@schnick371/devsteps-shared 1.1.0-next.3 → 2.0.0-next.1

package/dist/utils/claude-host.js

@@ -0,0 +1,72 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ *
+ * Claude Code host support.
+ *
+ * The Copilot host receives its customization as a `.github` tree copied into
+ * the workspace. Claude Code receives its agents, commands, and skills from the
+ * DevSteps plugin instead, so nothing is copied — but a project can still
+ * anchor the operating contract in its own `CLAUDE.md`.
+ *
+ * That anchor is the *same* managed block the Copilot contract carries: the
+ * block is vendor-neutral prose, so one authored source serves both hosts
+ * (TASK-770). An earlier revision kept a second, shorter body here on the
+ * grounds that the plugin ships the full contract as a skill; that reasoning is
+ * superseded, because a workspace that has not installed the plugin then has no
+ * contract at all, and two bodies drift.
+ *
+ * `.claude/settings.json` is never touched: permissions are the user's security
+ * boundary.
+ *
+ * @see EPIC-053 EPIC-056 TASK-736 TASK-770
+ */
+import { join } from 'node:path';
+import { readPackagedContractBlock, writeContractBlock, } from './contract-block.js';
+/**
+ * The project-owned header written above the block when `CLAUDE.md` is created.
+ *
+ * It names the project, says which part of the file DevSteps owns, and points at
+ * the plugin that ships the agents, commands, and skills. Everything here is the
+ * project's from the moment it is written — updates never touch it.
+ */
+export function renderClaudeContractPreamble(projectName) {
+    const heading = projectName ? `# ${projectName}` : '# Project guidance';
+    return `${heading}
+
+Describe this project here — what it is, how it is built, how it is tested.
+Everything above the DevSteps marker belongs to this project and is never
+rewritten. The marked block below is written by DevSteps and replaced on update.
+
+This project tracks work with DevSteps. Agents, commands, and skills ship with
+the DevSteps plugin:
+
+\`\`\`
+/plugin marketplace add Schnick371/devsteps
+/plugin install devsteps
+\`\`\``;
+}
+/**
+ * Create or update the DevSteps contract block in a project's `CLAUDE.md`.
+ *
+ * Creates the file with the preamble when it is absent, replaces the block when
+ * it is present, and migrates a workspace that still carries the earlier
+ * `devsteps:claude-contract` delimiters. A locally edited block is left alone
+ * unless `force` is set, mirroring the Copilot payload rule.
+ */
+export function writeClaudeContractBlock(projectPath, sourceGithubDir, projectName, options) {
+    const claudeMdPath = join(projectPath, 'CLAUDE.md');
+    const block = readPackagedContractBlock(sourceGithubDir);
+    if (!block) {
+        return {
+            status: 'unavailable',
+            path: claudeMdPath,
+            message: 'The installed DevSteps package ships no contract block.',
+        };
+    }
+    return writeContractBlock(claudeMdPath, block, {
+        preamble: renderClaudeContractPreamble(projectName),
+        force: options?.force ?? false,
+    });
+}
+//# sourceMappingURL=claude-host.js.map

package/dist/utils/claude-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-host.js","sourceRoot":"","sources":["../../src/utils/claude-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAGL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAU7B;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,WAAoB;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACxE,OAAO,GAAG,OAAO;;;;;;;;;;;;OAYZ,CAAC;AACR,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,eAAuB,EACvB,WAAoB,EACpB,OAA+B;IAE/B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAEzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,yDAAyD;SACnE,CAAC;IACJ,CAAC;IAED,OAAO,kBAAkB,CAAC,YAAY,EAAE,KAAK,EAAE;QAC7C,QAAQ,EAAE,4BAA4B,CAAC,WAAW,CAAC;QACnD,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,KAAK;KAC/B,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/codex-config.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ *
+ * Plan owned Codex policy while retaining native MCP settings and approvals.
+ */
+import type { CodexPayload } from './codex-payload.js';
+import type { CodexLedger, CodexMode, CodexOptions, CodexSpan } from './codex-types.js';
+/** Full TOML validation surrounds narrow managed-span editing; policy collisions always refuse. */
+export declare function planCodexConfig(root: string, before: Buffer | undefined, ledger: CodexLedger | undefined, mode: CodexMode, payload: CodexPayload | undefined, options: CodexOptions): {
+    bytes?: Buffer;
+    owned?: CodexSpan;
+};
+//# sourceMappingURL=codex-config.d.ts.map

package/dist/utils/codex-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-config.d.ts","sourceRoot":"","sources":["../../src/utils/codex-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AA4ExF,mGAAmG;AACnG,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,OAAO,EAAE,YAAY,GACpB;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,CAyCvC"}

package/dist/utils/codex-config.js

@@ -0,0 +1,93 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ *
+ * Plan owned Codex policy while retaining native MCP settings and approvals.
+ */
+import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { parse, stringify } from 'smol-toml';
+import { CONFIG_BEGIN, CONFIG_END, readCodexSpan, renderCodexSpan } from './codex-spans.js';
+import { MCP_TOOL_GROUP_ENV_VAR, mergeToolGroupEnv, selectToolGroups } from './mcp-tool-groups.js';
+function object(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function validateOwnedPolicy(original, text) {
+    const owned = parse(text);
+    for (const [table, key] of [
+        ['mcp_servers', 'devsteps'],
+        ['plugins', 'devsteps@devsteps'],
+    ]) {
+        if (!isDeepStrictEqual(object(original[table])[key], object(owned[table])[key])) {
+            throw new Error('Unowned settings extend or shadow the managed Codex policy.');
+        }
+    }
+}
+/** Only the native connection and an explicit tool-group selection are replaced. */
+function nativePolicy(previous, tools) {
+    const lines = [];
+    const preserved = { ...previous };
+    for (const key of ['command', 'args', 'cwd', 'env'])
+        delete preserved[key];
+    for (const key of ['startup_timeout_sec', 'startup_timeout_ms', 'tool_timeout_sec']) {
+        const value = preserved[key];
+        delete preserved[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== 'number' || !Number.isFinite(value) || value < 0)
+            throw new Error(`Invalid Codex MCP timeout: ${key}`);
+        lines.push(`${key} = ${value}`);
+    }
+    if (Object.keys(preserved).length) {
+        const text = stringify({ mcp_servers: { devsteps: preserved } }).trimEnd();
+        const header = '[mcp_servers.devsteps]\n';
+        lines.push(text.startsWith(header) ? text.slice(header.length) : text);
+    }
+    const selected = selectToolGroups(tools);
+    if (selected.unknown.length)
+        throw new Error(`Unknown tool groups: ${selected.unknown.join(', ')}`);
+    const env = mergeToolGroupEnv(previous.env, selected.selection);
+    if (env)
+        lines.push('', '[mcp_servers.devsteps.env]', ...Object.entries(env).map(([key, value]) => `${JSON.stringify(key)} = ${JSON.stringify(value)}`));
+    return lines;
+}
+function body(root, mode, payload, tools, previousServer = {}) {
+    const lines = [`[plugins.${JSON.stringify(payload.pluginId)}]`, `enabled = ${mode === 'plugin'}`];
+    if (mode === 'native') {
+        lines.push('', '[mcp_servers.devsteps]', 'command = "node"', `args = ${JSON.stringify([join(root, payload.runtimeTarget ?? ''), root])}`, `cwd = ${JSON.stringify(root)}`, ...nativePolicy(previousServer, tools));
+    }
+    else if (tools)
+        throw new Error('Codex plugin tool selection must be configured through its installed plugin.');
+    return lines.join('\n');
+}
+/** Full TOML validation surrounds narrow managed-span editing; policy collisions always refuse. */
+export function planCodexConfig(root, before, ledger, mode, payload, options) {
+    const original = parse(before?.toString('utf8') ?? '');
+    const span = readCodexSpan(before, ledger?.config, CONFIG_BEGIN, CONFIG_END);
+    if (span.edited)
+        throw new Error('Locally edited Codex configuration requires manual reconciliation; force cannot override policy.');
+    if (span.owned) {
+        validateOwnedPolicy(original, span.before.slice((span.start ?? 0) + span.owned.prefix.length, span.end));
+    }
+    const remainder = parse(span.remainder);
+    if (object(remainder.mcp_servers).devsteps !== undefined ||
+        object(remainder.plugins)['devsteps@devsteps'] !== undefined) {
+        throw new Error('Unowned DevSteps MCP or plugin policy conflicts with Codex setup.');
+    }
+    const previousServer = object(object(original.mcp_servers).devsteps);
+    const previousTools = object(previousServer.env)[MCP_TOOL_GROUP_ENV_VAR];
+    const tools = options.tools ??
+        (ledger?.mode === 'native' && mode === 'native' && typeof previousTools === 'string'
+            ? previousTools
+            : undefined);
+    const planned = renderCodexSpan(span, options.remove ? undefined : body(root, mode, payload, tools, previousServer), CONFIG_BEGIN, CONFIG_END);
+    const parsed = parse(planned.bytes?.toString('utf8') ?? '');
+    if (!options.remove &&
+        object(object(parsed.plugins)['devsteps@devsteps']).enabled !== (mode === 'plugin')) {
+        throw new Error('Codex plugin policy could not be represented safely.');
+    }
+    return planned;
+}
+//# sourceMappingURL=codex-config.js.map

package/dist/utils/codex-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-config.js","sourceRoot":"","sources":["../../src/utils/codex-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5F,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnG,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiC,EAAE,IAAY;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI;QACzB,CAAC,aAAa,EAAE,UAAU,CAAC;QAC3B,CAAC,SAAS,EAAE,mBAAmB,CAAC;KACjC,EAAE,CAAC;QACF,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,YAAY,CAAC,QAAiC,EAAE,KAAc;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,0BAA0B,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM;QACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,GAAG;QACL,KAAK,CAAC,IAAI,CACR,EAAE,EACF,4BAA4B,EAC5B,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CACxB,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACtE,CACF,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CACX,IAAY,EACZ,IAAe,EACf,OAAqB,EACrB,KAAc,EACd,cAAc,GAA4B,EAAE;IAE5C,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC;IAClG,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,wBAAwB,EACxB,kBAAkB,EAClB,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAC3E,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAC/B,GAAG,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,CACvC,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK;QACd,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,MAA0B,EAC1B,MAA+B,EAC/B,IAAe,EACf,OAAiC,EACjC,OAAqB;IAErB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,MAAM;QACb,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;IACJ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,mBAAmB,CACjB,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,IACE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,SAAS;QACpD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACzE,MAAM,KAAK,GACT,OAAO,CAAC,KAAK;QACb,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ;YAClF,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,OAAO,GAAG,eAAe,CAC7B,IAAI,EACJ,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAuB,EAAE,KAAK,EAAE,cAAc,CAAC,EAC7F,YAAY,EACZ,UAAU,CACX,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IACE,CAAC,OAAO,CAAC,MAAM;QACf,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EACnF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/codex-ignore.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ */
+import type { CodexSpan } from './codex-types.js';
+/** Ask Git for its actual exclude path, including repositories with a linked gitdir. */
+export declare function resolveCodexExclude(root: string): string | undefined;
+/** Exclude exact generated files; pre-existing project files and tracked guidance stay visible. */
+export declare function planCodexIgnore(root: string, owned: (CodexSpan & {
+    path: string;
+}) | undefined, generated: readonly string[], remove: boolean): {
+    path?: string;
+    before?: Buffer;
+    after?: Buffer;
+    owned?: CodexSpan & {
+        path: string;
+    };
+};
+//# sourceMappingURL=codex-ignore.d.ts.map

package/dist/utils/codex-ignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-ignore.d.ts","sourceRoot":"","sources":["../../src/utils/codex-ignore.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AASlD,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUpE;AAiCD,mGAAmG;AACnG,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,EACjD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,MAAM,EAAE,OAAO,GACd;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAiC1F"}

package/dist/utils/codex-ignore.js

@@ -0,0 +1,92 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ */
+import { spawnSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { isAbsolute, relative, resolve } from 'node:path';
+import { readCodexSpan, renderCodexSpan } from './codex-spans.js';
+import { readCodexTarget } from './codex-state.js';
+import { byteHash } from './snapshot-manifest.js';
+import { validateSnapshotKey } from './snapshot-paths.js';
+function gitPath(root, args) {
+    const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+    return result.status === 0 ? result.stdout.trim() : undefined;
+}
+/** Ask Git for its actual exclude path, including repositories with a linked gitdir. */
+export function resolveCodexExclude(root) {
+    const value = gitPath(root, ['rev-parse', '--git-path', 'info/exclude']);
+    const common = gitPath(root, ['rev-parse', '--git-common-dir']);
+    if (!value || !common)
+        return undefined;
+    const path = isAbsolute(value) ? resolve(value) : resolve(root, value);
+    const gitdir = isAbsolute(common) ? resolve(common) : resolve(root, common);
+    if (relative(gitdir, path).split('\\').join('/') !== 'info/exclude') {
+        throw new Error('Unexpected Git exclude path; no ignore policy was changed.');
+    }
+    return path;
+}
+function literalGitPath(key) {
+    return `/${key.replace(/[\\*?[\]]/g, '\\$&')}`;
+}
+/** Another consumer's removable span cannot become this consumer's deduplication evidence. */
+function unownedRules(content) {
+    const spans = /^# devsteps-codex-ignore:([0-9a-f]{64}):begin\n[\s\S]*?^# devsteps-codex-ignore:\1:end\n/gm;
+    return new Set(content
+        .replace(spans, '')
+        .split(/\r?\n/)
+        .map((line) => line.trim()));
+}
+function projectScope(root) {
+    const top = gitPath(root, ['rev-parse', '--show-toplevel']);
+    if (!top)
+        throw new Error('Cannot resolve the Git worktree root.');
+    const key = relative(resolve(top), root).split('\\').join('/');
+    if (key)
+        validateSnapshotKey(key);
+    if (key === '..' || key.startsWith('../') || isAbsolute(key))
+        throw new Error('Project is outside the Git worktree.');
+    const identity = byteHash(Buffer.from(realpathSync.native(root)));
+    return {
+        prefix: key ? `${key}/` : '',
+        begin: `# devsteps-codex-ignore:${identity}:begin`,
+        end: `# devsteps-codex-ignore:${identity}:end`,
+    };
+}
+/** Exclude exact generated files; pre-existing project files and tracked guidance stay visible. */
+export function planCodexIgnore(root, owned, generated, remove) {
+    const path = resolveCodexExclude(root);
+    if (owned && path !== owned.path)
+        throw new Error('Git exclude location changed since Codex setup.');
+    if (!path)
+        return {};
+    const scope = projectScope(root);
+    const before = readCodexTarget(path);
+    const span = readCodexSpan(before, owned, scope.begin, scope.end);
+    if (span.edited)
+        throw new Error('Locally edited Codex ignore span requires manual reconciliation.');
+    if (remove && !owned)
+        return {};
+    const present = unownedRules(span.remainder);
+    const paths = [...new Set([...generated, '.codex/devsteps/ownership.json'])].sort();
+    const missing = paths
+        .map((key) => literalGitPath(`${scope.prefix}${key}`))
+        .filter((key) => !present.has(key));
+    const body = remove || !missing.length
+        ? undefined
+        : `# DevSteps generated local payload\n${missing.join('\n')}`;
+    const result = renderCodexSpan(span, body, scope.begin, scope.end);
+    const backupRule = `${literalGitPath(`${scope.prefix}.devsteps/backups`)}/`;
+    let after = result.bytes?.toString('utf8') ?? '';
+    if (!present.has(backupRule)) {
+        const separator = after === '' ? '' : after.endsWith('\n') ? '\n' : '\n\n';
+        after += `${separator}# DevSteps project-local snapshot recovery\n${backupRule}\n`;
+    }
+    return {
+        path,
+        before,
+        after: Buffer.from(after),
+        owned: result.owned ? { ...result.owned, path } : undefined,
+    };
+}
+//# sourceMappingURL=codex-ignore.js.map

package/dist/utils/codex-ignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-ignore.js","sourceRoot":"","sources":["../../src/utils/codex-ignore.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,SAAS,OAAO,CAAC,IAAY,EAAE,IAAc;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GACT,4FAA4F,CAAC;IAC/F,OAAO,IAAI,GAAG,CACZ,OAAO;SACJ,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG;QAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE;QAC5B,KAAK,EAAE,2BAA2B,QAAQ,QAAQ;QAClD,GAAG,EAAE,2BAA2B,QAAQ,MAAM;KAC/C,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,KAAiD,EACjD,SAA4B,EAC5B,MAAe;IAEf,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI;QAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM;QACb,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,IAAI,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,gCAAgC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM;QACvB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,GAAG,cAAc,CAAC,GAAG,KAAK,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC;IAC5E,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,KAAK,IAAI,GAAG,SAAS,+CAA+C,UAAU,IAAI,CAAC;IACrF,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC;AACJ,CAAC"}

package/dist/utils/codex-manifest.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ */
+import { z } from 'zod';
+declare const resource: z.ZodObject<{
+    source: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export type CodexResource = z.infer<typeof resource>;
+/** The reproducible text manifest remains separate from the assembled runtime identity. */
+export declare function loadCodexManifest(root: string): {
+    manifest: {
+        schemaVersion: 1;
+        host: "codex";
+        version: string;
+        pluginId: "devsteps@devsteps";
+        contract: {
+            source: string;
+            sha256: string;
+        };
+        config?: {
+            source: string;
+            sha256: string;
+        } | undefined;
+        files: {
+            source: string;
+            sha256: string;
+            target: string;
+            mode: "both" | "native";
+        }[];
+        runtime?: {
+            source: string;
+            sha256: string;
+            target: string;
+            node: ">=22";
+        } | null | undefined;
+    };
+    manifestBytes: NonSharedBuffer;
+    overlayBytes?: undefined;
+} | {
+    manifest: {
+        schemaVersion: 1;
+        host: "codex";
+        version: string;
+        pluginId: "devsteps@devsteps";
+        contract: {
+            source: string;
+            sha256: string;
+        };
+        config?: {
+            source: string;
+            sha256: string;
+        } | undefined;
+        runtime: {
+            source: string;
+            sha256: string;
+            target: string;
+            node: ">=22";
+        };
+        files: {
+            source: string;
+            sha256: string;
+            target: string;
+            mode: "both" | "native";
+        }[];
+    };
+    manifestBytes: NonSharedBuffer;
+    overlayBytes: NonSharedBuffer;
+};
+export {};
+//# sourceMappingURL=codex-manifest.d.ts.map

package/dist/utils/codex-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-manifest.d.ts","sourceRoot":"","sources":["../../src/utils/codex-manifest.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,QAAQ;;;kBAA4D,CAAC;AAyB3E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAErD,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6B7C"}

package/dist/utils/codex-manifest.js

@@ -0,0 +1,63 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ */
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+import { assertSafeFile, workspacePath } from './snapshot-paths.js';
+const digest = z.string().regex(/^[0-9a-f]{64}$/);
+const resource = z.object({ source: z.string(), sha256: digest }).strict();
+const entry = resource.extend({ target: z.string(), mode: z.enum(['both', 'native']) });
+const runtime = resource.extend({ target: z.string(), node: z.literal('>=22') });
+const manifestSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    host: z.literal('codex'),
+    version: z.string().min(1),
+    pluginId: z.literal('devsteps@devsteps'),
+    contract: resource,
+    config: resource.optional(),
+    files: z.array(entry),
+    runtime: runtime.nullable().optional(),
+})
+    .strict();
+const overlaySchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    version: z.string().min(1),
+    node: z.literal('>=22'),
+    runtime,
+    files: z.array(entry).length(1),
+})
+    .strict();
+/** The reproducible text manifest remains separate from the assembled runtime identity. */
+export function loadCodexManifest(root) {
+    const path = workspacePath(root, 'project-setup/manifest.json');
+    assertSafeFile(path);
+    const manifestBytes = readFileSync(path);
+    const manifest = manifestSchema.parse(JSON.parse(manifestBytes.toString('utf8')));
+    const overlayPath = workspacePath(root, 'server/runtime-manifest.json');
+    if (!assertSafeFile(overlayPath, true))
+        return { manifest, manifestBytes };
+    const overlayBytes = readFileSync(overlayPath);
+    const overlay = overlaySchema.parse(JSON.parse(overlayBytes.toString('utf8')));
+    const metadata = overlay.files[0];
+    if (manifest.runtime ||
+        overlay.version !== manifest.version ||
+        overlay.runtime.source !== 'server/index.bundled.mjs' ||
+        overlay.runtime.target !== '.codex/devsteps/runtime/index.bundled.mjs' ||
+        metadata.source !== 'server/package.json' ||
+        metadata.mode !== 'native' ||
+        metadata.target !== '.codex/devsteps/runtime/package.json')
+        throw new Error('Codex assembled runtime overlay provenance mismatch.');
+    return {
+        manifest: {
+            ...manifest,
+            runtime: overlay.runtime,
+            files: [...manifest.files, ...overlay.files],
+        },
+        manifestBytes,
+        overlayBytes,
+    };
+}
+//# sourceMappingURL=codex-manifest.js.map

package/dist/utils/codex-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-manifest.js","sourceRoot":"","sources":["../../src/utils/codex-manifest.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACxF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACjF,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACxC,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,OAAO;IACP,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAChE,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC3E,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IACE,QAAQ,CAAC,OAAO;QAChB,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACpC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,0BAA0B;QACrD,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,2CAA2C;QACtE,QAAQ,CAAC,MAAM,KAAK,qBAAqB;QACzC,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC1B,QAAQ,CAAC,MAAM,KAAK,sCAAsC;QAE1D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,OAAO;QACL,QAAQ,EAAE;YACR,GAAG,QAAQ;YACX,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;SAC7C;QACD,aAAa;QACb,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/utils/codex-mcp-input.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ */
+/** Validate raw Codex arguments before thin adapters can discard unsupported policy fields. */
+export declare function assertCodexMcpArguments(args: object, allowed: readonly string[]): void;
+//# sourceMappingURL=codex-mcp-input.d.ts.map

package/dist/utils/codex-mcp-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-mcp-input.d.ts","sourceRoot":"","sources":["../../src/utils/codex-mcp-input.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,+FAA+F;AAC/F,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAKtF"}

package/dist/utils/codex-mcp-input.js

@@ -0,0 +1,14 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ */
+/** Validate raw Codex arguments before thin adapters can discard unsupported policy fields. */
+export function assertCodexMcpArguments(args, allowed) {
+    const raw = args;
+    if (raw.host !== 'codex')
+        return;
+    const unsupported = Object.keys(raw).find((key) => !allowed.includes(key));
+    if (unsupported)
+        throw new Error(`Unsupported Codex MCP argument: ${unsupported}`);
+}
+//# sourceMappingURL=codex-mcp-input.js.map

package/dist/utils/codex-mcp-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-mcp-input.js","sourceRoot":"","sources":["../../src/utils/codex-mcp-input.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,OAA0B;IAC9E,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,IAAI,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,WAAW,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/utils/codex-payload.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Copyright © 2026 Thomas Hertel (the@devsteps.dev)
+ * Licensed under the Apache License, Version 2.0
+ */
+import type { CodexMode } from './codex-types.js';
+export interface CodexPayload {
+    version: string;
+    pluginId: string;
+    contract: string;
+    files: Map<string, Buffer>;
+    runtimeTarget?: string;
+}
+/** Resolve delivery resources from the installed adapter, never the consumer cwd. */
+export declare function resolvePackagedCodexDir(moduleDirectory: string): string | undefined;
+/** Only generated guidance and the stable native runtime can be owned by setup. */
+export declare function validateCodexTarget(target: string): void;
+/** Validate the entire declared payload before exposing any bytes to the planner. */
+export declare function readCodexPayload(root: string, mode: CodexMode, packageVersion?: string): CodexPayload;
+//# sourceMappingURL=codex-payload.d.ts.map

package/dist/utils/codex-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-payload.d.ts","sourceRoot":"","sources":["../../src/utils/codex-payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYnF;AAWD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAcxD;AAqDD,qFAAqF;AACrF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,YAAY,CA4Cd"}