@pcircle/memesh 4.7.3 → 4.8.0

package/dist/host-runtime/codex-session.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getMemeshDirFromDbPath } from '../core/paths.js';
+import { readHostConfigFile, readTokenFile, requiredString } from './config.js';
+import { connectRouterHost } from './router-client.js';
+const MAX_HOOK_INPUT_BYTES = 64 * 1024;
+const CODEX_THREAD_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export async function startCodexSessionCompanion(config, hookInput, environment, dependencies = {}) {
+    if (hookInput.hook_event_name !== undefined && hookInput.hook_event_name !== 'SessionStart')
+        return null;
+    if (hookInput.source === 'compact')
+        return null;
+    const threadId = environment.CODEX_THREAD_ID;
+    if (!threadId || !CODEX_THREAD_ID.test(threadId))
+        return null;
+    if (hookInput.session_id !== undefined && hookInput.session_id !== threadId)
+        return null;
+    const realpath = dependencies.realpath ?? fs.realpathSync;
+    const workspace = realpath(requiredAbsolutePath(config.workspace, 'workspace'));
+    const cwd = realpath(requiredAbsolutePath(hookInput.cwd, 'cwd'));
+    if (workspace !== cwd)
+        return null;
+    return (dependencies.connect ?? connectRouterHost)({
+        socket_path: requiredString(config.router_socket, 'router_socket'),
+        auth_token: readTokenFile(config.token_file),
+        identity: {
+            project: requiredString(config.project, 'project'),
+            principal_id: requiredString(config.principal_id, 'principal_id'),
+            session_instance_id: threadId,
+            adapter_kind: 'codex-cli-queue',
+        },
+        async deliver() {
+            throw new Error('Codex CLI queue delivery must remain metadata-only inside the router.');
+        },
+    });
+}
+function requiredAbsolutePath(value, field) {
+    const result = requiredString(value, field);
+    if (!path.isAbsolute(result))
+        throw new Error(`${field} must be an absolute path.`);
+    return result;
+}
+async function readHookInput() {
+    let input = '';
+    process.stdin.setEncoding('utf8');
+    for await (const chunk of process.stdin) {
+        input += chunk;
+        if (Buffer.byteLength(input, 'utf8') > MAX_HOOK_INPUT_BYTES) {
+            throw new Error('Codex SessionStart hook input exceeds the byte limit.');
+        }
+    }
+    const value = JSON.parse(input);
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error('Codex SessionStart hook input must be an object.');
+    }
+    return value;
+}
+async function main() {
+    const configPath = path.join(getMemeshDirFromDbPath(), 'hosts', 'codex-session.json');
+    if (!fs.existsSync(configPath))
+        return;
+    const input = await readHookInput();
+    const connection = await startCodexSessionCompanion(readHostConfigFile(configPath), input, { CODEX_THREAD_ID: process.env.CODEX_THREAD_ID });
+    if (!connection)
+        return;
+    let closing = false;
+    const close = () => {
+        if (closing)
+            return;
+        closing = true;
+        void connection.close().finally(() => process.exit(0));
+    };
+    process.once('SIGINT', close);
+    process.once('SIGTERM', close);
+}
+function isMainModule() {
+    const entrypoint = process.argv[1];
+    if (!entrypoint)
+        return false;
+    try {
+        return fs.realpathSync(entrypoint) === fs.realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+}
+if (isMainModule()) {
+    try {
+        await main();
+    }
+    catch {
+        process.stderr.write('memesh-host-codex-session: session registration failed.\n');
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=codex-session.js.map

package/dist/host-runtime/codex-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-session.js","sourceRoot":"","sources":["../../src/host-runtime/codex-session.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAA6B,MAAM,oBAAoB,CAAC;AAElF,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,eAAe,GAAG,iEAAiE,CAAC;AA2B1F,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA8B,EAC9B,SAAiC,EACjC,WAAyC,EACzC,eAAkD,EAAE;IAEpD,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACzG,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAC;IAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzF,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC;IAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,QAAQ,CAAC,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,CAAC,YAAY,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAC;QACjD,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC;QAClE,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE;YACR,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;YAClD,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC;YACjE,mBAAmB,EAAE,QAAQ;YAC7B,YAAY,EAAE,iBAAiB;SAChC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,KAAK,IAAI,KAAK,CAAC;QACf,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACtF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IACvC,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,kBAAkB,CAAyB,UAAU,CAAC,EACtD,KAAK,EACL,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CACjD,CAAC;IACF,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAClF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/host-runtime/codex.d.ts

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { type ChildProcess, type SpawnOptions } from 'node:child_process';
+import { createCodexAppServerAdapter, type CodexAppServerAdapterOptions, type CodexAppServerThread, type StartCodexAppServerThreadInput } from '../host-adapters/codex-app-server.js';
+import { connectRouterHost } from './router-client.js';
+type SpawnManagedCodex = (command: string, args: string[], options: SpawnOptions) => ChildProcess;
+type StartManagedThread = (input: StartCodexAppServerThreadInput, options?: CodexAppServerAdapterOptions) => Promise<CodexAppServerThread>;
+export interface ManagedCodexHostConfig extends Record<string, unknown> {
+    router_socket: unknown;
+    token_file: unknown;
+    project: unknown;
+    principal_id: unknown;
+    session_instance_id?: unknown;
+    control_socket: unknown;
+    workspace: unknown;
+    codex_command?: unknown;
+    startup_timeout_ms?: unknown;
+}
+export interface ManagedCodexHost {
+    readonly thread_id: string;
+    readonly session_instance_id: string;
+    readonly process: ChildProcess;
+    close(): Promise<void>;
+}
+export interface ManagedCodexHostDependencies {
+    spawn?: SpawnManagedCodex;
+    start_thread?: StartManagedThread;
+    create_adapter?: typeof createCodexAppServerAdapter;
+    connect_router_host?: typeof connectRouterHost;
+    wait?: (milliseconds: number) => Promise<void>;
+}
+export declare function startManagedCodexHost(config: ManagedCodexHostConfig, dependencies?: ManagedCodexHostDependencies): Promise<ManagedCodexHost>;
+export {};
+//# sourceMappingURL=codex.d.ts.map

package/dist/host-runtime/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/host-runtime/codex.ts"],"names":[],"mappings":";AAEA,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKjF,OAAO,EAGL,2BAA2B,EAE3B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,8BAA8B,EACpC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,iBAAiB,EAA6B,MAAM,oBAAoB,CAAC;AAKlF,KAAK,iBAAiB,GAAG,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB,KAAK,kBAAkB,GAAG,CACxB,KAAK,EAAE,8BAA8B,EACrC,OAAO,CAAC,EAAE,4BAA4B,KACnC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrE,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IAEtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,2BAA2B,CAAC;IACpD,mBAAmB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAmBD,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,sBAAsB,EAC9B,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,gBAAgB,CAAC,CAuF3B"}

package/dist/host-runtime/codex.js

@@ -0,0 +1,215 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { CodexAppServerDisconnectedError, CodexAppServerTimeoutError, createCodexAppServerAdapter, startCodexAppServerThread, } from '../host-adapters/codex-app-server.js';
+import { assertSecureLocalHostRuntimeSupported, readHostConfig, readTokenFile, requiredString, } from './config.js';
+import { connectRouterHost } from './router-client.js';
+const DEFAULT_STARTUP_TIMEOUT_MS = 15_000;
+const STARTUP_RETRY_MS = 50;
+export async function startManagedCodexHost(config, dependencies = {}) {
+    assertSecureLocalHostRuntimeSupported();
+    const normalized = normalizeConfig(config);
+    assertUnusedPrivateSocketPath(normalized.controlSocket);
+    const spawnManagedCodex = dependencies.spawn ?? spawn;
+    const startThread = dependencies.start_thread ?? startCodexAppServerThread;
+    const createAdapter = dependencies.create_adapter ?? createCodexAppServerAdapter;
+    const connectHost = dependencies.connect_router_host ?? connectRouterHost;
+    const wait = dependencies.wait ?? delay;
+    const child = spawnManagedCodex(normalized.codexCommand, [
+        'app-server',
+        '--listen',
+        `unix://${normalized.controlSocket}`,
+    ], {
+        shell: false,
+        stdio: 'ignore',
+        windowsHide: true,
+    });
+    let routerConnection;
+    let closeTask;
+    const close = () => {
+        closeTask ??= (async () => {
+            await routerConnection?.close();
+            if (isChildRunning(child))
+                child.kill('SIGTERM');
+        })();
+        return closeTask;
+    };
+    const onChildEnded = () => { void close(); };
+    child.once('exit', onChildEnded);
+    child.once('error', onChildEnded);
+    try {
+        const thread = await waitForManagedThread({
+            child,
+            controlSocket: normalized.controlSocket,
+            workspace: normalized.workspace,
+            timeoutMs: normalized.startupTimeoutMs,
+            startThread,
+            wait,
+        });
+        assertPrivateControlSocket(normalized.controlSocket);
+        const adapter = createAdapter();
+        routerConnection = await connectHost({
+            socket_path: normalized.routerSocket,
+            auth_token: readTokenFile(normalized.tokenFile),
+            identity: {
+                project: normalized.project,
+                principal_id: normalized.principalId,
+                session_instance_id: normalized.sessionInstanceId,
+                adapter_kind: 'codex-app-server',
+            },
+            async deliver(delivery) {
+                const receipt = await adapter.queue({
+                    control_socket_path: normalized.controlSocket,
+                    thread_id: thread.thread_id,
+                    routing: {
+                        project: delivery.envelope.project,
+                        sender: delivery.envelope.sender,
+                        recipient: delivery.envelope.recipient,
+                        message_id: delivery.envelope.message_id,
+                        delivery_id: delivery.delivery_id,
+                        correlation_id: delivery.envelope.correlation_id,
+                    },
+                    envelope: delivery.envelope,
+                });
+                return {
+                    host: receipt.host,
+                    status: receipt.status,
+                    thread_id: receipt.thread_id,
+                    client_user_message_id: receipt.client_user_message_id,
+                    queued_submission_id: receipt.queued_submission_id,
+                };
+            },
+        });
+        return {
+            thread_id: thread.thread_id,
+            session_instance_id: normalized.sessionInstanceId,
+            process: child,
+            close,
+        };
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}
+async function waitForManagedThread(input) {
+    const deadline = Date.now() + input.timeoutMs;
+    let lastError;
+    for (;;) {
+        if (!isChildRunning(input.child)) {
+            throw new Error('Managed Codex app-server exited before creating a thread.');
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            throw lastError ?? new Error('Managed Codex app-server did not become ready before the startup timeout.');
+        }
+        try {
+            return await input.startThread({
+                control_socket_path: input.controlSocket,
+                workspace: input.workspace,
+                timeout_ms: Math.min(remaining, 1_000),
+            });
+        }
+        catch (error) {
+            if (!isReadinessTransportError(error))
+                throw error;
+            lastError = error;
+            await input.wait(Math.min(STARTUP_RETRY_MS, Math.max(1, deadline - Date.now())));
+        }
+    }
+}
+function isReadinessTransportError(error) {
+    return error instanceof CodexAppServerDisconnectedError || error instanceof CodexAppServerTimeoutError;
+}
+function normalizeConfig(config) {
+    const controlSocket = requiredAbsolutePath(config.control_socket, 'control_socket');
+    const workspace = fs.realpathSync(requiredAbsolutePath(config.workspace, 'workspace'));
+    if (!fs.statSync(workspace).isDirectory())
+        throw new Error('workspace must be an existing directory.');
+    return {
+        routerSocket: requiredString(config.router_socket, 'router_socket'),
+        tokenFile: config.token_file,
+        project: requiredString(config.project, 'project'),
+        principalId: requiredString(config.principal_id, 'principal_id'),
+        sessionInstanceId: config.session_instance_id === undefined
+            ? randomUUID()
+            : requiredString(config.session_instance_id, 'session_instance_id'),
+        controlSocket,
+        workspace,
+        codexCommand: requiredString(config.codex_command ?? 'codex', 'codex_command'),
+        startupTimeoutMs: boundedStartupTimeout(config.startup_timeout_ms ?? DEFAULT_STARTUP_TIMEOUT_MS),
+    };
+}
+function requiredAbsolutePath(value, field) {
+    const resolved = requiredString(value, field);
+    if (!path.isAbsolute(resolved))
+        throw new Error(`${field} must be an absolute path.`);
+    return resolved;
+}
+function boundedStartupTimeout(value) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 100 || value > 60_000) {
+        throw new Error('startup_timeout_ms must be an integer between 100 and 60000.');
+    }
+    return value;
+}
+function assertUnusedPrivateSocketPath(socketPath) {
+    const parent = fs.lstatSync(path.dirname(socketPath));
+    assertOwnerPrivate(parent, 'control socket parent directory');
+    if (parent.isSymbolicLink() || !parent.isDirectory()) {
+        throw new Error('The control socket parent must be a real owner-private directory.');
+    }
+    if (fs.lstatSync(socketPath, { throwIfNoEntry: false })) {
+        throw new Error('The managed control socket path must not already exist.');
+    }
+}
+function assertPrivateControlSocket(socketPath) {
+    const socket = fs.lstatSync(socketPath);
+    if (!socket.isSocket())
+        throw new Error('The managed control socket must be a Unix socket.');
+    assertOwnerPrivate(socket, 'managed control socket');
+}
+function assertOwnerPrivate(stat, label) {
+    if ((stat.mode & 0o077) !== 0)
+        throw new Error(`The ${label} must be owner-private.`);
+    if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+        throw new Error(`The ${label} must be owned by the current user.`);
+    }
+}
+function isChildRunning(child) {
+    return child.exitCode === null && child.signalCode === null;
+}
+function delay(milliseconds) {
+    return new Promise(resolve => setTimeout(resolve, milliseconds));
+}
+async function runManagedCodexHost() {
+    const host = await startManagedCodexHost(readHostConfig());
+    let shuttingDown = false;
+    const shutdown = () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        void host.close().finally(() => process.exit(0));
+    };
+    process.once('SIGINT', shutdown);
+    process.once('SIGTERM', shutdown);
+    host.process.once('exit', () => {
+        if (!shuttingDown)
+            process.exitCode = 1;
+    });
+}
+const entryPath = process.argv[1];
+if (entryPath && isExecutedModule(entryPath, import.meta.url)) {
+    await runManagedCodexHost();
+}
+function isExecutedModule(entryPath, moduleUrl) {
+    try {
+        return fs.realpathSync(entryPath) === fs.realpathSync(fileURLToPath(moduleUrl));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=codex.js.map

package/dist/host-runtime/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/host-runtime/codex.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,2BAA2B,EAC3B,yBAAyB,GAI1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qCAAqC,EACrC,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAA6B,MAAM,oBAAoB,CAAC;AAElF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,gBAAgB,GAAG,EAAE,CAAC;AA0D5B,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA8B,EAC9B,eAA6C,EAAE;IAE/C,qCAAqC,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,6BAA6B,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAExD,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,IAAI,yBAAyB,CAAC;IAC3E,MAAM,aAAa,GAAG,YAAY,CAAC,cAAc,IAAI,2BAA2B,CAAC;IACjF,MAAM,WAAW,GAAG,YAAY,CAAC,mBAAmB,IAAI,iBAAiB,CAAC;IAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,IAAI,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,YAAY,EAAE;QACvD,YAAY;QACZ,UAAU;QACV,UAAU,UAAU,CAAC,aAAa,EAAE;KACrC,EAAE;QACD,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,IAAI,gBAAkD,CAAC;IACvD,IAAI,SAAoC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,gBAAgB,EAAE,KAAK,EAAE,CAAC;YAChC,IAAI,cAAc,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,KAAK;YACL,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,gBAAgB;YACtC,WAAW;YACX,IAAI;SACL,CAAC,CAAC;QACH,0BAA0B,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,gBAAgB,GAAG,MAAM,WAAW,CAAC;YACnC,WAAW,EAAE,UAAU,CAAC,YAAY;YACpC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;YAC/C,QAAQ,EAAE;gBACR,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,YAAY,EAAE,UAAU,CAAC,WAAW;gBACpC,mBAAmB,EAAE,UAAU,CAAC,iBAAiB;gBACjD,YAAY,EAAE,kBAAkB;aACjC;YACD,KAAK,CAAC,OAAO,CAAC,QAAQ;gBACpB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;oBAClC,mBAAmB,EAAE,UAAU,CAAC,aAAa;oBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE;wBACP,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;wBAClC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;wBAChC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS;wBACtC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;wBACxC,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,cAAc;qBACjD;oBACD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CAAC;gBACH,OAAO;oBACL,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;iBACnD,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,mBAAmB,EAAE,UAAU,CAAC,iBAAiB;YACjD,OAAO,EAAE,KAAK;YACd,KAAK;SACN,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAOnC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IAC9C,IAAI,SAA4B,CAAC;IACjC,SAAS,CAAC;QACR,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC;gBAC7B,mBAAmB,EAAE,KAAK,CAAC,aAAa;gBACxC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACnD,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,+BAA+B,IAAI,KAAK,YAAY,0BAA0B,CAAC;AACzG,CAAC;AAED,SAAS,eAAe,CAAC,MAA8B;IACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvG,OAAO;QACL,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC;QACnE,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;QAClD,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC;QAChE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,KAAK,SAAS;YACzD,CAAC,CAAC,UAAU,EAAE;YACd,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACrE,aAAa;QACb,SAAS;QACT,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,IAAI,OAAO,EAAE,eAAe,CAAC;QAC9E,gBAAgB,EAAE,qBAAqB,CAAC,MAAM,CAAC,kBAAkB,IAAI,0BAA0B,CAAC;KACjG,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa;IACzD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACtF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,6BAA6B,CAAC,UAAkB;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,kBAAkB,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAkB;IACpD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7F,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAc,EAAE,KAAa;IACvD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,yBAAyB,CAAC,CAAC;IACtF,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,qCAAqC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB;IACzC,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,cAAc,EAA0B,CAAC,CAAC;IACnF,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QAC7B,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClC,IAAI,SAAS,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,MAAM,mBAAmB,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,SAAiB;IAC5D,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/host-runtime/config.d.ts

@@ -0,0 +1,9 @@
+export declare const SECURE_LOCAL_HOST_RUNTIME_UNSUPPORTED = "The secure local host runtime is not supported on Windows.";
+export declare function assertSecureLocalHostRuntimeSupported(): void;
+export declare function readHostConfig<T extends Record<string, unknown>>(): T;
+export declare function readHostConfigFile<T extends Record<string, unknown>>(configuredPath: string): T;
+export declare function readTokenFile(tokenFile: unknown): string;
+export declare function ensureRouterTokenFile(tokenFile: string): string;
+export declare function requiredString(value: unknown, field: string): string;
+export declare function optionalStringArray(value: unknown, field: string): string[];
+//# sourceMappingURL=config.d.ts.map

package/dist/host-runtime/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/host-runtime/config.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qCAAqC,+DACY,CAAC;AAE/D,wBAAgB,qCAAqC,IAAI,IAAI,CAI5D;AAED,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAKrE;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,CAAC,CAQ/F;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAOxD;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAI3E"}

package/dist/host-runtime/config.js

@@ -0,0 +1,91 @@
+import { randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+const MAX_HOST_CONFIG_FILE_BYTES = 64 * 1024;
+const MAX_ROUTER_TOKEN_FILE_BYTES = 8 * 1024;
+export const SECURE_LOCAL_HOST_RUNTIME_UNSUPPORTED = 'The secure local host runtime is not supported on Windows.';
+export function assertSecureLocalHostRuntimeSupported() {
+    if (process.platform === 'win32') {
+        throw new Error(SECURE_LOCAL_HOST_RUNTIME_UNSUPPORTED);
+    }
+}
+export function readHostConfig() {
+    const flag = process.argv.indexOf('--config');
+    const configuredPath = flag >= 0 ? process.argv[flag + 1] : process.env.MEMESH_HOST_CONFIG;
+    if (!configuredPath)
+        throw new Error('A host config file is required via --config or MEMESH_HOST_CONFIG.');
+    return readHostConfigFile(configuredPath);
+}
+export function readHostConfigFile(configuredPath) {
+    const value = JSON.parse(readOwnerPrivateFile(configuredPath, 'host config', MAX_HOST_CONFIG_FILE_BYTES));
+    if (!isRecord(value))
+        throw new Error('The host config must contain one JSON object.');
+    return value;
+}
+export function readTokenFile(tokenFile) {
+    const file = requiredString(tokenFile, 'token_file');
+    return requiredString(readOwnerPrivateFile(file, 'router token file', MAX_ROUTER_TOKEN_FILE_BYTES).trim(), 'router token');
+}
+export function ensureRouterTokenFile(tokenFile) {
+    assertSecureLocalHostRuntimeSupported();
+    try {
+        fs.writeFileSync(tokenFile, `${randomBytes(32).toString('hex')}\n`, { mode: 0o600, flag: 'wx' });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    return readTokenFile(tokenFile);
+}
+export function requiredString(value, field) {
+    if (typeof value !== 'string' || value.length === 0 || Buffer.byteLength(value) > 4096) {
+        throw new Error(`${field} must be a bounded non-empty string.`);
+    }
+    return value;
+}
+export function optionalStringArray(value, field) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new Error(`${field} must be an array.`);
+    return value.map((item, index) => requiredString(item, `${field}[${index}]`));
+}
+function readOwnerPrivateFile(file, label, maxBytes) {
+    assertSecureLocalHostRuntimeSupported();
+    if (typeof fs.constants.O_NOFOLLOW !== 'number') {
+        throw new Error(`This platform cannot safely reject a symlink ${label}.`);
+    }
+    const descriptor = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+    try {
+        const stat = fs.fstatSync(descriptor);
+        if (!stat.isFile())
+            throw new Error(`The ${label} must be an owner-private regular file.`);
+        assertOwnerPrivate(stat, label);
+        if (stat.size > maxBytes)
+            throw new Error(`The ${label} exceeds its ${maxBytes}-byte limit.`);
+        const content = Buffer.allocUnsafe(maxBytes + 1);
+        let bytesRead = 0;
+        while (bytesRead < content.length) {
+            const chunkBytes = fs.readSync(descriptor, content, bytesRead, content.length - bytesRead, null);
+            if (chunkBytes === 0)
+                break;
+            bytesRead += chunkBytes;
+        }
+        if (bytesRead > maxBytes)
+            throw new Error(`The ${label} exceeds its ${maxBytes}-byte limit.`);
+        return content.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function assertOwnerPrivate(stat, label) {
+    if ((stat.mode & 0o077) !== 0)
+        throw new Error(`The ${label} must be owner-private.`);
+    if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+        throw new Error(`The ${label} must be owned by the current user.`);
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=config.js.map

package/dist/host-runtime/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/host-runtime/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC;AAC7C,MAAM,CAAC,MAAM,qCAAqC,GAChD,4DAA4D,CAAC;AAE/D,MAAM,UAAU,qCAAqC;IACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC3F,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC3G,OAAO,kBAAkB,CAAI,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAoC,cAAsB;IAC1F,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,cAAc,EACd,aAAa,EACb,0BAA0B,CAC3B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACvF,OAAO,KAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACrD,OAAO,cAAc,CAAC,oBAAoB,CACxC,IAAI,EACJ,mBAAmB,EACnB,2BAA2B,CAC5B,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,qCAAqC,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,KAAa;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,KAAa;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAa,EAAE,QAAgB;IACzE,qCAAqC,EAAE,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,CAC5B,IAAI,EACJ,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAC1E,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,yCAAyC,CAAC,CAAC;QAC3F,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,QAAQ,cAAc,CAAC,CAAC;QAE9F,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,CAC5B,UAAU,EACV,OAAO,EACP,SAAS,EACT,OAAO,CAAC,MAAM,GAAG,SAAS,EAC1B,IAAI,CACL,CAAC;YACF,IAAI,UAAU,KAAK,CAAC;gBAAE,MAAM;YAC5B,SAAS,IAAI,UAAU,CAAC;QAC1B,CAAC;QACD,IAAI,SAAS,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,QAAQ,cAAc,CAAC,CAAC;QAC9F,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAc,EAAE,KAAa;IACvD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,yBAAyB,CAAC,CAAC;IACtF,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,qCAAqC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/host-runtime/router-client.d.ts

@@ -0,0 +1,38 @@
+import type { AgentJsonObject, AgentMessagePayload } from '../core/agent-messaging.js';
+export interface RouterHostIdentity {
+    project: string;
+    principal_id: string;
+    session_instance_id: string;
+    adapter_kind: string;
+}
+export interface RouterDelivery {
+    attempt_id: string;
+    delivery_id: string;
+    connection_id: string;
+    generation: number;
+    hops: number;
+    envelope: AgentMessagePayload;
+}
+export interface RouterHostConnection {
+    readonly connection_id: string;
+    readonly generation: number;
+    close(): Promise<void>;
+}
+export interface RouterClientResilienceOptions {
+    initial_retry_ms?: number;
+    max_retry_ms?: number;
+    retry_jitter?: number;
+    initial_attempts?: number;
+    registration_timeout_ms?: number;
+    start_router?: () => void | Promise<void>;
+    random?: () => number;
+}
+export interface ConnectRouterHostInput {
+    socket_path: string;
+    auth_token: string;
+    identity: RouterHostIdentity;
+    deliver(delivery: RouterDelivery): Promise<AgentJsonObject>;
+    resilience?: RouterClientResilienceOptions;
+}
+export declare function connectRouterHost(input: ConnectRouterHostInput): Promise<RouterHostConnection>;
+//# sourceMappingURL=router-client.d.ts.map

package/dist/host-runtime/router-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router-client.d.ts","sourceRoot":"","sources":["../../src/host-runtime/router-client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAWvF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5D,UAAU,CAAC,EAAE,6BAA6B,CAAC;CAC5C;AA8UD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAKpG"}