+        ),
+        ...(diagnosticCounts.size > 0
+          ? { diagnostic_counts: Object.fromEntries(diagnosticCounts) }
+          : {}),
+        skill_count: skills.length,
+      },
+    }
+  }
+}
+
 /**
  * sibling-inject (2026-07-04) 用: spawn する codex app-server プロセス自身の
  * 環境変数に、この cwd の capability トークンを乗せる。ディスクには書かず、
@@ -209,6 +334,24 @@ const DELIVERY_ECHO_TIMEOUT_MS = readPositiveIntEnv(
 )
 
 const CLIENT_INFO = { name: "cockpit-hub-agent", title: "Cockpit", version: "1.0.0" }
+const WORKSPACE_DEPENDENCIES_CACHE_TTL_MS = 30_000
+const WORKSPACE_DEPENDENCIES_FAILURE_TTL_MS = readPositiveIntEnv(
+  "HUB_AGENT_CODEX_WORKSPACE_DEPENDENCIES_FAILURE_TTL_MS",
+  30_000,
+)
+const WORKSPACE_DEPENDENCIES_DEADLINE_MS = readPositiveIntEnv(
+  "HUB_AGENT_CODEX_WORKSPACE_DEPENDENCIES_DEADLINE_MS",
+  45_000,
+)
+const HOST_CAPABILITIES_DEADLINE_MS = readPositiveIntEnv(
+  "HUB_AGENT_CODEX_HOST_CAPABILITIES_DEADLINE_MS",
+  10_000,
+)
+const FORM_ELICITATION_TIMEOUT_MS = readPositiveIntEnv(
+  "HUB_AGENT_CODEX_FORM_ELICITATION_TIMEOUT_MS",
+  10 * 60_000,
+)
+const DYNAMIC_TOOL_REQUEST_LEDGER_MAX = 256
 
 // T06499 (2026-07-18): 巨大スレッドの resume ガード。長期運用したスレッドの rollout は
 // 20MB 超まで肥大し得る (実測: メイン repo 540KB が正常なのに対し 20MB のスレッドあり)。
@@ -466,11 +609,80 @@ export class CodexStreamBridge extends EventEmitter {
     historyMaxBytes,
     listThreadsCacheTtlMs,
     accountRateLimitsCacheTtlMs,
+    workspaceDependenciesCacheTtlMs,
+    workspaceDependenciesFailureTtlMs,
+    workspaceDependenciesDeadlineMs,
+    hostCapabilitiesDeadlineMs,
+    formElicitationTimeoutMs,
+    resolveWorkspaceDependencies,
+    dynamicToolExecutorFactory,
+    artifactTemplatePickerConfigBuilder,
+    artifactTemplatePickerPreflight,
   } = {}) {
     super()
     this.codexCmd = codexCmd
     this.logger = logger
     this._clientFactory = clientFactory || ((opts) => new CodexAppServerClient(opts))
+    const uncachedWorkspaceDependencies = resolveWorkspaceDependencies || resolveCodexWorkspaceDependencies
+    this._workspaceDependenciesCacheTtlMs = sanitizePositiveInt(
+      workspaceDependenciesCacheTtlMs,
+      WORKSPACE_DEPENDENCIES_CACHE_TTL_MS,
+      { logger: this.logger, label: "codex.workspaceDependenciesCacheTtlMs" },
+    )
+    this._workspaceDependenciesFailureTtlMs = sanitizePositiveInt(
+      workspaceDependenciesFailureTtlMs,
+      WORKSPACE_DEPENDENCIES_FAILURE_TTL_MS,
+      { logger: this.logger, label: "codex.workspaceDependenciesFailureTtlMs" },
+    )
+    this._workspaceDependenciesDeadlineMs = sanitizePositiveInt(
+      workspaceDependenciesDeadlineMs,
+      WORKSPACE_DEPENDENCIES_DEADLINE_MS,
+      { logger: this.logger, label: "codex.workspaceDependenciesDeadlineMs" },
+    )
+    this._hostCapabilitiesDeadlineMs = sanitizePositiveInt(
+      hostCapabilitiesDeadlineMs,
+      HOST_CAPABILITIES_DEADLINE_MS,
+      { logger: this.logger, label: "codex.hostCapabilitiesDeadlineMs" },
+    )
+    this._formElicitationTimeoutMs = sanitizePositiveInt(
+      formElicitationTimeoutMs,
+      FORM_ELICITATION_TIMEOUT_MS,
+      { logger: this.logger, label: "codex.formElicitationTimeoutMs" },
+    )
+    this._workspaceDependenciesCache = new AsyncTtlCache({
+      ttlMs: this._workspaceDependenciesCacheTtlMs,
+    })
+    this._workspaceDependenciesFailure = null
+    this._resolveWorkspaceDependencies = async () => {
+      const cachedFailure = this._workspaceDependenciesFailure
+      if (cachedFailure && cachedFailure.expiresAt > Date.now()) {
+        throw deadlineError(cachedFailure.code)
+      }
+      this._workspaceDependenciesFailure = null
+      try {
+        const dependencies = await this._workspaceDependenciesCache.get(
+          () => withDeadline(
+            Promise.resolve().then(uncachedWorkspaceDependencies),
+            this._workspaceDependenciesDeadlineMs,
+            "CODEX_WORKSPACE_DEPENDENCIES_TIMEOUT",
+          ),
+        )
+        this._workspaceDependenciesFailure = null
+        return dependencies
+      } catch (error) {
+        // Negative cacheには安全なcodeと期限だけを保持する。cause/messageは秘密を含み得る。
+        this._workspaceDependenciesFailure = {
+          code: codexHostCapabilityErrorCode(error, "CODEX_WORKSPACE_DEPENDENCIES_FAILED"),
+          expiresAt: Date.now() + this._workspaceDependenciesFailureTtlMs,
+        }
+        throw deadlineError(this._workspaceDependenciesFailure.code)
+      }
+    }
+    this._dynamicToolExecutorFactory = dynamicToolExecutorFactory || createCodexDynamicToolExecutor
+    this._artifactTemplatePickerConfigBuilder = artifactTemplatePickerConfigBuilder
+      || buildCodexArtifactTemplatePickerConfig
+    this._artifactTemplatePickerPreflight = artifactTemplatePickerPreflight
+      || preflightCodexArtifactTemplatePicker
     // Stage 5: warm 保持の idle TTL（既定 7 日）。テストから短縮できるよう注入可能。
     this._detachTtlMs = detachTtlMs ?? IDLE_DETACH_TTL_MS
     // 子⑤ (T06544): 同時 warm 保持する cwd 数の上限 N（既定 20）。各 cwd は K 本に畳む。
@@ -741,6 +953,14 @@ export class CodexStreamBridge extends EventEmitter {
       // request_id -> { turnId, method, params }。major#1: reattach で新 stream へ未応答の承認要求を
       // 再送できるよう、元の method/params も保持する (Claude の _permissionResolvers と同型)。
       pendingApprovals: new Map(),
+      // host dynamic tool は permission request と別経路で即時応答する。
+      dynamicToolExecutor: this._dynamicToolExecutorFactory({
+        resolveWorkspaceDependencies: this._resolveWorkspaceDependencies,
+        logger: this.logger,
+      }),
+      // JSON-RPC request id ごとの exactly-once 応答台帳。callId の resolver single-flight は
+      // executor が別に担い、同じ callId でも request id が違えば各 request へ応答する。
+      handledDynamicToolRequestIds: new Set(),
       // ブラウザから codex.detach を受け取った (= 画面の持ち主が居なくなった) か。診断・ログ用。
       // Stage 5: 回収の可否は detachRequested ではなく lastActivityMs（LRU）と activeTurnId
       // （busy/stuck）で決める。detach してもすぐには殺さず warm 保持する。
@@ -827,7 +1047,13 @@ export class CodexStreamBridge extends EventEmitter {
         { stream_id, cwd, resuming, lifecycle_stage: "initialize_started" },
         "codex app-server session initialization",
       )
-      await client.request("initialize", { clientInfo: CLIENT_INFO })
+      await client.request("initialize", {
+        clientInfo: CLIENT_INFO,
+        capabilities: {
+          experimentalApi: true,
+          mcpServerOpenaiFormElicitation: true,
+        },
+      })
       // ここまでが「app-server プロセスが起動して JSON-RPC に応答できるようになるまで」。
       timing.initialize_ms = lap()
       // 公式 App Server handshake: initialize 応答後、同じ transport 上で initialized を
@@ -837,10 +1063,43 @@ export class CodexStreamBridge extends EventEmitter {
         { stream_id, cwd, resuming, lifecycle_stage: "initialized_sent" },
         "codex app-server session initialization",
       )
-      reachedThreadOp = true
       const startParams = { cwd, model: model || undefined, sandbox: sandbox || undefined }
       if (effort) startParams.effort = effort
       if (approvalPolicy) startParams.approvalPolicy = approvalPolicy
+      // app-serverを跨ぐcold resumeではthreadのhost側MCP/dynamic tool登録が復元されない実測が
+      // あるため、fresh startと同じcapabilityを毎回再注入する。in-memory reattachはこのcold経路へ
+      // 入らないので、既存process上での再buildは発生しない。
+      try {
+        const hostCapabilities = await withDeadline(
+          buildCodexHostCapabilities({
+            client,
+            cwd,
+            artifactTemplatePickerConfigBuilder: this._artifactTemplatePickerConfigBuilder,
+            artifactTemplatePickerPreflight: this._artifactTemplatePickerPreflight,
+            resolveWorkspaceDependencies: this._resolveWorkspaceDependencies,
+          }),
+          this._hostCapabilitiesDeadlineMs,
+          "CODEX_HOST_CAPABILITIES_TIMEOUT",
+        )
+        if (hostCapabilities.config) startParams.config = { ...hostCapabilities.config }
+        if (hostCapabilities.warning) {
+          this.logger?.warn?.(
+            hostCapabilities.warning,
+            "codex artifact template picker degraded",
+          )
+        }
+      } catch (error) {
+        this.logger?.warn?.(
+          {
+            error_code: codexHostCapabilityErrorCode(error, "CODEX_HOST_CAPABILITIES_FAILED"),
+            skill_count: 0,
+          },
+          "codex artifact template picker degraded",
+        )
+      }
+      startParams.dynamicTools = session.dynamicToolExecutor.definitions
+      startParams.runtimeWorkspaceRoots = [cwd]
+      timing.host_capabilities_ms = lap()
       this.logger?.info?.(
         {
           stream_id,
@@ -851,6 +1110,7 @@ export class CodexStreamBridge extends EventEmitter {
         },
         "codex app-server session initialization",
       )
+      reachedThreadOp = true
       const result = resuming
         ? await client.request("thread/resume", { ...startParams, threadId: resumeThreadId })
         : await client.request("thread/start", startParams)
@@ -951,6 +1211,7 @@ export class CodexStreamBridge extends EventEmitter {
       }
     } catch (err) {
       this.sessions.delete(stream_id)
+      this._settleAllPendingApprovals(session, { respond: false })
       client.stop()
       settleReady(null) // reattach 待ちへ「失敗」を通知 (reject しない)
       // 失敗も 1 行に落とす。**_classifyAttachFailure より前**に出す (分類は rollout の disk 走査を
@@ -987,6 +1248,7 @@ export class CodexStreamBridge extends EventEmitter {
    * ## 読み方
    * - `warm=true` / `mode=reattach_*` … app-server を立てていない (所要は `reattach_wait_ms` だけ)
    * - `warm=false` / `mode=cold_*` … `spawn_ms`(同期 spawn) + `initialize_ms`(プロセス起動待ち)
+   *   + `host_capabilities_ms`(cold start/resume の skills/runtime 構築)
    *   + `thread_op_ms`(thread/start|resume。resume は rollout 読み込み込み) + `history_flatten_ms`
    *
    * ログ量: attach 時のみ (ターン毎には出ない)。既存の "codex session attached" と同オーダー。
@@ -1000,6 +1262,7 @@ export class CodexStreamBridge extends EventEmitter {
         reattach_wait_ms: timing.reattach_wait_ms ?? null,
         spawn_ms: timing.spawn_ms ?? null,
         initialize_ms: timing.initialize_ms ?? null,
+        host_capabilities_ms: timing.host_capabilities_ms ?? null,
         thread_op_ms: timing.thread_op_ms ?? null,
         history_flatten_ms: timing.history_flatten_ms ?? null,
       },
@@ -1249,9 +1512,22 @@ export class CodexStreamBridge extends EventEmitter {
   /** app-server を 1 本 spawn して account/rateLimits/read を取る実処理 (キャッシュ miss 時のみ)。 */
   async _fetchAccountRateLimits({ cwd, profileId }) {
     const client = this._clientFactory({ cwd: cwd || process.cwd(), codexCmd: this.codexCmd, logger: this.logger })
+    client.on("error", (error) => {
+      this.logger?.warn?.(
+        {
+          error_code: codexHostCapabilityErrorCode(
+            error,
+            "CODEX_ACCOUNT_RATE_LIMITS_CLIENT_ERROR",
+          ),
+        },
+        "codex account rate limits client error",
+      )
+    })
     client.start()
     try {
-      await client.request("initialize", { clientInfo: CLIENT_INFO })
+      await client.request("initialize", {
+        clientInfo: CLIENT_INFO,
+      })
       client.notify("initialized", {})
       const result = await client.request("account/rateLimits/read", {})
       this._accountRateLimitsByProfile.set(profileId, result)
@@ -2540,13 +2816,27 @@ export class CodexStreamBridge extends EventEmitter {
   }
 
   _onServerRequest(session, msg) {
+    if (msg?.method === "item/tool/call") {
+      this._onDynamicToolCall(session, msg)
+      return
+    }
     const { stream_id } = session
+    const previous = session.pendingApprovals.get(msg.id)
+    if (previous?.timer) clearTimeout(previous.timer)
     // major#1: reattach 時に新 stream へ再送できるよう method/params も保持する。
-    session.pendingApprovals.set(msg.id, {
+    const pending = {
       turnId: session.activeTurnId,
       method: msg.method,
       params: msg.params,
-    })
+      timer: null,
+    }
+    if (msg.method === "mcpServer/elicitation/request") {
+      pending.timer = setTimeout(() => {
+        this._expireFormElicitation(session, msg.id, pending)
+      }, this._formElicitationTimeoutMs)
+      pending.timer.unref?.()
+    }
+    session.pendingApprovals.set(msg.id, pending)
     this.emit("permission", {
       stream_id,
       thread_id: session.threadId,
@@ -2557,6 +2847,49 @@ export class CodexStreamBridge extends EventEmitter {
     })
   }
 
+  _onDynamicToolCall(session, msg) {
+    if (session.handledDynamicToolRequestIds.has(msg?.id)) return
+    session.handledDynamicToolRequestIds.add(msg?.id)
+    if (session.handledDynamicToolRequestIds.size > DYNAMIC_TOOL_REQUEST_LEDGER_MAX) {
+      session.handledDynamicToolRequestIds.delete(
+        session.handledDynamicToolRequestIds.values().next().value,
+      )
+    }
+
+    const tool = sanitizeCodexDynamicToolName(msg?.params?.tool)
+    let execution
+    const requestThreadId = msg?.params?.threadId
+    const allowedThread = requestThreadId === session.threadId
+      // 表示台帳と停止台帳は観測経路・寿命が異なる。どちらか一方で既知なら、このsessionが
+      // 所有するsubagent threadとして許可する意図的なOR結合（積集合へ狭めない）。
+      || session.subagents.has(requestThreadId)
+      || session.subagentInterruptRegistry.has(requestThreadId)
+    if (!allowedThread) {
+      this.logger?.warn?.(
+        { tool, error_code: "THREAD_MISMATCH" },
+        "codex dynamic tool call rejected",
+      )
+      execution = Promise.resolve(codexDynamicToolFailure("THREAD_MISMATCH"))
+    } else {
+      execution = Promise.resolve().then(() => session.dynamicToolExecutor.execute(msg?.params))
+    }
+
+    void execution.catch(() => {
+      this.logger?.warn?.(
+        { tool, error_code: "DYNAMIC_TOOL_EXECUTOR_REJECTED" },
+        "codex dynamic tool call failed",
+      )
+      return codexDynamicToolFailure("DYNAMIC_TOOL_EXECUTOR_REJECTED")
+    }).then((result) => {
+      session.client.respond(msg.id, result)
+    }).catch(() => {
+      this.logger?.warn?.(
+        { tool, error_code: "DYNAMIC_TOOL_RESPONSE_FAILED" },
+        "codex dynamic tool response failed",
+      )
+    })
+  }
+
   /**
    * major#1: 未応答の承認要求を現在の stream へ再送する (reattach から呼ぶ)。Claude の
    * _replayPendingPermissions と同型。frontend は request_id で重複排除するため、既に表示済みの
@@ -2576,14 +2909,63 @@ export class CodexStreamBridge extends EventEmitter {
     }
   }
 
+  _pendingApprovalResult(info) {
+    return info?.method === "mcpServer/elicitation/request"
+      ? { action: "cancel", content: null }
+      : { decision: "decline" }
+  }
+
+  _settlePendingApproval(session, requestId, result, { respond = true } = {}) {
+    const info = session?.pendingApprovals?.get(requestId)
+    if (!info) return false
+    session.pendingApprovals.delete(requestId)
+    if (info.timer) clearTimeout(info.timer)
+    if (respond) session.client.respond(requestId, result)
+    return true
+  }
+
+  _settleAllPendingApprovals(session, { respond = true } = {}) {
+    for (const [requestId, info] of session?.pendingApprovals || []) {
+      this._settlePendingApproval(
+        session,
+        requestId,
+        this._pendingApprovalResult(info),
+        { respond },
+      )
+    }
+  }
+
+  _expireFormElicitation(session, requestId, expected) {
+    if (session?.pendingApprovals?.get(requestId) !== expected) return
+    if (!this._settlePendingApproval(
+      session,
+      requestId,
+      { action: "cancel", content: null },
+    )) return
+    this.emit("event", {
+      stream_id: session.stream_id,
+      producer_seq: session.seq,
+      thread_id: session.threadId,
+      cwd: session.cwd,
+      notification: {
+        method: "cockpit/permission_expired",
+        params: { request_id: requestId, method: expected.method },
+      },
+    })
+  }
+
   // ターン完了時、そのターンに紐づく未解決の承認要求は自動 decline する
   // (browser が応答する前にターンが打ち切られた/クラッシュ相当のケース。
   // claude-stream-bridge.mjs の「ターン終了時に未解決分は自動 deny」と同じ設計)。
   _autoResolveStalePendingApprovals(session, completedTurnId) {
     for (const [requestId, info] of session.pendingApprovals) {
-      if (info.turnId !== completedTurnId) continue
-      session.pendingApprovals.delete(requestId)
-      session.client.respond(requestId, { decision: "decline" })
+      const belongsToCompletedTurn = info.turnId !== null && info.turnId === completedTurnId
+      if (!belongsToCompletedTurn) continue
+      this._settlePendingApproval(
+        session,
+        requestId,
+        this._pendingApprovalResult(info),
+      )
     }
   }
 
@@ -2595,6 +2977,7 @@ export class CodexStreamBridge extends EventEmitter {
     this._settleTurnActiveWaiter(session)
     this._drainRejectQueue(session, { reason: "queue_dead" })
     this._settlePendingInjectDeliveries(session, "session_dead")
+    this._settleAllPendingApprovals(session, { respond: false })
     // 案B: app-server が死んだら全購読 stream_id キーを Map から外す（1 端末分だけでは
     // 他の購読キーが dangling で残る）。
     this._dropAllStreamKeys(session)
@@ -2947,8 +3330,7 @@ export class CodexStreamBridge extends EventEmitter {
       this.logger?.warn?.({ stream_id, request_id }, "codex permissionReply: unknown request_id (ignored)")
       return
     }
-    session.pendingApprovals.delete(request_id)
-    session.client.respond(request_id, result)
+    this._settlePendingApproval(session, request_id, result)
   }
 
   /**
@@ -3629,6 +4011,7 @@ export class CodexStreamBridge extends EventEmitter {
     this._settleTurnActiveWaiter(session)
     this._drainRejectQueue(session, { reason: "queue_dead" })
     this._settlePendingInjectDeliveries(session, "session_dead")
+    this._settleAllPendingApprovals(session)
     // 案B: 全購読 stream_id キーを Map から外す（primary 1 個だけ消すと dangling が残る）。
     this._dropAllStreamKeys(session)
     try {
@@ -3817,6 +4200,7 @@ export class CodexStreamBridge extends EventEmitter {
       this._settleTurnActiveWaiter(session)
       this._drainRejectQueue(session, { reason: "queue_dead" })
       this._settlePendingInjectDeliveries(session, "session_dead")
+      this._settleAllPendingApprovals(session)
       // hub-agent 再起動時にターン実行中のセッションを落とすと thread が汚染されうる
       // (exec 中の kill → output 欠落)。因果を後から辿れるよう必ず記録する。
       this.logger?.[session.activeTurnId ? "warn" : "info"]?.(

package/src/codex-workspace-dependencies.mjs

@@ -0,0 +1,331 @@
+import { constants as fsConstants } from "node:fs"
+import { access, readFile, realpath, stat } from "node:fs/promises"
+import { execFile } from "node:child_process"
+import { promisify } from "node:util"
+import os from "node:os"
+import path from "node:path"
+
+export const CODEX_PRIMARY_RUNTIME_BUNDLE_FORMAT = 2
+const execFileAsync = promisify(execFile)
+
+export class CodexWorkspaceDependenciesError extends Error {
+  constructor(code, message, options = {}) {
+    super(message, options)
+    this.name = "CodexWorkspaceDependenciesError"
+    this.code = code
+  }
+}
+
+function fail(code, message, cause) {
+  throw new CodexWorkspaceDependenciesError(code, message, cause ? { cause } : undefined)
+}
+
+function resolveRuntimeRoot(runtimeRootOverride, homedirImpl) {
+  if (runtimeRootOverride !== undefined) {
+    if (typeof runtimeRootOverride !== "string" || !path.isAbsolute(runtimeRootOverride)) {
+      fail("CODEX_RUNTIME_ROOT_INVALID", "runtimeRootOverride must be an absolute path")
+    }
+    return runtimeRootOverride
+  }
+
+  const home = homedirImpl()
+  if (typeof home !== "string" || !path.isAbsolute(home)) {
+    fail("CODEX_RUNTIME_ROOT_INVALID", "OS home directory must be an absolute path")
+  }
+  return path.join(home, ".cache", "codex-runtimes", "codex-primary-runtime")
+}
+
+function requireNonemptyString(manifest, field, { optional = false } = {}) {
+  const value = manifest[field]
+  if (optional && value === undefined) return null
+  if (typeof value !== "string" || value.trim() === "") {
+    fail("CODEX_RUNTIME_MANIFEST_INVALID", `Codex primary runtime manifest field ${field} must be a nonempty string`)
+  }
+  return value
+}
+
+function requireNativeDependencies(manifest) {
+  if (manifest.nativeDependencies === undefined) return []
+  if (
+    !Array.isArray(manifest.nativeDependencies)
+    || manifest.nativeDependencies.some((item) => typeof item !== "string" || item.trim() === "")
+  ) {
+    fail(
+      "CODEX_RUNTIME_MANIFEST_INVALID",
+      "Codex primary runtime manifest field nativeDependencies must be an array of nonempty strings",
+    )
+  }
+  return manifest.nativeDependencies
+}
+
+async function readManifest(manifestPath, readFileImpl) {
+  let raw
+  try {
+    raw = await readFileImpl(manifestPath, "utf8")
+  } catch (error) {
+    const code = error?.code === "ENOENT"
+      ? "CODEX_RUNTIME_MANIFEST_MISSING"
+      : "CODEX_RUNTIME_MANIFEST_UNREADABLE"
+    fail(code, "Codex primary runtime manifest is not readable", error)
+  }
+
+  try {
+    const manifest = JSON.parse(raw)
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+      fail("CODEX_RUNTIME_MANIFEST_INVALID", "Codex primary runtime manifest must be a JSON object")
+    }
+    return manifest
+  } catch (error) {
+    if (error instanceof CodexWorkspaceDependenciesError) throw error
+    fail("CODEX_RUNTIME_MANIFEST_INVALID_JSON", "Codex primary runtime manifest is not valid JSON", error)
+  }
+}
+
+async function requireFile(candidate, label, statImpl) {
+  try {
+    if ((await statImpl(candidate)).isFile()) return
+  } catch (error) {
+    fail("CODEX_RUNTIME_PATH_MISSING", `${label} is missing or inaccessible`, error)
+  }
+  fail("CODEX_RUNTIME_PATH_INVALID", `${label} must be a file`)
+}
+
+async function requireDirectory(candidate, label, statImpl) {
+  try {
+    if ((await statImpl(candidate)).isDirectory()) return
+  } catch (error) {
+    fail("CODEX_RUNTIME_PATH_MISSING", `${label} is missing or inaccessible`, error)
+  }
+  fail("CODEX_RUNTIME_PATH_INVALID", `${label} must be a directory`)
+}
+
+async function requireExecutableFile(candidate, label, executableErrorCode, statImpl, accessImpl) {
+  await requireFile(candidate, label, statImpl)
+  try {
+    await accessImpl(candidate, fsConstants.X_OK)
+  } catch (error) {
+    fail(executableErrorCode, `${label} is not executable`, error)
+  }
+}
+
+function isWithinRoot(candidate, root) {
+  const relative = path.relative(root, candidate)
+  return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative))
+}
+
+async function requireContainedRealPath(candidate, label, realRuntimeRoot, realpathImpl) {
+  let resolved
+  try {
+    resolved = await realpathImpl(candidate)
+  } catch (error) {
+    fail("CODEX_RUNTIME_PATH_MISSING", `${label} is missing or inaccessible`, error)
+  }
+  if (typeof resolved !== "string" || !path.isAbsolute(resolved)) {
+    fail("CODEX_RUNTIME_PATH_INVALID", `${label} real path must be absolute`)
+  }
+  if (!isWithinRoot(resolved, realRuntimeRoot)) {
+    fail("CODEX_RUNTIME_PATH_OUTSIDE_ROOT", `${label} resolves outside the Codex primary runtime root`)
+  }
+  return resolved
+}
+
+async function requireContainedManifestPath(manifestPath, realRuntimeRoot, realpathImpl) {
+  let resolved
+  try {
+    resolved = await realpathImpl(manifestPath)
+  } catch (error) {
+    const code = error?.code === "ENOENT"
+      ? "CODEX_RUNTIME_MANIFEST_MISSING"
+      : "CODEX_RUNTIME_MANIFEST_UNREADABLE"
+    fail(code, "Codex primary runtime manifest is not accessible", error)
+  }
+  if (typeof resolved !== "string" || !path.isAbsolute(resolved)) {
+    fail("CODEX_RUNTIME_PATH_INVALID", "Codex primary runtime manifest real path must be absolute")
+  }
+  if (!isWithinRoot(resolved, realRuntimeRoot)) {
+    fail(
+      "CODEX_RUNTIME_PATH_OUTSIDE_ROOT",
+      "Codex primary runtime manifest resolves outside the Codex primary runtime root",
+    )
+  }
+  return resolved
+}
+
+function childEnvWithoutExternalLanguagePaths(env) {
+  const childEnv = { ...env }
+  delete childEnv.NODE_OPTIONS
+  delete childEnv.NODE_PATH
+  delete childEnv.PYTHONHOME
+  delete childEnv.PYTHONPATH
+  return childEnv
+}
+
+/**
+ * Codex standard primary runtime の絶対パスを検証して返す。
+ *
+ * runtime.json 以外から版や配置を推測せず、ローカル npm・system Node・PATH へ
+ * fallback しない。runtimeRoot 自体のsymlinkは追従し、そのrealpathをcontainment rootとする。
+ * host側は成功・失敗をそれぞれ短期cacheするが、cache miss時はここで実体を再検証する。
+ */
+export async function resolveCodexWorkspaceDependencies({
+  env = process.env,
+  platform = process.platform,
+  arch = process.arch,
+  runtimeRootOverride,
+  homedirImpl = os.homedir,
+  readFileImpl = readFile,
+  realpathImpl = realpath,
+  statImpl = stat,
+  accessImpl = access,
+  execFileImpl = execFileAsync,
+} = {}) {
+  const runtimeRoot = resolveRuntimeRoot(runtimeRootOverride, homedirImpl)
+  const manifestPath = path.join(runtimeRoot, "runtime.json")
+  let realRuntimeRoot
+  try {
+    realRuntimeRoot = await realpathImpl(runtimeRoot)
+  } catch (error) {
+    fail("CODEX_RUNTIME_ROOT_UNREADABLE", "Codex primary runtime root is not accessible", error)
+  }
+  if (!path.isAbsolute(realRuntimeRoot)) {
+    fail("CODEX_RUNTIME_ROOT_INVALID", "Codex primary runtime real path must be absolute")
+  }
+  // manifestの内容を読む前に、symlinkを含む実体がruntime root内にあることを確認する。
+  await requireContainedManifestPath(manifestPath, realRuntimeRoot, realpathImpl)
+  const manifest = await readManifest(manifestPath, readFileImpl)
+
+  if (manifest.bundleFormatVersion !== CODEX_PRIMARY_RUNTIME_BUNDLE_FORMAT) {
+    fail(
+      "CODEX_RUNTIME_BUNDLE_FORMAT_UNSUPPORTED",
+      `Unsupported Codex primary runtime bundle format: ${String(manifest.bundleFormatVersion)}`,
+    )
+  }
+  if (manifest.targetPlatform !== platform) {
+    fail("CODEX_RUNTIME_PLATFORM_MISMATCH", "Codex primary runtime target platform does not match this process")
+  }
+  if (manifest.targetArch !== arch) {
+    fail("CODEX_RUNTIME_ARCH_MISMATCH", "Codex primary runtime target architecture does not match this process")
+  }
+  if (platform === "win32") {
+    fail(
+      "CODEX_RUNTIME_PLATFORM_UNSUPPORTED",
+      "Codex primary runtime layout for Windows is not supported by this resolver",
+    )
+  }
+
+  const bundleVersion = requireNonemptyString(manifest, "bundleVersion")
+  requireNonemptyString(manifest, "nodeVersion")
+  requireNonemptyString(manifest, "pythonVersion")
+  requireNonemptyString(manifest, "artifactToolVersion")
+  const pnpmVersion = requireNonemptyString(manifest, "pnpmVersion", { optional: true })
+  const nativeDependencies = requireNativeDependencies(manifest)
+
+  const runtimeNode = path.join(runtimeRoot, "dependencies", "node", "bin", "node")
+  const runtimeNodeModules = path.join(runtimeRoot, "dependencies", "node", "node_modules")
+  const runtimeBinDir = path.join(runtimeRoot, "dependencies", "bin", "override")
+  const runtimePython = path.join(runtimeRoot, "dependencies", "python", "bin", "python3")
+  const runtimePythonPackages = path.join(runtimeRoot, "dependencies", "python")
+  const runtimeFallbackBinDir = path.join(runtimeRoot, "dependencies", "bin", "fallback")
+  const runtimePnpm = pnpmVersion ? path.join(runtimeFallbackBinDir, "pnpm") : null
+  const runtimeGit = nativeDependencies.includes("git") ? path.join(runtimeFallbackBinDir, "git") : null
+
+  for (const [candidate, label] of [
+    [runtimeNode, "Bundled runtime Node"],
+    [runtimeNodeModules, "Bundled runtime node_modules"],
+    [runtimeBinDir, "Bundled runtime binary directory"],
+    [runtimePython, "Bundled runtime Python"],
+    [runtimePythonPackages, "Bundled runtime Python packages"],
+    [runtimeFallbackBinDir, "Bundled runtime fallback binary directory"],
+    [runtimePnpm, "Bundled runtime pnpm"],
+    [runtimeGit, "Bundled runtime git"],
+  ]) {
+    if (candidate) await requireContainedRealPath(candidate, label, realRuntimeRoot, realpathImpl)
+  }
+
+  await requireExecutableFile(
+    runtimeNode,
+    "Bundled runtime Node",
+    "CODEX_RUNTIME_NODE_NOT_EXECUTABLE",
+    statImpl,
+    accessImpl,
+  )
+  await requireDirectory(runtimeNodeModules, "Bundled runtime node_modules", statImpl)
+  await requireDirectory(runtimeBinDir, "Bundled runtime binary directory", statImpl)
+  await requireExecutableFile(
+    runtimePython,
+    "Bundled runtime Python",
+    "CODEX_RUNTIME_PYTHON_NOT_EXECUTABLE",
+    statImpl,
+    accessImpl,
+  )
+  await requireDirectory(runtimePythonPackages, "Bundled runtime Python packages", statImpl)
+  await requireDirectory(runtimeFallbackBinDir, "Bundled runtime fallback binary directory", statImpl)
+  if (runtimePnpm) {
+    await requireExecutableFile(
+      runtimePnpm,
+      "Bundled runtime pnpm",
+      "CODEX_RUNTIME_PNPM_NOT_EXECUTABLE",
+      statImpl,
+      accessImpl,
+    )
+  }
+  if (runtimeGit) {
+    await requireExecutableFile(
+      runtimeGit,
+      "Bundled runtime git",
+      "CODEX_RUNTIME_GIT_NOT_EXECUTABLE",
+      statImpl,
+      accessImpl,
+    )
+  }
+
+  const runtimeChildEnv = childEnvWithoutExternalLanguagePaths(env)
+
+  try {
+    await execFileImpl(
+      runtimeNode,
+      ["--input-type=module", "--eval", "await import('@oai/artifact-tool')"],
+      {
+        cwd: path.dirname(runtimeNodeModules),
+        env: runtimeChildEnv,
+        encoding: "utf8",
+        timeout: 15_000,
+        maxBuffer: 64 * 1024,
+        killSignal: "SIGKILL",
+        windowsHide: true,
+      },
+    )
+  } catch (error) {
+    fail("CODEX_RUNTIME_ARTIFACT_TOOL_UNAVAILABLE", "Bundled @oai/artifact-tool could not be imported", error)
+  }
+
+  try {
+    await execFileImpl(
+      runtimePython,
+      ["-I", "-c", "import docx"],
+      {
+        cwd: runtimePythonPackages,
+        env: runtimeChildEnv,
+        encoding: "utf8",
+        timeout: 15_000,
+        maxBuffer: 64 * 1024,
+        killSignal: "SIGKILL",
+        windowsHide: true,
+      },
+    )
+  } catch (error) {
+    fail("CODEX_RUNTIME_DOCUMENTS_PYTHON_UNAVAILABLE", "Bundled Python could not import docx", error)
+  }
+
+  return {
+    bundleVersion,
+    gitPath: runtimeGit,
+    nodePath: runtimeNode,
+    nodeModulesPath: runtimeNodeModules,
+    pnpmPath: runtimePnpm,
+    pythonPath: runtimePython,
+    pythonLibrariesPath: runtimePythonPackages,
+    overrideBinPath: runtimeBinDir,
+    fallbackBinPath: runtimeFallbackBinDir,
+  }
+}