@nowcrew/daemon 0.6.88-beta.3 → 0.6.88-beta.30

package/dist/daemon-migration-controller.js

@@ -1,211 +0,0 @@
-import { createHash } from "node:crypto";
-import { cp, lstat, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, relative, resolve } from "node:path";
-import { z } from "zod";
-import { loadProfile } from "./computer-profile.js";
-import { builtDaemonEntry } from "./computer-cli.js";
-import { installDaemonAutomatically } from "./automatic-daemon-installer.js";
-import { buildServiceSpec, captureExactService, serviceStatus, systemCommandRunner } from "./computer-service.js";
-import { readManagedServiceRegistry } from "./managed-service-registry.js";
-import { uninstallManagedService } from "./managed-service-lifecycle.js";
-import { resolveAutomaticInstallTarget } from "./automatic-install-target.js";
-import { buildStorageMigrationMappings, createSafeServiceManifest, CredentialMaterialError, } from "./storage-migration-manifest.js";
-const MigrationMessageSchema = z.object({
-    type: z.literal("daemon:migrate"),
-    migrationId: z.string().uuid(),
-    targetProfile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/),
-    targetDaemonHome: z.string().min(1),
-    targetAgentsRoot: z.string().min(1),
-}).strict();
-function migrationBackupRoot(input, id) {
-    return resolve(input.backupRoot ?? resolve(input.userHome ?? homedir(), ".crew", "migration-backups"), id);
-}
-function legacyLocalHome(input) {
-    return resolve(input.userHome ?? homedir(), ".crew");
-}
-async function assertEmptyOrMissing(path) {
-    try {
-        const entries = await readdir(path);
-        if (entries.length > 0)
-            throw new Error(`target path is not empty: ${path}`);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-}
-async function hashedFiles(root, directory = root) {
-    const entries = await readdir(directory, { withFileTypes: true });
-    const files = [];
-    for (const entry of entries) {
-        const path = resolve(directory, entry.name);
-        const stat = await lstat(path);
-        if (stat.isSymbolicLink())
-            throw new Error(`backup source contains a symbolic link: ${relative(root, path)}`);
-        if (stat.isDirectory())
-            files.push(...await hashedFiles(root, path));
-        else if (stat.isFile())
-            files.push({ path: relative(root, path), sha256: createHash("sha256").update(await readFile(path)).digest("hex") });
-    }
-    return files;
-}
-async function backupAndCopy(input, id, targetHome, targetAgents, service) {
-    // Validate and project service identity before creating any backup bytes. A descriptor containing
-    // a token must stop the migration before it can be copied into the local backup root.
-    const safeService = createSafeServiceManifest({
-        spec: service.spec,
-        snapshot: service.snapshot,
-        managedRecord: service.managedRecord,
-    });
-    const backup = migrationBackupRoot(input, id);
-    await mkdir(backup, { recursive: true, mode: 0o700 });
-    await cp(input.currentDaemonHome, resolve(backup, "daemon-home"), { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, resolve(backup, "agents-root"), { recursive: true, force: false });
-    await cp(input.currentDaemonHome, targetHome, { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, targetAgents, { recursive: true, force: false });
-    const daemonFiles = await hashedFiles(resolve(backup, "daemon-home"));
-    const agentFiles = await hashedFiles(resolve(backup, "agents-root"));
-    const mappings = buildStorageMigrationMappings({ daemonFiles, agentFiles });
-    await writeFile(resolve(backup, "manifest.json"), `${JSON.stringify({
-        version: 2,
-        migrationId: id,
-        profile: input.profileName,
-        daemonHome: input.currentDaemonHome,
-        agentsRoot: input.currentAgentsRoot,
-        service: safeService,
-        mappings,
-    }, null, 2)}\n`, { mode: 0o600 });
-    return backup;
-}
-async function cleanupCurrentServiceDefault(spec, input) {
-    const userHome = input.userHome ?? homedir();
-    const records = await readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) });
-    const record = records.find((candidate) => candidate.profile === spec.profile && candidate.daemonHome === input.currentDaemonHome);
-    if (record !== undefined && (spec.platform === "darwin" || spec.platform === "linux")) {
-        await uninstallManagedService({ spec, record, runner: systemCommandRunner, registry: { userHome, localHome: legacyLocalHome(input) } });
-        return;
-    }
-    // Windows and legacy descriptors are handled by the normal CLI/service lifecycle.
-    const { uninstallService } = await import("./computer-service.js");
-    const status = await serviceStatus(spec, systemCommandRunner);
-    if (status.installed)
-        await uninstallService(spec, systemCommandRunner);
-}
-export function createDaemonMigrationController(input) {
-    const handled = new Set();
-    let running = null;
-    const sendFailure = (id, errorCode, error) => {
-        input.sendStatus({ type: "daemon:migration-status", migrationId: id, status: "failed", errorCode, errorMessage: error instanceof Error ? error.message : String(error) });
-    };
-    const execute = async (raw) => {
-        const parsed = MigrationMessageSchema.safeParse(raw);
-        if (!parsed.success)
-            return false;
-        const message = parsed.data;
-        if (handled.has(message.migrationId))
-            return true;
-        if (running !== null) {
-            sendFailure(message.migrationId, "target_conflict", new Error("another migration is already running"));
-            return true;
-        }
-        running = (async () => {
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "preflight" });
-            if (input.isBusy()) {
-                sendFailure(message.migrationId, "runtime_busy", new Error("active executions must finish before migration"));
-                return;
-            }
-            const platform = input.platform ?? process.platform;
-            const userHome = input.userHome ?? homedir();
-            let targetPath;
-            let targetAgents;
-            let currentSpec;
-            let currentService;
-            let managedRecord = null;
-            let currentRegistryUrl;
-            try {
-                const currentProfile = await (input.loadCurrentProfile ?? loadProfile)(input.profileName, input.currentDaemonHome);
-                if (currentProfile.machineToken !== input.machineToken)
-                    throw new Error("active profile token does not match this daemon");
-                currentRegistryUrl = currentProfile.registryUrl;
-                const target = resolveAutomaticInstallTarget({
-                    serverUrl: input.serverUrl,
-                    requestedProfile: message.targetProfile,
-                    userHome,
-                    platform,
-                    // Layout migration creates the canonical service in the new local-home
-                    // root. Source registry and rollback material remain under legacy .crew.
-                    requestedLocalHomeMode: "nowwork",
-                });
-                if (!isAbsolute(message.targetDaemonHome) || !isAbsolute(message.targetAgentsRoot)
-                    || resolve(message.targetDaemonHome) !== resolve(target.daemonHome)
-                    || resolve(message.targetAgentsRoot) !== resolve(target.agentsRoot))
-                    throw new Error("requested target does not match the standard profile layout");
-                targetPath = resolve(target.daemonHome);
-                targetAgents = resolve(target.agentsRoot);
-                await assertEmptyOrMissing(targetPath);
-                await assertEmptyOrMissing(targetAgents);
-                currentSpec = buildServiceSpec({ platform, profile: input.profileName, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: input.currentDaemonHome });
-                const exact = await (input.captureCurrentService ?? ((spec) => captureExactService(spec, systemCommandRunner)))(currentSpec);
-                if (!exact.installed || !exact.running || !exact.exact)
-                    throw new Error("current managed service identity is not exact and running");
-                currentService = { installed: exact.installed, running: exact.running };
-                if (platform === "darwin" || platform === "linux") {
-                    const records = await (input.readManagedRecords ?? (() => readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) })))();
-                    managedRecord = records.find((record) => record.serviceId === currentSpec.id && record.profile === input.profileName && record.daemonHome === input.currentDaemonHome) ?? null;
-                    if (managedRecord === null)
-                        throw new Error("current managed service registry record is missing");
-                }
-            }
-            catch (error) {
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "target_conflict", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "backing_up" });
-            let backupPath;
-            try {
-                backupPath = await backupAndCopy(input, message.migrationId, targetPath, targetAgents, { spec: currentSpec, snapshot: currentService, managedRecord });
-                input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "installing", backupPath });
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "backup_failed", error);
-                return;
-            }
-            const install = input.install ?? installDaemonAutomatically;
-            try {
-                const result = await install({
-                    serverUrl: input.serverUrl,
-                    machineToken: input.machineToken,
-                    requestedProfile: message.targetProfile,
-                    requestedLocalHomeMode: "nowwork",
-                    ...(currentRegistryUrl === undefined ? {} : { requestedRegistryUrl: currentRegistryUrl }),
-                });
-                if (result.profile !== message.targetProfile || result.serviceId.length === 0) {
-                    throw new Error("target service identity did not match the requested profile");
-                }
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, "install_failed", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "restarting" });
-            try {
-                await (input.cleanupCurrentService ?? ((spec) => cleanupCurrentServiceDefault(spec, input)))(currentSpec);
-            }
-            catch (error) {
-                const targetSpec = buildServiceSpec({ platform, profile: message.targetProfile, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: targetPath });
-                await (input.cleanupTargetService ?? ((spec) => cleanupCurrentServiceDefault(spec, { ...input, profileName: message.targetProfile, currentDaemonHome: targetPath })))(targetSpec).catch(() => undefined);
-                sendFailure(message.migrationId, "service_cleanup_failed", error);
-                return;
-            }
-        })().finally(() => {
-            handled.add(message.migrationId);
-            running = null;
-        });
-        await running;
-        return true;
-    };
-    return { handle: execute, drain: async () => { await running; } };
-}

package/dist/daemon-migration-wiring.js

@@ -1,22 +0,0 @@
-import { daemonHome } from "./computer-profile.js";
-import { createDaemonMigrationController } from "./daemon-migration-controller.js";
-export function createServeMigrationController(input) {
-    if (input.profileName === undefined)
-        return null;
-    return createDaemonMigrationController({
-        serverUrl: input.config.serverUrl,
-        machineToken: input.config.machineToken,
-        profileName: input.profileName,
-        currentDaemonHome: daemonHome(),
-        currentAgentsRoot: input.config.agentsRoot,
-        isBusy: input.isBusy,
-        sendStatus: input.sendStatus,
-    });
-}
-export async function handleMigrationControlMessage(controller, decoded) {
-    if (controller === null || typeof decoded !== "object" || decoded === null
-        || !("type" in decoded) || decoded.type !== "daemon:migrate")
-        return false;
-    await controller.handle(decoded);
-    return true;
-}

package/dist/runtimes/codex-home-migration-cli.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-import { parseArgs } from "node:util";
-import { migrateCodexHome } from "./codex-home-migration.js";
-const { values } = parseArgs({
-    args: process.argv.slice(2),
-    strict: true,
-    options: {
-        "agent-home": { type: "string" },
-        "source-home": { type: "string" },
-        "backup-root": { type: "string" },
-        yes: { type: "boolean", default: false },
-    },
-});
-function required(value, name) {
-    if (!value?.trim())
-        throw new Error(`Missing --${name}`);
-    return value;
-}
-if (!values.yes)
-    throw new Error("Refusing Codex home migration without --yes");
-const result = await migrateCodexHome({
-    agentHome: required(values["agent-home"], "agent-home"),
-    sourceHome: required(values["source-home"], "source-home"),
-    backupRoot: required(values["backup-root"], "backup-root"),
-});
-process.stdout.write(`${result.status}${result.backupDir ? ` backup=${result.backupDir}` : ""}\n`);

package/dist/runtimes/codex-home-migration.js

@@ -1,112 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { lstat, mkdir, readlink, rename, rm, symlink, unlink, } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { randomUUID } from "node:crypto";
-import { atomicPrivateWrite } from "../atomic-private-write.js";
-import { defaultCodexHome, materializeDefaultCodexHome } from "./codex-home.js";
-const execFileAsync = promisify(execFile);
-const SQLITE_FILES = ["state_5.sqlite", "state_5.sqlite-wal", "state_5.sqlite-shm"];
-const MARKER_NAME = ".codex-home-migration.json";
-async function exists(path) {
-    try {
-        await lstat(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return false;
-        throw error;
-    }
-}
-async function assertNoOpenSqliteFiles(codexHome) {
-    for (const name of SQLITE_FILES) {
-        const path = join(codexHome, name);
-        if (!(await exists(path)))
-            continue;
-        try {
-            const result = await execFileAsync("lsof", ["-t", "--", path], { encoding: "utf8" });
-            if (result.stdout.trim()) {
-                throw new Error(`Codex SQLite file is still open: ${path}`);
-            }
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === 1)
-                continue;
-            if (code === "ENOENT")
-                throw new Error("lsof is required to verify Codex home quiescence");
-            throw error;
-        }
-    }
-}
-async function symlinkTarget(path) {
-    try {
-        const info = await lstat(path);
-        if (!info.isSymbolicLink())
-            return null;
-        return await readlink(path);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-export async function migrateCodexHome(input, dependencies = {}) {
-    const agentHome = resolve(input.agentHome);
-    const sourceHome = resolve(input.sourceHome);
-    const backupRoot = resolve(input.backupRoot);
-    const codexHome = defaultCodexHome(agentHome);
-    const sessions = join(codexHome, "sessions");
-    const index = join(codexHome, "session_index.jsonl");
-    const expectedSessions = resolve(sourceHome, "sessions");
-    const expectedIndex = resolve(sourceHome, "session_index.jsonl");
-    const marker = join(codexHome, MARKER_NAME);
-    const sessionLink = await symlinkTarget(sessions);
-    const indexLink = await symlinkTarget(index);
-    if (sessionLink === null && indexLink === null && await exists(marker)) {
-        return { status: "already-migrated" };
-    }
-    if (sessionLink === null || indexLink === null) {
-        throw new Error("Refusing migration: Codex home is not in the complete legacy symlink layout");
-    }
-    if (resolve(codexHome, sessionLink) !== expectedSessions || resolve(codexHome, indexLink) !== expectedIndex) {
-        throw new Error("Refusing migration: legacy symlinks do not point to the configured source home");
-    }
-    await (dependencies.ensureQuiesced ?? assertNoOpenSqliteFiles)(codexHome);
-    const stamp = (dependencies.now ?? (() => new Date()))().toISOString().replaceAll(/[^0-9]/g, "").slice(0, 14);
-    const backupDir = join(backupRoot, `${stamp}-${dependencies.id?.() ?? randomUUID()}`);
-    await mkdir(backupDir, { recursive: true, mode: 0o700 });
-    await symlink(sessionLink, join(backupDir, "sessions"), "dir");
-    await symlink(indexLink, join(backupDir, "session_index.jsonl"), "file");
-    const moved = [];
-    try {
-        for (const name of SQLITE_FILES) {
-            const current = join(codexHome, name);
-            if (await exists(current)) {
-                await rename(current, join(backupDir, name));
-                moved.push(name);
-            }
-        }
-        await materializeDefaultCodexHome(agentHome, sourceHome);
-        await atomicPrivateWrite(marker, JSON.stringify({
-            version: 1,
-            migrated_at: new Date().toISOString(),
-            source_home: sourceHome,
-            backup_dir: backupDir,
-        }) + "\n");
-        return { status: "migrated", backupDir };
-    }
-    catch (error) {
-        for (const name of moved.reverse()) {
-            await rename(join(backupDir, name), join(codexHome, name)).catch(() => undefined);
-        }
-        await rm(sessions, { recursive: true, force: true });
-        await unlink(index).catch(() => undefined);
-        await symlink(sessionLink, sessions, "dir").catch(() => undefined);
-        await symlink(indexLink, index, "file").catch(() => undefined);
-        throw error;
-    }
-}
-export const codexHomeMigrationMarkerName = MARKER_NAME;

package/dist/runtimes/codex-home.js

@@ -1,236 +0,0 @@
-import { chmod, copyFile, lstat, mkdir, open, readdir, readlink, rename, rm, symlink, unlink, link, writeFile, } from "node:fs/promises";
-import { constants } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
-const PRIVATE_CODEX_HOME = ".codex";
-export function defaultCodexHome(homeDir) {
-    return resolve(homeDir, PRIVATE_CODEX_HOME);
-}
-async function linkIfMissing(source, target) {
-    try {
-        await lstat(target);
-        return;
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-    try {
-        await lstat(source);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    try {
-        await symlink(source, target, "file");
-    }
-    catch (error) {
-        if (error.code !== "EEXIST")
-            throw error;
-    }
-}
-function isBelow(root, candidate) {
-    const child = relative(root, candidate);
-    return child !== "" && child !== ".." && !child.startsWith(`..${sep}`) && !child.startsWith(sep);
-}
-async function isExactSymlink(target, expectedSource) {
-    const linkTarget = await readlink(target);
-    return resolve(dirname(target), linkTarget) === resolve(expectedSource);
-}
-async function ensurePrivateSessions(target, legacySource) {
-    try {
-        const current = await lstat(target);
-        if (current.isSymbolicLink()) {
-            if (legacySource === undefined || !(await isExactSymlink(target, legacySource))) {
-                throw new Error(`Refusing to replace unexpected Codex sessions symlink: ${target}`);
-            }
-            const replacement = `${target}.private-${process.pid}-${Math.random().toString(36).slice(2)}`;
-            const legacyBackup = `${target}.legacy-${process.pid}-${Math.random().toString(36).slice(2)}`;
-            try {
-                await mkdir(replacement, { mode: 0o700 });
-                await rename(target, legacyBackup);
-                try {
-                    await rename(replacement, target);
-                }
-                catch (error) {
-                    await rename(legacyBackup, target).catch(() => undefined);
-                    throw error;
-                }
-            }
-            finally {
-                await rm(replacement, { recursive: true, force: true }).catch(() => undefined);
-                await rm(legacyBackup, { recursive: true, force: true }).catch(() => undefined);
-            }
-        }
-        else if (!current.isDirectory()) {
-            throw new Error(`Codex sessions target is not a directory: ${target}`);
-        }
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-        await mkdir(target, { mode: 0o700 });
-    }
-    await chmod(target, 0o700);
-}
-async function atomicCopyFile(source, target, mode) {
-    const parent = dirname(target);
-    await mkdir(parent, { recursive: true, mode: 0o700 });
-    const temporary = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-    try {
-        await copyFile(source, temporary, constants.COPYFILE_EXCL);
-        await chmod(temporary, mode);
-        try {
-            await link(temporary, target);
-            return true;
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            return false;
-        }
-    }
-    finally {
-        await unlink(temporary).catch(() => undefined);
-    }
-}
-async function ensurePrivateIndex(target, source) {
-    let current;
-    try {
-        current = await lstat(target);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-    if (current?.isSymbolicLink()) {
-        if (source === undefined || !(await isExactSymlink(target, source))) {
-            throw new Error(`Refusing to replace unexpected Codex session index symlink: ${target}`);
-        }
-        const replacement = `${target}.private-${process.pid}-${Math.random().toString(36).slice(2)}`;
-        const legacyBackup = `${target}.legacy-${process.pid}-${Math.random().toString(36).slice(2)}`;
-        try {
-            try {
-                await lstat(source);
-                await copyFile(source, replacement, constants.COPYFILE_EXCL);
-            }
-            catch (error) {
-                if (error.code !== "ENOENT")
-                    throw error;
-                await writeFile(replacement, "", { encoding: "utf8", flag: "wx" });
-            }
-            await chmod(replacement, 0o600);
-            await rename(target, legacyBackup);
-            try {
-                await rename(replacement, target);
-            }
-            catch (error) {
-                await rename(legacyBackup, target).catch(() => undefined);
-                throw error;
-            }
-        }
-        finally {
-            await rm(replacement, { force: true }).catch(() => undefined);
-            await rm(legacyBackup, { force: true }).catch(() => undefined);
-        }
-        current = undefined;
-    }
-    if (current !== undefined && !current.isFile()) {
-        throw new Error(`Codex session index target is not a regular file: ${target}`);
-    }
-    if (current !== undefined) {
-        await chmod(target, 0o600);
-        return;
-    }
-    if (source !== undefined) {
-        try {
-            await lstat(source);
-            if (await atomicCopyFile(source, target, 0o600))
-                return;
-            return;
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-    }
-    const handle = await open(target, "wx", 0o600).catch((error) => {
-        if (error.code === "EEXIST")
-            return null;
-        throw error;
-    });
-    await handle?.close();
-}
-async function findRollout(root, sessionId) {
-    const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
-        if (error.code === "ENOENT")
-            return [];
-        throw error;
-    });
-    const matches = [];
-    for (const entry of entries) {
-        const path = join(root, entry.name);
-        if (entry.isDirectory()) {
-            const nested = await findRollout(path, sessionId);
-            if (nested !== null)
-                matches.push(nested);
-        }
-        else if (entry.isFile() && entry.name.includes(sessionId)) {
-            matches.push(path);
-        }
-    }
-    if (matches.length > 1)
-        throw new Error(`Multiple Codex rollout files match session ${sessionId}`);
-    return matches[0] ?? null;
-}
-async function hydrateResumeRollout(sourceSessions, privateSessions, sessionId) {
-    if (sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
-        throw new Error("Invalid Codex resume session id");
-    }
-    const sourcePath = await findRollout(sourceSessions, sessionId);
-    if (sourcePath === null)
-        return;
-    const relativePath = relative(sourceSessions, sourcePath);
-    const destination = resolve(privateSessions, relativePath);
-    if (!isBelow(resolve(privateSessions), destination)) {
-        throw new Error("Codex resume rollout escaped the private sessions directory");
-    }
-    let existing;
-    try {
-        existing = await lstat(destination);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-    if (existing !== undefined) {
-        if (!existing.isFile() || existing.isSymbolicLink()) {
-            throw new Error(`Refusing to replace existing Codex rollout: ${destination}`);
-        }
-        return;
-    }
-    const mode = (await lstat(sourcePath)).mode & 0o777;
-    await atomicCopyFile(sourcePath, destination, mode);
-}
-/** Isolate Codex high-volume state per Agent while preserving auth and exact resume. */
-export async function materializeDefaultCodexHome(agentHome, sourceHome, resumeSessionId) {
-    const codexHome = defaultCodexHome(agentHome);
-    await mkdir(codexHome, { recursive: true, mode: 0o700 });
-    await chmod(codexHome, 0o700);
-    const source = sourceHome === undefined ? null : resolve(sourceHome);
-    if (source !== null && source !== codexHome) {
-        await Promise.all([
-            linkIfMissing(join(source, "auth.json"), join(codexHome, "auth.json")),
-            linkIfMissing(join(source, "config.toml"), join(codexHome, "config.toml")),
-        ]);
-    }
-    const sourceSessions = source === null || source === codexHome ? undefined : join(source, "sessions");
-    await ensurePrivateSessions(join(codexHome, "sessions"), sourceSessions);
-    const sourceIndex = source === null || source === codexHome ? undefined : join(source, "session_index.jsonl");
-    await ensurePrivateIndex(join(codexHome, "session_index.jsonl"), sourceIndex);
-    if (sourceSessions !== undefined && resumeSessionId) {
-        await hydrateResumeRollout(sourceSessions, join(codexHome, "sessions"), resumeSessionId);
-    }
-    return codexHome;
-}