@rynx-ai/runtime 0.1.11-beta.33 → 0.1.11-beta.35

package/dist/codex-home.js

@@ -1,26 +1,174 @@
 import { randomUUID } from "node:crypto";
-import { copyFileSync, cpSync, existsSync, mkdirSync, renameSync, rmSync, symlinkSync } from "node:fs";
+import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { parse, stringify } from "smol-toml";
 import { assertSkillPathComponent, getRuntimeProfile, resolveRuntimeHome, } from "@rynx-ai/core";
 import { adoptLegacyRuntimeDirectory, legacyRuntimeStateRoot, runtimeSessionDigest, runtimeSessionStateDir, } from "./runtime-state-paths.js";
-/** Inherit the user's LIVE login by symlink (stays in sync). */
-const SYMLINK_FILES = ["auth.json"];
+/** Codex-owned files that must stay live across every private home. */
+const CODEX_SYMLINK_FILES = [
+    "auth.json",
+    ".credentials.json",
+    "memories_1.sqlite",
+    "AGENTS.md",
+    "AGENTS.override.md",
+    "hooks.json",
+];
+/** Large/shared Codex state and cross-process coordination directories. */
+const CODEX_SYMLINK_DIRS = [
+    join("plugins", "cache"),
+    "mcp-oauth-locks",
+    "memories",
+    "rules",
+];
 /** Inherit the user's settings by snapshot copy (not the mutable NUX/update state). */
 const COPY_FILES = ["config.toml"];
 const RUNTIME_HOME_FILES = {
-    codex: { symlink: SYMLINK_FILES, copy: COPY_FILES },
+    codex: {
+        symlink: CODEX_SYMLINK_FILES,
+        symlinkDirs: CODEX_SYMLINK_DIRS,
+        copy: COPY_FILES,
+    },
     traex: {
         // Traex keeps credentials below `cli/`, while its user configuration lives
         // at the TRAE_HOME root. Keep both the current TOML name and the legacy YAML
         // name so existing installations remain usable without an implicit migrate.
         symlink: ["cli/auth.json"],
+        symlinkDirs: [],
         copy: ["traecli.toml", "traecli.yaml"],
     },
 };
+const CODEX_BUILTIN_PROVIDERS = new Set([
+    "openai",
+    "amazon-bedrock",
+    "amazon-bedrock-runtime",
+    "ollama",
+    "lmstudio",
+]);
+function isTomlTable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Resolve the effective native Provider, honoring the selected profile first. */
+function effectiveCodexModelProvider(config) {
+    let provider = config.model_provider;
+    const activeProfile = config.profile;
+    if (typeof activeProfile === "string" && activeProfile.trim() && isTomlTable(config.profiles)) {
+        const profile = config.profiles[activeProfile];
+        if (isTomlTable(profile) && typeof profile.model_provider === "string") {
+            provider = profile.model_provider;
+        }
+    }
+    return typeof provider === "string" && provider.trim() ? provider : null;
+}
+/** Read the credential mode from Codex's optional-field auth.json shape. */
+export function codexAuthEffectiveMode(authPath) {
+    let data;
+    try {
+        data = JSON.parse(readFileSync(authPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return null;
+    const auth = data;
+    const tokens = auth.tokens;
+    if (tokens && typeof tokens === "object" && !Array.isArray(tokens)) {
+        const tokenRecord = tokens;
+        for (const field of ["access_token", "refresh_token"]) {
+            const value = tokenRecord[field];
+            if (typeof value === "string" && value.trim())
+                return "chatgpt";
+        }
+    }
+    if (typeof auth.OPENAI_API_KEY === "string" && auth.OPENAI_API_KEY.trim())
+        return "apikey";
+    if (typeof auth.personal_access_token === "string" &&
+        auth.personal_access_token.trim())
+        return "pat";
+    return null;
+}
+/** Mirror Codex's provider-specific auth decision without spawning the CLI. */
+export function codexConfigEffectiveAuth(configPath, env = process.env) {
+    let config;
+    try {
+        config = parse(readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return "codex-login";
+    }
+    const providerId = effectiveCodexModelProvider(config);
+    if (!providerId)
+        return "codex-login";
+    if (CODEX_BUILTIN_PROVIDERS.has(providerId)) {
+        return providerId === "openai" ? "codex-login" : "provider-ready";
+    }
+    const provider = isTomlTable(config.model_providers)
+        ? config.model_providers[providerId]
+        : undefined;
+    if (!isTomlTable(provider))
+        return "provider-auth-missing";
+    if (provider.requires_openai_auth === true)
+        return "codex-login";
+    const envKey = provider.env_key;
+    if (typeof envKey !== "string" || !envKey.trim())
+        return "provider-ready";
+    const value = env[envKey.trim()];
+    return typeof value === "string" && value.trim()
+        ? "provider-ready"
+        : "provider-auth-missing";
+}
+/** True only when this exact launch would defer to an absent Codex login. */
+export function codexLaunchRequiresLogin(codexHome, env = process.env) {
+    return codexConfigEffectiveAuth(join(codexHome, "config.toml"), env) === "codex-login" &&
+        codexAuthEffectiveMode(join(codexHome, "auth.json")) === null;
+}
+function pathExistsOrIsSymlink(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isPrivateCodexHome(candidate) {
+    const normalized = resolve(candidate);
+    if (basename(normalized) !== "codex-home")
+        return false;
+    const ownerDir = dirname(normalized);
+    const namespace = dirname(ownerDir);
+    const root = dirname(namespace);
+    return (basename(namespace) === "sessions" && basename(root) === "runtime") || basename(namespace) === "codex-native";
+}
+function privateCodexHomeSource(candidate) {
+    const sourceDirs = new Set();
+    for (const name of ["auth.json", ".credentials.json", "memories_1.sqlite"]) {
+        const file = join(candidate, name);
+        try {
+            if (lstatSync(file).isSymbolicLink())
+                sourceDirs.add(dirname(realpathSync(file)));
+        }
+        catch {
+            // Missing or unreadable links do not identify a source home.
+        }
+    }
+    return sourceDirs.size === 1 ? [...sourceDirs][0] : null;
+}
+/** Resolve the user's auth/config source without nesting a parent Session's
+ * private CODEX_HOME into a child Session. */
+export function resolveCodexHomeConfigSource(candidate, defaultHome = join(homedir(), ".codex")) {
+    const source = resolve(candidate);
+    const fallback = resolve(defaultHome);
+    if (source !== fallback && isPrivateCodexHome(source)) {
+        return privateCodexHomeSource(source) ?? fallback;
+    }
+    return source;
+}
 /** The user's real CODEX_HOME (env override, else `~/.codex`). */
 function realCodexHome() {
-    return process.env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+    const fallback = join(homedir(), ".codex");
+    return resolveCodexHomeConfigSource(process.env.CODEX_HOME?.trim() || fallback, fallback);
 }
 /**
  * The deterministic private CODEX_HOME path for a rynx session. PER-SESSION,
@@ -52,8 +200,8 @@ export function legacyCodexHomePath() {
  * `_CODEX_HOME_COPY_FILES`.
  *
  * PER-SESSION: one private home per rynx session (matching reference implementation), so concurrent
- * agents never share a `skills/` dir. Idempotent: the symlink/copy are refreshed each
- * call so a re-login/config change propagates. Returns the private home dir.
+ * agents never share a `skills/` dir. Idempotent: existing Session-owned entries stay
+ * unchanged; live symlinks still observe source credential updates. Returns the private home dir.
  */
 export function prepareCodexHome(sessionId, realHome = realCodexHome()) {
     return prepareRuntimeHome(sessionId, "codex", realHome);
@@ -77,13 +225,9 @@ export function prepareRuntimeHome(sessionId, runtime, realHome = runtime === "c
     for (const name of files.symlink) {
         const src = join(realHome, name);
         const dst = join(dir, name);
+        if (pathExistsOrIsSymlink(dst))
+            continue;
         mkdirSync(dirname(dst), { recursive: true, mode: 0o700 });
-        try {
-            rmSync(dst, { recursive: true, force: true });
-        }
-        catch {
-            // absent — fine
-        }
         if (existsSync(src)) {
             try {
                 symlinkSync(src, dst);
@@ -93,11 +237,35 @@ export function prepareRuntimeHome(sessionId, runtime, realHome = runtime === "c
             }
         }
     }
+    for (const name of files.symlinkDirs) {
+        const src = join(realHome, name);
+        const dst = join(dir, name);
+        let sourceIsDirectory = false;
+        try {
+            sourceIsDirectory = statSync(src).isDirectory();
+        }
+        catch {
+            // Missing/unreadable shared state is optional.
+        }
+        if (!sourceIsDirectory)
+            continue;
+        if (pathExistsOrIsSymlink(dst))
+            continue;
+        mkdirSync(dirname(dst), { recursive: true, mode: 0o700 });
+        try {
+            symlinkSync(src, dst, "dir");
+        }
+        catch {
+            // Best-effort: Codex recreates absent cache/state in its private home.
+        }
+    }
     for (const name of files.copy) {
         const src = join(realHome, name);
         if (existsSync(src)) {
             try {
                 const dst = join(dir, name);
+                if (pathExistsOrIsSymlink(dst))
+                    continue;
                 mkdirSync(dirname(dst), { recursive: true, mode: 0o700 });
                 copyFileSync(src, dst);
             }
@@ -108,6 +276,145 @@ export function prepareRuntimeHome(sessionId, runtime, realHome = runtime === "c
     }
     return dir;
 }
+/** Trust a runner-selected workspace only in the Session's private config so
+ * Codex cannot stop a detached TUI at its project-trust prompt. */
+export function trustCodexProject(codexHome, cwd) {
+    const configPath = join(codexHome, "config.toml");
+    let config = {};
+    if (existsSync(configPath))
+        config = parse(readFileSync(configPath, "utf8"));
+    const projects = isTomlTable(config.projects) ? config.projects : {};
+    config.projects = projects;
+    let projectPath;
+    try {
+        projectPath = realpathSync(cwd);
+    }
+    catch {
+        projectPath = resolve(cwd);
+    }
+    const existingProject = projects[projectPath];
+    const project = isTomlTable(existingProject) ? existingProject : {};
+    project.trust_level = "trusted";
+    projects[projectPath] = project;
+    writeCodexConfig(configPath, config);
+}
+const DEFAULT_CODEX_MAX_RETRIES = 7;
+const DEFAULT_CODEX_REQUEST_TIMEOUT_SECONDS = 120;
+const DEVELOPER_INSTRUCTIONS_BASE_FILE = ".rynx-developer-instructions-base";
+/** Apply the Session retry budget through Codex's supported provider settings.
+ * A config with no provider definitions is left untouched. */
+export function applyCodexProviderRetryPolicy(codexHome, retry) {
+    const configPath = join(codexHome, "config.toml");
+    if (!existsSync(configPath) || lstatSync(configPath).isSymbolicLink())
+        return;
+    const config = parse(readFileSync(configPath, "utf8"));
+    if (!isTomlTable(config.model_providers))
+        return;
+    const maxRetries = retry?.maxRetries ?? DEFAULT_CODEX_MAX_RETRIES;
+    const timeoutSeconds = retry?.timeoutPerRequestSeconds ??
+        DEFAULT_CODEX_REQUEST_TIMEOUT_SECONDS;
+    let changed = false;
+    for (const provider of Object.values(config.model_providers)) {
+        if (!isTomlTable(provider))
+            continue;
+        provider.request_max_retries = maxRetries;
+        provider.stream_max_retries = maxRetries;
+        provider.stream_idle_timeout_ms = Math.trunc(timeoutSeconds * 1_000);
+        changed = true;
+    }
+    if (changed)
+        writeCodexConfig(configPath, config);
+}
+/** Preserve the user's private-home base instructions and append only the raw
+ * Agent-authored text. Repeated launches replace the managed suffix instead of
+ * accumulating it. Invalid user TOML is intentionally left untouched. */
+export function syncCodexDeveloperInstructions(codexHome, instructions) {
+    mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+    const configPath = join(codexHome, "config.toml");
+    if (pathExistsOrIsSymlink(configPath) && lstatSync(configPath).isSymbolicLink()) {
+        try {
+            const source = realpathSync(configPath);
+            const content = readFileSync(source, "utf8");
+            rmSync(configPath, { force: true });
+            writeFileSync(configPath, content, { encoding: "utf8", mode: 0o600 });
+        }
+        catch {
+            return;
+        }
+    }
+    let config;
+    try {
+        config = existsSync(configPath) ? parse(readFileSync(configPath, "utf8")) : {};
+    }
+    catch {
+        return;
+    }
+    const current = config.developer_instructions;
+    if (current !== undefined && typeof current !== "string")
+        return;
+    const addition = instructions?.trim() ?? "";
+    const basePath = join(codexHome, DEVELOPER_INSTRUCTIONS_BASE_FILE);
+    let base;
+    if (existsSync(basePath)) {
+        base = readFileSync(basePath, "utf8");
+    }
+    else {
+        base = typeof current === "string" ? current.trim() : "";
+        if (addition && base === addition) {
+            base = "";
+        }
+        else if (addition && base.endsWith(`\n\n${addition}`)) {
+            base = base.slice(0, -(`\n\n${addition}`).length).trimEnd();
+        }
+        writeFileSync(basePath, base, { encoding: "utf8", mode: 0o600 });
+    }
+    const active = base && addition ? `${base}\n\n${addition}` : base || addition;
+    if (active)
+        config.developer_instructions = active;
+    else
+        delete config.developer_instructions;
+    writeCodexConfig(configPath, config);
+}
+/** Read the active private-home instructions without conflating a definite
+ * absence with malformed or temporarily unreadable config. */
+export function readCodexDeveloperInstructionsState(codexHome) {
+    const configPath = join(codexHome, "config.toml");
+    let source;
+    try {
+        source = readFileSync(configPath, "utf8");
+    }
+    catch (error) {
+        const code = error.code;
+        return code === "ENOENT" || code === "ENOTDIR"
+            ? { state: "absent" }
+            : { state: "unreadable" };
+    }
+    let config;
+    try {
+        config = parse(source);
+    }
+    catch {
+        return { state: "unreadable" };
+    }
+    if (!Object.prototype.hasOwnProperty.call(config, "developer_instructions")) {
+        return { state: "absent" };
+    }
+    const instructions = config.developer_instructions;
+    return typeof instructions === "string" && instructions.trim()
+        ? { state: "present", value: instructions }
+        : { state: "unreadable" };
+}
+function writeCodexConfig(configPath, config) {
+    mkdirSync(dirname(configPath), { recursive: true, mode: 0o700 });
+    const staged = join(dirname(configPath), `.config.toml.${process.pid}.${randomUUID()}`);
+    try {
+        writeFileSync(staged, stringify(config), { encoding: "utf8", mode: 0o600 });
+        renameSync(staged, configPath);
+    }
+    finally {
+        rmSync(staged, { force: true });
+    }
+}
 /** Persist immutable skill copies in a native Provider home. Fork descendants
  * share that home, so entries must outlive every runner's temporary sources. */
 export function populateCodexSkills(codexHome, skills) {

package/dist/host.d.ts

@@ -1,4 +1,4 @@
-import { type ResolvedExecutionSnapshot, type ResolvedExecutionBudget, type RuntimeTurnOptions, type RuntimeUserInput, type SessionCollaborationMode, type LiveSessionFailure, type SessionWorkspaceSnapshot, type SessionInteractionResolution, type SessionEvent } from "@rynx-ai/core";
+import { type ResolvedExecutionSnapshot, type RuntimeTurnOptions, type RuntimeUserInput, type SessionCollaborationMode, type LiveSessionFailure, type SessionWorkspaceSnapshot, type SessionInteractionResolution, type SessionEvent } from "@rynx-ai/core";
 import { type AgentRuntimeId } from "@rynx-ai/core";
 import { type AppConfig } from "@rynx-ai/core";
 import { createCodexChildEnv } from "./codex-child-env.js";
@@ -107,14 +107,6 @@ export interface LiveSessionOpts {
     execution: ResolvedExecutionSnapshot;
     retargetMirror?: RetargetMirror;
 }
-/**
- * The `OPENAI_*` retry env for a codex-lineage app-server spawn, or `undefined`
- * when the budget declares no retry or the runtime is claude. claude applies
- * its retry budget per-run in `buildOptions` (see the claude executor), so it
- * never needs a dedicated app-server.
- */
-export declare function codexRetryEnv(runtime: AgentRuntimeId, budget?: ResolvedExecutionBudget): Record<string, string> | undefined;
-export declare function codexBackendKey(runtime: AgentRuntimeId, budget?: ResolvedExecutionBudget): string;
 export declare class LocalAgentHost implements CodexCapabilities {
     private readonly config;
     private readonly sessionStore;
@@ -122,8 +114,6 @@ export declare class LocalAgentHost implements CodexCapabilities {
     private readonly defaultRuntime;
     private readonly injectedCommandRunner?;
     private readonly injectedAppServerClient?;
-    private readonly clock;
-    private readonly backendIdleTtlMs;
     private readonly forwarderClientFactory;
     private readonly preloadClientFactory;
     /** Builds one short-lived message/interrupt client. */
@@ -143,21 +133,18 @@ export declare class LocalAgentHost implements CodexCapabilities {
     /** Claude forwarders stopped before their terminal is killed. Runner shutdown
      * finalizes these synchronously afterwards to scrub raw interaction answers. */
     private readonly pendingClaudeFinalizers;
+    private readonly pendingCleanupTasks;
     private readonly liveEnsuring;
     private readonly forkingTargets;
     /** Short-lived dedupe for managed fork notifications delivered after the
      * `thread/fork` response. Values are expected source Provider thread ids. */
     private readonly managedForkThreadStarts;
-    constructor({ config, commandRunner, sessionStore, allowedRoots, appServerClient, now, backendIdleTtlMs, forwarderClientFactory, preloadClientFactory, injectionClientFactory, sessionId, runtimeHomeSessionId, }: {
+    constructor({ config, commandRunner, sessionStore, allowedRoots, appServerClient, forwarderClientFactory, preloadClientFactory, injectionClientFactory, sessionId, runtimeHomeSessionId, }: {
         config: AppConfig;
         commandRunner?: CodexCommandRunner;
         sessionStore?: CodexSessionStore;
         allowedRoots?: string[];
         appServerClient?: CodexAppServerClient | null;
-        /** Monotonic-ish clock for idle reaping (tests inject a controllable one). */
-        now?: () => number;
-        /** Idle TTL after which a per-budget composite backend is reaped (ms). */
-        backendIdleTtlMs?: number;
         /** Override the live-session forwarder connection factory (tests inject a fake). */
         forwarderClientFactory?: (appServerUrl: string) => CodexAppServerClient;
         /** Override the short-lived known-thread preload connection factory. */
@@ -175,14 +162,6 @@ export declare class LocalAgentHost implements CodexCapabilities {
         runtimeHomeSessionId?: string;
     });
     private getBackend;
-    /**
-     * Stop + drop per-budget composite backends that have been idle longer than
-     * the TTL and have no in-flight run. Base per-runtime backends (key === the
-     * bare runtime id) are never reaped — they live for the process lifetime, as
-     * before. There are no per-conversation close hooks, so this lazy sweep (run
-     * on every `getBackend`) is how dedicated app-servers get reclaimed.
-     */
-    private reapIdleBackends;
     private createBackend;
     /** This session's private native home, shared by its app-server + TUI. */
     private runtimeHome;
@@ -208,11 +187,16 @@ export declare class LocalAgentHost implements CodexCapabilities {
      * SAME thread the structured data channel drives.
      */
     codexTerminalSpec(localThreadId: string): Promise<{
+        lifecycle: "required" | "auxiliary";
         command: string;
         args: string[];
         cwd: string;
         env?: Record<string, string>;
         skipTraexStartupPrompts?: boolean;
+        scrollback?: number;
+        tmuxAllowPassthrough?: boolean;
+        tmuxStartOnAttach?: boolean;
+        keepAliveAfterExit?: boolean;
     } | null>;
     /**
      * Bring up (idempotently) a session's persistent codex forwarder and emit its
@@ -302,9 +286,11 @@ export declare class LocalAgentHost implements CodexCapabilities {
      * forwarder and per-session app-server as one disposable runtime envelope;
      * the next message recreates that envelope and cold-resumes the native id. */
     teardownLiveCodexSession(localThreadId: string, error?: Error): boolean;
+    teardownAuxiliaryTerminalRuntime(localThreadId: string): Promise<void>;
     /** Complete the second shutdown phase after the runner has killed all native
      * terminals and hook subprocesses. Must run before the runner process exits. */
-    finalizeStoppedLiveSessions(): void;
+    finalizeStoppedLiveSessions(): Promise<void>;
+    private trackCleanup;
     /** The interactive `claude` TUI spec for a claude-native live session: the real
      *  `claude` binary with rynx's hooks (`--settings`), resuming the bound session.
      *  Trust is pre-seeded so the daemon-spawned TUI never blocks on a first-run