@deepseek-ai/dsh-subagent-codex 0.1.0-rc.7 → 0.1.0-rc.8

package/lib/types/index.d.ts

@@ -1,29 +1,34 @@
 /**
- * Fixed Codex one-shot subagent provider. Every accepted run starts a fresh
- * official `codex app-server --stdio` process in the delegating Session's
- * workspace and publishes only after an ephemeral thread exists.
+ * Profile-named Codex one-shot subagent provider. Every accepted run starts a
+ * fresh official package-local Codex wrapper with `app-server --stdio` in the
+ * delegating Session's workspace and publishes only after an ephemeral thread exists.
  *
  * @module @deepseek-ai/dsh-subagent-codex
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
+import { type CodexPermissionMode } from './run.ts';
 export declare const name = "subagent-codex";
 export declare const inject: string[];
-/** Deployment-owned environment and process-release bound. */
+/** Deployment-owned permission, environment, and process-release settings. */
 export interface Config {
+    /** Provider name on `ctx.subagents` (default `codex`). */
+    providerName?: string;
     /**
      * Explicit environment entries layered over the subprocess seam's
      * credential-scrubbed parent environment.
      */
     env?: Record<string, string>;
+    /** Native non-interactive permission mode fixed for this Provider instance. */
+    permissionMode?: CodexPermissionMode;
     /** Grace in milliseconds for app-server process-tree termination. */
     disposeGraceMs?: number;
 }
 export declare const Config: z<Config>;
 /**
- * Register the fixed `codex` provider.
+ * Register one Profile-named Codex provider.
  * @param ctx - context carrying shared subagent and subprocess services.
- * @param config - explicit child environment and disposal grace.
+ * @param config - registry name, permission mode, child environment, and disposal grace.
  */
 export declare function apply(ctx: Context, config: Config): void;
 //# sourceMappingURL=index.d.ts.map

package/lib/types/run.d.ts

@@ -12,20 +12,29 @@ import type { SubprocessHandle, SubprocessSpawnSpec } from '@deepseek-ai/dsh-sub
 import { CodexAppServerWire } from './wire.ts';
 /** Default POSIX grace between subprocess termination tiers. */
 export declare const DEFAULT_DISPOSE_GRACE_MS = 3000;
+/** Profile-selectable non-interactive Codex permission mode. */
+export type CodexPermissionMode = 'never' | 'approve-for-me' | 'dangerously-bypass-approvals-and-sandbox';
+/** Native non-interactive Codex modes mapped to official `thread/start` fields. */
+export declare const CODEX_PERMISSION_MODES: readonly ["never", "approve-for-me", "dangerously-bypass-approvals-and-sandbox"];
+/** Safe default for unattended Codex runs. */
+export declare const DEFAULT_CODEX_PERMISSION_MODE: CodexPermissionMode;
 /**
- * Resolve the fixed app-server command for a platform.
- *
- * Windows npm and pnpm installs expose `codex.cmd`, which requires `cmd.exe`;
- * the argv is constant so no task or configuration text enters the
- * shell boundary.
- * @param platform - host platform used to select the executable boundary.
- * @returns argv for the fixed Codex app-server command.
+ * Hide an unpublished Host failure behind fixed safe startup facts.
+ * @param cause Original Host failure retained for internal diagnostics.
+ * @returns A startup failure whose message contains only fixed safe facts.
+ */
+export declare function codexStartupFailure(cause: unknown): Error;
+/**
+ * Fixed package-local app-server command, independent of the host `PATH`.
+ * @returns Node, the official wrapper, and the fixed app-server arguments.
  */
-export declare function codexAppServerArgv(platform?: NodeJS.Platform): string[];
+export declare function codexAppServerArgv(): string[];
 /** Fully resolved inputs for one Codex app-server run. */
 export interface CodexRunSpec {
     /** Parent Session workspace, also supplied to `thread/start`. */
     readonly cwd: string;
+    /** Profile-selected native non-interactive permission mode. */
+    readonly permissionMode: CodexPermissionMode;
     /** Explicit deployment/test environment layered after the shared scrub. */
     readonly env: Record<string, string>;
     /** Subprocess termination grace passed to the shared process-tree owner. */

package/lib/types/wire.d.ts

@@ -9,6 +9,13 @@
 import type { Readable, Writable } from 'node:stream';
 import type { ContentBlock } from '@deepseek-ai/dsh-llm';
 import type { SubagentResult } from '@deepseek-ai/dsh-subagent';
+import type { CodexPermissionMode } from './run.ts';
+/** Product facts owned by the Codex wire after publication. */
+export interface CodexWireFailureFacts {
+    readonly stage: 'turn-start' | 'turn';
+    readonly category: string;
+    readonly httpStatus?: number | undefined;
+}
 /**
  * One app-server connection and its single ephemeral thread/turn.
  *
@@ -17,6 +24,7 @@ import type { SubagentResult } from '@deepseek-ai/dsh-subagent';
  */
 export declare class CodexAppServerWire {
     private readonly input;
+    private readonly permissionMode;
     private readonly transport;
     private readonly fatal;
     private threadId;
@@ -26,10 +34,23 @@ export declare class CodexAppServerWire {
     private readonly earlyTurnNotifications;
     private lastFinalAnswer;
     private lastUnphasedAnswer;
+    private diagnostic;
+    private failure;
+    private diagnosticOrder;
+    private observationOrder;
+    private pendingDiagnostic;
+    private stderrTail;
+    private inputEnded;
+    private terminalObserved;
     private closed;
-    constructor(input: Readable, output: Writable);
+    constructor(input: Readable, output: Writable, permissionMode: CodexPermissionMode);
     /** Start reading app-server frames. */
     start(): void;
+    /**
+     * Whether protocol output ended before a terminal turn notification.
+     * @returns `true` only for an early protocol close without a terminal turn.
+     */
+    endedBeforeTerminal(): boolean;
     /**
      * Perform the required app-server initialize/initialized handshake.
      * @param signal - unpublished-start cancellation.
@@ -59,6 +80,23 @@ export declare class CodexAppServerWire {
      * @returns the selected final or nullable-phase text block, if any.
      */
     collectOutput(): ContentBlock[];
+    /**
+     * The latest safe unattended permission fact observed for this run.
+     * @returns provider-authored diagnostic text, when one was observed.
+     */
+    collectDiagnostic(): string | undefined;
+    /**
+     * The structured failure fact observed for this published turn.
+     * Call only after a non-completed return or rejection from {@link runTurn}.
+     * @returns the fixed stage/category pair and optional HTTP status.
+     */
+    collectFailure(): CodexWireFailureFacts;
+    /**
+     * Observe product stderr while retaining only enough tail to recognize fixed
+     * permission signatures. The raw text is never copied into the diagnostic.
+     * @param chunk - one decoded stderr chunk already forwarded to the host.
+     */
+    observeStderr(chunk: string): void;
     /** Detach JSON-RPC listeners and reject outstanding requests. Idempotent. */
     close(): void;
     private guarded;
@@ -68,7 +106,17 @@ export declare class CodexAppServerWire {
     private readonly onInputEnd;
     private observePendingTurnId;
     private commitTurnId;
+    /**
+     * Validate the request's thread and turn association.
+     * @returns `true` when the matching turn is still provisional, so the caller
+     * defers its diagnostic until `commitTurnId()`.
+     */
     private validateRunIds;
+    private recordRequestDiagnostic;
+    private recordDiagnostic;
+    private recordFailure;
+    private nextObservationOrder;
+    private recordDeclinedItem;
     private handleServerRequest;
     private handleNotification;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-subagent-codex",
   "description": "One-shot Codex subagent provider over the official app-server protocol",
-  "version": "0.1.0-rc.7",
+  "version": "0.1.0-rc.8",
   "publishConfig": {
     "access": "public"
   },
@@ -28,35 +28,40 @@
   "files": [
     "lib/index.js",
     "lib/invariant.js",
+    "cordis.patch.yml",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
   "peerDependencies": {
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-sdk-protocol": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-subagent": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-subprocess": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-timeout": "^0.1.0-rc.7",
-    "@deepseek-ai/cordis": "^4.0.1"
+    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-subagent": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-subprocess": "^0.1.0-rc.8",
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-timeout": "^0.1.0-rc.8"
   },
   "dependencies": {
+    "@openai/codex": "0.147.0",
+    "@deepseek-ai/dsh-sdk-protocol": "^0.1.0-rc.8",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {
-    "@openai/codex": "0.147.0",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-loader-smoke": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-sdk-protocol": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-subprocess": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-subagent": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-timeout": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-agent": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-loader-smoke": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-subagent": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-subprocess-local": "^0.1.0-rc.8",
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.0-rc.7"
+    "@deepseek-ai/dsh-timeout": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-subprocess": "^0.1.0-rc.8"
   }
 }