@right-link/paperclip-plugin-codex-remote 0.3.1 → 0.3.2

package/dist/server/codex-home.js

@@ -1,378 +0,0 @@
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { resolvePaperclipInstanceRootForAdapter } from "@paperclipai/adapter-utils/server-utils";
-const TRUTHY_ENV_RE = /^(1|true|yes|on)$/i;
-const COPIED_SHARED_FILES = ["config.json", "config.toml", "instructions.md"];
-const SYMLINKED_SHARED_FILES = ["auth.json"];
-// Allowlist for the config.toml shipped into a remote sandbox. We send ONLY
-// what Codex needs to run against the configured model provider, and nothing
-// else — no `mcp_servers` (whose host binaries don't exist in the sandbox and
-// stall Codex for each server's startup_timeout_sec), no project trust lists,
-// plugins, marketplaces, desktop/Windows settings, etc.
-//
-// Kept top-level keys (everything else in the preamble is dropped):
-const REMOTE_KEPT_TOP_LEVEL_KEYS = new Set([
-    "model",
-    "model_provider",
-    "model_reasoning_effort",
-    "model_reasoning_summary",
-    "model_verbosity",
-    "model_supports_reasoning_summaries",
-    "approval_policy",
-    "preferred_auth_method",
-    "check_for_update_on_startup",
-    "web_search",
-    "personality",
-]);
-// Kept sections: only the model provider definitions (e.g.
-// `[model_providers.cliproxyapi]` and any sub-tables).
-const REMOTE_KEPT_SECTION_ROOT = "model_providers";
-/** Returns the dotted segments of a TOML table header, or null if not a header. */
-function parseTomlSectionSegments(line) {
-    const match = /^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*$/.exec(line);
-    if (!match)
-        return null;
-    return match[1].split(".").map((segment) => segment.trim().replace(/^['"]|['"]$/g, ""));
-}
-function parseTomlStringValue(line) {
-    const match = /^\s*[A-Za-z0-9_-]+\s*=\s*(['"])(.*?)\1\s*(?:#.*)?$/.exec(line);
-    return match?.[2] ?? null;
-}
-function tomlString(value) {
-    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-/**
- * Reduces a Codex `config.toml` to the minimum needed inside a remote sandbox:
- * the allowlisted top-level keys ({@link REMOTE_KEPT_TOP_LEVEL_KEYS}) plus the
- * `[model_providers.*]` sections. Everything else — MCP servers, project trust
- * lists, plugins, marketplaces, desktop/Windows host settings — is dropped, so
- * Codex starts clean and fast and never tries to launch host-only tooling.
- *
- * Each provider also gets `supports_websockets = false` injected: Codex defaults
- * to a `wss://` transport for the Responses API, but a sandbox reaching the
- * provider through a userspace-Tailscale HTTP proxy cannot open that WebSocket,
- * so Codex burns ~75s retrying it before falling back to HTTP on every run (the
- * misleading "failed to refresh available models: timeout waiting for child
- * process to exit"). Forcing HTTP removes that stall.
- */
-export function sanitizeRemoteCodexConfigToml(toml) {
-    const lines = toml.split(/\r?\n/);
-    const preamble = new Map();
-    const sections = [];
-    const providerNames = [];
-    let configuredProvider = null;
-    let inPreamble = true;
-    let currentSection = null;
-    for (const line of lines) {
-        const segments = parseTomlSectionSegments(line);
-        if (segments) {
-            inPreamble = false;
-            currentSection = null;
-            if (segments[0]?.toLowerCase() === REMOTE_KEPT_SECTION_ROOT) {
-                currentSection = { header: line, segments, lines: [] };
-                sections.push(currentSection);
-                if (segments.length === 2 && segments[1]) {
-                    providerNames.push(segments[1]);
-                }
-            }
-            continue;
-        }
-        if (inPreamble) {
-            const key = /^\s*([A-Za-z0-9_-]+)\s*=/.exec(line);
-            if (key && REMOTE_KEPT_TOP_LEVEL_KEYS.has(key[1].toLowerCase())) {
-                const normalizedKey = key[1].toLowerCase();
-                preamble.set(normalizedKey, line);
-                if (normalizedKey === "model_provider") {
-                    configuredProvider = parseTomlStringValue(line);
-                }
-            }
-            continue;
-        }
-        if (currentSection) {
-            currentSection.lines.push(line);
-        }
-    }
-    const activeProvider = configuredProvider && configuredProvider.toLowerCase() !== "openai" && providerNames.includes(configuredProvider)
-        ? configuredProvider
-        : providerNames.find((provider) => provider.toLowerCase() !== "openai") ?? configuredProvider ?? providerNames[0] ?? null;
-    if (activeProvider) {
-        preamble.set("model_provider", `model_provider = ${tomlString(activeProvider)}`);
-    }
-    preamble.set("preferred_auth_method", 'preferred_auth_method = "apikey"');
-    preamble.set("check_for_update_on_startup", "check_for_update_on_startup = false");
-    preamble.set("web_search", 'web_search = "disabled"');
-    const out = [...preamble.values()];
-    for (const section of sections) {
-        if (out.length > 0 && out[out.length - 1] !== "")
-            out.push("");
-        out.push(section.header);
-        const isProviderMainSection = section.segments.length === 2;
-        for (const line of section.lines) {
-            const key = /^\s*([A-Za-z0-9_-]+)\s*=/.exec(line);
-            if (isProviderMainSection &&
-                key &&
-                ["requires_openai_auth", "supports_websockets"].includes(key[1].toLowerCase())) {
-                continue;
-            }
-            out.push(line);
-        }
-        if (isProviderMainSection) {
-            out.push("requires_openai_auth = false");
-            out.push("supports_websockets = false");
-        }
-    }
-    if (out.length > 0 && out[out.length - 1] !== "")
-        out.push("");
-    out.push("[features]");
-    out.push("browser_use = false");
-    out.push("in_app_browser = false");
-    out.push("computer_use = false");
-    return out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
-}
-/**
- * Injects `supports_websockets = false` into every `[model_providers.<name>]`
- * section that does not already set the flag. Unlike
- * {@link sanitizeRemoteCodexConfigToml}, this preserves all other config
- * content — it is safe to apply to both local and remote config copies.
- */
-export function injectWebsocketsDisabled(toml) {
-    const lines = toml.split(/\r?\n/);
-    const out = [];
-    let inProviderMainSection = false;
-    let providerHasWebsocketsFlag = false;
-    const closeProviderSection = () => {
-        if (inProviderMainSection && !providerHasWebsocketsFlag) {
-            out.push("supports_websockets = false");
-        }
-        inProviderMainSection = false;
-        providerHasWebsocketsFlag = false;
-    };
-    for (const line of lines) {
-        const segments = parseTomlSectionSegments(line);
-        if (segments) {
-            closeProviderSection();
-            inProviderMainSection = segments[0]?.toLowerCase() === REMOTE_KEPT_SECTION_ROOT && segments.length === 2;
-            out.push(line);
-            continue;
-        }
-        if (inProviderMainSection) {
-            const key = /^\s*([A-Za-z0-9_-]+)\s*=/.exec(line);
-            if (key && key[1].toLowerCase() === "supports_websockets") {
-                providerHasWebsocketsFlag = true;
-            }
-        }
-        out.push(line);
-    }
-    closeProviderSection();
-    return out.join("\n");
-}
-/**
- * Builds a throwaway Codex home directory suitable for syncing into a remote
- * sandbox: the same auth/instructions as the managed home, but with a
- * sandbox-sanitized `config.toml` (see {@link sanitizeRemoteCodexConfigToml}).
- * The caller must invoke `cleanup()` when the run finishes.
- */
-export async function prepareRemoteCodexHomeAsset(sourceHome) {
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-remote-home-"));
-    const cleanup = async () => {
-        await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
-    };
-    try {
-        const configSource = path.join(sourceHome, "config.toml");
-        if (await pathExists(configSource)) {
-            const raw = await fs.readFile(configSource, "utf8");
-            await fs.writeFile(path.join(dir, "config.toml"), sanitizeRemoteCodexConfigToml(raw), { mode: 0o600 });
-        }
-        // Do not copy auth.json into remote sandboxes. Remote runs should use the
-        // sanitized config.toml provider credentials; copying ChatGPT-mode auth can
-        // make Codex start account/plugin background transports that are irrelevant
-        // in a sandbox and can stall startup.
-        for (const name of ["config.json", "instructions.md"]) {
-            const src = path.join(sourceHome, name);
-            if (await pathExists(src)) {
-                await fs.copyFile(src, path.join(dir, name));
-            }
-        }
-        return { dir, cleanup };
-    }
-    catch (error) {
-        await cleanup();
-        throw error;
-    }
-}
-function nonEmpty(value) {
-    return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-export async function pathExists(candidate) {
-    return fs.access(candidate).then(() => true).catch(() => false);
-}
-export function resolveSharedCodexHomeDir(env = process.env) {
-    const fromEnv = nonEmpty(env.CODEX_HOME);
-    return fromEnv ? path.resolve(fromEnv) : path.join(os.homedir(), ".codex");
-}
-function isWorktreeMode(env) {
-    return TRUTHY_ENV_RE.test(env.PAPERCLIP_IN_WORKTREE ?? "");
-}
-export function resolveManagedCodexHomeDir(env, companyId) {
-    const instanceRoot = resolvePaperclipInstanceRootForAdapter({
-        homeDir: nonEmpty(env.PAPERCLIP_HOME) ?? undefined,
-        instanceId: nonEmpty(env.PAPERCLIP_INSTANCE_ID) ?? undefined,
-        env,
-    });
-    return companyId
-        ? path.resolve(instanceRoot, "companies", companyId, "codex-home")
-        : path.resolve(instanceRoot, "codex-home");
-}
-async function ensureParentDir(target) {
-    await fs.mkdir(path.dirname(target), { recursive: true });
-}
-async function isExpectedSymlink(target, source) {
-    const existing = await fs.lstat(target).catch(() => null);
-    if (!existing?.isSymbolicLink())
-        return false;
-    const linkedPath = await fs.readlink(target).catch(() => null);
-    if (!linkedPath)
-        return false;
-    return path.resolve(path.dirname(target), linkedPath) === path.resolve(source);
-}
-async function createExpectedSymlink(target, source) {
-    try {
-        await fs.symlink(source, target);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "EEXIST" && await isExpectedSymlink(target, source))
-            return;
-        throw error;
-    }
-}
-function isSymlinkPermissionError(error) {
-    const code = error.code;
-    return code === "EPERM" || code === "EACCES";
-}
-async function ensureSymlinkOrCopy(target, source) {
-    const existing = await fs.lstat(target).catch(() => null);
-    if (!existing) {
-        await ensureParentDir(target);
-        try {
-            await createExpectedSymlink(target, source);
-            return "symlink";
-        }
-        catch (error) {
-            if (!isSymlinkPermissionError(error))
-                throw error;
-            await fs.copyFile(source, target);
-            return "copy";
-        }
-    }
-    if (!existing.isSymbolicLink()) {
-        return "copy";
-    }
-    if (await isExpectedSymlink(target, source))
-        return "symlink";
-    await fs.unlink(target);
-    try {
-        await createExpectedSymlink(target, source);
-        return "symlink";
-    }
-    catch (error) {
-        if (!isSymlinkPermissionError(error))
-            throw error;
-        await fs.copyFile(source, target);
-        return "copy";
-    }
-}
-async function filesHaveSameContent(target, source) {
-    const [targetBuf, sourceBuf] = await Promise.all([
-        fs.readFile(target).catch(() => null),
-        fs.readFile(source).catch(() => null),
-    ]);
-    if (!targetBuf || !sourceBuf)
-        return false;
-    return targetBuf.equals(sourceBuf);
-}
-/**
- * Copies a shared Codex config file (e.g. `config.toml`) into the managed home,
- * refreshing it whenever the source content changes. The managed copy is purely
- * a mirror of the shared file — nothing else writes to it — so keeping it in
- * sync prevents a stale config (e.g. an outdated provider `base_url`, bearer
- * token, or `requires_openai_auth` flag) from being shipped into the sandbox
- * after the host config is edited.
- */
-async function ensureCopiedFile(target, source) {
-    const existing = await fs.lstat(target).catch(() => null);
-    if (existing && !existing.isSymbolicLink() && (await filesHaveSameContent(target, source))) {
-        return false;
-    }
-    await ensureParentDir(target);
-    await fs.rm(target, { force: true });
-    await fs.copyFile(source, target);
-    return true;
-}
-/**
- * Writes an `auth.json` containing only `OPENAI_API_KEY` so the codex CLI can
- * authenticate via API key. Overwrites any existing file or symlink at that
- * path. Required because the codex CLI (>= 0.122) ignores the `OPENAI_API_KEY`
- * environment variable and only reads credentials from `$CODEX_HOME/auth.json`.
- */
-export async function writeApiKeyAuthJson(home, apiKey) {
-    await fs.mkdir(home, { recursive: true });
-    const target = path.join(home, "auth.json");
-    await fs.rm(target, { force: true });
-    await fs.writeFile(target, JSON.stringify({ OPENAI_API_KEY: apiKey }), { mode: 0o600 });
-}
-export async function prepareManagedCodexHome(env, onLog, companyId, options = {}) {
-    const targetHome = resolveManagedCodexHomeDir(env, companyId);
-    const apiKey = nonEmpty(options.apiKey ?? undefined);
-    const sourceHome = resolveSharedCodexHomeDir(env);
-    const seedFromShared = path.resolve(sourceHome) !== path.resolve(targetHome);
-    await fs.mkdir(targetHome, { recursive: true });
-    // If a previous run wrote an apikey-mode auth.json (regular file) and this
-    // run has no apiKey, remove it so the chatgpt-mode symlink can be restored.
-    // Without this cleanup, ensureSymlink bails on a non-symlink and Codex keeps
-    // authenticating with the stale key after it is removed from configuration.
-    if (!apiKey && seedFromShared) {
-        const authPath = path.join(targetHome, "auth.json");
-        const existing = await fs.lstat(authPath).catch(() => null);
-        if (existing && !existing.isSymbolicLink()) {
-            await fs.rm(authPath, { force: true });
-        }
-    }
-    if (seedFromShared) {
-        let copiedSharedAuth = false;
-        for (const name of SYMLINKED_SHARED_FILES) {
-            const source = path.join(sourceHome, name);
-            if (!(await pathExists(source)))
-                continue;
-            const mode = await ensureSymlinkOrCopy(path.join(targetHome, name), source);
-            copiedSharedAuth ||= mode === "copy";
-        }
-        const refreshedConfigFiles = [];
-        for (const name of COPIED_SHARED_FILES) {
-            const source = path.join(sourceHome, name);
-            if (!(await pathExists(source)))
-                continue;
-            if (await ensureCopiedFile(path.join(targetHome, name), source)) {
-                refreshedConfigFiles.push(name);
-            }
-        }
-        // Ensure Codex uses HTTP transport for model providers — avoids the ~75s
-        // WebSocket retry on every run when the provider doesn't support wss://.
-        const managedConfigToml = path.join(targetHome, "config.toml");
-        if (await pathExists(managedConfigToml)) {
-            const raw = await fs.readFile(managedConfigToml, "utf8");
-            const patched = injectWebsocketsDisabled(raw);
-            if (patched !== raw) {
-                await fs.writeFile(managedConfigToml, patched, { mode: 0o600 });
-            }
-        }
-        await onLog("stdout", `[paperclip] Using ${isWorktreeMode(env) ? "worktree-isolated" : "Paperclip-managed"} Codex home "${targetHome}" (seeded from "${sourceHome}"${copiedSharedAuth ? "; copied auth.json because symlinks are unavailable" : ""}${refreshedConfigFiles.length > 0 ? `; refreshed ${refreshedConfigFiles.join(", ")} from shared config` : ""}).\n`);
-    }
-    if (apiKey) {
-        await writeApiKeyAuthJson(targetHome, apiKey);
-        await onLog("stdout", `[paperclip] Wrote API-key auth.json into Codex home "${targetHome}" from configured OPENAI_API_KEY.\n`);
-    }
-    return targetHome;
-}
-//# sourceMappingURL=codex-home.js.map

package/dist/server/codex-home.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codex-home.js","sourceRoot":"","sources":["../../src/server/codex-home.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,iBAAiB,CAAU,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,WAAW,CAAU,CAAC;AAEtD,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,oEAAoE;AACpE,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO;IACP,gBAAgB;IAChB,wBAAwB;IACxB,yBAAyB;IACzB,iBAAiB;IACjB,oCAAoC;IACpC,iBAAiB;IACjB,uBAAuB;IACvB,6BAA6B;IAC7B,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AACH,2DAA2D;AAC3D,uDAAuD;AACvD,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAEnD,mFAAmF;AACnF,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,QAAQ,GAAmE,EAAE,CAAC;IACpF,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,cAAc,GAAmE,IAAI,CAAC;IAE1F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,GAAG,KAAK,CAAC;YACnB,cAAc,GAAG,IAAI,CAAC;YACtB,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,wBAAwB,EAAE,CAAC;gBAC5D,cAAc,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBACvD,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACjE,MAAM,aAAa,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;gBAC5C,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;gBAClC,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;oBACvC,kBAAkB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAClB,kBAAkB,IAAI,kBAAkB,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC/G,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,kBAAkB,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAE9H,IAAI,cAAc,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,kCAAkC,CAAC,CAAC;IAC1E,QAAQ,CAAC,GAAG,CAAC,6BAA6B,EAAE,qCAAqC,CAAC,CAAC;IACnF,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IAEtD,MAAM,GAAG,GAAa,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IACE,qBAAqB;gBACrB,GAAG;gBACH,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,EAC/E,CAAC;gBACD,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACnC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAEjC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,yBAAyB,GAAG,KAAK,CAAC;IAEtC,MAAM,oBAAoB,GAAG,GAAG,EAAE;QAChC,IAAI,qBAAqB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC1C,CAAC;QACD,qBAAqB,GAAG,KAAK,CAAC;QAC9B,yBAAyB,GAAG,KAAK,CAAC;IACpC,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,oBAAoB,EAAE,CAAC;YACvB,qBAAqB,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,wBAAwB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;YACzG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB,EAAE,CAAC;gBAC3D,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,oBAAoB,EAAE,CAAC;IACvB,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,6BAA6B,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,sCAAsC;QACtC,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,GAAsB;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAAsB,EACtB,SAAkB;IAElB,MAAM,YAAY,GAAG,sCAAsC,CAAC;QAC1D,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;QAClD,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,SAAS;QAC5D,GAAG;KACJ,CAAC,CAAC;IACH,OAAO,SAAS;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC7D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAc,EAAE,MAAc;IACjE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;IACnD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,MAAc;IAC/D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9D,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IAChE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACrC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC5D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAc;IACpE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAsB,EACtB,KAAuC,EACvC,SAAkB,EAClB,UAAsC,EAAE;IAExC,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE7E,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC1C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5E,gBAAgB,KAAK,IAAI,KAAK,MAAM,CAAC;QACvC,CAAC;QAED,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC1C,IAAI,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;gBAChE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,MAAM,KAAK,CACT,QAAQ,EACR,qBAAqB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,gBAAgB,UAAU,mBAAmB,UAAU,IAAI,gBAAgB,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,EAAE,GAAG,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,MAAM,CAChV,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,CACT,QAAQ,EACR,wDAAwD,UAAU,qCAAqC,CACxG,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/server/codex-home.test.js

@@ -1,244 +0,0 @@
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { pathExists, prepareManagedCodexHome, prepareRemoteCodexHomeAsset, sanitizeRemoteCodexConfigToml } from "./codex-home.js";
-describe("sanitizeRemoteCodexConfigToml", () => {
-    it("keeps only allowlisted top-level keys and model_providers sections", () => {
-        const toml = [
-            "windows_wsl_setup_acknowledged = true",
-            'model = "gpt-5.5"',
-            'model_provider = "cliproxyapi"',
-            'model_reasoning_effort = "medium"',
-            'personality = "pragmatic"',
-            'preferred_auth_method = "chatgpt"',
-            "check_for_update_on_startup = true",
-            'web_search = "cached"',
-            "",
-            "[marketplaces.openai-bundled]",
-            'source = "local"',
-            "",
-            "[windows]",
-            'sandbox = "elevated"',
-            "",
-            "[projects.'c:\\\\work']",
-            'trust_level = "trusted"',
-            "",
-            '[plugins."linear@openai-curated"]',
-            "enabled = true",
-            "",
-            "[model_providers.cliproxyapi]",
-            'base_url = "http://100.114.28.103:8317/v1"',
-            'experimental_bearer_token = "secret"',
-            'wire_api = "responses"',
-            "requires_openai_auth = true",
-            "supports_websockets = true",
-            "",
-            "[mcp_servers.node_repl]",
-            'command = "C:\\\\node_repl.exe"',
-            "startup_timeout_sec = 120",
-        ].join("\n");
-        const out = sanitizeRemoteCodexConfigToml(toml);
-        // Required for Codex + the provider: kept.
-        expect(out).toContain('model = "gpt-5.5"');
-        expect(out).toContain('model_provider = "cliproxyapi"');
-        expect(out).toContain('model_reasoning_effort = "medium"');
-        expect(out).toContain('preferred_auth_method = "apikey"');
-        expect(out).toContain("check_for_update_on_startup = false");
-        expect(out).toContain('web_search = "disabled"');
-        expect(out).toContain("[model_providers.cliproxyapi]");
-        expect(out).toContain("experimental_bearer_token");
-        expect(out).toContain("requires_openai_auth = false");
-        // Force HTTP transport so the sandbox doesn't burn ~75s retrying wss://.
-        expect(out).toContain("supports_websockets = false");
-        expect(out).toContain("[features]");
-        expect(out).toContain("browser_use = false");
-        expect(out).toContain("in_app_browser = false");
-        expect(out).toContain("computer_use = false");
-        expect(out).not.toContain("requires_openai_auth = true");
-        expect(out).not.toContain("supports_websockets = true");
-        // Everything host-specific: dropped.
-        expect(out).not.toContain("windows_wsl_setup_acknowledged");
-        expect(out).not.toContain("[mcp_servers");
-        expect(out).not.toContain("node_repl.exe");
-        expect(out).not.toContain("startup_timeout_sec");
-        expect(out).not.toContain("[projects");
-        expect(out).not.toContain("[windows]");
-        expect(out).not.toContain("[marketplaces");
-        expect(out).not.toContain("[plugins");
-    });
-    it("forces sandbox startup flags onto the active non-openai provider", () => {
-        const toml = [
-            'model_provider = "openai"',
-            "",
-            "[model_providers.openai]",
-            'base_url = "https://api.openai.com/v1"',
-            "supports_websockets = true",
-            "",
-            "[model_providers.cliproxyapi]",
-            'base_url = "http://x/v1"',
-            "requires_openai_auth = true",
-            "supports_websockets = true",
-        ].join("\n");
-        const out = sanitizeRemoteCodexConfigToml(toml);
-        expect(out).toContain('model_provider = "cliproxyapi"');
-        expect(out).toContain("[model_providers.cliproxyapi]");
-        expect(out).toContain("requires_openai_auth = false");
-        expect(out).toContain("supports_websockets = false");
-        expect(out).not.toContain('model_provider = "openai"');
-        expect(out).not.toContain("requires_openai_auth = true");
-        expect(out).not.toContain("supports_websockets = true");
-    });
-});
-describe("prepareRemoteCodexHomeAsset", () => {
-    it("omits auth.json so sandbox runs use config.toml provider credentials", async () => {
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-remote-home-"));
-        const sourceHome = path.join(root, "source");
-        await fs.mkdir(sourceHome, { recursive: true });
-        await fs.writeFile(path.join(sourceHome, "config.toml"), [
-            'model_provider = "cliproxyapi"',
-            "[model_providers.cliproxyapi]",
-            'base_url = "http://proxy/v1"',
-            "requires_openai_auth = false",
-        ].join("\n"), "utf8");
-        await fs.writeFile(path.join(sourceHome, "auth.json"), '{"auth_mode":"chatgpt"}\n', "utf8");
-        const asset = await prepareRemoteCodexHomeAsset(sourceHome);
-        try {
-            await expect(pathExists(path.join(asset.dir, "auth.json"))).resolves.toBe(false);
-            await expect(fs.readFile(path.join(asset.dir, "config.toml"), "utf8")).resolves.toContain("[model_providers.cliproxyapi]");
-            const config = await fs.readFile(path.join(asset.dir, "config.toml"), "utf8");
-            expect(config).toContain('preferred_auth_method = "apikey"');
-            expect(config).toContain("check_for_update_on_startup = false");
-            expect(config).toContain('web_search = "disabled"');
-            expect(config).toContain("requires_openai_auth = false");
-            expect(config).toContain("supports_websockets = false");
-            expect(config).toContain("[features]");
-            expect(config).toContain("browser_use = false");
-            expect(config).toContain("in_app_browser = false");
-            expect(config).toContain("computer_use = false");
-        }
-        finally {
-            await asset.cleanup();
-            await fs.rm(root, { recursive: true, force: true });
-        }
-    });
-});
-describe("codex managed home", () => {
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-    async function canCreateSymlink() {
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-home-symlink-check-"));
-        const source = path.join(root, "source.txt");
-        const target = path.join(root, "target.txt");
-        try {
-            await fs.writeFile(source, "probe", "utf8");
-            await fs.symlink(source, target);
-            return true;
-        }
-        catch {
-            return false;
-        }
-        finally {
-            await fs.rm(root, { recursive: true, force: true });
-        }
-    }
-    it("treats a concurrently-created expected auth symlink as success", async () => {
-        if (!(await canCreateSymlink()))
-            return;
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-home-"));
-        const sharedCodexHome = path.join(root, "shared-codex-home");
-        const paperclipHome = path.join(root, "paperclip-home");
-        const managedCodexHome = path.join(paperclipHome, "instances", "default", "companies", "company-1", "codex-home");
-        const sharedAuth = path.join(sharedCodexHome, "auth.json");
-        const managedAuth = path.join(managedCodexHome, "auth.json");
-        await fs.mkdir(sharedCodexHome, { recursive: true });
-        await fs.writeFile(sharedAuth, '{"token":"shared"}\n', "utf8");
-        const originalSymlink = fs.symlink.bind(fs);
-        vi.spyOn(fs, "symlink").mockImplementationOnce(async (source, target, type) => {
-            await originalSymlink(source, target, type);
-            const error = new Error("file already exists");
-            error.code = "EEXIST";
-            throw error;
-        });
-        try {
-            await expect(prepareManagedCodexHome({
-                CODEX_HOME: sharedCodexHome,
-                PAPERCLIP_HOME: paperclipHome,
-                PAPERCLIP_INSTANCE_ID: "default",
-            }, async () => { }, "company-1")).resolves.toBe(managedCodexHome);
-            expect((await fs.lstat(managedAuth)).isSymbolicLink()).toBe(true);
-            expect(await fs.realpath(managedAuth)).toBe(await fs.realpath(sharedAuth));
-        }
-        finally {
-            await fs.rm(root, { recursive: true, force: true });
-        }
-    });
-    it("refreshes a stale copied config.toml from the shared home", async () => {
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-home-"));
-        const sharedCodexHome = path.join(root, "shared-codex-home");
-        const paperclipHome = path.join(root, "paperclip-home");
-        const managedCodexHome = path.join(paperclipHome, "instances", "default", "companies", "company-1", "codex-home");
-        const sharedConfig = path.join(sharedCodexHome, "config.toml");
-        const managedConfig = path.join(managedCodexHome, "config.toml");
-        const logs = [];
-        await fs.mkdir(sharedCodexHome, { recursive: true });
-        await fs.writeFile(sharedConfig, 'requires_openai_auth = false\n', "utf8");
-        // Simulate an earlier run that copied a now-stale config into the managed home.
-        await fs.mkdir(managedCodexHome, { recursive: true });
-        await fs.writeFile(managedConfig, 'requires_openai_auth = true\n', "utf8");
-        const env = {
-            CODEX_HOME: sharedCodexHome,
-            PAPERCLIP_HOME: paperclipHome,
-            PAPERCLIP_INSTANCE_ID: "default",
-        };
-        try {
-            await prepareManagedCodexHome(env, async (_stream, chunk) => {
-                logs.push(chunk);
-            }, "company-1");
-            await expect(fs.readFile(managedConfig, "utf8")).resolves.toBe('requires_openai_auth = false\n');
-            expect(logs.join("")).toContain("refreshed config.toml from shared config");
-            // A second run with an unchanged source should not report another refresh.
-            logs.length = 0;
-            await prepareManagedCodexHome(env, async (_stream, chunk) => {
-                logs.push(chunk);
-            }, "company-1");
-            expect(logs.join("")).not.toContain("refreshed config.toml");
-        }
-        finally {
-            await fs.rm(root, { recursive: true, force: true });
-        }
-    });
-    it("copies auth.json when symlink creation is not permitted", async () => {
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-home-"));
-        const sharedCodexHome = path.join(root, "shared-codex-home");
-        const paperclipHome = path.join(root, "paperclip-home");
-        const managedCodexHome = path.join(paperclipHome, "instances", "default", "companies", "company-1", "codex-home");
-        const sharedAuth = path.join(sharedCodexHome, "auth.json");
-        const managedAuth = path.join(managedCodexHome, "auth.json");
-        const logs = [];
-        await fs.mkdir(sharedCodexHome, { recursive: true });
-        await fs.writeFile(sharedAuth, '{"token":"shared"}\n', "utf8");
-        vi.spyOn(fs, "symlink").mockImplementationOnce(async () => {
-            const error = new Error("operation not permitted");
-            error.code = "EPERM";
-            throw error;
-        });
-        try {
-            await expect(prepareManagedCodexHome({
-                CODEX_HOME: sharedCodexHome,
-                PAPERCLIP_HOME: paperclipHome,
-                PAPERCLIP_INSTANCE_ID: "default",
-            }, async (_stream, chunk) => {
-                logs.push(chunk);
-            }, "company-1")).resolves.toBe(managedCodexHome);
-            expect((await fs.lstat(managedAuth)).isSymbolicLink()).toBe(false);
-            await expect(fs.readFile(managedAuth, "utf8")).resolves.toBe('{"token":"shared"}\n');
-            expect(logs.join("")).toContain("copied auth.json because symlinks are unavailable");
-        }
-        finally {
-            await fs.rm(root, { recursive: true, force: true });
-        }
-    });
-});
-//# sourceMappingURL=codex-home.test.js.map