@hraness/xcb 0.9.1

package/dist/cli.js

@@ -0,0 +1,4190 @@
+#!/usr/bin/env node
+import {
+  CLAUDE_CODE_MIN_VERSION,
+  JUDGE_KEY_ENV,
+  JUDGE_KEY_VENDOR_ENV,
+  JUDGE_TOKEN_FILE,
+  JUDGE_URL_ENV,
+  PRIVATE_CONTROL_REJECT,
+  SqliteAccountLeases,
+  __require,
+  assertAgentTaskAccountLease,
+  assertCodexHostFileStable,
+  assertCodexManagedConfigResponse,
+  assertCodexProtocolManifest,
+  assertPrivateDirectory,
+  assertPrivateStat,
+  boundedText,
+  buildCodexProtocolManifest,
+  canonicalizePrivatePath,
+  checkJudgeKeyTarget,
+  claudeCodeVersionAdmitted,
+  claudeTaskRuntimeIdentity,
+  codexManagedAccountConfiguration,
+  createBwrapOsSandbox,
+  createCapabilityBroker,
+  createCapabilityProfile,
+  createClaudeTaskAdapter,
+  createCodexAccountProcess,
+  createCodexAccountStdioTransport,
+  createCodexManagedTaskAdapter,
+  createEgressBridge,
+  createManagedCodexAccountController,
+  createPublicWeb,
+  createSandboxedProviderProcessFactory,
+  createSeatbeltOsSandbox,
+  egressBridgeDialer,
+  fsyncDirectory,
+  hasJudgeKey,
+  identifier,
+  inspectCodexHostExecutable,
+  inspectCodexHostRuntime,
+  matchesPrivateStat,
+  openAccountDatabase,
+  openPrivateRead,
+  openPrivateWrite,
+  openPrivateWriteSync,
+  planBwrapPolicy,
+  planSeatbeltPolicy,
+  providerProcessWriteResult,
+  readExactPrivateFile,
+  removeJudgeKey,
+  resolveJudge,
+  resolveJudgeKey,
+  runAgentTask,
+  safeInteger,
+  sameFileIdentity,
+  storeJudgeKey,
+  streamFdContent,
+  verifyOsSandboxExecutable,
+  writeFileOnce
+} from "./index-kg2gx694.js";
+
+// src/cli.ts
+import { resolve as resolve3 } from "node:path";
+import { join as join14 } from "node:path";
+
+// src/cli/state.ts
+import { constants } from "node:fs";
+import { chmod, copyFile, lstat, mkdir, readdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, sep } from "node:path";
+var CLI_STATE_ENV = "XCB_STATE";
+var STATE_DIRNAME = ".xcb";
+var LEGACY_STATE_ENV = "AGENTMIXER_STATE";
+var LEGACY_STATE_DIRNAME = ".agentmixer";
+var MAX_MIGRATION_ENTRIES = 16384;
+var MAX_MIGRATION_BYTES = 4 * 1024 * 1024 * 1024;
+function cliStateRootPath(env = (name) => process.env[name]) {
+  const override = env(CLI_STATE_ENV);
+  if (override !== undefined) {
+    return canonicalizePrivatePath(override, { code: "XCB_STATE_INVALID", reject: PRIVATE_CONTROL_REJECT, maxLength: Infinity });
+  }
+  const home = homedir();
+  if (typeof home !== "string" || !isAbsolute(home))
+    throw new Error("XCB_HOME_UNAVAILABLE");
+  return join(home, STATE_DIRNAME);
+}
+async function privateDirectory(path) {
+  canonicalizePrivatePath(path, { code: "XCB_DIRECTORY_INVALID", reject: PRIVATE_CONTROL_REJECT, maxLength: Infinity });
+  return (await assertPrivateDirectory(path, {
+    code: "XCB_DIRECTORY_NOT_PRIVATE",
+    owner: "self",
+    mode: "ownerOnly",
+    canonical: "self",
+    statOrder: "realpathFirst",
+    stats: "number"
+  })).physical;
+}
+async function ensureCliState(child) {
+  const root = await mkdir(cliStateRootPath(), { mode: 448, recursive: true }).then(async () => await privateDirectory(cliStateRootPath()));
+  if (child === undefined)
+    return { root, path: root };
+  const name = boundedText(child, 64);
+  if (!/^[a-z][a-z0-9-]*$/u.test(name))
+    throw new Error("XCB_STATE_CHILD_INVALID");
+  const path = join(root, name);
+  await mkdir(path, { mode: 448, recursive: true });
+  return { root, path: await privateDirectory(path) };
+}
+function assertWorkspaceStateSeparation(workspace, stateRoot) {
+  const contains = (parent, child) => {
+    const path = relative(parent, child);
+    return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+  };
+  if (contains(workspace, stateRoot) || contains(stateRoot, workspace)) {
+    throw new Error("workspace overlaps private xcb state; choose a separate workspace or state root");
+  }
+}
+async function legacyStateRootPath(env = (name) => process.env[name]) {
+  const override = env(LEGACY_STATE_ENV);
+  let candidate = join(homedir(), LEGACY_STATE_DIRNAME);
+  if (override !== undefined) {
+    candidate = canonicalizePrivatePath(override, { code: "AGENTMIXER_STATE_INVALID", reject: PRIVATE_CONTROL_REJECT, maxLength: Infinity });
+  }
+  const stat = await lstat(candidate).catch(() => null);
+  if (stat === null)
+    return null;
+  return await privateDirectory(candidate);
+}
+async function migrateLegacyState(targetRoot, env = (name) => process.env[name]) {
+  const source = await legacyStateRootPath(env);
+  if (source === null)
+    throw new Error("XCB_LEGACY_STATE_ABSENT");
+  const target = await privateDirectory(targetRoot);
+  if (source === target)
+    throw new Error("XCB_LEGACY_STATE_SAME_AS_TARGET");
+  if ((await readdir(target)).length !== 0)
+    throw new Error("XCB_STATE_TARGET_NOT_EMPTY");
+  let entries = 0, bytes = 0;
+  const copyInto = async (from, to) => {
+    for (const name of await readdir(from)) {
+      if (name === "." || name === ".." || name.includes("/") || /[\x00-\x1f\x7f]/u.test(name))
+        throw new Error("XCB_LEGACY_ENTRY_INVALID");
+      const sourcePath = join(from, name);
+      const stat = await lstat(sourcePath);
+      if (stat.isSymbolicLink() || !stat.isDirectory() && !stat.isFile())
+        throw new Error("XCB_LEGACY_ENTRY_UNSUPPORTED");
+      entries += 1;
+      if (entries > MAX_MIGRATION_ENTRIES)
+        throw new Error("XCB_LEGACY_STATE_TOO_LARGE");
+      const targetPath = join(to, name);
+      if (stat.isDirectory()) {
+        if ((stat.mode & 63) !== 0)
+          throw new Error("XCB_LEGACY_ENTRY_NOT_PRIVATE");
+        await mkdir(targetPath, { mode: 448 });
+        await copyInto(sourcePath, targetPath);
+      } else {
+        bytes += stat.size;
+        if (bytes > MAX_MIGRATION_BYTES)
+          throw new Error("XCB_LEGACY_STATE_TOO_LARGE");
+        await copyFile(sourcePath, targetPath, constants.COPYFILE_EXCL);
+        await chmod(targetPath, stat.mode & 511);
+      }
+    }
+  };
+  await copyInto(source, target);
+  return { source, entries };
+}
+
+// src/cli/binaries.ts
+import { statSync } from "node:fs";
+import { chmod as chmod2, lstat as lstat2, realpath } from "node:fs/promises";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash } from "node:crypto";
+import { delimiter, isAbsolute as isAbsolute2, join as join4 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+
+// src/codex-scratch.ts
+var MAX_CONFIGURATION_BYTES = 256 * 1024;
+
+// src/codex-process.ts
+var CODEX_NATIVE_VERSION = "0.153.4";
+var CODEX_NATIVE_SHA256 = "b973d440acac501fd2594a43e7ca9ce41e0a65b9dfb28d0d7a7837c99e1261e3";
+
+// src/cli/devin.ts
+import { spawn as spawn2, spawnSync } from "node:child_process";
+import { mkdir as mkdir3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+
+// src/cli/auth.ts
+import { spawn } from "node:child_process";
+import { mkdir as mkdir2, readFile, rm } from "node:fs/promises";
+import { join as join2 } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+var fail = (code) => {
+  throw new Error(code);
+};
+async function providerAuthDirs(stateRoot, provider) {
+  const root = await privateDirectory(stateRoot);
+  for (const name of [`${provider}-auth`, `${provider}-home`]) {
+    await mkdir2(join2(root, name), { mode: 448, recursive: true });
+  }
+  return { config: await privateDirectory(join2(root, `${provider}-auth`)), home: await privateDirectory(join2(root, `${provider}-home`)) };
+}
+function managedLoginEnv(home, config) {
+  return {
+    HOME: home,
+    CLAUDE_CONFIG_DIR: config,
+    TMPDIR: join2(home, "tmp"),
+    PATH: "/usr/bin:/bin:/usr/local/bin",
+    LANG: "en_US.UTF-8",
+    NO_COLOR: "1",
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
+  };
+}
+var TOKEN_PATH = (stateRoot) => join2(stateRoot, "claude-oauth-token");
+function loginOutput(write, hidden, hide) {
+  const decoder = new StringDecoder("utf8"), prefix = "sk-ant-";
+  let held = "", matched = 0, escape = 0;
+  const render = (text) => {
+    let visible = "";
+    for (const character of text) {
+      if (hidden())
+        break;
+      if (escape === 1) {
+        escape = character === "[" ? 2 : character === "]" ? 3 : 0;
+        continue;
+      }
+      if (escape === 2) {
+        if (character >= "@" && character <= "~")
+          escape = 0;
+        continue;
+      }
+      if (escape === 3) {
+        if (character === "\x07")
+          escape = 0;
+        else if (character === "\x1B")
+          escape = 4;
+        continue;
+      }
+      if (escape === 4) {
+        escape = character === "\\" ? 0 : character === "\x1B" ? 4 : 3;
+        continue;
+      }
+      if (character === "\x1B") {
+        escape = 1;
+        continue;
+      }
+      if (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/u.test(character))
+        continue;
+      if (matched > 0 && /\s/u.test(character)) {
+        held += character;
+        continue;
+      }
+      if (character === prefix[matched]) {
+        held += character;
+        if (++matched === prefix.length) {
+          hide();
+          held = "";
+          visible += `<token captured>
+`;
+        }
+      } else {
+        visible += held;
+        held = character === prefix[0] ? character : "";
+        matched = held.length;
+        if (held === "")
+          visible += character;
+      }
+    }
+    if (visible !== "")
+      write(visible);
+  };
+  return {
+    push(chunk) {
+      const text = decoder.write(chunk);
+      render(text);
+      return text;
+    },
+    end() {
+      const text = decoder.end();
+      render(text);
+      if (!hidden() && held !== "")
+        write(held);
+      held = "";
+      return text;
+    }
+  };
+}
+async function storeToken(stateRoot, token) {
+  await privateDirectory(stateRoot);
+  await writeFileOnce(TOKEN_PATH(stateRoot), token + `
+`, { exclusive: false, nofollow: false, truncate: true });
+}
+async function readClaudeOAuthToken(stateRoot) {
+  try {
+    const text = await readFile(TOKEN_PATH(stateRoot), "utf8");
+    if (text.length > 2048)
+      return null;
+    const token = text.trim();
+    return /^sk-ant-oat\d{2}-[A-Za-z0-9_-]{16,1024}$/u.test(token) ? token : null;
+  } catch {
+    return null;
+  }
+}
+async function clearClaudeOAuthToken(stateRoot) {
+  await rm(TOKEN_PATH(stateRoot), { force: true });
+}
+async function claudeLogin(stateRoot, inspection) {
+  if (!inspection.versionMatches)
+    fail("CLAUDE_VERSION_MISMATCH");
+  const { config, home } = await providerAuthDirs(stateRoot, "claude");
+  await mkdir2(join2(home, "tmp"), { mode: 448, recursive: true });
+  const env = managedLoginEnv(home, config);
+  const setupToken = (args = ["setup-token"]) => new Promise((resolve) => {
+    let captured2 = "", hidden = false, bytes = 0, oversized = false;
+    const child = spawn(inspection.executablePath, args, {
+      stdio: ["inherit", "pipe", "pipe"],
+      env,
+      detached: false,
+      timeout: 600000,
+      killSignal: "SIGKILL"
+    });
+    const hide = () => {
+      hidden = true;
+    };
+    const stdout = loginOutput((text2) => {
+      process.stdout.write(text2);
+    }, () => hidden, hide);
+    const stderr = loginOutput((text2) => {
+      process.stderr.write(text2);
+    }, () => hidden, hide);
+    const bounded = (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes <= 64 * 1024)
+        return true;
+      oversized = true;
+      hide();
+      child.kill("SIGKILL");
+      return false;
+    };
+    child.stdout.on("data", (chunk) => {
+      if (!bounded(chunk))
+        return;
+      captured2 += stdout.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (bounded(chunk))
+        stderr.push(chunk);
+    });
+    child.on("error", () => resolve({ code: 1, captured: "" }));
+    child.on("close", (status) => {
+      captured2 += stdout.end();
+      stderr.end();
+      resolve({ code: oversized ? 1 : status ?? 1, captured: captured2 });
+    });
+  });
+  let result = await setupToken();
+  if (result.code !== 0) {
+    const login = await setupToken(["auth", "login"]);
+    if (login.code === 0)
+      result = await setupToken();
+  }
+  const { code, captured } = result;
+  const text = captured.replaceAll(/\x1b\[[0-9;?]*[a-zA-Z]/gu, "");
+  const raw = text.match(/sk-ant-oat\d{2}-[A-Za-z0-9_-]+(?:\n[ \t]*[A-Za-z0-9_-]+[ \t]*(?=\n|$))*/u)?.[0]?.replaceAll(/\s+/gu, "");
+  if (code !== 0)
+    fail("CLAUDE_LOGIN_FAILED");
+  const token = raw !== undefined && /^sk-ant-oat\d{2}-[A-Za-z0-9_-]{16,1024}$/u.test(raw) ? raw : fail("CLAUDE_LOGIN_FAILED");
+  await storeToken(stateRoot, token);
+}
+async function claudeAuthStatus(stateRoot) {
+  const token = await readClaudeOAuthToken(stateRoot);
+  return Object.freeze({ loggedIn: token !== null, authMethod: token === null ? null : "subscription-token" });
+}
+
+// src/cli/devin.ts
+var fail2 = (code) => {
+  throw new Error(code);
+};
+var CLI_DEVIN_MIN_VERSION = "3000.10.27";
+var CLI_DEVIN_MAX_MAJOR = 3000;
+var CLI_DEVIN_QUALIFICATION_REQUIRED = "Devin tasks are disabled: the exact effective tool inventory, command-tool exclusion, configuration isolation and workspace confinement have not been qualified. A matching CLI version or sign-in does not qualify this route; use Claude or an admitted Codex route until host qualification is implemented.";
+function versionTuple(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/u.exec(version.trim());
+  if (match === null)
+    return null;
+  return Object.freeze([Number(match[1]), Number(match[2]), Number(match[3])]);
+}
+function devinCliVersionMatches(version) {
+  const got = versionTuple(version), min = versionTuple(CLI_DEVIN_MIN_VERSION);
+  if (got === null || min === null || got[0] !== CLI_DEVIN_MAX_MAJOR)
+    return false;
+  for (let index = 0;index < 3; index += 1) {
+    if (got[index] !== min[index])
+      return got[index] > min[index];
+  }
+  return true;
+}
+function devinManagedEnv(home) {
+  return Object.freeze({
+    HOME: home,
+    XDG_DATA_HOME: join3(home, ".local", "share"),
+    XDG_CONFIG_HOME: join3(home, ".config"),
+    XDG_CACHE_HOME: join3(home, ".cache"),
+    TMPDIR: join3(home, "tmp"),
+    PATH: "/usr/bin:/bin:/usr/local/bin",
+    LANG: "en_US.UTF-8",
+    NO_COLOR: "1"
+  });
+}
+async function managedAuthContext(stateRoot) {
+  const { home } = await providerAuthDirs(stateRoot, "devin");
+  await mkdir3(join3(home, "tmp"), { mode: 448, recursive: true });
+  return Object.freeze({ home, env: devinManagedEnv(home) });
+}
+async function devinAuthStatus(stateRoot, inspection) {
+  const { env } = await managedAuthContext(stateRoot);
+  const result = spawnSync(inspection.executablePath, ["auth", "status"], {
+    env: { ...env },
+    timeout: 20000,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (typeof result.stdout !== "string")
+    return Object.freeze({ loggedIn: false, planType: null });
+  const text = boundedText(result.stdout, 16 * 1024, true);
+  const loggedIn = /^Logged in\b/mu.test(text);
+  const plan = /^\s*Plan:\s*(.+)$/mu.exec(text)?.[1]?.trim();
+  return Object.freeze({ loggedIn, planType: loggedIn && plan !== undefined && plan !== "" ? boundedText(plan, 64) : null });
+}
+async function devinLogin(stateRoot, inspection) {
+  const { env } = await managedAuthContext(stateRoot);
+  const code = await new Promise((resolve) => {
+    const child = spawn2(inspection.executablePath, ["auth", "login"], { stdio: "inherit", env: { ...env }, detached: false });
+    child.on("error", () => resolve(1));
+    child.on("exit", (status) => resolve(status ?? 1));
+  });
+  if (code !== 0)
+    fail2("DEVIN_LOGIN_FAILED");
+}
+async function devinLogout(stateRoot, inspection) {
+  const { env } = await managedAuthContext(stateRoot);
+  await new Promise((resolve) => {
+    const child = spawn2(inspection.executablePath, ["auth", "logout"], { stdio: "inherit", env: { ...env }, detached: false });
+    child.on("error", () => resolve(0));
+    child.on("exit", (status) => resolve(status ?? 0));
+  });
+}
+
+// src/cli/binaries.ts
+var CLI_CODEX_ENV = "XCB_CODEX";
+var CLI_CLAUDE_ENV = "XCB_CLAUDE";
+var CLI_DEVIN_ENV = "XCB_DEVIN";
+var LEGACY_CLI_CODEX_ENV = "AGENTMIXER_CODEX";
+var LEGACY_CLI_CLAUDE_ENV = "AGENTMIXER_CLAUDE";
+var LEGACY_CLI_DEVIN_ENV = "AGENTMIXER_DEVIN";
+var MAX_EXECUTABLE_BYTES = 256 * 1024 * 1024;
+async function inspectCliExecutable(rawPath) {
+  const canonical = canonicalizePrivatePath(rawPath, { code: "XCB_EXECUTABLE_INVALID", resolved: false, reject: PRIVATE_CONTROL_REJECT, maxLength: Infinity });
+  const executablePath = await realpath(canonical);
+  const stat = await lstat2(executablePath);
+  assertPrivateStat(stat, {
+    kind: "file",
+    noSymlink: true,
+    links: "single",
+    owner: "selfOrRoot",
+    mode: [{ mask: 18, equals: 0 }, { mask: 73, notEquals: 0 }, { mask: 3072, equals: 0 }],
+    size: { min: 1, max: MAX_EXECUTABLE_BYTES }
+  }, "XCB_EXECUTABLE_INVALID");
+  const handle = await openPrivateRead(executablePath, { nonblock: false });
+  try {
+    const bytes = await handle.readFile();
+    if (bytes.byteLength > MAX_EXECUTABLE_BYTES)
+      throw new Error("XCB_EXECUTABLE_INVALID");
+    return { executablePath, sha256: createHash("sha256").update(bytes).digest("hex"), bytes: new Uint8Array(bytes) };
+  } finally {
+    await handle.close();
+  }
+}
+function executableExists(path) {
+  try {
+    const stat = statSync(path);
+    return stat.isFile() && (stat.mode & 73) !== 0;
+  } catch {
+    return false;
+  }
+}
+function pathEntries(env) {
+  const raw = env("PATH");
+  if (typeof raw !== "string")
+    return [];
+  return raw.split(delimiter).filter((entry) => isAbsolute2(entry) && entry.length <= 512).slice(0, 64);
+}
+var PROVIDER_ENV = { claude: CLI_CLAUDE_ENV, codex: CLI_CODEX_ENV, devin: CLI_DEVIN_ENV };
+var LEGACY_PROVIDER_ENV = { claude: LEGACY_CLI_CLAUDE_ENV, codex: LEGACY_CLI_CODEX_ENV, devin: LEGACY_CLI_DEVIN_ENV };
+function cliBinaryCandidates(provider, env = (name) => process.env[name]) {
+  const pinned = env(PROVIDER_ENV[provider]) ?? env(LEGACY_PROVIDER_ENV[provider]);
+  const command = provider;
+  const home = homedir2();
+  const known = provider === "claude" ? [join4(home, ".local", "bin", "claude"), join4(home, ".claude", "local", "claude")] : provider === "codex" ? [join4(home, ".codex", "bin", "codex"), join4(home, ".local", "bin", "codex")] : [join4(home, ".local", "bin", "devin"), join4(home, ".devin", "bin", "devin")];
+  const found = [
+    ...pinned !== undefined ? [pinned] : [],
+    ...pathEntries(env).map((entry) => join4(entry, command)),
+    ...known
+  ];
+  return Object.freeze([...new Set(found)].filter((path) => isAbsolute2(path) && path.length <= 512).slice(0, 32));
+}
+function reportedVersion(executablePath) {
+  let result;
+  try {
+    result = spawnSync2(executablePath, ["--version"], {
+      timeout: 15000,
+      encoding: "utf8",
+      env: { PATH: "/usr/bin:/bin", HOME: homedir2(), LANG: "en_US.UTF-8" },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+  if (result.status !== 0 || typeof result.stdout !== "string")
+    return null;
+  const match = /(?:^|\s)(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:[-+.][0-9A-Za-z.-]*)?/u.exec(result.stdout.trim());
+  return match === null ? null : boundedText(match[0].trim(), 160);
+}
+async function repairCliExecutableMode(rawPath) {
+  if (typeof rawPath !== "string" || !isAbsolute2(rawPath))
+    return false;
+  let resolved;
+  try {
+    resolved = await realpath(rawPath);
+  } catch {
+    return false;
+  }
+  try {
+    const stat = await lstat2(resolved);
+    if (!matchesPrivateStat(stat, { kind: "file", noSymlink: true, links: "single", owner: "self", mode: [{ mask: 3072, equals: 0 }] }))
+      return false;
+    if ((stat.mode & 18) === 0)
+      return false;
+    await chmod2(resolved, 493);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function inspectCliBinary(provider, env = (name) => process.env[name], repair = false) {
+  for (const candidate of cliBinaryCandidates(provider, env)) {
+    if (!executableExists(candidate))
+      continue;
+    let inspected;
+    try {
+      inspected = await inspectCliExecutable(candidate);
+    } catch {
+      if (!repair || !await repairCliExecutableMode(candidate))
+        continue;
+      try {
+        inspected = await inspectCliExecutable(candidate);
+      } catch {
+        continue;
+      }
+    }
+    const version = reportedVersion(inspected.executablePath);
+    if (version === null)
+      continue;
+    const versionMatches = provider === "codex" ? version === CODEX_NATIVE_VERSION : provider === "claude" ? claudeCodeVersionAdmitted(version) : devinCliVersionMatches(version);
+    const pinnedSha256 = provider === "codex" ? CODEX_NATIVE_SHA256 : null;
+    return Object.freeze({
+      provider,
+      executablePath: inspected.executablePath,
+      version,
+      sha256: inspected.sha256,
+      pinnedSha256,
+      versionMatches,
+      digestMatches: pinnedSha256 === null ? true : inspected.sha256 === pinnedSha256
+    });
+  }
+  return null;
+}
+
+// src/cli/codex.ts
+import { createHash as createHash4, randomBytes as randomBytes2 } from "node:crypto";
+import { mkdir as mkdir5, mkdtemp as mkdtemp2, opendir as opendir2, readFile as readFile2, realpath as realpath3, rm as rm3 } from "node:fs/promises";
+import { join as join7 } from "node:path";
+
+// src/codex-managed-process.ts
+import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import { closeSync, fsyncSync, writeSync } from "node:fs";
+import { lstat as lstat3, mkdir as mkdir4, mkdtemp, opendir, realpath as realpath2, rm as rm2, unlink } from "node:fs/promises";
+import { join as join5 } from "node:path";
+import { PassThrough, Writable } from "node:stream";
+
+// src/codex-managed-offline-protocol.ts
+function createManagedOfflineProtocol(process2, accountHome, signal, deadline) {
+  const stdin = process2.stdin;
+  if (!stdin)
+    throw Error("OFFLINE_DIAGNOSTIC_STDIN_UNAVAILABLE");
+  let closing = false, configured = false, disabledNotices = 0, frames = 0, bytes = 0, line = "", failure = null, joined = false, decoded = false;
+  const methods = [], writes = new Set, decoder = new TextDecoder("utf-8", { fatal: true });
+  let revoke;
+  const revoked = new Promise((_, reject) => {
+    revoke = reject;
+  });
+  revoked.catch(() => {});
+  let pending;
+  const invalid = (code) => {
+    throw Error(code);
+  };
+  function object2(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length > 256)
+      return invalid("OFFLINE_DIAGNOSTIC_RESPONSE_INVALID");
+    return value;
+  }
+  function fail3(code) {
+    failure ??= code;
+    revoke(Error(failure));
+    pending?.reject(Error(code));
+    pending = undefined;
+  }
+  function active() {
+    if (closing || signal.aborted || failure || Date.now() >= deadline)
+      throw Error(failure ?? "OFFLINE_DIAGNOSTIC_PROTOCOL_STOPPED");
+  }
+  async function bounded(work) {
+    let timer;
+    try {
+      return await Promise.race([work, revoked, new Promise((_, reject) => {
+        timer = setTimeout(() => reject(Error("OFFLINE_DIAGNOSTIC_PROTOCOL_DEADLINE")), Math.max(0, deadline - Date.now()));
+      })]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  function write(frame, method) {
+    active();
+    methods.push(method);
+    const encoded = JSON.stringify(frame) + `
+`;
+    if (methods.length > 3 || Buffer.byteLength(encoded) > 8192)
+      return Promise.reject(Error("OFFLINE_DIAGNOSTIC_REQUEST_BOUND"));
+    const work = new Promise((resolve, reject) => stdin.write(encoded, (error) => error ? reject(Error("OFFLINE_DIAGNOSTIC_WRITE_FAILED")) : resolve()));
+    writes.add(work);
+    work.then(() => writes.delete(work), () => writes.delete(work));
+    return bounded(work);
+  }
+  async function rpc(id, method, params) {
+    active();
+    if (pending)
+      return invalid("OFFLINE_DIAGNOSTIC_CONCURRENT_RPC");
+    const result2 = new Promise((resolve, reject) => {
+      pending = { id, resolve, reject };
+    });
+    result2.catch(() => {});
+    await write({ id, method, params }, method);
+    return bounded(result2);
+  }
+  function onData(chunk) {
+    if (closing)
+      return;
+    try {
+      if (!(chunk instanceof Uint8Array) || (bytes += chunk.byteLength) > 2 * 1024 * 1024)
+        return invalid("OFFLINE_DIAGNOSTIC_RESPONSE_BOUND");
+      line += decoder.decode(chunk, { stream: true });
+      let index;
+      while ((index = line.indexOf(`
+`)) !== -1) {
+        const encoded = line.slice(0, index);
+        line = line.slice(index + 1);
+        if (++frames > 32 || Buffer.byteLength(encoded) > 1024 * 1024)
+          return invalid("OFFLINE_DIAGNOSTIC_FRAME_BOUND");
+        const frame = object2(JSON.parse(encoded));
+        if (frame.jsonrpc !== undefined && frame.jsonrpc !== "2.0")
+          return invalid("OFFLINE_DIAGNOSTIC_UNEXPECTED_RESPONSE");
+        if (Object.hasOwn(frame, "method")) {
+          if (Object.keys(frame).some((key) => !["method", "params", "jsonrpc", "emittedAtMs"].includes(key)) || frame.method !== "remoteControl/status/changed" || ++disabledNotices > 1)
+            return invalid("OFFLINE_DIAGNOSTIC_NATIVE_OPERATION_DENIED");
+          if (frame.emittedAtMs !== undefined && (!Number.isSafeInteger(frame.emittedAtMs) || Number(frame.emittedAtMs) < 0))
+            return invalid("OFFLINE_DIAGNOSTIC_NATIVE_OPERATION_DENIED");
+          const params = object2(frame.params);
+          if (params.status !== "disabled" || Object.keys(params).some((key) => !["status", "installationId", "serverName", "environmentId"].includes(key)))
+            return invalid("OFFLINE_DIAGNOSTIC_NATIVE_OPERATION_DENIED");
+          for (const [key, limit] of [["installationId", 160], ["serverName", 1024]]) {
+            if (typeof params[key] !== "string" || !params[key] || Buffer.byteLength(params[key]) > limit)
+              return invalid("OFFLINE_DIAGNOSTIC_NATIVE_OPERATION_DENIED");
+          }
+          if (params.environmentId != null && (typeof params.environmentId !== "string" || !params.environmentId || Buffer.byteLength(params.environmentId) > 160))
+            return invalid("OFFLINE_DIAGNOSTIC_NATIVE_OPERATION_DENIED");
+          continue;
+        }
+        if (!pending || frame.id !== pending.id || Object.hasOwn(frame, "error") || !Object.hasOwn(frame, "result") || Object.keys(frame).some((key) => !["id", "result", "jsonrpc"].includes(key)))
+          return invalid("OFFLINE_DIAGNOSTIC_UNEXPECTED_RESPONSE");
+        const current = pending;
+        pending = undefined;
+        current.resolve(frame.result);
+      }
+      if (Buffer.byteLength(line) > 1024 * 1024)
+        return invalid("OFFLINE_DIAGNOSTIC_FRAME_BOUND");
+    } catch (error) {
+      fail3(error instanceof Error && /^OFFLINE_DIAGNOSTIC_[A-Z_]+$/u.test(error.message) ? error.message : "OFFLINE_DIAGNOSTIC_RESPONSE_INVALID");
+    }
+  }
+  function finishDecoding() {
+    if (decoded)
+      return;
+    decoded = true;
+    try {
+      line += decoder.decode();
+      if (line.length !== 0)
+        fail3("OFFLINE_DIAGNOSTIC_TRUNCATED_FRAME");
+    } catch {
+      fail3("OFFLINE_DIAGNOSTIC_TRUNCATED_UTF8");
+    }
+  }
+  function onEnd() {
+    finishDecoding();
+    if (!closing && !configured)
+      fail3("OFFLINE_DIAGNOSTIC_PREMATURE_EXIT");
+  }
+  function onError() {
+    fail3("OFFLINE_DIAGNOSTIC_STREAM_FAILED");
+  }
+  function onAbort() {
+    fail3("OFFLINE_DIAGNOSTIC_CANCELLED");
+  }
+  process2.stdout.on("data", onData);
+  process2.stdout.on("end", onEnd);
+  process2.stdout.on("error", onError);
+  stdin.on("error", onError);
+  signal.addEventListener("abort", onAbort, { once: true });
+  const result = Promise.resolve().then(async () => {
+    await bounded(process2.ready);
+    active();
+    const initialized = object2(await rpc(1, "initialize", { clientInfo: { name: "xcb-offline-diagnostic", version: "0.6.0" }, capabilities: { experimentalApi: false, requestAttestation: false } }));
+    for (const [field, limit] of [["userAgent", 1024], ["codexHome", 4096], ["platformFamily", 128], ["platformOs", 128]]) {
+      if (typeof initialized[field] !== "string" || !initialized[field] || Buffer.byteLength(initialized[field]) > limit)
+        return invalid("OFFLINE_DIAGNOSTIC_INITIALIZE_INVALID");
+    }
+    if (initialized.codexHome !== accountHome || Object.keys(initialized).some((key) => !["userAgent", "codexHome", "platformFamily", "platformOs"].includes(key)))
+      return invalid("OFFLINE_DIAGNOSTIC_INITIALIZE_INVALID");
+    await write({ method: "initialized" }, "initialized");
+    const configuration = await rpc(2, "config/read", { cwd: process2.cwd, includeLayers: false });
+    active();
+    assertCodexManagedConfigResponse(configuration, { cwd: process2.cwd });
+    configured = true;
+    if (disabledNotices !== 1 || line.length !== 0)
+      return invalid("OFFLINE_DIAGNOSTIC_STARTUP_UNPROVEN");
+  }).catch((error) => {
+    fail3(error instanceof Error && /^OFFLINE_DIAGNOSTIC_[A-Z_]+$/u.test(error.message) ? error.message : "OFFLINE_DIAGNOSTIC_CONFIGURATION_INVALID");
+    throw Error(failure);
+  });
+  result.catch(() => {});
+  function stop() {
+    if (closing)
+      return;
+    closing = true;
+    finishDecoding();
+    revoke(Error("OFFLINE_DIAGNOSTIC_PROTOCOL_STOPPED"));
+    pending?.reject(Error("OFFLINE_DIAGNOSTIC_PROTOCOL_STOPPED"));
+    pending = undefined;
+    process2.stdout.off("data", onData);
+    process2.stdout.off("end", onEnd);
+    process2.stdout.off("error", onError);
+    stdin.off("error", onError);
+    signal.removeEventListener("abort", onAbort);
+  }
+  const receipt = () => Object.freeze({ methods: Object.freeze([...methods]), configurationObserved: configured, disabledNotices, frameCount: frames, failure, joined });
+  return Object.freeze({ result, stop, async join() {
+    stop();
+    await Promise.allSettled([result, ...writes]);
+    joined = writes.size === 0;
+    return receipt();
+  }, receipt });
+}
+
+// src/codex-managed-process.ts
+var hash = (value) => createHash2("sha256").update(value).digest("hex");
+var fail3 = (code) => {
+  throw new Error(code);
+};
+function check(value, code) {
+  if (!value)
+    fail3(code);
+}
+function digest(value) {
+  check(typeof value === "string" && /^[a-f0-9]{64}$/u.test(value), "CODEX_MANAGED_PROCESS_PIN_INVALID");
+  return value;
+}
+function record(value, keys) {
+  check(value !== null && typeof value === "object" && [Object.prototype, null].includes(Object.getPrototypeOf(value)), "CODEX_MANAGED_PROCESS_OBJECT_INVALID");
+  const result = Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    check(typeof key === "string" && keys.includes(key), "CODEX_MANAGED_PROCESS_UNKNOWN_FIELD");
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    check("value" in descriptor && descriptor.enumerable, "CODEX_MANAGED_PROCESS_ACCESSOR_DENIED");
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function path(value) {
+  return canonicalizePrivatePath(value, { code: "CODEX_MANAGED_PROCESS_PATH_INVALID" });
+}
+function egressHost(value) {
+  check(typeof value === "string", "CODEX_MANAGED_PROCESS_EGRESS_INVALID");
+  const lowered = value.toLowerCase();
+  check(lowered.length > 0 && Buffer.byteLength(lowered) <= 253 && /^[a-z0-9._:\[\]-]+$/u.test(lowered), "CODEX_MANAGED_PROCESS_EGRESS_INVALID");
+  return lowered;
+}
+function sandboxOf(value) {
+  if (value === undefined)
+    return;
+  const raw = record(value, ["executable", "sha256", "readOnlyPaths", "egress"]);
+  return Object.freeze({
+    executable: path(raw.executable),
+    sha256: digest(raw.sha256),
+    readOnlyPaths: raw.readOnlyPaths === undefined ? Object.freeze([]) : Object.freeze((check(Array.isArray(raw.readOnlyPaths) && raw.readOnlyPaths.length <= 256, "CODEX_MANAGED_PROCESS_SANDBOX_INVALID"), raw.readOnlyPaths.map((entry) => path(entry)))),
+    ...raw.egress === undefined ? {} : { egress: (() => {
+      const e = record(raw.egress, ["allowlist"]);
+      return Object.freeze({ ...e.allowlist === undefined ? {} : { allowlist: (check(Array.isArray(e.allowlist) && e.allowlist.length <= 256, "CODEX_MANAGED_PROCESS_EGRESS_INVALID"), Object.freeze(e.allowlist.map((entry) => egressHost(entry)))) } });
+    })() }
+  });
+}
+async function directory(value) {
+  return (await assertPrivateDirectory(value, { code: "CODEX_MANAGED_PROCESS_PRIVATE_DIRECTORY_REQUIRED", owner: "selfOrThrow" })).metadata;
+}
+var syncDirectory = fsyncDirectory;
+async function durableFile(value, contents) {
+  await writeFileOnce(value, contents, { syncFile: true, syncParent: true });
+}
+async function fixedFile(value, contents) {
+  await readExactPrivateFile(value, contents, {
+    invalidCode: "CODEX_MANAGED_PROCESS_FILE_INVALID",
+    changedCode: "CODEX_MANAGED_PROCESS_FILE_CHANGED",
+    loop: true,
+    stableCode: "CODEX_HOST_EXECUTABLE_CHANGED",
+    stablePlainFile: true
+  });
+}
+async function copyExecutable(sourcePath, destination, expectedSha256) {
+  const source = await openPrivateRead(sourcePath);
+  try {
+    const before = await source.stat({ bigint: true });
+    assertPrivateStat(before, { kind: "file", size: { min: 1n, max: 256n * 1024n * 1024n } }, "CODEX_MANAGED_PROCESS_EXECUTABLE_INVALID");
+    const target = await openPrivateWrite(destination, { mode: 320 });
+    try {
+      const sha = createHash2("sha256");
+      const count = await streamFdContent(source, before.size, {
+        code: "CODEX_MANAGED_PROCESS_EXECUTABLE_CHANGED",
+        earlyGrowth: true,
+        onChunk: async (chunk) => {
+          sha.update(chunk);
+          await target.writeFile(chunk);
+        }
+      });
+      check(count === Number(before.size) && sha.digest("hex") === expectedSha256 && await realpath2(sourcePath) === sourcePath, "CODEX_MANAGED_PROCESS_EXECUTABLE_CHANGED");
+      assertCodexHostFileStable(before, await source.stat({ bigint: true }), await lstat3(sourcePath, { bigint: true }));
+      await target.sync();
+    } finally {
+      await target.close();
+    }
+  } finally {
+    await source.close();
+  }
+  await inspectCodexHostExecutable(destination, expectedSha256);
+}
+async function inspectScratch(scratch) {
+  const entries = [];
+  for (const name of ["", "home", "tmp", "work"]) {
+    const value = name ? join5(scratch, name) : scratch, metadata = await directory(value), iterator = await opendir(value, { bufferSize: 4 });
+    const expected = name ? [] : ["home", "tmp", "work"], found = [];
+    try {
+      for (;; ) {
+        const entry = await iterator.read();
+        if (!entry)
+          break;
+        check(expected.includes(entry.name) && found.length < expected.length, "CODEX_MANAGED_PROCESS_SCRATCH_INVALID");
+        found.push(entry.name);
+      }
+    } finally {
+      await iterator.close();
+    }
+    check(JSON.stringify(found.sort()) === JSON.stringify(expected), "CODEX_MANAGED_PROCESS_SCRATCH_INVALID");
+    const current = await directory(value);
+    check(current.dev === metadata.dev && current.ino === metadata.ino, "CODEX_MANAGED_PROCESS_SCRATCH_CHANGED");
+    entries.push({ name, device: String(metadata.dev), inode: String(metadata.ino) });
+  }
+  const content = hash(JSON.stringify({ schema: "xcb.codex-managed-scratch.v1", directories: entries.map((entry) => entry.name), mode: 448 }));
+  return { content, identity: hash(JSON.stringify({ scratch, content, entries })) };
+}
+async function bounded(promise, deadline) {
+  const remaining = deadline - Date.now();
+  check(remaining > 0, "CODEX_MANAGED_PROCESS_DEADLINE");
+  let timer;
+  try {
+    return await Promise.race([promise, new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("CODEX_MANAGED_PROCESS_DEADLINE")), remaining);
+    })]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var system = {
+  inspectParent: inspectCodexHostRuntime,
+  startEgressBridge: (request) => createEgressBridge({ socketPath: request.socketPath, ...request.allowlist === undefined ? {} : { allowlist: request.allowlist }, dialer: egressBridgeDialer }),
+  spawn: (request) => spawn3(request.executable, [...request.args], { cwd: request.cwd, env: { ...request.env }, detached: true, stdio: ["pipe", "pipe", "pipe"] }),
+  processGroup(pid) {
+    const result = spawnSync3("/bin/ps", ["-p", String(pid), "-o", "pgid="], { encoding: "utf8", timeout: 1000, maxBuffer: 1024, env: { PATH: "/usr/bin:/bin" } });
+    return !result.error && result.status === 0 && /^[1-9][0-9]*$/u.test(result.stdout.trim()) ? Number(result.stdout.trim()) : null;
+  },
+  signalGroup(pgid, signal) {
+    try {
+      process.kill(-pgid, signal);
+      return true;
+    } catch (error) {
+      if (error.code === "ESRCH")
+        return false;
+      throw error;
+    }
+  }
+};
+function codexManagedOfflineSandbox(input) {
+  const raw = record(input, ["executable", "scratch", "accountHome"]), executable = path(raw.executable), scratch = path(raw.scratch), accountHome = path(raw.accountHome);
+  check(executable !== scratch && !executable.startsWith(scratch + "/") && executable !== accountHome && !executable.startsWith(accountHome + "/") && scratch !== accountHome && !scratch.startsWith(accountHome + "/") && !accountHome.startsWith(scratch + "/"), "CODEX_MANAGED_PROCESS_LAYOUT_INVALID");
+  const q = JSON.stringify;
+  return `(version 1)
+(deny default)
+(allow process-exec (literal ${q(executable)}))
+(allow file-read* (literal ${q(executable)}) (subpath "/System/Library") (subpath "/usr/lib") (subpath "/Library/Apple/System/Library") (subpath "/System/Cryptexes/OS") (subpath "/System/Volumes/Preboot/Cryptexes/OS") (literal "/dev/null") (literal "/dev/urandom") (literal "/dev/random"))
+(allow file-write* (literal "/dev/null"))
+(allow file-read-data file-write-data (literal "/dev/fd/0") (literal "/dev/fd/1") (literal "/dev/fd/2"))
+(allow file-map-executable (literal ${q(executable)}) (subpath "/System/Library") (subpath "/usr/lib") (subpath "/System/Cryptexes/OS") (subpath "/System/Volumes/Preboot/Cryptexes/OS"))
+(allow file-read* (literal "/") (path-ancestors "/System/Cryptexes/OS") (path-ancestors "/System/Volumes/Preboot/Cryptexes/OS"))
+(allow file-read-metadata (path-ancestors ${q(executable)}) (path-ancestors ${q(scratch)}) (path-ancestors ${q(accountHome)}))
+(allow file-read* file-write* (subpath ${q(scratch)}) (subpath ${q(accountHome)}))
+(allow file-read-data file-read-metadata (literal "/etc/codex/requirements.toml") (literal "/private/etc/codex/requirements.toml"))
+(allow file-read-metadata (path-ancestors "/etc/codex/requirements.toml") (path-ancestors "/private/etc/codex/requirements.toml"))
+(allow sysctl-read)
+(allow process-info* (target self))
+(allow signal (target self))
+`;
+}
+function codexManagedProviderSandbox(input) {
+  return codexManagedOfflineSandbox(input) + `(allow network-outbound (literal "/private/var/run/mDNSResponder") (remote tcp "*:443"))
+` + `(allow file-read-metadata (literal "/var"))
+`;
+}
+function codexManagedProviderV2Sandbox(input) {
+  return codexManagedProviderSandbox(input) + `(allow file-read* (literal "/private/etc/ssl/cert.pem"))
+`;
+}
+function createCodexManagedProcessLauncher(options, trustedSystem = system) {
+  const raw = record(options, ["stateRoot", "runtime", "admission", "startupTimeoutMs"]), stateRoot = path(raw.stateRoot);
+  const r = record(raw.runtime, ["executablePath", "version", "sha256", "schemaSha256", "parentRuntime", "sandbox"]), p = record(r.parentRuntime, ["expectedSha256"]);
+  const runtimeSandbox = sandboxOf(r.sandbox);
+  const runtime = Object.freeze({
+    executablePath: path(r.executablePath),
+    version: identifier(r.version),
+    sha256: digest(r.sha256),
+    schemaSha256: digest(r.schemaSha256),
+    parentRuntime: Object.freeze({ expectedSha256: digest(p.expectedSha256) }),
+    ...runtimeSandbox === undefined ? {} : { sandbox: runtimeSandbox }
+  });
+  const a = record(raw.admission, ["profile", "taskRuntimeVersion", "taskRuntimeDigest", "nativeSha256", "schemaSha256", "parentSha256"]);
+  const sandboxProfile = a.profile;
+  check(sandboxProfile === "managed-task-offline-candidate-v1" || sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v1" || sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v2", "CODEX_MANAGED_PROCESS_ADMISSION_MISMATCH");
+  check(digest(a.nativeSha256) === runtime.sha256 && digest(a.schemaSha256) === runtime.schemaSha256 && digest(a.parentSha256) === runtime.parentRuntime.expectedSha256, "CODEX_MANAGED_PROCESS_ADMISSION_MISMATCH");
+  const taskRuntime = Object.freeze({ version: identifier(a.taskRuntimeVersion), digest: digest(a.taskRuntimeDigest) }), startupMs = safeInteger(raw.startupTimeoutMs ?? 1e4, 1, 120000);
+  const host = Object.freeze({
+    inspectParent: trustedSystem.inspectParent.bind(trustedSystem),
+    spawn: trustedSystem.spawn.bind(trustedSystem),
+    processGroup: trustedSystem.processGroup.bind(trustedSystem),
+    signalGroup: trustedSystem.signalGroup.bind(trustedSystem),
+    ...trustedSystem.startEgressBridge === undefined ? {} : { startEgressBridge: trustedSystem.startEgressBridge.bind(trustedSystem) },
+    syncDirectory: trustedSystem.syncDirectory?.bind(trustedSystem) ?? syncDirectory
+  });
+  const seen = new WeakSet;
+  let generation = 0;
+  return Object.freeze({ launch(input) {
+    const launch = record(input, ["request", "runId", "accountId", "workspaceId", "configuration", "accountLease", "cancellationSignal"]), request = launch.request;
+    const lease = assertAgentTaskAccountLease(request), originalSignal = request.signal, cancellationSignal = launch.cancellationSignal;
+    check(request.route.provider === "codex" && request.route.authentication === "subscription" && launch.accountLease === lease && launch.runId === request.runId && launch.accountId === request.accountId && launch.workspaceId === request.workspaceId, "CODEX_MANAGED_PROCESS_BINDING_MISMATCH");
+    check(request.runtime.runtimeVersion === taskRuntime.version && request.runtime.runtimeDigest === taskRuntime.digest, "CODEX_MANAGED_PROCESS_RUNTIME_MAPPING_MISMATCH");
+    check(launch.configuration === codexManagedAccountConfiguration(), "CODEX_MANAGED_PROCESS_CONFIGURATION_MISMATCH");
+    check(cancellationSignal instanceof AbortSignal, "CODEX_MANAGED_PROCESS_SIGNAL_INVALID");
+    check(!seen.has(lease), "CODEX_MANAGED_PROCESS_DUPLICATE_RUN");
+    seen.add(lease);
+    const processGeneration = safeInteger(++generation, 1, Number.MAX_SAFE_INTEGER), configuration = codexManagedAccountConfiguration();
+    const binding = Object.freeze({
+      route: Object.freeze({ ...request.route }),
+      accountId: request.accountId,
+      workspaceId: request.workspaceId,
+      runId: request.runId,
+      profile: Object.freeze({ ...request.profile }),
+      model: Object.freeze({ ...request.model }),
+      runtime: Object.freeze({ ...request.runtime }),
+      accountLease: lease
+    });
+    return Promise.resolve(createOwnedCore({
+      stateRoot,
+      runtime,
+      host,
+      binding,
+      lease,
+      processGeneration,
+      configuration,
+      runId: request.runId,
+      originalSignal,
+      cancellationSignal,
+      startupMs,
+      sandboxProfile,
+      executionDeadline: request.executionDeadlineUnixMs,
+      outerDeadline: request.cleanupDeadlineUnixMs,
+      maxCleanupMs: request.limits.maxCleanupMs,
+      schema: "xcb.codex-managed-process.v1",
+      authority() {
+        assertAgentTaskAccountLease(request);
+        check(request.accountLease === lease && request.signal === originalSignal, "CODEX_MANAGED_PROCESS_BINDING_MISMATCH");
+      }
+    }));
+  } });
+}
+function createOwnedCore(input) {
+  const {
+    stateRoot,
+    runtime,
+    host,
+    binding,
+    lease,
+    processGeneration,
+    configuration,
+    runId,
+    schema,
+    originalSignal,
+    cancellationSignal,
+    startupMs,
+    executionDeadline,
+    outerDeadline,
+    maxCleanupMs,
+    authority
+  } = input;
+  const sandboxProfile = input.sandboxProfile ?? "managed-task-offline-candidate-v1";
+  const network = sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v2" ? "general-tcp443-system-resolver-var-metadata-ca-file-candidate" : sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v1" ? "general-tcp443-system-resolver-var-metadata-candidate" : "denied";
+  const owned = Object.freeze({ accountId: lease.accountId, owner: lease.owner, leaseGeneration: lease.generation, processGeneration });
+  const accountRoot = join5(stateRoot, "accounts", lease.accountId), accountHome = join5(accountRoot, "codex-home"), runs = join5(stateRoot, "runs");
+  const root = join5(runs, `task-${runId}-${processGeneration}-${randomBytes(12).toString("hex")}`), scratch = join5(root, "scratch"), runtimeRoot = join5(root, "runtime"), executable = join5(runtimeRoot, "codex"), cwd = join5(scratch, "work"), custodyPath = join5(root, "custody.jsonl"), lockPath = join5(accountRoot, "active.json");
+  const lockContents = JSON.stringify({ schema: "xcb.codex-account-lock.v1", binding: owned, journalPath: custodyPath }) + `
+`;
+  const startupDeadline = Math.min(executionDeadline, Date.now() + startupMs);
+  const state = {
+    phase: "preparing",
+    launchAttempted: false,
+    pid: null,
+    pgid: null,
+    rootExited: false,
+    groupAbsent: false,
+    stdioJoined: false,
+    lockReleased: false,
+    scratchRetained: false,
+    nativeExitCode: null,
+    nativeExitSignal: null,
+    runtimeSnapshotSha256: "",
+    profileSha256: "",
+    scratchContentSha256: "",
+    scratchIdentitySha256: ""
+  };
+  let child, lockOwned = false, pendingReleaseSync = false, journalFd, journalFailed = false, sequence = 0, previous = null, bridge;
+  let scratchIdentity, runtimeIdentity, preparationSettled = false, nativeClosed = false, spawnEvent = false, spawnError = false, closing = false, pendingWrites = 0;
+  let stopTask, cleanupDeadline, cleanupErrors = [], executionTimer;
+  const runtimeErrors = new Set, nativeStreams = { stdin: false, stdout: false, stderr: false };
+  let resolveExit, resolveClose;
+  const exited = new Promise((done) => {
+    resolveExit = done;
+  }), closed = new Promise((done) => {
+    resolveClose = done;
+  });
+  const streamClosures = [], stdout = new PassThrough;
+  stdout.on("error", () => {});
+  let inputClosed = false;
+  const stdin = new Writable({ write(chunk, _encoding, done) {
+    if (!child || closing || state.phase !== "running") {
+      done(new Error("CODEX_MANAGED_PROCESS_STDIN_UNAVAILABLE"));
+      return;
+    }
+    pendingWrites++;
+    let settled = false;
+    const settle = (error2) => {
+      if (settled)
+        return;
+      settled = true;
+      pendingWrites--;
+      done(error2);
+    };
+    try {
+      child.stdin.write(chunk, settle);
+    } catch {
+      settle(new Error("CODEX_MANAGED_PROCESS_STDIN_FAILED"));
+    }
+  } });
+  stdin.on("error", () => {});
+  function write(bytes) {
+    if (!(bytes instanceof Uint8Array) || bytes.byteLength === 0)
+      return Promise.reject(Error("CODEX_WRITE_INVALID"));
+    if (!child || closing || state.phase !== "running")
+      return Promise.resolve({ outcome: "refused-before-write", acceptedBytes: 0 });
+    const copy = Buffer.from(bytes);
+    return new Promise((resolve) => {
+      try {
+        stdin.write(copy, (error2) => resolve(error2 ? { outcome: "indeterminate", acceptedBytes: 0 } : providerProcessWriteResult({ outcome: "accepted-full", acceptedBytes: copy.byteLength }, copy.byteLength)));
+      } catch {
+        resolve({ outcome: "indeterminate", acceptedBytes: 0 });
+      }
+    });
+  }
+  const inputClosure = new Promise((done) => stdin.once("close", () => {
+    inputClosed = true;
+    done();
+  }));
+  const receipt = () => Object.freeze({
+    schema,
+    binding,
+    processGeneration,
+    productionQualified: false,
+    network,
+    profile: sandboxProfile,
+    nativeVersion: runtime.version,
+    executableSha256: runtime.sha256,
+    schemaSha256: runtime.schemaSha256,
+    parentRuntimeSha256: runtime.parentRuntime.expectedSha256,
+    configSha256: hash(configuration),
+    custodyPath,
+    ...state,
+    runtimeErrors: Object.freeze([...runtimeErrors]),
+    cleanupErrors: Object.freeze([...cleanupErrors])
+  });
+  const error = (code) => {
+    if (runtimeErrors.size < 24)
+      runtimeErrors.add(code);
+  };
+  function persist() {
+    check(journalFd !== undefined && !journalFailed && sequence < 32, "CODEX_MANAGED_PROCESS_JOURNAL_FAILED");
+    const line = JSON.stringify({ sequence, previousSha256: previous, snapshot: receipt() }) + `
+`;
+    try {
+      const bytes = Buffer.from(line);
+      check(bytes.length <= 16 * 1024, "CODEX_MANAGED_PROCESS_JOURNAL_BOUND");
+      let offset = 0;
+      while (offset < bytes.length) {
+        const count = writeSync(journalFd, bytes, offset, bytes.length - offset);
+        check(count > 0, "CODEX_MANAGED_PROCESS_JOURNAL_FAILED");
+        offset += count;
+      }
+      fsyncSync(journalFd);
+      previous = hash(line);
+      sequence++;
+    } catch {
+      journalFailed = true;
+      fail3("CODEX_MANAGED_PROCESS_JOURNAL_FAILED");
+    }
+  }
+  function admitted() {
+    authority();
+    check(!originalSignal.aborted && !cancellationSignal.aborted && !closing && Date.now() < startupDeadline, "CODEX_MANAGED_PROCESS_START_CANCELLED");
+  }
+  const preparation = Promise.resolve().then(async () => {
+    admitted();
+    await directory(stateRoot);
+    await directory(join5(stateRoot, "accounts"));
+    await directory(accountRoot);
+    await fixedFile(join5(accountRoot, "owner.json"), JSON.stringify({ schema: "xcb.codex-account-home.v1", accountId: owned.accountId }) + `
+`);
+    const parent = await host.inspectParent(runtime.parentRuntime);
+    check(parent.sha256 === runtime.parentRuntime.expectedSha256 && (parent.platform === "darwin" || parent.platform === "linux") && (parent.arch === "arm64" || parent.arch === "x64") && parent.version === "1.3.14", "CODEX_MANAGED_PROCESS_PARENT_MISMATCH");
+    check(parent.platform === "linux" === (runtime.sandbox !== undefined), "CODEX_MANAGED_PROCESS_SANDBOX_MISMATCH");
+    admitted();
+    await inspectCodexHostExecutable(runtime.executablePath, runtime.sha256);
+    admitted();
+    await directory(runs);
+    await mkdir4(root, { mode: 448 });
+    await syncDirectory(runs);
+    journalFd = openPrivateWriteSync(custodyPath);
+    fsyncSync(journalFd);
+    await syncDirectory(root);
+    const lock = await openPrivateWrite(lockPath);
+    lockOwned = true;
+    try {
+      await lock.writeFile(lockContents);
+      await lock.sync();
+    } finally {
+      await lock.close();
+    }
+    await syncDirectory(accountRoot);
+    persist();
+    await directory(accountHome);
+    await fixedFile(join5(accountHome, "config.toml"), configuration);
+    admitted();
+    await mkdir4(scratch, { mode: 448 });
+    state.scratchRetained = true;
+    scratchIdentity = await directory(scratch);
+    await mkdir4(runtimeRoot, { mode: 448 });
+    runtimeIdentity = await directory(runtimeRoot);
+    for (const name of ["home", "tmp", "work"])
+      await mkdir4(join5(scratch, name), { mode: 448 });
+    await copyExecutable(runtime.executablePath, executable, runtime.sha256);
+    state.runtimeSnapshotSha256 = runtime.sha256;
+    const policyPath = join5(root, parent.platform === "darwin" ? "sandbox.sb" : "sandbox.json");
+    if (parent.platform === "linux" && sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v1") {
+      check(host.startEgressBridge !== undefined && runtime.sandbox.egress !== undefined, "CODEX_MANAGED_PROCESS_EGRESS_UNAVAILABLE");
+      bridge = await host.startEgressBridge({ socketPath: join5(root, "egress.sock"), ...runtime.sandbox.egress.allowlist === undefined ? {} : { allowlist: runtime.sandbox.egress.allowlist } });
+    }
+    const sandboxPlan = parent.platform === "darwin" ? await createSeatbeltOsSandbox({ generateProfile: (spec) => (sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v2" ? codexManagedProviderV2Sandbox : sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v1" ? codexManagedProviderSandbox : codexManagedOfflineSandbox)({ executable: spec.executable, scratch: spec.scratch, accountHome: spec.accountHome }) }).plan({ platform: "darwin", executable, scratch, accountHome, network: sandboxProfile === "managed-task-offline-candidate-v1" ? "denied" : "provider-tcp443-dns", policyPath }) : await createBwrapOsSandbox({ executable: runtime.sandbox.executable, sha256: runtime.sandbox.sha256 }).plan({
+      platform: "linux",
+      executable,
+      scratch,
+      accountHome,
+      readOnlyPaths: runtime.sandbox.readOnlyPaths ?? [],
+      network: sandboxProfile === "managed-task-offline-candidate-v1" ? "denied" : "provider-tcp443-dns",
+      ...bridge === undefined ? {} : { egressSocket: bridge.socketPath },
+      policyPath
+    });
+    state.profileSha256 = sandboxPlan.policySha256;
+    await durableFile(policyPath, sandboxPlan.policy);
+    await syncDirectory(runtimeRoot);
+    const inspected = await inspectScratch(scratch);
+    state.scratchContentSha256 = inspected.content;
+    state.scratchIdentitySha256 = inspected.identity;
+    await fixedFile(join5(accountHome, "config.toml"), configuration);
+    await fixedFile(lockPath, lockContents);
+    await directory(accountHome);
+    admitted();
+    state.phase = "launch-pending";
+    state.launchAttempted = true;
+    persist();
+    const wrapped = sandboxPlan.wrap({
+      args: Object.freeze(["app-server", "--strict-config", "--listen", "stdio://"]),
+      cwd,
+      env: Object.freeze({
+        PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
+        HOME: join5(scratch, "home"),
+        CODEX_HOME: accountHome,
+        TMPDIR: join5(scratch, "tmp"),
+        NO_COLOR: "1",
+        CODEX_INTERNAL_APP_SERVER_REMOTE_CONTROL_DISABLED: "1",
+        ...sandboxProfile === "managed-task-provider-tcp443-dns-candidate-v2" && parent.platform === "darwin" ? { SSL_CERT_FILE: "/etc/ssl/cert.pem" } : {},
+        ...bridge === undefined ? {} : { XCB_EGRESS_SOCKET: bridge.socketPath }
+      })
+    });
+    child = host.spawn(Object.freeze({
+      executable: sandboxPlan.executable,
+      args: wrapped.args,
+      cwd,
+      env: wrapped.env,
+      detached: true,
+      stdio: Object.freeze(["pipe", "pipe", "pipe"])
+    }));
+    state.pid = child.pid ?? null;
+    child.once("spawn", () => {
+      spawnEvent = true;
+    });
+    child.once("exit", (code, signal) => {
+      state.rootExited = true;
+      state.nativeExitCode = code;
+      state.nativeExitSignal = signal;
+      resolveExit();
+    });
+    child.once("close", () => {
+      nativeClosed = true;
+      if (!spawnEvent && spawnError && state.pid === null) {
+        state.rootExited = true;
+        state.groupAbsent = true;
+        resolveExit();
+      }
+      resolveClose();
+    });
+    child.once("error", () => {
+      spawnError = true;
+      error("native-spawn");
+    });
+    for (const name of ["stdin", "stdout", "stderr"])
+      streamClosures.push(new Promise((done) => child[name].once("close", () => {
+        nativeStreams[name] = true;
+        done();
+      })));
+    let stdoutBytes = 0, stderrBytes = 0;
+    const streamFailed = (code) => {
+      error(code);
+      stopAndJoin().catch(() => {});
+    };
+    child.stdout.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > 16 * 1024 * 1024)
+        streamFailed("stdout-bound");
+      else if (!closing)
+        stdout.write(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes > 256 * 1024)
+        streamFailed("stderr-bound");
+    });
+    child.stdout.on("end", () => {
+      stdout.end();
+    });
+    for (const name of ["stdin", "stdout", "stderr"])
+      child[name].on("error", () => streamFailed(`native-${name}`));
+    persist();
+    check(state.pid !== null && Number.isSafeInteger(state.pid) && state.pid > 0, "CODEX_MANAGED_PROCESS_PID_UNPROVEN");
+    state.pgid = host.processGroup(state.pid);
+    check(state.pgid === state.pid, "CODEX_MANAGED_PROCESS_GROUP_UNPROVEN");
+    admitted();
+    check(!state.rootExited, "CODEX_MANAGED_PROCESS_PREMATURE_EXIT");
+    state.phase = "running";
+    persist();
+  }).catch((caught) => {
+    error(caught instanceof Error && /^(?:CODEX|TASK)_[A-Z_]+$/u.test(caught.message) ? caught.message : "preparation-failed");
+    if (!state.launchAttempted) {
+      state.rootExited = true;
+      state.groupAbsent = true;
+      resolveExit();
+    }
+    throw new Error("CODEX_MANAGED_PROCESS_PREPARATION_FAILED");
+  }).finally(() => {
+    preparationSettled = true;
+  });
+  preparation.catch(() => {});
+  function cancel() {
+    stopAndJoin().catch(() => {});
+  }
+  originalSignal.addEventListener("abort", cancel, { once: true });
+  cancellationSignal.addEventListener("abort", cancel, { once: true });
+  executionTimer = setTimeout(cancel, Math.max(0, executionDeadline - Date.now()));
+  if (originalSignal.aborted || cancellationSignal.aborted)
+    cancel();
+  const ready = bounded(preparation, startupDeadline).catch(() => {
+    error("startup-failed");
+    cancel();
+    throw new Error("CODEX_MANAGED_PROCESS_UNAVAILABLE");
+  });
+  ready.catch(() => {});
+  function stopAndJoin() {
+    if (stopTask !== undefined)
+      return stopTask;
+    closing = true;
+    cleanupDeadline ??= Math.min(outerDeadline, Date.now() + maxCleanupMs);
+    const deadline = cleanupDeadline;
+    clearTimeout(executionTimer);
+    originalSignal.removeEventListener("abort", cancel);
+    cancellationSignal.removeEventListener("abort", cancel);
+    const task = Promise.resolve().then(async () => {
+      cleanupErrors = [];
+      try {
+        if (!preparationSettled)
+          await bounded(preparation.catch(() => {}), deadline);
+        if (child) {
+          try {
+            child.stdin.end();
+          } catch {
+            error("stdin-end");
+          }
+          for (const signal of ["SIGTERM", "SIGKILL"]) {
+            if (state.rootExited || Date.now() >= deadline)
+              break;
+            if (state.pgid !== null && state.pgid === state.pid)
+              host.signalGroup(state.pgid, signal);
+            else
+              child.kill(signal);
+            if (!state.rootExited)
+              try {
+                await bounded(exited, Math.min(deadline, Date.now() + 250));
+              } catch {}
+          }
+          if (state.rootExited && state.pgid === state.pid && state.pgid !== null)
+            state.groupAbsent = !host.signalGroup(state.pgid, 0);
+          if (!nativeClosed || !nativeStreams.stdin || !nativeStreams.stdout || !nativeStreams.stderr)
+            await bounded(Promise.all([closed, ...streamClosures]), deadline);
+          check(nativeClosed && state.rootExited && state.groupAbsent && nativeStreams.stdin && nativeStreams.stdout && nativeStreams.stderr && pendingWrites === 0, "CODEX_MANAGED_PROCESS_STOP_UNPROVEN");
+        } else
+          check(preparationSettled && !state.launchAttempted && state.rootExited, "CODEX_MANAGED_PROCESS_LAUNCH_UNCERTAIN");
+        stdin.end();
+        stdin.destroy();
+        stdout.end();
+        stdout.resume();
+        if (!inputClosed)
+          await bounded(inputClosure, deadline);
+        if (!stdout.readableEnded)
+          await bounded(new Promise((done) => stdout.once("end", done)), deadline);
+        check(inputClosed && pendingWrites === 0, "CODEX_MANAGED_PROCESS_WRITES_UNJOINED");
+        state.stdioJoined = true;
+        if (bridge !== undefined) {
+          const receipt2 = await bridge.close();
+          check(receipt2.listenerClosed && receipt2.socketsJoined && receipt2.socketRemoved, "CODEX_MANAGED_PROCESS_EGRESS_UNJOINED");
+          bridge = undefined;
+        }
+        if (lockOwned) {
+          check(!journalFailed, "CODEX_MANAGED_PROCESS_JOURNAL_FAILED");
+          await fixedFile(lockPath, lockContents);
+          if (scratchIdentity && state.scratchRetained) {
+            const current = await directory(scratch);
+            check(current.dev === scratchIdentity.dev && current.ino === scratchIdentity.ino, "CODEX_MANAGED_PROCESS_SCRATCH_CHANGED");
+            await rm2(scratch, { recursive: true });
+            state.scratchRetained = false;
+          }
+          if (runtimeIdentity) {
+            const current = await directory(runtimeRoot);
+            check(current.dev === runtimeIdentity.dev && current.ino === runtimeIdentity.ino, "CODEX_MANAGED_PROCESS_RUNTIME_CHANGED");
+            await rm2(runtimeRoot, { recursive: true });
+            runtimeIdentity = undefined;
+          }
+          state.phase = "release-pending";
+          persist();
+          await unlink(lockPath);
+          lockOwned = false;
+          pendingReleaseSync = true;
+        }
+        if (pendingReleaseSync) {
+          await host.syncDirectory(accountRoot);
+          pendingReleaseSync = false;
+          state.lockReleased = true;
+        } else if (!state.lockReleased)
+          state.lockReleased = !state.launchAttempted;
+        check(state.lockReleased && !journalFailed, "CODEX_MANAGED_PROCESS_RELEASE_UNPROVEN");
+        state.phase = "closed";
+        if (journalFd !== undefined) {
+          persist();
+          closeSync(journalFd);
+          journalFd = undefined;
+        }
+      } catch {
+        state.phase = "recovery-required";
+        cleanupErrors = ["cleanup-unproven"];
+        if (journalFd !== undefined && !journalFailed)
+          try {
+            persist();
+          } catch {}
+      }
+      return receipt();
+    });
+    stopTask = task;
+    task.then((result) => {
+      if (result.phase !== "closed" && stopTask === task)
+        stopTask = undefined;
+    });
+    return task;
+  }
+  const handle = Object.freeze({ cwd, stdin, write, stdout, exited, ready, receipt, stopAndJoin });
+  return handle;
+}
+var retainedOfflineDiagnostics = new Map;
+async function assertNoDiagnosticAuth(accountHome) {
+  try {
+    await lstat3(join5(accountHome, "auth.json"));
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  fail3("OFFLINE_DIAGNOSTIC_AUTH_STATE_UNEXPECTED");
+}
+function runCodexManagedOfflineDiagnostic(options, trustedSystem = system) {
+  const raw = record(options, ["directory", "runtime", "signal", "admission"]), parentDirectory = path(raw.directory), signal = raw.signal;
+  check(signal instanceof AbortSignal, "OFFLINE_DIAGNOSTIC_SIGNAL_INVALID");
+  const r = record(raw.runtime, ["executablePath", "version", "sha256", "schemaSha256", "parentRuntime", "sandbox"]), p = record(r.parentRuntime, ["expectedSha256"]);
+  const runtimeSandbox = sandboxOf(r.sandbox);
+  const runtime = Object.freeze({
+    executablePath: path(r.executablePath),
+    version: identifier(r.version),
+    sha256: digest(r.sha256),
+    schemaSha256: digest(r.schemaSha256),
+    parentRuntime: Object.freeze({ expectedSha256: digest(p.expectedSha256) }),
+    ...runtimeSandbox === undefined ? {} : { sandbox: runtimeSandbox }
+  });
+  const admission = record(raw.admission, ["kind", "nativeSha256", "schemaSha256", "parentSha256"]);
+  check(admission.kind === "managed-offline-lifecycle-diagnostic-v1" && digest(admission.nativeSha256) === runtime.sha256 && digest(admission.schemaSha256) === runtime.schemaSha256 && digest(admission.parentSha256) === runtime.parentRuntime.expectedSha256, "OFFLINE_DIAGNOSTIC_ADMISSION_MISMATCH");
+  const host = Object.freeze({ inspectParent: trustedSystem.inspectParent.bind(trustedSystem), spawn: trustedSystem.spawn.bind(trustedSystem), processGroup: trustedSystem.processGroup.bind(trustedSystem), signalGroup: trustedSystem.signalGroup.bind(trustedSystem), syncDirectory: trustedSystem.syncDirectory?.bind(trustedSystem) ?? syncDirectory });
+  const outerDeadline = Date.now() + 60000, executionDeadline = outerDeadline - 15000;
+  return Promise.resolve().then(async () => {
+    signal.throwIfAborted();
+    await directory(parentDirectory);
+    signal.throwIfAborted();
+    const root = await mkdtemp(join5(parentDirectory, "managed-offline-diagnostic-"));
+    await directory(root);
+    await syncDirectory(parentDirectory);
+    const stateRoot = join5(root, "state");
+    await mkdir4(stateRoot, { mode: 448 });
+    await syncDirectory(root);
+    const databasePath = join5(root, "account-leases.sqlite"), journalPath = join5(root, "diagnostic.jsonl"), receiptPath = join5(root, "receipt.json");
+    await durableFile(databasePath, "");
+    await durableFile(journalPath, "");
+    let acquiredJournal, acquiredDatabase, leases;
+    try {
+      acquiredJournal = await openPrivateWrite(journalPath, { create: false, exclusive: false, append: true });
+      acquiredDatabase = await openAccountDatabase(databasePath);
+      leases = new SqliteAccountLeases(acquiredDatabase);
+    } catch (error2) {
+      try {
+        acquiredDatabase?.close();
+      } finally {
+        await acquiredJournal?.close();
+      }
+      throw error2;
+    }
+    const journal = acquiredJournal, database = acquiredDatabase;
+    const custody = { database, journal, joins: new Set };
+    retainedOfflineDiagnostics.set(root, custody);
+    function retain(work) {
+      custody.joins.add(work);
+      work.then(() => custody.joins.delete(work), () => custody.joins.delete(work));
+      return work;
+    }
+    const diagnosticId = randomBytes(12).toString("hex"), accountId = `diagnostic-${diagnosticId}`, accountHome = join5(stateRoot, "accounts", accountId, "codex-home"), configuration = codexManagedAccountConfiguration();
+    const controller = new AbortController, interrupt = () => controller.abort();
+    signal.addEventListener("abort", interrupt, { once: true });
+    if (signal.aborted)
+      controller.abort();
+    const timer = setTimeout(interrupt, Math.max(0, executionDeadline - Date.now()));
+    let lease, bootstrap, core;
+    let protocol, bootstrapJoined = false, processJoined = false, protocolReceipt = null, sequence = 0, journalFailed = false;
+    const failures = new Set, error = (code) => {
+      if (failures.size < 16)
+        failures.add(code);
+    };
+    async function persist(event, detail) {
+      try {
+        check(++sequence <= 12, "OFFLINE_DIAGNOSTIC_JOURNAL_BOUND");
+        const line = JSON.stringify({ sequence, event, detail }) + `
+`;
+        check(Buffer.byteLength(line) <= 16 * 1024, "OFFLINE_DIAGNOSTIC_JOURNAL_BOUND");
+        await journal.writeFile(line);
+        await journal.sync();
+      } catch {
+        journalFailed = true;
+        throw Error("OFFLINE_DIAGNOSTIC_JOURNAL_FAILED");
+      }
+    }
+    const cleanupDeadline = () => Math.min(outerDeadline, Date.now() + 1e4);
+    function active() {
+      controller.signal.throwIfAborted();
+      check(Date.now() < executionDeadline, "OFFLINE_DIAGNOSTIC_DEADLINE");
+    }
+    let bootstrapCleanupDeadline;
+    async function joinBootstrap() {
+      if (!bootstrap)
+        return;
+      bootstrapCleanupDeadline ??= cleanupDeadline();
+      const stopped = await retain(bootstrap.stopAndJoin({ binding: bootstrap.binding, deadlineMs: bootstrapCleanupDeadline })), receipt2 = bootstrap.receipt();
+      bootstrapJoined = stopped.processExited && stopped.processGroupStopped && stopped.stdoutEnded && stopped.stderrEnded && JSON.stringify(stopped.binding) === JSON.stringify(bootstrap.binding) && receipt2.phase === "closed" && receipt2.lockReleased && !receipt2.scratchRetained;
+      check(bootstrapJoined, "OFFLINE_DIAGNOSTIC_BOOTSTRAP_UNJOINED");
+      if (receipt2.failures.length !== 0)
+        error("OFFLINE_DIAGNOSTIC_BOOTSTRAP_RUNTIME_FAILED");
+    }
+    try {
+      await persist("prepared", { nativeSha256: runtime.sha256, schemaSha256: runtime.schemaSha256, parentSha256: runtime.parentRuntime.expectedSha256, configurationSha256: hash(configuration), productionQualified: false, network: "denied" });
+      active();
+      const bootstrapBegan = Date.now();
+      lease = leases.acquire({ provider: "codex", accountId, owner: `bootstrap-${diagnosticId}`, now: bootstrapBegan, ttlMs: outerDeadline - bootstrapBegan });
+      bootstrap = createCodexAccountProcess({ stateRoot, mode: "offline", runtime, binding: { accountId, owner: lease.owner, leaseGeneration: lease.generation, processGeneration: 1 }, startupTimeoutMs: 1e4 }, host);
+      custody.bootstrap = bootstrap;
+      await bounded(bootstrap.ready, Math.min(executionDeadline, Date.now() + 1e4));
+      controller.signal.throwIfAborted();
+      await joinBootstrap();
+      check(failures.size === 0, "OFFLINE_DIAGNOSTIC_BOOTSTRAP_RUNTIME_FAILED");
+      await persist("bootstrap-joined", { process: bootstrap.receipt(), leaseGeneration: lease.generation });
+      check(!journalFailed && leases.release(lease), "OFFLINE_DIAGNOSTIC_BOOTSTRAP_RELEASE_FAILED");
+      lease = undefined;
+      active();
+      await fixedFile(join5(accountHome, "config.toml"), configuration);
+      await assertNoDiagnosticAuth(accountHome);
+      active();
+      const taskBegan = Date.now();
+      lease = leases.acquire({ provider: "codex", accountId, owner: `diagnostic-${diagnosticId}`, now: taskBegan, ttlMs: outerDeadline - taskBegan });
+      const admittedLease = lease, binding = Object.freeze({ kind: "offline-diagnostic", diagnosticId, accountId, accountLease: admittedLease });
+      await persist("diagnostic-admitted", { kind: binding.kind, accountId, leaseGeneration: lease.generation });
+      core = createOwnedCore({
+        stateRoot,
+        runtime,
+        host,
+        binding,
+        lease: admittedLease,
+        processGeneration: 2,
+        configuration,
+        runId: `diagnostic-${diagnosticId}`,
+        schema: "xcb.codex-managed-offline-process.v1",
+        originalSignal: controller.signal,
+        cancellationSignal: controller.signal,
+        startupMs: 1e4,
+        executionDeadline,
+        outerDeadline,
+        maxCleanupMs: 1e4,
+        authority() {
+          check(lease === admittedLease && JSON.stringify(leases.inspect("codex", accountId)) === JSON.stringify(admittedLease), "OFFLINE_DIAGNOSTIC_LEASE_CHANGED");
+        }
+      });
+      custody.core = core;
+      protocol = createManagedOfflineProtocol(core, accountHome, controller.signal, executionDeadline);
+      custody.protocol = protocol;
+      await protocol.result;
+      controller.signal.throwIfAborted();
+      await fixedFile(join5(accountHome, "config.toml"), configuration);
+      await assertNoDiagnosticAuth(accountHome);
+    } catch (caught) {
+      error(caught instanceof Error && /^(?:OFFLINE_DIAGNOSTIC|CODEX_MANAGED_PROCESS|CODEX_ACCOUNT_PROCESS)_[A-Z_]+$/u.test(caught.message) ? caught.message : controller.signal.aborted ? "OFFLINE_DIAGNOSTIC_CANCELLED" : "OFFLINE_DIAGNOSTIC_FAILED");
+    } finally {
+      protocol?.stop();
+      controller.abort();
+      clearTimeout(timer);
+      signal.removeEventListener("abort", interrupt);
+      try {
+        if (core) {
+          const stopped = await retain(core.stopAndJoin());
+          processJoined = stopped.phase === "closed" && stopped.rootExited && stopped.groupAbsent && stopped.stdioJoined && stopped.lockReleased && stopped.cleanupErrors.length === 0;
+          if (stopped.runtimeErrors.length !== 0)
+            error("OFFLINE_DIAGNOSTIC_PROCESS_RUNTIME_FAILED");
+          check(processJoined, "OFFLINE_DIAGNOSTIC_PROCESS_UNJOINED");
+          await persist("diagnostic-process-joined", { process: stopped });
+        } else
+          await joinBootstrap();
+      } catch {
+        error("OFFLINE_DIAGNOSTIC_PROCESS_UNJOINED");
+      }
+      try {
+        if (protocol) {
+          protocolReceipt = await bounded(retain(protocol.join()), cleanupDeadline());
+          check(protocolReceipt.joined, "OFFLINE_DIAGNOSTIC_PROTOCOL_UNJOINED");
+          if (protocolReceipt.failure)
+            error(protocolReceipt.failure);
+        }
+      } catch {
+        error("OFFLINE_DIAGNOSTIC_PROTOCOL_UNJOINED");
+        protocolReceipt = protocol?.receipt() ?? null;
+      }
+      try {
+        if (lease && !journalFailed && (core ? processJoined && protocolReceipt?.joined === true : bootstrapJoined)) {
+          await persist("lease-release", { owner: core ? "diagnostic" : "bootstrap", generation: lease.generation });
+          check(leases.release(lease), "OFFLINE_DIAGNOSTIC_RELEASE_FAILED");
+          lease = undefined;
+        }
+      } catch {
+        error("OFFLINE_DIAGNOSTIC_RELEASE_FAILED");
+      }
+    }
+    const leaseReleased = lease === undefined && leases.inspect("codex", accountId) === null;
+    const receipt = Object.freeze({
+      schema: "xcb.codex-managed-offline-diagnostic.v1",
+      passed: failures.size === 0 && bootstrapJoined && processJoined && leaseReleased && protocolReceipt?.configurationObserved === true,
+      productionQualified: false,
+      network: "denied",
+      root,
+      receiptPath,
+      configurationSha256: hash(configuration),
+      nativeSha256: runtime.sha256,
+      schemaSha256: runtime.schemaSha256,
+      parentSha256: runtime.parentRuntime.expectedSha256,
+      bootstrapJoined,
+      processJoined,
+      leaseReleased,
+      protocol: protocolReceipt,
+      failures: Object.freeze([...failures])
+    });
+    try {
+      await persist("finished", receipt);
+    } finally {
+      if (leaseReleased && (!bootstrap || bootstrapJoined) && (!core || processJoined) && (!protocol || protocolReceipt?.joined === true) && custody.joins.size === 0) {
+        await journal.close();
+        database.close();
+        retainedOfflineDiagnostics.delete(root);
+      }
+    }
+    await durableFile(receiptPath, JSON.stringify(receipt) + `
+`);
+    return receipt;
+  });
+}
+
+// src/cli/qualification.ts
+import { lstat as lstat4, rename } from "node:fs/promises";
+import { createHash as createHash3 } from "node:crypto";
+import { join as join6 } from "node:path";
+var MAX_QUALIFICATION_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+var RECORD_VERSION = "xcb.cli-qualification.v1";
+var fail4 = (code) => {
+  throw new Error(code);
+};
+var digest2 = (value) => typeof value === "string" && /^[a-f0-9]{64}$/u.test(value) ? value : fail4("QUALIFICATION_DIGEST_INVALID");
+function recordPath(root, provider) {
+  return join6(root, `qualification-${identifier(provider)}.json`);
+}
+function parseRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    fail4("QUALIFICATION_RECORD_INVALID");
+  const raw = value;
+  if (Reflect.ownKeys(raw).sort().join(",") !== "admittedAtUnixMs,authentication,evidenceDigest,executablePath,executableSha256,expiresAtUnixMs,profileDigest,provider,routeId,runtimeDigest,runtimeVersion,version") {
+    fail4("QUALIFICATION_RECORD_INVALID");
+  }
+  const record2 = Object.freeze({
+    version: RECORD_VERSION,
+    provider: boundedText(raw.provider, 32),
+    routeId: identifier(raw.routeId),
+    authentication: boundedText(raw.authentication, 32),
+    executablePath: boundedText(raw.executablePath, 4096),
+    executableSha256: digest2(raw.executableSha256),
+    runtimeVersion: boundedText(raw.runtimeVersion, 160),
+    runtimeDigest: digest2(raw.runtimeDigest),
+    profileDigest: digest2(raw.profileDigest),
+    evidenceDigest: digest2(raw.evidenceDigest),
+    admittedAtUnixMs: safeInteger(raw.admittedAtUnixMs, 0, Number.MAX_SAFE_INTEGER),
+    expiresAtUnixMs: safeInteger(raw.expiresAtUnixMs, 0, Number.MAX_SAFE_INTEGER)
+  });
+  if (raw.version !== RECORD_VERSION || record2.expiresAtUnixMs <= record2.admittedAtUnixMs)
+    fail4("QUALIFICATION_RECORD_INVALID");
+  return record2;
+}
+async function readCliQualification(stateRoot, provider) {
+  const root = await privateDirectory(stateRoot);
+  const path2 = recordPath(root, provider);
+  try {
+    const stat = await lstat4(path2);
+    assertPrivateStat(stat, {
+      kind: "file",
+      noSymlink: true,
+      owner: "self",
+      mode: [{ mask: 63, equals: 0 }],
+      size: { max: 8192 }
+    }, "QUALIFICATION_RECORD_INVALID");
+    const handle = await openPrivateRead(path2, { nonblock: false });
+    try {
+      const text = await handle.readFile("utf8");
+      const record2 = parseRecord(JSON.parse(text));
+      if (record2.provider !== provider || record2.expiresAtUnixMs <= Date.now())
+        return null;
+      return record2;
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    if (error instanceof Error && error.message === "QUALIFICATION_RECORD_INVALID")
+      return null;
+    throw error;
+  }
+}
+async function writeCliQualification(stateRoot, record2) {
+  const root = await privateDirectory(stateRoot);
+  const parsed = parseRecord(JSON.parse(JSON.stringify(record2)));
+  const path2 = recordPath(root, parsed.provider);
+  const temp = `${path2}.tmp-${process.pid}`;
+  await writeFileOnce(temp, JSON.stringify(parsed, null, 2) + `
+`, { exclusive: false, truncate: true, syncFile: true });
+  await rename(temp, path2);
+  return parsed;
+}
+function toTaskQualification(record2, expected) {
+  if (record2.provider === "devin" || expected.route.provider === "devin") {
+    return Object.freeze({ status: "unqualified", reason: "Devin host qualification is not implemented; legacy binary-only admission is insufficient." });
+  }
+  if (record2.provider !== expected.route.provider || record2.routeId !== expected.route.id || record2.authentication !== expected.route.authentication || record2.profileDigest !== expected.profile.digest || record2.runtimeVersion !== expected.runtimeVersion || record2.runtimeDigest !== expected.runtimeDigest || record2.expiresAtUnixMs <= Date.now()) {
+    return Object.freeze({ status: "unqualified", reason: "Local admission record does not match this route, runtime and profile." });
+  }
+  return Object.freeze({
+    status: "qualified",
+    route: Object.freeze({ ...expected.route }),
+    profile: Object.freeze({ id: expected.profile.id, version: expected.profile.version, digest: expected.profile.digest }),
+    runtimeVersion: record2.runtimeVersion,
+    runtimeDigest: record2.runtimeDigest,
+    evidenceDigest: record2.evidenceDigest,
+    expiresAt: record2.expiresAtUnixMs,
+    controls: Object.freeze({
+      noCommandTools: true,
+      exactToolInventory: true,
+      workspaceReadIsolation: true,
+      workspaceWriteIsolation: true,
+      isolatedConfiguration: true,
+      authOutsideWorkspace: true,
+      hostBrokerOnly: true
+    })
+  });
+}
+function buildQualificationRecord(input) {
+  const admittedAtUnixMs = safeInteger(input.now, 0, Number.MAX_SAFE_INTEGER);
+  const record2 = Object.freeze({
+    version: RECORD_VERSION,
+    provider: boundedText(input.provider, 32),
+    routeId: identifier(input.route.id),
+    authentication: boundedText(input.route.authentication, 32),
+    executablePath: boundedText(input.executablePath, 4096),
+    executableSha256: digest2(input.executableSha256),
+    runtimeVersion: boundedText(input.runtimeVersion, 160),
+    runtimeDigest: digest2(input.runtimeDigest),
+    profileDigest: digest2(input.profileDigest),
+    evidenceDigest: "",
+    admittedAtUnixMs,
+    expiresAtUnixMs: admittedAtUnixMs + MAX_QUALIFICATION_AGE_MS
+  });
+  const evidenceDigest = input.evidenceDigest === undefined ? createHash3("sha256").update(JSON.stringify({ ...record2, evidenceDigest: "" })).digest("hex") : digest2(input.evidenceDigest);
+  return Object.freeze({ ...record2, evidenceDigest });
+}
+
+// src/cli/codex.ts
+var CLI_CODEX_SCHEMA_SHA256 = "ffb75cdcfe84e2a417ad481e7998a924db9f9cb9b4bea065b0067acbb5886748";
+var CLI_CODEX_SCHEMA_FILES = 416;
+var CLI_CODEX_SCHEMA_BYTES = 4137012;
+var CLI_CODEX_BUN_DARWIN_ARM64_SHA256 = "e0c90ec15d33363e6b70713d56bc3b2c7585c17f40a0fe0f8fd9305901d4e233";
+var CLI_CODEX_RUNTIME_VERSION = `codex-app-server:${CODEX_NATIVE_VERSION}:managed-task:v2`;
+function cliCodexHostDiagnostic() {
+  if (typeof Bun === "undefined" || Bun.version !== "1.3.14") {
+    return "Codex managed mode requires Bun 1.3.14. Launch xcb-compat with Bun 1.3.14, then run `xcb-compat doctor`; Node cannot run this qualified route.";
+  }
+  if (process.platform !== "darwin" || process.arch !== "arm64") {
+    return "Codex managed mode requires macOS arm64; this host has no qualified Codex sandbox.";
+  }
+  return null;
+}
+function assertCliCodexHost() {
+  if (typeof Bun === "undefined" || Bun.version !== "1.3.14")
+    throw new Error(`CLI_CODEX_BUN_REQUIRED: ${cliCodexHostDiagnostic()}`);
+  if (process.platform !== "darwin" || process.arch !== "arm64")
+    throw new Error(`CLI_CODEX_HOST_UNSUPPORTED: ${cliCodexHostDiagnostic()}`);
+}
+var hash2 = (value) => createHash4("sha256").update(value).digest("hex");
+function cliCodexRuntimeIdentity(input) {
+  const digest3 = hash2(JSON.stringify({ version: CLI_CODEX_RUNTIME_VERSION, ...input }));
+  return Object.freeze({ version: CLI_CODEX_RUNTIME_VERSION, digest: digest3 });
+}
+async function schemaBundleDigest(root) {
+  const paths = [];
+  async function visit(directory2, relative2) {
+    const iterator = await opendir2(directory2);
+    try {
+      for (;; ) {
+        const entry = await iterator.read();
+        if (entry === null)
+          break;
+        const child = relative2 === "" ? entry.name : `${relative2}/${entry.name}`;
+        if (entry.isDirectory())
+          await visit(join7(directory2, entry.name), child);
+        else if (entry.isFile() && /^[A-Za-z0-9._/-]{1,512}$/u.test(child))
+          paths.push(child);
+        else
+          throw new Error("CLI_CODEX_SCHEMA_ENTRY_INVALID");
+        if (paths.length > 1024)
+          throw new Error("CLI_CODEX_SCHEMA_FILES_INVALID");
+      }
+    } finally {
+      await iterator.close();
+    }
+  }
+  await visit(root, "");
+  const digest3 = createHash4("sha256");
+  let bytes = 0;
+  for (const relative2 of paths.sort()) {
+    const contents = await readFile2(join7(root, relative2));
+    bytes += contents.length;
+    if (bytes > 16 * 1024 * 1024)
+      throw new Error("CLI_CODEX_SCHEMA_BYTES_INVALID");
+    digest3.update(relative2).update("\x00").update(String(contents.length)).update("\x00").update(contents);
+  }
+  return { sha256: digest3.digest("hex"), files: paths.length, bytes };
+}
+async function qualifyCliCodexRuntime(input) {
+  assertCliCodexHost();
+  if (input.inspection.provider !== "codex" || input.inspection.version !== CODEX_NATIVE_VERSION || input.inspection.sha256 !== CODEX_NATIVE_SHA256 || !input.inspection.versionMatches || !input.inspection.digestMatches) {
+    throw new Error("CLI_CODEX_RUNTIME_UNADMITTED");
+  }
+  const stateRoot = await privateDirectory(input.stateRoot), executablePath = await realpath3(input.inspection.executablePath);
+  await inspectCodexHostExecutable(executablePath, CODEX_NATIVE_SHA256);
+  const parent = await inspectCodexHostRuntime({ expectedSha256: CLI_CODEX_BUN_DARWIN_ARM64_SHA256 });
+  const temporary = await realpath3(await mkdtemp2(join7(stateRoot, "codex-qualification-")));
+  let cleanup = true;
+  try {
+    const scratch = join7(temporary, "schema-scratch"), accountHome = join7(temporary, "schema-account"), schemaDirectory = join7(scratch, "schema");
+    await mkdir5(scratch, { mode: 448 });
+    await mkdir5(accountHome, { mode: 448 });
+    await mkdir5(schemaDirectory, { mode: 448 });
+    const profile = codexManagedOfflineSandbox({ executable: executablePath, scratch, accountHome });
+    const generated = Bun.spawn(["/usr/bin/sandbox-exec", "-p", profile, executablePath, "app-server", "generate-json-schema", "--experimental", "--out", schemaDirectory], {
+      cwd: scratch,
+      env: { PATH: "/usr/bin:/bin", HOME: scratch, TMPDIR: scratch, NO_COLOR: "1" },
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: 30000
+    });
+    const [code, stdout, stderr] = await Promise.all([generated.exited, new Response(generated.stdout).arrayBuffer(), new Response(generated.stderr).arrayBuffer()]);
+    if (code !== 0 || stdout.byteLength > 64 * 1024 || stderr.byteLength > 64 * 1024)
+      throw new Error("CLI_CODEX_SCHEMA_GENERATION_FAILED");
+    const schema = await schemaBundleDigest(schemaDirectory);
+    if (schema.sha256 !== CLI_CODEX_SCHEMA_SHA256 || schema.files !== CLI_CODEX_SCHEMA_FILES || schema.bytes !== CLI_CODEX_SCHEMA_BYTES) {
+      throw new Error("CLI_CODEX_SCHEMA_MISMATCH");
+    }
+    const manifest = buildCodexProtocolManifest({
+      protocolVersion: "v2-experimental",
+      sourceVersion: CODEX_NATIVE_VERSION,
+      executableSha256: CODEX_NATIVE_SHA256,
+      schemaSha256: schema.sha256,
+      generatedAtUnixMs: (input.now ?? Date.now)()
+    });
+    assertCodexProtocolManifest(manifest, { version: CODEX_NATIVE_VERSION, sha256: CODEX_NATIVE_SHA256, schemaSha256: schema.sha256 });
+    const controller = new AbortController, timer = setTimeout(() => controller.abort(), 60000);
+    let diagnostic;
+    try {
+      diagnostic = await runCodexManagedOfflineDiagnostic({
+        directory: temporary,
+        runtime: {
+          executablePath,
+          version: CODEX_NATIVE_VERSION,
+          sha256: CODEX_NATIVE_SHA256,
+          schemaSha256: schema.sha256,
+          parentRuntime: { expectedSha256: parent.sha256 }
+        },
+        signal: controller.signal,
+        admission: {
+          kind: "managed-offline-lifecycle-diagnostic-v1",
+          nativeSha256: CODEX_NATIVE_SHA256,
+          schemaSha256: schema.sha256,
+          parentSha256: parent.sha256
+        }
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    const protocol = diagnostic.protocol;
+    cleanup = diagnostic.bootstrapJoined && diagnostic.processJoined && diagnostic.leaseReleased && protocol?.joined === true;
+    if (!diagnostic.passed || !cleanup || protocol === null || protocol.failure !== null || protocol.configurationObserved !== true || JSON.stringify(protocol.methods) !== JSON.stringify(["initialize", "initialized", "config/read"]) || protocol.disabledNotices !== 1)
+      throw new Error("CLI_CODEX_OFFLINE_DIAGNOSTIC_FAILED");
+    const runtime = cliCodexRuntimeIdentity({
+      nativeSha256: CODEX_NATIVE_SHA256,
+      schemaSha256: schema.sha256,
+      parentSha256: parent.sha256
+    });
+    const content = Object.freeze({
+      schema: "xcb.cli-codex-admission.v1",
+      platform: "darwin-arm64",
+      runtime,
+      manifest,
+      nativeSha256: CODEX_NATIVE_SHA256,
+      schemaSha256: schema.sha256,
+      parentSha256: parent.sha256,
+      configurationSha256: diagnostic.configurationSha256,
+      offline: Object.freeze({
+        passed: true,
+        network: "denied",
+        bootstrapJoined: true,
+        processJoined: true,
+        leaseReleased: true,
+        methods: Object.freeze(["initialize", "initialized", "config/read"]),
+        configurationObserved: true,
+        disabledNotices: 1,
+        frameCount: protocol.frameCount
+      }),
+      productionQualified: false
+    });
+    return Object.freeze({ ...content, evidenceDigest: hash2(JSON.stringify(content)) });
+  } finally {
+    if (cleanup)
+      await rm3(temporary, { recursive: true, force: true });
+  }
+}
+function currentCodexIdentity() {
+  return cliCodexRuntimeIdentity({
+    nativeSha256: CODEX_NATIVE_SHA256,
+    schemaSha256: CLI_CODEX_SCHEMA_SHA256,
+    parentSha256: CLI_CODEX_BUN_DARWIN_ARM64_SHA256
+  });
+}
+async function admittedCodex(stateRoot, inspection) {
+  assertCliCodexHost();
+  if (process.platform !== "darwin" || process.arch !== "arm64" || inspection.provider !== "codex" || inspection.version !== CODEX_NATIVE_VERSION || inspection.sha256 !== CODEX_NATIVE_SHA256 || !inspection.versionMatches || !inspection.digestMatches)
+    throw new Error("CLI_CODEX_RUNTIME_UNADMITTED");
+  const expected = currentCodexIdentity(), record2 = await readCliQualification(stateRoot, "codex");
+  if (record2 === null || record2.executablePath !== inspection.executablePath || record2.executableSha256 !== CODEX_NATIVE_SHA256 || record2.runtimeVersion !== expected.version || record2.runtimeDigest !== expected.digest)
+    throw new Error("CLI_CODEX_RUNTIME_UNADMITTED");
+  return expected;
+}
+function createCliCodexManagedLauncher(stateRoot, inspection, runtime = currentCodexIdentity()) {
+  assertCliCodexHost();
+  return createCodexManagedProcessLauncher({
+    stateRoot,
+    runtime: {
+      executablePath: inspection.executablePath,
+      version: CODEX_NATIVE_VERSION,
+      sha256: CODEX_NATIVE_SHA256,
+      schemaSha256: CLI_CODEX_SCHEMA_SHA256,
+      parentRuntime: { expectedSha256: CLI_CODEX_BUN_DARWIN_ARM64_SHA256 }
+    },
+    admission: {
+      profile: "managed-task-provider-tcp443-dns-candidate-v2",
+      taskRuntimeVersion: runtime.version,
+      taskRuntimeDigest: runtime.digest,
+      nativeSha256: CODEX_NATIVE_SHA256,
+      schemaSha256: CLI_CODEX_SCHEMA_SHA256,
+      parentSha256: CLI_CODEX_BUN_DARWIN_ARM64_SHA256
+    }
+  });
+}
+async function withCodexAccount(stateRoot, inspection, action) {
+  await admittedCodex(stateRoot, inspection);
+  const root = await privateDirectory(stateRoot), database = await openAccountDatabase(join7(root, "account-leases.sqlite"));
+  const leases = new SqliteAccountLeases(database), owner = `cli-codex-${randomBytes2(10).toString("hex")}`;
+  const runtime = {
+    executablePath: inspection.executablePath,
+    version: CODEX_NATIVE_VERSION,
+    sha256: CODEX_NATIVE_SHA256,
+    schemaSha256: CLI_CODEX_SCHEMA_SHA256,
+    parentRuntime: { expectedSha256: CLI_CODEX_BUN_DARWIN_ARM64_SHA256 }
+  };
+  const controller = createManagedCodexAccountController({
+    accountId: "local",
+    owner,
+    processGeneration: Date.now(),
+    leases,
+    transportFactory(binding, onEvent) {
+      const processPort = createCodexAccountProcess({
+        binding,
+        stateRoot: root,
+        runtime,
+        mode: "device-code",
+        deviceCodeAdmission: {
+          profile: "codex-account-device-code-tcp443-dns-v3",
+          nativeSha256: CODEX_NATIVE_SHA256,
+          schemaSha256: CLI_CODEX_SCHEMA_SHA256,
+          parentSha256: CLI_CODEX_BUN_DARWIN_ARM64_SHA256
+        }
+      });
+      return createCodexAccountStdioTransport({ binding, process: processPort, onEvent, initializeTimeoutMs: 20000, closeTimeoutMs: 20000 });
+    },
+    operationTimeoutMs: 30000,
+    closeTimeoutMs: 20000
+  });
+  try {
+    return await action(controller);
+  } finally {
+    let released = false;
+    try {
+      released = (await controller.close()).released;
+    } finally {
+      database.close();
+    }
+    if (!released)
+      throw new Error("CLI_CODEX_ACCOUNT_CLOSE_UNPROVEN");
+  }
+}
+async function codexAuthStatus(stateRoot, inspection) {
+  try {
+    const snapshot = await withCodexAccount(stateRoot, inspection, (controller) => controller.check());
+    return Object.freeze({
+      admitted: true,
+      loggedIn: snapshot.state === "signed-in",
+      planType: snapshot.planType ?? null,
+      models: Object.freeze(snapshot.models.map((model) => model.id))
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message === "CLI_CODEX_RUNTIME_UNADMITTED") {
+      return Object.freeze({ admitted: false, loggedIn: false, planType: null, models: Object.freeze([]) });
+    }
+    throw error;
+  }
+}
+async function codexLogin(stateRoot, inspection, onChallenge, signal) {
+  return await withCodexAccount(stateRoot, inspection, async (controller) => {
+    let snapshot = await controller.check(signal);
+    if (snapshot.state === "signed-in")
+      return snapshot;
+    const challenge = await controller.startLogin("chatgptDeviceCode", signal);
+    onChallenge(challenge);
+    const deadline = Date.now() + 10 * 60 * 1000;
+    while (Date.now() < deadline && !signal?.aborted) {
+      await Bun.sleep(1500);
+      try {
+        snapshot = await controller.check(signal);
+      } catch {
+        if (controller.snapshot().state !== "unchecked")
+          throw new Error("CLI_CODEX_LOGIN_FAILED");
+        continue;
+      }
+      if (snapshot.state === "signed-in")
+        return snapshot;
+      if (snapshot.state === "recovery-required" || snapshot.state === "unavailable")
+        throw new Error("CLI_CODEX_LOGIN_FAILED");
+    }
+    await controller.cancelLogin(challenge.loginId).catch(() => {});
+    throw new Error(signal?.aborted ? "CLI_CODEX_LOGIN_ABORTED" : "CLI_CODEX_LOGIN_TIMEOUT");
+  });
+}
+async function codexLogout(stateRoot, inspection) {
+  await withCodexAccount(stateRoot, inspection, async (controller) => {
+    await controller.logout();
+  });
+}
+
+// src/cli/sandbox.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { createHash as createHash5 } from "node:crypto";
+import { writeFileSync, mkdirSync, openSync, closeSync as closeSync2, readSync, writeSync as writeSync2, fstatSync, lstatSync, realpathSync, rmSync, constants as constants2 } from "node:fs";
+import { access, lstat as lstat5, mkdir as mkdir6, readFile as readFile3, realpath as realpath4 } from "node:fs/promises";
+import { dirname, isAbsolute as isAbsolute3, join as join8 } from "node:path";
+import { fileURLToPath } from "node:url";
+var fail5 = (code) => {
+  throw new Error(code);
+};
+function path2(value) {
+  return canonicalizePrivatePath(value, { code: "CLI_SANDBOX_PATH_INVALID" });
+}
+function claudeCliSandboxPolicy(input) {
+  const executable = path2(input.executable), scratch = path2(input.scratch), accountHome = path2(input.accountHome);
+  const inside = (inner, outer) => inner === outer || inner.startsWith(outer + "/");
+  if (inside(executable, scratch) || inside(executable, accountHome) || inside(scratch, accountHome) || inside(accountHome, scratch)) {
+    fail5("CLI_SANDBOX_LAYOUT_INVALID");
+  }
+  const uid = process.getuid?.();
+  if (typeof uid !== "number" || !Number.isSafeInteger(uid) || uid < 0)
+    fail5("CLI_SANDBOX_UID_INVALID");
+  const claudeTmp = `/private/tmp/claude-${uid}`;
+  const q = JSON.stringify;
+  return `(version 1)
+(deny default)
+(allow process-exec (literal ${q(executable)}))
+(allow process-fork)
+(allow process-info* (target self))
+(allow signal (target self))
+(allow sysctl-read)
+(allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo"))
+(allow file-ioctl (literal "/dev/null") (subpath "/dev/fd"))
+(allow file-read* file-write* (literal "/dev/null") (literal "/dev/urandom") (literal "/dev/random") (literal "/dev/dtracehelper") (subpath "/dev/fd"))
+(allow file-read* (literal "/") (literal "/tmp") (literal "/etc") (literal "/var") (literal "/Library") (literal "/private/etc") (literal "/private/tmp") (literal "/private/var")
+  (literal ${q(executable)})
+  (subpath "/System") (subpath "/usr") (subpath "/Library/Preferences") (subpath "/Library/Apple") (subpath "/etc") (subpath "/private/etc") (subpath "/var/db/timezone") (subpath "/private/var/db/timezone"))
+(allow file-map-executable (literal ${q(executable)}) (subpath "/System") (subpath "/usr"))
+(allow file-read* file-write* (subpath ${q(scratch)}) (subpath ${q(accountHome)}) (subpath ${q(claudeTmp)}))
+(allow file-read-metadata (path-ancestors ${q(executable)}) (path-ancestors ${q(scratch)}) (path-ancestors ${q(accountHome)}) (path-ancestors ${q(claudeTmp)}))
+(allow network-outbound (literal "/private/var/run/mDNSResponder") (literal "/private/var/run/syslog") (remote tcp "*:443"))
+`;
+}
+var SEATBELT = "/usr/bin/sandbox-exec";
+var BWRAP_CANDIDATES = ["/usr/bin/bwrap", "/bin/bwrap", "/usr/local/bin/bwrap"];
+var FORWARDER_PORT = 48123;
+function lddClosure(executable) {
+  const result = spawnSync4("ldd", [executable], { encoding: "utf8", timeout: 15000 });
+  const paths = new Set;
+  if (result.status === 0 && typeof result.stdout === "string") {
+    for (const match of result.stdout.matchAll(/(?:=>\s*)?(\/[A-Za-z0-9._\/+:-]+)/g)) {
+      if (isAbsolute3(match[1]))
+        paths.add(match[1]);
+    }
+  }
+  return [...paths].sort();
+}
+async function prepareCliLinuxSandbox(input) {
+  const bridgeDirectory = path2(input.bridgeDirectory);
+  await mkdir6(bridgeDirectory, { mode: 448, recursive: true });
+  let bwrap;
+  for (const candidate of BWRAP_CANDIDATES) {
+    if (await access(candidate, constants2.X_OK).then(() => true, () => false)) {
+      bwrap = await realpath4(candidate);
+      break;
+    }
+  }
+  const wrapper = bwrap ?? fail5("CLI_SANDBOX_BWRAP_MISSING");
+  const bwrapSha256 = createHash5("sha256").update(await readFile3(wrapper)).digest("hex");
+  await verifyOsSandboxExecutable(wrapper, bwrapSha256, 8n * 1024n * 1024n);
+  const runtime = await realpath4(process.execPath);
+  let script;
+  for (const rel of ["../../sandbox/loopback-forwarder.cjs", "../sandbox/loopback-forwarder.cjs"]) {
+    const candidate = fileURLToPath(new URL(rel, import.meta.url));
+    if (await lstat5(candidate).then((meta) => meta.isFile(), () => false)) {
+      script = await realpath4(candidate);
+      break;
+    }
+  }
+  const forwarderScript = script ?? fail5("CLI_SANDBOX_FORWARDER_MISSING");
+  const runtimeLibs = lddClosure(runtime);
+  const socketPath = join8(bridgeDirectory, `egress-${process.pid}-${createHash5("sha256").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 12)}.sock`);
+  const bridge = await createEgressBridge({ socketPath, dialer: egressBridgeDialer });
+  return Object.freeze({
+    socketPath,
+    plan({ executable: exe, scratch, accountHome, policyPath }) {
+      const readOnlyPaths = [...new Set([...runtimeLibs, ...lddClosure(exe)])].sort();
+      return planBwrapPolicy({
+        platform: "linux",
+        executable: exe,
+        scratch,
+        accountHome,
+        readOnlyPaths,
+        network: "provider-tcp443-dns",
+        egressSocket: socketPath,
+        egressForward: {
+          runtime,
+          script: forwarderScript,
+          port: FORWARDER_PORT,
+          envFile: join8(scratch, "forwarder.env")
+        },
+        policyPath
+      }, wrapper);
+    },
+    close: () => bridge.close()
+  });
+}
+function claudeCliProcessFactory(accountHome, linux, platform = process.platform) {
+  if (platform === "darwin") {
+    const home = path2(accountHome);
+    return (input) => {
+      const executable = path2(input.executable);
+      const runRoot = dirname(executable);
+      const scratch = join8(runRoot, "scratch");
+      const policyPath = join8(runRoot, "sandbox.sb");
+      const plan = planSeatbeltPolicy({ platform: "darwin", executable, scratch, accountHome: home, network: "provider-tcp443-dns", policyPath }, claudeCliSandboxPolicy({ executable, scratch, accountHome: home }));
+      writeFileSync(policyPath, plan.policy, { mode: 256, flag: "w" });
+      return createSandboxedProviderProcessFactory(plan)(input);
+    };
+  }
+  if (platform === "linux" && linux !== undefined) {
+    const home = path2(accountHome);
+    return (input) => {
+      const executable = path2(input.executable);
+      const runRoot = dirname(executable);
+      const scratch = join8(runRoot, "scratch");
+      mkdirSync(scratch, { mode: 448, recursive: true });
+      const policyPath = join8(runRoot, "sandbox.json");
+      const plan = linux.plan({ executable, scratch, accountHome: home, policyPath });
+      writeFileSync(policyPath, plan.policy, { mode: 256, flag: "w" });
+      const env = Object.freeze({ PATH: "/usr/bin:/bin", HOME: scratch, TMPDIR: scratch, ...input.env });
+      return createSandboxedProviderProcessFactory(plan)({ ...input, env });
+    };
+  }
+  return;
+}
+async function seatbeltAvailable() {
+  if (process.platform !== "darwin")
+    return false;
+  try {
+    await access(SEATBELT, constants2.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/cli/provider.ts
+import { join as join9 } from "node:path";
+var CLI_CLAUDE_ROUTE = "claude-subscription";
+var CLI_CODEX_ROUTE = "codex-subscription";
+var CLI_CLAUDE_DEFAULT_MODEL = "claude-sonnet-4-5";
+var CLI_CODEX_DEFAULT_MODEL = "gpt-5.1-codex-mini";
+var CLI_DEVIN_DEFAULT_MODEL = "adaptive";
+var CLI_SYSTEM_PROMPT = [
+  "You are xcb, a coding assistant running inside the user's terminal.",
+  "The workspace tools address files inside the opened project directory only; there is no shell, process or arbitrary-path access.",
+  "Use workspace.list and workspace.search before workspace.read; keep each file's revision and pass it back as expectedRevision to workspace.write.",
+  "Answer directly and concisely. Never claim an action you did not perform through the tools."
+].join(" ");
+async function admitCliProvider(stateRoot, provider, profile) {
+  const inspection = await inspectCliBinary(provider, undefined, true);
+  if (inspection === null) {
+    return Object.freeze({ inspection, record: null, detail: `${provider} binary not found` });
+  }
+  if (!inspection.versionMatches) {
+    const required = provider === "codex" ? CODEX_NATIVE_VERSION : provider === "devin" ? CLI_DEVIN_MIN_VERSION : CLAUDE_CODE_MIN_VERSION;
+    const comparator = provider === "codex" ? `pinned ${required}` : `>= ${required}`;
+    const hint = provider === "claude" ? ` — install with \`bun add -g @anthropic-ai/claude-code@2\`` : provider === "devin" ? ` — upgrade the devin CLI to ${required} or newer` : "";
+    return Object.freeze({ inspection, record: null, detail: `${provider} ${inspection.version} found; ${comparator} required${hint}` });
+  }
+  if (provider === "devin") {
+    return Object.freeze({ inspection, record: null, detail: CLI_DEVIN_QUALIFICATION_REQUIRED });
+  }
+  if (provider === "codex") {
+    let evidence;
+    try {
+      evidence = await qualifyCliCodexRuntime({ stateRoot, inspection });
+    } catch (error) {
+      const code = error instanceof Error && /^CLI_CODEX_[A-Z_]+$/u.test(error.message) ? error.message : "CLI_CODEX_QUALIFICATION_FAILED";
+      return Object.freeze({ inspection, record: null, detail: cliCodexHostDiagnostic() ?? `codex managed admission failed: ${code}` });
+    }
+    const record3 = await writeCliQualification(await privateDirectory(stateRoot), buildQualificationRecord({
+      provider,
+      route: Object.freeze({ id: CLI_CODEX_ROUTE, provider: "codex", authentication: "subscription" }),
+      executablePath: inspection.executablePath,
+      executableSha256: inspection.sha256,
+      runtimeVersion: evidence.runtime.version,
+      runtimeDigest: evidence.runtime.digest,
+      profileDigest: profile.digest,
+      evidenceDigest: evidence.evidenceDigest,
+      now: Date.now()
+    }));
+    return Object.freeze({ inspection, record: record3, detail: `admitted ${provider} ${inspection.version}` });
+  }
+  const identity = claudeTaskRuntimeIdentity({ executableSha256: inspection.sha256, cliVersion: inspection.version, authentication: "subscription" });
+  const record2 = await writeCliQualification(await privateDirectory(stateRoot), buildQualificationRecord({
+    provider,
+    route: Object.freeze({ id: CLI_CLAUDE_ROUTE, provider: "claude", authentication: "subscription" }),
+    executablePath: inspection.executablePath,
+    executableSha256: inspection.sha256,
+    runtimeVersion: identity.version,
+    runtimeDigest: identity.digest,
+    profileDigest: profile.digest,
+    now: Date.now()
+  }));
+  return Object.freeze({ inspection, record: record2, detail: `admitted ${provider} ${inspection.version}` });
+}
+async function openCliProvider(stateRoot, provider, profile, events, _context) {
+  const inspection = await inspectCliBinary(provider);
+  if (inspection === null)
+    return Object.freeze({ status: "binary-missing", inspection });
+  if (!inspection.versionMatches)
+    return Object.freeze({ status: "version-mismatch", inspection });
+  if (provider === "devin")
+    return Object.freeze({ status: "unadmitted", inspection, detail: CLI_DEVIN_QUALIFICATION_REQUIRED });
+  if (provider === "codex") {
+    const detail = cliCodexHostDiagnostic();
+    if (detail !== null)
+      return Object.freeze({ status: "sandbox-unavailable", inspection, detail });
+  }
+  const record2 = await readCliQualification(stateRoot, provider);
+  if (record2 === null || record2.executableSha256 !== inspection.sha256 || record2.executablePath !== inspection.executablePath) {
+    return Object.freeze({ status: "unadmitted", inspection });
+  }
+  if (provider === "codex") {
+    if (process.platform !== "darwin" || process.arch !== "arm64")
+      return Object.freeze({ status: "sandbox-unavailable", inspection });
+    const route = Object.freeze({ id: CLI_CODEX_ROUTE, provider: "codex", authentication: "subscription" });
+    const identity = cliCodexRuntimeIdentity({
+      nativeSha256: inspection.sha256,
+      schemaSha256: CLI_CODEX_SCHEMA_SHA256,
+      parentSha256: CLI_CODEX_BUN_DARWIN_ARM64_SHA256
+    });
+    const qualification = toTaskQualification(record2, { route, profile, runtimeVersion: identity.version, runtimeDigest: identity.digest });
+    if (qualification.status !== "qualified")
+      return Object.freeze({ status: "unadmitted", inspection });
+    const adapter = createCodexManagedTaskAdapter({
+      route,
+      runtime: identity,
+      qualification,
+      instructions: Object.freeze({ base: CLI_SYSTEM_PROMPT, developer: "" }),
+      launcher: createCliCodexManagedLauncher(stateRoot, inspection, identity),
+      now: Date.now
+    });
+    return Object.freeze({ status: "ready", adapter, inspection, record: record2 });
+  }
+  if (provider === "claude") {
+    const { config } = await providerAuthDirs(stateRoot, "claude");
+    const route = Object.freeze({ id: CLI_CLAUDE_ROUTE, provider: "claude", authentication: "subscription" });
+    const runtime = Object.freeze({ executablePath: inspection.executablePath, executableSha256: inspection.sha256, cliVersion: inspection.version });
+    const identity = claudeTaskRuntimeIdentity({ executableSha256: inspection.sha256, cliVersion: inspection.version, authentication: "subscription" });
+    const qualification = toTaskQualification(record2, { route, profile, runtimeVersion: identity.version, runtimeDigest: identity.digest });
+    let linuxSandbox;
+    if (process.platform === "linux") {
+      const bridgeDirectory = join9(await privateDirectory(stateRoot), "egress");
+      linuxSandbox = await prepareCliLinuxSandbox({ bridgeDirectory }).catch(() => null) ?? undefined;
+      if (linuxSandbox === undefined)
+        return Object.freeze({ status: "sandbox-unavailable", inspection });
+    }
+    const processFactory = claudeCliProcessFactory(config, linuxSandbox);
+    const adapter = createClaudeTaskAdapter({
+      route,
+      runtime,
+      stateRoot,
+      authDirectory: config,
+      authentication: "subscription",
+      qualification,
+      systemPrompt: CLI_SYSTEM_PROMPT,
+      subscriptionToken: async () => {
+        const token = await readClaudeOAuthToken(stateRoot);
+        if (token === null)
+          throw new Error("CLAUDE_OAUTH_TOKEN_REQUIRED");
+        return token;
+      },
+      ...events === undefined ? {} : { events },
+      ...processFactory === undefined ? {} : { processFactory }
+    });
+    if (qualification.status !== "qualified") {
+      await linuxSandbox?.close().catch(() => {});
+      return Object.freeze({ status: "unadmitted", inspection });
+    }
+    return Object.freeze({
+      status: "ready",
+      adapter,
+      inspection,
+      record: record2,
+      ...linuxSandbox === undefined ? {} : { close: () => linuxSandbox.close() }
+    });
+  }
+  return Object.freeze({ status: "unadmitted", inspection });
+}
+
+// src/cli/sessions.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { appendFile, lstat as lstat6, mkdir as mkdir7, rm as rm4 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+var MAX_TITLE_BYTES = 200;
+var MAX_TRANSCRIPT_BYTES = 4 * 1024 * 1024;
+var MAX_SESSIONS = 512;
+var MAX_ENTRY_BYTES = 256 * 1024;
+var TABLE = "xcb_cli_sessions";
+var LEGACY_TABLE = "agentmixer_cli_sessions";
+var fail6 = (code) => {
+  throw new Error(code);
+};
+var provider = (value) => value === "codex" || value === "claude" || value === "devin" ? value : fail6("SESSION_PROVIDER_INVALID");
+function sessionFrom(row) {
+  return Object.freeze({
+    id: identifier(row.id),
+    provider: provider(row.provider),
+    accountId: row.account_id === null ? null : identifier(row.account_id),
+    workspace: boundedText(row.workspace, 4096),
+    model: boundedText(row.model, 160),
+    title: boundedText(row.title, MAX_TITLE_BYTES, true),
+    createdAt: safeInteger(row.created_at, 0, Number.MAX_SAFE_INTEGER),
+    lastActiveAt: safeInteger(row.last_active_at, 0, Number.MAX_SAFE_INTEGER),
+    turns: safeInteger(row.turns, 0, Number.MAX_SAFE_INTEGER)
+  });
+}
+function entry(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    fail6("TRANSCRIPT_ENTRY_INVALID");
+  const raw = value;
+  if (Reflect.ownKeys(raw).sort().join(",") !== "at,role,text")
+    fail6("TRANSCRIPT_ENTRY_INVALID");
+  const role = raw.role === "user" || raw.role === "assistant" || raw.role === "system" ? raw.role : fail6("TRANSCRIPT_ENTRY_INVALID");
+  return Object.freeze({ role, text: boundedText(raw.text, MAX_ENTRY_BYTES), at: safeInteger(raw.at, 0, Number.MAX_SAFE_INTEGER) });
+}
+
+class CliSessionStore {
+  database;
+  directory;
+  constructor(database, directory2) {
+    this.database = database;
+    this.directory = directory2;
+    const tables = new Set(database.query("SELECT name FROM sqlite_master WHERE type='table'").all().map((row) => row.name));
+    if (tables.has(LEGACY_TABLE) && !tables.has(TABLE)) {
+      database.exec(`ALTER TABLE ${LEGACY_TABLE} RENAME TO ${TABLE}`);
+    }
+    database.exec(`CREATE TABLE IF NOT EXISTS ${TABLE} (
+      id TEXT PRIMARY KEY, provider TEXT NOT NULL, account_id TEXT,
+      workspace TEXT NOT NULL, model TEXT NOT NULL, title TEXT NOT NULL,
+      created_at INTEGER NOT NULL, last_active_at INTEGER NOT NULL, turns INTEGER NOT NULL
+    )`);
+  }
+  static async open(directory2) {
+    await mkdir7(directory2, { mode: 448, recursive: true });
+    const root = await privateDirectory(directory2);
+    const transcripts = join10(root, "transcripts");
+    await mkdir7(transcripts, { mode: 448, recursive: true });
+    const database = await openAccountDatabase(join10(root, "sessions.sqlite"));
+    return new CliSessionStore(database, await privateDirectory(transcripts));
+  }
+  transcriptPath(id) {
+    return join10(this.directory, `${identifier(id)}.jsonl`);
+  }
+  async create(input) {
+    const id = `s_${randomBytes3(12).toString("hex")}`;
+    const workspace = boundedText(input.workspace, 4096);
+    const count = this.database.query("SELECT COUNT(*) AS n FROM xcb_cli_sessions").get();
+    if ((count?.n ?? 0) >= MAX_SESSIONS)
+      fail6("SESSION_LIMIT");
+    const row = this.database.query(`INSERT INTO xcb_cli_sessions (id, provider, account_id, workspace, model, title, created_at, last_active_at, turns)
+       VALUES (?, ?, ?, ?, ?, '', ?, ?, 0) RETURNING *`).get(id, provider(input.provider), input.accountId === null ? null : identifier(input.accountId), workspace, boundedText(input.model, 160), safeInteger(input.now, 0, Number.MAX_SAFE_INTEGER), safeInteger(input.now, 0, Number.MAX_SAFE_INTEGER));
+    return row === null ? fail6("SESSION_CREATE_FAILED") : sessionFrom(row);
+  }
+  get(id) {
+    const row = this.database.query("SELECT * FROM xcb_cli_sessions WHERE id=?").get(identifier(id));
+    return row === null ? null : sessionFrom(row);
+  }
+  list(limit = 64) {
+    const rows = this.database.query("SELECT * FROM xcb_cli_sessions ORDER BY last_active_at DESC LIMIT ?").all(safeInteger(limit, 1, MAX_SESSIONS));
+    return Object.freeze(rows.map(sessionFrom));
+  }
+  async record(session, entries, now) {
+    const current = this.get(session.id) ?? fail6("SESSION_MISSING");
+    for (const item of entries)
+      entry(item);
+    const path3 = this.transcriptPath(session.id);
+    const line = entries.map((item) => `${JSON.stringify(entry(item))}
+`).join("");
+    await appendFile(path3, line, { mode: 384 });
+    const stat = await lstat6(path3);
+    assertPrivateStat(stat, { kind: "file", size: { max: MAX_TRANSCRIPT_BYTES } }, "TRANSCRIPT_LIMIT");
+    const firstUser = entries.find((item) => item.role === "user");
+    const title = current.title === "" && firstUser !== undefined ? boundedText(firstUser.text.split(`
+`)[0].slice(0, 80), MAX_TITLE_BYTES, true) : current.title;
+    const row = this.database.query(`UPDATE xcb_cli_sessions SET title=?, last_active_at=?, turns=turns+? WHERE id=? RETURNING *`).get(title, safeInteger(now, 0, Number.MAX_SAFE_INTEGER), entries.length, current.id);
+    return row === null ? current : sessionFrom(row);
+  }
+  async remove(id) {
+    const session = this.get(id);
+    if (session === null)
+      return false;
+    this.database.query("DELETE FROM xcb_cli_sessions WHERE id=?").run(session.id);
+    await rm4(this.transcriptPath(session.id), { force: true });
+    return true;
+  }
+  async prune(beforeMs) {
+    const rows = this.database.query("SELECT id FROM xcb_cli_sessions WHERE last_active_at < ?").all(safeInteger(beforeMs, 0, Number.MAX_SAFE_INTEGER));
+    let removed = 0;
+    for (const row of rows) {
+      if (await this.remove(row.id))
+        removed += 1;
+    }
+    return removed;
+  }
+  async transcript(id, limitBytes = MAX_TRANSCRIPT_BYTES) {
+    const path3 = this.transcriptPath(id);
+    let text;
+    try {
+      const stat = await lstat6(path3);
+      assertPrivateStat(stat, { kind: "file", noSymlink: true, size: { max: limitBytes } }, "TRANSCRIPT_LIMIT");
+      const handle = await openPrivateRead(path3, { nonblock: false });
+      try {
+        text = await handle.readFile("utf8");
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return Object.freeze([]);
+      throw error;
+    }
+    const lines = text.split(`
+`).filter((lineText) => lineText !== "");
+    if (lines.length > 4096)
+      fail6("TRANSCRIPT_LIMIT");
+    return Object.freeze(lines.map((lineText) => entry(JSON.parse(lineText))));
+  }
+  close() {
+    this.database.close();
+  }
+}
+
+// src/cli/workspace.ts
+import { createHash as createHash7, randomBytes as randomBytes4 } from "node:crypto";
+import { lstatSync as lstatSync2, readdirSync, realpathSync as realpathSync2 } from "node:fs";
+import { link, lstat as lstat8, readdir as readdir2, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute5, join as join12, relative as relative3, resolve, sep as sep3 } from "node:path";
+
+// src/cli/write-coordination.ts
+import { createHash as createHash6 } from "node:crypto";
+import { lstat as lstat7, mkdir as mkdir8, realpath as realpath5 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { isAbsolute as isAbsolute4, join as join11, relative as relative2, sep as sep2 } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+var WAIT_MS = 5000;
+var queues = new Map;
+var inside = (path3, root) => {
+  const child = relative2(root, path3);
+  return child === "" || child !== ".." && !child.startsWith(`..${sep2}`) && !isAbsolute4(child);
+};
+var busy = (error) => error instanceof Error && /database (?:is )?locked|SQLITE_BUSY|SQLITE_LOCKED/u.test(error.message);
+function workspaceCoordinationRoot() {
+  return process.env.XCB_COORDINATION_ROOT ?? join11(homedir3(), ".local", "share", "xcb-coordination");
+}
+async function withWorkspaceWriteLock(workspace, directory2, action) {
+  canonicalizePrivatePath(directory2, { code: "WORKSPACE_COORDINATION_LAYOUT_INVALID", reject: PRIVATE_CONTROL_REJECT, maxLength: Infinity });
+  if (inside(directory2, workspace) || inside(workspace, directory2))
+    throw new Error("WORKSPACE_COORDINATION_LAYOUT_INVALID");
+  if (await realpath5(workspace) !== workspace || !(await lstat7(workspace)).isDirectory())
+    throw new Error("WORKSPACE_ROOT_CHANGED");
+  const path3 = join11(directory2, `${createHash6("sha256").update(workspace).digest("hex")}.sqlite`);
+  const prior = queues.get(path3);
+  if ((prior?.count ?? 0) >= 128)
+    throw new Error("WORKSPACE_WRITER_QUEUE_FULL");
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const previous = prior?.tail ?? Promise.resolve();
+  const ticket = { tail: previous.then(() => gate), count: (prior?.count ?? 0) + 1 };
+  queues.set(path3, ticket);
+  ticket.tail.then(() => {
+    if (queues.get(path3) === ticket)
+      queues.delete(path3);
+  });
+  const deadline = performance.now() + WAIT_MS;
+  let timer;
+  let database;
+  try {
+    await Promise.race([previous, new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("WORKSPACE_WRITER_BUSY")), WAIT_MS);
+    })]);
+    clearTimeout(timer);
+    await mkdir8(directory2, { recursive: true, mode: 448 });
+    await privateDirectory(directory2);
+    try {
+      await writeFileOnce(path3, "", { syncFile: true });
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+    }
+    const before = await lstat7(path3, { bigint: true });
+    assertPrivateStat(before, {
+      kind: "file",
+      noSymlink: true,
+      links: "single",
+      owner: "self",
+      mode: [{ mask: 63, equals: 0 }],
+      size: { max: 64n * 1024n }
+    }, "WORKSPACE_COORDINATION_NOT_PRIVATE");
+    for (;; ) {
+      if (performance.now() >= deadline)
+        throw new Error("WORKSPACE_WRITER_BUSY");
+      try {
+        database = await openAccountDatabase(path3, "DELETE");
+        database.exec("PRAGMA busy_timeout=0");
+        database.exec("BEGIN IMMEDIATE");
+        break;
+      } catch (error) {
+        database?.close();
+        database = undefined;
+        if (!busy(error))
+          throw error;
+        await delay(5);
+      }
+    }
+    const after = await lstat7(path3, { bigint: true });
+    if (!matchesPrivateStat(after, { kind: "file", links: "single", mode: [{ mask: 63, equals: 0 }] }) || !sameFileIdentity(after, before, ["dev", "ino", "uid"]))
+      throw new Error("WORKSPACE_COORDINATION_CHANGED");
+    if (await realpath5(workspace) !== workspace)
+      throw new Error("WORKSPACE_ROOT_CHANGED");
+    return await action();
+  } finally {
+    clearTimeout(timer);
+    try {
+      database?.exec("ROLLBACK");
+    } finally {
+      try {
+        database?.close();
+      } finally {
+        release();
+        const current = queues.get(path3);
+        if (current !== undefined)
+          current.count--;
+      }
+    }
+  }
+}
+
+// src/cli/workspace.ts
+var CLI_WORKSPACE_PROFILE_ID = "xcb.workspace";
+var CLI_WORKSPACE_PROFILE_VERSION = 1;
+var MAX_FILE_BYTES = 256 * 1024;
+var MAX_ENTRIES = 512;
+var MAX_DEPTH = 12;
+var fail7 = (code) => {
+  throw new Error(code);
+};
+function workspacePath(root, rawPath, { allowRoot = false } = {}) {
+  const text = boundedText(rawPath, 1024);
+  if (text.includes("\x00") || isAbsolute5(text))
+    fail7("WORKSPACE_PATH_INVALID");
+  const resolved = resolve(root, text);
+  const rel = relative3(root, resolved);
+  if (rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute5(rel) || rel === "" && !allowRoot)
+    fail7("WORKSPACE_PATH_ESCAPES");
+  if (rel !== "" && rel.split(sep3).length > MAX_DEPTH)
+    fail7("WORKSPACE_PATH_DEPTH");
+  return resolved;
+}
+function assertNoLinks(root, target, { allowLeafMissing = false } = {}) {
+  const rel = relative3(root, target);
+  const parts = rel.split(sep3);
+  let cursor = root;
+  for (const [index, part] of parts.entries()) {
+    cursor = join12(cursor, part);
+    let stat;
+    try {
+      stat = lstatSync2(cursor);
+    } catch (error) {
+      if (error.code === "ENOENT" && (index === parts.length - 1 ? allowLeafMissing : false))
+        return;
+      if (error.code === "ENOENT")
+        fail7("WORKSPACE_PATH_MISSING");
+      throw error;
+    }
+    if (stat.isSymbolicLink())
+      fail7("WORKSPACE_PATH_LINK");
+    if (index < parts.length - 1 && !stat.isDirectory())
+      fail7("WORKSPACE_PATH_INVALID");
+  }
+}
+function revisionOf(stat) {
+  const mtime = stat.mtimeNs !== undefined ? stat.mtimeNs : BigInt(Math.trunc(Number(stat.mtimeMs ?? 0) * 1e6));
+  return createHash7("sha256").update(`${String(stat.dev ?? 0)}:${String(stat.ino ?? 0)}:${String(stat.size)}:${String(mtime)}`).digest("hex").slice(0, 32);
+}
+function createCliWorkspace(rootInput, options = {}) {
+  const root = canonicalizePrivatePath(rootInput, { code: "WORKSPACE_ROOT_INVALID", reject: PRIVATE_CONTROL_REJECT, maxLength: Infinity });
+  const identity = lstatSync2(root, { bigint: true });
+  if (!identity.isDirectory() || identity.isSymbolicLink() || realpathSync2(root) !== root)
+    throw new Error("WORKSPACE_ROOT_INVALID");
+  const coordinationRoot = options.coordinationRoot ?? workspaceCoordinationRoot();
+  const checkRoot = () => {
+    const current = lstatSync2(root, { bigint: true });
+    if (!current.isDirectory() || current.dev !== identity.dev || current.ino !== identity.ino || realpathSync2(root) !== root)
+      throw new Error("WORKSPACE_ROOT_CHANGED");
+  };
+  const confined = (target, { allowRoot = false } = {}) => {
+    const rel = relative3(root, target);
+    if (rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute5(rel) || rel === "" && !allowRoot)
+      fail7("WORKSPACE_PATH_ESCAPES");
+    if (rel !== "" && rel.split(sep3).length > MAX_DEPTH)
+      fail7("WORKSPACE_PATH_DEPTH");
+    return target;
+  };
+  const readRevision = async (target) => {
+    confined(target);
+    assertNoLinks(root, target);
+    const stat = await lstat8(target);
+    assertPrivateStat(stat, { kind: "file", links: "single", size: { max: MAX_FILE_BYTES } }, "WORKSPACE_FILE_INVALID");
+    const handle = await openPrivateRead(target, { nonblock: false });
+    try {
+      const stable = await handle.stat();
+      assertPrivateStat(stable, { kind: "file", size: { max: MAX_FILE_BYTES } }, "WORKSPACE_FILE_INVALID");
+      const bytes = await handle.readFile();
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      return { text, revision: revisionOf(stable) };
+    } finally {
+      await handle.close();
+    }
+  };
+  const writeRevision = async (target, text, expectedRevision) => {
+    confined(target);
+    if (Buffer.byteLength(text) > MAX_FILE_BYTES)
+      fail7("WORKSPACE_FILE_LIMIT");
+    checkRoot();
+    return withWorkspaceWriteLock(root, coordinationRoot, async () => {
+      const check2 = async () => {
+        checkRoot();
+        assertNoLinks(root, target, { allowLeafMissing: true });
+        let stat;
+        try {
+          stat = await lstat8(target);
+        } catch (error) {
+          if (error.code !== "ENOENT")
+            throw error;
+        }
+        if (stat !== undefined && !matchesPrivateStat(stat, { kind: "file", links: "single", size: { max: MAX_FILE_BYTES } }))
+          fail7("WORKSPACE_FILE_INVALID");
+        if (expectedRevision === null && stat !== undefined)
+          fail7("WORKSPACE_REVISION_REQUIRED");
+        if (expectedRevision !== null) {
+          if (stat === undefined)
+            fail7("WORKSPACE_FILE_MISSING");
+          if ((await readRevision(target)).revision !== expectedRevision)
+            fail7("WORKSPACE_REVISION_MISMATCH");
+        }
+        return stat;
+      };
+      const current = await check2();
+      const directory2 = dirname2(target);
+      const temp = join12(directory2, `.xcb-write-${randomBytes4(16).toString("hex")}.tmp`);
+      const staged = await openPrivateWrite(temp);
+      try {
+        await staged.writeFile(text);
+        await staged.chmod(current === undefined ? 384 : current.mode & 511);
+        await staged.sync();
+        await check2();
+        if (expectedRevision === null) {
+          await link(temp, target);
+          await unlink2(temp);
+        } else
+          await rename2(temp, target);
+        await fsyncDirectory(directory2);
+        return { revision: revisionOf(await lstat8(target)) };
+      } finally {
+        await staged.close();
+        await unlink2(temp).catch((error) => {
+          if (error.code !== "ENOENT")
+            throw error;
+        });
+      }
+    });
+  };
+  const listEntries = async (target) => {
+    confined(target, { allowRoot: true });
+    assertNoLinks(root, target);
+    const stat = await lstat8(target);
+    if (!stat.isDirectory())
+      fail7("WORKSPACE_DIRECTORY_INVALID");
+    const entries = await readdir2(target, { withFileTypes: true });
+    const names = [];
+    for (const entry2 of entries.slice(0, MAX_ENTRIES)) {
+      if (entry2.isSymbolicLink())
+        continue;
+      if (!entry2.isDirectory() && !entry2.isFile())
+        continue;
+      names.push(entry2.isDirectory() ? `${entry2.name}/` : entry2.name);
+    }
+    return Object.freeze(names.sort());
+  };
+  const search = async (target, query) => {
+    boundedText(query, 512);
+    if (query.length === 0 || query.includes("\x00"))
+      fail7("WORKSPACE_QUERY_INVALID");
+    const hits = [];
+    const visit = async (directory2, depth) => {
+      if (depth > MAX_DEPTH || hits.length >= 128)
+        return;
+      let entries;
+      try {
+        entries = readdirSync(directory2, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const entry2 of entries.slice(0, MAX_ENTRIES)) {
+        if (hits.length >= 128)
+          return;
+        if (entry2.isSymbolicLink() || entry2.name === "node_modules" || entry2.name === ".git" || entry2.name.startsWith(".xcb-"))
+          continue;
+        const path3 = join12(directory2, entry2.name);
+        if (entry2.isDirectory()) {
+          await visit(path3, depth + 1);
+          continue;
+        }
+        if (!entry2.isFile())
+          continue;
+        let stat;
+        try {
+          stat = lstatSync2(path3);
+        } catch {
+          continue;
+        }
+        if (!matchesPrivateStat(stat, { kind: "file", size: { max: MAX_FILE_BYTES } }))
+          continue;
+        let text;
+        try {
+          text = (await readRevision(path3)).text;
+        } catch {
+          continue;
+        }
+        const lines = text.split(`
+`);
+        for (const [index, line] of lines.entries()) {
+          if (hits.length >= 128)
+            return;
+          if (line.includes(query))
+            hits.push({ path: relative3(root, path3).split(sep3).join("/"), line: index + 1, text: boundedText(line.trim(), 256) });
+        }
+      }
+    };
+    await visit(target === root ? root : confined(target, { allowRoot: true }), 0);
+    return Object.freeze(hits);
+  };
+  return Object.freeze({ root, readRevision, writeRevision, listEntries, search });
+}
+var objectSchema = (properties, required) => Object.freeze({
+  type: "object",
+  properties,
+  required: [...required],
+  additionalProperties: false
+});
+var requireString = (value, code) => typeof value === "string" ? value : fail7(code);
+function createCliWorkspaceProfile(workspace, web) {
+  const string = (extra = {}) => Object.freeze({ type: "string", ...extra });
+  return createCapabilityProfile({
+    id: CLI_WORKSPACE_PROFILE_ID,
+    version: CLI_WORKSPACE_PROFILE_VERSION,
+    tools: [
+      {
+        name: "workspace.list",
+        description: "List entries of a directory in the workspace. Paths are workspace-relative; directories end with '/'.",
+        inputSchema: objectSchema({ path: string({ maxLength: 1024 }) }, ["path"]),
+        parseInput(input) {
+          return Object.freeze({ path: requireString(input.path, "WORKSPACE_INPUT_INVALID") });
+        },
+        async execute(input, context) {
+          context.assertActive();
+          const entries = await workspace.listEntries(workspacePath(workspace.root, input.path, { allowRoot: true }));
+          context.assertActive();
+          return { entries: [...entries] };
+        }
+      },
+      {
+        name: "workspace.read",
+        description: "Read a UTF-8 file in the workspace (max 256 KiB) and its revision. Keep the revision to write the file later.",
+        inputSchema: objectSchema({ path: string({ maxLength: 1024 }) }, ["path"]),
+        parseInput(input) {
+          return Object.freeze({ path: requireString(input.path, "WORKSPACE_INPUT_INVALID") });
+        },
+        async execute(input, context) {
+          context.assertActive();
+          const result = await workspace.readRevision(workspacePath(workspace.root, input.path));
+          context.assertActive();
+          return { text: result.text, revision: result.revision };
+        }
+      },
+      {
+        name: "workspace.write",
+        description: "Write a UTF-8 file in the workspace. expectedRevision must be the revision from the last read, or null only for a new file.",
+        inputSchema: objectSchema({ path: string({ maxLength: 1024 }), text: string({ maxLength: MAX_FILE_BYTES }), expectedRevision: Object.freeze({ anyOf: [string(), Object.freeze({ type: "null" })] }) }, ["path", "text", "expectedRevision"]),
+        parseInput(input) {
+          const expectedRevision = input.expectedRevision;
+          if (expectedRevision !== null && typeof expectedRevision !== "string")
+            fail7("WORKSPACE_INPUT_INVALID");
+          return Object.freeze({
+            path: requireString(input.path, "WORKSPACE_INPUT_INVALID"),
+            text: requireString(input.text, "WORKSPACE_INPUT_INVALID"),
+            expectedRevision: expectedRevision ?? null
+          });
+        },
+        async execute(input, context) {
+          context.assertActive();
+          const value = input;
+          const result = await workspace.writeRevision(workspacePath(workspace.root, value.path), boundedText(value.text, MAX_FILE_BYTES, true), value.expectedRevision === null ? null : boundedText(value.expectedRevision, 160));
+          context.assertActive();
+          return { revision: result.revision };
+        }
+      },
+      {
+        name: "workspace.search",
+        description: "Find literal text in workspace files (skips .git, node_modules and symlinks; max 128 matches).",
+        inputSchema: objectSchema({ path: string({ maxLength: 1024 }), query: string({ minLength: 1, maxLength: 512 }) }, ["path", "query"]),
+        parseInput(input) {
+          const query = requireString(input.query, "WORKSPACE_INPUT_INVALID");
+          if (query.length === 0)
+            fail7("WORKSPACE_INPUT_INVALID");
+          return Object.freeze({ path: requireString(input.path, "WORKSPACE_INPUT_INVALID"), query });
+        },
+        async execute(input, context) {
+          context.assertActive();
+          const value = input;
+          const matches = await workspace.search(workspacePath(workspace.root, value.path, { allowRoot: true }), boundedText(value.query, 512));
+          context.assertActive();
+          return { matches: matches.map((match) => Object.freeze({ ...match })) };
+        }
+      },
+      ...web === undefined ? [] : [{
+        name: "web.fetch",
+        description: "Fetch bounded public HTTPS text (256 KiB, 15s). Private addresses and authenticated requests are unavailable.",
+        inputSchema: objectSchema({ url: string({ maxLength: 2048 }) }, ["url"]),
+        parseInput(input) {
+          return Object.freeze({ url: requireString(input.url, "WORKSPACE_INPUT_INVALID") });
+        },
+        async execute(input, context) {
+          context.assertActive();
+          const result = await web.fetch(boundedText(input.url, 2048), context.signal);
+          context.assertActive();
+          return { text: result.text };
+        }
+      }]
+    ]
+  });
+}
+
+// src/cli/run.ts
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { spawnSync as spawnSync5 } from "node:child_process";
+var MAX_CONTEXT_BYTES = 64 * 1024;
+var MAX_RUN_MS = 10 * 60 * 1000;
+var MAX_CLEANUP_MS = 30 * 1000;
+var MAX_OUTPUT_BYTES = 256 * 1024;
+function promptWithContext(prompt, prior) {
+  if (prior.length === 0)
+    return prompt;
+  const lines = ["Prior conversation in this session (recorded locally):"];
+  let bytes = 0;
+  const selected = [];
+  for (const entry2 of [...prior].reverse()) {
+    const line = `${entry2.role === "user" ? "User" : "xcb"}: ${entry2.text}`;
+    bytes += Buffer.byteLength(line) + 1;
+    if (bytes > MAX_CONTEXT_BYTES || selected.length >= 40)
+      break;
+    selected.unshift(line);
+  }
+  return [...lines, ...selected, "", "Current request:", prompt].join(`
+`);
+}
+async function recoverHeldLease(leases, provider2, accountId, proveStopped) {
+  if (leases.inspect === undefined || leases.recover === undefined)
+    return;
+  const held = leases.inspect(provider2, accountId);
+  if (held === null)
+    return;
+  if (proveStopped === undefined)
+    throw new Error("ACCOUNT_PROCESS_STOP_UNPROVEN");
+  const recovered = await leases.recover(held, async (lease) => {
+    let timer;
+    try {
+      const proven = await Promise.race([
+        proveStopped(Object.freeze({ ...lease })),
+        new Promise((resolve2) => {
+          timer = setTimeout(() => resolve2(false), 5000);
+        })
+      ]);
+      if (proven !== true)
+        return false;
+      const probe = spawnSync5("pgrep", ["-f", `${provider2}-run-${lease.owner}`], { timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
+      return probe.status === 1;
+    } finally {
+      clearTimeout(timer);
+    }
+  });
+  if (!recovered)
+    throw new Error("ACCOUNT_RECOVERY_CHANGED");
+}
+async function runCliTurn(input) {
+  const workspaceId = identifier(input.workspaceId);
+  const accountId = identifier(input.accountId);
+  const model = Object.freeze({ id: boundedText(input.model, 160), reasoningEffort: null, serviceTier: null });
+  const profile = input.profile;
+  const prompt = boundedText(promptWithContext(input.prompt, input.prior), 512 * 1024);
+  let active = true;
+  const attempt = () => {
+    const runId = `run_${randomBytes5(12).toString("hex")}`;
+    const inner = createCapabilityBroker({
+      profile,
+      workspaceId,
+      runId,
+      isActive: () => active && !input.signal.aborted,
+      signal: input.signal
+    });
+    const broker = Object.freeze({
+      profile: inner.profile,
+      workspaceId: inner.workspaceId,
+      runId: inner.runId,
+      assertActive: () => inner.assertActive(),
+      revoke: () => inner.revoke(),
+      close: () => inner.close(),
+      invoke: (name, callInput) => {
+        if (typeof name === "string")
+          input.onTool?.(name, callInput);
+        return inner.invoke(name, callInput);
+      }
+    });
+    return runAgentTask({ adapters: [input.adapter], leases: input.leases, now: input.now ?? Date.now }, {
+      route: input.adapter.route,
+      accountId,
+      workspaceId,
+      runId,
+      profile: Object.freeze({ id: profile.id, version: profile.version, digest: profile.digest }),
+      model,
+      purpose: "cli-turn",
+      prompt,
+      limits: Object.freeze({ maxRunMs: MAX_RUN_MS, maxCleanupMs: MAX_CLEANUP_MS, maxOutputBytes: MAX_OUTPUT_BYTES }),
+      signal: input.signal
+    }, broker);
+  };
+  try {
+    try {
+      const result = await attempt();
+      return Object.freeze({ result, output: result.output });
+    } catch (error) {
+      if (!(error instanceof Error) || error.message !== "ACCOUNT_BUSY_OR_RECOVERY_REQUIRED")
+        throw error;
+      await recoverHeldLease(input.leases, input.adapter.route.provider, accountId, input.proveAccountStopped);
+      const result = await attempt();
+      return Object.freeze({ result, output: result.output });
+    }
+  } finally {
+    active = false;
+  }
+}
+
+// src/cli/chat.ts
+import { isAbsolute as isAbsolute6, resolve as resolve2 } from "node:path";
+import { mkdir as mkdir9, realpath as realpath6, lstat as lstat9 } from "node:fs/promises";
+import { join as join13 } from "node:path";
+
+// src/cli/tui.ts
+var ESC = "\x1B";
+var color = (code, text) => process.env.NO_COLOR === undefined && process.stdout.isTTY ? `${ESC}[${code}m${text}${ESC}[0m` : text;
+var dim = (text) => color(90, text);
+var bold = (text) => color(1, text);
+var cyan = (text) => color(36, text);
+var yellow = (text) => color(33, text);
+var red = (text) => color(31, text);
+var green = (text) => color(32, text);
+var MAX_LINE_BYTES = 16 * 1024;
+var MAX_HISTORY = 200;
+
+class LineEditor {
+  history = [];
+  stdin = process.stdin;
+  stdout = process.stdout;
+  interrupted = null;
+  interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
+  constructor() {
+    if (this.interactive) {
+      this.stdin.setRawMode(true);
+      this.stdout.write(`${ESC}[?2004h`);
+    }
+    this.stdin.on("data", (chunk) => this.feed(chunk));
+    this.stdin.on("end", this.onEnd);
+  }
+  onEnd = () => {
+    if (this.resolveLine) {
+      const done = this.resolveLine;
+      done(null);
+    }
+  };
+  onInterrupt(handler) {
+    this.interrupted = handler;
+  }
+  close() {
+    if (this.interactive) {
+      this.stdout.write(`${ESC}[?2004l`);
+      this.stdin.setRawMode(false);
+    }
+    this.stdin.removeAllListeners("data");
+    this.stdin.removeListener("end", this.onEnd);
+  }
+  buffer = "";
+  cursor = 0;
+  historyIndex = -1;
+  draft = "";
+  paste = false;
+  resolveLine = null;
+  async readLine(prompt) {
+    if (this.resolveLine)
+      throw new Error("TUI_BUSY");
+    this.buffer = "";
+    this.cursor = 0;
+    this.historyIndex = -1;
+    this.draft = "";
+    this.stdout.write(prompt);
+    return await new Promise((resolve2) => {
+      this.resolveLine = (line) => {
+        this.resolveLine = null;
+        if (line !== null && line.trim() !== "" && this.history[0] !== line) {
+          this.history.unshift(boundedText(line, MAX_LINE_BYTES));
+          if (this.history.length > MAX_HISTORY)
+            this.history.pop();
+        }
+        this.stdout.write(`
+`);
+        resolve2(line);
+      };
+    });
+  }
+  render() {
+    if (!this.interactive)
+      return;
+    const shown = this.buffer;
+    this.stdout.write(`\r${ESC}[K` + dim("›") + " " + shown);
+    const back = shown.length - this.cursor;
+    if (back > 0)
+      this.stdout.write(`${ESC}[${back}D`);
+  }
+  feed(chunk) {
+    let i = 0;
+    const bytes = chunk;
+    while (i < bytes.length) {
+      const b = bytes[i];
+      if (b === 27 && bytes.subarray(i, i + 6).toString("latin1") === `${ESC}[200~`) {
+        this.paste = true;
+        i += 6;
+        continue;
+      }
+      if (b === 27 && bytes.subarray(i, i + 6).toString("latin1") === `${ESC}[201~`) {
+        this.paste = false;
+        i += 6;
+        continue;
+      }
+      if (b === 3) {
+        this.interrupted?.();
+        if (this.resolveLine) {
+          const done = this.resolveLine;
+          this.buffer = "";
+          this.render();
+          done("");
+        }
+        i += 1;
+        continue;
+      }
+      if (b === 4) {
+        if (this.resolveLine && this.buffer.length === 0) {
+          const done = this.resolveLine;
+          done(null);
+        }
+        i += 1;
+        continue;
+      }
+      if (!this.resolveLine) {
+        i += 1;
+        continue;
+      }
+      if (b === 13 || b === 10 && !this.paste) {
+        const done = this.resolveLine, line = this.buffer;
+        this.buffer = "";
+        this.cursor = 0;
+        done(line === null ? null : boundedText(line, MAX_LINE_BYTES));
+        i += 1;
+        continue;
+      }
+      if (b === 127) {
+        if (this.cursor > 0) {
+          this.buffer = this.buffer.slice(0, this.cursor - 1) + this.buffer.slice(this.cursor);
+          this.cursor -= 1;
+          this.render();
+        }
+        i += 1;
+        continue;
+      }
+      if (b === 1) {
+        this.cursor = 0;
+        this.render();
+        i += 1;
+        continue;
+      }
+      if (b === 5) {
+        this.cursor = this.buffer.length;
+        this.render();
+        i += 1;
+        continue;
+      }
+      if (b === 11) {
+        this.buffer = this.buffer.slice(0, this.cursor);
+        this.render();
+        i += 1;
+        continue;
+      }
+      if (b === 21) {
+        this.buffer = this.buffer.slice(this.cursor);
+        this.cursor = 0;
+        this.render();
+        i += 1;
+        continue;
+      }
+      if (b === 23) {
+        const before = this.buffer.slice(0, this.cursor).replace(/\s+$/u, "").replace(/\S+$/u, "");
+        this.buffer = before + this.buffer.slice(this.cursor);
+        this.cursor = before.length;
+        this.render();
+        i += 1;
+        continue;
+      }
+      if (b === 27) {
+        const seq = bytes.subarray(i, i + 4).toString("latin1");
+        if (seq.startsWith(`${ESC}[A`) || seq.startsWith(`${ESC}OA`)) {
+          if (this.historyIndex === -1)
+            this.draft = this.buffer;
+          if (this.historyIndex + 1 < this.history.length) {
+            this.historyIndex += 1;
+            this.buffer = this.history[this.historyIndex];
+            this.cursor = this.buffer.length;
+            this.render();
+          }
+          i += 3;
+          continue;
+        }
+        if (seq.startsWith(`${ESC}[B`) || seq.startsWith(`${ESC}OB`)) {
+          if (this.historyIndex > 0) {
+            this.historyIndex -= 1;
+            this.buffer = this.history[this.historyIndex];
+          } else {
+            this.historyIndex = -1;
+            this.buffer = this.draft;
+          }
+          this.cursor = this.buffer.length;
+          this.render();
+          i += 3;
+          continue;
+        }
+        if (seq.startsWith(`${ESC}[C`) || seq.startsWith(`${ESC}OC`)) {
+          this.cursor = Math.min(this.buffer.length, this.cursor + 1);
+          this.render();
+          i += 3;
+          continue;
+        }
+        if (seq.startsWith(`${ESC}[D`) || seq.startsWith(`${ESC}OD`)) {
+          this.cursor = Math.max(0, this.cursor - 1);
+          this.render();
+          i += 3;
+          continue;
+        }
+        if (seq.startsWith(`${ESC}[H`) || seq.startsWith(`${ESC}[1~`)) {
+          this.cursor = 0;
+          this.render();
+          i += 3;
+          continue;
+        }
+        if (seq.startsWith(`${ESC}[F`) || seq.startsWith(`${ESC}[4~`)) {
+          this.cursor = this.buffer.length;
+          this.render();
+          i += 3;
+          continue;
+        }
+        i += 1;
+        continue;
+      }
+      const rest = bytes.subarray(i);
+      const charLength = b < 128 ? 1 : b < 224 ? 2 : b < 240 ? 3 : 4;
+      const text = rest.subarray(0, charLength).toString("utf8");
+      const insert = text === `
+` || text === "\r" ? " " : text;
+      if (Buffer.byteLength(this.buffer) + Buffer.byteLength(insert) <= MAX_LINE_BYTES) {
+        this.buffer = this.buffer.slice(0, this.cursor) + insert + this.buffer.slice(this.cursor);
+        this.cursor += insert.length;
+        this.render();
+      }
+      i += charLength;
+    }
+  }
+}
+function startSpinner(label) {
+  if (!process.stdout.isTTY)
+    return Object.freeze({ stop() {} });
+  const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+  let index = 0;
+  const write = () => process.stdout.write(`\r${ESC}[K${cyan(frames[index % frames.length])} ${dim(label())}`);
+  const timer = setInterval(() => {
+    index += 1;
+    write();
+  }, 80);
+  write();
+  return Object.freeze({
+    stop() {
+      clearInterval(timer);
+      process.stdout.write(`\r${ESC}[K`);
+    }
+  });
+}
+function printTool(name, input) {
+  let detail = "";
+  if (input !== null && typeof input === "object" && !Array.isArray(input)) {
+    const record2 = input;
+    const first = typeof record2.path === "string" ? record2.path : typeof record2.url === "string" ? record2.url : typeof record2.query === "string" ? record2.query : "";
+    detail = first === "" ? "" : ` ${boundedText(first, 96)}`;
+  }
+  process.stdout.write(`${dim("  ⚙")} ${dim(name)}${dim(detail)}
+`);
+}
+function printRemainingText(output, streamedAll, streamedLast) {
+  const final = output ?? "";
+  if (final === "")
+    return;
+  if (streamedAll === "") {
+    process.stdout.write(`${final}
+`);
+    return;
+  }
+  const tail = final === streamedLast || final === streamedAll ? "" : final.startsWith(streamedAll) ? final.slice(streamedAll.length).replaceAll(/^\n+/u, "") : final;
+  if (tail !== "")
+    process.stdout.write(`${tail}
+`);
+}
+
+// src/cli/chat.ts
+var ACCOUNT_ID = "local";
+async function resolveWorkspace(raw) {
+  const path3 = isAbsolute6(raw) ? raw : resolve2(raw);
+  try {
+    const actual = await realpath6(path3);
+    const stat = await lstat9(actual);
+    if (!stat.isDirectory())
+      throw new Error("WORKSPACE_INVALID");
+    return actual;
+  } catch (error) {
+    if (error instanceof Error && error.message === "WORKSPACE_INVALID")
+      throw new Error(`not a directory: ${path3}`);
+    throw new Error(`workspace path does not exist: ${path3}`);
+  }
+}
+var HELP = `Commands:
+  /help       show this help
+  /new        start a new session
+  /sessions   list local sessions
+  /model <id> switch model (current session only)
+  /quit       exit
+
+Anything else is sent to the provider as a task. Ctrl-C cancels a running turn;
+Ctrl-D exits. Files stay inside the opened directory; the provider can only
+list, read, search and write through the brokered workspace tools.`;
+function describe(state, provider2) {
+  if (state.status === "ready")
+    return "";
+  if (state.detail !== undefined)
+    return state.detail;
+  if (state.status === "binary-missing")
+    return `${provider2} binary not found — install the provider CLI and run \`xcb-compat doctor\`.`;
+  if (state.status === "version-mismatch")
+    return `${provider2} ${state.inspection?.version} found but this build requires the pinned version — run \`xcb-compat doctor\`.`;
+  if (state.status === "sandbox-unavailable")
+    return "linux confinement unavailable — needs bubblewrap (`bwrap`) plus unprivileged user namespaces (Ubuntu 23.10+: `sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0`). Refusing to run unsandboxed.";
+  return `provider not admitted — run \`xcb-compat doctor\`, then \`xcb-compat auth ${provider2}\` if needed.`;
+}
+async function runCliChat(options) {
+  const { path: stateRoot } = await ensureCliState();
+  const sessions = await CliSessionStore.open(join13(stateRoot, "sessions"));
+  let workspacePath2;
+  let resumed = null;
+  if (options.sessionId !== undefined) {
+    resumed = sessions.get(options.sessionId);
+    if (resumed === null) {
+      process.stderr.write(`${red("xcb-compat:")} session not found.
+`);
+      sessions.close();
+      return 2;
+    }
+    try {
+      workspacePath2 = await resolveWorkspace(resumed.workspace);
+    } catch {
+      process.stderr.write(`${red("xcb-compat:")} session workspace is gone: ${resumed.workspace}
+`);
+      sessions.close();
+      return 2;
+    }
+  } else {
+    try {
+      workspacePath2 = await resolveWorkspace(options.workspace);
+    } catch (error) {
+      process.stderr.write(`${red("xcb-compat:")} ${error instanceof Error ? error.message : "invalid workspace"}
+`);
+      sessions.close();
+      return 2;
+    }
+  }
+  try {
+    assertWorkspaceStateSeparation(workspacePath2, stateRoot);
+  } catch (error) {
+    sessions.close();
+    throw error;
+  }
+  const providerName = options.provider ?? resumed?.provider ?? "claude";
+  if (resumed !== null && resumed.provider !== providerName) {
+    process.stderr.write(`${red("xcb-compat:")} session ${resumed.id} belongs to provider ${resumed.provider} — resume with \`--provider ${resumed.provider}\`.
+`);
+    sessions.close();
+    return 2;
+  }
+  await mkdir9(join13(stateRoot, "runs"), { mode: 448, recursive: true });
+  const leases = new SqliteAccountLeases(await openAccountDatabase(join13(stateRoot, "account-leases.sqlite")));
+  const web = createPublicWeb();
+  const workspace = createCliWorkspace(workspacePath2);
+  const profile = createCliWorkspaceProfile(workspace, { fetch: (url, signal) => web.fetchPublic(url, 256 * 1024, signal).then((r) => ({ text: r.text })) });
+  const events = {};
+  const opened = await openCliProvider(stateRoot, providerName, profile, events, { workspaceRoot: workspace.root });
+  if (opened.status !== "ready") {
+    process.stderr.write(`${red("xcb-compat:")} ${describe(opened, providerName)}
+`);
+    sessions.close();
+    return 2;
+  }
+  if (providerName === "claude") {
+    const auth = await claudeAuthStatus(stateRoot);
+    if (!auth.loggedIn) {
+      process.stderr.write(`${red("xcb-compat:")} not signed in — run ${bold("xcb-compat auth claude")} first.
+`);
+      sessions.close();
+      return 2;
+    }
+  }
+  if (providerName === "codex") {
+    const codexInspection = await inspectCliBinary("codex");
+    if (codexInspection !== null) {
+      const codex = await codexAuthStatus(stateRoot, codexInspection);
+      if (!codex.loggedIn) {
+        process.stderr.write(`${red("xcb-compat:")} not signed in — run ${bold("xcb-compat auth codex")} first.
+`);
+        sessions.close();
+        return 2;
+      }
+    }
+  }
+  if (providerName === "devin") {
+    const devinInspection = await inspectCliBinary("devin");
+    if (devinInspection !== null) {
+      const devin = await devinAuthStatus(stateRoot, devinInspection);
+      if (!devin.loggedIn) {
+        process.stderr.write(`${red("xcb-compat:")} not signed in — run ${bold("xcb-compat auth devin")} first.
+`);
+        sessions.close();
+        return 2;
+      }
+    }
+  }
+  const model = boundedText(options.model ?? (providerName === "claude" ? CLI_CLAUDE_DEFAULT_MODEL : providerName === "devin" ? CLI_DEVIN_DEFAULT_MODEL : CLI_CODEX_DEFAULT_MODEL), 160);
+  let session;
+  if (resumed !== null) {
+    session = resumed;
+  } else {
+    session = await sessions.create({ provider: providerName, accountId: ACCOUNT_ID, workspace: workspacePath2, model, now: Date.now() });
+  }
+  const editor = new LineEditor;
+  const turn = { controller: null };
+  editor.onInterrupt(() => turn.controller?.abort());
+  let currentModel = options.model ?? session.model;
+  process.stdout.write(`${bold("xcb")} ${dim("·")} ${cyan(providerName)} ${dim(currentModel)} ${dim("·")} ${workspacePath2}
+`);
+  process.stdout.write(dim(`session ${session.id} — /help for commands, Ctrl-D to exit
+
+`));
+  try {
+    for (;; ) {
+      const line = await editor.readLine("");
+      if (line === null)
+        break;
+      const text = line.trim();
+      if (text === "")
+        continue;
+      if (text.startsWith("/")) {
+        const [command, ...rest] = text.slice(1).split(/\s+/u);
+        if (command === "quit" || command === "exit")
+          break;
+        if (command === "help") {
+          process.stdout.write(`${HELP}
+
+`);
+          continue;
+        }
+        if (command === "new") {
+          session = await sessions.create({ provider: providerName, accountId: ACCOUNT_ID, workspace: workspacePath2, model: currentModel, now: Date.now() });
+          process.stdout.write(dim(`session ${session.id}
+
+`));
+          continue;
+        }
+        if (command === "sessions") {
+          for (const item of sessions.list(20)) {
+            process.stdout.write(`${item.id === session.id ? green("→") : " "} ${item.id}  ${dim(item.provider)}  ${dim(item.title || "(untitled)")}  ${dim(new Date(item.lastActiveAt).toISOString())}
+`);
+          }
+          process.stdout.write(`
+`);
+          continue;
+        }
+        if (command === "model") {
+          const next = rest.join(" ").trim();
+          if (next === "") {
+            process.stdout.write(dim(`model: ${currentModel}
+
+`));
+            continue;
+          }
+          currentModel = boundedText(next, 160);
+          process.stdout.write(dim(`model: ${currentModel} (new sessions keep their recorded model)
+
+`));
+          continue;
+        }
+        process.stdout.write(`${yellow("?")} unknown command /${boundedText(command ?? "", 32)} — /help
+
+`);
+        continue;
+      }
+      const controller = new AbortController;
+      turn.controller = controller;
+      const spinner = startSpinner(() => `${providerName} is thinking`);
+      let toolCalls = 0;
+      let streamedAll = "";
+      let streamedLast = "";
+      let providerError = null;
+      events.onAssistantText = (block) => {
+        spinner.stop();
+        if (!process.stdout.isTTY)
+          return;
+        streamedAll += (streamedAll === "" ? "" : `
+`) + block;
+        streamedLast = block;
+        process.stdout.write(`${block}
+`);
+      };
+      events.onProviderError = (text2) => {
+        providerError = text2;
+      };
+      try {
+        const prior = await sessions.transcript(session.id);
+        const { result, output } = await runCliTurn({
+          adapter: opened.adapter,
+          leases,
+          profile,
+          accountId: ACCOUNT_ID,
+          workspaceId: session.id,
+          model: currentModel,
+          prompt: text,
+          prior,
+          signal: controller.signal,
+          onTool: (name, input) => {
+            toolCalls += 1;
+            if (toolCalls <= 40) {
+              spinner.stop();
+              printTool(name, input);
+            }
+          }
+        });
+        spinner.stop();
+        const entries = [{ role: "user", text, at: Date.now() }];
+        if (output !== null)
+          entries.push({ role: "assistant", text: output, at: Date.now() });
+        session = await sessions.record(session, entries, Date.now());
+        if (result.outcome.status !== "completed") {
+          process.stdout.write(`${red("✗")} ${dim(boundedText(result.outcome.code ?? "run failed", 120))}
+`);
+          if (providerError !== null)
+            process.stdout.write(`${dim(providerError)}
+`);
+          process.stdout.write(`
+`);
+        } else {
+          printRemainingText(output, streamedAll, streamedLast);
+          process.stdout.write(`
+`);
+        }
+      } catch (error) {
+        spinner.stop();
+        const code = error instanceof Error ? boundedText(error.message, 160) : "CLI_RUN_FAILED";
+        process.stdout.write(`${red("✗")} ${dim(controller.signal.aborted ? "cancelled" : code)}
+`);
+        if (providerError !== null)
+          process.stdout.write(`${dim(providerError)}
+`);
+        process.stdout.write(`
+`);
+      } finally {
+        turn.controller = null;
+        events.onAssistantText = undefined;
+        events.onProviderError = undefined;
+      }
+    }
+  } finally {
+    editor.close();
+    if (opened.status === "ready" && opened.close !== undefined)
+      await opened.close().catch(() => {});
+    sessions.close();
+  }
+  return 0;
+}
+
+// src/cli.ts
+var VERSION = "0.9.1";
+var USAGE = `xcb-compat: the TypeScript compatibility CLI for xcb, which routes coding tasks
+across the Claude, Codex, and Devin subscriptions you already pay for
+(the native Rust CLI installs separately as \`xcb\`)
+
+Usage:
+  xcb-compat [path]            open the chat in a workspace (default: .)
+  xcb-compat auth claude       sign in with your Claude subscription
+  xcb-compat auth codex        sign in with your ChatGPT subscription
+  xcb-compat auth devin        sign in with your Devin account
+  xcb-compat auth status       show stored sign-in state
+  xcb-compat auth logout [p]   remove the stored credential (default: claude)
+  xcb-compat doctor            inspect provider binaries and admit this runtime
+  xcb-compat sessions          list local sessions
+  xcb-compat sessions rm <id>  remove one session and its transcript
+  xcb-compat sessions prune    remove sessions idle over 30 days (or N days)
+  xcb-compat resume [id]       continue a session (default: most recent)
+  xcb-compat run [-p text]     run one task headlessly (or pipe the task on stdin)
+  xcb-compat judge [status]    show judgment-provider (jev) state
+  xcb-compat judge token       store the jev API key read from stdin (piped, never echoed)
+  xcb-compat judge logout      remove the stored jev API key
+  xcb-compat judge test        ask the judge a bounded question batch (live call)
+  xcb-compat migrate           copy legacy AgentMixer state into ~/.xcb (keeps the original)
+  xcb-compat --version
+
+Options:
+  --provider <claude|codex|devin|auto>  pick the provider for run/chat/resume (default claude; resume uses session provider)
+  --model <id>                 model for this run or session
+  --cwd <path>                 workspace for run (default: current directory)
+
+Environment:
+  ${CLI_CLAUDE_ENV}    pin an exact claude executable path
+  ${CLI_CODEX_ENV}     pin an exact codex executable path
+  ${CLI_DEVIN_ENV}     pin an exact devin executable path
+  ${JUDGE_KEY_ENV}   jev API key (also ${JUDGE_KEY_VENDOR_ENV}); overrides the vaulted key
+  XCB_STATE     override the state root (default ~/.xcb)
+`;
+function parseFlags(args) {
+  const positional = [];
+  let provider2 = "claude", model, prompt, cwd;
+  for (let i = 0;i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--provider" || arg === "--model" || arg === "-p" || arg === "--cwd") {
+      const value = args[++i];
+      if (value === undefined)
+        fail8(`option ${arg} requires a value`);
+      if (arg === "--provider") {
+        if (value !== "claude" && value !== "codex" && value !== "devin" && value !== "auto") {
+          fail8(`unknown provider ${value} — supported: claude, codex, devin, auto`);
+        }
+        provider2 = value;
+      } else if (arg === "--model")
+        model = boundedText(value, 160);
+      else if (arg === "--cwd")
+        cwd = value;
+      else
+        prompt = boundedText(value, 512 * 1024);
+      continue;
+    }
+    if (arg.startsWith("--"))
+      fail8(`unknown option ${arg}`);
+    positional.push(arg);
+  }
+  return { provider: provider2, providerExplicit: args.includes("--provider"), model, positional, prompt, cwd };
+}
+var fail8 = (message) => {
+  process.stderr.write(`${red("xcb-compat:")} ${message}
+`);
+  process.exit(2);
+};
+async function cliProfileFor(workspace) {
+  const resolved = resolve3(workspace);
+  let actual;
+  try {
+    actual = await import("node:fs/promises").then((fs) => fs.realpath(resolved));
+  } catch {
+    fail8(`workspace path does not exist: ${resolved}`);
+  }
+  const ws = createCliWorkspace(actual);
+  const web = createPublicWeb();
+  const profile = createCliWorkspaceProfile(ws, { fetch: (url, signal) => web.fetchPublic(url, 262144, signal).then((r) => ({ text: r.text })) });
+  return { profile, workspace: ws };
+}
+var PROVIDER_PIN_ENV = { claude: CLI_CLAUDE_ENV, codex: CLI_CODEX_ENV, devin: CLI_DEVIN_ENV };
+async function commandDoctor(stateRoot) {
+  const { profile } = await cliProfileFor(process.cwd());
+  let admitted = 0;
+  for (const provider2 of ["claude", "codex", "devin"]) {
+    const admission = await admitCliProvider(stateRoot, provider2, profile);
+    if (admission.inspection === null) {
+      process.stdout.write(`${dim("○")} ${provider2}: not found (checked ${dim("$" + PROVIDER_PIN_ENV[provider2])}, PATH, known locations)
+`);
+      continue;
+    }
+    const detail = admission.record !== null ? green(admission.detail) : yellow(admission.detail);
+    process.stdout.write(`${admission.record !== null ? green("✓") : yellow("!")} ${provider2}: ${admission.inspection.version} ${dim(admission.inspection.sha256.slice(0, 16) + "…")} — ${detail}
+`);
+    if (admission.record !== null)
+      admitted += 1;
+  }
+  if (process.platform === "darwin") {
+    const seatbelt = await seatbeltAvailable();
+    process.stdout.write(`${seatbelt ? green("✓") : yellow("!")} sandbox: seatbelt ${seatbelt ? "available" : "unavailable"} ${dim("(claude runs confined; availability is not attestation)")}
+`);
+  }
+  const judgeKey = await resolveJudgeKey(stateRoot).catch(() => null);
+  let judgeBlocked = false;
+  if (judgeKey !== null) {
+    try {
+      checkJudgeKeyTarget(judgeKey.source, process.env[JUDGE_URL_ENV]);
+    } catch {
+      judgeBlocked = true;
+    }
+  }
+  process.stdout.write(`${judgeKey === null ? dim("○") : judgeBlocked ? yellow("!") : green("✓")} judge: ${judgeKey === null ? `no jev key — ${dim(`--provider auto\` needs one; pipe it into \`xcb-compat judge token\``)}` : judgeBlocked ? "blocked — vaulted key cannot be used with a custom endpoint" : `key from ${judgeKey.source} — ${dim("`--provider auto` can route")}`}
+`);
+  return admitted > 0 ? 0 : 1;
+}
+async function commandAuth(provider2, stateRoot) {
+  if (provider2 === "codex") {
+    const inspection2 = await inspectCliBinary("codex");
+    if (inspection2 === null)
+      return fail8("codex binary not found — install Codex CLI, then retry.");
+    if (!inspection2.versionMatches)
+      return fail8(`codex ${inspection2.version} found; this build admits only the pinned version — run \`xcb-compat doctor\`.`);
+    const status2 = await codexAuthStatus(stateRoot, inspection2);
+    if (!status2.admitted)
+      return fail8("codex is not admitted — run `xcb-compat doctor` first.");
+    if (status2.loggedIn) {
+      process.stdout.write(`${green("✓")} codex: already signed in (${status2.planType ?? "ChatGPT"})
+`);
+      return 0;
+    }
+    process.stdout.write(`${dim("Starting Codex device-code sign-in…")}
+`);
+    const snapshot = await codexLogin(stateRoot, inspection2, (challenge) => {
+      if (challenge.type === "chatgptDeviceCode") {
+        process.stdout.write(`
+Open ${challenge.verificationUrl} and enter code: ${challenge.userCode}
+
+`);
+      } else {
+        process.stdout.write(`
+Open ${challenge.authUrl} to sign in.
+
+`);
+      }
+    });
+    process.stdout.write(`${green("✓")} codex: signed in (${snapshot.planType ?? "ChatGPT"})
+`);
+    return 0;
+  }
+  if (provider2 === "devin") {
+    const inspection2 = await inspectCliBinary("devin");
+    if (inspection2 === null)
+      return fail8("devin binary not found — install the Devin CLI, then retry.");
+    if (!inspection2.versionMatches)
+      return fail8(`devin ${inspection2.version} found; this build requires devin >= ${CLI_DEVIN_MIN_VERSION} — run \`xcb-compat doctor\`.`);
+    const existing = await devinAuthStatus(stateRoot, inspection2);
+    if (existing.loggedIn) {
+      process.stdout.write(`${green("✓")} devin: already signed in (${existing.planType ?? "Devin"})
+`);
+      return 0;
+    }
+    process.stdout.write(`${dim("Opening Devin sign-in (credentials are stored under ~/.xcb only)…")}
+`);
+    await devinLogin(stateRoot, inspection2);
+    const status2 = await devinAuthStatus(stateRoot, inspection2);
+    if (!status2.loggedIn)
+      return fail8("sign-in did not produce credentials — re-run `xcb-compat auth devin`.");
+    process.stdout.write(`${green("✓")} devin: signed in (${status2.planType ?? "Devin"})
+`);
+    return 0;
+  }
+  if (provider2 !== "claude")
+    return fail8(`unknown provider ${provider2} — supported: claude, codex, devin`);
+  const inspection = await inspectCliBinary("claude");
+  if (inspection === null)
+    return fail8("claude binary not found — install Claude Code, then retry.");
+  if (!inspection.versionMatches)
+    return fail8(`claude ${inspection.version} found; this build admits only the pinned version — run \`xcb-compat doctor\`.`);
+  process.stdout.write(`${dim("Opening Claude sign-in (credentials are stored under ~/.xcb only)…")}
+`);
+  await claudeLogin(stateRoot, inspection);
+  const status = await claudeAuthStatus(stateRoot);
+  if (!status.loggedIn)
+    return fail8("sign-in did not produce credentials — re-run `xcb-compat auth claude`.");
+  process.stdout.write(`${green("✓")} signed in (${status.authMethod ?? "claude.ai"})
+`);
+  return 0;
+}
+async function commandAuthStatus(stateRoot) {
+  let any = false;
+  const claude = await claudeAuthStatus(stateRoot);
+  process.stdout.write(`claude: ${claude.loggedIn ? `signed in (${claude.authMethod ?? "claude.ai"})` : "signed out"}
+`);
+  if (claude.loggedIn)
+    any = true;
+  const codexInspection = await inspectCliBinary("codex");
+  if (codexInspection !== null) {
+    try {
+      const codex = await codexAuthStatus(stateRoot, codexInspection);
+      process.stdout.write(`codex: ${codex.loggedIn ? `signed in (${codex.planType ?? "ChatGPT"})` : codex.admitted ? "signed out" : "not admitted"}
+`);
+      if (codex.loggedIn)
+        any = true;
+    } catch {
+      process.stdout.write(`codex: error checking status
+`);
+    }
+  }
+  const devinInspection = await inspectCliBinary("devin");
+  if (devinInspection !== null) {
+    try {
+      const devin = await devinAuthStatus(stateRoot, devinInspection);
+      process.stdout.write(`devin: ${devin.loggedIn ? `signed in (${devin.planType ?? "Devin"})` : "signed out"}
+`);
+      if (devin.loggedIn)
+        any = true;
+    } catch {
+      process.stdout.write(`devin: error checking status
+`);
+    }
+  }
+  return any ? 0 : 1;
+}
+async function commandAuthLogout(provider2, stateRoot) {
+  if (provider2 === "codex") {
+    const inspection = await inspectCliBinary("codex");
+    if (inspection === null)
+      return fail8("codex binary not found.");
+    await codexLogout(stateRoot, inspection);
+    process.stdout.write(`codex: signed out
+`);
+    return 0;
+  }
+  if (provider2 === "devin") {
+    const inspection = await inspectCliBinary("devin");
+    if (inspection === null)
+      return fail8("devin binary not found.");
+    await devinLogout(stateRoot, inspection);
+    process.stdout.write(`devin: signed out
+`);
+    return 0;
+  }
+  if (provider2 !== undefined && provider2 !== "claude")
+    return fail8(`unknown provider ${provider2} — supported: claude, codex, devin`);
+  await clearClaudeOAuthToken(stateRoot);
+  process.stdout.write(`claude: signed out
+`);
+  return 0;
+}
+async function commandJudge(sub, stateRoot) {
+  if (sub === "token") {
+    if (process.stdin.isTTY)
+      fail8("usage: pipe the jev API key on stdin — e.g. `pbpaste | xcb-compat judge token` (never a command argument).");
+    const key2 = (await readStdin()).trim();
+    if (key2 === "")
+      fail8("empty input — pipe the jev API key on stdin.");
+    await storeJudgeKey(stateRoot, key2).catch((error) => {
+      if (error instanceof Error && error.message === "JUDGE_KEY_EXISTS") {
+        fail8("a jev key is already stored — run `xcb-compat judge logout` first to replace it.");
+      }
+      if (error instanceof Error && error.message === "JUDGE_KEY_INVALID") {
+        fail8("that does not look like a jev API key — check the copied value.");
+      }
+      throw error;
+    });
+    process.stdout.write(`${green("✓")} judge key stored in ${join14(stateRoot, JUDGE_TOKEN_FILE)} (mode 0600)
+`);
+    return 0;
+  }
+  if (sub === "logout") {
+    const removed = await removeJudgeKey(stateRoot);
+    process.stdout.write(removed ? `judge key removed
+` : `no stored judge key
+`);
+    return 0;
+  }
+  if (sub === "test") {
+    const judge = await resolveJudge({ stateRoot, enabled: true });
+    if (judge === null) {
+      return fail8(`no jev API key — pipe one into \`xcb-compat judge token\` or set ${JUDGE_KEY_ENV}.`);
+    }
+    const started = Date.now();
+    const answers = await judge.ask("xcb-compat judge connectivity probe", {
+      probe: { type: "noul", instructions: "Is the sky blue on a clear day?" },
+      pick: { type: "choice", instructions: "Which option names a color?", criteria: { red: "a color", spoon: "not a color" } },
+      rate: { type: "score", instructions: "How true is the claim that water is wet? Rate on the ordered criteria scale.", criteria: ["false", "partly true", "true"] }
+    });
+    const probe = answers.answers.probe, pick = answers.answers.pick, rate = answers.answers.rate;
+    if (probe?.type !== "noul" || pick?.type !== "choice" || rate?.type !== "score") {
+      return fail8("judge returned a malformed answer shape.");
+    }
+    process.stdout.write(`${green("✓")} judge answered in ${Date.now() - started}ms ${dim(`(model ${answers.model ?? "unknown"}, p=${probe.noul.toFixed(3)}, choice=${pick.choice}@${pick.confidence.toFixed(3)}, score=${rate.score.toFixed(3)}@${rate.confidence.toFixed(3)})`)}
+`);
+    return 0;
+  }
+  if (sub !== undefined && sub !== "status")
+    return fail8("usage: xcb-compat judge [status|token|logout|test]");
+  const key = await resolveJudgeKey(stateRoot).catch(() => null);
+  if (key !== null) {
+    try {
+      checkJudgeKeyTarget(key.source, process.env[JUDGE_URL_ENV]);
+    } catch {
+      return fail8("vaulted judge key is bound to the canonical System One endpoint; use an environment key for a custom endpoint.");
+    }
+  }
+  const vaulted = await hasJudgeKey(stateRoot);
+  const source = key === null ? "none" : key.source === "env" ? "environment" : "vault";
+  process.stdout.write(`judge: ${key === null ? "no key configured" : `key from ${source}`}${vaulted && key?.source !== "vault" ? dim(" (vault file also present)") : ""}
+`);
+  process.stdout.write(`${dim("  env: ")}${JUDGE_KEY_ENV} or ${JUDGE_KEY_VENDOR_ENV}${dim("  vault: ")}${join14(stateRoot, JUDGE_TOKEN_FILE)}
+`);
+  process.stdout.write(`${dim("  use --provider auto on `xcb-compat run` to route a task through the judge")}
+`);
+  return key === null ? 1 : 0;
+}
+async function latestSessionId(stateRoot) {
+  const sessions = await CliSessionStore.open(join14(stateRoot, "sessions"));
+  try {
+    return sessions.list(1)[0]?.id;
+  } finally {
+    sessions.close();
+  }
+}
+async function commandSessions(stateRoot, rest) {
+  const [sub, ...args] = rest;
+  const sessions = await CliSessionStore.open(join14(stateRoot, "sessions"));
+  try {
+    if (sub === undefined) {
+      for (const session of sessions.list(64)) {
+        process.stdout.write(`${session.id}  ${dim(session.provider)}  ${dim(session.model)}  ${session.title || "(untitled)"}  ${dim(new Date(session.lastActiveAt).toISOString())}
+`);
+      }
+      return 0;
+    }
+    if (sub === "rm") {
+      if (args.length !== 1)
+        return fail8("usage: xcb-compat sessions rm <id>");
+      if (!await sessions.remove(args[0]))
+        return fail8(`session not found: ${args[0]}`);
+      process.stdout.write(`removed ${args[0]}
+`);
+      return 0;
+    }
+    if (sub === "prune") {
+      if (args.length > 1)
+        return fail8("usage: xcb-compat sessions prune [days]");
+      const days = args[0] === undefined ? 30 : Number(args[0]);
+      if (!Number.isInteger(days) || days < 1 || days > 3650)
+        return fail8(`invalid days: ${args[0]}`);
+      const removed = await sessions.prune(Date.now() - days * 86400000);
+      process.stdout.write(`pruned ${removed} session${removed === 1 ? "" : "s"} idle over ${days} day${days === 1 ? "" : "s"}
+`);
+      return 0;
+    }
+    return fail8(`unknown sessions subcommand ${sub} — supported: rm, prune`);
+  } finally {
+    sessions.close();
+  }
+}
+async function autoProviderCandidates(stateRoot) {
+  const candidates = [];
+  for (const provider2 of ["claude", "codex"]) {
+    if (provider2 === "codex" && cliCodexHostDiagnostic() !== null)
+      continue;
+    const inspection = await inspectCliBinary(provider2);
+    if (inspection === null || !inspection.versionMatches)
+      continue;
+    const record2 = await readCliQualification(stateRoot, provider2);
+    if (record2 === null || record2.executableSha256 !== inspection.sha256 || record2.executablePath !== inspection.executablePath)
+      continue;
+    const authed = provider2 === "claude" ? (await claudeAuthStatus(stateRoot)).loggedIn : (await codexAuthStatus(stateRoot, inspection)).loggedIn;
+    if (authed)
+      candidates.push({ provider: provider2, label: `${provider2} ${inspection.version}` });
+  }
+  return candidates;
+}
+async function routeAutoProvider(stateRoot, prompt) {
+  const candidates = await autoProviderCandidates(stateRoot);
+  if (candidates.length === 0)
+    fail8("no admitted, signed-in providers — run `xcb-compat doctor` and `xcb-compat auth <provider>` first.");
+  if (candidates.length === 1)
+    return candidates[0].provider;
+  const judge = await resolveJudge({ stateRoot, enabled: true });
+  if (judge === null) {
+    return fail8(`--provider auto needs a jev API key — pipe one into \`xcb-compat judge token\` or set ${JUDGE_KEY_ENV}.`);
+  }
+  const criteria = {};
+  candidates.forEach((candidate, index) => {
+    criteria[`route_${index}`] = candidate.label;
+  });
+  let answers;
+  try {
+    answers = await judge.ask({ task: boundedText(prompt, 32768) }, {
+      route: {
+        type: "choice",
+        instructions: "Choose the best coding-agent provider for this task. Consider reliability for the task's apparent complexity. Return exactly one option key.",
+        criteria
+      }
+    });
+  } catch (error) {
+    return fail8(`judge routing failed: ${error instanceof Error ? error.message : "unknown error"}`);
+  }
+  const answer = answers.answers.route;
+  if (answer === undefined || answer.type !== "choice" || !(answer.choice in criteria)) {
+    return fail8("judge routing failed: the judge returned no usable choice — pick a provider explicitly.");
+  }
+  const winner = candidates[Number(answer.choice.slice("route_".length))];
+  process.stderr.write(`${dim(`judge routed to ${winner.provider} (${winner.label})`)}
+`);
+  return winner.provider;
+}
+async function commandRun(prompt, workspace, stateRoot, provider2, model) {
+  const prepared = await cliProfileFor(workspace);
+  assertWorkspaceStateSeparation(prepared.workspace.root, stateRoot);
+  const { profile, workspace: ws } = prepared;
+  if (provider2 === "auto")
+    provider2 = await routeAutoProvider(stateRoot, prompt);
+  const events = {};
+  const opened = await openCliProvider(stateRoot, provider2, profile, events, { workspaceRoot: ws.root });
+  if (opened.status !== "ready")
+    return fail8(opened.detail ?? `provider not admitted — run \`xcb-compat doctor\` and \`xcb-compat auth ${provider2}\` first.`);
+  if (provider2 === "claude") {
+    const auth = await claudeAuthStatus(stateRoot);
+    if (!auth.loggedIn)
+      return fail8("not signed in — run `xcb-compat auth claude` first.");
+  }
+  if (provider2 === "codex") {
+    const inspection = await inspectCliBinary("codex");
+    if (inspection !== null) {
+      const codex = await codexAuthStatus(stateRoot, inspection);
+      if (!codex.loggedIn)
+        return fail8("not signed in — run `xcb-compat auth codex` first.");
+    }
+  }
+  if (provider2 === "devin") {
+    const inspection = await inspectCliBinary("devin");
+    if (inspection !== null) {
+      const devin = await devinAuthStatus(stateRoot, inspection);
+      if (!devin.loggedIn)
+        return fail8("not signed in — run `xcb-compat auth devin` first.");
+    }
+  }
+  const leases = new SqliteAccountLeases(await openAccountDatabase(join14(stateRoot, "account-leases.sqlite")));
+  const sessions = await CliSessionStore.open(join14(stateRoot, "sessions"));
+  const runModel = model ?? (provider2 === "claude" ? CLI_CLAUDE_DEFAULT_MODEL : provider2 === "devin" ? CLI_DEVIN_DEFAULT_MODEL : CLI_CODEX_DEFAULT_MODEL);
+  let streamedAll = "", streamedLast = "", providerError = null;
+  events.onAssistantText = (block) => {
+    if (!process.stdout.isTTY)
+      return;
+    streamedAll += (streamedAll === "" ? "" : `
+`) + block;
+    streamedLast = block;
+    process.stdout.write(`${block}
+`);
+  };
+  events.onProviderError = (text) => {
+    providerError = text;
+  };
+  try {
+    const session = await sessions.create({ provider: provider2, accountId: "local", workspace: resolve3(workspace), model: runModel, now: Date.now() });
+    const { result, output } = await runCliTurn({
+      adapter: opened.adapter,
+      leases,
+      profile,
+      accountId: "local",
+      workspaceId: session.id,
+      model: runModel,
+      prompt,
+      prior: [],
+      signal: AbortSignal.timeout(600000),
+      onTool: (name) => process.stderr.write(dim(`  ⚙ ${name}
+`))
+    });
+    printRemainingText(output, streamedAll, streamedLast);
+    if (result.outcome.status !== "completed") {
+      process.stderr.write(`${red("xcb-compat:")} ${result.outcome.code ?? "run failed"}${providerError === null ? "" : ` — ${providerError}`}
+`);
+      return 1;
+    }
+    await sessions.record(session, [
+      { role: "user", text: prompt, at: Date.now() },
+      ...output === null ? [] : [{ role: "assistant", text: output, at: Date.now() }]
+    ], Date.now());
+    return 0;
+  } finally {
+    sessions.close();
+  }
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function main(argv) {
+  const [command, ...rest] = argv;
+  if (command === "--help" || command === "help" || command === "-h") {
+    process.stdout.write(USAGE);
+    return 0;
+  }
+  if (command === "--version" || command === "-v") {
+    process.stdout.write(`${VERSION}
+`);
+    return 0;
+  }
+  if (typeof Bun === "undefined" && (Number(process.versions.node?.split(".")[0]) || 0) < 24) {
+    return fail8("requires node ≥ 24 or bun ≥ 1.3.14");
+  }
+  const { path: stateRoot } = await ensureCliState();
+  if (command === "migrate") {
+    if (rest.length !== 0)
+      return fail8("usage: xcb-compat migrate");
+    const migrated = await migrateLegacyState(stateRoot);
+    process.stdout.write(`${green("✓")} migrated ${migrated.entries} entries from ${migrated.source}
+`);
+    process.stdout.write(`${dim("the legacy directory was left untouched — remove it yourself when ready")}
+`);
+    return 0;
+  }
+  if (command === "doctor")
+    return await commandDoctor(stateRoot);
+  if (command === "auth") {
+    const sub = rest[0];
+    if (sub === undefined || sub === "status")
+      return await commandAuthStatus(stateRoot);
+    if (sub === "logout")
+      return await commandAuthLogout(rest[1], stateRoot);
+    if (rest.length > 1)
+      return fail8("usage: xcb-compat auth <claude|codex|status|logout [provider]>");
+    return await commandAuth(sub, stateRoot);
+  }
+  if (command === "judge") {
+    if (rest.length > 1)
+      return fail8("usage: xcb-compat judge [status|token|logout|test]");
+    return await commandJudge(rest[0], stateRoot);
+  }
+  if (command === "sessions")
+    return await commandSessions(stateRoot, rest);
+  if (command === "run") {
+    const flags2 = parseFlags(rest);
+    let prompt = flags2.prompt ?? (flags2.positional.length ? flags2.positional.join(" ") : undefined);
+    if (prompt === undefined || prompt.trim() === "") {
+      if (process.stdin.isTTY)
+        fail8("usage: xcb-compat run -p <task>  (or pipe the task on stdin)");
+      prompt = await readStdin();
+    }
+    return await commandRun(boundedText(prompt, 524288), flags2.cwd ?? process.cwd(), stateRoot, flags2.provider, flags2.model);
+  }
+  if (command === "resume") {
+    const flags2 = parseFlags(rest);
+    const provider3 = flags2.provider === "auto" ? fail8("--provider auto routes a known task — use it with `xcb-compat run`; a chat session binds one provider up front.") : flags2.provider;
+    if (flags2.positional.length > 1)
+      return fail8("usage: xcb-compat resume [session-id]");
+    const id = flags2.positional[0] ?? await latestSessionId(stateRoot);
+    if (id === undefined)
+      return fail8("no sessions yet — start one with `xcb-compat`");
+    return await runCliChat({ workspace: process.cwd(), sessionId: id, ...flags2.providerExplicit ? { provider: provider3 } : {}, ...flags2.model === undefined ? {} : { model: flags2.model } });
+  }
+  const chatArgv = command === "chat" ? rest : argv;
+  const flags = parseFlags(chatArgv);
+  const provider2 = flags.provider === "auto" ? fail8("--provider auto routes a known task — use it with `xcb-compat run`; a chat session binds one provider up front.") : flags.provider;
+  if (flags.prompt !== undefined)
+    return fail8("-p is only valid with `xcb-compat run`");
+  const workspace = flags.positional[0] ?? ".";
+  if (flags.positional.length > 1)
+    return fail8("usage: xcb-compat [path]");
+  return await runCliChat({ workspace, provider: provider2, ...flags.model === undefined ? {} : { model: flags.model } });
+}
+main(process.argv.slice(2)).then((code) => process.exit(code), (error) => {
+  process.stderr.write(`${red("xcb-compat:")} ${error instanceof Error ? error.message : "unexpected failure"}
+`);
+  process.exit(1);
+});
+export {
+  main
+};