@fitlab-ai/agent-infra 0.9.5 → 0.9.7

package/dist/bin/internal-cli.js

@@ -8,7 +8,7 @@ const command = process.argv[2] || '';
 if (process.env.AGENT_INFRA_CONTROL_TOKEN
     && (command === 'task-lifecycle' || command === 'task-orchestration')) {
     const { sandboxControl } = await import('../lib/internal/sandbox-control.js');
-    sandboxControl(['client', command, ...process.argv.slice(3)]);
+    await sandboxControl(['client', command, ...process.argv.slice(3)]);
 }
 else
     switch (command) {
@@ -19,7 +19,7 @@ else
         }
         case 'sandbox-control': {
             const { sandboxControl } = await import('../lib/internal/sandbox-control.js');
-            sandboxControl(process.argv.slice(3));
+            await sandboxControl(process.argv.slice(3));
             break;
         }
         case 'agent-client': {
@@ -32,6 +32,11 @@ else
             await codexLifecycle(process.argv.slice(3));
             break;
         }
+        case 'codex-sandbox-controller': {
+            const { codexSandboxController } = await import('../lib/internal/codex-sandbox-controller.js');
+            await codexSandboxController(process.argv.slice(3));
+            break;
+        }
         case 'git-workflow': {
             const { gitWorkflow } = await import('../lib/internal/git-workflow.js');
             gitWorkflow(process.argv.slice(3));
@@ -109,7 +114,7 @@ else
         }
         case 'task-orchestration': {
             const { taskOrchestration } = await import('../lib/internal/task-orchestration.js');
-            taskOrchestration(process.argv.slice(3));
+            await taskOrchestration(process.argv.slice(3));
             break;
         }
         case 'task-review': {

package/dist/lib/agent-clients/adapters/codex-lifecycle/app-server.js

@@ -6,10 +6,12 @@ import path from 'node:path';
 import semver from 'semver';
 const LIFECYCLE_HOOKS = Object.freeze([
     Object.freeze({ event: 'PreToolUse', matcher: '^collaborationspawn_agent$', phase: 'pre-tool' }),
-    Object.freeze({ event: 'PostToolUse', matcher: '^collaborationspawn_agent$', phase: 'post-tool' }),
-    Object.freeze({ event: 'SubagentStart', matcher: '^agent-infra-lifecycle-(executor|reviewer)$', phase: 'subagent-start' }),
-    Object.freeze({ event: 'SubagentStop', matcher: '^agent-infra-lifecycle-(executor|reviewer)$', phase: 'subagent-stop' })
+    Object.freeze({ event: 'PostToolUse', matcher: '', phase: 'post-tool' }),
+    Object.freeze({ event: 'SubagentStart', matcher: '', phase: 'subagent-start' }),
+    Object.freeze({ event: 'SubagentStop', matcher: '', phase: 'subagent-stop' })
 ]);
+const DEFAULT_ROLLOUT_READ_ATTEMPTS = 81;
+const DEFAULT_ROLLOUT_RETRY_MS = 100;
 function object(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -18,6 +20,58 @@ function object(value) {
 function nonEmpty(value) {
     return typeof value === 'string' && value.trim() ? value : null;
 }
+function resolveCodexSpawnedChild(transcriptPath, expected) {
+    const name = path.basename(transcriptPath);
+    if (!transcriptPath || (!name.endsWith(`-${expected.sessionId}.jsonl`) && name !== `${expected.sessionId}.jsonl`)) {
+        throw new Error('Codex parent rollout path is invalid');
+    }
+    const stat = fs.lstatSync(transcriptPath);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('Codex parent rollout is not a regular file');
+    const maxBytes = 8 * 1024 * 1024;
+    const offset = Math.max(0, stat.size - maxBytes);
+    const buffer = Buffer.alloc(stat.size - offset);
+    const descriptor = fs.openSync(transcriptPath, 'r');
+    try {
+        fs.readSync(descriptor, buffer, 0, buffer.length, offset);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    let text = buffer.toString('utf8');
+    if (offset)
+        text = text.slice(text.indexOf('\n') + 1);
+    const records = text.split(/\r?\n/).filter(Boolean).map((line) => object(JSON.parse(line))).filter(Boolean);
+    const calls = records.filter((record) => {
+        const payload = object(record?.payload);
+        return record?.type === 'response_item'
+            && payload?.type === 'function_call'
+            && payload.call_id === expected.toolUseId
+            && payload.namespace === 'collaboration'
+            && payload.name === 'spawn_agent';
+    });
+    if (calls.length !== 1)
+        throw new Error('Codex parent rollout spawn call was not found uniquely');
+    const call = object(calls[0]?.payload);
+    const args = object(JSON.parse(nonEmpty(call?.arguments) ?? '{}'));
+    if (args?.agent_type !== expected.nativeAgent
+        || args.task_name !== expected.taskName
+        || (expected.requestedModel && args.model !== expected.requestedModel)
+        || (expected.requestedReasoningEffort && args.reasoning_effort !== expected.requestedReasoningEffort))
+        throw new Error('Codex parent rollout spawn identity does not match the hook event');
+    const activities = records.filter((record) => {
+        const payload = object(record?.payload);
+        return record?.type === 'event_msg'
+            && payload?.type === 'sub_agent_activity'
+            && payload.event_id === expected.toolUseId
+            && payload.kind === 'started'
+            && payload.agent_path === `/root/${expected.taskName}`
+            && nonEmpty(payload.agent_thread_id);
+    });
+    if (activities.length !== 1)
+        throw new Error('Codex parent rollout child activity was not found uniquely');
+    return nonEmpty(object(activities[0]?.payload)?.agent_thread_id);
+}
 function validateCodexLifecycleHookConfig(value) {
     const hooks = object(object(value)?.hooks);
     const valid = hooks && LIFECYCLE_HOOKS.every(({ event, matcher, phase }) => {
@@ -31,7 +85,7 @@ function validateCodexLifecycleHookConfig(value) {
             return entry.hooks.some((hookValue) => {
                 const hook = object(hookValue);
                 return hook?.type === 'command'
-                    && hook.timeout === 5
+                    && hook.timeout === 15
                     && hook.command === `node "$(git rev-parse --show-toplevel)/.agents/hooks/lifecycle-delegation.js" --client codex --event ${phase}`;
             });
         });
@@ -39,7 +93,7 @@ function validateCodexLifecycleHookConfig(value) {
     if (!valid)
         throw new Error('CODEX_PREFLIGHT_HOOKS_INVALID: lifecycle hooks are invalid');
 }
-function parseCodexHooksList(value, repoRoot) {
+function parseCodexHooksList(value, repoRoot, expectedSource = 'direct-host') {
     const root = object(value);
     const entries = Array.isArray(root?.data) ? root.data : [];
     const entry = entries.map(object).find((candidate) => candidate?.cwd === repoRoot);
@@ -53,12 +107,27 @@ function parseCodexHooksList(value, repoRoot) {
         eventName: String(hook.eventName ?? ''),
         matcher: typeof hook.matcher === 'string' ? hook.matcher : null,
         command: String(hook.command ?? ''),
-        enabled: hook.enabled === true
+        enabled: hook.enabled === true,
+        source: String(hook.source ?? ''),
+        sourcePathDigest: typeof hook.sourcePath === 'string' && path.isAbsolute(hook.sourcePath)
+            ? crypto.createHash('sha256').update(hook.sourcePath).digest('hex')
+            : '',
+        trustStatus: String(hook.trustStatus ?? ''),
+        currentHash: String(hook.currentHash ?? ''),
+        isManaged: hook.isManaged === true,
+        pluginId: typeof hook.pluginId === 'string' ? hook.pluginId : null
     }));
     const valid = LIFECYCLE_HOOKS.every(({ event, matcher, phase }) => hooks.some((hook) => hook.eventName === event.replace(/^./, (character) => character.toLowerCase())
         && hook.matcher === matcher
         && hook.command === `node "$(git rev-parse --show-toplevel)/.agents/hooks/lifecycle-delegation.js" --client codex --event ${phase}`
-        && hook.enabled));
+        && hook.enabled
+        && hook.currentHash.length > 0
+        && hook.sourcePathDigest.length === 64
+        && hook.pluginId === null
+        && (expectedSource === 'isolated-user'
+            ? hook.source === 'user' && hook.trustStatus !== 'modified'
+            : (hook.source === 'project' && hook.trustStatus === 'trusted')
+                || hook.isManaged && hook.trustStatus === 'managed')));
     if (!valid)
         throw new Error('CODEX_PREFLIGHT_HOOKS_NOT_LOADED: lifecycle hooks are not loaded for this workspace');
     return Object.freeze(hooks);
@@ -84,25 +153,37 @@ function hasCodexRuntimeLiveness(runtimeRoot, hookDefinitionHash, identity) {
         }
     });
 }
-function parseCodexThreadResolution(readValue, resumeValue) {
+function parseCodexThreadResolution(readValue, rolloutRecords) {
     const readRoot = object(readValue);
-    const resumeRoot = object(resumeValue);
     const thread = object(readRoot?.thread);
-    const resumedThread = object(resumeRoot?.thread);
     const source = object(thread?.source);
     const subAgent = object(source?.subAgent);
     const threadSpawn = object(subAgent?.thread_spawn);
+    const sessionMeta = rolloutRecords
+        .map(object)
+        .find((record) => record?.type === 'session_meta');
+    const sessionPayload = object(sessionMeta?.payload);
+    const turnContext = rolloutRecords
+        .map(object)
+        .filter((record) => record?.type === 'turn_context')
+        .at(-1);
+    const turnPayload = object(turnContext?.payload);
     const childThreadId = nonEmpty(thread?.id);
     const parentThreadId = nonEmpty(thread?.parentThreadId);
     const sourceParentThreadId = nonEmpty(threadSpawn?.parent_thread_id);
-    const resumedChildThreadId = nonEmpty(resumedThread?.id);
-    const model = nonEmpty(resumeRoot?.model);
-    const reasoningEffort = nonEmpty(resumeRoot?.reasoningEffort ?? object(resumeRoot?.settings)?.effort);
+    const rolloutChildThreadId = nonEmpty(sessionPayload?.id);
+    const rolloutParentThreadId = nonEmpty(sessionPayload?.parent_thread_id);
+    const agentRole = nonEmpty(sessionPayload?.agent_role);
+    const model = nonEmpty(turnPayload?.model);
+    const reasoningEffort = nonEmpty(turnPayload?.effort);
     const forkedFromId = thread?.forkedFromId;
     if (!childThreadId
-        || resumedChildThreadId !== childThreadId
+        || rolloutChildThreadId !== childThreadId
         || !parentThreadId
         || !sourceParentThreadId
+        || rolloutParentThreadId !== parentThreadId
+        || rolloutParentThreadId !== sourceParentThreadId
+        || !/^agent-infra-lifecycle-(executor|reviewer)$/.test(agentRole ?? '')
         || !model
         || !reasoningEffort
         || (forkedFromId !== null && typeof forkedFromId !== 'string')) {
@@ -114,7 +195,8 @@ function parseCodexThreadResolution(readValue, resumeValue) {
             childThreadId,
             parentThreadId,
             forkedFromId,
-            sourceParentThreadId
+            sourceParentThreadId,
+            nativeAgent: agentRole
         }),
         settings: Object.freeze({
             type: 'app-settings',
@@ -124,6 +206,46 @@ function parseCodexThreadResolution(readValue, resumeValue) {
         })
     });
 }
+function readCodexRolloutRecords(readValue, childThreadId) {
+    const thread = object(object(readValue)?.thread);
+    const rolloutPath = nonEmpty(thread?.path);
+    const rolloutName = rolloutPath ? path.basename(rolloutPath) : '';
+    if (!rolloutPath || (rolloutName !== `${childThreadId}.jsonl` && !rolloutName.endsWith(`-${childThreadId}.jsonl`))) {
+        throw new Error('Codex App Server rollout path is invalid');
+    }
+    const stat = fs.statSync(rolloutPath);
+    if (!stat.isFile())
+        throw new Error('Codex App Server rollout path is not a regular file');
+    const maxBytes = 1024 * 1024;
+    const bytes = Math.min(stat.size, maxBytes);
+    const descriptor = fs.openSync(rolloutPath, 'r');
+    try {
+        const buffer = Buffer.alloc(bytes);
+        fs.readSync(descriptor, buffer, 0, bytes, 0);
+        const text = buffer.toString('utf8');
+        const completeText = stat.size <= maxBytes ? text : text.slice(0, text.lastIndexOf('\n'));
+        return Object.freeze(completeText.split(/\r?\n/).filter(Boolean).map((line) => JSON.parse(line)));
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+async function resolveCodexRolloutRecords(readValue, childThreadId, attempts, retryMs) {
+    let lastError;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+            const records = readCodexRolloutRecords(readValue, childThreadId);
+            parseCodexThreadResolution(readValue, records);
+            return records;
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt + 1 < attempts)
+                await new Promise((resolve) => setTimeout(resolve, retryMs));
+        }
+    }
+    throw lastError;
+}
 function parseCodexTurnCompleted(value) {
     const root = object(value);
     const turn = object(root?.turn);
@@ -287,13 +409,13 @@ async function resolveCodexThread(childThreadId, options = {}) {
         const readThread = object(readResult?.thread);
         if (nonEmpty(readThread?.id) !== childThreadId)
             throw new Error('Codex App Server returned the wrong child thread');
-        const resumeResult = await transport.request('thread/resume', { threadId: childThreadId });
         let resolution;
         try {
-            resolution = parseCodexThreadResolution(readResult, resumeResult);
+            const rolloutRecords = await resolveCodexRolloutRecords(readResult, childThreadId, options.rolloutReadAttempts ?? DEFAULT_ROLLOUT_READ_ATTEMPTS, options.rolloutRetryMs ?? DEFAULT_ROLLOUT_RETRY_MS);
+            resolution = parseCodexThreadResolution(readResult, rolloutRecords);
         }
         catch {
-            throw new Error('Codex App Server resumed settings are unavailable');
+            throw new Error('Codex App Server rollout metadata is unavailable');
         }
         const reroutes = transport.notifications
             .filter((entry) => entry.method === 'model/rerouted')
@@ -322,6 +444,9 @@ async function resolveCodexTerminal(childThreadId, options = {}) {
             throw new Error('Codex App Server returned the wrong child thread');
         const turns = Array.isArray(thread?.turns) ? thread.turns : [];
         const turn = turns.at(-1);
+        const turnValue = object(turn);
+        if (!turnValue || turnValue.status === 'inProgress')
+            throw new Error('CODEX_TURN_NOT_TERMINAL');
         return parseCodexTurnCompleted({ threadId: childThreadId, turn });
     }
     finally {
@@ -364,19 +489,45 @@ async function preflightCodexLifecycleEvidence(repoRoot = process.cwd(), runtime
     let discoveredHooks;
     try {
         await transport.initialize();
-        discoveredHooks = parseCodexHooksList(await transport.request('hooks/list', { cwds: [repoRoot] }), repoRoot);
+        discoveredHooks = parseCodexHooksList(await transport.request('hooks/list', { cwds: [repoRoot] }), repoRoot, process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT ? 'isolated-user' : 'direct-host');
     }
     finally {
         transport.close();
     }
+    const lifecycleHooks = LIFECYCLE_HOOKS.map(({ event, matcher, phase }) => discoveredHooks.filter((hook) => hook.eventName === event.replace(/^./, (character) => character.toLowerCase())
+        && hook.matcher === matcher
+        && hook.command === `node "$(git rev-parse --show-toplevel)/.agents/hooks/lifecycle-delegation.js" --client codex --event ${phase}`));
+    if (lifecycleHooks.some((matches) => matches.length !== 1)) {
+        throw new Error('CODEX_PREFLIGHT_HOOK_SOURCE_AMBIGUOUS: lifecycle hook source is not unique');
+    }
+    const matchedHooks = lifecycleHooks.flat();
+    const sources = new Set(matchedHooks.map((hook) => hook.isManaged ? 'managed' : hook.source));
+    const sourcePathDigests = new Set(matchedHooks.map((hook) => hook.sourcePathDigest));
+    if (sources.size !== 1 || sourcePathDigests.size !== 1) {
+        throw new Error('CODEX_PREFLIGHT_HOOK_SOURCE_AMBIGUOUS: lifecycle hooks do not share one exact source');
+    }
+    const source = [...sources][0];
+    const hookSource = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT
+        ? 'isolated-user'
+        : source === 'managed' ? 'managed' : 'project';
     return Object.freeze({
         cliVersion: match[1],
         hookDefinitionHash,
         staticReady: true,
         discoveredHooks,
+        hookProvenance: Object.freeze({
+            hookSource,
+            hookSourcePathDigest: [...sourcePathDigests][0],
+            hookSourceHash: crypto.createHash('sha256').update(JSON.stringify(matchedHooks.map((hook) => ({
+                eventName: hook.eventName,
+                matcher: hook.matcher,
+                command: hook.command,
+                currentHash: hook.currentHash
+            })))).digest('hex')
+        }),
         runtimeLiveness,
         diagnostics: transport.diagnostics
     });
 }
-export { CodexAppServerTransport, hasCodexRuntimeLiveness, parseCodexModelReroute, parseCodexHooksList, parseCodexThreadResolution, parseCodexTurnCompleted, preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread, validateCodexLifecycleHookConfig };
+export { CodexAppServerTransport, hasCodexRuntimeLiveness, parseCodexModelReroute, parseCodexHooksList, parseCodexThreadResolution, parseCodexTurnCompleted, resolveCodexSpawnedChild, preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread, validateCodexLifecycleHookConfig };
 //# sourceMappingURL=app-server.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/build-identity.js

@@ -0,0 +1,162 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const LIFECYCLE_PROTOCOL_VERSION = 3;
+function exactText(value) {
+    return typeof value === 'string' && value.trim() === value && value.length > 0;
+}
+function normalizeRelativePath(value) {
+    return value.replaceAll('\\', '/');
+}
+function readLifecycleManifestFiles(packageRoot) {
+    const file = path.join(packageRoot, 'lib', 'agent-clients', 'adapters', 'codex-lifecycle', 'manifest-files.json');
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!Array.isArray(value.executableFiles)
+        || !Array.isArray(value.contractFiles)
+        || !value.executableFiles.every(exactText)
+        || !value.contractFiles.every(exactText)
+        || new Set(value.executableFiles).size !== value.executableFiles.length
+        || new Set(value.contractFiles).size !== value.contractFiles.length) {
+        throw new Error('Lifecycle manifest file list is invalid');
+    }
+    return Object.freeze({
+        executableFiles: Object.freeze([...value.executableFiles]),
+        contractFiles: Object.freeze([...value.contractFiles])
+    });
+}
+function executablePackageRoot() {
+    let current = path.dirname(fileURLToPath(import.meta.url));
+    while (true) {
+        const candidate = path.join(current, 'package.json');
+        if (fs.existsSync(candidate)) {
+            const value = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+            if (value.name === '@fitlab-ai/agent-infra')
+                return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            throw new Error('Lifecycle executable package root is unavailable');
+        current = parent;
+    }
+}
+function hashFiles(root, files) {
+    const hash = crypto.createHash('sha256');
+    for (const relative of [...new Set(files.map(normalizeRelativePath))].sort()) {
+        if (path.isAbsolute(relative) || relative.split(/[\\/]/u).includes('..')) {
+            throw new Error(`Lifecycle manifest path '${relative}' is unsafe`);
+        }
+        const file = path.join(root, relative);
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            throw new Error(`Lifecycle manifest entry '${relative}' must be a regular file`);
+        }
+        hash.update(relative);
+        hash.update('\0');
+        hash.update(fs.readFileSync(file));
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+function resolveLifecycleExecutableFiles(root, entries) {
+    const pending = [...entries];
+    const resolved = new Set();
+    while (pending.length > 0) {
+        const relative = normalizeRelativePath(pending.pop());
+        if (resolved.has(relative))
+            continue;
+        resolved.add(relative);
+        if (!/\.[cm]?[jt]s$/u.test(relative))
+            continue;
+        const file = path.join(root, relative);
+        const source = fs.readFileSync(file, 'utf8');
+        const imports = source.matchAll(/(?:\bfrom\s*|\bimport\s*(?:\(\s*)?)["'](\.[^"']+)["']/gu);
+        for (const match of imports) {
+            const requested = match[1];
+            const base = path.resolve(path.dirname(file), requested);
+            const candidates = [
+                base,
+                `${base}.ts`, `${base}.js`,
+                path.join(base, 'index.ts'), path.join(base, 'index.js')
+            ];
+            const dependency = candidates.find((candidate) => fs.existsSync(candidate) && fs.lstatSync(candidate).isFile());
+            if (!dependency)
+                throw new Error(`Lifecycle executable dependency '${requested}' from '${relative}' is unavailable`);
+            const dependencyRelative = path.relative(root, dependency);
+            if (dependencyRelative.startsWith('..') || path.isAbsolute(dependencyRelative)) {
+                throw new Error(`Lifecycle executable dependency '${requested}' escapes the package root`);
+            }
+            pending.push(normalizeRelativePath(dependencyRelative));
+        }
+    }
+    return [...resolved].sort();
+}
+function computeLifecycleBuildIdentity(repoRoot, options = {}) {
+    const packageRoot = executablePackageRoot();
+    const executableRoot = options.executableFiles ? repoRoot : packageRoot;
+    const defaults = readLifecycleManifestFiles(packageRoot);
+    const packageJson = JSON.parse(fs.readFileSync(path.join(executableRoot, 'package.json'), 'utf8'));
+    if (!exactText(packageJson.version))
+        throw new Error('Lifecycle package version is invalid');
+    let internalExecutableBuildHash;
+    if (options.executableFiles) {
+        internalExecutableBuildHash = hashFiles(repoRoot, options.executableFiles);
+    }
+    else {
+        const manifestFile = path.join(executableRoot, 'dist', 'lifecycle-build-manifest.json');
+        if (fs.existsSync(manifestFile)) {
+            const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
+            if (manifest.protocolVersion !== LIFECYCLE_PROTOCOL_VERSION
+                || manifest.packageVersion !== packageJson.version
+                || !exactText(manifest.sourceInputHash)
+                || !exactText(manifest.internalExecutableBuildHash)) {
+                throw new Error('Lifecycle executable build manifest is stale or invalid');
+            }
+            if (fileURLToPath(import.meta.url).split(path.sep).includes('dist')) {
+                const compiledFiles = defaults.executableFiles.map((file) => file.endsWith('.ts') ? path.join('dist', file.replace(/\.ts$/u, '.js')) : file);
+                if (hashFiles(executableRoot, resolveLifecycleExecutableFiles(executableRoot, compiledFiles)) !== manifest.internalExecutableBuildHash) {
+                    throw new Error('Lifecycle compiled executable build does not match its manifest');
+                }
+            }
+            else if (hashFiles(executableRoot, resolveLifecycleExecutableFiles(executableRoot, defaults.executableFiles)) !== manifest.sourceInputHash) {
+                throw new Error('Lifecycle executable build manifest is stale or invalid');
+            }
+            internalExecutableBuildHash = manifest.internalExecutableBuildHash;
+        }
+        else
+            internalExecutableBuildHash = hashFiles(executableRoot, resolveLifecycleExecutableFiles(executableRoot, defaults.executableFiles));
+    }
+    return Object.freeze({
+        protocolVersion: LIFECYCLE_PROTOCOL_VERSION,
+        packageVersion: packageJson.version,
+        internalExecutableBuildHash,
+        lifecycleContractHash: hashFiles(repoRoot, options.contractFiles ?? defaults.contractFiles)
+    });
+}
+function verifyLifecycleBuildIdentity(expected, actual) {
+    if (actual.protocolVersion !== expected.protocolVersion) {
+        return {
+            ok: false,
+            code: 'CODEX_LIFECYCLE_PROTOCOL_MISMATCH',
+            message: 'Codex lifecycle protocol version does not match'
+        };
+    }
+    if (actual.packageVersion !== expected.packageVersion
+        || actual.internalExecutableBuildHash !== expected.internalExecutableBuildHash) {
+        return {
+            ok: false,
+            code: 'CODEX_LIFECYCLE_BUILD_MISMATCH',
+            message: 'Codex lifecycle executable build identity does not match'
+        };
+    }
+    if (actual.lifecycleContractHash !== expected.lifecycleContractHash) {
+        return {
+            ok: false,
+            code: 'CODEX_LIFECYCLE_CONTRACT_MISMATCH',
+            message: 'Codex lifecycle contract identity does not match'
+        };
+    }
+    return { ok: true, code: null, message: null };
+}
+export { LIFECYCLE_PROTOCOL_VERSION, computeLifecycleBuildIdentity, readLifecycleManifestFiles, resolveLifecycleExecutableFiles, verifyLifecycleBuildIdentity };
+//# sourceMappingURL=build-identity.js.map