@fitlab-ai/agent-infra 0.9.3 → 0.9.5

package/dist/lib/agent-clients/adapters/claude-code-sandbox.js

@@ -0,0 +1,247 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { formatCredentialWarnings, formatRemaining, hasClaudeProviderAuth, inspectClaudeKeychainStatus, prepareClaudeCredentials, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from './claude-code-credentials.js';
+function readHostJsonSafe(filePath) {
+    if (!filePath || !fs.existsSync(filePath))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+const CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS = [
+    'model',
+    'fallbackModel',
+    'availableModels',
+    'modelOverrides',
+    'enforceAvailableModels',
+    'advisorModel',
+    'apiKeyHelper',
+    'effortLevel'
+];
+function isJsonObjectRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function mergeMissingStringEnvFields(target, source) {
+    if (!isJsonObjectRecord(source.env))
+        return false;
+    if (Object.hasOwn(target, 'env') && !isJsonObjectRecord(target.env))
+        return false;
+    let targetEnv = target.env;
+    let changed = false;
+    for (const [key, value] of Object.entries(source.env)) {
+        if (typeof value !== 'string' || value === '')
+            continue;
+        if (!targetEnv) {
+            targetEnv = {};
+            target.env = targetEnv;
+        }
+        if (!Object.hasOwn(targetEnv, key)) {
+            targetEnv[key] = value;
+            changed = true;
+        }
+    }
+    return changed;
+}
+function mergeMissingTopLevelSettings(target, source) {
+    let changed = false;
+    for (const key of CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS) {
+        if (!Object.hasOwn(source, key) || Object.hasOwn(target, key))
+            continue;
+        const value = source[key];
+        if (value === null || value === undefined || value === '')
+            continue;
+        target[key] = value;
+        changed = true;
+    }
+    return changed;
+}
+function requireCreateContext(context, hookId) {
+    if (!context)
+        throw new Error(`${hookId} requires create context`);
+    return context;
+}
+function requireEnterContext(context, hookId) {
+    if (!context)
+        throw new Error(`${hookId} requires enter context`);
+    return context;
+}
+export function ensureClaudeOnboarding(toolDir, hostHomeDir) {
+    const claudeJsonPath = path.join(toolDir, '.claude.json');
+    let data = {};
+    if (fs.existsSync(claudeJsonPath)) {
+        try {
+            data = JSON.parse(fs.readFileSync(claudeJsonPath, 'utf8'));
+        }
+        catch {
+            // Malformed JSON is replaced with a valid managed sandbox baseline.
+        }
+    }
+    let changed = false;
+    if (!data.hasCompletedOnboarding) {
+        data.hasCompletedOnboarding = true;
+        changed = true;
+    }
+    if (!data.projects) {
+        data.projects = {};
+        changed = true;
+    }
+    if (!data.projects['/workspace']) {
+        data.projects['/workspace'] = {};
+        changed = true;
+    }
+    if (!data.projects['/workspace'].hasTrustDialogAccepted) {
+        data.projects['/workspace'].hasTrustDialogAccepted = true;
+        changed = true;
+    }
+    if (hostHomeDir) {
+        const hostClaudeJson = readHostJsonSafe(path.join(hostHomeDir, '.claude.json'));
+        if (hostClaudeJson
+            && typeof hostClaudeJson.model === 'string'
+            && hostClaudeJson.model !== ''
+            && !Object.hasOwn(data, 'model')) {
+            data.model = hostClaudeJson.model;
+            changed = true;
+        }
+        if (hostClaudeJson) {
+            for (const key of Object.keys(hostClaudeJson)) {
+                if (/^unpin.*LaunchEffort$/.test(key)
+                    && hostClaudeJson[key] === true
+                    && !Object.hasOwn(data, key)) {
+                    data[key] = true;
+                    changed = true;
+                }
+            }
+        }
+    }
+    if (changed)
+        fs.writeFileSync(claudeJsonPath, JSON.stringify(data, null, 4), 'utf8');
+}
+export function ensureClaudeSettings(toolDir, hostHomeDir) {
+    const settingsPath = path.join(toolDir, 'settings.json');
+    let data = {};
+    if (fs.existsSync(settingsPath)) {
+        try {
+            data = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+        }
+        catch {
+            // Malformed JSON is replaced with a valid managed sandbox baseline.
+        }
+    }
+    let changed = false;
+    if (data.skipDangerousModePermissionPrompt !== true) {
+        data.skipDangerousModePermissionPrompt = true;
+        changed = true;
+    }
+    if (hostHomeDir) {
+        const hostSettings = readHostJsonSafe(path.join(hostHomeDir, '.claude', 'settings.json'));
+        if (hostSettings) {
+            changed = mergeMissingStringEnvFields(data, hostSettings) || changed;
+            changed = mergeMissingTopLevelSettings(data, hostSettings) || changed;
+        }
+    }
+    if (changed)
+        fs.writeFileSync(settingsPath, JSON.stringify(data, null, 4), 'utf8');
+}
+export function formatCredentialSyncStatus(result, isTTY = process.stderr.isTTY, providerAuthAvailable = false) {
+    if (providerAuthAvailable && (result.status === 'STALE_ACCESS' || result.status === 'MISSING'))
+        return null;
+    if (result.status === 'STALE_ACCESS') {
+        return 'Warning: Claude Code credentials on host appear stale. Run "ai sandbox refresh" or "claude /login" to renew.\n';
+    }
+    if (result.status === 'MISSING') {
+        return 'Warning: Claude Code credentials missing on host. Run "claude /login" to authenticate.\n';
+    }
+    if (result.status === 'KEYCHAIN_WRITE_FAILED') {
+        return `Warning: A sandbox refresh produced newer credentials but host Keychain write failed (${formatCredentialWarnings(result.warnings)}). Run "ai sandbox refresh" again or "claude /status" on the host to retry.\n`;
+    }
+    if (result.status === 'KEYCHAIN_LOCKED' || result.status === 'KEYCHAIN_ERROR') {
+        return 'Warning: Host keychain is unavailable; Claude credential sync skipped. Run "ai sandbox refresh" for details.\n';
+    }
+    if (result.status === 'OK' && result.authoritative !== 'host') {
+        const message = `Synced Claude Code credentials from sandbox refresh back to host (expires in ${formatRemaining(result.expiresAt)})`;
+        return isTTY ? `\x1b[2m${message}\x1b[0m\n` : `${message}\n`;
+    }
+    if (result.status === 'OK' && result.filesWritten.length > 0) {
+        const message = `Synced Claude Code credentials from host Keychain (expires in ${formatRemaining(result.expiresAt)})`;
+        return isTTY ? `\x1b[2m${message}\x1b[0m\n` : `${message}\n`;
+    }
+    return null;
+}
+const claudeCodeCredentialPreflightHook = {
+    id: 'claude-code-credential-preflight',
+    phase: 'prepare',
+    run: async ({ create }) => {
+        const { hostHome, hostEnv, project, resolvedTools } = requireCreateContext(create, 'claude-code-credential-preflight');
+        try {
+            validateClaudeCredentialsEnvOverride(hostEnv);
+            const outcome = prepareClaudeCredentials(hostHome, project, [...resolvedTools], undefined, undefined, (home) => inspectClaudeKeychainStatus(home, undefined, { envFn: () => ({ ...hostEnv }) }));
+            if (outcome.status === 'SKIPPED') {
+                return {
+                    status: 'warning',
+                    message: 'Claude Code credentials not found on host - creating this sandbox WITHOUT Claude Code credentials.\n'
+                        + '  Claude Code is still installed in the image but will not be authenticated.\n'
+                        + '  To enable it: run "claude" once on the host to complete login, then re-run "ai sandbox create".'
+                };
+            }
+            return { status: 'ready' };
+        }
+        catch (error) {
+            return {
+                status: 'fatal',
+                message: redactCommandError(error instanceof Error ? error.message : 'unknown credential error')
+            };
+        }
+    }
+};
+const claudeCodeBeforeContainerCreateHook = {
+    id: 'claude-code-before-container-create',
+    phase: 'before-container-create',
+    run: async ({ create }) => {
+        const { hostHome, resolvedTools } = requireCreateContext(create, 'claude-code-before-container-create');
+        const claudeCodeEntry = resolvedTools.find(({ tool }) => tool.id === 'claude-code');
+        if (claudeCodeEntry) {
+            ensureClaudeOnboarding(claudeCodeEntry.dir, hostHome);
+            ensureClaudeSettings(claudeCodeEntry.dir, hostHome);
+        }
+        return { status: 'ready' };
+    }
+};
+const claudeCodeBeforeEnterHook = {
+    id: 'claude-code-before-enter',
+    phase: 'before-enter',
+    run: async ({ enter }) => {
+        const { hostHome, hostEnv } = requireEnterContext(enter, 'claude-code-before-enter');
+        try {
+            validateClaudeCredentialsEnvOverride(hostEnv);
+        }
+        catch (error) {
+            return {
+                status: 'fatal',
+                message: redactCommandError(error instanceof Error ? error.message : 'invalid credentials override')
+            };
+        }
+        try {
+            const providerAuthAvailable = hasClaudeProviderAuth(hostHome);
+            const result = reconcileClaudeCredentials(hostHome, { envFn: () => ({ ...hostEnv }) });
+            const message = formatCredentialSyncStatus(result, process.stderr.isTTY, providerAuthAvailable);
+            return {
+                status: 'ready',
+                ...(message === null ? {} : { message })
+            };
+        }
+        catch (error) {
+            return {
+                status: 'warning',
+                message: `Failed to sync Claude Code credentials: ${redactCommandError(error instanceof Error ? error.message : 'unknown error')}`
+            };
+        }
+    }
+};
+export { claudeCodeBeforeContainerCreateHook, claudeCodeBeforeEnterHook, claudeCodeCredentialPreflightHook };
+//# sourceMappingURL=claude-code-sandbox.js.map

package/dist/lib/agent-clients/adapters/claude-code.js

@@ -1,5 +1,6 @@
 import { defineAgentClientAdapter } from '../adapter.js';
 import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+import { claudeCodeBeforeContainerCreateHook, claudeCodeBeforeEnterHook, claudeCodeCredentialPreflightHook } from './claude-code-sandbox.js';
 const claudeCodeAdapter = defineAgentClientAdapter({
     id: 'claude-code',
     displayName: 'Claude Code',
@@ -25,7 +26,7 @@ const claudeCodeAdapter = defineAgentClientAdapter({
     },
     project: {
         ownedPathPrefixes: ['.claude/'],
-        managed: ['.claude/commands/', '.claude/agents/'],
+        managed: ['.claude/commands/', '.claude/agents/', '.claude/rules/'],
         merged: ['.claude/settings.json'],
         ejected: [],
         seedCommands: [{
@@ -34,9 +35,18 @@ const claudeCodeAdapter = defineAgentClientAdapter({
                     'zh-CN': '.claude/commands/update-agent-infra.zh-CN.md'
                 },
                 target: '.claude/commands/update-agent-infra.md'
-            }]
+            }],
+        customCommand: {
+            target: '.claude/commands/${skillName}.md',
+            frontmatter: {},
+            includeUsage: true,
+            inheritDisableModelInvocation: true
+        }
     },
     sandbox: {
+        image: {
+            dockerfileFragment: 'claude-code'
+        },
         createTool: ({ home, project }) => ({
             id: 'claude-code',
             name: 'Claude Code',
@@ -64,7 +74,11 @@ const claudeCodeAdapter = defineAgentClientAdapter({
             { name: 'claude-yolo', command: 'claude --dangerously-skip-permissions; tput ed' },
             { name: 'cy', command: 'claude --dangerously-skip-permissions; tput ed' }
         ],
-        hooks: []
+        hooks: [
+            claudeCodeCredentialPreflightHook,
+            claudeCodeBeforeContainerCreateHook,
+            claudeCodeBeforeEnterHook
+        ]
     }
 });
 export { claudeCodeAdapter };

package/dist/lib/agent-clients/adapters/codex-lifecycle/app-server.js

@@ -0,0 +1,382 @@
+import { spawn, spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import semver from 'semver';
+const LIFECYCLE_HOOKS = Object.freeze([
+    Object.freeze({ event: 'PreToolUse', matcher: '^collaborationspawn_agent$', phase: 'pre-tool' }),
+    Object.freeze({ event: 'PostToolUse', matcher: '^collaborationspawn_agent$', phase: 'post-tool' }),
+    Object.freeze({ event: 'SubagentStart', matcher: '^agent-infra-lifecycle-(executor|reviewer)$', phase: 'subagent-start' }),
+    Object.freeze({ event: 'SubagentStop', matcher: '^agent-infra-lifecycle-(executor|reviewer)$', phase: 'subagent-stop' })
+]);
+function object(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function nonEmpty(value) {
+    return typeof value === 'string' && value.trim() ? value : null;
+}
+function validateCodexLifecycleHookConfig(value) {
+    const hooks = object(object(value)?.hooks);
+    const valid = hooks && LIFECYCLE_HOOKS.every(({ event, matcher, phase }) => {
+        const entries = hooks[event];
+        if (!Array.isArray(entries))
+            return false;
+        return entries.some((entryValue) => {
+            const entry = object(entryValue);
+            if (entry?.matcher !== matcher || !Array.isArray(entry.hooks))
+                return false;
+            return entry.hooks.some((hookValue) => {
+                const hook = object(hookValue);
+                return hook?.type === 'command'
+                    && hook.timeout === 5
+                    && hook.command === `node "$(git rev-parse --show-toplevel)/.agents/hooks/lifecycle-delegation.js" --client codex --event ${phase}`;
+            });
+        });
+    });
+    if (!valid)
+        throw new Error('CODEX_PREFLIGHT_HOOKS_INVALID: lifecycle hooks are invalid');
+}
+function parseCodexHooksList(value, repoRoot) {
+    const root = object(value);
+    const entries = Array.isArray(root?.data) ? root.data : [];
+    const entry = entries.map(object).find((candidate) => candidate?.cwd === repoRoot);
+    const errors = Array.isArray(entry?.errors) ? entry.errors : [];
+    if (errors.length)
+        throw new Error(`CODEX_PREFLIGHT_HOOK_DISCOVERY_FAILED: ${errors.map(String).join('; ')}`);
+    const hooks = (Array.isArray(entry?.hooks) ? entry.hooks : [])
+        .map(object)
+        .filter((hook) => hook !== null)
+        .map((hook) => Object.freeze({
+        eventName: String(hook.eventName ?? ''),
+        matcher: typeof hook.matcher === 'string' ? hook.matcher : null,
+        command: String(hook.command ?? ''),
+        enabled: hook.enabled === true
+    }));
+    const valid = LIFECYCLE_HOOKS.every(({ event, matcher, phase }) => hooks.some((hook) => hook.eventName === event.replace(/^./, (character) => character.toLowerCase())
+        && hook.matcher === matcher
+        && hook.command === `node "$(git rev-parse --show-toplevel)/.agents/hooks/lifecycle-delegation.js" --client codex --event ${phase}`
+        && hook.enabled));
+    if (!valid)
+        throw new Error('CODEX_PREFLIGHT_HOOKS_NOT_LOADED: lifecycle hooks are not loaded for this workspace');
+    return Object.freeze(hooks);
+}
+function hasCodexRuntimeLiveness(runtimeRoot, hookDefinitionHash, identity) {
+    if (!identity || !fs.existsSync(runtimeRoot))
+        return false;
+    return fs.readdirSync(runtimeRoot)
+        .filter((name) => /^[a-f0-9]{64}\.json$/.test(name))
+        .some((name) => {
+        try {
+            const record = object(JSON.parse(fs.readFileSync(path.join(runtimeRoot, name), 'utf8')));
+            const state = object(record?.state);
+            const spawnEvent = object(state?.spawn);
+            return !['invalid', 'expired'].includes(String(state?.status))
+                && spawnEvent?.hookDefinitionHash === hookDefinitionHash
+                && spawnEvent.sessionId === identity.sessionId
+                && spawnEvent.turnId === identity.turnId
+                && spawnEvent.toolUseId === identity.toolUseId;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function parseCodexThreadResolution(readValue, resumeValue) {
+    const readRoot = object(readValue);
+    const resumeRoot = object(resumeValue);
+    const thread = object(readRoot?.thread);
+    const resumedThread = object(resumeRoot?.thread);
+    const source = object(thread?.source);
+    const subAgent = object(source?.subAgent);
+    const threadSpawn = object(subAgent?.thread_spawn);
+    const childThreadId = nonEmpty(thread?.id);
+    const parentThreadId = nonEmpty(thread?.parentThreadId);
+    const sourceParentThreadId = nonEmpty(threadSpawn?.parent_thread_id);
+    const resumedChildThreadId = nonEmpty(resumedThread?.id);
+    const model = nonEmpty(resumeRoot?.model);
+    const reasoningEffort = nonEmpty(resumeRoot?.reasoningEffort ?? object(resumeRoot?.settings)?.effort);
+    const forkedFromId = thread?.forkedFromId;
+    if (!childThreadId
+        || resumedChildThreadId !== childThreadId
+        || !parentThreadId
+        || !sourceParentThreadId
+        || !model
+        || !reasoningEffort
+        || (forkedFromId !== null && typeof forkedFromId !== 'string')) {
+        throw new Error('Codex App Server thread resolution is invalid');
+    }
+    return Object.freeze({
+        thread: Object.freeze({
+            type: 'app-thread',
+            childThreadId,
+            parentThreadId,
+            forkedFromId,
+            sourceParentThreadId
+        }),
+        settings: Object.freeze({
+            type: 'app-settings',
+            childThreadId,
+            model,
+            reasoningEffort
+        })
+    });
+}
+function parseCodexTurnCompleted(value) {
+    const root = object(value);
+    const turn = object(root?.turn);
+    const childThreadId = nonEmpty(root?.threadId);
+    const turnId = nonEmpty(turn?.id);
+    const status = turn?.status;
+    if (!childThreadId || !turnId || !['completed', 'interrupted', 'failed'].includes(String(status))) {
+        throw new Error('Codex App Server turn completion is invalid');
+    }
+    return Object.freeze({
+        type: 'app-terminal',
+        childThreadId,
+        turnId,
+        status: status
+    });
+}
+function parseCodexModelReroute(value) {
+    const root = object(value);
+    const childThreadId = nonEmpty(root?.threadId);
+    const turnId = nonEmpty(root?.turnId);
+    const fromModel = nonEmpty(root?.fromModel);
+    const toModel = nonEmpty(root?.toModel);
+    const reasonValue = root?.reason;
+    const reason = nonEmpty(reasonValue) ?? (object(reasonValue) ? JSON.stringify(reasonValue) : null);
+    if (!childThreadId || !turnId || !fromModel || !toModel || !reason) {
+        throw new Error('Codex App Server model reroute is invalid');
+    }
+    return Object.freeze({ type: 'app-reroute', childThreadId, turnId, fromModel, toModel, reason });
+}
+class CodexAppServerTransport {
+    #options;
+    #child = null;
+    #buffer = '';
+    #stderr = '';
+    #nextId = 1;
+    #pending = new Map();
+    #notifications = [];
+    constructor(options = {}) {
+        this.#options = {
+            ...options,
+            command: options.command ?? 'codex',
+            args: options.args ?? ['app-server', '--stdio'],
+            timeoutMs: options.timeoutMs ?? 5_000
+        };
+    }
+    get diagnostics() {
+        return Object.freeze(this.#stderr.split(/\r?\n/).filter(Boolean));
+    }
+    get notifications() {
+        return Object.freeze([...this.#notifications]);
+    }
+    start() {
+        if (this.#child)
+            throw new Error('Codex App Server transport is already started');
+        const child = spawn(this.#options.command, [...this.#options.args], {
+            cwd: this.#options.cwd,
+            env: this.#options.env,
+            stdio: ['pipe', 'pipe', 'pipe']
+        });
+        this.#child = child;
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => this.#onData(chunk));
+        child.stderr.on('data', (chunk) => {
+            this.#stderr = `${this.#stderr}${chunk}`.slice(-32 * 1024);
+        });
+        child.on('error', (error) => this.#rejectAll(error));
+        child.on('exit', (code, signal) => {
+            if (this.#pending.size) {
+                this.#rejectAll(new Error(`Codex App Server exited before responding (code=${code}, signal=${signal})`));
+            }
+        });
+    }
+    #onData(chunk) {
+        this.#buffer += chunk;
+        for (;;) {
+            const newline = this.#buffer.indexOf('\n');
+            if (newline < 0)
+                return;
+            const line = this.#buffer.slice(0, newline).trim();
+            this.#buffer = this.#buffer.slice(newline + 1);
+            if (!line)
+                continue;
+            let message;
+            try {
+                const parsed = object(JSON.parse(line));
+                if (!parsed)
+                    throw new Error('message is not an object');
+                message = parsed;
+            }
+            catch (error) {
+                this.#rejectAll(new Error(`Codex App Server returned invalid JSON: ${String(error)}`));
+                continue;
+            }
+            if (typeof message.id === 'number') {
+                const pending = this.#pending.get(message.id);
+                if (!pending)
+                    continue;
+                clearTimeout(pending.timer);
+                this.#pending.delete(message.id);
+                if (message.error)
+                    pending.reject(new Error(`Codex App Server request failed: ${JSON.stringify(message.error)}`));
+                else
+                    pending.resolve(message.result);
+            }
+            else if (typeof message.method === 'string') {
+                this.#notifications.push(Object.freeze({ method: message.method, params: message.params }));
+            }
+        }
+    }
+    #rejectAll(error) {
+        for (const [id, pending] of this.#pending) {
+            clearTimeout(pending.timer);
+            this.#pending.delete(id);
+            pending.reject(error);
+        }
+    }
+    request(method, params) {
+        if (!this.#child || !this.#child.stdin.writable) {
+            return Promise.reject(new Error('Codex App Server transport is not running'));
+        }
+        const id = this.#nextId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.#pending.delete(id);
+                reject(new Error(`Codex App Server request '${method}' timed out`));
+            }, this.#options.timeoutMs);
+            this.#pending.set(id, { resolve, reject, timer });
+            this.#child.stdin.write(`${JSON.stringify({ id, method, params })}\n`);
+        });
+    }
+    notify(method, params = {}) {
+        if (!this.#child || !this.#child.stdin.writable)
+            throw new Error('Codex App Server transport is not running');
+        this.#child.stdin.write(`${JSON.stringify({ method, params })}\n`);
+    }
+    async initialize() {
+        const result = await this.request('initialize', {
+            clientInfo: { name: 'agent-infra', title: 'agent-infra', version: '0.9.5' },
+            capabilities: null
+        });
+        this.notify('initialized');
+        return result;
+    }
+    close() {
+        if (!this.#child)
+            return;
+        this.#child.stdin.end();
+        this.#child.kill();
+        this.#child = null;
+    }
+}
+async function resolveCodexThread(childThreadId, options = {}) {
+    if (!nonEmpty(childThreadId))
+        throw new Error('Codex child thread id is required');
+    const transport = new CodexAppServerTransport(options);
+    transport.start();
+    try {
+        await transport.initialize();
+        const readResult = object(await transport.request('thread/read', { threadId: childThreadId, includeTurns: false }));
+        const readThread = object(readResult?.thread);
+        if (nonEmpty(readThread?.id) !== childThreadId)
+            throw new Error('Codex App Server returned the wrong child thread');
+        const resumeResult = await transport.request('thread/resume', { threadId: childThreadId });
+        let resolution;
+        try {
+            resolution = parseCodexThreadResolution(readResult, resumeResult);
+        }
+        catch {
+            throw new Error('Codex App Server resumed settings are unavailable');
+        }
+        const reroutes = transport.notifications
+            .filter((entry) => entry.method === 'model/rerouted')
+            .map((entry) => parseCodexModelReroute(entry.params))
+            .filter((event) => event.childThreadId === childThreadId);
+        return Object.freeze({ resolution, reroutes: Object.freeze(reroutes), diagnostics: transport.diagnostics });
+    }
+    finally {
+        try {
+            await transport.request('thread/unsubscribe', { threadId: childThreadId });
+        }
+        catch {
+            // Closing the short-lived transport still removes the subscription.
+        }
+        transport.close();
+    }
+}
+async function resolveCodexTerminal(childThreadId, options = {}) {
+    const transport = new CodexAppServerTransport(options);
+    transport.start();
+    try {
+        await transport.initialize();
+        const result = object(await transport.request('thread/read', { threadId: childThreadId, includeTurns: true }));
+        const thread = object(result?.thread);
+        if (nonEmpty(thread?.id) !== childThreadId)
+            throw new Error('Codex App Server returned the wrong child thread');
+        const turns = Array.isArray(thread?.turns) ? thread.turns : [];
+        const turn = turns.at(-1);
+        return parseCodexTurnCompleted({ threadId: childThreadId, turn });
+    }
+    finally {
+        transport.close();
+    }
+}
+async function preflightCodexLifecycleEvidence(repoRoot = process.cwd(), runtimeIdentity) {
+    const versionRun = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+    const match = /codex-cli\s+(\d+\.\d+\.\d+)/.exec(versionRun.stdout ?? '');
+    if (versionRun.status !== 0 || !match?.[1] || !semver.gte(match[1], '0.147.0')) {
+        throw new Error('CODEX_PREFLIGHT_VERSION_UNSUPPORTED');
+    }
+    const featuresRun = spawnSync('codex', ['features', 'list'], { encoding: 'utf8' });
+    if (featuresRun.status !== 0
+        || !/^hooks\s+\S+\s+true$/m.test(featuresRun.stdout)
+        || !/^multi_agent\s+\S+\s+true$/m.test(featuresRun.stdout))
+        throw new Error('CODEX_PREFLIGHT_FEATURE_DISABLED');
+    const hooksPath = path.join(repoRoot, '.codex', 'hooks.json');
+    const hooksRaw = fs.readFileSync(hooksPath, 'utf8');
+    validateCodexLifecycleHookConfig(JSON.parse(hooksRaw));
+    const schemaDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-infra-codex-schema-'));
+    try {
+        const schemaRun = spawnSync('codex', ['app-server', 'generate-json-schema', '--out', schemaDir], { encoding: 'utf8' });
+        if (schemaRun.status !== 0)
+            throw new Error('CODEX_PREFLIGHT_SCHEMA_UNAVAILABLE');
+        const schema = fs.readFileSync(path.join(schemaDir, 'codex_app_server_protocol.v2.schemas.json'), 'utf8');
+        for (const field of ['parentThreadId', 'forkedFromId', 'ThreadSettings', 'turn/completed', 'model/rerouted']) {
+            if (!schema.includes(field))
+                throw new Error(`CODEX_PREFLIGHT_SCHEMA_MISSING:${field}`);
+        }
+    }
+    finally {
+        fs.rmSync(schemaDir, { recursive: true, force: true });
+    }
+    const hookDefinitionHash = crypto.createHash('sha256').update(hooksRaw).digest('hex');
+    const runtimeRoot = path.join(repoRoot, '.agents', 'workspace', '.runtime', 'codex-lifecycle');
+    const runtimeLiveness = hasCodexRuntimeLiveness(runtimeRoot, hookDefinitionHash, runtimeIdentity);
+    const transport = new CodexAppServerTransport();
+    transport.start();
+    let discoveredHooks;
+    try {
+        await transport.initialize();
+        discoveredHooks = parseCodexHooksList(await transport.request('hooks/list', { cwds: [repoRoot] }), repoRoot);
+    }
+    finally {
+        transport.close();
+    }
+    return Object.freeze({
+        cliVersion: match[1],
+        hookDefinitionHash,
+        staticReady: true,
+        discoveredHooks,
+        runtimeLiveness,
+        diagnostics: transport.diagnostics
+    });
+}
+export { CodexAppServerTransport, hasCodexRuntimeLiveness, parseCodexModelReroute, parseCodexHooksList, parseCodexThreadResolution, parseCodexTurnCompleted, preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread, validateCodexLifecycleHookConfig };
+//# sourceMappingURL=app-server.js.map