@tangle-network/sdk-provider-codex 0.0.0-stage → 0.4.1

package/dist/index.mjs

@@ -0,0 +1,1782 @@
+import { randomUUID } from "node:crypto";
+import { InteractionKind, ProxySecretBindingSchema, ProxySecretGrantSchema, ProxySecretReceiptSchema, ProxySecretUpdateControlsSchema, ProxySecretsSchema, isProxySecretScopeAttenuation, ownPropertyRecordSchema, proxySecretPresentationsEqual, resolveTangleRouterDefaults } from "@tangle-network/agent-interface";
+import { z } from "zod";
+import { HELD_SPARE_IDLE_MS, createDeferredParser, createHeldSpareRegistry, launchDifferences, resolveRawCapturePath, spawnRpcBridge } from "@tangle-network/sdk-cli-runner";
+import { CODEX_DISABLED_FEATURE_ARGS, CliProviderAdapterBase, InteractionBroker, McpInteractionSupport, NATIVE_SESSION_CONTRACTS, PROMPT_SECTION_SEPARATOR, SEALED_NATIVE_HOME_LAYOUT, assertSealedNativeHome, assertSealedNativeSearchPath, codexDeveloperInstructionArgs, deriveFilePart, forgetSessionScopes, interactionToggleEnabled, isLoopbackEndpoint, isPlainRecord, jsonEventParser, localMcpArgv, localMcpEnv, nativeEffortArgs, partitionImageAttachments, provenStoreBinary, reasoningEvents, recordCliTokenUsage, refuseSecretLaunch, resolveExecutableRealpath, secretMcpScope, secretSessionTurnQueue, servableMcpServer, servableStdioServer, sessionObservedEvents, streamPartBase, textDeltaEvents, toolResultEvents, toolStartEvents, trackFilePart, turnEndReason, untilSettledOrAborted, withTurnInteractions } from "@tangle-network/sdk-provider-cli-base";
+import { existsSync } from "node:fs";
+import path, { join } from "node:path";
+const TURN_KEY_PLACEHOLDER_PREFIX = "tangle-turn-key";
+const MODEL_KEY_PROXY_PATH_PREFIX = "/v1/";
+const LOOPBACK_BASE_URL = /^http:\/\/127\.0\.0\.1:[0-9]+$/;
+function isTurnKeyPlaceholder(value) {
+	return value?.startsWith(`${TURN_KEY_PLACEHOLDER_PREFIX}.`) === true;
+}
+function parseModelKeyProxyBinding(raw) {
+	if (raw === void 0) return void 0;
+	const parsed = JSON.parse(raw);
+	const baseUrl = typeof parsed === "object" && parsed !== null && "baseUrl" in parsed ? parsed.baseUrl : void 0;
+	if (typeof baseUrl !== "string" || !LOOPBACK_BASE_URL.test(baseUrl)) throw new Error("Model key proxy binding is invalid");
+	return {
+		baseUrl,
+		passThrough: typeof parsed === "object" && parsed !== null && "passThrough" in parsed && parsed.passThrough === true
+	};
+}
+const MODEL_KEY_PROXY_HOME_PATH_PREFIX = "/v1h/";
+function modelKeyProxyHomeTag(runtimeHome) {
+	return Buffer.from(runtimeHome.replace(/\/+$/, "")).toString("base64url");
+}
+function proxiedModelUrl(proxyBaseUrl, upstream, options) {
+	const encoded = Buffer.from(upstream).toString("base64url");
+	return options?.runtimeHome ? `${proxyBaseUrl}${MODEL_KEY_PROXY_HOME_PATH_PREFIX}${modelKeyProxyHomeTag(options.runtimeHome)}/${encoded}` : `${proxyBaseUrl}${MODEL_KEY_PROXY_PATH_PREFIX}${encoded}`;
+}
+function baseProxyToken(token) {
+	const i = token.indexOf(".");
+	return i === -1 ? token : token.slice(0, i);
+}
+const MODEL_PROXY_TOKENS = {
+	OPENCODE_MODEL_API_KEY: "proxy-model-token",
+	OPENAI_API_KEY: "proxy-openai-token",
+	ANTHROPIC_API_KEY: "proxy-anthropic-token",
+	OPENROUTER_API_KEY: "proxy-openrouter-token",
+	TANGLE_INFERENCE_KEY: "proxy-openai-token",
+	ZAI_API_KEY: "proxy-zai-token",
+	ZHIPU_API_KEY: "proxy-zai-token"
+};
+const MODEL_PROXY_TOKEN_VALUES = new Set(Object.values(MODEL_PROXY_TOKENS));
+function isManagedModelToken(value) {
+	const key = value?.trim();
+	return !!key && MODEL_PROXY_TOKEN_VALUES.has(baseProxyToken(key));
+}
+function managedModelProxyUrl(input) {
+	if (!isManagedModelToken(input.apiKey) || isTurnKeyPlaceholder(input.apiKey)) return void 0;
+	const binding = parseModelKeyProxyBinding(input.binding);
+	if (binding?.passThrough !== true) return void 0;
+	try {
+		const url = new URL(input.upstream);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+		if (url.username || url.password || url.search || url.hash) return void 0;
+	} catch {
+		return;
+	}
+	const runtimeHome = input.runtimeHome?.trim();
+	return proxiedModelUrl(binding.baseUrl, input.upstream, { ...runtimeHome ? { runtimeHome } : {} });
+}
+new Set([
+	...Object.keys(MODEL_PROXY_TOKENS),
+	"TANGLE_API_KEY",
+	"GITHUB_TOKEN",
+	"GH_TOKEN"
+]);
+/** True for a slot name, which exists at the proxy and never in a box env. */
+function isDeclaredSecretSlotEnvVar(name) {
+	return /^TANGLE_DECLARED_SLOT_\d+$/.test(name);
+}
+//#endregion
+//#region ../runtime-contracts/dist/harness-warm-transport.js
+/** Set only by the Sandbox API after the OpenCode warm-server rollout decision. */
+const AGENT_INTERNAL_OPENCODE_WARM_SERVER_ENV_VAR = "AGENT_INTERNAL_OPENCODE_WARM_SERVER";
+/**
+* Sidecar switch: after a warm claim, start the first session's OpenCode
+* server before that session's first turn. Effective only with
+* AGENT_INTERNAL_OPENCODE_WARM_SERVER=1. Any value other than "1" is off.
+*/
+const AGENT_INTERNAL_OPENCODE_PREWARM_ENV_VAR = "AGENT_INTERNAL_OPENCODE_PREWARM";
+/** Persistent Kimi wire process and shared create/resume prewarm gates. */
+const AGENT_INTERNAL_KIMI_WARM_SERVER_ENV_VAR = "AGENT_INTERNAL_KIMI_WARM_SERVER";
+const AGENT_INTERNAL_KIMI_PREWARM_ENV_VAR = "AGENT_INTERNAL_KIMI_PREWARM";
+/**
+* Claude Code and Codex run one process per turn. A harness's warm switch
+* sends its managed-token turns' model requests through the sidecar's key
+* proxy (which reports each turn's first model request) and lets a process
+* started ahead of the turn take the turn: Claude Code launches a managed turn
+* with its prompt on stdin (stream-json); Codex already reads its prompt from
+* stdin. Its prewarm switch starts that process at claim, boot and recover.
+* Both default off; off, every turn calls its upstream directly.
+*/
+const AGENT_INTERNAL_CLAUDE_CODE_WARM_SERVER_ENV_VAR = "AGENT_INTERNAL_CLAUDE_CODE_WARM_SERVER";
+const AGENT_INTERNAL_CLAUDE_CODE_PREWARM_ENV_VAR = "AGENT_INTERNAL_CLAUDE_CODE_PREWARM";
+const AGENT_INTERNAL_CODEX_WARM_SERVER_ENV_VAR = "AGENT_INTERNAL_CODEX_WARM_SERVER";
+/**
+* Per harness, the two switches the Sandbox API sets from its warm-server
+* rollout decision: the long-lived process transport, and prewarm, which
+* starts that process before the turn that uses it and is only meaningful
+* with it. A harness joins the rollout by adding one row; the Sandbox API,
+* the orchestrator's provision guard and its recreate carry all read this
+* table. Values are "1" or "0"; anything else is off.
+*/
+const HARNESS_WARM_TRANSPORT_ENV = {
+	opencode: {
+		warmServer: AGENT_INTERNAL_OPENCODE_WARM_SERVER_ENV_VAR,
+		prewarm: AGENT_INTERNAL_OPENCODE_PREWARM_ENV_VAR
+	},
+	"kimi-code": {
+		warmServer: AGENT_INTERNAL_KIMI_WARM_SERVER_ENV_VAR,
+		prewarm: AGENT_INTERNAL_KIMI_PREWARM_ENV_VAR
+	},
+	"claude-code": {
+		warmServer: AGENT_INTERNAL_CLAUDE_CODE_WARM_SERVER_ENV_VAR,
+		prewarm: AGENT_INTERNAL_CLAUDE_CODE_PREWARM_ENV_VAR
+	},
+	codex: {
+		warmServer: AGENT_INTERNAL_CODEX_WARM_SERVER_ENV_VAR,
+		prewarm: "AGENT_INTERNAL_CODEX_PREWARM"
+	}
+};
+function isReservedProfileUid(uid) {
+	return Number.isSafeInteger(uid) && uid >= 2e5;
+}
+//#endregion
+//#region ../runtime-contracts/dist/proxy-secret-materialization.js
+const syntheticHeader = {
+	alg: "HS256",
+	typ: "JWT"
+};
+const encode = (value) => btoa(value instanceof Uint8Array ? String.fromCharCode(...value) : JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+function placeholderPrefix(slot, format, expiresAt) {
+	return format === "jwt" ? `${encode(syntheticHeader)}.${encode({
+		sub: "sandbox-placeholder",
+		aud: "proxy-secret-placeholder",
+		exp: Math.floor(Date.parse(expiresAt) / 1e3)
+	})}.` : `proxy-declared-${slot.slice(21)}-token-`;
+}
+function isSyntheticPlaceholder(material) {
+	const prefix = placeholderPrefix(material.slot, material.grant.placeholderFormat, material.issuerExpiresAt);
+	return material.placeholder.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/.test(material.placeholder.slice(prefix.length));
+}
+z.array(z.strictObject({
+	binding: ProxySecretBindingSchema,
+	grant: ProxySecretGrantSchema,
+	placeholder: z.string().min(1),
+	slot: z.string().refine(isDeclaredSecretSlotEnvVar),
+	issuerExpiresAt: z.iso.datetime()
+})).superRefine((materials, ctx) => {
+	const bindings = ProxySecretsSchema.safeParse(materials.map((m) => m.binding));
+	const unique = (values) => new Set(values).size === values.length;
+	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
+		code: "custom",
+		message: "Invalid proxy secret materialization"
+	});
+});
+ProxySecretUpdateControlsSchema.extend({
+	resolvedSecrets: ownPropertyRecordSchema(z.string().min(1), { maxEntries: Number.MAX_SAFE_INTEGER }).default({}),
+	proxySecretGrants: ProxySecretReceiptSchema.options[0].shape.bindings,
+	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration.unwrap()
+}).strict().refine((body) => new Set(body.proxySecretGrants.map((b) => b.envName)).size === body.proxySecretGrants.length);
+//#endregion
+//#region ../runtime-contracts/dist/runtime-environment.js
+const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isSafeEnvVarName(name) {
+	if (typeof name !== "string") return false;
+	if (name.length === 0 || name.length > 256) return false;
+	return SAFE_ENV_VAR_NAME_RE.test(name);
+}
+/** Client proxy URLs first, then bypass names. */
+const EGRESS_PROXY_ENV_NAMES = [
+	"HTTPS_PROXY",
+	"https_proxy",
+	"HTTP_PROXY",
+	"http_proxy",
+	"NO_PROXY",
+	"no_proxy"
+];
+const CA_TRUST_ENV_NAMES = [
+	"NODE_EXTRA_CA_CERTS",
+	"SSL_CERT_FILE",
+	"CURL_CA_BUNDLE",
+	"GIT_SSL_CAINFO",
+	"NIX_SSL_CERT_FILE"
+];
+[...EGRESS_PROXY_ENV_NAMES, ...CA_TRUST_ENV_NAMES];
+const FORBIDDEN_ENV_VAR_NAMES = new Set([
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"DYLD_INSERT_LIBRARIES",
+	"DYLD_LIBRARY_PATH",
+	"DYLD_FALLBACK_LIBRARY_PATH",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"PATH",
+	"NIX_BIN_PATH",
+	"EGRESS_EDGE_POOL_ENABLED",
+	"EDGE_BIND_ID",
+	"PRIVACY_EGRESS",
+	"LOG_REDACT",
+	"IFS",
+	"BASH_ENV",
+	"ENV",
+	"SHELL",
+	"SHELLOPTS",
+	"PROMPT_COMMAND",
+	"HOME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_STATE_HOME",
+	"XDG_RUNTIME_DIR",
+	"HTTPS_PROXY",
+	"HTTP_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"https_proxy",
+	"http_proxy",
+	"all_proxy",
+	"no_proxy",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"HOSTNAME",
+	"CONTAINER_ID",
+	"AGENT_WORKSPACE_ROOT",
+	"WORKSPACE_PATH",
+	"STORAGE_PATH",
+	"WORKSPACE_FILE_API_ROOT_ONLY",
+	"WORKSPACE_ALLOWED_ABSOLUTE_PATHS",
+	"TANGLE_PLAN_CALLBACK_ALLOWED_ORIGINS"
+]);
+const FORBIDDEN_ENV_VAR_PREFIXES = [
+	"SIDECAR_",
+	"ORCHESTRATOR_",
+	"AGENT_INTERNAL_",
+	"SANDBOX_DEV_",
+	"AGENT_SUBPROCESS_",
+	"TEE_ATTESTATION_"
+];
+const RUNTIME_CALLER_ALLOWED_ENV_NAMES = new Set(["SIDECAR_CAPABILITIES", "SIDECAR_PLATFORM_CONTROL_RUNTIME"]);
+new Set(Object.values(HARNESS_WARM_TRANSPORT_ENV).flatMap(({ warmServer, prewarm }) => [warmServer, prewarm]));
+function isForbiddenEnvVarName(name) {
+	if (RUNTIME_CALLER_ALLOWED_ENV_NAMES.has(name)) return false;
+	if (FORBIDDEN_ENV_VAR_NAMES.has(name)) return true;
+	for (const prefix of FORBIDDEN_ENV_VAR_PREFIXES) if (name.startsWith(prefix)) return true;
+	return false;
+}
+/**
+* POSIX names for caller-owned container env. Runtime process.env merges must additionally enforce
+* isForbiddenEnvVarName, including project provisioning and Sidecar config.
+*/
+const safeEnvRecordSchema = ownPropertyRecordSchema(z.string(), { maxEntries: Number.MAX_SAFE_INTEGER }).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
+/** Names only: the caller must keep a separate source and pass values to resume({ env }). */
+const sandboxEnvRecoverySchema = z.object({ callerResupplies: z.array(z.string().max(256).refine(isSafeEnvVarName, { message: "invalid env var name" })).max(128).refine((keys) => new Set(keys).size === keys.length, { message: "callerResupplies must contain unique keys" }) }).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	dryRun: z.boolean().optional()
+}).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	eligibleCallerResupplyKeys: z.array(z.string()),
+	requiredOnColdResumeKeys: z.array(z.string()),
+	automaticCredentialRecovery: z.literal(false),
+	dryRun: z.boolean()
+}).strict();
+safeEnvRecordSchema.refine((value) => Object.keys(value).every((key) => !isForbiddenEnvVarName(key) && !key.startsWith("SIDECAR_")), { message: "runtime-owned env var name cannot be set by callers" });
+//#endregion
+//#region src/app-server-protocol.ts
+function grantToPermissionProfile(grant, requested) {
+	if (grant === "deny") return {
+		permissions: {},
+		scope: "turn"
+	};
+	const permissions = {};
+	if (requested.network != null) permissions.network = requested.network;
+	if (requested.fileSystem != null) permissions.fileSystem = requested.fileSystem;
+	return {
+		permissions,
+		scope: grant === "allow_once" ? "turn" : "session"
+	};
+}
+function normalizeChangeKind(kind) {
+	const raw = typeof kind === "string" ? kind : typeof kind === "object" && kind !== null ? kind.type : void 0;
+	if (raw === "add" || raw === "update" || raw === "delete") return raw;
+}
+function sandboxModeToPolicy(mode, workspaceRoot) {
+	if (mode === "danger-full-access") return { type: "dangerFullAccess" };
+	if (mode === "read-only") return {
+		type: "readOnly",
+		networkAccess: false
+	};
+	return {
+		type: "workspaceWrite",
+		writableRoots: [workspaceRoot],
+		networkAccess: false,
+		excludeTmpdirEnvVar: false,
+		excludeSlashTmp: false
+	};
+}
+function grantToReviewDecision(grant) {
+	if (grant === "deny") return "denied";
+	if (grant === "allow_once") return "approved";
+	return "approved_for_session";
+}
+function grantToApprovalDecision(grant) {
+	if (grant === "deny") return "decline";
+	if (grant === "allow_once") return "accept";
+	return "acceptForSession";
+}
+//#endregion
+//#region src/codex-app-server-interactions.ts
+/**
+* Approval reverse-calls (v1 + v2) → the unified broker; the resolved grant
+* maps back to codex's decision enum and unblocks the turn. One shape, four
+* wirings — each supplies its own id/tool extractors and v1-vs-v2 mapper.
+*/
+function registerBrokeredApprovals(bridge, approve) {
+	const onApproval = (method, id, tool, toDecision) => bridge.onRequest(method, async (p) => ({ decision: toDecision(await approve(id(p), tool(p), p)) }));
+	const cmd = (p) => (p.command ?? []).join(" ");
+	onApproval("execCommandApproval", (p) => p.callId, cmd, grantToReviewDecision);
+	onApproval("applyPatchApproval", (p) => p.callId, () => "apply_patch", grantToReviewDecision);
+	onApproval("item/commandExecution/requestApproval", (p) => p.callId ?? p.itemId ?? "", cmd, grantToApprovalDecision);
+	onApproval("item/fileChange/requestApproval", (p) => p.callId ?? p.itemId ?? "", () => "apply_patch", grantToApprovalDecision);
+	bridge.onRequest("item/permissions/requestApproval", async (p) => grantToPermissionProfile(await approve(p.itemId ?? "", `permission escalation${p.reason ? `: ${p.reason}` : ""}`, p), p.permissions ?? {}));
+}
+/**
+* Under approvalPolicy "never" codex should not ask; if it does anyway,
+* deny in the method's own response shape and surface a warning instead
+* of leaving a silent stall in the log. No Permission interaction is
+* raised — the question channel never enabled that capability.
+*/
+function registerDeniedApprovals(bridge, onEvent) {
+	const denyApproval = (method, response) => bridge.onRequest(method, async () => {
+		onEvent?.({
+			type: "warning",
+			code: "CODEX_UNEXPECTED_APPROVAL",
+			message: `codex requested ${method} despite approvalPolicy "never"; denied (question interactions do not route permissions)`
+		});
+		return response;
+	});
+	denyApproval("execCommandApproval", { decision: grantToReviewDecision("deny") });
+	denyApproval("applyPatchApproval", { decision: grantToReviewDecision("deny") });
+	denyApproval("item/commandExecution/requestApproval", { decision: grantToApprovalDecision("deny") });
+	denyApproval("item/fileChange/requestApproval", { decision: grantToApprovalDecision("deny") });
+	denyApproval("item/permissions/requestApproval", grantToPermissionProfile("deny", {}));
+}
+/**
+* The agent asking the user a clarifying question (codex's request_user_input
+* tool) → the unified broker's question round-trip. The positional answers
+* map back onto codex's per-question-id reply; no answer (timeout / teardown /
+* no live stream) replies with empty slots so the turn unblocks.
+*/
+function registerUserInputQuestions(bridge, permissions, sessionId, interactionBinding, questions, onEvent) {
+	bridge.onRequest("item/tool/requestUserInput", async (p) => {
+		if (!questions) {
+			onEvent?.({
+				type: "warning",
+				code: "CODEX_UNEXPECTED_QUESTION",
+				message: "codex requested item/tool/requestUserInput but question interactions were not enabled; answered with no selections"
+			});
+			const empty = {};
+			for (const q of p.questions ?? []) empty[q.id] = { answers: [] };
+			return { answers: empty };
+		}
+		const codexQuestions = p.questions ?? [];
+		const answers = await permissions.requestQuestion({
+			id: randomUUID(),
+			sessionId,
+			binding: interactionBinding,
+			questions: codexQuestions.map((q) => ({
+				question: q.question,
+				options: q.options?.map((o) => ({
+					label: o.label,
+					description: o.description
+				}))
+			})),
+			timeoutMs: typeof p.autoResolutionMs === "number" && p.autoResolutionMs > 0 ? p.autoResolutionMs : void 0,
+			emit: onEvent
+		});
+		const byId = {};
+		codexQuestions.forEach((q, index) => {
+			byId[q.id] = { answers: answers?.[index] ?? [] };
+		});
+		return { answers: byId };
+	});
+}
+function registerAppServerInteractions(bridge, permissions, sessionId, interactionBinding, interactive, questions, onEvent) {
+	const approve = (id, toolName, raw) => permissions.request({
+		id: id && id.length > 0 ? id : randomUUID(),
+		sessionId,
+		binding: interactionBinding,
+		toolName,
+		input: raw,
+		allowlistGrant: "deny",
+		emit: onEvent
+	});
+	if (interactive) registerBrokeredApprovals(bridge, approve);
+	else registerDeniedApprovals(bridge, onEvent);
+	registerUserInputQuestions(bridge, permissions, sessionId, interactionBinding, questions, onEvent);
+}
+function routesPermissions(config) {
+	return config.interactivePermissions === true || interactionToggleEnabled(config.interactions, "permission");
+}
+function routesQuestions(config) {
+	return routesPermissions(config) || interactionToggleEnabled(config.interactions, "question");
+}
+function codexRoutesPlans(config) {
+	return interactionToggleEnabled(config.interactions, "plan");
+}
+//#endregion
+//#region src/app-server-policy.ts
+function appServerPolicy(config, input = {}) {
+	const turnConfig = withTurnInteractions(config, input);
+	const interactive = routesPermissions(turnConfig);
+	const questions = routesQuestions(turnConfig);
+	const plans = codexRoutesPlans(turnConfig);
+	return {
+		interactive,
+		questions,
+		plans,
+		approvalPolicy: interactive ? config.approvalPolicy ?? "on-request" : "never",
+		sandbox: plans ? "read-only" : interactive || config.bypassPermissions === false ? config.sandboxMode ?? "workspace-write" : "danger-full-access"
+	};
+}
+function initialThreadId(input) {
+	const continuation = input.planContinuation;
+	if (!continuation) return input.nativeResume?.nativeSessionId;
+	if (continuation.providerState.kind !== "codex") throw new Error(`Codex cannot resume ${continuation.providerState.kind} plan state`);
+	return continuation.providerState.threadId;
+}
+//#endregion
+//#region src/app-server-items.ts
+function isTool(item) {
+	return item.type === "commandExecution" || item.type === "fileChange";
+}
+/** Native item IDs stay stable across tool, file and reasoning updates. */
+var AppServerItemMapper = class {
+	tools = /* @__PURE__ */ new Map();
+	reasoning = /* @__PURE__ */ new Map();
+	emittedThinking = false;
+	constructor(ids, logger) {
+		this.ids = ids;
+		this.logger = logger;
+	}
+	partBase(id) {
+		return {
+			id,
+			sessionID: this.ids.sessionId,
+			messageID: this.ids.messageId
+		};
+	}
+	filePart(path) {
+		const derived = deriveFilePart({
+			path,
+			messageId: this.ids.messageId
+		});
+		if (!derived) {
+			this.logger?.debug("skipping file part for non-absolute fileChange path", { path });
+			return null;
+		}
+		return {
+			...this.partBase(derived.id),
+			type: "file",
+			filename: derived.filename,
+			...derived.mediaType ? { mediaType: derived.mediaType } : {},
+			url: derived.url
+		};
+	}
+	toolPart(itemId, state) {
+		const settled = {
+			input: state.input,
+			output: state.output,
+			time: {
+				start: state.startTime,
+				end: Date.now()
+			}
+		};
+		const toolState = state.status === "running" ? {
+			status: "running",
+			input: state.input,
+			time: { start: state.startTime }
+		} : state.status === "failed" ? {
+			...settled,
+			status: "failed",
+			error: typeof state.output === "string" ? state.output : void 0
+		} : {
+			...settled,
+			status: "completed"
+		};
+		return {
+			...this.partBase(itemId),
+			type: "tool",
+			callID: itemId,
+			tool: state.tool,
+			state: toolState
+		};
+	}
+	onItemStarted(params) {
+		const item = params.item;
+		if (!isTool(item)) return [];
+		const state = {
+			tool: item.type === "commandExecution" ? "shell" : "apply_patch",
+			input: item.type === "commandExecution" ? {
+				command: item.command,
+				cwd: item.cwd
+			} : { changes: item.changes.map((change) => ({
+				path: change.path,
+				kind: normalizeChangeKind(change.kind) ?? change.kind
+			})) },
+			startTime: params.startedAtMs ?? Date.now(),
+			outputBuffer: "",
+			status: "running"
+		};
+		this.tools.set(item.id, state);
+		return [{
+			type: "message.part.updated",
+			part: this.toolPart(item.id, state)
+		}];
+	}
+	onItemCompleted(params) {
+		const item = params.item;
+		if (!isTool(item)) {
+			if (item.type === "reasoning" && typeof item.id === "string") this.reasoning.delete(item.id);
+			return [];
+		}
+		const state = this.tools.get(item.id);
+		if (!state) return [{
+			type: "warning",
+			code: "UNKNOWN_TOOL_RESULT",
+			message: `Received completion for unknown app-server item: ${item.id}`
+		}];
+		state.status = item.status === "completed" && (item.type !== "commandExecution" || (item.exitCode ?? 0) === 0) ? "completed" : "failed";
+		state.output = item.type === "commandExecution" ? item.aggregatedOutput ?? state.outputBuffer : item.changes.map((change) => change.diff).join("\n");
+		const events = [{
+			type: "message.part.updated",
+			part: this.toolPart(item.id, state)
+		}];
+		if (state.status !== "completed") return events;
+		if (item.type === "commandExecution") events.push({
+			type: "model-processing",
+			phase: "tool-result",
+			toolName: state.tool,
+			elapsedMs: item.durationMs ?? (params.completedAtMs ?? Date.now()) - state.startTime
+		});
+		else for (const change of item.changes) {
+			const kind = normalizeChangeKind(change.kind);
+			if (kind === "delete") continue;
+			if (kind === void 0 && change.kind == null) {
+				this.logger?.debug("fileChange change without a kind", { path: change.path });
+				continue;
+			}
+			const part = this.filePart(change.path);
+			if (part) events.push({
+				type: "message.part.updated",
+				part
+			});
+		}
+		return events;
+	}
+	onCommandOutputDelta(params) {
+		const state = this.tools.get(params.itemId);
+		if (state) state.outputBuffer += params.delta;
+		return [];
+	}
+	onReasoningDelta(params) {
+		if (!params.delta) return [];
+		const text = (this.reasoning.get(params.itemId) ?? "") + params.delta;
+		this.reasoning.set(params.itemId, text);
+		const part = {
+			...this.partBase(params.itemId),
+			type: "reasoning",
+			text
+		};
+		const events = [];
+		if (!this.emittedThinking) {
+			this.emittedThinking = true;
+			events.push({
+				type: "model-processing",
+				phase: "thinking"
+			});
+		}
+		events.push({
+			type: "message.part.updated",
+			part,
+			delta: params.delta
+		});
+		return events;
+	}
+	toolInvocations() {
+		return [...this.tools.values()].map((state) => ({
+			toolName: state.tool,
+			input: state.input,
+			result: state.output,
+			...state.status === "failed" ? { isError: true } : {}
+		}));
+	}
+};
+//#endregion
+//#region src/codex-app-server-turn.ts
+const CODEX_PLAN_MCP_NAME = "tangle-interaction";
+function durablePlanInstruction(continuation, planMode) {
+	if (continuation?.decision.outcome === "approved") return `The user approved durable plan ${continuation.plan.id}. Execute this exact plan now:\n\n${continuation.plan.body}`;
+	if (continuation?.decision.outcome === "rejected") return `The user rejected durable plan ${continuation.plan.id}. Revise it using this feedback:\n\n${continuation.decision.feedback}\n\nPrevious plan:\n${continuation.plan.body}\n\nWhen the revision is complete, call request_plan with the full revised plan. Submission ends this turn.`;
+	if (planMode) return "Produce a complete implementation plan, then call request_plan with its full body. Submission ends this turn; do not execute it.";
+}
+var CodexAppServerTurn = class {
+	activeThreadId;
+	submittedPlan;
+	planInteractions;
+	text = "";
+	tokenUsage;
+	activeTurnId;
+	closeEnd;
+	pendingTurnCompletions = [];
+	pendingTurnErrors = [];
+	planInterruptRequested = false;
+	terminalSettled = false;
+	resolveTurn;
+	rejectTurn;
+	turnDone;
+	items;
+	constructor(turn) {
+		this.turn = turn;
+		this.turnDone = new Promise((resolve, reject) => {
+			this.resolveTurn = resolve;
+			this.rejectTurn = reject;
+		});
+		this.turnDone.catch(() => {});
+		this.items = new AppServerItemMapper({
+			sessionId: turn.sessionId,
+			messageId: turn.messageId
+		}, turn.logger);
+	}
+	planProviderState() {
+		if (!this.activeThreadId) throw new Error("Codex thread identity was unavailable during plan submission");
+		return {
+			kind: "codex",
+			version: 1,
+			threadId: this.activeThreadId
+		};
+	}
+	subscribe(bridge) {
+		const unsubscribers = [
+			...this.subscribeItems(bridge),
+			this.subscribeAgentMessage(bridge),
+			this.subscribeTokenUsage(bridge),
+			bridge.onNotification("turn/completed", (p) => {
+				this.handleTurnCompleted(p);
+			}),
+			bridge.onNotification("error", (p) => this.handleErrorNotification(p)),
+			bridge.onClose((reason) => {
+				if (this.activeTurnId === void 0 && this.pendingTurnCompletions.length > 0) {
+					queueMicrotask(() => this.failFromClose(reason));
+					return;
+				}
+				this.failFromClose(reason);
+			})
+		];
+		return () => {
+			for (const unsubscribe of unsubscribers) unsubscribe();
+		};
+	}
+	async run(bridge, params) {
+		const { onEvent, sessionId } = this.turn;
+		try {
+			onEvent?.({
+				type: "status",
+				status: "started"
+			});
+			await this.handshake(bridge, params);
+			await this.startTurn(bridge, params);
+			await this.turnDone;
+			await params.cleanup?.();
+			if (this.submittedPlan) {
+				if (!this.planInteractions) throw new Error("Codex committed a plan without terminal plan support");
+				this.submittedPlan = await this.planInteractions.confirmSubmittedPlan();
+			}
+			return {
+				text: this.text,
+				toolInvocations: this.items.toolInvocations(),
+				sessionId,
+				outcome: this.submittedPlan ? {
+					type: "awaiting_plan_decision",
+					plan: this.submittedPlan
+				} : { type: "completed" },
+				...this.tokenUsage ? { tokenUsage: this.tokenUsage } : {}
+			};
+		} catch (error) {
+			if (this.submittedPlan) try {
+				await this.planInteractions?.withdrawSubmittedPlan(`Codex failed to terminalize its planning turn: ${error instanceof Error ? error.message : String(error)}`);
+			} catch (withdrawalError) {
+				throw new AggregateError([error, withdrawalError], "Codex planning failed and its durable plan could not be withdrawn");
+			}
+			throw Object.assign(error, { reason: error.reason ?? this.closeEnd ?? turnEndReason({ aborted: this.turn.input.abortSignal?.aborted }) });
+		}
+	}
+	async handshake(bridge, params) {
+		const initializeStarted = performance.now();
+		await bridge.request("initialize", {
+			clientInfo: {
+				name: "tangle-sidecar",
+				title: null,
+				version: "0.1.0"
+			},
+			capabilities: params.initialize ? { experimentalApi: true } : null
+		});
+		bridge.notify("initialized");
+		await params.initialize?.(bridge);
+		const previous = this.activeThreadId;
+		const { thread } = await bridge.request(previous ? "thread/resume" : "thread/start", {
+			...previous ? { threadId: previous } : {},
+			cwd: params.cwd,
+			model: params.model,
+			approvalPolicy: params.approvalPolicy,
+			sandbox: params.sandbox
+		});
+		if (previous && thread.id !== previous) throw new Error("Codex resumed a different thread");
+		this.activeThreadId = thread.id;
+		await this.turn.onNativeSession?.(thread.id);
+		this.turn.onEvent?.({
+			type: "native.session.observed",
+			provider: "codex",
+			nativeSessionId: thread.id
+		});
+		this.turn.logger.observePhase?.("cli_initialize", performance.now() - initializeStarted);
+	}
+	async startTurn(bridge, params) {
+		const { input, plans } = this.turn;
+		const turnMessage = [durablePlanInstruction(input.planContinuation, plans), params.promptText].filter((part) => typeof part === "string" && part.length > 0).join(PROMPT_SECTION_SEPARATOR);
+		const startedTurn = await bridge.request("turn/start", {
+			threadId: this.activeThreadId,
+			input: [{
+				type: "text",
+				text: turnMessage,
+				text_elements: []
+			}],
+			cwd: params.cwd,
+			approvalPolicy: params.approvalPolicy,
+			sandboxPolicy: sandboxModeToPolicy(params.sandbox, params.cwd),
+			model: params.model
+		});
+		this.activeTurnId = startedTurn.turn.id;
+		this.drainPendingTurnEvents();
+	}
+	completeTurn() {
+		if (this.terminalSettled) return;
+		this.terminalSettled = true;
+		this.resolveTurn?.();
+	}
+	failTurn(cause) {
+		if (this.terminalSettled) return;
+		this.terminalSettled = true;
+		this.rejectTurn?.(cause instanceof Error ? cause : new Error(String(cause)));
+	}
+	forward(events) {
+		for (const event of events) this.turn.onEvent?.(event);
+	}
+	subscribeItems(bridge) {
+		return [
+			bridge.onNotification("item/started", (p) => this.forward(this.items.onItemStarted(p))),
+			bridge.onNotification("item/completed", (p) => this.handleItemCompleted(bridge, p)),
+			bridge.onNotification("item/commandExecution/outputDelta", (p) => this.forward(this.items.onCommandOutputDelta(p))),
+			bridge.onNotification("item/reasoning/textDelta", (p) => this.forward(this.items.onReasoningDelta(p))),
+			bridge.onNotification("item/reasoning/summaryTextDelta", (p) => this.forward(this.items.onReasoningDelta(p)))
+		];
+	}
+	async handleItemCompleted(bridge, lifecycle) {
+		this.forward(this.items.onItemCompleted(lifecycle));
+		const item = lifecycle.item;
+		if (!this.turn.plans || item.type !== "mcpToolCall" || item.server !== "tangle-interaction" || item.tool !== "request_plan") return;
+		if (lifecycle.threadId !== this.activeThreadId || lifecycle.turnId !== this.activeTurnId) {
+			this.failTurn(/* @__PURE__ */ new Error("Codex completed request_plan for a different thread or turn"));
+			return;
+		}
+		if (item.status !== "completed" || !this.submittedPlan) {
+			this.failTurn(/* @__PURE__ */ new Error("Codex request_plan completed without a durable plan receipt"));
+			return;
+		}
+		if (this.planInterruptRequested) return;
+		this.planInterruptRequested = true;
+		try {
+			await bridge.request("turn/interrupt", {
+				threadId: this.activeThreadId,
+				turnId: this.activeTurnId
+			});
+		} catch (error) {
+			this.failTurn(error);
+		}
+	}
+	subscribeAgentMessage(bridge) {
+		const { sessionId, messageId, onEvent } = this.turn;
+		return bridge.onNotification("item/agentMessage/delta", (p) => {
+			const delta = p.delta ?? p.text ?? "";
+			if (!delta) return;
+			this.text += delta;
+			const part = {
+				id: messageId,
+				sessionID: sessionId,
+				messageID: messageId,
+				type: "text",
+				text: this.text
+			};
+			onEvent?.({
+				type: "message.part.updated",
+				part,
+				delta
+			});
+		});
+	}
+	subscribeTokenUsage(bridge) {
+		return bridge.onNotification("thread/tokenUsage/updated", (p) => {
+			const total = p.tokenUsage?.total;
+			if (!total) return;
+			this.tokenUsage = {
+				inputTokens: total.inputTokens ?? 0,
+				outputTokens: total.outputTokens ?? 0,
+				cacheReadInputTokens: total.cachedInputTokens
+			};
+		});
+	}
+	handleTurnCompleted(completed) {
+		if (this.activeThreadId === void 0 || this.activeTurnId === void 0) {
+			this.pendingTurnCompletions.push(completed);
+			return;
+		}
+		if (completed.threadId !== this.activeThreadId || completed.turn.id !== this.activeTurnId) return;
+		if (this.submittedPlan) {
+			if (!this.planInterruptRequested || completed.turn.status !== "interrupted") {
+				this.failTurn(/* @__PURE__ */ new Error(`Codex planning turn ended as ${completed.turn.status} before its durable plan was interrupted`));
+				return;
+			}
+			this.completeTurn();
+			return;
+		}
+		if (completed.turn.status === "completed") {
+			this.completeTurn();
+			return;
+		}
+		this.failTurn(new Error(completed.turn.error?.message ?? `Codex turn ended with status ${completed.turn.status}`));
+	}
+	reportTurnError(error, warning) {
+		if (this.terminalSettled) return;
+		this.turn.onEvent?.({
+			type: "warning",
+			code: "CODEX_TURN_ERROR",
+			message: warning
+		});
+		this.failTurn(error);
+	}
+	drainPendingTurnEvents() {
+		if (this.activeThreadId === void 0 || this.activeTurnId === void 0) return;
+		const pendingCompletions = this.pendingTurnCompletions.splice(0);
+		for (const completed of pendingCompletions) this.handleTurnCompleted(completed);
+		const pendingErrors = this.pendingTurnErrors.splice(0);
+		for (const pending of pendingErrors) this.reportTurnError(pending.error, pending.warning);
+	}
+	handleErrorNotification(p) {
+		const e = p;
+		const base = e.error?.message ?? "codex turn error";
+		const warning = e.error?.additionalDetails ? `${base} (${e.error.additionalDetails})` : base;
+		if (e.willRetry === true) {
+			this.turn.onEvent?.({
+				type: "warning",
+				code: "CODEX_TURN_ERROR",
+				message: warning
+			});
+			return;
+		}
+		if (this.activeTurnId === void 0 && this.pendingTurnCompletions.length > 0) {
+			this.pendingTurnErrors.push({
+				error: new Error(base),
+				warning
+			});
+			return;
+		}
+		this.reportTurnError(new Error(base), warning);
+	}
+	failFromClose(reason) {
+		this.drainPendingTurnEvents();
+		if (this.terminalSettled) return;
+		const error = reason.error ?? /* @__PURE__ */ new Error(`Codex app-server closed before the matching turn completed (${reason.reason}): send the next turn to resume its thread`);
+		this.closeEnd = turnEndReason({
+			aborted: this.turn.input.abortSignal?.aborted,
+			timedOut: reason.reason === "aborted",
+			linkLost: this.activeTurnId !== void 0 && reason.reason !== "graceful"
+		});
+		this.failTurn(Object.assign(error, { reason: this.closeEnd }));
+	}
+};
+//#endregion
+//#region src/codex-connection-config.ts
+const DEFAULT_MODEL = "gpt-5-mini";
+function resolveCodexRouterModel(model) {
+	if (!model) return DEFAULT_MODEL;
+	if (model.startsWith("openai/")) return model.slice(7);
+	if (model.startsWith("gpt-")) return model;
+	return DEFAULT_MODEL;
+}
+function normalizeExplicitCodexModel(model) {
+	return model.startsWith("openai/") ? model.slice(7) : model;
+}
+function resolveCodexAuthMode(config) {
+	return config.authMode ?? (config.apiKey ? "api-key" : "oauth");
+}
+const CODEX_CONFIG_PATH = ".codex/config.toml";
+function isCodexConfigPath(filePath) {
+	return path.posix.normalize(filePath.replaceAll("\\", "/").replace(/^~\//, "")) === CODEX_CONFIG_PATH;
+}
+function resolveCodexApiKeyBaseUrl(config) {
+	return config.baseUrl || (config.apiKey ? "https://api.openai.com/v1" : resolveTangleRouterDefaults().baseUrl);
+}
+function resolveCodexConnection(config, explicitModel) {
+	const authMode = resolveCodexAuthMode(config);
+	const gatewayDefaults = resolveTangleRouterDefaults();
+	const baseUrl = authMode === "api-key" ? resolveCodexApiKeyBaseUrl(config) : void 0;
+	const gatewayModel = process.env.CODEX_MODEL || process.env.TANGLE_ROUTER_CODEX_MODEL || gatewayDefaults.model;
+	return {
+		baseUrl,
+		model: explicitModel !== void 0 ? normalizeExplicitCodexModel(explicitModel) : authMode === "api-key" ? resolveCodexRouterModel(gatewayModel) : void 0
+	};
+}
+function codexGatewayConfigArgs(baseUrl) {
+	if (!baseUrl) return [];
+	return Object.entries({
+		model_provider: "tangle",
+		"model_providers.tangle.name": "Tangle Router",
+		"model_providers.tangle.base_url": baseUrl,
+		"model_providers.tangle.env_key": "OPENAI_API_KEY",
+		"model_providers.tangle.wire_api": "responses"
+	}).flatMap(([key, value]) => ["-c", `${key}=${tomlString(value)}`]);
+}
+function tomlString(value) {
+	return JSON.stringify(value);
+}
+function codexPlanMcpConfigArgs(options) {
+	return [
+		"-c",
+		`mcp_servers.${options.name}.url=${tomlString(options.url)}`,
+		"-c",
+		`mcp_servers.${options.name}.bearer_token_env_var=${tomlString(options.tokenEnv)}`,
+		"-c",
+		`mcp_servers.${options.name}.tools.request_plan.approval_mode="approve"`
+	];
+}
+function routedBaseUrl(config, baseUrl, getAgentEnvironment) {
+	if (!baseUrl || !codexWarmSwitchOn()) return baseUrl;
+	const host = getAgentEnvironment();
+	return managedModelProxyUrl({
+		binding: Object.hasOwn(host, "TANGLE_OPENCODE_MODEL_PROXY") ? host["TANGLE_OPENCODE_MODEL_PROXY"] : process.env["TANGLE_OPENCODE_MODEL_PROXY"],
+		apiKey: config.apiKey,
+		upstream: baseUrl,
+		runtimeHome: config.runtimeHome
+	}) ?? baseUrl;
+}
+function codexWarmSwitchOn() {
+	return process.env[AGENT_INTERNAL_CODEX_WARM_SERVER_ENV_VAR] === "1";
+}
+//#endregion
+//#region src/codex-native-launch.ts
+var CodexNativeLaunchAdapter = class extends CliProviderAdapterBase {
+	inheritProcessEnv = false;
+	nativeAttachmentKinds() {
+		return ["image"];
+	}
+	nativeConfigArgs(config, connection, prompts, flags) {
+		return [
+			...codexDeveloperInstructionArgs(prompts.appendSystemPrompt === void 0 ? prompts.systemPrompt : [prompts.systemPrompt, prompts.appendSystemPrompt].filter((part) => Boolean(part?.trim())).join("\n\n"), flags.concat(config.extraFlags ?? [])),
+			...codexGatewayConfigArgs(routedBaseUrl(config, connection.baseUrl, () => this.agentEnvironmentValues())),
+			...nativeEffortArgs("codex", config.profile?.model?.reasoningEffort),
+			...flags
+		];
+	}
+	buildExecArgs(params) {
+		const args = ["exec"];
+		if (params.sessionId) args.push("resume");
+		args.push("--json", ...CODEX_DISABLED_FEATURE_ARGS);
+		const explicitModel = params.model ?? params.config.model;
+		const connection = resolveCodexConnection(params.config, explicitModel);
+		if (connection.model) args.push("--model", connection.model);
+		if (!params.sessionId) args.push("--cd", params.workspaceRoot);
+		args.push("--skip-git-repo-check");
+		if (params.config.bypassPermissions !== false) args.push("--dangerously-bypass-approvals-and-sandbox");
+		else if (params.config.sandboxMode) args.push("--sandbox", params.config.sandboxMode);
+		args.push(...this.nativeConfigArgs(params.config, connection, params, params.config.extraFlags ?? []));
+		const { native: nativeImages, message: messageWithRemoteMarkers } = partitionImageAttachments({
+			message: params.message,
+			attachments: params.attachments,
+			qualifies: (attachment) => attachment.path !== void 0
+		});
+		const imageFlags = nativeImages.flatMap((attachment) => ["-i", attachment.path]);
+		args.push(...imageFlags, ...params.sessionId ? [params.sessionId] : [], "-");
+		return {
+			command: this.getCliPath(),
+			args,
+			useStdin: true,
+			stdin: messageWithRemoteMarkers
+		};
+	}
+	buildExecEnv(config) {
+		const env = this.agentEnvironmentValues();
+		if (config.runtimeHome) env.CODEX_HOME = path.join(config.runtimeHome, ".codex");
+		if (resolveCodexAuthMode(config) === "oauth") {
+			env.OPENAI_API_KEY = void 0;
+			env.OPENAI_BASE_URL = void 0;
+		} else {
+			if (config.apiKey) env.OPENAI_API_KEY = config.apiKey;
+			env.OPENAI_BASE_URL = routedBaseUrl(config, resolveCodexConnection(config).baseUrl, () => this.agentEnvironmentValues());
+		}
+		return env;
+	}
+	buildAppServerEnv(profilePlan, workspaceRoot) {
+		return this.applyWritableHomeDefaults(this.mergeProfilePlanEnvironment(this.buildNativeExecutionEnvironment(this.config), profilePlan, this.config.nativeAuthEnv !== void 0 || (this.config.authFiles?.length ?? 0) > 0), workspaceRoot);
+	}
+	getManagedAuthFiles() {
+		if (resolveCodexAuthMode(this.config) !== "oauth" || this.config.authFiles?.some((file) => isCodexConfigPath(file.path))) return [];
+		const model = this.config.model ? normalizeExplicitCodexModel(this.config.model) : void 0;
+		return [{
+			path: CODEX_CONFIG_PATH,
+			content: `${[...model ? [`model = ${tomlString(model)}`] : [], "cli_auth_credentials_store = \"file\""].join("\n")}\n`,
+			mode: 384
+		}];
+	}
+};
+//#endregion
+//#region src/codex-secret-profile.ts
+var CodexSecretProfileAdapter = class extends CodexNativeLaunchAdapter {
+	supportsSecretProfileRevisions = true;
+	mcpOwner;
+	binary;
+	constructor(options = {}) {
+		super(options);
+		this.mcpOwner = { proxy: options.mcpCredentialProxy };
+	}
+	refuse(reason, path = this.config.runtimeHome) {
+		return refuseSecretLaunch(`Secret Codex ${reason}`, { path });
+	}
+	getCliPath() {
+		return this.binary ?? super.getCliPath();
+	}
+	secretProfileVerificationScope() {
+		return `${this.provider}\0${resolveExecutableRealpath(super.getCliPath(), this.agentEnvironmentValues().PATH) ?? super.getCliPath()}`;
+	}
+	async verifyPreparedSecretProfileRevision(input, plan) {
+		await this.readNativeConfig(input, plan);
+	}
+	async readNativeConfig(input, plan) {
+		const workspace = input.workspaceRoot ?? this.storagePath;
+		const env = this.buildAppServerEnv(plan, workspace);
+		const cwd = env.TANGLE_PROFILE_REVISION_WORKSPACE;
+		const home = this.config.runtimeHome;
+		const identity = this.subprocessIdentity();
+		if (!cwd || !home || env.HOME !== home || env.CODEX_HOME !== `${home}/.codex` || env.TANGLE_SHARED_WORKSPACE !== workspace || !identity || !isReservedProfileUid(identity.uid)) this.refuse("identity or revision is invalid", home);
+		assertSealedNativeHome(home, identity.gid, SEALED_NATIVE_HOME_LAYOUT.codex);
+		assertSealedNativeSearchPath(cwd, [".codex", ".agents"]);
+		const command = await provenStoreBinary(`codex-cli ${NATIVE_SESSION_CONTRACTS.codex.cliVersion}`, {
+			command: super.getCliPath(),
+			cwd,
+			env,
+			inheritEnv: this.inheritProcessEnv,
+			isolatedIdentity: identity,
+			signal: input.abortSignal
+		});
+		this.binary = command;
+		const bridge = spawnRpcBridge({
+			detached: true,
+			inheritEnv: this.inheritProcessEnv,
+			command,
+			args: this.nativeArgs(input, plan),
+			cwd,
+			env,
+			...identity,
+			isolatedIdentity: this.config.subprocessUser,
+			defaultRequestTimeoutMs: 15e3,
+			signal: input.abortSignal
+		});
+		try {
+			await bridge.request("initialize", {
+				clientInfo: {
+					name: "tangle-profile-prepare",
+					version: "1"
+				},
+				capabilities: { experimentalApi: true }
+			});
+			bridge.notify("initialized");
+			const servers = await this.readNativeControls(bridge, plan, cwd);
+			const referenced = new Set(Object.values(servers).flatMap((server) => [...Object.values(server.env_http_headers ?? {}), ...server.env_vars ?? []]));
+			if (Object.entries(env).some(([name, value]) => value?.includes("{env:TANGLE_PROFILE_SECRET_") && !referenced.has(name))) this.refuse("secret is outside MCP", cwd);
+			return {
+				cwd,
+				env,
+				servers
+			};
+		} finally {
+			await bridge.close();
+		}
+	}
+	async readNativeControls(bridge, plan, cwd, expected) {
+		const { config, layers } = await bridge.request("config/read", {
+			cwd,
+			includeLayers: true
+		});
+		const prompt = plan.spawn.flags.find((flag) => flag.startsWith("model_instructions_file="));
+		if (config.features?.apps !== false || config.features.plugins !== false || prompt && config.model_instructions_file !== JSON.parse(prompt.slice(prompt.indexOf("=") + 1))) this.refuse("native controls differ", cwd);
+		if (!layers || layers.some((layer) => layer.config?.mcp_servers !== void 0 && layer.name?.type !== "sessionFlags")) this.refuse("has ambient MCP configuration", cwd);
+		const servers = config.mcp_servers ?? {};
+		if (expected && (Object.keys(servers).length !== Object.keys(expected).length || Object.entries(servers).some(([name, server]) => {
+			const declared = expected[name];
+			return !declared || server.url !== declared.url || server.command || (server.args?.length ?? 0) > 0 || Object.keys(server.env ?? {}).length > 0 || (server.env_vars?.length ?? 0) > 0 || (server.bearer_token_env_var ?? void 0) !== declared.bearer_token_env_var || JSON.stringify(server.http_headers ?? {}) !== JSON.stringify(declared.http_headers ?? {}) || Object.keys(server.env_http_headers ?? {}).length > 0;
+		}))) this.refuse("native MCP proxy controls differ", cwd);
+		return servers;
+	}
+	nativeArgs(input, plan, mcp) {
+		const prompts = this.resolveProfilePrompts(input, plan);
+		if (this.config.secretProfileRevisionRoot && plan) {
+			const context = `The mutable workspace is ${JSON.stringify(input.workspaceRoot ?? this.storagePath)}. The current directory holds the read-only supplied profile. Use absolute paths in the mutable workspace for edits, builds and git commands.`;
+			prompts.appendSystemPrompt = [prompts.appendSystemPrompt, context].filter(Boolean).join("\n\n");
+		}
+		const connection = resolveCodexConnection(this.config, this.resolveProfileModel(input.model?.model) ?? this.config.model);
+		const flags = (plan?.spawn.flags ?? []).filter((flag, index, all) => mcp === void 0 || !(flag === "-c" ? all[index + 1] : flag)?.startsWith("mcp_servers="));
+		return [
+			"app-server",
+			"--strict-config",
+			...CODEX_DISABLED_FEATURE_ARGS,
+			...this.nativeConfigArgs(this.config, connection, prompts, flags),
+			...mcp === void 0 ? [] : ["-c", `mcp_servers=${inlineToml(mcp)}`]
+		];
+	}
+	async prepareSecretCodexTurn(input, plan, sessionId) {
+		const native = await this.readNativeConfig(input, plan);
+		const cwd = this.bindSecretProfileSessionView(native.cwd, sessionId);
+		assertSealedNativeSearchPath(cwd, [".codex", ".agents"]);
+		const refs = this.secretProfileReferences(plan) ?? {};
+		const served = [];
+		const inherited = (entries) => Object.fromEntries(entries.map(([name, key]) => [name, native.env[key]]));
+		for (const [name, entry] of Object.entries(native.servers)) {
+			if (entry.enabled === false) continue;
+			const server = entry.url ? servableMcpServer(name, {
+				url: entry.url,
+				headers: {
+					...entry.http_headers,
+					...inherited(Object.entries(entry.env_http_headers ?? {}))
+				}
+			}, refs) : servableStdioServer(name, {
+				command: [entry.command, ...entry.args ?? []],
+				environment: {
+					...entry.env,
+					...inherited((entry.env_vars ?? []).map((key) => [key, key]))
+				}
+			}, refs);
+			if (typeof server === "string") this.refuse(`cannot serve MCP ${name}: ${server}`, cwd);
+			served.push(server);
+		}
+		const uid = this.config.subprocessUser?.uid;
+		const scope = secretMcpScope(sessionId, uid, this.mcpOwner);
+		const servers = {};
+		if (served.length) {
+			if (!this.mcpOwner.proxy) this.refuse("requires an MCP proxy", cwd);
+			const endpoint = await this.mcpOwner.proxy.endpoint(scope, served.map((server) => server.name));
+			for (const server of served) {
+				const url = endpoint.urls[server.name];
+				if (!url || !isLoopbackEndpoint(url)) this.refuse("MCP endpoint is not loopback", cwd);
+				const declared = native.servers[server.name];
+				servers[server.name] = {
+					url,
+					http_headers: { Authorization: `Bearer ${endpoint.placeholder}` },
+					...Object.fromEntries(Object.entries(declared ?? {}).filter(([key, value]) => value !== null && [
+						"tool_timeout_sec",
+						"startup_timeout_sec",
+						"enabled_tools",
+						"disabled_tools",
+						"required",
+						"defer_loading"
+					].includes(key)))
+				};
+			}
+		}
+		const args = this.nativeArgs(input, plan, servers);
+		return {
+			cwd,
+			env: native.env,
+			args,
+			release: served.length ? await this.mcpOwner.proxy?.lease(scope, served) : void 0,
+			validate: (bridge, extra) => this.readNativeControls(bridge, plan, cwd, {
+				...servers,
+				...extra
+			})
+		};
+	}
+	async shutdown() {
+		try {
+			if (!this.config.stableIsolatedIdentity) await forgetSessionScopes({ owner: this.mcpOwner });
+		} finally {
+			await super.shutdown();
+		}
+	}
+};
+function inlineToml(value) {
+	if (typeof value === "string") return tomlString(value);
+	if (typeof value === "boolean" || Number.isFinite(value)) return String(value);
+	if (Array.isArray(value)) return `[${value.map(inlineToml).join(", ")}]`;
+	if (isPlainRecord(value)) return `{ ${Object.entries(value).map(([key, entry]) => `${tomlString(key)} = ${inlineToml(entry)}`).join(", ")} }`;
+	refuseSecretLaunch("Secret Codex config value is unsupported", { actual: typeof value });
+}
+//#endregion
+//#region src/codex-app-server-adapter.ts
+const CODEX_PLAN_MCP_TOKEN_ENV = "TANGLE_INTERACTION_TOKEN";
+function appServerRawCapture(runtimeHome) {
+	return globalThis.process.getuid?.() === 0 && runtimeHome?.trim() ? { rawCapturePath: resolveRawCapturePath(runtimeHome.trim()) } : {};
+}
+var CodexAppServerAdapter = class extends CodexSecretProfileAdapter {
+	permissions = new InteractionBroker();
+	getCapabilities() {
+		const { interactive: permission, questions: question, plans: plan } = appServerPolicy(this.config);
+		return {
+			...super.getCapabilities(),
+			multimodal: !this.config.secretProfileRevisionRoot && !question && !plan,
+			interactions: [
+				...permission ? [InteractionKind.Permission] : [],
+				...question ? [InteractionKind.Question] : [],
+				...plan ? [InteractionKind.Plan] : []
+			]
+		};
+	}
+	async respondToInteraction(response) {
+		if (this.permissions.respond(response)) return;
+		this.permissions.respondQuestion(response);
+	}
+	async execute(input, services, onEvent) {
+		const nativeResume = input.nativeResume;
+		if (nativeResume) {
+			if (nativeResume.harness !== "codex" || input.planContinuation) throw new Error("Codex native resume requires Codex without plan continuation");
+			await this.seedNativeSessionForResume(input, nativeResume.nativeSessionId);
+		}
+		const { interactive, questions, plans } = appServerPolicy(this.config, input);
+		if (!this.config.secretProfileRevisionRoot && !interactive && !questions && !plans && !input.planContinuation) return super.execute(input, services, onEvent);
+		return this.withExecution(input.abortSignal, (signal) => this.executeViaAppServer({
+			...input,
+			abortSignal: signal
+		}, services, onEvent));
+	}
+	async executeViaAppServer(input, services, onEvent) {
+		const prepared = await this.prepareAppServerTurn(input, services, onEvent);
+		if (prepared.cached !== void 0) return prepared.cached;
+		const queue = this.config.secretProfileRevisionRoot ? secretSessionTurnQueue(this.secretProfileSessionView(prepared.sessionId).view) : void 0;
+		let bridge;
+		let result;
+		let closing;
+		const close = () => closing ??= this.closeAppServerTurn(prepared, bridge, queue);
+		prepared.run.cleanup = close;
+		try {
+			if (queue) await untilSettledOrAborted(queue.previous, input.abortSignal ?? new AbortController().signal);
+			bridge = await this.launchAppServerTurn(prepared);
+			result = await this.runAppServerTurn(prepared, bridge);
+		} finally {
+			if (!closing) await close();
+		}
+		await services.recorder.markTurnCompleted?.({ result });
+		onEvent?.({
+			type: "status",
+			status: "completed"
+		});
+		return result;
+	}
+	/** Capture session binding, profile/prompt and native callbacks before acquiring resources.
+	* Field construction stays one preparation record; launch/run/cleanup have separate owners. */
+	async prepareAppServerTurn(input, services, onEvent) {
+		this.ensureInitialized();
+		const opened = await this.openTurnSession({
+			...input,
+			sessionId: input.sessionId ?? input.interactionBinding?.sessionId
+		}, services.recorder, onEvent);
+		if (opened.cached) return { cached: opened.cached };
+		const { sessionId } = opened;
+		const interactionBinding = this.interactionExecutionBinding(input, sessionId);
+		const workspace = input.workspaceRoot ?? this.storagePath;
+		const { profilePlan } = await this.materializeTurnProfile(input, sessionId);
+		const { promptText } = await this.recordTurnPrompt(input, opened, services.recorder, {
+			nativeAttachmentKinds: [],
+			inlineImageBudgetBytes: 0
+		});
+		const connection = resolveCodexConnection(this.config, this.resolveProfileModel(input.model?.model) ?? this.config.model);
+		const policy = appServerPolicy(this.config, input);
+		const run = {
+			promptText,
+			cwd: workspace,
+			model: connection.model,
+			...policy
+		};
+		const turn = new CodexAppServerTurn({
+			sessionId,
+			messageId: opened.providerMessageIds?.assistantMessageId ?? randomUUID(),
+			input,
+			onEvent,
+			logger: this.logger,
+			plans: policy.plans,
+			onNativeSession: async (providerSessionId) => {
+				await this.getSessionStore().update(opened.sessionId, {
+					providerSessionId,
+					...this.config.runtimeHome ? { providerSessionHome: this.config.runtimeHome } : {}
+				});
+			}
+		});
+		turn.activeThreadId = initialThreadId(input) ?? opened.providerSessionId;
+		return {
+			releaseMcp: void 0,
+			input,
+			services,
+			onEvent,
+			sessionId,
+			profilePlan,
+			run,
+			policy,
+			turn,
+			interactionBinding
+		};
+	}
+	async launchAppServerTurn(context) {
+		const { input, profilePlan, run } = context;
+		const secret = this.config.secretProfileRevisionRoot && profilePlan ? await this.prepareSecretCodexTurn(input, profilePlan, context.sessionId) : void 0;
+		context.releaseMcp = secret?.release;
+		const env = secret?.env ?? this.buildAppServerEnv(profilePlan, run.cwd);
+		run.cwd = secret?.cwd ?? run.cwd;
+		const args = secret?.args ?? this.nativeArgs(input, profilePlan);
+		const extraMcp = await this.bindPlanMcp(context, args, env);
+		if (secret) run.initialize = async (initialized) => {
+			await secret.validate(initialized, extraMcp);
+			if (existsSync(join(run.cwd, ".codex/skills"))) await initialized.request("skills/extraRoots/set", { extraRoots: [join(run.cwd, ".codex/skills")] });
+		};
+		return this.spawnAppServer(input, {
+			args,
+			cwd: run.cwd,
+			env
+		});
+	}
+	spawnAppServer(input, launch) {
+		const { timeoutMs } = input;
+		const signal = AbortSignal.any([...input.abortSignal ? [input.abortSignal] : [], ...timeoutMs && timeoutMs > 0 ? [AbortSignal.timeout(timeoutMs)] : []]);
+		const started = performance.now();
+		const bridge = spawnRpcBridge({
+			...launch,
+			detached: true,
+			inheritEnv: this.inheritProcessEnv,
+			command: this.getCliPath(),
+			signal,
+			...this.subprocessSpawnOptions(),
+			isolatedIdentity: this.config.subprocessUser,
+			...appServerRawCapture(this.config.runtimeHome)
+		});
+		bridge.process?.once("spawn", () => this.logger.observePhase?.("cli_spawn", performance.now() - started));
+		return bridge;
+	}
+	async runAppServerTurn(context, bridge) {
+		const { turn, run, sessionId, services, onEvent, interactionBinding } = context;
+		registerAppServerInteractions(bridge, this.permissions, sessionId, interactionBinding, context.policy.interactive, context.policy.questions, onEvent);
+		const unsubscribe = turn.subscribe(bridge);
+		try {
+			const result = await turn.run(bridge, run);
+			await services.recorder.appendAssistantParts([{
+				id: randomUUID(),
+				type: "text",
+				text: result.text
+			}]);
+			await this.getMessageStore().append({
+				sessionId,
+				role: "assistant",
+				parts: [{
+					type: "text",
+					text: result.text
+				}]
+			});
+			return result;
+		} finally {
+			unsubscribe();
+		}
+	}
+	async closeAppServerTurn(context, bridge, queue) {
+		try {
+			await context.turn.planInteractions?.stop(context.sessionId);
+		} finally {
+			this.permissions.failSession(context.sessionId);
+			try {
+				await bridge?.close();
+			} finally {
+				await context.releaseMcp?.();
+			}
+			queue?.release();
+		}
+	}
+	async bindPlanMcp(context, args, env) {
+		if (!context.policy.plans) return {};
+		const { turn, sessionId, interactionBinding, services, onEvent } = context;
+		turn.planInteractions = new McpInteractionSupport(CODEX_PLAN_MCP_NAME, [InteractionKind.Plan]);
+		const planMcp = await turn.planInteractions.start(sessionId, interactionBinding, onEvent, {
+			planHost: services.planHost,
+			providerState: () => turn.planProviderState(),
+			onCommitted: (plan) => {
+				turn.submittedPlan = plan;
+			}
+		});
+		env[CODEX_PLAN_MCP_TOKEN_ENV] = planMcp.token;
+		args.push(...codexPlanMcpConfigArgs({
+			name: CODEX_PLAN_MCP_NAME,
+			tokenEnv: CODEX_PLAN_MCP_TOKEN_ENV,
+			url: planMcp.url
+		}));
+		return { [CODEX_PLAN_MCP_NAME]: {
+			url: planMcp.url,
+			bearer_token_env_var: CODEX_PLAN_MCP_TOKEN_ENV
+		} };
+	}
+};
+//#endregion
+//#region src/codex-exec-events.ts
+function mapCodexEventToStreamEvents(event, state, provider, logger) {
+	switch (event.type) {
+		case "session_started": return mapSessionStartedEvent(event, state);
+		case "thread.started": return mapThreadStartedEvent(event, state, provider);
+		case "message": return mapMessageEvent(event, state, logger);
+		case "item.started": return mapToolItem(event.item, state, false) ?? [{
+			type: "raw",
+			backend: provider,
+			event
+		}];
+		case "item.completed": return mapToolItem(event.item, state, true) ?? mapItemCompletedEvent(event, state, provider, logger);
+		case "turn.completed":
+			recordCliTokenUsage(state, event.usage);
+			return [{
+				type: "raw",
+				backend: provider,
+				event
+			}];
+		case "task_started": return mapTaskStartedEvent(event);
+		case "error": return mapErrorEvent(event);
+		default: return [{
+			type: "raw",
+			backend: provider,
+			event
+		}];
+	}
+}
+/**
+* A tool the agent ran, as `codex exec --json` reports it: an item that
+* starts and then completes. A completion without a start emits both.
+* Undefined for an item that is not a tool.
+*/
+function mapToolItem(item, state, completed) {
+	const call = codexToolCall(item);
+	if (!call) return void 0;
+	const events = state.toolCalls.has(call.id) ? [] : toolStartEvents(state, call);
+	if (!completed) return events;
+	const failed = item.status === "failed" || item.status === "declined" || typeof item.exit_code === "number" && item.exit_code !== 0 || item.error !== void 0 && item.error !== null;
+	return [...events, ...toolResultEvents(state, {
+		id: call.id,
+		content: item.aggregated_output ?? item.result ?? item.error ?? item.status,
+		isError: failed
+	})];
+}
+function codexToolCall(item) {
+	const id = item.id;
+	if (typeof id !== "string" || id.length === 0) return void 0;
+	switch (item.type) {
+		case "command_execution": return {
+			id,
+			name: "bash",
+			input: { command: item.command ?? "" }
+		};
+		case "mcp_tool_call":
+			if (!item.server && !item.tool) return void 0;
+			return {
+				id,
+				name: `mcp__${item.server ?? ""}__${item.tool ?? ""}`,
+				input: item.arguments ?? {}
+			};
+		case "web_search": return {
+			id,
+			name: "websearch",
+			input: { query: item.query ?? "" }
+		};
+		default: return;
+	}
+}
+function mapItemCompletedEvent(event, state, provider, logger) {
+	if (event.item?.type === "file_change") {
+		const fileEvents = mapFileChangeCompleted(event.item, state, logger);
+		if (fileEvents !== null) return fileEvents;
+		return [{
+			type: "raw",
+			backend: provider,
+			event
+		}];
+	}
+	if (event.item?.type !== "agent_message" || typeof event.item.text !== "string") return [{
+		type: "raw",
+		backend: provider,
+		event
+	}];
+	const nextText = event.item.text;
+	const previousLength = state.textBuffer.length;
+	const delta = nextText.startsWith(state.textBuffer) ? nextText.slice(previousLength) : void 0;
+	state.textBuffer = nextText;
+	state.textPartId ??= randomUUID();
+	return [{
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, state.textPartId),
+			type: "text",
+			text: state.textBuffer
+		},
+		...delta ? { delta } : {}
+	}];
+}
+function mapFileChangeCompleted(item, state, logger) {
+	if (!Array.isArray(item.changes)) {
+		logger.debug("file_change item.completed without a changes array", { itemId: item.id });
+		return null;
+	}
+	if (item.status !== void 0 && item.status !== "completed") return null;
+	const events = [];
+	for (const change of item.changes) {
+		if (typeof change?.path !== "string" || change.path.length === 0) {
+			logger.debug("malformed change in file_change item", { itemId: item.id });
+			continue;
+		}
+		if (change.kind == null) {
+			logger.debug("change without a kind in file_change item", {
+				itemId: item.id,
+				path: change.path
+			});
+			continue;
+		}
+		const tracked = trackFilePart(state, {
+			path: change.path,
+			changeKind: normalizeChangeKind(change.kind) ?? "update"
+		});
+		if (!tracked) continue;
+		events.push(filePartUpdated(state, tracked));
+	}
+	return events.length > 0 ? events : null;
+}
+function mapSessionStartedEvent(event, state) {
+	return [...sessionObservedEvents(state, "codex", event.session_id), {
+		type: "status",
+		status: "processing",
+		detail: "Session started"
+	}];
+}
+function mapThreadStartedEvent(event, state, provider) {
+	return [...sessionObservedEvents(state, "codex", event.thread_id), {
+		type: "raw",
+		backend: provider,
+		event
+	}];
+}
+function mapMessageEvent(event, state, logger) {
+	if (event.role !== "assistant" || !event.message.content) return [];
+	const events = [];
+	for (const block of event.message.content) events.push(...mapContentBlock(block, state, logger));
+	return events;
+}
+function mapContentBlock(block, state, logger) {
+	switch (block.type) {
+		case "text": return textDeltaEvents(state, block.text);
+		case "thinking": return reasoningEvents(state, block.thinking, { signalPhase: true });
+		case "tool_use": return toolStartEvents(state, block);
+		case "tool_result": return toolResultEvents(state, {
+			id: block.tool_use_id,
+			content: block.content,
+			isError: Boolean(block.is_error),
+			afterSuccess: (toolCall) => detectFileParts(toolCall, block.content, state, logger)
+		});
+		default: return [];
+	}
+}
+function detectFileParts(toolCall, raw, state, logger) {
+	const events = [];
+	if (!toolCall.name.startsWith("mcp__") || !Array.isArray(raw)) return events;
+	for (const block of raw) {
+		if (typeof block !== "object" || block === null || block.type !== "image") continue;
+		const { data, mimeType } = block;
+		if (typeof data !== "string" || typeof mimeType !== "string" || !/^[a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+$/.test(mimeType)) {
+			logger.debug("malformed image block in MCP tool result", { tool: toolCall.name });
+			continue;
+		}
+		const tracked = trackFilePart(state, {
+			dataUri: `data:${mimeType};base64,${data}`,
+			mediaType: mimeType
+		});
+		if (!tracked) continue;
+		events.push(filePartUpdated(state, tracked));
+	}
+	return events;
+}
+function mapTaskStartedEvent(event) {
+	return [{
+		type: "status",
+		status: "processing",
+		detail: `Task ${event.task_type ?? event.task_id} started`
+	}];
+}
+function mapErrorEvent(event) {
+	return [{
+		type: "warning",
+		code: event.code ?? "CODEX_ERROR",
+		message: event.message
+	}];
+}
+/** The complete emitted part for either native-path or MCP image observations. */
+function filePartUpdated(state, tracked) {
+	return {
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, tracked.id),
+			type: "file",
+			...tracked.filename ? { filename: tracked.filename } : {},
+			...tracked.mediaType ? { mediaType: tracked.mediaType } : {},
+			url: tracked.url
+		}
+	};
+}
+//#endregion
+//#region src/held-spare.ts
+/**
+* The Codex process started before the turn that uses it (the shared
+* mechanics are sdk-cli-runner held-spare.ts).
+*
+* `codex exec ... -` finishes its start (config, auth, model provider) and then
+* reads its prompt from stdin, so a process started with stdin held open does
+* that work ahead of the turn and takes the prompt the moment it arrives.
+* Codex requests carry no per-turn headers, so the turn's launch must equal
+* the spare's exactly: same argv, same environment.
+*/
+const codexHeldSpares = createHeldSpareRegistry();
+//#endregion
+//#region src/adapter.ts
+/** Type guard for Codex events. */
+function isCodexEvent(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return typeof value.type === "string";
+}
+/** Codex provider adapter. */
+var CodexProviderAdapter = class extends CodexAppServerAdapter {
+	provider = "codex";
+	profileHarness = "codex";
+	defaultCliPath = "codex";
+	/** Start the process the box's first turn will adopt: `codex exec` launched as an ordinary new-session managed turn. */
+	async prewarmProcess(workspaceRootOrUndefined, launch) {
+		this.ensureInitialized();
+		const refused = { ready: Promise.resolve(false) };
+		const home = this.config.runtimeHome?.trim();
+		if (!home || !codexWarmSwitchOn() || !isManagedModelToken(this.config.apiKey)) return refused;
+		const workspaceRoot = workspaceRootOrUndefined ?? this.storagePath;
+		const existing = codexHeldSpares.spareFor(home);
+		if (existing) return { ready: Promise.resolve(existing.state === "idle") };
+		const input = {
+			message: "",
+			systemPrompt: launch.systemPrompt,
+			workspaceRoot
+		};
+		if (this.resolveExecutionProfileForInput(input) || this.config.runtimeAttachments) return refused;
+		const config = withTurnInteractions(this.config, input);
+		if (routesPermissions(config) || routesQuestions(config) || codexRoutesPlans(config)) return refused;
+		const execArgs = this.buildExecArgs({
+			message: "",
+			config,
+			model: this.resolveProfileModel(void 0),
+			workspaceRoot,
+			systemPrompt: launch.systemPrompt
+		});
+		const env = this.buildTurnEnvironment(config, void 0, workspaceRoot, void 0);
+		const id = randomUUID();
+		const controller = new AbortController();
+		const parser = createDeferredParser();
+		const child = await super.spawnExecutionProcess({
+			input,
+			sessionId: id,
+			config,
+			execArgs,
+			workspaceRoot,
+			env,
+			signal: controller.signal,
+			parser: parser.config,
+			deferRawCapture: true
+		});
+		const spare = {
+			id,
+			home,
+			workspaceRoot,
+			args: execArgs.args,
+			env,
+			process: child,
+			parser,
+			controller,
+			startedAt: performance.now(),
+			state: "idle"
+		};
+		spare.idleTimer = setTimeout(() => {
+			this.logger.info("Held codex spare idle; stopping it", { home });
+			codexHeldSpares.stop(spare);
+		}, HELD_SPARE_IDLE_MS);
+		spare.idleTimer.unref();
+		codexHeldSpares.register(spare);
+		child.exitPromise.then(() => codexHeldSpares.stop(spare), () => codexHeldSpares.stop(spare));
+		this.logger.info("Held codex spare started", { home });
+		return { ready: Promise.resolve(child.pid !== void 0) };
+	}
+	/** A new session takes the spare in its HOME when its own launch is the spare's: the same. */
+	spawnExecutionProcess(request) {
+		const spare = codexHeldSpares.spareFor(this.config.runtimeHome?.trim());
+		if (!spare || spare.state !== "idle") return super.spawnExecutionProcess(request);
+		const differences = launchDifferences(spare, {
+			args: request.execArgs.args,
+			env: request.env
+		});
+		const reason = spare.workspaceRoot !== request.workspaceRoot ? "workspace" : !request.execArgs.useStdin ? "prompt-not-on-stdin" : request.timeoutMs !== void 0 ? "turn has a timeout" : differences.length > 0 ? `launch differs: ${differences.join(",")}` : void 0;
+		const own = () => super.spawnExecutionProcess(request);
+		if (reason) {
+			this.logger.info("Held codex spare not adopted", { reason });
+			codexHeldSpares.stop(spare);
+			return spare.process.exitPromise.then(own, own);
+		}
+		let adopted;
+		try {
+			adopted = codexHeldSpares.adopt(spare, request);
+		} catch (error) {
+			this.logger.info("Held codex spare not adopted", { reason: error instanceof Error ? error.message : String(error) });
+			return spare.process.exitPromise.then(own, own);
+		}
+		this.logger.observePhase?.("cli_ready_wait", 0);
+		this.logger.info("Held codex spare adopted", { heldMs: Math.round(performance.now() - spare.startedAt) });
+		return adopted;
+	}
+	createEventParser(state, onEvent) {
+		return jsonEventParser(this.logger, onEvent, {
+			label: "Codex",
+			accept: isCodexEvent,
+			map: (event) => this.mapEventToStreamEvents(event, state),
+			isReady: (event) => event.type === "thread.started"
+		});
+	}
+	buildMcpAddArgs(name, config) {
+		const args = [
+			"mcp",
+			"add",
+			name
+		];
+		if (config.type === "http" || config.type === "remote") {
+			args.push("--url", config.url);
+			if (config.headers?.Authorization) args.push("--bearer-token-env-var", "MCP_BEARER_TOKEN");
+		} else {
+			for (const [key, value] of Object.entries(localMcpEnv(config) ?? {})) args.push("--env", `${key}=${value}`);
+			args.push("--", ...localMcpArgv(config));
+		}
+		return args;
+	}
+	buildMcpListArgs() {
+		return ["mcp", "list"];
+	}
+	formatStdinMessage(message) {
+		return message;
+	}
+	mapEventToStreamEvents(event, state) {
+		return mapCodexEventToStreamEvents(event, state, this.provider, this.logger);
+	}
+};
+//#endregion
+export { CodexProviderAdapter, codexHeldSpares, normalizeExplicitCodexModel, resolveCodexApiKeyBaseUrl };
+
+//# sourceMappingURL=index.mjs.map