@xfey/tenso 0.1.130

package/dist/providers/openai/app-server/session-store.js

@@ -0,0 +1,303 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+const SESSION_METADATA_FILE = "metadata.json";
+const SESSION_RECOVERY_EVIDENCE_FILE = "recovery-evidence.json";
+const SESSION_ARCHIVE_INCIDENT_FILE = "archive-incident.json";
+const SESSION_CODEX_HOME_DIRECTORY = "codex-home";
+const SESSION_LOCK_FILE = ".turn.lock";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function ensurePrivateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    chmodSync(path, 0o700);
+}
+function writePrivateJson(path, value) {
+    ensurePrivateDirectory(dirname(path));
+    const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    chmodSync(temporaryPath, 0o600);
+    renameSync(temporaryPath, path);
+    chmodSync(path, 0o600);
+}
+function readJson(path) {
+    if (!existsSync(path)) {
+        return null;
+    }
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+function parseMetadata(value) {
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        typeof value.session_ref !== "string" ||
+        (value.kind !== "formal_task_run" &&
+            value.kind !== "task_compile" &&
+            value.kind !== "project_context_bootstrap" &&
+            value.kind !== "context_sync") ||
+        typeof value.owner_ref !== "string" ||
+        (value.thread_id !== undefined && typeof value.thread_id !== "string") ||
+        typeof value.codex_version !== "string" ||
+        typeof value.model !== "string" ||
+        typeof value.provider_fingerprint !== "string" ||
+        (value.lifecycle !== "active" &&
+            value.lifecycle !== "archived" &&
+            value.lifecycle !== "incompatible") ||
+        typeof value.created_at !== "string" ||
+        typeof value.last_used_at !== "string") {
+        return null;
+    }
+    return value;
+}
+function codexSessionsRoot(tuttiHome, projectId) {
+    return join(tuttiHome, "projects", projectId, "codex-sessions");
+}
+function ownerIndexPath(tuttiHome, projectId, kind, ownerRef) {
+    return kind === "formal_task_run"
+        ? join(codexSessionsRoot(tuttiHome, projectId), "task-index", `${ownerRef}.json`)
+        : join(codexSessionsRoot(tuttiHome, projectId), "procedure-index", kind, `${ownerRef}.json`);
+}
+function sessionRoot(tuttiHome, projectId, sessionRef) {
+    return join(codexSessionsRoot(tuttiHome, projectId), sessionRef);
+}
+function compatible(metadata, expected) {
+    return (metadata.lifecycle !== "incompatible" &&
+        metadata.codex_version === expected.codexVersion &&
+        metadata.model === expected.model &&
+        metadata.provider_fingerprint === expected.providerFingerprint);
+}
+function createSession(input) {
+    const sessionRef = `codex-session-${randomUUID()}`;
+    const root = sessionRoot(input.tuttiHome, input.projectId, sessionRef);
+    const codexHome = join(root, SESSION_CODEX_HOME_DIRECTORY);
+    ensurePrivateDirectory(codexSessionsRoot(input.tuttiHome, input.projectId));
+    ensurePrivateDirectory(root);
+    ensurePrivateDirectory(codexHome);
+    const timestamp = input.now.toISOString();
+    const metadata = {
+        version: 1,
+        session_ref: sessionRef,
+        kind: input.kind,
+        owner_ref: input.ownerRef,
+        codex_version: input.compatibility.codexVersion,
+        model: input.compatibility.model,
+        provider_fingerprint: input.compatibility.providerFingerprint,
+        lifecycle: "active",
+        created_at: timestamp,
+        last_used_at: timestamp,
+    };
+    const metadataPath = join(root, SESSION_METADATA_FILE);
+    writePrivateJson(metadataPath, metadata);
+    writePrivateJson(ownerIndexPath(input.tuttiHome, input.projectId, input.kind, input.ownerRef), {
+        version: 1,
+        kind: input.kind,
+        owner_ref: input.ownerRef,
+        session_ref: sessionRef,
+    });
+    return {
+        root,
+        codexHome,
+        metadataPath,
+        metadata,
+        disposition: input.disposition,
+    };
+}
+export function createProviderFingerprint(input) {
+    const canonical = JSON.stringify({
+        provider_kind: input.providerKind,
+        api_base_url: input.apiBaseUrl?.trim() || "https://api.openai.com/v1",
+    });
+    return `sha256:${createHash("sha256").update(canonical, "utf8").digest("hex")}`;
+}
+export function openCodexDurableSession(input) {
+    const now = input.now ?? new Date();
+    const indexValue = readJson(ownerIndexPath(input.tuttiHome, input.projectId, input.kind, input.ownerRef));
+    if (isRecord(indexValue) &&
+        indexValue.version === 1 &&
+        indexValue.kind === input.kind &&
+        indexValue.owner_ref === input.ownerRef &&
+        typeof indexValue.session_ref === "string") {
+        const root = sessionRoot(input.tuttiHome, input.projectId, indexValue.session_ref);
+        const metadataPath = join(root, SESSION_METADATA_FILE);
+        const metadata = parseMetadata(readJson(metadataPath));
+        if (metadata !== null &&
+            metadata.kind === input.kind &&
+            metadata.owner_ref === input.ownerRef) {
+            if (compatible(metadata, input.compatibility)) {
+                ensurePrivateDirectory(root);
+                const codexHome = join(root, SESSION_CODEX_HOME_DIRECTORY);
+                ensurePrivateDirectory(codexHome);
+                const updatedMetadata = {
+                    ...metadata,
+                    last_used_at: now.toISOString(),
+                };
+                writePrivateJson(metadataPath, updatedMetadata);
+                return {
+                    root,
+                    codexHome,
+                    metadataPath,
+                    metadata: updatedMetadata,
+                    disposition: "resumed",
+                };
+            }
+            writePrivateJson(metadataPath, {
+                ...metadata,
+                lifecycle: "incompatible",
+                last_used_at: now.toISOString(),
+            });
+            return createSession({
+                ...input,
+                now,
+                disposition: "replaced_incompatible",
+            });
+        }
+    }
+    return createSession({ ...input, now, disposition: "created" });
+}
+export function openCodexTaskSession(input) {
+    return openCodexDurableSession({
+        tuttiHome: input.tuttiHome,
+        projectId: input.projectId,
+        kind: "formal_task_run",
+        ownerRef: input.taskId,
+        compatibility: input.compatibility,
+        ...(input.now === undefined ? {} : { now: input.now }),
+    });
+}
+const MAX_RECOVERY_EVIDENCE_BYTES = 64 * 1024;
+function recoveryEvidencePath(session) {
+    return join(session.root, SESSION_RECOVERY_EVIDENCE_FILE);
+}
+export function writeCodexSessionRecoveryEvidence(input) {
+    const serialized = JSON.stringify(input.evidence);
+    const exceedsLimit = Buffer.byteLength(serialized, "utf8") > MAX_RECOVERY_EVIDENCE_BYTES;
+    const record = {
+        version: 1,
+        owner_activity_ref: input.ownerActivityRef,
+        updated_at: (input.now ?? new Date()).toISOString(),
+        truncated: exceedsLimit,
+        evidence: exceedsLimit
+            ? {
+                bounded_original_json: Buffer.from(serialized, "utf8")
+                    .subarray(0, MAX_RECOVERY_EVIDENCE_BYTES)
+                    .toString("utf8"),
+                truncation_notice: "Recovery evidence exceeded the machine-local byte limit.",
+            }
+            : input.evidence,
+    };
+    writePrivateJson(recoveryEvidencePath(input.session), record);
+    return record;
+}
+export function readCodexSessionRecoveryEvidence(session) {
+    const value = readJson(recoveryEvidencePath(session));
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        typeof value.owner_activity_ref !== "string" ||
+        typeof value.updated_at !== "string" ||
+        typeof value.truncated !== "boolean" ||
+        !isRecord(value.evidence)) {
+        return null;
+    }
+    return value;
+}
+export function updateCodexTaskSession(session, update) {
+    const current = parseMetadata(readJson(session.metadataPath));
+    if (current === null || current.session_ref !== session.metadata.session_ref) {
+        throw new Error("Codex task session metadata is unavailable or invalid.");
+    }
+    const next = update(current);
+    if (next.session_ref !== current.session_ref ||
+        next.kind !== current.kind ||
+        next.owner_ref !== current.owner_ref) {
+        throw new Error("Codex task session identity cannot change.");
+    }
+    writePrivateJson(session.metadataPath, next);
+    return { ...session, metadata: next };
+}
+export function recordCodexTaskSessionThread(session, threadId, now = new Date()) {
+    return updateCodexTaskSession(session, (metadata) => {
+        if (metadata.thread_id !== undefined && metadata.thread_id !== threadId) {
+            throw new Error("Codex task session thread identity cannot change.");
+        }
+        return {
+            ...metadata,
+            thread_id: threadId,
+            lifecycle: "active",
+            last_used_at: now.toISOString(),
+        };
+    });
+}
+export function markCodexTaskSessionArchived(session, now = new Date()) {
+    return updateCodexTaskSession(session, (metadata) => ({
+        ...metadata,
+        lifecycle: "archived",
+        last_used_at: now.toISOString(),
+    }));
+}
+export function recordCodexSessionArchiveFailure(session, now = new Date()) {
+    const incident = {
+        version: 1,
+        kind: "thread_archive_failed",
+        occurred_at: now.toISOString(),
+    };
+    writePrivateJson(join(session.root, SESSION_ARCHIVE_INCIDENT_FILE), incident);
+    return incident;
+}
+export function readCodexSessionArchiveIncident(session) {
+    const value = readJson(join(session.root, SESSION_ARCHIVE_INCIDENT_FILE));
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        value.kind !== "thread_archive_failed" ||
+        typeof value.occurred_at !== "string") {
+        return null;
+    }
+    return value;
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function acquireCodexTaskSessionLock(session) {
+    const lockPath = join(session.root, SESSION_LOCK_FILE);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const descriptor = openSync(lockPath, "wx", 0o600);
+            writeFileSync(descriptor, `${JSON.stringify({ version: 1, owner_pid: process.pid, created_at: new Date().toISOString() })}\n`, "utf8");
+            closeSync(descriptor);
+            let released = false;
+            return () => {
+                if (released) {
+                    return;
+                }
+                released = true;
+                try {
+                    unlinkSync(lockPath);
+                }
+                catch {
+                    // Releasing a process-local safety lock is best effort during shutdown.
+                }
+            };
+        }
+        catch (error) {
+            if (!existsSync(lockPath)) {
+                throw error;
+            }
+            const lockValue = readJson(lockPath);
+            const ownerPid = isRecord(lockValue) && typeof lockValue.owner_pid === "number" ? lockValue.owner_pid : null;
+            if (ownerPid !== null && isProcessAlive(ownerPid)) {
+                throw new Error("Codex task session already has an active turn owner.", { cause: error });
+            }
+            unlinkSync(lockPath);
+        }
+    }
+    throw new Error("Codex task session lock could not be acquired.");
+}
+//# sourceMappingURL=session-store.js.map

package/dist/providers/openai/app-server/skill-discovery.d.ts

@@ -0,0 +1,10 @@
+import { type CodexAppServerSkillInput } from "./skills.js";
+export declare function discoverCodexAppServerSkills(options: {
+    client: {
+        request: (method: string, params: unknown, timeoutMs: number) => Promise<unknown>;
+    };
+    cwd: string;
+    skills: CodexAppServerSkillInput[];
+    requestTimeoutMs: number;
+}): Promise<void>;
+//# sourceMappingURL=skill-discovery.d.ts.map

package/dist/providers/openai/app-server/skill-discovery.js

@@ -0,0 +1,29 @@
+import { realpathSync } from "node:fs";
+import { dirname } from "node:path";
+import { isRecord } from "./runtime-helpers.js";
+import { CodexAppServerSkillSelectionError } from "./skills.js";
+// Use the pinned binary's protocol, not fields accepted only by a newer client.
+// Extra roots are process-local; each invocation owns its app-server process.
+export async function discoverCodexAppServerSkills(options) {
+    if (options.skills.length === 0)
+        return;
+    try {
+        const cwd = realpathSync(options.cwd);
+        await options.client.request("skills/extraRoots/set", { extraRoots: [...new Set(options.skills.map((skill) => dirname(skill.path)))] }, options.requestTimeoutMs);
+        const response = await options.client.request("skills/list", { cwds: [cwd], forceReload: true }, options.requestTimeoutMs);
+        const entry = isRecord(response) && Array.isArray(response.data)
+            ? response.data.find((entry) => isRecord(entry) && entry.cwd === cwd)
+            : undefined;
+        const discovered = isRecord(entry) && Array.isArray(entry.skills) ? entry.skills : [];
+        if (!options.skills.every((skill) => discovered.some((candidate) => isRecord(candidate) &&
+            candidate.name === skill.name &&
+            candidate.path === skill.path &&
+            candidate.enabled === true)))
+            throw new Error("Selected skill was not discovered");
+    }
+    catch {
+        // No discovered paths, parser errors or arbitrary RPC error bodies in diagnostics.
+        throw new CodexAppServerSkillSelectionError("skill_discovery_failed", "Codex app-server could not discover the selected skills.");
+    }
+}
+//# sourceMappingURL=skill-discovery.js.map

package/dist/providers/openai/app-server/skills.d.ts

@@ -0,0 +1,73 @@
+import type { ActivityRef } from "@tutti/shared/ids";
+export type CodexAppServerSkillInput = {
+    name: string;
+    path: string;
+};
+export type CodexAppServerTextInputItem = {
+    type: "text";
+    text: string;
+    text_elements: [];
+};
+export type CodexAppServerSkillInputItem = {
+    type: "skill";
+    name: string;
+    path: string;
+};
+export type CodexAppServerTurnInputItem = CodexAppServerSkillInputItem | CodexAppServerTextInputItem;
+export type CodexAppServerBuiltInSkillName = "read-main-chat" | "read-project-docs" | "read-scratchpad" | "read-worklist" | "read-references" | "read-user-skills";
+export type CodexAppServerSkillSelectionName = "chat_assistant" | "project_context_bootstrap" | "task_compile" | "context_sync" | "reference_summary_refresh" | "workspace_write_run" | "follow_up_run";
+export type CodexAppServerContextApiScope = "messages:read" | "project-docs:list" | "project-docs:read" | "scratchpad:read" | "worklist:read" | "task:read" | "references:list" | "references:read" | "references:external" | "skills:list" | "skills:read";
+export type CodexAppServerSkillSelection = {
+    builtInSkillNames: CodexAppServerBuiltInSkillName[];
+    userSkillMode: "disabled" | "all_enabled";
+    contextApiScopes: CodexAppServerContextApiScope[];
+};
+export type CodexAppServerAgentContextTokenRequest = {
+    activityRef?: ActivityRef;
+    selectionName: CodexAppServerSkillSelectionName;
+    scopes: CodexAppServerContextApiScope[];
+};
+export type CodexAppServerAgentContextToken = {
+    token: string;
+    expires_at?: string;
+    invocation_ref?: string;
+};
+export type CodexAppServerAgentContextRuntime = {
+    baseUrl: string;
+    issueToken: (input: CodexAppServerAgentContextTokenRequest) => CodexAppServerAgentContextToken;
+};
+export type CodexAppServerContextRuntimeHint = {
+    text: string;
+    sensitiveValues: string[];
+    scopes: CodexAppServerContextApiScope[];
+    invocation_ref?: string;
+};
+export declare class CodexAppServerSkillSelectionError extends Error {
+    readonly code: "built_in_skill_not_found" | "built_in_skill_invalid" | "skill_discovery_failed";
+    constructor(code: "built_in_skill_not_found" | "built_in_skill_invalid" | "skill_discovery_failed", message: string);
+}
+export declare const CODEX_APP_SERVER_SKILL_SELECTIONS: Record<CodexAppServerSkillSelectionName, CodexAppServerSkillSelection>;
+export declare function resolveCodexAppServerSkillSelection(selectionName: CodexAppServerSkillSelectionName): CodexAppServerSkillSelection;
+export declare function resolveCodexAppServerSkillInputs(options: {
+    selectionName?: CodexAppServerSkillSelectionName;
+    selection?: CodexAppServerSkillSelection;
+    builtInSkillsRoot?: string;
+    userSkillsRoot?: string;
+}): CodexAppServerSkillInput[];
+export declare function buildCodexAppServerTurnInput(options: {
+    prompt: string;
+    skills?: CodexAppServerSkillInput[];
+    runtimeHints?: string[];
+}): CodexAppServerTurnInputItem[];
+export declare function buildCodexAppServerContextRuntimeHint(options: {
+    baseUrl: string;
+    token: string;
+    scopes: CodexAppServerContextApiScope[];
+    expiresAt?: string;
+}): string;
+export declare function resolveCodexAppServerContextRuntimeHint(options: {
+    activityRef?: ActivityRef;
+    selectionName?: CodexAppServerSkillSelectionName;
+    agentContext?: CodexAppServerAgentContextRuntime;
+}): CodexAppServerContextRuntimeHint | undefined;
+//# sourceMappingURL=skills.d.ts.map

package/dist/providers/openai/app-server/skills.js

@@ -0,0 +1,208 @@
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { listUserSkills } from "../../../skills/index.js";
+export class CodexAppServerSkillSelectionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "CodexAppServerSkillSelectionError";
+    }
+}
+export const CODEX_APP_SERVER_SKILL_SELECTIONS = {
+    chat_assistant: {
+        builtInSkillNames: [
+            "read-main-chat",
+            "read-project-docs",
+            "read-scratchpad",
+            "read-worklist",
+            "read-references",
+            "read-user-skills",
+        ],
+        userSkillMode: "disabled",
+        contextApiScopes: [
+            "messages:read",
+            "project-docs:list",
+            "project-docs:read",
+            "scratchpad:read",
+            "worklist:read",
+            "task:read",
+            "references:list",
+            "references:read",
+            "references:external",
+            "skills:list",
+            "skills:read",
+        ],
+    },
+    project_context_bootstrap: {
+        builtInSkillNames: ["read-project-docs", "read-references"],
+        userSkillMode: "disabled",
+        contextApiScopes: [
+            "project-docs:list",
+            "project-docs:read",
+            "references:list",
+            "references:read",
+            "references:external",
+        ],
+    },
+    task_compile: {
+        builtInSkillNames: ["read-project-docs", "read-worklist", "read-references"],
+        userSkillMode: "disabled",
+        contextApiScopes: [
+            "project-docs:list",
+            "project-docs:read",
+            "worklist:read",
+            "task:read",
+            "references:list",
+            "references:read",
+            "references:external",
+        ],
+    },
+    context_sync: {
+        builtInSkillNames: ["read-project-docs", "read-worklist", "read-references"],
+        userSkillMode: "disabled",
+        contextApiScopes: [
+            "project-docs:list",
+            "project-docs:read",
+            "worklist:read",
+            "task:read",
+            "references:list",
+            "references:read",
+        ],
+    },
+    reference_summary_refresh: {
+        builtInSkillNames: [],
+        userSkillMode: "disabled",
+        contextApiScopes: [],
+    },
+    workspace_write_run: {
+        builtInSkillNames: ["read-project-docs", "read-worklist", "read-references"],
+        userSkillMode: "all_enabled",
+        contextApiScopes: [
+            "project-docs:list",
+            "project-docs:read",
+            "worklist:read",
+            "task:read",
+            "references:list",
+            "references:read",
+            "references:external",
+        ],
+    },
+    follow_up_run: {
+        builtInSkillNames: ["read-project-docs", "read-worklist", "read-references"],
+        userSkillMode: "all_enabled",
+        contextApiScopes: [
+            "project-docs:list",
+            "project-docs:read",
+            "worklist:read",
+            "task:read",
+            "references:list",
+            "references:read",
+            "references:external",
+        ],
+    },
+};
+const DEFAULT_BUILT_IN_SKILLS_ROOT = fileURLToPath(new URL("../../../../prompts/skills", import.meta.url));
+function assertInside(parent, child) {
+    const parentPath = resolve(parent);
+    const childPath = resolve(child);
+    if (childPath !== parentPath && !childPath.startsWith(`${parentPath}/`)) {
+        throw new CodexAppServerSkillSelectionError("built_in_skill_invalid", "Built-in skill path escapes skill root.");
+    }
+}
+function resolveBuiltInSkill(options) {
+    const path = join(options.builtInSkillsRoot, options.name);
+    assertInside(options.builtInSkillsRoot, path);
+    const skillMdPath = join(path, "SKILL.md");
+    if (!existsSync(skillMdPath)) {
+        throw new CodexAppServerSkillSelectionError("built_in_skill_not_found", `Built-in skill is missing: ${options.name}`);
+    }
+    if (!statSync(skillMdPath).isFile()) {
+        throw new CodexAppServerSkillSelectionError("built_in_skill_invalid", `Built-in skill is invalid: ${options.name}`);
+    }
+    return { name: options.name, path: realpathSync(skillMdPath) };
+}
+function resolveUserSkill(options) {
+    return {
+        name: options.name,
+        path: realpathSync(join(options.userSkillsRoot, options.name, "SKILL.md")),
+    };
+}
+export function resolveCodexAppServerSkillSelection(selectionName) {
+    return CODEX_APP_SERVER_SKILL_SELECTIONS[selectionName];
+}
+export function resolveCodexAppServerSkillInputs(options) {
+    const selection = options.selection ??
+        (options.selectionName === undefined
+            ? {
+                builtInSkillNames: [],
+                userSkillMode: "disabled",
+                contextApiScopes: [],
+            }
+            : resolveCodexAppServerSkillSelection(options.selectionName));
+    const builtInSkillsRoot = options.builtInSkillsRoot ?? DEFAULT_BUILT_IN_SKILLS_ROOT;
+    const builtInSkills = selection.builtInSkillNames.map((name) => resolveBuiltInSkill({ builtInSkillsRoot, name }));
+    const userSkillsRoot = options.userSkillsRoot;
+    const userSkills = selection.userSkillMode === "all_enabled" && userSkillsRoot !== undefined
+        ? listUserSkills(userSkillsRoot).map((skill) => resolveUserSkill({ userSkillsRoot, name: skill.name }))
+        : [];
+    return [...builtInSkills, ...userSkills];
+}
+function createTextInputItem(text) {
+    return {
+        type: "text",
+        text,
+        text_elements: [],
+    };
+}
+export function buildCodexAppServerTurnInput(options) {
+    return [
+        ...(options.skills ?? []).map((skill) => ({
+            type: "skill",
+            name: skill.name,
+            path: skill.path,
+        })),
+        ...(options.runtimeHints ?? [])
+            .filter((hint) => hint.trim().length > 0)
+            .map((hint) => createTextInputItem(hint)),
+        createTextInputItem(options.prompt),
+    ];
+}
+export function buildCodexAppServerContextRuntimeHint(options) {
+    return [
+        "Tenso context API is available for this turn.",
+        `Base URL: ${options.baseUrl.replace(/\/+$/u, "")}`,
+        `Authorization: Bearer ${options.token}`,
+        `Allowed scopes: ${options.scopes.join(", ")}`,
+        ...(options.expiresAt === undefined ? [] : [`Token expires at: ${options.expiresAt}`]),
+        "Use these read-only endpoints only when additional Tenso collaboration context is needed.",
+        "Do not include the token, base URL, or raw large API responses in user-facing output.",
+    ].join("\n");
+}
+export function resolveCodexAppServerContextRuntimeHint(options) {
+    if (options.selectionName === undefined || options.agentContext === undefined) {
+        return undefined;
+    }
+    const selection = resolveCodexAppServerSkillSelection(options.selectionName);
+    if (selection.contextApiScopes.length === 0) {
+        return undefined;
+    }
+    const issued = options.agentContext.issueToken({
+        ...(options.activityRef === undefined ? {} : { activityRef: options.activityRef }),
+        selectionName: options.selectionName,
+        scopes: selection.contextApiScopes,
+    });
+    return {
+        text: buildCodexAppServerContextRuntimeHint({
+            baseUrl: options.agentContext.baseUrl,
+            token: issued.token,
+            scopes: selection.contextApiScopes,
+            ...(issued.expires_at === undefined ? {} : { expiresAt: issued.expires_at }),
+        }),
+        sensitiveValues: [issued.token, options.agentContext.baseUrl],
+        scopes: selection.contextApiScopes,
+        ...(issued.invocation_ref === undefined ? {} : { invocation_ref: issued.invocation_ref }),
+    };
+}
+//# sourceMappingURL=skills.js.map

package/dist/providers/openai/app-server/smoke-cli.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=smoke-cli.d.ts.map

package/dist/providers/openai/app-server/smoke-cli.js

@@ -0,0 +1,42 @@
+import { CodexAppServerSmokeError, resolveCodexAppServerSmokeProviderInput, runCodexAppServerNoWriteSmoke, } from "./smoke.js";
+function readBooleanFlag(flag) {
+    return process.argv.includes(flag);
+}
+async function main() {
+    const providerInput = resolveCodexAppServerSmokeProviderInput();
+    const smokeOptions = {
+        apiKey: providerInput.apiKey,
+        keepTemp: readBooleanFlag("--keep-temp"),
+        strictLeakCheck: readBooleanFlag("--strict-leak-check"),
+    };
+    if (providerInput.apiBaseUrl !== undefined) {
+        smokeOptions.apiBaseUrl = providerInput.apiBaseUrl;
+    }
+    if (providerInput.defaultModel !== undefined) {
+        smokeOptions.defaultModel = providerInput.defaultModel;
+    }
+    const result = await runCodexAppServerNoWriteSmoke(smokeOptions);
+    console.log(JSON.stringify({
+        provider_source: providerInput.source,
+        ...result,
+    }, null, 2));
+}
+main().catch((error) => {
+    if (error instanceof CodexAppServerSmokeError) {
+        console.error(JSON.stringify({
+            status: "failed",
+            code: error.code,
+            message: error.message,
+        }, null, 2));
+        process.exitCode = 1;
+        return;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(JSON.stringify({
+        status: "failed",
+        code: "unexpected_error",
+        message,
+    }, null, 2));
+    process.exitCode = 1;
+});
+//# sourceMappingURL=smoke-cli.js.map