@tangle-network/agent-runtime 0.94.1 → 0.94.2

package/dist/{chunk-PJNGPWTA.js → chunk-JFAGXZKR.js}

@@ -1,10 +1,22 @@
 // src/mcp/local-harness.ts
 import { spawn } from "child_process";
-import { createHash } from "crypto";
-import { constants } from "fs";
-import { access, chmod, mkdtemp, rm, symlink, writeFile } from "fs/promises";
+import { createHash, randomUUID } from "crypto";
+import { constants, createReadStream } from "fs";
+import {
+  access,
+  chmod,
+  copyFile,
+  mkdir,
+  mkdtemp,
+  open,
+  readFile,
+  realpath,
+  rm,
+  symlink,
+  writeFile
+} from "fs/promises";
 import { homedir, tmpdir } from "os";
-import { basename, join } from "path";
+import { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from "path";
 var codexReasoningEffort = {
   none: "none",
   minimal: "minimal",
@@ -117,6 +129,7 @@ function harnessInvocation(harness, profile, taskPrompt, options = {}) {
   return { command: invocation.command, args };
 }
 var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+var processKillGraceMs = 250;
 async function runLocalHarness(options) {
   const { harness, cwd, taskPrompt } = options;
   if (options.codexReproducible && harness !== "codex") {
@@ -125,6 +138,9 @@ async function runLocalHarness(options) {
   if (options.codexReproducible && process.platform !== "linux") {
     throw new Error("runLocalHarness: codexReproducible currently requires Linux");
   }
+  if (options.codexReadDeniedPaths !== void 0 && !options.codexReproducible) {
+    throw new Error("runLocalHarness: codexReadDeniedPaths requires codexReproducible");
+  }
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const spawnImpl = options.spawn ?? spawn;
   const invocation = HARNESS_INVOCATIONS[harness];
@@ -132,19 +148,34 @@ async function runLocalHarness(options) {
     throw new Error(`runLocalHarness: unknown harness ${String(harness)}`);
   }
   const startedAt = Date.now();
-  const command = options.invocation?.command ?? invocation.command;
+  const requestedCommand = options.invocation?.command ?? invocation.command;
   const args = options.invocation ? [...options.invocation.args] : buildHarnessArgs(harness, taskPrompt, options);
-  if (options.codexReproducible) assertCodexReproducibleInvocation(command, args);
+  if (options.codexReproducible) assertCodexReproducibleInvocation(requestedCommand, args);
   const baseEnv = options.env ?? process.env;
-  const isolated = options.codexReproducible ? await isolateCodexHome(baseEnv, cwd) : {
+  const isolated = options.codexReproducible ? await isolateCodexHome({
+    baseEnv,
+    cwd,
+    command: requestedCommand,
+    readDeniedPaths: options.codexReadDeniedPaths ?? [],
+    resolveExecutable: options.resolveCodexExecutable ?? resolveCodexNativeExecutable
+  }) : {
     env: baseEnv,
+    command: requestedCommand,
     cleanup: async () => void 0,
     controlledConfigSha256: "",
+    executableSha256: "",
+    readDeniedPathsSha256: "",
+    readDeniedPathCount: 0,
+    readDeniedPaths: [],
     ambientAuth: "",
     isolatedAuth: "",
-    writeProbe: ""
+    writeProbe: "",
+    stagedWriteProbe: "",
+    deniedProbePaths: []
   };
   const env = isolated.env;
+  const command = isolated.command;
+  if (options.codexReproducible) assertCodexReproducibleInvocation(command, args);
   try {
     const evidence = options.codexReproducible ? await collectCodexExecutionEvidence({
       command,
@@ -153,15 +184,26 @@ async function runLocalHarness(options) {
       env,
       spawn: spawnImpl,
       controlledConfigSha256: isolated.controlledConfigSha256,
+      executableSha256: isolated.executableSha256,
+      readDeniedPathsSha256: isolated.readDeniedPathsSha256,
+      readDeniedPathCount: isolated.readDeniedPathCount,
+      readDeniedPaths: isolated.readDeniedPaths,
       ambientAuth: isolated.ambientAuth,
       isolatedAuth: isolated.isolatedAuth,
       writeProbe: isolated.writeProbe,
+      stagedWriteProbe: isolated.stagedWriteProbe,
+      deniedProbePaths: isolated.deniedProbePaths,
       ...options.signal ? { signal: options.signal } : {}
     }) : void 0;
-    return await new Promise((resolve, reject) => {
+    return await new Promise((resolve2, reject) => {
       let child;
       try {
-        child = spawnImpl(command, args, { cwd, env, stdio: "pipe" });
+        child = spawnImpl(command, args, {
+          cwd,
+          env,
+          stdio: "pipe",
+          detached: process.platform !== "win32"
+        });
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
         return;
@@ -171,16 +213,25 @@ async function runLocalHarness(options) {
       let stderr = "";
       let timedOut = false;
       let settled = false;
+      let forceKillTimer = null;
+      let terminationStarted = false;
+      const terminate = () => {
+        if (terminationStarted) return;
+        terminationStarted = true;
+        signalProcessTree(child, "SIGTERM");
+        forceKillTimer = setTimeout(() => signalProcessTree(child, "SIGKILL"), processKillGraceMs);
+        forceKillTimer.unref?.();
+      };
       const timer = timeoutMs > 0 ? setTimeout(() => {
         timedOut = true;
-        if (!child.killed) child.kill("SIGTERM");
+        terminate();
       }, timeoutMs) : null;
       if (timer && typeof timer.unref === "function") {
         ;
         timer.unref();
       }
       const onAbort = () => {
-        if (!child.killed) child.kill("SIGTERM");
+        terminate();
       };
       if (options.signal) {
         if (options.signal.aborted) onAbort();
@@ -196,13 +247,15 @@ async function runLocalHarness(options) {
         if (settled) return;
         settled = true;
         if (timer) clearTimeout(timer);
+        if (forceKillTimer) clearTimeout(forceKillTimer);
         options.signal?.removeEventListener("abort", onAbort);
-        resolve(result);
+        resolve2(result);
       };
       child.on("error", (err) => {
         if (settled) return;
         settled = true;
         if (timer) clearTimeout(timer);
+        if (forceKillTimer) clearTimeout(forceKillTimer);
         options.signal?.removeEventListener("abort", onAbort);
         reject(err);
       });
@@ -223,6 +276,7 @@ async function runLocalHarness(options) {
           if (settled) return;
           settled = true;
           if (timer) clearTimeout(timer);
+          if (forceKillTimer) clearTimeout(forceKillTimer);
           options.signal?.removeEventListener("abort", onAbort);
           reject(err instanceof Error ? err : new Error(String(err)));
         }
@@ -250,9 +304,14 @@ var CODEX_EXECUTION_POLICY = {
   shellEnvironment: "core-filtered",
   loginShell: false,
   credentialsReadable: false,
+  hostHomeReadable: false,
+  procEnvironment: "private-sanitized",
+  sensitiveEnvironmentNamesVisible: false,
   parentRepoRead: false,
   gitMetadata: false,
   temporaryDirectory: "workspace-private",
+  stagedExecutable: "static-elf-read-only",
+  callerReadDeniedPaths: "enforced",
   containerSockets: false
 };
 var FORBIDDEN_CODEX_PROMPT_MARKERS = [
@@ -284,11 +343,16 @@ async function collectCodexExecutionEvidence(opts) {
   const sandboxProof = [
     hiddenEnvironmentChecks,
     "test -r .",
+    "! test -r .git",
     'touch "$1"',
     'rm "$1"',
-    '! test -r "$2"',
-    '! test -r "$3"',
-    '! test -r "$4"',
+    'staged_dir=$(dirname "$2")',
+    'test -x "$staged_dir/codex"',
+    '! chmod 700 "$staged_dir" 2>/dev/null',
+    '! rm "$staged_dir/codex" 2>/dev/null',
+    '! touch "$2" 2>/dev/null',
+    "shift 2",
+    'for path in "$@"; do ! test -r "$path" || exit 1; done',
     'touch "$TMPDIR/.agent-runtime-tmp-proof"',
     'rm "$TMPDIR/.agent-runtime-tmp-proof"'
   ].join(" && ");
@@ -303,9 +367,24 @@ async function collectCodexExecutionEvidence(opts) {
     sandboxProof,
     "sh",
     opts.writeProbe,
-    opts.ambientAuth,
-    opts.isolatedAuth,
-    join(homedir(), "code")
+    opts.stagedWriteProbe,
+    ...opts.deniedProbePaths
+  ]);
+  await runCodexProbe(opts, [
+    "sandbox",
+    "-P",
+    CODEX_PERMISSION_PROFILE,
+    "-C",
+    opts.cwd,
+    "python3",
+    "-c",
+    `import os,re
+pattern=re.compile(br'(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL|AUTH|COOKIE|CODEX_HOME)', re.I)
+paths=('/proc/1/environ', '/proc/self/environ', f'/proc/{os.getppid()}/environ')
+for path in dict.fromkeys(paths):
+ data=open(path,'rb').read().split(b'\\0')
+ names=(item.split(b'=',1)[0] for item in data if b'=' in item)
+ assert not any(pattern.search(name) for name in names), path`
   ]);
   await runCodexProbe(opts, [
     "sandbox",
@@ -344,14 +423,18 @@ async function collectCodexExecutionEvidence(opts) {
     }
   }
   const nonPromptArgs = [
-    opts.command,
+    "codex",
     ...opts.args.map((arg, index) => index === 1 ? "<PROMPT>" : arg)
   ];
   return {
     cliVersion,
+    executableSha256: opts.executableSha256,
     effectivePromptSha256: sha256(renderedPrompt),
     nonPromptArgsSha256: sha256(JSON.stringify(nonPromptArgs)),
     controlledConfigSha256: opts.controlledConfigSha256,
+    readDeniedPathsSha256: opts.readDeniedPathsSha256,
+    readDeniedPathCount: opts.readDeniedPathCount,
+    readDeniedPaths: [...opts.readDeniedPaths],
     policy: { ...CODEX_EXECUTION_POLICY }
   };
 }
@@ -395,10 +478,15 @@ function codexPromptDebugArgs(execArgs, prompt) {
   return debugArgs;
 }
 function runCodexProbe(opts, args) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let child;
     try {
-      child = opts.spawn(opts.command, args, { cwd: opts.cwd, env: opts.env, stdio: "pipe" });
+      child = opts.spawn(opts.command, args, {
+        cwd: opts.cwd,
+        env: opts.env,
+        stdio: "pipe",
+        detached: process.platform !== "win32"
+      });
     } catch (err) {
       reject(err instanceof Error ? err : new Error(String(err)));
       return;
@@ -407,12 +495,19 @@ function runCodexProbe(opts, args) {
     let stdout = "";
     let stderr = "";
     let settled = false;
+    let forceKillTimer = null;
     const timer = setTimeout(() => {
-      if (!child.killed) child.kill("SIGTERM");
+      signalProcessTree(child, "SIGTERM");
+      forceKillTimer = setTimeout(() => signalProcessTree(child, "SIGKILL"), processKillGraceMs);
+      forceKillTimer.unref?.();
     }, 1e4);
     timer.unref?.();
     const onAbort = () => {
-      if (!child.killed) child.kill("SIGTERM");
+      signalProcessTree(child, "SIGTERM");
+      if (!forceKillTimer) {
+        forceKillTimer = setTimeout(() => signalProcessTree(child, "SIGKILL"), processKillGraceMs);
+        forceKillTimer.unref?.();
+      }
     };
     if (opts.signal) {
       if (opts.signal.aborted) onAbort();
@@ -428,6 +523,7 @@ function runCodexProbe(opts, args) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
+      if (forceKillTimer) clearTimeout(forceKillTimer);
       opts.signal?.removeEventListener("abort", onAbort);
       reject(err);
     });
@@ -435,6 +531,7 @@ function runCodexProbe(opts, args) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
+      if (forceKillTimer) clearTimeout(forceKillTimer);
       opts.signal?.removeEventListener("abort", onAbort);
       if (code !== 0) {
         const safeStderr = redactCodexHome(stderr, opts.env.CODEX_HOME);
@@ -445,7 +542,7 @@ function runCodexProbe(opts, args) {
         );
         return;
       }
-      resolve({ stdout, stderr });
+      resolve2({ stdout, stderr });
     });
   });
 }
@@ -472,51 +569,120 @@ function redactJsonText(value, text) {
   return value;
 }
 var CODEX_AUTH_ENV = ["CODEX_ACCESS_TOKEN", "CODEX_API_KEY", "OPENAI_API_KEY"];
+var sensitiveEnvironmentName = /(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL|AUTH|COOKIE)/i;
 var CODEX_PERMISSION_PROFILE = "agent_runtime_reproducible";
-async function isolateCodexHome(baseEnv, cwd) {
+async function isolateCodexHome(opts) {
   const isolatedHome = await mkdtemp(join(tmpdir(), "agent-runtime-codex-"));
   await chmod(isolatedHome, 448);
   let workspaceTemp = "";
-  const writeProbe = join(cwd, ".agent-runtime-sandbox-write-proof");
+  let stagedExecutableDir = "";
+  let ownsStagedExecutableDir = false;
+  let writeProbe = "";
   const cleanup = async () => {
+    if (ownsStagedExecutableDir) {
+      await chmod(stagedExecutableDir, 448).catch(() => void 0);
+    }
     await Promise.all([
-      rm(writeProbe, { force: true }),
+      ...writeProbe ? [rm(writeProbe, { force: true })] : [],
       ...workspaceTemp ? [rm(workspaceTemp, { recursive: true, force: true })] : [],
+      ...ownsStagedExecutableDir ? [rm(stagedExecutableDir, { recursive: true, force: true })] : [],
       rm(isolatedHome, { recursive: true, force: true })
     ]);
   };
   try {
-    workspaceTemp = await mkdtemp(join(cwd, ".agent-runtime-tmp-"));
+    const readDeniedPaths = await normalizeReadDeniedPaths(opts.readDeniedPaths);
+    const candidateRoot = await realpath(opts.cwd);
+    writeProbe = join(candidateRoot, `.agent-runtime-write-proof-${randomUUID()}`);
+    const stagedPath = join(candidateRoot, ".agent-runtime-bin");
+    if (readDeniedPaths.some(
+      (path) => isSameOrDescendant(candidateRoot, path) || isSameOrDescendant(stagedPath, path) || isSameOrDescendant(path, stagedPath)
+    )) {
+      throw new Error(
+        "runLocalHarness: codexReadDeniedPaths cannot contain the candidate root or staged executable"
+      );
+    }
+    const nativeExecutable = await opts.resolveExecutable(opts.command, opts.baseEnv);
+    if (!await isStaticElfExecutable(nativeExecutable)) {
+      throw new Error(
+        "runLocalHarness: reproducible Codex mode requires a statically linked Linux Codex ELF"
+      );
+    }
+    const sourceExecutableSha256 = await sha256File(nativeExecutable);
+    stagedExecutableDir = stagedPath;
+    try {
+      await mkdir(stagedExecutableDir, { mode: 448 });
+      ownsStagedExecutableDir = true;
+    } catch (err) {
+      throw new Error(
+        `runLocalHarness: candidate-private .agent-runtime-bin must not already exist: ${String(err.code ?? err)}`
+      );
+    }
+    const stagedExecutable = join(stagedExecutableDir, "codex");
+    await copyFile(nativeExecutable, stagedExecutable, constants.COPYFILE_FICLONE);
+    await chmod(stagedExecutable, 320);
+    const executableSha256 = await sha256File(stagedExecutable);
+    if (executableSha256 !== sourceExecutableSha256 || !await isStaticElfExecutable(stagedExecutable)) {
+      throw new Error("runLocalHarness: staged Codex executable digest mismatch");
+    }
+    await chmod(stagedExecutableDir, 320);
+    workspaceTemp = await mkdtemp(join(candidateRoot, ".agent-runtime-tmp-"));
     await chmod(workspaceTemp, 448);
-    const ambientHome = baseEnv.CODEX_HOME?.trim() || join(homedir(), ".codex");
+    const ambientHome = resolve(opts.baseEnv.CODEX_HOME?.trim() || join(homedir(), ".codex"));
     const ambientAuth = join(ambientHome, "auth.json");
     const isolatedAuth = join(isolatedHome, "auth.json");
-    let linkedAuth = false;
     try {
       await access(ambientAuth, constants.R_OK);
       await symlink(ambientAuth, isolatedAuth);
-      linkedAuth = true;
     } catch (err) {
-      if (err.code !== "ENOENT") throw err;
-    }
-    if (!linkedAuth && !CODEX_AUTH_ENV.some((name) => Boolean(baseEnv[name]))) {
       throw new Error(
-        "runLocalHarness: reproducible Codex mode requires readable auth.json or an API token environment variable"
+        `runLocalHarness: reproducible Codex mode requires readable auth.json: ${String(err.code ?? err)}`
       );
     }
+    const deniedHostRoots = [homedir(), opts.baseEnv.HOME?.trim(), ambientHome].filter((path) => Boolean(path)).map((path) => resolve(path)).filter((path, index, paths) => paths.indexOf(path) === index);
     const controlledConfig = codexControlledConfig({
-      ambientHome,
-      ambientTmp: baseEnv.TMPDIR?.trim() || tmpdir(),
-      workspaceTemp
+      ambientTmp: opts.baseEnv.TMPDIR?.trim() || tmpdir(),
+      deniedHostRoots,
+      workspaceTemp,
+      stagedExecutableDir,
+      readDeniedPaths
     });
     await writeFile(join(isolatedHome, "config.toml"), controlledConfig, { mode: 384 });
+    const env = { ...opts.baseEnv };
+    for (const name of Object.keys(env)) {
+      if (sensitiveEnvironmentName.test(name) || CODEX_AUTH_ENV.some((authName) => authName === name)) {
+        delete env[name];
+      }
+    }
+    env.CODEX_HOME = isolatedHome;
+    const home = homedir();
+    const deniedProbePaths = [
+      ...deniedHostRoots,
+      ambientAuth,
+      isolatedAuth,
+      join(home, ".claude", ".credentials.json"),
+      join(home, ".claude.json"),
+      join(home, ".local", "share", "opencode", "auth.json"),
+      join(home, ".agents"),
+      join(home, "Documents"),
+      join(home, "Downloads"),
+      join(home, ".npm"),
+      join(home, "code"),
+      ...readDeniedPaths
+    ].filter((path, index, paths) => paths.indexOf(path) === index);
     return {
-      env: { ...baseEnv, CODEX_HOME: isolatedHome },
+      env,
+      command: stagedExecutable,
       cleanup,
       controlledConfigSha256: sha256(controlledConfig),
+      executableSha256,
+      readDeniedPaths,
+      readDeniedPathsSha256: sha256(JSON.stringify(readDeniedPaths)),
+      readDeniedPathCount: readDeniedPaths.length,
       ambientAuth,
       isolatedAuth,
-      writeProbe
+      writeProbe,
+      stagedWriteProbe: join(stagedExecutableDir, "write-proof"),
+      deniedProbePaths
     };
   } catch (err) {
     await cleanup();
@@ -524,30 +690,26 @@ async function isolateCodexHome(baseEnv, cwd) {
   }
 }
 function codexControlledConfig(opts) {
-  const home = homedir();
-  const deniedPaths = [
-    opts.ambientHome,
+  const rules = /* @__PURE__ */ new Map();
+  const broadDeniedPaths = minimalPathRoots([
+    ...opts.deniedHostRoots.map((path) => resolve(path)),
+    tmpdir(),
     opts.ambientTmp,
-    join(home, "code"),
-    join(home, "company"),
-    join(home, ".ssh"),
-    join(home, ".aws"),
-    join(home, ".config"),
-    join(home, ".cache"),
-    join(home, ".docker"),
-    join(home, ".kube"),
-    join(home, ".gnupg"),
-    join(home, ".pki"),
-    join(home, ".npmrc"),
-    join(home, ".netrc"),
-    join(home, ".git-credentials"),
+    "/proc",
     "/run/docker",
-    "/run/containerd",
-    opts.workspaceTemp
-  ];
-  const filesystemRules = deniedPaths.map(
-    (path) => `${JSON.stringify(path)} = ${path === opts.workspaceTemp ? '"write"' : '"deny"'}`
-  ).join("\n");
+    "/run/containerd"
+  ]);
+  for (const path of broadDeniedPaths) {
+    rules.set(path, "deny");
+  }
+  const workspaceRoot = dirname(opts.workspaceTemp);
+  for (const path of opts.readDeniedPaths) {
+    const alreadyDenied = broadDeniedPaths.some((root) => isSameOrDescendant(path, root));
+    if (!alreadyDenied || isSameOrDescendant(path, workspaceRoot)) rules.set(path, "deny");
+  }
+  if (!rules.has(opts.workspaceTemp)) rules.set(opts.workspaceTemp, "write");
+  if (!rules.has(opts.stagedExecutableDir)) rules.set(opts.stagedExecutableDir, "read");
+  const filesystemRules = [...rules].sort(([a], [b]) => a.localeCompare(b)).map(([path, access2]) => `${JSON.stringify(path)} = ${JSON.stringify(access2)}`).join("\n");
   return `default_permissions = "${CODEX_PERMISSION_PROFILE}"
 approval_policy = "never"
 allow_login_shell = false
@@ -559,15 +721,14 @@ ignore_default_excludes = false
 exclude = ["^CODEX_HOME$", "(?i).*TOKEN.*", "(?i).*KEY.*", "(?i).*SECRET.*", "(?i).*PASSWORD.*", "(?i).*CREDENTIAL.*", "(?i).*AUTH.*", "(?i).*COOKIE.*"]
 set = { TMPDIR = ${JSON.stringify(opts.workspaceTemp)} }
 
-[permissions.${CODEX_PERMISSION_PROFILE}]
-extends = ":workspace"
-
 [permissions.${CODEX_PERMISSION_PROFILE}.filesystem]
+":minimal" = "read"
 ${filesystemRules}
 ":slash_tmp" = "deny"
 
 [permissions.${CODEX_PERMISSION_PROFILE}.filesystem.":workspace_roots"]
 "." = "write"
+".git" = "deny"
 
 [permissions.${CODEX_PERMISSION_PROFILE}.network]
 enabled = false
@@ -579,6 +740,161 @@ enabled = false
 "/run/containerd/containerd.sock" = "deny"
 `;
 }
+function isSameOrDescendant(path, root) {
+  const normalizedPath = resolve(path);
+  const normalizedRoot = resolve(root);
+  return normalizedPath === normalizedRoot || normalizedPath.startsWith(`${normalizedRoot}${sep}`);
+}
+function minimalPathRoots(paths) {
+  const ordered = [...new Set(paths.map((path) => resolve(path)))].sort(
+    (a, b) => a.length - b.length || a.localeCompare(b)
+  );
+  return ordered.filter(
+    (path, index) => !ordered.slice(0, index).some((root) => isSameOrDescendant(path, root))
+  );
+}
+async function normalizeReadDeniedPaths(paths) {
+  if (!Array.isArray(paths)) {
+    throw new Error("runLocalHarness: codexReadDeniedPaths must be an array of absolute paths");
+  }
+  const normalized = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    if (typeof path !== "string" || path.length === 0 || path.includes("\0") || !isAbsolute(path)) {
+      throw new Error("runLocalHarness: codexReadDeniedPaths must contain absolute paths");
+    }
+    const absolute = resolve(path);
+    normalized.add(absolute);
+    try {
+      normalized.add(await realpath(absolute));
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  return [...normalized].sort();
+}
+async function resolveCodexNativeExecutable(command, env) {
+  const candidates = command.includes(sep) || isAbsolute(command) ? [resolve(command)] : (env.PATH ?? "").split(delimiter).filter(Boolean).map((entry) => join(entry, command));
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    let resolved;
+    try {
+      await access(candidate, constants.X_OK);
+      resolved = await realpath(candidate);
+    } catch {
+      continue;
+    }
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    if (await isStaticElfExecutable(resolved)) return resolved;
+    const packageRoot = await findCodexPackageRoot(resolved);
+    if (!packageRoot) continue;
+    const bundled = await findBundledCodexExecutable(packageRoot);
+    if (bundled) return bundled;
+  }
+  throw new Error(
+    "runLocalHarness: could not resolve the native Codex executable from the requested command"
+  );
+}
+async function findCodexPackageRoot(file) {
+  let cursor = dirname(file);
+  while (true) {
+    try {
+      const parsed = JSON.parse(await readFile(join(cursor, "package.json"), "utf8"));
+      if (parsed.name === "@openai/codex") return cursor;
+    } catch {
+    }
+    const parent = dirname(cursor);
+    if (parent === cursor) return void 0;
+    cursor = parent;
+  }
+}
+async function findBundledCodexExecutable(packageRoot) {
+  const target = linuxCodexTarget();
+  const candidates = [
+    join(
+      packageRoot,
+      "node_modules",
+      "@openai",
+      target.packageName,
+      "vendor",
+      target.triple,
+      "bin",
+      "codex"
+    ),
+    join(packageRoot, "vendor", target.triple, "bin", "codex")
+  ];
+  for (const executable of candidates) {
+    if (await isStaticElfExecutable(executable)) return executable;
+  }
+  return void 0;
+}
+function linuxCodexTarget() {
+  if (process.platform !== "linux") {
+    throw new Error("runLocalHarness: reproducible Codex mode requires Linux");
+  }
+  if (process.arch === "x64") {
+    return { packageName: "codex-linux-x64", triple: "x86_64-unknown-linux-musl" };
+  }
+  if (process.arch === "arm64") {
+    return { packageName: "codex-linux-arm64", triple: "aarch64-unknown-linux-musl" };
+  }
+  throw new Error(`runLocalHarness: unsupported Linux architecture ${process.arch}`);
+}
+async function isStaticElfExecutable(path) {
+  let handle;
+  try {
+    await access(path, constants.X_OK);
+    handle = await open(path, "r");
+    const header = Buffer.alloc(64);
+    const { bytesRead } = await handle.read(header, 0, header.length, 0);
+    if (bytesRead !== header.length || !header.subarray(0, 4).equals(Buffer.from([127, 69, 76, 70])) || header[4] !== 2 || header[5] !== 1) {
+      return false;
+    }
+    const programHeaderOffset = Number(header.readBigUInt64LE(32));
+    const programHeaderSize = header.readUInt16LE(54);
+    const programHeaderCount = header.readUInt16LE(56);
+    const expectedMachine = process.arch === "x64" ? 62 : process.arch === "arm64" ? 183 : -1;
+    if (![2, 3].includes(header.readUInt16LE(16)) || header.readUInt16LE(18) !== expectedMachine || !Number.isSafeInteger(programHeaderOffset) || programHeaderOffset < 64 || programHeaderSize < 56 || programHeaderSize > 1024 || programHeaderCount === 0 || programHeaderCount > 1024) {
+      return false;
+    }
+    const tableSize = programHeaderSize * programHeaderCount;
+    const table = Buffer.alloc(tableSize);
+    const tableRead = await handle.read(table, 0, tableSize, programHeaderOffset);
+    if (tableRead.bytesRead !== tableSize) return false;
+    for (let index = 0; index < programHeaderCount; index += 1) {
+      const type = table.readUInt32LE(index * programHeaderSize);
+      if (type === 3) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  } finally {
+    await handle?.close();
+  }
+}
+function sha256File(path) {
+  return new Promise((resolveDigest, reject) => {
+    const hash = createHash("sha256");
+    const stream = createReadStream(path);
+    stream.on("error", reject);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("end", () => resolveDigest(hash.digest("hex")));
+  });
+}
+function signalProcessTree(child, signal) {
+  if (process.platform !== "win32" && typeof child.pid === "number") {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch (err) {
+      if (err.code === "ESRCH") return;
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+  }
+}
 function parseCodexTokenUsage(stdout) {
   const completed = [];
   for (const [index, line] of stdout.split(/\r?\n/).entries()) {
@@ -631,4 +947,4 @@ export {
   runLocalHarness,
   parseCodexTokenUsage
 };
-//# sourceMappingURL=chunk-PJNGPWTA.js.map
+//# sourceMappingURL=chunk-JFAGXZKR.js.map