@rosthq/cli 0.7.164 → 0.7.165

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path15, preserveJsx) {
-  if (typeof path15 === "string" && /^\.\.?\//.test(path15)) {
-    return path15.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path16, preserveJsx) {
+  if (typeof path16 === "string" && /^\.\.?\//.test(path16)) {
+    return path16.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path15;
+  return path16;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -14343,10 +14343,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path15) {
-  if (!path15)
+function getElementAtPath(obj, path16) {
+  if (!path16)
     return obj;
-  return path15.reduce((acc, key) => acc?.[key], obj);
+  return path16.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14755,11 +14755,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path15, issues) {
+function prefixIssues(path16, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path15);
+    iss.path.unshift(path16);
     return iss;
   });
 }
@@ -14906,16 +14906,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path15 = []) => {
+  const processError = (error52, path16 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path16, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
       } else {
-        const fullpath = [...path15, ...issue2.path];
+        const fullpath = [...path16, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14942,17 +14942,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path15 = []) => {
+  const processError = (error52, path16 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path16, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
       } else {
-        const fullpath = [...path15, ...issue2.path];
+        const fullpath = [...path16, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14984,8 +14984,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path15 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path15) {
+  const path16 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path16) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27677,13 +27677,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path15 = ref.slice(1).split("/").filter(Boolean);
-  if (path15.length === 0) {
+  const path16 = ref.slice(1).split("/").filter(Boolean);
+  if (path16.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path15[0] === defsKey) {
-    const key = path15[1];
+  if (path16[0] === defsKey) {
+    const key = path16[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -29030,6 +29030,7 @@ var storedConfirmationPolicySchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/runner-setup.ts
+import { createHash, timingSafeEqual } from "node:crypto";
 var uuid3 = external_exports.string().uuid();
 var isoDateTime = external_exports.string().datetime({ offset: true });
 var sha256Hex = external_exports.string().regex(/^[0-9a-f]{64}$/, "expected a lowercase sha-256 hex digest");
@@ -29223,6 +29224,7 @@ var runnerSetupValidationAttemptSchema = external_exports.object({
   (attempt) => attempt.kind === "aicos_acceptance" === (attempt.activation_receipt_id !== null),
   "aicos_acceptance must be attributed to an activation receipt"
 );
+var RUNNER_SETUP_PROBE_ALLOWED_COMMAND_IDS = ["runner_setup.status"];
 var RUNNER_SETUP_PROBE_CAPABILITY_VERSION = 1;
 var runnerSetupValidationMcpCapabilityPayloadSchema = external_exports.object({
   capability_version: external_exports.literal(RUNNER_SETUP_PROBE_CAPABILITY_VERSION),
@@ -29241,6 +29243,18 @@ var runnerSetupValidationMcpConfigSchema = external_exports.object({
   token: external_exports.string().min(1).max(4096),
   expires_at: isoDateTime
 }).strict();
+function runnerSetupProbeNonceProof(input) {
+  const preimage = [
+    "rost.runner-setup.probe.v2",
+    input.nonce,
+    input.setup_id,
+    input.job_id,
+    input.runtime,
+    input.runner_id,
+    String(input.service_key_generation)
+  ].join("\n");
+  return createHash("sha256").update(preimage).digest("hex");
+}
 var runnerSetupValidationClaimRequestSchema = external_exports.object({
   setup_id: uuid3,
   runtime: runnerSetupRuntimeSchema
@@ -30976,7 +30990,7 @@ var forbiddenImportKeys = /* @__PURE__ */ new Set([
   "integration_id",
   "integrationId"
 ]);
-function rejectForbiddenImportShape(value, ctx, path15 = []) {
+function rejectForbiddenImportShape(value, ctx, path16 = []) {
   if (value === null || value === void 0) {
     return;
   }
@@ -30984,21 +30998,21 @@ function rejectForbiddenImportShape(value, ctx, path15 = []) {
     if (hasSecretShapedValue(value)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path15,
+        path: path16,
         message: "Definition imports cannot contain secret-shaped values. Provide credentials later through vault-backed connection flows."
       });
     }
     return;
   }
   if (Array.isArray(value)) {
-    value.forEach((item, index) => rejectForbiddenImportShape(item, ctx, [...path15, index]));
+    value.forEach((item, index) => rejectForbiddenImportShape(item, ctx, [...path16, index]));
     return;
   }
   if (typeof value !== "object") {
     return;
   }
   for (const [key, nested] of Object.entries(value)) {
-    const nestedPath = [...path15, key];
+    const nestedPath = [...path16, key];
     if (forbiddenImportKeys.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
@@ -35935,7 +35949,7 @@ var preflightArtifactDispositionSchema = external_exports.object({
   // on this envelope.
   transformations: external_exports.array(preflightTransformationSchema)
 }).strict().superRefine((data, ctx) => {
-  const add = (path15, message) => ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path15, message });
+  const add = (path16, message) => ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path16, message });
   const reasonIsBlank = data.reason !== null && data.reason.trim().length === 0;
   if (reasonIsBlank) add(["reason"], "reason must be nonblank when supplied");
   if (data.presence === "missing") {
@@ -36974,14 +36988,14 @@ var COMPLETE_SEAT_PERMISSION_ARGS_MAX_NODES = 5e3;
 function jsonByteLength(value) {
   return new TextEncoder().encode(JSON.stringify(value)).byteLength;
 }
-function boundCharterList(value, path15, ctx) {
+function boundCharterList(value, path16, ctx) {
   if (value.length > COMPLETE_SEAT_CHARTER_MAX_ITEMS_PER_LIST) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.too_big,
       maximum: COMPLETE_SEAT_CHARTER_MAX_ITEMS_PER_LIST,
       origin: "array",
       inclusive: true,
-      path: path15,
+      path: path16,
       message: `Complete-Seat Charter lists are limited to ${COMPLETE_SEAT_CHARTER_MAX_ITEMS_PER_LIST} entries.`
     });
   }
@@ -36998,7 +37012,7 @@ function addCompleteSeatCharterBounds(charter, ctx) {
     boundCharterList(charter.unanswered_boundaries, ["unanswered_boundaries"], ctx);
   }
   let argumentNodes = 0;
-  const visitArgument = (value, depth, path15) => {
+  const visitArgument = (value, depth, path16) => {
     argumentNodes += 1;
     if (argumentNodes > COMPLETE_SEAT_PERMISSION_ARGS_MAX_NODES) {
       return;
@@ -37006,15 +37020,15 @@ function addCompleteSeatCharterBounds(charter, ctx) {
     if (depth > COMPLETE_SEAT_PERMISSION_ARGS_MAX_DEPTH) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path15,
+        path: path16,
         message: `Complete-Seat permission arguments are limited to ${COMPLETE_SEAT_PERMISSION_ARGS_MAX_DEPTH} nested levels.`
       });
       return;
     }
     if (Array.isArray(value)) {
-      value.forEach((entry, index) => visitArgument(entry, depth + 1, [...path15, index]));
+      value.forEach((entry, index) => visitArgument(entry, depth + 1, [...path16, index]));
     } else if (value && typeof value === "object") {
-      Object.entries(value).forEach(([key, entry]) => visitArgument(entry, depth + 1, [...path15, key]));
+      Object.entries(value).forEach(([key, entry]) => visitArgument(entry, depth + 1, [...path16, key]));
     }
   };
   charter.permission_manifest.forEach((permission, index) => {
@@ -37175,9 +37189,9 @@ var createCompleteSeatRequestSchema = external_exports.object({
   }
   const useKeys = /* @__PURE__ */ new Set();
   for (const [index, use] of value.seat.source_uses.entries()) {
-    const path15 = ["seat", "source_uses", index, "source_key"];
-    if (!sourceKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path15, message: "Source use must resolve to the request source registry." });
-    if (useKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path15, message: "Source use must not be duplicated." });
+    const path16 = ["seat", "source_uses", index, "source_key"];
+    if (!sourceKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path16, message: "Source use must resolve to the request source registry." });
+    if (useKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path16, message: "Source use must not be duplicated." });
     useKeys.add(use.source_key);
   }
   if (value.seat.human_staffing.kind === "planned" && value.seat.human_staffing.source_ref) {
@@ -37190,8 +37204,8 @@ var createCompleteSeatRequestSchema = external_exports.object({
     ...value.seat.parent ? [{ ref: value.seat.parent, path: ["seat", "parent"] }] : [],
     ...value.seat.agent ? [{ ref: value.seat.agent.steward, path: ["seat", "agent", "steward"] }] : []
   ];
-  refs.forEach(({ ref, path: path15 }) => {
-    if (ref.kind !== "existing") ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path15, message: "Direct complete-seat requests require existing Seat references." });
+  refs.forEach(({ ref, path: path16 }) => {
+    if (ref.kind !== "existing") ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path16, message: "Direct complete-seat requests require existing Seat references." });
   });
 }).transform((value) => ({
   ...value,
@@ -37269,7 +37283,7 @@ var completeSeatApprovalProjectionSchema = external_exports.object({
 
 // ../../packages/protocol/src/setup-application.ts
 import { Buffer as Buffer2 } from "node:buffer";
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 
 // ../../packages/protocol/src/baserow-filter-operators.ts
 var baserowFilterOperatorSchema = external_exports.enum([
@@ -37687,26 +37701,26 @@ var PROHIBITED_CONTENT_MESSAGE_PREFIX = "Prohibited content";
 function prohibitedContentMessage(rule_id, found) {
   return `${PROHIBITED_CONTENT_MESSAGE_PREFIX} [${rule_id}]: ${found}. ${CONTENT_LINT_REMEDY[rule_id]}`;
 }
-function isIndexedPath(path15, family, field4) {
-  return path15.length === 3 && path15[0] === family && typeof path15[1] === "number" && path15[2] === field4;
+function isIndexedPath(path16, family, field4) {
+  return path16.length === 3 && path16[0] === family && typeof path16[1] === "number" && path16[2] === field4;
 }
-function isSchemaProvenMachineString(path15) {
-  if (path15.length === 1 && path15[0] === "managed_inference_hard_cap_usd") {
+function isSchemaProvenMachineString(path16) {
+  if (path16.length === 1 && path16[0] === "managed_inference_hard_cap_usd") {
     return true;
   }
-  if (isIndexedPath(path15, "sources", "source_upload_id") || isIndexedPath(path15, "sources", "sha256") || isIndexedPath(path15, "reconciliation", "source_sha256") || isIndexedPath(path15, "reconciliation", "normalized_identity_digest") || isIndexedPath(path15, "signal_readings", "period_start") || isIndexedPath(path15, "signal_readings", "value") || isIndexedPath(path15, "tasks", "due_on")) {
+  if (isIndexedPath(path16, "sources", "source_upload_id") || isIndexedPath(path16, "sources", "sha256") || isIndexedPath(path16, "reconciliation", "source_sha256") || isIndexedPath(path16, "reconciliation", "normalized_identity_digest") || isIndexedPath(path16, "signal_readings", "period_start") || isIndexedPath(path16, "signal_readings", "value") || isIndexedPath(path16, "tasks", "due_on")) {
     return true;
   }
-  if (path15.length === 2 && path15[0] === "cycle" && (path15[1] === "starts_on" || path15[1] === "ends_on")) {
+  if (path16.length === 2 && path16[0] === "cycle" && (path16[1] === "starts_on" || path16[1] === "ends_on")) {
     return true;
   }
-  if (path15.length >= 3 && path15.at(-3) === "citations" && typeof path15.at(-2) === "number" && path15.at(-1) === "document_id") {
+  if (path16.length >= 3 && path16.at(-3) === "citations" && typeof path16.at(-2) === "number" && path16.at(-1) === "document_id") {
     return true;
   }
-  if (path15.length === 6 && path15[0] === "seats" && typeof path15[1] === "number" && path15[2] === "charter" && path15[3] === "permission_manifest" && typeof path15[4] === "number" && path15[5] === "integration_id") {
+  if (path16.length === 6 && path16[0] === "seats" && typeof path16[1] === "number" && path16[2] === "charter" && path16[3] === "permission_manifest" && typeof path16[4] === "number" && path16[5] === "integration_id") {
     return true;
   }
-  return path15.length === 6 && path15[0] === "seats" && typeof path15[1] === "number" && path15[2] === "agent" && path15[3] === "skills" && typeof path15[4] === "number" && (path15[5] === "skill_version_id" || path15[5] === "content_sha256");
+  return path16.length === 6 && path16[0] === "seats" && typeof path16[1] === "number" && path16[2] === "agent" && path16[3] === "skills" && typeof path16[4] === "number" && (path16[5] === "skill_version_id" || path16[5] === "content_sha256");
 }
 function jsonByteLength2(value) {
   try {
@@ -37716,20 +37730,20 @@ function jsonByteLength2(value) {
     return Number.POSITIVE_INFINITY;
   }
 }
-function prohibitedSetupContentViolations(value, path15 = []) {
+function prohibitedSetupContentViolations(value, path16 = []) {
   if (typeof value === "string") {
-    if (isSchemaProvenMachineString(path15)) return [];
+    if (isSchemaProvenMachineString(path16)) return [];
     return contentViolationsForString(value).map(({ rule_id, found }) => ({
       rule_id,
-      path: path15,
+      path: path16,
       message: prohibitedContentMessage(rule_id, found)
     }));
   }
   if (Array.isArray(value)) {
-    return value.flatMap((entry, index) => prohibitedSetupContentViolations(entry, [...path15, index]));
+    return value.flatMap((entry, index) => prohibitedSetupContentViolations(entry, [...path16, index]));
   }
   if (value && typeof value === "object") {
-    return Object.entries(value).flatMap(([key, entry]) => prohibitedSetupContentViolations(entry, [...path15, key]));
+    return Object.entries(value).flatMap(([key, entry]) => prohibitedSetupContentViolations(entry, [...path16, key]));
   }
   return [];
 }
@@ -38046,7 +38060,7 @@ function canonicalJson(value) {
   return JSON.stringify(value);
 }
 function digestCanonicalJson(value) {
-  return `sha256:${createHash("sha256").update(canonicalJson(value)).digest("hex")}`;
+  return `sha256:${createHash2("sha256").update(canonicalJson(value)).digest("hex")}`;
 }
 var onboardingSetupOutputSchema = external_exports.object({
   application_id: uuidSchema19,
@@ -43709,7 +43723,7 @@ var CommandClient = class {
     this._credentialKind = options.credentialKind;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path15 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path16 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -43717,7 +43731,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path15}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path16}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -43730,7 +43744,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path15}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path16}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -49061,8 +49075,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path15, query) {
-  const url2 = new URL(path15, baseUrl);
+function buildUrl(baseUrl, path16, query) {
+  const url2 = new URL(path16, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -49092,12 +49106,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path15,
+      path: path16,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path15, query);
+      const url2 = buildUrl(options.baseUrl, path16, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -49959,7 +49973,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path15, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path16, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -49983,7 +49997,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path15);
+      const cleanPath = _this._removeEmptyFolders(path16);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -50060,8 +50074,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path15, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path15, fileBody, fileOptions);
+  async upload(path16, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path16, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -50101,9 +50115,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path15, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path16, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path15);
+    const cleanPath = _this3._removeEmptyFolders(path16);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -50172,10 +50186,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path15, options) {
+  async createSignedUploadUrl(path16, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path15);
+      let _path = _this4._getFinalPath(path16);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -50184,7 +50198,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path15,
+        path: path16,
         token
       };
     });
@@ -50244,8 +50258,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path15, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path15, fileBody, fileOptions);
+  async update(path16, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path16, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -50396,10 +50410,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path15, expiresIn, options) {
+  async createSignedUrl(path16, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path15);
+      let _path = _this8._getFinalPath(path16);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -50535,13 +50549,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path15, options, parameters) {
+  download(path16, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path15);
+    const _path = this._getFinalPath(path16);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -50572,9 +50586,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path15) {
+  async info(path16) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path15);
+    const _path = _this10._getFinalPath(path16);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -50595,9 +50609,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path15) {
+  async exists(path16) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path15);
+    const _path = _this11._getFinalPath(path16);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -50676,8 +50690,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path15, options) {
-    const _path = this._getFinalPath(path15);
+  getPublicUrl(path16, options) {
+    const _path = this._getFinalPath(path16);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -50816,10 +50830,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path15, options, parameters) {
+  async list(path16, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path15 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path16 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -50884,11 +50898,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path15) {
-    return `${this.bucketId}/${path15.replace(/^\/+/, "")}`;
+  _getFinalPath(path16) {
+    return `${this.bucketId}/${path16.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path15) {
-    return path15.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path16) {
+    return path16.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -55123,7 +55137,7 @@ async function recordImplementationRunClosed(store, status, fields, closedAt = /
 }
 
 // src/skill-trust.ts
-import { createHash as createHash2, createPublicKey, verify } from "node:crypto";
+import { createHash as createHash3, createPublicKey, verify } from "node:crypto";
 var TRUSTED_SIGNER_PUBLIC_KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOXSsKe/zFjaoAdZdvP/esPoeM1fsCGFmxv0INDlCxaW rost-implementation-skill-release";
 var TRUSTED_SIGNER_FINGERPRINT = "SHA256:ziSyU9vhGi0Q3GaeePB1R6BI3GqXutLhepnF/4Hx4rY";
 var RELEASE_REPOSITORY = {
@@ -55171,7 +55185,7 @@ var skillManifestSchema = external_exports.object({
   ).min(1)
 }).strict();
 function sha256Hex2(content) {
-  return createHash2("sha256").update(content).digest("hex");
+  return createHash3("sha256").update(content).digest("hex");
 }
 function readSshString(buffer, offset) {
   if (offset + 4 > buffer.length) {
@@ -55242,7 +55256,7 @@ function splitSignedTag(rawTagObject) {
   };
 }
 function buildSshSigMessage(payload) {
-  const digest = createHash2("sha512").update(payload, "utf8").digest();
+  const digest = createHash3("sha512").update(payload, "utf8").digest();
   return Buffer.concat([
     Buffer.from("SSHSIG"),
     makeSshString(Buffer.from("git")),
@@ -68157,7 +68171,7 @@ import path13 from "node:path";
 
 // src/forge-workspace.ts
 import { execFile as execFileCallback4 } from "node:child_process";
-import { createHash as createHash3, randomBytes } from "node:crypto";
+import { createHash as createHash4, randomBytes } from "node:crypto";
 import { constants as fsConstants5 } from "node:fs";
 import { chmod, link, lstat, mkdir as mkdir7, mkdtemp, open, readdir as readdir3, readFile as readFile10, realpath, rename, rm as rm7, stat as stat6, writeFile as writeFile7 } from "node:fs/promises";
 import os2 from "node:os";
@@ -68418,7 +68432,7 @@ async function hasUsableClaudeCredentialFile(cell2) {
   return parseUsableClaudeCredentialJson(read.data.toString("utf8")) !== null;
 }
 function claudeKeychainServiceNameForSecureStorageDir(secureStorageDir) {
-  const digest = createHash3("sha256").update(secureStorageDir).digest("hex").slice(0, 8);
+  const digest = createHash4("sha256").update(secureStorageDir).digest("hex").slice(0, 8);
   return `Claude Code-credentials-${digest}`;
 }
 function parseUsableClaudeCredentialJson(raw) {
@@ -68953,7 +68967,7 @@ var FORGE_GIT_AUTHOR_EMAIL = `${RSF_ADDON_BRAND.cliGroup}@${BRAND_DISTRIBUTION.c
 function shortRequestId(buildRequestId) {
   const hex3 = buildRequestId.replace(/-/g, "");
   const slice = hex3.slice(0, 8);
-  return slice.length > 0 ? slice : createHash3("sha1").update(buildRequestId).digest("hex").slice(0, 8);
+  return slice.length > 0 ? slice : createHash4("sha1").update(buildRequestId).digest("hex").slice(0, 8);
 }
 function requestRoot(baseDir, buildRequestId) {
   return path10.join(baseDir, "work", shortRequestId(buildRequestId));
@@ -69641,7 +69655,7 @@ async function removeWorkspace(ws) {
 
 // src/runner-serve.ts
 import { execFile as execFileCallback5, spawn } from "node:child_process";
-import { createHash as createHash4, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, randomUUID } from "node:crypto";
+import { createHash as createHash6, createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync, randomUUID } from "node:crypto";
 import { constants as fsConstants6 } from "node:fs";
 import { access as access3, chmod as chmod2, lstat as lstat2, mkdir as mkdir8, open as open2, readFile as readFile11, rename as rename2, rm as rm8, statfs, writeFile as writeFile8 } from "node:fs/promises";
 import { cpus, homedir as homedir7, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
@@ -69885,6 +69899,131 @@ function decideReconcileAction(input) {
   };
 }
 
+// src/runner-setup-validation.ts
+import { createHash as createHash5, createPrivateKey, sign as cryptoSign } from "node:crypto";
+var CLAIM_PATH = "/api/runner/setup-validation/claim";
+var RESULT_PATH = "/api/runner/setup-validation/result";
+var SERVICE_KEY_DOMAIN_SEPARATOR = "rost.runner-setup.service-key.v1";
+var SIGNATURE_HEADER = "x-rost-service-key-signature";
+var TIMESTAMP_HEADER = "x-rost-service-key-timestamp";
+function canonicalRequest(method, requestPath, timestamp, body) {
+  return [
+    SERVICE_KEY_DOMAIN_SEPARATOR,
+    method.toUpperCase(),
+    requestPath,
+    timestamp,
+    createHash5("sha256").update(body, "utf8").digest("hex")
+  ].join("\n");
+}
+async function signedPost(deps, requestPath, body) {
+  if (deps.state.service_key_private === void 0) {
+    throw new Error("Runner setup validation requires a bound service key.");
+  }
+  const rawBody = JSON.stringify(body);
+  const timestamp = String((deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime());
+  const signature = cryptoSign(
+    null,
+    Buffer.from(canonicalRequest("POST", requestPath, timestamp, rawBody), "utf8"),
+    createPrivateKey(deps.state.service_key_private)
+  ).toString("base64");
+  return deps.fetchImpl(`${deps.appUrl.replace(/\/+$/, "")}${requestPath}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${deps.state.runner_secret}`,
+      "content-type": "application/json",
+      [SIGNATURE_HEADER]: signature,
+      [TIMESTAMP_HEADER]: timestamp
+    },
+    body: rawBody
+  });
+}
+async function responseMessage(response) {
+  const text = redactForLog(await response.text());
+  return `Runner setup validation request failed (${response.status})${text.length > 0 ? `: ${text}` : "."}`;
+}
+async function executeRunnerSetupValidation(deps) {
+  const setupId = deps.state.active_setup_id;
+  if (setupId === void 0 || deps.state.service_key_private === void 0 || deps.state.service_key_generation === void 0) {
+    return { kind: "not_applicable" };
+  }
+  let claimResponse;
+  try {
+    claimResponse = await signedPost(deps, CLAIM_PATH, { setup_id: setupId, runtime: deps.runtime });
+  } catch (error51) {
+    return { kind: "retryable", message: redactForLog(error51 instanceof Error ? error51.message : String(error51)) };
+  }
+  if (!claimResponse.ok) {
+    return { kind: "retryable", message: await responseMessage(claimResponse) };
+  }
+  const claimParsed = runnerSetupValidationClaimResponseSchema.safeParse(await claimResponse.json().catch(() => null));
+  if (!claimParsed.success) {
+    return { kind: "retryable", message: "Runner setup validation claim returned an unexpected payload." };
+  }
+  const claim = claimParsed.data;
+  if (claim.challenge.setup_id !== setupId || claim.challenge.runtime !== deps.runtime) {
+    return { kind: "retryable", message: "Runner setup validation claim did not match the selected setup and runtime." };
+  }
+  if (new Date(claim.challenge.expires_at).getTime() <= (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime()) {
+    return { kind: "retryable", message: "Runner setup validation claim expired before the probe started." };
+  }
+  if (claim.allowed_command_ids.length !== 1 || claim.allowed_command_ids[0] !== RUNNER_SETUP_PROBE_ALLOWED_COMMAND_IDS[0]) {
+    return { kind: "retryable", message: "Runner setup validation claim granted an unexpected command set." };
+  }
+  const probe2 = await deps.runProbe({ runtime: deps.runtime, setupId, mcp: claim.mcp });
+  if (probe2.retryable === true) {
+    return { kind: "retryable", message: "Runner credential cell is busy; validation will retry." };
+  }
+  const cliVersion = await readCliVersion();
+  const mcpConfigDigest = createHash5("sha256").update(JSON.stringify({ url: claim.mcp.url, expires_at: claim.mcp.expires_at, allowed_command_ids: claim.allowed_command_ids })).digest("hex");
+  const proof = probe2.ok && probe2.setupId === setupId ? runnerSetupProbeNonceProof({
+    nonce: claim.challenge.nonce,
+    setup_id: setupId,
+    job_id: claim.job_id,
+    runtime: deps.runtime,
+    runner_id: deps.state.runner_id,
+    service_key_generation: deps.state.service_key_generation
+  }) : "0".repeat(64);
+  const reportBody = {
+    job_id: claim.job_id,
+    nonce: claim.challenge.nonce,
+    result: {
+      setup_id: setupId,
+      runtime: deps.runtime,
+      nonce_proof: proof,
+      service_key_generation: deps.state.service_key_generation
+    },
+    attempt: {
+      runner_id: deps.state.runner_id,
+      runtime: deps.runtime,
+      model: null,
+      provider_cli_version: probe2.providerCliVersion,
+      observed_at: probe2.observedAt
+    },
+    invoked_command_ids: [RUNNER_SETUP_PROBE_ALLOWED_COMMAND_IDS[0]],
+    receipt_facts: {
+      credential_cell_generation: 1,
+      provider_cli_version: probe2.providerCliVersion ?? "unknown",
+      rost_cli_version: cliVersion ?? "unknown",
+      sandbox_policy_version: probe2.sandboxPolicyVersion,
+      mcp_config_digest: mcpConfigDigest
+    }
+  };
+  let resultResponse;
+  try {
+    resultResponse = await signedPost(deps, RESULT_PATH, reportBody);
+  } catch (error51) {
+    return { kind: "retryable", message: redactForLog(error51 instanceof Error ? error51.message : String(error51)) };
+  }
+  if (!resultResponse.ok) {
+    return { kind: "retryable", message: await responseMessage(resultResponse) };
+  }
+  const resultParsed = runnerSetupValidationReportResponseSchema.safeParse(await resultResponse.json().catch(() => null));
+  if (!resultParsed.success || resultParsed.data.verdict !== "passed" || resultParsed.data.receipt === null) {
+    return { kind: "retryable", message: "Runner setup validation did not pass server verification." };
+  }
+  return { kind: "passed", expiresAt: resultParsed.data.receipt.expires_at };
+}
+
 // src/runner-serve.ts
 var execFile5 = promisify5(execFileCallback5);
 var EXCLUSIVE_NOFOLLOW_FLAGS = fsConstants6.O_CREAT | fsConstants6.O_EXCL | fsConstants6.O_WRONLY | fsConstants6.O_NOFOLLOW;
@@ -70003,6 +70142,43 @@ ${usage()}
         serverClaimContractVersion = learnedVersion !== null && learnedVersion >= HEARTBEAT_CLAIM_MIN_CONTRACT_VERSION ? learnedVersion : null;
         options.io.stdout.write(`heartbeat ok #${beat} runner_id=${state.runner_id} claude=${capabilities.claude.installed} codex=${capabilities.codex.installed}
 `);
+        const setupRuntime = state.setup_runtime;
+        const persistedValidation = state.setup_validation;
+        const validationStillCurrent = persistedValidation !== void 0 && persistedValidation.setup_id === state.active_setup_id && persistedValidation.runtime === setupRuntime && new Date(persistedValidation.expires_at).getTime() > Date.now();
+        if (setupRuntime !== void 0 && !validationStillCurrent) {
+          const runtimeCapability = detectedCapabilities[setupRuntime];
+          const validation = await executeRunnerSetupValidation({
+            fetchImpl,
+            appUrl: options.appUrl,
+            runtime: setupRuntime,
+            state,
+            runProbe: ({ runtime, setupId, mcp }) => runSetupValidationProbe({
+              runtime,
+              setupId,
+              mcp,
+              state,
+              config: config2,
+              env,
+              providerCliVersion: runtimeCapability.version
+            })
+          });
+          if (validation.kind === "passed" && state.active_setup_id !== void 0) {
+            state = {
+              ...state,
+              setup_validation: {
+                setup_id: state.active_setup_id,
+                runtime: setupRuntime,
+                expires_at: validation.expiresAt
+              }
+            };
+            await saveState(config2.stateFile, state);
+            options.io.stdout.write(`runner setup validation passed runtime=${setupRuntime}
+`);
+          } else if (validation.kind === "retryable") {
+            options.io.stderr.write(`${redactForLog(validation.message)}
+`);
+          }
+        }
       }
       if (localRuntime) {
         activeSessions += 1;
@@ -70424,7 +70600,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
   return state;
 }
 async function migrateLegacyCodexHome(state, homeDir, io) {
-  const runnerKey = createHash4("sha256").update(`codex-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
+  const runnerKey = createHash6("sha256").update(`codex-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
   const newHome = stableCodexHomeDir(state, homeDir);
   const legacyCandidates = [
     path12.join(tmpdir2(), "rost-runner-codex-home", `rost-runner-codex-home-${runnerKey}`),
@@ -70484,7 +70660,7 @@ async function migrateOneLegacyCodexHome(legacyHome, newHome, io) {
   }
 }
 function defaultRunnerStateFile(appUrl2) {
-  return path12.join(tmpdir2(), `rost-runner-${createHash4("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+  return path12.join(tmpdir2(), `rost-runner-${createHash6("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
 }
 async function loadState(filePath, expectedTenantId) {
   try {
@@ -70498,8 +70674,12 @@ async function loadState(filePath, expectedTenantId) {
         runner_secret: parsed.runner_secret,
         ...typeof parsed.tenant_id === "string" ? { tenant_id: parsed.tenant_id } : {},
         ...typeof parsed.name === "string" ? { name: parsed.name } : {},
+        ...typeof parsed.active_setup_id === "string" ? { active_setup_id: parsed.active_setup_id } : {},
+        ...parsed.setup_runtime === "claude" || parsed.setup_runtime === "codex" ? { setup_runtime: parsed.setup_runtime } : {},
         ...typeof parsed.service_key_private === "string" ? { service_key_private: parsed.service_key_private } : {},
         ...typeof parsed.service_key_public === "string" ? { service_key_public: parsed.service_key_public } : {},
+        ...typeof parsed.service_key_generation === "number" ? { service_key_generation: parsed.service_key_generation } : {},
+        ...isSetupValidationState(parsed.setup_validation) ? { setup_validation: parsed.setup_validation } : {},
         ...isRuntimeSessionMap(parsed.runtime_sessions) ? { runtime_sessions: parsed.runtime_sessions } : {},
         ...isInFlightWorkOrderMap(parsed.in_flight_work_orders) ? { in_flight_work_orders: parsed.in_flight_work_orders } : {}
       };
@@ -70509,6 +70689,11 @@ async function loadState(filePath, expectedTenantId) {
   }
   return null;
 }
+function isSetupValidationState(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record2 = value;
+  return typeof record2.setup_id === "string" && (record2.runtime === "claude" || record2.runtime === "codex") && typeof record2.expires_at === "string";
+}
 function isRuntimeSessionMap(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return false;
@@ -70523,7 +70708,7 @@ function isRuntimeSessionMap(value) {
 }
 async function saveState(filePath, state) {
   await mkdir8(path12.dirname(filePath), { recursive: true, mode: 448 });
-  const tempPath = `${filePath}.${process.pid}.${createHash4("sha1").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 8)}.tmp`;
+  const tempPath = `${filePath}.${process.pid}.${createHash6("sha1").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 8)}.tmp`;
   try {
     await writeFile8(tempPath, `${JSON.stringify(state)}
 `, { mode: 384 });
@@ -70566,7 +70751,7 @@ function generateRunnerServiceKeyPair() {
   return { privateKey: privatePem, publicKey: openSshEd25519PublicKey(publicKey) };
 }
 function runnerServiceKeyPairFromPrivate(privatePem) {
-  const privateKey = createPrivateKey(privatePem);
+  const privateKey = createPrivateKey2(privatePem);
   return { privateKey: privatePem, publicKey: openSshEd25519PublicKey(createPublicKey2(privateKey)) };
 }
 function runnerServiceKeyPairForState(state) {
@@ -71311,6 +71496,120 @@ function buildTurnCommand(input) {
     ]
   };
 }
+async function runSetupValidationProbe(input) {
+  const observedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (new Date(input.mcp.expires_at).getTime() <= Date.now()) {
+    return { ok: false, setupId: null, providerCliVersion: input.providerCliVersion, observedAt, sandboxPolicyVersion: input.config.sandbox.kind };
+  }
+  const configPath = path12.join(tmpdir2(), `rost-runner-setup-mcp-${randomUUID()}.json`);
+  const prompt = `Call rost_runner_setup_status exactly once with setup_id ${input.setupId}. Do not call any other tool. Then respond only with ROST_SETUP_ID=${input.setupId}.`;
+  const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: input.mcp.url, headers: { Authorization: `Bearer ${input.mcp.token}` } } } });
+  let claudeConfigDir = null;
+  let codexHomeDir = null;
+  let sandboxProfilePath = null;
+  const credentialCell = credentialCellDirForRuntime(input.runtime, input.state, input.config.homeDir);
+  const credentialCellLock = await acquireCodexHomeLock(credentialCell, {
+    waitMs: 0,
+    label: credentialCellLabelForRuntime(input.runtime)
+  });
+  if (credentialCellLock === null) {
+    return { ok: false, retryable: true, setupId: null, providerCliVersion: input.providerCliVersion, observedAt, sandboxPolicyVersion: input.config.sandbox.kind };
+  }
+  try {
+    if (input.runtime === "claude") {
+      const cell2 = stableClaudeHomeDir(input.state, input.config.homeDir);
+      if (await claudeCellNeedsLogin(cell2)) {
+        return { ok: false, setupId: null, providerCliVersion: input.providerCliVersion, observedAt, sandboxPolicyVersion: input.config.sandbox.kind };
+      }
+      claudeConfigDir = await provisionIsolatedClaudeConfigDir(
+        path12.join(tmpdir2(), `rost-runner-setup-claude-${randomUUID()}`),
+        cell2
+      );
+    } else {
+      codexHomeDir = await provisionIsolatedCodexHomeDir(
+        input.env,
+        stableCodexHomeDir(input.state, input.config.homeDir),
+        tmpdir2()
+      );
+    }
+    await writeFile8(configPath, `${mcpConfig}
+`, { mode: 384, flag: EXCLUSIVE_NOFOLLOW_FLAGS });
+    const built = buildSetupValidationProbeCommand(input.runtime, prompt, configPath);
+    if (input.config.sandbox.kind === "seatbelt") {
+      sandboxProfilePath = path12.join(tmpdir2(), `rost-runner-setup-${randomUUID()}.sb`);
+      await writeFile8(sandboxProfilePath, input.config.sandbox.profile, { mode: 384, flag: EXCLUSIVE_NOFOLLOW_FLAGS });
+    }
+    const wrapped = wrapCommandWithSandbox(input.config.sandbox, built.command, built.args, sandboxProfilePath);
+    const fakeModel = (input.env.ROST_RUNNER_FAKE_MODEL ?? "").trim();
+    const result = await runModelProcess({
+      command: fakeModel.length > 0 ? fakeModel : wrapped.command,
+      args: wrapped.args,
+      cwd: tmpdir2(),
+      timeoutMs: 12e4,
+      env: buildModelSpawnEnv(
+        input.env,
+        claudeConfigDir ?? void 0,
+        codexHomeDir ?? void 0,
+        input.runtime === "claude" ? stableClaudeHomeDir(input.state, input.config.homeDir) : void 0
+      ),
+      expectSessionEnvelope: input.runtime === "claude",
+      interactiveTurn: true,
+      ...input.runtime === "claude" ? { requiredMcpTools: ["mcp__rost__rost_runner_setup_status"] } : {}
+    });
+    const output = `${result.assistantText ?? ""}
+${result.transcript ?? ""}`;
+    const match = /(?:^|\s)ROST_SETUP_ID=([0-9a-f-]{36})(?:\s|$)/i.exec(output);
+    return {
+      ok: result.ok && match?.[1] === input.setupId,
+      setupId: match?.[1] ?? null,
+      providerCliVersion: input.providerCliVersion,
+      observedAt,
+      sandboxPolicyVersion: input.config.sandbox.kind
+    };
+  } catch {
+    return { ok: false, setupId: null, providerCliVersion: input.providerCliVersion, observedAt, sandboxPolicyVersion: input.config.sandbox.kind };
+  } finally {
+    await rm8(configPath, { force: true });
+    if (sandboxProfilePath !== null) await rm8(sandboxProfilePath, { force: true });
+    if (claudeConfigDir !== null) await rm8(claudeConfigDir, { recursive: true, force: true });
+    await credentialCellLock.release();
+  }
+}
+function buildSetupValidationProbeCommand(runtime, prompt, configPath) {
+  return {
+    command: runtime,
+    args: runtime === "claude" ? [
+      "-p",
+      prompt,
+      "--mcp-config",
+      configPath,
+      "--strict-mcp-config",
+      "--tools",
+      "",
+      "--allowedTools",
+      "mcp__rost__rost_runner_setup_status",
+      "--permission-mode",
+      "dontAsk",
+      "--output-format",
+      "stream-json",
+      "--verbose"
+    ] : [
+      "exec",
+      prompt,
+      "--mcp-config",
+      configPath,
+      "--sandbox",
+      "read-only",
+      "--skip-git-repo-check",
+      "--ephemeral",
+      "--ignore-user-config",
+      "--ignore-rules",
+      "-C",
+      tmpdir2(),
+      ...CODEX_NATIVE_TOOL_ISOLATION_CONFIG_ARGS
+    ]
+  };
+}
 function runLocalTurn(ctx, workOrder, runtime, kind) {
   return spawnRunnerTurn(ctx, workOrder, runtime, kind);
 }
@@ -71447,7 +71746,7 @@ async function prepareForgeTurn(ctx, workOrder, execution, runtime, seams) {
 var FORGE_MAX_CHANGED_PATHS = 2e3;
 var FORGE_MAX_CHANGED_PATH_LENGTH = 500;
 function forgeChangedPathsField(changedPaths) {
-  const withinCaps = changedPaths.length > 0 && changedPaths.length <= FORGE_MAX_CHANGED_PATHS && changedPaths.every((path15) => path15.length >= 1 && path15.length <= FORGE_MAX_CHANGED_PATH_LENGTH);
+  const withinCaps = changedPaths.length > 0 && changedPaths.length <= FORGE_MAX_CHANGED_PATHS && changedPaths.every((path16) => path16.length >= 1 && path16.length <= FORGE_MAX_CHANGED_PATH_LENGTH);
   return withinCaps ? { changedPaths: [...changedPaths] } : {};
 }
 async function finalizeForgeBuildPush(ctx, prep, result, seams) {
@@ -71576,11 +71875,11 @@ function journaledClaudeConfigDirNames(state) {
   );
 }
 function stableCodexHomeDir(state, homeDir) {
-  const key = createHash4("sha256").update(`codex-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
+  const key = createHash6("sha256").update(`codex-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
   return path12.join(runnerCodexHomeBaseDir(homeDir), `rost-runner-codex-home-${key}`);
 }
 function stableClaudeHomeDir(state, homeDir) {
-  const key = createHash4("sha256").update(`claude-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
+  const key = createHash6("sha256").update(`claude-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
   return path12.join(runnerClaudeHomeBaseDir(homeDir), `rost-runner-claude-home-${key}`);
 }
 function credentialCellDirForRuntime(runtime, state, homeDir) {
@@ -71693,11 +71992,11 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind, resumeSessionIdOve
     const token = typeof mcp.token === "string" ? mcp.token : "";
     const url2 = typeof mcp.url === "string" ? `${ctx.appUrl.replace(/\/+$/, "")}${mcp.url}` : `${ctx.appUrl.replace(/\/+$/, "")}/mcp`;
     const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
-    const configPath = path12.join(tmpdir2(), `rost-runner-mcp-${createHash4("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+    const configPath = path12.join(tmpdir2(), `rost-runner-mcp-${createHash6("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
     const prompt = buildTurnPrompt({ kind, workOrder, execution, hasWorkspace: forgePrep !== null });
     const claudeCell = runtime === "claude" ? stableClaudeHomeDir(ctx.state, ctx.config.homeDir) : null;
     const claudeConfigDir = runtime === "claude" && claudeCell !== null ? await provisionIsolatedClaudeConfigDir(
-      resumeClaudeConfigDir ?? path12.join(tmpdir2(), `rost-runner-claude-config-${createHash4("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`),
+      resumeClaudeConfigDir ?? path12.join(tmpdir2(), `rost-runner-claude-config-${createHash6("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`),
       claudeCell,
       (message) => ctx.io.stderr.write(`${redactForLog(message)}
 `)
@@ -71738,7 +72037,7 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind, resumeSessionIdOve
     if (sandbox.kind === "seatbelt") {
       sandboxProfilePath = path12.join(
         tmpdir2(),
-        `rost-runner-sandbox-${createHash4("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`
+        `rost-runner-sandbox-${createHash6("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`
       );
       await writeFile8(sandboxProfilePath, sandbox.profile, { mode: 384, flag: EXCLUSIVE_NOFOLLOW_FLAGS });
     }
@@ -71990,7 +72289,7 @@ async function spawnMergeConflictModel(ctx, input) {
   const token = typeof mcp.token === "string" ? mcp.token : "";
   const url2 = typeof mcp.url === "string" ? `${ctx.appUrl.replace(/\/+$/, "")}${mcp.url}` : `${ctx.appUrl.replace(/\/+$/, "")}/mcp`;
   const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
-  const configPath = path12.join(tmpdir2(), `rost-runner-mcp-${createHash4("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  const configPath = path12.join(tmpdir2(), `rost-runner-mcp-${createHash6("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
   const credentialCellLockWaitMs = 30 * 6e4;
   const credentialCellLock = ctx.credentialCellLockHeld !== true ? await acquireCodexHomeLock(credentialCellDirForRuntime(input.runtime, ctx.state, ctx.config.homeDir), { waitMs: credentialCellLockWaitMs, label: credentialCellLabelForRuntime(input.runtime) }) : null;
   if (ctx.credentialCellLockHeld !== true && credentialCellLock === null) {
@@ -71999,7 +72298,7 @@ async function spawnMergeConflictModel(ctx, input) {
   try {
     const claudeCell = input.runtime === "claude" ? stableClaudeHomeDir(ctx.state, ctx.config.homeDir) : null;
     const claudeConfigDir = input.runtime === "claude" && claudeCell !== null ? await provisionIsolatedClaudeConfigDir(
-      path12.join(tmpdir2(), `rost-runner-claude-config-${createHash4("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`),
+      path12.join(tmpdir2(), `rost-runner-claude-config-${createHash6("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`),
       claudeCell,
       (message) => ctx.io.stderr.write(`${redactForLog(message)}
 `)
@@ -72021,7 +72320,7 @@ async function spawnMergeConflictModel(ctx, input) {
     ].join("\n");
     let sandboxProfilePath = null;
     if (input.sandbox.kind === "seatbelt") {
-      sandboxProfilePath = path12.join(tmpdir2(), `rost-runner-sandbox-${createHash4("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`);
+      sandboxProfilePath = path12.join(tmpdir2(), `rost-runner-sandbox-${createHash6("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`);
       await writeFile8(sandboxProfilePath, input.sandbox.profile, { mode: 384, flag: EXCLUSIVE_NOFOLLOW_FLAGS });
     }
     const built = buildTurnCommand({
@@ -73430,11 +73729,724 @@ function isEnoent(error51) {
 }
 
 // src/runner-setup-orchestrator.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { constants as fsConstants8, realpathSync as realpathSync3 } from "node:fs";
-import { open as open3, rm as rm10 } from "node:fs/promises";
-import path14 from "node:path";
+import { open as open3, rm as rm11 } from "node:fs/promises";
+import path15 from "node:path";
 import { setTimeout as defaultSleep2 } from "node:timers/promises";
+
+// src/codex-auth-adapter.ts
+import { spawn as spawn3 } from "node:child_process";
+import { lstat as lstat4, readdir as readdir6, rm as rm10 } from "node:fs/promises";
+import path14 from "node:path";
+var CODEX_MIN_AUTH_ADAPTER_VERSION = "0.144.6";
+function parseCodexVersion(raw) {
+  const trimmed = raw.trim();
+  const match = /^(?:codex-cli\s+)?(\d+)\.(\d+)\.(\d+)$/.exec(trimmed);
+  if (match === null) {
+    return null;
+  }
+  return `${match[1]}.${match[2]}.${match[3]}`;
+}
+function parseVersionComponents(version4) {
+  const parts = version4.split(".");
+  const major = Number(parts[0]);
+  const minor = Number(parts[1]);
+  const patch = Number(parts[2]);
+  return [major, minor, patch];
+}
+function compareVersions(a, b) {
+  const [aMajor, aMinor, aPatch] = parseVersionComponents(a);
+  const [bMajor, bMinor, bPatch] = parseVersionComponents(b);
+  if (aMajor !== bMajor) return aMajor - bMajor;
+  if (aMinor !== bMinor) return aMinor - bMinor;
+  return aPatch - bPatch;
+}
+var CODEX_VERSION_CEILING = "0.145.0";
+function evaluateCodexVersion(raw) {
+  const version4 = parseCodexVersion(raw);
+  if (version4 === null) {
+    return { kind: "unparsable" };
+  }
+  if (compareVersions(version4, CODEX_MIN_AUTH_ADAPTER_VERSION) < 0) {
+    return { kind: "too_old", version: version4, minimum: CODEX_MIN_AUTH_ADAPTER_VERSION };
+  }
+  if (compareVersions(version4, CODEX_VERSION_CEILING) >= 0) {
+    return { kind: "unsupported_line", version: version4 };
+  }
+  return { kind: "supported", version: version4 };
+}
+var API_KEY_LINE_PREFIX = "Logged in using an API key";
+function parseCodexLoginStatus(result) {
+  const lines = `${result.stderr}
+${result.stdout}`.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+  const isChatgptLine = lines.some((line) => line === "Logged in using ChatGPT");
+  const isApiKeyLine = lines.some((line) => line.startsWith(API_KEY_LINE_PREFIX));
+  const isLoggedOutLine = lines.some((line) => line === "Not logged in");
+  const recognizedMatchCount = [isChatgptLine, isApiKeyLine, isLoggedOutLine].filter(Boolean).length;
+  if (recognizedMatchCount > 1) {
+    return { kind: "unrecognized" };
+  }
+  if (result.code === 0 && isChatgptLine) {
+    return { kind: "chatgpt" };
+  }
+  if (result.code === 0 && isApiKeyLine) {
+    return { kind: "api_key" };
+  }
+  if (result.code !== 0 && isLoggedOutLine) {
+    return { kind: "logged_out" };
+  }
+  if (result.code !== 0 && !isChatgptLine && !isApiKeyLine && !isLoggedOutLine) {
+    return { kind: "command_failed" };
+  }
+  return { kind: "unrecognized" };
+}
+function classifyAuthJsonStat(info, selfUid) {
+  const ownerMismatch = selfUid !== null && info.uid !== selfUid;
+  const permissiveBits = (info.mode & 63) !== 0;
+  if (info.isSymbolicLink || !info.isFile || info.nlink !== 1 || ownerMismatch || permissiveBits) {
+    return { kind: "foreign" };
+  }
+  if (info.size === 0) {
+    return { kind: "empty" };
+  }
+  return { kind: "owned" };
+}
+function isTrustworthyAncestorShape(info, selfUid) {
+  return info.isDirectory && !info.isSymbolicLink && (info.mode & 18) === 0 && (selfUid === null || info.uid === selfUid);
+}
+async function isTrustworthyAbsentCellChain(cell2, opts) {
+  const lstatImpl = opts?.lstatImpl ?? lstat4;
+  const selfUid = typeof process.getuid === "function" ? process.getuid() : null;
+  let current = path14.dirname(path14.resolve(cell2));
+  for (; ; ) {
+    let info;
+    try {
+      info = await lstatImpl(current);
+    } catch (error51) {
+      if (error51.code !== "ENOENT") {
+        return false;
+      }
+      info = null;
+    }
+    if (info === null) {
+      const parent = path14.dirname(current);
+      if (parent === current) {
+        return false;
+      }
+      current = parent;
+      continue;
+    }
+    return isTrustworthyAncestorShape(
+      {
+        isDirectory: info.isDirectory(),
+        isSymbolicLink: info.isSymbolicLink(),
+        mode: info.mode,
+        uid: info.uid
+      },
+      selfUid
+    );
+  }
+}
+async function inspectCodexAuthCell(cell2) {
+  if (!await isVerifiedExistingCodexHomeDir(cell2)) {
+    const resolvedCell = path14.resolve(cell2);
+    const leafInfo = await lstat4(resolvedCell).catch((error51) => error51.code === "ENOENT" ? null : "error").catch(() => "error");
+    if (leafInfo !== null) {
+      return { kind: "unreadable" };
+    }
+    const chainTrustworthy = await isTrustworthyAbsentCellChain(cell2);
+    return chainTrustworthy ? { kind: "absent" } : { kind: "unreadable" };
+  }
+  const cellInfo = await lstat4(cell2).catch(() => null);
+  if (cellInfo === null) {
+    return { kind: "unreadable" };
+  }
+  if ((cellInfo.mode & 63) !== 0) {
+    return { kind: "foreign" };
+  }
+  const authJsonPath = path14.join(cell2, "auth.json");
+  const info = await lstat4(authJsonPath).catch((error51) => {
+    if (error51.code === "ENOENT") {
+      return null;
+    }
+    throw error51;
+  }).catch(() => "unreadable");
+  if (info === "unreadable") {
+    return { kind: "unreadable" };
+  }
+  if (info === null) {
+    return { kind: "empty" };
+  }
+  const selfUid = typeof process.getuid === "function" ? process.getuid() : null;
+  return classifyAuthJsonStat(
+    {
+      isSymbolicLink: info.isSymbolicLink(),
+      isFile: info.isFile(),
+      nlink: info.nlink,
+      uid: info.uid,
+      mode: info.mode,
+      size: info.size
+    },
+    selfUid
+  );
+}
+function decideCodexAuth(version4, cell2, status) {
+  switch (version4.kind) {
+    case "too_old":
+      return { kind: "refuse", reason: "codex_version_too_old" };
+    case "unsupported_line":
+      return { kind: "refuse", reason: "codex_version_unsupported_line" };
+    case "unparsable":
+      return { kind: "refuse", reason: "codex_version_unparsable" };
+    case "supported":
+      break;
+    default: {
+      const exhaustive = version4;
+      throw new Error(`unreachable codex version verdict: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+  if (cell2.kind === "unreadable") {
+    return { kind: "refuse", reason: "cell_unreadable" };
+  }
+  if (cell2.kind === "foreign") {
+    return { kind: "refuse", reason: "foreign_cell_ownership" };
+  }
+  switch (cell2.kind) {
+    case "absent": {
+      switch (status.kind) {
+        case "chatgpt":
+        case "api_key":
+          return { kind: "refuse", reason: "status_not_from_this_cell" };
+        case "logged_out":
+        case "command_failed":
+        case "unrecognized":
+          return { kind: "device_auth_login_required" };
+        case "exit_unconfirmed":
+          return { kind: "refuse", reason: "probe_exit_unconfirmed" };
+        default: {
+          const exhaustive = status;
+          throw new Error(`unreachable codex login status: ${JSON.stringify(exhaustive)}`);
+        }
+      }
+    }
+    case "empty": {
+      switch (status.kind) {
+        case "chatgpt":
+        case "api_key":
+          return { kind: "refuse", reason: "status_not_from_this_cell" };
+        case "logged_out":
+          return { kind: "device_auth_login_required" };
+        case "command_failed":
+          return { kind: "refuse", reason: "status_unavailable" };
+        case "exit_unconfirmed":
+          return { kind: "refuse", reason: "probe_exit_unconfirmed" };
+        case "unrecognized":
+          return { kind: "refuse", reason: "unrecognized_status" };
+        default: {
+          const exhaustive = status;
+          throw new Error(`unreachable codex login status: ${JSON.stringify(exhaustive)}`);
+        }
+      }
+    }
+    case "owned": {
+      switch (status.kind) {
+        case "chatgpt":
+          return { kind: "proceed_to_validation" };
+        case "api_key":
+          return { kind: "refuse", reason: "api_key_auth_unsupported" };
+        case "logged_out":
+          return { kind: "device_auth_login_required" };
+        case "command_failed":
+          return { kind: "refuse", reason: "status_unavailable" };
+        case "exit_unconfirmed":
+          return { kind: "refuse", reason: "probe_exit_unconfirmed" };
+        case "unrecognized":
+          return { kind: "refuse", reason: "unrecognized_status" };
+        default: {
+          const exhaustive = status;
+          throw new Error(`unreachable codex login status: ${JSON.stringify(exhaustive)}`);
+        }
+      }
+    }
+    default: {
+      const exhaustive = cell2;
+      throw new Error(`unreachable codex auth cell state: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}
+var CODEX_LOGIN_ENV_ALLOWLIST = LOGIN_ENV_ALLOWLIST;
+function copyAllowlistedEnv(base) {
+  const env = {};
+  for (const key of CODEX_LOGIN_ENV_ALLOWLIST) {
+    const value = base[key];
+    if (typeof value === "string") {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+function buildCodexAuthEnv(base, cell2) {
+  const env = copyAllowlistedEnv(base);
+  env.CODEX_HOME = cell2;
+  return env;
+}
+var CODEX_PROBE_TIMEOUT_MS = 15e3;
+var CODEX_PROBE_KILL_GRACE_MS = 2e3;
+var CODEX_PROBE_SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+var CODEX_PROBE_SANDBOX_PROFILE = "(version 1) (allow default) (deny process-fork)";
+function probeContainmentUnavailable() {
+  return Object.assign(
+    new Error(
+      `refusing to run the codex probe: complete descendant containment is unavailable on ${process.platform}`
+    ),
+    {
+      code: "EROST_PROBE_CONTAINMENT_UNAVAILABLE",
+      codexProbeContainmentUnavailable: true
+    }
+  );
+}
+function decideProbeGroupKill(observed) {
+  if (observed.childExited && observed.groupHeldAtChildExit === false) {
+    return "skip";
+  }
+  return observed.groupPopulatedNow ? "signal" : "skip";
+}
+function spawnCapture(cmd, args, opts) {
+  const timeoutMs = opts.timeoutMs ?? CODEX_PROBE_TIMEOUT_MS;
+  const killGraceMs = opts.killGraceMs ?? CODEX_PROBE_KILL_GRACE_MS;
+  const containment = opts.containment ?? "required";
+  return new Promise((resolve2, reject) => {
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let spawnCommand = cmd;
+    let spawnArgs = args;
+    if (containment === "required") {
+      if (process.platform !== "darwin") {
+        reject(probeContainmentUnavailable());
+        return;
+      }
+      spawnCommand = CODEX_PROBE_SANDBOX_EXEC_PATH;
+      spawnArgs = ["-p", CODEX_PROBE_SANDBOX_PROFILE, cmd, ...args];
+    }
+    const child = spawn3(spawnCommand, spawnArgs, {
+      env: opts.env,
+      stdio: ["ignore", "pipe", "pipe"],
+      ...process.platform !== "win32" ? { detached: true } : {}
+    });
+    let settled = false;
+    let timedOut = false;
+    let killOutcome = null;
+    let timer = null;
+    let graceTimer = null;
+    let childExited = false;
+    let groupHeldAtChildExit = null;
+    const probeGroupPopulated = () => {
+      const pid = child.pid;
+      if (typeof pid !== "number") {
+        return false;
+      }
+      if (process.platform !== "win32") {
+        try {
+          process.kill(-pid, 0);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      return !childExited;
+    };
+    const terminateProbeGroup = () => {
+      if (killOutcome !== null) {
+        return;
+      }
+      if (decideProbeGroupKill({ childExited, groupHeldAtChildExit, groupPopulatedNow: probeGroupPopulated() }) === "skip") {
+        killOutcome = "skipped_nothing_ours";
+        return;
+      }
+      killProcessTree(child);
+      killOutcome = "signalled";
+    };
+    const clearTimers = () => {
+      if (timer !== null) {
+        clearTimeout(timer);
+      }
+      if (graceTimer !== null) {
+        clearTimeout(graceTimer);
+      }
+    };
+    const teardownCapture = () => {
+      child.stdout?.removeAllListeners("data");
+      child.stderr?.removeAllListeners("data");
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+    };
+    const startSettleGrace = (phase) => {
+      if (graceTimer !== null || settled) {
+        return;
+      }
+      graceTimer = setTimeout(() => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        clearTimers();
+        teardownCapture();
+        reject(Object.assign(
+          new Error(
+            phase === "timeout" ? `${cmd} ${args.join(" ")} timed out after ${timeoutMs}ms and the exit of its process tree could not be confirmed within ${killGraceMs}ms` : `${cmd} ${args.join(" ")} exited, but a descendant kept its output pipes open and its exit could not be confirmed within ${killGraceMs}ms`
+          ),
+          {
+            code: "ETIMEDOUT",
+            codexProbeExitUnconfirmedMs: killGraceMs,
+            codexProbeKillOutcome: killOutcome,
+            codexProbeSettlePhase: phase,
+            codexProbeContainment: containment
+          }
+        ));
+      }, killGraceMs);
+    };
+    timer = setTimeout(() => {
+      if (settled || childExited) {
+        return;
+      }
+      timedOut = true;
+      terminateProbeGroup();
+      startSettleGrace("timeout");
+    }, timeoutMs);
+    child.on("exit", () => {
+      childExited = true;
+      groupHeldAtChildExit = probeGroupPopulated();
+      if (settled) {
+        return;
+      }
+      terminateProbeGroup();
+      startSettleGrace("child_exit");
+    });
+    child.stdout?.on("data", (chunk) => stdoutChunks.push(chunk));
+    child.stderr?.on("data", (chunk) => stderrChunks.push(chunk));
+    child.on("error", (error51) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimers();
+      teardownCapture();
+      if (containment === "required" && error51.code !== void 0 && ["ENOENT", "EACCES"].includes(String(error51.code))) {
+        reject(probeContainmentUnavailable());
+        return;
+      }
+      reject(error51);
+    });
+    child.on("close", (code) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimers();
+      teardownCapture();
+      if (timedOut) {
+        reject(Object.assign(new Error(`${cmd} ${args.join(" ")} timed out after ${timeoutMs}ms`), {
+          code: "ETIMEDOUT",
+          codexProbeTimedOutMs: timeoutMs,
+          codexProbeKillOutcome: killOutcome,
+          codexProbeContainment: containment
+        }));
+        return;
+      }
+      resolve2({
+        code: code ?? 1,
+        stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+        stderr: Buffer.concat(stderrChunks).toString("utf8")
+      });
+    });
+  });
+}
+var CODEX_IGNORE_USER_CONFIG_ARGS = ["--ignore-user-config"];
+function describeProbeKillOutcome(error51) {
+  const outcome = "codexProbeKillOutcome" in error51 ? error51.codexProbeKillOutcome : null;
+  if (outcome === "signalled") {
+    return "SIGKILL was sent to its process group";
+  }
+  if (outcome === "skipped_nothing_ours") {
+    return "no signal was sent: the probe's process group held nothing of ours left to signal";
+  }
+  return "its kill outcome was not recorded";
+}
+function describeSpawnFailure(what, error51) {
+  if (typeof error51 === "object" && error51 !== null && "codexProbeContainmentUnavailable" in error51) {
+    return `${what} refused: complete descendant containment is unavailable on ${process.platform}`;
+  }
+  if (typeof error51 === "object" && error51 !== null && "codexProbeExitUnconfirmedMs" in error51) {
+    const graceMs = error51.codexProbeExitUnconfirmedMs;
+    const containment = "codexProbeContainment" in error51 ? error51.codexProbeContainment : null;
+    const phase = "codexProbeSettlePhase" in error51 ? error51.codexProbeSettlePhase : null;
+    const lede = phase === "child_exit" ? `${what} exited, but a descendant kept its output pipes open` : `${what} timed out`;
+    return containment === "required" ? `${lede}; ${describeProbeKillOutcome(error51)}, and its exit could not be confirmed within ${String(graceMs)}ms despite the probe containment boundary` : `${lede}; ${describeProbeKillOutcome(error51)}, and its exit could not be confirmed within ${String(graceMs)}ms; a descendant process may still be running`;
+  }
+  if (typeof error51 === "object" && error51 !== null && "codexProbeTimedOutMs" in error51) {
+    const timedOutMs = error51.codexProbeTimedOutMs;
+    const containment = "codexProbeContainment" in error51 ? error51.codexProbeContainment : null;
+    return containment === "required" ? `${what} timed out after ${String(timedOutMs)}ms; ${describeProbeKillOutcome(error51)}, and the probe process exited and closed its output pipes under the descendant-containment boundary` : `${what} timed out after ${String(timedOutMs)}ms; ${describeProbeKillOutcome(error51)}, and the probe process exited and closed its output pipes; a descendant that left the process group with its own stdio would not be observed here`;
+  }
+  const code = typeof error51 === "object" && error51 !== null && "code" in error51 ? String(error51.code) : "unknown";
+  return `${what} could not be spawned (${code})`;
+}
+async function probeCodexVersion(codexBin, opts) {
+  const spawnImpl = opts?.spawnImpl ?? spawnCapture;
+  const env = copyAllowlistedEnv(opts?.env ?? process.env);
+  let result;
+  try {
+    result = await spawnImpl(codexBin, ["--version", ...CODEX_IGNORE_USER_CONFIG_ARGS], {
+      env,
+      ...opts?.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
+      ...opts?.killGraceMs !== void 0 ? { killGraceMs: opts.killGraceMs } : {},
+      ...opts?.containmentForTest !== void 0 ? { containment: opts.containmentForTest } : {}
+    });
+  } catch (error51) {
+    opts?.onProbeError?.(describeSpawnFailure("codex --version", error51));
+    return { kind: "unparsable" };
+  }
+  if (result.code !== 0) {
+    return { kind: "unparsable" };
+  }
+  for (const line of `${result.stdout}
+${result.stderr}`.split("\n")) {
+    if (parseCodexVersion(line) !== null) {
+      return evaluateCodexVersion(line);
+    }
+  }
+  return { kind: "unparsable" };
+}
+var CODEX_AUTH_CELL_ROUTINE_ENTRIES = /* @__PURE__ */ new Set(["log", "tmp", "config.toml"]);
+function isRoutineCodexBookkeepingShape(entry, info, selfUid) {
+  if (!CODEX_AUTH_CELL_ROUTINE_ENTRIES.has(entry) || info.isSymbolicLink()) {
+    return false;
+  }
+  if (selfUid !== null && info.uid !== selfUid) {
+    return false;
+  }
+  if ((info.mode & 18) !== 0) {
+    return false;
+  }
+  return entry === "config.toml" ? info.isFile() && info.nlink === 1 : info.isDirectory();
+}
+async function sweepCodexAuthCell(cell2, onRepair, rmImpl) {
+  const removeImpl = rmImpl ?? ((target) => rm10(target, { recursive: true, force: true }));
+  const selfUid = typeof process.getuid === "function" ? process.getuid() : null;
+  const entries = await readdir6(cell2);
+  for (const entry of entries) {
+    const entryPath = path14.join(cell2, entry);
+    const info = await lstat4(entryPath).catch(() => null);
+    const isOwnedAuthJson = entry === "auth.json" && info !== null && classifyAuthJsonStat(
+      {
+        isSymbolicLink: info.isSymbolicLink(),
+        isFile: info.isFile(),
+        nlink: info.nlink,
+        uid: info.uid,
+        mode: info.mode,
+        size: info.size
+      },
+      selfUid
+    ).kind === "owned";
+    if (isOwnedAuthJson) {
+      continue;
+    }
+    const isRoutine = info !== null && isRoutineCodexBookkeepingShape(entry, info, selfUid);
+    if (!isRoutine) {
+      onRepair?.(`codex credential cell ${cell2}: removing unexpected entry ${JSON.stringify(entry)}`);
+    }
+    try {
+      await removeImpl(entryPath);
+    } catch (error51) {
+      const code = error51.code ?? "unknown";
+      throw new Error(
+        `refusing to use the codex credential cell: could not remove ${JSON.stringify(entry)} from the codex credential cell ${cell2} (${code}). The credential-cell sweep must not fail open \u2014 clear the entry (e.g. \`chflags -R nouchg\`, then \`rm -rf\`) and retry.`
+      );
+    }
+  }
+}
+var CODEX_PROBE_CREDENTIAL_CELL_LOCK_WAIT_MS = 5e3;
+async function probeCodexLoginStatus(codexBin, cell2, opts) {
+  const spawnImpl = opts?.spawnImpl ?? spawnCapture;
+  const acquireLockImpl = opts?.acquireLockImpl ?? acquireCodexHomeLock;
+  const waitMs = opts?.credentialCellLockWaitMs ?? CODEX_PROBE_CREDENTIAL_CELL_LOCK_WAIT_MS;
+  let lock;
+  try {
+    lock = await acquireLockImpl(cell2, { waitMs, label: "codex credential cell" });
+  } catch (error51) {
+    opts?.onProbeError?.(
+      `codex credential cell ${cell2}: could not acquire the credential-cell lock (${redactForLog(error51 instanceof Error ? error51.message : String(error51))}); could not determine login status`
+    );
+    return { kind: "command_failed" };
+  }
+  if (lock === null) {
+    opts?.onProbeError?.(
+      `codex credential cell ${cell2}: another process is using this cell (a running codex turn, or a concurrent device-auth login); could not determine login status without racing it`
+    );
+    return { kind: "command_failed" };
+  }
+  try {
+    try {
+      await ensureVerifiedCodexHomeDir(cell2, opts?.onRepair, "codex credential cell");
+      await sweepCodexAuthCell(cell2, opts?.onRepair, opts?.rmImpl);
+    } catch (error51) {
+      opts?.onProbeError?.(
+        `codex credential cell ${cell2}: could not verify or sweep the cell before probing login status (${redactForLog(error51 instanceof Error ? error51.message : String(error51))}); could not determine login status`
+      );
+      return { kind: "command_failed" };
+    }
+    const env = buildCodexAuthEnv(opts?.env ?? process.env, cell2);
+    let result;
+    try {
+      result = await spawnImpl(codexBin, ["login", "status"], {
+        env,
+        ...opts?.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
+        ...opts?.killGraceMs !== void 0 ? { killGraceMs: opts.killGraceMs } : {},
+        ...opts?.containmentForTest !== void 0 ? { containment: opts.containmentForTest } : {}
+      });
+    } catch (error51) {
+      opts?.onProbeError?.(describeSpawnFailure("codex login status", error51));
+      if (typeof error51 === "object" && error51 !== null && "codexProbeExitUnconfirmedMs" in error51) {
+        return { kind: "exit_unconfirmed" };
+      }
+      return { kind: "command_failed" };
+    }
+    return parseCodexLoginStatus(result);
+  } finally {
+    await lock.release();
+  }
+}
+var CODEX_LOGIN_CREDENTIAL_CELL_LOCK_WAIT_MS = 5e3;
+async function hasUsableCodexAuthCredential(cell2) {
+  const info = await lstat4(path14.join(cell2, "auth.json")).catch(() => null);
+  if (info === null) {
+    return false;
+  }
+  const selfUid = typeof process.getuid === "function" ? process.getuid() : null;
+  return classifyAuthJsonStat(
+    {
+      isSymbolicLink: info.isSymbolicLink(),
+      isFile: info.isFile(),
+      nlink: info.nlink,
+      uid: info.uid,
+      mode: info.mode,
+      size: info.size
+    },
+    selfUid
+  ).kind === "owned";
+}
+async function captureCodexAuthJsonIdentity(cell2) {
+  const info = await lstat4(path14.join(cell2, "auth.json"), { bigint: true }).catch(() => null);
+  if (info === null) {
+    return null;
+  }
+  return { ino: info.ino, mtimeNs: info.mtimeNs, size: info.size };
+}
+function isEnoentError(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
+}
+async function runCodexDeviceAuthLogin(options) {
+  const acquireLockImpl = options.acquireLockImpl ?? acquireCodexHomeLock;
+  const spawnLoginImpl = options.spawnLoginImpl ?? spawnLogin;
+  const commitSeedMarkerImpl = options.commitSeedMarkerImpl ?? ((cell2) => commitCodexHomeSeedMarker(cell2, { required: true }));
+  const waitMs = options.credentialCellLockWaitMs ?? CODEX_LOGIN_CREDENTIAL_CELL_LOCK_WAIT_MS;
+  const stderr = options.io?.stderr ?? process.stderr;
+  try {
+    const lock = await acquireLockImpl(options.cell, { waitMs, label: "codex credential cell" });
+    if (lock === null) {
+      stderr.write(
+        "another process is using this runner's codex credential cell (a running codex turn, or a concurrent device-auth login); wait for it to finish and retry.\n"
+      );
+      return 1;
+    }
+    try {
+      await ensureVerifiedCodexHomeDir(options.cell, options.onRepair, "codex credential cell");
+      const markerPath = path14.join(path14.dirname(options.cell), `${path14.basename(options.cell)}.seeded`);
+      try {
+        await rm10(markerPath, { force: true });
+      } catch (error51) {
+        throw new Error(
+          `refusing to run codex device-auth login: could not clear the existing auth marker ${markerPath}; the server must keep codex work blocked until login completes (${redactForLog(error51 instanceof Error ? error51.message : String(error51))})`
+        );
+      }
+      await sweepCodexAuthCell(options.cell, options.onRepair);
+      const preLoginAuthJsonIdentity = await captureCodexAuthJsonIdentity(options.cell);
+      let loginCode;
+      try {
+        loginCode = await spawnLoginImpl(options.codexBin, ["login", "--device-auth"], {
+          env: buildCodexAuthEnv(options.env, options.cell),
+          ...options.io ? { io: options.io } : {},
+          // FIX 8 (DER-3338 round 2, P3): default to "to-stderr", NOT spawnLogin's own "inherit"
+          // default. Conservative-by-default (invariant 10): an unspecified caller may be running
+          // under `--json`, and the device-auth URL/one-time code are human copy that must never land
+          // on stdout and corrupt a machine-readable stream. A caller that specifically wants the
+          // ceremony on an inherited TTY stdout (interactive standalone use) opts in explicitly.
+          ceremonyStdout: options.ceremonyStdout ?? "to-stderr"
+        });
+      } catch (error51) {
+        if (isEnoentError(error51)) {
+          stderr.write("codex CLI not found on PATH; install codex first.\n");
+          return 1;
+        }
+        throw error51;
+      }
+      if (loginCode !== 0) {
+        stderr.write(
+          `codex login --device-auth exited ${loginCode}; the runner credential was not provisioned.
+`
+        );
+        return 1;
+      }
+      const postLoginUsable = await hasUsableCodexAuthCredential(options.cell);
+      const postLoginAuthJsonIdentity = postLoginUsable ? await captureCodexAuthJsonIdentity(options.cell) : null;
+      const credentialWasRenewed = preLoginAuthJsonIdentity === null || postLoginAuthJsonIdentity !== null && (preLoginAuthJsonIdentity.ino !== postLoginAuthJsonIdentity.ino || preLoginAuthJsonIdentity.mtimeNs !== postLoginAuthJsonIdentity.mtimeNs || preLoginAuthJsonIdentity.size !== postLoginAuthJsonIdentity.size);
+      if (!postLoginUsable || !credentialWasRenewed) {
+        stderr.write(
+          postLoginUsable ? "codex login --device-auth reported success, but left the existing credential in the runner's codex credential cell untouched; the runner's authentication was not renewed. Retry the login.\n" : "codex login --device-auth reported success, but no usable credential is present in the runner's codex credential cell; the runner is NOT authenticated. Retry the login.\n"
+        );
+        return 1;
+      }
+      try {
+        await commitSeedMarkerImpl(options.cell);
+      } catch (error51) {
+        stderr.write(
+          `codex login --device-auth completed, but the runner auth marker could not be committed; the server will keep codex work blocked until it is. Retry the login: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`
+        );
+        return 1;
+      }
+      return 0;
+    } finally {
+      await lock.release();
+    }
+  } catch (error51) {
+    stderr.write(`${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+    return 1;
+  }
+}
+async function evaluateCodexAuth(options) {
+  const probeOpts = {
+    ...options.env !== void 0 ? { env: options.env } : {},
+    ...options.spawnImpl !== void 0 ? { spawnImpl: options.spawnImpl } : {},
+    ...options.onProbeError !== void 0 ? { onProbeError: options.onProbeError } : {}
+  };
+  const statusProbeOpts = {
+    ...probeOpts,
+    ...options.acquireLockImpl !== void 0 ? { acquireLockImpl: options.acquireLockImpl } : {},
+    ...options.credentialCellLockWaitMs !== void 0 ? { credentialCellLockWaitMs: options.credentialCellLockWaitMs } : {},
+    ...options.onRepair !== void 0 ? { onRepair: options.onRepair } : {}
+  };
+  const version4 = await probeCodexVersion(options.codexBin, probeOpts);
+  const cellState = await inspectCodexAuthCell(options.cell);
+  const versionRefused = version4.kind !== "supported";
+  const status = !versionRefused && (cellState.kind === "empty" || cellState.kind === "owned") ? await probeCodexLoginStatus(options.codexBin, options.cell, statusProbeOpts) : null;
+  const decision = decideCodexAuth(version4, cellState, status ?? { kind: "unrecognized" });
+  return { version: version4, cell: cellState, status, decision };
+}
+
+// src/runner-setup-orchestrator.ts
 var SETUP_SIDECAR_VERSION = 1;
 var SETUP_STAGES_IN_ORDER = [
   runnerSetupStageSchema.enum.pairing,
@@ -73503,13 +74515,13 @@ var runnerSetupSessionEnvelopeSchema = external_exports.object({
   action_required: runnerSetupActionRequiredSchema.nullable()
 }).passthrough();
 function runnerSetupSidecarBaseDir(homeDir) {
-  return path14.join(homeDir, ".rost", "runner", "setup");
+  return path15.join(homeDir, ".rost", "runner", "setup");
 }
 function sidecarFilePath(homeDir, setupId) {
-  return path14.join(runnerSetupSidecarBaseDir(homeDir), `${setupId}.json`);
+  return path15.join(runnerSetupSidecarBaseDir(homeDir), `${setupId}.json`);
 }
 function currentSidecarPath(homeDir) {
-  return path14.join(runnerSetupSidecarBaseDir(homeDir), "current");
+  return path15.join(runnerSetupSidecarBaseDir(homeDir), "current");
 }
 async function readPrivateTextFile(filePath) {
   let handle = null;
@@ -73578,7 +74590,7 @@ async function writeSidecar(homeDir, sidecar, options = {}) {
   }
 }
 async function clearCurrentSidecar(homeDir) {
-  await rm10(currentSidecarPath(homeDir), { force: true });
+  await rm11(currentSidecarPath(homeDir), { force: true });
 }
 function makeFreshSidecar(session, appUrl2, stateFile, now) {
   return {
@@ -73830,8 +74842,8 @@ function parseArgs2(args, options = {}) {
   return { ok: true, json: json2, agent, yes, noExecute, execute: execute2, runtime, userCode, setupId, stateFile, explicitStateFile, timeoutMs, rest };
 }
 function durableSetupStateFile(homeDir, appUrl2) {
-  const key = createHash5("sha1").update(appUrl2).digest("hex").slice(0, 8);
-  return path14.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-setup-${key}.json`);
+  const key = createHash7("sha1").update(appUrl2).digest("hex").slice(0, 8);
+  return path15.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-setup-${key}.json`);
 }
 function isEphemeralStateFile(stateFile, appUrl2) {
   return sameStateFile(stateFile, defaultRunnerStateFile(appUrl2));
@@ -73889,11 +74901,11 @@ async function preflightServiceInstall(stateFile, appUrl2, options, own) {
       actionRequired: { kind: "manual_service_install", runtime: null, url: null, user_code: null, expires_at: null }
     };
   }
-  if (!path14.isAbsolute(stateFile)) {
+  if (!path15.isAbsolute(stateFile)) {
     return {
       ok: false,
       exitCode: 1,
-      message: `The runner state file ${stateFile} is a relative path, and a launchd service resolves it against its own working directory, not yours. Re-run setup with an absolute path, for example \`--state-file "${path14.resolve(stateFile)}"\`.`
+      message: `The runner state file ${stateFile} is a relative path, and a launchd service resolves it against its own working directory, not yours. Re-run setup with an absolute path, for example \`--state-file "${path15.resolve(stateFile)}"\`.`
     };
   }
   if (isEphemeralStateFile(stateFile, appUrl2)) {
@@ -73927,9 +74939,9 @@ async function preflightServiceInstall(stateFile, appUrl2, options, own) {
 }
 function formatUsage(binName) {
   return [
-    `Usage: ${binName} runner setup start --runtime claude [--user-code <code>] [--json] [--agent] [--state-file <path>] [--timeout-ms <ms>] [--no-execute | --execute]`,
+    `Usage: ${binName} runner setup start --runtime claude|codex [--user-code <code>] [--json] [--agent] [--state-file <path>] [--timeout-ms <ms>] [--no-execute | --execute]`,
     `       ${binName} runner setup status [--setup-id <id>] [--json]`,
-    `       ${binName} runner setup resume [--setup-id <id>] [--runtime claude] [--user-code <code>] [--json] [--agent] [--timeout-ms <ms>] [--no-execute | --execute]`,
+    `       ${binName} runner setup resume [--setup-id <id>] [--runtime claude|codex] [--user-code <code>] [--json] [--agent] [--timeout-ms <ms>] [--no-execute | --execute]`,
     `       ${binName} runner setup cancel [--setup-id <id>] [--json]`
   ].join("\n");
 }
@@ -73941,9 +74953,6 @@ function validateRuntimeFlag(value) {
   if (!parsed.success) {
     return { ok: false, message: `Unsupported runtime: ${value}.` };
   }
-  if (parsed.data === "codex") {
-    return { ok: false, message: "Codex setup is not yet available." };
-  }
   return { ok: true, runtime: parsed.data };
 }
 function validateAgentUserCode(agent, userCode, verb, io, json2) {
@@ -73984,8 +74993,15 @@ async function validateProviderConsentCheckpoint(sidecar, homeDir) {
     return false;
   }
   const runnerId = pairingCheckpoint.runner_id;
-  const cell2 = stableClaudeHomeDir({ runner_id: runnerId, runner_secret: "" }, homeDir);
-  return cell2 === checkpoint.cell && !await claudeCellNeedsLogin(cell2);
+  if (provenRuntimes.length !== 1) return false;
+  if (provenRuntimes[0] === "claude") {
+    const cell3 = stableClaudeHomeDir({ runner_id: runnerId, runner_secret: "" }, homeDir);
+    return cell3 === checkpoint.cell && !await claudeCellNeedsLogin(cell3);
+  }
+  const cell2 = stableCodexHomeDir({ runner_id: runnerId, runner_secret: "" }, homeDir);
+  if (cell2 !== checkpoint.cell) return false;
+  const auth = await evaluateCodexAuth({ codexBin: "codex", cell: cell2 });
+  return auth.decision.kind === "proceed_to_validation";
 }
 async function validateServiceInstallCheckpoint(sidecar, options, execute2) {
   const checkpoint = sidecar.stages.service_install;
@@ -74091,10 +75107,13 @@ async function runPairingStage(sidecar, userCode, agent, fetchImpl, appUrl2, hom
     const newState = {
       runner_id: claimResult.runnerId,
       runner_secret: claimResult.runnerSecret,
+      active_setup_id: sidecar.setup_id,
+      ...sidecar.selected_runtimes[0] !== void 0 ? { setup_runtime: sidecar.selected_runtimes[0] } : {},
       ...claimResult.tenantId !== null ? { tenant_id: claimResult.tenantId } : {},
       ...claimResult.name !== null ? { name: claimResult.name } : {},
       ...claimResult.serviceKeyPrivate !== void 0 ? { service_key_private: claimResult.serviceKeyPrivate } : {},
-      ...claimResult.serviceKeyPublic !== void 0 ? { service_key_public: claimResult.serviceKeyPublic } : {}
+      ...claimResult.serviceKeyPublic !== void 0 ? { service_key_public: claimResult.serviceKeyPublic } : {},
+      ...claimResult.serviceKeyGeneration !== void 0 ? { service_key_generation: claimResult.serviceKeyGeneration } : {}
     };
     await saveState(sidecar.state_file, newState);
     await reapSupersededRunnerHomes(priorState, newState.runner_id, homeDir);
@@ -74137,14 +75156,33 @@ async function claimRunnerPairingCodeSafe(fetchImpl, appUrl2, userCode, serviceK
   }
 }
 async function runProviderConsentStage(sidecar, homeDir, appUrl2, env, io, loginImpl, now, allowLocalCeremony, json2) {
-  if (!sidecar.selected_runtimes.includes(runnerSetupRuntimeSchema.enum.claude)) {
-    return { kind: "login_failed", exitCode: 1, message: "Codex setup is not yet available." };
-  }
   const pairing = sidecar.stages.pairing;
   if (pairing === void 0) {
     return { kind: "login_failed", exitCode: 1, message: "Pairing checkpoint missing before provider consent." };
   }
   const state = { runner_id: pairing.runner_id, runner_secret: "" };
+  if (sidecar.selected_runtimes.length === 1 && sidecar.selected_runtimes[0] === "codex") {
+    const cell3 = stableCodexHomeDir(state, homeDir);
+    let auth = await evaluateCodexAuth({ codexBin: "codex", cell: cell3, env });
+    if (auth.decision.kind === "proceed_to_validation") {
+      return { kind: "done", sidecar: addStageCheckpoint(sidecar, runnerSetupStageSchema.enum.provider_consent, { cell: cell3, runtimes: ["codex"] }, now) };
+    }
+    if (auth.decision.kind !== "device_auth_login_required" || !allowLocalCeremony) {
+      return { kind: "needs_human_action" };
+    }
+    const loginExit2 = await runCodexDeviceAuthLogin({
+      codexBin: "codex",
+      cell: cell3,
+      env,
+      io: { stdout: io.stderr, stderr: io.stderr },
+      ceremonyStdout: json2 ? "to-stderr" : "inherit"
+    });
+    if (loginExit2 !== 0) {
+      return { kind: "login_failed", exitCode: 1, message: `Codex provider consent failed or was declined (exit ${loginExit2}). Re-run resume to retry.` };
+    }
+    auth = await evaluateCodexAuth({ codexBin: "codex", cell: cell3, env });
+    return auth.decision.kind === "proceed_to_validation" ? { kind: "done", sidecar: addStageCheckpoint(sidecar, runnerSetupStageSchema.enum.provider_consent, { cell: cell3, runtimes: ["codex"] }, now) } : { kind: "login_failed", exitCode: 1, message: "Codex credential cell is not ready after login." };
+  }
   const cell2 = stableClaudeHomeDir(state, homeDir);
   if (!await claudeCellNeedsLogin(cell2)) {
     const provenRuntimes = [runnerSetupRuntimeSchema.enum.claude];