@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/backend/codex.d.ts

@@ -36,18 +36,8 @@ export declare const CODEX_RESUME_ATTEMPT_FILE = "codex-resume-attempt.json";
 export declare const CODEX_RESUME_FAILED_FILE = "codex-resume-failed.json";
 /** Above this, a resumed rollout carries a note that codex may compact it first. */
 export declare const CODEX_RESUME_LARGE_BYTES: number;
-/** Pane-only detectors: construction performs no provider, config or session discovery. */
-export declare class CodexPaneDetectors {
-    private readonly paneDetectorContext?;
-    constructor(paneDetectorContext?: {
-        statusLineItems(): readonly string[] | null;
-        launchMayResume(): boolean;
-        windowsConpty?: boolean;
-        contextlessResume?: boolean;
-    } | undefined);
-    protected readConfiguredStatusLineItems(): string[] | null;
-    protected trustPaneFields(pane: string): Record<string, unknown>;
-    protected trustHoldReason(pane: string): Record<string, unknown>;
+export declare class CodexBackend implements CliBackend {
+    private instanceDir;
     /**
      * #1510: the reply-completion guard covers codex, its turn end read from the rollout (task_complete /
      * turn_aborted, recorded on 0.162.0 in tests/fixtures/reply-guard-1510): the pane alone stays busy through a tool
@@ -56,10 +46,52 @@ export declare class CodexPaneDetectors {
     readonly replyCompletionGuard = true;
     readonly turnEndFromTranscript = true;
     readonly binaryName = "codex";
-    protected configuredStatusLineItems: string[] | null | undefined;
-    protected configuredStatusLinePattern: RegExp | null | undefined;
+    private binaryPath;
+    private readonly sharedCodexHome;
+    private readonly isolatedCodexHome;
+    /** Which subscription this instance runs on, or null for the shared login. */
+    private credentialProfile;
+    /** Set only after preTrust wrote and read back this instance's private config. */
+    private authorizedTrust;
+    private configuredStatusLineItems;
+    private configuredStatusLinePattern;
+    /** Set by buildCommand when the resume plan fell back; read once by the daemon. */
+    private launchWarning;
     /** Whether the last buildCommand launched a resume (`resume <id>` or `--last`). */
-    protected lastLaunchResumes: boolean;
+    private lastLaunchResumes;
+    private quotaReplay;
+    quotaReplayHistory(): ReturnType<typeof snapshotCodexQuotaHistory>;
+    /** Set by writeConfig when the status_line could not be made verifiable (#931). */
+    private statusLineWarning;
+    /** #2357: set by buildCommand when the codex being launched lacks a package companion (codex-code-mode-host). */
+    private packageWarning;
+    constructor(instanceDir: string);
+    /**
+     * Compute and (on first call for an existing instance) migrate to a SHORT
+     * persistent CODEX_HOME under `~/.agend/cx/<8-char-hash>/`.
+     *
+     * Background (#953): codex 0.157.0 added `app-server-control.sock` under
+     * CODEX_HOME. For instances with long `-t<topic_id>` suffixes the full path
+     * exceeds the Unix socket SUN_LEN (~107 chars). codex canonicalises the path
+     * before binding the socket, so a symlink workaround does not help — the real
+     * path must be short.
+     *
+     * Migration steps (each is idempotent; half-completed states self-heal):
+     *  1. If shortHome does not exist AND legacyHome is a real directory (not a
+     *     symlink) → atomic renameSync. On EXDEV or any other error, fall back
+     *     safely: keep using the legacy long path (instance can still start, just
+     *     without the short-path fix).
+     *  2. If shortHome exists but legacyHome is missing → recreate the backward-
+     *     compat symlink (self-heal for rename-succeeded-but-symlink-failed crash).
+     *  3. If both shortHome and legacyHome (as symlink) exist → nothing to do.
+     *  4. New instance (no legacyHome) → create shortHome directly.
+     *
+     * Fail-safe guarantee: migration failure must never make the instance worse.
+     * The caller always receives a valid path it can use as CODEX_HOME.
+     */
+    /** Exposed for fleet-manager to delete the short home on instance removal. */
+    static shortHomeFor(instanceDir: string): string;
+    private static resolveShortHome;
     supportsQueuedInput(): boolean;
     /**
      * Codex's input row, from live captures on codex-cli 0.153.4: `› Ask Codex to
@@ -80,20 +112,6 @@ export declare class CodexPaneDetectors {
     getBottomReadyPattern(): RegExp | null;
     /** Observed on real Codex 0.156.0: the live input row precedes its footer. */
     isDeliveryInputReadyPane(pane: string): boolean;
-    /**
-     * Complete ownership of a long pasted envelope: the `›` composer row and every wrapped row down to a context footer are
-     * proven by ownedComposerRow, however many rows they take. The Enter gate accepts this as well as isDeliveryInputReadyPane,
-     * never instead of the dialog, busy and expected-seq checks.
-     */
-    ownsComposerRows(pane: string): boolean;
-    private nativeContextlessPattern;
-    private nativeContextlessEmpty;
-    private nativeContextlessRows;
-    /**
-     * The screen above Codex's footer, shared by both readers: null when the footer is not a Codex footer at all or the
-     * app server behind the composer is gone (#1099). `rows` excludes the footer.
-     */
-    private composerFrame;
     /**
      * Live status chrome that must veto the broad prompt/context ready match.
      *
@@ -122,116 +140,6 @@ export declare class CodexPaneDetectors {
      * no-Context status line must satisfy the same exact prompt/footer shape.
      */
     isPeriodicRedrawIdlePane(pane: string): boolean;
-    getReadyPattern(): RegExp;
-    protected configuredStatusLineFooterPattern(): RegExp | null;
-    private isConfiguredStatusLineFooter;
-    protected configuredHasContextItem(): boolean;
-    /**
-     * #978: a Context item in ANY position, accepted only as part of a footer
-     * whose every segment matches the configured status_line items. Codex keeps
-     * the user's order (`gpt-5.6-sol medium · Context 46% left · ~/x`); an
-     * arbitrary indented transcript line that happens to contain the item does
-     * not match that grammar. A stale config fails closed, and the daemon's
-     * stable-composer escape hatch then keeps the instance from latching.
-     */
-    private isConfiguredContextFooter;
-    /** Any footer that proves the Context meter owns the bottom row. */
-    private isAnyContextFooter;
-    /**
-     * #978 escape hatch: the live, EMPTY Codex composer within the last few
-     * non-blank rows, no busy marker, and none of the known selection screens.
-     * Deliberately says nothing about the footer, which is what is unknown.
-     */
-    isStableUnknownLayoutIdlePane(pane: string): boolean;
-    private isCodexIdleFooter;
-    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
-    isProxyReplyChromeLine(line: string): boolean;
-    getErrorPatterns(): ErrorPattern[];
-    getStartupDialogs(): StartupDialog[];
-    /**
-     * #984: session-selection screens only a human may answer. Held (never
-     * keyed) so the delivery gate keeps messages queued and dialog_parked tells
-     * the operator; listed before the generic selection hold for a clear notice.
-     */
-    private sessionHoldDialogs;
-    /**
-     * The user's decision (hmsg-53600a2c): codex's folder-trust prompt in an AgEnD session is always answered Trust — the
-     * workspace is the agent's own, whatever preTrust covered (preTrust stays, so the prompt rarely shows at all). Enter,
-     * only with the cursor on "Trust and continue" among the known options (trustCursor); any other layout or row is
-     * held (trustHoldDialog). It trusts the folder only: per-action approvals are separate dialogs and are not touched.
-     */
-    private autoTrustDialog;
-    private trustHoldDialog;
-    /**
-     * #1008: the rate-limit model-switch picker parked unattended instances (it
-     * waits forever and its default option changes the model). Prevention is
-     * `notice.hide_rate_limit_model_nudge` (hideRateLimitModelNudge — real and
-     * effective on 0.157.1 and 0.159.2, verified live); this is the answer for a
-     * picker that appears anyway (config not applied, a CLI that moved the key).
-     *
-     * Escape, not a navigated Enter: it selects nothing, so it can never take
-     * option 1 (switch model) or option 3 (writes "never show again" into the
-     * config). Deliberately not one-shot: if the picker swallowed the key it is
-     * simply sent again on the next poll, and a repeated Escape is harmless.
-     */
-    private rateSwitchPickerDialog;
-    private updatePickerDialog;
-    private usageLimitLunaReserveDialog;
-    private workspaceLimitPromptDialog;
-    private unknownSelectionHoldDialog;
-    getRuntimeDialogs(): RuntimeDialog[];
-    getInputUnavailableTransients(): InputUnavailableTransient[];
-    /** Only a resume paints "Resuming session…"; a fresh launch never does. */
-    launchMayShowInputTransient(): boolean;
-    getQuitCommand(): string;
-    getCompactCommand(): string;
-    getClearCommand(): string;
-    getCancelKey(): string;
-}
-export declare class CodexBackend extends CodexPaneDetectors implements CliBackend {
-    private instanceDir;
-    private binaryPath;
-    private readonly sharedCodexHome;
-    private readonly isolatedCodexHome;
-    /** Which subscription this instance runs on, or null for the shared login. */
-    private credentialProfile;
-    /** Set only after preTrust wrote and read back this instance's private config. */
-    private authorizedTrust;
-    /** Set by buildCommand when the resume plan fell back; read once by the daemon. */
-    private launchWarning;
-    private quotaReplay;
-    quotaReplayHistory(): ReturnType<typeof snapshotCodexQuotaHistory>;
-    /** Set by writeConfig when the status_line could not be made verifiable (#931). */
-    private statusLineWarning;
-    /** #2357: set by buildCommand when the codex being launched lacks a package companion (codex-code-mode-host). */
-    private packageWarning;
-    constructor(instanceDir: string);
-    /**
-     * Compute and (on first call for an existing instance) migrate to a SHORT
-     * persistent CODEX_HOME under `~/.agend/cx/<8-char-hash>/`.
-     *
-     * Background (#953): codex 0.157.0 added `app-server-control.sock` under
-     * CODEX_HOME. For instances with long `-t<topic_id>` suffixes the full path
-     * exceeds the Unix socket SUN_LEN (~107 chars). codex canonicalises the path
-     * before binding the socket, so a symlink workaround does not help — the real
-     * path must be short.
-     *
-     * Migration steps (each is idempotent; half-completed states self-heal):
-     *  1. If shortHome does not exist AND legacyHome is a real directory (not a
-     *     symlink) → atomic renameSync. On EXDEV or any other error, fall back
-     *     safely: keep using the legacy long path (instance can still start, just
-     *     without the short-path fix).
-     *  2. If shortHome exists but legacyHome is missing → recreate the backward-
-     *     compat symlink (self-heal for rename-succeeded-but-symlink-failed crash).
-     *  3. If both shortHome and legacyHome (as symlink) exist → nothing to do.
-     *  4. New instance (no legacyHome) → create shortHome directly.
-     *
-     * Fail-safe guarantee: migration failure must never make the instance worse.
-     * The caller always receives a valid path it can use as CODEX_HOME.
-     */
-    /** Exposed for fleet-manager to delete the short home on instance removal. */
-    static shortHomeFor(instanceDir: string): string;
-    private static resolveShortHome;
     /**
      * The row codex paints for input it has taken into its own queue instead of
      * submitting: `↳ <message>` under "Messages to be submitted after next tool
@@ -330,15 +238,74 @@ export declare class CodexBackend extends CodexPaneDetectors implements CliBacke
      * atomic rename prevents readers from observing a truncated config.
      */
     private cleanSharedConfig;
-    protected readConfiguredStatusLineItems(): string[] | null;
+    getReadyPattern(): RegExp;
+    private readConfiguredStatusLineItems;
+    private configuredStatusLineFooterPattern;
+    private isConfiguredStatusLineFooter;
+    private configuredHasContextItem;
+    /**
+     * #978: a Context item in ANY position, accepted only as part of a footer
+     * whose every segment matches the configured status_line items. Codex keeps
+     * the user's order (`gpt-5.6-sol medium · Context 46% left · ~/x`); an
+     * arbitrary indented transcript line that happens to contain the item does
+     * not match that grammar. A stale config fails closed, and the daemon's
+     * stable-composer escape hatch then keeps the instance from latching.
+     */
+    private isConfiguredContextFooter;
+    /** Any footer that proves the Context meter owns the bottom row. */
+    private isAnyContextFooter;
+    /**
+     * #978 escape hatch: the live, EMPTY Codex composer within the last few
+     * non-blank rows, no busy marker, and none of the known selection screens.
+     * Deliberately says nothing about the footer, which is what is unknown.
+     */
+    isStableUnknownLayoutIdlePane(pane: string): boolean;
+    private isCodexIdleFooter;
+    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
+    isProxyReplyChromeLine(line: string): boolean;
+    getErrorPatterns(): ErrorPattern[];
+    getStartupDialogs(): StartupDialog[];
+    /**
+     * #984: session-selection screens only a human may answer. Held (never
+     * keyed) so the delivery gate keeps messages queued and dialog_parked tells
+     * the operator; listed before the generic selection hold for a clear notice.
+     */
+    private sessionHoldDialogs;
+    /**
+     * The user's decision (hmsg-53600a2c): codex's folder-trust prompt in an AgEnD session is always answered Trust — the
+     * workspace is the agent's own, whatever preTrust covered (preTrust stays, so the prompt rarely shows at all). Enter,
+     * only with the cursor on "Trust and continue" among the known options (trustCursor); any other layout or row is
+     * held (trustHoldDialog). It trusts the folder only: per-action approvals are separate dialogs and are not touched.
+     */
+    private autoTrustDialog;
+    private trustHoldDialog;
     /**
      * #2893: why the authorized folder-trust answer did not take this prompt (log only): what the pane shows against what
      * preTrust authorized for this launch, and whether the instance's config trusts the folder codex is asking about. A
      * field case of a held trust prompt then explains itself in daemon.log.
      */
-    protected trustHoldReason(pane: string): Record<string, unknown>;
+    private trustHoldReason;
     /** What an auto-trust answered (log only): the folder and root on the prompt, what preTrust covered, and the config path. */
-    protected trustPaneFields(pane: string): Record<string, unknown>;
+    private trustPaneFields;
+    /**
+     * #1008: the rate-limit model-switch picker parked unattended instances (it
+     * waits forever and its default option changes the model). Prevention is
+     * `notice.hide_rate_limit_model_nudge` (hideRateLimitModelNudge — real and
+     * effective on 0.157.1 and 0.159.2, verified live); this is the answer for a
+     * picker that appears anyway (config not applied, a CLI that moved the key).
+     *
+     * Escape, not a navigated Enter: it selects nothing, so it can never take
+     * option 1 (switch model) or option 3 (writes "never show again" into the
+     * config). Deliberately not one-shot: if the picker swallowed the key it is
+     * simply sent again on the next poll, and a repeated Escape is harmless.
+     */
+    private rateSwitchPickerDialog;
+    private updatePickerDialog;
+    private usageLimitLunaReserveDialog;
+    private workspaceLimitPromptDialog;
+    private unknownSelectionHoldDialog;
+    getRuntimeDialogs(): RuntimeDialog[];
+    getInputUnavailableTransients(): InputUnavailableTransient[];
     getContextUsage(): number | null;
     getSessionId(): string | null;
     /** The launch as the database plans it — and, when it has no conversation for this directory, an auto-resume (M-2266). */
@@ -355,7 +322,13 @@ export declare class CodexBackend extends CodexPaneDetectors implements CliBacke
     private writeResumeAttempt;
     /** Which Codex session this launch resumes (#984). Reads, never writes, Codex state. */
     private planResume;
+    /** Only a resume paints "Resuming session…"; a fresh launch never does. */
+    launchMayShowInputTransient(): boolean;
     consumeLaunchWarning(): string | null;
+    getQuitCommand(): string;
+    getCompactCommand(): string;
+    getClearCommand(): string;
+    getCancelKey(): string;
     getEffortStrategy(): "runtime" | "restart" | "unsupported";
     /**
      * Effort levels are PER MODEL in Codex, published in the same models_cache