@paperclipai/server 2026.830.0-canary.4 → 2026.830.0-canary.6

package/dist/build-info.json

@@ -1,3 +1,3 @@
 {
-  "commit": "ea86e780a"
+  "commit": "f44f5b1ab"
 }

package/dist/vendor/paperclip-runner/drivers/codex/app-server-transport.d.ts

@@ -0,0 +1,108 @@
+import type { HarnessRuntimeRequestResolution } from "../../contracts/harness-driver.js";
+export interface CodexRpcNotification {
+    method: string;
+    params: Record<string, unknown>;
+    /** Internal-only correlation retained outside provider params and canonical PRP payloads. */
+    paperclipTrace?: {
+        sourceEventId: string;
+        sourceEventType: string;
+    };
+}
+export interface CodexTraceInterpretation {
+    sourceEventId: string;
+    sourceEventType: string;
+    providerMethod: string;
+    disposition: "mapped" | "ignored" | "rejected";
+    emittedEventIds: string[];
+    reason: string;
+}
+export interface CodexRpcServerRequest extends CodexRpcNotification {
+    id: string | number;
+}
+export type CodexServerRequestHandler = (request: CodexRpcServerRequest) => Promise<Record<string, unknown>>;
+export interface CodexAppServerTransport {
+    request(method: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    notify(method: string, params?: Record<string, unknown>): void;
+    notifications(): AsyncIterable<CodexRpcNotification>;
+    setServerRequestHandler(handler: CodexServerRequestHandler): void;
+    /**
+     * Optional provider-neutral resolution path used when a transport has
+     * already normalized a native server request behind another PRP boundary.
+     */
+    resolveRuntimeRequest?(input: {
+        requestId: string;
+        turnId: string;
+        resolution: HarnessRuntimeRequestResolution;
+    }): Promise<void>;
+    close(): Promise<void>;
+    processInfo?(): CodexTransportProcessInfo;
+    attachRun?(input: {
+        runId: string;
+        turnId: string;
+        itemId: string;
+    }): Promise<void>;
+    /** Records post-rehydration driver mapping without affecting run authority. */
+    recordTraceInterpretation?(input: CodexTraceInterpretation): void;
+}
+export interface CodexTransportProcessInfo {
+    pid: number | null;
+    processGroupId: number | null;
+    startedAt: string;
+    exited: boolean;
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+}
+/**
+ * Environment for the trusted app-server process itself. HOME and CODEX_HOME
+ * are retained so Codex can authenticate; model-issued commands receive a
+ * separate empty-by-default environment and filesystem permission profile.
+ */
+export declare function createSanitizedCodexEnvironment(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function sanitizedEnvironmentKeys(source?: NodeJS.ProcessEnv): string[];
+export declare function redactCodexDiagnostic(message: string): string;
+export declare const CODEX_METHOD_NOT_FOUND = -32601;
+export declare const CODEX_INVALID_REQUEST = -32600;
+/**
+ * A provider error response, carrying its JSON-RPC code. Callers need the code
+ * to tell "this provider build will not serve the method" apart from "the call
+ * failed this time", which are different facts about a capability.
+ */
+export declare class CodexRpcError extends Error {
+    readonly code: number | null;
+    constructor(message: string, code: number | null);
+    get methodUnavailable(): boolean;
+}
+/**
+ * True only when the provider answered and its answer denies the method. A
+ * plain `Error` here means the call never got an answer — a transport or
+ * protocol failure — which must not be read as a missing capability.
+ */
+export declare function isCodexMethodUnavailable(error: unknown): boolean;
+export interface ProcessCodexTransportOptions {
+    command?: string;
+    args?: string[];
+    environment?: NodeJS.ProcessEnv;
+    onDiagnostic?: (message: string) => void;
+    maxLineBytes?: number;
+    maxPendingRequests?: number;
+    maxQueuedNotifications?: number;
+    maxQueuedNotificationBytes?: number;
+    maxBufferedOutputBytes?: number;
+    maxInflightServerRequests?: number;
+    /** Starts a dedicated process group so runnerd and its Codex child are reaped together. */
+    processGroup?: boolean;
+    closeGraceMs?: number;
+    onProcess?: (info: CodexTransportProcessInfo) => void;
+}
+/** Local stdio JSON-RPC transport. App-server never becomes a WAN endpoint. */
+export declare class ProcessCodexAppServerTransport implements CodexAppServerTransport {
+    #private;
+    constructor(options?: ProcessCodexTransportOptions);
+    request(method: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    notify(method: string, params?: Record<string, unknown>): void;
+    notifications(): AsyncIterable<CodexRpcNotification>;
+    setServerRequestHandler(handler: CodexServerRequestHandler): void;
+    close(): Promise<void>;
+    processInfo(): CodexTransportProcessInfo;
+}
+//# sourceMappingURL=app-server-transport.d.ts.map

package/dist/vendor/paperclip-runner/drivers/codex/app-server-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-server-transport.d.ts","sourceRoot":"","sources":["../../../src/drivers/codex/app-server-transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEzF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,6FAA6F;IAC7F,cAAc,CAAC,EAAE;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IACjE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC,MAAM,WAAW,uBAAuB;IACtC,OAAO,CACL,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,aAAa,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACrD,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAClE;;;OAGG;IACH,qBAAqB,CAAC,CAAC,KAAK,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,+BAA+B,CAAC;KAC7C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,WAAW,CAAC,IAAI,yBAAyB,CAAC;IAC1C,SAAS,CAAC,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,+EAA+E;IAC/E,yBAAyB,CAAC,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;CAC/B;AA+ID;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CASnB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,EAAE,CAEV;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgC7D;AAWD,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAe7C;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAI/C;IAED,IAAI,iBAAiB,IAAI,OAAO,CAE/B;CACF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE;AAaD,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2FAA2F;IAC3F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,IAAI,CAAC;CACvD;AAUD,+EAA+E;AAC/E,qBAAa,8BAA+B,YAAW,uBAAuB;;IA4B5E,YAAY,OAAO,GAAE,4BAAiC,EA4FrD;IAED,OAAO,CACL,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBlC;IAED,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE7D;IAED,aAAa,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAEnD;IAED,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAEhE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA2B3B;IAED,WAAW,IAAI,yBAAyB,CASvC;CA2MF"}

package/dist/vendor/paperclip-runner/drivers/codex/app-server-transport.js

@@ -0,0 +1,565 @@
+import { spawn } from "node:child_process";
+class BoundedAsyncQueue {
+    maxValues;
+    maxBytes;
+    #values = [];
+    #waiters = [];
+    #queuedBytes = 0;
+    #closed = false;
+    #error = null;
+    constructor(maxValues, maxBytes) {
+        this.maxValues = maxValues;
+        this.maxBytes = maxBytes;
+    }
+    push(value, bytes) {
+        if (this.#closed)
+            return false;
+        const waiter = this.#waiters.shift();
+        if (waiter !== undefined) {
+            waiter.resolve({ value, done: false });
+            return true;
+        }
+        if (this.#values.length >= this.maxValues ||
+            this.#queuedBytes + bytes > this.maxBytes) {
+            return false;
+        }
+        this.#values.push({ value, bytes });
+        this.#queuedBytes += bytes;
+        return true;
+    }
+    close(error) {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#values = [];
+        this.#queuedBytes = 0;
+        this.#error = error ?? null;
+        for (const waiter of this.#waiters.splice(0)) {
+            if (error === undefined)
+                waiter.resolve({ value: undefined, done: true });
+            else
+                waiter.reject(error);
+        }
+    }
+    [Symbol.asyncIterator]() {
+        return {
+            next: async () => {
+                const queued = this.#values.shift();
+                if (queued !== undefined) {
+                    this.#queuedBytes -= queued.bytes;
+                    return { value: queued.value, done: false };
+                }
+                if (this.#error !== null)
+                    return Promise.reject(this.#error);
+                if (this.#closed)
+                    return { value: undefined, done: true };
+                return new Promise((resolve, reject) => {
+                    this.#waiters.push({ resolve, reject });
+                });
+            },
+        };
+    }
+}
+class BoundedLineDecoder {
+    maxLineBytes;
+    onLine;
+    onError;
+    #buffer = Buffer.alloc(0);
+    #closed = false;
+    constructor(maxLineBytes, onLine, onError) {
+        this.maxLineBytes = maxLineBytes;
+        this.onLine = onLine;
+        this.onError = onError;
+    }
+    write(chunk) {
+        if (this.#closed)
+            return;
+        const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        let offset = 0;
+        while (offset < incoming.length) {
+            const newline = incoming.indexOf(0x0a, offset);
+            const end = newline < 0 ? incoming.length : newline;
+            const segment = incoming.subarray(offset, end);
+            if (this.#buffer.length + segment.length > this.maxLineBytes) {
+                this.#fail(new Error(`codex app-server line exceeded ${this.maxLineBytes} bytes`));
+                return;
+            }
+            if (segment.length > 0)
+                this.#buffer = Buffer.concat([this.#buffer, segment]);
+            if (newline < 0)
+                return;
+            const line = this.#buffer;
+            this.#buffer = Buffer.alloc(0);
+            this.onLine(line.toString("utf8"), line.length);
+            if (this.#closed)
+                return;
+            offset = newline + 1;
+        }
+    }
+    end() {
+        if (this.#closed)
+            return;
+        if (this.#buffer.length > 0) {
+            this.#fail(new Error("codex app-server ended with an unterminated JSON-RPC line"));
+        }
+        this.#closed = true;
+    }
+    close() {
+        this.#closed = true;
+        this.#buffer = Buffer.alloc(0);
+    }
+    #fail(error) {
+        this.close();
+        this.onError(error);
+    }
+}
+const SAFE_ENVIRONMENT_KEYS = [
+    "ALL_PROXY",
+    "CODEX_HOME",
+    "HOME",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "LANG",
+    "LC_ALL",
+    "NO_PROXY",
+    "NODE_EXTRA_CA_CERTS",
+    "PATH",
+    "PATHEXT",
+    "SSL_CERT_FILE",
+    "SystemRoot",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "WINDIR",
+];
+/**
+ * Environment for the trusted app-server process itself. HOME and CODEX_HOME
+ * are retained so Codex can authenticate; model-issued commands receive a
+ * separate empty-by-default environment and filesystem permission profile.
+ */
+export function createSanitizedCodexEnvironment(source = process.env) {
+    const environment = {};
+    for (const key of SAFE_ENVIRONMENT_KEYS) {
+        const value = source[key];
+        if (value === undefined)
+            continue;
+        if (key.includes("PROXY") && proxyContainsCredentials(value))
+            continue;
+        environment[key] = value;
+    }
+    return environment;
+}
+export function sanitizedEnvironmentKeys(source = process.env) {
+    return Object.keys(createSanitizedCodexEnvironment(source)).sort();
+}
+export function redactCodexDiagnostic(message) {
+    return message
+        .replaceAll(/\u001b\[[0-?]*[ -/]*[@-~]/g, "")
+        .replace(/Bearer\s+[A-Za-z0-9._~+\/-]+/gi, "Bearer [REDACTED]")
+        .replace(/Basic\s+([A-Za-z0-9+/=]+)/gi, (match, encoded) => {
+        try {
+            // Only redact an actual RFC 7617 credential. Treating every word after
+            // “Basic” as base64 corrupted ordinary question copy such as
+            // “Basic API” before it entered the Paperclip protocol.
+            const decoded = Buffer.from(encoded, "base64").toString("utf8");
+            return decoded.includes(":") ? "Basic [REDACTED]" : match;
+        }
+        catch {
+            return match;
+        }
+    })
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi, "$1[REDACTED]@")
+        .replace(/([?&](?:api[_-]?key|token|secret|password)=)[^&#\s]+/gi, "$1[REDACTED]")
+        .replace(/(["'](?:api[_-]?key|token|secret|password|authorization)["']\s*:\s*["'])[^"']+/gi, "$1[REDACTED]")
+        .replace(/(api[_-]?key|token|secret|password)\s*[=:]\s*[^\s,;]+/gi, "$1=[REDACTED]")
+        .replace(/(PAPERCLIP_API_KEY|OPENAI_API_KEY|OPENROUTER_API_KEY)=[^\s]+/g, "$1=[REDACTED]");
+}
+function proxyContainsCredentials(value) {
+    try {
+        const url = new URL(value);
+        return url.username.length > 0 || url.password.length > 0;
+    }
+    catch {
+        return true;
+    }
+}
+export const CODEX_METHOD_NOT_FOUND = -32_601;
+export const CODEX_INVALID_REQUEST = -32_600;
+/**
+ * Codes where the provider refused the call itself rather than failing while
+ * serving it: the method is absent (-32601), or the request was rejected
+ * outright, which is how the Codex app-server reports a feature it has
+ * switched off (-32600 `goals feature is disabled`). Server-error codes
+ * (-32603 and the -32000..-32099 implementation range) and transport failures
+ * describe one attempt, not what the build supports.
+ */
+const METHOD_UNAVAILABLE_CODES = [
+    CODEX_METHOD_NOT_FOUND,
+    CODEX_INVALID_REQUEST,
+];
+/**
+ * A provider error response, carrying its JSON-RPC code. Callers need the code
+ * to tell "this provider build will not serve the method" apart from "the call
+ * failed this time", which are different facts about a capability.
+ */
+export class CodexRpcError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = "CodexRpcError";
+        this.code = code;
+    }
+    get methodUnavailable() {
+        return this.code !== null && METHOD_UNAVAILABLE_CODES.includes(this.code);
+    }
+}
+/**
+ * True only when the provider answered and its answer denies the method. A
+ * plain `Error` here means the call never got an answer — a transport or
+ * protocol failure — which must not be read as a missing capability.
+ */
+export function isCodexMethodUnavailable(error) {
+    return error instanceof CodexRpcError && error.methodUnavailable;
+}
+function rpcErrorCode(value) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    const code = value.code;
+    return typeof code === "number" && Number.isFinite(code) ? code : null;
+}
+const DEFAULT_MAX_LINE_BYTES = 1024 * 1024;
+const DEFAULT_MAX_PENDING_REQUESTS = 64;
+const DEFAULT_MAX_QUEUED_NOTIFICATIONS = 256;
+const DEFAULT_MAX_QUEUED_NOTIFICATION_BYTES = 4 * 1024 * 1024;
+const DEFAULT_MAX_BUFFERED_OUTPUT_BYTES = 4 * 1024 * 1024;
+const DEFAULT_MAX_INFLIGHT_SERVER_REQUESTS = 32;
+const MAX_DIAGNOSTIC_LINE_BYTES = 16 * 1024;
+/** Local stdio JSON-RPC transport. App-server never becomes a WAN endpoint. */
+export class ProcessCodexAppServerTransport {
+    #process;
+    #notifications;
+    #pending = new Map();
+    #nextId = 1;
+    #serverRequestHandler = async () => ({
+        success: false,
+        contentItems: [{ type: "input_text", text: "Unsupported client request." }],
+    });
+    #inflightServerRequests = 0;
+    #closed = false;
+    #exited = false;
+    #exitCode = null;
+    #exitSignal = null;
+    #resolveExit;
+    #exitPromise;
+    #processGroup;
+    #startedAt;
+    #closeGraceMs;
+    #onProcess;
+    #onDiagnostic;
+    #maxLineBytes;
+    #maxPendingRequests;
+    #maxInflightServerRequests;
+    #maxBufferedOutputBytes;
+    #stdoutDecoder;
+    #stderrDecoder;
+    constructor(options = {}) {
+        this.#onDiagnostic = options.onDiagnostic;
+        this.#maxLineBytes = positiveLimit(options.maxLineBytes, DEFAULT_MAX_LINE_BYTES);
+        this.#maxPendingRequests = positiveLimit(options.maxPendingRequests, DEFAULT_MAX_PENDING_REQUESTS);
+        this.#maxInflightServerRequests = positiveLimit(options.maxInflightServerRequests, DEFAULT_MAX_INFLIGHT_SERVER_REQUESTS);
+        this.#maxBufferedOutputBytes = positiveLimit(options.maxBufferedOutputBytes, DEFAULT_MAX_BUFFERED_OUTPUT_BYTES);
+        this.#processGroup =
+            options.processGroup === true && process.platform !== "win32";
+        this.#startedAt = new Date().toISOString();
+        this.#closeGraceMs = positiveLimit(options.closeGraceMs, 1_000);
+        this.#onProcess = options.onProcess;
+        this.#exitPromise = new Promise((resolve) => {
+            this.#resolveExit = resolve;
+        });
+        this.#notifications = new BoundedAsyncQueue(positiveLimit(options.maxQueuedNotifications, DEFAULT_MAX_QUEUED_NOTIFICATIONS), positiveLimit(options.maxQueuedNotificationBytes, DEFAULT_MAX_QUEUED_NOTIFICATION_BYTES));
+        this.#process = spawn(options.command ?? "codex", options.args ?? ["app-server"], {
+            env: options.environment ?? createSanitizedCodexEnvironment(),
+            stdio: "pipe",
+            detached: this.#processGroup,
+        });
+        this.#stdoutDecoder = new BoundedLineDecoder(this.#maxLineBytes, (line, bytes) => this.#onLine(line, bytes), (error) => this.#fatal(error));
+        this.#stderrDecoder = new BoundedLineDecoder(MAX_DIAGNOSTIC_LINE_BYTES, (line) => this.#onDiagnostic?.(redactCodexDiagnostic(line)), () => this.#onDiagnostic?.("codex app-server diagnostic line exceeded retention limit"));
+        this.#process.stdout.on("data", (chunk) => this.#stdoutDecoder.write(chunk));
+        this.#process.stdout.on("end", () => {
+            this.#stdoutDecoder.end();
+            this.#fatal(new Error("codex app-server stdout ended before transport closure"));
+        });
+        this.#process.stdout.on("error", (error) => this.#fatal(error));
+        this.#process.stdout.on("close", () => {
+            this.#fatal(new Error("codex app-server stdout closed before transport closure"));
+        });
+        this.#process.stderr.on("data", (chunk) => this.#stderrDecoder.write(chunk));
+        this.#process.stderr.on("end", () => this.#stderrDecoder.end());
+        this.#process.stdin.on("error", (error) => this.#fatal(error));
+        this.#process.on("error", (error) => this.#fatal(error));
+        this.#process.on("exit", (code, signal) => {
+            this.#exited = true;
+            this.#exitCode = code;
+            this.#exitSignal = signal;
+            this.#resolveExit();
+            this.#onProcess?.(this.processInfo());
+            if (!this.#closed) {
+                this.#fatal(new Error(`codex app-server exited (code=${code ?? "null"}, signal=${signal ?? "none"})`));
+            }
+        });
+        this.#onProcess?.(this.processInfo());
+    }
+    request(method, params) {
+        if (this.#closed)
+            return Promise.reject(new Error("codex app-server transport is closed"));
+        if (this.#pending.size >= this.#maxPendingRequests) {
+            return Promise.reject(new Error(`codex app-server pending request limit ${this.#maxPendingRequests} exceeded`));
+        }
+        const id = this.#nextId++;
+        return new Promise((resolve, reject) => {
+            this.#pending.set(id, { resolve, reject });
+            try {
+                this.#write({ method, id, params });
+            }
+            catch (error) {
+                this.#pending.delete(id);
+                reject(error);
+            }
+        });
+    }
+    notify(method, params) {
+        this.#write(params === undefined ? { method } : { method, params });
+    }
+    notifications() {
+        return this.#notifications;
+    }
+    setServerRequestHandler(handler) {
+        this.#serverRequestHandler = handler;
+    }
+    async close() {
+        const firstClose = !this.#closed;
+        if (firstClose) {
+            this.#closed = true;
+            this.#stdoutDecoder.close();
+            this.#stderrDecoder.close();
+            this.#notifications.close();
+            this.#failAll(new Error("codex app-server transport closed"));
+        }
+        if (!this.#exited) {
+            if (firstClose)
+                this.#signal("SIGTERM");
+            const exited = await Promise.race([
+                this.#exitPromise.then(() => true),
+                new Promise((resolve) => setTimeout(() => resolve(false), this.#closeGraceMs)),
+            ]);
+            if (!exited && !this.#exited) {
+                this.#signal("SIGKILL");
+                await Promise.race([
+                    this.#exitPromise,
+                    new Promise((resolve) => setTimeout(resolve, this.#closeGraceMs)),
+                ]);
+            }
+        }
+    }
+    processInfo() {
+        return {
+            pid: this.#process.pid ?? null,
+            processGroupId: this.#processGroup ? (this.#process.pid ?? null) : null,
+            startedAt: this.#startedAt,
+            exited: this.#exited,
+            exitCode: this.#exitCode,
+            signal: this.#exitSignal,
+        };
+    }
+    #signal(signal) {
+        const pid = this.#process.pid;
+        if (this.#processGroup && pid !== undefined) {
+            try {
+                process.kill(-pid, signal);
+                return;
+            }
+            catch {
+                // The group may already be gone; the direct child kill below is idempotent.
+            }
+        }
+        this.#process.kill(signal);
+    }
+    #write(message) {
+        if (this.#closed)
+            throw new Error("codex app-server transport is closed");
+        let serialized;
+        try {
+            serialized = JSON.stringify(message);
+        }
+        catch (error) {
+            const failure = error instanceof Error ? error : new Error(String(error));
+            this.#fatal(failure);
+            throw failure;
+        }
+        const line = `${serialized}\n`;
+        const lineBytes = Buffer.byteLength(line);
+        if (lineBytes - 1 > this.#maxLineBytes) {
+            const error = new Error(`outbound codex JSON-RPC line exceeded ${this.#maxLineBytes} bytes`);
+            this.#fatal(error);
+            throw error;
+        }
+        if (this.#process.stdin.writableLength + lineBytes >
+            this.#maxBufferedOutputBytes) {
+            const error = new Error(`outbound codex JSON-RPC buffer exceeded ${this.#maxBufferedOutputBytes} bytes`);
+            this.#fatal(error);
+            throw error;
+        }
+        try {
+            this.#process.stdin.write(line);
+        }
+        catch (error) {
+            const failure = error instanceof Error ? error : new Error(String(error));
+            this.#fatal(failure);
+            throw failure;
+        }
+    }
+    #onLine(line, bytes) {
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            this.#fatal(new Error("codex app-server emitted malformed JSON"));
+            return;
+        }
+        if (!isRecord(value)) {
+            this.#fatal(new Error("codex app-server emitted a non-object JSON-RPC message"));
+            return;
+        }
+        const message = value;
+        const hasResult = Object.hasOwn(message, "result");
+        const hasError = Object.hasOwn(message, "error");
+        if (typeof message.id === "number" && (hasResult || hasError)) {
+            if (!Number.isSafeInteger(message.id) ||
+                message.id <= 0 ||
+                hasResult === hasError) {
+                this.#fatal(new Error("codex app-server emitted a malformed JSON-RPC response"));
+                return;
+            }
+            const pending = this.#pending.get(message.id);
+            if (pending === undefined) {
+                this.#fatal(new Error("codex app-server responded to an unknown request id"));
+                return;
+            }
+            this.#pending.delete(message.id);
+            if (hasError) {
+                pending.reject(new CodexRpcError(redactCodexDiagnostic(boundedJson(message.error)), rpcErrorCode(message.error)));
+            }
+            else if (isRecord(message.result)) {
+                pending.resolve(message.result);
+            }
+            else {
+                const error = new Error("codex app-server response result was not an object");
+                pending.reject(error);
+                this.#fatal(error);
+            }
+            return;
+        }
+        if (typeof message.method !== "string" ||
+            message.method.length === 0 ||
+            hasResult ||
+            hasError) {
+            this.#fatal(new Error("codex app-server emitted a malformed JSON-RPC message"));
+            return;
+        }
+        if (message.params !== undefined && !isRecord(message.params)) {
+            this.#fatal(new Error("codex app-server message params were not an object"));
+            return;
+        }
+        const params = message.params ?? {};
+        if (message.id !== undefined) {
+            if (!isValidServerRequestId(message.id)) {
+                this.#fatal(new Error("codex app-server request id had an invalid type"));
+                return;
+            }
+            this.#handleServerRequest({
+                id: message.id,
+                method: message.method,
+                params,
+            });
+            return;
+        }
+        if (!this.#notifications.push({ method: message.method, params }, bytes)) {
+            this.#fatal(new Error("codex app-server notification queue limit exceeded"));
+        }
+    }
+    #handleServerRequest(request) {
+        if (this.#inflightServerRequests >= this.#maxInflightServerRequests) {
+            this.#writeServerResponse({
+                id: request.id,
+                error: {
+                    code: -32_001,
+                    message: "Client request queue limit exceeded.",
+                },
+            });
+            return;
+        }
+        this.#inflightServerRequests += 1;
+        void Promise.resolve()
+            .then(() => this.#serverRequestHandler(request))
+            .then((result) => {
+            this.#writeServerResponse({ id: request.id, result });
+        }, (error) => {
+            this.#writeServerResponse({
+                id: request.id,
+                error: {
+                    code: -32_000,
+                    message: redactCodexDiagnostic(String(error)),
+                },
+            });
+        })
+            .finally(() => {
+            this.#inflightServerRequests -= 1;
+        });
+    }
+    #writeServerResponse(message) {
+        if (this.#closed)
+            return;
+        try {
+            this.#write(message);
+        }
+        catch (error) {
+            this.#fatal(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    #fatal(error) {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#stdoutDecoder.close();
+        this.#stderrDecoder.close();
+        this.#signal("SIGKILL");
+        this.#notifications.close(error);
+        this.#failAll(error);
+        this.#onDiagnostic?.(redactCodexDiagnostic(error.message));
+    }
+    #failAll(error) {
+        for (const pending of this.#pending.values())
+            pending.reject(error);
+        this.#pending.clear();
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function positiveLimit(value, fallback) {
+    return Number.isSafeInteger(value) && (value ?? 0) > 0 ? value : fallback;
+}
+function isValidServerRequestId(value) {
+    return ((typeof value === "number" && Number.isSafeInteger(value)) ||
+        (typeof value === "string" &&
+            value.length > 0 &&
+            Buffer.byteLength(value) <= 256));
+}
+function boundedJson(value) {
+    const serialized = JSON.stringify(value) ?? String(value);
+    return serialized.length <= MAX_DIAGNOSTIC_LINE_BYTES
+        ? serialized
+        : `${serialized.slice(0, MAX_DIAGNOSTIC_LINE_BYTES)}...[truncated]`;
+}
+//# sourceMappingURL=app-server-transport.js.map