@ekairos/openai-reactor 1.22.34-beta.development.0 → 1.22.35

package/dist/codex.reactor.js

@@ -1,5 +1,28 @@
-import { OUTPUT_ITEM_TYPE, createContextStepStreamChunk, encodeContextStepStreamChunk, } from "@ekairos/events";
-import { asRecord, asString, buildCodexParts, defaultInstructionFromTrigger } from "./shared.js";
+import { OUTPUT_ITEM_TYPE, createContextStepStreamChunk, encodeContextStepStreamChunk, resolveContextPartChunkDescriptor, resolveContextPartChunkIdentity, actionsToActionSpecs, } from "@ekairos/events";
+import { SANDBOX_EXECUTE_COMMAND_ACTION_NAME } from "@ekairos/sandbox/contract";
+import { randomUUID } from "node:crypto";
+import { asRecord, asString, buildCodexParts, defaultInstructionFromTrigger, readCodexDynamicActionDetails, } from "./shared.js";
+function isCodexExecutableAction(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "execute" in value &&
+        typeof value.execute === "function");
+}
+function isCodexSandboxRuntime(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "use" in value &&
+        typeof value.use === "function");
+}
+function hasStreamCapableSandboxDb(value) {
+    const db = asRecord(value);
+    const streams = asRecord(db.streams);
+    const tx = asRecord(db.tx);
+    return (typeof db.transact === "function" &&
+        typeof streams.createWriteStream === "function" &&
+        typeof tx.sandbox_processes === "object" &&
+        tx.sandbox_processes !== null);
+}
 const PROVIDER_SCOPE_PREFIX = "context/";
 const PROVIDER_STARTED = "context/started";
 const PROVIDER_ARCHIVED = "context/archived";
@@ -14,6 +37,9 @@ function toJsonSafe(value) {
         return undefined;
     }
 }
+function cleanRecord(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
 export function mapCodexChunkType(providerChunkType) {
     const value = providerChunkType.toLowerCase();
     if (value.includes("start_step"))
@@ -30,22 +56,27 @@ export function mapCodexChunkType(providerChunkType) {
         return "chunk.reasoning_delta";
     if (value.includes("reasoning_end"))
         return "chunk.reasoning_end";
-    if (value.includes("action_input_start") || value.includes("tool_input_start")) {
-        return "chunk.action_input_start";
-    }
+    if (value.includes("action_started") || value.includes("tool_started"))
+        return "chunk.action_started";
+    if (value.includes("action_completed") || value.includes("tool_completed"))
+        return "chunk.action_completed";
+    if (value.includes("action_failed") || value.includes("tool_failed"))
+        return "chunk.action_failed";
+    if (value.includes("action_input_start") || value.includes("tool_input_start"))
+        return "chunk.action_started";
     if (value.includes("action_input_delta") || value.includes("tool_input_delta")) {
         return "chunk.action_input_delta";
     }
     if (value.includes("action_input_available") ||
         value.includes("tool_input_available") ||
         value.includes("action_call")) {
-        return "chunk.action_input_available";
+        return "chunk.action_started";
     }
     if (value.includes("action_output_available") || value.includes("tool_output_available")) {
-        return "chunk.action_output_available";
+        return "chunk.action_completed";
     }
     if (value.includes("action_output_error") || value.includes("tool_output_error")) {
-        return "chunk.action_output_error";
+        return "chunk.action_failed";
     }
     if (value.includes("message_metadata"))
         return "chunk.message_metadata";
@@ -89,6 +120,19 @@ function isActionItemType(itemType) {
 function resolveActionRef(params, item) {
     const fromParams = asString(params.itemId) ||
         asString(params.toolCallId) ||
+        asString(params.callId) ||
+        asString(params.id);
+    if (fromParams)
+        return fromParams;
+    const fromItem = asString(item.id) || asString(item.toolCallId);
+    if (fromItem)
+        return fromItem;
+    return undefined;
+}
+function resolveProviderPartId(params, item) {
+    const fromParams = asString(params.itemId) ||
+        asString(params.toolCallId) ||
+        asString(params.callId) ||
         asString(params.id);
     if (fromParams)
         return fromParams;
@@ -97,6 +141,39 @@ function resolveActionRef(params, item) {
         return fromItem;
     return undefined;
 }
+function withCodexPartDescriptor(chunkType, providerPartId) {
+    return resolveContextPartChunkDescriptor({
+        chunkType,
+        providerPartId,
+    });
+}
+function completeCodexMappedChunkIdentity(mapped, stepId) {
+    const data = asRecord(mapped.data);
+    const providerPartId = asString(mapped.providerPartId) ||
+        (mapped.chunkType.startsWith("chunk.action_") ? asString(mapped.actionRef) : "") ||
+        asString(data.providerPartId) ||
+        asString(data.id) ||
+        asString(data.itemId) ||
+        asString(data.toolCallId) ||
+        asString(mapped.actionRef);
+    const identity = resolveContextPartChunkIdentity({
+        stepId,
+        provider: "codex",
+        providerPartId,
+        chunkType: mapped.chunkType,
+        partType: mapped.partType,
+        partSlot: mapped.partSlot,
+    });
+    return {
+        partId: identity?.partId,
+        providerPartId: identity?.providerPartId,
+        partType: identity?.partType,
+        partSlot: identity?.partSlot,
+        actionRef: mapped.chunkType.startsWith("chunk.action_")
+            ? asString(mapped.actionRef) || identity?.providerPartId
+            : undefined,
+    };
+}
 export function mapCodexAppServerNotification(providerChunk) {
     const chunk = asRecord(providerChunk);
     const method = asString(chunk.method).trim();
@@ -120,18 +197,73 @@ export function mapCodexAppServerNotification(providerChunk) {
     const itemType = normalizeLower(item.type);
     const itemStatus = normalizeLower(item.status);
     const actionRef = resolveActionRef(params, item);
+    const providerPartId = resolveProviderPartId(params, item);
     const hasItemError = Boolean(item.error);
-    const mappedData = toJsonSafe({
+    const actionDetails = readCodexDynamicActionDetails(params);
+    const isCommandExecutionItem = itemType === "commandexecution";
+    const isCommandExecutionOutputDelta = method === "item/commandExecution/outputDelta";
+    const commandExecutionInput = isCommandExecutionItem
+        ? cleanRecord({
+            command: asString(item.command),
+            args: [],
+            cwd: asString(item.cwd) || undefined,
+            kind: "command",
+            mode: "foreground",
+            metadata: cleanRecord({
+                source: "codex.commandExecution",
+                commandActions: Array.isArray(item.commandActions) ? item.commandActions : [],
+            }),
+        })
+        : undefined;
+    const commandExecutionOutput = isCommandExecutionItem
+        ? cleanRecord({
+            success: itemStatus === "failed"
+                ? false
+                : typeof item.exitCode === "number"
+                    ? item.exitCode === 0
+                    : undefined,
+            exitCode: typeof item.exitCode === "number" ? item.exitCode : undefined,
+            output: asString(item.aggregatedOutput) || undefined,
+            error: asString(item.error || item.message) || undefined,
+            command: asString(item.command) || undefined,
+            durationMs: typeof item.durationMs === "number" ? item.durationMs : undefined,
+            status: itemStatus === "failed" || (typeof item.exitCode === "number" && item.exitCode !== 0)
+                ? "failed"
+                : itemStatus === "completed"
+                    ? "exited"
+                    : itemStatus || undefined,
+        })
+        : undefined;
+    const mappedData = toJsonSafe(cleanRecord({
         method,
         params,
-    });
-    const map = (chunkType) => ({
-        chunkType,
-        providerChunkType: method,
-        actionRef: chunkType.startsWith("chunk.action_") ? actionRef : undefined,
-        data: mappedData,
-        raw: toJsonSafe(providerChunk),
-    });
+        actionCallId: actionDetails.actionCallId,
+        actionName: actionDetails.actionName ||
+            (isCommandExecutionItem || isCommandExecutionOutputDelta
+                ? SANDBOX_EXECUTE_COMMAND_ACTION_NAME
+                : undefined),
+        input: actionDetails.input ?? commandExecutionInput,
+        output: actionDetails.output ??
+            commandExecutionOutput ??
+            (isCommandExecutionOutputDelta
+                ? cleanRecord({ output: asString(params.delta) || undefined })
+                : undefined),
+        success: actionDetails.success,
+        errorText: actionDetails.errorText,
+    }));
+    const map = (chunkType) => {
+        const descriptor = withCodexPartDescriptor(chunkType, providerPartId);
+        return {
+            chunkType,
+            providerChunkType: method,
+            providerPartId: descriptor?.providerPartId,
+            partType: descriptor?.partType,
+            partSlot: descriptor?.partSlot,
+            actionRef: chunkType.startsWith("chunk.action_") ? actionRef : undefined,
+            data: mappedData,
+            raw: toJsonSafe(providerChunk),
+        };
+    };
     switch (method) {
         case "turn/started":
             return map("chunk.start");
@@ -168,7 +300,14 @@ export function mapCodexAppServerNotification(providerChunk) {
         case "item/commandExecution/outputDelta":
         case "item/fileChange/outputDelta":
         case "item/mcpToolCall/progress":
-            return map("chunk.action_output_available");
+            return map("chunk.action_completed");
+        case "item/tool/call":
+            return map("chunk.action_started");
+        case "item/tool/result":
+            if (asRecord(params.result).success === false || asString(params.error)) {
+                return map("chunk.action_failed");
+            }
+            return map("chunk.action_completed");
         case "item/started": {
             if (itemType === "agentmessage")
                 return map("chunk.text_start");
@@ -177,7 +316,7 @@ export function mapCodexAppServerNotification(providerChunk) {
             if (itemType === "usermessage")
                 return map("chunk.message_metadata");
             if (isActionItemType(itemType))
-                return map("chunk.action_input_available");
+                return map("chunk.action_started");
             return map("chunk.message_metadata");
         }
         case "item/completed": {
@@ -189,9 +328,9 @@ export function mapCodexAppServerNotification(providerChunk) {
                 return map("chunk.message_metadata");
             if (isActionItemType(itemType)) {
                 if (hasItemError || itemStatus === "failed" || itemStatus === "declined") {
-                    return map("chunk.action_output_error");
+                    return map("chunk.action_failed");
                 }
-                return map("chunk.action_output_available");
+                return map("chunk.action_completed");
             }
             if (hasItemError || itemStatus === "failed" || itemStatus === "declined") {
                 return map("chunk.error");
@@ -218,12 +357,25 @@ export function defaultMapCodexChunk(providerChunk) {
     const chunk = asRecord(providerChunk);
     const providerChunkType = asString(chunk.type) || "unknown";
     const actionRef = asString(chunk.actionRef) || asString(chunk.toolCallId) || asString(chunk.id) || undefined;
+    const providerPartId = asString(chunk.providerPartId) ||
+        asString(chunk.itemId) ||
+        asString(chunk.toolCallId) ||
+        asString(chunk.id) ||
+        asString(chunk.actionRef) ||
+        undefined;
+    const chunkType = mapCodexChunkType(providerChunkType);
+    const descriptor = withCodexPartDescriptor(chunkType, providerPartId);
     return {
-        chunkType: mapCodexChunkType(providerChunkType),
+        chunkType,
         providerChunkType,
+        providerPartId: descriptor?.providerPartId,
+        partType: descriptor?.partType,
+        partSlot: descriptor?.partSlot,
         actionRef,
         data: toJsonSafe({
             id: chunk.id,
+            itemId: chunk.itemId,
+            providerPartId: descriptor?.providerPartId,
             delta: chunk.delta,
             text: chunk.text,
             finishReason: chunk.finishReason,
@@ -278,6 +430,1246 @@ function extractUsageMetrics(usageSource) {
         promptTokensUncached,
     };
 }
+function asUnknownArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+function asNumberRecord(value) {
+    const record = asRecord(value);
+    const out = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (typeof entry === "number" && Number.isFinite(entry)) {
+            out[key] = entry;
+        }
+    }
+    return out;
+}
+function isValidProviderContextId(value) {
+    const normalized = value.trim();
+    if (!normalized)
+        return false;
+    if (/^[0-9a-fA-F-]{36}$/.test(normalized))
+        return true;
+    if (/^urn:uuid:[0-9a-fA-F-]{36}$/.test(normalized))
+        return true;
+    return false;
+}
+function normalizeAppServerBaseUrl(raw) {
+    const trimmed = String(raw || "").trim().replace(/\/+$/, "");
+    if (trimmed.endsWith("/turn"))
+        return trimmed.slice(0, -"/turn".length);
+    if (trimmed.endsWith("/rpc"))
+        return trimmed.slice(0, -"/rpc".length);
+    if (trimmed.endsWith("/events"))
+        return trimmed.slice(0, -"/events".length);
+    return trimmed;
+}
+function parseSseDataBlock(block) {
+    const lines = block.split("\n").map((line) => line.trimEnd());
+    const dataLines = lines.filter((line) => line.startsWith("data:"));
+    if (!dataLines.length)
+        return null;
+    return dataLines.map((line) => line.replace(/^data:\s*/, "")).join("\n");
+}
+function shellSingleQuote(value) {
+    return `'${String(value).replace(/'/g, `'\"'\"'`)}'`;
+}
+function stripProviderControlChars(value) {
+    return String(value ?? "").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/g, "");
+}
+function parseSandboxJsonl(stdout) {
+    const events = [];
+    let result = {};
+    for (const rawLine of stripProviderControlChars(stdout).split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line.startsWith("EKAIROS_CODEX_"))
+            continue;
+        const tab = line.indexOf("\t");
+        if (tab === -1)
+            continue;
+        const prefix = line.slice(0, tab);
+        const payload = asRecord(JSON.parse(line.slice(tab + 1)));
+        if (prefix === "EKAIROS_CODEX_EVENT")
+            events.push(payload);
+        if (prefix === "EKAIROS_CODEX_RESULT")
+            result = payload;
+    }
+    return { events, result };
+}
+function buildCodexDynamicTools(actionSpecs) {
+    const specs = actionSpecs && typeof actionSpecs === "object" ? actionSpecs : {};
+    return Object.entries(specs)
+        .map(([name, spec]) => {
+        const toolName = asString(name).trim();
+        if (!toolName)
+            return null;
+        return {
+            name: toolName,
+            description: asString(spec?.description).trim() || `Run ${toolName}.`,
+            inputSchema: spec && "inputSchema" in spec && spec.inputSchema !== undefined
+                ? spec.inputSchema
+                : { type: "object", additionalProperties: true },
+        };
+    })
+        .filter(Boolean);
+}
+function toCodexActionSpecs(value) {
+    const specs = asRecord(value);
+    const out = {};
+    for (const [name, spec] of Object.entries(specs)) {
+        const record = asRecord(spec);
+        if (!record)
+            continue;
+        if (record.type === "provider-defined")
+            continue;
+        out[name] = {
+            type: record.type === "function" ? "function" : undefined,
+            description: asString(record.description) || undefined,
+            inputSchema: record.inputSchema,
+        };
+    }
+    return out;
+}
+function formatCodexToolOutput(value) {
+    if (typeof value === "string")
+        return value;
+    try {
+        return JSON.stringify(toJsonSafe(value) ?? value);
+    }
+    catch {
+        return String(value);
+    }
+}
+async function executeCodexDynamicToolCall(args, params) {
+    const actionDetails = readCodexDynamicActionDetails(params);
+    const toolName = asString(actionDetails.actionName).trim();
+    const callId = asString(actionDetails.actionCallId).trim();
+    const action = toolName ? (args.actions ?? {})[toolName] : undefined;
+    const input = actionDetails.input ?? {};
+    if (!toolName || !isCodexExecutableAction(action)) {
+        const errorText = `codex_dynamic_tool_not_found:${toolName || "unknown"}`;
+        return {
+            success: false,
+            output: { error: errorText },
+            errorText,
+            response: {
+                success: false,
+                contentItems: [{ type: "inputText", text: errorText }],
+            },
+        };
+    }
+    try {
+        const output = await action.execute(input, {
+            runtime: args.runtime,
+            context: args.storedContext ?? args.context,
+            contextIdentifier: args.contextIdentifier,
+            toolCallId: callId || undefined,
+            messages: [],
+            eventId: args.eventId,
+            executionId: args.executionId,
+            triggerEventId: undefined,
+            contextId: args.contextId,
+            stepId: args.stepId,
+            iteration: args.iteration ?? 0,
+        });
+        return {
+            success: true,
+            output,
+            response: {
+                success: true,
+                contentItems: [{ type: "inputText", text: formatCodexToolOutput(output) }],
+            },
+        };
+    }
+    catch (error) {
+        const errorText = error instanceof Error ? error.message : String(error);
+        return {
+            success: false,
+            output: { error: errorText },
+            errorText,
+            response: {
+                success: false,
+                contentItems: [{ type: "inputText", text: `Action failed: ${errorText}` }],
+            },
+        };
+    }
+}
+async function codexAppServerRespond(baseUrl, payload) {
+    const response = await fetch(`${baseUrl}/respond`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(payload),
+    });
+    const body = await readJsonResponse(response);
+    if (!response.ok || body.error) {
+        throw new Error(asString(body.error) || `codex_respond_http_${response.status}`);
+    }
+}
+function codexSandboxBridgeScript() {
+    return String.raw `
+import http from "node:http";
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { randomUUID } from "node:crypto";
+
+const PORT = Number(process.env.CODEX_BRIDGE_PORT || "4500");
+function asRecord(value) { return value && typeof value === "object" ? value : {}; }
+function asString(value) { return typeof value === "string" ? value : value == null ? "" : String(value); }
+const child = spawn("codex", ["app-server", "--enable", "apps"], { stdio: ["pipe", "pipe", "inherit"], env: process.env });
+const rl = createInterface({ input: child.stdout });
+const pending = new Map();
+const subscribers = new Set();
+let initialized = false;
+
+function notifyAll(payload) {
+  const data = "data: " + JSON.stringify(payload) + "\n\n";
+  for (const res of subscribers) {
+    try { res.write(data); } catch { subscribers.delete(res); }
+  }
+}
+rl.on("line", (line) => {
+  let msg;
+  try { msg = JSON.parse(line); } catch { return; }
+  if (msg && msg.id && pending.has(msg.id)) {
+    const p = pending.get(msg.id);
+    pending.delete(msg.id);
+    clearTimeout(p.timer);
+    if (msg.error) {
+      const err = asRecord(msg.error);
+      p.reject(new Error(asString(err.message) || asString(msg.error) || "rpc_error"));
+    } else {
+      p.resolve(msg);
+    }
+    return;
+  }
+  notifyAll(msg);
+});
+function sendRpc(payload, timeoutMs = 60000) {
+  const id = payload.id || randomUUID();
+  const msg = { ...payload, id };
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error("rpc_timeout:" + asString(payload.method)));
+    }, timeoutMs);
+    pending.set(id, { resolve, reject, timer });
+    child.stdin.write(JSON.stringify(msg) + "\n");
+  });
+}
+async function ensureInitialized() {
+  if (initialized) return;
+  await sendRpc({ method: "initialize", params: { clientInfo: { name: "ekairos-sandbox", version: "1.0.0" }, capabilities: { experimentalApi: true } } });
+  child.stdin.write(JSON.stringify({ method: "initialized", params: {} }) + "\n");
+  initialized = true;
+}
+const server = http.createServer((req, res) => {
+  if (req.method === "GET" && req.url === "/health") {
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(JSON.stringify({ ok: true, initialized }));
+    return;
+  }
+  if (req.method === "GET" && req.url === "/events") {
+    res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+    res.write("data: " + JSON.stringify({ type: "ready" }) + "\n\n");
+    subscribers.add(res);
+    req.on("close", () => subscribers.delete(res));
+    return;
+  }
+  if (req.method === "POST" && req.url === "/rpc") {
+    let body = "";
+    req.on("data", (chunk) => { body += chunk; });
+    req.on("end", async () => {
+      try {
+        await ensureInitialized();
+        const payload = body ? JSON.parse(body) : {};
+        const out = await sendRpc(payload);
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify(out));
+      } catch (error) {
+        res.writeHead(503, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: asString(error?.message || error) }));
+      }
+    });
+    return;
+  }
+  if (req.method === "POST" && req.url === "/respond") {
+    let body = "";
+    req.on("data", (chunk) => { body += chunk; });
+    req.on("end", async () => {
+      try {
+        const payload = body ? JSON.parse(body) : {};
+        if (!payload || payload.id === undefined || payload.id === null) {
+          res.writeHead(400, { "content-type": "application/json" });
+          res.end(JSON.stringify({ error: "response_id_required" }));
+          return;
+        }
+        child.stdin.write(JSON.stringify(payload) + "\n");
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: true }));
+      } catch (error) {
+        res.writeHead(503, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: asString(error?.message || error) }));
+      }
+    });
+    return;
+  }
+  res.writeHead(404, { "content-type": "application/json" });
+  res.end(JSON.stringify({ error: "not_found" }));
+});
+child.on("exit", () => process.exit(1));
+server.listen(PORT, "0.0.0.0", async () => {
+  try { await ensureInitialized(); } catch {}
+  console.log("[codex-bridge] listening http://0.0.0.0:" + PORT);
+});
+`;
+}
+function codexSandboxTurnRunnerScript() {
+    return String.raw `
+import { readFileSync } from "node:fs";
+const baseUrl = (process.env.CODEX_BRIDGE_URL || "http://127.0.0.1:4500").replace(/\/+$/, "");
+const instruction = process.env.CODEX_INSTRUCTION_FILE
+  ? readFileSync(process.env.CODEX_INSTRUCTION_FILE, "utf8")
+  : process.env.CODEX_INSTRUCTION || "";
+const repoPath = process.env.CODEX_REPO_PATH || process.cwd();
+const providerContextId = process.env.CODEX_PROVIDER_CONTEXT_ID || "";
+const model = process.env.CODEX_MODEL || "";
+function asRecord(value) { return value && typeof value === "object" ? value : {}; }
+function asString(value) { return typeof value === "string" ? value : value == null ? "" : String(value); }
+function emit(prefix, payload) { process.stdout.write(prefix + "\t" + JSON.stringify(payload) + "\n"); }
+async function rpc(method, params) {
+  const res = await fetch(baseUrl + "/rpc", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ method, params }) });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok || json.error) throw new Error(asString(json.error) || "rpc_failed:" + method);
+  return json;
+}
+function parseSse(block) {
+  const lines = block.split("\n").map((line) => line.trimEnd()).filter((line) => line.startsWith("data:"));
+  if (!lines.length) return null;
+  return lines.map((line) => line.replace(/^data:\s*/, "")).join("\n");
+}
+let threadId = providerContextId;
+let turnId = "";
+let assistantText = "";
+let reasoningText = "";
+let diff = "";
+let usage = {};
+let completedTurn = {};
+const eventsResponse = await fetch(baseUrl + "/events", { headers: { accept: "text/event-stream" } });
+if (!eventsResponse.ok || !eventsResponse.body) throw new Error("events_unavailable:" + eventsResponse.status);
+if (threadId) {
+  await rpc("thread/resume", { threadId });
+} else {
+  const params = { cwd: repoPath, approvalPolicy: "never", sandboxPolicy: { type: "externalSandbox", networkAccess: "enabled" } };
+  if (model) params.model = model;
+  const started = await rpc("thread/start", params);
+  threadId = asString(asRecord(asRecord(started.result).thread).id) || asString(asRecord(started.result).id) || asString(started.threadId);
+}
+if (!threadId) throw new Error("thread_id_missing");
+const reader = eventsResponse.body.getReader();
+const decoder = new TextDecoder();
+let buffer = "";
+const turnParams = { threadId, input: [{ type: "text", text: instruction }], cwd: repoPath, approvalPolicy: "never", sandboxPolicy: { type: "externalSandbox", networkAccess: "enabled" } };
+if (model) turnParams.model = model;
+const turnStart = await rpc("turn/start", turnParams);
+turnId = asString(asRecord(asRecord(turnStart.result).turn).id) || asString(asRecord(turnStart.result).id) || asString(turnStart.turnId);
+let done = false;
+while (!done) {
+  const read = await reader.read();
+  if (read.done) break;
+  buffer += decoder.decode(read.value, { stream: true });
+  const blocks = buffer.split("\n\n");
+  buffer = blocks.pop() || "";
+  for (const block of blocks) {
+    const data = parseSse(block);
+    if (!data || data === "[DONE]") continue;
+    const evt = JSON.parse(data);
+    const method = asString(evt.method);
+    if (!method || method.startsWith("codex/event/")) continue;
+    const params = asRecord(evt.params);
+    const evtTurnId = asString(params.turnId) || asString(asRecord(params.turn).id);
+    const evtThreadId = asString(params.threadId) || asString(asRecord(params.turn).threadId);
+    const scoped = (evtTurnId && turnId && evtTurnId === turnId) || (evtThreadId && evtThreadId === threadId) || method.startsWith("thread/") || method.startsWith("context/");
+    if (!scoped) continue;
+    emit("EKAIROS_CODEX_EVENT", evt);
+    if (method === "turn/started" && !turnId) turnId = evtTurnId || asString(asRecord(params.turn).id);
+    if (method === "item/agentMessage/delta") assistantText += asString(params.delta);
+    if (method === "item/reasoning/summaryTextDelta" || method === "item/reasoning/textDelta") reasoningText += asString(params.delta);
+    if (method === "turn/diff/updated") diff = asString(params.diff);
+    if (method === "thread/tokenUsage/updated" || method === "context/tokenUsage/updated") usage = asRecord(params.tokenUsage);
+    if (method === "item/completed") {
+      const item = asRecord(params.item);
+      if (asString(item.type) === "agentMessage" && asString(item.text).trim()) assistantText = asString(item.text);
+      if (asString(item.type) === "reasoning" && asString(item.summary).trim()) reasoningText = asString(item.summary);
+    }
+    if (method === "turn/completed") {
+      completedTurn = asRecord(params.turn);
+      done = true;
+      break;
+    }
+    if (method === "turn/failed") throw new Error("turn_failed:" + (evtTurnId || turnId || "unknown"));
+  }
+}
+await reader.cancel().catch(() => {});
+emit("EKAIROS_CODEX_RESULT", { providerContextId: threadId, turnId: asString(completedTurn.id) || turnId, assistantText, reasoningText, diff, usage, completedTurn });
+`;
+}
+function ensureOk(result, label) {
+    if (!result.ok)
+        throw new Error(`${label}: ${result.error}`);
+    return result.data;
+}
+async function resolveCodexSandboxDomain(runtime) {
+    const rootDomain = runtime.meta?.().domain;
+    if (!rootDomain) {
+        throw new Error("codex_sandbox_domain_required");
+    }
+    const scoped = await runtime.use(rootDomain);
+    if (!scoped.actions) {
+        throw new Error("codex_sandbox_actions_required");
+    }
+    return scoped;
+}
+async function executeCodexSandboxTurn(args, helpers) {
+    const sandboxConfig = args.config.sandbox ?? {};
+    const runtime = args.runtime;
+    if (!isCodexSandboxRuntime(runtime)) {
+        throw new Error("codex_sandbox_runtime_required");
+    }
+    const scoped = await resolveCodexSandboxDomain(runtime);
+    const actions = scoped.actions;
+    const sandboxDb = scoped.db;
+    const provider = sandboxConfig.provider ?? "sprites";
+    const homeDir = provider === "vercel" ? "/vercel/sandbox" : "/home/sprite";
+    const codexHome = String(sandboxConfig.codexHome ?? `${homeDir}/.codex`).trim() || `${homeDir}/.codex`;
+    const bridgePort = Math.max(1, Number(sandboxConfig.bridgePort ?? 4500));
+    const appPort = Math.max(1, Number(sandboxConfig.appPort ?? (provider === "vercel" ? 3000 : 8080)));
+    const defaultWorkspaceRoot = provider === "vercel" ? "/vercel/sandbox" : "/workspace";
+    const repoPath = String(args.config.repoPath || `${defaultWorkspaceRoot}/ekairos-app`).trim() ||
+        `${defaultWorkspaceRoot}/ekairos-app`;
+    const workRoot = `${defaultWorkspaceRoot}/.ekairos/codex`;
+    const bridgePath = `${workRoot}/codex-bridge.mjs`;
+    const turnRunnerPath = `${workRoot}/codex-turn-runner.mjs`;
+    const instructionPath = `${workRoot}/instruction-${args.executionId}-${args.stepId}.txt`;
+    const checkpoints = [];
+    const observedCommandProcesses = new Map();
+    const observedCommandProcessResults = new Map();
+    let sandboxId = String(sandboxConfig.sandboxId ?? "").trim();
+    if (!sandboxId) {
+        const created = ensureOk(await actions.createSandbox({
+            provider: sandboxConfig.provider ?? "sprites",
+            runtime: sandboxConfig.runtime ?? "node22",
+            purpose: sandboxConfig.purpose ?? "codex-reactor-sandbox",
+            ports: Array.from(new Set([bridgePort, appPort, ...(Array.isArray(sandboxConfig.ports) ? sandboxConfig.ports : [])])),
+            ...(provider === "sprites"
+                ? {
+                    sprites: {
+                        name: sandboxConfig.spriteName,
+                        waitForCapacity: true,
+                        urlSettings: { auth: "public" },
+                        deleteOnStop: true,
+                    },
+                }
+                : {}),
+            ...(provider === "vercel" ? { vercel: sandboxConfig.vercel ?? {} } : {}),
+        }), "codex_sandbox_create");
+        sandboxId = String(created.sandboxId);
+    }
+    if (!sandboxId)
+        throw new Error("codex_sandbox_id_missing");
+    const emitAndObserveProviderChunk = async (providerChunk) => {
+        await helpers.emitProviderChunk(providerChunk);
+        const evt = asRecord(providerChunk);
+        const method = asString(evt.method);
+        const params = asRecord(evt.params);
+        if (!method)
+            return;
+        if (method === "item/started") {
+            const item = asRecord(params.item);
+            if (asString(item.type) !== "commandExecution")
+                return;
+            const codexItemId = asString(item.id);
+            if (!codexItemId || observedCommandProcesses.has(codexItemId))
+                return;
+            if (!hasStreamCapableSandboxDb(sandboxDb))
+                return;
+            const processId = randomUUID();
+            const streamClientId = `sandbox-process:${processId}`;
+            const stream = sandboxDb.streams.createWriteStream({ clientId: streamClientId });
+            const streamId = typeof stream.streamId === "function" ? await stream.streamId() : streamClientId;
+            const writer = stream.getWriter();
+            const now = Date.now();
+            const metadata = {
+                source: "codex.commandExecution",
+                codexItemId,
+                providerThreadId: asString(params.threadId),
+                providerTurnId: asString(params.turnId),
+                parent: "codex-app-server",
+                commandActions: item.commandActions,
+                observed: true,
+                lastSeq: 1,
+                chunkCount: 1,
+            };
+            await sandboxDb.transact([
+                sandboxDb.tx.sandbox_processes[processId]
+                    .update({
+                    kind: "command",
+                    mode: "foreground",
+                    status: "running",
+                    provider,
+                    command: asString(item.command),
+                    args: [],
+                    cwd: asString(item.cwd) || repoPath,
+                    externalProcessId: asString(item.processId) || undefined,
+                    streamId,
+                    streamClientId,
+                    streamStartedAt: now,
+                    startedAt: now,
+                    updatedAt: now,
+                    metadata,
+                })
+                    .link({ sandbox: sandboxId, stream: streamId }),
+            ]);
+            const statusChunk = {
+                version: 1,
+                at: new Date().toISOString(),
+                seq: 1,
+                type: "status",
+                sandboxId,
+                processId,
+                data: {
+                    status: "running",
+                    command: asString(item.command),
+                    args: [],
+                    cwd: asString(item.cwd) || repoPath,
+                    externalProcessId: asString(item.processId) || null,
+                },
+            };
+            await writer.write(`${JSON.stringify(statusChunk)}\n`);
+            observedCommandProcesses.set(codexItemId, {
+                processId,
+                streamId,
+                streamClientId,
+                writer,
+                seq: 1,
+            });
+            observedCommandProcessResults.set(codexItemId, {
+                processId,
+                streamId,
+                streamClientId,
+            });
+            return;
+        }
+        if (method === "item/commandExecution/outputDelta") {
+            const codexItemId = asString(params.itemId);
+            const observed = observedCommandProcesses.get(codexItemId);
+            if (!observed)
+                return;
+            observed.seq += 1;
+            await observed.writer.write(`${JSON.stringify({
+                version: 1,
+                at: new Date().toISOString(),
+                seq: observed.seq,
+                type: "stdout",
+                sandboxId,
+                processId: observed.processId,
+                data: {
+                    text: asString(params.delta),
+                    source: "codex.commandExecution",
+                    codexItemId,
+                },
+            })}\n`);
+            return;
+        }
+        if (method === "item/completed") {
+            const item = asRecord(params.item);
+            if (asString(item.type) !== "commandExecution")
+                return;
+            const codexItemId = asString(item.id);
+            const observed = observedCommandProcesses.get(codexItemId);
+            if (!observed)
+                return;
+            const aggregatedOutput = asString(item.aggregatedOutput);
+            if (aggregatedOutput) {
+                observed.seq += 1;
+                await observed.writer.write(`${JSON.stringify({
+                    version: 1,
+                    at: new Date().toISOString(),
+                    seq: observed.seq,
+                    type: "stdout",
+                    sandboxId,
+                    processId: observed.processId,
+                    data: {
+                        text: aggregatedOutput,
+                        source: "codex.commandExecution",
+                        codexItemId,
+                        aggregated: true,
+                    },
+                })}\n`);
+            }
+            const exitCode = typeof item.exitCode === "number" ? item.exitCode : Number(item.exitCode ?? 0);
+            const status = asString(item.status) === "failed" || exitCode !== 0 ? "failed" : "exited";
+            observed.seq += 1;
+            await observed.writer.write(`${JSON.stringify({
+                version: 1,
+                at: new Date().toISOString(),
+                seq: observed.seq,
+                type: "exit",
+                sandboxId,
+                processId: observed.processId,
+                data: {
+                    exitCode: Number.isFinite(exitCode) ? exitCode : null,
+                    status,
+                },
+            })}\n`);
+            await observed.writer.close();
+            observed.writer.releaseLock();
+            await sandboxDb.transact([
+                sandboxDb.tx.sandbox_processes[observed.processId].update({
+                    status,
+                    ...(Number.isFinite(exitCode) ? { exitCode } : {}),
+                    streamFinishedAt: Date.now(),
+                    streamAbortReason: asString(item.error) || null,
+                    exitedAt: Date.now(),
+                    updatedAt: Date.now(),
+                    metadata: {
+                        source: "codex.commandExecution",
+                        codexItemId,
+                        providerThreadId: asString(params.threadId),
+                        providerTurnId: asString(params.turnId),
+                        durationMs: item.durationMs,
+                        completed: item,
+                    },
+                }),
+            ]);
+            observedCommandProcesses.delete(codexItemId);
+        }
+    };
+    ensureOk(await actions.installCodexAuth({
+        sandboxId,
+        codexHome,
+        authJsonPath: sandboxConfig.authJsonPath,
+        credentialsJsonPath: sandboxConfig.credentialsJsonPath,
+        configTomlPath: sandboxConfig.configTomlPath,
+    }), "codex_sandbox_auth");
+    ensureOk(await actions.writeFiles({
+        sandboxId,
+        files: [
+            {
+                path: bridgePath,
+                contentBase64: Buffer.from(codexSandboxBridgeScript(), "utf8").toString("base64"),
+            },
+            {
+                path: turnRunnerPath,
+                contentBase64: Buffer.from(codexSandboxTurnRunnerScript(), "utf8").toString("base64"),
+            },
+            {
+                path: instructionPath,
+                contentBase64: Buffer.from(args.instruction, "utf8").toString("base64"),
+            },
+        ],
+    }), "codex_sandbox_write_files");
+    const runProcess = async (label, script, kind = "command", requiredText) => {
+        const result = ensureOk(await actions.runCommandProcess({
+            sandboxId,
+            command: "sh",
+            args: ["-lc", script],
+            kind,
+            mode: "foreground",
+            metadata: { source: "codex-reactor", label },
+        }), label);
+        if (requiredText) {
+            const output = stripProviderControlChars(`${asString(asRecord(result.result).output)}\n${asString(asRecord(result.result).error)}`);
+            if (!output.includes(requiredText)) {
+                throw new Error(`${label}: missing_sentinel:${requiredText}:${output.slice(-1000)}`);
+            }
+        }
+        return result;
+    };
+    await runProcess("codex_sandbox_prepare_codex", [
+        "set -euo pipefail",
+        `mkdir -p ${shellSingleQuote(codexHome)} ${shellSingleQuote(workRoot)}`,
+        `chmod 700 ${shellSingleQuote(codexHome)} || true`,
+        `chmod 600 ${shellSingleQuote(`${codexHome}/auth.json`)} 2>/dev/null || true`,
+        "if ! command -v codex >/dev/null 2>&1; then npm i -g @openai/codex@latest; fi",
+        `HOME=${shellSingleQuote(homeDir)} CODEX_HOME=${shellSingleQuote(codexHome)} codex login status`,
+        "echo codex_sandbox_prepare_codex_ok",
+    ].join("\n"), "command", "codex_sandbox_prepare_codex_ok");
+    if (sandboxConfig.checkpoint !== false) {
+        const checkpoint = await actions.createCheckpoint({
+            sandboxId,
+            comment: "codex auth and cli ready",
+        });
+        if (checkpoint.ok) {
+            checkpoints.push({ label: "codex-ready", checkpointId: String(checkpoint.data.checkpointId) });
+        }
+    }
+    await runProcess("codex_sandbox_start_bridge", [
+        "set -euo pipefail",
+        `if ! curl -fsS http://127.0.0.1:${bridgePort}/health >/dev/null 2>&1; then`,
+        `  HOME=${shellSingleQuote(homeDir)} CODEX_HOME=${shellSingleQuote(codexHome)} CODEX_BRIDGE_PORT=${bridgePort} nohup node ${shellSingleQuote(bridgePath)} > /tmp/ekairos-codex-bridge-${bridgePort}.log 2>&1 &`,
+        `  echo $! > /tmp/ekairos-codex-bridge-${bridgePort}.pid`,
+        "fi",
+        `for i in $(seq 1 90); do curl -fsS http://127.0.0.1:${bridgePort}/health >/dev/null 2>&1 && echo codex_sandbox_bridge_ok && exit 0; sleep 1; done`,
+        `cat /tmp/ekairos-codex-bridge-${bridgePort}.log || true`,
+        "exit 1",
+    ].join("\n"), "codex-app-server", "codex_sandbox_bridge_ok");
+    if (sandboxConfig.createApp) {
+        const createdApp = ensureOk(await actions.createEkairosApp({
+            sandboxId,
+            appDir: repoPath,
+            packageManager: "pnpm",
+            instantTokenEnvName: "INSTANT_PERSONAL_ACCESS_TOKEN",
+        }), "codex_sandbox_create_app");
+        const createdAppOutput = stripProviderControlChars(asString(asRecord(createdApp.result).output));
+        if (!createdAppOutput.includes("sandbox_create_ekairos_app_ok")) {
+            throw new Error(`codex_sandbox_create_app: missing_sentinel:${createdAppOutput.slice(-1000)}`);
+        }
+    }
+    if (sandboxConfig.installApp) {
+        await runProcess("codex_sandbox_install_app", [
+            "set -euo pipefail",
+            `cd ${shellSingleQuote(repoPath)}`,
+            "for i in 1 2 3; do npx -y pnpm@10.15.1 install && break; echo pnpm_install_retry_$i; sleep 20; done",
+            "test -x node_modules/.bin/next",
+            "echo codex_sandbox_install_app_ok",
+        ].join("\n"), "command", "codex_sandbox_install_app_ok");
+    }
+    let appBaseUrl = "";
+    if (sandboxConfig.startApp) {
+        await runProcess("codex_sandbox_start_app", [
+            "set -euo pipefail",
+            `cd ${shellSingleQuote(repoPath)}`,
+            `if ! curl -fsS http://127.0.0.1:${appPort}/api/ekairos/domain >/dev/null 2>&1; then`,
+            `  nohup npx -y pnpm@10.15.1 dev --hostname 0.0.0.0 --port ${appPort} > /tmp/ekairos-app-${appPort}.log 2>&1 &`,
+            `  echo $! > /tmp/ekairos-app-${appPort}.pid`,
+            "fi",
+            `for i in $(seq 1 180); do curl -fsS http://127.0.0.1:${appPort}/api/ekairos/domain >/dev/null 2>&1 && echo codex_sandbox_start_app_ok && exit 0; sleep 1; done`,
+            `cat /tmp/ekairos-app-${appPort}.log || true`,
+            "exit 1",
+        ].join("\n"), "dev-server", "codex_sandbox_start_app_ok");
+        const portUrl = ensureOk(await actions.getPortUrl({ sandboxId, port: appPort }), "codex_sandbox_port_url");
+        appBaseUrl = String(portUrl.url ?? "").replace(/\/+$/, "");
+        if (appBaseUrl) {
+            const response = await fetch(`${appBaseUrl}/api/ekairos/domain`);
+            if (!response.ok)
+                throw new Error(`codex_sandbox_app_url_unavailable_${response.status}`);
+        }
+    }
+    if (sandboxConfig.checkpoint !== false && (sandboxConfig.createApp || sandboxConfig.installApp || sandboxConfig.startApp)) {
+        const checkpoint = await actions.createCheckpoint({
+            sandboxId,
+            comment: "codex reactor app ready",
+        });
+        if (checkpoint.ok) {
+            checkpoints.push({ label: "app-ready", checkpointId: String(checkpoint.data.checkpointId) });
+        }
+    }
+    const bridgeUrl = ensureOk(await actions.getPortUrl({ sandboxId, port: bridgePort }), "codex_sandbox_bridge_url");
+    const bridgeBaseUrl = String(bridgeUrl.url ?? "").replace(/\/+$/, "");
+    if (!bridgeBaseUrl)
+        throw new Error("codex_sandbox_bridge_url_missing");
+    const turn = await executeCodexHttpTurn({
+        ...args,
+        systemPrompt: args.systemPrompt,
+        config: {
+            ...args.config,
+            mode: "remote",
+            appServerUrl: bridgeBaseUrl,
+            repoPath,
+        },
+        actions: args.actions,
+        actionSpecs: args.actionSpecs,
+        context: args.context,
+        storedContext: args.storedContext,
+        contextIdentifier: args.contextIdentifier,
+    }, {
+        ...helpers,
+        emitProviderChunk: emitAndObserveProviderChunk,
+    }, bridgeBaseUrl);
+    return {
+        providerContextId: turn.providerContextId,
+        turnId: turn.turnId,
+        assistantText: turn.assistantText,
+        reasoningText: turn.reasoningText,
+        diff: turn.diff,
+        toolParts: turn.toolParts,
+        usage: turn.usage,
+        metadata: {
+            provider: "codex-sandbox",
+            dynamicTools: asUnknownArray(asRecord(turn.metadata).dynamicTools),
+            sandbox: {
+                sandboxId,
+                repoPath,
+                appBaseUrl,
+                bridgeBaseUrl,
+                bridgePort,
+                appPort,
+                processId: "",
+                streamId: "",
+                streamClientId: "",
+                commandProcesses: Object.fromEntries(observedCommandProcessResults.entries()),
+                checkpoints,
+            },
+            providerResponse: asRecord(turn.metadata).providerResponse,
+            streamTrace: helpers.streamTrace(),
+        },
+    };
+}
+async function readJsonResponse(response) {
+    const text = await response.text().catch(() => "");
+    if (!text.trim())
+        return {};
+    try {
+        return asRecord(JSON.parse(text));
+    }
+    catch {
+        return {};
+    }
+}
+async function codexAppServerRpc(baseUrl, method, params) {
+    const response = await fetch(`${baseUrl}/rpc`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ method, params }),
+    });
+    const payload = await readJsonResponse(response);
+    if (!response.ok) {
+        const error = asString(payload.error) || asString(asRecord(payload.error).message);
+        throw new Error(error || `codex_rpc_http_${response.status}`);
+    }
+    if (payload.error) {
+        const error = asString(payload.error) || asString(asRecord(payload.error).message);
+        throw new Error(error || "codex_rpc_error");
+    }
+    return payload;
+}
+async function executeCodexHttpTurn(args, helpers, baseUrl) {
+    const eventsResponse = await fetch(`${baseUrl}/events`, {
+        method: "GET",
+        headers: { accept: "text/event-stream" },
+    });
+    if (!eventsResponse.ok || !eventsResponse.body) {
+        throw new Error(`codex_events_unavailable_${eventsResponse.status}`);
+    }
+    const dynamicTools = buildCodexDynamicTools(args.actionSpecs);
+    const baseInstructions = asString(args.systemPrompt).trim();
+    const requestedThreadId = asString(args.config.providerContextId).trim();
+    let providerContextId = requestedThreadId;
+    if (providerContextId && isValidProviderContextId(providerContextId)) {
+        await codexAppServerRpc(baseUrl, "thread/resume", { threadId: providerContextId });
+    }
+    else {
+        const startParams = {
+            cwd: args.config.repoPath,
+            approvalPolicy: args.config.approvalPolicy ?? "never",
+            sandboxPolicy: args.config.sandboxPolicy && Object.keys(args.config.sandboxPolicy).length > 0
+                ? args.config.sandboxPolicy
+                : { type: "externalSandbox", networkAccess: "enabled" },
+            ...(dynamicTools.length > 0 ? { dynamicTools, dynamic_tools: dynamicTools } : {}),
+            ...(dynamicTools.length > 0
+                ? { experimentalRawEvents: true, persistExtendedHistory: true }
+                : {}),
+            ...(baseInstructions ? { baseInstructions } : {}),
+        };
+        if (args.config.model)
+            startParams.model = args.config.model;
+        const started = await codexAppServerRpc(baseUrl, "thread/start", startParams);
+        providerContextId =
+            asString(asRecord(asRecord(started.result).thread).id) ||
+                asString(asRecord(started.result).id) ||
+                asString(started.threadId);
+    }
+    if (!providerContextId)
+        throw new Error("codex_thread_id_missing");
+    const turnParams = {
+        threadId: providerContextId,
+        input: [{ type: "text", text: args.instruction }],
+        cwd: args.config.repoPath,
+        approvalPolicy: args.config.approvalPolicy ?? "never",
+        sandboxPolicy: args.config.sandboxPolicy && Object.keys(args.config.sandboxPolicy).length > 0
+            ? args.config.sandboxPolicy
+            : { type: "externalSandbox", networkAccess: "enabled" },
+        ...(dynamicTools.length > 0 ? { dynamicTools, dynamic_tools: dynamicTools } : {}),
+    };
+    if (args.config.model)
+        turnParams.model = args.config.model;
+    const turnStart = await codexAppServerRpc(baseUrl, "turn/start", turnParams);
+    let turnId = asString(asRecord(asRecord(turnStart.result).turn).id) ||
+        asString(asRecord(turnStart.result).id) ||
+        asString(turnStart.turnId);
+    const reader = eventsResponse.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    let assistantText = "";
+    let reasoningText = "";
+    let diff = "";
+    let usage = {};
+    let completedTurn = {};
+    const isScopedToTurn = (evt) => {
+        const params = asRecord(evt.params);
+        const evtTurnId = asString(params.turnId) || asString(asRecord(params.turn).id);
+        const evtThreadId = asString(params.threadId) ||
+            asString(params.providerContextId) ||
+            asString(asRecord(params.turn).threadId) ||
+            asString(asRecord(params.turn).providerContextId);
+        return ((evtTurnId && turnId && evtTurnId === turnId) ||
+            (evtThreadId && evtThreadId === providerContextId) ||
+            asString(evt.method).startsWith("thread/") ||
+            asString(evt.method).startsWith("context/"));
+    };
+    try {
+        while (true) {
+            const read = await reader.read();
+            if (read.done)
+                break;
+            if (!read.value)
+                continue;
+            buffer += decoder.decode(read.value, { stream: true });
+            const blocks = buffer.split("\n\n");
+            buffer = blocks.pop() ?? "";
+            for (const block of blocks) {
+                const data = parseSseDataBlock(block);
+                if (!data || data === "[DONE]")
+                    continue;
+                const evt = asRecord(JSON.parse(data));
+                const method = asString(evt.method);
+                if (!method)
+                    continue;
+                if (method === "item/tool/call" && evt.id !== undefined && evt.id !== null) {
+                    if (!isScopedToTurn(evt))
+                        continue;
+                    const toolParams = asRecord(evt.params);
+                    await helpers.emitProviderChunk(evt);
+                    const executed = await executeCodexDynamicToolCall(args, toolParams);
+                    await helpers.emitProviderChunk({
+                        method: "item/tool/result",
+                        params: {
+                            ...toolParams,
+                            result: executed.response,
+                            output: executed.output,
+                            success: executed.success,
+                            errorText: executed.errorText,
+                        },
+                    });
+                    await codexAppServerRespond(baseUrl, {
+                        id: evt.id,
+                        result: executed.response,
+                    });
+                    continue;
+                }
+                const params = asRecord(evt.params);
+                if (!isScopedToTurn(evt))
+                    continue;
+                await helpers.emitProviderChunk(evt);
+                if (method === "turn/started" && !turnId) {
+                    turnId = asString(asRecord(params.turn).id) || asString(params.turnId);
+                }
+                if (method === "item/agentMessage/delta") {
+                    assistantText += asString(params.delta);
+                }
+                if (method === "item/reasoning/summaryTextDelta" || method === "item/reasoning/textDelta") {
+                    reasoningText += asString(params.delta);
+                }
+                if (method === "turn/diff/updated") {
+                    diff = asString(params.diff);
+                }
+                if (method === "thread/tokenUsage/updated" || method === "context/tokenUsage/updated") {
+                    usage = asRecord(params.tokenUsage);
+                }
+                if (method === "item/completed") {
+                    const item = asRecord(params.item);
+                    if (asString(item.type) === "agentMessage" && asString(item.text).trim()) {
+                        assistantText = asString(item.text);
+                    }
+                    if (asString(item.type) === "reasoning" && asString(item.summary).trim()) {
+                        reasoningText = asString(item.summary);
+                    }
+                }
+                if (method === "turn/completed") {
+                    completedTurn = asRecord(params.turn);
+                    return {
+                        providerContextId,
+                        turnId: asString(completedTurn.id) || turnId,
+                        assistantText,
+                        reasoningText,
+                        diff,
+                        toolParts: asUnknownArray(completedTurn.toolParts),
+                        usage,
+                        metadata: {
+                            provider: "codex-app-server",
+                            providerResponse: completedTurn,
+                            dynamicTools: dynamicTools.map((tool) => asString(tool.name)).filter(Boolean),
+                            streamTrace: helpers.streamTrace(),
+                        },
+                    };
+                }
+                if (method === "turn/failed") {
+                    const evtTurnId = asString(params.turnId) || asString(asRecord(params.turn).id);
+                    throw new Error(`codex_turn_failed_${evtTurnId || turnId || "unknown"}`);
+                }
+            }
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    throw new Error("codex_turn_completion_missing");
+}
+export async function executeCodexAppServerTurnStep(args) {
+    "use step";
+    const baseUrl = normalizeAppServerBaseUrl(args.config.appServerUrl);
+    if (!baseUrl)
+        throw new Error("codex_app_server_url_required");
+    let sequence = 0;
+    const mappedChunks = [];
+    const chunkTypeCounters = new Map();
+    const providerChunkTypeCounters = new Map();
+    const contextWriter = args.contextStepStream?.getWriter();
+    const workflowWriter = args.writable?.getWriter();
+    const emitProviderChunk = async (providerChunk) => {
+        const mapped = defaultMapCodexChunk(providerChunk);
+        if (!mapped || mapped.skip)
+            return;
+        sequence += 1;
+        const identity = completeCodexMappedChunkIdentity(mapped, args.stepId);
+        const mappedChunk = {
+            at: new Date().toISOString(),
+            sequence,
+            chunkType: mapped.chunkType,
+            providerChunkType: mapped.providerChunkType,
+            partId: identity.partId,
+            providerPartId: identity.providerPartId,
+            partType: identity.partType,
+            partSlot: identity.partSlot,
+            actionRef: identity.actionRef,
+            data: mapped.data,
+            raw: mapped.raw ?? toJsonSafe(providerChunk),
+        };
+        mappedChunks.push(mappedChunk);
+        chunkTypeCounters.set(mappedChunk.chunkType, (chunkTypeCounters.get(mappedChunk.chunkType) ?? 0) + 1);
+        const providerType = mappedChunk.providerChunkType || "unknown";
+        providerChunkTypeCounters.set(providerType, (providerChunkTypeCounters.get(providerType) ?? 0) + 1);
+        const payload = {
+            at: mappedChunk.at,
+            sequence,
+            chunkType: mappedChunk.chunkType,
+            provider: "codex",
+            providerChunkType: mappedChunk.providerChunkType,
+            partId: mappedChunk.partId,
+            providerPartId: mappedChunk.providerPartId,
+            partType: mappedChunk.partType,
+            partSlot: mappedChunk.partSlot,
+            actionRef: mappedChunk.actionRef,
+            data: mappedChunk.data,
+            raw: mappedChunk.raw,
+        };
+        await contextWriter?.write(encodeContextStepStreamChunk(createContextStepStreamChunk({
+            ...payload,
+            stepId: args.stepId,
+        })));
+        await workflowWriter?.write({
+            type: "data-chunk.emitted",
+            data: {
+                type: "chunk.emitted",
+                contextId: args.contextId,
+                executionId: args.executionId,
+                stepId: args.stepId,
+                itemId: args.eventId,
+                ...payload,
+            },
+        });
+    };
+    const streamTrace = () => ({
+        totalChunks: mappedChunks.length,
+        chunkTypes: Object.fromEntries(chunkTypeCounters.entries()),
+        providerChunkTypes: Object.fromEntries(providerChunkTypeCounters.entries()),
+        chunks: mappedChunks,
+    });
+    try {
+        if (args.config.mode === "sandbox" || args.config.sandbox) {
+            return await executeCodexSandboxTurn(args, {
+                emitProviderChunk,
+                streamTrace,
+            });
+        }
+        if (String(args.config.appServerUrl || "").trim().replace(/\/+$/, "").endsWith("/turn")) {
+            const response = await fetch(args.config.appServerUrl, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({
+                    instruction: args.instruction,
+                    config: args.config,
+                    runtime: { source: "openai-reactor" },
+                }),
+            });
+            const payload = await readJsonResponse(response);
+            if (!response.ok) {
+                throw new Error(asString(payload.error) || `codex_turn_http_${response.status}`);
+            }
+            for (const chunk of asUnknownArray(payload.stream)) {
+                await emitProviderChunk(chunk);
+            }
+            return {
+                providerContextId: asString(payload.providerContextId) ||
+                    asString(payload.contextId) ||
+                    asString(args.config.providerContextId),
+                turnId: asString(payload.turnId),
+                assistantText: asString(payload.assistantText) || asString(payload.text),
+                reasoningText: asString(payload.reasoningText) || asString(payload.reasoning),
+                diff: asString(payload.diff),
+                toolParts: asUnknownArray(payload.toolParts),
+                usage: asRecord(payload.usage),
+                metadata: {
+                    provider: "codex-app-server",
+                    response: payload,
+                    streamTrace: streamTrace(),
+                },
+            };
+        }
+        return await executeCodexHttpTurn(args, {
+            emitProviderChunk,
+            streamTrace,
+        }, baseUrl);
+        const eventsResponse = await fetch(`${baseUrl}/events`, {
+            method: "GET",
+            headers: { accept: "text/event-stream" },
+        });
+        if (!eventsResponse.ok || !eventsResponse.body) {
+            throw new Error(`codex_events_unavailable_${eventsResponse.status}`);
+        }
+        const requestedThreadId = asString(args.config.providerContextId).trim();
+        let providerContextId = requestedThreadId;
+        if (providerContextId && isValidProviderContextId(providerContextId)) {
+            await codexAppServerRpc(baseUrl, "thread/resume", { threadId: providerContextId });
+        }
+        else {
+            const startParams = {
+                cwd: args.config.repoPath,
+                approvalPolicy: args.config.approvalPolicy ?? "never",
+                sandboxPolicy: args.config.sandboxPolicy && Object.keys(args.config.sandboxPolicy ?? {}).length > 0
+                    ? args.config.sandboxPolicy
+                    : { type: "externalSandbox", networkAccess: "enabled" },
+            };
+            if (args.config.model)
+                startParams.model = args.config.model;
+            const started = await codexAppServerRpc(baseUrl, "thread/start", startParams);
+            providerContextId =
+                asString(asRecord(asRecord(started.result).thread).id) ||
+                    asString(asRecord(started.result).id) ||
+                    asString(started.threadId);
+        }
+        if (!providerContextId)
+            throw new Error("codex_thread_id_missing");
+        const turnParams = {
+            threadId: providerContextId,
+            input: [{ type: "text", text: args.instruction }],
+            cwd: args.config.repoPath,
+            approvalPolicy: args.config.approvalPolicy ?? "never",
+            sandboxPolicy: args.config.sandboxPolicy && Object.keys(args.config.sandboxPolicy ?? {}).length > 0
+                ? args.config.sandboxPolicy
+                : { type: "externalSandbox", networkAccess: "enabled" },
+        };
+        if (args.config.model)
+            turnParams.model = args.config.model;
+        const turnStart = await codexAppServerRpc(baseUrl, "turn/start", turnParams);
+        let turnId = asString(asRecord(asRecord(turnStart.result).turn).id) ||
+            asString(asRecord(turnStart.result).id) ||
+            asString(turnStart.turnId);
+        const reader = eventsResponse.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        let assistantText = "";
+        let reasoningText = "";
+        let diff = "";
+        let usage = {};
+        let completedTurn = {};
+        try {
+            while (true) {
+                const read = await reader.read();
+                if (read.done)
+                    break;
+                if (!read.value)
+                    continue;
+                buffer += decoder.decode(read.value, { stream: true });
+                const blocks = buffer.split("\n\n");
+                buffer = blocks.pop() ?? "";
+                for (const block of blocks) {
+                    const data = parseSseDataBlock(block);
+                    if (!data || data === "[DONE]")
+                        continue;
+                    const evt = asRecord(JSON.parse(String(data)));
+                    const method = asString(evt.method);
+                    if (!method)
+                        continue;
+                    const params = asRecord(evt.params);
+                    const evtTurnId = asString(params.turnId) || asString(asRecord(params.turn).id);
+                    const evtThreadId = asString(params.threadId) ||
+                        asString(params.providerContextId) ||
+                        asString(asRecord(params.turn).threadId) ||
+                        asString(asRecord(params.turn).providerContextId);
+                    const scopedToTurn = (evtTurnId && turnId && evtTurnId === turnId) ||
+                        (evtThreadId && evtThreadId === providerContextId) ||
+                        method.startsWith("thread/") ||
+                        method.startsWith("context/");
+                    if (!scopedToTurn)
+                        continue;
+                    await emitProviderChunk(evt);
+                    if (method === "turn/started" && !turnId) {
+                        turnId = asString(asRecord(params.turn).id) || evtTurnId;
+                    }
+                    if (method === "item/agentMessage/delta") {
+                        assistantText += asString(params.delta);
+                    }
+                    if (method === "item/reasoning/summaryTextDelta" || method === "item/reasoning/textDelta") {
+                        reasoningText += asString(params.delta);
+                    }
+                    if (method === "turn/diff/updated") {
+                        diff = asString(params.diff);
+                    }
+                    if (method === "thread/tokenUsage/updated" || method === "context/tokenUsage/updated") {
+                        usage = asRecord(params.tokenUsage);
+                    }
+                    if (method === "item/completed") {
+                        const item = asRecord(params.item);
+                        if (asString(item.type) === "agentMessage" && asString(item.text).trim()) {
+                            assistantText = asString(item.text);
+                        }
+                        if (asString(item.type) === "reasoning" && asString(item.summary).trim()) {
+                            reasoningText = asString(item.summary);
+                        }
+                    }
+                    if (method === "turn/completed") {
+                        completedTurn = asRecord(params.turn);
+                        return {
+                            providerContextId,
+                            turnId: asString(completedTurn.id) || turnId,
+                            assistantText,
+                            reasoningText,
+                            diff,
+                            toolParts: asUnknownArray(completedTurn.toolParts),
+                            usage,
+                            metadata: {
+                                provider: "codex-app-server",
+                                providerResponse: completedTurn,
+                                streamTrace: streamTrace(),
+                            },
+                        };
+                    }
+                    if (method === "turn/failed") {
+                        throw new Error(`codex_turn_failed_${evtTurnId || turnId || "unknown"}`);
+                    }
+                }
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => { });
+        }
+        throw new Error("codex_turn_completion_missing");
+    }
+    finally {
+        contextWriter?.releaseLock();
+        workflowWriter?.releaseLock();
+    }
+}
 /**
  * Codex App Server reactor for @ekairos/events.
  *
@@ -298,7 +1690,6 @@ export function createCodexReactor(options) {
     const maxPersistedStreamChunks = Math.max(0, Number(options.maxPersistedStreamChunks ?? 300));
     return async (params) => {
         let chunkSequence = 0;
-        const contextStepStreamWriter = params.contextStepStream?.getWriter();
         const chunkTypeCounters = new Map();
         const providerChunkTypeCounters = new Map();
         const capturedChunks = [];
@@ -307,13 +1698,12 @@ export function createCodexReactor(options) {
         const context = asRecord(params.context.content);
         const instruction = (options.buildInstruction
             ? await options.buildInstruction({
-                env: params.env,
                 context,
                 triggerEvent: params.triggerEvent,
             })
             : defaultInstructionFromTrigger(params.triggerEvent)).trim();
         const config = await options.resolveConfig({
-            env: params.env,
+            runtime: params.runtime,
             context,
             triggerEvent: params.triggerEvent,
             contextId: params.contextId,
@@ -322,6 +1712,27 @@ export function createCodexReactor(options) {
             stepId: params.stepId,
             iteration: params.iteration,
         });
+        const persistedReactor = asRecord(params.context.reactor);
+        const persistedReactorState = asRecord(persistedReactor.state);
+        if (!config.providerContextId) {
+            const providerContextId = asString(persistedReactorState.providerContextId);
+            if (providerContextId)
+                config.providerContextId = providerContextId;
+        }
+        if (config.sandbox) {
+            const sandboxState = asRecord(persistedReactorState.sandbox);
+            if (!config.sandbox.sandboxId) {
+                const sandboxId = asString(sandboxState.sandboxId);
+                if (sandboxId)
+                    config.sandbox.sandboxId = sandboxId;
+            }
+            if (!config.repoPath) {
+                const repoPath = asString(sandboxState.repoPath);
+                if (repoPath)
+                    config.repoPath = repoPath;
+            }
+        }
+        const effectiveActionSpecs = toCodexActionSpecs(actionsToActionSpecs(params.actions));
         const startedAtMs = Date.now();
         let streamedAssistantText = "";
         let streamedReasoningText = "";
@@ -333,6 +1744,8 @@ export function createCodexReactor(options) {
             const mappedMethod = asString(mappedData.method);
             if (mappedMethod !== "item/started" &&
                 mappedMethod !== "item/completed" &&
+                mappedMethod !== "item/tool/call" &&
+                mappedMethod !== "item/tool/result" &&
                 mappedMethod !== "thread/tokenUsage/updated" &&
                 mappedMethod !== "context/tokenUsage/updated" &&
                 mappedMethod !== "turn/completed" &&
@@ -381,12 +1794,17 @@ export function createCodexReactor(options) {
                 return;
             const now = new Date().toISOString();
             chunkSequence += 1;
+            const identity = completeCodexMappedChunkIdentity(mapped, params.stepId);
             const mappedChunk = {
                 at: now,
                 sequence: chunkSequence,
                 chunkType: mapped.chunkType,
                 providerChunkType: mapped.providerChunkType,
-                actionRef: mapped.actionRef,
+                partId: identity.partId,
+                providerPartId: identity.providerPartId,
+                partType: identity.partType,
+                partSlot: identity.partSlot,
+                actionRef: identity.actionRef,
                 data: mapped.data,
                 raw: includeRawProviderChunksInOutput
                     ? mapped.raw ?? toJsonSafe(providerChunk)
@@ -448,12 +1866,25 @@ export function createCodexReactor(options) {
                 chunkType: mappedChunk.chunkType,
                 provider: "codex",
                 providerChunkType: mappedChunk.providerChunkType,
+                partId: mappedChunk.partId,
+                providerPartId: mappedChunk.providerPartId,
+                partType: mappedChunk.partType,
+                partSlot: mappedChunk.partSlot,
                 actionRef: mappedChunk.actionRef,
                 data: mappedChunk.data,
                 raw: mapped.raw ?? toJsonSafe(providerChunk),
             };
-            if (contextStepStreamWriter) {
-                await contextStepStreamWriter.write(encodeContextStepStreamChunk(createContextStepStreamChunk(payload)));
+            if (params.contextStepStream) {
+                const writer = params.contextStepStream.getWriter();
+                try {
+                    await writer.write(encodeContextStepStreamChunk(createContextStepStreamChunk({
+                        ...payload,
+                        stepId: params.stepId,
+                    })));
+                }
+                finally {
+                    writer.releaseLock();
+                }
             }
             if (params.writable) {
                 const writer = params.writable.getWriter();
@@ -475,9 +1906,9 @@ export function createCodexReactor(options) {
                 }
             }
         };
-        try {
-            const turn = await options.executeTurn({
-                env: params.env,
+        const turn = options.executeTurn
+            ? await options.executeTurn({
+                runtime: params.runtime,
                 context,
                 triggerEvent: params.triggerEvent,
                 contextId: params.contextId,
@@ -487,71 +1918,113 @@ export function createCodexReactor(options) {
                 iteration: params.iteration,
                 instruction,
                 config,
+                actions: params.actions,
+                actionSpecs: effectiveActionSpecs,
                 skills: params.skills,
+                storedContext: params.context,
+                contextIdentifier: params.contextIdentifier,
+                contextStepStream: params.contextStepStream,
                 writable: params.writable,
-                silent: params.silent,
                 emitChunk,
+            })
+            : await executeCodexAppServerTurnStep({
+                config,
+                runtime: params.runtime,
+                instruction,
+                systemPrompt: params.systemPrompt,
+                contextId: params.contextId,
+                eventId: params.eventId,
+                executionId: params.executionId,
+                stepId: params.stepId,
+                iteration: params.iteration,
+                context,
+                actions: params.actions,
+                actionSpecs: effectiveActionSpecs,
+                storedContext: params.context,
+                contextIdentifier: params.contextIdentifier,
+                contextStepStream: params.contextStepStream,
+                writable: params.writable,
             });
-            const finishedAtMs = Date.now();
-            const streamTrace = includeStreamTraceInOutput
-                ? {
-                    totalChunks: chunkSequence,
-                    chunkTypes: Object.fromEntries(chunkTypeCounters.entries()),
-                    providerChunkTypes: Object.fromEntries(providerChunkTypeCounters.entries()),
-                }
-                : undefined;
-            const usagePayload = toJsonSafe(turn.usage ?? asRecord(turn.metadata).usage);
-            const usageMetrics = extractUsageMetrics(usagePayload);
-            const assistantEvent = {
-                id: params.eventId,
-                type: OUTPUT_ITEM_TYPE,
-                channel: "web",
-                createdAt: new Date().toISOString(),
-                status: "completed",
-                content: {
-                    parts: buildCodexParts({
-                        toolName,
-                        includeReasoningPart,
-                        semanticChunks,
-                        rawChunks: allCapturedChunks,
-                        result: turn,
-                        instruction,
-                        streamTrace,
-                    }),
-                },
-            };
-            return {
-                assistantEvent,
-                actionRequests: [],
-                messagesForModel: [],
-                llm: {
-                    provider: "codex",
-                    model: asString(config.model || "codex"),
-                    promptTokens: usageMetrics.promptTokens,
-                    promptTokensCached: usageMetrics.promptTokensCached,
-                    promptTokensUncached: usageMetrics.promptTokensUncached,
-                    completionTokens: usageMetrics.completionTokens,
-                    totalTokens: usageMetrics.totalTokens,
-                    latencyMs: Math.max(0, finishedAtMs - startedAtMs),
-                    rawUsage: usagePayload,
-                    rawProviderMetadata: toJsonSafe({
-                        providerContextId: turn.providerContextId,
-                        turnId: turn.turnId,
-                        metadata: turn.metadata ?? null,
-                        streamTrace: streamTrace
-                            ? {
-                                totalChunks: streamTrace.totalChunks,
-                                chunkTypes: streamTrace.chunkTypes,
-                                providerChunkTypes: streamTrace.providerChunkTypes,
-                            }
-                            : undefined,
-                    }),
+        const finishedAtMs = Date.now();
+        const returnedStreamTrace = asRecord(asRecord(turn.metadata).streamTrace);
+        const returnedChunks = Array.isArray(returnedStreamTrace.chunks)
+            ? returnedStreamTrace.chunks
+            : [];
+        const effectiveRawChunks = allCapturedChunks.length > 0 ? allCapturedChunks : returnedChunks;
+        const effectiveSemanticChunks = semanticChunks.length > 0 ? semanticChunks : returnedChunks;
+        const returnedChunkTypes = asNumberRecord(returnedStreamTrace.chunkTypes);
+        const returnedProviderChunkTypes = asNumberRecord(returnedStreamTrace.providerChunkTypes);
+        const returnedTotalChunks = typeof returnedStreamTrace.totalChunks === "number"
+            ? returnedStreamTrace.totalChunks
+            : returnedChunks.length;
+        const streamTrace = includeStreamTraceInOutput
+            ? {
+                totalChunks: chunkSequence || returnedTotalChunks,
+                chunkTypes: chunkSequence > 0
+                    ? Object.fromEntries(chunkTypeCounters.entries())
+                    : returnedChunkTypes,
+                providerChunkTypes: chunkSequence > 0
+                    ? Object.fromEntries(providerChunkTypeCounters.entries())
+                    : returnedProviderChunkTypes,
+            }
+            : undefined;
+        const usagePayload = toJsonSafe(turn.usage ?? asRecord(turn.metadata).usage);
+        const usageMetrics = extractUsageMetrics(usagePayload);
+        const assistantEvent = {
+            id: params.eventId,
+            type: OUTPUT_ITEM_TYPE,
+            channel: "web",
+            createdAt: new Date().toISOString(),
+            status: "completed",
+            content: {
+                parts: buildCodexParts({
+                    toolName,
+                    includeReasoningPart,
+                    semanticChunks: effectiveSemanticChunks,
+                    rawChunks: effectiveRawChunks,
+                    result: turn,
+                    instruction,
+                    streamTrace,
+                }),
+            },
+        };
+        return {
+            assistantEvent,
+            actionRequests: [],
+            messagesForModel: [],
+            reactor: {
+                kind: "codex",
+                state: {
+                    providerContextId: turn.providerContextId,
+                    lastTurnId: turn.turnId,
+                    provider: asString(asRecord(turn.metadata).provider || "codex"),
+                    sandbox: asRecord(asRecord(turn.metadata).sandbox),
                 },
-            };
-        }
-        finally {
-            contextStepStreamWriter?.releaseLock();
-        }
+            },
+            llm: {
+                provider: "codex",
+                model: asString(config.model || "codex"),
+                promptTokens: usageMetrics.promptTokens,
+                promptTokensCached: usageMetrics.promptTokensCached,
+                promptTokensUncached: usageMetrics.promptTokensUncached,
+                completionTokens: usageMetrics.completionTokens,
+                totalTokens: usageMetrics.totalTokens,
+                latencyMs: Math.max(0, finishedAtMs - startedAtMs),
+                rawUsage: usagePayload,
+                rawProviderMetadata: toJsonSafe({
+                    providerContextId: turn.providerContextId,
+                    turnId: turn.turnId,
+                    metadata: turn.metadata ?? null,
+                    streamTrace: streamTrace
+                        ? {
+                            totalChunks: streamTrace.totalChunks,
+                            chunkTypes: streamTrace.chunkTypes,
+                            providerChunkTypes: streamTrace.providerChunkTypes,
+                        }
+                        : undefined,
+                }),
+            },
+        };
     };
 }
 //# sourceMappingURL=codex.reactor.js.map