@with-logic/elwood 0.2.1 → 0.2.2

package/dist/codex/config/lock.js

@@ -1,22 +1,113 @@
 /**
- * Process-wide async mutex for the Codex `config.toml`. The file is a single
- * process-global resource, but Elwood sessions serialize only per-session, so
- * two concurrent `setModel` switches could interleave their snapshot / picker /
- * compare-and-swap restore transactions on the shared file and leave the wrong
- * model persisted as the user's default. This serializes the whole transaction
- * across all sessions in the process. Mirrors clipboard-lock.ts and implements
- * PRD §5.3 setModel restore and C-CODEX-14.
+ * Per-file async mutex for Codex `config.toml`. Elwood sessions serialize only
+ * per-session, so two concurrent `setModel` switches on one config file could
+ * interleave their snapshot / picker / compare-and-swap restore transactions and
+ * leave the wrong model persisted as the user's default. The lock is keyed per canonical
+ * config file: every path that names one file (a symlinked home or config, another letter
+ * case or Unicode form) shares its lock, and sessions whose configs have different keys never
+ * wait on each other. Paths that differ only in case share a key on every volume, so on a
+ * case-sensitive volume two such files share a lock. Implements PRD §5.3 setModel restore and
+ * C-CODEX-14.
  *
  * SCOPE: this lock is PROCESS-LOCAL. Two separate Elwood processes sharing one
  * `config.toml` can still interleave their transactions — an accepted current
  * limitation (the compare-and-swap still refuses to clobber an unrelated edit).
  * Closing it needs an inter-process lock on the resolved path and is separate work.
  */
+import { readlinkSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { createAsyncMutex } from "../../core/async-mutex.js";
+import { elwoodError, errnoCode } from "../../core/errors.js";
+/** Locks with a holder or a waiter; an idle file's entry is removed. */
+const locks = new Map();
 /**
- * Runs `task` while holding the config lock: each caller waits for the prior
- * holder to finish before starting, and the lock is released when `task`
- * settles (success or failure), so a failing switch never wedges the queue.
+ * Runs `task` while holding the lock for the config file at `path`: each caller on that
+ * file waits for the prior holder to finish before starting, and the lock is released when
+ * `task` settles (success or failure), so a failing switch never wedges the queue. A path
+ * that cannot be resolved rejects without running `task`.
  */
-export const withCodexConfigLock = createAsyncMutex();
+export function withCodexConfigLock(path, task, cancel) {
+    let key;
+    try {
+        key = configFileIdentity(path);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    const lock = locks.get(key) ?? { run: createAsyncMutex(), users: 0 };
+    locks.set(key, lock);
+    lock.users += 1;
+    const result = lock.run(task, cancel);
+    const release = () => {
+        lock.users -= 1;
+        if (lock.users === 0)
+            locks.delete(key);
+    };
+    result.then(release, release);
+    return result;
+}
+/** How many lock entries currently have a holder or waiter. */
+export function codexConfigLocksForTests() {
+    return locks.size;
+}
+/**
+ * The key for the file at `path`, so every path naming it shares one lock: its canonical path,
+ * spelled by `lockSpelling`. A config Codex has not created yet is named by where it will be: a
+ * dangling symlink by its target, otherwise by its deepest existing directory's canonical path
+ * plus the names still to be created. Any other failure to resolve it rejects, since a fallback
+ * could give two names for one file two locks.
+ */
+function configFileIdentity(path) {
+    const unresolved = [];
+    for (let candidatePath = path;; candidatePath = dirname(candidatePath)) {
+        const real = realpathIfPresent(candidatePath);
+        if (real !== undefined)
+            return lockSpelling(join(real, ...unresolved));
+        const target = unresolved.length === 0 ? linkTarget(path) : undefined;
+        // Relative to the link's own directory, followed physically, as the kernel follows it.
+        if (target !== undefined)
+            return configFileIdentity(isAbsolute(target) ? target : `${dirname(path)}/${target}`);
+        unresolved.unshift(basename(candidatePath));
+    }
+}
+/**
+ * One spelling for every way of writing a path: Unicode-decomposed and fully case-folded.
+ * macOS volumes ignore Unicode normalization, and the default APFS folds case fully, so `ß`,
+ * `ẞ`, `ss`, and `SS` name one file; lower-casing alone keeps `ß`. Lower, upper, then lower
+ * case again folds them all to `ss`. Every key is folded the same way, never by asking the
+ * volume, so a key cannot change when its file appears. On a case-sensitive volume, two configs
+ * whose paths differ only in case share a lock too, which only makes one switch wait for the
+ * other.
+ */
+function lockSpelling(path) {
+    return path.normalize("NFD").toLowerCase().toUpperCase().toLowerCase().normalize("NFD");
+}
+/** `path`'s canonical path, or `undefined` when it does not exist. */
+function realpathIfPresent(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch (error) {
+        const errno = errnoCode(error);
+        if (errno === "ENOENT")
+            return undefined;
+        throw unresolvable(path, errno);
+    }
+}
+/** A missing file's symlink target; `undefined` when nothing is there at all. */
+function linkTarget(path) {
+    try {
+        return readlinkSync(path);
+    }
+    catch (error) {
+        const errno = errnoCode(error);
+        if (errno === "ENOENT")
+            return undefined;
+        throw unresolvable(path, errno);
+    }
+}
+function unresolvable(path, errno) {
+    const message = "Could not resolve the Codex config to lock it.";
+    return elwoodError("model_automation_failed", message, { path, errno });
+}
 //# sourceMappingURL=lock.js.map

package/dist/codex/config/lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/codex/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAmB,gBAAgB,EAAoB,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI9D,wEAAwE;AACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,IAAsB,EACtB,MAAoB;IAEpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,aAAa,GAAG,IAAI,GAAI,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,uFAAuF;QACvF,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QACxF,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAyB;IAC3D,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,OAAO,WAAW,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/codex/config/read.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reads a Codex config.toml without letting the file stall or flood Elwood. The file can sit
+ * in a project-local `CODEX_HOME` that the agent itself may rewrite, so it can become a FIFO
+ * (a blocking read waits for a writer and freezes every session in the process) or grow
+ * without bound. Implements PRD §5.3 and C-CODEX-25.
+ */
+/** The largest config.toml Elwood reads (C-CODEX-25). */
+export declare const maxCodexConfigBytes: number;
+/**
+ * The text of the config.toml at `path`, or `undefined` when there is none. Anything else
+ * that is not a regular file of at most `maxCodexConfigBytes` throws an errno-coded error:
+ * `EISDIR` for a directory, `EFTYPE` for any other kind of file (a FIFO, socket, or device),
+ * `EFBIG` past the limit, and an open or read failure's own code.
+ */
+export declare function readCodexConfigFile(path: string): string | undefined;
+//# sourceMappingURL=read.d.ts.map

package/dist/codex/config/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/codex/config/read.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAI/C;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBpE"}

package/dist/codex/config/read.js

@@ -0,0 +1,75 @@
+/**
+ * Reads a Codex config.toml without letting the file stall or flood Elwood. The file can sit
+ * in a project-local `CODEX_HOME` that the agent itself may rewrite, so it can become a FIFO
+ * (a blocking read waits for a writer and freezes every session in the process) or grow
+ * without bound. Implements PRD §5.3 and C-CODEX-25.
+ */
+import { closeSync, constants, fstatSync, openSync, readSync, statSync } from "node:fs";
+import { errnoCode } from "../../core/errors.js";
+/** The largest config.toml Elwood reads (C-CODEX-25). */
+export const maxCodexConfigBytes = 1024 * 1024;
+/**
+ * The text of the config.toml at `path`, or `undefined` when there is none. Anything else
+ * that is not a regular file of at most `maxCodexConfigBytes` throws an errno-coded error:
+ * `EISDIR` for a directory, `EFTYPE` for any other kind of file (a FIFO, socket, or device),
+ * `EFBIG` past the limit, and an open or read failure's own code.
+ */
+export function readCodexConfigFile(path) {
+    let fd;
+    try {
+        // O_NONBLOCK: opening a FIFO read-only would otherwise wait for a writer.
+        fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (errnoCode(error) === "ENOENT")
+            return undefined;
+        // macOS will not open a Unix socket at all, failing with an errno Node cannot name
+        // (EOPNOTSUPP, "Unknown system error -102"). A target that cannot be opened is
+        // classified as it would be once open; any other failure keeps its own code.
+        throw notRegularFile(statOrUndefined(path), path) ?? error;
+    }
+    try {
+        const rejected = notRegularFile(fstatSync(fd), path);
+        if (rejected !== undefined)
+            throw rejected;
+        return readSizeChecked(fd, path);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function statOrUndefined(path) {
+    try {
+        return statSync(path);
+    }
+    catch {
+        return undefined;
+    }
+}
+function notRegularFile(stat, path) {
+    if (stat === undefined || stat.isFile())
+        return undefined;
+    return fileError(stat.isDirectory() ? "EISDIR" : "EFTYPE", path);
+}
+/**
+ * Reads the descriptor to end of file, failing with `EFBIG` once it holds more than the
+ * limit. It reads at most one byte past the limit: that byte is how a file over the limit
+ * is told apart from one exactly at it.
+ */
+function readSizeChecked(fd, path) {
+    const buffer = Buffer.alloc(maxCodexConfigBytes + 1);
+    let length = 0;
+    for (;;) {
+        const read = readSync(fd, buffer, length, buffer.length - length, null);
+        if (read === 0)
+            return buffer.toString("utf8", 0, length);
+        length += read;
+        if (length > maxCodexConfigBytes)
+            throw fileError("EFBIG", path);
+    }
+}
+function fileError(code, path) {
+    const reason = code === "EFBIG" ? `is larger than ${maxCodexConfigBytes} bytes` : "is not a regular file";
+    return Object.assign(new Error(`${code}: Codex config ${reason}: ${path}`), { code, path });
+}
+//# sourceMappingURL=read.js.map

package/dist/codex/config/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../src/codex/config/read.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAc,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,0EAA0E;QAC1E,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,mFAAmF;QACnF,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,QAAQ,CAAC;QAC3C,OAAO,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB,EAAE,IAAY;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,EAAU,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,IAAI,CAAC;QACf,IAAI,MAAM,GAAG,mBAAmB;YAAE,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAoB,EAAE,IAAY;IACnD,MAAM,MAAM,GACV,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,mBAAmB,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAC7F,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB,MAAM,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/codex/config/restore.d.ts

@@ -1,9 +1,9 @@
 /**
  * Compensates the Codex CLI persisting picker selections into config.toml.
  * Implements PRD §5.3 setModel restore and C-CODEX-14: a compare-and-swap restore
- * of the user's global config that never clobbers concurrent edits, written
- * atomically (sibling temp file + rename) so a crash mid-restore can never leave
- * the user's config truncated.
+ * of the config.toml a session's Codex runs with (C-CODEX-24) that never clobbers
+ * concurrent edits, written atomically (sibling temp file + rename) so a crash
+ * mid-restore can never leave that config truncated.
  */
 /**
  * `restored`: the snapshot was written back. `unchanged`: the picker wrote nothing.
@@ -12,14 +12,21 @@
  * the picker created one — Elwood has nothing to restore and leaves the new file.
  */
 type ConfigRestoreOutcome = "restored" | "skipped" | "unchanged" | "no_snapshot";
-export declare function codexConfigPath(): string;
 /**
  * Builds the CONTENT-FREE `raw` for a swallowed restore-failure warning: the config
  * path plus a bounded errno code only — never the error message, which could carry
- * credentials or conversation data if the failure came from a public listener.
+ * credentials or conversation data if the failure came from a public listener. A config
+ * read that failed carries its errno as `details.code` (C-CODEX-25).
  */
 export declare function restoreFailureRaw(path: string, error: unknown): string;
-export declare function snapshotCodexConfig(): string | undefined;
+/**
+ * The config's contents before the picker opens, or `undefined` when it does not exist. One
+ * that cannot be read (C-CODEX-25) fails the switch here: Codex would persist its selection
+ * into a file Elwood could not restore.
+ */
+export declare function snapshotCodexConfig(path: string): string | undefined;
+/** The config's contents at the restore, read as `snapshotCodexConfig` reads them. */
+export declare function currentCodexConfig(path: string): string | undefined;
 /**
  * Restores the snapshot if and only if the file now differs solely in the
  * root-level model keys the picker writes. Anything else — a concurrent user
@@ -28,6 +35,9 @@ export declare function snapshotCodexConfig(): string | undefined;
  * picker created is reported as `no_snapshot` rather than misreported as a
  * concurrent edit.
  */
-export declare function restoreCodexConfig(snapshot: string | undefined): ConfigRestoreOutcome;
+export declare function restoreCodexConfig({ path, snapshot, }: {
+    readonly path: string;
+    readonly snapshot: string | undefined;
+}): ConfigRestoreOutcome;
 export {};
 //# sourceMappingURL=restore.d.ts.map

package/dist/codex/config/restore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH;;;;;GAKG;AACH,KAAK,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtE;AAED,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAUrF"}
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH;;;;;GAKG;AACH,KAAK,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAGtE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnE;AAUD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,IAAI,EACJ,QAAQ,GACT,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,GAAG,oBAAoB,CAQvB"}

package/dist/codex/config/restore.js

@@ -1,28 +1,43 @@
 /**
  * Compensates the Codex CLI persisting picker selections into config.toml.
  * Implements PRD §5.3 setModel restore and C-CODEX-14: a compare-and-swap restore
- * of the user's global config that never clobbers concurrent edits, written
- * atomically (sibling temp file + rename) so a crash mid-restore can never leave
- * the user's config truncated.
+ * of the config.toml a session's Codex runs with (C-CODEX-24) that never clobbers
+ * concurrent edits, written atomically (sibling temp file + rename) so a crash
+ * mid-restore can never leave that config truncated.
  */
-import { chmodSync, existsSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { homedir } from "node:os";
+import { chmodSync, existsSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
-import { errnoCode } from "../../core/errors.js";
-export function codexConfigPath() {
-    return join(process.env["CODEX_HOME"] ?? join(homedir(), ".codex"), "config.toml");
-}
+import { ElwoodError, elwoodError, errnoCode } from "../../core/errors.js";
+import { readCodexConfigFile } from "./read.js";
 /**
  * Builds the CONTENT-FREE `raw` for a swallowed restore-failure warning: the config
  * path plus a bounded errno code only — never the error message, which could carry
- * credentials or conversation data if the failure came from a public listener.
+ * credentials or conversation data if the failure came from a public listener. A config
+ * read that failed carries its errno as `details.code` (C-CODEX-25).
  */
 export function restoreFailureRaw(path, error) {
-    return `${path} (${errnoCode(error) ?? "UNKNOWN"})`;
+    const code = error instanceof ElwoodError ? error.details["code"] : errnoCode(error);
+    return `${path} (${typeof code === "string" ? code : "UNKNOWN"})`;
+}
+/**
+ * The config's contents before the picker opens, or `undefined` when it does not exist. One
+ * that cannot be read (C-CODEX-25) fails the switch here: Codex would persist its selection
+ * into a file Elwood could not restore.
+ */
+export function snapshotCodexConfig(path) {
+    return readForSwitch(path, "Could not read the Codex config before switching models.");
+}
+/** The config's contents at the restore, read as `snapshotCodexConfig` reads them. */
+export function currentCodexConfig(path) {
+    return readForSwitch(path, "Could not read the Codex config to restore its default model.");
 }
-export function snapshotCodexConfig() {
-    const path = codexConfigPath();
-    return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+function readForSwitch(path, message) {
+    try {
+        return readCodexConfigFile(path);
+    }
+    catch (error) {
+        throw elwoodError("model_automation_failed", message, { path, code: errnoCode(error) });
+    }
 }
 /**
  * Restores the snapshot if and only if the file now differs solely in the
@@ -32,14 +47,12 @@ export function snapshotCodexConfig() {
  * picker created is reported as `no_snapshot` rather than misreported as a
  * concurrent edit.
  */
-export function restoreCodexConfig(snapshot) {
-    const path = codexConfigPath();
-    const exists = existsSync(path);
+export function restoreCodexConfig({ path, snapshot, }) {
     if (snapshot === undefined)
-        return exists ? "no_snapshot" : "unchanged";
-    if (!exists)
+        return existsSync(path) ? "no_snapshot" : "unchanged";
+    const current = currentCodexConfig(path);
+    if (current === undefined)
         return "skipped";
-    const current = readFileSync(path, "utf8");
     if (current === snapshot)
         return "unchanged";
     if (withoutRootModelKeys(current) !== withoutRootModelKeys(snapshot))

package/dist/codex/config/restore.js.map

@@ -1 +1 @@
-{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUjD,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uBAAuB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC,CAAC,yEAAyE;QACpF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;QAClD,IAAI,MAAM,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../src/codex/config/restore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAUhD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,MAAM,IAAI,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrF,OAAO,GAAG,IAAI,KAAK,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,CAAC,IAAI,EAAE,0DAA0D,CAAC,CAAC;AACzF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,aAAa,CAAC,IAAI,EAAE,+DAA+D,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,IAAI,EACJ,QAAQ,GAIT;IACC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IAClF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uBAAuB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC,CAAC,yEAAyE;QACpF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;QAClD,IAAI,MAAM,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/codex/config/transaction.d.ts

@@ -1,6 +1,6 @@
 /**
  * The Codex setModel config transaction: snapshot → drive the picker → restore,
- * all under the process-wide config lock. Factored out of session-instance so
+ * all under the lock for the session's config file. Factored out of session-instance so
  * every branch (switch succeeds/rejects × restore succeeds/throws) is unit
  * testable without a live session. Implements PRD §5.3 setModel restore and
  * C-CODEX-14 (a late picker rejection must still restore, and a restore failure
@@ -8,6 +8,8 @@
  */
 import type { MutexCancel } from "../../core/async-mutex.ts";
 type CodexModelSwitch = {
+    /** The session's config.toml; the transaction holds that file's lock. */
+    readonly path: string;
     /** Reads the current config.toml so it can be restored after the switch. */
     readonly snapshot: () => string | undefined;
     /** Drives the picker; rejects if the CLI automation fails or times out. */
@@ -17,7 +19,7 @@ type CodexModelSwitch = {
     /**
      * Reports a restore failure that had to be SWALLOWED because a primary error is
      * being preserved (both the picker and the restore failed). Without this the user
-     * would get no signal that their global config.toml may remain mutated. Optional;
+     * would get no signal that the session's config.toml may remain mutated. Optional;
      * omitted in tests that don't assert the diagnostic.
      */
     readonly onRestoreError?: (error: unknown) => void;
@@ -32,11 +34,11 @@ type CodexModelSwitch = {
      * The wait is BEST-EFFORT and bounded: it settles on the observed PTY exit, or on its
      * own deadline if the process never reports one. So the restore is ordered after a
      * confirmed exit in the normal case, but a CLI that never exits cannot hold the
-     * process-wide config lock indefinitely — it is a bound, not a guarantee of exit.
+     * config lock indefinitely — it is a bound, not a guarantee of exit.
      */
     readonly waitForCliExit?: () => Promise<unknown> | undefined;
     /**
-     * Cancels this switch while it is still WAITING for the process-wide config lock, so a
+     * Cancels this switch while it is still WAITING for the config lock, so a
      * deadline or session close behind another transaction rejects at once instead of
      * waiting out that transaction (including its exit bound). Once this switch holds the
      * lock it owns config.toml and must finish its snapshot/restore.

package/dist/codex/config/transaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAG7D,KAAK,gBAAgB,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuCvE"}
+{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAG7D,KAAK,gBAAgB,GAAG;IACtB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCvE"}

package/dist/codex/config/transaction.js

@@ -1,6 +1,6 @@
 /**
  * The Codex setModel config transaction: snapshot → drive the picker → restore,
- * all under the process-wide config lock. Factored out of session-instance so
+ * all under the lock for the session's config file. Factored out of session-instance so
  * every branch (switch succeeds/rejects × restore succeeds/throws) is unit
  * testable without a live session. Implements PRD §5.3 setModel restore and
  * C-CODEX-14 (a late picker rejection must still restore, and a restore failure
@@ -9,7 +9,7 @@
 import { withCodexConfigLock } from "./lock.js";
 export function runCodexModelSwitch(io) {
     return new Promise((resolve, reject) => {
-        const transaction = withCodexConfigLock(async () => {
+        const transact = async () => {
             const snapshot = io.snapshot();
             let primary;
             let failed = false;
@@ -44,7 +44,8 @@ export function runCodexModelSwitch(io) {
             restoreAfterSwitch(io, snapshot, failed || closing);
             if (failed)
                 throw primary;
-        }, io.cancel);
+        };
+        const transaction = withCodexConfigLock(io.path, transact, io.cancel);
         // A rejection already delivered above makes this one a no-op.
         transaction.then(resolve, reject);
     });

package/dist/codex/config/transaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAuChD,MAAM,UAAU,mBAAmB,CAAC,EAAoB;IACtD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAgB,CAAC;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,kFAAkF;YAClF,kFAAkF;YAClF,kFAAkF;YAClF,8EAA8E;YAC9E,8EAA8E;YAC9E,MAAM,QAAQ,GAAG,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACvC,oFAAoF;YACpF,mFAAmF;YACnF,mFAAmF;YACnF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,iFAAiF;gBACjF,gFAAgF;gBAChF,mFAAmF;gBACnF,8EAA8E;gBAC9E,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChB,MAAM,QAAQ,CAAC;YACjB,CAAC;YACD,qFAAqF;YACrF,0EAA0E;YAC1E,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC;YACpD,IAAI,MAAM;gBAAE,MAAM,OAAO,CAAC;QAC5B,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACd,8DAA8D;QAC9D,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CACzB,EAAoB,EACpB,QAA4B,EAC5B,OAAgB;IAEhB,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,CAAC;QACjC,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;QACjF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../../src/codex/config/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAyChD,MAAM,UAAU,mBAAmB,CAAC,EAAoB;IACtD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAgB,CAAC;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,kFAAkF;YAClF,kFAAkF;YAClF,kFAAkF;YAClF,8EAA8E;YAC9E,8EAA8E;YAC9E,MAAM,QAAQ,GAAG,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACvC,oFAAoF;YACpF,mFAAmF;YACnF,mFAAmF;YACnF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,iFAAiF;gBACjF,gFAAgF;gBAChF,mFAAmF;gBACnF,8EAA8E;gBAC9E,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChB,MAAM,QAAQ,CAAC;YACjB,CAAC;YACD,qFAAqF;YACrF,0EAA0E;YAC1E,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC;YACpD,IAAI,MAAM;gBAAE,MAAM,OAAO,CAAC;QAC5B,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,8DAA8D;QAC9D,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CACzB,EAAoB,EACpB,QAA4B,EAC5B,OAAgB;IAEhB,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,CAAC;QACjC,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;QACjF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/codex/images/clipboard-copies.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The temp copies Codex saves of pasted images. Codex writes each image pasted into its
+ * composer to a `codex-clipboard-*.png` file in its temp directory and never removes it, and
+ * Elwood attaches every Codex image by pasting it (C-API-46). A session collects the copies
+ * its own transcript names, in the `local_image` parts of the user messages it records, and
+ * removes them once its CLI has exited. Implements PRD §5.3 (C-API-46).
+ */
+import type { ImageCopyErrorCode } from "../../core/warnings/images.ts";
+/** The `local_image` paths of a completed `UserMessage` transcript item, of any kind. */
+export declare function localImagePathsIn(item: unknown): readonly string[];
+/**
+ * The copy `path` names directly in `tempDir`, rebuilt from `tempDir` and its name, else
+ * `undefined`. A path with a `..` segment never counts, since a link before it could lead
+ * the original path out of `tempDir`; repeated separators, which Codex may write after a
+ * `TMPDIR` that ends in one, do.
+ */
+export declare function clipboardCopyAt(path: string, tempDir: string): string | undefined;
+/**
+ * The pasted-image copies a committed transcript item names: those of its `local_image`
+ * paths that are copies directly in `tempDir`. Any other path, such as an image the user
+ * named by its own path, is never a copy.
+ */
+export declare function clipboardCopiesIn(item: unknown, tempDir: string): readonly string[];
+/** The pasted-image copies one session's transcript has named. */
+export declare class CodexClipboardCopies {
+    private readonly elwoodTempDir;
+    private readonly paths;
+    observe(item: unknown): void;
+    /**
+     * Removes every copy named so far, then calls `done` with the first failure's errno token,
+     * or `undefined` when every copy is gone: at once when there are none, else once the
+     * removals have finished. They run one at a time, so a session that pasted many images
+     * never blocks the event loop on them. Best-effort, as Elwood's own image temp files are
+     * (C-API-44): a copy that cannot be removed is left for the OS to reap. A copy already gone
+     * is not a failure.
+     */
+    removeAll(done: (failure: ImageCopyErrorCode | undefined) => void): void;
+}
+//# sourceMappingURL=clipboard-copies.d.ts.map

package/dist/codex/images/clipboard-copies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard-copies.d.ts","sourceRoot":"","sources":["../../../src/codex/images/clipboard-copies.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAOxE,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAUlE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKjF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEnF;AAED,kEAAkE;AAClE,qBAAa,oBAAoB;IAG/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI5B;;;;;;;OAOG;IACH,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,kBAAkB,GAAG,SAAS,KAAK,IAAI,GAAG,IAAI;CAUzE"}

package/dist/codex/images/clipboard-copies.js

@@ -0,0 +1,91 @@
+/**
+ * The temp copies Codex saves of pasted images. Codex writes each image pasted into its
+ * composer to a `codex-clipboard-*.png` file in its temp directory and never removes it, and
+ * Elwood attaches every Codex image by pasting it (C-API-46). A session collects the copies
+ * its own transcript names, in the `local_image` parts of the user messages it records, and
+ * removes them once its CLI has exited. Implements PRD §5.3 (C-API-46).
+ */
+import { unlink } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join, normalize, resolve, sep } from "node:path";
+import { isErrnoToken } from "../../core/errors.js";
+import { isRecord } from "../../core/predicates.js";
+import { boundedErrorToken } from "../../core/warnings/reasons.js";
+import { payloadOf } from "../transcript/payload.js";
+/** The name Codex gives a pasted image's copy (a random suffix, six characters or a UUID). */
+const copyNamePattern = /^codex-clipboard-[A-Za-z0-9_-]+\.png$/;
+/** The `local_image` paths of a completed `UserMessage` transcript item, of any kind. */
+export function localImagePathsIn(item) {
+    const payload = payloadOf(item);
+    const message = payload?.["type"] === "item_completed" ? payload["item"] : undefined;
+    if (!(isRecord(message) && message["type"] === "UserMessage"))
+        return [];
+    const content = message["content"];
+    if (!Array.isArray(content))
+        return [];
+    return content.flatMap((part) => {
+        const path = isRecord(part) && part["type"] === "local_image" ? part["path"] : undefined;
+        return typeof path === "string" ? [path] : [];
+    });
+}
+/**
+ * The copy `path` names directly in `tempDir`, rebuilt from `tempDir` and its name, else
+ * `undefined`. A path with a `..` segment never counts, since a link before it could lead
+ * the original path out of `tempDir`; repeated separators, which Codex may write after a
+ * `TMPDIR` that ends in one, do.
+ */
+export function clipboardCopyAt(path, tempDir) {
+    const name = basename(path);
+    const copy = join(tempDir, name);
+    const direct = normalize(path) === copy && !path.split(sep).includes("..");
+    return copyNamePattern.test(name) && direct ? copy : undefined;
+}
+/**
+ * The pasted-image copies a committed transcript item names: those of its `local_image`
+ * paths that are copies directly in `tempDir`. Any other path, such as an image the user
+ * named by its own path, is never a copy.
+ */
+export function clipboardCopiesIn(item, tempDir) {
+    return localImagePathsIn(item).flatMap((path) => clipboardCopyAt(path, tempDir) ?? []);
+}
+/** The pasted-image copies one session's transcript has named. */
+export class CodexClipboardCopies {
+    // Elwood's temp dir. Codex starts through the user's login shell, which could point it
+    // at another; copies there are not this session's to remove (PRD §5.3).
+    elwoodTempDir = resolve(tmpdir());
+    paths = new Set();
+    observe(item) {
+        for (const path of clipboardCopiesIn(item, this.elwoodTempDir))
+            this.paths.add(path);
+    }
+    /**
+     * Removes every copy named so far, then calls `done` with the first failure's errno token,
+     * or `undefined` when every copy is gone: at once when there are none, else once the
+     * removals have finished. They run one at a time, so a session that pasted many images
+     * never blocks the event loop on them. Best-effort, as Elwood's own image temp files are
+     * (C-API-44): a copy that cannot be removed is left for the OS to reap. A copy already gone
+     * is not a failure.
+     */
+    removeAll(done) {
+        const paths = [...this.paths];
+        this.paths.clear();
+        if (paths.length === 0) {
+            done(undefined);
+            return;
+        }
+        // `done` runs outside the removal's promise, as a deferred exit already does.
+        void removeEach(paths).then((failure) => queueMicrotask(() => done(failure)));
+    }
+}
+async function removeEach(paths) {
+    let failure;
+    for (const path of paths) {
+        const code = await unlink(path).then(() => undefined, 
+        // The errno token, else `UnknownError`: never a path or a raw message.
+        (error) => boundedErrorToken(error, isErrnoToken));
+        if (code !== undefined && code !== "ENOENT")
+            failure ??= code;
+    }
+    return failure;
+}
+//# sourceMappingURL=clipboard-copies.js.map

package/dist/codex/images/clipboard-copies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard-copies.js","sourceRoot":"","sources":["../../../src/codex/images/clipboard-copies.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,8FAA8F;AAC9F,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAa,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa,EAAE,OAAe;IAC9D,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,kEAAkE;AAClE,MAAM,OAAO,oBAAoB;IAC/B,uFAAuF;IACvF,wEAAwE;IACvD,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,OAAO,CAAC,IAAa;QACnB,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,IAAuD;QAC/D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,8EAA8E;QAC9E,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;CACF;AAED,KAAK,UAAU,UAAU,CAAC,KAAwB;IAChD,IAAI,OAAuC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAClC,GAAG,EAAE,CAAC,SAAS;QACf,uEAAuE;QACvE,CAAC,KAAc,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAC3D,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/codex/model-picker.d.ts

@@ -2,6 +2,6 @@
  * Codex /model picker automation spec.
  * Implements PRD §5.7, C-API-23, and C-API-24.
  */
-import type { ModelPickerSpec } from "../core/models/picker.ts";
+import { type ModelPickerSpec } from "../core/models/picker.ts";
 export declare const codexModelPicker: ModelPickerSpec;
 //# sourceMappingURL=model-picker.d.ts.map