@williambeto/ai-workflow 2.8.2 → 2.9.0

package/{chunk-4FI5ODAM.js → chunk-JDSEOEYW.js}

@@ -235,6 +235,8 @@ function isDestructiveCommand(command) {
   return gitCommandIsDestructive(command);
 }
 var OpenCodeAdapter = class {
+  runtime = "opencode";
+  provenance = "opencode-adapter";
   cwd;
   constructor({ cwd = process.cwd() } = {}) {
     this.cwd = cwd;
@@ -572,8 +574,153 @@ AIWK_ORCHESTRATED_CHILD: The parent execute process exclusively owns collect-evi
   }
 };
 
-// src/core/sdd/validator.ts
+// src/core/runtime/codex-runtime-adapter.ts
+import { spawnSync as spawnSync2, execSync as execSync2 } from "child_process";
 import fs from "fs/promises";
+import os from "os";
+import path from "path";
+var SPECIALIZED_AGENTS = /* @__PURE__ */ new Set(["Nexus", "Orion", "Astra", "Sage", "Phoenix"]);
+function nativeAgentName(agent) {
+  return agent.trim().toLowerCase();
+}
+var CodexRuntimeAdapter = class {
+  runtime = "codex";
+  provenance = "codex-cli-jsonl";
+  cwd;
+  constructor({ cwd = process.cwd() } = {}) {
+    this.cwd = cwd;
+  }
+  async isProjectTrusted() {
+    const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
+    const configPath = path.join(codexHome, "config.toml");
+    const config = await fs.readFile(configPath, "utf8").catch(() => "");
+    if (!config) return false;
+    const normalizedCwd = path.resolve(this.cwd).replaceAll("\\", "\\\\");
+    const section = new RegExp(
+      `(?:^|\\n)\\[projects\\.${JSON.stringify(normalizedCwd).replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\\$&")}\\]\\s*\\n([\\s\\S]*?)(?=\\n\\[|$)`,
+      "m"
+    ).exec(config)?.[1] || "";
+    return /^trust_level\s*=\s*["']trusted["']\s*$/m.test(section);
+  }
+  async inspect() {
+    try {
+      const help = spawnSync2("codex", ["exec", "--help"], { encoding: "utf8" });
+      const available = help.status === 0;
+      const helpText = `${help.stdout || ""}
+${help.stderr || ""}`;
+      const projectTrusted = await this.isProjectTrusted();
+      const configuredAgents = await Promise.all(
+        [...SPECIALIZED_AGENTS].map(
+          (agent) => fs.access(path.join(this.cwd, ".codex", "agents", `${nativeAgentName(agent)}.toml`)).then(() => true).catch(() => false)
+        )
+      );
+      return {
+        available,
+        supports: {
+          run: available,
+          server: false,
+          formatJson: /--json\b/.test(helpText),
+          agent: projectTrusted && configuredAgents.every(Boolean),
+          model: /--model\b/.test(helpText)
+        },
+        projectTrusted
+      };
+    } catch {
+      return {
+        available: false,
+        supports: { run: false, server: false, formatJson: false, agent: false, model: false },
+        projectTrusted: false
+      };
+    }
+  }
+  async execute(_message, { agent = null, readOnly = false } = {}) {
+    const inspection = await this.inspect();
+    const requestedAgent = agent || null;
+    if (!readOnly) {
+      let branch = "";
+      try {
+        branch = execSync2("git branch --show-current", { cwd: this.cwd, encoding: "utf8", stdio: "pipe" }).trim();
+      } catch {
+      }
+      if (["main", "master"].includes(branch) && process.env.AI_WORKFLOW_BYPASS_PROTECTED_BRANCH !== "true") {
+        return {
+          success: false,
+          status: "BLOCKED",
+          error: "FAIL_PROTECTED_BRANCH: Direct writes to protected branch are prohibited.",
+          commandsRun: [],
+          eventCount: 0,
+          runtimeAgentRequested: requestedAgent,
+          runtimeAgentApplied: null,
+          runtimeAgentSupported: inspection.supports.agent,
+          runtimeAgentSelectionMode: "native-delegation",
+          runtimeActorConfirmation: "unavailable",
+          output: ""
+        };
+      }
+    }
+    if (!inspection.available || !inspection.supports.formatJson) {
+      return {
+        success: false,
+        status: "BLOCKED",
+        error: "Codex CLI with `exec --json` is required for observed workflow execution.",
+        commandsRun: [],
+        eventCount: 0,
+        runtimeAgentRequested: requestedAgent,
+        runtimeAgentApplied: null,
+        runtimeAgentSupported: inspection.supports.agent,
+        runtimeAgentSelectionMode: "native-delegation",
+        runtimeActorConfirmation: "unavailable",
+        output: ""
+      };
+    }
+    if (inspection.projectTrusted === false) {
+      return {
+        success: false,
+        status: "BLOCKED",
+        error: "Codex project is not trusted; project-local native agents are disabled until the repository is trusted in Codex.",
+        commandsRun: [],
+        eventCount: 0,
+        runtimeAgentRequested: requestedAgent,
+        runtimeAgentApplied: null,
+        runtimeAgentSupported: false,
+        runtimeAgentSelectionMode: "unavailable",
+        runtimeActorConfirmation: "unavailable",
+        output: ""
+      };
+    }
+    if (!inspection.supports.agent) {
+      return {
+        success: false,
+        status: "BLOCKED",
+        error: "Codex native agent configuration is incomplete; cannot confirm the requested workflow owner.",
+        commandsRun: [],
+        eventCount: 0,
+        runtimeAgentRequested: requestedAgent,
+        runtimeAgentApplied: null,
+        runtimeAgentSupported: false,
+        runtimeAgentSelectionMode: "unavailable",
+        runtimeActorConfirmation: "unavailable",
+        output: ""
+      };
+    }
+    return {
+      success: false,
+      status: "BLOCKED",
+      error: "Codex CLI `exec` does not provide stable custom-agent selection and observed ownership. AI Workflow Kit blocks CLI delivery rather than claiming Astra execution. Use interactive Codex in this trusted repository; a future app-server adapter is required for CLI orchestration.",
+      commandsRun: [],
+      eventCount: 0,
+      runtimeAgentRequested: requestedAgent,
+      runtimeAgentApplied: null,
+      runtimeAgentSupported: true,
+      runtimeAgentSelectionMode: "unavailable",
+      runtimeActorConfirmation: "unavailable",
+      output: ""
+    };
+  }
+};
+
+// src/core/sdd/validator.ts
+import fs2 from "fs/promises";
 var SpecValidator = class {
   validateContent(content, requiredStatus = "APPROVED") {
     const title = content.split(/\r?\n/, 1)[0]?.trim() || "";
@@ -622,7 +769,7 @@ var SpecValidator = class {
    */
   async validate(filePath) {
     try {
-      const content = await fs.readFile(filePath, "utf8");
+      const content = await fs2.readFile(filePath, "utf8");
       return this.validateContent(content, "APPROVED");
     } catch (error) {
       if (error.code === "ENOENT") {
@@ -634,9 +781,9 @@ var SpecValidator = class {
 };
 
 // src/core/handoff/handoff-engine.ts
-import { execSync as execSync2 } from "child_process";
-import fs2 from "fs/promises";
-import path from "path";
+import { execSync as execSync3 } from "child_process";
+import fs3 from "fs/promises";
+import path2 from "path";
 var HandoffEngine = class {
   cwd;
   constructor({ cwd }) {
@@ -649,9 +796,9 @@ var HandoffEngine = class {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     let specsContent = "";
     for (const specPath of specPaths) {
-      const absolutePath = path.isAbsolute(specPath) ? specPath : path.join(this.cwd, specPath);
+      const absolutePath = path2.isAbsolute(specPath) ? specPath : path2.join(this.cwd, specPath);
       try {
-        const content = await fs2.readFile(absolutePath, "utf8");
+        const content = await fs3.readFile(absolutePath, "utf8");
         specsContent += `### File: ${specPath}
 
 ${content}
@@ -667,7 +814,7 @@ ${content}
     }
     let gitDiff = "No changes detected.";
     try {
-      gitDiff = execSync2("git diff HEAD", { cwd: this.cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || "No changes detected.";
+      gitDiff = execSync3("git diff HEAD", { cwd: this.cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || "No changes detected.";
     } catch (err) {
       gitDiff = `[Error capturing diff: ${err.message}]`;
     }
@@ -678,9 +825,9 @@ ${content}
       evidenceJson = JSON.stringify(data, null, 2);
       evidenceSummary = `Status: ${data.status || data.internalStatus || "unknown"}, Commands: ${data.commands?.length || 0}`;
     } else {
-      const evidencePath = path.join(this.cwd, "EVIDENCE.json");
+      const evidencePath = path2.join(this.cwd, "EVIDENCE.json");
       try {
-        const content = await fs2.readFile(evidencePath, "utf8");
+        const content = await fs3.readFile(evidencePath, "utf8");
         const data = JSON.parse(content);
         evidenceJson = JSON.stringify(data, null, 2);
         evidenceSummary = `Status: ${data.status}, Commands: ${data.commands?.length || 0}`;
@@ -688,16 +835,16 @@ ${content}
       }
     }
     const possibleTemplatePaths = [
-      path.join(this.cwd, ".ai-workflow/templates/HANDOFF.template.md"),
-      path.join(this.cwd, ".ai-workflow/harness/handoffs/HANDOFF.template.md"),
-      path.join(getPackageRoot(), "dist-assets/templates/HANDOFF.template.md"),
-      path.join(getPackageRoot(), "dist-assets/harness/handoffs/HANDOFF.template.md")
+      path2.join(this.cwd, ".ai-workflow/templates/HANDOFF.template.md"),
+      path2.join(this.cwd, ".ai-workflow/harness/handoffs/HANDOFF.template.md"),
+      path2.join(getPackageRoot(), "dist-assets/templates/HANDOFF.template.md"),
+      path2.join(getPackageRoot(), "dist-assets/harness/handoffs/HANDOFF.template.md")
     ];
     let template = null;
     let lastError = null;
     for (const tPath of possibleTemplatePaths) {
       try {
-        template = await fs2.readFile(tPath, "utf8");
+        template = await fs3.readFile(tPath, "utf8");
         break;
       } catch (err) {
         lastError = err;
@@ -709,18 +856,18 @@ ${possibleTemplatePaths.join("\n")}
 Last error: ${lastError?.message}`);
     }
     const packet = template.replace("${TASK_ID}", taskId || "unknown").replace("${TIMESTAMP}", timestamp).replace("${AUTHOR}", author || "AI Workflow Kit").replace("${STATUS}", status || "IN_PROGRESS").replace("${SPECS_CONTENT}", specsContent || "No specs provided.").replace("${EVIDENCE_SUMMARY}", evidenceSummary).replace("${EVIDENCE_JSON}", evidenceJson).replace("${GIT_DIFF}", gitDiff).replace("${NEXT_ACTIONS}", nextActions || "Awaiting manager assignment.");
-    const handoffDir = path.join(this.cwd, ".ai-workflow/handoffs");
-    await fs2.mkdir(handoffDir, { recursive: true });
+    const handoffDir = path2.join(this.cwd, ".ai-workflow/handoffs");
+    await fs3.mkdir(handoffDir, { recursive: true });
     const packetName = `HANDOFF-${taskId || "TMP"}-${Date.now()}.md`;
-    const packetPath = path.join(handoffDir, packetName);
-    await fs2.writeFile(packetPath, packet);
+    const packetPath = path2.join(handoffDir, packetName);
+    await fs3.writeFile(packetPath, packet);
     return packetPath;
   }
 };
 
 // src/core/healing/healer-engine.ts
-import fs3 from "fs/promises";
-import path2 from "path";
+import fs4 from "fs/promises";
+import path3 from "path";
 import crypto from "crypto";
 
 // src/core/statuses.ts
@@ -793,7 +940,7 @@ var HealerEngine = class {
     this.ledger = ledger;
   }
   get statePath() {
-    return path2.join(this.cwd, ".ai-workflow", `healing-state-${this.taskSlug}.json`);
+    return path3.join(this.cwd, ".ai-workflow", `healing-state-${this.taskSlug}.json`);
   }
   fingerprint(result) {
     return crypto.createHash("sha256").update(stableJson(collectBlockingFindings(result))).digest("hex");
@@ -813,18 +960,18 @@ var HealerEngine = class {
     return false;
   }
   async writeState(state) {
-    await fs3.mkdir(path2.dirname(this.statePath), { recursive: true });
-    await fs3.writeFile(this.statePath, JSON.stringify(state, null, 2));
+    await fs4.mkdir(path3.dirname(this.statePath), { recursive: true });
+    await fs4.writeFile(this.statePath, JSON.stringify(state, null, 2));
   }
   async resetState() {
     try {
-      await fs3.unlink(this.statePath);
+      await fs4.unlink(this.statePath);
     } catch {
     }
   }
   async writeRemediationRequest({ attempt, result }) {
-    const requestPath = path2.join(this.cwd, ".ai-workflow", "remediation-request.json");
-    await fs3.mkdir(path2.dirname(requestPath), { recursive: true });
+    const requestPath = path3.join(this.cwd, ".ai-workflow", "remediation-request.json");
+    await fs4.mkdir(path3.dirname(requestPath), { recursive: true });
     const request = {
       taskSlug: this.taskSlug,
       executionMode: this.mode,
@@ -835,7 +982,7 @@ var HealerEngine = class {
       findingsFingerprint: this.fingerprint(result),
       instruction: "Apply the smallest safe correction for the listed gates, then rerun validation. Do not broaden scope."
     };
-    await fs3.writeFile(requestPath, JSON.stringify(request, null, 2));
+    await fs4.writeFile(requestPath, JSON.stringify(request, null, 2));
     return requestPath;
   }
   async run({
@@ -942,8 +1089,8 @@ var HealerEngine = class {
 };
 
 // src/core/evidence/evidence-ledger.ts
-import fs4 from "fs/promises";
-import path3 from "path";
+import fs5 from "fs/promises";
+import path4 from "path";
 import { createHash } from "crypto";
 var EvidenceLedger = class {
   cwd;
@@ -996,8 +1143,8 @@ var EvidenceLedger = class {
    * Saves the ledger events to a JSON file.
    */
   async save(filePath) {
-    const targetPath = path3.isAbsolute(filePath) ? filePath : path3.join(this.cwd, filePath);
-    await fs4.mkdir(path3.dirname(targetPath), { recursive: true });
+    const targetPath = path4.isAbsolute(filePath) ? filePath : path4.join(this.cwd, filePath);
+    await fs5.mkdir(path4.dirname(targetPath), { recursive: true });
     for (const event of this.events) {
       if (event.workflowId !== this.workflowId) {
         throw new Error(`Ledger workflowId conflict: '${event.workflowId}' does not match '${this.workflowId}'.`);
@@ -1005,9 +1152,9 @@ var EvidenceLedger = class {
     }
     const serialized = JSON.stringify(this.events, null, 2);
     const contentHash = createHash("sha256").update(serialized).digest("hex");
-    const targetExists = await fs4.access(targetPath).then(() => true).catch(() => false);
+    const targetExists = await fs5.access(targetPath).then(() => true).catch(() => false);
     if (targetExists) {
-      const diskHash = createHash("sha256").update(await fs4.readFile(targetPath)).digest("hex");
+      const diskHash = createHash("sha256").update(await fs5.readFile(targetPath)).digest("hex");
       if (this.loadedPath !== targetPath || this.loadedContentHash === null || diskHash !== this.loadedContentHash) {
         throw new Error(`Ledger changed on disk or was not loaded before update: '${targetPath}'.`);
       }
@@ -1016,20 +1163,20 @@ var EvidenceLedger = class {
     }
     const temporaryPath = `${targetPath}.${process.pid}.${Date.now()}.tmp`;
     try {
-      await fs4.writeFile(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
-      await fs4.rename(temporaryPath, targetPath);
+      await fs5.writeFile(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
+      await fs5.rename(temporaryPath, targetPath);
       this.loadedPath = targetPath;
       this.loadedContentHash = contentHash;
     } catch (error) {
-      await fs4.rm(temporaryPath, { force: true }).catch(() => {
+      await fs5.rm(temporaryPath, { force: true }).catch(() => {
       });
       throw error;
     }
   }
   async load(filePath) {
-    const targetPath = path3.isAbsolute(filePath) ? filePath : path3.join(this.cwd, filePath);
+    const targetPath = path4.isAbsolute(filePath) ? filePath : path4.join(this.cwd, filePath);
     try {
-      const content = await fs4.readFile(targetPath, "utf8");
+      const content = await fs5.readFile(targetPath, "utf8");
       const parsed = JSON.parse(content);
       if (!Array.isArray(parsed) || parsed.some((event) => event.workflowId !== this.workflowId)) {
         throw new Error(`Ledger is incompatible with workflow '${this.workflowId}'.`);
@@ -1157,9 +1304,9 @@ var DelegationController = class {
       actor: supported ? actor : "Atlas",
       actorType: supported ? "runtime-agent" : "control-plane",
       observed: true,
-      runtime: "opencode",
+      runtime: this.adapter.runtime,
       eventType: startType,
-      provenance: "opencode-adapter",
+      provenance: this.adapter.provenance,
       data: {
         phase,
         runtimeAgentRequested: actor,
@@ -1190,7 +1337,7 @@ var DelegationController = class {
       runResult = await this.adapter.execute(prompt, { agent: actor, readOnly, requireActorConfirmation: true, orchestratedChild: true });
     }
     if (runResult.success && requireExplicitActor) {
-      if (!["explicit", "sdk-session"].includes(runResult.runtimeAgentSelectionMode || "") || runResult.runtimeAgentApplied !== actor || runResult.runtimeActorConfirmation !== "confirmed") {
+      if (!["explicit", "sdk-session", "native-delegation"].includes(runResult.runtimeAgentSelectionMode || "") || runResult.runtimeAgentApplied !== actor || runResult.runtimeActorConfirmation !== "confirmed") {
         runResult = {
           ...runResult,
           success: false,
@@ -1216,9 +1363,9 @@ var DelegationController = class {
       actor: runResult.runtimeAgentApplied === actor ? actor : "Atlas",
       actorType: runResult.runtimeAgentApplied === actor ? "runtime-agent" : "control-plane",
       observed: true,
-      runtime: "opencode",
+      runtime: this.adapter.runtime,
       eventType: completeType,
-      provenance: "opencode-adapter",
+      provenance: this.adapter.provenance,
       data: {
         phase,
         success: runResult.success,
@@ -1261,9 +1408,9 @@ var DelegationController = class {
         actor: canApply ? owner : "Atlas",
         actorType: canApply ? "runtime-agent" : "control-plane",
         observed: true,
-        runtime: "opencode",
+        runtime: this.adapter.runtime,
         eventType: "implementation_start",
-        provenance: "opencode-adapter",
+        provenance: this.adapter.provenance,
         data: {
           agent: owner,
           prompt: promptMsg,
@@ -1287,9 +1434,9 @@ var DelegationController = class {
         actor: isApplied ? owner : "Atlas",
         actorType: isApplied ? "runtime-agent" : "control-plane",
         observed: true,
-        runtime: "opencode",
+        runtime: this.adapter.runtime,
         eventType: "implementation_complete",
-        provenance: "opencode-adapter",
+        provenance: this.adapter.provenance,
         data: {
           success: runResult.success,
           commandsRun: runResult.commandsRun || [],
@@ -1337,9 +1484,9 @@ var DelegationController = class {
           actor: canApply ? "Sage" : "Atlas",
           actorType: canApply ? "auditor" : "control-plane",
           observed: true,
-          runtime: "opencode",
+          runtime: this.adapter.runtime,
           eventType: "validation_start",
-          provenance: "opencode-adapter",
+          provenance: this.adapter.provenance,
           data: {
             agent: "Sage",
             event: "validation.started",
@@ -1357,8 +1504,8 @@ var DelegationController = class {
       }
       let gitDiff = "";
       try {
-        const { execSync: execSync5 } = await import("child_process");
-        gitDiff = execSync5("git diff HEAD", { cwd: this.cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        const { execSync: execSync6 } = await import("child_process");
+        gitDiff = execSync6("git diff HEAD", { cwd: this.cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       } catch {
       }
       const prompt = `Please validate the implementation. Diff:
@@ -1372,9 +1519,9 @@ ${JSON.stringify(result, null, 2)}`;
           actor: isApplied ? "Sage" : "Atlas",
           actorType: isApplied ? "auditor" : "control-plane",
           observed: true,
-          runtime: "opencode",
+          runtime: this.adapter.runtime,
           eventType: "validation_complete",
-          provenance: "opencode-adapter",
+          provenance: this.adapter.provenance,
           data: {
             success: runResult.success,
             commandsRun: runResult.commandsRun || [],
@@ -1401,11 +1548,38 @@ ${JSON.stringify(result, null, 2)}`;
   }
 };
 
+// src/core/runtime/runtime-factory.ts
+import fs6 from "fs/promises";
+import path5 from "path";
+function isRuntimeName(value) {
+  return value === "opencode" || value === "codex";
+}
+async function resolveRuntime({ cwd, runtime }) {
+  if (runtime !== void 0) {
+    if (!isRuntimeName(runtime)) {
+      throw new Error(`Unsupported runtime '${runtime}'. Expected opencode or codex.`);
+    }
+    return runtime;
+  }
+  try {
+    const raw = await fs6.readFile(path5.join(cwd, ".ai-workflow", "config.json"), "utf8");
+    const config = JSON.parse(raw);
+    const configured = typeof config.runtime === "string" ? config.runtime.split("+").map((item) => item.trim()) : [];
+    if (configured.length === 1 && configured[0] === "codex") return "codex";
+  } catch {
+  }
+  return "opencode";
+}
+async function createRuntimeAdapter(options) {
+  const runtime = await resolveRuntime(options);
+  return runtime === "codex" ? new CodexRuntimeAdapter({ cwd: options.cwd }) : new OpenCodeAdapter({ cwd: options.cwd });
+}
+
 // src/core/finalization/workspace-snapshot.ts
-import fs5 from "fs/promises";
-import path4 from "path";
+import fs7 from "fs/promises";
+import path6 from "path";
 import crypto2 from "crypto";
-import { execFileSync, execSync as execSync3 } from "child_process";
+import { execFileSync, execSync as execSync4 } from "child_process";
 var WorkspaceSnapshot = class {
   cwd;
   fastTrack;
@@ -1437,7 +1611,7 @@ var WorkspaceSnapshot = class {
     }
     const execGit = (args) => {
       try {
-        return execSync3(`git ${args}`, { cwd: this.cwd, encoding: "utf8", stdio: "pipe" }).trim();
+        return execSync4(`git ${args}`, { cwd: this.cwd, encoding: "utf8", stdio: "pipe" }).trim();
       } catch {
         return "";
       }
@@ -1483,10 +1657,10 @@ var WorkspaceSnapshot = class {
       const normalizedPath = relativePath.replaceAll("\\", "/");
       if (this.isIgnored(normalizedPath)) continue;
       try {
-        const fullPath = path4.join(this.cwd, relativePath);
-        const stat = await fs5.stat(fullPath);
+        const fullPath = path6.join(this.cwd, relativePath);
+        const stat = await fs7.stat(fullPath);
         if (!stat.isFile()) continue;
-        const content = await fs5.readFile(fullPath);
+        const content = await fs7.readFile(fullPath);
         const sha256 = crypto2.createHash("sha256").update(content).digest("hex");
         const isExecutable = (stat.mode & 73) !== 0;
         const mode = isExecutable ? "100755" : "100644";
@@ -1497,10 +1671,10 @@ var WorkspaceSnapshot = class {
   }
   async scanDir(dir, filesMap) {
     try {
-      const entries = await fs5.readdir(dir, { withFileTypes: true });
+      const entries = await fs7.readdir(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = path4.join(dir, entry.name);
-        const relativePath = path4.relative(this.cwd, fullPath);
+        const fullPath = path6.join(dir, entry.name);
+        const relativePath = path6.relative(this.cwd, fullPath);
         if (this.isIgnored(relativePath)) {
           continue;
         }
@@ -1508,8 +1682,8 @@ var WorkspaceSnapshot = class {
           await this.scanDir(fullPath, filesMap);
         } else if (entry.isFile()) {
           try {
-            const stat = await fs5.stat(fullPath);
-            const content = await fs5.readFile(fullPath);
+            const stat = await fs7.stat(fullPath);
+            const content = await fs7.readFile(fullPath);
             const sha256 = crypto2.createHash("sha256").update(content).digest("hex");
             const isExecutable = (stat.mode & 73) !== 0;
             const mode = isExecutable ? "100755" : "100644";
@@ -1543,9 +1717,9 @@ var WorkspaceSnapshot = class {
 };
 
 // src/core/finalization/finalizer.ts
-import { execSync as execSync4 } from "child_process";
-import path5 from "path";
-import fs6 from "fs/promises";
+import { execSync as execSync5 } from "child_process";
+import path7 from "path";
+import fs8 from "fs/promises";
 var Finalizer = class {
   cwd;
   snapshotManager;
@@ -1558,9 +1732,9 @@ var Finalizer = class {
   getChangedFilesFromGit() {
     try {
       const files = /* @__PURE__ */ new Set();
-      const diff = execSync4("git diff --name-only HEAD", { cwd: this.cwd, encoding: "utf8" });
+      const diff = execSync5("git diff --name-only HEAD", { cwd: this.cwd, encoding: "utf8" });
       diff.split("\n").map((f) => f.trim()).filter(Boolean).forEach((f) => files.add(f));
-      const status = execSync4("git status --short --untracked-files=all", { cwd: this.cwd, encoding: "utf8" });
+      const status = execSync5("git status --short --untracked-files=all", { cwd: this.cwd, encoding: "utf8" });
       status.split("\n").forEach((line) => {
         const match = line.match(/^(?:[ MADRCU?!]{2}\s+|[MADRCU?!]\s+)(.+)$/);
         if (match) {
@@ -1618,8 +1792,8 @@ var Finalizer = class {
     const verifyResult = await fidelityGate.verify(filesToCheck);
     let passed = requestFidelity.passed && verifyResult.passed;
     let reason = !requestFidelity.passed ? requestFidelity.reason : verifyResult.reason;
-    const evidencePath = path5.join(this.cwd, "EVIDENCE.json");
-    const hasEvidence = await fs6.access(evidencePath).then(() => true).catch(() => false);
+    const evidencePath = path7.join(this.cwd, "EVIDENCE.json");
+    const hasEvidence = await fs8.access(evidencePath).then(() => true).catch(() => false);
     if (hasEvidence) {
       const { EvidenceValidator } = await import("./evidence-validator-HS3NTWAB.js");
       const isTest = process.env.NODE_ENV === "test" || process.env.VITEST === "true";
@@ -1827,7 +2001,7 @@ var RequestClassifier = class {
 };
 
 // src/core/execution-planner.ts
-import path6 from "path";
+import path8 from "path";
 var ExecutionPlanner = class {
   cwd;
   constructor({ cwd = process.cwd() } = {}) {
@@ -1839,7 +2013,7 @@ var ExecutionPlanner = class {
   plan(classification, taskSlug = "task") {
     const remediationLimit = classification.remediationLimit;
     const branchNeeded = classification.intent === "write";
-    const specPath = classification.specNeeded ? path6.join("docs/workflows", taskSlug, "spec.md") : null;
+    const specPath = classification.specNeeded ? path8.join("docs/workflows", taskSlug, "spec.md") : null;
     const owner = classification.routingDecision?.mutationOwner === "Astra" ? "Astra" : classification.routingDecision?.selectedActor || (classification.intent === "write" ? "Astra" : classification.owner);
     const validationsExpected = [];
     if (classification.validationNeeded) {
@@ -1932,6 +2106,7 @@ export {
   isTerminalFailure,
   COMPLETION_STATUS_TEXT,
   OpenCodeAdapter,
+  CodexRuntimeAdapter,
   SpecValidator,
   HandoffEngine,
   HealerEngine,
@@ -1939,9 +2114,11 @@ export {
   resolveWorkflowProfile,
   EvidenceLedger,
   DelegationController,
+  resolveRuntime,
+  createRuntimeAdapter,
   Finalizer,
   RequestClassifier,
   ExecutionPlanner,
   WorkflowStateMachine
 };
-//# sourceMappingURL=chunk-4FI5ODAM.js.map
+//# sourceMappingURL=chunk-JDSEOEYW.js.map