@kbediako/codex-orchestrator 0.1.37 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (302) hide show
  1. package/.agents/plugins/marketplace.json +20 -0
  2. package/README.md +73 -291
  3. package/bin/codex-orchestrator.js +161 -0
  4. package/codex.orchestrator.json +149 -13
  5. package/dist/bin/codex-orchestrator.js +795 -1154
  6. package/dist/orchestrator/src/cli/adapters/CommandPlanner.js +22 -4
  7. package/dist/orchestrator/src/cli/adapters/CommandReviewer.js +3 -3
  8. package/dist/orchestrator/src/cli/adapters/CommandTester.js +2 -2
  9. package/dist/orchestrator/src/cli/adapters/cloudFailureDiagnostics.js +183 -11
  10. package/dist/orchestrator/src/cli/coStatusAttachCliShell.js +402 -0
  11. package/dist/orchestrator/src/cli/coStatusCliShell.js +429 -0
  12. package/dist/orchestrator/src/cli/coStatusOperatorAutopilotCliShell.js +120 -0
  13. package/dist/orchestrator/src/cli/codexCliShell.js +72 -0
  14. package/dist/orchestrator/src/cli/codexDefaultsSetup.js +49 -11
  15. package/dist/orchestrator/src/cli/config/delegationConfig.js +317 -5
  16. package/dist/orchestrator/src/cli/config/repoConfigPolicy.js +2 -3
  17. package/dist/orchestrator/src/cli/config/userConfig.js +28 -13
  18. package/dist/orchestrator/src/cli/control/authenticatedControlRouteGate.js +69 -0
  19. package/dist/orchestrator/src/cli/control/authenticatedRouteComposition.js +267 -0
  20. package/dist/orchestrator/src/cli/control/authenticatedRouteController.js +5 -0
  21. package/dist/orchestrator/src/cli/control/authenticatedRouteDispatcher.js +41 -0
  22. package/dist/orchestrator/src/cli/control/compatibilityIssuePresenter.js +1035 -0
  23. package/dist/orchestrator/src/cli/control/confirmationApproveController.js +62 -0
  24. package/dist/orchestrator/src/cli/control/confirmationCreateController.js +69 -0
  25. package/dist/orchestrator/src/cli/control/confirmationIssueConsumeController.js +43 -0
  26. package/dist/orchestrator/src/cli/control/confirmationListController.js +22 -0
  27. package/dist/orchestrator/src/cli/control/confirmationValidateController.js +58 -0
  28. package/dist/orchestrator/src/cli/control/confirmations.js +25 -3
  29. package/dist/orchestrator/src/cli/control/controlActionCancelConfirmation.js +65 -0
  30. package/dist/orchestrator/src/cli/control/controlActionController.js +77 -0
  31. package/dist/orchestrator/src/cli/control/controlActionControllerSequencing.js +161 -0
  32. package/dist/orchestrator/src/cli/control/controlActionExecution.js +142 -0
  33. package/dist/orchestrator/src/cli/control/controlActionFinalization.js +43 -0
  34. package/dist/orchestrator/src/cli/control/controlActionOutcome.js +60 -0
  35. package/dist/orchestrator/src/cli/control/controlActionPreflight.js +476 -0
  36. package/dist/orchestrator/src/cli/control/controlAuthenticatedRouteHandoff.js +57 -0
  37. package/dist/orchestrator/src/cli/control/controlBootstrapAssembly.js +39 -0
  38. package/dist/orchestrator/src/cli/control/controlBootstrapMetadataPersistence.js +16 -0
  39. package/dist/orchestrator/src/cli/control/controlEventTransport.js +49 -0
  40. package/dist/orchestrator/src/cli/control/controlExpiryLifecycle.js +102 -0
  41. package/dist/orchestrator/src/cli/control/controlHostOwnership.js +480 -0
  42. package/dist/orchestrator/src/cli/control/controlHostSupervision.js +608 -0
  43. package/dist/orchestrator/src/cli/control/controlOversightFacade.js +8 -0
  44. package/dist/orchestrator/src/cli/control/controlOversightReadContract.js +1 -0
  45. package/dist/orchestrator/src/cli/control/controlOversightReadService.js +16 -0
  46. package/dist/orchestrator/src/cli/control/controlOversightUpdateContract.js +1 -0
  47. package/dist/orchestrator/src/cli/control/controlPersistenceFiles.js +6 -0
  48. package/dist/orchestrator/src/cli/control/controlQuestionChildResolution.js +18 -0
  49. package/dist/orchestrator/src/cli/control/controlRequestContext.js +42 -0
  50. package/dist/orchestrator/src/cli/control/controlRequestController.js +9 -0
  51. package/dist/orchestrator/src/cli/control/controlRequestPredispatch.js +17 -0
  52. package/dist/orchestrator/src/cli/control/controlRequestRouteDispatch.js +44 -0
  53. package/dist/orchestrator/src/cli/control/controlRuntime.js +992 -0
  54. package/dist/orchestrator/src/cli/control/controlServer.js +23 -1456
  55. package/dist/orchestrator/src/cli/control/controlServerAuditAndErrorHelpers.js +115 -0
  56. package/dist/orchestrator/src/cli/control/controlServerAuthenticatedRouteBranch.js +29 -0
  57. package/dist/orchestrator/src/cli/control/controlServerBootstrapLifecycle.js +30 -0
  58. package/dist/orchestrator/src/cli/control/controlServerBootstrapStartSequence.js +21 -0
  59. package/dist/orchestrator/src/cli/control/controlServerOwnedRuntimeLifecycle.js +67 -0
  60. package/dist/orchestrator/src/cli/control/controlServerPublicLifecycle.js +756 -0
  61. package/dist/orchestrator/src/cli/control/controlServerPublicRouteHelpers.js +86 -0
  62. package/dist/orchestrator/src/cli/control/controlServerReadyInstanceLifecycle.js +25 -0
  63. package/dist/orchestrator/src/cli/control/controlServerReadyInstanceStartup.js +18 -0
  64. package/dist/orchestrator/src/cli/control/controlServerRequestBodyHelpers.js +37 -0
  65. package/dist/orchestrator/src/cli/control/controlServerRequestShell.js +40 -0
  66. package/dist/orchestrator/src/cli/control/controlServerRequestShellBinding.js +17 -0
  67. package/dist/orchestrator/src/cli/control/controlServerSeedLoading.js +27 -0
  68. package/dist/orchestrator/src/cli/control/controlServerSeededRuntimeAssembly.js +186 -0
  69. package/dist/orchestrator/src/cli/control/controlServerStartupInputPreparation.js +31 -0
  70. package/dist/orchestrator/src/cli/control/controlServerStartupSequence.js +49 -0
  71. package/dist/orchestrator/src/cli/control/controlState.js +233 -2
  72. package/dist/orchestrator/src/cli/control/controlStatusDashboard.js +1899 -0
  73. package/dist/orchestrator/src/cli/control/controlTelegramBridgeBootstrapLifecycle.js +22 -0
  74. package/dist/orchestrator/src/cli/control/controlTelegramBridgeLifecycle.js +67 -0
  75. package/dist/orchestrator/src/cli/control/controlTelegramBridgeOversightFacadeFactory.js +8 -0
  76. package/dist/orchestrator/src/cli/control/controlTelegramCommandController.js +49 -0
  77. package/dist/orchestrator/src/cli/control/controlTelegramDispatchRead.js +40 -0
  78. package/dist/orchestrator/src/cli/control/controlTelegramPollingController.js +89 -0
  79. package/dist/orchestrator/src/cli/control/controlTelegramProjectionNotificationController.js +29 -0
  80. package/dist/orchestrator/src/cli/control/controlTelegramPushState.js +63 -0
  81. package/dist/orchestrator/src/cli/control/controlTelegramQuestionRead.js +13 -0
  82. package/dist/orchestrator/src/cli/control/controlTelegramReadController.js +216 -0
  83. package/dist/orchestrator/src/cli/control/controlTelegramUpdateHandler.js +63 -0
  84. package/dist/orchestrator/src/cli/control/controlWatcher.js +73 -5
  85. package/dist/orchestrator/src/cli/control/delegationRegisterController.js +35 -0
  86. package/dist/orchestrator/src/cli/control/dynamicToolBridgePolicy.js +139 -0
  87. package/dist/orchestrator/src/cli/control/eventsSseController.js +12 -0
  88. package/dist/orchestrator/src/cli/control/linearBudgetState.js +1789 -0
  89. package/dist/orchestrator/src/cli/control/linearDispatchSource.js +1137 -0
  90. package/dist/orchestrator/src/cli/control/linearGraphqlClient.js +150 -0
  91. package/dist/orchestrator/src/cli/control/linearRateLimit.js +102 -0
  92. package/dist/orchestrator/src/cli/control/linearWebhookController.js +499 -0
  93. package/dist/orchestrator/src/cli/control/liveLinearAdvisoryRuntime.js +70 -0
  94. package/dist/orchestrator/src/cli/control/observabilityApiController.js +173 -0
  95. package/dist/orchestrator/src/cli/control/observabilityReadModel.js +500 -0
  96. package/dist/orchestrator/src/cli/control/observabilitySurface.js +284 -0
  97. package/dist/orchestrator/src/cli/control/observabilityUpdateNotifier.js +22 -0
  98. package/dist/orchestrator/src/cli/control/operatorDashboardPresenter.js +252 -0
  99. package/dist/orchestrator/src/cli/control/providerAgentCapacity.js +70 -0
  100. package/dist/orchestrator/src/cli/control/providerControlHostFreshnessGauge.js +1068 -0
  101. package/dist/orchestrator/src/cli/control/providerIntakeState.js +473 -0
  102. package/dist/orchestrator/src/cli/control/providerIssueHandoff.js +6811 -0
  103. package/dist/orchestrator/src/cli/control/providerIssueObservability.js +1348 -0
  104. package/dist/orchestrator/src/cli/control/providerIssueRetryQueue.js +84 -0
  105. package/dist/orchestrator/src/cli/control/providerLinearRuntimeProof.js +588 -0
  106. package/dist/orchestrator/src/cli/control/providerLinearScreenshotProof.js +473 -0
  107. package/dist/orchestrator/src/cli/control/providerLinearWorkerTruth.js +383 -0
  108. package/dist/orchestrator/src/cli/control/providerLinearWorkflowAudit.js +254 -0
  109. package/dist/orchestrator/src/cli/control/providerLinearWorkflowFacade.js +5573 -0
  110. package/dist/orchestrator/src/cli/control/providerLinearWorkflowStates.js +115 -0
  111. package/dist/orchestrator/src/cli/control/providerMergeCloseout.js +1868 -0
  112. package/dist/orchestrator/src/cli/control/providerOperatorAutopilot.js +1580 -0
  113. package/dist/orchestrator/src/cli/control/providerOperatorAutopilotLifecycle.js +154 -0
  114. package/dist/orchestrator/src/cli/control/providerOperatorAutopilotLocalRolloutExecution.js +1006 -0
  115. package/dist/orchestrator/src/cli/control/providerPollingHealth.js +435 -0
  116. package/dist/orchestrator/src/cli/control/providerTerminalCleanup.js +516 -0
  117. package/dist/orchestrator/src/cli/control/providerWorkerHosts.js +191 -0
  118. package/dist/orchestrator/src/cli/control/providerWorkflowConfigStore.js +515 -0
  119. package/dist/orchestrator/src/cli/control/questionChildResolutionAdapter.js +361 -0
  120. package/dist/orchestrator/src/cli/control/questionQueueController.js +181 -0
  121. package/dist/orchestrator/src/cli/control/questionReadRetryDeduplication.js +9 -0
  122. package/dist/orchestrator/src/cli/control/questionReadSequence.js +10 -0
  123. package/dist/orchestrator/src/cli/control/securityViolationController.js +27 -0
  124. package/dist/orchestrator/src/cli/control/selectedRunProjection.js +1838 -0
  125. package/dist/orchestrator/src/cli/control/telegramOversightApiClient.js +48 -0
  126. package/dist/orchestrator/src/cli/control/telegramOversightBridge.js +180 -0
  127. package/dist/orchestrator/src/cli/control/telegramOversightBridgeProjectionDeliveryQueue.js +25 -0
  128. package/dist/orchestrator/src/cli/control/telegramOversightBridgeRuntimeLifecycle.js +45 -0
  129. package/dist/orchestrator/src/cli/control/telegramOversightBridgeStateStore.js +77 -0
  130. package/dist/orchestrator/src/cli/control/telegramOversightControlActionApiClient.js +45 -0
  131. package/dist/orchestrator/src/cli/control/trackerDispatchPilot.js +439 -0
  132. package/dist/orchestrator/src/cli/control/uiDataController.js +34 -0
  133. package/dist/orchestrator/src/cli/control/uiSessionController.js +100 -0
  134. package/dist/orchestrator/src/cli/controlHostCliShell.js +860 -0
  135. package/dist/orchestrator/src/cli/controlHostFreshnessGaugeCliShell.js +129 -0
  136. package/dist/orchestrator/src/cli/controlHostSupervisionCliShell.js +2127 -0
  137. package/dist/orchestrator/src/cli/delegationCliShell.js +62 -0
  138. package/dist/orchestrator/src/cli/delegationServer.js +567 -678
  139. package/dist/orchestrator/src/cli/delegationServerCliShell.js +52 -0
  140. package/dist/orchestrator/src/cli/delegationServerQuestionFlowShell.js +228 -0
  141. package/dist/orchestrator/src/cli/delegationServerToolDispatchShell.js +411 -0
  142. package/dist/orchestrator/src/cli/delegationServerTransport.js +274 -0
  143. package/dist/orchestrator/src/cli/delegationSetup.js +51 -171
  144. package/dist/orchestrator/src/cli/devtoolsCliShell.js +34 -0
  145. package/dist/orchestrator/src/cli/doctor.js +542 -122
  146. package/dist/orchestrator/src/cli/doctorCliRequestShell.js +72 -0
  147. package/dist/orchestrator/src/cli/doctorCliShell.js +138 -0
  148. package/dist/orchestrator/src/cli/doctorUsage.js +136 -16
  149. package/dist/orchestrator/src/cli/exec/experience.js +16 -2
  150. package/dist/orchestrator/src/cli/exec/summary.js +3 -0
  151. package/dist/orchestrator/src/cli/execCliShell.js +51 -0
  152. package/dist/orchestrator/src/cli/flowCliRequestShell.js +44 -0
  153. package/dist/orchestrator/src/cli/flowCliShell.js +239 -0
  154. package/dist/orchestrator/src/cli/frontendTestCliRequestShell.js +80 -0
  155. package/dist/orchestrator/src/cli/frontendTestCliShell.js +41 -0
  156. package/dist/orchestrator/src/cli/init.js +1 -0
  157. package/dist/orchestrator/src/cli/initCliShell.js +50 -0
  158. package/dist/orchestrator/src/cli/linearCliShell.js +1200 -0
  159. package/dist/orchestrator/src/cli/mcpEnableCliShell.js +132 -0
  160. package/dist/orchestrator/src/cli/metrics/metricsAggregator.js +3 -2
  161. package/dist/orchestrator/src/cli/metrics/metricsRecorder.js +56 -0
  162. package/dist/orchestrator/src/cli/orchestrator.js +66 -1376
  163. package/dist/orchestrator/src/cli/planCliShell.js +19 -0
  164. package/dist/orchestrator/src/cli/prCliShell.js +41 -0
  165. package/dist/orchestrator/src/cli/providerLinearChildLanePhaseContract.js +204 -0
  166. package/dist/orchestrator/src/cli/providerLinearChildLaneRunner.js +1772 -0
  167. package/dist/orchestrator/src/cli/providerLinearChildLaneShell.js +2420 -0
  168. package/dist/orchestrator/src/cli/providerLinearChildStreamShell.js +385 -0
  169. package/dist/orchestrator/src/cli/providerLinearWorkerRunner.js +5738 -0
  170. package/dist/orchestrator/src/cli/resumeCliShell.js +14 -0
  171. package/dist/orchestrator/src/cli/reviewCliLaunchShell.js +72 -0
  172. package/dist/orchestrator/src/cli/rlm/alignment.js +3 -3
  173. package/dist/orchestrator/src/cli/rlm/context.js +94 -7
  174. package/dist/orchestrator/src/cli/rlm/rlmCodexRuntimeShell.js +546 -0
  175. package/dist/orchestrator/src/cli/rlm/symbolic.js +4 -2
  176. package/dist/orchestrator/src/cli/rlmCliRequestShell.js +42 -0
  177. package/dist/orchestrator/src/cli/rlmCompletionCliShell.js +46 -0
  178. package/dist/orchestrator/src/cli/rlmLaunchCliShell.js +51 -0
  179. package/dist/orchestrator/src/cli/rlmRunner.js +83 -523
  180. package/dist/orchestrator/src/cli/run/blockMemory.js +500 -0
  181. package/dist/orchestrator/src/cli/run/manifest.js +410 -73
  182. package/dist/orchestrator/src/cli/run/manifestPersister.js +45 -14
  183. package/dist/orchestrator/src/cli/run/runMemoryController.js +216 -0
  184. package/dist/orchestrator/src/cli/run/source0.js +690 -0
  185. package/dist/orchestrator/src/cli/run/workspacePath.js +101 -0
  186. package/dist/orchestrator/src/cli/runtime/mode.js +2 -1
  187. package/dist/orchestrator/src/cli/runtime/provider.js +39 -2
  188. package/dist/orchestrator/src/cli/selfCheckCliShell.js +12 -0
  189. package/dist/orchestrator/src/cli/services/commandRunner.js +668 -18
  190. package/dist/orchestrator/src/cli/services/execRuntime.js +66 -1
  191. package/dist/orchestrator/src/cli/services/orchestratorAutoScoutEvidenceRecorder.js +71 -0
  192. package/dist/orchestrator/src/cli/services/orchestratorCloudBranchResolution.js +8 -0
  193. package/dist/orchestrator/src/cli/services/orchestratorCloudEnvironmentResolution.js +22 -0
  194. package/dist/orchestrator/src/cli/services/orchestratorCloudExecutionLifecycleShell.js +39 -0
  195. package/dist/orchestrator/src/cli/services/orchestratorCloudPromptBuilder.js +37 -0
  196. package/dist/orchestrator/src/cli/services/orchestratorCloudRouteFallbackContract.js +45 -0
  197. package/dist/orchestrator/src/cli/services/orchestratorCloudRouteShell.js +36 -0
  198. package/dist/orchestrator/src/cli/services/orchestratorCloudTargetExecutor.js +277 -0
  199. package/dist/orchestrator/src/cli/services/orchestratorControlPlaneLifecycle.js +98 -0
  200. package/dist/orchestrator/src/cli/services/orchestratorControlPlaneLifecycleShell.js +54 -0
  201. package/dist/orchestrator/src/cli/services/orchestratorExecutionLifecycle.js +112 -0
  202. package/dist/orchestrator/src/cli/services/orchestratorExecutionModePolicy.js +27 -0
  203. package/dist/orchestrator/src/cli/services/orchestratorExecutionRouteAdapterShell.js +59 -0
  204. package/dist/orchestrator/src/cli/services/orchestratorExecutionRouteDecisionShell.js +57 -0
  205. package/dist/orchestrator/src/cli/services/orchestratorExecutionRouteState.js +21 -0
  206. package/dist/orchestrator/src/cli/services/orchestratorExecutionRouter.js +2 -0
  207. package/dist/orchestrator/src/cli/services/orchestratorLocalPipelineExecutor.js +149 -0
  208. package/dist/orchestrator/src/cli/services/orchestratorLocalRouteShell.js +63 -0
  209. package/dist/orchestrator/src/cli/services/orchestratorPlanShell.js +54 -0
  210. package/dist/orchestrator/src/cli/services/orchestratorPlanTargetTracker.js +16 -0
  211. package/dist/orchestrator/src/cli/services/orchestratorResumePreparationShell.js +84 -0
  212. package/dist/orchestrator/src/cli/services/orchestratorResumeTokenValidation.js +15 -0
  213. package/dist/orchestrator/src/cli/services/orchestratorRunLifecycleCompletion.js +31 -0
  214. package/dist/orchestrator/src/cli/services/orchestratorRunLifecycleExecutionRegistration.js +37 -0
  215. package/dist/orchestrator/src/cli/services/orchestratorRunLifecycleOrchestrationShell.js +83 -0
  216. package/dist/orchestrator/src/cli/services/orchestratorRunLifecycleTaskManagerShell.js +37 -0
  217. package/dist/orchestrator/src/cli/services/orchestratorRuntimeManifestMutation.js +20 -0
  218. package/dist/orchestrator/src/cli/services/orchestratorStartPreparationShell.js +56 -0
  219. package/dist/orchestrator/src/cli/services/orchestratorStatusShell.js +70 -0
  220. package/dist/orchestrator/src/cli/services/pipelineResolver.js +7 -3
  221. package/dist/orchestrator/src/cli/services/plannerMemory.js +119 -0
  222. package/dist/orchestrator/src/cli/services/runPreparation.js +7 -3
  223. package/dist/orchestrator/src/cli/services/runSummaryWriter.js +9 -0
  224. package/dist/orchestrator/src/cli/setupBootstrapShell.js +114 -0
  225. package/dist/orchestrator/src/cli/setupCliShell.js +51 -0
  226. package/dist/orchestrator/src/cli/skillsCliShell.js +56 -0
  227. package/dist/orchestrator/src/cli/startCliRequestShell.js +53 -0
  228. package/dist/orchestrator/src/cli/startCliShell.js +68 -0
  229. package/dist/orchestrator/src/cli/statusCliShell.js +22 -0
  230. package/dist/orchestrator/src/cli/utils/authProvenanceFingerprint.js +27 -0
  231. package/dist/orchestrator/src/cli/utils/cloudPreflight.js +83 -1
  232. package/dist/orchestrator/src/cli/utils/delegationConfigParser.js +250 -0
  233. package/dist/orchestrator/src/cli/utils/delegationMcpHealth.js +1382 -0
  234. package/dist/orchestrator/src/cli/utils/devtools.js +2 -54
  235. package/dist/orchestrator/src/cli/utils/mcpServerEntry.js +53 -0
  236. package/dist/orchestrator/src/cli/utils/packageProgramResolver.js +151 -0
  237. package/dist/orchestrator/src/cli/utils/providerOverrideEnv.js +71 -0
  238. package/dist/orchestrator/src/cli/utils/trailingJsonObject.js +59 -0
  239. package/dist/orchestrator/src/learning/crystalizer.js +2 -2
  240. package/dist/orchestrator/src/persistence/ExperienceStore.js +233 -49
  241. package/dist/orchestrator/src/persistence/TaskStateStore.js +6 -6
  242. package/dist/orchestrator/src/persistence/lockFile.js +70 -4
  243. package/dist/orchestrator/src/persistence/sanitizeIdentifier.js +39 -0
  244. package/dist/orchestrator/src/sync/createCloudSyncWorker.js +3 -2
  245. package/dist/orchestrator/src/utils/atomicWrite.js +17 -2
  246. package/dist/packages/orchestrator/src/exec/unified-exec.js +99 -6
  247. package/dist/packages/orchestrator/src/instructions/promptPacks.js +150 -19
  248. package/dist/packages/sdk-node/src/orchestrator.js +137 -13
  249. package/dist/packages/shared/config/designConfig.js +8 -1
  250. package/dist/packages/shared/streams/stdio.js +1 -1
  251. package/dist/scripts/design/pipeline/permit.js +15 -0
  252. package/dist/scripts/lib/docs-catalog.js +365 -0
  253. package/dist/scripts/lib/docs-helpers.js +87 -5
  254. package/dist/scripts/lib/pr-watch-merge.js +1088 -80
  255. package/dist/scripts/lib/provider-run-contract.js +26 -0
  256. package/dist/scripts/lib/review-command-intent-classification.js +532 -0
  257. package/dist/scripts/lib/review-command-probe-classification.js +385 -0
  258. package/dist/scripts/lib/review-execution-boundary-preflight.js +279 -0
  259. package/dist/scripts/lib/review-execution-runtime.js +753 -0
  260. package/dist/scripts/lib/review-execution-state.js +1144 -0
  261. package/dist/scripts/lib/review-execution-telemetry.js +215 -0
  262. package/dist/scripts/lib/review-inspection-target-parsing.js +78 -0
  263. package/dist/scripts/lib/review-launch-attempt.js +601 -0
  264. package/dist/scripts/lib/review-meta-surface-boundary-analysis.js +300 -0
  265. package/dist/scripts/lib/review-meta-surface-normalization.js +746 -0
  266. package/dist/scripts/lib/review-non-interactive-handoff.js +61 -0
  267. package/dist/scripts/lib/review-prompt-context.js +376 -0
  268. package/dist/scripts/lib/review-scope-advisory.js +286 -0
  269. package/dist/scripts/lib/review-scope-paths.js +123 -0
  270. package/dist/scripts/lib/review-shell-command-parser.js +389 -0
  271. package/dist/scripts/lib/review-shell-env-interpreter.js +340 -0
  272. package/dist/scripts/lib/run-manifests.js +192 -36
  273. package/dist/scripts/lib/spark-policy-classifier.js +593 -0
  274. package/dist/scripts/run-review.js +507 -1777
  275. package/docs/public/downstream-setup.md +106 -0
  276. package/docs/public/provider-onboarding.md +173 -0
  277. package/package.json +30 -11
  278. package/plugins/codex-orchestrator/.codex-plugin/plugin.json +30 -0
  279. package/plugins/codex-orchestrator/.mcp.json +13 -0
  280. package/plugins/codex-orchestrator/launcher.mjs +359 -0
  281. package/schemas/manifest.json +395 -0
  282. package/skills/chrome-devtools/SKILL.md +1 -1
  283. package/skills/codex-orchestrator/SKILL.md +83 -0
  284. package/skills/collab-subagents-first/SKILL.md +2 -1
  285. package/skills/delegation-usage/DELEGATION_GUIDE.md +24 -11
  286. package/skills/delegation-usage/SKILL.md +20 -13
  287. package/skills/land/SKILL.md +77 -0
  288. package/skills/linear/SKILL.md +255 -0
  289. package/skills/release/SKILL.md +47 -3
  290. package/skills/standalone-review/SKILL.md +6 -1
  291. package/templates/README.md +4 -2
  292. package/templates/codex/.codex/agents/awaiter-high.toml +2 -2
  293. package/templates/codex/.codex/agents/explorer-fast.toml +1 -0
  294. package/templates/codex/.codex/agents/worker-complex.toml +1 -1
  295. package/templates/codex/.codex/config.toml +3 -4
  296. package/templates/codex/.codex/providers/README.md +13 -0
  297. package/templates/codex/.codex/providers/control.example.json +18 -0
  298. package/templates/codex/.codex/providers/provider.env.example +15 -0
  299. package/templates/codex/AGENTS.md +12 -7
  300. package/templates/codex/mcp-client.json +5 -1
  301. package/docs/README.md +0 -307
  302. package/docs/assets/setup.gif +0 -0
@@ -3,9 +3,11 @@ import { CommandPlanner } from '../adapters/index.js';
3
3
  import { PipelineResolver } from './pipelineResolver.js';
4
4
  import { sanitizeTaskId } from '../run/environment.js';
5
5
  import { loadTaskMetadata } from '../tasks/taskMetadata.js';
6
+ import { loadPromptPackMetadata } from '../../../../packages/orchestrator/src/instructions/promptPacks.js';
6
7
  import { resolvePipeline } from '../pipelines/index.js';
7
8
  import { findPipeline } from '../config/userConfig.js';
8
9
  import { logger } from '../../logger.js';
10
+ import { buildTaskMemoryContext } from './plannerMemory.js';
9
11
  export function overrideTaskEnvironment(baseEnv, taskId) {
10
12
  if (!taskId) {
11
13
  return { ...baseEnv };
@@ -44,7 +46,8 @@ export async function prepareRun(options) {
44
46
  logger.info(`prepareRun resolved pipeline ${resolvedPipeline.pipeline.id}`);
45
47
  const metadata = await loadTaskMetadata(env);
46
48
  logger.info(`prepareRun loaded metadata for task ${metadata.id}`);
47
- const taskContext = createTaskContext(metadata);
49
+ const promptPackMetadata = await loadPromptPackMetadata(env.repoRoot);
50
+ const taskContext = createTaskContext(metadata, buildTaskMemoryContext(promptPackMetadata));
48
51
  const targetId = resolveTargetStageId(options.targetStageId, options.planTargetFallback ?? null);
49
52
  const planner = options.planner ?? new CommandPlanner(resolvedPipeline.pipeline, { targetStageId: targetId });
50
53
  logger.info(`prepareRun running planner for pipeline ${resolvedPipeline.pipeline.id}`);
@@ -80,13 +83,14 @@ export function resolvePipelineForResume(env, manifest, config, fallbackConfig =
80
83
  const { pipeline } = resolvePipeline(env, { pipelineId: manifest.pipeline_id, config });
81
84
  return pipeline;
82
85
  }
83
- export function createTaskContext(metadata) {
86
+ export function createTaskContext(metadata, memory = buildTaskMemoryContext([])) {
84
87
  return {
85
88
  id: metadata.id,
86
89
  title: metadata.title,
87
90
  description: undefined,
88
91
  metadata: {
89
92
  slug: metadata.slug
90
- }
93
+ },
94
+ memory
91
95
  };
92
96
  }
@@ -1,4 +1,5 @@
1
1
  import { join } from 'node:path';
2
+ import { materializeRunBlockMemory } from '../run/blockMemory.js';
2
3
  import { relativeToRepo } from '../run/runPaths.js';
3
4
  import { writeJsonAtomic } from '../utils/fs.js';
4
5
  import { persistManifest } from '../run/manifestPersister.js';
@@ -102,5 +103,13 @@ export async function persistRunSummary(env, paths, manifest, runSummary, persis
102
103
  const summaryPath = join(paths.runDir, 'run-summary.json');
103
104
  await writeJsonAtomic(summaryPath, runSummary);
104
105
  manifest.run_summary_path = relativeToRepo(env, summaryPath);
106
+ manifest.memory = {
107
+ ...(manifest.memory ?? {}),
108
+ ...(await materializeRunBlockMemory({
109
+ env,
110
+ paths,
111
+ manifest
112
+ }))
113
+ };
105
114
  await persistManifest(paths, manifest, persister, { force: true });
106
115
  }
@@ -0,0 +1,114 @@
1
+ /* eslint-disable patterns/prefer-logger-over-console */
2
+ import { formatDevtoolsSetupSummary, runDevtoolsSetup } from './devtoolsSetup.js';
3
+ import { formatDelegationSetupSummary, runDelegationSetup } from './delegationSetup.js';
4
+ import { buildCommandPreview } from './utils/commandPreview.js';
5
+ import { formatSkillsInstallSummary, installSkills, listBundledSkills } from './skills.js';
6
+ const DEFAULT_DEPENDENCIES = {
7
+ buildCommandPreview,
8
+ listBundledSkills,
9
+ installSkills,
10
+ runDelegationSetup,
11
+ runDevtoolsSetup,
12
+ formatSkillsInstallSummary,
13
+ formatDelegationSetupSummary,
14
+ formatDevtoolsSetupSummary,
15
+ log: (line) => console.log(line)
16
+ };
17
+ export async function runSetupBootstrapShell(params, overrides = {}) {
18
+ const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
19
+ const delegationCommandPreview = params.repoFlag
20
+ ? dependencies.buildCommandPreview('codex-orchestrator', ['delegation', 'setup', '--yes', '--repo', params.repoFlag])
21
+ : 'codex-orchestrator delegation setup --yes';
22
+ const bundledSkills = await dependencies.listBundledSkills();
23
+ if (bundledSkills.length === 0) {
24
+ throw new Error('No bundled skills detected; cannot run setup.');
25
+ }
26
+ const guidance = buildSetupGuidance();
27
+ if (!params.apply) {
28
+ const installCommand = `codex-orchestrator skills install ${params.refreshSkills ? '--force ' : ''}--only ${bundledSkills.join(',')}`;
29
+ const skillsNote = params.refreshSkills
30
+ ? 'Installs bundled skills into $CODEX_HOME/skills with overwrite enabled via --refresh-skills.'
31
+ : 'Installs bundled skills into $CODEX_HOME/skills without overwriting existing files by default. Add --refresh-skills to force overwrite.';
32
+ const delegation = await dependencies.runDelegationSetup({ repoRoot: params.repoRoot });
33
+ const devtools = await dependencies.runDevtoolsSetup();
34
+ const payload = {
35
+ status: 'planned',
36
+ steps: {
37
+ skills: {
38
+ commandLines: [installCommand],
39
+ note: skillsNote
40
+ },
41
+ delegation,
42
+ devtools,
43
+ guidance
44
+ }
45
+ };
46
+ if (params.format === 'json') {
47
+ dependencies.log(JSON.stringify(payload, null, 2));
48
+ return;
49
+ }
50
+ dependencies.log('Setup plan:');
51
+ dependencies.log('- Skills:');
52
+ for (const commandLine of payload.steps.skills.commandLines) {
53
+ dependencies.log(` - ${commandLine}`);
54
+ }
55
+ dependencies.log(`- Delegation: ${delegationCommandPreview}`);
56
+ dependencies.log('- DevTools: codex-orchestrator devtools setup --yes');
57
+ for (const line of formatSetupGuidanceSummary(guidance)) {
58
+ dependencies.log(line);
59
+ }
60
+ dependencies.log('Run with --yes to apply this setup.');
61
+ return;
62
+ }
63
+ const skills = await dependencies.installSkills({ force: params.refreshSkills, only: bundledSkills });
64
+ const delegation = await dependencies.runDelegationSetup({ apply: true, repoRoot: params.repoRoot });
65
+ const devtools = await dependencies.runDevtoolsSetup({ apply: true });
66
+ for (const line of dependencies.formatSkillsInstallSummary(skills)) {
67
+ dependencies.log(line);
68
+ }
69
+ for (const line of dependencies.formatDelegationSetupSummary(delegation)) {
70
+ dependencies.log(line);
71
+ }
72
+ for (const line of dependencies.formatDevtoolsSetupSummary(devtools)) {
73
+ dependencies.log(line);
74
+ }
75
+ for (const line of formatSetupGuidanceSummary(guidance)) {
76
+ dependencies.log(line);
77
+ }
78
+ dependencies.log('Next: codex-orchestrator doctor --usage');
79
+ }
80
+ function buildSetupGuidance() {
81
+ return {
82
+ note: 'Agent-first default: run docs-review before implementation and implementation-gate before handoff.',
83
+ references: [
84
+ 'https://github.com/Kbediako/CO#downstream-setup',
85
+ 'https://github.com/Kbediako/CO/blob/main/docs/public/downstream-setup.md',
86
+ 'https://github.com/Kbediako/CO/blob/main/docs/public/provider-onboarding.md',
87
+ 'https://github.com/Kbediako/CO/blob/main/docs/guides/collab-vs-mcp.md',
88
+ 'https://github.com/Kbediako/CO/blob/main/docs/guides/rlm-recursion-v2.md'
89
+ ],
90
+ recommended_commands: [
91
+ 'codex-orchestrator flow --task <task-id>',
92
+ 'codex-orchestrator doctor --format json',
93
+ 'codex-orchestrator rlm --multi-agent auto "<goal>"',
94
+ 'codex-orchestrator codex defaults --yes',
95
+ 'codex-orchestrator mcp enable --servers delegation --yes'
96
+ ]
97
+ };
98
+ }
99
+ function formatSetupGuidanceSummary(guidance) {
100
+ const lines = ['Setup guidance:', `- ${guidance.note}`];
101
+ if (guidance.recommended_commands.length > 0) {
102
+ lines.push('- Recommended commands:');
103
+ for (const command of guidance.recommended_commands) {
104
+ lines.push(` - ${command}`);
105
+ }
106
+ }
107
+ if (guidance.references.length > 0) {
108
+ lines.push('- References:');
109
+ for (const reference of guidance.references) {
110
+ lines.push(` - ${reference}`);
111
+ }
112
+ }
113
+ return lines;
114
+ }
@@ -0,0 +1,51 @@
1
+ /* eslint-disable patterns/prefer-logger-over-console */
2
+ import process from 'node:process';
3
+ import { runSetupBootstrapShell } from './setupBootstrapShell.js';
4
+ const SETUP_CLI_HELP = `Usage: codex-orchestrator setup [--yes] [--refresh-skills] [--format json]
5
+
6
+ One-shot bootstrap for downstream users. Installs bundled skills and configures
7
+ delegation + DevTools MCP wiring.
8
+
9
+ Options:
10
+ --yes Apply setup (otherwise plan only).
11
+ --refresh-skills Overwrite bundled skills in $CODEX_HOME/skills during setup.
12
+ --repo <path> Repo root for delegation wiring (default cwd).
13
+ --format json Emit machine-readable output (dry-run only).
14
+ `;
15
+ const DEFAULT_DEPENDENCIES = {
16
+ runSetupBootstrapShell,
17
+ getCwd: () => process.cwd(),
18
+ log: (line) => console.log(line)
19
+ };
20
+ export async function runSetupCliShell(params, overrides = {}) {
21
+ const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
22
+ const format = resolveOutputFormat(params.flags);
23
+ const apply = Boolean(params.flags['yes']);
24
+ const refreshSkills = Boolean(params.flags['refresh-skills']);
25
+ if (format === 'json' && apply) {
26
+ throw new Error('setup does not support --format json with --yes.');
27
+ }
28
+ const repoFlag = readStringFlag(params.flags, 'repo');
29
+ const repoRoot = repoFlag ?? dependencies.getCwd();
30
+ await dependencies.runSetupBootstrapShell({
31
+ format,
32
+ apply,
33
+ refreshSkills,
34
+ repoRoot,
35
+ repoFlag: repoFlag ?? undefined
36
+ });
37
+ }
38
+ export function printSetupCliHelp(log = DEFAULT_DEPENDENCIES.log) {
39
+ log(SETUP_CLI_HELP);
40
+ }
41
+ function resolveOutputFormat(flags) {
42
+ return flags['format'] === 'json' ? 'json' : 'text';
43
+ }
44
+ function readStringFlag(flags, key) {
45
+ const value = flags[key];
46
+ if (typeof value !== 'string') {
47
+ return undefined;
48
+ }
49
+ const trimmed = value.trim();
50
+ return trimmed.length > 0 ? trimmed : undefined;
51
+ }
@@ -0,0 +1,56 @@
1
+ /* eslint-disable patterns/prefer-logger-over-console */
2
+ import { formatSkillsInstallSummary, installSkills } from './skills.js';
3
+ const DEFAULT_DEPENDENCIES = {
4
+ installSkills,
5
+ formatSkillsInstallSummary,
6
+ log: (line) => console.log(line)
7
+ };
8
+ export async function runSkillsCliShell(params, overrides = {}) {
9
+ const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
10
+ const positionals = [...params.positionals];
11
+ const subcommand = positionals.shift();
12
+ const wantsHelp = params.flags['help'] === true
13
+ || params.flags['--help'] === true
14
+ || params.flags['h'] === true
15
+ || !subcommand
16
+ || subcommand === 'help'
17
+ || subcommand === '--help'
18
+ || subcommand === '-h';
19
+ if (wantsHelp) {
20
+ params.printHelp();
21
+ return;
22
+ }
23
+ if (subcommand === 'install') {
24
+ const format = resolveOutputFormat(params.flags);
25
+ const result = await dependencies.installSkills({
26
+ force: params.flags['force'] === true,
27
+ codexHome: readStringFlag(params.flags, 'codex-home'),
28
+ only: parseOnlyFlag(params.flags['only'])
29
+ });
30
+ if (format === 'json') {
31
+ dependencies.log(JSON.stringify(result, null, 2));
32
+ return;
33
+ }
34
+ for (const line of dependencies.formatSkillsInstallSummary(result)) {
35
+ dependencies.log(line);
36
+ }
37
+ return;
38
+ }
39
+ throw new Error(`Unknown skills command: ${subcommand}`);
40
+ }
41
+ function resolveOutputFormat(flags) {
42
+ return flags['format'] === 'json' ? 'json' : 'text';
43
+ }
44
+ function readStringFlag(flags, key) {
45
+ const value = flags[key];
46
+ return typeof value === 'string' ? value : undefined;
47
+ }
48
+ function parseOnlyFlag(value) {
49
+ if (value === undefined) {
50
+ return undefined;
51
+ }
52
+ if (typeof value !== 'string') {
53
+ throw new Error('--only requires a comma-separated list of skill names.');
54
+ }
55
+ return value.split(',').map((entry) => entry.trim()).filter(Boolean);
56
+ }
@@ -0,0 +1,53 @@
1
+ import { runStartCliShell } from './startCliShell.js';
2
+ const DEFAULT_DEPENDENCIES = {
3
+ runStartCliShell
4
+ };
5
+ export async function runStartCliRequestShell(params, overrides = {}) {
6
+ const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
7
+ const format = resolveOutputFormat(params.flags);
8
+ const executionMode = params.resolveExecutionModeFlag(params.flags);
9
+ const runtimeMode = params.resolveRuntimeModeFlag(params.flags);
10
+ params.applyRepoConfigRequiredPolicy(params.flags);
11
+ const autoIssueLogEnabled = params.resolveAutoIssueLogEnabled(params.flags);
12
+ const taskIdOverride = readStringFlagValue(params.flags['task']);
13
+ const goal = params.readStringFlag(params.flags, 'goal');
14
+ await dependencies.runStartCliShell({
15
+ orchestrator: params.orchestrator,
16
+ pipelineId: params.positionals[0],
17
+ format,
18
+ executionMode,
19
+ runtimeMode,
20
+ autoIssueLogEnabled,
21
+ taskIdOverride,
22
+ parentRunId: readStringFlagValue(params.flags['parent-run']),
23
+ approvalPolicy: readStringFlagValue(params.flags['approval-policy']),
24
+ issueProvider: readStringFlagValue(params.flags['issue-provider']),
25
+ issueId: readStringFlagValue(params.flags['issue-id']),
26
+ issueIdentifier: readStringFlagValue(params.flags['issue-identifier']),
27
+ issueUpdatedAt: readStringFlagValue(params.flags['issue-updated-at']),
28
+ targetStageId: params.resolveTargetStageId(params.flags),
29
+ runWithUi: async (action) => await params.runWithUi(format, action),
30
+ emitRunOutput: params.emitRunOutput,
31
+ maybeCaptureAutoIssueLog: params.maybeCaptureAutoIssueLog,
32
+ resolveTaskFilter: params.resolveTaskFilter,
33
+ withAutoIssueLogContext: params.withAutoIssueLogContext,
34
+ maybeEmitRunAdoptionHint: params.maybeEmitRunAdoptionHint,
35
+ isLegacyCollabEnvAliasEnabled: () => params.shouldWarnLegacyMultiAgentEnv(params.flags),
36
+ applyRlmEnvOverrides: () => params.applyRlmEnvOverrides(params.flags, goal),
37
+ resolveRlmTaskId: params.resolveRlmTaskId,
38
+ setTaskEnvironment: params.setTaskEnvironment,
39
+ log: params.log,
40
+ warn: params.warn,
41
+ setExitCode: params.setExitCode
42
+ });
43
+ }
44
+ function resolveOutputFormat(flags) {
45
+ return flags['format'] === 'json' ? 'json' : 'text';
46
+ }
47
+ function readStringFlagValue(value) {
48
+ if (typeof value !== 'string') {
49
+ return undefined;
50
+ }
51
+ const trimmed = value.trim();
52
+ return trimmed.length > 0 ? trimmed : undefined;
53
+ }
@@ -0,0 +1,68 @@
1
+ /* eslint-disable patterns/prefer-logger-over-console */
2
+ const DEFAULT_DEPENDENCIES = {
3
+ warnLegacyEnvMessage: 'Warning: RLM_SYMBOLIC_COLLAB is a legacy alias; prefer RLM_SYMBOLIC_MULTI_AGENT.'
4
+ };
5
+ export async function runStartCliShell(params, overrides = {}) {
6
+ const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
7
+ const isRlm = params.pipelineId === 'rlm';
8
+ if (isRlm) {
9
+ const warnLegacyEnvAlias = params.isLegacyCollabEnvAliasEnabled();
10
+ params.applyRlmEnvOverrides();
11
+ if (warnLegacyEnvAlias) {
12
+ params.warn(dependencies.warnLegacyEnvMessage);
13
+ }
14
+ }
15
+ let taskIdOverride = params.taskIdOverride;
16
+ try {
17
+ await params.runWithUi(async (runEvents) => {
18
+ if (isRlm) {
19
+ taskIdOverride = params.resolveRlmTaskId(taskIdOverride);
20
+ params.setTaskEnvironment(taskIdOverride);
21
+ if (params.format !== 'json') {
22
+ params.log(`Task: ${taskIdOverride}`);
23
+ }
24
+ }
25
+ const result = await params.orchestrator.start({
26
+ pipelineId: params.pipelineId,
27
+ taskId: taskIdOverride,
28
+ parentRunId: params.parentRunId,
29
+ approvalPolicy: params.approvalPolicy,
30
+ issueProvider: params.issueProvider,
31
+ issueId: params.issueId,
32
+ issueIdentifier: params.issueIdentifier,
33
+ issueUpdatedAt: params.issueUpdatedAt,
34
+ targetStageId: params.targetStageId,
35
+ executionMode: params.executionMode,
36
+ runtimeMode: params.runtimeMode,
37
+ runEvents
38
+ });
39
+ const issueLogCapture = result.manifest.status !== 'succeeded'
40
+ ? await params.maybeCaptureAutoIssueLog({
41
+ enabled: params.autoIssueLogEnabled,
42
+ issueTitle: `Auto issue log: start ${params.pipelineId ?? 'diagnostics'} failed`,
43
+ issueNotes: `Automatic failure capture for run ${result.manifest.run_id} (${result.manifest.status}).`,
44
+ taskFilter: params.resolveTaskFilter(result.manifest.task_id, taskIdOverride)
45
+ })
46
+ : { issueLog: null, issueLogError: null };
47
+ params.emitRunOutput(result, params.format, 'Run started', issueLogCapture);
48
+ if (result.manifest.status === 'failed' || result.manifest.status === 'cancelled') {
49
+ params.setExitCode(1);
50
+ }
51
+ if (result.manifest.status === 'succeeded' && result.manifest.pipeline_id !== 'rlm') {
52
+ await params.maybeEmitRunAdoptionHint({
53
+ format: params.format,
54
+ taskFilter: params.resolveTaskFilter(result.manifest.task_id, taskIdOverride)
55
+ });
56
+ }
57
+ });
58
+ }
59
+ catch (error) {
60
+ const issueLogCapture = await params.maybeCaptureAutoIssueLog({
61
+ enabled: params.autoIssueLogEnabled,
62
+ issueTitle: `Auto issue log: start ${params.pipelineId ?? 'diagnostics'} failed before run manifest`,
63
+ issueNotes: 'Automatic failure capture for start setup failure before run manifest creation.',
64
+ taskFilter: params.resolveTaskFilter(undefined, taskIdOverride)
65
+ });
66
+ throw params.withAutoIssueLogContext(error, issueLogCapture);
67
+ }
68
+ }
@@ -0,0 +1,22 @@
1
+ const DEFAULT_DEPENDENCIES = {
2
+ delay: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
3
+ terminalStatuses: new Set(['succeeded', 'failed', 'cancelled'])
4
+ };
5
+ export async function runStatusCliShell(params, overrides = {}) {
6
+ const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
7
+ let manifest = await params.orchestrator.status({
8
+ runId: params.runId,
9
+ format: params.format
10
+ });
11
+ if (!params.watch) {
12
+ return manifest;
13
+ }
14
+ while (!dependencies.terminalStatuses.has(manifest.status)) {
15
+ await dependencies.delay(params.interval * 1000);
16
+ manifest = await params.orchestrator.status({
17
+ runId: params.runId,
18
+ format: params.format
19
+ });
20
+ }
21
+ return manifest;
22
+ }
@@ -0,0 +1,27 @@
1
+ import { createHmac } from 'node:crypto';
2
+ import process from 'node:process';
3
+ export const AUTH_PROVENANCE_FINGERPRINT_KEY_ENV_KEYS = [
4
+ 'CODEX_AUTH_PROVENANCE_FINGERPRINT_KEY',
5
+ 'CODEX_ORCHESTRATOR_AUTH_PROVENANCE_KEY'
6
+ ];
7
+ function normalizeFingerprintValue(value) {
8
+ const trimmed = String(value ?? '').trim();
9
+ return trimmed.length > 0 ? trimmed : null;
10
+ }
11
+ export function resolveAuthProvenanceFingerprintKey(env = process.env) {
12
+ for (const key of AUTH_PROVENANCE_FINGERPRINT_KEY_ENV_KEYS) {
13
+ const value = normalizeFingerprintValue(env?.[key]);
14
+ if (value) {
15
+ return value;
16
+ }
17
+ }
18
+ return null;
19
+ }
20
+ export function fingerprintAuthProvenanceValue(value, env = process.env) {
21
+ const raw = normalizeFingerprintValue(value);
22
+ const key = resolveAuthProvenanceFingerprintKey(env);
23
+ if (!raw || !key) {
24
+ return null;
25
+ }
26
+ return `hmac-sha256:${createHmac('sha256', key).update(raw).digest('hex').slice(0, 16)}`;
27
+ }
@@ -1,4 +1,7 @@
1
+ import process from 'node:process';
1
2
  import { spawn } from 'node:child_process';
3
+ import { fingerprintAuthProvenanceValue } from './authProvenanceFingerprint.js';
4
+ import { resolveCodexCliBin } from './codexCli.js';
2
5
  function runCommand(command, args, options) {
3
6
  const timeoutMs = options.timeoutMs ?? 10_000;
4
7
  return new Promise((resolve) => {
@@ -55,6 +58,80 @@ function normalizeBranch(raw) {
55
58
  }
56
59
  return trimmed.replace(/^refs\/heads\//u, '');
57
60
  }
61
+ function normalizeCloudPreflightRequestValue(raw) {
62
+ const trimmed = String(raw ?? '').trim();
63
+ return trimmed.length > 0 ? trimmed : null;
64
+ }
65
+ function readFirstCloudPreflightEnvValue(env, keys) {
66
+ if (!env) {
67
+ return null;
68
+ }
69
+ for (const key of keys) {
70
+ const value = normalizeCloudPreflightRequestValue(env[key]);
71
+ if (value) {
72
+ return value;
73
+ }
74
+ }
75
+ return null;
76
+ }
77
+ function readFirstCloudPreflightCredentialSource(env) {
78
+ if (!env) {
79
+ return null;
80
+ }
81
+ for (const key of [
82
+ 'CODEX_API_KEY',
83
+ 'OPENAI_API_KEY',
84
+ 'CODEX_AUTH_TOKEN',
85
+ 'OPENAI_AUTH_TOKEN',
86
+ 'CHATGPT_AUTH_TOKEN'
87
+ ]) {
88
+ if (normalizeCloudPreflightRequestValue(env[key])) {
89
+ return `env:${key}`;
90
+ }
91
+ }
92
+ return null;
93
+ }
94
+ export function buildCloudPreflightAuthProvenance(params) {
95
+ const credentialSource = readFirstCloudPreflightCredentialSource(params.env);
96
+ const profile = readFirstCloudPreflightEnvValue(params.env, [
97
+ 'CODEX_AUTH_PROFILE',
98
+ 'CODEX_PROFILE',
99
+ 'OPENAI_PROFILE',
100
+ 'CHATGPT_AUTH_PROFILE',
101
+ 'CHATGPT_PROFILE'
102
+ ]);
103
+ const account = readFirstCloudPreflightEnvValue(params.env, [
104
+ 'CODEX_ACCOUNT_ID',
105
+ 'CODEX_ACCOUNT',
106
+ 'CODEX_ACCOUNT_EMAIL',
107
+ 'OPENAI_ACCOUNT_ID',
108
+ 'OPENAI_ORG_ID',
109
+ 'CHATGPT_ACCOUNT_ID',
110
+ 'CHATGPT_ACCOUNT',
111
+ 'CHATGPT_ACCOUNT_EMAIL'
112
+ ]);
113
+ return {
114
+ providerKind: 'codex_cloud',
115
+ activeProfileFingerprint: fingerprintAuthProvenanceValue(profile, params.env),
116
+ activeAccountFingerprint: fingerprintAuthProvenanceValue(account, params.env),
117
+ cloudEnvId: params.environmentId,
118
+ cloudBranch: params.branch,
119
+ credentialSource,
120
+ authFreshness: credentialSource ? 'env_credential_present' : 'credential_source_unknown'
121
+ };
122
+ }
123
+ export function buildCloudPreflightRequest(params) {
124
+ const env = params.env ?? process.env;
125
+ const branch = normalizeCloudPreflightRequestValue(params.branch)
126
+ ?? normalizeCloudPreflightRequestValue(env.CODEX_CLOUD_BRANCH);
127
+ return {
128
+ repoRoot: params.repoRoot,
129
+ codexBin: resolveCodexCliBin(env),
130
+ environmentId: params.environmentId,
131
+ branch,
132
+ env
133
+ };
134
+ }
58
135
  export async function runCloudPreflight(params) {
59
136
  const issues = [];
60
137
  const branch = normalizeBranch(params.branch);
@@ -95,7 +172,12 @@ export async function runCloudPreflight(params) {
95
172
  details: {
96
173
  codexBin: params.codexBin,
97
174
  environmentId: params.environmentId,
98
- branch
175
+ branch,
176
+ authProvenance: buildCloudPreflightAuthProvenance({
177
+ env: params.env,
178
+ environmentId: params.environmentId,
179
+ branch
180
+ })
99
181
  }
100
182
  };
101
183
  }