@xfey/tutti 0.1.0

package/dist/providers/openai/app-server/permission-profile.js

@@ -0,0 +1,67 @@
+export function createReadOnlyPermissionProfile(readablePaths, options = {}) {
+    const paths = Array.isArray(readablePaths) ? readablePaths : [readablePaths];
+    return {
+        type: "managed",
+        network: {
+            enabled: options.networkEnabled ?? true,
+        },
+        fileSystem: {
+            type: "restricted",
+            entries: [
+                {
+                    access: "read",
+                    path: {
+                        type: "special",
+                        value: {
+                            kind: "minimal",
+                        },
+                    },
+                },
+                ...[...new Set(paths)].map((path) => ({
+                    access: "read",
+                    path: {
+                        type: "path",
+                        path,
+                    },
+                })),
+            ],
+        },
+    };
+}
+export function createWorkspaceWritePermissionProfile(writableRoot, options = {}) {
+    return {
+        type: "managed",
+        network: {
+            enabled: options.networkEnabled ?? true,
+        },
+        fileSystem: {
+            type: "restricted",
+            entries: [
+                {
+                    access: "read",
+                    path: {
+                        type: "special",
+                        value: {
+                            kind: "minimal",
+                        },
+                    },
+                },
+                {
+                    access: "read",
+                    path: {
+                        type: "path",
+                        path: writableRoot,
+                    },
+                },
+                {
+                    access: "write",
+                    path: {
+                        type: "path",
+                        path: writableRoot,
+                    },
+                },
+            ],
+        },
+    };
+}
+//# sourceMappingURL=permission-profile.js.map

package/dist/providers/openai/app-server/provider-config.d.ts

@@ -0,0 +1,10 @@
+import type { CodexAppServerConfigOverride } from "../codex-app-server.js";
+export declare const CODEX_APP_SERVER_OPENAI_MODEL_PROVIDER = "openai";
+export declare const CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER = "tutti_openai_compatible";
+export declare function resolveCodexAppServerModelProvider(input: {
+    apiBaseUrl?: string;
+}): string;
+export declare function buildCodexAppServerProviderConfigOverrides(input: {
+    apiBaseUrl?: string;
+}): CodexAppServerConfigOverride[];
+//# sourceMappingURL=provider-config.d.ts.map

package/dist/providers/openai/app-server/provider-config.js

@@ -0,0 +1,39 @@
+export const CODEX_APP_SERVER_OPENAI_MODEL_PROVIDER = "openai";
+export const CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER = "tutti_openai_compatible";
+export function resolveCodexAppServerModelProvider(input) {
+    return input.apiBaseUrl === undefined
+        ? CODEX_APP_SERVER_OPENAI_MODEL_PROVIDER
+        : CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER;
+}
+export function buildCodexAppServerProviderConfigOverrides(input) {
+    if (input.apiBaseUrl === undefined) {
+        return [];
+    }
+    return [
+        {
+            key: "model_provider",
+            value: JSON.stringify(CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER),
+        },
+        {
+            key: `model_providers.${CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER}.name`,
+            value: JSON.stringify("Tutti OpenAI-compatible"),
+        },
+        {
+            key: `model_providers.${CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER}.base_url`,
+            value: JSON.stringify(input.apiBaseUrl),
+        },
+        {
+            key: `model_providers.${CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER}.wire_api`,
+            value: JSON.stringify("responses"),
+        },
+        {
+            key: `model_providers.${CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER}.requires_openai_auth`,
+            value: "true",
+        },
+        {
+            key: `model_providers.${CODEX_APP_SERVER_TUTTI_OPENAI_COMPATIBLE_MODEL_PROVIDER}.supports_websockets`,
+            value: "false",
+        },
+    ];
+}
+//# sourceMappingURL=provider-config.js.map

package/dist/providers/openai/app-server/read-only-procedure.d.ts

@@ -0,0 +1,68 @@
+import { type CodexAppServerAgentContextRuntime, type CodexAppServerSkillSelectionName } from "./skills.js";
+import { type OpenAiTokenUsage } from "../token-usage.js";
+export type CodexAppServerWebSearchMode = "disabled" | "cached" | "live";
+export type CodexAppServerReadOnlyProcedureInput<TOutput> = {
+    apiKey: string;
+    apiBaseUrl?: string;
+    defaultModel?: string;
+    workspaceRoot: string;
+    appServerCwd?: string;
+    readablePaths?: string[];
+    prompt: string;
+    outputSchema: unknown;
+    validateOutput: (value: unknown) => value is TOutput;
+    networkAccess?: boolean;
+    webSearchMode?: CodexAppServerWebSearchMode;
+    skillSelectionName?: CodexAppServerSkillSelectionName;
+    tuttiHome?: string;
+    builtInSkillsRoot?: string;
+    agentContext?: CodexAppServerAgentContextRuntime;
+    strictLeakCheck?: boolean;
+    codexCommand?: string;
+    requestTimeoutMs?: number;
+    turnTimeoutMs?: number;
+    baseEnv?: NodeJS.ProcessEnv;
+};
+export type CodexAppServerReadOnlyProcedureResult<TOutput> = {
+    output: TOutput;
+    model: string;
+    turn_status: "completed";
+    notification_count: number;
+    agent_message_event_count: number;
+    server_request_methods: string[];
+    git_status_unchanged: true;
+    stderr_had_output: boolean;
+    stderr_excerpt: string;
+    usage?: OpenAiTokenUsage;
+};
+export type CodexAppServerReadOnlyProcedureErrorDetails = {
+    turn_status?: string;
+    turn_error_message?: string;
+    turn_error_code?: string;
+    turn_error_http_status?: number;
+    turn_timeout_ms?: number;
+    last_activity_at?: string;
+    notification_count?: number;
+    server_request_methods?: string[];
+    notification_methods?: string[];
+    agent_message_excerpt?: string;
+    stderr_excerpt?: string;
+};
+export declare class CodexAppServerReadOnlyProcedureError extends Error {
+    readonly code: "app_server_protocol_error" | "auth_failed" | "thread_start_failed" | "turn_failed" | "turn_timeout" | "unexpected_server_request" | "skill_selection_failed" | "output_parse_failed" | "output_validation_failed" | "write_detected" | "secret_leak_detected";
+    readonly details: CodexAppServerReadOnlyProcedureErrorDetails;
+    constructor(code: "app_server_protocol_error" | "auth_failed" | "thread_start_failed" | "turn_failed" | "turn_timeout" | "unexpected_server_request" | "skill_selection_failed" | "output_parse_failed" | "output_validation_failed" | "write_detected" | "secret_leak_detected", message: string, details?: CodexAppServerReadOnlyProcedureErrorDetails);
+}
+export declare function resolveReadOnlyWebSearchMode(input: {
+    networkAccess?: boolean;
+    webSearchMode?: CodexAppServerWebSearchMode;
+}): CodexAppServerWebSearchMode;
+export declare function buildReadOnlyThreadConfig(input: {
+    networkAccess?: boolean;
+    webSearchMode?: CodexAppServerWebSearchMode;
+}): {
+    web_search: CodexAppServerWebSearchMode;
+};
+export declare function parseCodexAppServerStructuredJson(text: string): unknown;
+export declare function runCodexAppServerReadOnlyProcedure<TOutput>(options: CodexAppServerReadOnlyProcedureInput<TOutput>): Promise<CodexAppServerReadOnlyProcedureResult<TOutput>>;
+//# sourceMappingURL=read-only-procedure.d.ts.map

package/dist/providers/openai/app-server/read-only-procedure.js

@@ -0,0 +1,293 @@
+import { execFileSync, spawn } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { buildCodexAppServerProcessPlan } from "../codex-app-server.js";
+import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
+import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError, } from "./json-rpc.js";
+import { createReadOnlyPermissionProfile } from "./permission-profile.js";
+import { buildCodexAppServerProviderConfigOverrides, resolveCodexAppServerModelProvider, } from "./provider-config.js";
+import { buildCodexAppServerTurnInput, resolveCodexAppServerContextRuntimeHint, resolveCodexAppServerSkillInputs, CodexAppServerSkillSelectionError, } from "./skills.js";
+import { containsKnownSecret, createCodexSpawnEnv, extractAgentText, extractServerRequestMethod, findJsonObjectCandidates, isApiKeyAccount, readThreadId, readTurnError, readTurnStatus, redactWithKnownValues, compactText, } from "./runtime-helpers.js";
+import { extractCodexAppServerTokenUsage } from "../token-usage.js";
+const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
+const DEFAULT_TURN_TIMEOUT_MS = 600_000;
+const DEFAULT_WEB_SEARCH_MODE = "live";
+export class CodexAppServerReadOnlyProcedureError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "CodexAppServerReadOnlyProcedureError";
+    }
+}
+export function resolveReadOnlyWebSearchMode(input) {
+    if (input.networkAccess === false) {
+        return "disabled";
+    }
+    return input.webSearchMode ?? DEFAULT_WEB_SEARCH_MODE;
+}
+export function buildReadOnlyThreadConfig(input) {
+    return {
+        web_search: resolveReadOnlyWebSearchMode(input),
+    };
+}
+function readGitStatus(repoRoot) {
+    return execFileSync("git", ["status", "--porcelain", "--untracked-files=all"], {
+        cwd: repoRoot,
+        encoding: "utf8",
+    });
+}
+function isTurnWaitTimeout(error) {
+    return (error instanceof CodexAppServerProtocolError &&
+        (error.code === "notification_timeout" || error.code === "server_request_timeout"));
+}
+function readOnlyTimeoutDetails(input) {
+    const details = {
+        turn_timeout_ms: input.turnTimeoutMs,
+        notification_count: input.client.notifications.length,
+        server_request_methods: input.client.serverRequests.map(extractServerRequestMethod),
+        notification_methods: input.client.notifications
+            .map((notification) => notification.method)
+            .slice(-20),
+        stderr_excerpt: redactWithKnownValues(input.client.stderr, input.sensitiveValues).slice(0, 500),
+    };
+    if (input.client.lastActivityAt !== undefined) {
+        details.last_activity_at = input.client.lastActivityAt;
+    }
+    return details;
+}
+export function parseCodexAppServerStructuredJson(text) {
+    const candidates = findJsonObjectCandidates(text);
+    if (candidates.length === 0) {
+        throw new CodexAppServerReadOnlyProcedureError("output_parse_failed", "Codex app-server did not return a JSON object.");
+    }
+    for (const jsonText of candidates.toReversed()) {
+        try {
+            return JSON.parse(jsonText);
+        }
+        catch {
+            // Earlier app-server progress can contain brace-shaped text.
+        }
+    }
+    throw new CodexAppServerReadOnlyProcedureError("output_parse_failed", "Codex app-server returned malformed JSON.");
+}
+export async function runCodexAppServerReadOnlyProcedure(options) {
+    let skillInputs;
+    let contextRuntimeHint;
+    try {
+        skillInputs = resolveCodexAppServerSkillInputs({
+            ...(options.skillSelectionName === undefined ? {} : { selectionName: options.skillSelectionName }),
+            ...(options.tuttiHome === undefined ? {} : { tuttiHome: options.tuttiHome }),
+            ...(options.builtInSkillsRoot === undefined
+                ? {}
+                : { builtInSkillsRoot: options.builtInSkillsRoot }),
+        });
+        contextRuntimeHint = resolveCodexAppServerContextRuntimeHint({
+            ...(options.skillSelectionName === undefined ? {} : { selectionName: options.skillSelectionName }),
+            ...(options.agentContext === undefined ? {} : { agentContext: options.agentContext }),
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new CodexAppServerReadOnlyProcedureError(error instanceof CodexAppServerSkillSelectionError
+            ? "skill_selection_failed"
+            : "app_server_protocol_error", redactWithKnownValues(message, [
+            options.apiKey,
+            options.workspaceRoot,
+            options.appServerCwd ?? "",
+            options.tuttiHome ?? "",
+            options.builtInSkillsRoot ?? "",
+        ]));
+    }
+    const model = options.defaultModel ?? DEFAULT_OPENAI_MODEL;
+    const tempRoot = mkdtempSync(join(tmpdir(), "tutti-codex-readonly-procedure-"));
+    const codexHome = join(tempRoot, "codex-home");
+    mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+    const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    const turnTimeoutMs = options.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
+    const networkEnabled = options.networkAccess ?? true;
+    const appServerCwd = options.appServerCwd ?? options.workspaceRoot;
+    const readablePaths = options.readablePaths === undefined || options.readablePaths.length === 0
+        ? [options.workspaceRoot]
+        : options.readablePaths;
+    const gitStatusBefore = readGitStatus(options.workspaceRoot);
+    const modelProvider = resolveCodexAppServerModelProvider(options);
+    const processPlan = buildCodexAppServerProcessPlan({
+        codexHome,
+        configOverrides: buildCodexAppServerProviderConfigOverrides(options),
+    });
+    const command = options.codexCommand ?? processPlan.command;
+    const child = spawn(command, processPlan.args, {
+        cwd: process.cwd(),
+        env: createCodexSpawnEnv(codexHome, options.baseEnv ?? process.env),
+        stdio: "pipe",
+    });
+    const client = new CodexAppServerJsonRpcClient(child);
+    const sensitiveValues = [
+        options.apiKey,
+        tempRoot,
+        codexHome,
+        options.workspaceRoot,
+        appServerCwd,
+        ...readablePaths,
+        options.tuttiHome ?? "",
+        options.builtInSkillsRoot ?? "",
+        ...(contextRuntimeHint?.sensitiveValues ?? []),
+        ...skillInputs.map((skill) => skill.path),
+    ];
+    const strictLeakCheckValues = [
+        options.apiKey,
+        ...(contextRuntimeHint?.sensitiveValues ?? []),
+    ];
+    try {
+        await client.request("initialize", {
+            clientInfo: {
+                name: "tutti-readonly-procedure",
+                title: "Tutti Read-only Procedure",
+                version: "0.0.0",
+            },
+            capabilities: {
+                experimentalApi: false,
+            },
+        }, requestTimeoutMs);
+        client.notify("initialized");
+        const loginResponse = await client.request("account/login/start", {
+            type: "apiKey",
+            apiKey: options.apiKey,
+        }, requestTimeoutMs);
+        if (!isApiKeyAccount(loginResponse)) {
+            throw new CodexAppServerReadOnlyProcedureError("auth_failed", "Codex app-server did not accept API key auth.");
+        }
+        const threadStartResponse = await client.request("thread/start", {
+            cwd: appServerCwd,
+            model,
+            modelProvider,
+            approvalPolicy: "never",
+            permissionProfile: createReadOnlyPermissionProfile(readablePaths, {
+                networkEnabled,
+            }),
+            config: buildReadOnlyThreadConfig(options),
+            ephemeral: true,
+            experimentalRawEvents: false,
+            persistExtendedHistory: false,
+        }, requestTimeoutMs);
+        const threadId = readThreadId(threadStartResponse);
+        if (threadId === null) {
+            throw new CodexAppServerReadOnlyProcedureError("thread_start_failed", "Codex app-server did not return a thread id.");
+        }
+        await client.request("turn/start", {
+            threadId,
+            input: buildCodexAppServerTurnInput({
+                prompt: options.prompt,
+                skills: skillInputs,
+                ...(contextRuntimeHint === undefined
+                    ? {}
+                    : { runtimeHints: [contextRuntimeHint.text] }),
+            }),
+            cwd: appServerCwd,
+            approvalPolicy: "never",
+            permissionProfile: createReadOnlyPermissionProfile(readablePaths, {
+                networkEnabled,
+            }),
+            model,
+            modelProvider,
+            outputSchema: options.outputSchema,
+        }, requestTimeoutMs);
+        const turnCompletedPromise = client.waitForNotification((notification) => notification.method === "turn/completed", turnTimeoutMs);
+        const serverRequestPromise = client.waitForServerRequest(turnTimeoutMs);
+        let completedOrRequest;
+        try {
+            completedOrRequest = await Promise.race([
+                turnCompletedPromise.then((notification) => ({ kind: "completed", notification })),
+                serverRequestPromise.then((request) => ({ kind: "server_request", request })),
+            ]);
+        }
+        catch (error) {
+            if (isTurnWaitTimeout(error)) {
+                throw new CodexAppServerReadOnlyProcedureError("turn_timeout", "Codex app-server turn timed out before completion or an interactive server request.", readOnlyTimeoutDetails({ client, turnTimeoutMs, sensitiveValues }));
+            }
+            throw error;
+        }
+        if (completedOrRequest.kind === "server_request") {
+            throw new CodexAppServerReadOnlyProcedureError("unexpected_server_request", `Codex app-server requested interactive handling: ${completedOrRequest.request.method}`);
+        }
+        if (client.serverRequests.length > 0) {
+            throw new CodexAppServerReadOnlyProcedureError("unexpected_server_request", `Codex app-server requested interactive handling: ${client.serverRequests[0]?.method ?? "unknown"}`);
+        }
+        const turnStatus = readTurnStatus(completedOrRequest.notification.params);
+        if (turnStatus !== "completed") {
+            await client.waitForOutputSettle({ quietMs: 25, maxWaitMs: 250 });
+            const turnError = readTurnError(completedOrRequest.notification.params);
+            const agentText = client.notifications
+                .map((notification) => extractAgentText(notification))
+                .join("");
+            const details = {
+                ...(turnStatus === null ? {} : { turn_status: turnStatus }),
+                ...(turnError.message === undefined
+                    ? {}
+                    : { turn_error_message: redactWithKnownValues(turnError.message, sensitiveValues) }),
+                ...(turnError.code === undefined ? {} : { turn_error_code: turnError.code }),
+                ...(turnError.httpStatus === undefined
+                    ? {}
+                    : { turn_error_http_status: turnError.httpStatus }),
+                notification_count: client.notifications.length,
+                server_request_methods: client.serverRequests.map(extractServerRequestMethod),
+                notification_methods: client.notifications
+                    .map((notification) => notification.method)
+                    .slice(-20),
+                agent_message_excerpt: compactText(redactWithKnownValues(agentText, sensitiveValues), 500),
+                stderr_excerpt: redactWithKnownValues(client.stderr, sensitiveValues).slice(0, 500),
+            };
+            const detailSuffix = details.turn_error_message === undefined ? "" : `: ${details.turn_error_message}`;
+            throw new CodexAppServerReadOnlyProcedureError("turn_failed", `Codex app-server turn did not complete successfully: ${turnStatus ?? "unknown"}${detailSuffix}`, details);
+        }
+        await client.waitForOutputSettle({ quietMs: 25, maxWaitMs: 250 });
+        const agentText = client.notifications
+            .map((notification) => extractAgentText(notification))
+            .join("");
+        const parsed = parseCodexAppServerStructuredJson(agentText);
+        if (!options.validateOutput(parsed)) {
+            throw new CodexAppServerReadOnlyProcedureError("output_validation_failed", "Codex app-server structured output did not match the expected schema.");
+        }
+        const gitStatusAfter = readGitStatus(options.workspaceRoot);
+        if (gitStatusAfter !== gitStatusBefore) {
+            throw new CodexAppServerReadOnlyProcedureError("write_detected", "Codex app-server read-only Procedure changed the repository.");
+        }
+        const rawOutput = `${client.rawStdout}\n${client.stderr}`;
+        if (options.strictLeakCheck === true && containsKnownSecret(rawOutput, strictLeakCheckValues)) {
+            throw new CodexAppServerReadOnlyProcedureError("secret_leak_detected", "Codex app-server output contained a sensitive runtime value.");
+        }
+        const usage = extractCodexAppServerTokenUsage(client.notifications);
+        return {
+            output: parsed,
+            model,
+            turn_status: "completed",
+            notification_count: client.notifications.length,
+            agent_message_event_count: client.notifications.filter((notification) => notification.method === "item/agentMessage/delta" ||
+                notification.method === "item/completed").length,
+            server_request_methods: client.serverRequests.map(extractServerRequestMethod),
+            git_status_unchanged: true,
+            stderr_had_output: client.stderr.length > 0,
+            stderr_excerpt: redactWithKnownValues(client.stderr, sensitiveValues).slice(0, 500),
+            ...(usage === undefined ? {} : { usage }),
+        };
+    }
+    catch (error) {
+        if (error instanceof CodexAppServerReadOnlyProcedureError) {
+            throw error;
+        }
+        if (error instanceof CodexAppServerProtocolError) {
+            throw new CodexAppServerReadOnlyProcedureError("app_server_protocol_error", redactWithKnownValues(error.message, sensitiveValues));
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw new CodexAppServerReadOnlyProcedureError("app_server_protocol_error", redactWithKnownValues(message, sensitiveValues));
+    }
+    finally {
+        client.dispose();
+        rmSync(tempRoot, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=read-only-procedure.js.map

package/dist/providers/openai/app-server/runtime-helpers.d.ts

@@ -0,0 +1,20 @@
+import type { CodexAppServerJsonRpcNotification, CodexAppServerJsonRpcServerRequest } from "./json-rpc.js";
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function isApiKeyAccount(value: unknown): value is {
+    type: "apiKey";
+};
+export declare function readThreadId(value: unknown): string | null;
+export declare function readTurnStatus(value: unknown): string | null;
+export declare function readTurnError(value: unknown): {
+    message?: string;
+    code?: string;
+    httpStatus?: number;
+};
+export declare function extractServerRequestMethod(value: CodexAppServerJsonRpcServerRequest): string;
+export declare function extractAgentText(notification: CodexAppServerJsonRpcNotification): string;
+export declare function createCodexSpawnEnv(codexHome: string, baseEnv: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function redactWithKnownValues(value: string, sensitiveValues: readonly string[]): string;
+export declare function containsKnownSecret(value: string, secrets: readonly string[]): boolean;
+export declare function compactText(value: string, maxLength: number): string;
+export declare function findJsonObjectCandidates(value: string): string[];
+//# sourceMappingURL=runtime-helpers.d.ts.map

package/dist/providers/openai/app-server/runtime-helpers.js

@@ -0,0 +1,151 @@
+import { isAbsolute } from "node:path";
+import { REDACTION_LABELS, redactText } from "@tutti/shared/utils";
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function isApiKeyAccount(value) {
+    return isRecord(value) && value.type === "apiKey";
+}
+export function readThreadId(value) {
+    if (!isRecord(value) || !isRecord(value.thread) || typeof value.thread.id !== "string") {
+        return null;
+    }
+    return value.thread.id;
+}
+export function readTurnStatus(value) {
+    if (!isRecord(value) || !isRecord(value.turn) || typeof value.turn.status !== "string") {
+        return null;
+    }
+    return value.turn.status;
+}
+export function readTurnError(value) {
+    if (!isRecord(value) || !isRecord(value.turn) || !isRecord(value.turn.error)) {
+        return {};
+    }
+    const error = value.turn.error;
+    const details = {};
+    if (typeof error.message === "string") {
+        details.message = error.message;
+    }
+    if (typeof error.code === "string") {
+        details.code = error.code;
+    }
+    if (isRecord(error.codexErrorInfo)) {
+        const [firstKey] = Object.keys(error.codexErrorInfo);
+        if (firstKey !== undefined) {
+            details.code = firstKey;
+            const nested = error.codexErrorInfo[firstKey];
+            if (isRecord(nested) && typeof nested.httpStatusCode === "number") {
+                details.httpStatus = nested.httpStatusCode;
+            }
+        }
+    }
+    return details;
+}
+export function extractServerRequestMethod(value) {
+    return value.method;
+}
+export function extractAgentText(notification) {
+    if (!isRecord(notification.params)) {
+        return "";
+    }
+    if (notification.method === "item/agentMessage/delta" &&
+        typeof notification.params.delta === "string") {
+        return notification.params.delta;
+    }
+    if (notification.method === "item/completed" &&
+        isRecord(notification.params.item) &&
+        notification.params.item.type === "agentMessage" &&
+        typeof notification.params.item.text === "string") {
+        return notification.params.item.text;
+    }
+    return "";
+}
+export function createCodexSpawnEnv(codexHome, baseEnv) {
+    const env = {
+        CODEX_HOME: codexHome,
+    };
+    if (baseEnv.PATH !== undefined) {
+        env.PATH = baseEnv.PATH;
+    }
+    if (baseEnv.HOME !== undefined) {
+        env.HOME = baseEnv.HOME;
+    }
+    return env;
+}
+export function redactWithKnownValues(value, sensitiveValues) {
+    let redacted = redactText(value);
+    const orderedSensitiveValues = [...sensitiveValues]
+        .filter((sensitiveValue) => sensitiveValue !== "")
+        .sort((left, right) => right.length - left.length);
+    for (const sensitiveValue of orderedSensitiveValues) {
+        redacted = redacted
+            .split(sensitiveValue)
+            .join(isAbsolute(sensitiveValue) ? REDACTION_LABELS.localPath : "[REDACTED]");
+    }
+    return redacted;
+}
+export function containsKnownSecret(value, secrets) {
+    return secrets.some((secret) => secret !== "" && value.includes(secret));
+}
+export function compactText(value, maxLength) {
+    const normalized = value.replace(/\s+/gu, " ").trim();
+    if (normalized.length <= maxLength) {
+        return normalized;
+    }
+    return `${normalized.slice(0, maxLength)}...`;
+}
+function stripJsonFence(value) {
+    const trimmed = value.trim();
+    const fenceMatch = /^```(?:json)?\s*([\s\S]*?)\s*```$/iu.exec(trimmed);
+    return fenceMatch?.[1]?.trim() ?? trimmed;
+}
+export function findJsonObjectCandidates(value) {
+    const text = stripJsonFence(value);
+    const candidates = [];
+    let start = -1;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let index = 0; index < text.length; index += 1) {
+        const char = text[index];
+        if (start < 0) {
+            if (char === "{") {
+                start = index;
+                depth = 1;
+            }
+            continue;
+        }
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === "\\") {
+                escaped = true;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            continue;
+        }
+        if (char === "{") {
+            depth += 1;
+            continue;
+        }
+        if (char === "}") {
+            depth -= 1;
+            if (depth === 0) {
+                candidates.push(text.slice(start, index + 1));
+                start = -1;
+                inString = false;
+                escaped = false;
+            }
+        }
+    }
+    return candidates;
+}
+//# sourceMappingURL=runtime-helpers.js.map