@zalom/plastic 2.0.0-alpha.9 → 2.0.2

package/scripts/lib/worktree.rb

@@ -1,6 +1,7 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
+require_relative "store_layout"
 require "json"
 require "yaml"
 require "socket"
@@ -108,16 +109,16 @@ module Worktree
 
   # --- provisioning ----------------------------------------------------------
 
-  # Resolve the slug from the bridge's intent.store, create code + store
+  # Resolve the slug from the delivery's intent.store, create code + store
   # worktrees (idempotent: reuse an existing worktree path, do not error), write
-  # the `worktree` block plus `provisioned: true` onto bridge_data, return it.
+  # the `worktree` block plus `provisioned: true` onto delivery, return it.
   #
   # Fails open with a stderr log when the repo is non-git or unresolvable:
   # sets `provisioned: false` and leaves `code: null`. All git ops use
   # `git -C <resolved path>` -- never cwd (decision D6).
-  def provision(bridge_data, home: Dir.home, runner: ShellRunner.new)
-    return bridge_data unless bridge_data.is_a?(Hash)
-    intent = bridge_data["intent"] || {}
+  def provision(delivery, home: Dir.home, runner: ShellRunner.new)
+    return delivery unless delivery.is_a?(Hash)
+    intent = delivery["intent"] || {}
     intent_id = intent["id"].to_s
     store = intent["store"].to_s
     intent_slug = slug_from_dir(intent["dir"]) || slug_from_dir(store)
@@ -173,15 +174,15 @@ module Worktree
     # replaced by the fresh unprovisioned block; the guard must not fail harder
     # than the bug it guards.
     if code_ok
-      bridge_data["worktree"] = block
+      delivery["worktree"] = block
     else
-      existing = bridge_data["worktree"]
+      existing = delivery["worktree"]
       keep = existing.is_a?(Hash) && !blank?(existing["code"]) &&
              Dir.exist?(existing["code"].to_s)
-      bridge_data["worktree"] = block unless keep
+      delivery["worktree"] = block unless keep
     end
 
-    bridge_data
+    delivery
   end
 
   # Remove the worktree (then `git worktree prune`), clear the worktree block.
@@ -189,21 +190,21 @@ module Worktree
   # policy on top via `finish`; this is the plain remove. Pass `remove: false` to
   # clear the block WITHOUT touching git (so `finish` can merge first, then call
   # release to drop the worktree once the code branch is integrated).
-  def release(bridge_data, home: Dir.home, runner: ShellRunner.new, remove: true)
-    return bridge_data unless bridge_data.is_a?(Hash)
-    block = bridge_data["worktree"]
-    return bridge_data unless block.is_a?(Hash)
+  def release(delivery, home: Dir.home, runner: ShellRunner.new, remove: true)
+    return delivery unless delivery.is_a?(Hash)
+    block = delivery["worktree"]
+    return delivery unless block.is_a?(Hash)
 
     if remove
-      slug = slug_for_store(bridge_data.dig("intent", "store").to_s, home: home)
+      slug = slug_for_store(delivery.dig("intent", "store").to_s, home: home)
       repo = repo_for(slug, home: home)
 
       remove_worktree(runner, repo: repo, worktree: block["code"]) if repo && block["code"]
       prune(runner, repo: repo) if repo
     end
 
-    bridge_data.delete("worktree")
-    bridge_data
+    delivery.delete("worktree")
+    delivery
   end
 
   # --- cleanup policy (merge-vs-remove) -------------------------------------
@@ -222,19 +223,19 @@ module Worktree
   # Fail-open and idempotent throughout: a missing block, missing branch, or any
   # git failure never raises and never blocks teardown. All git ops use
   # `git -C <path>`, never cwd (decision D6). No-op when nothing was provisioned.
-  def finish(bridge_data, home: Dir.home, runner: ShellRunner.new, merge: false)
-    return bridge_data unless bridge_data.is_a?(Hash)
-    block = bridge_data["worktree"]
-    return bridge_data unless block.is_a?(Hash)
+  def finish(delivery, home: Dir.home, runner: ShellRunner.new, merge: false)
+    return delivery unless delivery.is_a?(Hash)
+    block = delivery["worktree"]
+    return delivery unless block.is_a?(Hash)
 
     if merge
-      slug = slug_for_store(bridge_data.dig("intent", "store").to_s, home: home)
+      slug = slug_for_store(delivery.dig("intent", "store").to_s, home: home)
       repo = repo_for(slug, home: home)
       branch = block["code_branch"]
       merge_branch(runner, repo: repo, branch: branch) if repo && !blank?(branch)
     end
 
-    release(bridge_data, home: home, runner: runner, remove: true)
+    release(delivery, home: home, runner: runner, remove: true)
   end
 
   # Merge `branch` into the repo's default branch from the main checkout. The
@@ -298,8 +299,8 @@ module Worktree
   # --- lock ------------------------------------------------------------------
 
   # True iff ANOTHER session's delivery.lock is FRESH on this intent's dir
-  # (intent 108, D2): the durable lock file decides; /tmp bridges are not
-  # consulted and no pid is probed. current_session being the owner or a
+  # (intent 108, D2): the durable lock file decides alone, and no pid is
+  # probed. current_session being the owner or a
   # delegate does not count as "other". A stale lock does not hold (explicit
   # takeover reclaims it).
   def lock_held_by_other?(intent_id:, store:, current_session:, home: Dir.home,
@@ -377,14 +378,8 @@ module Worktree
   # (no project repo). Mirrors qmd_sync's slug_for_store fallback.
   def slug_for_store(store_dir, home: Dir.home)
     return nil if blank?(store_dir)
-    plastic_home = File.expand_path(File.join(home, ".plastic"))
-    store_dir = File.expand_path(store_dir)
-    return nil if store_dir == File.join(plastic_home, "store")
-
-    parts = store_dir.split(File::SEPARATOR)
-    idx = parts.rindex("projects")
-    return parts[idx + 1] if idx && parts[idx + 1] && parts[idx + 2] == "store"
-    nil
+    slug = Plastic::StoreLayout.locate(store_dir).last
+    (slug == Plastic::StoreLayout::GLOBAL) ? nil : slug
   end
 
   # Best-effort slug for the worktree dir-name from an intent dir/store path:

package/scripts/lib/worktree_sweep.rb

@@ -1,8 +1,9 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
+require_relative "store_layout"
 require_relative "worktree"
-require_relative "bridge"
+require_relative "index_entry"
 
 # WorktreeSweep -- the one-time orphan sweep for store worktrees retired by
 # intent 178 (D2). Pure candidate classification plus a thin apply step, both
@@ -55,14 +56,14 @@ module WorktreeSweep
   # Matching on the full name, not just the numeric id, sidesteps id
   # collisions across projects (ids are only unique WITHIN one store).
   def resolve_intent_dir(plastic_home, name)
-    candidates = [File.join(plastic_home, "store", name)] +
-                 Dir.glob(File.join(plastic_home, "projects", "*", "store", name))
+    candidates = [File.join(Plastic::StoreLayout.global_store(plastic_home), name)] +
+                 Dir.glob(File.join(Plastic::StoreLayout.projects_root(plastic_home), "*", "store", name))
     candidates.find { |d| Dir.exist?(d) }
   end
 
   # The INDEX.md section heading (e.g. "Active", "Completed") that lists this
   # intent dir, or nil if no INDEX.md entry links to it. Reuses
-  # Bridge.index_entry_match so this never drifts from the shared parser.
+  # IndexEntry.match so this never drifts from the shared parser.
   def index_status(intent_dir, name)
     store = File.dirname(intent_dir)
     index = File.join(File.dirname(store), "INDEX.md")
@@ -75,7 +76,7 @@ module WorktreeSweep
         section = stripped.sub(/\A##\s*/, "").strip
         next
       end
-      m = Bridge.index_entry_match(stripped)
+      m = IndexEntry.match(stripped)
       next unless m
       return section if m[3].to_s.include?(name)
     end

package/scripts/link-suggest

@@ -26,6 +26,7 @@
 # nothing. --edge is explicit and required (sources is decided by origin, never
 # inferred); --rating is required when --edge is chain.
 
+require_relative "lib/store_layout"
 require_relative "lib/link_suggestions"
 
 module LinkSuggestCLI
@@ -69,7 +70,7 @@ module LinkSuggestCLI
         i += 1
       end
     end
-    opts[:store_dir] ||= File.join(opts[:home], "store")
+    opts[:store_dir] ||= Plastic::StoreLayout.global_store(opts[:home])
     opts
   end
 

package/scripts/meter-watch

@@ -0,0 +1,57 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# meter-watch (intent 355, n5, D6): reads the rate-limit cache under --home
+# and writes ~/.plastic/.cache/meter-state.json with the state (ok, reduce,
+# stop, resume, stale, unavailable), the two raw percentages, the reset
+# time, and when it was checked. A session watches that one file instead of
+# every session parsing the cache and re-deriving the thresholds.
+#
+# Usage:
+#   meter-watch [--home DIR]
+#   meter-watch --install-timer [--home DIR]
+#
+# --install-timer writes a LaunchAgent plist under --home (default
+# ~/.plastic when --home is not given) that runs this tick every 20
+# minutes. It never calls launchctl; load it yourself with the command it
+# prints. The Plastic installer never calls --install-timer on its own.
+#
+# Exit codes: 0 reported (unavailable included); 2 usage error.
+
+require "json"
+require_relative "lib/meter_watch"
+
+def usage_abort(message)
+  warn "meter-watch: #{message}"
+  warn "Usage: meter-watch [--home DIR] [--install-timer]"
+  exit 2
+end
+
+home = File.join(Dir.home, ".plastic")
+install_timer = false
+
+argv = ARGV.dup
+until argv.empty?
+  case (token = argv.shift)
+  when "--home"
+    usage_abort("--home requires a value") if argv.empty?
+    home = argv.shift
+  when "--install-timer"
+    install_timer = true
+  else
+    usage_abort("unknown argument #{token.inspect}")
+  end
+end
+
+home = File.expand_path(home)
+
+if install_timer
+  plist_path = MeterWatch.install_timer(home: home, script_path: File.expand_path(__FILE__))
+  puts "Installed LaunchAgent at #{plist_path}"
+  puts "Run `launchctl load #{plist_path}` to activate it."
+  exit 0
+end
+
+state = MeterWatch.new(home: home).tick
+puts JSON.generate(state)

package/scripts/migrate-to-global

@@ -17,7 +17,7 @@ GLOBAL_ROOT="$HOME/.plastic"
 LOCAL_PLASTIC="$PROJECT_PATH/.plastic"
 
 if [ ! -d "$GLOBAL_ROOT" ]; then
-  echo "Error: Global Plastic not installed. Run /plastic-install first." >&2
+  echo "Error: Global Plastic not installed. Run 'plastic install' first." >&2
   exit 1
 fi
 

package/scripts/new-intent

@@ -35,6 +35,7 @@
 # exactly one line, `created <dir>` or `joined <dir>`; exit 0 either way,
 # exit 1 on bad input or failed self-validation.
 
+require_relative "lib/store_layout"
 require "fileutils"
 require "date"
 require_relative "lib/savepoint"
@@ -167,17 +168,7 @@ end
 # [nil, "global"] only if the layout is unrecognized, in which case Links
 # projection falls back to single-store resolution rooted at this store.
 def store_context(store)
-  store = File.expand_path(store)
-  parent = File.dirname(store)               # `<home>` or `<home>/projects/<slug>`
-  if File.basename(store) == "store" && File.basename(File.dirname(parent)) == "projects"
-    slug = File.basename(parent)
-    home = File.dirname(File.dirname(parent)) # strip projects/<slug>
-    [home, "project:#{slug}"]
-  elsif File.basename(store) == "store"
-    [parent, "global"]                        # `<home>/store`
-  else
-    [parent, "global"]
-  end
+  Plastic::StoreLayout.home_and_scope(store)
 end
 
 # The in-scope stores under `plastic_home`, each { key:, store: }. Delegates to
@@ -283,7 +274,7 @@ def run_tmp(opts)
   abort "new-intent: --sources is not valid with --tmp" unless opts[:sources].empty?
   abort "new-intent: --tags is not valid with --tmp" unless opts[:tags].empty?
 
-  store = opts[:store] ? expand(opts[:store]) : expand(File.join(ENV.fetch("PLASTIC_HOME", "~/.plastic"), "store"))
+  store = opts[:store] ? expand(opts[:store]) : Plastic::StoreLayout.global_store(expand(ENV.fetch("PLASTIC_HOME", "~/.plastic")))
   templates = opts[:templates] ? expand(opts[:templates]) : default_templates_dir
   abort "new-intent: templates dir not found: #{templates}" unless Dir.exist?(templates)
 
@@ -362,7 +353,7 @@ def main(argv)
   # 4a. I1 reciprocity: write the child's id into EACH source intent's frontmatter
   # `chain` (the formative-reciprocity backlink), for BOTH the `--parent` and the
   # `--sources` path. `sources` is the redundant-explicit set from step 3 (it already
-  # folds in `--parent`). Collect the touched source files so their `## Links` can be
+  # includes `--parent`). Collect the touched source files so their `## Links` can be
   # re-projected once the chain edges are on disk.
   source_files = []
   sources.each do |src_id|

package/scripts/node-input

@@ -0,0 +1,92 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require_relative "lib/node_input"
+require_relative "lib/savepoint"
+
+# node-input - the CLI over NodeInput (intent 338, G5). Builds one node's
+# whole input from disk and writes it to attempts/<node>--a<N>.input (or
+# --out), printing a parsable summary and the exact node-transition running
+# command intent 340's runner should record.
+#
+# Usage:
+#   node-input <intent_dir> --node <id> [--budget N] [--hop-tokens N]
+#               [--holder H] [--expires E] [--model M] [--attempt N]
+#               [--out PATH] [--force]
+#
+# Exit codes (spec D17, shared with node-transition's family):
+#   0 - the node input was written (or the identical bytes already existed)
+#   2 - usage: not an intent directory, missing --node, or an unknown node
+#   3 - an unreadable, cyclic or unparsable graph, node file, or record
+#   4 - overflow past the third cut; nothing was written
+#   5 - an existing attempt file whose bytes differ; nothing was written
+module NodeInputCLI
+  module_function
+
+  def usage
+    warn "Usage: node-input <intent_dir> --node <id> [--budget N] [--hop-tokens N] " \
+         "[--holder H] [--expires E] [--model M] [--attempt N] [--out PATH] [--force]"
+  end
+
+  def intent_directory?(dir)
+    dir && File.directory?(dir) && File.exist?(Savepoint.intent_file(dir))
+  end
+
+  def opt(args, name)
+    (i = args.index(name)) && args[i + 1]
+  end
+
+  def main(argv)
+    args = argv.dup
+    intent_dir_arg = args.shift
+
+    unless intent_directory?(intent_dir_arg && File.expand_path(intent_dir_arg))
+      warn "node-input: #{intent_dir_arg.inspect} is not an intent directory"
+      usage
+      exit 2
+    end
+    intent_dir = File.expand_path(intent_dir_arg)
+
+    node = opt(args, "--node")
+    if node.to_s.strip.empty?
+      warn "node-input: --node is required"
+      usage
+      exit 2
+    end
+
+    budget = opt(args, "--budget")
+    hop_tokens = opt(args, "--hop-tokens")
+    attempt = opt(args, "--attempt")
+    out = opt(args, "--out")
+    holder = opt(args, "--holder")
+    expires = opt(args, "--expires")
+    model = opt(args, "--model")
+    force = args.include?("--force")
+
+    result = NodeInput.build(
+      intent_dir: intent_dir,
+      node: node,
+      budget_tokens: budget ? budget.to_i : NodeInput::DEFAULT_BUDGET_TOKENS,
+      hop_tokens: hop_tokens ? hop_tokens.to_i : NodeInput::DEFAULT_HOP_TOKENS,
+      holder: holder,
+      expires: expires,
+      model: model,
+      attempt: attempt ? attempt.to_i : nil,
+      out: out,
+      force: force,
+    )
+
+    if result[:ok]
+      puts NodeInput.summary_line(result)
+      puts result[:running_command]
+      exit 0
+    end
+
+    Array(result[:errors]).each { |e| warn "node-input: #{e}" }
+    puts result[:needs_decision_command] if result[:needs_decision_command]
+    exit result[:exit_code]
+  end
+end
+
+NodeInputCLI.main(ARGV) if $PROGRAM_NAME == __FILE__

package/scripts/node-run

@@ -0,0 +1,225 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "digest"
+require "time"
+require "yaml"
+require "fileutils"
+require_relative "lib/savepoint"
+require_relative "lib/node_ledger"
+require_relative "lib/node_input"
+require_relative "lib/node_worktree"
+require_relative "lib/node_file"
+require_relative "lib/ready_set"
+require_relative "lib/runner_core"
+require_relative "lib/codex_adapter"
+
+# node-run - the Codex leg of one node's whole attempt (intent 340b, G7c, n6).
+#
+# On Claude Code a subagent dispatch IS the executor; on Codex the executor
+# is a subprocess, so this script owns the timing of a whole node: it reads
+# the node's live `running` line, resolves the node input that line names,
+# builds the `codex exec` argv for the node's kind (CodexAdapter), runs it
+# in the node's worktree with the node input on stdin, reads the executor's
+# final message, and writes it to the attempt's own return path.
+#
+# It writes NO ledger transition, on any path - success, refusal or error
+# alike. That is the whole point: exactly one thing writes `done` (the
+# runner's own six-check absorb gate), and a second writer here would throw
+# that guarantee away. The caller absorbs with `runner step --return
+# ID=PATH` through the same six checks every other return goes through.
+#
+# Usage:
+#   node-run <intent_dir> --node <id> [--session SID] [--now ISO8601]
+#            [--timeout-seconds N]
+#
+# Exit codes: 0 - a return file was written (whatever its content actually
+# says; that judgment belongs to the absorb gate, not this script). Every
+# other code is a REFUSAL: nothing is written, node-run never even reached
+# `codex exec`.
+#   2 - usage: not an intent directory, or missing --node
+#   3 - the node has no live `running` line
+#   4 - the running line is held by another session
+#   5 - the node input the running line names is missing from disk
+#   6 - the node input on disk does not hash to the running line's input=
+#   7 - no worktree could be resolved to run in
+module NodeRunCLI
+  module_function
+
+  def usage
+    warn "Usage: node-run <intent_dir> --node <id> [--session SID] [--now ISO8601] " \
+         "[--timeout-seconds N]"
+  end
+
+  def opt(args, name)
+    (i = args.index(name)) && args[i + 1]
+  end
+
+  def intent_directory?(dir)
+    dir && File.directory?(dir) && File.exist?(Savepoint.intent_file(dir))
+  end
+
+  # <intent_dir>/attempts/<node>--a<N>.return.yml (spec): beside the node input,
+  # one per attempt, the same treatment input files already get - never
+  # reused across attempts, so a second attempt's return can never be
+  # mistaken for the first's.
+  def return_path(intent_dir, node, attempt)
+    File.join(intent_dir, "attempts", "#{node}--a#{attempt}.return.yml")
+  end
+
+  # The node's own declared kind, read straight off its node file - "work"
+  # when the file cannot be found or parsed at all (mirroring RunnerPolicy's
+  # own unknown-kind fallback), but the LITERAL string it declares
+  # otherwise, even an invalid one (matrix row 6.10): CodexAdapter's own
+  # kind table only distinguishes "read-only" (verify, research) from
+  # everything else, so an unrecognized kind still gets the widest, safest
+  # treatment rather than no treatment at all.
+  def resolve_kind(intent_dir, node)
+    path = ReadySet.find_node_path(intent_dir, node)
+    return "work" unless path
+
+    parsed = NodeFile.parse(path)
+    kind = parsed[:kind].to_s.strip
+    kind.empty? ? "work" : kind
+  end
+
+  # The directory `codex exec -C` runs in: a `work` node's own worktree when
+  # one is actually provisioned on disk, else the shared intent worktree -
+  # verify and research nodes never get a worktree of their own (327 D6,
+  # D29), so the only place they could ever leave a diff is the intent
+  # worktree itself, exactly where NodeWorktree.changed_paths already looks
+  # for one.
+  def node_target_dir(context, node:, kind:)
+    if NodeWorktree::WORKTREE_KINDS.include?(kind.to_s)
+      p = NodeWorktree.paths(context, node: node)
+      return p["path"] if p["path"] && Dir.exist?(p["path"])
+    end
+    context.worktree
+  end
+
+  # A synthetic, deliberately non-YAML-mapping line the absorb gate reads as
+  # unparsable (spec Approach: "a return file the gate reads as
+  # unparsable"), covering every subprocess failure the same way: a nonzero
+  # exit, a timeout, an empty message file, and a message with no YAML
+  # document either way. Carries no colon-shaped `key: value` text on
+  # purpose, so it can never accidentally parse as a YAML mapping that
+  # happens to satisfy NodeReturn's own schema.
+  def unparsable_body(node, result)
+    reason =
+      if result[:timed_out]
+        "node-run - codex exec for #{node} timed out with no usable return"
+      elsif !result[:exit_code].nil? && result[:exit_code] != 0
+        "node-run - codex exec for #{node} exited #{result[:exit_code]} with no usable return"
+      else
+        "node-run - codex exec for #{node} produced no parsable YAML document on either " \
+          "--output-last-message or stdout"
+      end
+    "#{reason}\n"
+  end
+
+  def main(argv)
+    args = argv.dup
+    intent_dir_arg = args.shift
+
+    unless intent_directory?(intent_dir_arg && File.expand_path(intent_dir_arg))
+      warn "node-run: #{intent_dir_arg.inspect} is not an intent directory"
+      usage
+      exit 2
+    end
+    intent_dir = File.expand_path(intent_dir_arg)
+
+    node = opt(args, "--node")
+    if node.to_s.strip.empty?
+      warn "node-run: --node is required"
+      usage
+      exit 2
+    end
+
+    session_flag = opt(args, "--session")
+    now_flag = opt(args, "--now")
+    timeout_flag = opt(args, "--timeout-seconds")
+
+    begin
+      now_flag ? Time.iso8601(now_flag) : Time.now
+    rescue ArgumentError
+      warn "node-run: --now must be ISO 8601"
+      exit 2
+    end
+
+    context = RunnerCore.context(intent_dir: intent_dir, session: session_flag,
+                                  env: ENV["CLAUDE_CODE_SESSION_ID"])
+
+    savepoint_path = File.join(intent_dir, "savepoint.md")
+    current_status = NodeLedger.status_for(savepoint_path, node)
+    running_entry = NodeLedger.last_running(savepoint_path, node)
+    unless current_status == "running" && running_entry
+      warn "node-run: #{node} has no live running line (state is #{current_status})"
+      exit 3
+    end
+
+    fields = running_entry[:fields] || {}
+    holder = fields["holder"]
+    if context.session.nil? || context.session.to_s != holder.to_s
+      warn "node-run: #{node}'s running line is held by #{holder.inspect}, not this session"
+      exit 4
+    end
+
+    kind = resolve_kind(intent_dir, node)
+
+    # matrix row 6.11: the attempt number comes from NodeInput's own
+    # counter, never a hand count. `lease_flag_given: false` because the
+    # running line this attempt is acting on ALREADY exists on disk (it is
+    # what we just read above) - counting it a second time would double it
+    # (the same count, plus one, that produced it in the first place when
+    # the node input was originally built).
+    attempt = NodeInput.compute_attempt_number(intent_dir: intent_dir, node: node, lease_flag_given: false)
+    input_path = NodeInput.input_path(intent_dir: intent_dir, node: node, attempt: attempt)
+
+    unless File.exist?(input_path)
+      warn "node-run: #{node}'s node input is missing at #{input_path}"
+      exit 5
+    end
+
+    input_bytes = File.binread(input_path)
+    actual_sha = Digest::SHA256.hexdigest(input_bytes)[0, 12]
+    expected_sha = fields["input"]
+    unless expected_sha && actual_sha == expected_sha
+      warn "node-run: #{node}'s node input at #{input_path} does not hash to input=#{expected_sha.inspect} " \
+           "(computed #{actual_sha})"
+      exit 6
+    end
+
+    worktree = node_target_dir(context, node: node, kind: kind)
+    if worktree.nil? || !Dir.exist?(worktree)
+      warn "node-run: #{node} has no resolvable worktree to run in"
+      exit 7
+    end
+
+    out_path = return_path(intent_dir, node, attempt)
+    FileUtils.mkdir_p(File.dirname(out_path))
+    message_path = "#{out_path}.msg"
+
+    timeout_seconds = timeout_flag ? timeout_flag.to_i : CodexAdapter.timeout_seconds(kind)
+    codex_argv = CodexAdapter.build_argv(kind: kind, worktree: worktree, output_last_message: message_path,
+                                          model: fields["model"], effort: fields["effort"])
+
+    result = CodexAdapter.execute(codex_argv, stdin_data: input_bytes, timeout_seconds: timeout_seconds,
+                                   output_last_message_path: message_path)
+
+    # matrix rows 6.20-6.22: a nonzero exit or a timeout is authoritative -
+    # any message text the child managed to leave behind is never trusted
+    # once either has happened. Only a clean exit with no usable message at
+    # all falls to "no parsable YAML document".
+    failed = result[:timed_out] || (!result[:exit_code].nil? && result[:exit_code] != 0)
+    body = failed ? unparsable_body(node, result) : (result[:message] || unparsable_body(node, result))
+
+    File.write(out_path, body)
+    File.delete(message_path) if File.exist?(message_path)
+
+    puts out_path
+    exit 0
+  end
+end
+
+NodeRunCLI.main(ARGV) if $PROGRAM_NAME == __FILE__