@kbediako/codex-orchestrator 0.1.38 → 0.2.1

package/dist/orchestrator/src/cli/coStatusCliShell.js

@@ -0,0 +1,451 @@
+/* eslint-disable patterns/prefer-logger-over-console */
+import { join, resolve, sep } from 'node:path';
+import { readUiDatasetWithEndpointRecovery, resolveAttachTarget, runCoStatusAttachCliShell } from './coStatusAttachCliShell.js';
+import { readControlServerSeeds } from './control/controlServerSeedLoading.js';
+import { ControlStateStore } from './control/controlState.js';
+import { createControlRuntime } from './control/controlRuntime.js';
+import { normalizeLinearAdvisoryState } from './control/linearWebhookController.js';
+import { readUiDataset } from './control/operatorDashboardPresenter.js';
+import { evaluateProviderControlHostFreshnessGauge } from './control/providerControlHostFreshnessGauge.js';
+import { normalizeProviderIntakeState } from './control/providerIntakeState.js';
+const CO_STATUS_ATTACH_UNSUPPORTED_FLAGS = ['pipeline'];
+const LOCAL_DEGRADED_FALLBACK_ALLOWED_VERDICTS = new Set([
+    'healthy',
+    'degraded'
+]);
+const LOCAL_DEGRADED_FALLBACK_ALLOWED_FINDING_CODES = new Set(['active_worker_proof_missing']);
+const CURRENT_HOST_UNHEALTHY_MARKER = 'current-host-unhealthy';
+const CURRENT_HOST_UNHEALTHY_STALE_ENDPOINT_FALLBACK = 'control-host unavailable; stale endpoint after control-host restart';
+const LEGACY_CURRENT_HOST_UNHEALTHY_STALE_ENDPOINT_FALLBACK = 'control-host unavailable; control_endpoint.json has not rotated to a reachable host';
+const CURRENT_HOST_UNHEALTHY_ROTATED_ENDPOINT_FALLBACK = 'refreshed control-host endpoint is still unreachable';
+export async function runCoStatusCliShell(params) {
+    if (params.flags.help !== undefined) {
+        params.printHelp();
+        return;
+    }
+    assertAttachCompatibleFlags(params.flags);
+    const format = readStringFlag(params.flags, 'format') === 'json' ? 'json' : 'text';
+    if (format !== 'json') {
+        await runCoStatusAttachCliShell(params);
+        return;
+    }
+    const dataset = await readCoStatusJsonDataset({ flags: params.flags });
+    console.log(JSON.stringify(dataset, null, 2));
+}
+export async function readCoStatusJsonDataset(input) {
+    let target = await resolveAttachTarget(input.flags);
+    try {
+        return await readUiDatasetWithEndpointRecovery({
+            flags: input.flags,
+            getTarget: () => target,
+            setTarget: (nextTarget) => {
+                target = nextTarget;
+            },
+            requestTimeoutMs: input.requestTimeoutMs,
+            recoverSameEndpointTimeout: true
+        });
+    }
+    catch (error) {
+        const degradedDataset = await tryReadLocalDegradedUiDataset({
+            error,
+            target
+        });
+        if (degradedDataset) {
+            return degradedDataset;
+        }
+        throw error;
+    }
+}
+function readStringFlag(flags, key) {
+    const value = flags[key];
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function assertAttachCompatibleFlags(flags) {
+    const unsupported = CO_STATUS_ATTACH_UNSUPPORTED_FLAGS.filter((flag) => flags[flag] !== undefined);
+    if (unsupported.length === 0) {
+        return;
+    }
+    const renderedFlags = unsupported.map((flag) => `--${flag}`).join(', ');
+    throw new Error(`co-status attaches to an existing control host and does not accept launch-only flags: ${renderedFlags}. Use \`control-host\` to start a control host with launch settings.`);
+}
+async function tryReadLocalDegradedUiDataset(input) {
+    const degradedReason = resolveLocalDegradedReadReason(input.error);
+    if (!degradedReason) {
+        return null;
+    }
+    const freshnessReport = await evaluateProviderControlHostFreshnessGauge({
+        artifactRoot: input.target.runDir
+    });
+    const refreshAgeVerdict = freshnessReport.metrics.last_successful_refresh_age_ms.verdict;
+    if (!isEligibleLocalDegradedFallbackFreshnessReport(freshnessReport) ||
+        !LOCAL_DEGRADED_FALLBACK_ALLOWED_VERDICTS.has(refreshAgeVerdict)) {
+        return null;
+    }
+    const localDataset = await readLocalUiDataset(input.target);
+    const dataset = applyProviderIntakeTruthOverlay(localDataset.dataset, input.target, localDataset.providerIntakeState);
+    const providerIntake = dataset.provider_intake ?? null;
+    if (!providerIntake || providerIntake.active_claim_count < 1) {
+        return null;
+    }
+    return {
+        ...dataset,
+        degraded_read: buildDegradedReadPayload(input.target, freshnessReport, degradedReason)
+    };
+}
+function resolveLocalDegradedReadReason(error) {
+    const message = error?.message ?? String(error);
+    if (message.includes('Re-resolving control_endpoint.json failed')) {
+        return null;
+    }
+    if (isCurrentHostUnhealthyErrorMessage(message)) {
+        return 'current_host_unhealthy';
+    }
+    if (message.includes('control-host ui request timeout after')) {
+        return 'ui_request_timeout';
+    }
+    return null;
+}
+function isCurrentHostUnhealthyErrorMessage(message) {
+    return [
+        CURRENT_HOST_UNHEALTHY_MARKER,
+        CURRENT_HOST_UNHEALTHY_STALE_ENDPOINT_FALLBACK,
+        LEGACY_CURRENT_HOST_UNHEALTHY_STALE_ENDPOINT_FALLBACK,
+        CURRENT_HOST_UNHEALTHY_ROTATED_ENDPOINT_FALLBACK
+    ].some((fragment) => message.includes(fragment));
+}
+function isEligibleLocalDegradedFallbackFreshnessReport(report) {
+    if (LOCAL_DEGRADED_FALLBACK_ALLOWED_VERDICTS.has(report.verdict)) {
+        return true;
+    }
+    if (report.verdict !== 'unknown') {
+        return false;
+    }
+    return (report.findings.length > 0 &&
+        report.findings.every((finding) => LOCAL_DEGRADED_FALLBACK_ALLOWED_FINDING_CODES.has(finding.code)));
+}
+function buildDegradedReadPayload(target, report, reason) {
+    return {
+        reason,
+        source: 'local_seeded_runtime',
+        freshness_verdict: report.verdict,
+        artifact_root: target.runDir,
+        finding_codes: report.findings.map((finding) => finding.code)
+    };
+}
+function applyProviderIntakeTruthOverlay(dataset, target, providerIntakeState) {
+    const providerIntake = dataset.provider_intake ?? null;
+    const selectedClaim = selectDegradedOverlayClaim(providerIntakeState, providerIntake?.selected_claim.issue_identifier);
+    if (!selectedClaim) {
+        return dataset;
+    }
+    const activeClaims = [...providerIntakeState.claims]
+        .sort(compareDegradedClaims)
+        .filter(isDegradedActiveClaim);
+    const runningClaims = activeClaims.filter((claim) => resolveDegradedClaimState(claim) === 'running');
+    const status = resolveDegradedClaimStatus(resolveDegradedClaimState(selectedClaim));
+    const selected = buildDegradedSelectedPayload(dataset.selected, selectedClaim, target, status);
+    const runningEntries = runningClaims.map((claim) => buildDegradedRunningSessionPayload(claim, selected, dataset.host));
+    const synthesizedIssues = activeClaims.length > 0 ? activeClaims : [selectedClaim];
+    const issues = [
+        ...synthesizedIssues.map((claim) => buildDegradedIssuePayload(dataset.issues.find((entry) => entry.issue_identifier === claim.issue_identifier) ?? null, claim, selected, dataset.host, resolveDegradedClaimStatus(resolveDegradedClaimState(claim)))),
+        ...dataset.issues.filter((entry) => entry.issue_identifier !== selected.issue_identifier &&
+            !synthesizedIssues.some((claim) => claim.issue_identifier === entry.issue_identifier) &&
+            !isDegradedPlaceholderIssue(entry, target))
+    ].map((entry) => ({
+        ...entry,
+        is_selected: entry.issue_identifier === selected.issue_identifier
+    }));
+    return {
+        ...dataset,
+        counts: {
+            ...dataset.counts,
+            running: runningEntries.length > 0 ? runningEntries.length : dataset.counts.running,
+            issues: issues.length
+        },
+        selected_issue_identifier: selected.issue_identifier,
+        selected,
+        running: runningEntries.length > 0 ? runningEntries : dataset.running,
+        issues
+    };
+}
+function selectDegradedOverlayClaim(state, selectedIssueIdentifier) {
+    const activeClaims = [...state.claims].sort(compareDegradedClaims).filter(isDegradedActiveClaim);
+    const preferred = typeof selectedIssueIdentifier === 'string'
+        ? activeClaims.find((claim) => claim.issue_identifier === selectedIssueIdentifier) ??
+            state.claims.find((claim) => claim.issue_identifier === selectedIssueIdentifier) ??
+            null
+        : null;
+    return preferred ?? activeClaims[0] ?? state.claims[0] ?? null;
+}
+function isDegradedActiveClaim(claim) {
+    switch (claim.state) {
+        case 'accepted':
+        case 'starting':
+        case 'running':
+        case 'resuming':
+        case 'resumable':
+        case 'handoff_failed':
+            return true;
+        default:
+            return false;
+    }
+}
+function compareDegradedClaims(left, right) {
+    return rankDegradedClaimState(right.state) - rankDegradedClaimState(left.state)
+        || Date.parse(right.updated_at) - Date.parse(left.updated_at);
+}
+function rankDegradedClaimState(state) {
+    switch (state) {
+        case 'running':
+            return 9;
+        case 'resuming':
+            return 8;
+        case 'starting':
+            return 7;
+        case 'resumable':
+            return 6;
+        case 'accepted':
+            return 5;
+        case 'released':
+            return 4;
+        case 'handoff_failed':
+            return 3;
+        case 'completed':
+            return 2;
+        case 'duplicate':
+            return 1;
+        case 'stale':
+            return 0;
+        case 'ignored':
+        default:
+            return -1;
+    }
+}
+function isDegradedPlaceholderIssue(issue, target) {
+    return (issue.task_id === (target.taskId ?? issue.task_id) &&
+        issue.run_id === (target.runId ?? issue.run_id) &&
+        (issue.issue_identifier === (target.taskId ?? null) ||
+            issue.issue_identifier === (target.runId ?? null)));
+}
+function buildDegradedSelectedPayload(existing, claim, target, status) {
+    const latestEvent = buildDegradedLatestEvent(claim);
+    return {
+        issue_id: claim.issue_id,
+        issue_identifier: claim.issue_identifier,
+        task_id: claim.task_id,
+        run_id: claim.run_id,
+        raw_status: status.raw_status,
+        display_status: status.display_status,
+        status_reason: claim.reason,
+        started_at: existing?.started_at ?? null,
+        updated_at: claim.updated_at,
+        completed_at: null,
+        summary: claim.issue_title,
+        last_error: existing?.last_error ?? null,
+        latest_action: existing?.latest_action ?? null,
+        latest_event: latestEvent,
+        workspace: {
+            path: existing?.workspace.path ?? resolve(target.runDir, '..', '..', '..')
+        },
+        ...(claim.worker_host !== undefined ? { worker_host: claim.worker_host ?? null } : {}),
+        question_summary: existing?.question_summary ?? {
+            queued_count: 0,
+            latest_question: null
+        },
+        tracked: existing?.tracked ?? { linear: null }
+    };
+}
+function buildDegradedIssuePayload(existing, claim, selected, host, status) {
+    const running = resolveDegradedClaimState(claim) === 'running' ? buildDegradedRunningPayload(claim) : null;
+    return {
+        issue_identifier: claim.issue_identifier,
+        issue_id: claim.issue_id,
+        task_id: claim.task_id,
+        run_id: claim.run_id,
+        status: status.issue_status,
+        raw_status: status.raw_status,
+        display_status: status.display_status,
+        status_reason: claim.reason,
+        title: claim.issue_title,
+        url: existing?.url ?? null,
+        workspace: {
+            path: selected.workspace.path,
+            host
+        },
+        ...(claim.worker_host !== undefined ? { worker_host: claim.worker_host ?? null } : {}),
+        session: {
+            session_id: existing?.session.session_id ?? null,
+            thread_id: existing?.session.thread_id ?? null,
+            turn_count: existing?.session.turn_count ?? null
+        },
+        owner: existing?.owner ?? {
+            phase: null,
+            status: null
+        },
+        tokens: existing?.tokens ?? null,
+        rate_limits: existing?.rate_limits ?? null,
+        summary: claim.issue_title,
+        last_error: existing?.last_error ?? null,
+        latest_event: buildDegradedLatestEvent(claim),
+        recent_agent_activity: existing?.recent_agent_activity ?? [],
+        linear_activity: existing?.linear_activity ?? [],
+        running,
+        retry: existing?.retry ?? null,
+        attempts: existing?.attempts ?? {
+            restart_count: null,
+            current_retry_attempt: claim.retry_attempt ?? null
+        },
+        tracked: existing?.tracked ?? selected.tracked,
+        provider_linear_worker_proof: existing?.provider_linear_worker_proof ?? null,
+        provider_debug_snapshot: existing?.provider_debug_snapshot ?? null,
+        is_selected: true
+    };
+}
+function buildDegradedRunningPayload(claim) {
+    return {
+        issue_id: claim.issue_id,
+        issue_identifier: claim.issue_identifier,
+        state: 'running',
+        display_state: 'running',
+        status_reason: claim.reason,
+        pid: null,
+        ...(claim.worker_host !== undefined ? { worker_host: claim.worker_host ?? null } : {}),
+        session_id: null,
+        turn_count: null,
+        last_event: 'provider_intake_refresh',
+        last_message: claim.reason,
+        display_event: 'provider_intake_refresh',
+        event_source: 'provider_intake_state',
+        message_recorded_at: claim.updated_at,
+        source_updated_at: claim.updated_at,
+        started_at: null,
+        last_event_at: claim.updated_at,
+        tokens: {
+            input_tokens: null,
+            output_tokens: null,
+            total_tokens: null
+        }
+    };
+}
+function buildDegradedRunningSessionPayload(claim, selected, host) {
+    return {
+        issue_identifier: claim.issue_identifier,
+        issue_id: claim.issue_id,
+        id: claim.issue_identifier,
+        bucket: 'running',
+        state: 'running',
+        reason: claim.reason,
+        aliases: [claim.task_id, claim.run_id].filter((value) => Boolean(value)),
+        task_id: claim.task_id,
+        run_id: claim.run_id,
+        summary: claim.issue_title,
+        display_state: 'running',
+        status_reason: claim.reason,
+        pid: null,
+        session_id: null,
+        thread_id: null,
+        turn_count: null,
+        workspace_path: selected.workspace.path,
+        host,
+        ...(claim.worker_host !== undefined ? { worker_host: claim.worker_host ?? null } : {}),
+        last_event: 'provider_intake_refresh',
+        last_message: claim.reason,
+        display_event: 'provider_intake_refresh',
+        started_at: null,
+        last_event_at: claim.updated_at,
+        tokens: {
+            input_tokens: null,
+            output_tokens: null,
+            total_tokens: null
+        }
+    };
+}
+function buildDegradedLatestEvent(claim) {
+    return {
+        event: 'provider_intake_refresh',
+        message: claim.reason,
+        at: claim.updated_at
+    };
+}
+function resolveDegradedClaimStatus(state) {
+    if (state === 'running') {
+        return {
+            raw_status: 'in_progress',
+            display_status: 'running',
+            issue_status: 'running'
+        };
+    }
+    return {
+        raw_status: state,
+        display_status: state,
+        issue_status: state
+    };
+}
+function resolveDegradedClaimState(claim) {
+    return claim.state === 'handoff_failed' && claim.reason === 'provider_issue_handoff_owned'
+        ? 'handoff_owned'
+        : claim.state;
+}
+async function readLocalUiDataset(target) {
+    const paths = buildRunPathsFromTarget(target);
+    const { controlSeed, linearAdvisorySeed, providerIntakeSeed } = await readControlServerSeeds(paths);
+    const providerIntakeState = normalizeProviderIntakeState(providerIntakeSeed);
+    const controlStore = new ControlStateStore({
+        runId: target.runId ?? 'control-host',
+        controlSeq: controlSeed?.control_seq ?? 0,
+        latestAction: controlSeed?.latest_action ?? null,
+        featureToggles: controlSeed?.feature_toggles ?? null,
+        transportMutation: controlSeed?.transport_mutation ?? null
+    });
+    const runtime = createControlRuntime({
+        controlStore,
+        questionQueue: { list: () => [] },
+        paths,
+        linearAdvisoryState: normalizeLinearAdvisoryState(linearAdvisorySeed),
+        providerIntakeState
+    });
+    return {
+        dataset: await readUiDataset({
+            readCompatibilityProjection: () => runtime.snapshot().readCompatibilityProjection()
+        }),
+        providerIntakeState
+    };
+}
+function buildRunPathsFromTarget(target) {
+    const runDir = resolve(target.runDir);
+    const manifestPath = resolve(target.manifestPath);
+    return {
+        runDir,
+        manifestPath,
+        heartbeatPath: join(runDir, '.heartbeat'),
+        resumeTokenPath: join(runDir, '.resume-token'),
+        logPath: join(runDir, 'runner.ndjson'),
+        eventsPath: join(runDir, 'events.jsonl'),
+        controlPath: join(runDir, 'control.json'),
+        controlAuthPath: join(runDir, 'control_auth.json'),
+        controlEndpointPath: join(runDir, 'control_endpoint.json'),
+        confirmationsPath: join(runDir, 'confirmations.json'),
+        questionsPath: join(runDir, 'questions.json'),
+        delegationTokensPath: join(runDir, 'delegation_tokens.json'),
+        commandsDir: join(runDir, 'commands'),
+        errorsDir: join(runDir, 'errors'),
+        compatDir: join(findTaskCliDir(runDir), 'mcp', target.runId ?? 'control-host'),
+        compatManifestPath: join(findTaskCliDir(runDir), 'mcp', target.runId ?? 'control-host', 'manifest.json'),
+        localCompatDir: join(findRunsRoot(runDir), 'local-mcp', target.runId ?? 'control-host')
+    };
+}
+function findTaskCliDir(runDir) {
+    return resolve(runDir, '..', '..');
+}
+function findRunsRoot(runDir) {
+    const parts = resolve(runDir).split(sep);
+    const runsIndex = parts.lastIndexOf('.runs');
+    if (runsIndex <= 0) {
+        return resolve(runDir, '..', '..', '..');
+    }
+    return parts.slice(0, runsIndex + 1).join(sep) || sep;
+}

package/dist/orchestrator/src/cli/coStatusOperatorAutopilotCliShell.js

@@ -0,0 +1,120 @@
+/* eslint-disable patterns/prefer-logger-over-console */
+import process from 'node:process';
+import { isoTimestamp } from './utils/time.js';
+import { fetchUiDataset, resolveAttachTarget } from './coStatusAttachCliShell.js';
+import { appendProviderOperatorAutopilotLifecycleRecord, resolveProviderOperatorAutopilotLifecyclePath } from './control/providerOperatorAutopilotLifecycle.js';
+export async function runCoStatusOperatorAutopilotCliShell(params) {
+    if (params.flags.help !== undefined) {
+        params.printHelp();
+        return;
+    }
+    const [surface, actionName, ...unexpected] = params.positionals;
+    if (surface !== 'local-rollout' || !isLifecycleCommand(actionName)) {
+        throw new Error('co-status operator-autopilot requires: local-rollout <acknowledge|clear|dismiss>.');
+    }
+    if (unexpected.length > 0) {
+        throw new Error(`Unknown co-status operator-autopilot argument(s): ${unexpected.join(' ')}`);
+    }
+    const actionIdSelector = readStringFlag(params.flags, 'action-id');
+    const issueSelector = readStringFlag(params.flags, 'issue');
+    if (actionIdSelector && issueSelector) {
+        throw new Error('co-status operator-autopilot local-rollout accepts exactly one selector: --issue or --action-id.');
+    }
+    const selector = actionIdSelector ?? issueSelector;
+    if (!selector) {
+        throw new Error('co-status operator-autopilot local-rollout accepts exactly one selector: --issue or --action-id.');
+    }
+    const actor = readStringFlag(params.flags, 'actor') ??
+        normalizeOptionalString(process.env.USER) ??
+        'operator';
+    const reason = readStringFlag(params.flags, 'reason');
+    if (!reason) {
+        throw new Error('co-status operator-autopilot local-rollout requires --reason.');
+    }
+    const format = readStringFlag(params.flags, 'format') === 'json' ? 'json' : 'text';
+    const state = mapLifecycleCommand(actionName);
+    const target = await resolveAttachTarget(params.flags);
+    const dataset = await fetchUiDataset(target.baseUrl, target.token);
+    const operatorAutopilot = dataset.provider_workflow?.operator_autopilot ?? null;
+    const pendingActions = operatorAutopilot?.last_result?.pending_actions ?? [];
+    const pendingAction = selectPendingLocalRolloutAction({
+        pendingActions,
+        selector,
+        selectorKind: actionIdSelector ? 'action-id' : 'issue'
+    });
+    if (!pendingAction.action_instance_id) {
+        throw new Error('Matched pending local rollout action is missing action_instance_id; wait for a fresh operator-autopilot evaluation.');
+    }
+    const lifecyclePath = readLifecyclePath(operatorAutopilot) ??
+        resolveProviderOperatorAutopilotLifecyclePath(target.runDir);
+    const record = {
+        action_instance_id: pendingAction.action_instance_id,
+        kind: 'local_rollout',
+        issue_id: pendingAction.issue_id,
+        issue_identifier: pendingAction.issue_identifier,
+        state,
+        actor,
+        reason,
+        recorded_at: isoTimestamp(),
+        source: 'co-status'
+    };
+    const store = await appendProviderOperatorAutopilotLifecycleRecord(lifecyclePath, record);
+    const payload = {
+        status: 'recorded',
+        lifecycle_path: lifecyclePath,
+        state,
+        action: actionName,
+        record,
+        record_count: store.records.length,
+        pending_action: pendingAction
+    };
+    if (format === 'json') {
+        console.log(JSON.stringify(payload, null, 2));
+        return;
+    }
+    console.log(`Recorded ${state} lifecycle for ${pendingAction.issue_identifier ?? pendingAction.issue_id} (${pendingAction.action_instance_id}).`);
+    console.log(`Lifecycle path: ${lifecyclePath}`);
+}
+function selectPendingLocalRolloutAction(input) {
+    const selector = input.selector.trim();
+    const normalizedSelector = selector.toLowerCase();
+    const matches = input.pendingActions.filter((pendingAction) => {
+        if (input.selectorKind === 'action-id') {
+            return pendingAction.action_instance_id === selector;
+        }
+        return (pendingAction.issue_id === selector ||
+            pendingAction.issue_identifier?.toLowerCase() === normalizedSelector);
+    });
+    if (matches.length === 0) {
+        throw new Error(`No pending local rollout action matched ${selector}.`);
+    }
+    if (matches.length > 1) {
+        throw new Error(`Multiple pending local rollout actions matched ${selector}; retry with --action-id.`);
+    }
+    return matches[0];
+}
+function readLifecyclePath(operatorAutopilot) {
+    const lifecyclePath = operatorAutopilot?.lifecycle_path;
+    return typeof lifecyclePath === 'string' && lifecyclePath.trim().length > 0
+        ? lifecyclePath
+        : null;
+}
+function isLifecycleCommand(value) {
+    return value === 'acknowledge' || value === 'clear' || value === 'dismiss';
+}
+function mapLifecycleCommand(command) {
+    if (command === 'acknowledge') {
+        return 'acknowledged';
+    }
+    return command === 'clear' ? 'cleared' : 'dismissed';
+}
+function readStringFlag(flags, key) {
+    return normalizeOptionalString(flags[key]);
+}
+function normalizeOptionalString(value) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}

package/dist/orchestrator/src/cli/codexCliShell.js

@@ -0,0 +1,119 @@
+/* eslint-disable patterns/prefer-logger-over-console */
+import { formatCodexCliSetupSummary, runCodexCliSetup } from './codexCliSetup.js';
+import { formatCodexDefaultsSetupSummary, runCodexDefaultsSetup } from './codexDefaultsSetup.js';
+const LEGACY_CHATGPT_AUTH_TRUE_VALUES = new Set(['true', '1', 'yes', 'on', 'enabled']);
+const LEGACY_CHATGPT_AUTH_FALSE_VALUES = new Set(['false', '0', 'no', 'off', 'disabled']);
+const DEFAULT_DEPENDENCIES = {
+    runCodexCliSetup,
+    runCodexDefaultsSetup,
+    formatCodexCliSetupSummary,
+    formatCodexDefaultsSetupSummary,
+    log: (line) => console.log(line)
+};
+export async function runCodexCliShell(params, overrides = {}) {
+    const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
+    const positionals = [...params.positionals];
+    const subcommand = positionals.shift();
+    const wantsHelp = params.flags['help'] === true
+        || params.flags['--help'] === true
+        || params.flags['h'] === true
+        || !subcommand
+        || subcommand === 'help'
+        || subcommand === '--help'
+        || subcommand === '-h';
+    if (wantsHelp) {
+        params.printHelp();
+        return;
+    }
+    if (subcommand === 'setup') {
+        const format = resolveOutputFormat(params.flags);
+        const apply = Boolean(params.flags['yes']);
+        const force = Boolean(params.flags['force']);
+        const result = await dependencies.runCodexCliSetup({
+            apply,
+            force,
+            source: readStringFlag(params.flags, 'source'),
+            ref: readStringFlag(params.flags, 'ref'),
+            downloadUrl: readStringFlag(params.flags, 'download-url'),
+            downloadSha256: readStringFlag(params.flags, 'download-sha256')
+        });
+        if (format === 'json') {
+            dependencies.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        for (const line of dependencies.formatCodexCliSetupSummary(result)) {
+            dependencies.log(line);
+        }
+        return;
+    }
+    if (subcommand === 'defaults') {
+        const format = resolveOutputFormat(params.flags);
+        const apply = Boolean(params.flags['yes']);
+        const force = Boolean(params.flags['force']);
+        const authScope = readAuthScopeFlag(params.flags);
+        const result = await dependencies.runCodexDefaultsSetup({
+            apply,
+            force,
+            authScope
+        });
+        if (format === 'json') {
+            dependencies.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        for (const line of dependencies.formatCodexDefaultsSetupSummary(result)) {
+            dependencies.log(line);
+        }
+        return;
+    }
+    throw new Error(`Unknown codex subcommand: ${subcommand}`);
+}
+function resolveOutputFormat(flags) {
+    return flags['format'] === 'json' ? 'json' : 'text';
+}
+function readStringFlag(flags, key) {
+    const value = flags[key];
+    return typeof value === 'string' ? value : undefined;
+}
+function readAuthScopeFlag(flags) {
+    const legacyChatGptAuth = readLegacyChatGptAuthFlag(flags);
+    if (!Object.prototype.hasOwnProperty.call(flags, 'auth-scope')) {
+        if (legacyChatGptAuth === true) {
+            return 'chatgpt';
+        }
+        if (legacyChatGptAuth === false) {
+            return 'portable';
+        }
+        return undefined;
+    }
+    const value = readStringFlag(flags, 'auth-scope');
+    if (value === undefined) {
+        throw new Error('Missing value for codex defaults auth scope: expected portable or chatgpt.');
+    }
+    if (legacyChatGptAuth === true && value !== 'chatgpt') {
+        throw new Error('Conflicting codex defaults auth scope: --chatgpt-auth requires --auth-scope chatgpt.');
+    }
+    if (legacyChatGptAuth === false && value !== 'portable') {
+        throw new Error('Conflicting codex defaults auth scope: --chatgpt-auth=false requires --auth-scope portable.');
+    }
+    if (value === 'portable' || value === 'chatgpt') {
+        return value;
+    }
+    throw new Error(`Invalid codex defaults auth scope: ${value}`);
+}
+function readLegacyChatGptAuthFlag(flags) {
+    if (!Object.prototype.hasOwnProperty.call(flags, 'chatgpt-auth')) {
+        return undefined;
+    }
+    const value = flags['chatgpt-auth'];
+    if (typeof value === 'boolean') {
+        return value;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (LEGACY_CHATGPT_AUTH_TRUE_VALUES.has(normalized)) {
+        return true;
+    }
+    if (LEGACY_CHATGPT_AUTH_FALSE_VALUES.has(normalized)) {
+        return false;
+    }
+    throw new Error(`Invalid codex defaults ChatGPT auth flag: --chatgpt-auth expected a boolean-like value, got ${value}.`);
+}