@fitlab-ai/agent-infra 0.11.11 → 0.11.13

package/dist/lib/agent-clients/adapters/codex-lifecycle/cli.js

@@ -0,0 +1,447 @@
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread } from './app-server.js';
+import { createCodexLifecycleStore } from './store.js';
+import { verifyCodexSandboxControllerContextWithWarnings } from './sandbox-controller.js';
+import { resolveTaskRef } from '../../../task/resolve-ref.js';
+import { resolveTaskContext } from '../../../task/resolve-ref.js';
+import { hasSealableOrchestrationDelegation, readRun } from '../../../task/orchestration.js';
+import { parseCodexLifecycleBinding, verifyCodexLifecycleTaskBinding } from './binding.js';
+import { activateCodexOrchestrationDelegation, activateCodexSpawnDelegation, reconcileCodexOrchestrationDelegation, sealCodexOrchestrationDelegation, sealCodexParentDelegation } from '../codex-orchestration.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from '../../../internal/cli-route-inventory.js';
+const USAGE = 'Usage: agent-infra-internal codex-lifecycle <hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
+const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
+function output(value) {
+    process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+function failure(code, message) {
+    output({ status: 'failed', changed: false, evidence: null, diagnostics: [], error: { code, message } });
+    process.exitCode = 1;
+}
+function outputBridgeResult(result) {
+    if (result.error?.code === 'ORCHESTRATION_DELEGATION_MISSING') {
+        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+        return;
+    }
+    output(result);
+    if (result.status !== 'running')
+        process.exitCode = 1;
+}
+function parse(args) {
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return null;
+    }
+    const operation = args[0];
+    if (!operation) {
+        failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', 'operation is required');
+        return null;
+    }
+    const allowed = {
+        'hook-event': ['--event', '--bridge'],
+        'resolve-start': ['--child-id'],
+        'resolve-stop': ['--child-id'],
+        preflight: ['--format', '--session-id', '--turn-id', '--tool-use-id'],
+        consume: ['--child-id', '--consumer']
+    }[operation];
+    if (!allowed) {
+        failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', 'unknown operation');
+        return null;
+    }
+    const values = {};
+    for (let index = 1; index < args.length; index += 1) {
+        const flag = args[index];
+        if (!allowed.includes(flag) || Object.hasOwn(values, flag)) {
+            failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
+            return null;
+        }
+        const value = args[++index];
+        if (!value || value.startsWith('--')) {
+            failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', `option '${flag}' requires a value`);
+            return null;
+        }
+        values[flag] = value;
+    }
+    return Object.freeze({ operation, values: Object.freeze(values) });
+}
+function cliVersion() {
+    const result = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+    const version = /codex-cli\s+(\d+\.\d+\.\d+)/.exec(result.stdout ?? '')?.[1];
+    if (result.status !== 0 || !version)
+        throw new Error('Codex CLI version is unavailable');
+    return version;
+}
+function hookDefinitionHash() {
+    const file = path.join(process.cwd(), '.codex', 'hooks.json');
+    return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+function resolveLifecycleTaskContext() {
+    const controllerPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+    const taskId = controllerPath
+        ? verifyCodexSandboxControllerContextWithWarnings(controllerPath, { repoRoot: process.cwd() }).context.taskId
+        : process.env.AGENT_INFRA_TASK_ID;
+    const context = taskId
+        ? resolveTaskRef(taskId, { repoRoot: process.cwd() })
+        : resolveTaskContext(undefined, { repoRoot: process.cwd() });
+    if (!context.ok)
+        throw new Error(`${context.code}: ${context.message}`);
+    return context;
+}
+function verifyPendingBinding(binding, nativeAgent, expected = {}) {
+    const resolved = resolveLifecycleTaskContext();
+    const run = readRun(resolved.taskDir);
+    if (!run)
+        throw new Error('Codex lifecycle task binding has no current orchestration run');
+    verifyCodexLifecycleTaskBinding(binding, run, nativeAgent, expected);
+    return { resolved, run };
+}
+function verifyStoredBinding(taskId, binding, nativeAgent) {
+    const resolved = resolveTaskRef(taskId, { repoRoot: process.cwd() });
+    if (!resolved.ok)
+        throw new Error(`${resolved.code}: ${resolved.message}`);
+    const run = readRun(resolved.taskDir);
+    const receipt = run?.pendingDelegation;
+    if (!receipt || run?.status !== 'running'
+        || receipt.id !== binding.receiptId
+        || receipt.runId !== binding.runId
+        || receipt.client !== 'codex'
+        || receipt.role !== nativeRole(nativeAgent)) {
+        throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: stored task receipt is not the current pending lifecycle event');
+    }
+}
+function sameTaskBinding(left, right) {
+    return left?.runId === right.runId && left.receiptId === right.receiptId;
+}
+function nativeRole(nativeAgent) {
+    const match = /^agent-infra-lifecycle-(executor|reviewer)$/u.exec(nativeAgent);
+    return match?.[1] ?? null;
+}
+function taskScopedStore(taskId) {
+    return createCodexLifecycleStore({
+        repoRoot: process.cwd(),
+        taskId,
+        cliVersion: cliVersion()
+    });
+}
+async function readStdin() {
+    let input = '';
+    process.stdin.setEncoding('utf8');
+    for await (const chunk of process.stdin) {
+        input += chunk;
+        if (Buffer.byteLength(input) > 64 * 1024)
+            throw new Error('Codex lifecycle input exceeds 64 KiB');
+    }
+    return JSON.parse(input || '{}');
+}
+function recordFromPayload(phase, payload, taskBinding) {
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        throw new Error('Codex lifecycle hook payload must be an object');
+    }
+    const value = payload;
+    const text = (key) => typeof value[key] === 'string' ? value[key] : '';
+    if (!MANAGED_AGENT.test(text('nativeAgent')))
+        return null;
+    if (phase === 'pre-tool')
+        return {
+            type: 'hook-spawn',
+            sessionId: text('sessionId'),
+            turnId: text('turnId'),
+            toolUseId: text('toolUseId'),
+            nativeAgent: text('nativeAgent'),
+            ...(text('requestedModel') ? { requestedModel: text('requestedModel') } : {}),
+            ...(text('requestedReasoningEffort') ? { requestedReasoningEffort: text('requestedReasoningEffort') } : {}),
+            hookDefinitionHash: text('hookDefinitionHash'),
+            ...(taskBinding ? { taskBinding } : {})
+        };
+    if (phase === 'subagent-start')
+        return {
+            type: 'hook-child',
+            sessionId: text('sessionId'),
+            turnId: text('turnId'),
+            childThreadId: text('childThreadId'),
+            nativeAgent: text('nativeAgent'),
+            source: 'hook'
+        };
+    if (phase === 'subagent-stop')
+        return {
+            type: 'hook-stop',
+            sessionId: text('sessionId'),
+            turnId: text('turnId'),
+            childThreadId: text('childThreadId'),
+            nativeAgent: text('nativeAgent')
+        };
+    if (phase === 'post-tool')
+        return null;
+    throw new Error(`unknown Codex lifecycle hook phase '${phase}'`);
+}
+function payloadText(payload, key) {
+    return payload && typeof payload === 'object' && !Array.isArray(payload)
+        && typeof payload[key] === 'string'
+        ? payload[key]
+        : '';
+}
+function resolveHookTaskContext(phase, toolName, payload) {
+    const spawnName = payloadText(payload, 'taskName');
+    const needsSpawnBinding = phase === 'pre-tool' || (phase === 'post-tool' && toolName === 'collaborationspawn_agent');
+    const spawnBinding = needsSpawnBinding ? parseCodexLifecycleBinding(spawnName) : null;
+    if (needsSpawnBinding && !spawnBinding) {
+        throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISSING: task_name must carry the prepared task binding');
+    }
+    const nativeAgent = payloadText(payload, 'nativeAgent');
+    const taskContext = spawnBinding
+        ? verifyPendingBinding(spawnBinding.binding, nativeAgent, {
+            requestedModel: payloadText(payload, 'requestedModel') || undefined,
+            requestedReasoningEffort: payloadText(payload, 'requestedReasoningEffort') || undefined
+        }).resolved
+        : resolveLifecycleTaskContext();
+    const store = taskScopedStore(taskContext.taskId);
+    if (spawnBinding)
+        verifyStoredBinding(taskContext.taskId, spawnBinding.binding, nativeAgent);
+    return { spawnBinding, nativeAgent, taskContext, store };
+}
+function currentHookTaskBinding(taskDir, taskId, spawnBinding, nativeAgent) {
+    if (!spawnBinding) {
+        const run = readRun(taskDir);
+        const receipt = run?.pendingDelegation;
+        if (!receipt || receipt.client !== 'codex' || receipt.role !== nativeRole(nativeAgent)) {
+            throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: no matching pending task receipt');
+        }
+        verifyStoredBinding(taskId, { taskId: receipt.taskId, runId: receipt.runId, receiptId: receipt.id }, nativeAgent);
+    }
+    const receipt = readRun(taskDir)?.pendingDelegation;
+    return receipt && { taskId: receipt.taskId, runId: receipt.runId, receiptId: receipt.id };
+}
+function validateHookStopIdentity(store, event, currentBinding) {
+    const record = store.read(event.childThreadId);
+    const child = record.state.child;
+    if (!currentBinding || !sameTaskBinding(record.taskBinding, currentBinding)
+        || !child
+        || child.sessionId !== event.sessionId
+        || child.turnId !== event.turnId
+        || child.childThreadId !== event.childThreadId
+        || child.nativeAgent !== event.nativeAgent) {
+        throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: stop event does not match the current task receipt and child');
+    }
+}
+function matchingHookChildSpawns(store, binding, event) {
+    return binding ? store.findByTaskBinding(binding).filter((record) => record.state.spawn?.sessionId === event.sessionId
+        && record.state.spawn?.nativeAgent === event.nativeAgent) : [];
+}
+async function applyHookChildEvent(event, currentBinding, taskContext, store, bridge, resolved) {
+    const candidates = matchingHookChildSpawns(store, currentBinding, event);
+    if (candidates.length !== 1) {
+        throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: child event has no unique spawn for the current task receipt');
+    }
+    const childResolution = resolved ?? await resolveCodexThread(event.childThreadId);
+    verifyStoredBinding(taskContext.taskId, currentBinding, event.nativeAgent);
+    const latestCandidates = matchingHookChildSpawns(store, currentBinding, event);
+    if (latestCandidates.length !== 1 || latestCandidates[0].revision !== candidates[0].revision) {
+        throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: task receipt spawn became ambiguous during child resolution');
+    }
+    if (childResolution.resolution.thread.childThreadId !== event.childThreadId
+        || childResolution.resolution.thread.parentThreadId !== event.sessionId
+        || childResolution.resolution.thread.nativeAgent !== event.nativeAgent) {
+        throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: resolved child does not match the current spawn');
+    }
+    verifyStoredBinding(taskContext.taskId, currentBinding, event.nativeAgent);
+    const spawn = latestCandidates[0].state.spawn;
+    if (!spawn)
+        throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: current spawn record is missing');
+    const result = store.applyToSpawn({
+        sessionId: spawn.sessionId, turnId: spawn.turnId, toolUseId: spawn.toolUseId, taskBinding: currentBinding
+    }, { ...event, parentThreadId: childResolution.resolution.thread.parentThreadId }, latestCandidates[0].revision);
+    if (bridge) {
+        outputBridgeResult(await activateCodexOrchestrationDelegation(event.childThreadId, {
+            store, orchestrationOptions: { repoRoot: process.cwd(), taskId: taskContext.taskId },
+            resolveThread: async () => childResolution
+        }));
+        return;
+    }
+    output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: childResolution.diagnostics, error: result.state.error });
+    if (result.state.status === 'invalid')
+        process.exitCode = 1;
+}
+async function handleBridgePostTool(toolName, payload, nativeAgent, taskId, store) {
+    const orchestrationOptions = { repoRoot: process.cwd(), taskId };
+    if (toolName === 'collaborationspawn_agent') {
+        if (!MANAGED_AGENT.test(nativeAgent)) {
+            output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+            return;
+        }
+        const requestedModel = payloadText(payload, 'requestedModel');
+        const requestedReasoningEffort = payloadText(payload, 'requestedReasoningEffort');
+        const bridged = await activateCodexSpawnDelegation({
+            sessionId: payloadText(payload, 'sessionId'), turnId: payloadText(payload, 'turnId'),
+            toolUseId: payloadText(payload, 'toolUseId'), transcriptPath: payloadText(payload, 'transcriptPath'),
+            nativeAgent, taskName: payloadText(payload, 'taskName'),
+            ...(requestedModel ? { requestedModel } : {}),
+            ...(requestedReasoningEffort ? { requestedReasoningEffort } : {})
+        }, { store, orchestrationOptions });
+        outputBridgeResult(bridged);
+        return;
+    }
+    if (toolName === 'collaborationwait_agent') {
+        outputBridgeResult(await sealCodexParentDelegation(payloadText(payload, 'sessionId'), { store, orchestrationOptions }));
+        return;
+    }
+    output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+}
+async function sealConsumedHookStop(event, store, taskId) {
+    const result = await sealCodexOrchestrationDelegation(event.childThreadId, {
+        store, orchestrationOptions: { repoRoot: process.cwd(), taskId }
+    });
+    outputBridgeResult(result);
+}
+function handleMissingHookEvent(phase, bridge, payload, taskId) {
+    if (phase === 'post-tool' && bridge) {
+        const value = payload;
+        outputBridgeResult(reconcileCodexOrchestrationDelegation(String(value.childThreadId ?? ''), {
+            orchestrationOptions: { repoRoot: process.cwd(), taskId }
+        }));
+        return;
+    }
+    output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+}
+async function handlePreflight(parsed) {
+    const format = parsed.values['--format'] ?? 'json';
+    if (!['text', 'json'].includes(format))
+        throw new Error("format must be 'text' or 'json'");
+    const runtimeFields = [parsed.values['--session-id'], parsed.values['--turn-id'], parsed.values['--tool-use-id']];
+    if (runtimeFields.some(Boolean) && !runtimeFields.every(Boolean)) {
+        throw new Error('preflight runtime identity requires --session-id, --turn-id, and --tool-use-id together');
+    }
+    const runtimeIdentity = runtimeFields.every(Boolean)
+        ? { sessionId: runtimeFields[0], turnId: runtimeFields[1], toolUseId: runtimeFields[2] }
+        : undefined;
+    const result = await preflightCodexLifecycleEvidence(process.cwd(), runtimeIdentity);
+    if (format === 'text') {
+        process.stdout.write(`Codex lifecycle static preflight: ready\nCLI: ${result.cliVersion}\nRuntime hook liveness: ${result.runtimeLiveness ? 'observed' : 'not-yet-observed'}\n`);
+    }
+    else
+        output({ status: 'ready', changed: false, evidence: result, diagnostics: result.diagnostics, error: null });
+}
+async function codexLifecycle(args = []) {
+    if (!ensureInternalHandlerRoute('codex-lifecycle', args))
+        return;
+    const parsed = parse(args);
+    if (!parsed || process.exitCode)
+        return;
+    try {
+        if (internalHandlerRoute('codex-lifecycle', 'preflight', parsed.operation)) {
+            await handlePreflight(parsed);
+            return;
+        }
+        if (internalHandlerRoute('codex-lifecycle', 'hook-event', parsed.operation)) {
+            const phase = parsed.values['--event'];
+            if (!phase || !['pre-tool', 'subagent-start', 'post-tool', 'subagent-stop'].includes(phase)) {
+                throw new Error('hook-event requires a known --event');
+            }
+            if (parsed.values['--bridge'] !== undefined && parsed.values['--bridge'] !== 'true') {
+                throw new Error("hook-event --bridge must be 'true'");
+            }
+            const payload = await readStdin();
+            const toolName = payloadText(payload, 'toolName');
+            const hookContext = resolveHookTaskContext(phase, toolName, payload);
+            const { spawnBinding, nativeAgent, taskContext, store } = hookContext;
+            if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
+                await handleBridgePostTool(toolName, payload, nativeAgent, taskContext.taskId, store);
+                return;
+            }
+            const event = recordFromPayload(phase, payload, spawnBinding?.binding);
+            if (!event) {
+                handleMissingHookEvent(phase, parsed.values['--bridge'] === 'true', payload, taskContext.taskId);
+                return;
+            }
+            const currentBinding = currentHookTaskBinding(taskContext.taskDir, taskContext.taskId, spawnBinding, nativeAgent);
+            if (event.type === 'hook-stop') {
+                validateHookStopIdentity(store, event, currentBinding);
+            }
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop'
+                && store.read(event.childThreadId).consumer) {
+                await sealConsumedHookStop(event, store, taskContext.taskId);
+                return;
+            }
+            if (event.type === 'hook-child') {
+                await applyHookChildEvent(event, currentBinding, taskContext, store, parsed.values['--bridge'] === 'true');
+                return;
+            }
+            if (!currentBinding)
+                throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISMATCH: current task receipt is missing');
+            verifyStoredBinding(taskContext.taskId, currentBinding, nativeAgent);
+            const result = store.apply(event);
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
+                if (!hasSealableOrchestrationDelegation('codex', event.childThreadId, { repoRoot: process.cwd(), taskId: taskContext.taskId })) {
+                    output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+                    return;
+                }
+                output({
+                    status: result.state.status,
+                    changed: true,
+                    evidence: result.state,
+                    diagnostics: [],
+                    error: result.state.error
+                });
+                return;
+            }
+            output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: [], error: result.state.error });
+            if (result.state.status === 'invalid')
+                process.exitCode = 1;
+            return;
+        }
+        const childThreadId = parsed.values['--child-id'];
+        if (!childThreadId)
+            throw new Error(`operation '${parsed.operation}' requires --child-id`);
+        const taskContext = resolveLifecycleTaskContext();
+        const store = taskScopedStore(taskContext.taskId);
+        const existing = store.read(childThreadId);
+        if (!existing.taskBinding)
+            throw new Error('CODEX_LIFECYCLE_TASK_BINDING_MISSING: stored lifecycle identity has no task binding');
+        verifyStoredBinding(taskContext.taskId, existing.taskBinding, existing.state.startEvidence?.nativeAgent ?? existing.state.spawn?.nativeAgent ?? '');
+        if (internalHandlerRoute('codex-lifecycle', 'resolve-start', parsed.operation)) {
+            if (store.read(childThreadId).state.spawn?.hookDefinitionHash !== hookDefinitionHash()) {
+                throw new Error('Codex lifecycle hook definition hash is stale');
+            }
+            const resolved = await resolveCodexThread(childThreadId);
+            verifyStoredBinding(taskContext.taskId, existing.taskBinding, existing.state.startEvidence?.nativeAgent ?? existing.state.spawn?.nativeAgent ?? '');
+            let latest = store.apply(resolved.resolution.thread);
+            for (const reroute of resolved.reroutes)
+                latest = store.apply(reroute);
+            latest = store.apply(resolved.resolution.settings);
+            output({ status: latest.state.status, changed: true, evidence: latest.state.startEvidence, diagnostics: resolved.diagnostics, error: latest.state.error });
+            if (latest.state.status !== 'start-ready')
+                process.exitCode = 1;
+            return;
+        }
+        if (internalHandlerRoute('codex-lifecycle', 'resolve-stop', parsed.operation)) {
+            const stopTurnId = store.read(childThreadId).state.stop?.turnId;
+            if (!stopTurnId)
+                throw new Error('Codex lifecycle stop hook is not available');
+            const terminal = await resolveCodexTerminal(childThreadId, stopTurnId);
+            verifyStoredBinding(taskContext.taskId, existing.taskBinding, existing.state.startEvidence?.nativeAgent ?? existing.state.spawn?.nativeAgent ?? '');
+            const latest = store.apply(terminal);
+            if (latest.state.status !== 'stop-ready') {
+                throw new Error(`Codex lifecycle stop evidence is not ready (status=${latest.state.status})`);
+            }
+            output({ status: latest.state.status, changed: true, evidence: latest.state.stopEvidence, diagnostics: [], error: latest.state.error });
+            return;
+        }
+        if (internalHandlerRoute('codex-lifecycle', 'consume', parsed.operation)) {
+            const consumer = parsed.values['--consumer'];
+            if (!consumer)
+                throw new Error('consume requires --consumer');
+            verifyStoredBinding(taskContext.taskId, existing.taskBinding, existing.state.startEvidence?.nativeAgent ?? existing.state.spawn?.nativeAgent ?? '');
+            const consumed = store.consume(childThreadId, consumer, hookDefinitionHash());
+            output({ status: 'consumed', changed: true, evidence: {
+                    start: consumed.state.startEvidence,
+                    stop: consumed.state.stopEvidence
+                }, diagnostics: [], error: null });
+        }
+    }
+    catch (error) {
+        failure('CODEX_LIFECYCLE_FAILED', error instanceof Error ? error.message : String(error));
+    }
+}
+export { codexLifecycle };
+//# sourceMappingURL=cli.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/controller-client.js

@@ -0,0 +1,130 @@
+import { SandboxControlClientError, requestSandboxAgentOperation } from '../../../sandbox/control/client.js';
+function fail(code, message, accepted = true) {
+    throw new SandboxControlClientError({ code, message: `${code}: ${message}`, retryable: false }, accepted);
+}
+function exactKeys(value, keys) {
+    return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
+}
+function validProcess(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const process = value;
+    return exactKeys(process, ['pid', 'startTime'])
+        && Number.isSafeInteger(process.pid) && process.pid > 0
+        && Number.isSafeInteger(process.startTime) && process.startTime >= 0;
+}
+function validBuild(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const build = value;
+    return exactKeys(build, ['internalExecutableBuildHash', 'lifecycleContractHash', 'packageVersion', 'protocolVersion'])
+        && build.protocolVersion === 3
+        && typeof build.packageVersion === 'string' && build.packageVersion.length > 0
+        && typeof build.internalExecutableBuildHash === 'string' && /^[a-f0-9]{64}$/u.test(build.internalExecutableBuildHash)
+        && typeof build.lifecycleContractHash === 'string' && /^[a-f0-9]{64}$/u.test(build.lifecycleContractHash);
+}
+function parseCodexControllerResult(response) {
+    if (response.phase !== 'completed' || response.error !== null || response.stderr !== '') {
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result outer response is invalid');
+    }
+    let value;
+    try {
+        if (!response.stdout.endsWith('\n') || response.stdout.slice(0, -1).includes('\n'))
+            throw new Error('not canonical');
+        value = JSON.parse(response.stdout);
+    }
+    catch {
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result payload is invalid');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result payload is invalid');
+    }
+    const result = value;
+    const keys = result.status === 'verified'
+        ? ['binding', 'changed', 'error', 'lease', 'status', 'version']
+        : ['changed', 'error', 'lease', 'status', 'version'];
+    if (!exactKeys(result, keys) || result.version !== 1
+        || !['opened', 'closed', 'failed', 'verified'].includes(result.status)) {
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result schema is invalid');
+    }
+    if (result.status === 'failed') {
+        const error = result.error;
+        if (response.exitCode !== 1 || result.changed !== false || result.lease !== null || !error
+            || !exactKeys(error, ['code', 'message', 'retryable'])
+            || typeof error.code !== 'string' || !/^[A-Z][A-Z0-9_]+$/u.test(error.code)
+            || typeof error.message !== 'string' || error.retryable !== false) {
+            fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller failure result is invalid');
+        }
+        fail(error.code, error.message);
+    }
+    if (response.exitCode !== 0 || result.error !== null) {
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller success result is invalid');
+    }
+    if (result.status === 'closed') {
+        if (typeof result.changed !== 'boolean' || result.lease !== null)
+            fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller close result is invalid');
+        return result;
+    }
+    if (result.status === 'verified') {
+        const binding = result.binding;
+        if (result.changed !== false || result.lease !== null || !binding
+            || !exactKeys(binding, ['controllerInstanceDigest', 'controlGeneration', 'taskId'])
+            || typeof binding.taskId !== 'string' || binding.taskId.length === 0
+            || typeof binding.controlGeneration !== 'string' || binding.controlGeneration.length === 0
+            || typeof binding.controllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(binding.controllerInstanceDigest)) {
+            fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller verify result is invalid');
+        }
+        return result;
+    }
+    const lease = result.lease;
+    if (result.changed !== true || !lease
+        || !exactKeys(lease, ['buildIdentity', 'controlGeneration', 'controllerInstanceDigest', 'controllerProcess', 'expiresAt', 'issuedAt', 'leaseId', 'leaseSecret', 'taskId', 'version'])
+        || lease.version !== 1 || typeof lease.leaseId !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.leaseId)
+        || typeof lease.leaseSecret !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.leaseSecret)
+        || typeof lease.taskId !== 'string' || lease.taskId.length === 0
+        || typeof lease.controlGeneration !== 'string' || lease.controlGeneration.length === 0
+        || typeof lease.controllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.controllerInstanceDigest)
+        || !validProcess(lease.controllerProcess) || !validBuild(lease.buildIdentity)
+        || !Number.isSafeInteger(lease.issuedAt) || !Number.isSafeInteger(lease.expiresAt)
+        || lease.expiresAt <= lease.issuedAt) {
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller open result is invalid');
+    }
+    return result;
+}
+function requestController(params) {
+    const result = parseCodexControllerResult(requestSandboxAgentOperation({
+        agentClient: 'codex',
+        operation: `controller.${params.command}`,
+        payload: params.command === 'open'
+            ? { controllerProcess: params.controllerProcess }
+            : { proof: params.controllerProof },
+        ...params
+    }));
+    if (result.status === 'opened'
+        && (result.lease.controlGeneration !== (params.generation ?? process.env.AGENT_INFRA_CONTROL_GENERATION)
+            || result.lease.controllerProcess.pid !== params.controllerProcess.pid
+            || result.lease.controllerProcess.startTime !== params.controllerProcess.startTime)) {
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result does not match the request');
+    }
+    return result;
+}
+function requestCodexControllerOpen(params) {
+    const result = requestController({ ...params, command: 'open', controllerProof: null });
+    if (result.status !== 'opened')
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller open returned the wrong result');
+    return result;
+}
+function requestCodexControllerClose(params) {
+    const result = requestController({ ...params, command: 'close' });
+    if (result.status !== 'closed')
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller close returned the wrong result');
+    return result;
+}
+function requestCodexControllerVerify(params) {
+    const result = requestController({ ...params, controllerProcess: params.controllerProof.controllerProcess, command: 'verify' });
+    if (result.status !== 'verified')
+        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller verify returned the wrong result');
+    return result;
+}
+export { parseCodexControllerResult, requestCodexControllerClose, requestCodexControllerOpen, requestCodexControllerVerify };
+//# sourceMappingURL=controller-client.js.map