@scotthuang/agent-knock-knock 0.12.11 → 0.12.13

package/dist/src/terminal-submission-acceptance.js

@@ -2,111 +2,559 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { redactString } from "./runtime-log.js";
-export function validateTerminalSubmissionAcceptanceEvidence(value, expected) {
-    if (!isRecord(value)) {
-        throw new Error("native acceptance evidence is unavailable");
+import { exactNativeThreadId, fingerprint, normalizedRolloutIdentity, parsedInteger, requiredString, sha256Value, validTimestamp, validateCodexRolloutAcceptanceAnchor, validateTerminalSubmissionAcceptanceEvidence } from "./terminal-submission-facts.js";
+export { validateCodexRolloutAcceptanceAnchor, validateTerminalSubmissionAcceptanceEvidence };
+const CODEX_ACCEPTANCE_MAX_BYTES = 16 * 1024 * 1024;
+const CODEX_COMPLETION_MAX_BYTES = 256 * 1024 * 1024;
+const CODEX_COMPLETION_MAX_TEXT_LENGTH = 4000;
+const CODEX_ACTIVE_TASK_SCAN_CHUNK_BYTES = 64 * 1024;
+const CODEX_ACTIVE_TASK_MAX_RECORD_BYTES = 16 * 1024 * 1024;
+const CODEX_ROLLOUT_HEADER_MAX_BYTES = 1024 * 1024;
+const CODEX_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
+const NO_FOLLOW_FLAG = typeof fs.constants.O_NOFOLLOW === "number"
+    ? fs.constants.O_NOFOLLOW
+    : 0;
+/**
+ * Capture the latest active native task in an exact open Codex rollout.
+ * This is intentionally separate from the pre-send acceptance anchor: all
+ * task-start and root-user evidence already exists when this function runs.
+ */
+export function captureCodexHumanStartedActiveTaskAnchor(options) {
+    const current = options.currentIdentity;
+    const nativeThreadId = exactNativeThreadId(current.sessionId);
+    const processUuid = requiredString(current.processUuid, "Codex process UUID");
+    const processBirth = requiredString(current.processBirth, "Codex process birth");
+    if (!current.rollout) {
+        throw new Error("the active Codex task has no exact rollout identity");
+    }
+    const rollout = normalizedRolloutIdentity(current.rollout);
+    const maxBytes = positiveByteLimit(options.maxBytes, CODEX_COMPLETION_MAX_BYTES, "Codex active-task capture");
+    const opened = openExactRollout(rollout);
+    try {
+        const before = opened.stat;
+        assertPrivateRegularFile(before);
+        if (before.size === 0) {
+            return undefined;
+        }
+        if (!fileEndsWithNewline(opened.fd, before.size)) {
+            throw new Error("Codex active-task rollout has an incomplete JSONL tail; retry");
+        }
+        const header = readCodexRolloutHeader(opened.fd, before.size);
+        const codexVersion = assertExistingCodexRolloutHeader(header, nativeThreadId);
+        const active = latestCodexHumanStartedActiveTask(opened.fd, before.size, maxBytes);
+        const after = fs.fstatSync(opened.fd);
+        if (!sameStableFile(before, after)) {
+            throw new Error("Codex active-task rollout changed while it was captured; retry");
+        }
+        if (!active) {
+            return undefined;
+        }
+        const base = {
+            schema: "agent-knock-knock/codex-human-started-active-task-anchor",
+            version: 1,
+            native_thread_id: nativeThreadId,
+            process_uuid: processUuid,
+            process_birth: processBirth,
+            captured_at: (options.now ?? new Date()).toISOString(),
+            rollout,
+            turn_id: active.turnId,
+            request_hash: active.requestHash,
+            codex_version: codexVersion,
+            task_started_offset_bytes: active.taskStartedOffsetBytes,
+            user_message_offset_bytes: active.userMessageOffsetBytes,
+            observed_end_offset_bytes: before.size
+        };
+        return {
+            ...base,
+            anchor_fingerprint: fingerprint(base)
+        };
+    }
+    finally {
+        fs.closeSync(opened.fd);
+    }
+}
+/** Observe only the exact human-started task named by the persisted anchor. */
+export function observeCodexHumanStartedActiveTask(options) {
+    try {
+        const anchor = validateCodexHumanStartedActiveTaskAnchor(options.anchor);
+        const maxBytes = positiveByteLimit(options.maxBytes, CODEX_COMPLETION_MAX_BYTES, "Codex active-task observation");
+        const resumeOffsetBytes = codexActiveTaskResumeOffset(anchor, options.resumeOffsetBytes);
+        const opened = openExactRollout(anchor.rollout);
+        try {
+            const before = opened.stat;
+            assertPrivateRegularFile(before);
+            if (before.size < anchor.observed_end_offset_bytes) {
+                throw new Error("Codex active-task rollout was truncated after capture");
+            }
+            if (before.size < resumeOffsetBytes) {
+                throw new Error("Codex active-task rollout was truncated after observation");
+            }
+            assertCodexActiveTaskResumeBoundary(opened.fd, resumeOffsetBytes);
+            const availableBytes = before.size - resumeOffsetBytes;
+            const bytesToRead = Math.min(availableBytes, maxBytes);
+            if (bytesToRead === 0) {
+                assertCodexHumanStartedIdentity(anchor, options.currentIdentity);
+                return {
+                    status: "pending",
+                    observedEndOffsetBytes: before.size,
+                    safeResumeOffsetBytes: resumeOffsetBytes
+                };
+            }
+            const buffer = readExactBytes(opened.fd, resumeOffsetBytes, bytesToRead);
+            const completeLength = completeJsonlPrefixLength(buffer);
+            if (completeLength === 0 && availableBytes > maxBytes) {
+                throw new Error("Codex active-task JSONL record exceeded the bounded read limit");
+            }
+            const completeBuffer = buffer.subarray(0, completeLength);
+            const safeResumeOffsetBytes = resumeOffsetBytes + completeLength;
+            const after = fs.fstatSync(opened.fd);
+            if (!sameStableFile(before, after)) {
+                assertCodexHumanStartedIdentity(anchor, options.currentIdentity);
+                return {
+                    status: "pending",
+                    observedEndOffsetBytes: after.size,
+                    safeResumeOffsetBytes: resumeOffsetBytes
+                };
+            }
+            const suffixRecords = parseCodexJsonlRecords(completeBuffer, "active-task suffix");
+            const laterTaskOffset = suffixRecords.find(({ value }) => isLaterCodexHumanTaskRecord(value))?.offsetBytes;
+            const exactCompletionOffset = suffixRecords.find(({ value }) => isExactCodexTaskCompleteRecord(value, anchor.turn_id))?.offsetBytes;
+            const exactAbortRecords = suffixRecords.filter(({ value }) => isExactCodexTurnAbortedRecord(value, anchor.turn_id));
+            if (exactAbortRecords.length > 1) {
+                throw new Error("the exact Codex active task has duplicate turn_aborted records");
+            }
+            const exactAbort = exactAbortRecords[0];
+            const exactSettlementOffset = [
+                exactCompletionOffset,
+                exactAbort?.offsetBytes
+            ].filter((offset) => offset !== undefined)
+                .sort((left, right) => left - right)[0];
+            if (laterTaskOffset !== undefined &&
+                (exactSettlementOffset === undefined ||
+                    laterTaskOffset < exactSettlementOffset)) {
+                throw new Error("a later Codex human task appeared after the active-task anchor");
+            }
+            if (exactAbort &&
+                (exactCompletionOffset === undefined ||
+                    exactAbort.offsetBytes < exactCompletionOffset)) {
+                return codexHumanStartedTaskAbortCompletion(anchor, exactAbort.value, before.size);
+            }
+            const completion = scanExactCodexTaskComplete(completeBuffer.toString("utf8"), anchor.turn_id);
+            if (completion.status === "failure") {
+                throw new Error(completion.detail);
+            }
+            if (completion.status === "pending") {
+                assertCodexHumanStartedIdentity(anchor, options.currentIdentity);
+                return {
+                    status: "pending",
+                    observedEndOffsetBytes: before.size,
+                    safeResumeOffsetBytes
+                };
+            }
+            return {
+                status: "completed",
+                completion: {
+                    source: "durable",
+                    outcome: "success",
+                    text: truncateCompletionText(redactString(completion.text)),
+                    ...(completion.timestamp ? { timestamp: completion.timestamp } : {}),
+                    id: anchor.turn_id,
+                    confidence: "high",
+                    metadata: {
+                        match: "human_started_bound_rollout_task_complete",
+                        turn_id: anchor.turn_id,
+                        native_thread_id: anchor.native_thread_id,
+                        anchor_fingerprint: anchor.anchor_fingerprint,
+                        observed_end_offset_bytes: before.size
+                    }
+                }
+            };
+        }
+        finally {
+            fs.closeSync(opened.fd);
+        }
+    }
+    catch (error) {
+        if (isRetryableProviderIoError(error)) {
+            return {
+                status: "unavailable",
+                reason: error instanceof Error ? error.message : String(error),
+                retryable: true
+            };
+        }
+        return {
+            status: "invalidated",
+            reason: error instanceof Error ? error.message : String(error)
+        };
+    }
+}
+function codexActiveTaskResumeOffset(anchor, value) {
+    const offset = value === undefined
+        ? anchor.observed_end_offset_bytes
+        : safeByteOffset(value, "Codex active-task resume offset");
+    if (offset < anchor.observed_end_offset_bytes) {
+        throw new Error("Codex active-task resume offset predates its anchor");
+    }
+    return offset;
+}
+function assertCodexActiveTaskResumeBoundary(fd, offset) {
+    if (offset > 0 && byteAtOffset(fd, offset - 1) !== 0x0a) {
+        throw new Error("Codex active-task resume offset is not a JSONL boundary");
+    }
+}
+function completeJsonlPrefixLength(buffer) {
+    if (buffer.length === 0) {
+        return 0;
+    }
+    const newline = buffer.lastIndexOf(0x0a);
+    return newline < 0 ? 0 : newline + 1;
+}
+export function validateCodexHumanStartedActiveTaskAnchor(value) {
+    if (!isRecord(value) ||
+        value.schema !==
+            "agent-knock-knock/codex-human-started-active-task-anchor" ||
+        value.version !== 1) {
+        throw new Error("Codex human-started active-task anchor is invalid");
     }
     const allowedKeys = new Set([
-        "source",
-        "kind",
-        "nativeThreadId",
-        "requestHash",
-        "acceptanceId",
-        "acceptedAt",
-        "anchorFingerprint",
-        "evidenceFingerprint",
-        "metadata"
+        "schema", "version", "native_thread_id", "process_uuid", "process_birth",
+        "captured_at", "rollout", "turn_id", "request_hash", "codex_version",
+        "task_started_offset_bytes", "user_message_offset_bytes",
+        "observed_end_offset_bytes", "anchor_fingerprint"
     ]);
     if (Object.keys(value).some((key) => !allowedKeys.has(key))) {
-        throw new Error("native acceptance evidence contains unsupported fields");
-    }
-    if (value.source !== expected.source || value.kind !== "native_user_turn") {
-        throw new Error("native acceptance evidence has the wrong agent or kind");
-    }
-    if (requiredString(value.nativeThreadId, "native acceptance thread") !==
-        requiredString(expected.nativeThreadId, "expected native acceptance thread") ||
-        sha256Value(value.requestHash, "native acceptance request hash") !==
-            sha256Value(expected.requestHash, "expected native acceptance request hash")) {
-        throw new Error("native acceptance evidence does not match the exact request binding");
-    }
-    requiredString(value.acceptanceId, "native acceptance id");
-    sha256Value(value.anchorFingerprint, "native acceptance anchor fingerprint");
-    sha256Value(value.evidenceFingerprint, "native acceptance evidence fingerprint");
-    if (value.acceptedAt !== undefined && !validTimestamp(value.acceptedAt)) {
-        throw new Error("native acceptance evidence timestamp is invalid");
-    }
-    if (value.metadata !== undefined) {
-        if (!isRecord(value.metadata)) {
-            throw new Error("native acceptance evidence metadata is invalid");
-        }
-        const allowedMetadata = value.source === "codex_rollout"
-            ? new Set([
-                "turn_id",
-                "anchor_offset_bytes",
-                "observed_end_offset_bytes"
-            ])
-            : new Set([
-                "prompt_uuid",
-                "claude_version",
-                "transcript_file_id",
-                "anchor_offset_bytes",
-                "observed_end_offset_bytes",
-                "agent_started_at_ms"
-            ]);
-        for (const [key, item] of Object.entries(value.metadata)) {
-            if (!allowedMetadata.has(key) ||
-                !(typeof item === "string" ||
-                    (typeof item === "number" && Number.isFinite(item)))) {
-                throw new Error("native acceptance evidence metadata is not allowlisted");
-            }
+        throw new Error("Codex human-started active-task anchor has unsupported fields");
+    }
+    const nativeThreadId = exactNativeThreadId(value.native_thread_id);
+    const turnId = exactNativeThreadId(value.turn_id);
+    const capturedAt = value.captured_at;
+    if (nativeThreadId !== value.native_thread_id ||
+        turnId !== value.turn_id ||
+        !validTimestamp(capturedAt) ||
+        typeof capturedAt !== "string" ||
+        new Date(capturedAt).toISOString() !== capturedAt) {
+        throw new Error("Codex human-started active-task anchor identity is invalid");
+    }
+    for (const [field, label] of [
+        [value.process_uuid, "Codex active-task process UUID"],
+        [value.process_birth, "Codex active-task process birth"]
+    ]) {
+        if (requiredString(field, label) !== field ||
+            field.includes("\0")) {
+            throw new Error(`${label} is not canonical`);
         }
     }
-    const { evidenceFingerprint, ...base } = value;
-    if (fingerprint(base) !== evidenceFingerprint) {
-        throw new Error("native acceptance evidence fingerprint does not match");
+    if (sha256Value(value.request_hash, "Codex active-task request hash") !==
+        value.request_hash) {
+        throw new Error("Codex active-task request hash is not canonical");
+    }
+    if (typeof value.codex_version !== "string" ||
+        !CODEX_VERSION_PATTERN.test(value.codex_version)) {
+        throw new Error("Codex active-task version is invalid");
+    }
+    if (sha256Value(value.anchor_fingerprint, "Codex active-task anchor fingerprint") !== value.anchor_fingerprint) {
+        throw new Error("Codex active-task anchor fingerprint is not canonical");
+    }
+    if (!isRecord(value.rollout)) {
+        throw new Error("Codex human-started active-task rollout identity is invalid");
+    }
+    const rolloutKeys = new Set(["fd", "device", "inode", "path"]);
+    if (Object.keys(value.rollout).some((key) => !rolloutKeys.has(key))) {
+        throw new Error("Codex human-started active-task rollout has unsupported fields");
+    }
+    const rollout = normalizedRolloutIdentity(value.rollout);
+    if (Object.entries(rollout).some(([key, normalized]) => normalized !== value.rollout[key] || normalized.includes("\0")) ||
+        !path.isAbsolute(rollout.path)) {
+        throw new Error("Codex human-started active-task rollout path is not absolute");
+    }
+    const taskStartedOffset = safeByteOffset(value.task_started_offset_bytes, "Codex active-task task_started offset");
+    const userMessageOffset = safeByteOffset(value.user_message_offset_bytes, "Codex active-task user-message offset");
+    const observedEndOffset = safeByteOffset(value.observed_end_offset_bytes, "Codex active-task observed-end offset");
+    if (userMessageOffset <= taskStartedOffset ||
+        observedEndOffset <= userMessageOffset) {
+        throw new Error("Codex human-started active-task byte boundaries are inconsistent");
+    }
+    const { anchor_fingerprint: _anchorFingerprint, ...base } = value;
+    if (fingerprint(base) !== value.anchor_fingerprint) {
+        throw new Error("Codex human-started active-task anchor fingerprint does not match");
     }
     return value;
 }
-export function terminalSubmissionReplayReceipt(options) {
-    if (options.proofLevel !== "agent_accepted") {
-        return {
-            replayed: true,
-            delivered: false,
-            status: "submission_pending_acceptance",
-            submission_outcome: "pending_acceptance",
-            delivery_receipt: options.proofLevel,
-            do_not_retry: true
-        };
+function assertCodexHumanStartedIdentity(anchor, current) {
+    if (exactNativeThreadId(current.sessionId) !== anchor.native_thread_id ||
+        requiredString(current.processUuid, "Codex process UUID") !==
+            anchor.process_uuid ||
+        requiredString(current.processBirth, "Codex process birth") !==
+            anchor.process_birth ||
+        !current.rollout ||
+        !sameRolloutIdentity(normalizedRolloutIdentity(current.rollout), anchor.rollout)) {
+        throw new Error("Codex process, thread, or rollout identity changed after capture");
     }
-    try {
-        validateTerminalSubmissionAcceptanceEvidence(options.evidence, options.expected);
-        return {
-            replayed: true,
-            delivered: true,
-            status: "async_pending",
-            submission_outcome: "agent_accepted",
-            delivery_receipt: "agent_accepted"
-        };
+}
+function latestCodexHumanStartedActiveTask(fd, endOffset, maxBytes) {
+    const lowerBound = Math.max(0, endOffset - maxBytes);
+    const terminalTurns = new Map();
+    const userRecords = [];
+    let cursor = endOffset;
+    let leadingRecord = Buffer.alloc(0);
+    while (cursor > lowerBound) {
+        const readStart = Math.max(lowerBound, cursor - CODEX_ACTIVE_TASK_SCAN_CHUNK_BYTES);
+        const chunk = readExactBytes(fd, readStart, cursor - readStart);
+        const combined = leadingRecord.length > 0
+            ? Buffer.concat([chunk, leadingRecord])
+            : chunk;
+        let recordsBuffer = combined;
+        let recordsOffset = readStart;
+        if (readStart > 0) {
+            const firstNewline = combined.indexOf(0x0a);
+            if (firstNewline < 0) {
+                assertBoundedCodexActiveTaskRecord(combined.length);
+                leadingRecord = Buffer.from(combined);
+                cursor = readStart;
+                continue;
+            }
+            leadingRecord = Buffer.from(combined.subarray(0, firstNewline + 1));
+            assertBoundedCodexActiveTaskRecord(leadingRecord.length);
+            recordsBuffer = combined.subarray(firstNewline + 1);
+            recordsOffset += firstNewline + 1;
+        }
+        else {
+            leadingRecord = Buffer.alloc(0);
+        }
+        const records = parseCodexJsonlRecords(recordsBuffer, "active-task rollout tail");
+        for (let index = records.length - 1; index >= 0; index -= 1) {
+            const record = records[index];
+            const decision = inspectCodexActiveTaskRecordInReverse({
+                value: record.value,
+                offsetBytes: recordsOffset + record.offsetBytes
+            }, terminalTurns, userRecords);
+            if (decision.status === "resolved") {
+                return decision.active;
+            }
+        }
+        cursor = readStart;
     }
-    catch (error) {
-        return {
-            replayed: true,
-            delivered: false,
-            status: "submission_uncertain",
-            submission_outcome: "uncertain",
-            delivery_receipt: "enter_dispatched",
-            do_not_retry: true,
-            evidence_error: error instanceof Error ? error.message : String(error)
-        };
+    if (lowerBound > 0) {
+        throw new Error("Codex active-task boundary exceeded the bounded reverse scan limit");
     }
+    return undefined;
+}
+function inspectCodexActiveTaskRecordInReverse(record, terminalTurns, userRecords) {
+    const { value, offsetBytes } = record;
+    const payload = isRecord(value.payload) ? value.payload : undefined;
+    if (!payload) {
+        return { status: "continue" };
+    }
+    if (value.type === "event_msg" &&
+        (payload.type === "task_complete" || payload.type === "turn_aborted")) {
+        const turnId = exactNativeThreadId(payload.turn_id);
+        const kind = payload.type === "task_complete" ? "completed" : "aborted";
+        const previous = terminalTurns.get(turnId);
+        if (previous) {
+            throw new Error(previous === kind
+                ? `Codex rollout contains duplicate ${String(payload.type)} evidence`
+                : "Codex rollout contains conflicting terminal task evidence");
+        }
+        terminalTurns.set(turnId, kind);
+        return { status: "continue" };
+    }
+    if (value.type === "response_item" &&
+        payload.type === "message" &&
+        payload.role === "user") {
+        const metadata = isRecord(payload.internal_chat_message_metadata_passthrough)
+            ? payload.internal_chat_message_metadata_passthrough
+            : undefined;
+        const rawTurnId = optionalString(metadata?.turn_id);
+        if (rawTurnId) {
+            const text = exactCodexUserResponseText(payload.content);
+            userRecords.push({
+                offsetBytes,
+                turnId: rawTurnId.toLowerCase(),
+                ...(text === undefined ? {} : { requestHash: fingerprintText(text) })
+            });
+        }
+        return { status: "continue" };
+    }
+    if (value.type !== "event_msg" || payload.type !== "task_started") {
+        return { status: "continue" };
+    }
+    const turnId = exactNativeThreadId(payload.turn_id);
+    if (terminalTurns.has(turnId)) {
+        return { status: "resolved" };
+    }
+    const matchingUsers = userRecords.filter((user) => user.turnId === turnId);
+    if (matchingUsers.length === 0) {
+        return { status: "resolved" };
+    }
+    if (matchingUsers.length !== 1) {
+        throw new Error("Codex active task has multiple same-turn root user rows");
+    }
+    const [user] = matchingUsers;
+    if (user.requestHash === undefined) {
+        throw new Error("Codex active-task root user row has unsupported prompt content");
+    }
+    if (user.offsetBytes <= offsetBytes) {
+        throw new Error("Codex active-task root user row precedes task_started");
+    }
+    if (userRecords.some((candidate) => candidate.offsetBytes > user.offsetBytes && candidate.turnId !== turnId)) {
+        throw new Error("Codex active task is not the latest native human task");
+    }
+    return {
+        status: "resolved",
+        active: {
+            turnId,
+            requestHash: user.requestHash,
+            taskStartedOffsetBytes: offsetBytes,
+            userMessageOffsetBytes: user.offsetBytes
+        }
+    };
+}
+function assertBoundedCodexActiveTaskRecord(length) {
+    if (length > CODEX_ACTIVE_TASK_MAX_RECORD_BYTES) {
+        throw new Error("Codex active-task JSONL record exceeded the safe read limit");
+    }
+}
+function isLaterCodexHumanTaskRecord(value) {
+    const payload = isRecord(value.payload) ? value.payload : undefined;
+    return Boolean(payload &&
+        ((value.type === "event_msg" && payload.type === "task_started") ||
+            (value.type === "response_item" &&
+                payload.type === "message" &&
+                payload.role === "user")));
+}
+function isExactCodexTaskCompleteRecord(value, expectedTurnId) {
+    const payload = isRecord(value.payload) ? value.payload : undefined;
+    return value.type === "event_msg" &&
+        payload?.type === "task_complete" &&
+        optionalString(payload.turn_id)?.toLowerCase() === expectedTurnId;
+}
+function isExactCodexTurnAbortedRecord(value, expectedTurnId) {
+    const payload = isRecord(value.payload) ? value.payload : undefined;
+    return value.type === "event_msg" &&
+        payload?.type === "turn_aborted" &&
+        optionalString(payload.turn_id)?.toLowerCase() === expectedTurnId;
+}
+function codexHumanStartedTaskAbortCompletion(anchor, value, observedEndOffsetBytes) {
+    const payload = isRecord(value.payload) ? value.payload : undefined;
+    if (!payload || payload.type !== "turn_aborted") {
+        throw new Error("Codex active-task abort evidence is invalid");
+    }
+    const reason = optionalString(payload.reason) ?? "interrupted";
+    if (value.timestamp !== undefined && !validTimestamp(value.timestamp)) {
+        throw new Error("Codex active-task turn_aborted record has an invalid timestamp");
+    }
+    const redactedReason = truncateCompletionText(redactString(reason));
+    return {
+        status: "completed",
+        completion: {
+            source: "durable",
+            outcome: "failure",
+            text: truncateCompletionText(redactString(`Codex task stopped: ${redactedReason}`)),
+            ...(value.timestamp !== undefined
+                ? { timestamp: String(value.timestamp) }
+                : {}),
+            id: anchor.turn_id,
+            confidence: "high",
+            metadata: {
+                match: "human_started_bound_rollout_turn_aborted",
+                turn_id: anchor.turn_id,
+                native_thread_id: anchor.native_thread_id,
+                anchor_fingerprint: anchor.anchor_fingerprint,
+                abort_reason: redactedReason,
+                observed_end_offset_bytes: observedEndOffsetBytes
+            }
+        }
+    };
+}
+function parseCodexJsonlRecords(buffer, label) {
+    if (buffer.length > 0 && buffer[buffer.length - 1] !== 0x0a) {
+        throw new Error(`Codex ${label} ends with an incomplete JSONL record`);
+    }
+    const records = [];
+    let offset = 0;
+    while (offset < buffer.length) {
+        const newline = buffer.indexOf(0x0a, offset);
+        if (newline < 0) {
+            break;
+        }
+        const recordOffset = offset;
+        let lineBuffer = buffer.subarray(offset, newline);
+        if (lineBuffer.at(-1) === 0x0d) {
+            lineBuffer = lineBuffer.subarray(0, lineBuffer.length - 1);
+        }
+        offset = newline + 1;
+        const line = lineBuffer.toString("utf8");
+        if (!line.trim()) {
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            throw new Error(`Codex ${label} contains invalid JSONL`);
+        }
+        if (!isRecord(parsed)) {
+            throw new Error(`Codex ${label} contains a non-object JSONL record`);
+        }
+        records.push({ value: parsed, offsetBytes: recordOffset });
+    }
+    return records;
+}
+function assertExistingCodexRolloutHeader(buffer, nativeThreadId) {
+    const first = parseCodexJsonlRecords(buffer, "active-task rollout")[0]?.value;
+    const payload = first?.type === "session_meta" && isRecord(first.payload)
+        ? first.payload
+        : undefined;
+    if (!payload ||
+        exactNativeThreadId(payload.id) !== nativeThreadId ||
+        payload.originator !== "codex-tui" ||
+        payload.source !== "cli") {
+        throw new Error("Codex active-task rollout header does not identify the exact CLI thread");
+    }
+    const codexVersion = optionalString(payload.cli_version);
+    if (!codexVersion || !CODEX_VERSION_PATTERN.test(codexVersion)) {
+        throw new Error("Codex active-task rollout header has no exact CLI version");
+    }
+    return codexVersion;
+}
+function readCodexRolloutHeader(fd, size) {
+    const bytesToRead = Math.min(size, CODEX_ROLLOUT_HEADER_MAX_BYTES);
+    const buffer = readExactBytes(fd, 0, bytesToRead);
+    const newline = buffer.indexOf(0x0a);
+    if (newline < 0) {
+        throw new Error("Codex active-task rollout header exceeded the safe read limit");
+    }
+    return buffer.subarray(0, newline + 1);
+}
+function readExactBytes(fd, offset, length) {
+    const buffer = Buffer.allocUnsafe(length);
+    let total = 0;
+    while (total < length) {
+        const read = fs.readSync(fd, buffer, total, length - total, offset + total);
+        if (read === 0) {
+            break;
+        }
+        total += read;
+    }
+    if (total !== length) {
+        throw new Error("Codex rollout changed while it was being read");
+    }
+    return buffer;
+}
+function positiveByteLimit(value, fallback, label) {
+    const result = value ?? fallback;
+    if (!Number.isSafeInteger(result) || result <= 0) {
+        throw new Error(`${label} byte limit is invalid`);
+    }
+    return result;
+}
+function safeByteOffset(value, label) {
+    if (!Number.isSafeInteger(value) || Number(value) < 0) {
+        throw new Error(`${label} is invalid`);
+    }
+    return Number(value);
 }
-const CODEX_ACCEPTANCE_MAX_BYTES = 16 * 1024 * 1024;
-const CODEX_COMPLETION_MAX_BYTES = 256 * 1024 * 1024;
-const CODEX_COMPLETION_MAX_TEXT_LENGTH = 4000;
-const NATIVE_THREAD_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
-const NO_FOLLOW_FLAG = typeof fs.constants.O_NOFOLLOW === "number"
-    ? fs.constants.O_NOFOLLOW
-    : 0;
 export function captureCodexRolloutAcceptanceAnchor(options) {
     const processUuid = requiredString(options.processUuid, "Codex process UUID");
     const processBirth = requiredString(options.processBirth, "Codex process birth");
@@ -898,91 +1346,6 @@ function assertVirginRolloutHeader(options) {
         throw new Error("virgin Codex rollout predates its terminal submission anchor");
     }
 }
-export function validateCodexRolloutAcceptanceAnchor(value) {
-    if (!isRecord(value) ||
-        value.schema !== "agent-knock-knock/codex-rollout-acceptance-anchor" ||
-        (value.version !== 1 && value.version !== 2 && value.version !== 3) ||
-        !["existing", "pre_materialization", "candidate_set"].includes(String(value.mode)) ||
-        !Number.isSafeInteger(value.offset_bytes) ||
-        value.offset_bytes < 0 ||
-        typeof value.file_existed !== "boolean") {
-        throw new Error("Codex rollout acceptance anchor is invalid");
-    }
-    if (value.version === 1) {
-        exactNativeThreadId(value.native_thread_id);
-        if ("native_thread_binding" in value) {
-            throw new Error("bound Codex acceptance anchor has deferred binding state");
-        }
-    }
-    else if (value.version === 2 && (value.mode !== "pre_materialization" ||
-        value.native_thread_binding !== "post_submission" ||
-        "native_thread_id" in value)) {
-        throw new Error("virgin Codex acceptance anchor is inconsistent");
-    }
-    else if (value.version === 3 && (value.mode !== "candidate_set" ||
-        value.native_thread_binding !== "post_submission" ||
-        "native_thread_id" in value ||
-        value.file_existed !== false ||
-        value.offset_bytes !== 0 ||
-        typeof value.zero_file_baseline !== "boolean" ||
-        !Number.isSafeInteger(value.inventory_pid) ||
-        value.inventory_pid <= 1 ||
-        (value.inventory_cwd !== undefined &&
-            !path.isAbsolute(value.inventory_cwd)) ||
-        !/^[0-9a-f]{64}$/u.test(String(value.inventory_fingerprint)) ||
-        !Array.isArray(value.candidate_rollouts) ||
-        value.candidate_rollouts.length > 128 ||
-        value.zero_file_baseline !== (value.candidate_rollouts.length === 0))) {
-        throw new Error("candidate-set Codex acceptance anchor is inconsistent");
-    }
-    requiredString(value.process_uuid, "Codex process UUID");
-    requiredString(value.process_birth, "Codex process birth");
-    if (!validTimestamp(value.captured_at)) {
-        throw new Error("Codex acceptance capture timestamp is invalid");
-    }
-    sha256Value(value.anchor_fingerprint, "Codex acceptance anchor fingerprint");
-    const { anchor_fingerprint: _fingerprint, ...base } = value;
-    if (fingerprint(base) !== value.anchor_fingerprint) {
-        throw new Error("Codex rollout acceptance anchor fingerprint does not match");
-    }
-    if (value.version === 3) {
-        const seenThreads = new Set();
-        const seenFiles = new Set();
-        for (const candidate of value.candidate_rollouts) {
-            if (!isRecord(candidate)) {
-                throw new Error("Codex candidate-set rollout entry is invalid");
-            }
-            const nativeThreadId = exactNativeThreadId(candidate.native_thread_id);
-            const rollout = normalizedRolloutIdentity(candidate.rollout);
-            if (!Number.isSafeInteger(candidate.offset_bytes) ||
-                candidate.offset_bytes < 0 ||
-                seenThreads.has(nativeThreadId) ||
-                seenFiles.has(`${rollout.device}:${rollout.inode}`)) {
-                throw new Error("Codex candidate-set rollout entries are ambiguous");
-            }
-            seenThreads.add(nativeThreadId);
-            seenFiles.add(`${rollout.device}:${rollout.inode}`);
-        }
-        return value;
-    }
-    const rollout = "rollout" in value ? value.rollout : undefined;
-    if (value.file_existed !== (value.mode === "existing") ||
-        value.file_existed !== Boolean(rollout)) {
-        throw new Error("Codex rollout acceptance anchor file state is inconsistent");
-    }
-    if (value.mode === "existing" && rollout) {
-        normalizedRolloutIdentity(rollout);
-        if (value.expected_empty_native_session !== undefined) {
-            throw new Error("existing Codex acceptance anchor has pre-materialization state");
-        }
-    }
-    else if (value.offset_bytes !== 0 ||
-        rollout !== undefined ||
-        value.expected_empty_native_session !== true) {
-        throw new Error("Codex pre-materialization acceptance anchor is inconsistent");
-    }
-    return value;
-}
 function validateCodexOpenRootInventoryForAcceptance(value) {
     if (!isRecord(value) ||
         value.schema !==
@@ -1080,6 +1443,21 @@ function fileEndsWithNewline(fd, size) {
     const last = Buffer.allocUnsafe(1);
     return fs.readSync(fd, last, 0, 1, size - 1) === 1 && last[0] === 0x0a;
 }
+function byteAtOffset(fd, offset) {
+    const buffer = Buffer.allocUnsafe(1);
+    return fs.readSync(fd, buffer, 0, 1, offset) === 1
+        ? buffer[0]
+        : undefined;
+}
+function isRetryableProviderIoError(error) {
+    if (!isRecord(error) || typeof error.code !== "string") {
+        return false;
+    }
+    return new Set([
+        "EACCES", "EAGAIN", "EBUSY", "EIO", "EMFILE", "ENFILE", "ENOENT",
+        "EPERM", "ESTALE", "ETIMEDOUT"
+    ]).has(error.code);
+}
 function sameStableFile(left, right) {
     return left.dev === right.dev &&
         left.ino === right.ino &&
@@ -1087,65 +1465,20 @@ function sameStableFile(left, right) {
         left.mtimeMs === right.mtimeMs &&
         left.ctimeMs === right.ctimeMs;
 }
-function normalizedRolloutIdentity(value) {
-    const normalized = {
-        fd: requiredString(value.fd, "Codex rollout descriptor"),
-        device: requiredString(value.device, "Codex rollout device"),
-        inode: requiredString(value.inode, "Codex rollout inode"),
-        path: requiredString(value.path, "Codex rollout path")
-    };
-    parsedInteger(normalized.device);
-    parsedInteger(normalized.inode);
-    return normalized;
-}
 function sameRolloutIdentity(left, right) {
     return left.fd === right.fd &&
         left.device === right.device &&
         left.inode === right.inode &&
         left.path === right.path;
 }
-function exactNativeThreadId(value) {
-    const text = requiredString(value, "Codex native thread ID").toLowerCase();
-    if (!NATIVE_THREAD_ID_PATTERN.test(text)) {
-        throw new Error("Codex native thread ID is not an exact UUID");
-    }
-    return text;
-}
-function parsedInteger(value) {
-    try {
-        return BigInt(value);
-    }
-    catch {
-        throw new Error("Codex rollout file identity is not numeric");
-    }
-}
-function sha256Value(value, label) {
-    const text = requiredString(value, label).toLowerCase();
-    if (!/^[0-9a-f]{64}$/u.test(text)) {
-        throw new Error(`${label} is not a SHA-256 value`);
-    }
-    return text;
-}
-function requiredString(value, label) {
-    if (typeof value !== "string" || value.trim().length === 0) {
-        throw new Error(`${label} is unavailable`);
-    }
-    return value.trim();
-}
 function optionalString(value) {
     return typeof value === "string" && value.trim().length > 0
         ? value.trim()
         : undefined;
 }
-function validTimestamp(value) {
-    return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
 function fingerprintText(value) {
     return createHash("sha256").update(value).digest("hex");
 }
-function fingerprint(value) {
-    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
-}
 function isRecord(value) {
     return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }