agent-embassy 1.0.0 → 1.2.0

package/dist/src/gateway/service.d.ts

@@ -32,6 +32,25 @@ export type GatewayAdapterDelivery = {
     /** Transient, bounded by the adapter. Never copied into normalized state. */
     replyText?: string;
 };
+/**
+ * One provider-wide Codex endpoint transition. Native thread and generation
+ * identifiers stay inside this controller boundary and are never projected.
+ */
+export type GatewayAdapterEndpointRefresh = Readonly<{
+    outcome: "compatible";
+    previous: PrivateEndpointIdentity;
+    current: PrivateEndpointIdentity;
+    attestation: CompatibilityAttestation;
+    routes: readonly Readonly<{
+        routeHandle: string;
+        state: GatewayAdapterRouteState;
+    }>[];
+}> | Readonly<{
+    outcome: "incompatible";
+    previous: PrivateEndpointIdentity;
+    candidate: PrivateEndpointIdentity;
+    attestation: CompatibilityAttestation;
+}>;
 export type GatewayAdapterCallbacks = {
     onDelivery: (event: GatewayAdapterDelivery) => void;
     onRouteState: (event: {
@@ -61,6 +80,8 @@ export type GatewayAdapterCallbacks = {
     onProtocolNotice?: (event: {
         code: string;
     }) => void;
+    /** Provider-wide, compatibility-gated Codex endpoint replacement. */
+    onEndpointRefresh?: (event: GatewayAdapterEndpointRefresh) => void;
 };
 export type GatewayAdapterStart = {
     health: "healthy" | "degraded";
@@ -81,6 +102,23 @@ export type GatewayAdapterDispatchResult = {
     safeErrorCode?: string;
     replyText?: string;
 };
+/**
+ * One transient, service-authorized provider dispatch. Provenance fields are
+ * carried beside the raw body so the provider can frame it exactly once at
+ * its semantic write boundary. They must not be projected or persisted.
+ */
+export type GatewayAdapterDispatchInput = {
+    sourceAlias: string;
+    targetAlias: string;
+    conversationId: string;
+    binding: PrivateRouteBinding;
+    authorization: "selected_route" | "native_reply";
+    messageId: string;
+    text: string;
+    expectsReply: boolean;
+    deadlineAt: string;
+    steer?: true;
+};
 /**
  * Narrow provider boundary. Production adapters wrap ClaudePeerAdapter or one
  * exact CodexAppServerConnector; tests use in-memory fakes. Implementations
@@ -107,6 +145,7 @@ export interface GatewayProviderAdapter {
     }): Promise<{
         routeHandle: string;
         state: GatewayAdapterRouteState;
+        endpointRefresh?: GatewayAdapterEndpointRefresh;
     }>;
     /** Claude-only workspace guard. Codex registration has no workspace gate. */
     assertWorkspaceDisjoint?(routeHandle: string, stateRoot: string): Promise<void>;
@@ -189,16 +228,7 @@ export interface GatewayProviderAdapter {
         pendingCallbacks: number;
         clean: boolean;
     }>;
-    dispatch(input: {
-        sourceAlias: string;
-        binding: PrivateRouteBinding;
-        authorization: "selected_route" | "native_reply";
-        messageId: string;
-        text: string;
-        expectsReply: boolean;
-        deadlineAt: string;
-        steer?: true;
-    }): Promise<GatewayAdapterDispatchResult>;
+    dispatch(input: GatewayAdapterDispatchInput): Promise<GatewayAdapterDispatchResult>;
     releaseRoute?(routeHandle: string): Promise<void>;
     close(): Promise<void>;
 }
@@ -239,16 +269,42 @@ export declare class GatewayService {
     private readonly activeDispatchByTarget;
     private readonly scheduledDispatchTargets;
     private readonly dispatchRunnerTargets;
+    /** Claude sends that proved no write wait for exact provider-idle evidence. */
+    private readonly claudePrewriteIdleWaitTargets;
     private readonly heldRedispatchTimers;
     private readonly pendingClaudeReplies;
     private readonly deliveryTrackers;
     private readonly deliveryTokens;
     private readonly runtimeAlerts;
     private readonly activityEvents;
+    private activeCodexIncompatibility;
     private activitySequence;
     private readonly detachedReceiptWrites;
     private readonly nativeIngressByConversation;
     private readonly callbackQueue;
+    /**
+     * Endpoint replacement is authority-bearing lifecycle evidence, not an
+     * ordinary refreshable observation. Keep one coalesced slot outside the
+     * bounded callback queue so delivery evidence can never displace it (or be
+     * displaced by it).
+     */
+    private endpointRefreshCallback;
+    private activeEndpointRefreshCallback;
+    private endpointRefreshRetryRequested;
+    private endpointRefreshConflictBoundary;
+    private activeEndpointRefreshCallbackKey;
+    private endpointRefreshCallbackPoisoned;
+    private endpointRefreshConflictPending;
+    /** Last successfully activated transition per allowed Codex host. */
+    private readonly activatedEndpointRefreshes;
+    /** Durable reanchors awaiting their exact native-listener activation. */
+    private readonly durablyAppliedEndpointRefreshes;
+    /** Selector transitions staged until their exact registration owns a helper. */
+    private readonly pendingSelectorEndpointActivations;
+    /** Last incompatible transition already projected per allowed Codex host. */
+    private readonly handledIncompatibleEndpointRefreshes;
+    /** Process-local dedupe for automatic public activity rows across retries. */
+    private readonly endpointRefreshActivityKeys;
     private callbackWorker;
     private callbackScheduled;
     private readonly callbackCapacity;
@@ -274,6 +330,12 @@ export declare class GatewayService {
     /** Route-scoped fences; unrelated Codex registrations remain dispatchable. */
     private readonly codexSuccessionDispatchFrozen;
     private readonly codexSuccessionPoisoned;
+    /**
+     * Exact stale authority whose process-owned native advertisement was already
+     * removed, but whose durable orphan deletion did not commit. Keep dispatch
+     * frozen and permit only the same exact cleanup transaction to retry.
+     */
+    private readonly codexOrphanCleanupPending;
     private codexSuccessionState;
     private pendingCodexSuccessionRecovery;
     /**
@@ -297,8 +359,22 @@ export declare class GatewayService {
     private fingerprintSnapshot;
     private callbacksFor;
     private enqueueCallback;
+    private enqueueEndpointRefreshCallback;
+    private poisonEndpointRefreshCallbacks;
+    private hasPendingCallbackWork;
     private enqueueCallbackWorkerOnly;
     private drainCallbackQueueLocked;
+    /**
+     * A selector can synchronously admit callbacks while its promise is still
+     * running under the service mutex. Drain exactly the ordinary work that was
+     * retained before the selector returned before applying a returned endpoint
+     * transition. Delivery evidence wins within that fixed snapshot; callbacks
+     * admitted while it is reduced remain queued for the ordinary worker, and
+     * the dedicated endpoint-transition slot is never consumed recursively.
+     */
+    private drainSelectorCallbackSnapshotLocked;
+    private failClosedEndpointRefreshConflict;
+    private requireEndpointRefreshUnconflicted;
     private isTerminalAdapterDelivery;
     /**
      * Delivery evidence observed strictly before the deadline must reach the
@@ -318,6 +394,13 @@ export declare class GatewayService {
     private assertClaudeWorkspaceDisjoint;
     private contextTargetBinding;
     private recoverCodexSuccessionAfterRestartLocked;
+    /**
+     * Rebuild process-owned route and listener authority for retained Codex
+     * registrations during staged startup. The provider's selectRoute performs
+     * the exact loaded/list + history-free resume proof; durable state advances
+     * only after the new native advertisement and status are live.
+     */
+    private reactivateRetainedCodexRoutesAfterRestartLocked;
     private completePendingCodexSuccessionRecoveryLocked;
     private assertPendingCodexSuccessionRecoveryMatch;
     private requireCurrentNativeCodexGeneration;
@@ -341,10 +424,16 @@ export declare class GatewayService {
     private codexSuccessionPoisonBarrierCleanLocked;
     private codexSuccessionBarrierCleanLocked;
     private rescheduleIdleRoutesLocked;
+    private codexSuccessionIsStable;
+    private requireUnchangedStaleCodexOrphan;
+    private nativeCodexOrphanBarrierClean;
+    private endpointCallbacksQuiet;
     private registerCodex;
     private lockCodexRegistration;
     private rollbackCodexRegistration;
     private unregisterCodex;
+    private finalizeStaleCodexOrphanRemovalLocked;
+    private removeStaleCodexRegistration;
     private discoveryPublicFingerprint;
     private refreshClaudeDiscovery;
     private renameClaudeRoute;
@@ -426,6 +515,7 @@ export declare class GatewayService {
     private enqueueObservedClaudeReplyAfterRouteTeardownLocked;
     private pruneTransient;
     private awaitDispatchWithNativeHeldLocked;
+    private restoreQueuedMessageContextLocked;
     private dispatchOne;
     private scheduleDispatch;
     private scheduleHeldRedispatch;
@@ -436,6 +526,8 @@ export declare class GatewayService {
     private onClaudeReply;
     private onClaudeMessage;
     private releasePendingClaude;
+    private onCodexEndpointRefresh;
+    private applyCodexEndpointRefresh;
     private onRouteState;
     private setNativeCodexStatus;
     private rejectDetachedNativeReceipt;