@wrenai/genbi 0.0.3 → 0.0.5

package/dist-server/server/runtime-host/codex-compatibility.d.ts

@@ -0,0 +1,110 @@
+import { z } from "zod";
+import type { RuntimeBackendDiagnostic, RuntimeBackendReadiness } from "./types.js";
+export declare const CODEX_BASELINE_VERSION = "0.156.1";
+export declare const CODEX_REQUIRED_CONTRACTS: readonly ["initialize", "config/read", "thread/start", "turn/start", "turn/interrupt", "permissionProfile/list", "thread/start.permissions", "turn/start.permissions", "command/exec.permissionProfile", "command/exec", "command/exec/write", "command/exec/resize", "command/exec/terminate", "protected_read", "shared_temp_isolation", "network_deny", "timeout_cleanup", "connection_cleanup", "account/read", "thread/start.dynamicTools", "item/tool/call", "component_step_isolation"];
+export declare const codexCertificationSchema: z.ZodObject<{
+    state: z.ZodLiteral<"certified_row">;
+    platform: z.ZodLiteral<"darwin-arm64">;
+    version: z.ZodLiteral<"0.156.1">;
+    executableSha256: z.ZodString;
+    source: z.ZodString;
+    protocolSha256: z.ZodString;
+    executionScope: z.ZodObject<{
+        models: z.ZodArray<z.ZodString>;
+        entries: z.ZodArray<z.ZodEnum<{
+            answer_query: "answer_query";
+            generate_dashboard: "generate_dashboard";
+        }>>;
+    }, z.core.$strict>;
+    contracts: z.ZodArray<z.ZodEnum<{
+        "account/read": "account/read";
+        "command/exec": "command/exec";
+        "command/exec.permissionProfile": "command/exec.permissionProfile";
+        "command/exec/resize": "command/exec/resize";
+        "command/exec/terminate": "command/exec/terminate";
+        "command/exec/write": "command/exec/write";
+        component_step_isolation: "component_step_isolation";
+        "config/read": "config/read";
+        connection_cleanup: "connection_cleanup";
+        initialize: "initialize";
+        "item/tool/call": "item/tool/call";
+        network_deny: "network_deny";
+        "permissionProfile/list": "permissionProfile/list";
+        protected_read: "protected_read";
+        shared_temp_isolation: "shared_temp_isolation";
+        "thread/start": "thread/start";
+        "thread/start.dynamicTools": "thread/start.dynamicTools";
+        "thread/start.permissions": "thread/start.permissions";
+        timeout_cleanup: "timeout_cleanup";
+        "turn/interrupt": "turn/interrupt";
+        "turn/start": "turn/start";
+        "turn/start.permissions": "turn/start.permissions";
+    }>>;
+    terminal: z.ZodOptional<z.ZodObject<{
+        transport: z.ZodLiteral<"remote-tui-v1">;
+        deterministicProbesSha256: z.ZodString;
+        packedAcceptanceSha256: z.ZodString;
+        releaseApprovalSha256: z.ZodString;
+    }, z.core.$strict>>;
+    evidence: z.ZodObject<{
+        deterministicProbesSha256: z.ZodString;
+        packedAcceptanceSha256: z.ZodString;
+        releaseApprovalSha256: z.ZodString;
+    }, z.core.$strict>;
+    dependencies: z.ZodObject<{
+        warble: z.ZodString;
+        ir: z.ZodString;
+        "context-loader": z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type CodexCertification = z.infer<typeof codexCertificationSchema>;
+export declare const CODEX_CERTIFIED_ROWS: readonly CodexCertification[];
+declare const CODEX_DEPENDENCY_PACKAGES: {
+    readonly "@warble/cli": "warble";
+    readonly "@warble/codex-local": "warble";
+    readonly "@warble/claude-agent-sdk": "warble";
+    readonly "@warble/ir-spec": "ir";
+    readonly "@wrenai/context-loader": "context-loader";
+};
+export type CodexDependencyPackage = keyof typeof CODEX_DEPENDENCY_PACKAGES;
+export type CodexInstalledDependencies = Readonly<Partial<Record<CodexDependencyPackage, string | undefined>>>;
+export interface CodexDependencyReaders {
+    /** Manifest path, or undefined only when Node cannot resolve the package at all. */
+    readonly resolve?: (name: CodexDependencyPackage) => string | undefined;
+    readonly read?: (file: string) => string;
+    readonly declared?: (name: CodexDependencyPackage) => string | undefined;
+}
+/**
+ * The installed package manifests are authoritative: what Node resolves is what runs, and a
+ * consumer's overrides can make it differ from this package's declared pin. Every npm package
+ * ships its own package.json and all of these resolve `<name>/package.json`, so a packed install
+ * can read them. This package's declared exact pin is the fallback only when a package cannot be
+ * resolved at all; a resolved manifest that cannot be read or carries no version is "unreadable"
+ * and therefore drifts, as does a dependency found in neither place.
+ */
+export declare function installedCodexDependencies({ resolve, read, declared, }?: CodexDependencyReaders): CodexInstalledDependencies;
+/** Each entry names one drifted package as `name: certified X, installed Y`. */
+export declare function codexDependencyDrift(certified: CodexCertification["dependencies"], installed: CodexInstalledDependencies): readonly string[];
+/** Host-only diagnostic; `drift` details `codex_dependencies_drifted` and never enters readiness text. */
+export type CodexIdentityDiagnostic = RuntimeBackendDiagnostic & {
+    readonly drift?: readonly string[];
+};
+export type CodexIdentityVerdict = {
+    readonly readiness: RuntimeBackendReadiness<"codex-app-server">;
+    readonly diagnostic: CodexIdentityDiagnostic;
+};
+export interface CodexObservedIdentity {
+    readonly platform: string;
+    readonly versionOutput: string;
+    readonly executableSha256: string;
+    readonly source: string;
+    readonly protocolSha256: string;
+    readonly contracts: readonly string[];
+}
+/** Pure comparison for release verification; only the packaged rows grant execution. */
+export declare function evaluateCodexIdentity(observed: CodexObservedIdentity, rows?: readonly unknown[], installed?: CodexInstalledDependencies): CodexIdentityVerdict;
+/** Application admission is narrower than the vendor protocol capability probe. */
+export declare function isCodexExecutionCertified(source: string, executableSha256: string, models: readonly string[], entry: string, rows?: readonly unknown[]): boolean;
+/** A driver certification alone never admits the remote CLI renderer. */
+export declare function isCodexTerminalCertified(source: string, executableSha256: string, models: readonly string[], entry: string, rows?: readonly unknown[]): boolean;
+export {};

package/dist-server/server/runtime-host/codex-compatibility.js

@@ -0,0 +1,162 @@
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { runtimeNotReady, runtimeReady } from "./policy.js";
+export const CODEX_BASELINE_VERSION = "0.156.1";
+export const CODEX_REQUIRED_CONTRACTS = [
+    "initialize", "config/read", "thread/start", "turn/start", "turn/interrupt",
+    "permissionProfile/list", "thread/start.permissions", "turn/start.permissions", "command/exec.permissionProfile",
+    "command/exec", "command/exec/write", "command/exec/resize", "command/exec/terminate",
+    "protected_read", "shared_temp_isolation", "network_deny", "timeout_cleanup", "connection_cleanup",
+    "account/read", "thread/start.dynamicTools", "item/tool/call", "component_step_isolation",
+];
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const exactVersion = z.string().regex(/^[0-9]+\.[0-9]+\.[0-9]+$/);
+export const codexCertificationSchema = z.object({
+    state: z.literal("certified_row"),
+    platform: z.literal("darwin-arm64"),
+    version: z.literal(CODEX_BASELINE_VERSION),
+    executableSha256: digest,
+    source: z.string().url().refine((value) => value.startsWith("https://")),
+    protocolSha256: digest,
+    executionScope: z.object({ models: z.array(z.string().min(1)).min(1), entries: z.array(z.enum(["answer_query", "generate_dashboard"])).min(1) }).strict(),
+    contracts: z.array(z.enum(CODEX_REQUIRED_CONTRACTS)).refine((values) => values.length === CODEX_REQUIRED_CONTRACTS.length && new Set(values).size === values.length),
+    terminal: z.object({
+        transport: z.literal("remote-tui-v1"),
+        deterministicProbesSha256: digest,
+        packedAcceptanceSha256: digest,
+        releaseApprovalSha256: digest,
+    }).strict().optional(),
+    evidence: z.object({
+        deterministicProbesSha256: digest,
+        packedAcceptanceSha256: digest,
+        releaseApprovalSha256: digest,
+    }).strict(),
+    /** The component versions the acceptance records were produced with; drift denies the row. */
+    dependencies: z.object({ warble: exactVersion, ir: exactVersion, "context-loader": exactVersion }).strict(),
+}).strict();
+// Tested baseline evidence is not a production execution grant. Release
+// engineering must add an exact reviewed row, never a minimum-version range.
+export const CODEX_CERTIFIED_ROWS = Object.freeze([
+    {
+        "state": "certified_row",
+        "platform": "darwin-arm64",
+        "version": "0.156.1",
+        "executableSha256": "0196e89fe5a7598f816ee54232c3d7c26d75e502ab5cfe2c9240e81d90f7255a",
+        "source": "https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-darwin-arm64.tgz",
+        "protocolSha256": "655adafa0ccea3d84f30bcbdc74e201fa14511c51e08d0cd024a0280daa8bc60",
+        "executionScope": { "models": ["gpt-5.5"], "entries": ["answer_query"] },
+        "contracts": [...CODEX_REQUIRED_CONTRACTS],
+        "terminal": { "transport": "remote-tui-v1", "deterministicProbesSha256": "9abc4615a9a6020d8d0a2efbeaf36306a48cf3675020e3d43039c6b3505be60f", "packedAcceptanceSha256": "e3a8080db623e4695fba916c1ba4b0da53559ada529de13ba594da7ab5350f71", "releaseApprovalSha256": "322145f63432c3c2751877f30bfc059e7af14af93818c176d50f99182546b0aa" },
+        "evidence": { "deterministicProbesSha256": "5ad42e18f831e1688bc76665224c627b3cb25919383717ade7d7107548e1ce90", "packedAcceptanceSha256": "d15692acec5557e41e5b4eed5ced697d5fed5c2aaf8f0c231ac7afca503f7ca0", "releaseApprovalSha256": "c9eb86e98e18fd5ebe6f3f21865facda6bf8b7beb4f2c6f200db9611dbecf88f" },
+        "dependencies": { "warble": "0.15.2", "ir": "0.8.0", "context-loader": "0.1.1" }
+    }
+]);
+const CODEX_DEPENDENCY_PACKAGES = {
+    "@warble/cli": "warble",
+    "@warble/codex-local": "warble",
+    "@warble/claude-agent-sdk": "warble",
+    "@warble/ir-spec": "ir",
+    "@wrenai/context-loader": "context-loader",
+};
+function packageRoot() {
+    const server = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+    const parent = path.resolve(server, "..");
+    return path.basename(parent) === "dist-server" ? path.resolve(parent, "..") : parent;
+}
+function declaredPin(name) {
+    try {
+        const value = JSON.parse(readFileSync(path.join(packageRoot(), "package.json"), "utf8")).dependencies?.[name];
+        return typeof value === "string" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The installed package manifests are authoritative: what Node resolves is what runs, and a
+ * consumer's overrides can make it differ from this package's declared pin. Every npm package
+ * ships its own package.json and all of these resolve `<name>/package.json`, so a packed install
+ * can read them. This package's declared exact pin is the fallback only when a package cannot be
+ * resolved at all; a resolved manifest that cannot be read or carries no version is "unreadable"
+ * and therefore drifts, as does a dependency found in neither place.
+ */
+export function installedCodexDependencies({ resolve = (name) => { try {
+    return createRequire(import.meta.url).resolve(`${name}/package.json`);
+}
+catch {
+    return undefined;
+} }, read = (file) => readFileSync(file, "utf8"), declared = declaredPin, } = {}) {
+    const installedVersion = (name) => {
+        const manifest = resolve(name);
+        if (manifest === undefined)
+            return declared(name);
+        try {
+            const version = JSON.parse(read(manifest)).version;
+            return typeof version === "string" ? version : "unreadable";
+        }
+        catch {
+            return "unreadable";
+        }
+    };
+    return Object.fromEntries(Object.keys(CODEX_DEPENDENCY_PACKAGES)
+        .map((name) => [name, installedVersion(name)]));
+}
+/** Each entry names one drifted package as `name: certified X, installed Y`. */
+export function codexDependencyDrift(certified, installed) {
+    return Object.entries(CODEX_DEPENDENCY_PACKAGES)
+        .filter(([name, key]) => installed[name] !== certified[key])
+        .map(([name, key]) => `${name}: certified ${certified[key]}, installed ${installed[name] ?? "unresolved"}`);
+}
+/** Pure comparison for release verification; only the packaged rows grant execution. */
+export function evaluateCodexIdentity(observed, rows = CODEX_CERTIFIED_ROWS, installed = installedCodexDependencies()) {
+    const deny = (code, phase) => ({
+        readiness: runtimeNotReady("codex-app-server", "incompatible", code), diagnostic: { phase },
+    });
+    if (observed.platform !== "darwin-arm64")
+        return deny("runtime_platform_unsupported", "platform");
+    const match = /^codex-cli ([0-9]+\.[0-9]+\.[0-9]+)\r?\n?$/.exec(observed.versionOutput);
+    if (!match)
+        return deny("codex_cli_version_malformed", "version");
+    if (match[1] !== CODEX_BASELINE_VERSION)
+        return deny("codex_cli_version_unsupported", "version");
+    const valid = rows.map((row) => codexCertificationSchema.safeParse(row)).filter((row) => row.success).map((row) => row.data);
+    const row = valid.find((candidate) => candidate.executableSha256 === observed.executableSha256 && candidate.source === observed.source);
+    if (!row)
+        return deny("codex_identity_uncertified", "identity");
+    if (row.protocolSha256 !== observed.protocolSha256)
+        return deny("codex_app_server_protocol_incompatible", "capability");
+    if (CODEX_REQUIRED_CONTRACTS.some((name) => !observed.contracts.includes(name))) {
+        return deny("codex_sandbox_policy_unavailable", "capability");
+    }
+    // The row's evidence was accepted with exact component versions; a matching binary running
+    // other components is not what was certified, so it stays denied until re-certification.
+    const drift = codexDependencyDrift(row.dependencies, installed);
+    if (drift.length > 0) {
+        const denied = deny("codex_dependencies_drifted", "identity");
+        return { ...denied, diagnostic: { ...denied.diagnostic, drift } };
+    }
+    return {
+        readiness: runtimeReady(row.version, ["app_server_rpc", "sandbox_policy", "filesystem_isolation", "network_isolation", "pty", "terminal_resize", "terminal_terminate"]),
+        diagnostic: { phase: "capability", observedVersion: row.version },
+    };
+}
+/** Application admission is narrower than the vendor protocol capability probe. */
+export function isCodexExecutionCertified(source, executableSha256, models, entry, rows = CODEX_CERTIFIED_ROWS) {
+    return models.length > 0 && rows.some((value) => {
+        const row = codexCertificationSchema.safeParse(value);
+        return row.success && row.data.source === source && row.data.executableSha256 === executableSha256
+            && row.data.executionScope.entries.some((allowed) => allowed === entry)
+            && models.every((model) => row.data.executionScope.models.includes(model));
+    });
+}
+/** A driver certification alone never admits the remote CLI renderer. */
+export function isCodexTerminalCertified(source, executableSha256, models, entry, rows = CODEX_CERTIFIED_ROWS) {
+    return rows.some((value) => {
+        const row = codexCertificationSchema.safeParse(value);
+        return row.success && row.data.terminal?.transport === "remote-tui-v1"
+            && isCodexExecutionCertified(source, executableSha256, models, entry, [row.data]);
+    });
+}

package/dist-server/server/runtime-host/codex-component-step.d.ts

@@ -0,0 +1,19 @@
+import type { StepRun, StepResponse } from "../../harness/components/runner.js";
+import { type RpcTransport } from "./codex-rpc.js";
+/** Internal driver input from a certified provisioner, never browser configuration. */
+export interface CodexComponentPolicy {
+    readonly cwd: string;
+    readonly codexHome: string;
+    readonly permissionProfile: string;
+    readonly model: string;
+    readonly accountEmail: string;
+    readonly configuration: Readonly<Record<string, unknown>>;
+    /** Revalidates approved account, exact executable, environment and generation. */
+    assertCurrent(): void;
+    /** Cheap revocation check for passive events; full integrity is still checked at every effect boundary. */
+    assertLive?(): void;
+}
+/** Explicit feature denylist for the reviewed vendor baseline; new enabled defaults refuse. */
+export declare function codexComponentConfiguration(profile: string): Readonly<Record<string, unknown>>;
+/** Fresh connection/thread per step. No spawn, activation, command RPC or provider fallback. */
+export declare function runCodexComponentStep(transport: RpcTransport, approved: CodexComponentPolicy, run: StepRun): Promise<StepResponse>;

package/dist-server/server/runtime-host/codex-component-step.js

@@ -0,0 +1,308 @@
+import { isDeepStrictEqual } from "node:util";
+import { z } from "zod";
+import { CODEX_BASELINE_VERSION } from "./codex-compatibility.js";
+import { codexAccountUpdatedSchema, codexDisabledCodeModeWarningSchema, codexRateLimitsUpdatedSchema } from "./codex-events.js";
+import { CodexRpcClient, CodexRpcError, object } from "./codex-rpc.js";
+const id = z.string().min(1).max(256);
+const callSchema = z.object({ threadId: id, turnId: id, callId: id, tool: id, arguments: z.unknown(), namespace: z.null().optional() }).strict();
+const turnSchema = z.object({ id, status: z.enum(["inProgress", "completed", "failed", "interrupted"]), items: z.array(z.unknown()).max(512), itemsView: z.enum(["full", "notLoaded", "summary"]).default("full") })
+    .refine((turn) => turn.itemsView !== "notLoaded" || turn.items.length === 0);
+const threadSchema = z.object({ id, cwd: z.string(), cliVersion: z.literal(CODEX_BASELINE_VERSION), ephemeral: z.literal(true) });
+function deny() { throw new CodexRpcError("protocol"); }
+function parse(schema, value) { const result = schema.safeParse(value); return result.success ? result.data : deny(); }
+function freeze(value) {
+    if (value && typeof value === "object") {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+function configured(value) {
+    if (Array.isArray(value))
+        return value.map(configured);
+    if (object(value))
+        return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== null).map(([k, v]) => [k, configured(v)]));
+    return value;
+}
+function validatePolicy(policy) {
+    const c = policy.configuration;
+    if (!policy.model || !policy.accountEmail || !policy.permissionProfile || c.default_permissions !== policy.permissionProfile
+        || c.model_provider !== "openai" || c.approval_policy !== "never" || c.project_doc_max_bytes !== 0 || c.web_search !== "disabled"
+        || !isDeepStrictEqual(c.mcp_servers, {}) || !isDeepStrictEqual(c.project_root_markers, []))
+        deny();
+    const features = c.features;
+    if (!object(features) || ["shell_tool", "unified_exec", "multi_agent", "apps", "plugins", "hooks"].some((name) => features[name] !== false))
+        deny();
+    const permission = object(c.permissions) ? c.permissions[policy.permissionProfile] : undefined;
+    if (!object(permission) || !isDeepStrictEqual(permission.network, { enabled: false }) || !object(permission.filesystem)
+        || !isDeepStrictEqual(permission.filesystem, { "/": "deny" }))
+        deny();
+    if (!isDeepStrictEqual(c.shell_environment_policy, { inherit: "none", set: {} }))
+        deny();
+}
+/** Explicit feature denylist for the reviewed vendor baseline; new enabled defaults refuse. */
+export function codexComponentConfiguration(profile) {
+    if (!/^[a-z][a-z0-9_-]{0,63}$/.test(profile))
+        deny();
+    return {
+        default_permissions: profile, model_provider: "openai", approval_policy: "never",
+        project_doc_max_bytes: 0, project_root_markers: [], web_search: "disabled", mcp_servers: {},
+        permissions: { [profile]: { filesystem: { "/": "deny" }, network: { enabled: false } } },
+        shell_environment_policy: { inherit: "none", set: {} },
+        features: Object.fromEntries([
+            "shell_tool", "unified_exec", "multi_agent", "apps", "plugins", "hooks", "auth_elicitation",
+            "mentions_v2", "remote_plugin", "tool_suggest", "memories", "remote_control", "mcp_2026_07_28",
+            "browser_use", "browser_use_external", "browser_use_full_cdp_access", "computer_use", "code_mode_host",
+            "code_mode", "code_mode_only", "image_generation", "in_app_browser", "multi_agent_v2", "plugin_sharing",
+            "skill_mcp_dependency_install", "skill_search", "workspace_dependencies", "request_permissions_tool",
+            "exec_permission_approvals", "guardian_approval", "guardianv2", "goals", "external_agent_memory_import",
+            "realtime_conversation", "shell_snapshot", "standalone_web_search",
+        ].map((name) => [name, false])),
+    };
+}
+/** Fresh connection/thread per step. No spawn, activation, command RPC or provider fallback. */
+export async function runCodexComponentStep(transport, approved, run) {
+    // Capture authority before callbacks or transport I/O can mutate the supplied object.
+    const policy = freeze({ cwd: approved.cwd, codexHome: approved.codexHome,
+        permissionProfile: approved.permissionProfile, model: approved.model, accountEmail: approved.accountEmail,
+        configuration: structuredClone(approved.configuration), assertCurrent: approved.assertCurrent.bind(approved),
+        ...(approved.assertLive ? { assertLive: approved.assertLive.bind(approved) } : {}) });
+    let phase = "init";
+    let threadId;
+    let turnId;
+    let finalText;
+    let usage = { inputTokens: 0, outputTokens: 0 };
+    const items = new Map();
+    const calls = new Set();
+    let failed = false;
+    let threadStarted = false;
+    let turnStarted = false;
+    let accountResponseReceived = false;
+    let queued = [];
+    let queuedBytes = 0;
+    let pendingTools = 0;
+    let toolQueue = Promise.resolve();
+    let resolveTurn;
+    let rejectTurn;
+    const completion = new Promise((resolve, reject) => { resolveTurn = resolve; rejectTurn = reject; });
+    void completion.catch(() => { });
+    let scopeReady;
+    const ready = new Promise((resolve) => { scopeReady = resolve; });
+    const check = () => { if (failed)
+        deny(); run.signal.throwIfAborted(); (policy.assertLive ?? policy.assertCurrent)(); };
+    const verify = () => { if (failed)
+        deny(); run.signal.throwIfAborted(); policy.assertCurrent(); };
+    const scope = (value) => { if (value.threadId !== threadId || value.turnId !== turnId)
+        deny(); };
+    const receive = (event) => {
+        check();
+        const p = object(event.params) ? event.params : deny();
+        if (event.method === "account/rateLimits/updated") {
+            parse(codexRateLimitsUpdatedSchema, p);
+            return;
+        } // telemetry only, never authority
+        if (event.method === "account/updated") {
+            if (accountResponseReceived || phase !== "init")
+                deny();
+            parse(codexAccountUpdatedSchema, p);
+            return; // startup only; account/read must still verify the pinned identity
+        }
+        if (event.method === "remoteControl/status/changed") {
+            if (p.status !== "disabled")
+                deny();
+            return;
+        }
+        if (phase === "thread" || phase === "starting") {
+            queuedBytes += Buffer.byteLength(JSON.stringify(event));
+            if (queued.length >= 128 || queuedBytes > 1_048_576)
+                deny();
+            queued.push(event);
+            return;
+        }
+        if (event.method === "thread/started") {
+            const t = parse(threadSchema, p.thread);
+            if (threadStarted || t.id !== threadId || t.cwd !== policy.cwd)
+                deny();
+            threadStarted = true;
+            return;
+        }
+        if (!threadId || p.threadId !== threadId)
+            deny();
+        if (event.method === "warning") {
+            parse(codexDisabledCodeModeWarningSchema, p);
+            const features = policy.configuration.features;
+            if (!object(features) || features.code_mode_host !== false || features.code_mode !== false)
+                deny();
+            return; // exact denial warning only; no tool or permission is enabled
+        }
+        if (event.method === "thread/status/changed") {
+            parse(z.object({ type: z.enum(["notLoaded", "idle", "systemError", "active"]) }), p.status);
+            return;
+        }
+        if (phase !== "running")
+            deny();
+        if (event.method === "turn/started" || event.method === "turn/completed") {
+            const t = parse(turnSchema, p.turn);
+            if (t.id !== turnId)
+                deny();
+            if (event.method === "turn/started") {
+                if (turnStarted || t.status !== "inProgress" || t.items.length)
+                    deny();
+                turnStarted = true;
+                return;
+            }
+            const completedIds = new Set();
+            for (const raw of t.items) {
+                const item = parse(z.object({ id, type: z.enum(["userMessage", "agentMessage", "reasoning", "dynamicToolCall"]) }).passthrough(), raw);
+                const observed = items.get(item.id);
+                if (completedIds.has(item.id) || !observed?.done || observed.type !== item.type || !isDeepStrictEqual(observed.completed, raw))
+                    deny();
+                completedIds.add(item.id);
+            }
+            // Summary/notLoaded views omit items; the complete streamed lifecycle is
+            // authoritative. Every supplied item still matches, and full views cover all.
+            if (!threadStarted || !turnStarted || (t.itemsView === "full" && completedIds.size !== items.size) || t.status !== "completed" || pendingTools || [...items.values()].some((item) => !item.done) || finalText === undefined)
+                deny();
+            phase = "finished";
+            resolveTurn();
+            return;
+        }
+        scope(p);
+        if (event.method === "thread/tokenUsage/updated") {
+            const total = parse(z.object({ total: z.object({ inputTokens: z.number().int().nonnegative(), outputTokens: z.number().int().nonnegative() }) }), p.tokenUsage).total;
+            if (total.inputTokens < usage.inputTokens || total.outputTokens < usage.outputTokens)
+                deny();
+            usage = total;
+            return;
+        }
+        if (event.method === "item/started" || event.method === "item/completed") {
+            parse(z.number().int().nonnegative(), p[event.method === "item/started" ? "startedAtMs" : "completedAtMs"]);
+            const item = parse(z.object({ id, type: z.enum(["userMessage", "agentMessage", "reasoning", "dynamicToolCall"]) }).passthrough(), p.item);
+            if (item.type === "dynamicToolCall" && (typeof item.tool !== "string" || !Object.hasOwn(run.tools, item.tool) || item.namespace != null))
+                deny();
+            if (event.method === "item/started") {
+                if (items.has(item.id) || items.size >= 512)
+                    deny();
+                items.set(item.id, { type: item.type, done: false });
+            }
+            else {
+                const state = items.get(item.id);
+                if (!state || state.done || state.type !== item.type)
+                    deny();
+                state.done = true;
+                state.completed = structuredClone(p.item);
+                if (item.type === "agentMessage")
+                    finalText = parse(z.string().max(1_048_576), item.text);
+                if (item.type === "dynamicToolCall" && (!calls.has(item.id) || item.status !== "completed" || item.success !== true))
+                    deny();
+            }
+            return;
+        }
+        if (!["item/agentMessage/delta", "item/reasoning/textDelta", "item/reasoning/summaryTextDelta", "item/reasoning/summaryPartAdded"].includes(event.method)
+            || typeof p.itemId !== "string" || !items.has(p.itemId) || items.get(p.itemId).done)
+            deny();
+    };
+    const rpc = new CodexRpcClient(transport, receive, 1_048_576, async (event) => {
+        check();
+        if (event.method !== "item/tool/call" || (phase !== "starting" && phase !== "running"))
+            deny();
+        const call = parse(callSchema, event.params);
+        if (calls.has(call.callId) || calls.size >= 32 || !Object.hasOwn(run.tools, call.tool))
+            deny();
+        calls.add(call.callId);
+        pendingTools++;
+        const result = toolQueue.then(async () => {
+            await Promise.race([ready, completion.then(deny)]);
+            check();
+            scope(call);
+            if (phase !== "running")
+                deny();
+            if (Buffer.byteLength(JSON.stringify(call.arguments)) > 65_536)
+                deny();
+            verify();
+            const output = await run.tools[call.tool](call.arguments);
+            verify();
+            if (phase !== "running")
+                deny();
+            const text = JSON.stringify(output);
+            if (text === undefined || Buffer.byteLength(text) > 1_048_000)
+                deny();
+            return { contentItems: [{ type: "inputText", text }], success: true };
+        });
+        toolQueue = result.catch(() => { failed = true; rpc.fail("protocol"); });
+        try {
+            return await result;
+        }
+        finally {
+            pendingTools--;
+        }
+    });
+    rpc.onFailure((error) => { failed = true; rejectTurn(error); });
+    const abort = () => rpc.fail("cancelled");
+    run.signal.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(() => rpc.fail("timeout"), 120_000);
+    const drain = () => { const events = queued; queued = []; queuedBytes = 0; for (const event of events)
+        receive(event); };
+    try {
+        verify();
+        validatePolicy(policy);
+        const initialized = parse(z.object({ codexHome: z.literal(policy.codexHome), platformFamily: z.literal("unix"), platformOs: z.literal("macos"), userAgent: z.string() }), await rpc.request("initialize", { clientInfo: { name: "genbi-components", version: "1" }, capabilities: { experimentalApi: true } }));
+        if (!initialized.userAgent.includes(`/${CODEX_BASELINE_VERSION} `))
+            deny();
+        rpc.notify("initialized", {});
+        const effective = parse(z.object({ config: z.record(z.string(), z.unknown()) }), await rpc.request("config/read", { cwd: policy.cwd, includeLayers: false }));
+        for (const [key, expected] of Object.entries(policy.configuration)) {
+            if (key === "features") {
+                const features = effective.config.features;
+                if (!object(features) || Object.values(configured(features)).some((value) => value !== false) || !object(expected) || Object.keys(expected).some((name) => features[name] !== false))
+                    deny();
+            }
+            else if (!isDeepStrictEqual(configured(effective.config[key]), configured(expected)))
+                deny();
+        }
+        parse(z.object({ requiresOpenaiAuth: z.literal(true), account: z.object({ type: z.literal("chatgpt"), email: z.literal(policy.accountEmail) }) }), await rpc.request("account/read", { refreshToken: false }, 10_000, undefined, () => { accountResponseReceived = true; }));
+        verify();
+        phase = "thread";
+        const started = parse(z.object({ thread: threadSchema, model: z.literal(policy.model), modelProvider: z.literal("openai"),
+            approvalPolicy: z.literal("never"), cwd: z.literal(policy.cwd),
+            activePermissionProfile: z.object({ id: z.literal(policy.permissionProfile), extends: z.null().optional() }).strict(),
+            instructionSources: z.array(z.never()).default([]), runtimeWorkspaceRoots: z.array(z.never()).default([]),
+        }), await rpc.request("thread/start", {
+            cwd: policy.cwd, model: policy.model, modelProvider: "openai", permissions: policy.permissionProfile, approvalPolicy: "never", ephemeral: true,
+            runtimeWorkspaceRoots: [], environments: [], allowProviderModelFallback: false,
+            baseInstructions: [run.brief, run.prompt].filter(Boolean).join("\n\n"), developerInstructions: "",
+            dynamicTools: Object.keys(run.tools).map((name) => ({ name, description: run.toolDescriptions[name] ?? name, inputSchema: run.toolSchemas[name] ?? deny() })),
+        }));
+        if (started.thread.cwd !== policy.cwd)
+            deny();
+        threadId = started.thread.id;
+        phase = "init";
+        drain();
+        verify();
+        phase = "starting";
+        const startedTurn = parse(z.object({ turn: turnSchema }), await rpc.request("turn/start", {
+            threadId, model: policy.model, permissions: policy.permissionProfile, approvalPolicy: "never", cwd: policy.cwd, runtimeWorkspaceRoots: [], environments: [],
+            input: [{ type: "text", text: JSON.stringify({ request: run.request, input: run.input, consumes: run.consumes }) }],
+        }));
+        if (startedTurn.turn.status !== "inProgress")
+            deny();
+        turnId = startedTurn.turn.id;
+        phase = "running";
+        scopeReady();
+        drain();
+        await completion;
+        verify();
+        return { value: finalText, usage };
+    }
+    catch (error) {
+        rpc.fail(error instanceof CodexRpcError ? error.reason : "protocol");
+        throw new CodexRpcError(error instanceof CodexRpcError ? error.reason : "protocol");
+    }
+    finally {
+        phase = "finished";
+        clearTimeout(timer);
+        run.signal.removeEventListener("abort", abort);
+        await rpc.close();
+    }
+}