@skill-harness/adapters 0.12.0 → 0.14.0

package/dist/codex-host-observer.js

@@ -0,0 +1,309 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { learningCopy, learningJournal, learningHash } from './learning-journal.js';
+import { collapseVotePanel } from '@skill-harness/core';
+import { inertCodexSdkStreams, boundCodexSdkStreams } from './codex-sdk-transport.js';
+/** LOCAL host protocol with an inert installed-SDK seam; no auth loader or live network switch.
+ * The trusted host owns this module and transport streams; the subject gets framed IPC only.
+ * Stream finish proves a host-side write, NOT provider receipt, backend identity or token limits.
+ * Journal integrity assumes a trusted cooperative host/filesystem, not hostile same-UID rollback. */
+export const CODEX_SUBSCRIPTION_DESTINATION = 'https://chatgpt.com/backend-api/codex/responses';
+const MODELS = ['gpt-5.3-codex-spark', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.5', 'gpt-5.6-luna', 'gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-6-astra'];
+const sha = (b) => createHash('sha256').update(b).digest('hex');
+function closed(v, keys) { if (!v || Object.keys(v).sort().join() !== keys.sort().join())
+    throw Error('closed local Codex contract required'); }
+function admit(raw) {
+    const s = learningCopy(raw);
+    closed(s, ['version', 'maxCalls', 'wallMs', 'invocations']);
+    if (s.version !== 'codex-host-local-v1' || !Number.isSafeInteger(s.maxCalls) || s.maxCalls < 1 || s.maxCalls > 16 || !Number.isSafeInteger(s.wallMs) || s.wallMs < 1 || s.wallMs > 150000 || !Array.isArray(s.invocations) || !s.invocations.length || s.invocations.length > s.maxCalls)
+        throw Error('bounded local host spec required');
+    for (const i of s.invocations) {
+        closed(i, ['id', 'role', 'model', 'effort', 'instructions', 'input', 'expectedSha256', 'subjectId']);
+        if (!/^[a-zA-Z0-9_-]{1,64}$/.test(i.id) || !['proposer', 'subject', 'judge'].includes(i.role) || !MODELS.includes(i.model) || !['low', 'medium', 'high'].includes(i.effort) || typeof i.instructions !== 'string' || typeof i.input !== 'string' || Buffer.byteLength(i.instructions) + Buffer.byteLength(i.input) > 4096 || !/^[a-f0-9]{64}$/.test(i.expectedSha256))
+            throw Error('unresolved or unbounded subscription invocation');
+    }
+    if (new Set(s.invocations.map(i => i.id)).size !== s.invocations.length)
+        throw Error('duplicate invocation');
+    if (s.invocations.some((i, k) => s.invocations.some((j, l) => k !== l && i.model === j.model && (i.role !== j.role || i.role === 'judge' && i.subjectId === j.subjectId))))
+        throw Error('known model role conflict before effects');
+    for (const i of s.invocations) {
+        if (i.role === 'judge' ? !s.invocations.some(t => t.role === 'subject' && t.id === i.subjectId) : i.subjectId !== null)
+            throw Error('frozen subject/panel binding required');
+        if (s.invocations.filter(t => t.role === 'judge' && t.subjectId === i.id).length > 3)
+            throw Error('at most three panel roles');
+    }
+    return s;
+}
+/** This checks supplied policy consistency, never authenticates its source or invents lineage. */
+export function inspectCodexRoleSeparation(raw) {
+    const rows = learningCopy(raw);
+    const blocked = (reason) => ({ state: 'BLOCKED', reason, liveQualified: false });
+    if (!Array.isArray(rows) || rows.length < 3 || rows.length > 16 || !['proposer', 'subject', 'judge'].every(r => rows.some(x => x.role === r)))
+        return blocked('required roles absent');
+    for (const r of rows) {
+        closed(r, ['role', 'model', 'canonical', 'lineage']);
+        if (!['proposer', 'subject', 'judge'].includes(r.role) || !MODELS.includes(r.model))
+            return blocked('unsupported exact subscription identity');
+    }
+    if (rows.some(r => typeof r.canonical !== 'string' || !r.canonical || r.canonical.length > 512 || /[\u0000-\u001f\u007f]/.test(r.canonical)))
+        return blocked('unresolved canonical identity');
+    if (rows.some(r => r.lineage !== null && (typeof r.lineage !== 'string' || !r.lineage || r.lineage.length > 512 || /[\u0000-\u001f\u007f]/.test(r.lineage))))
+        return blocked('malformed lineage disclosure');
+    if (new Set(rows.map(r => r.model)).size !== rows.length || new Set(rows.map(r => r.canonical)).size !== rows.length)
+        return blocked('canonical identity conflict');
+    const disclosures = [...new Set(rows.flatMap(r => r.lineage === null ? ['lineage unresolved; correlation unknown'] : rows.filter(x => x.lineage === r.lineage).length > 1 ? [`shared lineage: ${r.lineage}`] : []))];
+    return { state: 'CONSISTENT_DECLARATION_ONLY', reason: 'canonical declarations are not authenticated resolution; lineage is disclosed, not proof of training independence', disclosures, liveQualified: false };
+}
+function sourceSettled(rows, id) {
+    const bound = rows.find(r => r.type === 'producer-ipc-bound' && r.id === id);
+    return !bound || rows.some(r => r.type === 'producer-ipc-settled' && r.id === id && r.bindingHash === bound.bindingHash);
+}
+function readBounded(stream, limit, signal) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0, ended = false;
+        const cleanup = () => { stream.off('data', data); stream.off('end', end); stream.off('error', error); stream.off('close', close); signal.removeEventListener('abort', abort); };
+        const error = (e) => { cleanup(); stream.destroy(); reject(e); };
+        const data = (b) => { if (!Buffer.isBuffer(b) && typeof b !== 'string') {
+            error(Error('host stream requires byte chunks'));
+            return;
+        } size += typeof b === 'string' ? Buffer.byteLength(b) : b.length; if (size > limit) {
+            error(Error('host stream byte bound'));
+            return;
+        } chunks.push(Buffer.from(b)); };
+        const end = () => { ended = true; cleanup(); resolve(Buffer.concat(chunks)); };
+        const close = () => { if (!ended)
+            error(Error('incomplete host stream')); };
+        const abort = () => error(Error(signal.reason === 'producer-source-cancelled' ? 'source cancelled' : 'host deadline exceeded'));
+        stream.on('data', data);
+        stream.once('end', end);
+        stream.once('error', error);
+        stream.once('close', close);
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted)
+            abort();
+    });
+}
+function writeBody(stream, body, signal) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { stream.off('error', error); stream.off('finish', finish); stream.off('close', close); signal.removeEventListener('abort', abort); };
+        const error = (e) => { cleanup(); stream.destroy(); reject(e); };
+        const finish = () => { cleanup(); resolve(); };
+        const close = () => error(Error('host write incomplete'));
+        const abort = () => error(Error(signal.reason === 'producer-source-cancelled' ? 'source cancelled' : 'host deadline exceeded'));
+        stream.once('error', error);
+        stream.once('finish', finish);
+        stream.once('close', close);
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted) {
+            abort();
+            return;
+        }
+        stream.end(body);
+    });
+}
+function parseVote(text, ordinal) { const v = JSON.parse(text); closed(v, ['verdict', 'suspect']); if (typeof v.suspect !== 'boolean' || !['PASS', 'FAIL', 'ERROR', 'NOT-MEASURED', 'JUDGE-AMBIGUOUS'].includes(v.verdict))
+    throw Error('malformed host-observed vote'); return { ...v, ordinal }; }
+function body(i, blindInput) {
+    // Exact supported request subset inspected in installed Codex buildRequestBody. No tools,
+    // service tier, cache/session key, extension onPayload, endpoint or sampling overrides.
+    return JSON.stringify({ model: i.model, store: false, stream: true, instructions: i.instructions, input: [{ role: 'user', content: [{ type: 'input_text', text: blindInput ?? i.input }] }], text: { verbosity: 'low' }, include: ['reasoning.encrypted_content'], tool_choice: 'none', parallel_tool_calls: false, reasoning: { effort: i.effort, summary: 'auto' } });
+}
+export function createLocalCodexHost(path, input, rolePolicy, subscription) {
+    const spec = admit(input), policy = rolePolicy === undefined ? null : learningCopy(rolePolicy);
+    if (policy) {
+        const separation = inspectCodexRoleSeparation(policy);
+        if (separation.state === 'BLOCKED')
+            throw Error(separation.reason);
+        for (const i of spec.invocations)
+            if (!policy.some(r => r.role === i.role && r.model === i.model))
+                throw Error('unbound canonical role policy');
+    }
+    if (subscription) {
+        closed(subscription, ['charterSha256', 'mode', 'requestBytes', 'responseBytes', 'totalRequestBytes', 'totalResponseBytes', 'callMs']);
+        if (!/^[a-f0-9]{64}$/.test(subscription.charterSha256) || !['fixture', 'subscription-live'].includes(subscription.mode) || ![subscription.requestBytes, subscription.responseBytes, subscription.totalRequestBytes, subscription.totalResponseBytes, subscription.callMs].every(n => Number.isSafeInteger(n) && n > 0) || subscription.requestBytes > 4096 || subscription.responseBytes > 16384 || subscription.callMs > 30000)
+            throw Error('invalid subscription reservations');
+    }
+    learningJournal(path, { type: 'codex-host-local-v1', spec, rolePolicy: policy, subscription: subscription ?? null, seed: randomBytes(32).toString('hex'), createdAt: Date.now() });
+    return openLocalCodexHost(path);
+}
+export function openLocalCodexHost(path) {
+    const store = learningJournal(path), first = store.read()[0].value;
+    if (first.type !== 'codex-host-local-v1' || typeof first.createdAt !== 'number' || typeof first.seed !== 'string')
+        throw Error('local host owner required');
+    const spec = admit(first.spec);
+    const append = (value) => { const prior = store.read().at(-1).id; return store.append(prior, value); };
+    const inspect = () => { const rows = store.read().map(e => e.value), claims = rows.filter(r => r.type === 'claim'), results = rows.filter(r => r.type === 'observation'); return { calls: claims.length, complete: results.length === spec.invocations.length && claims.length === results.length && results.every(r => sourceSettled(rows, r.id)) && !rows.some(r => r.type === 'abort'), aborted: rows.some(r => r.type === 'abort') || claims.length !== results.length, liveQualified: false }; };
+    const observeSdk = (value) => { const rows = store.read(); if (value.type === 'sdk-response-validated' && rows.some(e => e.value.type === 'sdk-response-validated' && e.value.responseId === value.responseId))
+        throw Error('replayed SDK response'); const claim = rows.filter(e => e.value.type === 'claim').at(-1)?.value; if (!claim || value.type === 'sdk-wire-observed' && value.requestSha256 !== claim.requestSha256)
+        throw Error('SDK observation without bound claim'); append({ ...value, id: claim.id, sequence: claim.sequence }); };
+    const host = { inspect,
+        async exchangeSubscriptionSdk(subjectFrames, binding, transport, charterSha256, sourceSignal) {
+            const reservation = first.subscription;
+            if (!reservation || reservation.charterSha256 !== charterSha256 || !first.rolePolicy || (reservation.mode === 'fixture' ? 'fixture-http' : 'subscription-http') !== transport.kind) {
+                subjectFrames.destroy();
+                throw Error('subscription charter/transport binding refused');
+            }
+            const separation = inspectCodexRoleSeparation(first.rolePolicy);
+            if (separation.state === 'BLOCKED') {
+                subjectFrames.destroy();
+                throw Error(separation.reason);
+            }
+            const streams = boundCodexSdkStreams(binding, transport, observeSdk, reservation);
+            try {
+                return await host.exchange(subjectFrames, streams.transport, streams.response, true, sourceSignal);
+            }
+            finally {
+                subjectFrames.destroy();
+                streams.transport.destroy();
+                streams.response.destroy();
+            }
+        },
+        async exchangeSdk(subjectFrames, binding, fixture) {
+            if (!first.rolePolicy) {
+                subjectFrames.destroy();
+                throw Error('frozen canonical policy required before SDK effects');
+            }
+            const separation = inspectCodexRoleSeparation(first.rolePolicy);
+            if (separation.state === 'BLOCKED') {
+                subjectFrames.destroy();
+                throw Error(separation.reason);
+            }
+            const streams = inertCodexSdkStreams(binding, fixture, observeSdk);
+            return host.exchange(subjectFrames, streams.transport, streams.response);
+        },
+        async exchange(subjectFrames, hostTransport, hostResponse, subscriptionMode = false, sourceSignal) {
+            const reservation = first.subscription;
+            if (!!reservation !== subscriptionMode) {
+                subjectFrames.destroy();
+                hostTransport.destroy();
+                hostResponse.destroy();
+                throw Error('subscription owner requires bound transport');
+            }
+            if (reservation && store.read().some(e => e.value.type === 'subscription-finished')) {
+                subjectFrames.destroy();
+                hostTransport.destroy();
+                hostResponse.destroy();
+                throw Error('subscription execution finished');
+            }
+            const state = inspect();
+            if (state.aborted)
+                throw Error('host aborted or stranded claim; no retry');
+            if (state.calls >= spec.maxCalls)
+                throw Error('call budget exhausted');
+            const clockHistory = store.read(), now = Date.now(), lastClock = Math.max(Number(first.createdAt), ...clockHistory.filter(e => e.value.type === 'clock').map(e => Number(e.value.at)));
+            if (!Number.isFinite(now) || now < lastClock) {
+                store.append(clockHistory.at(-1).id, { type: 'abort', reason: 'host clock rollback refused' });
+                throw Error('host clock rollback refused');
+            }
+            store.append(clockHistory.at(-1).id, { type: 'clock', at: now });
+            const controller = new AbortController(), remaining = Math.min(spec.wallMs - (now - Number(first.createdAt)), reservation?.callMs ?? Infinity);
+            let deadlineExceeded = false;
+            const timer = setTimeout(() => { deadlineExceeded = true; controller.abort(); }, Math.max(0, remaining));
+            const cancelSource = () => controller.abort('producer-source-cancelled');
+            sourceSignal?.addEventListener('abort', cancelSource, { once: true });
+            if (sourceSignal?.aborted)
+                cancelSource();
+            try {
+                if (remaining <= 0)
+                    throw Error('host deadline exceeded');
+                const frameBytes = await readBounded(subjectFrames, 1024, controller.signal), text = new TextDecoder('utf8', { fatal: true }).decode(frameBytes), frame = JSON.parse(text);
+                closed(frame, ['id', 'sequence']);
+                if (frame.sequence !== 1 || text !== JSON.stringify({ id: frame.id, sequence: 1 }) + '\n')
+                    throw Error('incomplete or noncanonical invocation sequence');
+                const i = spec.invocations.find(i => i.id === frame.id);
+                if (!i)
+                    throw Error('unbound invocation');
+                const history = store.read();
+                if (history.some(e => e.value.type === 'claim' && e.value.id === i.id))
+                    throw Error('invocation already claimed; no retry');
+                if (history.some(e => e.value.type === 'abort') || history.filter(e => e.value.type === 'claim').length !== history.filter(e => e.value.type === 'observation').length)
+                    throw Error('host aborted or concurrent claim');
+                let blindInput;
+                if (i.role === 'judge') {
+                    const subject = history.find(e => e.value.type === 'observation' && e.value.id === i.subjectId)?.value;
+                    if (!subject || subject.objective !== 'PASS' || !sourceSettled(history.map(e => e.value), i.subjectId))
+                        throw Error('objective gate blocks judge emission or source unsettled');
+                    const siblings = spec.invocations.filter(t => t.role === 'judge' && t.subjectId === i.subjectId), ordinal = siblings.findIndex(t => t.id === i.id);
+                    const previous = siblings.slice(0, ordinal).map((t, k) => { const r = history.find(e => e.value.type === 'observation' && e.value.id === t.id)?.value; if (!r || !sourceSettled(history.map(e => e.value), t.id))
+                        throw Error('preceding panel observation missing or source unsettled'); return parseVote(Buffer.from(String(r.outputBase64), 'base64').toString('utf8'), k + 1); });
+                    if (ordinal === 2 && !collapseVotePanel(previous).split)
+                        throw Error('tie-break requires clean split');
+                    blindInput = JSON.stringify({ label: sha(String(first.seed) + String(i.subjectId)).slice(0, 24), outputBase64: subject.outputBase64, criterion: i.input });
+                }
+                const requestBody = body(i, blindInput), sequence = history.filter(e => e.value.type === 'claim').length + 1;
+                if (Buffer.byteLength(requestBody) > (reservation?.requestBytes ?? 4096))
+                    throw Error('host request byte bound');
+                if (sequence > spec.maxCalls)
+                    throw Error('call budget exhausted');
+                if (reservation) {
+                    const claims = history.filter(e => e.value.type === 'claim');
+                    if ((claims.length + 1) * reservation.requestBytes > reservation.totalRequestBytes || (claims.length + 1) * reservation.responseBytes > reservation.totalResponseBytes) {
+                        append({ type: 'subscription-reservation-refused', id: i.id, charterSha256: reservation.charterSha256, claimedCalls: claims.length, limits: reservation });
+                        throw Error('aggregate subscription byte reservation exhausted');
+                    }
+                }
+                store.append(history.at(-1).id, { type: 'claim', id: i.id, sequence, role: i.role, destination: CODEX_SUBSCRIPTION_DESTINATION, requestSha256: sha(requestBody), ...(reservation ? { requestReservation: reservation.requestBytes, responseReservation: reservation.responseBytes, charterSha256: reservation.charterSha256, executionMode: reservation.mode } : {}) });
+                await writeBody(hostTransport, Buffer.from(requestBody), controller.signal);
+                append({ type: 'host-write-completed', id: i.id, sequence, requestBody, requestSha256: sha(requestBody) });
+                const output = await readBounded(hostResponse, reservation?.responseBytes ?? 16384, controller.signal);
+                const result = { id: i.id, sequence, requestBody, requestSha256: sha(requestBody), outputBase64: output.toString('base64'), outputSha256: sha(output), objective: i.role === 'judge' ? (parseVote(new TextDecoder('utf8', { fatal: true }).decode(output), 1), 'PASS') : sha(output) === i.expectedSha256 ? 'PASS' : 'FAIL', providerInternalFacts: null, liveQualified: false };
+                if (sourceSignal?.aborted)
+                    throw Error('source cancelled before observation');
+                if (reservation && store.read().some(e => e.value.type === 'abort'))
+                    throw Error('concurrent subscription abort');
+                append({ type: 'observation', ...result });
+                return result;
+            }
+            catch (error) {
+                append({ type: 'abort', reason: 'local exchange failed; no automatic retry', deadlineExceeded, sourceAborted: sourceSignal?.aborted === true });
+                throw error;
+            }
+            finally {
+                clearTimeout(timer);
+                sourceSignal?.removeEventListener('abort', cancelSource);
+                subjectFrames.destroy();
+                hostTransport.destroy();
+                hostResponse.destroy();
+            }
+        },
+        panel(subjectId, judgeIds, rawPolicy) {
+            const policy = learningCopy(rawPolicy);
+            if (first.rolePolicy && learningHash(policy) !== learningHash(first.rolePolicy))
+                throw Error('frozen canonical policy changed');
+            const separation = inspectCodexRoleSeparation(policy);
+            if (separation.state === 'BLOCKED')
+                throw Error(separation.reason);
+            if (!Array.isArray(judgeIds) || ![2, 3].includes(judgeIds.length) || new Set(judgeIds).size !== judgeIds.length)
+                throw Error('panel cardinality');
+            const subject = spec.invocations.find(i => i.id === subjectId && i.role === 'subject');
+            if (!subject)
+                throw Error('subject binding');
+            const judges = spec.invocations.filter(i => i.role === 'judge' && i.subjectId === subjectId);
+            if (judgeIds.some((id, k) => judges[k]?.id !== id))
+                throw Error('frozen panel order');
+            for (const i of [subject, ...judges.slice(0, judgeIds.length)])
+                if (!policy.some(p => p.role === i.role && p.model === i.model))
+                    throw Error('exact panel role binding');
+            const rows = store.read().map(e => e.value);
+            if (rows.some(r => r.type === 'abort'))
+                throw Error('aborted owner blocks panel');
+            const output = rows.find(r => r.type === 'observation' && r.id === subjectId);
+            if (!output || output.objective !== 'PASS' || !sourceSettled(rows, subjectId))
+                throw Error('objective gate blocks panel or source unsettled');
+            const votes = judgeIds.map((id, k) => { const r = rows.find(r => r.type === 'observation' && r.id === id); if (!r || !sourceSettled(rows, id))
+                throw Error('panel observation missing or source unsettled'); return parseVote(Buffer.from(String(r.outputBase64), 'base64').toString('utf8'), k + 1); });
+            if (collapseVotePanel(votes.slice(0, 2)).split !== (votes.length === 3))
+                throw Error('tie-break required exactly for clean split');
+            const binding = learningHash({ subjectId, judgeIds, policy }), old = rows.find(r => r.type === 'panel' && r.subjectId === subjectId);
+            if (old && old.binding !== binding)
+                throw Error('panel binding changed');
+            const result = { label: sha(String(first.seed) + subjectId).slice(0, 24), collapse: collapseVotePanel(votes), identityStatus: separation.state, disclosures: separation.disclosures, liveQualified: false, routingDefault: null };
+            if (!old)
+                append({ type: 'panel', subjectId, binding, result });
+            return result;
+        },
+        eligibleOutputs() { const rows = store.read(); return rows.filter(e => sourceSettled(rows.map(r => r.value), e.value.id) && e.value.type === 'observation' && e.value.objective === 'PASS' && spec.invocations.some(i => i.id === e.value.id && i.role === 'subject')).map(e => ({ label: sha(String(first.seed) + String(e.value.id)).slice(0, 24), outputBase64: String(e.value.outputBase64), outputSha256: String(e.value.outputSha256), liveQualified: false })); },
+    };
+    return host;
+}
+//# sourceMappingURL=codex-host-observer.js.map

package/dist/codex-https.d.ts

@@ -0,0 +1,7 @@
+import { type CodexHttpPort } from './codex-subscription.js';
+/** Low-level trusted-host capability. No auth discovery, redirects, fetch/global agents,
+ * proxy support, retries or WebSocket path. The frozen entrypoint owns approval/reservations.
+ * Constructing this port does not connect; only a separately approved entry may call exchange. */
+export declare function createCodexHttpsPort(): CodexHttpPort;
+/** Explicit larger-request profile for producer-review-v1, not a legacy cap override. */
+export declare function createCodexReviewHttpsPort(): CodexHttpPort;

package/dist/codex-https.js

@@ -0,0 +1,221 @@
+import { Agent, request } from 'node:https';
+import { rootCertificates, checkServerIdentity } from 'node:tls';
+import { createHash } from 'node:crypto';
+import { SUBSCRIPTION_ENDPOINT, validateCodexOAuth } from './codex-subscription.js';
+const hash = (b) => createHash('sha256').update(b).digest('hex');
+const ERROR_CODES = new Set(['ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'ENETUNREACH', 'EHOSTUNREACH', 'EACCES', 'EPERM', 'ERR_TLS_CERT_ALTNAME_INVALID', 'CERT_HAS_EXPIRED', 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'SELF_SIGNED_CERT_IN_CHAIN', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'ERR_SSL_WRONG_VERSION_NUMBER']);
+function errorCode(error) {
+    // No messages, getters, arbitrary codes or implicit string conversion in diagnostics.
+    try {
+        const code = error && Object.getOwnPropertyDescriptor(error, 'code')?.value;
+        return typeof code === 'string' && ERROR_CODES.has(code) ? code : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+const REFUSAL_TYPES = new Set(['invalid_request_error', 'authentication_error', 'permission_error', 'rate_limit_error', 'server_error']);
+const REFUSAL_CODES = new Set(['invalid_json', 'invalid_request', 'invalid_parameter', 'unknown_parameter', 'unsupported_parameter', 'unsupported_value', 'missing_required_parameter', 'model_not_found', 'invalid_api_key', 'insufficient_quota', 'rate_limit_exceeded']);
+const REFUSAL_PARAMETERS = new Set(['model', 'input', 'instructions', 'reasoning', 'reasoning.effort', 'reasoning.summary', 'text', 'text.verbosity', 'tools', 'tool_choice', 'parallel_tool_calls', 'store', 'stream', 'max_output_tokens', 'temperature', 'top_p', 'include', 'service_tier', 'prompt_cache_key', 'previous_response_id', 'background']);
+// Diagnostic prose is untrusted data, never a dispatch/retry instruction. A vocabulary
+// allowlist redacts unfamiliar tokens rather than retaining opaque identities.
+const DIAGNOSTIC_WORDS = new Set(('a an the this that is are was be not no only for with without and or to of in on at as by from must cannot can could does do has have failed failure error request response body json field parameter value model unsupported supported support invalid unknown missing required expected found available unavailable permitted allowed valid format type string object array parse parsing deserialize into target provide provided please input instructions reasoning effort low medium high minimal none verbosity authentication authorization permission denied unauthorized forbidden access expired quota exceeded rate limit too many requests service temporarily internal server detail message redacted').split(' '));
+function explanation(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 1024 || /[^\x20-\x7e]/.test(value))
+        return null;
+    const text = value.replace(/\bBearer\s+[^\s,;]+/gi, '[redacted]')
+        .replace(/\b[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, '[redacted]')
+        .replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, '[redacted]')
+        .replace(/\b[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}\b/gi, '[redacted]')
+        .replace(/\b(?:account(?:[_ -]?id)?|user[_ -]?id|email|authorization|api[_ -]?key|token)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi, '[redacted]')
+        .replace(/\b(?:sk-[A-Za-z0-9_-]+|gpt-[A-Za-z0-9.-]+)\b/g, '[redacted]').trim();
+    if (/[^A-Za-z0-9 _.,:;!?()\[\]'"`\/-]/.test(text))
+        return null;
+    const words = text.match(/[A-Za-z0-9_]+(?:[.-][A-Za-z0-9_]+)*/g) ?? [];
+    const known = (w) => DIAGNOSTIC_WORDS.has(w.toLowerCase()) || REFUSAL_PARAMETERS.has(w) || REFUSAL_TYPES.has(w) || REFUSAL_CODES.has(w);
+    if (!words.some(w => w.toLowerCase() !== 'redacted' && known(w)))
+        return null;
+    return text.replace(/[A-Za-z0-9_]+(?:[.-][A-Za-z0-9_]+)*/g, w => known(w) ? w : '[redacted]').slice(0, 256);
+}
+function refusalMetadata(value) {
+    const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+    const root = object(value), envelope = object(root?.error) ? 'error-object' : typeof root?.error === 'string' ? 'error-string' : typeof root?.detail === 'string' ? 'detail-string' : object(root?.detail) ? 'detail-object' : Array.isArray(root?.detail) ? 'detail-list' : typeof root?.message === 'string' ? 'message-string' : 'unknown';
+    let node = root;
+    // Only documented error/detail envelopes, a single validation error, and bounded depth.
+    for (let depth = 0; node && depth < 3; depth++) {
+        const child = node.error ?? node.detail;
+        if (Array.isArray(child)) {
+            node = child.length === 1 ? object(child[0]) : undefined;
+            break;
+        }
+        const next = object(child);
+        if (!next)
+            break;
+        node = next;
+    }
+    const allowed = (v, set) => typeof v === 'string' && set.has(v) ? v : 'unknown';
+    let parameter = allowed(node?.param, REFUSAL_PARAMETERS);
+    if (parameter === 'unknown' && Array.isArray(node?.loc) && node.loc.length >= 2 && node.loc.length <= 4 && node.loc[0] === 'body' && node.loc.slice(1).every(p => typeof p === 'string'))
+        parameter = allowed(node.loc.slice(1).join('.'), REFUSAL_PARAMETERS);
+    return { type: allowed(node?.type, REFUSAL_TYPES), code: allowed(node?.code, REFUSAL_CODES), parameter, envelope, explanation: explanation(node?.message ?? node?.msg ?? node?.detail ?? node?.error) };
+}
+/** Low-level trusted-host capability. No auth discovery, redirects, fetch/global agents,
+ * proxy support, retries or WebSocket path. The frozen entrypoint owns approval/reservations.
+ * Constructing this port does not connect; only a separately approved entry may call exchange. */
+export function createCodexHttpsPort() { return httpsPort(4096, 16384); }
+/** Explicit larger-request profile for producer-review-v1, not a legacy cap override. */
+export function createCodexReviewHttpsPort() { return httpsPort(65536, 262144); }
+function httpsPort(requestLimit, responseLimit) {
+    let inFlight = false;
+    const preflight = () => { if (['HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'http_proxy', 'https_proxy', 'all_proxy', 'NODE_EXTRA_CA_CERTS'].some(k => !!process.env[k]) || process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0')
+        throw Error('unsupported production transport environment'); };
+    return { kind: 'subscription-http', preflight, async exchange(wire, rawCredential, signal, record, limits) {
+            preflight();
+            if (![limits.requestBytes, limits.responseBytes, limits.callMs].every(n => Number.isSafeInteger(n) && n > 0) || !Buffer.isBuffer(wire.body) || inFlight || wire.destination !== SUBSCRIPTION_ENDPOINT || wire.method !== 'POST' || !['zstd', null].includes(wire.encoding) || wire.body.length > limits.requestBytes || limits.requestBytes > requestLimit || limits.responseBytes > responseLimit || limits.callMs > 30000)
+                throw Error('subscription-http-refused');
+            const credential = validateCodexOAuth(rawCredential, rawCredential.accountId, 'subscription-live');
+            signal.throwIfAborted();
+            const body = Buffer.from(wire.body);
+            inFlight = true;
+            const agent = new Agent({ keepAlive: false, maxSockets: 1, maxCachedSessions: 0 });
+            try {
+                return await new Promise((resolve, reject) => {
+                    let settled = false, written = false, req, timer;
+                    const finish = (error, response) => { if (settled)
+                        return; settled = true; clearTimeout(timer); signal.removeEventListener('abort', abort); agent.destroy(); inFlight = false; if (error)
+                        reject(Error('subscription-http-failed'));
+                    else
+                        resolve(response); };
+                    let phase = 'request';
+                    const fail = (error) => { if (settled)
+                        return; try {
+                        record({ type: 'http-request-failed', classification: signal.aborted ? 'aborted' : 'transport-failure', phase, errorCode: errorCode(error) });
+                    }
+                    catch {
+                        finish(Error('record failed'));
+                        return;
+                    } finish(Error('request failed')); };
+                    const refuse = (reason) => { if (settled)
+                        return; try {
+                        record({ type: 'http-request-failed', classification: 'response-refused', phase: 'response', reason });
+                    }
+                    catch {
+                        finish(Error('record failed'));
+                        return;
+                    } finish(Error('response refused')); };
+                    const abort = () => { req?.destroy(); finish(Error('aborted')); };
+                    // All routing and TLS fields are fixed here, not taken from SDK headers or caller options.
+                    try {
+                        req = request({ protocol: 'https:', hostname: 'chatgpt.com', port: 443, path: '/backend-api/codex/responses', method: 'POST', agent, servername: 'chatgpt.com', rejectUnauthorized: true, checkServerIdentity, ca: [...rootCertificates], minVersion: 'TLSv1.2', headers: { authorization: `Bearer ${credential.access}`, 'chatgpt-account-id': credential.accountId, originator: 'pi', 'user-agent': 'skill-harness-codex-host', 'openai-beta': 'responses=experimental', accept: 'text/event-stream', 'accept-encoding': 'identity', 'content-type': 'application/json', 'content-length': body.length, ...(wire.encoding ? { 'content-encoding': wire.encoding } : {}) } }, res => {
+                            // Node's internal end listener can detach res.socket before our end listener.
+                            // Retain the original socket, not a later nullable/replaced IncomingMessage reference.
+                            const socket = res.socket, tlsAuthorized = socket?.authorized === true;
+                            phase = 'response';
+                            const chunks = [];
+                            let bytes = 0;
+                            try {
+                                record({ type: 'http-response-observed', phase: 'headers', status: res.statusCode ?? 0, providerInternalFacts: null });
+                            }
+                            catch {
+                                req?.destroy();
+                                finish(Error('record failed'));
+                                return;
+                            }
+                            res.on('error', fail);
+                            res.on('aborted', () => refuse('response-aborted'));
+                            res.on('close', () => { if (!settled)
+                                refuse('response-closed'); });
+                            res.on('data', (chunk) => { if (settled)
+                                return; bytes += chunk.length; if (bytes > limits.responseBytes) {
+                                refuse('response-byte-limit');
+                                return;
+                            } chunks.push(Buffer.from(chunk)); });
+                            res.on('end', () => {
+                                if (settled)
+                                    return;
+                                try {
+                                    if (!written) {
+                                        refuse('write-incomplete');
+                                        return;
+                                    }
+                                    if (!tlsAuthorized || socket?.authorized !== true) {
+                                        refuse('tls-unverified');
+                                        return;
+                                    }
+                                    if (res.complete !== true || res.aborted) {
+                                        refuse('message-incomplete');
+                                        return;
+                                    }
+                                    if (res.headers['content-encoding'] && res.headers['content-encoding'] !== 'identity') {
+                                        refuse('response-encoding');
+                                        return;
+                                    }
+                                    const raw = Buffer.concat(chunks), status = res.statusCode ?? 0;
+                                    // Inspect reflections before ANY body digest or structured refusal is recorded, at all statuses.
+                                    let parsed;
+                                    try {
+                                        parsed = JSON.parse(raw.toString('utf8'));
+                                    }
+                                    catch { /* Non-JSON refusal fields remain unknown; no parser error text is retained. */ }
+                                    const decoded = parsed === undefined ? '' : JSON.stringify(parsed);
+                                    if ([credential.access, credential.accountId].some(value => raw.includes(Buffer.from(value)) || decoded.includes(value))) {
+                                        refuse('credential-reflection');
+                                        return;
+                                    }
+                                    if (status >= 300 && status < 400) {
+                                        refuse('redirect');
+                                        return;
+                                    }
+                                    const response = status === 200 ? new Response(raw, { status, headers: { 'content-type': String(res.headers['content-type'] ?? '') } }) : new Response(JSON.stringify({ error: { message: 'subscription request refused' } }), { status: status >= 400 && status <= 599 ? status : 502, headers: { 'content-type': 'application/json' } });
+                                    record({ type: 'http-response-observed', status, bodyBytes: raw.length, bodySha256: hash(raw), tlsAuthorized: true, complete: true, serverName: 'chatgpt.com', providerInternalFacts: null, ...(status !== 200 ? { refusal: refusalMetadata(parsed) } : {}) });
+                                    finish(undefined, response);
+                                }
+                                catch {
+                                    refuse('internal-completion');
+                                }
+                            });
+                        });
+                    }
+                    catch (error) {
+                        fail(error);
+                        return;
+                    }
+                    if (settled) {
+                        req.destroy();
+                        return;
+                    }
+                    // Last entered phase, not a claim that DNS/connect/TLS caused the error.
+                    req.once('socket', socket => { if (settled)
+                        return; phase = 'lookup'; socket.once('lookup', error => { if (!settled && !error)
+                        phase = 'connect'; }); socket.once('connect', () => { if (!settled)
+                        phase = 'tls'; }); socket.once('secureConnect', () => { if (!settled)
+                        phase = 'write'; }); });
+                    timer = setTimeout(() => { req?.destroy(); finish(Error('deadline')); }, limits.callMs);
+                    req.once('error', fail);
+                    req.once('finish', () => { if (settled)
+                        return; try {
+                        record({ type: 'http-request-started', requestBytes: body.length, wireSha256: hash(body), meaning: 'host write finish, not provider receipt' });
+                        written = true;
+                    }
+                    catch {
+                        req?.destroy();
+                        finish(Error('record failed'));
+                    } });
+                    signal.addEventListener('abort', abort, { once: true });
+                    if (signal.aborted) {
+                        abort();
+                        return;
+                    }
+                    req.end(body);
+                });
+            }
+            catch {
+                throw Error('subscription-http-failed');
+            }
+            finally {
+                inFlight = false;
+                agent.destroy();
+            }
+        } };
+}
+//# sourceMappingURL=codex-https.js.map

package/dist/codex-model-profile.d.ts

@@ -0,0 +1,38 @@
+/** Separate from linux-bwrap-digest-v1: this proves only a fixed IPC probe workload.
+ * It MUST NOT be used to run arbitrary model/extension code. A model-bearing profile
+ * additionally needs aggregate host/descendant memory/CPU/egress limits and token
+ * semantics; these are deliberately reported unqualified rather than bypassed. */
+export declare const CODEX_LOCAL_PROFILE: Readonly<{
+    id: "linux-bwrap-codex-ipc-probe-v1";
+    network: "unshared-no-egress";
+    credentials: "none";
+    cpuSeconds: 2;
+    nofile: 64;
+    heapMiB: 32;
+    wallMs: 3000;
+    outputBytes: 4096;
+    arbitraryCode: false;
+    modelExecutionQualified: false;
+}>;
+export declare function probeLocalCodexProfile(id: string): Promise<{
+    profile: Readonly<{
+        id: "linux-bwrap-codex-ipc-probe-v1";
+        network: "unshared-no-egress";
+        credentials: "none";
+        cpuSeconds: 2;
+        nofile: 64;
+        heapMiB: 32;
+        wallMs: 3000;
+        outputBytes: 4096;
+        arbitraryCode: false;
+        modelExecutionQualified: false;
+    }>;
+    fingerprints: Record<string, string>;
+    modelExecutionQualified: false;
+    remaining: string[];
+    frame: string;
+    netNamespace: string;
+    envKeys: string[];
+    pwd: string;
+    rootReadOnly: boolean;
+}>;