@with-logic/elwood 0.2.0 → 0.2.2

package/dist/codex/config/home.js

@@ -0,0 +1,122 @@
+/**
+ * The `CODEX_HOME` a launched Codex runs with, as reported by the shell that launches it.
+ * Codex starts through the user's interactive login shell (§4.2), whose startup files can
+ * export a `CODEX_HOME` other than Elwood's own, or derive one from `$PWD`, the terminal, or
+ * the session's environment. A second shell cannot reproduce all of that, so the launch shell
+ * itself reports, just before it starts Codex, the exported values Codex inherits and the
+ * directory it starts Codex in, and the session reads its config.toml path from that report
+ * (§5.3). Implements PRD §4.2 and §5.3.
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { userInfo } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { ElwoodError, elwoodError, errnoCode } from "../../core/errors.js";
+import { abortableDelay } from "../../core/trust/abortable.js";
+import { shellQuote } from "../../runtime/shell.js";
+// A child `/bin/sh` of the launch shell sees only EXPORTED variables, exactly what Codex
+// inherits: an assignment that a startup file did not export reaches neither. It also starts
+// in the launch shell's directory, where Codex starts, and `$PWD` names that directory.
+const reportExported = shellQuote(`printf '%s\\0%s\\0%s\\0' "$CODEX_HOME" "$HOME" "$PWD"`);
+const expectedReportValueCount = 3;
+// Polled often enough that an operation waiting on a launch shell barely adds to its own
+// latency, while each poll stays one small read. The caller's signal bounds the wait.
+const reportPollMs = 25;
+/** The launch shell's exit status when it could not write the report (sysexits' EX_CANTCREAT). */
+export const reportFailedStatus = 73;
+/**
+ * The launch-script step that writes Codex's `CODEX_HOME`, `HOME`, and directory to
+ * `reportPath`, and ends the launch shell with `reportFailedStatus` if it cannot, so Codex
+ * starts only after a complete report. The values go to a file, not stdout, because startup
+ * files print to the same terminal (banners, tool notices, background jobs) and nothing would
+ * separate that from the report.
+ */
+export function reportCodexHomeCommand(reportPath) {
+    return `/bin/sh -c ${reportExported} > ${shellQuote(reportPath)} || exit ${reportFailedStatus}`;
+}
+/**
+ * The config.toml of the `CODEX_HOME` in `reportPath`, by Codex's own rule
+ * (`find_codex_home`): a non-empty `CODEX_HOME`, canonicalized the way Codex does, a relative
+ * one from the directory Codex runs in; else `$HOME/.codex`, where an empty `HOME` falls back
+ * to the account's home directory, as Codex's `home_dir` lookup does, and a relative one is
+ * from the directory Codex runs in. A model operation can
+ * start before the launch shell has reached the report, so an unfinished report is waited for
+ * until `signal` aborts, which then rejects with its reason, naming the report (`waitEnded`).
+ */
+export async function reportedCodexConfigPath(reportPath, signal) {
+    for (;;) {
+        const values = readReport(reportPath);
+        if (values !== undefined)
+            return join(codexHomeDir(reportPath, values), "config.toml");
+        if (!(await abortableDelay(signal, reportPollMs)))
+            throw waitEnded(reportPath, signal.reason);
+    }
+}
+/**
+ * Why the wait for a report ended. A typed reason, such as the operation's deadline, names the
+ * report it was waiting for, since the picker never opened; any other passes through as is.
+ */
+function waitEnded(reportPath, reason) {
+    if (!(reason instanceof ElwoodError))
+        return reason;
+    return elwoodError(reason.code, reason.message, { ...reason.details, path: reportPath });
+}
+/**
+ * Whether the launch shell finished its report, which it does before it starts Codex. A report
+ * that cannot be read counts as unfinished.
+ */
+export function codexHomeReported(reportPath) {
+    try {
+        return readReport(reportPath) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/** The report's values once complete; `undefined` while the launch shell is still writing it. */
+function readReport(reportPath) {
+    let text;
+    try {
+        text = readFileSync(reportPath, "utf8");
+    }
+    catch (error) {
+        const errno = errnoCode(error);
+        if (errno === "ENOENT")
+            return undefined;
+        throw unreadable(reportPath, { errno });
+    }
+    const parts = text.split("\0");
+    if (isComplete(parts)) {
+        const [codexHome, shellHomeDir, codexWorkingDirectory] = parts;
+        return [codexHome, shellHomeDir, codexWorkingDirectory];
+    }
+    // Fewer parts is a report still being written. A value cannot hold a NUL, so anything else
+    // is not a report.
+    if (parts.length <= expectedReportValueCount)
+        return undefined;
+    throw unreadable(reportPath, { cause: "The report is not three NUL-terminated values." });
+}
+/** Three NUL-terminated values split into four parts, the last one empty. */
+function isComplete(parts) {
+    return parts.length === expectedReportValueCount + 1 && parts[expectedReportValueCount] === "";
+}
+function codexHomeDir(reportPath, values) {
+    const [codexHome, shellHomeDir, codexWorkingDirectory] = values;
+    if (!codexHome) {
+        const home = shellHomeDir || userInfo().homedir;
+        // Codex uses `HOME` as given, so a relative one names a path from where Codex runs.
+        return isAbsolute(home) ? join(home, ".codex") : `${codexWorkingDirectory}/${home}/.codex`;
+    }
+    // Joined as text, not with `resolve`, which would drop `dir/..` by name: the kernel, and so
+    // Codex's canonicalization, follows `dir` first when it is a symlink, and so does realpath.
+    const path = isAbsolute(codexHome) ? codexHome : `${codexWorkingDirectory}/${codexHome}`;
+    try {
+        return realpathSync.native(path);
+    }
+    catch (error) {
+        throw unreadable(reportPath, { codexHome: path, errno: errnoCode(error) });
+    }
+}
+function unreadable(path, details) {
+    return elwoodError("model_automation_failed", "Could not read the CODEX_HOME this Codex session runs with.", { path, ...details });
+}
+//# sourceMappingURL=home.js.map

package/dist/codex/config/home.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home.js","sourceRoot":"","sources":["../../../src/codex/config/home.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,MAAM,cAAc,GAAG,UAAU,CAAC,uDAAuD,CAAC,CAAC;AAC3F,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,yFAAyF;AACzF,sFAAsF;AACtF,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,kGAAkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,cAAc,cAAc,MAAM,UAAU,CAAC,UAAU,CAAC,YAAY,kBAAkB,EAAE,CAAC;AAClG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,MAAmB;IAEnB,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAAE,MAAM,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,UAAkB,EAAE,MAAe;IACpD,IAAI,CAAC,CAAC,MAAM,YAAY,WAAW,CAAC;QAAE,OAAO,MAAM,CAAC;IACpD,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD,iGAAiG;AACjG,SAAS,UAAU,CAAC,UAAkB;IACpC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,UAAU,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,CAAC,GAAG,KAAK,CAAC;QAC/D,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,2FAA2F;IAC3F,mBAAmB;IACnB,IAAI,KAAK,CAAC,MAAM,IAAI,wBAAwB;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,UAAU,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAwB;IAC1C,OAAO,KAAK,CAAC,MAAM,KAAK,wBAAwB,GAAG,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,MAAsB;IAC9D,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,CAAC,GAAG,MAAM,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC,OAAO,CAAC;QAChD,oFAAoF;QACpF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,IAAI,IAAI,SAAS,CAAC;IAC7F,CAAC;IACD,4FAA4F;IAC5F,4FAA4F;IAC5F,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,qBAAqB,IAAI,SAAS,EAAE,CAAC;IACzF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAA0C;IAC1E,OAAO,WAAW,CAChB,yBAAyB,EACzB,6DAA6D,EAC7D,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CACrB,CAAC;AACJ,CAAC"}

package/dist/codex/config/lock.d.ts

@@ -1,21 +1,27 @@
 /**
- * Process-wide async mutex for the Codex `config.toml`. The file is a single
- * process-global resource, but Elwood sessions serialize only per-session, so
- * two concurrent `setModel` switches could interleave their snapshot / picker /
- * compare-and-swap restore transactions on the shared file and leave the wrong
- * model persisted as the user's default. This serializes the whole transaction
- * across all sessions in the process. Mirrors clipboard-lock.ts and implements
- * PRD §5.3 setModel restore and C-CODEX-14.
+ * Per-file async mutex for Codex `config.toml`. Elwood sessions serialize only
+ * per-session, so two concurrent `setModel` switches on one config file could
+ * interleave their snapshot / picker / compare-and-swap restore transactions and
+ * leave the wrong model persisted as the user's default. The lock is keyed per canonical
+ * config file: every path that names one file (a symlinked home or config, another letter
+ * case or Unicode form) shares its lock, and sessions whose configs have different keys never
+ * wait on each other. Paths that differ only in case share a key on every volume, so on a
+ * case-sensitive volume two such files share a lock. Implements PRD §5.3 setModel restore and
+ * C-CODEX-14.
  *
  * SCOPE: this lock is PROCESS-LOCAL. Two separate Elwood processes sharing one
  * `config.toml` can still interleave their transactions — an accepted current
  * limitation (the compare-and-swap still refuses to clobber an unrelated edit).
  * Closing it needs an inter-process lock on the resolved path and is separate work.
  */
+import { type MutexCancel } from "../../core/async-mutex.ts";
 /**
- * Runs `task` while holding the config lock: each caller waits for the prior
- * holder to finish before starting, and the lock is released when `task`
- * settles (success or failure), so a failing switch never wedges the queue.
+ * Runs `task` while holding the lock for the config file at `path`: each caller on that
+ * file waits for the prior holder to finish before starting, and the lock is released when
+ * `task` settles (success or failure), so a failing switch never wedges the queue. A path
+ * that cannot be resolved rejects without running `task`.
  */
-export declare const withCodexConfigLock: import("../../core/async-mutex.ts").AsyncMutex;
+export declare function withCodexConfigLock<T>(path: string, task: () => Promise<T>, cancel?: MutexCancel): Promise<T>;
+/** How many lock entries currently have a holder or waiter. */
+export declare function codexConfigLocksForTests(): number;
 //# sourceMappingURL=lock.d.ts.map

package/dist/codex/config/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,gDAAqB,CAAC"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAqC,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAQhG;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAED,+DAA+D;AAC/D,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD"}

package/dist/codex/config/lock.js

@@ -1,22 +1,113 @@
 /**
- * Process-wide async mutex for the Codex `config.toml`. The file is a single
- * process-global resource, but Elwood sessions serialize only per-session, so
- * two concurrent `setModel` switches could interleave their snapshot / picker /
- * compare-and-swap restore transactions on the shared file and leave the wrong
- * model persisted as the user's default. This serializes the whole transaction
- * across all sessions in the process. Mirrors clipboard-lock.ts and implements
- * PRD §5.3 setModel restore and C-CODEX-14.
+ * Per-file async mutex for Codex `config.toml`. Elwood sessions serialize only
+ * per-session, so two concurrent `setModel` switches on one config file could
+ * interleave their snapshot / picker / compare-and-swap restore transactions and
+ * leave the wrong model persisted as the user's default. The lock is keyed per canonical
+ * config file: every path that names one file (a symlinked home or config, another letter
+ * case or Unicode form) shares its lock, and sessions whose configs have different keys never
+ * wait on each other. Paths that differ only in case share a key on every volume, so on a
+ * case-sensitive volume two such files share a lock. Implements PRD §5.3 setModel restore and
+ * C-CODEX-14.
  *
  * SCOPE: this lock is PROCESS-LOCAL. Two separate Elwood processes sharing one
  * `config.toml` can still interleave their transactions — an accepted current
  * limitation (the compare-and-swap still refuses to clobber an unrelated edit).
  * Closing it needs an inter-process lock on the resolved path and is separate work.
  */
+import { readlinkSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { createAsyncMutex } from "../../core/async-mutex.js";
+import { elwoodError, errnoCode } from "../../core/errors.js";
+/** Locks with a holder or a waiter; an idle file's entry is removed. */
+const locks = new Map();
 /**
- * Runs `task` while holding the config lock: each caller waits for the prior
- * holder to finish before starting, and the lock is released when `task`
- * settles (success or failure), so a failing switch never wedges the queue.
+ * Runs `task` while holding the lock for the config file at `path`: each caller on that
+ * file waits for the prior holder to finish before starting, and the lock is released when
+ * `task` settles (success or failure), so a failing switch never wedges the queue. A path
+ * that cannot be resolved rejects without running `task`.
  */
-export const withCodexConfigLock = createAsyncMutex();
+export function withCodexConfigLock(path, task, cancel) {
+    let key;
+    try {
+        key = configFileIdentity(path);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    const lock = locks.get(key) ?? { run: createAsyncMutex(), users: 0 };
+    locks.set(key, lock);
+    lock.users += 1;
+    const result = lock.run(task, cancel);
+    const release = () => {
+        lock.users -= 1;
+        if (lock.users === 0)
+            locks.delete(key);
+    };
+    result.then(release, release);
+    return result;
+}
+/** How many lock entries currently have a holder or waiter. */
+export function codexConfigLocksForTests() {
+    return locks.size;
+}
+/**
+ * The key for the file at `path`, so every path naming it shares one lock: its canonical path,
+ * spelled by `lockSpelling`. A config Codex has not created yet is named by where it will be: a
+ * dangling symlink by its target, otherwise by its deepest existing directory's canonical path
+ * plus the names still to be created. Any other failure to resolve it rejects, since a fallback
+ * could give two names for one file two locks.
+ */
+function configFileIdentity(path) {
+    const unresolved = [];
+    for (let candidatePath = path;; candidatePath = dirname(candidatePath)) {
+        const real = realpathIfPresent(candidatePath);
+        if (real !== undefined)
+            return lockSpelling(join(real, ...unresolved));
+        const target = unresolved.length === 0 ? linkTarget(path) : undefined;
+        // Relative to the link's own directory, followed physically, as the kernel follows it.
+        if (target !== undefined)
+            return configFileIdentity(isAbsolute(target) ? target : `${dirname(path)}/${target}`);
+        unresolved.unshift(basename(candidatePath));
+    }
+}
+/**
+ * One spelling for every way of writing a path: Unicode-decomposed and fully case-folded.
+ * macOS volumes ignore Unicode normalization, and the default APFS folds case fully, so `ß`,
+ * `ẞ`, `ss`, and `SS` name one file; lower-casing alone keeps `ß`. Lower, upper, then lower
+ * case again folds them all to `ss`. Every key is folded the same way, never by asking the
+ * volume, so a key cannot change when its file appears. On a case-sensitive volume, two configs
+ * whose paths differ only in case share a lock too, which only makes one switch wait for the
+ * other.
+ */
+function lockSpelling(path) {
+    return path.normalize("NFD").toLowerCase().toUpperCase().toLowerCase().normalize("NFD");
+}
+/** `path`'s canonical path, or `undefined` when it does not exist. */
+function realpathIfPresent(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch (error) {
+        const errno = errnoCode(error);
+        if (errno === "ENOENT")
+            return undefined;
+        throw unresolvable(path, errno);
+    }
+}
+/** A missing file's symlink target; `undefined` when nothing is there at all. */
+function linkTarget(path) {
+    try {
+        return readlinkSync(path);
+    }
+    catch (error) {
+        const errno = errnoCode(error);
+        if (errno === "ENOENT")
+            return undefined;
+        throw unresolvable(path, errno);
+    }
+}
+function unresolvable(path, errno) {
+    const message = "Could not resolve the Codex config to lock it.";
+    return elwoodError("model_automation_failed", message, { path, errno });
+}
 //# sourceMappingURL=lock.js.map

package/dist/codex/config/lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAmB,gBAAgB,EAAoB,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI9D,wEAAwE;AACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,IAAsB,EACtB,MAAoB;IAEpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,aAAa,GAAG,IAAI,GAAI,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,uFAAuF;QACvF,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QACxF,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAyB;IAC3D,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,OAAO,WAAW,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/codex/config/read.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reads a Codex config.toml without letting the file stall or flood Elwood. The file can sit
+ * in a project-local `CODEX_HOME` that the agent itself may rewrite, so it can become a FIFO
+ * (a blocking read waits for a writer and freezes every session in the process) or grow
+ * without bound. Implements PRD §5.3 and C-CODEX-25.
+ */
+/** The largest config.toml Elwood reads (C-CODEX-25). */
+export declare const maxCodexConfigBytes: number;
+/**
+ * The text of the config.toml at `path`, or `undefined` when there is none. Anything else
+ * that is not a regular file of at most `maxCodexConfigBytes` throws an errno-coded error:
+ * `EISDIR` for a directory, `EFTYPE` for any other kind of file (a FIFO, socket, or device),
+ * `EFBIG` past the limit, and an open or read failure's own code.
+ */
+export declare function readCodexConfigFile(path: string): string | undefined;
+//# sourceMappingURL=read.d.ts.map

package/dist/codex/config/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/codex/config/read.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAI/C;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBpE"}

package/dist/codex/config/read.js

@@ -0,0 +1,75 @@
+/**
+ * Reads a Codex config.toml without letting the file stall or flood Elwood. The file can sit
+ * in a project-local `CODEX_HOME` that the agent itself may rewrite, so it can become a FIFO
+ * (a blocking read waits for a writer and freezes every session in the process) or grow
+ * without bound. Implements PRD §5.3 and C-CODEX-25.
+ */
+import { closeSync, constants, fstatSync, openSync, readSync, statSync } from "node:fs";
+import { errnoCode } from "../../core/errors.js";
+/** The largest config.toml Elwood reads (C-CODEX-25). */
+export const maxCodexConfigBytes = 1024 * 1024;
+/**
+ * The text of the config.toml at `path`, or `undefined` when there is none. Anything else
+ * that is not a regular file of at most `maxCodexConfigBytes` throws an errno-coded error:
+ * `EISDIR` for a directory, `EFTYPE` for any other kind of file (a FIFO, socket, or device),
+ * `EFBIG` past the limit, and an open or read failure's own code.
+ */
+export function readCodexConfigFile(path) {
+    let fd;
+    try {
+        // O_NONBLOCK: opening a FIFO read-only would otherwise wait for a writer.
+        fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (errnoCode(error) === "ENOENT")
+            return undefined;
+        // macOS will not open a Unix socket at all, failing with an errno Node cannot name
+        // (EOPNOTSUPP, "Unknown system error -102"). A target that cannot be opened is
+        // classified as it would be once open; any other failure keeps its own code.
+        throw notRegularFile(statOrUndefined(path), path) ?? error;
+    }
+    try {
+        const rejected = notRegularFile(fstatSync(fd), path);
+        if (rejected !== undefined)
+            throw rejected;
+        return readSizeChecked(fd, path);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function statOrUndefined(path) {
+    try {
+        return statSync(path);
+    }
+    catch {
+        return undefined;
+    }
+}
+function notRegularFile(stat, path) {
+    if (stat === undefined || stat.isFile())
+        return undefined;
+    return fileError(stat.isDirectory() ? "EISDIR" : "EFTYPE", path);
+}
+/**
+ * Reads the descriptor to end of file, failing with `EFBIG` once it holds more than the
+ * limit. It reads at most one byte past the limit: that byte is how a file over the limit
+ * is told apart from one exactly at it.
+ */
+function readSizeChecked(fd, path) {
+    const buffer = Buffer.alloc(maxCodexConfigBytes + 1);
+    let length = 0;
+    for (;;) {
+        const read = readSync(fd, buffer, length, buffer.length - length, null);
+        if (read === 0)
+            return buffer.toString("utf8", 0, length);
+        length += read;
+        if (length > maxCodexConfigBytes)
+            throw fileError("EFBIG", path);
+    }
+}
+function fileError(code, path) {
+    const reason = code === "EFBIG" ? `is larger than ${maxCodexConfigBytes} bytes` : "is not a regular file";
+    return Object.assign(new Error(`${code}: Codex config ${reason}: ${path}`), { code, path });
+}
+//# sourceMappingURL=read.js.map

package/dist/codex/config/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../src/codex/config/read.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAc,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,0EAA0E;QAC1E,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,mFAAmF;QACnF,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,QAAQ,CAAC;QAC3C,OAAO,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB,EAAE,IAAY;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,EAAU,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,IAAI,CAAC;QACf,IAAI,MAAM,GAAG,mBAAmB;YAAE,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAoB,EAAE,IAAY;IACnD,MAAM,MAAM,GACV,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,mBAAmB,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAC7F,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB,MAAM,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/codex/config/restore.d.ts

@@ -1,9 +1,9 @@
 /**
  * Compensates the Codex CLI persisting picker selections into config.toml.
  * Implements PRD §5.3 setModel restore and C-CODEX-14: a compare-and-swap restore
- * of the user's global config that never clobbers concurrent edits, written
- * atomically (sibling temp file + rename) so a crash mid-restore can never leave
- * the user's config truncated.
+ * of the config.toml a session's Codex runs with (C-CODEX-24) that never clobbers
+ * concurrent edits, written atomically (sibling temp file + rename) so a crash
+ * mid-restore can never leave that config truncated.
  */
 /**
  * `restored`: the snapshot was written back. `unchanged`: the picker wrote nothing.
@@ -12,14 +12,21 @@
  * the picker created one — Elwood has nothing to restore and leaves the new file.
  */
 type ConfigRestoreOutcome = "restored" | "skipped" | "unchanged" | "no_snapshot";
-export declare function codexConfigPath(): string;
 /**
  * Builds the CONTENT-FREE `raw` for a swallowed restore-failure warning: the config
  * path plus a bounded errno code only — never the error message, which could carry
- * credentials or conversation data if the failure came from a public listener.
+ * credentials or conversation data if the failure came from a public listener. A config
+ * read that failed carries its errno as `details.code` (C-CODEX-25).
  */
 export declare function restoreFailureRaw(path: string, error: unknown): string;
-export declare function snapshotCodexConfig(): string | undefined;
+/**
+ * The config's contents before the picker opens, or `undefined` when it does not exist. One
+ * that cannot be read (C-CODEX-25) fails the switch here: Codex would persist its selection
+ * into a file Elwood could not restore.
+ */
+export declare function snapshotCodexConfig(path: string): string | undefined;
+/** The config's contents at the restore, read as `snapshotCodexConfig` reads them. */
+export declare function currentCodexConfig(path: string): string | undefined;
 /**
  * Restores the snapshot if and only if the file now differs solely in the
  * root-level model keys the picker writes. Anything else — a concurrent user
@@ -28,6 +35,9 @@ export declare function snapshotCodexConfig(): string | undefined;
  * picker created is reported as `no_snapshot` rather than misreported as a
  * concurrent edit.
  */
-export declare function restoreCodexConfig(snapshot: string | undefined): ConfigRestoreOutcome;
+export declare function restoreCodexConfig({ path, snapshot, }: {
+    readonly path: string;
+    readonly snapshot: string | undefined;
+}): ConfigRestoreOutcome;
 export {};
 //# sourceMappingURL=restore.d.ts.map

package/dist/codex/config/restore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH;;;;;GAKG;AACH,KAAK,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtE;AAED,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAUrF"}
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH;;;;;GAKG;AACH,KAAK,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAGtE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnE;AAUD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,IAAI,EACJ,QAAQ,GACT,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,GAAG,oBAAoB,CAQvB"}

package/dist/codex/config/restore.js

@@ -1,28 +1,43 @@
 /**
  * Compensates the Codex CLI persisting picker selections into config.toml.
  * Implements PRD §5.3 setModel restore and C-CODEX-14: a compare-and-swap restore
- * of the user's global config that never clobbers concurrent edits, written
- * atomically (sibling temp file + rename) so a crash mid-restore can never leave
- * the user's config truncated.
+ * of the config.toml a session's Codex runs with (C-CODEX-24) that never clobbers
+ * concurrent edits, written atomically (sibling temp file + rename) so a crash
+ * mid-restore can never leave that config truncated.
  */
-import { chmodSync, existsSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { homedir } from "node:os";
+import { chmodSync, existsSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
-import { errnoCode } from "../../core/errors.js";
-export function codexConfigPath() {
-    return join(process.env["CODEX_HOME"] ?? join(homedir(), ".codex"), "config.toml");
-}
+import { ElwoodError, elwoodError, errnoCode } from "../../core/errors.js";
+import { readCodexConfigFile } from "./read.js";
 /**
  * Builds the CONTENT-FREE `raw` for a swallowed restore-failure warning: the config
  * path plus a bounded errno code only — never the error message, which could carry
- * credentials or conversation data if the failure came from a public listener.
+ * credentials or conversation data if the failure came from a public listener. A config
+ * read that failed carries its errno as `details.code` (C-CODEX-25).
  */
 export function restoreFailureRaw(path, error) {
-    return `${path} (${errnoCode(error) ?? "UNKNOWN"})`;
+    const code = error instanceof ElwoodError ? error.details["code"] : errnoCode(error);
+    return `${path} (${typeof code === "string" ? code : "UNKNOWN"})`;
+}
+/**
+ * The config's contents before the picker opens, or `undefined` when it does not exist. One
+ * that cannot be read (C-CODEX-25) fails the switch here: Codex would persist its selection
+ * into a file Elwood could not restore.
+ */
+export function snapshotCodexConfig(path) {
+    return readForSwitch(path, "Could not read the Codex config before switching models.");
+}
+/** The config's contents at the restore, read as `snapshotCodexConfig` reads them. */
+export function currentCodexConfig(path) {
+    return readForSwitch(path, "Could not read the Codex config to restore its default model.");
 }
-export function snapshotCodexConfig() {
-    const path = codexConfigPath();
-    return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+function readForSwitch(path, message) {
+    try {
+        return readCodexConfigFile(path);
+    }
+    catch (error) {
+        throw elwoodError("model_automation_failed", message, { path, code: errnoCode(error) });
+    }
 }
 /**
  * Restores the snapshot if and only if the file now differs solely in the
@@ -32,14 +47,12 @@ export function snapshotCodexConfig() {
  * picker created is reported as `no_snapshot` rather than misreported as a
  * concurrent edit.
  */
-export function restoreCodexConfig(snapshot) {
-    const path = codexConfigPath();
-    const exists = existsSync(path);
+export function restoreCodexConfig({ path, snapshot, }) {
     if (snapshot === undefined)
-        return exists ? "no_snapshot" : "unchanged";
-    if (!exists)
+        return existsSync(path) ? "no_snapshot" : "unchanged";
+    const current = currentCodexConfig(path);
+    if (current === undefined)
         return "skipped";
-    const current = readFileSync(path, "utf8");
     if (current === snapshot)
         return "unchanged";
     if (withoutRootModelKeys(current) !== withoutRootModelKeys(snapshot))

package/dist/codex/config/restore.js.map

@@ -1 +1 @@
-{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUjD,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uBAAuB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC,CAAC,yEAAyE;QACpF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;QAClD,IAAI,MAAM,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAUhD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,MAAM,IAAI,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrF,OAAO,GAAG,IAAI,KAAK,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,CAAC,IAAI,EAAE,0DAA0D,CAAC,CAAC;AACzF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,aAAa,CAAC,IAAI,EAAE,+DAA+D,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,IAAI,EACJ,QAAQ,GAIT;IACC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IAClF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uBAAuB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC,CAAC,yEAAyE;QACpF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;QAClD,IAAI,MAAM,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/codex/config/transaction.d.ts

@@ -1,6 +1,6 @@
 /**
  * The Codex setModel config transaction: snapshot → drive the picker → restore,
- * all under the process-wide config lock. Factored out of session-instance so
+ * all under the lock for the session's config file. Factored out of session-instance so
  * every branch (switch succeeds/rejects × restore succeeds/throws) is unit
  * testable without a live session. Implements PRD §5.3 setModel restore and
  * C-CODEX-14 (a late picker rejection must still restore, and a restore failure
@@ -8,6 +8,8 @@
  */
 import type { MutexCancel } from "../../core/async-mutex.ts";
 type CodexModelSwitch = {
+    /** The session's config.toml; the transaction holds that file's lock. */
+    readonly path: string;
     /** Reads the current config.toml so it can be restored after the switch. */
     readonly snapshot: () => string | undefined;
     /** Drives the picker; rejects if the CLI automation fails or times out. */
@@ -17,7 +19,7 @@ type CodexModelSwitch = {
     /**
      * Reports a restore failure that had to be SWALLOWED because a primary error is
      * being preserved (both the picker and the restore failed). Without this the user
-     * would get no signal that their global config.toml may remain mutated. Optional;
+     * would get no signal that the session's config.toml may remain mutated. Optional;
      * omitted in tests that don't assert the diagnostic.
      */
     readonly onRestoreError?: (error: unknown) => void;
@@ -32,11 +34,11 @@ type CodexModelSwitch = {
      * The wait is BEST-EFFORT and bounded: it settles on the observed PTY exit, or on its
      * own deadline if the process never reports one. So the restore is ordered after a
      * confirmed exit in the normal case, but a CLI that never exits cannot hold the
-     * process-wide config lock indefinitely — it is a bound, not a guarantee of exit.
+     * config lock indefinitely — it is a bound, not a guarantee of exit.
      */
     readonly waitForCliExit?: () => Promise<unknown> | undefined;
     /**
-     * Cancels this switch while it is still WAITING for the process-wide config lock, so a
+     * Cancels this switch while it is still WAITING for the config lock, so a
      * deadline or session close behind another transaction rejects at once instead of
      * waiting out that transaction (including its exit bound). Once this switch holds the
      * lock it owns config.toml and must finish its snapshot/restore.

package/dist/codex/config/transaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAG7D,KAAK,gBAAgB,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuCvE"}
+{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAG7D,KAAK,gBAAgB,GAAG;IACtB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCvE"}