@zaip-ai/cli 6.3.0 → 7.5.0

package/dist/services/codex-native-authority-policy-template.js

@@ -0,0 +1,132 @@
+export const CODEX_NATIVE_AUTHORITY_POLICY = String.raw `import { createHash } from "node:crypto";
+import { lstat, readFile, readdir } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+export function checkDestructivePatterns(command, patterns, deny) {
+  if (/^(?:Write-Output|echo|printf)\s+'(?:[^']|'')*'\s*$/i.test(command)) return;
+  for (const entry of patterns) if (entry.pattern.test(command)) deny(entry.reason);
+}
+export async function configuredDeploymentBranches(repositoryRoot, deny) {
+  const defaults = { applicationBranches: ["beta"], scopeBranches: { frontend: "beta", backend: "beta" }, productionBranch: "main" };
+  let source;
+  try {
+    source = await readFile(resolve(repositoryRoot, ".agents/config/project.yaml"), "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return defaults;
+    deny("Could not read project.yaml deploy policy.");
+  }
+  let document;
+  try {
+    const parser = await import(
+      pathToFileURL(
+        resolve(repositoryRoot, ".agents/skills/zaip-skill-github-deploy/scripts/yaml-parser.mjs"),
+      ).href,
+    );
+    document = parser.parseDocument(source, { strict: true, uniqueKeys: true });
+  } catch {
+    deny("Canonical deploy YAML parser is unavailable.");
+  }
+  if (document.errors.length > 0) deny("project.yaml deploy policy is malformed.");
+  const config = document.toJS();
+  if (config === null || typeof config !== "object" || Array.isArray(config)) {
+    deny("project.yaml must contain a mapping.");
+  }
+  const deploy = config.deploy;
+  if (deploy === undefined) return defaults;
+  if (deploy === null || typeof deploy !== "object" || Array.isArray(deploy)) {
+    deny("project.yaml deploy must be a mapping.");
+  }
+  if (!Object.keys(deploy).every((key) => ["branch", "production_branch", "allow_production", "frontend", "backend", "database"].includes(key))) {
+    deny("project.yaml deploy has unsupported keys.");
+  }
+  for (const key of ["frontend", "backend", "database"]) {
+    if (deploy[key] !== undefined && (deploy[key] === null || typeof deploy[key] !== "object" || Array.isArray(deploy[key]) || !Object.keys(deploy[key]).every((nested) => nested === "branch"))) deny("project.yaml deploy scope is invalid.");
+  }
+  const productionBranch = Object.hasOwn(deploy, "production_branch")
+    ? deploy.production_branch
+    : defaults.productionBranch;
+  const frontend = deploy.frontend !== undefined && Object.hasOwn(deploy.frontend, "branch") ? deploy.frontend.branch : "beta";
+  const backend = deploy.backend !== undefined && Object.hasOwn(deploy.backend, "branch") ? deploy.backend.branch : "beta";
+  const database = deploy.database !== undefined && Object.hasOwn(deploy.database, "branch") ? deploy.database.branch : "beta";
+  if (database !== "beta") deny("project.yaml deploy.database.branch must be beta.");
+  if (
+    !isSafeBranchName(frontend) ||
+    !isSafeBranchName(backend) ||
+    !isSafeBranchName(productionBranch) ||
+    (frontend !== "main" && frontend === productionBranch) ||
+    (backend !== "main" && backend === productionBranch)
+  ) {
+    deny("project.yaml application deploy policy is invalid.");
+  }
+  return { applicationBranches: [...new Set([frontend, backend])], scopeBranches: { frontend, backend }, productionBranch };
+}
+function isSafeBranchName(branch) {
+  return typeof branch === "string" && branch.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) && !branch.includes("..") && !branch.includes("//") && !branch.includes("@{") && !branch.endsWith(".") && !branch.endsWith("/") && !branch.split("/").some((segment) => segment.startsWith(".") || segment.endsWith(".lock"));
+}
+export async function authenticatedSubagentTurn(child, binding, authorityRoot, boundedRead) {
+  const sha = value => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+  const directory = ".agents/private/state/codex-subagent-continuations/v1/" + sha(child.run_id);
+  let files;
+  try { files = await readdir(resolve(authorityRoot, directory)); }
+  catch (error) { if (error.code !== "ENOENT") throw error; files = []; }
+  if (!files.length) return binding.continuation_receipt === undefined ? child.client_turn_id : null;
+  if (files.length > 64 || files.some(file => !/^[a-f0-9]{64}\.json$/.test(file))) return null;
+  const receipts = [];
+  for (const file of files) {
+    const value = JSON.parse(await boundedRead(resolve(authorityRoot, directory, file), 8192, authorityRoot));
+    if (value.schema_version !== 1 || value.run_id !== child.run_id || value.parent_run_id !== child.parent_run_id ||
+        value.run_header_sha256 !== sha(child) || value.original_turn_id !== child.client_turn_id ||
+        value.native_session_id !== binding.native_session_id || ![value.native_session_id, value.agent_path].includes(child.client_thread_id) ||
+        value.agent_type !== child.agent_name || value.model !== child.model || value.reasoning_effort !== child.reasoning_effort ||
+        value.task_id !== child.task_id || value.change_id !== child.change_id || value.execution_id !== child.execution_id ||
+        value.spec_id !== child.spec_id || value.prd_id !== child.prd_id ||
+        !["interrupted", "completed"].includes(value.previous_native_status) || !/^[a-f0-9]{64}$/.test(value.native_context_sha256) ||
+        file !== sha([binding.native_session_id, value.turn_id]) + ".json") return null;
+    receipts.push(value);
+  }
+  let turn = child.client_turn_id, selected = null;
+  const seen = new Set();
+  while (true) {
+    const next = receipts.filter(value => value.previous_turn_id === turn);
+    if (next.length > 1) return null;
+    if (!next.length) break;
+    if (seen.has(next[0])) return null;
+    seen.add(next[0]); selected = next[0]; turn = selected.turn_id;
+  }
+  if (seen.size !== receipts.length || !selected || binding.continuation_receipt !== directory + "/" + sha([binding.native_session_id, turn]) + ".json") return null;
+  return turn;
+}
+const inside = (path, root) => { const scoped = relative(root, resolve(path)); return scoped === "" || (!scoped.startsWith("..") && !isAbsolute(scoped)); };
+/** Inspect existing ancestors too: a missing destination can still traverse a junction. */
+export async function isSafePatchPath(target, root) {
+  if (!inside(target, root)) return false;
+  for (let path = resolve(target);; path = dirname(path)) {
+    try {
+      const info = await lstat(path);
+      if (info.isSymbolicLink() || (info.isFile() && info.nlink !== 1)) return false;
+    } catch (error) { if (error.code !== "ENOENT") return false; }
+    if (path === resolve(root)) return true;
+    if (dirname(path) === path) return false;
+  }
+}
+/** Validate only this native child's patch scope and its still-active canonical ancestry. */
+export function nativePatchScopeMatches(scope, path) {
+  if (typeof path !== "string" || !path || isAbsolute(path) || /[\\:\x00]/.test(path) ||
+      path.split("/").some(part => !part || part === "." || part === "..")) return false;
+  if (typeof scope !== "string" || !scope || isAbsolute(scope) || /[\\:\x00]/.test(scope) ||
+      scope.split("/").some(part => !part || part === "." || part === "..") ||
+      scope.replace(/\/\*\*$/, "").includes("**")) return false;
+  const recursive = scope.endsWith("/**");
+  const base = recursive ? scope.slice(0, -3) : scope;
+  // Literal directory scopes retain their existing descendant semantics.
+  if (!scope.includes("*")) {
+    const literalScope = process.platform === "win32" ? scope.toLowerCase() : scope;
+    const literalPath = process.platform === "win32" ? path.toLowerCase() : path;
+    return literalPath === literalScope || literalPath.startsWith(literalScope + "/");
+  }
+  let pattern = "";
+  for (const char of base) pattern += char === "*" ? "[^/]*" : /[\^$+?.()|{}\[\]]/.test(char) ? "\\" + char : char;
+  return new RegExp("^" + pattern + (recursive ? "(?:/.*)?" : "") + "$", process.platform === "win32" ? "i" : "").test(path);
+}
+`;
+//# sourceMappingURL=codex-native-authority-policy-template.js.map

package/dist/services/codex-native-authority-policy-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-native-authority-policy-template.js","sourceRoot":"","sources":["../../src/services/codex-native-authority-policy-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkItD,CAAC"}

package/dist/services/codex-native-tool-authority-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-native-tool-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gCAAgC,QAiRT,CAAC"}
+{"version":3,"file":"codex-native-tool-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gCAAgC,QAmR5C,CAAC"}

package/dist/services/codex-native-tool-authority-template.js

@@ -1,108 +1,17 @@
 import { CODEX_VALIDATION_RUNTIME_SUPPORT } from "./codex-validation-runtime-template.js";
 export const CODEX_NATIVE_TOOL_AUTHORITY_HOOK = String.raw `import { execFile } from "node:child_process";
+import { createTaskDeliveryAuthority } from "./zaip-task-delivery-authority.mjs";
 import { promisify } from "node:util";
 const executeGit = promisify(execFile);
+import { authenticatedSubagentTurn, isSafePatchPath, nativePatchScopeMatches } from "./zaip-native-authority-policy.mjs";
+export { authenticatedSubagentTurn, checkDestructivePatterns, configuredDeploymentBranches, isSafePatchPath, nativePatchScopeMatches } from "./zaip-native-authority-policy.mjs";
 import { createHash } from "node:crypto";
-import { lstat, readFile, realpath } from "node:fs/promises";
+import { lstat, readFile, readdir, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-// Run starts remain JSON objects; subsequent canonical v3 events are compact arrays.
-// Decode only identity/terminal fields needed for authority, never infer a Run.
-export function readAuthorityRunRecords(text, id) {
-  if (typeof text !== "string" || !text.endsWith("\n")) throw new Error("incomplete_run");
-  const types = { f: "run.finished", d: "run.finalization.decided", a: "run.attribution.recovered", m: "model.selection.recorded", p: "provider.invocation.finished", c: "model.call.observed", u: "usage.recorded" };
-  const records = text.split(/\r?\n/).filter(Boolean).map((line, index) => {
-    const value = JSON.parse(line);
-    const record = Array.isArray(value)
-      ? value[0] === 3 && Object.hasOwn(types, value[1]) && value.length >= 7
-        ? { schema_version: 2, type: types[value[1]], event_id: value[2], sequence: value[3], run_id: id }
-        : null
-      : value;
-    if (!record || record.schema_version !== 2 || record.run_id !== id || record.sequence !== index + 1 ||
-        ((Array.isArray(value) || record.event_id !== undefined) && record.event_id !== id + ":" + String(index + 1).padStart(6, "0")) ||
-        typeof record.type !== "string" || (index === 0 ? record.type !== "run.started" : record.type === "run.started"))
-      throw new Error("invalid_run_identity");
-    return record;
-  });
-  if (!records.length) throw new Error("empty_run");
-  return records;
-}
 
-export function checkDestructivePatterns(command, patterns, deny) {
-  if (/^(?:Write-Output|echo|printf)\s+'(?:[^']|'')*'\s*$/i.test(command)) return;
-  for (const entry of patterns) if (entry.pattern.test(command)) deny(entry.reason);
-}
-export async function configuredDeploymentBranches(repositoryRoot, deny) {
-  const defaults = { applicationBranches: ["beta"], scopeBranches: { frontend: "beta", backend: "beta" }, productionBranch: "main" };
-  let source;
-  try {
-    source = await readFile(resolve(repositoryRoot, ".agents/config/project.yaml"), "utf8");
-  } catch (error) {
-    if (error?.code === "ENOENT") return defaults;
-    deny("Could not read project.yaml deploy policy.");
-  }
-  let document;
-  try {
-    const parser = await import(
-      pathToFileURL(
-        resolve(repositoryRoot, ".agents/skills/zaip-skill-github-deploy/scripts/yaml-parser.mjs"),
-      ).href,
-    );
-    document = parser.parseDocument(source, { strict: true, uniqueKeys: true });
-  } catch {
-    deny("Canonical deploy YAML parser is unavailable.");
-  }
-  if (document.errors.length > 0) deny("project.yaml deploy policy is malformed.");
-  const config = document.toJS();
-  if (config === null || typeof config !== "object" || Array.isArray(config)) {
-    deny("project.yaml must contain a mapping.");
-  }
-  const deploy = config.deploy;
-  if (deploy === undefined) return defaults;
-  if (deploy === null || typeof deploy !== "object" || Array.isArray(deploy)) {
-    deny("project.yaml deploy must be a mapping.");
-  }
-  if (!Object.keys(deploy).every((key) => ["branch", "production_branch", "allow_production", "frontend", "backend", "database"].includes(key))) {
-    deny("project.yaml deploy has unsupported keys.");
-  }
-  for (const key of ["frontend", "backend", "database"]) {
-    if (deploy[key] !== undefined && (deploy[key] === null || typeof deploy[key] !== "object" || Array.isArray(deploy[key]) || !Object.keys(deploy[key]).every((nested) => nested === "branch"))) deny("project.yaml deploy scope is invalid.");
-  }
-  const productionBranch = Object.hasOwn(deploy, "production_branch")
-    ? deploy.production_branch
-    : defaults.productionBranch;
-  const frontend = deploy.frontend !== undefined && Object.hasOwn(deploy.frontend, "branch") ? deploy.frontend.branch : "beta";
-  const backend = deploy.backend !== undefined && Object.hasOwn(deploy.backend, "branch") ? deploy.backend.branch : "beta";
-  const database = deploy.database !== undefined && Object.hasOwn(deploy.database, "branch") ? deploy.database.branch : "beta";
-  if (database !== "beta") deny("project.yaml deploy.database.branch must be beta.");
-  if (
-    !isSafeBranchName(frontend) ||
-    !isSafeBranchName(backend) ||
-    !isSafeBranchName(productionBranch) ||
-    (frontend !== "main" && frontend === productionBranch) ||
-    (backend !== "main" && backend === productionBranch)
-  ) {
-    deny("project.yaml application deploy policy is invalid.");
-  }
-  return { applicationBranches: [...new Set([frontend, backend])], scopeBranches: { frontend, backend }, productionBranch };
-}
-function isSafeBranchName(branch) {
-  return typeof branch === "string" && branch.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) && !branch.includes("..") && !branch.includes("//") && !branch.includes("@{") && !branch.endsWith(".") && !branch.endsWith("/") && !branch.split("/").some((segment) => segment.startsWith(".") || segment.endsWith(".lock"));
-}
 const inside = (path, root) => { const scoped = relative(root, resolve(path)); return scoped === "" || (!scoped.startsWith("..") && !isAbsolute(scoped)); };
-const authorityPath = path => /^(?:\.agents\/(?:records|data\/runs)\/|\.local\/(?:codex-hook-|codex-telemetry-spool\/|runs\/))/i.test(path.replaceAll("\\", "/"));
-/** Inspect existing ancestors too: a missing destination can still traverse a junction. */
-export async function isSafePatchPath(target, root) {
-  if (!inside(target, root)) return false;
-  for (let path = resolve(target);; path = dirname(path)) {
-    try {
-      const info = await lstat(path);
-      if (info.isSymbolicLink() || (info.isFile() && info.nlink !== 1)) return false;
-    } catch (error) { if (error.code !== "ENOENT") return false; }
-    if (path === resolve(root)) return true;
-    if (dirname(path) === path) return false;
-  }
-}
+const authorityPath = path => /^(?:\.agents\/(?:private|state)(?:\/|$)|\.agents\/(?:records|data\/runs)\/|\.local\/(?:recovery\/post-publication(?:\/|$)|codex-hook-|codex-principal-continuations\/|codex-subagent-continuations\/|codex-telemetry-spool\/|runs\/))/i.test(path.replaceAll("\\", "/"));
 async function canonicalScopes(id, root, boundedRead) {
   const date = typeof id === "string" && /^TASK-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+$/.exec(id);
   if (!date) throw new Error("invalid_task");
@@ -120,12 +29,11 @@ async function canonicalScopes(id, root, boundedRead) {
     return value;
   });
 }
-/** Validate only this native child's patch scope and its still-active canonical ancestry. */
 export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead, authorityRoot = repositoryRoot) {
   if (event.tool_name !== "apply_patch" || typeof event.session_id !== "string" || typeof event.turn_id !== "string") return false;
   try {
     const key = createHash("sha256").update(JSON.stringify([event.session_id, event.turn_id])).digest("hex");
-    const binding = JSON.parse(await boundedRead(resolve(authorityRoot, ".local/codex-hook-native/v2", key + ".json"), 65536));
+    const binding = JSON.parse(await boundedRead(resolve(authorityRoot, ".agents/private/state/codex-hook-native/v2", key + ".json"), 65536));
     if (binding.schema_version !== 2 || binding.session_id !== event.session_id || binding.turn_id !== event.turn_id ||
         typeof binding.native_session_id !== "string" ||
         ![binding.native_session_id, binding.parent_session_id, binding.host_session_id].includes(event.session_id) ||
@@ -163,7 +71,7 @@ export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead
         binding.host_session_id !== (macro === null ? parent.client_thread_id : macro.client_thread_id)) return false;
     if (child.client !== "codex-subagent" || child.run_role !== "subagent" || child.run_purpose !== "execution" ||
         !child.execution_eligibility?.includes("delivery") || child.parent_run_id !== parent.run_id ||
-        child.client_thread_id !== binding.agent_id || child.client_turn_id !== event.turn_id ||
+        child.client_thread_id !== binding.agent_id || await authenticatedSubagentTurn(child, binding, authorityRoot, boundedRead) !== event.turn_id ||
         parent.agent !== "agent-orchestrator" || !(ownTaskRoot || delegatedTaskOrchestrator) ||
         parent.client_thread_id !== binding.parent_session_id ||
         parent.entrypoint !== "task" || !binding.task_id || !binding.execution_id ||
@@ -172,55 +80,143 @@ export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead
     const command = event.tool_input?.command;
     if (typeof command !== "string") return false;
     const scopes = await canonicalScopes(binding.task_id, authorityRoot, boundedRead);
-    if (JSON.stringify(scopes) !== JSON.stringify(binding.write_scopes)) return false;
+    if (binding.continuation_receipt === undefined && JSON.stringify(scopes) !== JSON.stringify(binding.write_scopes)) return false;
     const paths = [...command.matchAll(/^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm)].map(match => match[1].trim());
-    for (const path of paths) if (!await isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) return false;
+    for (const path of paths) if (isAbsolute(path) || /[\\:\x00]/.test(path) || path.split("/").some(part => !part || part === "." || part === "..") || !await isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) return false;
     return paths.length > 0 && paths.every(path => {
       const target = resolve(repositoryRoot, path);
-      return !authorityPath(relative(repositoryRoot, target)) && inside(target, repositoryRoot) && scopes.some(scope => {
-        if (typeof scope !== "string" || !scope || isAbsolute(scope) || scope.split(/[\\/]/).includes("..")) return false;
-        const base = resolve(repositoryRoot, scope.replace(/\/\*\*$/, ""));
-        return inside(base, repositoryRoot) && inside(target, base);
-      });
+      return !authorityPath(relative(repositoryRoot, target)) && inside(target, repositoryRoot) && scopes.some(scope => nativePatchScopeMatches(scope, relative(repositoryRoot, target).replaceAll("\\", "/")));
     });
   } catch { return false; }
 }
-export async function hasCurrentTaskOrchestratorRun(event, installedRoot, boundedRead) {
-  const threadId = event.session_id, turnId = event.turn_id;
-  if (typeof threadId !== "string" || typeof turnId !== "string" || !threadId || !turnId) return false;
-  if ((process.env.CODEX_THREAD_ID && threadId !== process.env.CODEX_THREAD_ID) ||
-      (process.env.CODEX_TURN_ID && turnId !== process.env.CODEX_TURN_ID)) return false;
-  try {
-    const digest = createHash("sha256").update(JSON.stringify(["codex", threadId, turnId, null, null])).digest("hex");
-    const correlation = JSON.parse(await boundedRead(resolve(installedRoot, ".local/codex-telemetry-spool/v1/correlations", digest + ".json"), 65536, installedRoot));
-    const id = correlation.run_id;
-    const dated = typeof id === "string" ? /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{2,16}$/.exec(id) : null;
-    if (!dated || correlation.schema_version !== 1 || correlation.thread_id !== threadId || correlation.turn_id !== turnId || correlation.agent_path !== null) return false;
-    const candidates = [
-      ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
-      ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + dated[3] + "/" + id + ".jsonl",
-      ".agents/data/runs/" + dated[1] + "/" + dated[2] + "/" + dated[3] + "/" + id + ".jsonl",
-      ".local/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
-    ];
-    let selected = null;
-    for (const candidate of candidates) {
-      try {
-        const source = await boundedRead(resolve(installedRoot, candidate), 8388608, installedRoot);
-        if (selected !== null) return false;
-        selected = source;
-      } catch (error) { if (error.code !== "ENOENT") return false; }
+
+/** Only the canonical reservation entrypoint may relay an authenticated macro to its captured Task owner. */
+export function isMacroTaskCausalReservationAttempt(command) {
+  return /^(?:node|node\.exe)\s+\.agents\/runtime\/bin\/zaip\.mjs\s+(?:execution\s+native-next\s|run\s+continue-(?:principal|subagent)\s|task\s+settle-replan\s)/.test(command) &&
+    (/(?:^|\s)--(?:reserve-causal|startup-failed)(?=\s|;|$)/.test(command) || /\srun\s+continue-(?:principal|subagent)\s/.test(command));
+}
+export async function hasMacroTaskCausalReservation(event, command, tokenizeLiteralCommand, repositoryRoot, boundedRead, authorityRoot = repositoryRoot, legacy = null) {
+  if (!["exec_command", "shell_command", "Bash"].includes(event.tool_name)) return false;
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^(?:node|node\.exe)$/i.test(tokens[0] ?? "") ||
+      tokens[1] !== ".agents/runtime/bin/zaip.mjs") return false;
+  if (tokens[2] === "run" && tokens[3] === "continue-principal" && tokens.includes("--task"))
+    return rootTaskContinuationBootstrap(event, tokens, authorityRoot, boundedRead, legacy);
+  if (resolve(event.cwd) !== resolve(repositoryRoot)) return false;
+  const continuing = tokens[2] === "run" && ["continue-principal", "continue-subagent"].includes(tokens[3]);
+  const subagentContinuation = continuing && tokens[3] === "continue-subagent";
+  const startup = tokens[2] === "task" && tokens[3] === "settle-replan";
+  const reservation = tokens[2] === "execution" && tokens[3] === "native-next";
+  if (!(continuing ? /^RUN-[A-Z0-9-]+$/.test(tokens[4] ?? "") : startup ? /^TASK-[A-Z0-9-]+$/.test(tokens[4] ?? "") : reservation && /^EXEC-[A-Z0-9-]+$/.test(tokens[4] ?? ""))) return false;
+  const values = continuing ? (subagentContinuation ? ["--task-owner", "--parent-run-id", "--native-session", "--turn", "--from-turn", "--task", "--execution", "--spec"] : ["--task-owner", "--execution", "--spec", "--from-turn"]) : startup ? ["--run", "--commit", "--validation", "--expected-revision", "--reservation", "--spawn-call-id", "--scope-amendment"] : ["--run", "--contexts", "--host-capabilities", "--host-capabilities-json", "--validation"];
+  const booleans = continuing ? ["--json"] : startup ? ["--startup-failed", "--json"] : ["--reserve-causal", "--json"];
+  const options = new Map();
+  for (let index = 5; index < tokens.length; index++) {
+    const flag = tokens[index];
+    if (options.has(flag)) return false;
+    if (booleans.includes(flag)) options.set(flag, true);
+    else {
+      if (!values.includes(flag) || !tokens[index + 1] || tokens[index + 1].startsWith("--")) return false;
+      options.set(flag, tokens[++index]);
     }
-    if (selected === null || !selected.endsWith("\n")) return false;
-    const records = readAuthorityRunRecords(selected, id), started = records[0];
-    if (records.some((record, i) => record.run_id !== id || record.sequence !== i + 1 || record.schema_version !== 2)) return false;
-    const valid = started?.type === "run.started" && started.client_thread_id === threadId && started.client_turn_id === turnId &&
-      ["codex", "codex-desktop"].includes(started.client) && started.phase === "execution" &&
-      typeof started.task_id === "string" && started.task_id.startsWith("TASK-") &&
-      typeof started.execution_id === "string" && started.execution_id.startsWith("EXEC-") &&
-      started.agent === "agent-orchestrator" && started.run_role === "orchestrator" && started.parent_run_id === null && started.entrypoint === "task" &&
-      correlation.task_id === started.task_id && correlation.execution_id === started.execution_id &&
-      !records.some(record => record.type === "run.finished" || record.type === "run.finalization.decided");
-    return valid ? started : false;
+  }
+  if (reservation && (options.size !== (options.has("--validation") ? 6 : 5) || options.get("--reserve-causal") !== true || options.get("--json") !== true ||
+      (options.has("--validation") && !/^(?:TEST|CHECK|INT|E2E|REVIEW|QUALITY|PERF|ROLLBACK)-[A-Z0-9-]+$/.test(options.get("--validation"))) ||
+      !/^RUN-[A-Z0-9-]+$/.test(options.get("--run") ?? "") ||
+      ["--contexts", ...(options.has("--host-capabilities-json") ? [] : ["--host-capabilities"])].some(flag => {
+        const path = options.get(flag);
+        return typeof path !== "string" || !/^(?:\.local\/)?[A-Za-z0-9_./-]+\.json$/.test(path) ||
+          path.split("/").some(part => !part || part === "." || part === "..");
+      }))) return false;
+  if (reservation && options.has("--host-capabilities-json")) {
+    if (options.has("--host-capabilities")) return false;
+    const value = options.get("--host-capabilities-json");
+    if (typeof value !== "string" || Buffer.byteLength(value) > 16384) return false;
+    try { const parsed = JSON.parse(value); if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false; } catch { return false; }
+  }
+  if (continuing && (options.size !== (subagentContinuation ? 9 : 5) || options.get("--json") !== true ||
+      !/^RUN-[A-Z0-9-]+$/.test(options.get("--task-owner") ?? "") || !/^EXEC-[A-Z0-9-]+$/.test(options.get("--execution") ?? "") ||
+      !/^SPEC-[A-Z0-9-]+$/.test(options.get("--spec") ?? "") || typeof options.get("--from-turn") !== "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(options.get("--from-turn")))) return false;
+  if (startup && ((options.size !== 8 && options.size !== 9) || options.get("--json") !== true || options.get("--startup-failed") !== true ||
+      !/^RUN-[A-Z0-9-]+$/.test(options.get("--run") ?? "") || !/^[a-f0-9]{40}$/.test(options.get("--commit") ?? "") ||
+      !/^(?:TEST|CHECK|INT|E2E|REVIEW|QUALITY|PERF|ROLLBACK)-[A-Z0-9-]+$/.test(options.get("--validation") ?? "") ||
+      !/^\d+$/.test(options.get("--expected-revision") ?? "") || !/^CAUSAL-[a-f0-9]{64}$/.test(options.get("--reservation") ?? "") ||
+      !/^call_[A-Za-z0-9_-]{1,160}$/.test(options.get("--spawn-call-id") ?? "") ||
+      (options.has("--scope-amendment") && !/^\.agents\/records\/changes\/[A-Za-z0-9_/-]+\/artifacts\/rework\/scopes-[a-f0-9]{24}\.json$/.test(options.get("--scope-amendment"))))) return false;
+  const thread = event.session_id, turn = event.turn_id;
+  if (typeof thread !== "string" || !thread || typeof turn !== "string" || !turn ||
+      (process.env.CODEX_THREAD_ID && thread !== process.env.CODEX_THREAD_ID) ||
+      (process.env.CODEX_TURN_ID && turn !== process.env.CODEX_TURN_ID)) return false;
+  try {
+    const readActive = async id => {
+      const date = /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{2,16}$/.exec(id ?? "");
+      if (!date) throw new Error("invalid_run");
+      let source = null;
+      for (const path of [
+        ".agents/records/runs/" + date[1] + "/" + date[2] + "/" + id + ".jsonl",
+        ".agents/records/runs/" + date[1] + "/" + date[2] + "/" + date[3] + "/" + id + ".jsonl",
+      ]) {
+        try {
+          const text = await boundedRead(resolve(authorityRoot, path), 8388608, authorityRoot);
+          if (source !== null) throw new Error("ambiguous_run");
+          source = text;
+        } catch (error) { if (error.code !== "ENOENT") throw error; }
+      }
+      const records = readAuthorityRunRecords(source, id);
+      if (records.some(record => ["run.finished", "run.finalization.decided"].includes(record.type))) throw new Error("terminal_run");
+      return records[0];
+    };
+    const digest = createHash("sha256").update(JSON.stringify(["codex", thread, turn, null, null])).digest("hex");
+    const owner = await readActive(options.get(continuing ? "--task-owner" : "--run"));
+    const macro = await readActive(owner.parent_run_id);
+    let correlation;
+    try {
+      correlation = JSON.parse(await boundedRead(resolve(authorityRoot, ".agents/private/state/codex-telemetry-spool/v1/correlations", digest + ".json"), 65536, authorityRoot));
+    } catch (error) { if (error.code !== "ENOENT") throw error; }
+    // A continuation has its own immutable identity receipt; it does not rewrite
+    // the original turn's telemetry correlation or invent one for the new turn.
+    if (correlation !== undefined && (!correlation || typeof correlation !== "object" || Array.isArray(correlation) || correlation.schema_version !== 1 || correlation.thread_id !== thread || correlation.turn_id !== turn ||
+        correlation.agent_path !== null || correlation.run_id !== macro.run_id || correlation.execution_id !== macro.execution_id || correlation.task_id !== null)) return false;
+    if (macro.client_turn_id === turn && correlation === undefined) return false;
+    if (!["codex", "codex-desktop"].includes(macro.client) || macro.client_thread_id !== thread ||
+        macro.agent !== "agent-orchestrator" || macro.run_role !== "orchestrator" || macro.phase !== "execution" ||
+        macro.parent_run_id !== null || macro.task_id !== null || macro.entrypoint !== "spec" || macro.run_purpose !== "orchestration" || macro.execution_kind !== "delivery" ||
+        typeof macro.spec_id !== "string" || !/^SPEC-[A-Z0-9-]+$/.test(macro.spec_id) ||
+        (reservation && macro.execution_id !== tokens[4]) ||
+        owner.client !== "codex-subagent" || owner.agent !== "agent-orchestrator" || owner.run_role !== "subagent" ||
+        owner.run_purpose !== "orchestration" || owner.phase !== "execution" || owner.entrypoint !== "task" || owner.execution_kind !== "delivery" ||
+        owner.invocation_kind !== "delegated" || owner.delegation_depth !== 1 || owner.parent_run_id !== macro.run_id ||
+        owner.parent_agent_invocation_id !== macro.agent_invocation_id || owner.root_agent_invocation_id !== macro.agent_invocation_id ||
+        typeof macro.agent_invocation_id !== "string" || typeof owner.agent_invocation_id !== "string" ||
+        typeof owner.client_thread_id !== "string" || !owner.client_thread_id || typeof owner.client_turn_id !== "string" || !owner.client_turn_id ||
+        owner.execution_id !== macro.execution_id || owner.spec_id !== macro.spec_id || owner.prd_id !== macro.prd_id || !/^TASK-[A-Z0-9-]+$/.test(owner.task_id ?? "")) return false;
+    const continued = async checkedTurn => {
+      const key = createHash("sha256").update(JSON.stringify([macro.run_id, thread, checkedTurn])).digest("hex");
+      const value = JSON.parse(await boundedRead(resolve(authorityRoot, ".agents/private/state/codex-principal-continuations/v1", key + ".json"), 8192, authorityRoot));
+      const context = createHash("sha256").update(JSON.stringify({ session: thread, turn: checkedTurn, model: macro.model, reasoningEffort: macro.reasoning_effort })).digest("hex");
+      return Object.keys(value).sort().join(",") === "context_sha256,execution_id,model,original_turn_id,prd_id,previous_turn_id,principal_run_id,reasoning_effort,schema_version,session_id,spec_id,task_id,task_owner_run_id,turn_id" &&
+        value.schema_version === 1 && value.principal_run_id === macro.run_id && value.task_owner_run_id === owner.run_id && value.task_id === owner.task_id &&
+        value.execution_id === macro.execution_id && value.spec_id === macro.spec_id && value.prd_id === macro.prd_id && value.session_id === thread &&
+        value.original_turn_id === macro.client_turn_id && value.previous_turn_id === macro.client_turn_id && value.turn_id === checkedTurn && value.model === macro.model && value.reasoning_effort === macro.reasoning_effort && value.context_sha256 === context;
+    };
+    if (subagentContinuation) {
+      const child = await readActive(tokens[4]);
+      if (options.get("--execution") !== macro.execution_id || options.get("--spec") !== macro.spec_id || options.get("--task") !== owner.task_id ||
+          !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(options.get("--native-session") ?? "") ||
+          !/^[A-Za-z0-9_-]{1,256}$/.test(options.get("--turn") ?? "") ||
+          child.parent_run_id !== options.get("--parent-run-id") ||
+          child.parent_run_id !== (child.run_id === owner.run_id ? macro.run_id : owner.run_id) ||
+          child.client !== "codex-subagent" || child.run_role !== "subagent" || child.execution_kind !== "delivery" ||
+          child.task_id !== owner.task_id || child.change_id !== owner.change_id || child.execution_id !== owner.execution_id || child.spec_id !== owner.spec_id || child.prd_id !== owner.prd_id ||
+          (child.run_id !== owner.run_id && child.run_purpose !== "execution")) return false;
+    } else if (continuing) {
+      if (tokens[4] !== macro.run_id || options.get("--execution") !== macro.execution_id || options.get("--spec") !== macro.spec_id ||
+          turn === macro.client_turn_id || turn === options.get("--from-turn") ||
+          options.get("--from-turn") !== macro.client_turn_id) return false;
+    } else if (macro.client_turn_id !== turn && !await continued(turn)) return false;
+    if (startup && tokens[4] !== owner.task_id) return false;
+    await canonicalScopes(owner.task_id, authorityRoot, boundedRead);
+    return owner;
   } catch { return false; }
 }
 
@@ -250,19 +246,19 @@ export async function hasClaimedTaskWriter(event, repositoryRoot, boundedRead, d
     let runId = directRun?.run_id, taskId = directRun?.task_id, executionId = directRun?.execution_id;
     if (!runId) {
       const key = createHash("sha256").update(JSON.stringify([event.session_id, event.turn_id])).digest("hex");
-      const binding = JSON.parse(await boundedRead(resolve(authorityRoot, ".local/codex-hook-native/v2", key + ".json"), 65536));
+      const binding = JSON.parse(await boundedRead(resolve(authorityRoot, ".agents/private/state/codex-hook-native/v2", key + ".json"), 65536));
       if (binding.session_id !== event.session_id || binding.turn_id !== event.turn_id) return false;
       runId = binding.parent_run_id; taskId = binding.task_id; executionId = binding.execution_id;
     }
     if (!/^RUN-[A-Z0-9-]+$/.test(runId ?? "") || !/^TASK-[A-Z0-9-]+$/.test(taskId ?? "") ||
         !/^EXEC-[A-Z0-9-]+$/.test(executionId ?? "")) return false;
-    const source = await boundedRead(resolve(authorityRoot, ".local/task-workspaces/shared-writer.json"), 65536).catch(() => null);
+    const source = await boundedRead(resolve(authorityRoot, ".agents/private/state/task-workspaces/shared-writer.json"), 65536).catch(() => null);
     const claim = source === null ? null : JSON.parse(source);
     if (claim?.mode === "shared" && claim.status === "ready" && claim.branch === null &&
       claim.run_id === runId && claim.task_id === taskId && claim.execution_id === executionId &&
       resolve(claim.path) === resolve(authorityRoot) && resolve(repositoryRoot) === resolve(authorityRoot) &&
       resolve(claim.canonical_workspace) === resolve(authorityRoot)) return true;
-    const isolated = JSON.parse(await boundedRead(resolve(authorityRoot, ".local/task-workspaces/claims", taskId + ".json"), 65536));
+    const isolated = JSON.parse(await boundedRead(resolve(authorityRoot, ".agents/private/state/task-workspaces/claims", taskId + ".json"), 65536));
     return isolated.status === "ready" && isolated.mode !== "shared" &&
       isolated.run_id === runId && isolated.task_id === taskId && isolated.execution_id === executionId &&
       typeof isolated.branch === "string" && isolated.branch.startsWith("codex/") &&
@@ -271,5 +267,11 @@ export async function hasClaimedTaskWriter(event, repositoryRoot, boundedRead, d
       await isolatedGitMatchesClaim(repositoryRoot, authorityRoot, isolated);
   } catch { return false; }
 }
-` + CODEX_VALIDATION_RUNTIME_SUPPORT;
+` +
+    CODEX_VALIDATION_RUNTIME_SUPPORT +
+    String.raw `
+const taskDeliveryAuthority = createTaskDeliveryAuthority({ hasClaimedTaskWriter });
+export const { readAuthorityRunRecords, hasCurrentTaskOrchestratorRun } = taskDeliveryAuthority;
+const { rootTaskContinuationBootstrap } = taskDeliveryAuthority;
+`;
 //# sourceMappingURL=codex-native-tool-authority-template.js.map

package/dist/services/codex-native-tool-authority-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-native-tool-authority-template.js","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgRX,GAAG,gCAAgC,CAAC"}
+{"version":3,"file":"codex-native-tool-authority-template.js","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4QX;IACC,gCAAgC;IAChC,MAAM,CAAC,GAAG,CAAA;;;;CAIX,CAAC"}

package/dist/services/codex-node-options-template.d.ts

@@ -0,0 +1,3 @@
+/** Embedded in the reviewed support module; no new installed module or authority route. */
+export declare const CODEX_NODE_OPTIONS_SUPPORT = "\nfunction validateNodeEntrypoint(args, deny) {\n  const block = () => deny(\"Inline or piped interpreter execution is blocked; Node requires a reviewed script without preloads.\");\n  const informational = [\"--version\", \"-v\", \"--help\", \"-h\"];\n  if (args.length === 1 && informational.includes(args[0])) return;\n  const switches = [\"--test\", \"--test-only\", \"--test-force-exit\", \"--check\", \"-c\", \"--no-warnings\", \"--no-deprecation\", \"--trace-warnings\", \"--experimental-strip-types\"];\n  const valued = [\"--test-name-pattern\", \"--test-skip-pattern\", \"--test-concurrency\", \"--test-timeout\"];\n  for (let index = 0; index < args.length; index++) {\n    const value = args[index];\n    if (value === \"--\") {\n      if (!args[index + 1] || args[index + 1] === \"-\") block();\n      return;\n    }\n    if (!value) block();\n    if (!value.startsWith(\"-\")) return; // All following values belong to the script.\n    if (/^(?:--(?:eval|print|require|import|loader|experimental-loader)(?:=|$)|-[epr])/.test(value)) block();\n    if (switches.includes(value)) continue;\n    const name = value.split(\"=\")[0];\n    if (valued.includes(name)) {\n      if (value.includes(\"=\")) { if (!value.split(\"=\").slice(1).join(\"=\")) block(); }\n      else if (!args[++index] || args[index].startsWith(\"-\")) block();\n      continue;\n    }\n    block(); // Unknown pre-entry options, stdin and interactive Node fail closed.\n  }\n  block();\n}\n";
+//# sourceMappingURL=codex-node-options-template.d.ts.map

package/dist/services/codex-node-options-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-node-options-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-node-options-template.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,q8CA2BtC,CAAC"}

package/dist/services/codex-node-options-template.js

@@ -0,0 +1,30 @@
+/** Embedded in the reviewed support module; no new installed module or authority route. */
+export const CODEX_NODE_OPTIONS_SUPPORT = `
+function validateNodeEntrypoint(args, deny) {
+  const block = () => deny("Inline or piped interpreter execution is blocked; Node requires a reviewed script without preloads.");
+  const informational = ["--version", "-v", "--help", "-h"];
+  if (args.length === 1 && informational.includes(args[0])) return;
+  const switches = ["--test", "--test-only", "--test-force-exit", "--check", "-c", "--no-warnings", "--no-deprecation", "--trace-warnings", "--experimental-strip-types"];
+  const valued = ["--test-name-pattern", "--test-skip-pattern", "--test-concurrency", "--test-timeout"];
+  for (let index = 0; index < args.length; index++) {
+    const value = args[index];
+    if (value === "--") {
+      if (!args[index + 1] || args[index + 1] === "-") block();
+      return;
+    }
+    if (!value) block();
+    if (!value.startsWith("-")) return; // All following values belong to the script.
+    if (/^(?:--(?:eval|print|require|import|loader|experimental-loader)(?:=|$)|-[epr])/.test(value)) block();
+    if (switches.includes(value)) continue;
+    const name = value.split("=")[0];
+    if (valued.includes(name)) {
+      if (value.includes("=")) { if (!value.split("=").slice(1).join("=")) block(); }
+      else if (!args[++index] || args[index].startsWith("-")) block();
+      continue;
+    }
+    block(); // Unknown pre-entry options, stdin and interactive Node fail closed.
+  }
+  block();
+}
+`;
+//# sourceMappingURL=codex-node-options-template.js.map

package/dist/services/codex-node-options-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-node-options-template.js","sourceRoot":"","sources":["../../src/services/codex-node-options-template.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BzC,CAAC"}

package/dist/services/codex-pre-tool-cli-capture-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-cli-capture-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-cli-capture-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,QAsG3C,CAAC"}
+{"version":3,"file":"codex-pre-tool-cli-capture-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-cli-capture-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,QAkT3C,CAAC"}