@pasko70/pibo 1.16.6 → 2.0.0

package/dist/agent-runtimes/codex-native/config.js

@@ -0,0 +1,152 @@
+import { isAbsolute, resolve } from "node:path";
+import { piboHomePath } from "../../core/pibo-home.js";
+const MAX_TIMEOUT_MS = 10 * 60 * 1_000;
+const MAX_AUTH_LOGIN_TIMEOUT_MS = 30 * 60 * 1_000;
+const ENVIRONMENT_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const RESERVED_ENVIRONMENT_KEYS = new Set([
+    "CODEX_HOME",
+    "HOME",
+    "USERPROFILE",
+    "XDG_CACHE_HOME",
+    "XDG_CONFIG_HOME",
+    "XDG_DATA_HOME",
+    "XDG_STATE_HOME",
+    "TMP",
+    "TEMP",
+    "TMPDIR",
+    "NODE_OPTIONS",
+    "LD_PRELOAD",
+    "BASH_ENV",
+    "ENV",
+    "PYTHONHOME",
+    "PYTHONPATH",
+    "RUBYOPT",
+    "PERL5OPT",
+    "JAVA_TOOL_OPTIONS",
+    "_JAVA_OPTIONS",
+]);
+export const DEFAULT_CODEX_NATIVE_ENVIRONMENT_ALLOWLIST = [
+    "PATH",
+    "PATHEXT",
+    "SystemRoot",
+    "WINDIR",
+    "COMSPEC",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TZ",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "ALL_PROXY",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+];
+export const CODEX_NATIVE_RUNTIME_CONFIG_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+        executable: { type: "string", minLength: 1, default: "codex" },
+        homeRoot: { type: "string", minLength: 1 },
+        environmentAllowlist: {
+            type: "array",
+            items: { type: "string", pattern: ENVIRONMENT_KEY_PATTERN.source },
+            uniqueItems: true,
+        },
+        experimentalUserInput: { type: "boolean", default: false },
+        diagnosticTimeoutMs: { type: "integer", minimum: 1, maximum: MAX_TIMEOUT_MS, default: 5_000 },
+        startupTimeoutMs: { type: "integer", minimum: 1, maximum: MAX_TIMEOUT_MS, default: 10_000 },
+        requestTimeoutMs: { type: "integer", minimum: 1, maximum: MAX_TIMEOUT_MS, default: 120_000 },
+        authLoginTimeoutMs: { type: "integer", minimum: 1, maximum: MAX_AUTH_LOGIN_TIMEOUT_MS, default: 15 * 60 * 1_000 },
+        shutdownTimeoutMs: { type: "integer", minimum: 1, maximum: MAX_TIMEOUT_MS, default: 2_000 },
+        killTimeoutMs: { type: "integer", minimum: 1, maximum: MAX_TIMEOUT_MS, default: 500 },
+    },
+};
+export function defaultCodexNativeRuntimeConfig() {
+    return {
+        executable: "codex",
+        homeRoot: piboHomePath("agent-runtimes", "codex-native"),
+        environmentAllowlist: [...DEFAULT_CODEX_NATIVE_ENVIRONMENT_ALLOWLIST],
+        experimentalUserInput: false,
+        diagnosticTimeoutMs: 5_000,
+        startupTimeoutMs: 10_000,
+        requestTimeoutMs: 120_000,
+        authLoginTimeoutMs: 15 * 60 * 1_000,
+        shutdownTimeoutMs: 2_000,
+        killTimeoutMs: 500,
+    };
+}
+function timeout(value, fallback, label, maximum = MAX_TIMEOUT_MS) {
+    const selected = value ?? fallback;
+    if (!Number.isSafeInteger(selected) || Number(selected) <= 0 || Number(selected) > maximum) {
+        throw new Error(`${label} must be a positive integer no greater than ${maximum}`);
+    }
+    return Number(selected);
+}
+function environmentAllowlist(value, fallback) {
+    const selected = value ?? fallback;
+    if (!Array.isArray(selected))
+        throw new Error("environmentAllowlist must be an array of environment variable names");
+    const result = [];
+    const seen = new Set();
+    for (const entry of selected) {
+        if (typeof entry !== "string" || !ENVIRONMENT_KEY_PATTERN.test(entry)) {
+            throw new Error("environmentAllowlist entries must be valid environment variable names");
+        }
+        const canonical = entry.toUpperCase();
+        if (RESERVED_ENVIRONMENT_KEYS.has(canonical) || canonical.startsWith("DYLD_")) {
+            throw new Error(`environmentAllowlist may not include reserved key "${entry}"`);
+        }
+        if (seen.has(canonical))
+            throw new Error(`environmentAllowlist contains duplicate key "${entry}"`);
+        seen.add(canonical);
+        result.push(entry);
+    }
+    return result;
+}
+export function parseCodexNativeRuntimeConfig(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("config must be an object");
+    const supported = new Set([
+        "executable",
+        "homeRoot",
+        "environmentAllowlist",
+        "experimentalUserInput",
+        "diagnosticTimeoutMs",
+        "startupTimeoutMs",
+        "requestTimeoutMs",
+        "authLoginTimeoutMs",
+        "shutdownTimeoutMs",
+        "killTimeoutMs",
+    ]);
+    const unknown = Object.keys(value).find((key) => !supported.has(key));
+    if (unknown)
+        throw new Error(`unsupported config field "${unknown}"`);
+    const defaults = defaultCodexNativeRuntimeConfig();
+    const executable = value.executable ?? defaults.executable;
+    if (typeof executable !== "string" || !executable.trim())
+        throw new Error("executable must be a non-empty string");
+    const homeRoot = value.homeRoot ?? defaults.homeRoot;
+    if (typeof homeRoot !== "string" || !homeRoot.trim())
+        throw new Error("homeRoot must be a non-empty absolute path");
+    if (!isAbsolute(homeRoot))
+        throw new Error("homeRoot must be an absolute path");
+    return {
+        executable: executable.trim(),
+        homeRoot: resolve(homeRoot),
+        environmentAllowlist: environmentAllowlist(value.environmentAllowlist, defaults.environmentAllowlist),
+        experimentalUserInput: value.experimentalUserInput === undefined
+            ? defaults.experimentalUserInput
+            : (() => {
+                if (typeof value.experimentalUserInput !== "boolean")
+                    throw new Error("experimentalUserInput must be boolean");
+                return value.experimentalUserInput;
+            })(),
+        diagnosticTimeoutMs: timeout(value.diagnosticTimeoutMs, defaults.diagnosticTimeoutMs, "diagnosticTimeoutMs"),
+        startupTimeoutMs: timeout(value.startupTimeoutMs, defaults.startupTimeoutMs, "startupTimeoutMs"),
+        requestTimeoutMs: timeout(value.requestTimeoutMs, defaults.requestTimeoutMs, "requestTimeoutMs"),
+        authLoginTimeoutMs: timeout(value.authLoginTimeoutMs, defaults.authLoginTimeoutMs, "authLoginTimeoutMs", MAX_AUTH_LOGIN_TIMEOUT_MS),
+        shutdownTimeoutMs: timeout(value.shutdownTimeoutMs, defaults.shutdownTimeoutMs, "shutdownTimeoutMs"),
+        killTimeoutMs: timeout(value.killTimeoutMs, defaults.killTimeoutMs, "killTimeoutMs"),
+    };
+}

package/dist/agent-runtimes/codex-native/history.js

@@ -0,0 +1,283 @@
+import { redactCodexNativeSensitiveText } from "./redaction.js";
+import { CODEX_NATIVE_ADAPTER_ID } from "./thread.js";
+const CODEX_HISTORY_CURSOR_PREFIX = "codex-history:";
+const DEFAULT_HISTORY_LIMIT = 100;
+const MAX_HISTORY_LIMIT = 200;
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isoFromSeconds(seconds, fallback) {
+    const selected = Number.isSafeInteger(seconds) ? Number(seconds) : fallback;
+    const date = new Date(selected * 1_000);
+    return Number.isNaN(date.getTime()) ? new Date(0).toISOString() : date.toISOString();
+}
+function jsonValue(value, depth = 0) {
+    if (depth > 32)
+        return "[maximum depth reached]";
+    if (value === null || typeof value === "boolean")
+        return value;
+    if (typeof value === "string")
+        return redactCodexNativeSensitiveText(value);
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : String(value);
+    if (Array.isArray(value))
+        return value.map((entry) => jsonValue(entry, depth + 1));
+    if (isRecord(value)) {
+        const result = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (entry !== undefined)
+                result[key] = jsonValue(entry, depth + 1);
+        }
+        return result;
+    }
+    return String(value);
+}
+function turnStatus(turn) {
+    if (turn.status === "inProgress")
+        return "running";
+    if (turn.status === "failed")
+        return "error";
+    return "complete";
+}
+function textUserInput(item) {
+    if (!Array.isArray(item.content))
+        return "";
+    const text = [];
+    for (const part of item.content) {
+        if (!isRecord(part) || typeof part.type !== "string")
+            continue;
+        if (part.type === "text" && typeof part.text === "string")
+            text.push(redactCodexNativeSensitiveText(part.text));
+        else if (part.type === "image" || part.type === "localImage")
+            text.push("[image]");
+        else if (part.type === "audio" || part.type === "localAudio")
+            text.push("[audio]");
+        else if (part.type === "skill" && typeof part.name === "string")
+            text.push(`[skill: ${part.name}]`);
+        else if (part.type === "mention" && typeof part.name === "string")
+            text.push(`[mention: ${part.name}]`);
+    }
+    return text.join("\n");
+}
+function reasoningParts(item) {
+    const values = [
+        ...(Array.isArray(item.summary) ? item.summary : []),
+        ...(Array.isArray(item.content) ? item.content : []),
+    ].filter((value) => typeof value === "string" && value.length > 0)
+        .map(redactCodexNativeSensitiveText);
+    return values.length > 0 ? [{ type: "reasoning", text: values.join("\n") }] : [];
+}
+function itemEntry(thread, turn, item, sequence) {
+    const createdAt = isoFromSeconds(turn.startedAt ?? turn.completedAt, thread.updatedAt);
+    const base = {
+        id: `codex:${thread.id}:${turn.id}:${item.id}`,
+        type: "message",
+        source: "native",
+        createdAt,
+        sequence,
+        turnId: turn.id,
+        nativeTurnId: turn.id,
+        nativeEntryId: item.id,
+        status: turnStatus(turn),
+    };
+    if (item.type === "userMessage") {
+        return { ...base, role: "user", content: textUserInput(item) };
+    }
+    if (item.type === "agentMessage" && typeof item.text === "string") {
+        return { ...base, role: "assistant", content: redactCodexNativeSensitiveText(item.text) };
+    }
+    if (item.type === "reasoning") {
+        const content = reasoningParts(item);
+        if (content.length === 0)
+            return undefined;
+        return { ...base, role: "assistant", content };
+    }
+    if (item.type === "commandExecution") {
+        const command = typeof item.command === "string" ? redactCodexNativeSensitiveText(item.command) : "Codex command";
+        const output = typeof item.aggregatedOutput === "string" ? redactCodexNativeSensitiveText(item.aggregatedOutput) : "";
+        const status = typeof item.status === "string" ? item.status : "completed";
+        return {
+            ...base,
+            role: "tool",
+            content: output || "Codex command execution",
+            toolCallId: item.id,
+            toolName: "codex_command",
+            result: output,
+            isError: status === "failed" || status === "declined",
+            metadata: { command },
+        };
+    }
+    if (item.type === "fileChange") {
+        const status = typeof item.status === "string" ? item.status : "completed";
+        return {
+            ...base,
+            role: "tool",
+            content: "Codex file change",
+            toolCallId: item.id,
+            toolName: "codex_file_change",
+            result: jsonValue(item.changes),
+            isError: status === "failed" || status === "declined",
+        };
+    }
+    if (item.type === "mcpToolCall") {
+        const server = typeof item.server === "string" ? item.server : "mcp";
+        const tool = typeof item.tool === "string" ? item.tool : "tool";
+        const status = typeof item.status === "string" ? item.status : "completed";
+        return {
+            ...base,
+            role: "tool",
+            content: status === "failed" ? "Codex MCP tool failed" : "Codex MCP tool result",
+            toolCallId: item.id,
+            toolName: `${server}/${tool}`,
+            result: jsonValue(item.result ?? item.error ?? null),
+            isError: status === "failed",
+        };
+    }
+    if (item.type === "dynamicToolCall") {
+        const tool = typeof item.tool === "string" ? item.tool : "dynamic_tool";
+        const status = typeof item.status === "string" ? item.status : "completed";
+        return {
+            ...base,
+            role: "tool",
+            content: status === "failed" ? "Codex dynamic tool failed" : "Codex dynamic tool result",
+            toolCallId: item.id,
+            toolName: tool,
+            result: jsonValue(item.contentItems ?? item.success ?? null),
+            isError: status === "failed" || item.success === false,
+        };
+    }
+    if (item.type === "webSearch") {
+        return {
+            ...base,
+            role: "tool",
+            content: typeof item.query === "string" ? item.query : "Codex web search",
+            toolCallId: item.id,
+            toolName: "codex_web_search",
+            result: jsonValue(item.results ?? null),
+            isError: false,
+        };
+    }
+    return undefined;
+}
+export function codexThreadHistoryEntries(thread) {
+    const entries = [];
+    let sequence = 0;
+    if (thread.name) {
+        entries.push({
+            id: `codex:${thread.id}:session-info`,
+            type: "session_info",
+            source: "native",
+            createdAt: isoFromSeconds(thread.createdAt, thread.createdAt),
+            sequence: sequence++,
+            nativeEntryId: thread.id,
+            name: redactCodexNativeSensitiveText(thread.name),
+        });
+    }
+    for (const turn of thread.turns) {
+        for (const item of turn.items) {
+            const entry = itemEntry(thread, turn, item, sequence);
+            if (!entry)
+                continue;
+            entries.push(entry);
+            sequence += 1;
+        }
+        if (turn.status === "failed" && turn.error !== undefined) {
+            entries.push({
+                id: `codex:${thread.id}:${turn.id}:error`,
+                type: "message",
+                source: "native",
+                createdAt: isoFromSeconds(turn.completedAt ?? turn.startedAt, thread.updatedAt),
+                sequence: sequence++,
+                turnId: turn.id,
+                nativeTurnId: turn.id,
+                nativeEntryId: `${turn.id}:error`,
+                role: "assistant",
+                content: "Codex turn failed.",
+                status: "error",
+                error: "Codex turn failed.",
+            });
+        }
+    }
+    return entries;
+}
+export function inspectCodexThreadHistory(runtimeInstanceId, binding, thread) {
+    return {
+        runtimeInstanceId,
+        adapterId: CODEX_NATIVE_ADAPTER_ID,
+        bindingState: binding.state,
+        available: true,
+        locator: { kind: "adapter-resolved" },
+        title: thread.name ? redactCodexNativeSensitiveText(thread.name) : undefined,
+        firstMessage: thread.preview ? redactCodexNativeSensitiveText(thread.preview) : undefined,
+        createdAt: isoFromSeconds(thread.createdAt, thread.createdAt),
+        updatedAt: isoFromSeconds(thread.updatedAt, thread.updatedAt),
+        entryCount: thread.turns.length > 0 ? codexThreadHistoryEntries(thread).length : undefined,
+        version: thread.cliVersion,
+        diagnostics: [],
+    };
+}
+export function unavailableCodexThreadHistoryInspection(runtimeInstanceId, binding, code, message) {
+    return {
+        runtimeInstanceId,
+        adapterId: CODEX_NATIVE_ADAPTER_ID,
+        bindingState: binding.state,
+        available: false,
+        diagnostics: [{
+                severity: binding.state === "missing" ? "error" : "warning",
+                code,
+                message,
+            }],
+    };
+}
+function encodeCursor(cursor) {
+    return `${CODEX_HISTORY_CURSOR_PREFIX}${Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url")}`;
+}
+function decodeCursor(value, threadId) {
+    if (!value)
+        return undefined;
+    if (!value.startsWith(CODEX_HISTORY_CURSOR_PREFIX))
+        throw new Error("Invalid Codex native history cursor.");
+    try {
+        const parsed = JSON.parse(Buffer.from(value.slice(CODEX_HISTORY_CURSOR_PREFIX.length), "base64url").toString("utf8"));
+        if (parsed.v !== 1 || parsed.threadId !== threadId || !Number.isSafeInteger(parsed.beforeIndex) || Number(parsed.beforeIndex) < 0) {
+            throw new Error("invalid cursor");
+        }
+        return parsed;
+    }
+    catch {
+        throw new Error("Invalid Codex native history cursor.");
+    }
+}
+function selectedLimit(value) {
+    if (value === undefined)
+        return DEFAULT_HISTORY_LIMIT;
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new Error("Codex native history limit must be a positive integer.");
+    return Math.min(value, MAX_HISTORY_LIMIT);
+}
+export function pageCodexThreadHistory(input) {
+    const allEntries = codexThreadHistoryEntries(input.thread);
+    const beforeTimestampMs = input.beforeTimestamp === undefined ? undefined : Date.parse(input.beforeTimestamp);
+    if (beforeTimestampMs !== undefined && Number.isNaN(beforeTimestampMs)) {
+        throw new Error("Codex native history beforeTimestamp is invalid.");
+    }
+    const filtered = beforeTimestampMs === undefined
+        ? allEntries
+        : allEntries.filter((entry) => Date.parse(entry.createdAt) < beforeTimestampMs);
+    const cursor = decodeCursor(input.cursor, input.thread.id);
+    const end = Math.min(cursor?.beforeIndex ?? filtered.length, filtered.length);
+    const limit = selectedLimit(input.limit);
+    const start = Math.max(0, end - limit);
+    const entries = filtered.slice(start, end);
+    const hasMore = start > 0;
+    return {
+        runtimeInstanceId: input.runtimeInstanceId,
+        adapterId: CODEX_NATIVE_ADAPTER_ID,
+        source: "native",
+        entries,
+        orderOffset: start,
+        ...(hasMore ? { nextCursor: encodeCursor({ v: 1, threadId: input.thread.id, beforeIndex: start }) } : {}),
+        hasMore,
+        inspection: inspectCodexThreadHistory(input.runtimeInstanceId, input.binding, input.thread),
+    };
+}

package/dist/agent-runtimes/codex-native/mcp-stdio-launcher.js

@@ -0,0 +1,89 @@
+import { spawn } from "node:child_process";
+const ENVIRONMENT_KEY_PATTERN = /^PIBO_CODEX_MCP_STDIO_[A-F0-9]{16}_(COMMAND|ARGS|ENV|CWD)$/;
+const MAX_COMMAND_BYTES = 16 * 1024;
+const MAX_ARGS = 512;
+const MAX_ARGS_BYTES = 256 * 1024;
+const MAX_ENVIRONMENT_ENTRIES = 512;
+const MAX_ENVIRONMENT_BYTES = 512 * 1024;
+function fail() {
+    process.stderr.write("Pibo native Codex MCP stdio launcher configuration is invalid.\n");
+    process.exit(125);
+}
+function takeEnvironment(name) {
+    if (!name || !ENVIRONMENT_KEY_PATTERN.test(name))
+        fail();
+    const value = process.env[name];
+    delete process.env[name];
+    if (value === undefined)
+        fail();
+    return value;
+}
+function parseStringArray(value) {
+    if (Buffer.byteLength(value, "utf8") > MAX_ARGS_BYTES)
+        fail();
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        fail();
+    }
+    if (!Array.isArray(parsed) || parsed.length > MAX_ARGS || parsed.some((entry) => typeof entry !== "string"))
+        fail();
+    return parsed;
+}
+function parseEnvironment(value) {
+    if (Buffer.byteLength(value, "utf8") > MAX_ENVIRONMENT_BYTES)
+        fail();
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        fail();
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        fail();
+    const entries = Object.entries(parsed);
+    if (entries.length > MAX_ENVIRONMENT_ENTRIES)
+        fail();
+    const environment = Object.create(null);
+    for (const [name, entry] of entries) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || typeof entry !== "string")
+            fail();
+        environment[name] = entry;
+    }
+    return environment;
+}
+const [commandEnvironment, argsEnvironment, childEnvironment, cwdEnvironment] = process.argv.slice(2);
+const command = takeEnvironment(commandEnvironment);
+if (!command.trim() || Buffer.byteLength(command, "utf8") > MAX_COMMAND_BYTES)
+    fail();
+const args = parseStringArray(takeEnvironment(argsEnvironment));
+const configuredEnvironment = parseEnvironment(takeEnvironment(childEnvironment));
+const cwdValue = takeEnvironment(cwdEnvironment);
+const cwd = cwdValue || undefined;
+const environment = {
+    ...process.env,
+    ...configuredEnvironment,
+};
+const child = spawn(command, args, {
+    cwd,
+    env: environment,
+    stdio: "inherit",
+});
+let terminal = false;
+const finish = (code) => {
+    if (terminal)
+        return;
+    terminal = true;
+    process.exit(code);
+};
+child.once("error", () => finish(126));
+child.once("exit", (code, signal) => finish(code ?? (signal ? 128 : 1)));
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.once(signal, () => {
+        if (!terminal)
+            child.kill(signal);
+    });
+}