@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/server/routes/syncV3FeedRoutes.js

@@ -5,7 +5,7 @@ import { buildWorkspaceSyncV3InitiativeRepairPage, decodeWorkspaceSyncV3Initiati
 import { WORKSPACE_SYNC_V3_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3FeedProfile.js';
 import { isWorkspaceSyncV3InitiativeLegacyPushDisabled } from '../../sync/v3/planningActivation.js';
 import { WORKSPACE_SYNC_V3_COMBINED_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3CombinedCoverage.js';
-import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3TaskCoverRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
+import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3TaskCoverRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, decodeWorkspaceSyncV3WorkflowTaskCoverRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
 import { isWorkspaceSyncV3CombinedLegacyFenceEnabled } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
 import { resolveCombinedFeedCapability } from '../../sync/v3/combinedFeedCapability.js';
 import { resolveWorkspaceSyncV3RegisteredCoverage } from '../../sync/v3/workspaceSyncV3CoverageRegistry.js';
@@ -22,6 +22,9 @@ function json(res, status, body) {
     res.end(JSON.stringify(body));
 }
 function decodeCombinedRepairCursorForContract(rawCursor, keyring, wire) {
+    if (wire.taskCoverProjectionRequired && wire.workflowWriterPrerequisitesRequired) {
+        return decodeWorkspaceSyncV3WorkflowTaskCoverRepairCursor(rawCursor, keyring);
+    }
     if (wire.taskCoverProjectionRequired)
         return decodeWorkspaceSyncV3TaskCoverRepairCursor(rawCursor, keyring);
     if (wire.workflowWriterPrerequisitesRequired)
@@ -236,6 +239,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                 cursorKeyring: keyring, cursor, pageSize: Number.isFinite(limit) ? limit : undefined,
                 nestedCoverage: requestedWire.nestedWriterPrerequisitesRequired,
                 workflowCoverage: requestedWire.workflowWriterPrerequisitesRequired,
+                workflowTaskCoverCoverage: requestedWire.workflowWriterPrerequisitesRequired
+                    && requestedWire.taskCoverProjectionRequired,
                 planningOrderCoverage: requestedWire.planningOrderWriterPrerequisitesRequired,
                 taskCoverCoverage: requestedWire.taskCoverProjectionRequired });
             json(res, 200, attestLegacyPushBoundary({ ...page }, {
@@ -352,6 +357,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
+                        workflowTaskCoverCoverage: coverage.wire.workflowWriterPrerequisitesRequired
+                            && coverage.wire.taskCoverProjectionRequired,
                         planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
                         taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
                         coveredLegacyWritesFenced: combinedLegacyPushDisabled })
@@ -399,6 +406,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
+                        workflowTaskCoverCoverage: coverage.wire.workflowWriterPrerequisitesRequired
+                            && coverage.wire.taskCoverProjectionRequired,
                         planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
                         taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
                         coveredLegacyWritesFenced: combinedLegacyPushDisabled })

package/dist/server/routes/syncV3OperationRoutes.js

@@ -27,11 +27,11 @@ import { parseWorkspaceSyncV3OriginActor, } from '../../sync/v3/workspaceSyncV3O
 import { validateWorkspaceSyncV3TaskCommentReconcileProvenance, verifyWorkspaceSyncV3TaskCommentReconcileProvenance, } from '../../sync/v3/taskCommentReconcileProvenance.js';
 import { isStrongWorkspaceSyncV3OriginAssertionProfileToken, verifyWorkspaceSyncV3OriginAssertion, WORKSPACE_SYNC_V3_ORIGIN_ASSERTION_HEADER, workspaceSyncV3OriginAssertionBinding, } from '../../sync/v3/workspaceSyncV3OriginAssertion.js';
 import { validateWorkflowRuntimeMutationCommand } from '../../sync/v3/workflowRuntimeSync.js';
-import { resolveWorkflowRuntimeMutationCapability } from '../../sync/v3/durableWorkflowRuntimeMutationRouter.js';
-import { normalizeWorkflowAssignmentSyncRecord, WorkflowAssignmentSyncError, } from '../../sync/v3/workflowAssignmentSync.js';
+import { resolveWorkflowRuntimeDurableTransportCapability } from '../../sync/v3/durableWorkflowRuntimeMutationRouter.js';
+import { normalizeTaskStatusOperationWithWorkflowAssignment, WorkflowAssignmentSyncError, } from '../../sync/v3/workflowAssignmentSync.js';
 import { WorkflowAssignmentSyncConflictError } from '../../storage/workflowStore.js';
 import { DurableTaskCommentMutationError } from '../../sync/v3/taskCommentMutationService.js';
-import { DurableTaskChecklistMutationError } from '../../sync/v3/taskChecklistMutationService.js';
+import { DurableTaskChecklistMutationError, validateTaskChecklistItemUpdateIntent, } from '../../sync/v3/taskChecklistMutationService.js';
 import { DurableTaskAttachmentLinksMutationError } from '../../sync/v3/taskAttachmentLinksMutationService.js';
 import { validateWorkspaceSyncV3TaskAttachmentLinksPayload, validateWorkspaceSyncV3TaskChecklistPayload, validateWorkspaceSyncV3TaskCommentsPayload, } from '../../sync/v3/workspaceSyncV3NestedTaskCodecs.js';
 import { parseJsonBody } from './primitives.js';
@@ -368,6 +368,7 @@ export function parseWorkspaceSyncV3OperationEnvelope(body) {
         assertExactKeys(payload, [
             ...baseKeys,
             ...(payload.workflowAssignment === undefined ? [] : ['workflowAssignment']),
+            ...(payload.reviewHandoff === undefined ? [] : ['reviewHandoff']),
             ...(payload.originActor === undefined ? [] : ['originActor']),
             ...(payload.expectedDetailRevision === undefined ? [] : ['expectedDetailRevision']),
         ], 'operation.payload');
@@ -377,9 +378,8 @@ export function parseWorkspaceSyncV3OperationEnvelope(body) {
             canceledReason: payload.canceledReason,
             metadataPatch: payload.metadataPatch,
         });
-        const workflowAssignment = payload.workflowAssignment === undefined
-            ? undefined
-            : normalizeWorkflowAssignmentSyncRecord(payload.workflowAssignment);
+        const normalizedOperationPayload = normalizeTaskStatusOperationWithWorkflowAssignment(payload);
+        const workflowAssignment = normalizedOperationPayload.workflowAssignment;
         if (workflowAssignment
             && (normalizedPayload.status !== 'in-progress'
                 || workflowAssignment.execution.taskId !== entityId)) {
@@ -396,6 +396,9 @@ export function parseWorkspaceSyncV3OperationEnvelope(body) {
                 payload: {
                     ...normalizedPayload,
                     ...(workflowAssignment ? { workflowAssignment } : {}),
+                    ...(normalizedOperationPayload.reviewHandoff
+                        ? { reviewHandoff: normalizedOperationPayload.reviewHandoff }
+                        : {}),
                     ...(originActor ? { originActor } : {}),
                     ...(expectedDetailRevision ? { expectedDetailRevision } : {}),
                 },
@@ -460,7 +463,24 @@ export function parseWorkspaceSyncV3OperationEnvelope(body) {
         if (baseLifecycleRevision !== '0') {
             throw new SyncV3RequestError('Task checklist lifecycle revision must be 0.');
         }
-        assertExactKeys(payload, payload.originActor === undefined ? ['items'] : ['items', 'originActor'], 'operation.payload');
+        const expectedDetailRevision = payload.expectedDetailRevision === undefined
+            ? undefined
+            : requireId(payload.expectedDetailRevision, 'operation.payload.expectedDetailRevision');
+        let itemUpdateIntent;
+        try {
+            itemUpdateIntent = payload.itemUpdateIntent === undefined
+                ? undefined
+                : validateTaskChecklistItemUpdateIntent(payload.itemUpdateIntent);
+        }
+        catch (error) {
+            throw new SyncV3RequestError(error instanceof Error ? error.message : 'operation.payload.itemUpdateIntent is invalid.');
+        }
+        assertExactKeys(payload, [
+            'items',
+            ...(expectedDetailRevision === undefined ? [] : ['expectedDetailRevision']),
+            ...(itemUpdateIntent === undefined ? [] : ['itemUpdateIntent']),
+            ...(payload.originActor === undefined ? [] : ['originActor']),
+        ], 'operation.payload');
         let items;
         try {
             items = validateWorkspaceSyncV3TaskChecklistPayload({ taskId: entityId, items: payload.items }).items;
@@ -474,7 +494,12 @@ export function parseWorkspaceSyncV3OperationEnvelope(body) {
         return { ...common, operation: {
                 domain: 'task-checklist', entityId, mutationKind: 'replace', baseEntityRevision,
                 baseLifecycleRevision: '0',
-                payload: { items, ...(originActor ? { originActor } : {}) },
+                payload: {
+                    items,
+                    ...(expectedDetailRevision ? { expectedDetailRevision } : {}),
+                    ...(itemUpdateIntent ? { itemUpdateIntent } : {}),
+                    ...(originActor ? { originActor } : {}),
+                },
             } };
     }
     if (operation.domain === 'task-attachment-links' && operation.mutationKind === 'replace') {
@@ -730,7 +755,7 @@ export function registerWorkspaceSyncV3OperationRoutes(input) {
     const taxonomyEnabled = input.taxonomyEnabled ?? isWorkspaceSyncV3TaxonomyEnabled();
     const initiativeEnabled = input.initiativeEnabled ?? isWorkspaceSyncV3InitiativesEnabled();
     const workstreamEnabled = input.workstreamEnabled ?? isWorkspaceSyncV3WorkstreamsEnabled();
-    const workflowRuntimeEnabled = input.workflowRuntimeEnabled ?? resolveWorkflowRuntimeMutationCapability({
+    const workflowRuntimeEnabled = input.workflowRuntimeEnabled ?? resolveWorkflowRuntimeDurableTransportCapability({
         runtimeMode: 'cloud',
         surface: 'http',
         env: input.env,
@@ -1026,6 +1051,7 @@ export function registerWorkspaceSyncV3OperationRoutes(input) {
                     operationId: envelope.operationId,
                     errorCode: String(error?.code || 'POST_COMMIT_EFFECT_FAILED').slice(0, 100),
                 }),
+                includeWorkflowRuntimeJournal: workflowRuntimeEnabled,
             };
             const operationWasCommitted = Boolean(store.readCommittedOperationResponse({
                 tenantId: input.core.getTenantId(),

package/dist/server/routes/tasks.js

@@ -69,6 +69,7 @@ import { createDurableWorkstreamMutationRouter } from '../../sync/v3/durableWork
 import { createDurableWorkstreamTaskOrderMutationRouter } from '../../sync/v3/durableWorkstreamTaskOrderMutationRouter.js';
 import { serializeCanonicalPlanningAttachmentLinks } from '../../sync/planningCanonicalFields.js';
 import { createTaskHttpDurableRouters } from './durableTaskHttpRouters.js';
+import { WorkspaceSyncDurabilityStore } from '../../sync/v3/syncDurabilityStore.js';
 // === SECTION: Module dependency interface ===
 const UI_STATE_MAX_JSON_BODY_BYTES = 50 * 1024 * 1024;
 function normalizeDurableChecklistItems(input) {
@@ -534,8 +535,25 @@ export function registerTaskRoutes(deps) {
         if (!ensureAppAccess(req, res))
             return;
         const workspaceId = requestWorkspaceId(req);
+        const relationships = core.listTaskRelationshipsForSync(workspaceId);
+        const requestUrl = new URL(req.url || '', 'http://localhost');
+        const includeSyncCoordinates = requestUrl.searchParams.get('includeSyncCoordinates') === 'true';
+        const durabilityStore = includeSyncCoordinates
+            ? new WorkspaceSyncDurabilityStore(core.getDatabaseAdapter())
+            : null;
+        const syncCoordinates = durabilityStore
+            ? Object.fromEntries(relationships.map((relationship) => [
+                relationship.id,
+                durabilityStore.readEntityRevisionCoordinates({
+                    tenantId: core.getTenantId(),
+                    workspaceId,
+                    domain: 'task-relationship',
+                    entityId: relationship.id,
+                }),
+            ]))
+            : undefined;
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ relationships: core.listTaskRelationshipsForSync(workspaceId) }));
+        res.end(JSON.stringify({ relationships, ...(syncCoordinates ? { syncCoordinates } : {}) }));
     });
     const handleListDeletedTasks = async (req, res) => {
         if (!ensureAppAccess(req, res))
@@ -601,7 +619,8 @@ export function registerTaskRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ dataVersion }));
     });
-    // GET /api/taskforce/health - Lightweight readiness signal for API + DB
+    // GET /api/taskforce/health - Bounded, non-mutating readiness signal for API + DB.
+    // `/api/taskforce/version` remains the dependency-free process/build liveness signal.
     addRoute('GET', '/api/taskforce/health', async (req, res) => {
         const healthy = core.isDatabaseHealthy();
         const payload = {

package/dist/server/routes/workflows.js

@@ -8,7 +8,7 @@ import { WorkflowStore } from '../../storage/workflowStore.js';
 import { createDurableTaskHttpRootMutationRouter } from '../../sync/v3/durableTaskHttpRootMutationRouter.js';
 import { fingerprintWorkspaceSyncPayload, WorkspaceSyncDurabilityStore, } from '../../sync/v3/syncDurabilityStore.js';
 import { normalizeWorkflowAssignmentSyncRecord } from '../../sync/v3/workflowAssignmentSync.js';
-import { createDurableWorkflowRuntimeMutationRouter, resolveWorkflowRuntimeMutationCapability, } from '../../sync/v3/durableWorkflowRuntimeMutationRouter.js';
+import { areWorkflowRuntimeMutationsFenced, createDurableWorkflowRuntimeMutationRouter, resolveWorkflowRuntimeMutationCapability, } from '../../sync/v3/durableWorkflowRuntimeMutationRouter.js';
 import { parseJsonBody, resolveHttpErrorStatusCode } from './primitives.js';
 import { requestRuntimeMode } from './shared.js';
 function writeJson(res, statusCode, payload) {
@@ -94,6 +94,14 @@ export function registerWorkflowRoutes(deps) {
     const executionMutationGuard = (req, res) => {
         if (!guard(req, res))
             return false;
+        if (areWorkflowRuntimeMutationsFenced()) {
+            writeJson(res, 503, {
+                success: false,
+                error: 'Workflow execution changes are temporarily paused.',
+                code: 'WORKFLOW_RUNTIME_MUTATIONS_FENCED',
+            });
+            return false;
+        }
         return durableWorkflowHttpEnabled(req) || requireCloudRuntime(res, 'Workflow execution');
     };
     const workspaceIdFor = (req) => String(requestWorkspaceId(req) || '').trim() || 'default';

package/dist/server/routes.js

@@ -27,11 +27,15 @@ import { registerTaskRoutes } from './routes/tasks.js';
 import { registerWorkspaceRoutes } from './routes/workspaces.js';
 import { registerAuthRoutes } from './routes/auth.js';
 import { registerAdminRoutes } from './routes/admin.js';
+import { registerGitHubReviewEvidenceRoutes } from './routes/githubReviewEvidence.js';
+import { registerExecutorPhaseAApprovalRoutes } from './routes/executorPhaseAApprovals.js';
+import { registerExecutorPhaseAIssuerRedemptionRoutes } from './routes/executorPhaseAIssuerRedemptions.js';
 import { registerResourceRoutes } from './routes/resources.js';
 import { registerDocumentRoutes } from './routes/documents.js';
 import { registerDocumentReviewRoutes } from './routes/documentReviews.js';
 import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
 import { registerAgentsRoutes } from './routes/agents.js';
+import { registerModelConnectionsRoutes } from './routes/modelConnections.js';
 import { registerAgentRolesRoutes } from './routes/agentRoles.js';
 import { registerAgentSkillsRoutes } from './routes/agentSkills.js';
 import { registerWorkflowRoutes } from './routes/workflows.js';
@@ -40,6 +44,8 @@ import { createAgentRoleBehaviorReferenceResolver } from '../services/agentRoleR
 import { registerLocalMcpHealthRoutes } from './routes/localMcpHealth.js';
 import { registerLocalUpdateRoutes } from './routes/localUpdate.js';
 import { registerLocalServiceRoutes } from './routes/localService.js';
+import { createGitHubReviewEvidenceRuntime } from '../services/githubReviewEvidenceRuntime.js';
+import { createExecutorPhaseAApprovalRuntime } from '../services/executorPhaseAApprovalRuntime.js';
 import { escapeHtml } from './routes/primitives.js';
 import { getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, shouldExposeDevAuthTokens } from './routes/authSupport.js';
 import { requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, } from './routes/shared.js';
@@ -1443,6 +1449,51 @@ export function createRoutes(core, context = {}) {
         normalizeDocumentPathInput,
     });
     registerLocalServiceRoutes({ addRoute, core, context: context.localService });
+    const githubReviewEvidence = createGitHubReviewEvidenceRuntime(core);
+    registerGitHubReviewEvidenceRoutes({
+        addRoute,
+        store: githubReviewEvidence.store,
+        configured: githubReviewEvidence.configured,
+        inspectInstallation: (installationId) => githubReviewEvidence.verifier.inspectInstallation(installationId),
+        requestWorkspaceId,
+        requestRole,
+        resolveAuthenticatedUserId,
+        ensureAppAccess,
+        ensureWorkspaceAdminRole,
+        ensureAdminRole,
+        requireCloudRuntime,
+        auditAuthAction,
+    });
+    const executorPhaseAApprovals = createExecutorPhaseAApprovalRuntime(core);
+    registerExecutorPhaseAApprovalRoutes({
+        addRoute,
+        service: executorPhaseAApprovals.service,
+        requireCloudRuntime,
+        ensureAppAccess,
+        resolveHumanSystemAdminActor: (req) => {
+            if (!context.authConfig?.enabled)
+                return null;
+            const access = resolveRequestAccess(req, context.authConfig);
+            if (!access.authenticated || !access.userId || access.userId === 'anonymous')
+                return null;
+            return core.getSystemRole(access.userId) === 'system_admin' ? access.userId : null;
+        },
+        hasActiveWorkspaceMembership: (workspaceId, userId) => core.listWorkspaceUsers(workspaceId).some((membership) => (String(membership.userId || '').trim() === userId
+            && String(membership.status || '').trim().toLowerCase() === 'active'
+            && membership.disabled !== true)),
+        auditAuthAction,
+        workspaceId: executorPhaseAApprovals.policy.workspaceId,
+        allowedOrigin: executorPhaseAApprovals.policy.issuer,
+        performanceEnvironment: resolveDeploymentConfig(process.env).cloudEnvironment === 'performance',
+    });
+    registerExecutorPhaseAIssuerRedemptionRoutes({
+        addRoute,
+        requireCloudRuntime,
+        performanceEnvironment: resolveDeploymentConfig(process.env).cloudEnvironment === 'performance',
+        featureEnabled: String(process.env.TASKFORCE_PHASE_A_ISSUER_REDEMPTION_ENABLED || '').trim().toLowerCase() === 'true',
+        auditAuthAction,
+        workspaceId: executorPhaseAApprovals.policy.workspaceId,
+    });
     registerAdminRoutes({
         addRoute,
         core,
@@ -1452,6 +1503,7 @@ export function createRoutes(core, context = {}) {
         requestRole,
         ensureAppAccess,
         ensureAdminRole,
+        ensureWorkspaceAdminRole,
         ensureCloudPlanData,
         requireCloudRuntime,
         resolveAuthenticatedUserId,
@@ -1565,6 +1617,13 @@ export function createRoutes(core, context = {}) {
             resolveBehaviorReference: createAgentRoleBehaviorReferenceResolver(new AgentRoleStore(core.getDatabaseAdapter(), core.getTenantId()), workspaceId),
         }),
     });
+    registerModelConnectionsRoutes({
+        addRoute,
+        ensureAppAccess,
+        core,
+        resolveAuthenticatedUserId,
+        resolveRuntimeMode: (req) => (context.authConfig?.runtimeMode === 'cloud' ? 'cloud' : requestRuntimeMode(req)),
+    });
     registerAgentRolesRoutes({
         addRoute,
         ensureAppAccess,

package/dist/service/localServiceCli.d.ts

@@ -1,4 +1,4 @@
-import { createStandaloneServer } from '../server/index.js';
+import type { StandaloneServerOptions, TaskforceStandaloneServer } from '../server/index.js';
 import { inspectLocalServiceDescriptor } from '../server/localServiceLease.js';
 import { acquireLocalServiceOwnershipForRuntime } from '../server/localServiceOwnershipBootstrap.js';
 import { type SqliteWalHolder } from '../storage/sqliteWalHealth.js';
@@ -18,7 +18,7 @@ export interface LocalServiceCliOptions {
     executablePath: string;
     cliEntryPath: string;
     execArgv?: readonly string[];
-    createServer?: typeof createStandaloneServer;
+    createServer?: (options: StandaloneServerOptions) => TaskforceStandaloneServer;
     acquireOwnership?: typeof acquireLocalServiceOwnershipForRuntime;
     inspectDescriptor?: typeof inspectLocalServiceDescriptor;
     spawnDetached?: (executablePath: string, args: readonly string[], env: NodeJS.ProcessEnv) => void;

package/dist/service/localServiceCli.js

@@ -2,7 +2,6 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { applyLocalServiceCloudTarget, localServiceCloudTargetsEqual, parseLocalServiceCloudTarget, resolveLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
 import { localServiceRuntimeContractsEqual, parseLocalServiceRuntimeContract, resolveLocalServiceRuntimeContract, } from '../config/localServiceRuntimeContract.js';
-import { createStandaloneServer } from '../server/index.js';
 import { inspectLocalServiceDescriptor, redactLocalServiceDescriptor, } from '../server/localServiceLease.js';
 import { acquireLocalServiceOwnershipForRuntime, } from '../server/localServiceOwnershipBootstrap.js';
 import { discoverOrStartLocalService, LOCAL_SERVICE_API_BASE_PATH, LOCAL_SERVICE_PROTOCOL_VERSION, resolveLocalServiceLeaseInput, spawnDetachedLocalService, waitForLocalServiceDescriptor, } from './localServiceClientLifecycle.js';
@@ -126,7 +125,9 @@ async function runForeground(command, options) {
         });
     };
     try {
-        server = options.createServer({
+        const createServer = options.createServer
+            || (await import('../server/index.js')).createStandaloneServer;
+        server = createServer({
             projectRoot: command.projectRoot,
             port: 0,
             localSyncProcessLock: ownership.syncProcessLock || undefined,
@@ -370,7 +371,7 @@ export async function runLocalServiceCli(argv, input) {
         executablePath: input.executablePath,
         cliEntryPath: input.cliEntryPath,
         execArgv: input.execArgv || [],
-        createServer: input.createServer || createStandaloneServer,
+        createServer: input.createServer,
         acquireOwnership: input.acquireOwnership || acquireLocalServiceOwnershipForRuntime,
         inspectDescriptor: input.inspectDescriptor || inspectLocalServiceDescriptor,
         spawnDetached: input.spawnDetached || spawnDetachedLocalService,

package/dist/services/codexAppServerModelGateway.d.ts

@@ -1,5 +1,27 @@
 import type { ModelGateway, ModelGatewayGenerateInput, ModelGatewayGenerateResult } from './modelGateway.js';
+export declare const PINNED_CODEX_APP_SERVER_VERSION = "0.148.0-alpha.9";
+export declare class CodexAppServerCompatibilityError extends Error {
+    readonly reason: 'version' | 'credential_home';
+    constructor(reason: 'version' | 'credential_home', message: string);
+}
+export declare function resolveBundledCodexCommand(): string;
+export declare function assertCodexAppServerCompatibility(result: unknown, expectedCodexHome?: string): void;
 export type CodexAppServerModelKeyIdMap = Partial<Record<string, string>>;
+export interface CodexDeviceCodeLoginStart {
+    loginId: string;
+    userCode: string;
+    verificationUrl: string;
+}
+export interface CodexAccountSnapshot {
+    type: string;
+    email?: string;
+    planType?: string;
+}
+export interface CodexAccountLoginCompletion {
+    loginId: string;
+    success: boolean;
+    error?: string;
+}
 type CodexAppServerApprovalPolicy = 'never';
 type CodexAppServerSandboxMode = 'read-only';
 type CodexAppServerSandboxPolicy = {
@@ -15,6 +37,15 @@ type CodexAppServerRuntimePolicy = {
 export interface CodexAppServerClient {
     initialize(): Promise<void>;
     assertChatGptSubscriptionAuth(): Promise<void>;
+    startChatGptDeviceCodeLogin(): Promise<CodexDeviceCodeLoginStart>;
+    waitForAccountLoginCompleted(input: {
+        loginId: string;
+        timeoutMs: number;
+        signal?: AbortSignal;
+    }): Promise<CodexAccountLoginCompletion>;
+    cancelAccountLogin(loginId: string): Promise<'canceled' | 'notFound'>;
+    readAccount(refreshToken?: boolean): Promise<CodexAccountSnapshot | null>;
+    logoutAccount(): Promise<void>;
     startThread(input: {
         model: string;
         developerInstructions?: string;
@@ -30,7 +61,7 @@ export interface CodexAppServerClient {
         text: string;
         stopReason?: string;
     }>;
-    close(): void;
+    close(): Promise<void>;
 }
 export interface CodexAppServerModelGatewayOptions {
     client?: CodexAppServerClient;
@@ -42,14 +73,16 @@ export interface CodexAppServerModelGatewayOptions {
     modelKeyIds?: CodexAppServerModelKeyIdMap;
     timeoutMs?: number;
     requestTimeoutMs?: number;
+    credentialPaths?: string[];
 }
 export declare const DEFAULT_CODEX_APP_SERVER_MODEL_KEY_IDS: CodexAppServerModelKeyIdMap;
 export declare function buildCodexAppServerEnv(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-export declare function sanitizeCodexAppServerStderr(value: unknown): string;
+export declare function sanitizeCodexAppServerStderr(value: unknown, credentialPaths?: string[]): string;
 export declare function collectCodexAppServerStderr(current: string, chunk: unknown): string;
 export declare function assertCodexChatGptSubscriptionAccount(result: unknown): void;
+export declare function extractCodexAccountLoginCompletion(messages: unknown[], loginId: string, credentialPaths?: string[]): CodexAccountLoginCompletion | null;
 export declare function isCodexSubscriptionDevRuntimeAllowed(source?: NodeJS.ProcessEnv): boolean;
-export declare function extractCodexTurnCompletion(messages: unknown[]): {
+export declare function extractCodexTurnCompletion(messages: unknown[], credentialPaths?: string[]): {
     text: string;
     stopReason: string;
 } | null;
@@ -61,18 +94,33 @@ export declare class CodexAppServerJsonRpcClient implements CodexAppServerClient
     private initialized;
     private readonly lineReader;
     private readonly requestTimeoutMs;
-    private readonly turnRejectors;
+    private readonly terminalRejectors;
+    private readonly loginNotificationStart;
     private terminalError;
     private stderrTail;
+    private readonly credentialPaths;
+    private readonly expectedCodexHome;
+    private readonly processExited;
+    private closePromise;
     constructor(options?: {
         command?: string;
         args?: string[];
         cwd?: string;
         env?: NodeJS.ProcessEnv;
         requestTimeoutMs?: number;
+        credentialPaths?: string[];
     });
     initialize(): Promise<void>;
     assertChatGptSubscriptionAuth(): Promise<void>;
+    startChatGptDeviceCodeLogin(): Promise<CodexDeviceCodeLoginStart>;
+    waitForAccountLoginCompleted(input: {
+        loginId: string;
+        timeoutMs: number;
+        signal?: AbortSignal;
+    }): Promise<CodexAccountLoginCompletion>;
+    cancelAccountLogin(loginId: string): Promise<'canceled' | 'notFound'>;
+    readAccount(refreshToken?: boolean): Promise<CodexAccountSnapshot | null>;
+    logoutAccount(): Promise<void>;
     startThread(input: {
         model: string;
         developerInstructions?: string;
@@ -89,12 +137,13 @@ export declare class CodexAppServerJsonRpcClient implements CodexAppServerClient
         text: string;
         stopReason?: string;
     }>;
-    close(): void;
+    close(): Promise<void>;
     private request;
     private sendNotification;
     private handleLine;
     private sendResponseError;
     private waitForTurnCompletion;
+    private waitForNotification;
     private rejectAll;
     private fail;
 }