@fitlab-ai/agent-infra 0.9.5 → 0.9.7

package/dist/lib/agent-clients/adapters/codex-lifecycle/store.js

@@ -14,10 +14,12 @@ function readRecord(file) {
         || !Number.isSafeInteger(value.revision)
         || value.revision < 1
         || !value.state
-        || value.state.schemaVersion !== 1) {
+        || value.state.schemaVersion !== 1
+        || (value.spawnObservedAt != null && (typeof value.spawnObservedAt !== 'string'
+            || !Number.isFinite(Date.parse(value.spawnObservedAt))))) {
         throw new Error(`Codex lifecycle record '${path.basename(file)}' is invalid`);
     }
-    return value;
+    return Object.freeze({ ...value, spawnObservedAt: value.spawnObservedAt ?? null });
 }
 function recordFiles(root) {
     if (!fs.existsSync(root))
@@ -26,6 +28,15 @@ function recordFiles(root) {
         .filter((name) => /^[a-f0-9]{64}\.json$/.test(name))
         .map((name) => path.join(root, name));
 }
+function hasActiveCodexLifecycleEvidence(root, query) {
+    return recordFiles(root).map(readRecord).some((record) => {
+        const evidence = record.state.startEvidence;
+        return record.consumer === null
+            && ['start-ready', 'observed-terminal', 'stop-ready'].includes(record.state.status)
+            && evidence?.nativeAgent === query.nativeAgent
+            && evidence.hookDefinitionHash === query.hookDefinitionHash;
+    });
+}
 function writeRecord(file, record, expectedRevision) {
     const temp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
     fs.writeFileSync(temp, `${JSON.stringify(record, null, 2)}\n`, {
@@ -99,7 +110,7 @@ function createCodexLifecycleStore(options) {
         if (event.type === 'hook-child') {
             const matches = recordFiles(root).filter((file) => {
                 const state = readRecord(file).state;
-                return state.spawn?.sessionId === event.sessionId
+                return state.spawn?.sessionId === event.parentThreadId
                     && state.spawn.nativeAgent === event.nativeAgent
                     && (!state.child || state.child.childThreadId === event.childThreadId);
             });
@@ -121,6 +132,7 @@ function createCodexLifecycleStore(options) {
     function apply(event) {
         return withWriteLock(() => {
             const file = locate(event);
+            const observedAt = now();
             const current = fs.existsSync(file)
                 ? readRecord(file)
                 : Object.freeze({
@@ -129,7 +141,8 @@ function createCodexLifecycleStore(options) {
                     state: createCodexLifecycleState(options.cliVersion),
                     consumer: null,
                     consumedAt: null,
-                    updatedAt: now()
+                    spawnObservedAt: null,
+                    updatedAt: observedAt
                 });
             if (current.consumer)
                 throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
@@ -140,12 +153,52 @@ function createCodexLifecycleStore(options) {
                 state: nextState,
                 consumer: null,
                 consumedAt: null,
+                spawnObservedAt: event.type === 'hook-spawn' && current.revision === 0
+                    ? observedAt
+                    : current.spawnObservedAt,
+                updatedAt: observedAt
+            });
+            writeRecord(file, next, current.revision);
+            return Object.freeze({ path: file, revision: next.revision, state: next.state });
+        });
+    }
+    function applyToSpawn(identity, event) {
+        return withWriteLock(() => {
+            const file = path.join(root, `${digest(`${identity.sessionId}\0${identity.turnId}\0${identity.toolUseId}`)}.json`);
+            if (!fs.existsSync(file))
+                throw new Error('Codex lifecycle spawn identity was not found');
+            const current = readRecord(file);
+            if (current.consumer)
+                throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+            if (current.state.spawn?.sessionId !== identity.sessionId
+                || current.state.spawn.turnId !== identity.turnId
+                || current.state.spawn.toolUseId !== identity.toolUseId)
+                throw new Error('Codex lifecycle spawn identity does not match the stored event');
+            const nextState = reduceCodexLifecycleEvent(current.state, event);
+            const next = Object.freeze({
+                ...current,
+                revision: current.revision + 1,
+                state: nextState,
                 updatedAt: now()
             });
             writeRecord(file, next, current.revision);
             return Object.freeze({ path: file, revision: next.revision, state: next.state });
         });
     }
+    function findByParent(parentThreadId) {
+        const matches = recordFiles(root)
+            .map(readRecord)
+            .filter((record) => record.state.startEvidence?.parentThreadId === parentThreadId
+            && ['start-ready', 'observed-terminal', 'stop-ready'].includes(record.state.status));
+        const unconsumed = matches.filter((record) => !record.consumer);
+        if (unconsumed.length > 1)
+            throw new Error(`Codex lifecycle parent '${parentThreadId}' has ambiguous active children`);
+        if (unconsumed.length === 1)
+            return Object.freeze(unconsumed);
+        return Object.freeze(matches
+            .filter((record) => record.consumer && record.state.status === 'stop-ready')
+            .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)));
+    }
     function read(childThreadId) {
         const matches = findByChild(childThreadId);
         if (matches.length !== 1)
@@ -161,8 +214,15 @@ function createCodexLifecycleStore(options) {
                 throw new Error(`Codex lifecycle child '${childThreadId}' was not found uniquely`);
             const file = matches[0];
             const current = readRecord(file);
-            if (current.consumer)
-                throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+            if (current.consumer) {
+                if (current.consumer !== consumer) {
+                    throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+                }
+                if (expectedHookDefinitionHash
+                    && current.state.startEvidence?.hookDefinitionHash !== expectedHookDefinitionHash)
+                    throw new Error('Codex lifecycle hook definition hash is stale');
+                return current;
+            }
             if (current.state.status !== 'stop-ready')
                 throw new Error('Codex lifecycle evidence is not stop-ready');
             if (expectedHookDefinitionHash
@@ -205,7 +265,7 @@ function createCodexLifecycleStore(options) {
             return changed;
         });
     }
-    return Object.freeze({ root, apply, consume, expireBefore, read });
+    return Object.freeze({ root, apply, applyToSpawn, consume, expireBefore, findByParent, read });
 }
-export { createCodexLifecycleStore };
+export { createCodexLifecycleStore, hasActiveCodexLifecycleEvidence };
 //# sourceMappingURL=store.js.map

package/dist/lib/agent-clients/adapters/codex.js

@@ -11,7 +11,7 @@ const codexAdapter = defineAgentClientAdapter({
         commands: { level: 'integrated' },
         hooks: { level: 'integrated' },
         subagents: { level: 'experimental' },
-        orchestration: { level: 'unsupported' },
+        orchestration: { level: 'experimental' },
         sandbox: { level: 'integrated' },
         verification: { level: 'compatible' }
     },

package/dist/lib/defaults.json

@@ -56,7 +56,6 @@
             ".agents/skills/",
             ".agents/templates/",
             ".agents/workflows/",
-            ".agents/workspace/README.md",
             ".git-hooks/check-large-files.cjs",
             ".git-hooks/check-version-format.sh",
             ".github/scripts/",
@@ -84,6 +83,15 @@
             ".git-hooks/pre-commit",
             ".gitignore"
         ],
-        "ejected": []
+        "ejected": [],
+        "retiredManaged": [
+            {
+                "path": ".agents/workspace/README.md",
+                "templateHashes": [
+                    "sha256:967b27ca4008154c5abf99a1df728242f80ed3ace9bd98eb2828bc1c76af826c",
+                    "sha256:15aa21942cf2a1396d27834f1d3d723b61a46f8d14600b706f39f3bebc21aea3"
+                ]
+            }
+        ]
     }
 }

package/dist/lib/git/workflow.js

@@ -12,6 +12,9 @@ function value(runner, cwd, args, trim = true) {
     const result = run(runner, cwd, args);
     return result.status === 0 ? (trim ? result.stdout.trim() : result.stdout.replace(/\n$/, '')) : null;
 }
+function nulPaths(output) {
+    return output.split('\0').filter(Boolean);
+}
 function cleanMessage(message) {
     return message.replace(/(https?:\/\/)[^\s/@:]+(?::[^\s/@]*)?@/gi, '$1***@').trim();
 }
@@ -64,9 +67,33 @@ function commitExplicitPaths(input, runner = defaultRunner) {
     const unrelatedStaged = before.snapshot.staged.filter((candidate) => !selected.has(candidate));
     if (unrelatedStaged.length > 0)
         return { status: 'failed', changed: false, snapshot: before.snapshot, operations: [], error: { code: 'GIT_STAGED_SCOPE_MISMATCH', message: `Unrelated staged paths: ${unrelatedStaged.join(', ')}` } };
-    const add = run(runner, input.cwd, ['add', '--', ...input.paths]);
-    if (add.status !== 0)
-        return { status: 'failed', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'stage', status: 'failed', message: add.stderr.trim() }], error: { code: 'GIT_STAGE_FAILED', message: add.stderr.trim() } };
+    const stageFailure = (message) => ({ status: 'failed', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'stage', status: 'failed', message }], error: { code: 'GIT_STAGE_FAILED', message } });
+    const indexed = run(runner, input.cwd, ['ls-files', '-z', '--', ...input.paths]);
+    if (indexed.status !== 0)
+        return stageFailure(indexed.stderr.trim());
+    const headed = run(runner, input.cwd, ['ls-tree', '-r', '--name-only', '-z', 'HEAD', '--', ...input.paths]);
+    if (headed.status !== 0)
+        return stageFailure(headed.stderr.trim());
+    const indexedPaths = new Set(nulPaths(indexed.stdout));
+    const headPaths = new Set(nulPaths(headed.stdout));
+    const trackedPaths = [];
+    const addPaths = [];
+    for (const candidate of input.paths) {
+        if (indexedPaths.has(candidate))
+            trackedPaths.push(candidate);
+        else if (!headPaths.has(candidate) || fs.existsSync(path.join(input.cwd, candidate)))
+            addPaths.push(candidate);
+    }
+    if (trackedPaths.length > 0) {
+        const update = run(runner, input.cwd, ['add', '-u', '--', ...trackedPaths]);
+        if (update.status !== 0)
+            return stageFailure(update.stderr.trim());
+    }
+    if (addPaths.length > 0) {
+        const add = run(runner, input.cwd, ['add', '--', ...addPaths]);
+        if (add.status !== 0)
+            return stageFailure(add.stderr.trim());
+    }
     const staged = run(runner, input.cwd, ['diff', '--cached', '--quiet', '--']);
     if (staged.status === 0)
         return { status: 'no-op', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'stage', status: 'no-op' }], error: null };
@@ -119,7 +146,6 @@ function pushRebasedBranch(input, runner = defaultRunner) {
         .map((name) => value(runner, input.cwd, ['rev-parse', '--git-path', name]))
         .filter((candidate) => Boolean(candidate));
     if (snapshot.worktree.length > 0 || snapshot.staged.length > 0 ||
-        run(runner, input.cwd, ['rev-parse', '-q', '--verify', 'REBASE_HEAD']).status === 0 ||
         rebasePaths.some((candidate) => fs.existsSync(path.isAbsolute(candidate) ? candidate : path.join(input.cwd, candidate)))) {
         return { status: 'failed', changed: false, snapshot, operations: [], error: { code: 'GIT_LOCAL_STATE_UNSAFE', message: 'Working tree must be clean with no rebase in progress' } };
     }

package/dist/lib/internal/codex-lifecycle.js

@@ -4,7 +4,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread } from '../agent-clients/adapters/codex-lifecycle/app-server.js';
 import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.js';
-const USAGE = 'Usage: agent-infra-internal codex-lifecycle <hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
+import { createCodexCapabilityStore } from '../agent-clients/adapters/codex-lifecycle/capability-store.js';
+import { computeLifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.js';
+import { verifyCodexSandboxControllerContext } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
+import { resolveTaskRef } from '../task/resolve-ref.js';
+import { activateCodexOrchestrationDelegation, activateCodexSpawnDelegation, reconcileCodexOrchestrationDelegation, sealCodexOrchestrationDelegation, sealCodexParentDelegation } from '../task/codex-orchestration.js';
+const USAGE = 'Usage: agent-infra-internal codex-lifecycle <capability-arm|hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
 const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
 function output(value) {
     process.stdout.write(`${JSON.stringify(value)}\n`);
@@ -13,6 +18,15 @@ function failure(code, message) {
     output({ status: 'failed', changed: false, evidence: null, diagnostics: [], error: { code, message } });
     process.exitCode = 1;
 }
+function outputBridgeResult(result) {
+    if (result.error?.code === 'ORCHESTRATION_DELEGATION_MISSING') {
+        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+        return;
+    }
+    output(result);
+    if (result.status !== 'running')
+        process.exitCode = 1;
+}
 function parse(args) {
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
@@ -24,7 +38,8 @@ function parse(args) {
         return null;
     }
     const allowed = {
-        'hook-event': ['--event'],
+        'capability-arm': ['--task-id'],
+        'hook-event': ['--event', '--bridge'],
         'resolve-start': ['--child-id'],
         'resolve-stop': ['--child-id'],
         preflight: ['--format', '--session-id', '--turn-id', '--tool-use-id'],
@@ -61,6 +76,16 @@ function hookDefinitionHash() {
     const file = path.join(process.cwd(), '.codex', 'hooks.json');
     return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 }
+function controllerBinding(taskId) {
+    const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+    if (!contextPath)
+        return undefined;
+    const context = verifyCodexSandboxControllerContext(contextPath, taskId, { repoRoot: process.cwd() });
+    return {
+        instanceDigest: context.controllerInstanceDigest,
+        controlGeneration: context.controlGeneration
+    };
+}
 async function readStdin() {
     let input = '';
     process.stdin.setEncoding('utf8');
@@ -110,6 +135,12 @@ function recordFromPayload(phase, payload) {
         return null;
     throw new Error(`unknown Codex lifecycle hook phase '${phase}'`);
 }
+function payloadText(payload, key) {
+    return payload && typeof payload === 'object' && !Array.isArray(payload)
+        && typeof payload[key] === 'string'
+        ? payload[key]
+        : '';
+}
 async function codexLifecycle(args = []) {
     const parsed = parse(args);
     if (!parsed || process.exitCode)
@@ -140,18 +171,153 @@ async function codexLifecycle(args = []) {
                 output({ status: 'ready', changed: false, evidence: result, diagnostics: result.diagnostics, error: null });
             return;
         }
+        if (parsed.operation === 'capability-arm') {
+            const taskId = parsed.values['--task-id'];
+            if (!taskId)
+                throw new Error('capability-arm requires --task-id');
+            const resolved = resolveTaskRef(taskId, { repoRoot: process.cwd() });
+            if (!resolved.ok)
+                throw new Error(`${resolved.code}: ${resolved.message}`);
+            const armed = createCodexCapabilityStore().arm({
+                taskId: resolved.taskId,
+                buildIdentity: computeLifecycleBuildIdentity(process.cwd()),
+                controller: controllerBinding(resolved.taskId)
+            });
+            output({
+                status: 'armed',
+                changed: true,
+                capabilityToken: armed.token,
+                marker: armed.marker,
+                expiresAt: armed.expiresAt,
+                buildIdentity: armed.buildIdentity,
+                error: null
+            });
+            return;
+        }
         const store = createCodexLifecycleStore({ cliVersion: cliVersion() });
         if (parsed.operation === 'hook-event') {
             const phase = parsed.values['--event'];
             if (!phase || !['pre-tool', 'subagent-start', 'post-tool', 'subagent-stop'].includes(phase)) {
                 throw new Error('hook-event requires a known --event');
             }
-            const event = recordFromPayload(phase, await readStdin());
+            if (parsed.values['--bridge'] !== undefined && parsed.values['--bridge'] !== 'true') {
+                throw new Error("hook-event --bridge must be 'true'");
+            }
+            const payload = await readStdin();
+            if (phase === 'post-tool') {
+                const capabilityToken = payloadText(payload, 'capabilityToken');
+                if (capabilityToken) {
+                    const capabilityStore = createCodexCapabilityStore();
+                    const armed = capabilityStore.inspect(capabilityToken);
+                    const capability = createCodexCapabilityStore().attest({
+                        token: capabilityToken,
+                        sessionId: payloadText(payload, 'sessionId'),
+                        turnId: payloadText(payload, 'turnId'),
+                        toolUseId: payloadText(payload, 'toolUseId'),
+                        hookDefinitionHash: payloadText(payload, 'hookDefinitionHash'),
+                        buildIdentity: computeLifecycleBuildIdentity(process.cwd()),
+                        controller: controllerBinding(armed.taskId)
+                    });
+                    output({
+                        status: capability.status,
+                        changed: true,
+                        evidence: {
+                            revision: capability.revision,
+                            sessionId: capability.sessionId,
+                            turnId: capability.turnId,
+                            toolUseId: capability.toolUseId,
+                            expiresAt: capability.expiresAt
+                        },
+                        diagnostics: [],
+                        error: null
+                    });
+                    return;
+                }
+            }
+            if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
+                const toolName = payloadText(payload, 'toolName');
+                if (toolName === 'collaborationspawn_agent') {
+                    const nativeAgent = payloadText(payload, 'nativeAgent');
+                    if (!MANAGED_AGENT.test(nativeAgent)) {
+                        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+                        return;
+                    }
+                    const requestedModel = payloadText(payload, 'requestedModel');
+                    const requestedReasoningEffort = payloadText(payload, 'requestedReasoningEffort');
+                    const bridged = await activateCodexSpawnDelegation({
+                        sessionId: payloadText(payload, 'sessionId'),
+                        turnId: payloadText(payload, 'turnId'),
+                        toolUseId: payloadText(payload, 'toolUseId'),
+                        transcriptPath: payloadText(payload, 'transcriptPath'),
+                        nativeAgent,
+                        taskName: payloadText(payload, 'taskName'),
+                        ...(requestedModel ? { requestedModel } : {}),
+                        ...(requestedReasoningEffort ? { requestedReasoningEffort } : {})
+                    }, { store });
+                    outputBridgeResult(bridged);
+                    return;
+                }
+                if (toolName === 'collaborationwait_agent') {
+                    outputBridgeResult(await sealCodexParentDelegation(payloadText(payload, 'sessionId'), { store }));
+                    return;
+                }
+                output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+                return;
+            }
+            const event = recordFromPayload(phase, payload);
             if (!event) {
+                if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
+                    const value = payload;
+                    const childThreadId = String(value.childThreadId ?? '');
+                    const reconciled = reconcileCodexOrchestrationDelegation(childThreadId);
+                    outputBridgeResult(reconciled);
+                    return;
+                }
                 output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
                 return;
             }
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
+                try {
+                    if (store.read(event.childThreadId).consumer) {
+                        const bridged = await sealCodexOrchestrationDelegation(event.childThreadId, { store });
+                        outputBridgeResult(bridged);
+                        return;
+                    }
+                }
+                catch {
+                    // The normal apply path below owns missing or invalid evidence errors.
+                }
+            }
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-child') {
+                const resolved = await resolveCodexThread(event.childThreadId);
+                store.apply({
+                    ...event,
+                    parentThreadId: resolved.resolution.thread.parentThreadId
+                });
+                const bridged = await activateCodexOrchestrationDelegation(event.childThreadId, {
+                    store,
+                    resolveThread: async () => resolved
+                });
+                outputBridgeResult(bridged);
+                return;
+            }
+            if (event.type === 'hook-child') {
+                const resolved = await resolveCodexThread(event.childThreadId);
+                const result = store.apply({
+                    ...event,
+                    parentThreadId: resolved.resolution.thread.parentThreadId
+                });
+                output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: resolved.diagnostics, error: result.state.error });
+                if (result.state.status === 'invalid')
+                    process.exitCode = 1;
+                return;
+            }
             const result = store.apply(event);
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
+                const bridged = await sealCodexOrchestrationDelegation(event.childThreadId, { store });
+                outputBridgeResult(bridged);
+                return;
+            }
             output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: [], error: result.state.error });
             if (result.state.status === 'invalid')
                 process.exitCode = 1;

package/dist/lib/internal/codex-sandbox-controller.js

@@ -0,0 +1,106 @@
+import { runCodexSandboxController, verifyCodexSandboxControllerContext } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
+const USAGE = 'Usage: agent-infra-internal codex-sandbox-controller <run|verify-context> [options]\n';
+function fail(code, message, exitCode = 1) {
+    process.stdout.write(`${JSON.stringify({
+        status: 'failed',
+        changed: false,
+        error: { code, message }
+    })}\n`);
+    process.exitCode = exitCode;
+}
+function parse(args) {
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return null;
+    }
+    const operation = args[0];
+    if (!operation || !['run', 'verify-context'].includes(operation)) {
+        process.stderr.write(USAGE);
+        fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', 'operation must be run or verify-context', 2);
+        return null;
+    }
+    const allowed = new Set([
+        '--task-id',
+        '--task-ref',
+        '--context',
+        '--executor-model',
+        '--executor-reasoning-effort',
+        '--reviewer-model',
+        '--reviewer-reasoning-effort'
+    ]);
+    const values = {};
+    for (let index = 1; index < args.length; index += 1) {
+        const flag = args[index];
+        const value = args[++index];
+        if (!allowed.has(flag) || Object.hasOwn(values, flag) || !value || value.startsWith('--')) {
+            fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', `invalid option '${flag}'`, 2);
+            return null;
+        }
+        values[flag] = value;
+    }
+    return { operation, values };
+}
+async function codexSandboxController(args = []) {
+    const parsed = parse(args);
+    if (!parsed || process.exitCode)
+        return;
+    const taskId = parsed.values['--task-id'];
+    if (!taskId) {
+        fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', '--task-id is required', 2);
+        return;
+    }
+    try {
+        if (parsed.operation === 'verify-context') {
+            const contextPath = parsed.values['--context']
+                ?? process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+            if (!contextPath)
+                throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_MISSING');
+            const context = verifyCodexSandboxControllerContext(contextPath, taskId);
+            process.stdout.write(`${JSON.stringify({
+                status: 'ready',
+                changed: false,
+                context: {
+                    taskId: context.taskId,
+                    controlGeneration: context.controlGeneration,
+                    controllerInstanceDigest: context.controllerInstanceDigest,
+                    expiresAt: context.expiresAt,
+                    buildIdentity: context.buildIdentity,
+                    hookDefinitionHash: context.hookDefinitionHash,
+                    lifecycleProfilesHash: context.lifecycleProfilesHash
+                },
+                error: null
+            })}\n`);
+            return;
+        }
+        const taskRef = parsed.values['--task-ref'];
+        if (!taskRef)
+            throw new Error('CODEX_SANDBOX_CONTROLLER_TASK_REF_REQUIRED');
+        const policy = [
+            '--executor-model',
+            '--executor-reasoning-effort',
+            '--reviewer-model',
+            '--reviewer-reasoning-effort'
+        ];
+        if (policy.some((flag) => parsed.values[flag] !== undefined)
+            && policy.some((flag) => parsed.values[flag] === undefined)) {
+            throw new Error('CODEX_SANDBOX_CONTROLLER_MODEL_POLICY_INVALID');
+        }
+        const exitCode = await runCodexSandboxController({
+            taskId,
+            taskRef,
+            executorModel: parsed.values['--executor-model'],
+            executorReasoningEffort: parsed.values['--executor-reasoning-effort'],
+            reviewerModel: parsed.values['--reviewer-model'],
+            reviewerReasoningEffort: parsed.values['--reviewer-reasoning-effort']
+        });
+        process.exitCode = exitCode;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1]
+            ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+        fail(code, message);
+    }
+}
+export { codexSandboxController };
+//# sourceMappingURL=codex-sandbox-controller.js.map