@ornexus/neocortex 4.60.66 → 4.60.68

package/packages/client/dist/private-execution/codex-executor.js

@@ -1,4 +1,574 @@
-import{codexLifecycleGuardPath as J}from"./codex-lifecycle-guard.js";import{execFileSync as X,spawn as Y}from"node:child_process";import{createHash as T,randomBytes as q}from"node:crypto";import{connect as U,createServer as Z}from"node:net";import{accessSync as k,lstatSync as B,mkdtempSync as Q,readFileSync as ee,realpathSync as te,rmdirSync as M,unlinkSync as A,constants as C}from"node:fs";import{homedir as re}from"node:os";import{join as v,resolve as L}from"node:path";import{gitLifecycleRuntimeDirectory as oe}from"../git/git-lifecycle-store.js";import{captureDirectYoloCheckoutEvidence as H}from"../git/direct-yolo-checkpoint.js";import{createPrivateCodexScopedRunner as ne}from"./codex-scoped-permissions.js";import{createPrivateCodexHostRuntime as se}from"./codex-host-runtime.js";const N=3e4,m=16*1024,ie=1024*1024,ae=256*1024,j=/^codex-cli\s+(\d+\.\d+\.\d+)\s*$/,x="p222-isolated",ce=["PATH","HOME","LANG","LC_ALL","TERM","CODEX_HOME"],G=["-c",'web_search="disabled"',"-c","features.hooks=false","-c","analytics.enabled=false","-c",'history.persistence="none"',"-c",'otel.exporter="none"',"-c",'otel.metrics_exporter="none"',"-c",'otel.trace_exporter="none"',"-c","otel.log_user_prompt=false","-c","notify=[]"],I=new WeakMap,P=new WeakMap;function de(r){const e={};for(const t of ce)typeof r[t]=="string"&&(e[t]=r[t]);return e}async function $(r,e){if(e.configReadProbe&&(e.stdin!==void 0||r.at(-1)!=="app-server"))throw new Error("private-codex-web-search-isolation-unproven");return new Promise((t,o)=>{const s=de(process.env);e.codexHome!==void 0&&(s.CODEX_HOME=e.codexHome);const n=process.platform==="linux",a=Y(n?process.execPath:e.codexHome===void 0?"codex":"/bin/sh",n?[J,"process"]:e.codexHome===void 0?[...r]:["-c",'umask 077; exec codex "$@"',"neocortex-private-codex",...r],{cwd:e.cwd,stdio:n?["pipe","pipe","pipe","ipc"]:["pipe","pipe","pipe"],env:s,detached:n}),d=()=>{if(process.platform==="linux"&&a.pid!==void 0)try{process.kill(-a.pid,"SIGKILL")}catch(l){if(l.code!=="ESRCH")throw l}else a.kill("SIGKILL")},i=[],u=[];let f=0,p=0,c=!1,w=!1,E="",S=!1;const b=l=>a.stdin.write(`${JSON.stringify(l)}
-`),_=setTimeout(()=>{c=!0,d()},e.timeoutMs);a.stdout.on("data",l=>{if(f+=l.byteLength,f+p>e.maxOutputBytes)w=!0,d();else if(i.push(l),e.configReadProbe){E+=l.toString("utf8");let y;for(;(y=E.indexOf(`
-`))>=0;){const D=E.slice(0,y);E=E.slice(y+1);try{const R=JSON.parse(D);R.id===1&&R.result&&!S?(S=!0,b({method:"initialized",params:{}}),b({id:2,method:"config/read",params:{includeLayers:!1,cwd:e.cwd}})):R.id===2&&a.stdin.end()}catch{}}}}),a.stderr.on("data",l=>{p+=l.byteLength,f+p>e.maxOutputBytes?(w=!0,d()):u.push(l)}),a.on("error",l=>{clearTimeout(_),o(l)}),a.on("close",l=>{clearTimeout(_),t({exitCode:l,stdout:Buffer.concat(i),stderr:Buffer.concat(u),timedOut:c,outputExceeded:w})}),a.stdin.on("error",()=>{}),n&&a.send({kind:"private-codex-launch",args:[...r],codexHome:e.codexHome},l=>{l&&(clearTimeout(_),d(),o(new Error("private-codex-process-guard-unavailable")))}),e.configReadProbe?b({id:1,method:"initialize",params:{clientInfo:{name:"p222-isolation-probe",version:"1"},capabilities:{}}}):a.stdin.end(e.stdin)})}function h(r){return r.exitCode===0&&!r.timedOut&&!r.outputExceeded}async function W(r,e){const t=await e(["-c","features.plugins=false","plugin","list","--json"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m}),o=await e(["mcp","list","--json"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(t)||!h(o))return null;try{const s=JSON.parse(t.stdout.toString("utf8")),n=JSON.parse(o.stdout.toString("utf8"));if(!!!(s&&typeof s=="object"&&!Array.isArray(s)&&Array.isArray(s.installed)&&s.installed.length===0)||!Array.isArray(n)||n.length>64)return null;const d=n.map(c=>{if(!c||typeof c!="object"||Array.isArray(c))throw new Error("invalid catalog");const w=c;if(typeof w.name!="string"||!/^[A-Za-z0-9_-]{1,64}$/.test(w.name)||typeof w.enabled!="boolean")throw new Error("invalid catalog");return w.name});if(new Set(d).size!==d.length)return null;if(d.length===0)return[];const i=[...d].sort().flatMap(c=>["-c",`mcp_servers.${c}.enabled=false`]),u=await e([...i,"mcp","list","--json"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(u))return null;const f=JSON.parse(u.stdout.toString("utf8"));if(!Array.isArray(f)||f.length!==d.length)return null;const p=new Set;for(const c of f){if(!c||typeof c!="object"||Array.isArray(c)||typeof c.name!="string"||!d.includes(c.name)||c.enabled!==!1||p.has(c.name))return null;p.add(c.name)}return Object.freeze(i)}catch{return null}}async function z(r,e){const t=await e(["-c","features.hooks=false","features","list"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(t))return!1;const o=t.stdout.toString("utf8").split(/\r?\n/).filter(s=>/^hooks\s+\S+\s+(?:true|false)\s*$/.test(s));return o.length===1&&/^hooks\s+\S+\s+false\s*$/.test(o[0])}async function V(r,e,t){const o=await e(["-c","features.plugins=false",...t,...G,"--strict-config","app-server"],{cwd:r,configReadProbe:!0,timeoutMs:1e4,maxOutputBytes:262144});try{if(!h(o))return!1;const n=o.stdout.toString("utf8").split(/\r?\n/).filter(Boolean).map(a=>JSON.parse(a)).filter(a=>a&&a.id===2);return n.length===1&&!n[0].error&&n[0].result?.config?.web_search==="disabled"}catch{return!1}finally{o.stdout.fill(0),o.stderr.fill(0)}}function ue(r){const e=B(r);if(!e.isFile()||e.isSymbolicLink())throw new Error("private-codex-auth-unavailable");k(r,C.R_OK)}function F(r){const e={...process.env};for(const t of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete e[t];try{const t=s=>X("git",[...s],{cwd:r,env:e,encoding:"utf8",timeout:5e3,maxBuffer:m,stdio:["ignore","pipe","ignore"]}).trim(),o=[t(["rev-parse","--git-dir"]),t(["rev-parse","--git-common-dir"])].map(s=>te(L(r,s)));if(o.some(s=>!B(s).isDirectory()))throw new Error("git-control-invalid");return[...new Set(o)]}catch{throw new Error("private-codex-git-control-unavailable")}}async function le(r,e){const t=await e(["sandbox","-P",x,"--","git","rev-parse","--git-dir"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(t))return!1;for(const o of F(r)){const s=v(o,`.neocortex-git-probe-${q(16).toString("hex")}`),n=await e(["sandbox","-P",x,"--","sh","-c",'mkdir "$1"',"sh",s],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});let a=!1,d=!1;try{const i=B(s);a=!0,d=i.isDirectory()}catch(i){if(i.code!=="ENOENT")return!1}if(a&&(d?M(s):A(s)),n.exitCode!==1||n.timedOut||n.outputExceeded||a)return!1}return!0}async function fe(r,e,t){if(!B(e).isDirectory())return!1;k(e,C.R_OK);const o=await t(["sandbox","-P",x,"--","sh","-c",'if test -r "$1"; then exit 42; else exit 43; fi',"sh",e],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});return o.exitCode===43&&!o.timedOut&&!o.outputExceeded}async function pe(r,e){const t=Z(o=>o.end());await new Promise((o,s)=>{t.once("error",s),t.listen(0,"127.0.0.1",()=>o())});try{const o=t.address();if(!o||typeof o=="string")return!1;const s='const s=require("node:net").connect(Number(process.argv[1]),"127.0.0.1");s.setTimeout(1500);s.on("connect",()=>{s.end();process.exit(0)});s.on("error",()=>process.exit(1));s.on("timeout",()=>process.exit(1))';if(!await new Promise(i=>{const u=U(o.port,"127.0.0.1");u.setTimeout(1500),u.once("connect",()=>{u.end(),i(!0)}),u.once("error",()=>i(!1)),u.once("timeout",()=>{u.destroy(),i(!1)})}))return!1;const a=await e(["sandbox","-P",x,"--","node","--version"],{cwd:r,timeoutMs:5e3,maxOutputBytes:m});if(!h(a))return!1;const d=await e(["sandbox","-P",x,"--","node","-e",s,String(o.port)],{cwd:r,timeoutMs:5e3,maxOutputBytes:m});return d.exitCode===1&&!d.timedOut&&!d.outputExceeded}finally{t.close()}}async function Re(r,e={}){if((e.platform??process.platform)!=="linux")throw new Error("private-codex-platform-unsupported");const t=L(r),o=e.userHome??re(),s=e.codexHome??process.env.CODEX_HOME??v(o,".codex"),n=e.runner?void 0:se(t,s);try{const a=n?async(g,K)=>(n.verify(),$(g,{...K,codexHome:n.home})):$,d=n?.home??s,i=e.runner??await ne(t,a,{...e,codexHome:d,credentialSourceHome:n?.sourceHome??s,gitControlDirectories:F(t)}),u=v(d,"auth.json");try{ue(u)}catch{throw new Error("private-codex-auth-unavailable")}const f=await i(["--version"],{cwd:t,timeoutMs:5e3,maxOutputBytes:m}),p=h(f)?j.exec(f.stdout.toString("utf8").trim()):null;if(!p)throw new Error("private-codex-version-unavailable");const c=await i(["login","status"],{cwd:t,timeoutMs:5e3,maxOutputBytes:m});if(!h(c)||!/Logged in using ChatGPT/i.test(Buffer.concat([c.stdout,c.stderr]).toString("utf8")))throw new Error("private-codex-subscription-required");const w=await W(t,i).catch(()=>null);if(w===null)throw new Error("private-codex-mcp-isolation-unproven");if(!await z(t,i).catch(()=>!1))throw new Error("private-codex-hook-isolation-unproven");if(!await V(t,i,w).catch(()=>!1))throw new Error("private-codex-web-search-isolation-unproven");const S=await oe(t).catch(()=>{throw new Error("private-codex-git-lifecycle-read-isolation-unproven")}),b=v(o,".ssh"),_=await i(["sandbox","-P",x,"--","sh","-c",...n?['test ! -r "$1" && test ! -r "$2" && test ! -r "$3"',"sh",u,b,v(s,"auth.json")]:['test ! -r "$1" && test ! -r "$2"',"sh",u,b]],{cwd:t,timeoutMs:1e4,maxOutputBytes:m});if(!h(_))throw new Error("private-codex-auth-isolation-unproven");const l=Q(v(t,".private-codex-probe-")),y=v(l,"receipt");try{const g=await i(["sandbox","-P",x,"--","sh","-c",'printf "P222_PROBE\\n" > "$1"',"sh",y],{cwd:t,timeoutMs:1e4,maxOutputBytes:m});if(!h(g)||ee(y,"utf8")!==`P222_PROBE
-`)throw new Error("private-codex-workspace-write-unproven")}catch{throw new Error("private-codex-workspace-write-unproven")}finally{try{A(y)}catch{}M(l)}if(!await le(t,i).catch(()=>!1))throw new Error("private-codex-git-control-isolation-unproven");if(!await fe(t,S,i).catch(()=>!1))throw new Error("private-codex-git-lifecycle-read-isolation-unproven");if(!await(e.networkProbe??pe)(t,i))throw new Error("private-codex-network-isolation-unproven");const O=Object.freeze({schemaVersion:6,hostKind:"codex-cli",hostVersion:p[1],projectRoot:t,observedAtMs:(e.now??Date.now)(),authIsolation:"passed",workspaceWrite:"passed",gitControlWriteDenied:"passed",gitLifecycleReadDenied:"passed",mcpIsolation:"passed",environmentIsolation:"passed",networkDenied:"passed",webSearchDisabled:"passed",credentialKind:"chatgpt-subscription"});if(I.set(O,i),n){const g=setTimeout(()=>{P.delete(O),I.delete(O);try{n.close()}catch{}},N);g.unref(),P.set(O,{runtime:n,timer:g})}return O}catch(a){throw n?.close(),a}}async function Te(r,e,t={}){const o=P.get(e);o&&(clearTimeout(o.timer),P.delete(e));try{const s=(t.now??Date.now)();if(t.model!==void 0&&!/^gpt-[a-z0-9][a-z0-9.-]{0,63}$/.test(t.model))throw new Error("private-codex-model-invalid");if(e.schemaVersion!==6||e.hostKind!=="codex-cli"||e.authIsolation!=="passed"||e.workspaceWrite!=="passed"||e.gitControlWriteDenied!=="passed"||e.gitLifecycleReadDenied!=="passed"||e.mcpIsolation!=="passed"||e.environmentIsolation!=="passed"||e.webSearchDisabled!=="passed"||e.networkDenied!=="passed"||e.credentialKind!=="chatgpt-subscription"||s<e.observedAtMs||s-e.observedAtMs>N||typeof r!="string"||Buffer.byteLength(r,"utf8")<1||Buffer.byteLength(r,"utf8")>ae)throw new Error("private-codex-preflight-stale");const n=t.runner??I.get(e);if(!n)throw new Error("private-codex-preflight-stale");const a=await n(["--version"],{cwd:e.projectRoot,timeoutMs:5e3,maxOutputBytes:m});if(!h(a)||j.exec(a.stdout.toString("utf8").trim())?.[1]!==e.hostVersion)throw new Error("private-codex-version-drift");const d=(p,c)=>{const w=Object.freeze({schemaVersion:1,kind:"PrivateCodexWorkspaceEffectFailure/1",phase:p,agentReturnedSuccessfully:c!==void 0,...c===void 0?{}:{stdoutSha256:T("sha256").update(c.stdout).digest("hex"),stderrSha256:T("sha256").update(c.stderr).digest("hex"),stdoutBytes:c.stdout.length,stderrBytes:c.stderr.length},publicSafe:!0});try{Promise.resolve(t.onWorkspaceEffectFailure?.(w)).catch(()=>{})}catch{}return new Error("private-codex-workspace-effect-unverified")},i=t.requireWorkspaceEffect?await H(e.projectRoot).catch(()=>{throw d("before-capture")}):void 0;if(i&&t.expectedExecutionBranch!==void 0&&i.branch!==t.expectedExecutionBranch)throw d("branch-before");if(!await z(e.projectRoot,n).catch(()=>!1))throw new Error("private-codex-hook-isolation-unproven");const u=await W(e.projectRoot,n).catch(()=>null);if(u===null)throw new Error("private-codex-mcp-isolation-unproven");if(!await V(e.projectRoot,n,u).catch(()=>!1))throw new Error("private-codex-web-search-isolation-unproven");const f=await n(["exec","--ephemeral","--json","--strict-config","-c","features.plugins=false",...t.model===void 0?[]:["--model",t.model],...u,...G,"-c","shell_environment_policy.ignore_default_excludes=false","-c",'shell_environment_policy.include_only=["PATH","HOME","LANG","LC_ALL","TERM"]',"-c",`default_permissions="${x}"`,"-C",e.projectRoot,"-"],{cwd:e.projectRoot,stdin:r,timeoutMs:10*6e4,maxOutputBytes:ie});if(!h(f))throw new Error("private-codex-execution-unverified");if(o?.runtime.verify(),i){const p=await H(e.projectRoot).catch(()=>{throw d("after-capture",f)});if(p.headSha!==i.headSha||p.branch!==i.branch)throw d("identity-after",f);if(p.payloadDigest===i.payloadDigest)throw d("no-payload-change",f)}return Object.freeze({schemaVersion:1,outcome:"executor-returned-unverified",exitCode:0,stdoutSha256:T("sha256").update(f.stdout).digest("hex"),stderrSha256:T("sha256").update(f.stderr).digest("hex"),stdoutBytes:f.stdout.byteLength,stderrBytes:f.stderr.byteLength,publicSafe:!0})}finally{o&&(I.delete(e),o.runtime.close())}}export{Re as preflightPrivateCodexExecutor,de as privateCodexEnvironment,$ as runBoundedCodexProcess,Te as runPrivateCodexStep};
+import { codexLifecycleGuardPath } from './codex-lifecycle-guard.js';
+/**
+ * P222.16 beta candidate. A local Codex CLI is an executor, not a P127 native
+ * task delegation capability. No protected material is passed in argv, env,
+ * files, logs, or this module's public receipt.
+ */
+import { execFileSync, spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { connect, createServer } from 'node:net';
+import { accessSync, lstatSync, mkdtempSync, readFileSync, realpathSync, rmdirSync, unlinkSync, constants as fsConstants, } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { gitLifecycleRuntimeDirectory } from '../git/git-lifecycle-store.js';
+import { captureDirectYoloCheckoutEvidence } from '../git/direct-yolo-checkpoint.js';
+import { createPrivateCodexScopedRunner } from './codex-scoped-permissions.js';
+import { createPrivateCodexHostRuntime } from './codex-host-runtime.js';
+const PREFLIGHT_TTL_MS = 30_000;
+const MAX_PROBE_OUTPUT_BYTES = 16 * 1024;
+const MAX_AGENT_OUTPUT_BYTES = 1024 * 1024;
+const MAX_AGENT_MATERIAL_BYTES = 256 * 1024;
+const VERSION_PATTERN = /^codex-cli\s+(\d+\.\d+\.\d+)\s*$/;
+const PRIVATE_PERMISSION_PROFILE = 'p222-isolated';
+const PRIVATE_ENVIRONMENT_KEYS = [
+    'PATH', 'HOME', 'LANG', 'LC_ALL', 'TERM', 'CODEX_HOME',
+];
+// Keep these scoped to the protected exec, not the operator's global Codex
+// configuration. This limits local telemetry/history; it says nothing about
+// retention by the authenticated ChatGPT workspace or inference provider.
+const PRIVATE_CODEX_DATA_CONTROLS = [
+    '-c', 'web_search="disabled"',
+    '-c', 'features.hooks=false',
+    '-c', 'analytics.enabled=false',
+    '-c', 'history.persistence="none"',
+    '-c', 'otel.exporter="none"',
+    '-c', 'otel.metrics_exporter="none"',
+    '-c', 'otel.trace_exporter="none"',
+    '-c', 'otel.log_user_prompt=false',
+    '-c', 'notify=[]',
+];
+const scopedPreflightRunners = new WeakMap();
+const scopedHostRuntimes = new WeakMap();
+/** The CLI needs its login location and executable path, not host secrets. */
+export function privateCodexEnvironment(source) {
+    const environment = {};
+    for (const key of PRIVATE_ENVIRONMENT_KEYS) {
+        if (typeof source[key] === 'string')
+            environment[key] = source[key];
+    }
+    return environment;
+}
+export async function runBoundedCodexProcess(args, options) {
+    if (options.configReadProbe && (options.stdin !== undefined || args.at(-1) !== 'app-server')) {
+        throw new Error('private-codex-web-search-isolation-unproven');
+    }
+    return new Promise((resolveProcess, rejectProcess) => {
+        const environment = privateCodexEnvironment(process.env);
+        if (options.codexHome !== undefined)
+            environment.CODEX_HOME = options.codexHome;
+        const supervised = process.platform === 'linux';
+        const child = spawn(supervised ? process.execPath : options.codexHome === undefined ? 'codex' : '/bin/sh', supervised
+            ? [codexLifecycleGuardPath, 'process'] : options.codexHome === undefined
+            ? [...args] : ['-c', 'umask 077; exec codex "$@"', 'neocortex-private-codex', ...args], {
+            cwd: options.cwd,
+            stdio: supervised ? ['pipe', 'pipe', 'pipe', 'ipc'] : ['pipe', 'pipe', 'pipe'],
+            env: environment,
+            detached: supervised,
+        });
+        const stop = () => {
+            if (process.platform === 'linux' && child.pid !== undefined) {
+                try {
+                    process.kill(-child.pid, 'SIGKILL');
+                }
+                catch (error) {
+                    if (error.code !== 'ESRCH')
+                        throw error;
+                }
+            }
+            else
+                child.kill('SIGKILL');
+        };
+        const stdout = [];
+        const stderr = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let timedOut = false;
+        let outputExceeded = false;
+        let rpcBuffer = '';
+        let rpcInitialized = false;
+        const sendRpc = (value) => child.stdin.write(`${JSON.stringify(value)}\n`);
+        const timeout = setTimeout(() => { timedOut = true; stop(); }, options.timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            stdoutBytes += chunk.byteLength;
+            if (stdoutBytes + stderrBytes > options.maxOutputBytes) {
+                outputExceeded = true;
+                stop();
+            }
+            else {
+                stdout.push(chunk);
+                if (options.configReadProbe) {
+                    rpcBuffer += chunk.toString('utf8');
+                    let boundary;
+                    while ((boundary = rpcBuffer.indexOf('\n')) >= 0) {
+                        const line = rpcBuffer.slice(0, boundary);
+                        rpcBuffer = rpcBuffer.slice(boundary + 1);
+                        try {
+                            const row = JSON.parse(line);
+                            if (row.id === 1 && row.result && !rpcInitialized) {
+                                rpcInitialized = true;
+                                sendRpc({ method: 'initialized', params: {} });
+                                sendRpc({ id: 2, method: 'config/read', params: { includeLayers: false, cwd: options.cwd } });
+                            }
+                            else if (row.id === 2)
+                                child.stdin.end();
+                        }
+                        catch { /* Invalid probe output is refused below; never print configuration. */ }
+                    }
+                }
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            stderrBytes += chunk.byteLength;
+            if (stdoutBytes + stderrBytes > options.maxOutputBytes) {
+                outputExceeded = true;
+                stop();
+            }
+            else
+                stderr.push(chunk);
+        });
+        child.on('error', (error) => { clearTimeout(timeout); rejectProcess(error); });
+        child.on('close', (exitCode) => {
+            clearTimeout(timeout);
+            resolveProcess({
+                exitCode, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr), timedOut, outputExceeded,
+            });
+        });
+        child.stdin.on('error', () => {
+            // A child that closed stdin still reaches the close handler and fails
+            // through its physical exit code; never print the private stdin payload.
+        });
+        if (supervised)
+            child.send({ kind: 'private-codex-launch', args: [...args], codexHome: options.codexHome }, error => {
+                if (error) {
+                    clearTimeout(timeout);
+                    stop();
+                    rejectProcess(new Error('private-codex-process-guard-unavailable'));
+                }
+            });
+        if (options.configReadProbe)
+            sendRpc({ id: 1, method: 'initialize', params: {
+                    clientInfo: { name: 'p222-isolation-probe', version: '1' }, capabilities: {},
+                } });
+        else
+            child.stdin.end(options.stdin);
+    });
+}
+function processPassed(result) {
+    return result.exitCode === 0 && !result.timedOut && !result.outputExceeded;
+}
+async function privateMcpOverrides(root, runner) {
+    // Installed account plugins can bring MCP tools even when `codex mcp list`
+    // reports no directly configured servers. Disable plugins on the actual
+    // agent run and prove the CLI resolves that override to an empty catalog.
+    const plugins = await runner(['-c', 'features.plugins=false', 'plugin', 'list', '--json'], {
+        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+    });
+    const servers = await runner(['mcp', 'list', '--json'], {
+        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+    });
+    if (!processPassed(plugins) || !processPassed(servers))
+        return null;
+    try {
+        const pluginCatalog = JSON.parse(plugins.stdout.toString('utf8'));
+        const directServers = JSON.parse(servers.stdout.toString('utf8'));
+        const pluginsDisabled = Boolean(pluginCatalog && typeof pluginCatalog === 'object'
+            && !Array.isArray(pluginCatalog)
+            && Array.isArray(pluginCatalog.installed)
+            && pluginCatalog.installed.length === 0);
+        if (!pluginsDisabled || !Array.isArray(directServers) || directServers.length > 64)
+            return null;
+        const names = directServers.map((server) => {
+            if (!server || typeof server !== 'object' || Array.isArray(server))
+                throw new Error('invalid catalog');
+            const value = server;
+            // The CLI's dotted override parser cannot safely address dots/quoted keys.
+            if (typeof value.name !== 'string' || !/^[A-Za-z0-9_-]{1,64}$/.test(value.name)
+                || typeof value.enabled !== 'boolean')
+                throw new Error('invalid catalog');
+            return value.name;
+        });
+        if (new Set(names).size !== names.length)
+            return null;
+        if (names.length === 0)
+            return [];
+        const overrides = [...names].sort().flatMap(name => ['-c', `mcp_servers.${name}.enabled=false`]);
+        const scoped = await runner([...overrides, 'mcp', 'list', '--json'], {
+            cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+        });
+        if (!processPassed(scoped))
+            return null;
+        const resolved = JSON.parse(scoped.stdout.toString('utf8'));
+        if (!Array.isArray(resolved) || resolved.length !== names.length)
+            return null;
+        const observed = new Set();
+        for (const server of resolved) {
+            if (!server || typeof server !== 'object' || Array.isArray(server)
+                || typeof server.name !== 'string' || !names.includes(server.name)
+                || server.enabled !== false || observed.has(server.name))
+                return null;
+            observed.add(server.name);
+        }
+        return Object.freeze(overrides);
+    }
+    catch {
+        return null;
+    }
+}
+async function checkHookIsolation(root, runner) {
+    // User and project hooks are additive. Prove the same per-run override used
+    // below resolves to disabled before delivering any protected material.
+    const features = await runner(['-c', 'features.hooks=false', 'features', 'list'], {
+        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+    });
+    if (!processPassed(features))
+        return false;
+    const hooks = features.stdout.toString('utf8').split(/\r?\n/)
+        .filter((line) => /^hooks\s+\S+\s+(?:true|false)\s*$/.test(line));
+    return hooks.length === 1 && /^hooks\s+\S+\s+false\s*$/.test(hooks[0]);
+}
+async function checkWebSearchIsolation(root, runner, mcpOverrides) {
+    const result = await runner(['-c', 'features.plugins=false', ...mcpOverrides,
+        ...PRIVATE_CODEX_DATA_CONTROLS, '--strict-config', 'app-server'], {
+        cwd: root, configReadProbe: true, timeoutMs: 10_000, maxOutputBytes: 256 * 1024,
+    });
+    try {
+        if (!processPassed(result))
+            return false;
+        const rows = result.stdout.toString('utf8').split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+        const replies = rows.filter(row => row && row.id === 2);
+        return replies.length === 1 && !replies[0].error && replies[0].result?.config?.web_search === 'disabled';
+    }
+    catch {
+        return false;
+    }
+    finally {
+        result.stdout.fill(0);
+        result.stderr.fill(0);
+    }
+}
+function requireReadableRegularFile(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('private-codex-auth-unavailable');
+    accessSync(path, fsConstants.R_OK);
+}
+function gitControlDirectories(root) {
+    const environment = { ...process.env };
+    for (const key of [
+        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
+    ])
+        delete environment[key];
+    try {
+        const command = (args) => execFileSync('git', [...args], {
+            cwd: root, env: environment, encoding: 'utf8', timeout: 5_000, maxBuffer: MAX_PROBE_OUTPUT_BYTES,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        const directories = [command(['rev-parse', '--git-dir']), command(['rev-parse', '--git-common-dir'])]
+            .map((path) => realpathSync(resolve(root, path)));
+        if (directories.some((path) => !lstatSync(path).isDirectory()))
+            throw new Error('git-control-invalid');
+        return [...new Set(directories)];
+    }
+    catch {
+        throw new Error('private-codex-git-control-unavailable');
+    }
+}
+async function checkGitControlWriteDenied(root, runner) {
+    const readable = await runner(['sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'git', 'rev-parse', '--git-dir'], {
+        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+    });
+    if (!processPassed(readable))
+        return false;
+    for (const directory of gitControlDirectories(root)) {
+        const marker = join(directory, `.neocortex-git-probe-${randomBytes(16).toString('hex')}`);
+        const denied = await runner([
+            'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c', 'mkdir "$1"', 'sh', marker,
+        ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
+        let markerExists = false;
+        let createdDirectory = false;
+        try {
+            const entry = lstatSync(marker);
+            markerExists = true;
+            createdDirectory = entry.isDirectory();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                return false;
+        }
+        if (markerExists) {
+            if (createdDirectory)
+                rmdirSync(marker);
+            else
+                unlinkSync(marker);
+        }
+        if (denied.exitCode !== 1 || denied.timedOut || denied.outputExceeded || markerExists)
+            return false;
+    }
+    return true;
+}
+async function checkGitLifecycleReadDenied(root, privateDirectory, runner) {
+    if (!lstatSync(privateDirectory).isDirectory())
+        return false;
+    accessSync(privateDirectory, fsConstants.R_OK);
+    const denied = await runner([
+        'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c',
+        'if test -r "$1"; then exit 42; else exit 43; fi', 'sh', privateDirectory,
+    ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
+    return denied.exitCode === 43 && !denied.timedOut && !denied.outputExceeded;
+}
+async function checkSandboxNetworkDenied(root, runner) {
+    const server = createServer((socket) => socket.end());
+    await new Promise((resolveListen, rejectListen) => {
+        server.once('error', rejectListen);
+        server.listen(0, '127.0.0.1', () => resolveListen());
+    });
+    try {
+        const address = server.address();
+        if (!address || typeof address === 'string')
+            return false;
+        // First prove the loopback endpoint is reachable outside the sandbox.
+        const script = 'const s=require("node:net").connect(Number(process.argv[1]),"127.0.0.1");s.setTimeout(1500);s.on("connect",()=>{s.end();process.exit(0)});s.on("error",()=>process.exit(1));s.on("timeout",()=>process.exit(1))';
+        const outside = await new Promise((resolveConnection) => {
+            const connection = connect(address.port, '127.0.0.1');
+            connection.setTimeout(1500);
+            connection.once('connect', () => { connection.end(); resolveConnection(true); });
+            connection.once('error', () => resolveConnection(false));
+            connection.once('timeout', () => { connection.destroy(); resolveConnection(false); });
+        });
+        if (!outside)
+            return false;
+        const nodeAvailable = await runner(['sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'node', '--version'], {
+            cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+        });
+        if (!processPassed(nodeAvailable))
+            return false;
+        const inside = await runner(['sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'node', '-e', script, String(address.port)], {
+            cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+        });
+        return inside.exitCode === 1 && !inside.timedOut && !inside.outputExceeded;
+    }
+    finally {
+        server.close();
+    }
+}
+/**
+ * Probe the exact default sandbox configuration used by `codex exec`. This
+ * intentionally does not elevate P127 task delegation or attest remote code.
+ */
+export async function preflightPrivateCodexExecutor(projectRoot, options = {}) {
+    if ((options.platform ?? process.platform) !== 'linux')
+        throw new Error('private-codex-platform-unsupported');
+    const root = resolve(projectRoot);
+    const userHome = options.userHome ?? homedir();
+    const sourceHome = options.codexHome ?? process.env.CODEX_HOME ?? join(userHome, '.codex');
+    const hostRuntime = options.runner ? undefined : createPrivateCodexHostRuntime(root, sourceHome);
+    try {
+        const base = hostRuntime ? async (args, runOptions) => {
+            hostRuntime.verify();
+            return runBoundedCodexProcess(args, { ...runOptions, codexHome: hostRuntime.home });
+        } : runBoundedCodexProcess;
+        const codexHome = hostRuntime?.home ?? sourceHome;
+        const runner = options.runner ?? await createPrivateCodexScopedRunner(root, base, {
+            ...options, codexHome, credentialSourceHome: hostRuntime?.sourceHome ?? sourceHome, gitControlDirectories: gitControlDirectories(root),
+        });
+        const authPath = join(codexHome, 'auth.json');
+        try {
+            requireReadableRegularFile(authPath);
+        }
+        catch {
+            throw new Error('private-codex-auth-unavailable');
+        }
+        const version = await runner(['--version'], { cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
+        const match = processPassed(version) ? VERSION_PATTERN.exec(version.stdout.toString('utf8').trim()) : null;
+        if (!match)
+            throw new Error('private-codex-version-unavailable');
+        const login = await runner(['login', 'status'], { cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
+        if (!processPassed(login) || !/Logged in using ChatGPT/i.test(Buffer.concat([login.stdout, login.stderr]).toString('utf8'))) {
+            throw new Error('private-codex-subscription-required');
+        }
+        const mcpOverrides = await privateMcpOverrides(root, runner).catch(() => null);
+        if (mcpOverrides === null)
+            throw new Error('private-codex-mcp-isolation-unproven');
+        const hookIsolation = await checkHookIsolation(root, runner).catch(() => false);
+        if (!hookIsolation)
+            throw new Error('private-codex-hook-isolation-unproven');
+        if (!await checkWebSearchIsolation(root, runner, mcpOverrides).catch(() => false)) {
+            throw new Error('private-codex-web-search-isolation-unproven');
+        }
+        // Codex's path-deny mount requires this exact path to exist before the first
+        // sandbox process starts. Create it outside the sandbox and verify it later.
+        const lifecycleDirectory = await gitLifecycleRuntimeDirectory(root).catch(() => {
+            throw new Error('private-codex-git-lifecycle-read-isolation-unproven');
+        });
+        const sshDirectory = join(userHome, '.ssh');
+        const credentialDenial = await runner([
+            'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c',
+            ...(hostRuntime ? ['test ! -r "$1" && test ! -r "$2" && test ! -r "$3"', 'sh', authPath, sshDirectory, join(sourceHome, 'auth.json')]
+                : ['test ! -r "$1" && test ! -r "$2"', 'sh', authPath, sshDirectory]),
+        ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
+        if (!processPassed(credentialDenial))
+            throw new Error('private-codex-auth-isolation-unproven');
+        const probeDir = mkdtempSync(join(root, '.private-codex-probe-'));
+        const receiptPath = join(probeDir, 'receipt');
+        try {
+            const writer = await runner([
+                'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c', 'printf "P222_PROBE\\n" > "$1"', 'sh', receiptPath,
+            ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
+            if (!processPassed(writer) || readFileSync(receiptPath, 'utf8') !== 'P222_PROBE\n') {
+                throw new Error('private-codex-workspace-write-unproven');
+            }
+        }
+        catch {
+            throw new Error('private-codex-workspace-write-unproven');
+        }
+        finally {
+            try {
+                unlinkSync(receiptPath);
+            }
+            catch { /* no receipt */ }
+            rmdirSync(probeDir);
+        }
+        const gitControlWriteDenied = await checkGitControlWriteDenied(root, runner).catch(() => false);
+        if (!gitControlWriteDenied)
+            throw new Error('private-codex-git-control-isolation-unproven');
+        const gitLifecycleReadDenied = await checkGitLifecycleReadDenied(root, lifecycleDirectory, runner).catch(() => false);
+        if (!gitLifecycleReadDenied)
+            throw new Error('private-codex-git-lifecycle-read-isolation-unproven');
+        const networkDenied = await (options.networkProbe ?? checkSandboxNetworkDenied)(root, runner);
+        if (!networkDenied)
+            throw new Error('private-codex-network-isolation-unproven');
+        const preflight = Object.freeze({
+            schemaVersion: 6, hostKind: 'codex-cli', hostVersion: match[1], projectRoot: root,
+            observedAtMs: (options.now ?? Date.now)(), authIsolation: 'passed', workspaceWrite: 'passed',
+            gitControlWriteDenied: 'passed', gitLifecycleReadDenied: 'passed', mcpIsolation: 'passed',
+            environmentIsolation: 'passed',
+            networkDenied: 'passed', webSearchDisabled: 'passed', credentialKind: 'chatgpt-subscription',
+        });
+        scopedPreflightRunners.set(preflight, runner);
+        if (hostRuntime) {
+            const timer = setTimeout(() => {
+                scopedHostRuntimes.delete(preflight);
+                scopedPreflightRunners.delete(preflight);
+                try {
+                    hostRuntime.close();
+                }
+                catch { /* Custody failure must not delete another owner's directory. */ }
+            }, PREFLIGHT_TTL_MS);
+            timer.unref();
+            scopedHostRuntimes.set(preflight, { runtime: hostRuntime, timer });
+        }
+        return preflight;
+    }
+    catch (error) {
+        hostRuntime?.close();
+        throw error;
+    }
+}
+export async function runPrivateCodexStep(material, preflight, options = {}) {
+    const hostRuntime = scopedHostRuntimes.get(preflight);
+    if (hostRuntime) {
+        clearTimeout(hostRuntime.timer);
+        scopedHostRuntimes.delete(preflight);
+    }
+    try {
+        const now = (options.now ?? Date.now)();
+        if (options.model !== undefined && !/^gpt-[a-z0-9][a-z0-9.-]{0,63}$/.test(options.model)) {
+            throw new Error('private-codex-model-invalid');
+        }
+        if (preflight.schemaVersion !== 6 || preflight.hostKind !== 'codex-cli'
+            || preflight.authIsolation !== 'passed' || preflight.workspaceWrite !== 'passed'
+            || preflight.gitControlWriteDenied !== 'passed' || preflight.gitLifecycleReadDenied !== 'passed'
+            || preflight.mcpIsolation !== 'passed' || preflight.environmentIsolation !== 'passed'
+            || preflight.webSearchDisabled !== 'passed' || preflight.networkDenied !== 'passed' || preflight.credentialKind !== 'chatgpt-subscription'
+            || now < preflight.observedAtMs || now - preflight.observedAtMs > PREFLIGHT_TTL_MS
+            || typeof material !== 'string' || Buffer.byteLength(material, 'utf8') < 1
+            || Buffer.byteLength(material, 'utf8') > MAX_AGENT_MATERIAL_BYTES) {
+            throw new Error('private-codex-preflight-stale');
+        }
+        const runner = options.runner ?? scopedPreflightRunners.get(preflight);
+        if (!runner)
+            throw new Error('private-codex-preflight-stale');
+        const version = await runner(['--version'], {
+            cwd: preflight.projectRoot, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
+        });
+        if (!processPassed(version) || VERSION_PATTERN.exec(version.stdout.toString('utf8').trim())?.[1] !== preflight.hostVersion) {
+            throw new Error('private-codex-version-drift');
+        }
+        const effectFailure = (phase, processResult) => {
+            const observation = Object.freeze({
+                schemaVersion: 1, kind: 'PrivateCodexWorkspaceEffectFailure/1', phase,
+                agentReturnedSuccessfully: processResult !== undefined,
+                ...(processResult === undefined ? {} : {
+                    stdoutSha256: createHash('sha256').update(processResult.stdout).digest('hex'),
+                    stderrSha256: createHash('sha256').update(processResult.stderr).digest('hex'),
+                    stdoutBytes: processResult.stdout.length, stderrBytes: processResult.stderr.length,
+                }), publicSafe: true,
+            });
+            try {
+                void Promise.resolve(options.onWorkspaceEffectFailure?.(observation)).catch(() => undefined);
+            }
+            catch { /* Observation cannot replace the original refusal. */ }
+            return new Error('private-codex-workspace-effect-unverified');
+        };
+        const before = options.requireWorkspaceEffect
+            ? await captureDirectYoloCheckoutEvidence(preflight.projectRoot).catch(() => {
+                throw effectFailure('before-capture');
+            }) : undefined;
+        if (before && options.expectedExecutionBranch !== undefined
+            && before.branch !== options.expectedExecutionBranch) {
+            throw effectFailure('branch-before');
+        }
+        // A managed requirement may change after the short-lived preflight. Check
+        // again at the material handoff boundary; never let a passing old receipt
+        // authorize an exec whose effective hook policy is now enabled.
+        if (!await checkHookIsolation(preflight.projectRoot, runner).catch(() => false)) {
+            throw new Error('private-codex-hook-isolation-unproven');
+        }
+        const mcpOverrides = await privateMcpOverrides(preflight.projectRoot, runner).catch(() => null);
+        if (mcpOverrides === null) {
+            throw new Error('private-codex-mcp-isolation-unproven');
+        }
+        if (!await checkWebSearchIsolation(preflight.projectRoot, runner, mcpOverrides).catch(() => false)) {
+            throw new Error('private-codex-web-search-isolation-unproven');
+        }
+        const result = await runner([
+            'exec', '--ephemeral', '--json', '--strict-config', '-c', 'features.plugins=false',
+            ...(options.model === undefined ? [] : ['--model', options.model]),
+            ...mcpOverrides,
+            ...PRIVATE_CODEX_DATA_CONTROLS,
+            '-c', 'shell_environment_policy.ignore_default_excludes=false',
+            '-c', 'shell_environment_policy.include_only=["PATH","HOME","LANG","LC_ALL","TERM"]',
+            '-c', `default_permissions="${PRIVATE_PERMISSION_PROFILE}"`,
+            '-C', preflight.projectRoot, '-',
+        ], {
+            cwd: preflight.projectRoot, stdin: material, timeoutMs: 10 * 60_000, maxOutputBytes: MAX_AGENT_OUTPUT_BYTES,
+        });
+        if (!processPassed(result))
+            throw new Error('private-codex-execution-unverified');
+        hostRuntime?.runtime.verify();
+        if (before) {
+            const after = await captureDirectYoloCheckoutEvidence(preflight.projectRoot).catch(() => {
+                throw effectFailure('after-capture', result);
+            });
+            if (after.headSha !== before.headSha || after.branch !== before.branch) {
+                throw effectFailure('identity-after', result);
+            }
+            if (after.payloadDigest === before.payloadDigest)
+                throw effectFailure('no-payload-change', result);
+        }
+        return Object.freeze({
+            schemaVersion: 1, outcome: 'executor-returned-unverified', exitCode: 0,
+            stdoutSha256: createHash('sha256').update(result.stdout).digest('hex'),
+            stderrSha256: createHash('sha256').update(result.stderr).digest('hex'),
+            stdoutBytes: result.stdout.byteLength, stderrBytes: result.stderr.byteLength,
+            publicSafe: true,
+        });
+    }
+    finally {
+        if (hostRuntime) {
+            scopedPreflightRunners.delete(preflight);
+            hostRuntime.runtime.close();
+        }
+    }
+}