@mostok/codexes 0.1.0

package/dist/runtime/init/initialize-runtime.js

@@ -0,0 +1,275 @@
+import os from "node:os";
+import path from "node:path";
+import { copyFile, cp, mkdir, readFile, stat, writeFile, } from "node:fs/promises";
+import { createAccountRegistry } from "../../accounts/account-registry.js";
+export async function initializeRuntimeEnvironment(input) {
+    const legacyCodexHome = path.join(os.homedir(), ".codex");
+    const firstRun = !(await pathExists(input.paths.sharedCodexHome));
+    const createdDirectories = [];
+    const createdFiles = [];
+    const copiedSharedArtifacts = [];
+    const skippedArtifacts = [];
+    input.logger.info("runtime_init.start", {
+        dataRoot: input.paths.dataRoot,
+        sharedCodexHome: input.paths.sharedCodexHome,
+        legacyCodexHome,
+        firstRun,
+    });
+    for (const directory of [
+        input.paths.dataRoot,
+        input.paths.sharedCodexHome,
+        input.paths.accountRoot,
+        input.paths.runtimeRoot,
+        path.join(input.paths.runtimeRoot, "backups"),
+        path.join(input.paths.runtimeRoot, "tmp"),
+        path.dirname(input.paths.registryFile),
+    ]) {
+        if (!(await pathExists(directory))) {
+            createdDirectories.push(directory);
+            input.logger.info("runtime_init.directory_create", { directory });
+        }
+        else {
+            input.logger.debug("runtime_init.directory_exists", { directory });
+        }
+        await mkdir(directory, { recursive: true });
+    }
+    const configResult = await ensureSharedConfigToml({
+        legacyCodexHome,
+        logger: input.logger,
+        sharedCodexHome: input.paths.sharedCodexHome,
+    });
+    createdFiles.push(...configResult.createdFiles);
+    copiedSharedArtifacts.push(...configResult.copiedArtifacts);
+    skippedArtifacts.push(...configResult.skippedArtifacts);
+    const mcpResult = await ensureSharedFileCopy({
+        artifactName: "mcp.json",
+        logger: input.logger,
+        sharedCodexHome: input.paths.sharedCodexHome,
+        sourceCodexHome: legacyCodexHome,
+    });
+    createdFiles.push(...mcpResult.createdFiles);
+    copiedSharedArtifacts.push(...mcpResult.copiedArtifacts);
+    skippedArtifacts.push(...mcpResult.skippedArtifacts);
+    const trustResult = await ensureSharedDirectoryCopy({
+        artifactName: "trust",
+        logger: input.logger,
+        sharedCodexHome: input.paths.sharedCodexHome,
+        sourceCodexHome: legacyCodexHome,
+    });
+    copiedSharedArtifacts.push(...trustResult.copiedArtifacts);
+    skippedArtifacts.push(...trustResult.skippedArtifacts);
+    // Registry creation is part of first-run runtime setup but must not create account auth state.
+    const registry = createAccountRegistry({
+        accountRoot: input.paths.accountRoot,
+        logger: input.logger,
+        registryFile: input.paths.registryFile,
+    });
+    if (!(await pathExists(input.paths.registryFile))) {
+        createdFiles.push(input.paths.registryFile);
+        input.logger.info("runtime_init.registry_bootstrap", {
+            registryFile: input.paths.registryFile,
+        });
+    }
+    else {
+        input.logger.debug("runtime_init.registry_exists", {
+            registryFile: input.paths.registryFile,
+        });
+    }
+    await registry.listAccounts();
+    const result = {
+        firstRun,
+        legacyCodexHome,
+        sharedCodexHome: input.paths.sharedCodexHome,
+        createdDirectories,
+        createdFiles,
+        copiedSharedArtifacts,
+        skippedArtifacts,
+    };
+    input.logger.info("runtime_init.complete", {
+        firstRun: result.firstRun,
+        createdDirectories: result.createdDirectories,
+        createdFiles: result.createdFiles,
+        copiedSharedArtifacts: result.copiedSharedArtifacts,
+        skippedArtifacts: result.skippedArtifacts,
+    });
+    return result;
+}
+async function ensureSharedConfigToml(input) {
+    const targetPath = path.join(input.sharedCodexHome, "config.toml");
+    const sourcePath = path.join(input.legacyCodexHome, "config.toml");
+    if (await pathExists(targetPath)) {
+        const existingConfig = await readFile(targetPath, "utf8");
+        const existingMode = detectCredentialStoreMode(existingConfig);
+        input.logger.debug("runtime_init.config_exists", {
+            targetPath,
+            credentialStoreMode: existingMode,
+        });
+        if (existingMode === "missing") {
+            await writeFile(targetPath, pinFileCredentialStore(existingConfig), "utf8");
+            input.logger.info("runtime_init.config_file_mode_pinned", {
+                targetPath,
+            });
+        }
+        else if (existingMode !== "file") {
+            input.logger.warn("runtime_init.config_mode_unsupported", {
+                targetPath,
+                credentialStoreMode: existingMode,
+            });
+        }
+        return emptyArtifactResult();
+    }
+    if (await pathExists(sourcePath) && !samePath(sourcePath, targetPath)) {
+        const sourceConfig = await readFile(sourcePath, "utf8");
+        const pinnedConfig = pinFileCredentialStore(sourceConfig);
+        await writeFile(targetPath, pinnedConfig, "utf8");
+        input.logger.info("runtime_init.config_imported", {
+            sourcePath,
+            targetPath,
+            sourceCredentialStoreMode: detectCredentialStoreMode(sourceConfig),
+            targetCredentialStoreMode: detectCredentialStoreMode(pinnedConfig),
+        });
+        return {
+            copiedArtifacts: ["config.toml"],
+            createdFiles: [targetPath],
+            skippedArtifacts: [],
+        };
+    }
+    await writeFile(targetPath, [
+        "cli_auth_credentials_store = \"file\"",
+        "",
+        "# Wrapper-owned shared Codex home for codexes.",
+        "# Add MCP and trust configuration here as needed.",
+        "",
+    ].join("\n"), "utf8");
+    input.logger.info("runtime_init.config_created", {
+        targetPath,
+    });
+    return {
+        copiedArtifacts: [],
+        createdFiles: [targetPath],
+        skippedArtifacts: [],
+    };
+}
+async function ensureSharedFileCopy(input) {
+    const targetPath = path.join(input.sharedCodexHome, input.artifactName);
+    const sourcePath = path.join(input.sourceCodexHome, input.artifactName);
+    if (await pathExists(targetPath)) {
+        input.logger.debug("runtime_init.file_exists", {
+            artifactName: input.artifactName,
+            targetPath,
+        });
+        return emptyArtifactResult();
+    }
+    if (!(await pathExists(sourcePath)) || samePath(sourcePath, targetPath)) {
+        input.logger.debug("runtime_init.file_skip", {
+            artifactName: input.artifactName,
+            sourcePath,
+            targetPath,
+            reason: "source_missing_or_same_path",
+        });
+        return {
+            copiedArtifacts: [],
+            createdFiles: [],
+            skippedArtifacts: [
+                {
+                    path: input.artifactName,
+                    reason: "source_missing_or_same_path",
+                },
+            ],
+        };
+    }
+    await copyFile(sourcePath, targetPath);
+    input.logger.info("runtime_init.file_copied", {
+        artifactName: input.artifactName,
+        sourcePath,
+        targetPath,
+    });
+    return {
+        copiedArtifacts: [input.artifactName],
+        createdFiles: [targetPath],
+        skippedArtifacts: [],
+    };
+}
+async function ensureSharedDirectoryCopy(input) {
+    const targetPath = path.join(input.sharedCodexHome, input.artifactName);
+    const sourcePath = path.join(input.sourceCodexHome, input.artifactName);
+    if (await pathExists(targetPath)) {
+        input.logger.debug("runtime_init.directory_artifact_exists", {
+            artifactName: input.artifactName,
+            targetPath,
+        });
+        return emptyArtifactResult();
+    }
+    if (!(await pathExists(sourcePath)) || samePath(sourcePath, targetPath)) {
+        input.logger.debug("runtime_init.directory_artifact_skip", {
+            artifactName: input.artifactName,
+            sourcePath,
+            targetPath,
+            reason: "source_missing_or_same_path",
+        });
+        return {
+            copiedArtifacts: [],
+            createdFiles: [],
+            skippedArtifacts: [
+                {
+                    path: input.artifactName,
+                    reason: "source_missing_or_same_path",
+                },
+            ],
+        };
+    }
+    await cp(sourcePath, targetPath, { recursive: true });
+    input.logger.info("runtime_init.directory_artifact_copied", {
+        artifactName: input.artifactName,
+        sourcePath,
+        targetPath,
+    });
+    return {
+        copiedArtifacts: [input.artifactName],
+        createdFiles: [],
+        skippedArtifacts: [],
+    };
+}
+function detectCredentialStoreMode(rawConfig) {
+    const match = rawConfig.match(/^\s*cli_auth_credentials_store\s*=\s*"([^"]+)"/m);
+    return match?.[1]?.trim().toLowerCase() ?? "missing";
+}
+function pinFileCredentialStore(rawConfig) {
+    if (/^\s*cli_auth_credentials_store\s*=\s*"file"/m.test(rawConfig)) {
+        return rawConfig;
+    }
+    if (/^\s*cli_auth_credentials_store\s*=\s*"[^"]+"/m.test(rawConfig)) {
+        return rawConfig.replace(/^\s*cli_auth_credentials_store\s*=\s*"[^"]+"/m, 'cli_auth_credentials_store = "file"');
+    }
+    const trimmed = rawConfig.trim();
+    if (!trimmed) {
+        return 'cli_auth_credentials_store = "file"\n';
+    }
+    return ['cli_auth_credentials_store = "file"', "", trimmed, ""].join("\n");
+}
+function samePath(left, right) {
+    return path.resolve(left) === path.resolve(right);
+}
+async function pathExists(targetPath) {
+    try {
+        await stat(targetPath);
+        return true;
+    }
+    catch (error) {
+        if (typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return false;
+        }
+        throw error;
+    }
+}
+function emptyArtifactResult() {
+    return {
+        copiedArtifacts: [],
+        createdFiles: [],
+        skippedArtifacts: [],
+    };
+}
+//# sourceMappingURL=initialize-runtime.js.map

package/dist/runtime/init/initialize-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initialize-runtime.js","sourceRoot":"","sources":["../../../src/runtime/init/initialize-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,EAAE,EACF,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAe3E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IACC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GAAoD,EAAE,CAAC;IAE7E,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;QACtC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,eAAe;QACf,QAAQ;KACT,CAAC,CAAC;IAEH,KAAK,MAAM,SAAS,IAAI;QACtB,KAAK,CAAC,KAAK,CAAC,QAAQ;QACpB,KAAK,CAAC,KAAK,CAAC,eAAe;QAC3B,KAAK,CAAC,KAAK,CAAC,WAAW;QACvB,KAAK,CAAC,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;KACvC,EAAE,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACnC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC;QAChD,eAAe;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;KAC7C,CAAC,CAAC;IACH,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAChD,qBAAqB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC5D,gBAAgB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;QAC3C,YAAY,EAAE,UAAU;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,eAAe,EAAE,eAAe;KACjC,CAAC,CAAC;IACH,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7C,qBAAqB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACzD,gBAAgB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAErD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC;QAClD,YAAY,EAAE,OAAO;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,eAAe,EAAE,eAAe;KACjC,CAAC,CAAC;IACH,qBAAqB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC3D,gBAAgB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAEvD,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QACrC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAClD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YACnD,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;SACvC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;YACjD,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;SACvC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAgC;QAC1C,QAAQ;QACR,eAAe;QACf,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,kBAAkB;QAClB,YAAY;QACZ,qBAAqB;QACrB,gBAAgB;KACjB,CAAC;IAEF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;QACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAIrC;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IAEnE,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QAE/D,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAC/C,UAAU;YACV,mBAAmB,EAAE,YAAY;SAClC,CAAC,CAAC;QAEH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5E,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACxD,UAAU;aACX,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACxD,UAAU;gBACV,mBAAmB,EAAE,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAElD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAChD,UAAU;YACV,UAAU;YACV,yBAAyB,EAAE,yBAAyB,CAAC,YAAY,CAAC;YAClE,yBAAyB,EAAE,yBAAyB,CAAC,YAAY,CAAC;SACnE,CAAC,CAAC;QAEH,OAAO;YACL,eAAe,EAAE,CAAC,aAAa,CAAC;YAChC,YAAY,EAAE,CAAC,UAAU,CAAC;YAC1B,gBAAgB,EAAE,EAAE;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,CACb,UAAU,EACV;QACE,uCAAuC;QACvC,EAAE;QACF,gDAAgD;QAChD,mDAAmD;QACnD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;QAC/C,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,CAAC,UAAU,CAAC;QAC1B,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAKnC;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAExE,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU;SACX,CAAC,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACxE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU;YACV,UAAU;YACV,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,EAAE;YACnB,YAAY,EAAE,EAAE;YAChB,gBAAgB,EAAE;gBAChB;oBACE,IAAI,EAAE,KAAK,CAAC,YAAY;oBACxB,MAAM,EAAE,6BAA6B;iBACtC;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;QAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU;QACV,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;QACrC,YAAY,EAAE,CAAC,UAAU,CAAC;QAC1B,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAKxC;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAExE,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;YAC3D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU;SACX,CAAC,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACxE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU;YACV,UAAU;YACV,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,EAAE;YACnB,YAAY,EAAE,EAAE;YAChB,gBAAgB,EAAE;gBAChB;oBACE,IAAI,EAAE,KAAK,CAAC,YAAY;oBACxB,MAAM,EAAE,6BAA6B;iBACtC;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;QAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU;QACV,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;QACrC,YAAY,EAAE,EAAE;QAChB,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACjF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,IAAI,8CAA8C,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,+CAA+C,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC,OAAO,CACtB,+CAA+C,EAC/C,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,qCAAqC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAWD,SAAS,mBAAmB;IAC1B,OAAO;QACL,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC"}

package/dist/runtime/lock/runtime-lock.d.ts

@@ -0,0 +1,11 @@
+import type { Logger } from "../../logging/logger.js";
+export interface RuntimeLock {
+    release(): Promise<void>;
+}
+export declare function acquireRuntimeLock(input: {
+    logger: Logger;
+    runtimeRoot: string;
+    pollIntervalMs?: number;
+    staleLockMs?: number;
+    waitTimeoutMs?: number;
+}): Promise<RuntimeLock>;

package/dist/runtime/lock/runtime-lock.js

@@ -0,0 +1,99 @@
+import os from "node:os";
+import path from "node:path";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+const DEFAULT_WAIT_TIMEOUT_MS = 15_000;
+const DEFAULT_STALE_LOCK_MS = 5 * 60 * 1000;
+const DEFAULT_POLL_INTERVAL_MS = 250;
+export async function acquireRuntimeLock(input) {
+    const lockRoot = path.join(input.runtimeRoot, "lock");
+    const ownerFile = path.join(lockRoot, "owner.json");
+    const waitTimeoutMs = input.waitTimeoutMs ?? DEFAULT_WAIT_TIMEOUT_MS;
+    const staleLockMs = input.staleLockMs ?? DEFAULT_STALE_LOCK_MS;
+    const pollIntervalMs = input.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const startedAt = Date.now();
+    input.logger.info("runtime_lock.acquire.start", {
+        lockRoot,
+        waitTimeoutMs,
+        staleLockMs,
+        pollIntervalMs,
+    });
+    while (true) {
+        try {
+            await mkdir(lockRoot);
+            const owner = {
+                pid: process.pid,
+                host: os.hostname(),
+                createdAt: new Date().toISOString(),
+            };
+            await writeFile(ownerFile, JSON.stringify(owner, null, 2), "utf8");
+            input.logger.info("runtime_lock.acquire.complete", {
+                lockRoot,
+                waitedMs: Date.now() - startedAt,
+                owner,
+            });
+            return {
+                async release() {
+                    input.logger.info("runtime_lock.release.start", { lockRoot });
+                    await rm(lockRoot, { force: true, recursive: true }).catch(() => undefined);
+                    input.logger.info("runtime_lock.release.complete", { lockRoot });
+                },
+            };
+        }
+        catch (error) {
+            if (!isAlreadyExistsError(error)) {
+                input.logger.error("runtime_lock.acquire.failed", {
+                    lockRoot,
+                    message: error instanceof Error ? error.message : String(error),
+                });
+                throw error;
+            }
+        }
+        const lockAgeMs = await readLockAgeMs(lockRoot, ownerFile);
+        if (lockAgeMs !== null && lockAgeMs > staleLockMs) {
+            input.logger.warn("runtime_lock.stale_detected", {
+                lockRoot,
+                lockAgeMs,
+            });
+            await rm(lockRoot, { force: true, recursive: true }).catch(() => undefined);
+            continue;
+        }
+        const waitedMs = Date.now() - startedAt;
+        input.logger.debug("runtime_lock.acquire.waiting", {
+            lockRoot,
+            waitedMs,
+            lockAgeMs,
+        });
+        if (waitedMs >= waitTimeoutMs) {
+            input.logger.error("runtime_lock.acquire.timeout", {
+                lockRoot,
+                waitedMs,
+                lockAgeMs,
+            });
+            throw new Error(`Timed out waiting for the shared runtime lock after ${waitTimeoutMs}ms.`);
+        }
+        await sleep(pollIntervalMs);
+    }
+}
+async function readLockAgeMs(lockRoot, ownerFile) {
+    const ownerContents = await readFile(ownerFile, "utf8").catch(() => null);
+    if (ownerContents) {
+        const parsed = JSON.parse(ownerContents);
+        if (typeof parsed.createdAt === "string") {
+            return Date.now() - new Date(parsed.createdAt).getTime();
+        }
+    }
+    const lockStats = await stat(lockRoot).catch(() => null);
+    return lockStats ? Date.now() - lockStats.mtimeMs : null;
+}
+function isAlreadyExistsError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "EEXIST");
+}
+function sleep(durationMs) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, durationMs);
+    });
+}
+//# sourceMappingURL=runtime-lock.js.map

package/dist/runtime/lock/runtime-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-lock.js","sourceRoot":"","sources":["../../../src/runtime/lock/runtime-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGxE,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAMrC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAMxC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QAC9C,QAAQ;QACR,aAAa;QACb,WAAW;QACX,cAAc;KACf,CAAC,CAAC;IAEH,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG;gBACZ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAEnE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBACjD,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,KAAK;aACN,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,CAAC,OAAO;oBACX,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC9D,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC5E,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACnE,CAAC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;oBAChD,QAAQ;oBACR,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAChE,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,WAAW,EAAE,CAAC;YAClD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC/C,QAAQ;gBACR,SAAS;aACV,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;YACjD,QAAQ;YACR,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBACjD,QAAQ;gBACR,QAAQ;gBACR,SAAS;aACV,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,uDAAuD,aAAa,KAAK,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,SAAiB;IAC9D,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAA4B,CAAC;QACpE,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,UAAkB;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/login-workspace.d.ts

@@ -0,0 +1,18 @@
+import type { Logger } from "../logging/logger.js";
+import type { RuntimeContract } from "./runtime-contract.js";
+export interface LoginWorkspace {
+    workspaceRoot: string;
+    codexHome: string;
+}
+export declare function prepareLoginWorkspace(input: {
+    logger: Logger;
+    runtimeRoot: string;
+    sharedCodexHome: string;
+}): Promise<LoginWorkspace>;
+export declare function copyAccountScopedAuthArtifacts(input: {
+    accountId: string;
+    destinationRoot: string;
+    logger: Logger;
+    runtimeContract: RuntimeContract;
+    sourceCodexHome: string;
+}): Promise<void>;

package/dist/runtime/login-workspace.js

@@ -0,0 +1,171 @@
+import { copyFile, cp, mkdir, mkdtemp, readFile, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+export async function prepareLoginWorkspace(input) {
+    const workspaceParent = path.join(input.runtimeRoot, "tmp");
+    await mkdir(workspaceParent, { recursive: true });
+    const workspaceRoot = await mkdtemp(path.join(workspaceParent, "account-add-"));
+    const codexHome = path.join(workspaceRoot, "codex-home");
+    await mkdir(codexHome, { recursive: true });
+    input.logger.info("login_workspace.created", {
+        workspaceRoot,
+        codexHome,
+        sharedCodexHome: input.sharedCodexHome,
+    });
+    await ensurePinnedFileConfig({
+        codexHome,
+        logger: input.logger,
+        sharedCodexHome: input.sharedCodexHome,
+    });
+    await copySharedArtifactIfPresent({
+        artifactName: "mcp.json",
+        codexHome,
+        logger: input.logger,
+        sharedCodexHome: input.sharedCodexHome,
+    });
+    await copySharedDirectoryIfPresent({
+        artifactName: "trust",
+        codexHome,
+        logger: input.logger,
+        sharedCodexHome: input.sharedCodexHome,
+    });
+    await mkdir(path.join(codexHome, "sessions"), { recursive: true });
+    return { workspaceRoot, codexHome };
+}
+export async function copyAccountScopedAuthArtifacts(input) {
+    const accountRules = input.runtimeContract.fileRules.filter((rule) => rule.classification === "account");
+    input.logger.info("login_workspace.copy_account_artifacts.start", {
+        accountId: input.accountId,
+        destinationRoot: input.destinationRoot,
+        sourceCodexHome: input.sourceCodexHome,
+        allowedPatterns: accountRules.map((rule) => rule.pathPattern),
+    });
+    await mkdir(input.destinationRoot, { recursive: true });
+    for (const rule of accountRules) {
+        await copyRuleArtifacts({
+            destinationRoot: input.destinationRoot,
+            logger: input.logger,
+            rule,
+            sourceCodexHome: input.sourceCodexHome,
+        });
+    }
+    input.logger.info("login_workspace.copy_account_artifacts.complete", {
+        accountId: input.accountId,
+        destinationRoot: input.destinationRoot,
+    });
+}
+async function ensurePinnedFileConfig(input) {
+    const sourceConfigPath = path.join(input.sharedCodexHome, "config.toml");
+    const targetConfigPath = path.join(input.codexHome, "config.toml");
+    const configContents = await readFile(sourceConfigPath, "utf8").catch(() => "");
+    const pinnedConfig = pinFileCredentialStore(configContents);
+    await writeFile(targetConfigPath, pinnedConfig, "utf8");
+    input.logger.info("login_workspace.config_prepared", {
+        sourceConfigPath,
+        targetConfigPath,
+        credentialStoreMode: "file",
+    });
+}
+async function copySharedArtifactIfPresent(input) {
+    const sourcePath = path.join(input.sharedCodexHome, input.artifactName);
+    const targetPath = path.join(input.codexHome, input.artifactName);
+    if (!(await pathExists(sourcePath))) {
+        input.logger.debug("login_workspace.shared_file_skipped", {
+            artifactName: input.artifactName,
+            sourcePath,
+            reason: "missing",
+        });
+        return;
+    }
+    await copyFile(sourcePath, targetPath);
+    input.logger.debug("login_workspace.shared_file_copied", {
+        artifactName: input.artifactName,
+        sourcePath,
+        targetPath,
+    });
+}
+async function copySharedDirectoryIfPresent(input) {
+    const sourcePath = path.join(input.sharedCodexHome, input.artifactName);
+    const targetPath = path.join(input.codexHome, input.artifactName);
+    if (!(await pathExists(sourcePath))) {
+        input.logger.debug("login_workspace.shared_directory_skipped", {
+            artifactName: input.artifactName,
+            sourcePath,
+            reason: "missing",
+        });
+        return;
+    }
+    await cp(sourcePath, targetPath, { recursive: true });
+    input.logger.debug("login_workspace.shared_directory_copied", {
+        artifactName: input.artifactName,
+        sourcePath,
+        targetPath,
+    });
+}
+async function copyRuleArtifacts(input) {
+    if (input.rule.pathPattern.endsWith("/**")) {
+        const relativeDirectory = input.rule.pathPattern.slice(0, -3);
+        const sourceDirectory = path.join(input.sourceCodexHome, relativeDirectory);
+        const targetDirectory = path.join(input.destinationRoot, relativeDirectory);
+        if (!(await pathExists(sourceDirectory))) {
+            input.logger.debug("login_workspace.account_directory_skipped", {
+                pathPattern: input.rule.pathPattern,
+                sourceDirectory,
+                reason: "missing",
+            });
+            return;
+        }
+        await cp(sourceDirectory, targetDirectory, { recursive: true });
+        input.logger.debug("login_workspace.account_directory_copied", {
+            pathPattern: input.rule.pathPattern,
+            sourceDirectory,
+            targetDirectory,
+        });
+        return;
+    }
+    const sourceFile = path.join(input.sourceCodexHome, input.rule.pathPattern);
+    const targetFile = path.join(input.destinationRoot, input.rule.pathPattern);
+    if (!(await pathExists(sourceFile))) {
+        input.logger.debug("login_workspace.account_file_skipped", {
+            pathPattern: input.rule.pathPattern,
+            sourceFile,
+            reason: "missing",
+        });
+        return;
+    }
+    await mkdir(path.dirname(targetFile), { recursive: true });
+    await copyFile(sourceFile, targetFile);
+    input.logger.debug("login_workspace.account_file_copied", {
+        pathPattern: input.rule.pathPattern,
+        sourceFile,
+        targetFile,
+    });
+}
+function pinFileCredentialStore(rawConfig) {
+    if (/^\s*cli_auth_credentials_store\s*=\s*"file"/m.test(rawConfig)) {
+        return rawConfig;
+    }
+    if (/^\s*cli_auth_credentials_store\s*=\s*"[^"]+"/m.test(rawConfig)) {
+        return rawConfig.replace(/^\s*cli_auth_credentials_store\s*=\s*"[^"]+"/m, 'cli_auth_credentials_store = "file"');
+    }
+    const trimmed = rawConfig.trim();
+    if (!trimmed) {
+        return 'cli_auth_credentials_store = "file"\n';
+    }
+    return ['cli_auth_credentials_store = "file"', "", trimmed, ""].join("\n");
+}
+async function pathExists(targetPath) {
+    try {
+        await stat(targetPath);
+        return true;
+    }
+    catch (error) {
+        if (typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return false;
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=login-workspace.js.map

package/dist/runtime/login-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-workspace.js","sourceRoot":"","sources":["../../src/runtime/login-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAEzD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAC3C,aAAa;QACb,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IAEH,MAAM,sBAAsB,CAAC;QAC3B,SAAS;QACT,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,UAAU;QACxB,SAAS;QACT,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,4BAA4B,CAAC;QACjC,YAAY,EAAE,OAAO;QACrB,SAAS;QACT,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEnE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CACzD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAC5C,CAAC;IAEF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,iBAAiB,CAAC;YACtB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI;YACJ,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;QACnE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAIrC;IACC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAE5D,MAAM,SAAS,CAAC,gBAAgB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;QACnD,gBAAgB;QAChB,gBAAgB;QAChB,mBAAmB,EAAE,MAAM;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAK1C;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAElE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU;YACV,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;QACvD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU;QACV,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAElE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;YAC7D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU;YACV,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU;QACV,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAKhC;IACC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC5E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAE5E,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBAC9D,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;gBACnC,eAAe;gBACf,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;YAC7D,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;YACnC,eAAe;YACf,eAAe;SAChB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;YACzD,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;YACnC,UAAU;YACV,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;QACxD,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,UAAU;QACV,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,IAAI,8CAA8C,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,+CAA+C,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC,OAAO,CACtB,+CAA+C,EAC/C,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,qCAAqC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/runtime/runtime-contract.d.ts

@@ -0,0 +1,44 @@
+import type { CredentialStoreMode } from "../config/wrapper-config.js";
+import type { Logger } from "../logging/logger.js";
+export type RuntimeFileClass = "shared" | "account" | "ephemeral" | "protected";
+export interface RuntimeFileRule {
+    pathPattern: string;
+    classification: RuntimeFileClass;
+    syncBack: "never" | "if-changed" | "account-to-runtime-only";
+    reason: string;
+}
+export interface RuntimeContract {
+    credentialStoreMode: CredentialStoreMode;
+    sharedCodexHome: string;
+    runtimeRoot: string;
+    perAccountRoot: string;
+    supported: boolean;
+    fileRules: RuntimeFileRule[];
+    syncBackStrategy: {
+        whenChildProcessSucceeds: string;
+        whenChildProcessFails: string;
+        compareStrategy: string;
+    };
+}
+export declare function createRuntimeContract(input: {
+    accountRoot: string;
+    credentialStoreMode: CredentialStoreMode;
+    logger: Logger;
+    runtimeRoot: string;
+    sharedCodexHome: string;
+}): RuntimeContract;
+export declare function resolveAccountRuntimePaths(contract: RuntimeContract, accountId: string): {
+    accountDirectory: string;
+    accountStateDirectory: string;
+    accountMetadataFile: string;
+    runtimeBackupDirectory: string;
+    runtimeTempDirectory: string;
+};
+export declare function summarizeRuntimeContract(contract: RuntimeContract): {
+    supported: boolean;
+    credentialStoreMode: CredentialStoreMode;
+    sharedCodexHome: string;
+    runtimeRoot: string;
+    perAccountRoot: string;
+    classifications: Record<RuntimeFileClass, number>;
+};