@remnic/core 9.69.37 → 9.69.39

package/dist/chunk-CWTCMZGE.js

@@ -0,0 +1,858 @@
+import {
+  callCodexCliFallback,
+  getCodexCliFallbackRunnerForProcess,
+  isCodexCliFallbackRunnerRegistered,
+  normalizeCodexCliTimeoutMs,
+  setCodexCliFallbackRunnerForProcess
+} from "./chunk-E2AWJ7KQ.js";
+import {
+  launchProcess
+} from "./chunk-ZEFVK7XC.js";
+import {
+  expandTildePath
+} from "./chunk-6KH5NLQS.js";
+import {
+  raceAbort
+} from "./chunk-BTTPKDIL.js";
+import {
+  log
+} from "./chunk-3WCASNQZ.js";
+
+// src/providers/codex-subscription.ts
+import { mkdir, mkdtemp, readFile, rm, stat } from "fs/promises";
+import os from "os";
+import path from "path";
+var CODEX_SUBSCRIPTION_PROVIDER_ID = "codex-subscription";
+var CODEX_EXECUTABLE_ENV = "REMNIC_CODEX_EXECUTABLE";
+var DEFAULT_REASONING_EFFORT = "medium";
+var DEFAULT_TIMEOUT_MS = 12e4;
+var LOGIN_STATUS_TIMEOUT_MS = 1e4;
+var LOGIN_STATUS_CACHE_TTL_MS = 10 * 6e4;
+var STDIO_LIMIT = 64e3;
+var OUTPUT_SUMMARY_LIMIT = 500;
+var PATH_BEARING_ENV_KEYS = Object.freeze({ CODEX_HOME: true, HOME: true, USERPROFILE: true });
+var CODEX_RUNTIME_ENV_ALLOWLIST = Object.freeze({
+  ALL_PROXY: true,
+  APPDATA: true,
+  CODEX_HOME: true,
+  COLORTERM: true,
+  COMSPEC: true,
+  FORCE_COLOR: true,
+  HOME: true,
+  HOMEDRIVE: true,
+  HOMEPATH: true,
+  LANG: true,
+  LOCALAPPDATA: true,
+  LOGNAME: true,
+  NO_COLOR: true,
+  NODE_EXTRA_CA_CERTS: true,
+  NO_PROXY: true,
+  NUMBER_OF_PROCESSORS: true,
+  OS: true,
+  PATH: true,
+  PATHEXT: true,
+  PROGRAMDATA: true,
+  PROCESSOR_ARCHITECTURE: true,
+  HTTP_PROXY: true,
+  HTTPS_PROXY: true,
+  SHELL: true,
+  SSL_CERT_DIR: true,
+  SSL_CERT_FILE: true,
+  SYSTEMDRIVE: true,
+  SYSTEMROOT: true,
+  TEMP: true,
+  TERM: true,
+  TMP: true,
+  TMPDIR: true,
+  USER: true,
+  USERNAME: true,
+  USERPROFILE: true,
+  WINDIR: true,
+  XDG_CACHE_HOME: true,
+  XDG_CONFIG_HOME: true,
+  XDG_DATA_HOME: true,
+  XDG_RUNTIME_DIR: true
+});
+var LOGIN_OK_PATTERN = /logged in using chatgpt/i;
+var LOGIN_API_KEY_PATTERN = /api key/i;
+var AUTH_FAILURE_PATTERN = /\b401\b|\b403\b|unauthorized|forbidden|not logged in|no active|re-?authenticat|token expired|session expired|please log ?in/i;
+var TIMEOUT_PATTERN = /timed out after \d+ms/i;
+var SECRET_ECHO_PATTERNS = [
+  /sk-[A-Za-z0-9_-]{8,}/g,
+  /Bearer\s+[A-Za-z0-9._-]{8,}/g,
+  /eyJ[A-Za-z0-9._-]{10,}/g
+];
+function codexSubscriptionBuiltinProviderConfig() {
+  return {
+    baseUrl: "codex-cli://subscription",
+    api: "codex-cli",
+    models: []
+  };
+}
+var CodexSubscriptionAuthError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "CodexSubscriptionAuthError";
+    this.reason = reason;
+  }
+};
+var CodexSubscriptionConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodexSubscriptionConfigError";
+  }
+};
+var CodexSubscriptionTimeoutError = class extends Error {
+  constructor(timeoutMs) {
+    super(`codex-subscription request timed out after ${timeoutMs}ms`);
+    this.name = "TimeoutError";
+  }
+};
+var loginStatusCache = /* @__PURE__ */ new Map();
+var childrenByRunner = /* @__PURE__ */ new WeakMap();
+var runnerByOwner = /* @__PURE__ */ new WeakMap();
+var shutdownByRunner = /* @__PURE__ */ new WeakMap();
+var defaultRegisteredRunner;
+var coreRunnerRegistered = false;
+function createCodexSubscriptionRunner(deps = {}) {
+  const envSource = deps.env ?? process.env;
+  const children = /* @__PURE__ */ new Set();
+  const shutdown = new AbortController();
+  const runnerDeps = {
+    ...deps,
+    runCodexExec: deps.runCodexExec ?? ((request) => runCodexExecSubprocess(request, children)),
+    runLoginStatus: deps.runLoginStatus ?? ((executable, env, timeoutMs, signal) => runLoginStatusSubprocess(executable, env, timeoutMs, signal, children))
+  };
+  const runner = (request) => {
+    const signal = request.options.signal ? AbortSignal.any([request.options.signal, shutdown.signal]) : shutdown.signal;
+    if (signal.aborted) {
+      return Promise.reject(abortErrorOf(signal));
+    }
+    return runCodexSubscriptionRequest(
+      { ...request, options: { ...request.options, signal } },
+      runnerDeps,
+      envSource
+    );
+  };
+  childrenByRunner.set(runner, children);
+  shutdownByRunner.set(runner, shutdown);
+  return runner;
+}
+function getCodexSubscriptionRunnerForOwner(owner) {
+  let runner = runnerByOwner.get(owner);
+  const shutdown = runner ? shutdownByRunner.get(runner) : void 0;
+  if (!runner || shutdown?.signal.aborted) {
+    runner = createCodexSubscriptionRunner();
+    runnerByOwner.set(owner, runner);
+  }
+  return runner;
+}
+function getCodexSubscriptionShutdownSignal(runner) {
+  return shutdownByRunner.get(runner)?.signal;
+}
+function ensureCodexSubscriptionRunnerRegistered(deps = {}) {
+  if (isCodexCliFallbackRunnerRegistered()) return false;
+  defaultRegisteredRunner = createCodexSubscriptionRunner(deps);
+  setCodexCliFallbackRunnerForProcess(defaultRegisteredRunner);
+  coreRunnerRegistered = true;
+  return true;
+}
+function isDefaultRegisteredCodexSubscriptionRunner() {
+  return defaultRegisteredRunner !== void 0 && getCodexCliFallbackRunnerForProcess() === defaultRegisteredRunner;
+}
+function terminateActiveCodexSubscriptionChildren(signal = "SIGTERM", runner) {
+  const target = runner ?? defaultRegisteredRunner;
+  if (!target) return;
+  const shutdown = shutdownByRunner.get(target);
+  if (shutdown && !shutdown.signal.aborted) {
+    shutdown.abort(new DOMException("The operation was aborted.", "AbortError"));
+  }
+  const pids = childrenByRunner.get(target);
+  if (!pids) return;
+  for (const pid of pids) {
+    terminateCodexChildPid(pid, signal);
+  }
+}
+function beginCodexSubscriptionShutdown(runner, forceKillAfterMs = 1e3) {
+  terminateActiveCodexSubscriptionChildren("SIGTERM", runner);
+  const timer = setTimeout(() => {
+    terminateActiveCodexSubscriptionChildren("SIGKILL", runner);
+  }, forceKillAfterMs);
+  timer.unref();
+  return () => {
+    clearTimeout(timer);
+    terminateActiveCodexSubscriptionChildren("SIGKILL", runner);
+  };
+}
+async function runCodexSubscriptionRequest(request, deps, envSource) {
+  const { config } = request;
+  assertNoApiKeyConfig(config);
+  const executable = resolveExecutable(config, envSource);
+  const env = buildIsolatedEnv(envSource);
+  const providerTimeoutMs = config.retryOptions?.timeoutMs !== void 0 ? normalizeCodexCliTimeoutMs(config.retryOptions.timeoutMs) : void 0;
+  const timeoutMs = request.options.timeoutMs ?? providerTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const now = deps.now ?? Date.now;
+  const deadlineStartedAt = now();
+  if (request.options.signal?.aborted) {
+    throw abortErrorOf(request.options.signal);
+  }
+  await assertSubscriptionLogin(executable, env, deps, {
+    loginStatusTimeoutMs: Math.min(LOGIN_STATUS_TIMEOUT_MS, timeoutMs),
+    callerTimeoutMs: timeoutMs,
+    deadlineStartedAt,
+    signal: request.options.signal
+  });
+  if (request.options.signal?.aborted) {
+    throw abortErrorOf(request.options.signal);
+  }
+  const remainingTimeoutMs = timeoutMs - (now() - deadlineStartedAt);
+  if (remainingTimeoutMs <= 0) {
+    throw new CodexSubscriptionTimeoutError(timeoutMs);
+  }
+  let tempDir;
+  try {
+    tempDir = await mkdtemp(path.join(deps.tmpdir?.() ?? os.tmpdir(), "remnic-codex-sub-"));
+    const workspacePath = path.join(tempDir, "workspace");
+    const outputPath = path.join(tempDir, "last-message.txt");
+    await mkdir(workspacePath, { recursive: true });
+    const runCodexExec = deps.runCodexExec;
+    const result = await runCodexExec({
+      executable,
+      args: buildExecArgs(request.modelId, config, workspacePath, outputPath),
+      input: buildPrompt(request.messages),
+      env,
+      outputPath,
+      workspacePath,
+      timeoutMs: remainingTimeoutMs,
+      signal: request.options.signal
+    });
+    if (result.status !== 0) {
+      const failure = execFailureError(result, remainingTimeoutMs, executable, env);
+      if (failure instanceof CodexSubscriptionTimeoutError) {
+        throw failure;
+      }
+      if (request.options.signal?.aborted) {
+        throw abortErrorOf(request.options.signal);
+      }
+      throw failure;
+    }
+    if (request.options.signal?.aborted) {
+      throw abortErrorOf(request.options.signal);
+    }
+    const content = result.outputText.trim();
+    if (content.length === 0) {
+      throw new Error(
+        `codex-subscription: codex exec returned no final message (${summarizeOutput(result.stderr, result.stdout)})`
+      );
+    }
+    return { content, ...usageFrom(result) };
+  } finally {
+    if (tempDir) {
+      await rm(tempDir, { force: true, recursive: true }).catch(() => {
+      });
+    }
+  }
+}
+function assertNoApiKeyConfig(config) {
+  if (config.apiKey !== void 0 && config.apiKey !== "") {
+    throw new CodexSubscriptionConfigError(
+      `${CODEX_SUBSCRIPTION_PROVIDER_ID} does not accept apiKey configuration: it authenticates through the Codex CLI login. Remove the apiKey field and run \`codex login\` with a ChatGPT account instead.`
+    );
+  }
+}
+function resolveExecutable(config, env) {
+  const configured = config.codexCliExecutable ?? config.executable ?? env[CODEX_EXECUTABLE_ENV] ?? "codex";
+  const expanded = expandTildePath(String(configured).trim());
+  if (expanded.trim().length === 0) {
+    throw new CodexSubscriptionConfigError(`${CODEX_EXECUTABLE_ENV} / executable must not be empty`);
+  }
+  if (expanded.includes("/") || expanded.includes("\\")) {
+    return path.resolve(expanded);
+  }
+  return expanded;
+}
+function buildIsolatedEnv(source) {
+  const env = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (value !== void 0 && isAllowedEnvKey(key)) {
+      env[key] = PATH_BEARING_ENV_KEYS[key.toUpperCase()] === true ? normalizePathEnvValue(value) : value;
+    }
+  }
+  return env;
+}
+function normalizePathEnvValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return value;
+  }
+  const expanded = expandTildePath(trimmed);
+  return path.isAbsolute(expanded) ? expanded : path.resolve(expanded);
+}
+function isAllowedEnvKey(key) {
+  const normalized = key.toUpperCase();
+  return CODEX_RUNTIME_ENV_ALLOWLIST[normalized] === true || normalized.startsWith("LC_");
+}
+async function assertSubscriptionLogin(executable, env, deps, ctx) {
+  const now = deps.now ?? Date.now;
+  const cacheKey = `${executable}\0${resolveCodexAuthHome(env) ?? ""}`;
+  const cached = loginStatusCache.get(cacheKey);
+  if (cached && now() - cached.at < LOGIN_STATUS_CACHE_TTL_MS) {
+    if (!cached.settled || await authStoreFingerprint(env) === cached.fingerprint) {
+      await waitForLoginEntry(cached, cacheKey, ctx, now);
+      return;
+    }
+  }
+  loginStatusCache.delete(cacheKey);
+  if (ctx.signal?.aborted) {
+    throw abortErrorOf(ctx.signal);
+  }
+  const entry = {
+    at: now(),
+    fingerprint: null,
+    waiters: 0,
+    settled: false,
+    controller: new AbortController(),
+    promise: Promise.resolve(void 0)
+  };
+  entry.promise = runLoginStatusCheck(executable, env, deps, ctx, entry);
+  entry.promise.then(
+    () => {
+      entry.settled = true;
+    },
+    () => {
+      entry.settled = true;
+      if (loginStatusCache.get(cacheKey) === entry) {
+        loginStatusCache.delete(cacheKey);
+      }
+    }
+  );
+  loginStatusCache.set(cacheKey, entry);
+  await waitForLoginEntry(entry, cacheKey, ctx, now);
+}
+async function runLoginStatusCheck(executable, env, deps, ctx, entry) {
+  const runLoginStatus = deps.runLoginStatus;
+  const result = await runLoginStatus(executable, env, ctx.loginStatusTimeoutMs, entry.controller.signal);
+  const output = `${result.stdout}
+${result.stderr}`.trim();
+  if (TIMEOUT_PATTERN.test(output)) {
+    throw new CodexSubscriptionTimeoutError(ctx.loginStatusTimeoutMs);
+  }
+  if (result.status === 0 && LOGIN_OK_PATTERN.test(output)) {
+    entry.fingerprint = await authStoreFingerprint(env);
+    return;
+  }
+  const apiKeyNote = LOGIN_API_KEY_PATTERN.test(output) ? " The CLI currently reports an API-key login; subscription extraction needs a ChatGPT login." : "";
+  throw new CodexSubscriptionAuthError(
+    "unauthenticated",
+    `codex-subscription: no ChatGPT-backed Codex login found. Run \`codex login\` and choose the ChatGPT account option, then retry.${apiKeyNote}`
+  );
+}
+async function waitForLoginEntry(entry, cacheKey, ctx, now) {
+  const remainingMs = ctx.callerTimeoutMs - (now() - ctx.deadlineStartedAt);
+  if (remainingMs <= 0) {
+    throw new CodexSubscriptionTimeoutError(ctx.callerTimeoutMs);
+  }
+  const signal = ctx.signal;
+  let rejectOnAbort;
+  const abortWait = new Promise((_resolve, reject) => {
+    rejectOnAbort = reject;
+  });
+  const onAbort = () => {
+    if (signal === void 0) return;
+    rejectOnAbort(abortErrorOf(signal));
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+  entry.waiters++;
+  let deadlineTimer;
+  try {
+    await Promise.race([
+      entry.promise,
+      abortWait,
+      new Promise((_resolve, reject) => {
+        deadlineTimer = setTimeout(
+          () => reject(new CodexSubscriptionTimeoutError(ctx.callerTimeoutMs)),
+          remainingMs
+        );
+      })
+    ]);
+  } catch (err) {
+    if (signal?.aborted) {
+      throw abortErrorOf(signal);
+    }
+    throw err;
+  } finally {
+    clearTimeout(deadlineTimer);
+    signal?.removeEventListener("abort", onAbort);
+    entry.waiters--;
+    if (entry.waiters <= 0 && !entry.settled) {
+      entry.controller.abort();
+      if (loginStatusCache.get(cacheKey) === entry) {
+        loginStatusCache.delete(cacheKey);
+      }
+    }
+  }
+}
+async function authStoreFingerprint(env) {
+  const home = resolveCodexAuthHome(env);
+  if (!home) {
+    return null;
+  }
+  try {
+    const stats = await stat(path.join(home, "auth.json"));
+    return `${stats.mtimeMs}:${stats.size}`;
+  } catch {
+    return null;
+  }
+}
+function resolveCodexAuthHome(env) {
+  if (env.CODEX_HOME) return env.CODEX_HOME;
+  const profile = env.HOME ?? env.USERPROFILE;
+  return profile ? path.join(profile, ".codex") : void 0;
+}
+function buildExecArgs(modelId, config, workspacePath, outputPath) {
+  const reasoningEffort = readReasoningEffort(config) ?? DEFAULT_REASONING_EFFORT;
+  return [
+    "exec",
+    "--strict-config",
+    "--model",
+    modelId,
+    "--config",
+    `model_reasoning_effort=${JSON.stringify(reasoningEffort)}`,
+    "--config",
+    'approval_policy="never"',
+    "--config",
+    'web_search="disabled"',
+    "--disable",
+    "hooks",
+    "--disable",
+    "shell_tool",
+    "--disable",
+    "unified_exec",
+    "--disable",
+    "apps",
+    "--disable",
+    "plugins",
+    "--disable",
+    "remote_plugin",
+    "--disable",
+    "multi_agent",
+    "--disable",
+    "browser_use",
+    "--disable",
+    "browser_use_external",
+    "--disable",
+    "computer_use",
+    "--disable",
+    "image_generation",
+    "--disable",
+    "in_app_browser",
+    "--disable",
+    "goals",
+    "--disable",
+    "memories",
+    "--disable",
+    "chronicle",
+    "--disable",
+    "tool_suggest",
+    "--disable",
+    "workspace_dependencies",
+    "--disable",
+    "shell_snapshot",
+    "--ephemeral",
+    "--ignore-user-config",
+    "--ignore-rules",
+    "--sandbox",
+    "read-only",
+    "--cd",
+    workspacePath,
+    "--skip-git-repo-check",
+    "--json",
+    "--output-last-message",
+    outputPath,
+    "-"
+  ];
+}
+function readReasoningEffort(config) {
+  for (const value of [config.codexCliReasoningEffort, config.reasoningEffort]) {
+    if (typeof value === "string") {
+      const normalized = value.trim().toLowerCase();
+      if (normalized === "low" || normalized === "medium" || normalized === "high" || normalized === "xhigh") {
+        return normalized;
+      }
+      throw new CodexSubscriptionConfigError(
+        "codex-subscription reasoningEffort must be one of low, medium, high, xhigh (got unrecognized value)"
+      );
+    }
+  }
+  return void 0;
+}
+function buildPrompt(messages) {
+  const transcript = messages.map((message) => JSON.stringify({ role: message.role, content: message.content })).join("\n");
+  return [
+    "You are acting as an LLM completion endpoint for a memory-extraction pipeline, not as a coding agent.",
+    "Answer the request in the transcript below. Do not inspect files, run commands, browse, or use tools.",
+    "Return only the final answer text. If the request asks for JSON, return raw JSON only.",
+    "",
+    'TRANSCRIPT (JSON Lines: one {"role":"...","content":"..."} object per message; newlines inside content are escaped):',
+    transcript
+  ].join("\n");
+}
+function execFailureError(result, timeoutMs, executable, env) {
+  const combined = `${result.stderr}
+${result.stdout}`;
+  if (TIMEOUT_PATTERN.test(combined)) {
+    return new CodexSubscriptionTimeoutError(timeoutMs);
+  }
+  if (AUTH_FAILURE_PATTERN.test(combined)) {
+    loginStatusCache.delete(`${executable}\0${env.CODEX_HOME ?? env.HOME ?? ""}`);
+    return new CodexSubscriptionAuthError(
+      "expired_or_revoked",
+      "codex-subscription: the Codex CLI rejected the request as unauthenticated (session expired or revoked). Run `codex login` again to re-authenticate, then retry."
+    );
+  }
+  const exitLabel = result.signal ? `signal ${result.signal}` : `exit ${result.status ?? "unknown"}`;
+  return new Error(
+    `codex-subscription: codex exec failed (${exitLabel}): ${summarizeOutput(result.stderr, result.stdout)}`
+  );
+}
+function summarizeOutput(stderr, stdout) {
+  const summary = [stderr.trim(), stdout.trim()].filter((part) => part.length > 0).join("\n");
+  if (summary.length === 0) {
+    return "no process output";
+  }
+  return redactSecretEchoes(summary).slice(-OUTPUT_SUMMARY_LIMIT);
+}
+function redactSecretEchoes(value) {
+  let redacted = value;
+  for (const pattern of SECRET_ECHO_PATTERNS) {
+    redacted = redacted.replace(pattern, "[redacted]");
+  }
+  return redacted;
+}
+function usageFrom(result) {
+  const usage = parseCodexJsonlUsage(`${result.stdout}
+${result.stderr}`);
+  if (!usage) {
+    return {};
+  }
+  return {
+    usage: {
+      inputTokens: usage.inputTokens,
+      outputTokens: usage.outputTokens,
+      totalTokens: usage.inputTokens + usage.outputTokens
+    }
+  };
+}
+function parseCodexJsonlUsage(output) {
+  let usage;
+  for (const line of output.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("{")) continue;
+    try {
+      const event = JSON.parse(trimmed);
+      if (event.type !== "turn.completed" || !event.usage) continue;
+      const inputTokens = readCounter(event.usage.input_tokens);
+      const outputTokens = readCounter(event.usage.output_tokens);
+      if (inputTokens !== void 0 && outputTokens !== void 0) {
+        usage = { inputTokens, outputTokens };
+      }
+    } catch {
+    }
+  }
+  return usage;
+}
+function readCounter(value) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    return void 0;
+  }
+  return value;
+}
+function abortErrorOf(signal) {
+  if (signal.reason instanceof CodexSubscriptionTimeoutError) return signal.reason;
+  const reason = signal.reason instanceof Error ? signal.reason : signal.reason !== void 0 ? new Error(String(signal.reason)) : new DOMException("The operation was aborted.", "AbortError");
+  const match = /fallback LLM timed out after (\d+)ms/i.exec(reason.message);
+  if (match) {
+    return new CodexSubscriptionTimeoutError(Number(match[1]));
+  }
+  return reason;
+}
+function appendBounded(existing, next) {
+  const redacted = redactSecretEchoes(existing + next);
+  return redacted.length > STDIO_LIMIT ? redacted.slice(-STDIO_LIMIT) : redacted;
+}
+async function runLoginStatusSubprocess(executable, env, timeoutMs, signal, children) {
+  return await runSubprocess(executable, ["login", "status"], {
+    env,
+    stdin: void 0,
+    timeoutMs,
+    timeoutLabel: "login status",
+    signal,
+    children
+  });
+}
+async function runCodexExecSubprocess(request, children) {
+  const result = await runSubprocess(request.executable, request.args, {
+    env: request.env,
+    stdin: request.input,
+    timeoutMs: request.timeoutMs,
+    timeoutLabel: "exec",
+    signal: request.signal,
+    cwd: request.workspacePath,
+    children
+  });
+  if (result.status === 124) return { ...result, outputText: "" };
+  let outputText = "";
+  try {
+    outputText = (await readFile(request.outputPath, "utf8")).trim();
+  } catch {
+  }
+  return { ...result, outputText };
+}
+async function runSubprocess(executable, args, options) {
+  return await new Promise((resolve, reject) => {
+    if (options.signal?.aborted) {
+      reject(abortErrorOf(options.signal));
+      return;
+    }
+    const child = launchProcess(executable, args, {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      env: options.env,
+      stdio: [options.stdin === void 0 ? "ignore" : "pipe", "pipe", "pipe"],
+      detached: process.platform !== "win32",
+      windowsHide: true
+    });
+    registerActiveCodexChild(child.pid, options.children);
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    let killTimeout;
+    const clearKillTimeout = () => {
+      if (killTimeout) {
+        clearTimeout(killTimeout);
+        killTimeout = void 0;
+      }
+    };
+    const terminate = (signal) => {
+      if (child.pid && process.platform !== "win32") {
+        try {
+          process.kill(-child.pid, signal);
+          return;
+        } catch {
+        }
+      }
+      child.kill(signal);
+    };
+    const scheduleForcedKill = () => {
+      clearKillTimeout();
+      killTimeout = setTimeout(() => terminate("SIGKILL"), 1e3);
+      killTimeout.unref();
+    };
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      options.signal?.removeEventListener("abort", onAbort);
+      fn();
+    };
+    const settleTimeout = () => {
+      timedOut = true;
+      stderr = appendBounded(
+        stderr,
+        `
+codex-subscription: ${options.timeoutLabel} timed out after ${options.timeoutMs}ms.`
+      );
+      finish(() => {
+        resolve({
+          status: 124,
+          signal: "SIGTERM",
+          stdout,
+          stderr
+        });
+      });
+    };
+    const onAbort = () => {
+      const reasonText = options.signal?.reason instanceof Error ? options.signal.reason.message : String(options.signal?.reason ?? "");
+      terminate("SIGTERM");
+      scheduleForcedKill();
+      if (/fallback LLM timed out after \d+ms/i.test(reasonText)) {
+        settleTimeout();
+        return;
+      }
+      finish(() => reject(abortErrorOf(options.signal)));
+    };
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    const timeout = options.timeoutMs ? setTimeout(() => {
+      terminate("SIGTERM");
+      scheduleForcedKill();
+      settleTimeout();
+    }, options.timeoutMs) : void 0;
+    timeout?.unref();
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout = appendBounded(stdout, chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr = appendBounded(stderr, chunk);
+    });
+    child.stdin?.on("error", (error) => {
+      stderr = appendBounded(stderr, `
+codex-subscription: stdin error: ${error.code ?? error.message}`);
+    });
+    child.on("error", (error) => {
+      unregisterActiveCodexChild(child.pid, options.children);
+      finish(() => {
+        reject(
+          child.pid ? new Error(`codex-subscription: codex CLI failed after start: ${safeMessage(error)}`, { cause: error }) : new CodexSubscriptionAuthError(
+            "unauthenticated",
+            `codex-subscription: codex CLI not found at \`${executable}\` \u2014 install the Codex CLI and run \`codex login\` with a ChatGPT account, then retry.`
+          )
+        );
+      });
+    });
+    child.on("close", (status, signal) => {
+      clearKillTimeout();
+      unregisterActiveCodexChild(child.pid, options.children);
+      finish(() => {
+        resolve({
+          status: timedOut ? status === null || status === 0 ? 124 : status : status,
+          signal: timedOut ? signal ?? "SIGTERM" : signal,
+          stdout,
+          stderr
+        });
+      });
+    });
+    if (options.stdin !== void 0) {
+      try {
+        child.stdin?.end(options.stdin);
+      } catch (error) {
+        log.debug(`codex-subscription: failed writing prompt to stdin: ${safeMessage(error)}`);
+      }
+    }
+  });
+}
+function safeMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function registerActiveCodexChild(pid, children) {
+  if (pid === void 0) return;
+  children.add(pid);
+}
+function unregisterActiveCodexChild(pid, children) {
+  if (pid === void 0) return;
+  children.delete(pid);
+}
+function terminateCodexChildPid(pid, signal) {
+  if (process.platform !== "win32") {
+    try {
+      process.kill(-pid, signal);
+      return;
+    } catch {
+    }
+  }
+  try {
+    process.kill(pid, signal);
+  } catch {
+  }
+}
+
+// src/fallback-llm-codex-subscription.ts
+function isTerminalCodexSubscriptionError(error) {
+  return error instanceof CodexSubscriptionTimeoutError || error instanceof CodexSubscriptionAuthError || error instanceof CodexSubscriptionConfigError;
+}
+async function raceFallbackLlmDeadline(work, timeoutMs, abortOnTimeout) {
+  const deadline = new AbortController();
+  const timer = setTimeout(() => deadline.abort(), timeoutMs);
+  deadline.signal.addEventListener("abort", abortOnTimeout, { once: true });
+  try {
+    const value = await raceAbort(
+      work,
+      deadline.signal,
+      `fallback LLM timed out after ${timeoutMs}ms`
+    );
+    return { timedOut: false, value };
+  } catch (error) {
+    if (!deadline.signal.aborted) throw error;
+    const afterAbort = await Promise.race([
+      work.then(
+        (value) => ({ state: "value", value }),
+        (lateError) => ({ state: "error", error: lateError })
+      ),
+      new Promise((resolve) => {
+        setImmediate(() => resolve({ state: "pending" }));
+      })
+    ]);
+    if (afterAbort.state === "value") return { timedOut: false, value: afterAbort.value };
+    if (afterAbort.state === "error") throw afterAbort.error;
+    void work.then(
+      () => void 0,
+      () => void 0
+    );
+    return { timedOut: true };
+  } finally {
+    clearTimeout(timer);
+    deadline.signal.removeEventListener("abort", abortOnTimeout);
+  }
+}
+async function tryCodexSubscriptionProvider(model, messages, options, resolveFallbackApiKey, runner) {
+  if (model.providerConfig.api !== "codex-cli") return void 0;
+  if (model.providerId === CODEX_SUBSCRIPTION_PROVIDER_ID) {
+    assertNoApiKeyConfig(model.providerConfig);
+  }
+  const resolvedApiKey = model.providerConfig.apiKey === void 0 ? void 0 : await resolveFallbackApiKey();
+  const rawKey = model.providerConfig.apiKey;
+  const needsResolution = rawKey === "secretref-managed" || typeof rawKey === "object" && rawKey !== null;
+  if (needsResolution && !resolvedApiKey) {
+    throw new Error(`API key for provider "${model.providerId}" could not be resolved from secret ref`);
+  }
+  const effectiveConfig = {
+    ...model.providerConfig,
+    ...resolvedApiKey ? { apiKey: resolvedApiKey } : {}
+  };
+  const callOptions = {
+    timeoutMs: options.timeoutMs === void 0 ? void 0 : Math.max(1, options.timeoutMs - Math.min(100, Math.max(5, Math.floor(options.timeoutMs / 5)))),
+    signal: options.signal
+  };
+  if (isCodexCliFallbackRunnerRegistered() && !(runner && isDefaultRegisteredCodexSubscriptionRunner())) {
+    return await callCodexCliFallback(effectiveConfig, model.modelId, messages, callOptions);
+  }
+  if (runner) {
+    return await callCodexCliFallback(effectiveConfig, model.modelId, messages, callOptions, runner);
+  }
+  ensureCodexSubscriptionRunnerRegistered();
+  return await callCodexCliFallback(effectiveConfig, model.modelId, messages, callOptions);
+}
+function abortReason(signal) {
+  const reason = signal?.reason;
+  return reason instanceof Error ? reason : new Error("fallback LLM request aborted");
+}
+function withCodexRuntimeShutdown(options, runner) {
+  if (!runner) return options;
+  const shutdown = getCodexSubscriptionShutdownSignal(runner);
+  if (!shutdown) return options;
+  return {
+    ...options,
+    signal: options.signal ? AbortSignal.any([options.signal, shutdown]) : shutdown
+  };
+}
+
+export {
+  CODEX_SUBSCRIPTION_PROVIDER_ID,
+  codexSubscriptionBuiltinProviderConfig,
+  CodexSubscriptionAuthError,
+  CodexSubscriptionConfigError,
+  CodexSubscriptionTimeoutError,
+  createCodexSubscriptionRunner,
+  getCodexSubscriptionRunnerForOwner,
+  ensureCodexSubscriptionRunnerRegistered,
+  terminateActiveCodexSubscriptionChildren,
+  beginCodexSubscriptionShutdown,
+  isTerminalCodexSubscriptionError,
+  raceFallbackLlmDeadline,
+  tryCodexSubscriptionProvider,
+  abortReason,
+  withCodexRuntimeShutdown
+};
+//# sourceMappingURL=chunk-CWTCMZGE.js.map