@playola-radio/slipstream 0.1.0

package/dist/harness-context/codex.js

@@ -0,0 +1,49 @@
+import { isAbsolute } from 'node:path';
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/**
+ * Codex identity adapter (fail-closed).
+ *
+ * Per the SC3 probe (tools/identity-probe/FINDINGS.md): Codex exposes NO identity
+ * environment variable and a clean env at startup — identity arrives ONLY on the
+ * tool call, in `_meta`. The carrier is `_meta.threadId` (== session_id) plus
+ * `_meta['x-codex-turn-metadata'].workspaces`, a map from the canonical worktree
+ * path to its origin/commit. `cwd` is unreliable (sometimes `/`) and is never a
+ * binding input.
+ *
+ * Fail closed unless `_meta` is present, `threadId` is present, and `workspaces`
+ * has EXACTLY one key: an absent, empty, or multi-root map is ambiguous, so we
+ * refuse rather than guess. (A dropped Codex transport is terminal for the binding
+ * — recovery needs a new conversation — but that is the transport's concern, not
+ * this pure derivation's.)
+ */
+export function codexIdentity(toolCallParams) {
+    if (!isObject(toolCallParams))
+        return { unresolved: 'tool call has no params' };
+    const meta = toolCallParams._meta;
+    if (!isObject(meta))
+        return { unresolved: 'tool call _meta is absent' };
+    const threadId = meta.threadId;
+    if (typeof threadId !== 'string' || threadId.length === 0) {
+        return { unresolved: 'tool call _meta.threadId is absent' };
+    }
+    const turn = meta['x-codex-turn-metadata'];
+    if (!isObject(turn))
+        return { unresolved: 'tool call _meta.x-codex-turn-metadata is absent' };
+    const workspaces = turn.workspaces;
+    if (!isObject(workspaces))
+        return { unresolved: 'tool call _meta workspaces map is absent' };
+    const keys = Object.keys(workspaces);
+    if (keys.length === 0)
+        return { unresolved: 'workspaces map is empty; worktree root is ambiguous' };
+    if (keys.length > 1)
+        return { unresolved: `workspaces map has ${keys.length} roots; ambiguous` };
+    const worktree = keys[0];
+    // The worktree root must be an absolute path. A relative key (`.`, or an array's
+    // `0`) would be resolved against the daemon's own CWD, which is never a binding
+    // input — reject it before contacting the daemon.
+    if (!isAbsolute(worktree))
+        return { unresolved: `workspace root ${worktree} is not an absolute path` };
+    return { harness: 'codex', harness_session_id: threadId, worktree };
+}

package/dist/harness-context.js

@@ -0,0 +1,49 @@
+/**
+ * The forwarder's harness-identity resolver.
+ *
+ * SC3 requires verified harness session context; CWD alone is insufficient, and
+ * ambiguous identity must FAIL rather than guess. The two harnesses expose
+ * identity by different mechanisms and at different times (see FINDINGS.md), so
+ * this dispatches by `clientInfo.name` at `initialize`:
+ *   - claude-code   → identity is the env triple, observable eagerly at initialize
+ *                     and cached (tool-call params carry no identity).
+ *   - codex-mcp-client → identity arrives only per tool call, derived each time.
+ *
+ * Anything else — an unrecognized client, or a call before initialize — fails
+ * closed. `worktree`/`harness_session_id` here are DECLARED context the forwarder
+ * ships to the daemon; the daemon does the selection comparison.
+ */
+import { claudeIdentity } from "./harness-context/claude.js";
+import { codexIdentity } from "./harness-context/codex.js";
+export function isResolved(result) {
+    return !('unresolved' in result);
+}
+export const CLAUDE_CLIENT = 'claude-code';
+export const CODEX_CLIENT = 'codex-mcp-client';
+function isObject(v) {
+    return typeof v === 'object' && v !== null;
+}
+export function createHarnessContext() {
+    let resolve = () => ({
+        unresolved: 'harness not initialized',
+    });
+    return {
+        initialize(clientInfo, env) {
+            const name = isObject(clientInfo) && typeof clientInfo.name === 'string' ? clientInfo.name : undefined;
+            if (name === CLAUDE_CLIENT) {
+                const cached = claudeIdentity(env); // eager: the env triple is available now
+                resolve = () => cached;
+            }
+            else if (name === CODEX_CLIENT) {
+                resolve = (params) => codexIdentity(params); // per-call: identity only at declaration
+            }
+            else {
+                const reason = `unrecognized harness clientInfo.name: ${name ?? '(absent)'}`;
+                resolve = () => ({ unresolved: reason });
+            }
+        },
+        identityForCall(toolCallParams) {
+            return resolve(toolCallParams);
+        },
+    };
+}

package/dist/health.js

@@ -0,0 +1,65 @@
+export function createHealth(durableSeq = 0n) {
+    let state = 'starting';
+    let seq = durableSeq;
+    let failure;
+    let gapPending = false;
+    const listeners = new Set();
+    return {
+        snapshot: () => ({
+            state,
+            durable_seq: seq.toString(),
+            ...(failure ? { failure } : {}),
+            gap_pending: gapPending,
+        }),
+        setDurableSeq: (next) => {
+            seq = next;
+            // A listener that throws (violating its contract) must not corrupt the
+            // caller that just advanced the durable seq — e.g. break the append path
+            // between a durable commit and the bookkeeping that follows it. Report and
+            // keep notifying the rest.
+            for (const l of listeners) {
+                try {
+                    l();
+                }
+                catch (err) {
+                    // Reporting must itself be crash-proof: String(err) can re-enter user
+                    // code (a custom toString / Symbol.toPrimitive) that throws again, and
+                    // that second exception would escape into the caller — re-opening the
+                    // exact post-commit hole this catch exists to close.
+                    let detail;
+                    try {
+                        detail = String(err);
+                    }
+                    catch {
+                        detail = '<unstringifiable listener error>';
+                    }
+                    console.error(`slipstream: health listener threw: ${detail}`);
+                }
+            }
+        },
+        markHealthy: () => {
+            state = 'healthy';
+            failure = undefined;
+            gapPending = false;
+        },
+        markFailing: (next) => {
+            // Keep the first failure of an outage: it marks when acknowledgment
+            // stopped. A failed recovery attempt re-enters `failing` from
+            // `recovering`; preserve that original failure rather than overwriting it.
+            if (state !== 'failing') {
+                state = 'failing';
+                failure ??= next;
+                gapPending = true;
+            }
+        },
+        markRecovering: () => {
+            state = 'recovering';
+        },
+        subscribe: (listener) => {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+    };
+}