@tumnel/codex 0.1.1

package/dist/cli.js

@@ -0,0 +1,1911 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Codex } from "@openai/codex-sdk";
+
+// src/codex-adapter.ts
+import { z as z2 } from "zod";
+
+// src/codex-sessions.ts
+import { createHash, randomBytes } from "crypto";
+import { createReadStream } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { readFile, readdir, stat } from "fs/promises";
+import { z } from "zod";
+var sessionMetaSchema = z.object({
+  type: z.literal("session_meta"),
+  payload: z.object({
+    session_id: z.string().min(1).optional(),
+    id: z.string().min(1).optional(),
+    cwd: z.string().min(1).optional(),
+    timestamp: z.string().optional(),
+    cli_version: z.string().min(1).optional()
+  }).passthrough()
+});
+function defaultSessionsDir(environment = process.env) {
+  const root = environment.CODEX_HOME ?? join(homedir(), ".codex");
+  return join(root, "sessions");
+}
+function projectId(directory) {
+  const hash = createHash("sha256").update(directory.toLowerCase()).digest("base64url").slice(0, 12);
+  return `project_${hash}`;
+}
+function createSessionId() {
+  return `codex_${randomBytes(9).toString("base64url")}`;
+}
+function createMessageId(record) {
+  record.messageIndex += 1;
+  return `message_${record.messageIndex}`;
+}
+async function readFirstLine(path) {
+  return new Promise((resolve) => {
+    const stream = createReadStream(path, { encoding: "utf8", highWaterMark: 64 * 1024 });
+    let buffer = "";
+    stream.on("data", (chunk) => {
+      buffer += chunk;
+      const newline = buffer.indexOf("\n");
+      if (newline !== -1) {
+        stream.destroy();
+        resolve(buffer.slice(0, newline));
+        return;
+      }
+      if (buffer.length > 512 * 1024) {
+        stream.destroy();
+        resolve(buffer);
+        return;
+      }
+    });
+    stream.on("error", () => resolve(null));
+    stream.on("end", () => resolve(buffer.length ? buffer : null));
+  });
+}
+async function readRolloutTitle(path, fallback) {
+  let source;
+  try {
+    source = await readFile(path, "utf8");
+  } catch {
+    return fallback;
+  }
+  let title = fallback;
+  for (const line of source.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const outer = JSON.parse(line);
+      const payload = asRecord(outer.payload);
+      if (stringValue(payload?.type) !== "thread_name_updated") continue;
+      title = stringValue(payload?.thread_name) ?? title;
+    } catch {
+    }
+  }
+  return title;
+}
+async function walkRollouts(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const results = [];
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) results.push(...await walkRollouts(path));
+    else if (entry.isFile() && entry.name.endsWith(".jsonl")) results.push(path);
+  }
+  return results;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function timestampValue(value, fallback) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string") {
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return fallback;
+}
+function textFromValue(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    const text = value.map((item) => textFromValue(item)).filter((item) => item !== null).join("");
+    return text || null;
+  }
+  const record = asRecord(value);
+  if (!record) return null;
+  for (const key of ["text", "message", "content", "output_text"]) {
+    const text = textFromValue(record[key]);
+    if (text !== null) return text;
+  }
+  return null;
+}
+function parseJsonValue(value) {
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function historyMessageId(sessionId, index) {
+  return `history_${sessionId}_${index}`;
+}
+function historyPartId(sessionId, index, partIndex) {
+  return `history_${sessionId}_${index}_${partIndex}`;
+}
+function createHistoryMessage(sessionId, index, role, created) {
+  return {
+    info: {
+      id: historyMessageId(sessionId, index),
+      sessionID: sessionId,
+      role,
+      time: { created, completed: role === "assistant" ? created : void 0 }
+    },
+    parts: []
+  };
+}
+function addHistoryText(message, sessionId, partIndex, type, text) {
+  if (!text.trim()) return;
+  message.parts.push({
+    id: historyPartId(sessionId, Number(message.info.id.split("_").at(-1) ?? 0), partIndex),
+    sessionID: sessionId,
+    messageID: message.info.id,
+    type,
+    text
+  });
+}
+function localFileUrl(value) {
+  const path = stringValue(value);
+  if (!path) return null;
+  return path.startsWith("file://") ? path : `file://${path}`;
+}
+async function readRolloutHistory(path, sessionId) {
+  let source;
+  let updated = 0;
+  try {
+    source = await readFile(path, "utf8");
+    updated = (await stat(path)).mtimeMs;
+  } catch {
+    return { messages: [], title: "(untitled session)", updated };
+  }
+  const messages = [];
+  const toolParts = /* @__PURE__ */ new Map();
+  let title = "(untitled session)";
+  let messageIndex = 0;
+  let lastAssistant = null;
+  const ensureAssistant = (created) => {
+    if (lastAssistant) return lastAssistant;
+    const message = createHistoryMessage(sessionId, messageIndex++, "assistant", created);
+    messages.push(message);
+    lastAssistant = message;
+    return message;
+  };
+  for (const line of source.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    let outer;
+    try {
+      outer = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const payload = asRecord(outer.payload);
+    if (!payload) continue;
+    const type = stringValue(payload.type);
+    const created = timestampValue(outer.timestamp, updated || Date.now());
+    if (type === "user_message") {
+      const text = stringValue(payload.message);
+      const message = createHistoryMessage(sessionId, messageIndex++, "user", created);
+      if (text) addHistoryText(message, sessionId, 0, "text", text);
+      const localImages = Array.isArray(payload.local_images) ? payload.local_images : [];
+      for (const [index, image] of localImages.entries()) {
+        const url = localFileUrl(image);
+        if (!url) continue;
+        message.parts.push({
+          id: historyPartId(sessionId, Number(message.info.id.split("_").at(-1) ?? 0), index + 1),
+          sessionID: sessionId,
+          messageID: message.info.id,
+          type: "file",
+          url
+        });
+      }
+      if (message.parts.length) messages.push(message);
+      lastAssistant = null;
+      continue;
+    }
+    if (type === "agent_message") {
+      const text = stringValue(payload.message);
+      if (!text) continue;
+      const message = createHistoryMessage(sessionId, messageIndex++, "assistant", created);
+      addHistoryText(message, sessionId, Number(message.info.id.split("_").at(-1) ?? 0), "text", text);
+      messages.push(message);
+      lastAssistant = message;
+      continue;
+    }
+    if (type === "reasoning") {
+      const text = textFromValue(payload.summary) ?? textFromValue(payload.content);
+      if (!text) continue;
+      const message = ensureAssistant(created);
+      addHistoryText(message, sessionId, message.parts.length, "reasoning", text);
+      continue;
+    }
+    if (type === "thread_name_updated") {
+      title = stringValue(payload.thread_name) ?? title;
+      continue;
+    }
+    if (type === "function_call" || type === "custom_tool_call") {
+      const message = ensureAssistant(created);
+      const callId = stringValue(payload.call_id) ?? `${sessionId}:${message.parts.length}`;
+      const name = stringValue(payload.name) ?? (type === "function_call" ? "function" : "tool");
+      const input = parseJsonValue(payload.arguments ?? payload.input);
+      const part = {
+        id: `history_${callId}`,
+        sessionID: sessionId,
+        messageID: message.info.id,
+        type: "tool",
+        tool: name,
+        state: {
+          status: "running",
+          title: name,
+          input: { arguments: input }
+        }
+      };
+      message.parts.push(part);
+      toolParts.set(callId, part);
+      continue;
+    }
+    if (type === "function_call_output" || type === "custom_tool_call_output") {
+      const callId = stringValue(payload.call_id);
+      if (!callId) continue;
+      const part = toolParts.get(callId);
+      if (!part) continue;
+      const state = asRecord(part.state) ?? {};
+      part.state = {
+        ...state,
+        status: "completed",
+        output: payload.output ?? payload.result ?? null
+      };
+      continue;
+    }
+    if (type === "exec_command_end") {
+      const callId = stringValue(payload.call_id);
+      const part = callId ? toolParts.get(callId) : void 0;
+      if (!part) continue;
+      const state = asRecord(part.state) ?? {};
+      part.state = {
+        ...state,
+        status: payload.exit_code === 0 ? "completed" : "error",
+        ...payload.aggregated_output !== void 0 ? { output: payload.aggregated_output } : {}
+      };
+    }
+  }
+  for (const message of messages) {
+    if (message.info.role === "assistant") {
+      message.info.time.completed ??= updated || message.info.time.created;
+    }
+  }
+  return { messages, title, updated };
+}
+async function discoverSessions(sessionsDir) {
+  const rollouts = await walkRollouts(sessionsDir);
+  const sessions = [];
+  for (const path of rollouts) {
+    const line = await readFirstLine(path);
+    if (!line) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const result = sessionMetaSchema.safeParse(parsed);
+    if (!result.success) continue;
+    const meta = result.data.payload;
+    const id = meta.session_id ?? meta.id;
+    if (!id || !meta.cwd) continue;
+    const created = meta.timestamp ? Date.parse(meta.timestamp) : NaN;
+    let mtime = created;
+    try {
+      const info = await stat(path);
+      mtime = info.mtimeMs;
+    } catch {
+      mtime = Number.isFinite(created) ? created : 0;
+    }
+    sessions.push({
+      id,
+      directory: meta.cwd,
+      version: meta.cli_version ?? "unknown",
+      created: Number.isFinite(created) ? created : mtime,
+      updated: mtime,
+      title: await readRolloutTitle(path, "(untitled session)"),
+      rolloutPath: path
+    });
+  }
+  return sessions;
+}
+var CodexSessionStore = class {
+  constructor(sessionsDir = defaultSessionsDir()) {
+    this.sessionsDir = sessionsDir;
+  }
+  sessionsDir;
+  records = /* @__PURE__ */ new Map();
+  discoveryCache = {
+    at: 0,
+    byDirectory: /* @__PURE__ */ new Map()
+  };
+  create(input) {
+    const now = Date.now();
+    const record = {
+      id: input.id,
+      projectID: projectId(input.directory),
+      directory: input.directory,
+      title: input.title ?? "(untitled session)",
+      version: input.version,
+      created: now,
+      updated: now,
+      thread: input.thread ?? null,
+      codexThreadId: input.codexThreadId ?? null,
+      model: input.model,
+      busy: false,
+      failed: false,
+      messages: input.messages ?? [],
+      messageIndex: input.messages?.length ?? 0
+    };
+    this.records.set(record.id, record);
+    return record;
+  }
+  get(id) {
+    return this.records.get(id);
+  }
+  has(id) {
+    return this.records.has(id);
+  }
+  list(directory) {
+    const all = [...this.records.values()];
+    return directory ? all.filter((record) => samePath(record.directory, directory)) : all;
+  }
+  remove(id) {
+    return this.records.delete(id);
+  }
+  touch(id) {
+    const record = this.records.get(id);
+    if (record) record.updated = Date.now();
+  }
+  async refreshDiscovery() {
+    const now = Date.now();
+    if (this.discoveryCache.at !== 0 && now - this.discoveryCache.at <= 3e4) return;
+    const discovered = await discoverSessions(this.sessionsDir);
+    const byDirectory = /* @__PURE__ */ new Map();
+    for (const session of discovered) {
+      const list = byDirectory.get(session.directory) ?? [];
+      list.push(session);
+      byDirectory.set(session.directory, list);
+    }
+    this.discoveryCache.at = now;
+    this.discoveryCache.byDirectory = byDirectory;
+  }
+  async discoverAll(directory) {
+    await this.refreshDiscovery();
+    return directory ? [...this.discoveryCache.byDirectory.entries()].filter(([dir]) => samePath(dir, directory)).flatMap(([, sessions]) => sessions) : [...this.discoveryCache.byDirectory.values()].flat();
+  }
+  async discover(directory) {
+    const matching = await this.discoverAll(directory);
+    const liveThreadIds = new Set(
+      [...this.records.values()].map((record) => record.codexThreadId).filter((id) => Boolean(id))
+    );
+    return matching.filter((session) => !liveThreadIds.has(session.id));
+  }
+  async loadHistory(sessionId, directory) {
+    const discovered = (await this.discoverAll(directory)).find((session) => session.id === sessionId);
+    if (!discovered) return null;
+    return readRolloutHistory(discovered.rolloutPath, discovered.id);
+  }
+  directories() {
+    const directories = new Set(this.list().map((record) => record.directory));
+    for (const session of this.discoveryCache.byDirectory.values()) {
+      for (const record of session) directories.add(record.directory);
+    }
+    return [...directories];
+  }
+};
+function samePath(left, right) {
+  if (process.platform === "win32") return left.toLowerCase() === right.toLowerCase();
+  return left === right;
+}
+
+// src/safe-json.ts
+var sensitiveKey = /(?:api[-_]?key|access[-_]?token|refresh[-_]?token|authorization|credential|password|private[-_]?key|secret)/i;
+function toSafeJson(value) {
+  return visit(value, /* @__PURE__ */ new WeakSet(), 0);
+}
+function visit(value, seen, depth) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") return Number.isFinite(value) ? value : String(value);
+  if (typeof value === "bigint") return value.toString();
+  if (typeof value === "undefined" || typeof value === "function" || typeof value === "symbol") {
+    return null;
+  }
+  if (depth >= 30) return "[Maximum depth reached]";
+  if (value instanceof Date) return value.toISOString();
+  if (value instanceof Error) {
+    return { name: value.name, message: value.message };
+  }
+  if (ArrayBuffer.isView(value)) {
+    return `[${value.constructor.name} omitted]`;
+  }
+  if (value instanceof ArrayBuffer) return "[ArrayBuffer omitted]";
+  if (typeof value !== "object") return String(value);
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const result2 = value.map((entry) => visit(entry, seen, depth + 1));
+    seen.delete(value);
+    return result2;
+  }
+  const result = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (sensitiveKey.test(key)) {
+      result[key] = "[REDACTED]";
+      continue;
+    }
+    if (typeof entry === "undefined" || typeof entry === "function" || typeof entry === "symbol") continue;
+    result[key] = visit(entry, seen, depth + 1);
+  }
+  seen.delete(value);
+  return result;
+}
+
+// src/codex-adapter.ts
+var directorySchema = z2.string().min(1).max(4096).optional();
+var emptyParamsSchema = z2.object({}).strict();
+var projectListSchema = z2.object({ directory: z2.string().max(4096).optional() }).strict();
+var sessionListSchema = z2.object({ directory: directorySchema }).strict();
+var sessionCreateSchema = z2.object({
+  directory: directorySchema,
+  parentID: z2.string().min(1).max(256).optional(),
+  title: z2.string().min(1).max(512).optional()
+}).strict();
+var sessionForkSchema = z2.object({
+  sessionId: z2.string().min(1).max(256),
+  directory: directorySchema,
+  messageID: z2.string().min(1).max(256).optional(),
+  title: z2.string().min(1).max(512).optional()
+}).strict();
+var sessionDeleteSchema = z2.object({
+  sessionId: z2.string().min(1).max(256),
+  directory: directorySchema
+}).strict();
+var sessionStatusSchema = z2.object({ directory: directorySchema }).strict();
+var sessionMessagesSchema = z2.object({
+  sessionId: z2.string().min(1).max(256),
+  directory: directorySchema,
+  limit: z2.number().int().positive().max(1e3).optional()
+}).strict();
+var textPartSchema = z2.object({
+  type: z2.literal("text"),
+  text: z2.string().max(1e6)
+}).strict();
+var filePartSchema = z2.object({
+  type: z2.literal("file"),
+  mime: z2.string().min(1).max(256),
+  filename: z2.string().min(1).max(1024).optional(),
+  url: z2.string().min(1).max(8e6)
+}).strict();
+var sessionPromptSchema = z2.object({
+  sessionId: z2.string().min(1).max(256),
+  directory: directorySchema,
+  messageID: z2.string().min(1).max(256).optional(),
+  model: z2.object({
+    providerID: z2.string().min(1).max(128),
+    modelID: z2.string().min(1).max(256)
+  }).strict().optional(),
+  agent: z2.string().min(1).max(128).optional(),
+  variant: z2.string().min(1).max(128).optional(),
+  noReply: z2.boolean().optional(),
+  system: z2.string().max(1e5).optional(),
+  tools: z2.record(z2.string().min(1).max(128), z2.boolean()).optional(),
+  parts: z2.array(z2.union([textPartSchema, filePartSchema])).min(1).max(100)
+}).strict();
+var sessionAbortSchema = z2.object({
+  sessionId: z2.string().min(1).max(256),
+  directory: directorySchema
+}).strict();
+var permissionReplySchema = z2.object({
+  sessionId: z2.string().min(1).max(256),
+  permissionId: z2.string().min(1).max(256),
+  directory: directorySchema,
+  response: z2.enum(["once", "always", "reject"])
+}).strict();
+var providerListSchema = z2.object({ directory: directorySchema }).strict();
+var agentListSchema = z2.object({ directory: directorySchema }).strict();
+var permissionListSchema = z2.object({
+  directory: directorySchema,
+  sessionId: z2.string().min(1).max(256).optional()
+}).strict();
+var questionListSchema = z2.object({
+  directory: directorySchema,
+  sessionId: z2.string().min(1).max(256).optional()
+}).strict();
+var questionReplySchema = z2.object({
+  requestId: z2.string().min(1).max(256),
+  directory: directorySchema,
+  answers: z2.array(z2.array(z2.string().trim().min(1).max(8e3)).min(1).max(32)).min(1).max(32)
+}).strict();
+var questionRejectSchema = z2.object({
+  requestId: z2.string().min(1).max(256),
+  directory: directorySchema
+}).strict();
+var EventBus = class {
+  queue = [];
+  wake = null;
+  push(event) {
+    this.queue.push(event);
+    this.wake?.();
+    this.wake = null;
+  }
+  async *stream(signal) {
+    while (!signal.aborted) {
+      const next = this.queue.shift();
+      if (next !== void 0) {
+        yield toSafeJson(next);
+        continue;
+      }
+      await new Promise((resolve) => {
+        const done = () => {
+          signal.removeEventListener("abort", done);
+          this.wake = null;
+          resolve();
+        };
+        signal.addEventListener("abort", done, { once: true });
+        this.wake = done;
+      });
+    }
+  }
+};
+function errorMessage(error) {
+  const message = error instanceof Error ? error.message : "Codex request failed";
+  return message.slice(0, 512);
+}
+function sessionView(record) {
+  return {
+    id: record.id,
+    projectID: record.projectID,
+    directory: record.directory,
+    title: record.title,
+    version: record.version,
+    time: { created: record.created, updated: record.updated }
+  };
+}
+function discoveredSessionView(session) {
+  return {
+    id: session.id,
+    projectID: projectId(session.directory),
+    directory: session.directory,
+    title: session.title,
+    version: session.version,
+    time: { created: session.created, updated: session.updated }
+  };
+}
+function buildUserMessage(record, parts, now = Date.now()) {
+  const info = {
+    id: createMessageId(record),
+    sessionID: record.id,
+    role: "user",
+    time: { created: now }
+  };
+  const messageParts = [];
+  for (const [index, part] of parts.entries()) {
+    if (part.type === "text") {
+      messageParts.push({
+        id: `${info.id}_${index}`,
+        sessionID: record.id,
+        messageID: info.id,
+        type: "text",
+        text: part.text
+      });
+    } else {
+      const file = {
+        id: `${info.id}_${index}`,
+        sessionID: record.id,
+        messageID: info.id,
+        type: "file",
+        mime: part.mime,
+        url: part.url
+      };
+      if (part.filename) file.filename = part.filename;
+      messageParts.push(file);
+    }
+  }
+  return { info, parts: messageParts };
+}
+function createAssistantMessage(record, now = Date.now()) {
+  const info = {
+    id: createMessageId(record),
+    sessionID: record.id,
+    role: "assistant",
+    time: { created: now }
+  };
+  return { info, parts: [] };
+}
+function activeAssistantMessage(record) {
+  const last = record.messages[record.messages.length - 1];
+  return last && last.info.role === "assistant" ? last : null;
+}
+function upsertStreamedPart(message, part, lifecycle, now = Date.now()) {
+  const index = message.parts.findIndex((existing2) => existing2.id === part.id);
+  const existing = index === -1 ? void 0 : message.parts[index];
+  if (part.type === "reasoning") {
+    const previousTime = existing?.time && typeof existing.time === "object" ? existing.time : null;
+    const started = typeof previousTime?.start === "number" ? previousTime.start : now;
+    part.time = lifecycle === "completed" ? { start: started, end: now } : { start: started };
+  }
+  if (index === -1) message.parts.push(part);
+  else message.parts[index] = part;
+  return part;
+}
+function itemPart(record, item) {
+  const message = activeAssistantMessage(record);
+  if (!message) return null;
+  const base = {
+    id: item.id,
+    sessionID: record.id,
+    messageID: message.info.id
+  };
+  switch (item.type) {
+    case "agent_message":
+      return { ...base, type: "text", text: item.text };
+    case "reasoning":
+      return { ...base, type: "reasoning", text: item.text };
+    case "command_execution":
+      return {
+        ...base,
+        type: "tool",
+        tool: "bash",
+        state: {
+          status: item.status === "in_progress" ? "running" : item.status === "failed" ? "error" : "completed",
+          title: item.command.slice(0, 512),
+          input: { command: item.command },
+          ...item.aggregated_output ? { output: item.aggregated_output } : {}
+        }
+      };
+    case "file_change":
+      return {
+        ...base,
+        type: "tool",
+        tool: "edit",
+        state: {
+          status: item.status === "failed" ? "error" : "completed",
+          title: item.changes.length === 1 ? `Edited ${item.changes[0].path}` : `Edited ${item.changes.length} files`,
+          input: { changes: item.changes }
+        }
+      };
+    case "mcp_tool_call":
+      return {
+        ...base,
+        type: "tool",
+        tool: item.tool,
+        state: {
+          status: item.status === "in_progress" ? "running" : item.status === "failed" ? "error" : "completed",
+          title: `${item.server}:${item.tool}`,
+          input: { arguments: item.arguments },
+          ...item.error ? { error: item.error.message } : {}
+        }
+      };
+    case "web_search":
+      return {
+        ...base,
+        type: "tool",
+        tool: "web_search",
+        state: {
+          status: "completed",
+          title: "Web search",
+          input: { query: item.query }
+        }
+      };
+    case "todo_list": {
+      const completed = item.items.filter((todo) => todo.completed).length;
+      return {
+        ...base,
+        type: "tool",
+        tool: "todo_list",
+        state: {
+          status: completed === item.items.length ? "completed" : "running",
+          title: item.items.length > 0 ? `Tasks ${completed}/${item.items.length}` : "Tasks",
+          input: { items: item.items }
+        }
+      };
+    }
+    case "error":
+      return {
+        ...base,
+        type: "tool",
+        tool: "codex_error",
+        state: {
+          status: "error",
+          title: "Codex error",
+          input: {},
+          error: item.message
+        }
+      };
+  }
+}
+function toUserInput(parts) {
+  const input = [];
+  for (const part of parts) {
+    if (part.type === "text" && typeof part.text === "string" && part.text.length) {
+      input.push({ type: "text", text: part.text });
+    } else if (part.type === "file" && typeof part.url === "string") {
+      const path = part.url.replace(/^file:\/\//, "");
+      if (path) input.push({ type: "local_image", path });
+    }
+  }
+  return input;
+}
+function threadOptions(config, directory, model) {
+  return {
+    workingDirectory: directory,
+    model: model ?? config.model,
+    sandboxMode: config.sandboxMode,
+    approvalPolicy: config.approvalPolicy,
+    modelReasoningEffort: config.modelReasoningEffort,
+    webSearchMode: config.webSearchMode,
+    skipGitRepoCheck: config.skipGitRepoCheck,
+    networkAccessEnabled: config.networkAccess
+  };
+}
+function ensureThread(codex, record, config, model) {
+  const selectedModel = model ?? record.model ?? config.model;
+  if (record.thread && record.model === selectedModel) return record.thread;
+  record.model = selectedModel;
+  if (record.codexThreadId) {
+    record.thread = codex.resumeThread(
+      record.codexThreadId,
+      threadOptions(config, record.directory, selectedModel)
+    );
+  } else {
+    record.thread = codex.startThread(threadOptions(config, record.directory, selectedModel));
+  }
+  return record.thread;
+}
+function createCodexAdapter(options) {
+  const { codex, config, sessions } = options;
+  const bus = new EventBus();
+  const log = options.log ?? (async () => void 0);
+  const controllers = /* @__PURE__ */ new WeakMap();
+  const emit = (type, directory, properties) => {
+    bus.push({ directory, payload: { type, properties } });
+  };
+  const finishRun = (record, controller) => {
+    controllers.delete(record);
+    record.busy = false;
+    record.updated = Date.now();
+    emit("session.updated", record.directory, { info: sessionView(record) });
+    if (!record.failed) {
+      emit("session.status", record.directory, { sessionID: record.id, status: { type: "idle" } });
+    }
+    emit("session.idle", record.directory, { sessionID: record.id });
+    void log("info", "Codex turn finished", { sessionId: record.id });
+  };
+  const handleThreadEvent = (record, event) => {
+    switch (event.type) {
+      case "thread.started":
+        record.codexThreadId = event.thread_id;
+        return;
+      case "turn.completed": {
+        const message = activeAssistantMessage(record);
+        if (message) {
+          message.info.time.completed = Date.now();
+          emit("message.updated", record.directory, { info: message.info });
+        }
+        void log("info", "Codex turn completed", {
+          sessionId: record.id,
+          inputTokens: event.usage.input_tokens,
+          outputTokens: event.usage.output_tokens
+        });
+        return;
+      }
+      case "turn.failed":
+        record.failed = true;
+        emit("session.error", record.directory, { sessionID: record.id, message: event.error.message });
+        return;
+      case "item.started":
+      case "item.updated":
+      case "item.completed": {
+        let message = activeAssistantMessage(record);
+        if (!message) {
+          message = createAssistantMessage(record);
+          record.messages.push(message);
+          emit("message.updated", record.directory, { info: message.info });
+        }
+        const part = itemPart(record, event.item);
+        if (!part) return;
+        const lifecycle = event.type === "item.started" ? "started" : event.type === "item.updated" ? "updated" : "completed";
+        emit("message.part.updated", record.directory, {
+          part: upsertStreamedPart(message, part, lifecycle)
+        });
+        return;
+      }
+      case "error":
+        record.failed = true;
+        emit("session.error", record.directory, { sessionID: record.id, message: event.message });
+        return;
+    }
+  };
+  const startRun = (record, input, model) => {
+    if (record.busy) throw new Error("Codex session is already running a turn");
+    record.busy = true;
+    record.failed = false;
+    const controller = new AbortController();
+    controllers.set(record, controller);
+    const thread = ensureThread(codex, record, config, model);
+    emit("session.status", record.directory, { sessionID: record.id, status: { type: "busy" } });
+    void log("info", "Codex turn started", { sessionId: record.id });
+    void (async () => {
+      try {
+        const { events } = await thread.runStreamed(input, { signal: controller.signal });
+        for await (const event of events) handleThreadEvent(record, event);
+      } catch (error) {
+        if (!controller.signal.aborted) {
+          record.failed = true;
+          emit("session.error", record.directory, {
+            sessionID: record.id,
+            message: errorMessage(error)
+          });
+          void log("warn", "Codex turn failed", { sessionId: record.id, reason: errorMessage(error) });
+        }
+      } finally {
+        finishRun(record, controller);
+      }
+    })();
+  };
+  return {
+    async invoke(method, rawParams) {
+      switch (method) {
+        case "device.health": {
+          emptyParamsSchema.parse(rawParams);
+          return {
+            healthy: true,
+            connector: "codex",
+            version: "0.1.0",
+            model: config.model ?? null
+          };
+        }
+        case "project.list": {
+          const params = projectListSchema.parse(rawParams);
+          const directory = params.directory || void 0;
+          const records = sessions.list(directory);
+          const discovered = await sessions.discoverAll(directory);
+          const directories = /* @__PURE__ */ new Map();
+          for (const record of records) {
+            const existing = directories.get(record.directory);
+            if (existing === void 0 || record.created < existing) {
+              directories.set(record.directory, record.created);
+            }
+          }
+          for (const session of discovered) {
+            const existing = directories.get(session.directory);
+            if (existing === void 0 || session.created < existing) {
+              directories.set(session.directory, session.created);
+            }
+          }
+          return [...directories.entries()].map(([worktree, created]) => ({
+            id: projectId(worktree),
+            worktree,
+            time: { created }
+          }));
+        }
+        case "session.list": {
+          const params = sessionListSchema.parse(rawParams);
+          const discovered = params.directory ? await sessions.discover(params.directory) : await sessions.discover();
+          const views = [
+            ...sessions.list(params.directory).map(sessionView),
+            ...discovered.map(discoveredSessionView)
+          ];
+          return views.map(toSafeJson);
+        }
+        case "session.create": {
+          const params = sessionCreateSchema.parse(rawParams);
+          if (!params.directory) throw new Error("session.create requires a directory");
+          const record = sessions.create({
+            id: createSessionId(),
+            directory: params.directory,
+            title: params.title,
+            version: "0.1.0",
+            model: config.model
+          });
+          return toSafeJson(sessionView(record));
+        }
+        case "session.fork":
+          throw new Error("session.fork is not supported by the Codex connector");
+        case "session.delete": {
+          const params = sessionDeleteSchema.parse(rawParams);
+          const record = sessions.get(params.sessionId);
+          if (record) {
+            emit("session.deleted", record.directory, { info: sessionView(record) });
+            sessions.remove(record.id);
+          }
+          return true;
+        }
+        case "session.status": {
+          const params = sessionStatusSchema.parse(rawParams);
+          const statuses = {};
+          for (const record of sessions.list(params.directory)) {
+            statuses[record.id] = {
+              type: record.busy ? "busy" : record.failed ? "error" : "idle"
+            };
+          }
+          return statuses;
+        }
+        case "session.messages": {
+          const params = sessionMessagesSchema.parse(rawParams);
+          const record = sessions.get(params.sessionId);
+          if (!record) {
+            const history = await sessions.loadHistory(params.sessionId, params.directory);
+            if (!history) return [];
+            const messages2 = params.limit ? history.messages.slice(-params.limit) : history.messages;
+            return toSafeJson(messages2);
+          }
+          const messages = params.limit ? record.messages.slice(-params.limit) : record.messages;
+          return toSafeJson(messages.map((message) => ({ info: message.info, parts: message.parts })));
+        }
+        case "session.prompt": {
+          const params = sessionPromptSchema.parse(rawParams);
+          const selectedModel = params.model ? params.model.providerID === "codex" ? params.model.modelID : (() => {
+            throw new Error(`Codex does not support provider ${params.model?.providerID}`);
+          })() : void 0;
+          let record = sessions.get(params.sessionId);
+          if (!record) {
+            const discovered = await sessions.discover(params.directory);
+            const session = discovered.find((item) => item.id === params.sessionId);
+            if (!session) throw new Error(`Unknown Codex session ${params.sessionId}`);
+            const history = await sessions.loadHistory(session.id, session.directory);
+            record = sessions.create({
+              id: params.sessionId,
+              directory: session.directory,
+              title: history?.title ?? session.title,
+              version: session.version,
+              codexThreadId: session.id,
+              model: selectedModel ?? config.model,
+              messages: history?.messages
+            });
+          }
+          const userMessage = buildUserMessage(record, params.parts);
+          record.messages.push(userMessage);
+          emit("message.updated", record.directory, { info: userMessage.info });
+          startRun(record, toUserInput(params.parts), selectedModel);
+          return { accepted: true };
+        }
+        case "session.abort": {
+          const params = sessionAbortSchema.parse(rawParams);
+          const record = sessions.get(params.sessionId);
+          const controller = record ? controllers.get(record) : void 0;
+          controller?.abort();
+          return { accepted: true };
+        }
+        case "provider.list": {
+          providerListSchema.parse(rawParams);
+          if (!config.model) return toSafeJson({ default: {}, providers: [] });
+          return toSafeJson({
+            default: { codex: config.model },
+            providers: [
+              {
+                id: "codex",
+                name: "Codex",
+                models: [
+                  {
+                    id: config.model,
+                    name: config.model,
+                    attachment: false,
+                    reasoning: true,
+                    toolCall: true,
+                    status: "active",
+                    variants: []
+                  }
+                ]
+              }
+            ]
+          });
+        }
+        case "agent.list": {
+          agentListSchema.parse(rawParams);
+          return [];
+        }
+        case "permission.list": {
+          permissionListSchema.parse(rawParams);
+          return [];
+        }
+        case "permission.reply": {
+          permissionReplySchema.parse(rawParams);
+          return true;
+        }
+        case "question.list": {
+          questionListSchema.parse(rawParams);
+          return [];
+        }
+        case "question.reply": {
+          questionReplySchema.parse(rawParams);
+          throw new Error("The Codex connector does not support interactive questions");
+        }
+        case "question.reject": {
+          questionRejectSchema.parse(rawParams);
+          throw new Error("The Codex connector does not support interactive questions");
+        }
+        case "event.subscribe": {
+          emptyParamsSchema.parse(rawParams);
+          return { subscribed: true };
+        }
+      }
+    },
+    async *events(signal) {
+      yield* bus.stream(signal);
+    },
+    async log(level, message, extra) {
+      await log(level, message, extra);
+    }
+  };
+}
+
+// ../protocol/src/index.ts
+import { z as z3 } from "zod";
+var BRIDGE_PROTOCOL_VERSION = 1;
+var bridgeRoleSchema = z3.enum(["device", "browser"]);
+var deviceIdSchema = z3.string().min(1).max(128).regex(/^[a-zA-Z0-9._:-]+$/, "Device ID contains unsupported characters");
+var clientIdSchema = z3.string().min(1).max(128).regex(/^[a-zA-Z0-9._:-]+$/, "Client ID contains unsupported characters");
+var base64UrlSchema = z3.string().min(16).max(512).regex(/^[A-Za-z0-9_-]+$/, "Value must use unpadded base64url encoding");
+var deviceAuthProofSchema = z3.object({
+  deviceId: deviceIdSchema,
+  publicKey: z3.string().min(32).max(512),
+  timestamp: z3.number().int().positive(),
+  nonce: base64UrlSchema.max(128),
+  signature: base64UrlSchema
+}).strict();
+var pairingClientSchema = z3.object({
+  clientId: clientIdSchema,
+  label: z3.string().trim().min(1).max(80).optional()
+}).strict();
+var pairingStartRequestSchema = z3.object({
+  proof: deviceAuthProofSchema,
+  client: pairingClientSchema
+}).strict();
+var pairingClaimRequestSchema = z3.object({
+  ticket: base64UrlSchema.max(128),
+  client: pairingClientSchema
+}).strict();
+var pairingStartResponseSchema = z3.object({
+  deviceId: deviceIdSchema,
+  pairingId: base64UrlSchema.max(128),
+  pairUrl: z3.string().url(),
+  expiresAt: z3.number().int().positive(),
+  deviceOnline: z3.boolean()
+}).strict();
+var pairingClaimResponseSchema = z3.object({
+  deviceId: deviceIdSchema,
+  authorized: z3.literal(true)
+}).strict();
+var pairingRevokeRequestSchema = z3.object({
+  clientId: clientIdSchema
+}).strict();
+var pairingRevokeResponseSchema = z3.object({
+  revoked: z3.literal(true)
+}).strict();
+var pairedDeviceSchema = z3.object({
+  clientId: clientIdSchema,
+  label: z3.string().nullable(),
+  online: z3.boolean(),
+  pairedAt: z3.number().int().positive()
+}).strict();
+var pairedDevicesResponseSchema = z3.object({
+  devices: z3.array(pairedDeviceSchema)
+}).strict();
+var bridgeConnectionSchema = z3.object({
+  role: bridgeRoleSchema,
+  clientId: clientIdSchema
+});
+var bridgeMethodSchema = z3.enum([
+  "device.health",
+  "project.list",
+  "session.list",
+  "session.create",
+  "session.fork",
+  "session.delete",
+  "session.status",
+  "session.messages",
+  "session.prompt",
+  "session.abort",
+  "provider.list",
+  "agent.list",
+  "permission.list",
+  "permission.reply",
+  "question.list",
+  "question.reply",
+  "question.reject",
+  "event.subscribe"
+]);
+var jsonValueSchema = z3.lazy(
+  () => z3.union([
+    z3.null(),
+    z3.boolean(),
+    z3.number(),
+    z3.string(),
+    z3.array(jsonValueSchema),
+    z3.record(z3.string(), jsonValueSchema)
+  ])
+);
+var messageBase = {
+  version: z3.literal(BRIDGE_PROTOCOL_VERSION)
+};
+var bridgeHelloSchema = z3.object({
+  ...messageBase,
+  type: z3.literal("device.hello"),
+  clientId: clientIdSchema,
+  agentVersion: z3.string().min(1).max(64),
+  connectorId: z3.string().min(1).max(64).default("opencode")
+}).strict();
+var bridgeRequestSchema = z3.object({
+  ...messageBase,
+  type: z3.literal("request"),
+  id: z3.string().min(1).max(128),
+  connectorId: z3.string().min(1).max(64).optional(),
+  method: bridgeMethodSchema,
+  params: jsonValueSchema
+}).strict();
+var bridgeErrorSchema = z3.object({
+  code: z3.enum([
+    "INVALID_MESSAGE",
+    "ROLE_NOT_ALLOWED",
+    "DEVICE_OFFLINE",
+    "REQUEST_NOT_FOUND",
+    "DUPLICATE_REQUEST",
+    "SESSION_BUSY",
+    "INTERNAL_ERROR"
+  ]),
+  message: z3.string().min(1).max(512)
+}).strict();
+var bridgeSuccessResponseSchema = z3.object({
+  ...messageBase,
+  type: z3.literal("response"),
+  id: z3.string().min(1).max(128),
+  ok: z3.literal(true),
+  result: jsonValueSchema
+}).strict();
+var bridgeFailureResponseSchema = z3.object({
+  ...messageBase,
+  type: z3.literal("response"),
+  id: z3.string().min(1).max(128),
+  ok: z3.literal(false),
+  error: bridgeErrorSchema
+}).strict();
+var bridgeResponseSchema = z3.union([
+  bridgeSuccessResponseSchema,
+  bridgeFailureResponseSchema
+]);
+var bridgeEventSchema = z3.object({
+  ...messageBase,
+  type: z3.literal("event"),
+  connectorId: z3.string().min(1).max(64).optional(),
+  event: z3.string().min(1).max(128),
+  payload: jsonValueSchema
+}).strict();
+var bridgeSystemSchema = z3.object({
+  ...messageBase,
+  type: z3.literal("system"),
+  event: z3.enum([
+    "connection.ready",
+    "presence.changed",
+    "pairing.claimed",
+    "protocol.error"
+  ]),
+  payload: jsonValueSchema
+}).strict();
+var bridgeMessageSchema = z3.union([
+  bridgeHelloSchema,
+  bridgeRequestSchema,
+  bridgeResponseSchema,
+  bridgeEventSchema,
+  bridgeSystemSchema
+]);
+function parseBridgeMessage(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    return {
+      ok: false,
+      error: {
+        code: "INVALID_MESSAGE",
+        message: "Message must be valid JSON"
+      }
+    };
+  }
+  const result = bridgeMessageSchema.safeParse(parsed);
+  if (!result.success) {
+    return {
+      ok: false,
+      error: {
+        code: "INVALID_MESSAGE",
+        message: result.error.issues[0]?.message ?? "Message does not match the bridge protocol"
+      }
+    };
+  }
+  return { ok: true, message: result.data };
+}
+function encodeBridgeMessage(message) {
+  return JSON.stringify(bridgeMessageSchema.parse(message));
+}
+
+// src/identity.ts
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  randomBytes as randomBytes2,
+  sign,
+  verify
+} from "crypto";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
+import { mkdir, open, readFile as readFile2 } from "fs/promises";
+import { z as z4 } from "zod";
+var DEVICE_PROOF_PREFIX = "tumnel-device-proof-v1";
+var identitySchema = z4.object({
+  version: z4.literal(1),
+  deviceId: z4.string().regex(/^device_[A-Za-z0-9_-]{32,64}$/),
+  publicKey: z4.string().min(1),
+  privateKey: z4.string().min(1),
+  createdAt: z4.string().datetime()
+}).strict();
+function defaultIdentityPath(environment = process.env) {
+  const configRoot = environment.TUMNEL_CONFIG_DIR ?? environment.XDG_CONFIG_HOME ?? (process.platform === "win32" && environment.USERPROFILE ? join2(environment.USERPROFILE, ".config") : join2(homedir2(), ".config"));
+  return join2(configRoot, "tumnel", "identity.json");
+}
+function legacyIdentityPaths(environment = process.env) {
+  const configRoot = environment.TUMNEL_CONFIG_DIR ?? environment.XDG_CONFIG_HOME ?? (process.platform === "win32" && environment.USERPROFILE ? join2(environment.USERPROFILE, ".config") : join2(homedir2(), ".config"));
+  return [
+    join2(configRoot, "opencode", "tumnel", "identity.json"),
+    join2(configRoot, "codex", "tumnel", "identity.json")
+  ];
+}
+function deviceIdFromPublicKey(publicKey) {
+  const fingerprint = createHash2("sha256").update(Buffer.from(publicKey, "base64")).digest("base64url");
+  return `device_${fingerprint}`;
+}
+function createIdentity() {
+  const pair = generateKeyPairSync("ed25519");
+  const publicKey = pair.publicKey.export({ type: "spki", format: "der" }).toString("base64");
+  const privateKey = pair.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+  return {
+    version: 1,
+    deviceId: deviceIdFromPublicKey(publicKey),
+    publicKey,
+    privateKey,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function validateKeyPair(identity) {
+  if (deviceIdFromPublicKey(identity.publicKey) !== identity.deviceId) {
+    throw new Error("Tumnel identity fingerprint does not match its public key");
+  }
+  const challenge = Buffer.from("tumnel-device-identity-v1");
+  const signature = sign(null, challenge, createPrivateKey(identity.privateKey));
+  const valid = verify(
+    null,
+    challenge,
+    createPublicKey({ key: Buffer.from(identity.publicKey, "base64"), format: "der", type: "spki" }),
+    signature
+  );
+  if (!valid) {
+    throw new Error("Tumnel identity contains an invalid key pair");
+  }
+  return identity;
+}
+async function readIdentity(path) {
+  const contents = await readFile2(path, "utf8");
+  return validateKeyPair(identitySchema.parse(JSON.parse(contents)));
+}
+async function persistNewIdentity(path, identity) {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  const handle = await open(path, "wx", 384);
+  try {
+    await handle.writeFile(`${JSON.stringify(identity, null, 2)}
+`, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function loadOrCreateIdentity(path = defaultIdentityPath(), migrationSources = path === defaultIdentityPath() ? legacyIdentityPaths() : []) {
+  try {
+    return await readIdentity(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (migrationSources.length > 0) {
+    for (const legacyPath of migrationSources) {
+      try {
+        const identity2 = await readIdentity(legacyPath);
+        try {
+          await persistNewIdentity(path, identity2);
+          return identity2;
+        } catch (error) {
+          if (error.code !== "EEXIST") throw error;
+          return readIdentity(path);
+        }
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+  }
+  const identity = createIdentity();
+  try {
+    await persistNewIdentity(path, identity);
+    return identity;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    return readIdentity(path);
+  }
+}
+function createDeviceProof(identity, timestamp = Date.now(), nonce = randomBytes2(24).toString("base64url")) {
+  const message = `${DEVICE_PROOF_PREFIX}
+${identity.deviceId}
+${timestamp}
+${nonce}`;
+  const signature = sign(null, Buffer.from(message), createPrivateKey(identity.privateKey));
+  return {
+    deviceId: identity.deviceId,
+    publicKey: identity.publicKey,
+    timestamp,
+    nonce,
+    signature: signature.toString("base64url")
+  };
+}
+
+// src/client.ts
+var CONNECT_TIMEOUT_MS = 15e3;
+var STABLE_CONNECTION_MS = 3e4;
+var INITIAL_BACKOFF_MS = 500;
+var MAX_BACKOFF_MS = 3e4;
+function bridgeUrl(relayUrl, identity, proof) {
+  const url = new URL(relayUrl);
+  if (url.protocol === "http:") url.protocol = "ws:";
+  if (url.protocol === "https:") url.protocol = "wss:";
+  if (url.protocol !== "ws:" && url.protocol !== "wss:") {
+    throw new Error("TUMNEL_RELAY_URL must use http, https, ws, or wss");
+  }
+  const basePath = url.pathname.replace(/\/$/, "");
+  url.pathname = `${basePath}/api/bridge/${encodeURIComponent(identity.deviceId)}`;
+  url.search = "";
+  url.searchParams.set("role", "device");
+  url.searchParams.set("clientId", identity.deviceId);
+  url.searchParams.set("connectorId", "codex");
+  url.searchParams.set("publicKey", proof.publicKey);
+  url.searchParams.set("timestamp", String(proof.timestamp));
+  url.searchParams.set("nonce", proof.nonce);
+  url.searchParams.set("signature", proof.signature);
+  return url.toString();
+}
+function abortableDelay(milliseconds, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted) return resolve();
+    const timeout = setTimeout(resolve, milliseconds);
+    signal.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timeout);
+        resolve();
+      },
+      { once: true }
+    );
+  });
+}
+function eventName(payload) {
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return "codex.event";
+  if (typeof payload.type === "string") return payload.type.slice(0, 128);
+  const nested = payload.payload;
+  if (typeof nested === "object" && nested !== null && !Array.isArray(nested) && typeof nested.type === "string") {
+    return nested.type.slice(0, 128);
+  }
+  return "codex.event";
+}
+async function messageText(data) {
+  if (typeof data === "string") return data;
+  if (data instanceof Blob) return data.text();
+  if (data instanceof ArrayBuffer) return Buffer.from(data).toString("utf8");
+  if (ArrayBuffer.isView(data)) {
+    return Buffer.from(data.buffer, data.byteOffset, data.byteLength).toString("utf8");
+  }
+  return null;
+}
+function errorMessage2(error) {
+  const message = error instanceof Error ? error.message : "Codex request failed";
+  return message.slice(0, 512);
+}
+var TumnelBridgeClient = class {
+  relayUrl;
+  identity;
+  adapter;
+  webSocketFactory;
+  random;
+  proofFactory;
+  abortController = new AbortController();
+  connectionLoop;
+  eventLoop;
+  socket;
+  currentState = "idle";
+  constructor(options) {
+    this.relayUrl = options.relayUrl;
+    this.identity = options.identity;
+    this.adapter = options.adapter;
+    this.webSocketFactory = options.webSocketFactory ?? ((url) => new WebSocket(url));
+    this.random = options.random ?? Math.random;
+    this.proofFactory = options.proofFactory ?? (() => createDeviceProof(this.identity));
+  }
+  get state() {
+    return this.currentState;
+  }
+  get deviceId() {
+    return this.identity.deviceId;
+  }
+  start() {
+    if (this.connectionLoop || this.abortController.signal.aborted) return;
+    this.connectionLoop = this.runConnectionLoop();
+    this.eventLoop = this.runEventLoop();
+  }
+  async stop() {
+    if (this.currentState === "stopped") return;
+    this.currentState = "stopped";
+    this.abortController.abort();
+    this.socket?.close(1e3, "Connector disposed");
+    await Promise.allSettled([this.connectionLoop, this.eventLoop]);
+  }
+  async runConnectionLoop() {
+    let attempt = 0;
+    while (!this.abortController.signal.aborted) {
+      const startedAt = Date.now();
+      try {
+        await this.connectOnce();
+      } catch (error) {
+        await this.adapter.log("warn", "Cloud relay connection failed", {
+          reason: errorMessage2(error)
+        });
+      }
+      if (this.abortController.signal.aborted) break;
+      attempt = Date.now() - startedAt >= STABLE_CONNECTION_MS ? 0 : attempt + 1;
+      const exponential = Math.min(MAX_BACKOFF_MS, INITIAL_BACKOFF_MS * 2 ** Math.min(attempt, 10));
+      const delay = Math.round(exponential * (0.75 + this.random() * 0.5));
+      await this.adapter.log("info", "Reconnecting to Cloud relay", {
+        attempt,
+        delayMs: delay
+      });
+      await abortableDelay(delay, this.abortController.signal);
+    }
+  }
+  async connectOnce() {
+    this.currentState = "connecting";
+    const proof = await this.proofFactory();
+    const socket = this.webSocketFactory(bridgeUrl(this.relayUrl, this.identity, proof));
+    this.socket = socket;
+    return new Promise((resolve, reject) => {
+      let opened = false;
+      const timeout = setTimeout(() => {
+        socket.close(4e3, "Connection timeout");
+        reject(new Error("Timed out connecting to Cloud relay"));
+      }, CONNECT_TIMEOUT_MS);
+      const abort = () => socket.close(1e3, "Connector disposed");
+      this.abortController.signal.addEventListener("abort", abort, { once: true });
+      socket.addEventListener("open", () => {
+        opened = true;
+        clearTimeout(timeout);
+        this.currentState = "connected";
+        const hello = {
+          version: BRIDGE_PROTOCOL_VERSION,
+          type: "device.hello",
+          clientId: this.identity.deviceId,
+          agentVersion: "0.1.1",
+          connectorId: "codex"
+        };
+        socket.send(encodeBridgeMessage(hello));
+        void this.adapter.log("info", "Connected to Cloud relay", {
+          deviceId: this.identity.deviceId
+        });
+      });
+      socket.addEventListener("message", (event) => {
+        void this.handleMessage(socket, event.data);
+      });
+      socket.addEventListener("error", () => {
+        if (!opened) {
+          clearTimeout(timeout);
+          reject(new Error("Cloud relay WebSocket error"));
+        }
+      });
+      socket.addEventListener("close", (event) => {
+        clearTimeout(timeout);
+        this.abortController.signal.removeEventListener("abort", abort);
+        if (this.socket === socket) this.socket = void 0;
+        if (!this.abortController.signal.aborted) this.currentState = "idle";
+        if (!this.abortController.signal.aborted) {
+          void this.adapter.log("warn", "Cloud relay disconnected", {
+            code: event.code,
+            reason: event.reason.slice(0, 256),
+            wasClean: event.wasClean
+          });
+        }
+        if (opened) resolve();
+        else reject(new Error("Cloud relay closed before connecting"));
+      });
+    });
+  }
+  async handleMessage(socket, data) {
+    const raw = await messageText(data);
+    if (raw === "pong" || raw === null) return;
+    const parsed = parseBridgeMessage(raw);
+    if (!parsed.ok) {
+      await this.adapter.log("warn", "Ignored invalid Cloud relay message", {
+        code: parsed.error.code,
+        message: parsed.error.message
+      });
+      return;
+    }
+    if (parsed.message.type !== "request") return;
+    await this.handleRequest(socket, parsed.message);
+  }
+  async handleRequest(socket, request) {
+    let response;
+    try {
+      response = {
+        version: BRIDGE_PROTOCOL_VERSION,
+        type: "response",
+        id: request.id,
+        ok: true,
+        result: await this.adapter.invoke(request.method, request.params)
+      };
+    } catch (error) {
+      response = {
+        version: BRIDGE_PROTOCOL_VERSION,
+        type: "response",
+        id: request.id,
+        ok: false,
+        error: {
+          code: "INTERNAL_ERROR",
+          message: errorMessage2(error)
+        }
+      };
+    }
+    if (socket.readyState === WebSocket.OPEN) socket.send(encodeBridgeMessage(response));
+  }
+  async runEventLoop() {
+    let attempt = 0;
+    while (!this.abortController.signal.aborted) {
+      try {
+        for await (const payload of this.adapter.events(this.abortController.signal)) {
+          const event = {
+            version: BRIDGE_PROTOCOL_VERSION,
+            type: "event",
+            event: eventName(payload),
+            payload
+          };
+          if (this.socket?.readyState === WebSocket.OPEN) {
+            this.socket.send(encodeBridgeMessage(event));
+          }
+        }
+        attempt = 0;
+      } catch (error) {
+        if (this.abortController.signal.aborted) break;
+        attempt += 1;
+        await this.adapter.log("warn", "Codex event stream disconnected", {
+          reason: errorMessage2(error),
+          attempt
+        });
+        const delay = Math.min(MAX_BACKOFF_MS, INITIAL_BACKOFF_MS * 2 ** Math.min(attempt, 10));
+        await abortableDelay(delay, this.abortController.signal);
+      }
+    }
+  }
+};
+
+// src/config.ts
+import { z as z5 } from "zod";
+var DEFAULT_RELAY_URL = "https://openbridge.jlfloressanchez01.workers.dev";
+var DEFAULT_LOCAL_PORT = 43817;
+var DEFAULT_SANDBOX_MODE = "workspace-write";
+var DEFAULT_APPROVAL_POLICY = "on-request";
+var localPortSchema = z5.number().int().min(1024).max(65535);
+var sandboxModeSchema = z5.enum(["read-only", "workspace-write", "danger-full-access"]);
+var approvalPolicySchema = z5.enum(["never", "on-request", "on-failure", "untrusted"]);
+var modelReasoningEffortSchema = z5.enum(["minimal", "low", "medium", "high", "xhigh"]);
+var webSearchModeSchema = z5.enum(["disabled", "cached", "live"]);
+var connectorOptionsSchema = z5.object({
+  relayUrl: z5.string().url().optional(),
+  identityPath: z5.string().min(1).optional(),
+  localPort: localPortSchema.optional(),
+  appOrigins: z5.array(z5.string().url()).max(10).optional(),
+  model: z5.string().min(1).max(256).optional(),
+  sandboxMode: sandboxModeSchema.optional(),
+  approvalPolicy: approvalPolicySchema.optional(),
+  modelReasoningEffort: modelReasoningEffortSchema.optional(),
+  webSearchMode: webSearchModeSchema.optional(),
+  skipGitRepoCheck: z5.boolean().optional(),
+  networkAccess: z5.boolean().optional()
+}).strict();
+function envBool(value) {
+  if (value === void 0) return void 0;
+  return value === "1" || value.toLowerCase() === "true";
+}
+function resolveConfig(options, environment = process.env) {
+  const parsedOptions = connectorOptionsSchema.parse(options ?? {});
+  const relayUrl = parsedOptions.relayUrl ?? environment.TUMNEL_RELAY_URL ?? DEFAULT_RELAY_URL;
+  const configuredOrigins = environment.TUMNEL_APP_ORIGIN?.split(",").map((origin) => origin.trim()).filter(Boolean);
+  const sandboxMode = sandboxModeSchema.parse(
+    parsedOptions.sandboxMode ?? environment.CODEX_SANDBOX ?? DEFAULT_SANDBOX_MODE
+  );
+  const approvalPolicy = approvalPolicySchema.parse(
+    parsedOptions.approvalPolicy ?? environment.CODEX_APPROVAL_POLICY ?? DEFAULT_APPROVAL_POLICY
+  );
+  return {
+    relayUrl,
+    identityPath: parsedOptions.identityPath ?? environment.TUMNEL_IDENTITY_PATH,
+    localPort: localPortSchema.parse(
+      parsedOptions.localPort ?? (environment.TUMNEL_LOCAL_PORT ? Number(environment.TUMNEL_LOCAL_PORT) : DEFAULT_LOCAL_PORT)
+    ),
+    appOrigins: parsedOptions.appOrigins ?? configuredOrigins ?? [],
+    model: parsedOptions.model ?? environment.CODEX_MODEL,
+    sandboxMode,
+    approvalPolicy,
+    modelReasoningEffort: parsedOptions.modelReasoningEffort ?? environment.CODEX_REASONING_EFFORT,
+    webSearchMode: parsedOptions.webSearchMode ?? environment.CODEX_WEB_SEARCH,
+    skipGitRepoCheck: parsedOptions.skipGitRepoCheck ?? envBool(environment.CODEX_SKIP_GIT_REPO_CHECK) ?? false,
+    networkAccess: parsedOptions.networkAccess ?? envBool(environment.CODEX_NETWORK_ACCESS) ?? false
+  };
+}
+
+// src/local-server.ts
+import { createServer } from "http";
+function relayOrigin(relayUrl) {
+  const url = new URL(relayUrl);
+  if (url.protocol === "ws:") url.protocol = "http:";
+  if (url.protocol === "wss:") url.protocol = "https:";
+  return url.origin;
+}
+function closeServer(server) {
+  return new Promise((resolve) => server.close(() => resolve()));
+}
+async function startPairingServer(options) {
+  const allowedOrigins = /* @__PURE__ */ new Set([
+    relayOrigin(options.relayUrl),
+    "http://127.0.0.1:5173",
+    "http://localhost:5173",
+    ...options.appOrigins
+  ]);
+  const server = createServer((request, response) => {
+    const origin = request.headers.origin;
+    const expectedHosts = /* @__PURE__ */ new Set([
+      `127.0.0.1:${options.port}`,
+      `localhost:${options.port}`
+    ]);
+    if (!expectedHosts.has(request.headers.host ?? "")) {
+      response.writeHead(403, { "Cache-Control": "no-store" });
+      response.end("Forbidden");
+      return;
+    }
+    const requestUrl = new URL(request.url ?? "/", `http://${request.headers.host}`);
+    if (request.method === "GET" && requestUrl.pathname === "/v1/health") {
+      const body2 = JSON.stringify({ ready: true });
+      response.writeHead(200, {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json; charset=utf-8",
+        "Content-Length": Buffer.byteLength(body2).toString()
+      });
+      response.end(body2);
+      return;
+    }
+    if (request.method === "GET" && requestUrl.pathname === "/v1/connect") {
+      const returnOrigin = requestUrl.searchParams.get("returnOrigin");
+      const clientId = clientIdSchema.safeParse(requestUrl.searchParams.get("clientId"));
+      if (!returnOrigin || !allowedOrigins.has(returnOrigin) || !clientId.success) {
+        response.writeHead(400, { "Cache-Control": "no-store" });
+        response.end("Invalid pairing handoff");
+        return;
+      }
+      const payload = Buffer.from(JSON.stringify({
+        proof: createDeviceProof(options.identity),
+        client: { clientId: clientId.data, label: "Desktop browser" }
+      })).toString("base64url");
+      const redirect = new URL("/connect", returnOrigin);
+      redirect.hash = new URLSearchParams({ payload }).toString();
+      response.writeHead(302, {
+        "Cache-Control": "no-store",
+        "Referrer-Policy": "no-referrer",
+        Location: redirect.toString()
+      });
+      response.end();
+      return;
+    }
+    if (!origin || !allowedOrigins.has(origin)) {
+      response.writeHead(403, { "Cache-Control": "no-store" });
+      response.end("Forbidden");
+      return;
+    }
+    const corsHeaders = {
+      "Access-Control-Allow-Origin": origin,
+      "Access-Control-Allow-Methods": "GET, OPTIONS",
+      "Access-Control-Allow-Headers": "Content-Type",
+      "Cache-Control": "no-store",
+      Vary: "Origin"
+    };
+    if (request.headers["access-control-request-private-network"] === "true") {
+      corsHeaders["Access-Control-Allow-Private-Network"] = "true";
+    }
+    if (request.method === "OPTIONS") {
+      response.writeHead(204, corsHeaders);
+      response.end();
+      return;
+    }
+    if (request.method !== "GET" || requestUrl.pathname !== "/v1/pairing-proof") {
+      response.writeHead(404, corsHeaders);
+      response.end("Not Found");
+      return;
+    }
+    const body = JSON.stringify({ proof: createDeviceProof(options.identity) });
+    response.writeHead(200, {
+      ...corsHeaders,
+      "Content-Type": "application/json; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body).toString()
+    });
+    response.end(body);
+  });
+  const listening = await new Promise((resolve) => {
+    const onError = (error) => {
+      server.removeListener("listening", onListening);
+      void options.log("warn", "Local pairing endpoint is unavailable", {
+        port: options.port,
+        reason: error.code ?? error.message
+      });
+      resolve(false);
+    };
+    const onListening = () => {
+      server.removeListener("error", onError);
+      resolve(true);
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(options.port, "127.0.0.1");
+  });
+  if (!listening) return null;
+  await options.log("info", "Local pairing endpoint ready", { port: options.port });
+  return {
+    port: options.port,
+    stop: () => closeServer(server)
+  };
+}
+
+// src/index.ts
+async function createCodexConnector(options = {}) {
+  const config = resolveConfig(options.config, options.environment);
+  const identity = await loadOrCreateIdentity(config.identityPath);
+  const codex = options.codex ?? new Codex();
+  const sessions = new CodexSessionStore(options.sessionsDir);
+  const adapter = createCodexAdapter({ codex, config, sessions, log: options.log });
+  const bridge = new TumnelBridgeClient({
+    relayUrl: config.relayUrl,
+    identity,
+    adapter
+  });
+  const pairingServer = await startPairingServer({
+    identity,
+    port: config.localPort,
+    relayUrl: config.relayUrl,
+    appOrigins: config.appOrigins,
+    log: (level, message, fields) => adapter.log(level, message, fields)
+  });
+  bridge.start();
+  return {
+    bridge,
+    pairingServer,
+    stop: async () => {
+      await bridge.stop();
+      await pairingServer?.stop();
+    }
+  };
+}
+
+// src/cli.ts
+var printHelp = () => {
+  console.log(`Tumnel connector for Codex
+
+Usage:
+  tumnel-codex [options]
+
+Options:
+  --model <model>              Codex model id (e.g. gpt-5-mini)
+  --port <port>                Local pairing endpoint port (default 43817)
+  --relay-url <url>            Tumnel relay URL (default: production relay)
+  --sandbox <mode>             Sandbox: read-only | workspace-write | danger-full-access
+  --approval-policy <policy>   Approval: never | on-request | on-failure | untrusted
+  --version                    Print the connector version
+  -h, --help                   Show this help
+
+Environment:
+  TUMNEL_RELAY_URL, TUMNEL_APP_ORIGIN, TUMNEL_IDENTITY_PATH, TUMNEL_LOCAL_PORT,
+  TUMNEL_CONFIG_DIR, CODEX_MODEL, CODEX_SANDBOX, CODEX_APPROVAL_POLICY,
+  CODEX_REASONING_EFFORT, CODEX_WEB_SEARCH, CODEX_NETWORK_ACCESS,
+  CODEX_SKIP_GIT_REPO_CHECK, CODEX_HOME
+
+The connect command starts the Codex agent bridge and keeps it connected to the
+Tumnel relay until interrupted. Pair from the Tumnel web app when it is online.`);
+};
+var printVersion = async () => {
+  const { version } = JSON.parse(
+    await import("fs/promises").then(
+      ({ readFile: readFile3 }) => readFile3(new URL("../package.json", import.meta.url), "utf8")
+    )
+  );
+  console.log(`@tumnel/codex ${version}`);
+};
+var run = async () => {
+  const command = process.argv[2] ?? "connect";
+  if (command === "--help" || command === "-h" || command === "help") {
+    printHelp();
+    return;
+  }
+  if (command === "--version" || command === "-v") {
+    printVersion();
+    return;
+  }
+  if (command !== "connect" && !command.startsWith("-")) {
+    throw new Error(`Unknown command: ${command}`);
+  }
+  const args = command === "connect" ? process.argv.slice(3) : process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp();
+    return;
+  }
+  const versionIndex = args.indexOf("--version");
+  if (versionIndex !== -1) {
+    await printVersion();
+    return;
+  }
+  const config = {};
+  const flag = (name) => {
+    const index = args.indexOf(name);
+    if (index === -1) return;
+    const value = args[index + 1];
+    if (!value) throw new Error(`Missing value for ${name}`);
+    const key = {
+      "--model": "model",
+      "--port": "localPort",
+      "--relay-url": "relayUrl",
+      "--sandbox": "sandboxMode",
+      "--approval-policy": "approvalPolicy"
+    }[name] ?? name;
+    config[key] = name === "--port" ? Number(value) : value;
+  };
+  flag("--model");
+  flag("--port");
+  flag("--relay-url");
+  flag("--sandbox");
+  flag("--approval-policy");
+  const connector = await createCodexConnector({ config });
+  const port = connector.pairingServer?.port;
+  console.log("Tumnel Codex connector started");
+  console.log(`  Device ID:    ${connector.bridge.deviceId}`);
+  if (port) console.log(`  Pairing port: http://127.0.0.1:${port}`);
+  console.log("Press Ctrl+C to stop.\n");
+  let stopping = false;
+  const stop = async () => {
+    if (stopping) return;
+    stopping = true;
+    console.log("\nStopping Tumnel Codex connector...");
+    await connector.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void stop());
+  process.on("SIGTERM", () => void stop());
+};
+run().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map