@openrig/cli 0.6.14 → 0.7.1

package/daemon/dist/domain/codex-core-plugin-install.js

@@ -0,0 +1,126 @@
+import nodePath from "node:path";
+import { parse as parseToml } from "smol-toml";
+// Codex loads the openrig-core plugin's hooks only from a plugin installed through its own marketplace path and enabled
+// in its config. OpenRig installs it with Codex's own commands (`codex plugin marketplace add`, `codex plugin add`), which
+// write `[plugins."openrig-core@openrig"] enabled = true` into the user config.toml. Before any install or reinstall,
+// OpenRig reads the person's choice and never overrides it:
+// - an explicit `enabled = false` for the plugin keeps it disabled;
+// - with no explicit value for the plugin, an effective `[plugins._default] enabled = false` keeps it disabled too (Codex
+//   applies that default to an entry without its own `enabled`, and an install would replace it with an explicit true);
+//   like Codex, a higher layer's `_default` overrides a lower one's;
+// - an explicit `enabled = true` is the person's choice and allows it;
+// - a layer that exists but can't be read or parsed leaves the answer unknown, so nothing is installed.
+// The layers read are the config files Codex reads at fixed paths: the system config, the user config, and the legacy
+// managed config, in Codex's precedence order. Profiles, project config, session flags, MDM and cloud-managed config are
+// not visible here; the report says so.
+export const CODEX_CORE_MARKETPLACE = "openrig";
+export const CODEX_CORE_PLUGIN = "openrig-core";
+export const CODEX_CORE_PLUGIN_KEY = `${CODEX_CORE_PLUGIN}@${CODEX_CORE_MARKETPLACE}`;
+/** The config files Codex reads at fixed paths, lowest precedence first, as `{ name, path }`. */
+export function codexReadableConfigLayers(codexHome, systemDir = "/etc/codex") {
+    return [
+        { name: "system config", path: nodePath.join(systemDir, "config.toml") },
+        { name: "user config", path: nodePath.join(codexHome, "config.toml") },
+        { name: "legacy managed config", path: nodePath.join(systemDir, "managed_config.toml") },
+    ];
+}
+const NOT_VISIBLE = "profile, project, session-flag, MDM and cloud-managed config aren't visible to OpenRig";
+/** Whether OpenRig may run Codex's install for the plugin, from the layers it can read. */
+export function codexCorePluginEnablement(layers) {
+    let explicit;
+    let defaultOff;
+    for (const layer of layers) {
+        if (layer.state === "absent")
+            continue;
+        if (layer.state === "unreadable")
+            return { decision: "unknown", reason: `${layer.name} at ${layer.path} can't be read (${layer.reason})` };
+        let doc;
+        try {
+            doc = parseToml(layer.content);
+        }
+        catch (error) {
+            return { decision: "unknown", reason: `${layer.name} at ${layer.path} can't be parsed (${error.message.split("\n")[0]})` };
+        }
+        const plugins = doc["plugins"];
+        if (plugins === undefined)
+            continue;
+        if (!isTable(plugins))
+            return { decision: "unknown", reason: `${layer.name} has a plugins value that isn't a table` };
+        const entry = plugins[CODEX_CORE_PLUGIN_KEY];
+        if (entry !== undefined) {
+            if (!isTable(entry))
+                return { decision: "unknown", reason: `${layer.name} has a ${CODEX_CORE_PLUGIN_KEY} value that isn't a table` };
+            if (entry["enabled"] !== undefined) {
+                if (typeof entry["enabled"] !== "boolean")
+                    return { decision: "unknown", reason: `${layer.name} sets ${CODEX_CORE_PLUGIN_KEY}.enabled to a non-boolean` };
+                explicit = { enabled: entry["enabled"], layer: layer.name };
+            }
+        }
+        const fallback = plugins["_default"];
+        if (fallback !== undefined) {
+            if (!isTable(fallback) || (fallback["enabled"] !== undefined && typeof fallback["enabled"] !== "boolean")) {
+                return { decision: "unknown", reason: `${layer.name} has a plugins._default that this reader doesn't recognise` };
+            }
+            // Layers come lowest precedence first, as Codex merges them: a higher layer's _default replaces a lower one's.
+            if (fallback["enabled"] === false)
+                defaultOff = layer.name;
+            else if (fallback["enabled"] === true)
+                defaultOff = undefined;
+        }
+    }
+    if (explicit) {
+        return explicit.enabled
+            ? { decision: "allow", reason: `${CODEX_CORE_PLUGIN_KEY} is explicitly enabled in the ${explicit.layer}` }
+            : { decision: "disabled", reason: `${CODEX_CORE_PLUGIN_KEY} is explicitly disabled in the ${explicit.layer}; it stays disabled` };
+    }
+    if (defaultOff)
+        return { decision: "disabled", reason: `plugins._default disables plugins in the ${defaultOff}; ${CODEX_CORE_PLUGIN_KEY} stays disabled` };
+    return { decision: "allow", reason: `no layer OpenRig can read disables ${CODEX_CORE_PLUGIN_KEY} (${NOT_VISIBLE})` };
+}
+/** The `[marketplaces.openrig]` source recorded in the user config, if any. */
+export function recordedMarketplaceSource(userConfig) {
+    if (userConfig === null)
+        return undefined;
+    let doc;
+    try {
+        doc = parseToml(userConfig);
+    }
+    catch {
+        return null;
+    }
+    const marketplaces = doc["marketplaces"];
+    if (!isTable(marketplaces))
+        return undefined;
+    const entry = marketplaces[CODEX_CORE_MARKETPLACE];
+    if (entry === undefined)
+        return undefined;
+    return isTable(entry) && typeof entry["source"] === "string" ? entry["source"] : null;
+}
+/** Whether the user config sets an explicit `enabled = true` for the plugin (what Codex's install writes there). */
+export function userLayerEnablesCorePlugin(userConfig) {
+    if (userConfig === null)
+        return false;
+    let doc;
+    try {
+        doc = parseToml(userConfig);
+    }
+    catch {
+        return false;
+    }
+    const plugins = doc["plugins"];
+    const entry = isTable(plugins) ? plugins[CODEX_CORE_PLUGIN_KEY] : undefined;
+    return isTable(entry) && entry["enabled"] === true;
+}
+/** The local marketplace manifest that lists the vendored plugin, in a layout Codex reads (`.agents/plugins/marketplace.json`). */
+export function codexCoreMarketplaceManifest() {
+    return `${JSON.stringify({
+        name: CODEX_CORE_MARKETPLACE,
+        interface: { displayName: "OpenRig" },
+        plugins: [{ name: CODEX_CORE_PLUGIN, source: `./${CODEX_CORE_PLUGIN}` }],
+    }, null, 2)}\n`;
+}
+export const CODEX_MARKETPLACE_MANIFEST_PATH = nodePath.join(".agents", "plugins", "marketplace.json");
+function isTable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=codex-core-plugin-install.js.map

package/daemon/dist/domain/codex-core-plugin-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-core-plugin-install.js","sourceRoot":"","sources":["../../src/domain/codex-core-plugin-install.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,wHAAwH;AACxH,2HAA2H;AAC3H,sHAAsH;AACtH,4DAA4D;AAC5D,oEAAoE;AACpE,0HAA0H;AAC1H,wHAAwH;AACxH,qEAAqE;AACrE,uEAAuE;AACvE,wGAAwG;AACxG,sHAAsH;AACtH,yHAAyH;AACzH,wCAAwC;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,iBAAiB,IAAI,sBAAsB,EAAE,CAAC;AAEtF,iGAAiG;AACjG,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,SAAS,GAAG,YAAY;IACnF,OAAO;QACL,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE;QACxE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE;QACtE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE;KACzF,CAAC;AACJ,CAAC;AAUD,MAAM,WAAW,GAAG,wFAAwF,CAAC;AAE7G,2FAA2F;AAC3F,MAAM,UAAU,yBAAyB,CAAC,MAA8B;IACtE,IAAI,QAAyD,CAAC;IAC9D,IAAI,UAA8B,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY;YAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,mBAAmB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QAC3I,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YAAC,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAAC,CAAC;QAClE,OAAO,KAAK,EAAE,CAAC;YAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,qBAAsB,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;QACxJ,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,yCAAyC,EAAE,CAAC;QACtH,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,UAAU,qBAAqB,2BAA2B,EAAE,CAAC;YACrI,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS;oBAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,SAAS,qBAAqB,2BAA2B,EAAE,CAAC;gBAC1J,QAAQ,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC1G,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,4DAA4D,EAAE,CAAC;YACpH,CAAC;YACD,+GAA+G;YAC/G,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK;gBAAE,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;iBACtD,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI;gBAAE,UAAU,GAAG,SAAS,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,OAAO;YACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,qBAAqB,iCAAiC,QAAQ,CAAC,KAAK,EAAE,EAAE;YAC1G,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,qBAAqB,kCAAkC,QAAQ,CAAC,KAAK,qBAAqB,EAAE,CAAC;IACtI,CAAC;IACD,IAAI,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,4CAA4C,UAAU,KAAK,qBAAqB,iBAAiB,EAAE,CAAC;IAC3J,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,sCAAsC,qBAAqB,KAAK,WAAW,GAAG,EAAE,CAAC;AACvH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,UAAyB;IACjE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QAAC,GAAG,GAAG,SAAS,CAAC,UAAU,CAA4B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtF,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,0BAA0B,CAAC,UAAyB;IAClE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QAAC,GAAG,GAAG,SAAS,CAAC,UAAU,CAA4B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACvF,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,4BAA4B;IAC1C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QACvB,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;QACrC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,iBAAiB,EAAE,EAAE,CAAC;KACzE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEvG,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/daemon/dist/domain/codex-owned-plugin-trust.d.ts

@@ -0,0 +1,26 @@
+import { type CodexConfigLayerRead } from "./codex-core-plugin-install.js";
+/** Codex rust-v0.164.0 plugin_fingerprint.rs. Strict comparison also includes entries Codex excludes as generated files. */
+export declare function codexPluginContentHash(root: string, strict?: boolean): string;
+export declare function codexLegacyPluginTrustPath(configPath: string): string;
+interface OwnedApproval {
+    schema: 1;
+    plugin: string;
+    contentHash: string;
+    declarations: Record<string, string>;
+}
+export declare const ownedCodexApprovalPath: (configPath: string) => string;
+/** No native baseline is changed. Existing declarations must already be approved; only content approval may advance. */
+export declare function planOwnedCodexContentApproval(input: {
+    configPath: string;
+    content: string;
+    layers: CodexConfigLayerRead[];
+    shipped: string;
+    installed: string;
+    freshGrant?: boolean;
+}): {
+    hashes: Record<string, string>;
+    approval: OwnedApproval;
+} | undefined;
+export declare function recordOwnedCodexApproval(configPath: string, approval: OwnedApproval): void;
+export {};
+//# sourceMappingURL=codex-owned-plugin-trust.d.ts.map

package/daemon/dist/domain/codex-owned-plugin-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-owned-plugin-trust.d.ts","sourceRoot":"","sources":["../../src/domain/codex-owned-plugin-trust.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAmBlG,4HAA4H;AAC5H,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CA8B3E;AAcD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,UAAU,aAAa;IAAG,MAAM,EAAE,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE;AAChH,eAAO,MAAM,sBAAsB,GAAI,YAAY,MAAM,WAAyE,CAAC;AAEnI,wHAAwH;AACxH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/H,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAAG,SAAS,CAiD1E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI,CAM1F"}

package/daemon/dist/domain/codex-owned-plugin-trust.js

@@ -0,0 +1,187 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { createRequire } from "node:module";
+import { parse } from "smol-toml";
+import { CODEX_CORE_PLUGIN_KEY } from "./codex-core-plugin-install.js";
+const { computeCodexHookTrust } = createRequire(import.meta.url)("../../assets/plugins/openrig-core/hooks/scripts/codex-hook-trust.cjs");
+// Published openrig-core0.1.17: Codex0.164's native baseline and the complete shipped tree agree.
+const LEGACY_CONTENT = process.platform === "win32" ? "sha256:f94b92a51872b7a5c0ba57d762a8cd68208a10f4e4ffed701220feafab626889" : "sha256:3317076e0df0d10402c17f26a17f26a21264980a6f0b551a1e21a3c0f785efca";
+const LEGACY_DECLARATIONS = {
+    session_start: "a746b5abb568d50725b08bf39660bbf08d15fa3d3a5961208862e7beaadba43d",
+    user_prompt_submit_0: "f56dfb2a70982d6a7ae4a6c4ace58b943e16dcb08fe3bc87d3c8803477f4a5c1",
+    user_prompt_submit_1: "c648714b3a02675ba4ea029b8e62dbcd77569afc317ad4f1bc3e8cbfbe7b34ee",
+    stop: "bb444b151db38aff570d0ceadc2cc84b21afb021f00b15b326aef55a27d87d40",
+    post_compact: "f4dd49518599c67ac23c80daef3537bb03b02e23a1e8c1da1210534766afefae",
+    permission_request: "75c66b08f505a22f84def73ecf6d61e98dd1b24ed8ecdcc05306eba3013e64d4",
+};
+const legacyDeclarations = Object.fromEntries(Object.entries(LEGACY_DECLARATIONS).map(([event, hash]) => {
+    const match = /^(user_prompt_submit)_([01])$/.exec(event);
+    return [`${CODEX_CORE_PLUGIN_KEY}:hooks/codex.json:${match?.[1] ?? event}:${match?.[2] ?? 0}:0`, `sha256:${hash}`];
+}));
+const readFlags = fs.constants.O_RDONLY | fs.constants.O_NONBLOCK | (fs.constants.O_NOFOLLOW ?? 0);
+/** Codex rust-v0.164.0 plugin_fingerprint.rs. Strict comparison also includes entries Codex excludes as generated files. */
+export function codexPluginContentHash(root, strict = false) {
+    if (!fs.lstatSync(root).isDirectory())
+        throw new Error("plugin root is not a directory");
+    const hash = createHash("sha256").update("codex-plugin-bundle-v1");
+    const length = (value) => { const bytes = Buffer.alloc(8); bytes.writeBigUInt64LE(BigInt(value)); hash.update(bytes); };
+    const visit = (file) => {
+        const name = path.basename(file);
+        if (file !== root && !strict && (name === "__pycache__" || name === ".venv" || name.endsWith(".pyc") || name.endsWith(".egg-info")))
+            return;
+        const relative = Buffer.from(path.relative(root, file));
+        length(relative.length);
+        hash.update(relative);
+        const before = fs.lstatSync(file);
+        if (before.isDirectory()) {
+            hash.update("directory");
+            for (const child of fs.readdirSync(file).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))))
+                visit(path.join(file, child));
+        }
+        else if (before.isFile()) {
+            hash.update("file");
+            length(before.size);
+            const fd = fs.openSync(file, readFlags);
+            try {
+                const opened = fs.fstatSync(fd);
+                if (!opened.isFile() || opened.ino !== before.ino || opened.dev !== before.dev)
+                    throw new Error("plugin file changed while fingerprinting");
+                const buffer = Buffer.alloc(65536);
+                let total = 0;
+                while (total <= before.size) {
+                    const count = fs.readSync(fd, buffer, 0, Math.min(buffer.length, before.size + 1 - total), null);
+                    if (!count)
+                        break;
+                    total += count;
+                    hash.update(buffer.subarray(0, count));
+                }
+                if (total !== before.size)
+                    throw new Error("plugin file changed while fingerprinting");
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+        else
+            throw new Error("unsupported plugin entry type");
+    };
+    visit(root);
+    return `sha256:${hash.digest("hex")}`;
+}
+function readRecord(file) {
+    let fd;
+    try {
+        fd = fs.openSync(file, readFlags);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    try {
+        const info = fs.fstatSync(fd);
+        if (!info.isFile() || info.size > 65536 || (process.platform !== "win32" && (info.mode & 0o022) !== 0)
+            || (process.getuid && info.uid !== process.getuid()))
+            throw new Error("unreadable hook approval record");
+        return fs.readFileSync(fd, "utf8");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function codexLegacyPluginTrustPath(configPath) {
+    const hash = createHash("sha256");
+    for (const part of [configPath, CODEX_CORE_PLUGIN_KEY]) {
+        const bytes = Buffer.from(part), size = Buffer.alloc(8);
+        size.writeBigUInt64LE(BigInt(bytes.length));
+        hash.update(size);
+        hash.update(bytes);
+    }
+    return path.join(path.dirname(configPath), ".hook-trust", hash.digest("hex"));
+}
+export const ownedCodexApprovalPath = (configPath) => path.join(path.dirname(configPath), ".openrig-core-hook-trust.json");
+/** No native baseline is changed. Existing declarations must already be approved; only content approval may advance. */
+export function planOwnedCodexContentApproval(input) {
+    try {
+        if (codexPluginContentHash(input.shipped, true) !== codexPluginContentHash(input.installed, true))
+            return;
+        const contentHash = codexPluginContentHash(input.installed);
+        const declarations = {};
+        const manifest = JSON.parse(fs.readFileSync(path.join(input.shipped, "hooks/codex.json"), "utf8"));
+        for (const [event, groups] of Object.entries(manifest.hooks)) {
+            groups.forEach((group, groupIndex) => group.hooks.forEach((handler, handlerIndex) => {
+                const { key, hash } = computeCodexHookTrust(event, { ...handler, matcher: group.matcher, timeoutSec: handler.timeout,
+                    keySource: `${CODEX_CORE_PLUGIN_KEY}:hooks/codex.json`, groupIndex, handlerIndex });
+                declarations[key] = hash;
+            }));
+        }
+        if (Object.keys(declarations).length !== 6)
+            return;
+        const docs = input.layers.map(layer => {
+            if (layer.state === "unreadable")
+                throw new Error("unknown config layer");
+            return { ...layer, doc: layer.state === "read" ? parse(layer.content) : {} };
+        });
+        const doc = parse(input.content);
+        const otherChoice = (value, key, checkRoot = true) => value !== null && typeof value === "object"
+            && ((checkRoot && Object.hasOwn(value.hooks?.state ?? {}, key)) || Object.values(value).some(child => otherChoice(child, key)));
+        const nestedPluginChoice = (value, nested = false) => value !== null && typeof value === "object"
+            && ((nested && (Object.hasOwn(value.plugins ?? {}, CODEX_CORE_PLUGIN_KEY) || Object.hasOwn(value.plugins ?? {}, "_default")))
+                || Object.values(value).some(child => nestedPluginChoice(child, true)));
+        if (docs.some(layer => nestedPluginChoice(layer.doc)))
+            return;
+        const states = doc.hooks?.state ?? {};
+        for (const [key, hash] of Object.entries(declarations)) {
+            const state = states[key];
+            if (!state || (state.enabled !== undefined && state.enabled !== true) || state.trusted_hash !== hash
+                || Object.keys(state).some(field => !["enabled", "trusted_hash", "trusted_content_hash"].includes(field))
+                || !input.content.split("\n").some(line => line.trim() === `[hooks.state.${JSON.stringify(key)}]`)
+                || docs.some(layer => otherChoice(layer.doc, key, layer.path !== input.configPath)))
+                return;
+        }
+        const approval = { schema: 1, plugin: CODEX_CORE_PLUGIN_KEY, contentHash, declarations };
+        const hashes = Object.fromEntries(Object.keys(declarations).map(key => [key, contentHash]));
+        if (input.freshGrant)
+            return { hashes, approval };
+        if (Object.keys(declarations).every(key => states[key].trusted_content_hash === contentHash))
+            return { hashes: {}, approval };
+        const baseline = readRecord(codexLegacyPluginTrustPath(input.configPath));
+        if (Object.keys(declarations).every(key => (states[key].trusted_content_hash ?? baseline) === contentHash))
+            return { hashes, approval };
+        const saved = readRecord(ownedCodexApprovalPath(input.configPath));
+        const previous = saved === undefined ? { schema: 1, plugin: CODEX_CORE_PLUGIN_KEY,
+            contentHash: LEGACY_CONTENT, declarations: legacyDeclarations } : JSON.parse(saved);
+        if (previous.schema !== 1 || previous.plugin !== CODEX_CORE_PLUGIN_KEY || !/^sha256:[a-f0-9]{64}$/.test(previous.contentHash)
+            || Object.keys(previous.declarations).length !== 6)
+            return;
+        for (const [key, hash] of Object.entries(declarations)) {
+            if (previous.declarations[key] !== hash || (states[key].trusted_content_hash ?? baseline) !== previous.contentHash)
+                return;
+        }
+        return { hashes, approval };
+    }
+    catch {
+        return undefined;
+    } // Unknown ownership or config leaves native review in place.
+}
+export function recordOwnedCodexApproval(configPath, approval) {
+    const file = ownedCodexApprovalPath(configPath), content = `${JSON.stringify(approval, null, 2)}\n`;
+    if (readRecord(file) === content)
+        return;
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, content, { flag: "wx", mode: 0o600 });
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+//# sourceMappingURL=codex-owned-plugin-trust.js.map

package/daemon/dist/domain/codex-owned-plugin-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-owned-plugin-trust.js","sourceRoot":"","sources":["../../src/domain/codex-owned-plugin-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAA6B,MAAM,gCAAgC,CAAC;AAElG,MAAM,EAAE,qBAAqB,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,sEAAsE,CAAC,CAAC;AACzI,kGAAkG;AAClG,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC,CAAC,yEAAyE,CAAC;AAC5M,MAAM,mBAAmB,GAA2B;IAClD,aAAa,EAAE,kEAAkE;IACjF,oBAAoB,EAAE,kEAAkE;IACxF,oBAAoB,EAAE,kEAAkE;IACxF,IAAI,EAAE,kEAAkE;IACxE,YAAY,EAAE,kEAAkE;IAChF,kBAAkB,EAAE,kEAAkE;CACvF,CAAC;AACF,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE;IACtG,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,qBAAqB,qBAAqB,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;AACrH,CAAC,CAAC,CAAC,CAAC;AACJ,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;AAEnG,4HAA4H;AAC5H,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAAM,GAAG,KAAK;IACjE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,OAAO;QAC5I,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACzI,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC5I,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBAClD,OAAO,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;oBACjG,IAAI,CAAC,KAAK;wBAAE,MAAM;oBAClB,KAAK,IAAI,KAAK,CAAC;oBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBACzD,CAAC;gBACD,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzF,CAAC;oBAAS,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACjC,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACxG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;eACjG,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3G,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAGD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,+BAA+B,CAAC,CAAC;AAEnI,wHAAwH;AACxH,MAAM,UAAU,6BAA6B,CAAC,KAE7C;IACC,IAAI,CAAC;QACH,IAAI,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO;QAC1G,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACnG,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqG,EAAG,CAAC;YAClK,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE;gBAClF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO;oBAClH,SAAS,EAAE,GAAG,qBAAqB,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;gBACtF,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAC3B,CAAC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1E,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAQ,CAAC;QACxC,MAAM,WAAW,GAAG,CAAC,KAAU,EAAE,GAAW,EAAE,SAAS,GAAG,IAAI,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;eAClH,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAClI,MAAM,kBAAkB,GAAG,CAAC,KAAU,EAAE,MAAM,GAAG,KAAK,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;eAC1G,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;mBACxH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO;QAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;mBAC/F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;mBACtG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;mBAC/F,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;gBAAE,OAAO;QAChG,CAAC;QACD,MAAM,QAAQ,GAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,KAAK,WAAW,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC9H,MAAM,QAAQ,GAAG,UAAU,CAAC,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,IAAI,QAAQ,CAAC,KAAK,WAAW,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACxI,MAAM,KAAK,GAAG,UAAU,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAkB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB;YAC9F,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;eACxH,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,IAAI,QAAQ,CAAC,KAAK,QAAQ,CAAC,WAAW;gBAAE,OAAO;QAC7H,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC,CAAC,6DAA6D;AAC7F,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,UAAkB,EAAE,QAAuB;IAClF,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,IAAI,CAAC;QAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;YAClG,CAAC;QAAC,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;IAAC,CAAC;AACtI,CAAC"}

package/daemon/dist/domain/codex-rebuild-permissions.d.ts

@@ -0,0 +1,54 @@
+import type { SessionRegistry } from "./session-registry.js";
+import { type NativeProcessLister } from "./native-process-lineage.js";
+/** Native turn_context policy, not a requested mode, profile or argv observation. */
+export interface CodexPermissionEnvelope {
+    approvalPolicy: "untrusted" | "on-request" | "never";
+    sandboxPolicy: {
+        type: "danger-full-access" | "read-only";
+    } | {
+        type: "workspace-write";
+        writable_roots?: string[];
+        network_access: boolean;
+        exclude_tmpdir_env_var: boolean;
+        exclude_slash_tmp: boolean;
+    };
+}
+export interface CodexPermissionContinuity {
+    state: "emitted" | "unverified" | "selection_used";
+    detail: string;
+}
+export type CodexRebuildPermissions = {
+    state: "observed";
+    envelope: CodexPermissionEnvelope;
+    observedAt: string;
+    processStartedAt: string;
+    profile: string | null;
+} | {
+    state: "unverified";
+    reason: string;
+};
+export declare function parseCodexPermissionEnvelope(value: unknown): CodexPermissionEnvelope | null;
+/** All workspace fields are explicit, including [] when the native record omitted its empty roots.
+ * Config overrides replace the requested fields; no fresh-launch add-dir/network grants follow. */
+export declare function codexEnvelopeArgs(envelope: CodexPermissionEnvelope): string;
+/** Read one file descriptor: header binds the thread; newest context must belong to this process.
+ * Bounded to 1 MiB each of tail and header, with no fallback to older complete policies. */
+export declare function readCodexPermissionRecord(path: string, thread: string, cwd: string, notBeforeMs: number): {
+    envelope: CodexPermissionEnvelope;
+    observedAt: string;
+} | null;
+/** Only the live pane's one native process may locate the predecessor record. Registry tokens,
+ * recency and profile names are never substitutes. Failures keep rebuild available, explicitly unverified. */
+export declare function observeCodexRebuildPermissions(input: {
+    nodeId: string;
+    sessionName: string;
+    cwd: string;
+    sessions: Pick<SessionRegistry, "currentOccupantTenure" | "getBindingForNode" | "currentOccupantGenerationForSession">;
+    tmux: {
+        getPanePid(target: string): Promise<number | null>;
+    };
+    readThreadId: (pid: number, startedAt: string) => Promise<string | undefined> | string | undefined;
+    rollout: (thread: string) => string | null;
+    listProcesses?: NativeProcessLister;
+}): Promise<CodexRebuildPermissions>;
+//# sourceMappingURL=codex-rebuild-permissions.d.ts.map

package/daemon/dist/domain/codex-rebuild-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-rebuild-permissions.d.ts","sourceRoot":"","sources":["../../src/domain/codex-rebuild-permissions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAiE,KAAK,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAKtI,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;IACrD,aAAa,EAAE;QAAE,IAAI,EAAE,oBAAoB,GAAG,WAAW,CAAA;KAAE,GACvD;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAC5E,sBAAsB,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;CACrE;AACD,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,gBAAgB,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,MAAM,uBAAuB,GAC/B;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,uBAAuB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC9H;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAsB3F;AAED;mGACmG;AACnG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,CAS3E;AAED;4FAC4F;AAC5F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GACtG;IAAE,QAAQ,EAAE,uBAAuB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAyBjE;AAED;8GAC8G;AAC9G,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IACjD,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,uBAAuB,GAAG,mBAAmB,GAAG,qCAAqC,CAAC,CAAC;IACvH,IAAI,EAAE;QAAE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;KAAE,CAAC;IAC7D,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;IACnG,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC3C,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAgCnC"}

package/daemon/dist/domain/codex-rebuild-permissions.js

@@ -0,0 +1,134 @@
+import { closeSync, fstatSync, openSync, readSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { observeCodexPaneProcess, codexCommandResumeToken, processArgv } from "./native-process-lineage.js";
+import { lstartToMinTs } from "./codex-thread-id.js";
+import { parseSqliteUtcMs } from "./sqlite-time.js";
+import { shellQuote } from "../adapters/shell-quote.js";
+export function parseCodexPermissionEnvelope(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const input = value;
+    if (["permission_profile", "file_system_sandbox_policy", "network_sandbox_policy"].some(key => input[key] !== undefined))
+        return null;
+    if (!["untrusted", "on-request", "never"].includes(input.approval_policy))
+        return null;
+    const policy = input.sandbox_policy;
+    if (!policy || typeof policy !== "object" || Array.isArray(policy))
+        return null;
+    const sandbox = policy;
+    const approvalPolicy = input.approval_policy;
+    if (sandbox.type === "danger-full-access" && Object.keys(sandbox).length === 1) {
+        return { approvalPolicy, sandboxPolicy: { type: "danger-full-access" } };
+    }
+    if (sandbox.type === "read-only" && Object.keys(sandbox).every(key => key === "type" || key === "network_access")
+        && (sandbox.network_access === undefined || sandbox.network_access === false)) {
+        return { approvalPolicy, sandboxPolicy: { type: "read-only" } };
+    }
+    const keys = ["type", "writable_roots", "network_access", "exclude_tmpdir_env_var", "exclude_slash_tmp"];
+    if (sandbox.type !== "workspace-write" || Object.keys(sandbox).some(key => !keys.includes(key))
+        || keys.slice(2).some(key => typeof sandbox[key] !== "boolean"))
+        return null;
+    if (sandbox.writable_roots !== undefined && (!Array.isArray(sandbox.writable_roots)
+        || sandbox.writable_roots.some(root => typeof root !== "string" || !isAbsolute(root) || root.includes("\0"))))
+        return null;
+    return { approvalPolicy, sandboxPolicy: { ...sandbox } };
+}
+/** All workspace fields are explicit, including [] when the native record omitted its empty roots.
+ * Config overrides replace the requested fields; no fresh-launch add-dir/network grants follow. */
+export function codexEnvelopeArgs(envelope) {
+    const policy = envelope.sandboxPolicy;
+    let args = ` -s ${policy.type} -a ${envelope.approvalPolicy}`;
+    if (policy.type === "workspace-write") {
+        const fields = { writable_roots: policy.writable_roots ?? [], network_access: policy.network_access,
+            exclude_tmpdir_env_var: policy.exclude_tmpdir_env_var, exclude_slash_tmp: policy.exclude_slash_tmp };
+        for (const [key, value] of Object.entries(fields))
+            args += ` -c ${shellQuote(`sandbox_workspace_write.${key}=${JSON.stringify(value)}`)}`;
+    }
+    return args;
+}
+/** Read one file descriptor: header binds the thread; newest context must belong to this process.
+ * Bounded to 1 MiB each of tail and header, with no fallback to older complete policies. */
+export function readCodexPermissionRecord(path, thread, cwd, notBeforeMs) {
+    let fd;
+    try {
+        fd = openSync(path, "r");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const size = fstatSync(fd).size;
+        const head = Buffer.alloc(Math.min(size, 1024 * 1024));
+        readSync(fd, head, 0, head.length, 0);
+        const metadata = JSON.parse(head.toString("utf8").split("\n")[0]);
+        if (metadata.type !== "session_meta" || metadata.payload?.id !== thread)
+            return null;
+        const start = Math.max(0, size - 1024 * 1024);
+        const tail = Buffer.alloc(size - start);
+        readSync(fd, tail, 0, tail.length, start);
+        const lines = tail.toString("utf8").split("\n");
+        if (start)
+            lines.shift();
+        for (let index = lines.length - 1; index >= 0; index--) {
+            if (!lines[index].includes('"turn_context"'))
+                continue;
+            const entry = JSON.parse(lines[index]);
+            if (entry.type !== "turn_context")
+                continue;
+            const at = Date.parse(entry.timestamp);
+            if (!Number.isFinite(at) || at <= notBeforeMs || entry.payload?.cwd !== cwd)
+                return null;
+            const envelope = parseCodexPermissionEnvelope(entry.payload);
+            return envelope ? { envelope, observedAt: new Date(at).toISOString() } : null;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Only the live pane's one native process may locate the predecessor record. Registry tokens,
+ * recency and profile names are never substitutes. Failures keep rebuild available, explicitly unverified. */
+export async function observeCodexRebuildPermissions(input) {
+    const unverified = (reason) => ({ state: "unverified", reason });
+    const tenure = input.sessions.currentOccupantTenure(input.nodeId);
+    const binding = input.sessions.getBindingForNode(input.nodeId);
+    if (!tenure || !binding?.tmuxPane || binding.tmuxSession !== input.sessionName
+        || input.sessions.currentOccupantGenerationForSession(input.sessionName) !== tenure.generationUuid) {
+        return unverified("The predecessor's current occupant and pane binding could not be established.");
+    }
+    try {
+        const probe = { target: binding.tmuxPane, tmux: input.tmux, listProcesses: input.listProcesses };
+        const first = await observeCodexPaneProcess(probe);
+        const start = lstartToMinTs(first?.process.startedAt);
+        const boot = parseSqliteUtcMs(tenure.bootAt);
+        if (!first || start === undefined || !Number.isFinite(boot))
+            return unverified("The predecessor's native process identity or start time was not established.");
+        const thread = await input.readThreadId(first.process.pid, first.process.startedAt);
+        const argvThread = codexCommandResumeToken(first.process.command);
+        if (!thread || (argvThread !== undefined && argvThread !== thread))
+            return unverified("The predecessor's process and native conversation could not be joined.");
+        const path = input.rollout(thread);
+        const record = path ? readCodexPermissionRecord(path, thread, input.cwd, Math.max(start * 1000 + 999, boot)) : null;
+        if (!record)
+            return unverified("No complete supported native permission policy for this predecessor process and working directory was readable in the bounded record.");
+        const after = await observeCodexPaneProcess(probe);
+        const current = input.sessions.getBindingForNode(input.nodeId);
+        if (after?.fingerprint !== first.fingerprint || input.sessions.currentOccupantTenure(input.nodeId)?.generationUuid !== tenure.generationUuid
+            || input.sessions.currentOccupantGenerationForSession(input.sessionName) !== tenure.generationUuid
+            || current?.tmuxPane !== binding.tmuxPane || current?.tmuxSession !== binding.tmuxSession) {
+            return unverified("The predecessor changed while its native permission policy was read.");
+        }
+        const argv = processArgv(first.process.command);
+        const profileAt = argv.findIndex(arg => arg === "-p" || arg === "--profile");
+        return { state: "observed", ...record, processStartedAt: first.process.startedAt,
+            profile: profileAt >= 0 ? argv[profileAt + 1] ?? null : null };
+    }
+    catch {
+        return unverified("The predecessor's native permission observation was unavailable.");
+    }
+}
+//# sourceMappingURL=codex-rebuild-permissions.js.map

package/daemon/dist/domain/codex-rebuild-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-rebuild-permissions.js","sourceRoot":"","sources":["../../src/domain/codex-rebuild-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,WAAW,EAA4B,MAAM,6BAA6B,CAAC;AACtI,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAiBxD,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,CAAC,oBAAoB,EAAE,4BAA4B,EAAE,wBAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtI,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAyB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC;IACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,OAAO,GAAG,MAAiC,CAAC;IAClD,MAAM,cAAc,GAAG,KAAK,CAAC,eAA4D,CAAC;IAC1F,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,gBAAgB,CAAC;WAC5G,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WAC1F,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;WAC9E,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7H,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,GAAG,OAAO,EAA8C,EAAE,CAAC;AACvG,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,QAAiC;IACjE,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC;IACtC,IAAI,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,cAAc,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;YACjG,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACvG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,IAAI,OAAO,UAAU,CAAC,2BAA2B,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW,EAAE,WAAmB;IAEtG,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QACxC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,SAAS;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,WAAW,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACzF,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7D,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACrD,CAAC;AAED;8GAC8G;AAC9G,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAOpD;IACC,MAAM,UAAU,GAAG,CAAC,MAAc,EAA2B,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;WACzE,KAAK,CAAC,QAAQ,CAAC,mCAAmC,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;QACrG,OAAO,UAAU,CAAC,+EAA+E,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QACjG,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC,8EAA8E,CAAC,CAAC;QAC/J,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,SAAU,CAAC,CAAC;QACrF,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,CAAC;YAAE,OAAO,UAAU,CAAC,wEAAwE,CAAC,CAAC;QAChK,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpH,IAAI,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC,uIAAuI,CAAC,CAAC;QACxK,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,KAAK,EAAE,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,KAAK,MAAM,CAAC,cAAc;eACvI,KAAK,CAAC,QAAQ,CAAC,mCAAmC,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,cAAc;eAC/F,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5F,OAAO,UAAU,CAAC,sEAAsE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,CAAC,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,SAAU;YAC/E,OAAO,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,UAAU,CAAC,kEAAkE,CAAC,CAAC;IAAC,CAAC;AACpG,CAAC"}

package/daemon/dist/domain/codex-thread-id.d.ts

@@ -3,6 +3,15 @@ export type CodexCaptureDiagnostic = {
     count?: number;
 };
 export type CodexCaptureReporter = (diagnostic: CodexCaptureDiagnostic) => void;
+/** A read's thread with whether it met no detected incompleteness: every versioned database found (discovery), and every
+ *  one opened and queried. `incomplete` names which part fell short. Not an atomic snapshot: databases can change during
+ *  the read, and rows inside the process's start second stay excluded by the reuse gate. */
+export interface CodexThreadEvidence {
+    thread?: string;
+    reason?: CodexCaptureDiagnostic["reason"];
+    fullyReadable: boolean;
+    incomplete?: "unreadable" | "discovery";
+}
 /** F1 (B12's completion): may return a plain value (test stubs stay sync) or a Promise — every
  *  caller awaits it, and the DEFAULT is async so the per-PID `ps eww` spawn no longer blocks the
  *  event loop (measured live: 28.9s/15min of burst blocking inside the 8-attempt capture loops). */
@@ -98,6 +107,12 @@ export declare class CodexThreadIdResolver {
      * rule (e91d7a94) on the cache above.
      */
     resolveUngatedLegacy(pid: number, report?: CodexCaptureReporter): Promise<string | undefined>;
+    /**
+     * {@link resolve} for the explicit `codexHome` read, with whether that read met no detected incompleteness. The thread
+     * and diagnostic are what `resolve` gives for the same home; only the readability is new. For a caller that must tell
+     * a complete read from a partial one (the in-place restart), never a cache or another home.
+     */
+    resolveWithReadability(pid: number, identity: string): Promise<CodexThreadEvidence>;
     private resolveWithDiagnostics;
     private resolveInternal;
     private cacheHome;
@@ -120,5 +135,12 @@ export type StartSecondRows =
  *  later), rows after it resolve. Unparseable → undefined (the caller falls
  *  back to the ungated read rather than inventing a gate). */
 export declare function lstartToMinTs(identity: string | undefined): number | undefined;
-export declare function resolveCodexDbPaths(homeDir: string, kind: "logs" | "state", exists?: (path: string) => boolean, codexHome?: string): string[];
+/**
+ * The versioned Codex databases of `kind`, newest first. `discovery`, when passed, is set false when the search may have
+ * missed one: the listing failed, or a listed database was dropped by (or threw in) the existence check. The returned
+ * paths are the same whether or not it's passed, the historical fallback included.
+ */
+export declare function resolveCodexDbPaths(homeDir: string, kind: "logs" | "state", exists?: (path: string) => boolean, codexHome?: string, discovery?: {
+    complete: boolean;
+}): string[];
 //# sourceMappingURL=codex-thread-id.d.ts.map