@ornexus/neocortex 4.60.73 → 4.60.75

package/packages/client/dist/private-execution/codex-executor.js

@@ -1,574 +1,4 @@
-import { codexLifecycleGuardPath } from './codex-lifecycle-guard.js';
-/**
- * P222.16 beta candidate. A local Codex CLI is an executor, not a P127 native
- * task delegation capability. No protected material is passed in argv, env,
- * files, logs, or this module's public receipt.
- */
-import { execFileSync, spawn } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
-import { connect, createServer } from 'node:net';
-import { accessSync, lstatSync, mkdtempSync, readFileSync, realpathSync, rmdirSync, unlinkSync, constants as fsConstants, } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { gitLifecycleRuntimeDirectory } from '../git/git-lifecycle-store.js';
-import { captureDirectYoloCheckoutEvidence } from '../git/direct-yolo-checkpoint.js';
-import { createPrivateCodexScopedRunner } from './codex-scoped-permissions.js';
-import { createPrivateCodexHostRuntime } from './codex-host-runtime.js';
-const PREFLIGHT_TTL_MS = 30_000;
-const MAX_PROBE_OUTPUT_BYTES = 16 * 1024;
-const MAX_AGENT_OUTPUT_BYTES = 1024 * 1024;
-const MAX_AGENT_MATERIAL_BYTES = 256 * 1024;
-const VERSION_PATTERN = /^codex-cli\s+(\d+\.\d+\.\d+)\s*$/;
-const PRIVATE_PERMISSION_PROFILE = 'p222-isolated';
-const PRIVATE_ENVIRONMENT_KEYS = [
-    'PATH', 'HOME', 'LANG', 'LC_ALL', 'TERM', 'CODEX_HOME',
-];
-// Keep these scoped to the protected exec, not the operator's global Codex
-// configuration. This limits local telemetry/history; it says nothing about
-// retention by the authenticated ChatGPT workspace or inference provider.
-const PRIVATE_CODEX_DATA_CONTROLS = [
-    '-c', 'web_search="disabled"',
-    '-c', 'features.hooks=false',
-    '-c', 'analytics.enabled=false',
-    '-c', 'history.persistence="none"',
-    '-c', 'otel.exporter="none"',
-    '-c', 'otel.metrics_exporter="none"',
-    '-c', 'otel.trace_exporter="none"',
-    '-c', 'otel.log_user_prompt=false',
-    '-c', 'notify=[]',
-];
-const scopedPreflightRunners = new WeakMap();
-const scopedHostRuntimes = new WeakMap();
-/** The CLI needs its login location and executable path, not host secrets. */
-export function privateCodexEnvironment(source) {
-    const environment = {};
-    for (const key of PRIVATE_ENVIRONMENT_KEYS) {
-        if (typeof source[key] === 'string')
-            environment[key] = source[key];
-    }
-    return environment;
-}
-export async function runBoundedCodexProcess(args, options) {
-    if (options.configReadProbe && (options.stdin !== undefined || args.at(-1) !== 'app-server')) {
-        throw new Error('private-codex-web-search-isolation-unproven');
-    }
-    return new Promise((resolveProcess, rejectProcess) => {
-        const environment = privateCodexEnvironment(process.env);
-        if (options.codexHome !== undefined)
-            environment.CODEX_HOME = options.codexHome;
-        const supervised = process.platform === 'linux';
-        const child = spawn(supervised ? process.execPath : options.codexHome === undefined ? 'codex' : '/bin/sh', supervised
-            ? [codexLifecycleGuardPath, 'process'] : options.codexHome === undefined
-            ? [...args] : ['-c', 'umask 077; exec codex "$@"', 'neocortex-private-codex', ...args], {
-            cwd: options.cwd,
-            stdio: supervised ? ['pipe', 'pipe', 'pipe', 'ipc'] : ['pipe', 'pipe', 'pipe'],
-            env: environment,
-            detached: supervised,
-        });
-        const stop = () => {
-            if (process.platform === 'linux' && child.pid !== undefined) {
-                try {
-                    process.kill(-child.pid, 'SIGKILL');
-                }
-                catch (error) {
-                    if (error.code !== 'ESRCH')
-                        throw error;
-                }
-            }
-            else
-                child.kill('SIGKILL');
-        };
-        const stdout = [];
-        const stderr = [];
-        let stdoutBytes = 0;
-        let stderrBytes = 0;
-        let timedOut = false;
-        let outputExceeded = false;
-        let rpcBuffer = '';
-        let rpcInitialized = false;
-        const sendRpc = (value) => child.stdin.write(`${JSON.stringify(value)}\n`);
-        const timeout = setTimeout(() => { timedOut = true; stop(); }, options.timeoutMs);
-        child.stdout.on('data', (chunk) => {
-            stdoutBytes += chunk.byteLength;
-            if (stdoutBytes + stderrBytes > options.maxOutputBytes) {
-                outputExceeded = true;
-                stop();
-            }
-            else {
-                stdout.push(chunk);
-                if (options.configReadProbe) {
-                    rpcBuffer += chunk.toString('utf8');
-                    let boundary;
-                    while ((boundary = rpcBuffer.indexOf('\n')) >= 0) {
-                        const line = rpcBuffer.slice(0, boundary);
-                        rpcBuffer = rpcBuffer.slice(boundary + 1);
-                        try {
-                            const row = JSON.parse(line);
-                            if (row.id === 1 && row.result && !rpcInitialized) {
-                                rpcInitialized = true;
-                                sendRpc({ method: 'initialized', params: {} });
-                                sendRpc({ id: 2, method: 'config/read', params: { includeLayers: false, cwd: options.cwd } });
-                            }
-                            else if (row.id === 2)
-                                child.stdin.end();
-                        }
-                        catch { /* Invalid probe output is refused below; never print configuration. */ }
-                    }
-                }
-            }
-        });
-        child.stderr.on('data', (chunk) => {
-            stderrBytes += chunk.byteLength;
-            if (stdoutBytes + stderrBytes > options.maxOutputBytes) {
-                outputExceeded = true;
-                stop();
-            }
-            else
-                stderr.push(chunk);
-        });
-        child.on('error', (error) => { clearTimeout(timeout); rejectProcess(error); });
-        child.on('close', (exitCode) => {
-            clearTimeout(timeout);
-            resolveProcess({
-                exitCode, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr), timedOut, outputExceeded,
-            });
-        });
-        child.stdin.on('error', () => {
-            // A child that closed stdin still reaches the close handler and fails
-            // through its physical exit code; never print the private stdin payload.
-        });
-        if (supervised)
-            child.send({ kind: 'private-codex-launch', args: [...args], codexHome: options.codexHome }, error => {
-                if (error) {
-                    clearTimeout(timeout);
-                    stop();
-                    rejectProcess(new Error('private-codex-process-guard-unavailable'));
-                }
-            });
-        if (options.configReadProbe)
-            sendRpc({ id: 1, method: 'initialize', params: {
-                    clientInfo: { name: 'p222-isolation-probe', version: '1' }, capabilities: {},
-                } });
-        else
-            child.stdin.end(options.stdin);
-    });
-}
-function processPassed(result) {
-    return result.exitCode === 0 && !result.timedOut && !result.outputExceeded;
-}
-async function privateMcpOverrides(root, runner) {
-    // Installed account plugins can bring MCP tools even when `codex mcp list`
-    // reports no directly configured servers. Disable plugins on the actual
-    // agent run and prove the CLI resolves that override to an empty catalog.
-    const plugins = await runner(['-c', 'features.plugins=false', 'plugin', 'list', '--json'], {
-        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-    });
-    const servers = await runner(['mcp', 'list', '--json'], {
-        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-    });
-    if (!processPassed(plugins) || !processPassed(servers))
-        return null;
-    try {
-        const pluginCatalog = JSON.parse(plugins.stdout.toString('utf8'));
-        const directServers = JSON.parse(servers.stdout.toString('utf8'));
-        const pluginsDisabled = Boolean(pluginCatalog && typeof pluginCatalog === 'object'
-            && !Array.isArray(pluginCatalog)
-            && Array.isArray(pluginCatalog.installed)
-            && pluginCatalog.installed.length === 0);
-        if (!pluginsDisabled || !Array.isArray(directServers) || directServers.length > 64)
-            return null;
-        const names = directServers.map((server) => {
-            if (!server || typeof server !== 'object' || Array.isArray(server))
-                throw new Error('invalid catalog');
-            const value = server;
-            // The CLI's dotted override parser cannot safely address dots/quoted keys.
-            if (typeof value.name !== 'string' || !/^[A-Za-z0-9_-]{1,64}$/.test(value.name)
-                || typeof value.enabled !== 'boolean')
-                throw new Error('invalid catalog');
-            return value.name;
-        });
-        if (new Set(names).size !== names.length)
-            return null;
-        if (names.length === 0)
-            return [];
-        const overrides = [...names].sort().flatMap(name => ['-c', `mcp_servers.${name}.enabled=false`]);
-        const scoped = await runner([...overrides, 'mcp', 'list', '--json'], {
-            cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-        });
-        if (!processPassed(scoped))
-            return null;
-        const resolved = JSON.parse(scoped.stdout.toString('utf8'));
-        if (!Array.isArray(resolved) || resolved.length !== names.length)
-            return null;
-        const observed = new Set();
-        for (const server of resolved) {
-            if (!server || typeof server !== 'object' || Array.isArray(server)
-                || typeof server.name !== 'string' || !names.includes(server.name)
-                || server.enabled !== false || observed.has(server.name))
-                return null;
-            observed.add(server.name);
-        }
-        return Object.freeze(overrides);
-    }
-    catch {
-        return null;
-    }
-}
-async function checkHookIsolation(root, runner) {
-    // User and project hooks are additive. Prove the same per-run override used
-    // below resolves to disabled before delivering any protected material.
-    const features = await runner(['-c', 'features.hooks=false', 'features', 'list'], {
-        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-    });
-    if (!processPassed(features))
-        return false;
-    const hooks = features.stdout.toString('utf8').split(/\r?\n/)
-        .filter((line) => /^hooks\s+\S+\s+(?:true|false)\s*$/.test(line));
-    return hooks.length === 1 && /^hooks\s+\S+\s+false\s*$/.test(hooks[0]);
-}
-async function checkWebSearchIsolation(root, runner, mcpOverrides) {
-    const result = await runner(['-c', 'features.plugins=false', ...mcpOverrides,
-        ...PRIVATE_CODEX_DATA_CONTROLS, '--strict-config', 'app-server'], {
-        cwd: root, configReadProbe: true, timeoutMs: 10_000, maxOutputBytes: 256 * 1024,
-    });
-    try {
-        if (!processPassed(result))
-            return false;
-        const rows = result.stdout.toString('utf8').split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
-        const replies = rows.filter(row => row && row.id === 2);
-        return replies.length === 1 && !replies[0].error && replies[0].result?.config?.web_search === 'disabled';
-    }
-    catch {
-        return false;
-    }
-    finally {
-        result.stdout.fill(0);
-        result.stderr.fill(0);
-    }
-}
-function requireReadableRegularFile(path) {
-    const stat = lstatSync(path);
-    if (!stat.isFile() || stat.isSymbolicLink())
-        throw new Error('private-codex-auth-unavailable');
-    accessSync(path, fsConstants.R_OK);
-}
-function gitControlDirectories(root) {
-    const environment = { ...process.env };
-    for (const key of [
-        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
-        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
-    ])
-        delete environment[key];
-    try {
-        const command = (args) => execFileSync('git', [...args], {
-            cwd: root, env: environment, encoding: 'utf8', timeout: 5_000, maxBuffer: MAX_PROBE_OUTPUT_BYTES,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        const directories = [command(['rev-parse', '--git-dir']), command(['rev-parse', '--git-common-dir'])]
-            .map((path) => realpathSync(resolve(root, path)));
-        if (directories.some((path) => !lstatSync(path).isDirectory()))
-            throw new Error('git-control-invalid');
-        return [...new Set(directories)];
-    }
-    catch {
-        throw new Error('private-codex-git-control-unavailable');
-    }
-}
-async function checkGitControlWriteDenied(root, runner) {
-    const readable = await runner(['sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'git', 'rev-parse', '--git-dir'], {
-        cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-    });
-    if (!processPassed(readable))
-        return false;
-    for (const directory of gitControlDirectories(root)) {
-        const marker = join(directory, `.neocortex-git-probe-${randomBytes(16).toString('hex')}`);
-        const denied = await runner([
-            'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c', 'mkdir "$1"', 'sh', marker,
-        ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
-        let markerExists = false;
-        let createdDirectory = false;
-        try {
-            const entry = lstatSync(marker);
-            markerExists = true;
-            createdDirectory = entry.isDirectory();
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                return false;
-        }
-        if (markerExists) {
-            if (createdDirectory)
-                rmdirSync(marker);
-            else
-                unlinkSync(marker);
-        }
-        if (denied.exitCode !== 1 || denied.timedOut || denied.outputExceeded || markerExists)
-            return false;
-    }
-    return true;
-}
-async function checkGitLifecycleReadDenied(root, privateDirectory, runner) {
-    if (!lstatSync(privateDirectory).isDirectory())
-        return false;
-    accessSync(privateDirectory, fsConstants.R_OK);
-    const denied = await runner([
-        'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c',
-        'if test -r "$1"; then exit 42; else exit 43; fi', 'sh', privateDirectory,
-    ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
-    return denied.exitCode === 43 && !denied.timedOut && !denied.outputExceeded;
-}
-async function checkSandboxNetworkDenied(root, runner) {
-    const server = createServer((socket) => socket.end());
-    await new Promise((resolveListen, rejectListen) => {
-        server.once('error', rejectListen);
-        server.listen(0, '127.0.0.1', () => resolveListen());
-    });
-    try {
-        const address = server.address();
-        if (!address || typeof address === 'string')
-            return false;
-        // First prove the loopback endpoint is reachable outside the sandbox.
-        const script = 'const s=require("node:net").connect(Number(process.argv[1]),"127.0.0.1");s.setTimeout(1500);s.on("connect",()=>{s.end();process.exit(0)});s.on("error",()=>process.exit(1));s.on("timeout",()=>process.exit(1))';
-        const outside = await new Promise((resolveConnection) => {
-            const connection = connect(address.port, '127.0.0.1');
-            connection.setTimeout(1500);
-            connection.once('connect', () => { connection.end(); resolveConnection(true); });
-            connection.once('error', () => resolveConnection(false));
-            connection.once('timeout', () => { connection.destroy(); resolveConnection(false); });
-        });
-        if (!outside)
-            return false;
-        const nodeAvailable = await runner(['sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'node', '--version'], {
-            cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-        });
-        if (!processPassed(nodeAvailable))
-            return false;
-        const inside = await runner(['sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'node', '-e', script, String(address.port)], {
-            cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-        });
-        return inside.exitCode === 1 && !inside.timedOut && !inside.outputExceeded;
-    }
-    finally {
-        server.close();
-    }
-}
-/**
- * Probe the exact default sandbox configuration used by `codex exec`. This
- * intentionally does not elevate P127 task delegation or attest remote code.
- */
-export async function preflightPrivateCodexExecutor(projectRoot, options = {}) {
-    if ((options.platform ?? process.platform) !== 'linux')
-        throw new Error('private-codex-platform-unsupported');
-    const root = resolve(projectRoot);
-    const userHome = options.userHome ?? homedir();
-    const sourceHome = options.codexHome ?? process.env.CODEX_HOME ?? join(userHome, '.codex');
-    const hostRuntime = options.runner ? undefined : createPrivateCodexHostRuntime(root, sourceHome);
-    try {
-        const base = hostRuntime ? async (args, runOptions) => {
-            hostRuntime.verify();
-            return runBoundedCodexProcess(args, { ...runOptions, codexHome: hostRuntime.home });
-        } : runBoundedCodexProcess;
-        const codexHome = hostRuntime?.home ?? sourceHome;
-        const runner = options.runner ?? await createPrivateCodexScopedRunner(root, base, {
-            ...options, codexHome, credentialSourceHome: hostRuntime?.sourceHome ?? sourceHome, gitControlDirectories: gitControlDirectories(root),
-        });
-        const authPath = join(codexHome, 'auth.json');
-        try {
-            requireReadableRegularFile(authPath);
-        }
-        catch {
-            throw new Error('private-codex-auth-unavailable');
-        }
-        const version = await runner(['--version'], { cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
-        const match = processPassed(version) ? VERSION_PATTERN.exec(version.stdout.toString('utf8').trim()) : null;
-        if (!match)
-            throw new Error('private-codex-version-unavailable');
-        const login = await runner(['login', 'status'], { cwd: root, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
-        if (!processPassed(login) || !/Logged in using ChatGPT/i.test(Buffer.concat([login.stdout, login.stderr]).toString('utf8'))) {
-            throw new Error('private-codex-subscription-required');
-        }
-        const mcpOverrides = await privateMcpOverrides(root, runner).catch(() => null);
-        if (mcpOverrides === null)
-            throw new Error('private-codex-mcp-isolation-unproven');
-        const hookIsolation = await checkHookIsolation(root, runner).catch(() => false);
-        if (!hookIsolation)
-            throw new Error('private-codex-hook-isolation-unproven');
-        if (!await checkWebSearchIsolation(root, runner, mcpOverrides).catch(() => false)) {
-            throw new Error('private-codex-web-search-isolation-unproven');
-        }
-        // Codex's path-deny mount requires this exact path to exist before the first
-        // sandbox process starts. Create it outside the sandbox and verify it later.
-        const lifecycleDirectory = await gitLifecycleRuntimeDirectory(root).catch(() => {
-            throw new Error('private-codex-git-lifecycle-read-isolation-unproven');
-        });
-        const sshDirectory = join(userHome, '.ssh');
-        const credentialDenial = await runner([
-            'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c',
-            ...(hostRuntime ? ['test ! -r "$1" && test ! -r "$2" && test ! -r "$3"', 'sh', authPath, sshDirectory, join(sourceHome, 'auth.json')]
-                : ['test ! -r "$1" && test ! -r "$2"', 'sh', authPath, sshDirectory]),
-        ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
-        if (!processPassed(credentialDenial))
-            throw new Error('private-codex-auth-isolation-unproven');
-        const probeDir = mkdtempSync(join(root, '.private-codex-probe-'));
-        const receiptPath = join(probeDir, 'receipt');
-        try {
-            const writer = await runner([
-                'sandbox', '-P', PRIVATE_PERMISSION_PROFILE, '--', 'sh', '-c', 'printf "P222_PROBE\\n" > "$1"', 'sh', receiptPath,
-            ], { cwd: root, timeoutMs: 10_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES });
-            if (!processPassed(writer) || readFileSync(receiptPath, 'utf8') !== 'P222_PROBE\n') {
-                throw new Error('private-codex-workspace-write-unproven');
-            }
-        }
-        catch {
-            throw new Error('private-codex-workspace-write-unproven');
-        }
-        finally {
-            try {
-                unlinkSync(receiptPath);
-            }
-            catch { /* no receipt */ }
-            rmdirSync(probeDir);
-        }
-        const gitControlWriteDenied = await checkGitControlWriteDenied(root, runner).catch(() => false);
-        if (!gitControlWriteDenied)
-            throw new Error('private-codex-git-control-isolation-unproven');
-        const gitLifecycleReadDenied = await checkGitLifecycleReadDenied(root, lifecycleDirectory, runner).catch(() => false);
-        if (!gitLifecycleReadDenied)
-            throw new Error('private-codex-git-lifecycle-read-isolation-unproven');
-        const networkDenied = await (options.networkProbe ?? checkSandboxNetworkDenied)(root, runner);
-        if (!networkDenied)
-            throw new Error('private-codex-network-isolation-unproven');
-        const preflight = Object.freeze({
-            schemaVersion: 6, hostKind: 'codex-cli', hostVersion: match[1], projectRoot: root,
-            observedAtMs: (options.now ?? Date.now)(), authIsolation: 'passed', workspaceWrite: 'passed',
-            gitControlWriteDenied: 'passed', gitLifecycleReadDenied: 'passed', mcpIsolation: 'passed',
-            environmentIsolation: 'passed',
-            networkDenied: 'passed', webSearchDisabled: 'passed', credentialKind: 'chatgpt-subscription',
-        });
-        scopedPreflightRunners.set(preflight, runner);
-        if (hostRuntime) {
-            const timer = setTimeout(() => {
-                scopedHostRuntimes.delete(preflight);
-                scopedPreflightRunners.delete(preflight);
-                try {
-                    hostRuntime.close();
-                }
-                catch { /* Custody failure must not delete another owner's directory. */ }
-            }, PREFLIGHT_TTL_MS);
-            timer.unref();
-            scopedHostRuntimes.set(preflight, { runtime: hostRuntime, timer });
-        }
-        return preflight;
-    }
-    catch (error) {
-        hostRuntime?.close();
-        throw error;
-    }
-}
-export async function runPrivateCodexStep(material, preflight, options = {}) {
-    const hostRuntime = scopedHostRuntimes.get(preflight);
-    if (hostRuntime) {
-        clearTimeout(hostRuntime.timer);
-        scopedHostRuntimes.delete(preflight);
-    }
-    try {
-        const now = (options.now ?? Date.now)();
-        if (options.model !== undefined && !/^gpt-[a-z0-9][a-z0-9.-]{0,63}$/.test(options.model)) {
-            throw new Error('private-codex-model-invalid');
-        }
-        if (preflight.schemaVersion !== 6 || preflight.hostKind !== 'codex-cli'
-            || preflight.authIsolation !== 'passed' || preflight.workspaceWrite !== 'passed'
-            || preflight.gitControlWriteDenied !== 'passed' || preflight.gitLifecycleReadDenied !== 'passed'
-            || preflight.mcpIsolation !== 'passed' || preflight.environmentIsolation !== 'passed'
-            || preflight.webSearchDisabled !== 'passed' || preflight.networkDenied !== 'passed' || preflight.credentialKind !== 'chatgpt-subscription'
-            || now < preflight.observedAtMs || now - preflight.observedAtMs > PREFLIGHT_TTL_MS
-            || typeof material !== 'string' || Buffer.byteLength(material, 'utf8') < 1
-            || Buffer.byteLength(material, 'utf8') > MAX_AGENT_MATERIAL_BYTES) {
-            throw new Error('private-codex-preflight-stale');
-        }
-        const runner = options.runner ?? scopedPreflightRunners.get(preflight);
-        if (!runner)
-            throw new Error('private-codex-preflight-stale');
-        const version = await runner(['--version'], {
-            cwd: preflight.projectRoot, timeoutMs: 5_000, maxOutputBytes: MAX_PROBE_OUTPUT_BYTES,
-        });
-        if (!processPassed(version) || VERSION_PATTERN.exec(version.stdout.toString('utf8').trim())?.[1] !== preflight.hostVersion) {
-            throw new Error('private-codex-version-drift');
-        }
-        const effectFailure = (phase, processResult) => {
-            const observation = Object.freeze({
-                schemaVersion: 1, kind: 'PrivateCodexWorkspaceEffectFailure/1', phase,
-                agentReturnedSuccessfully: processResult !== undefined,
-                ...(processResult === undefined ? {} : {
-                    stdoutSha256: createHash('sha256').update(processResult.stdout).digest('hex'),
-                    stderrSha256: createHash('sha256').update(processResult.stderr).digest('hex'),
-                    stdoutBytes: processResult.stdout.length, stderrBytes: processResult.stderr.length,
-                }), publicSafe: true,
-            });
-            try {
-                void Promise.resolve(options.onWorkspaceEffectFailure?.(observation)).catch(() => undefined);
-            }
-            catch { /* Observation cannot replace the original refusal. */ }
-            return new Error('private-codex-workspace-effect-unverified');
-        };
-        const before = options.requireWorkspaceEffect
-            ? await captureDirectYoloCheckoutEvidence(preflight.projectRoot).catch(() => {
-                throw effectFailure('before-capture');
-            }) : undefined;
-        if (before && options.expectedExecutionBranch !== undefined
-            && before.branch !== options.expectedExecutionBranch) {
-            throw effectFailure('branch-before');
-        }
-        // A managed requirement may change after the short-lived preflight. Check
-        // again at the material handoff boundary; never let a passing old receipt
-        // authorize an exec whose effective hook policy is now enabled.
-        if (!await checkHookIsolation(preflight.projectRoot, runner).catch(() => false)) {
-            throw new Error('private-codex-hook-isolation-unproven');
-        }
-        const mcpOverrides = await privateMcpOverrides(preflight.projectRoot, runner).catch(() => null);
-        if (mcpOverrides === null) {
-            throw new Error('private-codex-mcp-isolation-unproven');
-        }
-        if (!await checkWebSearchIsolation(preflight.projectRoot, runner, mcpOverrides).catch(() => false)) {
-            throw new Error('private-codex-web-search-isolation-unproven');
-        }
-        const result = await runner([
-            'exec', '--ephemeral', '--json', '--strict-config', '-c', 'features.plugins=false',
-            ...(options.model === undefined ? [] : ['--model', options.model]),
-            ...mcpOverrides,
-            ...PRIVATE_CODEX_DATA_CONTROLS,
-            '-c', 'shell_environment_policy.ignore_default_excludes=false',
-            '-c', 'shell_environment_policy.include_only=["PATH","HOME","LANG","LC_ALL","TERM"]',
-            '-c', `default_permissions="${PRIVATE_PERMISSION_PROFILE}"`,
-            '-C', preflight.projectRoot, '-',
-        ], {
-            cwd: preflight.projectRoot, stdin: material, timeoutMs: 10 * 60_000, maxOutputBytes: MAX_AGENT_OUTPUT_BYTES,
-        });
-        if (!processPassed(result))
-            throw new Error('private-codex-execution-unverified');
-        hostRuntime?.runtime.verify();
-        if (before) {
-            const after = await captureDirectYoloCheckoutEvidence(preflight.projectRoot).catch(() => {
-                throw effectFailure('after-capture', result);
-            });
-            if (after.headSha !== before.headSha || after.branch !== before.branch) {
-                throw effectFailure('identity-after', result);
-            }
-            if (after.payloadDigest === before.payloadDigest)
-                throw effectFailure('no-payload-change', result);
-        }
-        return Object.freeze({
-            schemaVersion: 1, outcome: 'executor-returned-unverified', exitCode: 0,
-            stdoutSha256: createHash('sha256').update(result.stdout).digest('hex'),
-            stderrSha256: createHash('sha256').update(result.stderr).digest('hex'),
-            stdoutBytes: result.stdout.byteLength, stderrBytes: result.stderr.byteLength,
-            publicSafe: true,
-        });
-    }
-    finally {
-        if (hostRuntime) {
-            scopedPreflightRunners.delete(preflight);
-            hostRuntime.runtime.close();
-        }
-    }
-}
+import{codexLifecycleGuardPath as J}from"./codex-lifecycle-guard.js";import{execFileSync as X,spawn as Y}from"node:child_process";import{createHash as T,randomBytes as q}from"node:crypto";import{connect as U,createServer as Z}from"node:net";import{accessSync as k,lstatSync as B,mkdtempSync as Q,readFileSync as ee,realpathSync as te,rmdirSync as M,unlinkSync as A,constants as C}from"node:fs";import{homedir as re}from"node:os";import{join as v,resolve as L}from"node:path";import{gitLifecycleRuntimeDirectory as oe}from"../git/git-lifecycle-store.js";import{captureDirectYoloCheckoutEvidence as H}from"../git/direct-yolo-checkpoint.js";import{createPrivateCodexScopedRunner as ne}from"./codex-scoped-permissions.js";import{createPrivateCodexHostRuntime as se}from"./codex-host-runtime.js";const N=3e4,m=16*1024,ie=1024*1024,ae=256*1024,j=/^codex-cli\s+(\d+\.\d+\.\d+)\s*$/,x="p222-isolated",ce=["PATH","HOME","LANG","LC_ALL","TERM","CODEX_HOME"],G=["-c",'web_search="disabled"',"-c","features.hooks=false","-c","analytics.enabled=false","-c",'history.persistence="none"',"-c",'otel.exporter="none"',"-c",'otel.metrics_exporter="none"',"-c",'otel.trace_exporter="none"',"-c","otel.log_user_prompt=false","-c","notify=[]"],I=new WeakMap,P=new WeakMap;function de(r){const e={};for(const t of ce)typeof r[t]=="string"&&(e[t]=r[t]);return e}async function $(r,e){if(e.configReadProbe&&(e.stdin!==void 0||r.at(-1)!=="app-server"))throw new Error("private-codex-web-search-isolation-unproven");return new Promise((t,o)=>{const s=de(process.env);e.codexHome!==void 0&&(s.CODEX_HOME=e.codexHome);const n=process.platform==="linux",a=Y(n?process.execPath:e.codexHome===void 0?"codex":"/bin/sh",n?[J,"process"]:e.codexHome===void 0?[...r]:["-c",'umask 077; exec codex "$@"',"neocortex-private-codex",...r],{cwd:e.cwd,stdio:n?["pipe","pipe","pipe","ipc"]:["pipe","pipe","pipe"],env:s,detached:n}),d=()=>{if(process.platform==="linux"&&a.pid!==void 0)try{process.kill(-a.pid,"SIGKILL")}catch(l){if(l.code!=="ESRCH")throw l}else a.kill("SIGKILL")},i=[],u=[];let f=0,p=0,c=!1,w=!1,E="",S=!1;const b=l=>a.stdin.write(`${JSON.stringify(l)}
+`),_=setTimeout(()=>{c=!0,d()},e.timeoutMs);a.stdout.on("data",l=>{if(f+=l.byteLength,f+p>e.maxOutputBytes)w=!0,d();else if(i.push(l),e.configReadProbe){E+=l.toString("utf8");let y;for(;(y=E.indexOf(`
+`))>=0;){const D=E.slice(0,y);E=E.slice(y+1);try{const R=JSON.parse(D);R.id===1&&R.result&&!S?(S=!0,b({method:"initialized",params:{}}),b({id:2,method:"config/read",params:{includeLayers:!1,cwd:e.cwd}})):R.id===2&&a.stdin.end()}catch{}}}}),a.stderr.on("data",l=>{p+=l.byteLength,f+p>e.maxOutputBytes?(w=!0,d()):u.push(l)}),a.on("error",l=>{clearTimeout(_),o(l)}),a.on("close",l=>{clearTimeout(_),t({exitCode:l,stdout:Buffer.concat(i),stderr:Buffer.concat(u),timedOut:c,outputExceeded:w})}),a.stdin.on("error",()=>{}),n&&a.send({kind:"private-codex-launch",args:[...r],codexHome:e.codexHome},l=>{l&&(clearTimeout(_),d(),o(new Error("private-codex-process-guard-unavailable")))}),e.configReadProbe?b({id:1,method:"initialize",params:{clientInfo:{name:"p222-isolation-probe",version:"1"},capabilities:{}}}):a.stdin.end(e.stdin)})}function h(r){return r.exitCode===0&&!r.timedOut&&!r.outputExceeded}async function W(r,e){const t=await e(["-c","features.plugins=false","plugin","list","--json"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m}),o=await e(["mcp","list","--json"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(t)||!h(o))return null;try{const s=JSON.parse(t.stdout.toString("utf8")),n=JSON.parse(o.stdout.toString("utf8"));if(!!!(s&&typeof s=="object"&&!Array.isArray(s)&&Array.isArray(s.installed)&&s.installed.length===0)||!Array.isArray(n)||n.length>64)return null;const d=n.map(c=>{if(!c||typeof c!="object"||Array.isArray(c))throw new Error("invalid catalog");const w=c;if(typeof w.name!="string"||!/^[A-Za-z0-9_-]{1,64}$/.test(w.name)||typeof w.enabled!="boolean")throw new Error("invalid catalog");return w.name});if(new Set(d).size!==d.length)return null;if(d.length===0)return[];const i=[...d].sort().flatMap(c=>["-c",`mcp_servers.${c}.enabled=false`]),u=await e([...i,"mcp","list","--json"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(u))return null;const f=JSON.parse(u.stdout.toString("utf8"));if(!Array.isArray(f)||f.length!==d.length)return null;const p=new Set;for(const c of f){if(!c||typeof c!="object"||Array.isArray(c)||typeof c.name!="string"||!d.includes(c.name)||c.enabled!==!1||p.has(c.name))return null;p.add(c.name)}return Object.freeze(i)}catch{return null}}async function z(r,e){const t=await e(["-c","features.hooks=false","features","list"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(t))return!1;const o=t.stdout.toString("utf8").split(/\r?\n/).filter(s=>/^hooks\s+\S+\s+(?:true|false)\s*$/.test(s));return o.length===1&&/^hooks\s+\S+\s+false\s*$/.test(o[0])}async function V(r,e,t){const o=await e(["-c","features.plugins=false",...t,...G,"--strict-config","app-server"],{cwd:r,configReadProbe:!0,timeoutMs:1e4,maxOutputBytes:262144});try{if(!h(o))return!1;const n=o.stdout.toString("utf8").split(/\r?\n/).filter(Boolean).map(a=>JSON.parse(a)).filter(a=>a&&a.id===2);return n.length===1&&!n[0].error&&n[0].result?.config?.web_search==="disabled"}catch{return!1}finally{o.stdout.fill(0),o.stderr.fill(0)}}function ue(r){const e=B(r);if(!e.isFile()||e.isSymbolicLink())throw new Error("private-codex-auth-unavailable");k(r,C.R_OK)}function F(r){const e={...process.env};for(const t of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete e[t];try{const t=s=>X("git",[...s],{cwd:r,env:e,encoding:"utf8",timeout:5e3,maxBuffer:m,stdio:["ignore","pipe","ignore"]}).trim(),o=[t(["rev-parse","--git-dir"]),t(["rev-parse","--git-common-dir"])].map(s=>te(L(r,s)));if(o.some(s=>!B(s).isDirectory()))throw new Error("git-control-invalid");return[...new Set(o)]}catch{throw new Error("private-codex-git-control-unavailable")}}async function le(r,e){const t=await e(["sandbox","-P",x,"--","git","rev-parse","--git-dir"],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});if(!h(t))return!1;for(const o of F(r)){const s=v(o,`.neocortex-git-probe-${q(16).toString("hex")}`),n=await e(["sandbox","-P",x,"--","sh","-c",'mkdir "$1"',"sh",s],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});let a=!1,d=!1;try{const i=B(s);a=!0,d=i.isDirectory()}catch(i){if(i.code!=="ENOENT")return!1}if(a&&(d?M(s):A(s)),n.exitCode!==1||n.timedOut||n.outputExceeded||a)return!1}return!0}async function fe(r,e,t){if(!B(e).isDirectory())return!1;k(e,C.R_OK);const o=await t(["sandbox","-P",x,"--","sh","-c",'if test -r "$1"; then exit 42; else exit 43; fi',"sh",e],{cwd:r,timeoutMs:1e4,maxOutputBytes:m});return o.exitCode===43&&!o.timedOut&&!o.outputExceeded}async function pe(r,e){const t=Z(o=>o.end());await new Promise((o,s)=>{t.once("error",s),t.listen(0,"127.0.0.1",()=>o())});try{const o=t.address();if(!o||typeof o=="string")return!1;const s='const s=require("node:net").connect(Number(process.argv[1]),"127.0.0.1");s.setTimeout(1500);s.on("connect",()=>{s.end();process.exit(0)});s.on("error",()=>process.exit(1));s.on("timeout",()=>process.exit(1))';if(!await new Promise(i=>{const u=U(o.port,"127.0.0.1");u.setTimeout(1500),u.once("connect",()=>{u.end(),i(!0)}),u.once("error",()=>i(!1)),u.once("timeout",()=>{u.destroy(),i(!1)})}))return!1;const a=await e(["sandbox","-P",x,"--","node","--version"],{cwd:r,timeoutMs:5e3,maxOutputBytes:m});if(!h(a))return!1;const d=await e(["sandbox","-P",x,"--","node","-e",s,String(o.port)],{cwd:r,timeoutMs:5e3,maxOutputBytes:m});return d.exitCode===1&&!d.timedOut&&!d.outputExceeded}finally{t.close()}}async function Re(r,e={}){if((e.platform??process.platform)!=="linux")throw new Error("private-codex-platform-unsupported");const t=L(r),o=e.userHome??re(),s=e.codexHome??process.env.CODEX_HOME??v(o,".codex"),n=e.runner?void 0:se(t,s);try{const a=n?async(g,K)=>(n.verify(),$(g,{...K,codexHome:n.home})):$,d=n?.home??s,i=e.runner??await ne(t,a,{...e,codexHome:d,credentialSourceHome:n?.sourceHome??s,gitControlDirectories:F(t)}),u=v(d,"auth.json");try{ue(u)}catch{throw new Error("private-codex-auth-unavailable")}const f=await i(["--version"],{cwd:t,timeoutMs:5e3,maxOutputBytes:m}),p=h(f)?j.exec(f.stdout.toString("utf8").trim()):null;if(!p)throw new Error("private-codex-version-unavailable");const c=await i(["login","status"],{cwd:t,timeoutMs:5e3,maxOutputBytes:m});if(!h(c)||!/Logged in using ChatGPT/i.test(Buffer.concat([c.stdout,c.stderr]).toString("utf8")))throw new Error("private-codex-subscription-required");const w=await W(t,i).catch(()=>null);if(w===null)throw new Error("private-codex-mcp-isolation-unproven");if(!await z(t,i).catch(()=>!1))throw new Error("private-codex-hook-isolation-unproven");if(!await V(t,i,w).catch(()=>!1))throw new Error("private-codex-web-search-isolation-unproven");const S=await oe(t).catch(()=>{throw new Error("private-codex-git-lifecycle-read-isolation-unproven")}),b=v(o,".ssh"),_=await i(["sandbox","-P",x,"--","sh","-c",...n?['test ! -r "$1" && test ! -r "$2" && test ! -r "$3"',"sh",u,b,v(s,"auth.json")]:['test ! -r "$1" && test ! -r "$2"',"sh",u,b]],{cwd:t,timeoutMs:1e4,maxOutputBytes:m});if(!h(_))throw new Error("private-codex-auth-isolation-unproven");const l=Q(v(t,".private-codex-probe-")),y=v(l,"receipt");try{const g=await i(["sandbox","-P",x,"--","sh","-c",'printf "P222_PROBE\\n" > "$1"',"sh",y],{cwd:t,timeoutMs:1e4,maxOutputBytes:m});if(!h(g)||ee(y,"utf8")!==`P222_PROBE
+`)throw new Error("private-codex-workspace-write-unproven")}catch{throw new Error("private-codex-workspace-write-unproven")}finally{try{A(y)}catch{}M(l)}if(!await le(t,i).catch(()=>!1))throw new Error("private-codex-git-control-isolation-unproven");if(!await fe(t,S,i).catch(()=>!1))throw new Error("private-codex-git-lifecycle-read-isolation-unproven");if(!await(e.networkProbe??pe)(t,i))throw new Error("private-codex-network-isolation-unproven");const O=Object.freeze({schemaVersion:6,hostKind:"codex-cli",hostVersion:p[1],projectRoot:t,observedAtMs:(e.now??Date.now)(),authIsolation:"passed",workspaceWrite:"passed",gitControlWriteDenied:"passed",gitLifecycleReadDenied:"passed",mcpIsolation:"passed",environmentIsolation:"passed",networkDenied:"passed",webSearchDisabled:"passed",credentialKind:"chatgpt-subscription"});if(I.set(O,i),n){const g=setTimeout(()=>{P.delete(O),I.delete(O);try{n.close()}catch{}},N);g.unref(),P.set(O,{runtime:n,timer:g})}return O}catch(a){throw n?.close(),a}}async function Te(r,e,t={}){const o=P.get(e);o&&(clearTimeout(o.timer),P.delete(e));try{const s=(t.now??Date.now)();if(t.model!==void 0&&!/^gpt-[a-z0-9][a-z0-9.-]{0,63}$/.test(t.model))throw new Error("private-codex-model-invalid");if(e.schemaVersion!==6||e.hostKind!=="codex-cli"||e.authIsolation!=="passed"||e.workspaceWrite!=="passed"||e.gitControlWriteDenied!=="passed"||e.gitLifecycleReadDenied!=="passed"||e.mcpIsolation!=="passed"||e.environmentIsolation!=="passed"||e.webSearchDisabled!=="passed"||e.networkDenied!=="passed"||e.credentialKind!=="chatgpt-subscription"||s<e.observedAtMs||s-e.observedAtMs>N||typeof r!="string"||Buffer.byteLength(r,"utf8")<1||Buffer.byteLength(r,"utf8")>ae)throw new Error("private-codex-preflight-stale");const n=t.runner??I.get(e);if(!n)throw new Error("private-codex-preflight-stale");const a=await n(["--version"],{cwd:e.projectRoot,timeoutMs:5e3,maxOutputBytes:m});if(!h(a)||j.exec(a.stdout.toString("utf8").trim())?.[1]!==e.hostVersion)throw new Error("private-codex-version-drift");const d=(p,c)=>{const w=Object.freeze({schemaVersion:1,kind:"PrivateCodexWorkspaceEffectFailure/1",phase:p,agentReturnedSuccessfully:c!==void 0,...c===void 0?{}:{stdoutSha256:T("sha256").update(c.stdout).digest("hex"),stderrSha256:T("sha256").update(c.stderr).digest("hex"),stdoutBytes:c.stdout.length,stderrBytes:c.stderr.length},publicSafe:!0});try{Promise.resolve(t.onWorkspaceEffectFailure?.(w)).catch(()=>{})}catch{}return new Error("private-codex-workspace-effect-unverified")},i=t.requireWorkspaceEffect?await H(e.projectRoot).catch(()=>{throw d("before-capture")}):void 0;if(i&&t.expectedExecutionBranch!==void 0&&i.branch!==t.expectedExecutionBranch)throw d("branch-before");if(!await z(e.projectRoot,n).catch(()=>!1))throw new Error("private-codex-hook-isolation-unproven");const u=await W(e.projectRoot,n).catch(()=>null);if(u===null)throw new Error("private-codex-mcp-isolation-unproven");if(!await V(e.projectRoot,n,u).catch(()=>!1))throw new Error("private-codex-web-search-isolation-unproven");const f=await n(["exec","--ephemeral","--json","--strict-config","-c","features.plugins=false",...t.model===void 0?[]:["--model",t.model],...u,...G,"-c","shell_environment_policy.ignore_default_excludes=false","-c",'shell_environment_policy.include_only=["PATH","HOME","LANG","LC_ALL","TERM"]',"-c",`default_permissions="${x}"`,"-C",e.projectRoot,"-"],{cwd:e.projectRoot,stdin:r,timeoutMs:10*6e4,maxOutputBytes:ie});if(!h(f))throw new Error("private-codex-execution-unverified");if(o?.runtime.verify(),i){const p=await H(e.projectRoot).catch(()=>{throw d("after-capture",f)});if(p.headSha!==i.headSha||p.branch!==i.branch)throw d("identity-after",f);if(p.payloadDigest===i.payloadDigest)throw d("no-payload-change",f)}return Object.freeze({schemaVersion:1,outcome:"executor-returned-unverified",exitCode:0,stdoutSha256:T("sha256").update(f.stdout).digest("hex"),stderrSha256:T("sha256").update(f.stderr).digest("hex"),stdoutBytes:f.stdout.byteLength,stderrBytes:f.stderr.byteLength,publicSafe:!0})}finally{o&&(I.delete(e),o.runtime.close())}}export{Re as preflightPrivateCodexExecutor,de as privateCodexEnvironment,$ as runBoundedCodexProcess,Te as runPrivateCodexStep};