@jungjaehoon/mama-core 2.4.1 → 4.1.0

package/dist/runtime/drivers/cli-secret-redaction.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretRedactingStream = void 0;
+exports.configuredSecretValues = configuredSecretValues;
+exports.redactConfiguredSecrets = redactConfiguredSecrets;
+exports.claudeConfiguredSecrets = claudeConfiguredSecrets;
+const node_fs_1 = require("node:fs");
+const node_string_decoder_1 = require("node:string_decoder");
+function configuredSecretValues(launch) {
+    const names = new Set();
+    const addJsonString = (source) => {
+        try {
+            const name = JSON.parse(source);
+            if (typeof name === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+                names.add(name);
+            }
+        }
+        catch (error) {
+            throw new Error('Codex app-server launch config contained malformed environment quoting', {
+                cause: error,
+            });
+        }
+    };
+    for (const argument of launch.args) {
+        for (const match of argument.matchAll(/env_vars\s*=\s*\[([^\]]*)\]/g)) {
+            for (const quoted of match[1].matchAll(/"(?:\\.|[^"\\])*"/g)) {
+                addJsonString(quoted[0]);
+            }
+        }
+        for (const match of argument.matchAll(/bearer_token_env_var\s*=\s*("(?:\\.|[^"\\])*")/g)) {
+            addJsonString(match[1]);
+        }
+        for (const match of argument.matchAll(/env_http_headers\s*=\s*\{([^}]*)\}/g)) {
+            for (const binding of match[1].matchAll(/=\s*("(?:\\.|[^"\\])*")/g)) {
+                addJsonString(binding[1]);
+            }
+        }
+    }
+    const values = new Set();
+    for (const name of names) {
+        const value = launch.env[name];
+        if (typeof value === 'string' && value.length > 0) {
+            values.add(value);
+        }
+    }
+    return values;
+}
+/** Exact configured values, never an entropy/token-length guess. */
+function redactConfiguredSecrets(value, secrets) {
+    for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {
+        if (secret)
+            value = value.split(secret).join('[REDACTED]');
+    }
+    return value;
+}
+function claudeConfiguredSecrets(configPath, env) {
+    const values = new Set();
+    const add = (value) => {
+        if (typeof value === 'string' && value)
+            values.add(value);
+    };
+    for (const [name, value] of Object.entries(env)) {
+        if (name !== 'MAX_THINKING_TOKENS' && /(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/i.test(name))
+            add(value);
+    }
+    if (!configPath)
+        return values;
+    let config;
+    try {
+        config = JSON.parse((0, node_fs_1.readFileSync)(configPath, 'utf8'));
+    }
+    catch {
+        throw new Error('Native MCP secret configuration could not be read');
+    }
+    for (const server of Object.values(config.mcpServers ?? {})) {
+        for (const value of Object.values(server.env ?? {}))
+            add(value);
+        for (const value of Object.values(server.headers ?? {}))
+            add(value);
+        for (const value of Object.values(server.http_headers ?? {}))
+            add(value);
+        for (const name of [
+            ...(server.env_vars ?? []),
+            ...Object.values(server.env_http_headers ?? {}),
+        ])
+            add(env[name]);
+        if (server.bearer_token_env_var)
+            add(env[server.bearer_token_env_var]);
+    }
+    return values;
+}
+/** Keep the possible credential suffix until the next chunk (including UTF-8 boundaries). */
+class SecretRedactingStream {
+    secrets;
+    emit;
+    pending = '';
+    decoder = new node_string_decoder_1.StringDecoder('utf8');
+    overlap;
+    constructor(secrets, emit) {
+        this.secrets = secrets;
+        this.emit = emit;
+        this.overlap = Math.max(0, ...[...secrets].map((secret) => secret.length - 1));
+    }
+    write(chunk) {
+        this.pending += this.decoder.write(chunk);
+        let cut = Math.max(0, this.pending.length - this.overlap);
+        // Never split a complete match at the output boundary.
+        for (const secret of this.secrets) {
+            for (let start = this.pending.indexOf(secret); secret && start !== -1; start = this.pending.indexOf(secret, start + 1)) {
+                if (start < cut && start + secret.length > cut)
+                    cut = start;
+            }
+        }
+        if (cut)
+            this.emit(redactConfiguredSecrets(this.pending.slice(0, cut), this.secrets));
+        this.pending = this.pending.slice(cut);
+    }
+    end() {
+        this.pending += this.decoder.end();
+        if (this.pending)
+            this.emit(redactConfiguredSecrets(this.pending, this.secrets));
+        this.pending = '';
+    }
+}
+exports.SecretRedactingStream = SecretRedactingStream;
+//# sourceMappingURL=cli-secret-redaction.js.map

package/dist/runtime/drivers/codex-app-server-process.d.ts

@@ -0,0 +1,277 @@
+import { type HostToolBridge, type PromptResult, type NativeInputReceipt, type SessionPolicyStatus } from './types.js';
+import { type PromptCallbacks, type PromptOptions } from './types.js';
+export interface CodexAppServerProcessOptions {
+    /**
+     * The product's own root directory. A driver does not know what a product
+     * calls its home; the caller states it and the driver keeps its files there.
+     */
+    /**
+     * Where this run keeps its files. Required: a driver does not know a product's
+     * directory name, and the default it used to compute spelled one out.
+     */
+    hostRootDir: string;
+    sessionKey: string;
+    model: string;
+    systemPrompt: string;
+    cwd: string;
+    sandbox: 'read-only' | 'workspace-write' | 'danger-full-access';
+    command?: string;
+    requestTimeout?: number;
+    codexHome?: string;
+    isolatedHome?: string;
+    registryRoot?: string;
+    mcpConfigPath?: string;
+    /**
+     * Where the consumer's own Codex CLI keeps its credential, copied into the managed
+     * home so the isolated runtime can authenticate.
+     *
+     * The driver used to look for it under the user's home directory. That is a fact
+     * about whoever installed a CLI, not about this driver, and a core that goes looking
+     * for one consumer's dotfile is not shared. Absent means no credential is copied -
+     * the managed home keeps whatever it already had.
+     */
+    authSourcePath?: string;
+    /** Managed `model_reasoning_effort`; unset means the built-in default, unknown values throw. */
+    effort?: string;
+    /** Enable the managed workspace shell; disabled unless the consumer opts in. */
+    shellTool?: boolean;
+    /** Enable live web search; disabled unless the consumer opts in. */
+    webSearch?: boolean;
+    /** Explicit shell environment overrides; does not replace the app-server's isolated HOME. */
+    shellEnvironment?: Record<string, string>;
+    /** Complete backend environment; omitted retains normal process inheritance. */
+    processEnv?: NodeJS.ProcessEnv;
+    /** Absolute credential paths the native command sandbox must not read. */
+    deniedReadPaths?: string[];
+    allowLoginShell?: boolean;
+    /** Stable identity/rules fingerprint; dynamic conversation context must be excluded. */
+    policyFingerprint?: string;
+    /** Observability sink for Codex-native subagent threads spawned by a parent turn. */
+    onSubagentEvent?: (event: SubagentEvent) => void;
+    /**
+     * Host factory for a CHILD-SCOPED authority. A child outlives the parent turn, so it
+     * must never inherit the parent's snapshot bridge (whose envelope expires with the
+     * parent wall). Called once per announced child; the child's tool calls are queued
+     * until it resolves. `null` (or no factory at all) means the child has no authority
+     * and every call it makes is refused with `subagent authority unavailable`.
+     */
+    createSubagentBridge?: (info: SubagentBridgeRequest) => Promise<SubagentBridge | null>;
+    /**
+     * Grace after the PARENT announced a child completed before the child's missing own
+     * `turn/completed` is reported as `unknown`. Test seam; the default is 5s.
+     */
+    subagentGraceMs?: number;
+    /** Bounded life of a registered child; a child Codex killed must not leak. */
+    subagentTtlMs?: number;
+}
+import type { SubagentBridge, SubagentBridgeRequest } from '../subagent-bridge.js';
+export type { SubagentBridge, SubagentBridgeRequest } from '../subagent-bridge.js';
+/**
+ * One Codex-native subagent thread, observed from the parent thread.
+ *
+ * Codex announces children on the PARENT thread as `subAgentActivity` items and then
+ * drives the child on ITS OWN thread id - including after the parent turn completed.
+ * These events only report that; they never gate the child.
+ */
+export interface SubagentEvent {
+    kind: 'started' | 'completed';
+    /** The PARENT's session key; a child never owns a session of its own. */
+    sessionKey: string;
+    parentThreadId: string;
+    agentThreadId: string;
+    /** Codex agent path, e.g. "/root/board". */
+    agentPath: string;
+    /**
+     * Completion events only. `unknown` is the honest verdict when the parent announced a
+     * completion and the child's own `turn/completed` never arrived: no result, no failure
+     * either. It must never be rendered as success.
+     */
+    status?: 'completed' | 'failed' | 'interrupted' | 'unknown';
+    /** Last `final_answer` agentMessage text seen on the child thread, bounded. */
+    finalText?: string;
+    /** Redacted failure message; failed child turns only. */
+    error?: string;
+}
+export interface CodexAppServerPromptOptions {
+    preparePrompt?: PromptOptions['preparePrompt'];
+    nativeInputId?: string;
+    /**
+     * Per-run counted-token budget (input + output; codex reports input INCLUSIVE of cache,
+     * so cache reads are not added again). A codex turn is a whole
+     * agentic loop of model calls, so the budget is checked on every usage event INSIDE the
+     * turn and the turn is interrupted when it crosses; AgentLoop's per-turn check would only
+     * see the total after the turn ended (0.43.0 stopped board runs one turn too late).
+     */
+    runTokenBudget?: number;
+    sessionKey?: string;
+    model?: string;
+    systemPrompt?: string;
+    cwd?: string;
+    sandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
+    /** Restrict this thread's model tools to explicitly stated readable roots. */
+    restrictedReadRoots?: readonly string[];
+    requestTimeout?: number;
+    policyFingerprint?: string;
+    resumeSession?: boolean;
+    hostToolBridge?: HostToolBridge;
+    /**
+     * Full instructions to re-supply when this call has to resume a durable thread.
+     * `thread/resume` accepts `baseInstructions` (ThreadResumeParams), so a rehydrated
+     * thread can be re-anchored through the protocol instead of the turn-text
+     * `<system-reminder>` workaround. Lazy on purpose: rebuilding the composed prompt
+     * costs an embedding search, and a live thread never resumes - the callback runs
+     * only inside the resume branch. Omit it to keep the legacy bootstrap behaviour.
+     */
+    resumeInstructions?: () => Promise<string>;
+    /** Measurement only: host lane and brief state for the per-turn [prompt] log line. */
+    promptTelemetry?: {
+        kind: string;
+        brief: 'sent' | 'omitted';
+    };
+}
+export declare class CodexAppServerProcess {
+    private readonly options;
+    private readonly registry;
+    private child;
+    private stdout;
+    private stderr;
+    private nextId;
+    private pending;
+    private lateTurnStarts;
+    private turnStartReconciliations;
+    private turns;
+    private readonly subagents;
+    /**
+     * Child threads that already reported a terminal status. The SAME `started`
+     * announcement arrives as both an item/started and an item/completed view, and the
+     * second view can land after the child's own turn/completed - `subagents.has` no longer
+     * dedupes it then, so it would mint a second authority and a second completion for a
+     * dead child. Bounded FIFO: identity of recent children, not a growing ledger.
+     */
+    private readonly finishedSubagents;
+    private readonly threadContexts;
+    private sessions;
+    private sessionQueues;
+    private connectionQueue;
+    private startPromise;
+    private shutdownPromise;
+    private stopped;
+    private stderrTail;
+    private secrets;
+    private authFingerprint;
+    private authFingerprintInitialized;
+    private authSourceSignature;
+    private managedConfigFingerprint;
+    private managedConfigSignature;
+    private secretLaunchFingerprint;
+    private secretLaunchFingerprintInitialized;
+    private killTimer;
+    private finalKillTimer;
+    constructor(options: CodexAppServerProcessOptions);
+    prompt(text: string, callbacks?: PromptCallbacks, overrides?: CodexAppServerPromptOptions): Promise<PromptResult>;
+    /** Append input to this exact native turn; never queue behind it or start a replacement. */
+    steer(text: string, target: NativeInputReceipt, sessionKey?: string, beforeSend?: () => void): Promise<NativeInputReceipt>;
+    reset(sessionKey?: string): Promise<void>;
+    getSessionPolicyStatus(overrides?: CodexAppServerPromptOptions): SessionPolicyStatus;
+    stop(): Promise<void>;
+    executeSandboxedCommand(command: string, cwd: string, roots: readonly string[], signal?: AbortSignal): Promise<{
+        exitCode: number;
+        stdout: string;
+        stderr: string;
+    }>;
+    getThreadId(sessionKey?: string): string | undefined;
+    getStatus(): {
+        running: boolean;
+        childPid?: number;
+        pendingRequestCount: number;
+        hasActiveTurn: boolean;
+        stdoutListenerCount: number;
+        stderrListenerCount: number;
+        shutdownTimerActive: boolean;
+    };
+    private resolveSessionPolicy;
+    private enqueueSession;
+    private prepareConnection;
+    private assertRegistryPolicy;
+    private registryPolicyMatches;
+    private prepareManagedFiles;
+    private ensureStarted;
+    private start;
+    private openThread;
+    private policyFingerprint;
+    /** Restrict Codex-native child creation only for a thread with a stated read boundary. */
+    private threadConfig;
+    private validateInstructionMetadata;
+    private validateResponsePolicy;
+    private startTurn;
+    private request;
+    private requestOnce;
+    private notify;
+    private handleLine;
+    private handleNotification;
+    private resolveTurn;
+    /** Returns true when this notification belongs to the subagent surface and was consumed. */
+    private observeNativeItem;
+    private handleSubagentNotification;
+    private subagentFinalText;
+    /** A working child keeps the parent's idle timeout alive (the parent may be in wait_agent). */
+    private refreshParentTurnIdleTimeout;
+    /** Drop every thread context this session left behind on a previous thread id. */
+    private pruneThreadContexts;
+    private knownThreadIds;
+    private registerSubagent;
+    /**
+     * The parent says a child finished. That is an announcement, not a result: it can win
+     * the race against the child's own `turn/completed`, which is what carries status and
+     * final text. Wait a bounded grace for the real event, then report `unknown`.
+     */
+    private observeParentSideCompletion;
+    /**
+     * Emits exactly one completion per child thread and releases its authority with the
+     * same terminal status. Grandchildren keep their own entries.
+     */
+    private finishSubagent;
+    private deliverSubagentCompletion;
+    /** FIFO-bounded identity of finished children; the oldest id is forgotten first. */
+    private rememberFinishedSubagent;
+    private clearSubagentTimers;
+    private emitSubagentEvent;
+    /** Every live child is reported interrupted and its authority released. */
+    private terminateSubagents;
+    /** A reset/restart drops the thread's context and interrupts its children. */
+    private discardSessionThreadState;
+    private handleSubagentToolRequest;
+    private dispatchSubagentToolCall;
+    private reportSubagentToolComplete;
+    private isSubagentToolActive;
+    private handleServerRequest;
+    private handleDynamicToolRequest;
+    private failToolProtocol;
+    private requiredToolString;
+    private dispatchDynamicToolCall;
+    private isToolTurnActive;
+    private toolResult;
+    private replyDisabledTool;
+    private replyToolError;
+    private reply;
+    private handleStderr;
+    private redact;
+    private toError;
+    private refreshTurnIdleTimeout;
+    private failTurn;
+    /** Interrupt a turn whose counted usage crossed its run budget; the loop reports stoppedBy. */
+    private enforceTurnBudget;
+    private timeoutTurn;
+    private getOrCreateTurnStartReconciliation;
+    private completeTurnStartReconciliation;
+    private reconcileAcknowledgedTurn;
+    private handleLateTurnStartResponse;
+    private clearTurnCallbacks;
+    private failAll;
+    private failProcess;
+    private restart;
+    private shutdown;
+    private performShutdown;
+    private detach;
+}
+//# sourceMappingURL=codex-app-server-process.d.ts.map