@pasko70/pibo 2.0.0 → 2.2.0

package/dist/agent-runtimes/codex-native/process.js

@@ -1,7 +1,8 @@
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { chmod, lstat, mkdir, realpath, rm, rmdir, writeFile, } from "node:fs/promises";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { lstat, mkdir, realpath, rm, rmdir, writeFile, } from "node:fs/promises";
+import { extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { protectPrivatePathsSync } from "../../core/private-path.js";
 import { CodexAppServerClient } from "./client.js";
 import { CODEX_APP_SERVER_PROTOCOL_NAME, CODEX_APP_SERVER_SUPPORTED_RANGE, CODEX_APP_SERVER_VERSION, } from "./protocol-version.js";
 const MAX_VERSION_OUTPUT_BYTES = 64 * 1024;
@@ -59,12 +60,13 @@ function isInside(root, candidate) {
     const child = relative(root, candidate);
     return child === "" || (!child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute(child));
 }
-async function ensurePrivateDirectory(path) {
-    await mkdir(path, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
-    const metadata = await lstat(path);
-    if (metadata.isSymbolicLink() || !metadata.isDirectory())
-        throw new Error("runtime path is not a private directory");
-    await chmod(path, PRIVATE_DIRECTORY_MODE);
+async function ensurePrivateDirectories(paths) {
+    for (const path of paths) {
+        await mkdir(path, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+        const metadata = await lstat(path);
+        if (metadata.isSymbolicLink() || !metadata.isDirectory())
+            throw new Error("runtime path is not a private directory");
+    }
 }
 async function ensurePrivateConfig(path) {
     try {
@@ -77,12 +79,17 @@ async function ensurePrivateConfig(path) {
     const metadata = await lstat(path);
     if (metadata.isSymbolicLink() || !metadata.isFile())
         throw new Error("runtime config is not a private regular file");
-    await chmod(path, PRIVATE_FILE_MODE);
 }
 function nodeErrorCode(error) {
     const code = error?.code;
     return typeof code === "string" && /^[A-Z0-9_]+$/.test(code) ? code : undefined;
 }
+function codexExecutableInvocation(executable, args) {
+    if (process.platform === "win32" && isAbsolute(executable) && [".js", ".cjs", ".mjs"].includes(extname(executable).toLowerCase())) {
+        return { command: process.execPath, args: [executable, ...args] };
+    }
+    return { command: executable, args: [...args] };
+}
 export async function prepareCodexNativeInstancePaths(config, runtimeInstanceId) {
     if (!runtimeInstanceId.trim())
         throw new CodexNativeProcessError("home_unavailable", "Codex runtime instance id is required.");
@@ -92,8 +99,7 @@ export async function prepareCodexNativeInstancePaths(config, runtimeInstanceId)
         const root = join(canonicalHomeRoot, safeSegment(runtimeInstanceId));
         const codexHome = join(root, "codex-home");
         const sessions = join(root, "sessions");
-        for (const path of [root, codexHome, sessions])
-            await ensurePrivateDirectory(path);
+        await ensurePrivateDirectories([canonicalHomeRoot, root, codexHome, sessions]);
         const canonicalRoot = await realpath(root);
         for (const path of [codexHome, sessions]) {
             const canonical = await realpath(path);
@@ -102,6 +108,10 @@ export async function prepareCodexNativeInstancePaths(config, runtimeInstanceId)
         }
         const configFile = join(codexHome, "config.toml");
         await ensurePrivateConfig(configFile);
+        protectPrivatePathsSync([
+            ...([canonicalHomeRoot, root, codexHome, sessions].map((path) => ({ path, kind: "directory" }))),
+            { path: configFile, kind: "file" },
+        ]);
         return { root: canonicalRoot, codexHome: await realpath(codexHome), configFile, sessions: await realpath(sessions) };
     }
     catch {
@@ -117,17 +127,16 @@ export async function prepareCodexNativeSessionPaths(input) {
     const generationRoot = join(sessionRoot, safeSegment(input.sessionGeneration));
     let sessionDirectoryReady = false;
     try {
-        await ensurePrivateDirectory(sessionRoot);
-        sessionDirectoryReady = true;
         const processHome = join(generationRoot, "home");
         const temp = join(generationRoot, "tmp");
         const xdgCache = join(processHome, ".cache");
         const xdgConfig = join(processHome, ".config");
         const xdgData = join(processHome, ".local", "share");
         const xdgState = join(processHome, ".local", "state");
-        for (const path of [generationRoot, processHome, temp, xdgCache, xdgConfig, xdgData, xdgState]) {
-            await ensurePrivateDirectory(path);
-        }
+        const privateDirectories = [sessionRoot, generationRoot, processHome, temp, xdgCache, xdgConfig, xdgData, xdgState];
+        await ensurePrivateDirectories(privateDirectories);
+        protectPrivatePathsSync(privateDirectories.map((path) => ({ path, kind: "directory" })));
+        sessionDirectoryReady = true;
         const canonicalGenerationRoot = await realpath(generationRoot);
         if (!isInside(instance.sessions, canonicalGenerationRoot))
             throw new Error("runtime generation escaped its session root");
@@ -209,7 +218,8 @@ async function probeCodexVersion(config, environment) {
     return await new Promise((resolveProbe) => {
         let child;
         try {
-            child = spawn(config.executable, ["--version"], { env: environment, stdio: ["ignore", "pipe", "pipe"] });
+            const invocation = codexExecutableInvocation(config.executable, ["--version"]);
+            child = spawn(invocation.command, invocation.args, { env: environment, stdio: ["ignore", "pipe", "pipe"] });
         }
         catch (error) {
             resolveProbe({ status: "failed", errorCode: nodeErrorCode(error) });
@@ -413,18 +423,19 @@ export async function startCodexNativeAppServer(input) {
     let client;
     try {
         const capabilities = { experimentalApi: false };
+        const invocation = codexExecutableInvocation(input.config.executable, [
+            "app-server",
+            "--stdio",
+            "--strict-config",
+            "-c",
+            `tools.experimental_request_user_input.enabled=${input.config.experimentalUserInput}`,
+            "-c",
+            `features.default_mode_request_user_input=${input.config.experimentalUserInput}`,
+        ]);
         client = await CodexAppServerClient.start({
-            command: input.config.executable,
+            command: invocation.command,
             fileCreationMask: 0o077,
-            args: [
-                "app-server",
-                "--stdio",
-                "--strict-config",
-                "-c",
-                `tools.experimental_request_user_input.enabled=${input.config.experimentalUserInput}`,
-                "-c",
-                `features.default_mode_request_user_input=${input.config.experimentalUserInput}`,
-            ],
+            args: invocation.args,
             cwd: resolve(input.workspace),
             env: buildCodexNativeProcessEnvironment({
                 config: input.config,

package/dist/agent-runtimes/codex-native/resource-delivery.js

@@ -56,7 +56,9 @@ function optionalStringArray(value, label, maxItems = 512, maxLength = 256) {
 function buildDeveloperInstructions(resources) {
     if (!resources)
         return undefined;
-    const contributions = resources.getContextContributions().filter((contribution) => contribution.id !== ENABLED_MCP_CONTEXT_ID && contribution.content?.trim());
+    const contributions = resources.getContextContributions().filter((contribution) => contribution.id !== ENABLED_MCP_CONTEXT_ID
+        && !contribution.nativeDiscovered
+        && contribution.content?.trim());
     if (contributions.length === 0)
         return undefined;
     if (contributions.length > MAX_CONTEXT_CONTRIBUTIONS) {
@@ -252,18 +254,18 @@ export class CodexNativeResourceDelivery {
     threadConfig;
     developerInstructions;
     skillRoots;
-    skillPaths;
+    selectedSkills;
     expectedMcpServers;
     portableTools;
     mcpAccess;
     credentialIssuedAtMs;
     credentialExpiresAtMs;
-    constructor(environment, threadConfig, developerInstructions, skillRoots, skillPaths, expectedMcpServers, portableTools, mcpAccess, credentialIssuedAtMs, credentialExpiresAtMs) {
+    constructor(environment, threadConfig, developerInstructions, skillRoots, selectedSkills, expectedMcpServers, portableTools, mcpAccess, credentialIssuedAtMs, credentialExpiresAtMs) {
         this.environment = environment;
         this.threadConfig = threadConfig;
         this.developerInstructions = developerInstructions;
         this.skillRoots = skillRoots;
-        this.skillPaths = skillPaths;
+        this.selectedSkills = selectedSkills;
         this.expectedMcpServers = expectedMcpServers;
         this.portableTools = portableTools;
         this.mcpAccess = mcpAccess;
@@ -318,17 +320,26 @@ export class CodexNativeResourceDelivery {
                 };
                 expectedMcpServers.push({ name: serverName, toolNames: [...mcpAccess.allowedToolNames] });
             }
-            const skillPaths = input.resources
-                ? await Promise.all(input.resources.getSkillPaths("materialized").map(async (path) => await realpath(path)))
+            const selectedSkills = input.resources
+                ? await Promise.all(input.resources.getInspection().skills.flatMap((skill) => {
+                    const path = skill.materializedPath;
+                    return path ? [{ name: skill.name, path }] : [];
+                }).map(async (skill) => ({ ...skill, path: await realpath(skill.path) })))
                 : [];
             const materializedSkillsRoot = input.resources?.getInspection().paths?.skills;
-            const skillRoots = skillPaths.length > 0 && materializedSkillsRoot
+            const skillRoots = selectedSkills.length > 0 && materializedSkillsRoot
                 ? [await realpath(materializedSkillsRoot)]
                 : [];
-            const threadConfig = Object.keys(codexMcpServers).length > 0
-                ? { mcp_servers: asJsonValue(codexMcpServers) }
-                : undefined;
-            return new CodexNativeResourceDelivery(resourceEnvironment, threadConfig, buildDeveloperInstructions(input.resources), skillRoots, skillPaths, expectedMcpServers, input.portableTools, mcpAccess, credentialIssuedAtMs, credentialExpiresAtMs);
+            const threadConfig = {};
+            if (Object.keys(codexMcpServers).length > 0)
+                threadConfig.mcp_servers = asJsonValue(codexMcpServers);
+            if (input.nativeSubagentsEnabled !== undefined) {
+                threadConfig.features = input.nativeSubagentsEnabled
+                    ? { multi_agent: true, multi_agent_v2: true }
+                    : { multi_agent: false, multi_agent_v2: false };
+                threadConfig.agents = { enabled: input.nativeSubagentsEnabled };
+            }
+            return new CodexNativeResourceDelivery(resourceEnvironment, Object.keys(threadConfig).length > 0 ? threadConfig : undefined, buildDeveloperInstructions(input.resources), skillRoots, selectedSkills, expectedMcpServers, input.portableTools, mcpAccess, credentialIssuedAtMs, credentialExpiresAtMs);
         }
         catch (error) {
             if (mcpAccess && input.portableTools)
@@ -382,20 +393,32 @@ export class CodexNativeResourceDelivery {
             throw new Error("Codex could not load the selected Pibo skills.");
         }
         const loadedPaths = new Set();
+        const loadedSkills = new Map();
         for (const entry of response.data) {
             if (!isRecord(entry) || !Array.isArray(entry.skills) || !Array.isArray(entry.errors)) {
                 throw new Error("Codex skills/list returned an invalid entry.");
             }
             for (const skill of entry.skills) {
-                if (!isRecord(skill) || typeof skill.path !== "string" || typeof skill.enabled !== "boolean") {
+                if (!isRecord(skill) || typeof skill.name !== "string" || typeof skill.path !== "string" || typeof skill.enabled !== "boolean") {
                     throw new Error("Codex skills/list returned an invalid skill.");
                 }
-                if (skill.enabled)
-                    loadedPaths.add(await realpath(skill.path).catch(() => skill.path));
+                if (skill.enabled) {
+                    const path = await realpath(skill.path).catch(() => skill.path);
+                    loadedPaths.add(path);
+                    const sameNamePaths = loadedSkills.get(skill.name) ?? new Set();
+                    sameNamePaths.add(path);
+                    loadedSkills.set(skill.name, sameNamePaths);
+                }
             }
         }
-        if (this.skillPaths.some((path) => !loadedPaths.has(path))) {
-            throw new Error("Codex did not load every selected Pibo skill.");
+        for (const skill of this.selectedSkills) {
+            const sameNamePaths = loadedSkills.get(skill.name) ?? new Set();
+            const conflictingPath = [...sameNamePaths].find((path) => path !== skill.path);
+            if (conflictingPath) {
+                throw new Error(`Selected Pibo skill "${skill.name}" conflicts with a native Codex skill; explicit Pibo-skill precedence cannot be guaranteed.`);
+            }
+            if (!loadedPaths.has(skill.path))
+                throw new Error(`Codex did not load selected Pibo skill "${skill.name}".`);
         }
     }
     async verifyThread(client, threadId) {

package/dist/agent-runtimes/codex-native/turn.js

@@ -217,11 +217,12 @@ function toolFailed(item) {
         return false;
     return ["declined", "failed", "error"].includes(item.status.toLowerCase());
 }
-function newPendingTurn() {
+function newPendingTurn(kind = "turn") {
     const completion = deferred();
     const turnIdReady = deferred();
     void completion.promise.catch(() => { });
     return {
+        kind,
         completion,
         turnIdReady,
         turnIdReadySettled: false,
@@ -238,6 +239,8 @@ function newPendingTurn() {
         reasoningSummaryParts: new Map(),
         reasoningContentParts: new Map(),
         completedReasoningItems: new Set(),
+        compactionStarted: false,
+        compactionEnded: false,
         startedTools: new Map(),
         completedTools: new Set(),
     };
@@ -311,6 +314,36 @@ export class CodexNativeTurnController {
             throw error;
         }
     }
+    async compact() {
+        if (this.disposed)
+            throw new Error("Codex native turn controller is disposed.");
+        if (this.pending)
+            throw new Error("Codex native session already has an active turn.");
+        const pending = newPendingTurn("compaction");
+        this.pending = pending;
+        this.ensureCompactionStarted(pending);
+        try {
+            await this.client.request("thread/compact/start", { threadId: this.threads.thread.id });
+            await pending.completion.promise;
+        }
+        catch (error) {
+            if (!pending.terminal && this.pending === pending) {
+                const normalized = error instanceof Error ? error : new Error("Codex compaction could not be completed.");
+                if (pending.started || pending.turnId) {
+                    this.failActiveTurn(pending, normalized, runtimeSessionErrorDetails(safeDiagnosticText(normalized.message)));
+                }
+                else {
+                    this.finishCompaction(pending, {
+                        aborted: false,
+                        errorMessage: safeDiagnosticText(normalized.message),
+                    });
+                    this.pending = undefined;
+                    this.resolveTurnId(pending, undefined);
+                }
+            }
+            throw error;
+        }
+    }
     async steer(text, clientUserMessageId) {
         const pending = this.pending;
         if (!pending || pending.terminal)
@@ -350,6 +383,12 @@ export class CodexNativeTurnController {
         const pending = this.pending;
         this.pending = undefined;
         if (pending && !pending.terminal) {
+            if ((pending.kind === "compaction" || pending.compactionStarted) && !pending.compactionEnded) {
+                this.finishCompaction(pending, {
+                    aborted: true,
+                    errorMessage: "Codex native compaction was interrupted because the session was disposed.",
+                });
+            }
             pending.terminal = true;
             this.resolveTurnId(pending, undefined);
             pending.completion.reject(new CodexAppServerClientError("closed", "Codex native turn controller was disposed"));
@@ -636,7 +675,7 @@ export class CodexNativeTurnController {
         if (item.type === "reasoning")
             this.ensureReasoningStarted(pending, item.id);
         else if (item.type === "contextCompaction") {
-            this.emit({ type: "compaction_start", reason: "codex_context_compaction" });
+            this.ensureCompactionStarted(pending);
         }
         else {
             this.ensureToolStarted(pending, item);
@@ -672,9 +711,7 @@ export class CodexNativeTurnController {
             return;
         }
         if (item.type === "contextCompaction") {
-            this.emit({
-                type: "compaction_end",
-                reason: "codex_context_compaction",
+            this.finishCompaction(pending, {
                 result: redactCodexNativeValue(item),
                 aborted: false,
             });
@@ -692,6 +729,25 @@ export class CodexNativeTurnController {
             isError: toolFailed(item),
         });
     }
+    ensureCompactionStarted(pending) {
+        if (pending.compactionStarted)
+            return;
+        pending.compactionStarted = true;
+        this.emit({ type: "compaction_start", reason: "codex_context_compaction" });
+    }
+    finishCompaction(pending, input) {
+        this.ensureCompactionStarted(pending);
+        if (pending.compactionEnded)
+            return;
+        pending.compactionEnded = true;
+        this.emit({
+            type: "compaction_end",
+            reason: "codex_context_compaction",
+            ...(input.result !== undefined ? { result: input.result } : {}),
+            aborted: input.aborted,
+            ...(input.errorMessage ? { errorMessage: input.errorMessage } : {}),
+        });
+    }
     assistantIndex(pending, itemId) {
         const existing = pending.assistantIndices.get(itemId);
         if (existing !== undefined)
@@ -781,6 +837,13 @@ export class CodexNativeTurnController {
         pending.completion.resolve(persistedTurn);
     }
     finishIncompleteItems(pending, status) {
+        if ((pending.kind === "compaction" || pending.compactionStarted) && !pending.compactionEnded) {
+            this.finishCompaction(pending, {
+                aborted: status === "interrupted",
+                ...(status === "failed" ? { errorMessage: "Codex compaction ended before item/completed." } : {}),
+                result: { status },
+            });
+        }
         for (const [itemId, text] of pending.assistantBuffers) {
             if (pending.completedAssistantItems.has(itemId) || !text)
                 continue;