@rynx-ai/runtime 0.1.11-beta.5 → 0.1.11-beta.51

package/dist/codex-home.js

@@ -1,26 +1,174 @@
 import { randomUUID } from "node:crypto";
-import { copyFileSync, cpSync, existsSync, mkdirSync, renameSync, rmSync, symlinkSync } from "node:fs";
+import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { getRuntimeProfile, resolveRuntimeHome, SAFE_SKILL_NAME, } from "@rynx-ai/core";
+import { basename, dirname, join, resolve } from "node:path";
+import { parse, stringify } from "smol-toml";
+import { assertSkillPathComponent, getRuntimeProfile, resolveRuntimeHome, } from "@rynx-ai/core";
 import { adoptLegacyRuntimeDirectory, legacyRuntimeStateRoot, runtimeSessionDigest, runtimeSessionStateDir, } from "./runtime-state-paths.js";
-/** Inherit the user's LIVE login by symlink (stays in sync). */
-const SYMLINK_FILES = ["auth.json"];
+/** Codex-owned files that must stay live across every private home. */
+const CODEX_SYMLINK_FILES = [
+    "auth.json",
+    ".credentials.json",
+    "memories_1.sqlite",
+    "AGENTS.md",
+    "AGENTS.override.md",
+    "hooks.json",
+];
+/** Large/shared Codex state and cross-process coordination directories. */
+const CODEX_SYMLINK_DIRS = [
+    join("plugins", "cache"),
+    "mcp-oauth-locks",
+    "memories",
+    "rules",
+];
 /** Inherit the user's settings by snapshot copy (not the mutable NUX/update state). */
 const COPY_FILES = ["config.toml"];
 const RUNTIME_HOME_FILES = {
-    codex: { symlink: SYMLINK_FILES, copy: COPY_FILES },
+    codex: {
+        symlink: CODEX_SYMLINK_FILES,
+        symlinkDirs: CODEX_SYMLINK_DIRS,
+        copy: COPY_FILES,
+    },
     traex: {
         // Traex keeps credentials below `cli/`, while its user configuration lives
         // at the TRAE_HOME root. Keep both the current TOML name and the legacy YAML
         // name so existing installations remain usable without an implicit migrate.
         symlink: ["cli/auth.json"],
+        symlinkDirs: [],
         copy: ["traecli.toml", "traecli.yaml"],
     },
 };
+const CODEX_BUILTIN_PROVIDERS = new Set([
+    "openai",
+    "amazon-bedrock",
+    "amazon-bedrock-runtime",
+    "ollama",
+    "lmstudio",
+]);
+function isTomlTable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Resolve the effective native Provider, honoring the selected profile first. */
+function effectiveCodexModelProvider(config) {
+    let provider = config.model_provider;
+    const activeProfile = config.profile;
+    if (typeof activeProfile === "string" && activeProfile.trim() && isTomlTable(config.profiles)) {
+        const profile = config.profiles[activeProfile];
+        if (isTomlTable(profile) && typeof profile.model_provider === "string") {
+            provider = profile.model_provider;
+        }
+    }
+    return typeof provider === "string" && provider.trim() ? provider : null;
+}
+/** Read the credential mode from Codex's optional-field auth.json shape. */
+export function codexAuthEffectiveMode(authPath) {
+    let data;
+    try {
+        data = JSON.parse(readFileSync(authPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return null;
+    const auth = data;
+    const tokens = auth.tokens;
+    if (tokens && typeof tokens === "object" && !Array.isArray(tokens)) {
+        const tokenRecord = tokens;
+        for (const field of ["access_token", "refresh_token"]) {
+            const value = tokenRecord[field];
+            if (typeof value === "string" && value.trim())
+                return "chatgpt";
+        }
+    }
+    if (typeof auth.OPENAI_API_KEY === "string" && auth.OPENAI_API_KEY.trim())
+        return "apikey";
+    if (typeof auth.personal_access_token === "string" &&
+        auth.personal_access_token.trim())
+        return "pat";
+    return null;
+}
+/** Mirror Codex's provider-specific auth decision without spawning the CLI. */
+export function codexConfigEffectiveAuth(configPath, env = process.env) {
+    let config;
+    try {
+        config = parse(readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return "codex-login";
+    }
+    const providerId = effectiveCodexModelProvider(config);
+    if (!providerId)
+        return "codex-login";
+    if (CODEX_BUILTIN_PROVIDERS.has(providerId)) {
+        return providerId === "openai" ? "codex-login" : "provider-ready";
+    }
+    const provider = isTomlTable(config.model_providers)
+        ? config.model_providers[providerId]
+        : undefined;
+    if (!isTomlTable(provider))
+        return "provider-auth-missing";
+    if (provider.requires_openai_auth === true)
+        return "codex-login";
+    const envKey = provider.env_key;
+    if (typeof envKey !== "string" || !envKey.trim())
+        return "provider-ready";
+    const value = env[envKey.trim()];
+    return typeof value === "string" && value.trim()
+        ? "provider-ready"
+        : "provider-auth-missing";
+}
+/** True only when this exact launch would defer to an absent Codex login. */
+export function codexLaunchRequiresLogin(codexHome, env = process.env) {
+    return codexConfigEffectiveAuth(join(codexHome, "config.toml"), env) === "codex-login" &&
+        codexAuthEffectiveMode(join(codexHome, "auth.json")) === null;
+}
+function pathExistsOrIsSymlink(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isPrivateCodexHome(candidate) {
+    const normalized = resolve(candidate);
+    if (basename(normalized) !== "codex-home")
+        return false;
+    const ownerDir = dirname(normalized);
+    const namespace = dirname(ownerDir);
+    const root = dirname(namespace);
+    return (basename(namespace) === "sessions" && basename(root) === "runtime") || basename(namespace) === "codex-native";
+}
+function privateCodexHomeSource(candidate) {
+    const sourceDirs = new Set();
+    for (const name of ["auth.json", ".credentials.json", "memories_1.sqlite"]) {
+        const file = join(candidate, name);
+        try {
+            if (lstatSync(file).isSymbolicLink())
+                sourceDirs.add(dirname(realpathSync(file)));
+        }
+        catch {
+            // Missing or unreadable links do not identify a source home.
+        }
+    }
+    return sourceDirs.size === 1 ? [...sourceDirs][0] : null;
+}
+/** Resolve the user's auth/config source without nesting a parent Session's
+ * private CODEX_HOME into a child Session. */
+export function resolveCodexHomeConfigSource(candidate, defaultHome = join(homedir(), ".codex")) {
+    const source = resolve(candidate);
+    const fallback = resolve(defaultHome);
+    if (source !== fallback && isPrivateCodexHome(source)) {
+        return privateCodexHomeSource(source) ?? fallback;
+    }
+    return source;
+}
 /** The user's real CODEX_HOME (env override, else `~/.codex`). */
 function realCodexHome() {
-    return process.env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+    const fallback = join(homedir(), ".codex");
+    return resolveCodexHomeConfigSource(process.env.CODEX_HOME?.trim() || fallback, fallback);
 }
 /**
  * The deterministic private CODEX_HOME path for a rynx session. PER-SESSION,
@@ -52,8 +200,8 @@ export function legacyCodexHomePath() {
  * `_CODEX_HOME_COPY_FILES`.
  *
  * PER-SESSION: one private home per rynx session (matching reference implementation), so concurrent
- * agents never share a `skills/` dir. Idempotent: the symlink/copy are refreshed each
- * call so a re-login/config change propagates. Returns the private home dir.
+ * agents never share a `skills/` dir. Idempotent: existing Session-owned entries stay
+ * unchanged; live symlinks still observe source credential updates. Returns the private home dir.
  */
 export function prepareCodexHome(sessionId, realHome = realCodexHome()) {
     return prepareRuntimeHome(sessionId, "codex", realHome);
@@ -77,13 +225,9 @@ export function prepareRuntimeHome(sessionId, runtime, realHome = runtime === "c
     for (const name of files.symlink) {
         const src = join(realHome, name);
         const dst = join(dir, name);
+        if (pathExistsOrIsSymlink(dst))
+            continue;
         mkdirSync(dirname(dst), { recursive: true, mode: 0o700 });
-        try {
-            rmSync(dst, { recursive: true, force: true });
-        }
-        catch {
-            // absent — fine
-        }
         if (existsSync(src)) {
             try {
                 symlinkSync(src, dst);
@@ -93,11 +237,35 @@ export function prepareRuntimeHome(sessionId, runtime, realHome = runtime === "c
             }
         }
     }
+    for (const name of files.symlinkDirs) {
+        const src = join(realHome, name);
+        const dst = join(dir, name);
+        let sourceIsDirectory = false;
+        try {
+            sourceIsDirectory = statSync(src).isDirectory();
+        }
+        catch {
+            // Missing/unreadable shared state is optional.
+        }
+        if (!sourceIsDirectory)
+            continue;
+        if (pathExistsOrIsSymlink(dst))
+            continue;
+        mkdirSync(dirname(dst), { recursive: true, mode: 0o700 });
+        try {
+            symlinkSync(src, dst, "dir");
+        }
+        catch {
+            // Best-effort: Codex recreates absent cache/state in its private home.
+        }
+    }
     for (const name of files.copy) {
         const src = join(realHome, name);
         if (existsSync(src)) {
             try {
                 const dst = join(dir, name);
+                if (pathExistsOrIsSymlink(dst))
+                    continue;
                 mkdirSync(dirname(dst), { recursive: true, mode: 0o700 });
                 copyFileSync(src, dst);
             }
@@ -108,14 +276,151 @@ export function prepareRuntimeHome(sessionId, runtime, realHome = runtime === "c
     }
     return dir;
 }
+/** Trust a runner-selected workspace only in the Session's private config so
+ * Codex cannot stop a detached TUI at its project-trust prompt. */
+export function trustCodexProject(codexHome, cwd) {
+    const configPath = join(codexHome, "config.toml");
+    let config = {};
+    if (existsSync(configPath))
+        config = parse(readFileSync(configPath, "utf8"));
+    const projects = isTomlTable(config.projects) ? config.projects : {};
+    config.projects = projects;
+    let projectPath;
+    try {
+        projectPath = realpathSync(cwd);
+    }
+    catch {
+        projectPath = resolve(cwd);
+    }
+    const existingProject = projects[projectPath];
+    const project = isTomlTable(existingProject) ? existingProject : {};
+    project.trust_level = "trusted";
+    projects[projectPath] = project;
+    writeCodexConfig(configPath, config);
+}
+const DEFAULT_CODEX_MAX_RETRIES = 7;
+const DEFAULT_CODEX_REQUEST_TIMEOUT_SECONDS = 120;
+const DEVELOPER_INSTRUCTIONS_BASE_FILE = ".rynx-developer-instructions-base";
+/** Apply the Session retry budget through Codex's supported provider settings.
+ * A config with no provider definitions is left untouched. */
+export function applyCodexProviderRetryPolicy(codexHome, retry) {
+    const configPath = join(codexHome, "config.toml");
+    if (!existsSync(configPath) || lstatSync(configPath).isSymbolicLink())
+        return;
+    const config = parse(readFileSync(configPath, "utf8"));
+    if (!isTomlTable(config.model_providers))
+        return;
+    const maxRetries = retry?.maxRetries ?? DEFAULT_CODEX_MAX_RETRIES;
+    const timeoutSeconds = retry?.timeoutPerRequestSeconds ??
+        DEFAULT_CODEX_REQUEST_TIMEOUT_SECONDS;
+    let changed = false;
+    for (const provider of Object.values(config.model_providers)) {
+        if (!isTomlTable(provider))
+            continue;
+        provider.request_max_retries = maxRetries;
+        provider.stream_max_retries = maxRetries;
+        provider.stream_idle_timeout_ms = Math.trunc(timeoutSeconds * 1_000);
+        changed = true;
+    }
+    if (changed)
+        writeCodexConfig(configPath, config);
+}
+/** Preserve the user's private-home base instructions and append only the raw
+ * Agent-authored text. Repeated launches replace the managed suffix instead of
+ * accumulating it. Invalid user TOML is intentionally left untouched. */
+export function syncCodexDeveloperInstructions(codexHome, instructions) {
+    mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+    const configPath = join(codexHome, "config.toml");
+    if (pathExistsOrIsSymlink(configPath) && lstatSync(configPath).isSymbolicLink()) {
+        try {
+            const source = realpathSync(configPath);
+            const content = readFileSync(source, "utf8");
+            rmSync(configPath, { force: true });
+            writeFileSync(configPath, content, { encoding: "utf8", mode: 0o600 });
+        }
+        catch {
+            return;
+        }
+    }
+    let config;
+    try {
+        config = existsSync(configPath) ? parse(readFileSync(configPath, "utf8")) : {};
+    }
+    catch {
+        return;
+    }
+    const current = config.developer_instructions;
+    if (current !== undefined && typeof current !== "string")
+        return;
+    const addition = instructions?.trim() ?? "";
+    const basePath = join(codexHome, DEVELOPER_INSTRUCTIONS_BASE_FILE);
+    let base;
+    if (existsSync(basePath)) {
+        base = readFileSync(basePath, "utf8");
+    }
+    else {
+        base = typeof current === "string" ? current.trim() : "";
+        if (addition && base === addition) {
+            base = "";
+        }
+        else if (addition && base.endsWith(`\n\n${addition}`)) {
+            base = base.slice(0, -(`\n\n${addition}`).length).trimEnd();
+        }
+        writeFileSync(basePath, base, { encoding: "utf8", mode: 0o600 });
+    }
+    const active = base && addition ? `${base}\n\n${addition}` : base || addition;
+    if (active)
+        config.developer_instructions = active;
+    else
+        delete config.developer_instructions;
+    writeCodexConfig(configPath, config);
+}
+/** Read the active private-home instructions without conflating a definite
+ * absence with malformed or temporarily unreadable config. */
+export function readCodexDeveloperInstructionsState(codexHome) {
+    const configPath = join(codexHome, "config.toml");
+    let source;
+    try {
+        source = readFileSync(configPath, "utf8");
+    }
+    catch (error) {
+        const code = error.code;
+        return code === "ENOENT" || code === "ENOTDIR"
+            ? { state: "absent" }
+            : { state: "unreadable" };
+    }
+    let config;
+    try {
+        config = parse(source);
+    }
+    catch {
+        return { state: "unreadable" };
+    }
+    if (!Object.prototype.hasOwnProperty.call(config, "developer_instructions")) {
+        return { state: "absent" };
+    }
+    const instructions = config.developer_instructions;
+    return typeof instructions === "string" && instructions.trim()
+        ? { state: "present", value: instructions }
+        : { state: "unreadable" };
+}
+function writeCodexConfig(configPath, config) {
+    mkdirSync(dirname(configPath), { recursive: true, mode: 0o700 });
+    const staged = join(dirname(configPath), `.config.toml.${process.pid}.${randomUUID()}`);
+    try {
+        writeFileSync(staged, stringify(config), { encoding: "utf8", mode: 0o600 });
+        renameSync(staged, configPath);
+    }
+    finally {
+        rmSync(staged, { force: true });
+    }
+}
 /** Persist immutable skill copies in a native Provider home. Fork descendants
  * share that home, so entries must outlive every runner's temporary sources. */
 export function populateCodexSkills(codexHome, skills) {
     const skillsDir = join(codexHome, "skills");
     for (const skill of skills) {
-        if (!SAFE_SKILL_NAME.test(skill.name)) {
-            throw new Error(`unsafe skill name: ${skill.name}`);
-        }
+        assertSkillPathComponent(skill.name);
     }
     if (skills.length === 0)
         return;

package/dist/codex-session-store.d.ts

@@ -8,6 +8,23 @@ export interface CodexSessionRecord {
      * metadata remains self-contained; this only tells a runner where the
      * Provider persisted its rollout/state. */
     runtimeHomeOwnerSessionId?: string;
+    /** Claude hook/forwarder rendezvous ownership. A rotated target keeps the
+     * physical pane's bridge while the retired logical source is re-keyed to an
+     * isolated bridge; both may still share one Provider runtime home. */
+    bridgeOwnerSessionId?: string;
+    /** Durable recovery edge for a Claude-native `/clear`·`/fork`. The target
+     * binding is written before IPC publication; `published` is flipped only
+     * after the parent durably creates the logical target. */
+    nativeRotationSourceSessionId?: string;
+    /** Authoritative latest published target when this record is the source.
+     * Avoids choosing an arbitrary historical edge after repeated rotations. */
+    nativeRotationTargetSessionId?: string;
+    nativeRotationKind?: "clear" | "fork";
+    nativeRotationPublished?: boolean;
+    /** Stable transcript boundary captured by the rotating forwarder at the
+     * target SessionStart. Clear starts at zero; fork starts after the copied
+     * source prefix. Recovery must not replace this with a later file EOF. */
+    nativeRotationInitialTranscriptOffset?: number;
     updatedAt: string;
 }
 export interface ClaudeForkIntent {
@@ -15,6 +32,12 @@ export interface ClaudeForkIntent {
     sourceSessionId: string;
     sourceClaudeSessionId: string;
     targetClaudeSessionId: string;
+    /** Target transcript atomically cloned before the target runner starts. Its
+     * presence means recovery must resume this exact file, never re-clone a
+     * source that may have advanced since the fork boundary. */
+    forkTranscriptPath?: string;
+    /** Exact byte length of the cloned prefix, measured before Claude starts. */
+    forkTranscriptPrefixBytes?: number;
     updatedAt: string;
 }
 export interface CodexSessionStore {

package/dist/codex-session-store.js

@@ -107,6 +107,27 @@ export class FileCodexSessionStore {
                         ...(record.runtimeHomeOwnerSessionId
                             ? { runtimeHomeOwnerSessionId: record.runtimeHomeOwnerSessionId }
                             : {}),
+                        ...(record.bridgeOwnerSessionId
+                            ? { bridgeOwnerSessionId: record.bridgeOwnerSessionId }
+                            : {}),
+                        ...(record.nativeRotationSourceSessionId
+                            ? { nativeRotationSourceSessionId: record.nativeRotationSourceSessionId }
+                            : {}),
+                        ...(record.nativeRotationTargetSessionId
+                            ? { nativeRotationTargetSessionId: record.nativeRotationTargetSessionId }
+                            : {}),
+                        ...(record.nativeRotationKind
+                            ? { nativeRotationKind: record.nativeRotationKind }
+                            : {}),
+                        ...(record.nativeRotationPublished
+                            ? { nativeRotationPublished: true }
+                            : {}),
+                        ...(Number.isSafeInteger(record.nativeRotationInitialTranscriptOffset) &&
+                            record.nativeRotationInitialTranscriptOffset >= 0
+                            ? {
+                                nativeRotationInitialTranscriptOffset: record.nativeRotationInitialTranscriptOffset,
+                            }
+                            : {}),
                         updatedAt: record.updatedAt,
                     };
                 }