agent-embassy 1.0.0

package/dist/src/gateway/providers.js

@@ -0,0 +1,2451 @@
+import { createHash, randomBytes } from "node:crypto";
+import path from "node:path";
+import { BridgeError } from "../errors.js";
+import { CLAUDE_PEER_COMPATIBILITY, ClaudePeerAdapter, } from "./claude-peer.js";
+import { startClaudeCompatibilityScratch, } from "./claude-compatibility-scratch.js";
+import { compatibilityProbeNames, sharesCompatibilityMajor, } from "./compatibility.js";
+import { CODEX_APP_SERVER_WRITABLE_VERSIONS, CodexAppServerConnector, CodexConnectorError, } from "./codex-app-server.js";
+import { LocalCodexTransportError } from "./codex-local-transport.js";
+import { ClaudeNativeHelperSupervisor, } from "./claude-helper-supervisor.js";
+import { isDashboardLocale } from "./locale.js";
+const LOCAL_HOST = "this-mac";
+const NATIVE_CLAUDE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+const PUBLIC_ALIAS = /^[a-z][a-z0-9_-]{0,31}@[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
+const OPAQUE_ROUTE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+const MAX_CLAUDE_PENDING = 1_024;
+const DEFAULT_CLAUDE_DISCOVERY_POLL_MS = 1_000;
+const CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS = [25, 100, 250];
+const MAX_CODEX_ROUTES = 128;
+const MAX_CODEX_CALLBACKS = 512;
+const MAX_TRANSIENT_REPLY_BYTES = 64 * 1024;
+const DEFAULT_CODEX_CLEANUP_TIMEOUT_MS = 5_000;
+const DEFAULT_CODEX_CLEANUP_POLL_MS = 25;
+const DEFAULT_CODEX_RECOVERY_INITIAL_MS = 250;
+const DEFAULT_CODEX_RECOVERY_MAX_MS = 5_000;
+const COMPATIBILITY_PROBE_THREAD_ID = "00000000-0000-7000-8000-000000000000";
+const COMPATIBILITY_TURN_TIMEOUT_MS = 60_000;
+const CLAUDE_CERTIFICATION_TIMEOUT_MS = 10_000;
+const CLAUDE_CERTIFICATION_DISCOVERY_POLL_MS = 100;
+function passedProbe(name) {
+    return { name, outcome: "pass" };
+}
+function failedProbe(name, safeErrorCode) {
+    return { name, outcome: "fail", safeErrorCode };
+}
+function exactLocalHost(hostId) {
+    if ((hostId ?? LOCAL_HOST) !== LOCAL_HOST) {
+        throw new BridgeError("GATEWAY_REMOTE_PROVIDER_DISABLED", "This provider is restricted to the exact local host boundary.");
+    }
+    return LOCAL_HOST;
+}
+function positiveBounded(value, fallback, maximum) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) ||
+        resolved <= 0 ||
+        resolved > maximum) {
+        throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "A provider capacity is outside its reviewed bound.");
+    }
+    return resolved;
+}
+function strictDeadline(value, now) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed) ||
+        new Date(parsed).toISOString() !== value ||
+        parsed <= now) {
+        return undefined;
+    }
+    return parsed;
+}
+function sameEndpoint(binding, identity) {
+    return (binding.provider === identity.provider &&
+        binding.hostId === identity.hostId &&
+        binding.endpointGeneration === identity.endpointGeneration);
+}
+function callbackEndpoint(identity, routeHandle) {
+    return { ...identity, routeHandle };
+}
+function invokeCallback(operation) {
+    try {
+        operation();
+    }
+    catch {
+        // Provider observation consumers cannot change a transport outcome.
+    }
+}
+function validateAttestedClaudeRuntime(runtime) {
+    if (!sharesCompatibilityMajor(runtime.claudeCodeVersion, CLAUDE_PEER_COMPATIBILITY.claudeCodeVersion) ||
+        [
+            runtime.claudeExecutable,
+            runtime.sessionsDir,
+            runtime.socketDir,
+        ].some((value) => !path.isAbsolute(value) ||
+            path.normalize(value) !== value ||
+            value.includes("\0"))) {
+        throw new BridgeError("CLAUDE_RUNTIME_ATTESTATION_INVALID", "The local Claude provider requires exact pinned runtime evidence.");
+    }
+}
+function claudeEndpointGeneration(runtime) {
+    return `claude_${createHash("sha256")
+        .update(runtime.claudeCodeVersion)
+        .update("\0")
+        .update(runtime.claudeExecutable)
+        .update("\0")
+        .update(runtime.sessionsDir)
+        .update("\0")
+        .update(runtime.socketDir)
+        .digest("hex")
+        .slice(0, 32)}`;
+}
+function claudeRouteState(peer) {
+    return peer.status === "idle" ? "idle" : "busy";
+}
+export class LocalClaudeGatewayProvider {
+    identity;
+    protocol = "claude-peer";
+    protocolVersion = `${CLAUDE_PEER_COMPATIBILITY.peerProtocol}`;
+    peer;
+    runtimeVersion;
+    maxPending;
+    discoveryPollMs;
+    now;
+    selectedStateRoots = new Map();
+    nativeHelpers;
+    compatibilityScratchFactory;
+    discovered = new Map();
+    selected = new Map();
+    /** Exact live same-UID sessions observed through native inbound frames. */
+    nativeInbound = new Map();
+    /** Exact listener owner for every receipt capability handed to the service. */
+    nativeInboundReceiptOwners = new Map();
+    selectedObservations = new Map();
+    /** Invalidates any discovery that overlaps a dispatch on this route. */
+    selectedDispatchEpoch = new Map();
+    /**
+     * A dispatch invalidates the pre-dispatch registry observation. The first
+     * subsequent successful discovery must therefore be published even when
+     * the native peer completed between polls and is idle again.
+     */
+    selectedObservationDirty = new Set();
+    pendingByProviderId = new Map();
+    providerIdByGatewayId = new Map();
+    /** Includes the pre-write reservation through exact terminal settlement. */
+    pendingTargetByGatewayId = new Map();
+    /** Provider-owned terminal rejections that never enter the service queue. */
+    rejectedNativeInbound = new Map();
+    discoveryInFlight;
+    monitorTimer;
+    /** Invocation-ordered registry mutations; the tail itself never rejects. */
+    nativeCodexRegistrationTail = Promise.resolve();
+    callbacks;
+    activeNativeCodexListener;
+    preparedNativeCodexListener;
+    nativeCodexPreparationInFlight;
+    retiredNativeCodexListener;
+    /** Fences discovery callbacks and monitor restarts across listener rotation. */
+    nativeCodexSuccessionFreeze;
+    compatibilityCertificationInFlight = false;
+    initialized = false;
+    closed = false;
+    constructor(options) {
+        validateAttestedClaudeRuntime(options.runtime);
+        if (options.locale !== undefined && !isDashboardLocale(options.locale)) {
+            throw new BridgeError("DASHBOARD_LOCALE_UNSUPPORTED", "The Claude provider notice locale is unsupported.");
+        }
+        const hostId = exactLocalHost(options.hostId);
+        this.identity = {
+            provider: "claude",
+            hostId,
+            endpointGeneration: claudeEndpointGeneration(options.runtime),
+        };
+        this.runtimeVersion = options.runtime.claudeCodeVersion;
+        this.maxPending = positiveBounded(options.maxPendingMessages, MAX_CLAUDE_PENDING, 4_096);
+        this.discoveryPollMs = positiveBounded(options.discoveryPollMs, DEFAULT_CLAUDE_DISCOVERY_POLL_MS, 30_000);
+        this.now = options.now ?? Date.now;
+        this.peer = (options.peerFactory ??
+            ((runtime, locale, deliveryNotices) => new ClaudePeerAdapter({
+                sessionsDir: runtime.sessionsDir,
+                socketDir: runtime.socketDir,
+                attestedClaudeCodeVersion: runtime.claudeCodeVersion,
+                locale,
+                deliveryNotices,
+            })))(options.runtime, options.locale ?? "en", options.deliveryNotices ?? "merged");
+        this.compatibilityScratchFactory =
+            options.compatibilityScratchFactory ??
+                (() => startClaudeCompatibilityScratch(options.runtime));
+        this.nativeHelpers =
+            options.nativeHelpers === undefined
+                ? undefined
+                : new ClaudeNativeHelperSupervisor({
+                    identity: this.identity,
+                    runtime: options.runtime,
+                    locale: options.locale ?? "en",
+                    deliveryNotices: options.deliveryNotices ?? "merged",
+                    maxPendingMessages: this.maxPending,
+                    maxHelpers: positiveBounded(options.nativeHelpers.maxHelpers, 256, 128),
+                    callbacks: () => this.callbacks,
+                    ...(options.nativeHelpers.factory === undefined
+                        ? {}
+                        : { factory: options.nativeHelpers.factory }),
+                });
+    }
+    compatibilitySurface() {
+        return { surface: "claude", version: this.runtimeVersion };
+    }
+    async runCompatibilityProbes() {
+        const [launcher, version, registry, socket, protocol] = compatibilityProbeNames.claude;
+        try {
+            const discovery = await this.peer.discover();
+            // Runtime discovery is deliberately per-record fail-safe: malformed,
+            // dead, unsafe, or non-routable records are omitted rather than allowed
+            // to poison the whole registry. Startup compatibility must use the same
+            // boundary. Fail only when the bounded scan itself is incomplete, or a
+            // nonempty registry contains no record with a parseable closed schema.
+            const registryUnusable = discovery.truncated ||
+                (discovery.entriesScanned > 0 && discovery.parseableRecords === 0);
+            return [
+                passedProbe(launcher),
+                passedProbe(version),
+                registryUnusable
+                    ? failedProbe(registry, "CLAUDE_REGISTRY_SCHEMA_REJECTED")
+                    : passedProbe(registry),
+                passedProbe(socket),
+                passedProbe(protocol),
+            ];
+        }
+        catch {
+            return [
+                passedProbe(launcher),
+                passedProbe(version),
+                failedProbe(registry, "CLAUDE_REGISTRY_UNAVAILABLE"),
+                failedProbe(socket, "CLAUDE_SOCKET_VALIDATION_UNAVAILABLE"),
+                passedProbe(protocol),
+            ];
+        }
+    }
+    async runCompatibilityCertification(input) {
+        void input.routeHandle;
+        void input.withTurn;
+        const depth = "wire";
+        let scratch;
+        let listener;
+        if (this.compatibilityCertificationInFlight) {
+            return {
+                depth,
+                outcome: "fail",
+                certifiedAt: new Date(this.now()).toISOString(),
+                safeErrorCode: "CLAUDE_CERTIFICATION_BUSY",
+            };
+        }
+        this.compatibilityCertificationInFlight = true;
+        try {
+            this.assertReady();
+            scratch = await this.compatibilityScratchFactory();
+            const deadlineAt = this.now() + CLAUDE_CERTIFICATION_TIMEOUT_MS;
+            let targetId;
+            while (this.now() < deadlineAt) {
+                scratch.assertRunning();
+                const discovery = await this.peer.discover();
+                if (discovery.truncated) {
+                    throw new BridgeError("CLAUDE_CERTIFICATION_DISCOVERY_INCOMPLETE", "The scratch session could not be proven from a complete registry scan.", true);
+                }
+                const matches = discovery.peers.filter((peer) => peer.alias === scratch?.name && peer.targetId === scratch?.sessionId);
+                if (matches.length > 1) {
+                    throw new BridgeError("CLAUDE_CERTIFICATION_TARGET_COLLISION", "The scratch session identity was not unique.");
+                }
+                if (matches.length === 1) {
+                    targetId = matches[0]?.targetId;
+                    break;
+                }
+                await new Promise((resolve) => {
+                    const timer = setTimeout(resolve, CLAUDE_CERTIFICATION_DISCOVERY_POLL_MS);
+                    timer.unref();
+                });
+            }
+            if (targetId === undefined) {
+                throw new BridgeError("CLAUDE_CERTIFICATION_TARGET_UNAVAILABLE", "The bounded scratch session did not publish a discoverable peer record.", true);
+            }
+            await this.peer.assertTargetWorkspaceDisjoint(targetId, input.controllerStateRoot);
+            listener = await this.peer.listen({
+                onMessage: () => undefined,
+                onReceipt: () => undefined,
+            });
+            const sent = await this.peer.send(targetId, "[embassy compat-certify] ignore", {
+                listener,
+                receiptDeadlineAt: deadlineAt,
+            });
+            if (sent.transportStatus !== "transport_written" ||
+                sent.receiptStatus !== "pending") {
+                throw new BridgeError("CLAUDE_CERTIFICATION_WRITE_UNCONFIRMED", "The scratch diagnostic frame was not accepted for receipt tracking.", true);
+            }
+            // A direct `crossSessionInbound: accept` write emits no native
+            // peer_message_status frame. That status family describes the optional
+            // approval lifecycle, not universal delivery acknowledgement. For this
+            // wire-depth certification, the strongest portable evidence is the
+            // confirmed write to the exact, uniquely discovered scratch session.
+            return {
+                depth,
+                outcome: "pass",
+                certifiedAt: new Date(this.now()).toISOString(),
+            };
+        }
+        catch (error) {
+            const observedCode = error instanceof BridgeError && /^[A-Z][A-Z0-9_]{0,63}$/.test(error.code)
+                ? error.code
+                : "CLAUDE_CERTIFICATION_FAILED";
+            return {
+                depth,
+                outcome: "fail",
+                certifiedAt: new Date(this.now()).toISOString(),
+                safeErrorCode: observedCode,
+            };
+        }
+        finally {
+            await listener?.close().catch(() => undefined);
+            await scratch?.close().catch(() => undefined);
+            await this.peer.discover().catch(() => undefined);
+            this.compatibilityCertificationInFlight = false;
+        }
+    }
+    async initialize(callbacks) {
+        if (this.closed) {
+            throw new BridgeError("CLAUDE_PROVIDER_CLOSED", "The local Claude provider is closed.");
+        }
+        if (this.initialized) {
+            throw new BridgeError("CLAUDE_PROVIDER_ALREADY_INITIALIZED", "The local Claude provider can be initialized only once.");
+        }
+        this.callbacks = callbacks;
+        if (this.nativeHelpers !== undefined) {
+            this.initialized = true;
+            return { health: "healthy", compatibility: "compatible" };
+        }
+        try {
+            let listenerGeneration;
+            const listener = await this.peer.listen({
+                onMessage: async (message) => {
+                    if (listenerGeneration !== undefined) {
+                        await this.onListenerMessage(listenerGeneration, message);
+                    }
+                },
+                onReceipt: (event) => {
+                    if (listenerGeneration !== undefined) {
+                        this.onReceipt(listenerGeneration, event);
+                    }
+                },
+                onProtocolNotice: (notice) => {
+                    this.callbacks?.onProtocolNotice?.({ code: notice.code });
+                },
+            });
+            listenerGeneration = {
+                generation: listener.generation,
+                listener,
+                lifecycle: "active",
+                registrationProvisional: false,
+                provisionalIngressForwarded: false,
+                inboundQuiesced: false,
+                publicationAttempted: false,
+                publicationUncertain: false,
+            };
+            if (this.closed) {
+                await listener.close();
+                throw new BridgeError("CLAUDE_PROVIDER_CLOSED", "The local Claude provider closed during initialization.");
+            }
+            this.activeNativeCodexListener = listenerGeneration;
+            this.initialized = true;
+            return { health: "healthy", compatibility: "compatible" };
+        }
+        catch {
+            this.callbacks = undefined;
+            throw new BridgeError("CLAUDE_CALLBACK_UNAVAILABLE", "The private Claude callback listener could not be established.");
+        }
+    }
+    async discoverClaudePeers() {
+        this.assertReady();
+        return await this.refreshClaudeDiscovery();
+    }
+    async assertWorkspaceDisjoint(routeHandle, stateRoot) {
+        this.assertReady();
+        await this.peer.assertTargetWorkspaceDisjoint(routeHandle, stateRoot);
+        this.selectedStateRoots.set(routeHandle, stateRoot);
+    }
+    async selectRoute(input) {
+        this.assertReady();
+        const candidate = this.discovered.get(input.routeHandle);
+        if (candidate === undefined || candidate.alias !== input.alias) {
+            throw new BridgeError("CLAUDE_ROUTE_MISMATCH", "The selected Claude alias no longer matches that exact peer generation.");
+        }
+        this.selected.set(input.routeHandle, input.alias);
+        this.selectedDispatchEpoch.set(input.routeHandle, this.selectedDispatchEpoch.get(input.routeHandle) ?? 0);
+        this.selectedObservationDirty.delete(input.routeHandle);
+        this.selectedObservations.set(input.routeHandle, `${candidate.state}:`);
+        this.scheduleClaudeMonitor();
+        return { routeHandle: input.routeHandle, state: candidate.state };
+    }
+    async resolveReplyAddress(address) {
+        this.assertReady();
+        const resolved = await this.peer.resolveReplyAddress(address);
+        const selectedAlias = this.selected.get(resolved.targetId);
+        if (selectedAlias === undefined ||
+            resolved.kind !== "interactive" ||
+            selectedAlias !== `${resolved.alias}@${this.identity.hostId}`) {
+            throw new BridgeError("CLAUDE_REPLY_ROUTE_MISMATCH", "The reply capability is not the exact selected Claude generation.");
+        }
+        return { routeHandle: resolved.targetId };
+    }
+    async advertiseNativeCodexPeer(input) {
+        if (this.nativeHelpers !== undefined) {
+            this.assertReady();
+            await this.nativeHelpers.advertise(input);
+            return;
+        }
+        const registration = this.nativeCodexRegistration(input);
+        await this.serializeNativeCodexRegistration(async () => {
+            this.assertReady();
+            const active = this.requireActiveNativeCodexListener();
+            if (active.registration !== undefined &&
+                active.registration.alias !== registration.alias) {
+                throw new BridgeError("CODEX_PEER_ALREADY_ADVERTISED", "This listener generation already advertises another Codex peer.");
+            }
+            const installedProvisional = active.registration === undefined;
+            if (installedProvisional) {
+                active.registration = registration;
+                active.registrationProvisional = true;
+                active.provisionalIngressForwarded = false;
+            }
+            try {
+                await active.listener.advertise(registration.name, registration.cwd);
+                // Reassert exact ownership after publication. A preceding serialized
+                // attempt may have removed its own clean provisional registration.
+                active.registration = registration;
+                active.registrationProvisional = false;
+                active.provisionalIngressForwarded = false;
+            }
+            catch (error) {
+                if (error instanceof BridgeError &&
+                    error.recoverable &&
+                    installedProvisional &&
+                    active.registration === registration &&
+                    !active.provisionalIngressForwarded) {
+                    delete active.registration;
+                    active.registrationProvisional = false;
+                }
+                throw error;
+            }
+        });
+    }
+    currentNativeCodexPeerGeneration(alias) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            return this.nativeHelpers.currentGeneration(alias);
+        }
+        const active = this.requireActiveNativeCodexListener();
+        if (active.registration?.alias !== alias) {
+            throw new BridgeError("CODEX_PEER_GENERATION_MISMATCH", "The requested Codex alias is not the active listener generation.");
+        }
+        return active.generation;
+    }
+    /** Child-host initialization seam before its immutable advertisement exists. */
+    currentUnadvertisedNativeCodexPeerGeneration() {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            throw new BridgeError("CLAUDE_NATIVE_HELPER_NESTING_FORBIDDEN", "A supervised provider cannot itself act as a native helper host.");
+        }
+        const active = this.requireActiveNativeCodexListener();
+        if (active.registration !== undefined) {
+            throw new BridgeError("CODEX_PEER_ALREADY_ADVERTISED", "The native listener already owns an advertised Codex identity.");
+        }
+        return active.generation;
+    }
+    async prepareNativeCodexPeerGeneration(input) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            if (input.currentGeneration === undefined) {
+                throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "A supervised succession must name its exact current generation.");
+            }
+            await this.nativeHelpers.prepareGeneration({
+                alias: input.alias,
+                cwd: input.cwd,
+                generation: input.generation,
+                currentGeneration: input.currentGeneration,
+            });
+            return;
+        }
+        const active = this.requireActiveNativeCodexListener();
+        if (input.currentGeneration !== undefined &&
+            input.currentGeneration !== active.generation) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "The prepared successor does not name the exact current generation.");
+        }
+        if (active.registration === undefined) {
+            throw new BridgeError("CODEX_PEER_NOT_ADVERTISED", "A successor requires one active advertised Codex generation.");
+        }
+        if (input.generation === active.generation ||
+            this.nativeCodexPreparationInFlight !== undefined ||
+            this.preparedNativeCodexListener !== undefined ||
+            this.retiredNativeCodexListener !== undefined) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_CAPACITY", "Only one distinct prepared or retired Codex generation is allowed.");
+        }
+        const registration = this.nativeCodexRegistration(input);
+        this.nativeCodexPreparationInFlight = input.generation;
+        let prepared;
+        try {
+            const listener = await this.peer.listenPrepared(input.generation, {
+                onMessage: async (message) => {
+                    if (prepared !== undefined) {
+                        await this.onListenerMessage(prepared, message);
+                    }
+                },
+                onReceipt: (event) => {
+                    if (prepared !== undefined)
+                        this.onReceipt(prepared, event);
+                },
+            });
+            prepared = {
+                generation: listener.generation,
+                listener,
+                lifecycle: "prepared",
+                registration,
+                registrationProvisional: false,
+                provisionalIngressForwarded: false,
+                inboundQuiesced: true,
+                publicationAttempted: false,
+                publicationUncertain: false,
+            };
+            if (listener.generation !== input.generation || this.closed) {
+                await listener.close().catch(() => undefined);
+                throw new BridgeError("CLAUDE_CALLBACK_UNAVAILABLE", "The prepared Claude callback generation could not be established.");
+            }
+            this.preparedNativeCodexListener = prepared;
+        }
+        finally {
+            if (this.nativeCodexPreparationInFlight === input.generation) {
+                this.nativeCodexPreparationInFlight = undefined;
+            }
+        }
+    }
+    async quiesceNativeCodexPeerGeneration(generation) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.quiesceGeneration(generation);
+            return;
+        }
+        const active = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, generation, "active");
+        if (this.nativeCodexSuccessionFreeze !== undefined &&
+            this.nativeCodexSuccessionFreeze !== generation) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "Another native Codex generation already owns the succession freeze.");
+        }
+        this.nativeCodexSuccessionFreeze = generation;
+        if (this.monitorTimer !== undefined) {
+            clearTimeout(this.monitorTimer);
+            this.monitorTimer = undefined;
+        }
+        try {
+            await active.listener.quiesceInbound();
+            active.inboundQuiesced = true;
+        }
+        catch (error) {
+            if (this.nativeCodexSuccessionFreeze === generation) {
+                this.nativeCodexSuccessionFreeze = undefined;
+            }
+            this.scheduleClaudeMonitor();
+            throw error;
+        }
+    }
+    async observeNativeCodexSuccessionBarrier(generation) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            return await this.nativeHelpers.observeBarrier(generation);
+        }
+        const active = this.activeNativeCodexListener;
+        const activeGenerationMatched = active?.generation === generation;
+        const pendingOutboundReceipts = this.providerIdByGatewayId.size;
+        let pendingInboundReceipts = 0;
+        for (const owner of this.nativeInboundReceiptOwners.values()) {
+            if (owner.generation === generation)
+                pendingInboundReceipts += 1;
+        }
+        let rejectedInboundSettlements = 0;
+        for (const rejection of this.rejectedNativeInbound.values()) {
+            if (rejection.listenerGeneration === generation) {
+                rejectedInboundSettlements += 1;
+            }
+        }
+        const ingressQuiesced = activeGenerationMatched && active.inboundQuiesced;
+        const monitorFrozen = activeGenerationMatched &&
+            this.nativeCodexSuccessionFreeze === generation;
+        const discoveryInFlight = this.discoveryInFlight !== undefined;
+        return {
+            generation,
+            activeGenerationMatched,
+            ingressQuiesced,
+            monitorFrozen,
+            discoveryInFlight,
+            pendingOutboundReceipts,
+            pendingInboundReceipts,
+            rejectedInboundSettlements,
+            clean: activeGenerationMatched &&
+                ingressQuiesced &&
+                monitorFrozen &&
+                !discoveryInFlight &&
+                pendingOutboundReceipts === 0 &&
+                pendingInboundReceipts === 0 &&
+                rejectedInboundSettlements === 0,
+        };
+    }
+    async publishPreparedNativeCodexPeer(input) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            return await this.nativeHelpers.publishPrepared(input);
+        }
+        const current = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, input.currentGeneration, "active");
+        const prepared = this.requireNativeCodexListenerGeneration(this.preparedNativeCodexListener, input.preparedGeneration, "prepared");
+        if (!current.inboundQuiesced || prepared.registration === undefined) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_QUIET", "The old listener must be quiesced before publication.");
+        }
+        if (!(await this.observeNativeCodexSuccessionBarrier(current.generation)).clean) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_QUIET", "Native Codex succession requires a clean provider-wide barrier.", true);
+        }
+        if (prepared.publicationOutcome === "published" ||
+            prepared.publicationOutcome === "not_published") {
+            return prepared.publicationOutcome;
+        }
+        if (prepared.publicationOperation !== undefined) {
+            return await prepared.publicationOperation;
+        }
+        prepared.publicationAttempted = true;
+        const operation = prepared.listener.publishReplacing(current.listener, prepared.registration.name, prepared.registration.cwd);
+        prepared.publicationOperation = operation;
+        try {
+            const outcome = await operation;
+            if (outcome === "published") {
+                prepared.publicationOutcome = "published";
+                return "published";
+            }
+            if (outcome === "unknown") {
+                prepared.publicationUncertain = true;
+                prepared.publicationOutcome = "unknown";
+                return "unknown";
+            }
+            if (prepared.publicationUncertain) {
+                prepared.publicationOutcome = "unknown";
+                return "unknown";
+            }
+            prepared.publicationOutcome = "not_published";
+            return "not_published";
+        }
+        catch (error) {
+            prepared.publicationUncertain = true;
+            prepared.publicationOutcome = "unknown";
+            throw error;
+        }
+        finally {
+            if (prepared.publicationOperation === operation) {
+                delete prepared.publicationOperation;
+            }
+        }
+    }
+    async activatePreparedNativeCodexPeerGeneration(generation) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.activatePrepared(generation);
+            return;
+        }
+        const prepared = this.requireNativeCodexListenerGeneration(this.preparedNativeCodexListener, generation, "prepared");
+        if (prepared.publicationOutcome !== "published" ||
+            this.retiredNativeCodexListener !== undefined) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_PUBLISHED", "Only a confirmed published generation can become active.");
+        }
+        const current = this.requireActiveNativeCodexListener();
+        prepared.listener.grantSuccessionActivation();
+        prepared.listener.resumeInbound();
+        prepared.inboundQuiesced = false;
+        current.lifecycle = "retired";
+        prepared.lifecycle = "active";
+        this.retiredNativeCodexListener = current;
+        this.activeNativeCodexListener = prepared;
+        this.preparedNativeCodexListener = undefined;
+        if (this.nativeCodexSuccessionFreeze === current.generation) {
+            this.nativeCodexSuccessionFreeze = undefined;
+        }
+        await this.purgeNativeCodexPeerGenerationReplyCapabilities(current.generation);
+        this.scheduleClaudeMonitor();
+    }
+    async cleanupPreparedNativeCodexPeerGeneration(generation) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.cleanupPrepared(generation);
+            return;
+        }
+        const prepared = this.requireNativeCodexListenerGeneration(this.preparedNativeCodexListener, generation, "prepared");
+        if (prepared.publicationAttempted &&
+            (prepared.publicationUncertain ||
+                prepared.publicationOutcome !== "not_published")) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_ROLLBACK_FORBIDDEN", "A possibly published Codex generation cannot be rolled back.");
+        }
+        await prepared.listener.close();
+        if (this.preparedNativeCodexListener === prepared) {
+            this.preparedNativeCodexListener = undefined;
+        }
+    }
+    async resumeNativeCodexPeerGeneration(generation) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.resumeGeneration(generation);
+            return;
+        }
+        const active = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, generation, "active");
+        if (this.preparedNativeCodexListener !== undefined) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_CLEANUP_REQUIRED", "The prepared listener must be cleaned before resuming the old one.");
+        }
+        active.listener.resumeInbound();
+        active.inboundQuiesced = false;
+        if (this.nativeCodexSuccessionFreeze === generation) {
+            this.nativeCodexSuccessionFreeze = undefined;
+        }
+        this.scheduleClaudeMonitor();
+    }
+    async rollbackPreparedNativeCodexPeerGeneration(input) {
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.rollbackPrepared(input);
+            return;
+        }
+        await this.cleanupPreparedNativeCodexPeerGeneration(input.preparedGeneration);
+        await this.resumeNativeCodexPeerGeneration(input.resumeGeneration);
+    }
+    async retireNativeCodexPeerGeneration(input) {
+        this.assertReady();
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.retireGeneration(input);
+            return;
+        }
+        const active = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, input.protectedActiveGeneration, "active");
+        const retired = this.requireNativeCodexListenerGeneration(this.retiredNativeCodexListener, input.retiredGeneration, "retired");
+        if (active === retired) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "The protected and retired listener generations must be distinct.");
+        }
+        const ownsPendingReceipt = [...this.nativeInboundReceiptOwners.values()].some((owner) => owner === retired);
+        const ownsRejectedSettlement = [
+            ...this.rejectedNativeInbound.values(),
+        ].some((rejection) => rejection.listener === retired.listener);
+        const ownsOutboundReceipt = [...this.pendingByProviderId.values()].some((pending) => pending.listener === retired.listener);
+        if (ownsPendingReceipt || ownsRejectedSettlement || ownsOutboundReceipt) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_QUIET", "A retired listener cannot close while it owns receipt capabilities.", true);
+        }
+        await retired.listener.close();
+        if (this.retiredNativeCodexListener === retired) {
+            this.retiredNativeCodexListener = undefined;
+        }
+    }
+    async purgeNativeCodexPeerGenerationReplyCapabilities(generation) {
+        if (this.nativeHelpers !== undefined) {
+            return await this.nativeHelpers.purgeGenerationReplies(generation);
+        }
+        let purged = 0;
+        for (const [routeHandle, route] of this.nativeInbound) {
+            if (route.listenerGeneration !== generation)
+                continue;
+            this.nativeInbound.delete(routeHandle);
+            purged += 1;
+        }
+        return purged;
+    }
+    async unadvertiseNativeCodexPeer(alias) {
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.unadvertise(alias);
+            return;
+        }
+        await this.serializeNativeCodexRegistration(async () => {
+            const active = this.activeNativeCodexListener;
+            if (active?.registration?.alias !== alias)
+                return;
+            await active.listener.unadvertise(active.registration.name);
+            await this.purgeNativeCodexPeerGenerationReplyCapabilities(active.generation);
+            delete active.registration;
+            active.registrationProvisional = false;
+            active.provisionalIngressForwarded = false;
+        });
+    }
+    async updateNativeCodexPeerStatus(alias, status) {
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.updateStatus(alias, status);
+            return;
+        }
+        const active = this.activeNativeCodexListener;
+        if (active?.registration?.alias !== alias)
+            return;
+        await active.listener.updateAdvertisedStatus(status);
+    }
+    async updateNativeInboundStatus(receiptHandle, status, diagnosticCode) {
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.updateInboundStatus(receiptHandle, status, diagnosticCode);
+            return;
+        }
+        const owner = this.requireNativeInboundReceiptOwner(receiptHandle);
+        try {
+            await owner.listener.acknowledge(receiptHandle, status, diagnosticCode === undefined ? undefined : { code: diagnosticCode });
+            if (status !== "held") {
+                this.nativeInboundReceiptOwners.delete(receiptHandle);
+            }
+        }
+        catch (error) {
+            if (status !== "held" &&
+                (!(error instanceof BridgeError) || !error.recoverable)) {
+                this.nativeInboundReceiptOwners.delete(receiptHandle);
+            }
+            throw error;
+        }
+    }
+    async notifyNativeInboundProgress(receiptHandle, progress) {
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.notifyInboundProgress(receiptHandle, progress);
+            return;
+        }
+        const owner = this.requireNativeInboundReceiptOwner(receiptHandle);
+        await owner.listener.notifyInboundProgress(receiptHandle, progress);
+    }
+    async releaseNativeInboundReceipt(receiptHandle) {
+        if (this.nativeHelpers !== undefined) {
+            return await this.nativeHelpers.releaseInboundReceipt(receiptHandle);
+        }
+        const owner = this.nativeInboundReceiptOwners.get(receiptHandle);
+        if (owner === undefined)
+            return false;
+        this.nativeInboundReceiptOwners.delete(receiptHandle);
+        return owner.listener.releaseInboundReceipt(receiptHandle);
+    }
+    async quiesceNativeInbound() {
+        if (this.closed)
+            return;
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.quiesceAll();
+            return;
+        }
+        const active = this.activeNativeCodexListener;
+        if (active === undefined)
+            return;
+        await active.listener.quiesceInbound();
+        active.inboundQuiesced = true;
+    }
+    async dispatch(input) {
+        if (this.nativeHelpers !== undefined) {
+            if (input.sourceAlias === undefined ||
+                !this.initialized ||
+                this.closed ||
+                !sameEndpoint(input.binding, this.identity)) {
+                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
+            }
+            const selectedAlias = this.selected.get(input.binding.routeHandle);
+            const stateRoot = this.selectedStateRoots.get(input.binding.routeHandle);
+            if (input.authorization === "selected_route" &&
+                (selectedAlias === undefined || stateRoot === undefined)) {
+                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
+            }
+            if (input.authorization === "selected_route") {
+                this.selectedDispatchEpoch.set(input.binding.routeHandle, (this.selectedDispatchEpoch.get(input.binding.routeHandle) ?? 0) + 1);
+                this.selectedObservationDirty.add(input.binding.routeHandle);
+                this.emitClaudeRouteObservation(input.binding.routeHandle, "busy");
+            }
+            try {
+                const sourceAlias = input.sourceAlias;
+                const result = await this.nativeHelpers.dispatch({
+                    ...input,
+                    sourceAlias,
+                    ...(selectedAlias === undefined ? {} : { selectedAlias }),
+                    ...(stateRoot === undefined ? {} : { stateRoot }),
+                });
+                if (input.authorization === "selected_route" &&
+                    result.state === "pending") {
+                    this.selectedObservationDirty.delete(input.binding.routeHandle);
+                    this.emitClaudeRouteObservation(input.binding.routeHandle, "idle", undefined, true);
+                }
+                return result;
+            }
+            catch (error) {
+                if (error instanceof BridgeError && error.recoverable) {
+                    return {
+                        state: "failed",
+                        safeErrorCode: "CLAUDE_NATIVE_HELPER_UNAVAILABLE",
+                    };
+                }
+                return {
+                    state: "ambiguous",
+                    safeErrorCode: "CLAUDE_NATIVE_HELPER_OUTCOME_UNKNOWN",
+                };
+            }
+        }
+        const activeListener = this.activeNativeCodexListener;
+        if (!this.initialized ||
+            this.closed ||
+            activeListener === undefined ||
+            activeListener.inboundQuiesced ||
+            this.nativeCodexSuccessionFreeze !== undefined ||
+            !sameEndpoint(input.binding, this.identity)) {
+            return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
+        }
+        if (input.authorization === "native_reply") {
+            try {
+                await this.refreshClaudeDiscovery();
+            }
+            catch {
+                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
+            }
+            const observedRoute = this.nativeInbound.get(input.binding.routeHandle);
+            const current = this.discovered.get(input.binding.routeHandle);
+            if (observedRoute === undefined ||
+                observedRoute.listenerGeneration !== activeListener.generation ||
+                current?.alias !== observedRoute.alias) {
+                this.nativeInbound.delete(input.binding.routeHandle);
+                return { state: "failed", safeErrorCode: "CLAUDE_NATIVE_REPLY_STALE" };
+            }
+        }
+        else if (this.selected.get(input.binding.routeHandle) === undefined) {
+            return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
+        }
+        if (this.activeNativeCodexListener !== activeListener ||
+            activeListener.inboundQuiesced ||
+            this.nativeCodexSuccessionFreeze !== undefined) {
+            return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
+        }
+        const deadline = strictDeadline(input.deadlineAt, this.now());
+        if (deadline === undefined) {
+            return { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" };
+        }
+        if (this.providerIdByGatewayId.size >= this.maxPending ||
+            this.providerIdByGatewayId.has(input.messageId)) {
+            return { state: "failed", safeErrorCode: "CLAUDE_RECEIPT_CAPACITY" };
+        }
+        this.providerIdByGatewayId.set(input.messageId, "");
+        this.pendingTargetByGatewayId.set(input.messageId, input.binding.routeHandle);
+        if (input.authorization === "selected_route") {
+            this.selectedDispatchEpoch.set(input.binding.routeHandle, (this.selectedDispatchEpoch.get(input.binding.routeHandle) ?? 0) + 1);
+            // Once a selected-route dispatch begins, keep the route conservatively
+            // busy until a later registry refresh observes authoritative state.
+            this.selectedObservationDirty.add(input.binding.routeHandle);
+            this.emitClaudeRouteObservation(input.binding.routeHandle, "busy");
+        }
+        let providerId;
+        let trackingFailed = false;
+        let terminalDuringSend = false;
+        const onTransportStatus = (event) => {
+            if (providerId === undefined) {
+                providerId = event.messageId;
+                trackingFailed = !this.trackClaudeMessage(event.messageId, input.messageId, input.binding.routeHandle, deadline, activeListener);
+            }
+            if (trackingFailed)
+                return;
+            if (providerId !== event.messageId) {
+                terminalDuringSend = true;
+                this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_RECEIPT_ID_MISMATCH");
+                return;
+            }
+            if (event.status === "transport_written") {
+                this.recordClaudeWriteEvidence(event.messageId, "transport_written");
+                this.emitDelivery({
+                    messageId: input.messageId,
+                    state: "transport_written",
+                });
+            }
+            else if (event.status === "write_started" ||
+                event.status === "ambiguous") {
+                const newlyUncertain = this.recordClaudeWriteEvidence(event.messageId, "transport_uncertain");
+                if (newlyUncertain) {
+                    this.emitDelivery({
+                        messageId: input.messageId,
+                        state: "transport_uncertain",
+                        safeErrorCode: "CLAUDE_TRANSPORT_OUTCOME_UNCERTAIN",
+                    });
+                }
+            }
+            else if (event.status === "not_written") {
+                terminalDuringSend = true;
+                this.finishClaudeMessage(event.messageId, "failed", "CLAUDE_TRANSPORT_NOT_WRITTEN");
+            }
+            // A post-write ambiguity remains tracked. The exact receipt or the
+            // listener's bounded timeout is authoritative and may settle it later.
+        };
+        try {
+            const result = await this.peer.send(input.binding.routeHandle, input.text, {
+                listener: activeListener.listener,
+                receiptDeadlineAt: deadline,
+                onTransportStatus,
+            });
+            if (providerId === undefined ||
+                providerId !== result.messageId ||
+                result.receiptStatus !== "pending" ||
+                trackingFailed) {
+                if (trackingFailed) {
+                    this.abandonClaudeTracking(input.messageId, providerId);
+                    this.emitDelivery({
+                        messageId: input.messageId,
+                        state: "ambiguous",
+                        safeErrorCode: "CLAUDE_RECEIPT_TRACKING_FAILED",
+                    });
+                    return { state: "pending" };
+                }
+                if (providerId !== undefined) {
+                    this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_RECEIPT_TRACKING_FAILED");
+                }
+                else {
+                    this.providerIdByGatewayId.delete(input.messageId);
+                    this.pendingTargetByGatewayId.delete(input.messageId);
+                }
+                return { state: "ambiguous", safeErrorCode: "CLAUDE_RECEIPT_TRACKING_FAILED" };
+            }
+            if (input.authorization === "selected_route") {
+                this.selectedObservationDirty.delete(input.binding.routeHandle);
+                this.emitClaudeRouteObservation(input.binding.routeHandle, "idle", undefined, true);
+            }
+            return { state: "pending" };
+        }
+        catch (error) {
+            if (trackingFailed) {
+                this.abandonClaudeTracking(input.messageId, providerId);
+                this.emitDelivery({
+                    messageId: input.messageId,
+                    state: "ambiguous",
+                    safeErrorCode: "CLAUDE_RECEIPT_TRACKING_FAILED",
+                });
+                return { state: "pending" };
+            }
+            if (terminalDuringSend)
+                return { state: "pending" };
+            if (providerId !== undefined) {
+                if (error instanceof BridgeError &&
+                    error.code === "CLAUDE_PEER_WRITE_AMBIGUOUS") {
+                    return { state: "pending" };
+                }
+                this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_DISPATCH_OUTCOME_AMBIGUOUS");
+                return { state: "pending" };
+            }
+            this.providerIdByGatewayId.delete(input.messageId);
+            this.pendingTargetByGatewayId.delete(input.messageId);
+            if (error instanceof BridgeError &&
+                error.code === "CLAUDE_PEER_MESSAGE_EXPIRED") {
+                return { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" };
+            }
+            return { state: "failed", safeErrorCode: "CLAUDE_DISPATCH_REJECTED" };
+        }
+    }
+    async releaseRoute(routeHandle) {
+        this.selected.delete(routeHandle);
+        this.selectedDispatchEpoch.delete(routeHandle);
+        this.selectedObservationDirty.delete(routeHandle);
+        this.selectedObservations.delete(routeHandle);
+        this.discovered.delete(routeHandle);
+        this.selectedStateRoots.delete(routeHandle);
+        if (this.nativeHelpers !== undefined) {
+            await this.nativeHelpers.releaseRoute(routeHandle);
+        }
+        if (this.selected.size === 0 && this.monitorTimer !== undefined) {
+            clearTimeout(this.monitorTimer);
+            this.monitorTimer = undefined;
+        }
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const rejection of this.rejectedNativeInbound.values()) {
+            this.releaseRejectedNativeInbound(rejection);
+        }
+        this.rejectedNativeInbound.clear();
+        try {
+            await this.nativeHelpers?.close();
+            await this.peer.close();
+        }
+        finally {
+            for (const pending of this.pendingByProviderId.values()) {
+                clearTimeout(pending.timer);
+            }
+            this.pendingByProviderId.clear();
+            this.providerIdByGatewayId.clear();
+            this.pendingTargetByGatewayId.clear();
+            this.selected.clear();
+            this.selectedStateRoots.clear();
+            this.nativeInbound.clear();
+            this.nativeInboundReceiptOwners.clear();
+            this.selectedDispatchEpoch.clear();
+            this.selectedObservationDirty.clear();
+            this.selectedObservations.clear();
+            this.discovered.clear();
+            if (this.monitorTimer !== undefined)
+                clearTimeout(this.monitorTimer);
+            this.monitorTimer = undefined;
+            this.activeNativeCodexListener = undefined;
+            this.preparedNativeCodexListener = undefined;
+            this.retiredNativeCodexListener = undefined;
+            this.nativeCodexPreparationInFlight = undefined;
+            this.nativeCodexSuccessionFreeze = undefined;
+            this.callbacks = undefined;
+        }
+    }
+    assertReady() {
+        if (!this.initialized || this.closed) {
+            throw new BridgeError("CLAUDE_PROVIDER_UNAVAILABLE", "The local Claude provider is not available.", true);
+        }
+    }
+    serializeNativeCodexRegistration(operation) {
+        const queued = this.nativeCodexRegistrationTail.then(operation);
+        this.nativeCodexRegistrationTail = queued.then(() => undefined, () => undefined);
+        return queued;
+    }
+    nativeCodexRegistration(input) {
+        const suffix = `@${this.identity.hostId}`;
+        if (!input.alias.endsWith(suffix)) {
+            throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "The native Codex peer alias must target this host.");
+        }
+        const name = input.alias.slice(0, -suffix.length);
+        if (!name.startsWith("codex-") || !NATIVE_CLAUDE_NAME.test(name)) {
+            throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "The native Codex peer alias must start with codex-.");
+        }
+        if (!path.isAbsolute(input.cwd) || input.cwd.includes("\0")) {
+            throw new BridgeError("INVALID_CODEX_PEER_CWD", "A native Codex peer requires an absolute working directory.");
+        }
+        return { alias: input.alias, cwd: input.cwd, name };
+    }
+    requireActiveNativeCodexListener() {
+        this.assertReady();
+        const active = this.activeNativeCodexListener;
+        if (active === undefined || active.lifecycle !== "active") {
+            throw new BridgeError("CLAUDE_CALLBACK_UNAVAILABLE", "The private Claude callback listener is unavailable.", true);
+        }
+        return active;
+    }
+    requireNativeCodexListenerGeneration(listenerGeneration, generation, lifecycle) {
+        if (listenerGeneration === undefined ||
+            listenerGeneration.generation !== generation ||
+            listenerGeneration.listener.generation !== generation ||
+            listenerGeneration.lifecycle !== lifecycle) {
+            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "The requested native Codex listener generation is not the exact lifecycle owner.");
+        }
+        return listenerGeneration;
+    }
+    requireNativeInboundReceiptOwner(receiptHandle) {
+        this.assertReady();
+        const owner = this.nativeInboundReceiptOwners.get(receiptHandle);
+        if (owner === undefined || !this.ownsNativeCodexListener(owner)) {
+            throw new BridgeError("CLAUDE_PEER_RECEIPT_UNKNOWN", "The native Claude peer receipt is unknown or already settled.");
+        }
+        return owner;
+    }
+    ownsNativeCodexListener(listenerGeneration) {
+        return (this.activeNativeCodexListener === listenerGeneration ||
+            this.preparedNativeCodexListener === listenerGeneration ||
+            this.retiredNativeCodexListener === listenerGeneration);
+    }
+    async onListenerMessage(listenerGeneration, message) {
+        const reject = async (diagnosticCode) => {
+            if (message.receiptHandle !== undefined) {
+                await this.rejectNativeInboundReceipt(listenerGeneration, message.receiptHandle, diagnosticCode);
+            }
+        };
+        if (this.closed ||
+            listenerGeneration.listener.closed ||
+            !this.ownsNativeCodexListener(listenerGeneration)) {
+            try {
+                if (message.receiptHandle !== undefined) {
+                    listenerGeneration.listener.releaseInboundReceipt(message.receiptHandle);
+                }
+            }
+            catch {
+                // A detached generation has no safe callback or settlement authority.
+            }
+            return;
+        }
+        if (this.activeNativeCodexListener !== listenerGeneration ||
+            listenerGeneration.lifecycle !== "active" ||
+            listenerGeneration.inboundQuiesced ||
+            this.nativeCodexSuccessionFreeze !== undefined) {
+            await reject("CLAUDE_NATIVE_GENERATION_STALE");
+            return;
+        }
+        const registrationAtIngress = listenerGeneration.registration;
+        if (message.sourceTargetId === undefined ||
+            message.sourceAlias === undefined ||
+            !message.replySupported) {
+            await reject("CLAUDE_SOURCE_ROUTE_INVALID");
+            return;
+        }
+        const sourceTargetId = message.sourceTargetId;
+        let sourceAlias;
+        try {
+            await this.refreshClaudeDiscovery();
+            const current = this.discovered.get(sourceTargetId);
+            const expectedAlias = `${message.sourceAlias}@${this.identity.hostId}`;
+            if (current?.alias === expectedAlias)
+                sourceAlias = expectedAlias;
+        }
+        catch {
+            sourceAlias = undefined;
+        }
+        // Discovery is asynchronous. Recheck exact generation ownership before
+        // giving the body or its receipt capability to a service callback.
+        if (this.activeNativeCodexListener !== listenerGeneration ||
+            listenerGeneration.lifecycle !== "active" ||
+            listenerGeneration.inboundQuiesced ||
+            this.nativeCodexSuccessionFreeze !== undefined ||
+            listenerGeneration.registration !== registrationAtIngress) {
+            await reject("CLAUDE_NATIVE_GENERATION_STALE");
+            return;
+        }
+        if (sourceAlias === undefined) {
+            await reject("CLAUDE_SOURCE_ROUTE_STALE");
+            return;
+        }
+        const callbacks = this.callbacks;
+        const registration = registrationAtIngress;
+        if (registration !== undefined) {
+            if (callbacks?.onClaudeMessage === undefined ||
+                (!this.nativeInbound.has(sourceTargetId) &&
+                    this.nativeInbound.size >= this.maxPending) ||
+                (message.receiptHandle !== undefined &&
+                    !this.nativeInboundReceiptOwners.has(message.receiptHandle) &&
+                    this.nativeInboundReceiptOwners.size >= this.maxPending)) {
+                await reject("CLAUDE_NATIVE_INGRESS_CAPACITY");
+                return;
+            }
+            if (message.receiptHandle !== undefined &&
+                this.nativeInboundReceiptOwners.has(message.receiptHandle)) {
+                await reject("CLAUDE_NATIVE_RECEIPT_COLLISION");
+                return;
+            }
+            this.nativeInbound.set(sourceTargetId, {
+                alias: sourceAlias,
+                listenerGeneration: listenerGeneration.generation,
+            });
+            if (message.receiptHandle !== undefined) {
+                this.nativeInboundReceiptOwners.set(message.receiptHandle, listenerGeneration);
+            }
+            if (listenerGeneration.registrationProvisional) {
+                listenerGeneration.provisionalIngressForwarded = true;
+            }
+            invokeCallback(() => callbacks.onClaudeMessage?.({
+                endpoint: callbackEndpoint(this.identity, sourceTargetId),
+                sourceAlias,
+                targetAlias: registration.alias,
+                text: message.content,
+                ...(message.receiptHandle === undefined
+                    ? {}
+                    : { receiptHandle: message.receiptHandle }),
+            }));
+            return;
+        }
+        if (callbacks !== undefined && this.selected.get(sourceTargetId) === sourceAlias) {
+            invokeCallback(() => callbacks.onClaudeReply({
+                endpoint: callbackEndpoint(this.identity, sourceTargetId),
+                text: message.content,
+            }));
+            return;
+        }
+        await reject("CLAUDE_ROUTE_UNAVAILABLE");
+    }
+    rejectNativeInboundReceipt(listenerGeneration, receiptHandle, diagnosticCode) {
+        const rejectionKey = `${listenerGeneration.generation}\0${receiptHandle}`;
+        const existing = this.rejectedNativeInbound.get(rejectionKey);
+        if (existing !== undefined)
+            return existing.operation;
+        const listener = listenerGeneration.listener;
+        if (this.closed ||
+            listener.closed ||
+            !this.ownsNativeCodexListener(listenerGeneration)) {
+            try {
+                listener.releaseInboundReceipt(receiptHandle);
+            }
+            catch {
+                // A missing/closing listener leaves no safe terminal write path.
+            }
+            return Promise.resolve();
+        }
+        const rejection = {
+            receiptHandle,
+            listener,
+            listenerGeneration: listenerGeneration.generation,
+            released: false,
+            operation: Promise.resolve(),
+        };
+        this.rejectedNativeInbound.set(rejectionKey, rejection);
+        rejection.operation = this.settleRejectedNativeInbound(rejection, diagnosticCode).finally(() => {
+            if (this.rejectedNativeInbound.get(rejectionKey) === rejection) {
+                this.rejectedNativeInbound.delete(rejectionKey);
+            }
+        });
+        return rejection.operation;
+    }
+    async settleRejectedNativeInbound(rejection, diagnosticCode) {
+        for (let attempt = 0; attempt <= CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS.length; attempt += 1) {
+            if (this.closed ||
+                rejection.released ||
+                rejection.listener.closed ||
+                !this.ownsNativeCodexListenerGeneration(rejection.listenerGeneration, rejection.listener)) {
+                this.releaseRejectedNativeInbound(rejection);
+                return;
+            }
+            try {
+                await rejection.listener.acknowledge(rejection.receiptHandle, "expired", { code: diagnosticCode });
+                return;
+            }
+            catch (error) {
+                if (rejection.released)
+                    return;
+                const cleanPrewrite = error instanceof BridgeError && error.recoverable;
+                if (!cleanPrewrite ||
+                    attempt === CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS.length) {
+                    // Ambiguous/nonrecoverable writes are never replayed. Explicit
+                    // release is idempotent even if the listener already consumed the
+                    // terminal capability after a possibly-written attempt.
+                    this.releaseRejectedNativeInbound(rejection);
+                    return;
+                }
+            }
+            await this.waitForRejectedNativeInboundRetry(rejection, CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS[attempt]);
+        }
+    }
+    ownsNativeCodexListenerGeneration(generation, listener) {
+        return [
+            this.activeNativeCodexListener,
+            this.preparedNativeCodexListener,
+            this.retiredNativeCodexListener,
+        ].some((candidate) => candidate?.generation === generation && candidate.listener === listener);
+    }
+    async waitForRejectedNativeInboundRetry(rejection, delayMs) {
+        await new Promise((resolve) => {
+            let settled = false;
+            const finish = () => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                if (rejection.cancelRetry === finish) {
+                    delete rejection.cancelRetry;
+                }
+                resolve();
+            };
+            const timer = setTimeout(finish, delayMs);
+            rejection.cancelRetry = finish;
+            if (this.closed || rejection.released)
+                finish();
+        });
+    }
+    releaseRejectedNativeInbound(rejection) {
+        if (rejection.released)
+            return;
+        rejection.released = true;
+        rejection.cancelRetry?.();
+        try {
+            rejection.listener.releaseInboundReceipt(rejection.receiptHandle);
+        }
+        catch {
+            // The listener owns a bounded process-lifetime capability. Closing must
+            // remain best-effort even if its explicit release path is unavailable.
+        }
+    }
+    trackClaudeMessage(providerId, gatewayMessageId, targetId, deadline, listenerGeneration) {
+        if (this.pendingByProviderId.has(providerId) ||
+            this.providerIdByGatewayId.get(gatewayMessageId) !== "" ||
+            this.pendingByProviderId.size >= this.maxPending) {
+            return false;
+        }
+        const timer = setTimeout(() => {
+            const pending = this.pendingByProviderId.get(providerId);
+            if (pending === undefined)
+                return;
+            pending.listener.untrack(providerId);
+            if (pending.writeEvidence === "transport_written") {
+                this.finishClaudeMessage(providerId, "unconfirmed", "CLAUDE_RECEIPT_UNCONFIRMED");
+            }
+            else if (pending.writeEvidence === "transport_uncertain") {
+                this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_DISPATCH_OUTCOME_AMBIGUOUS");
+            }
+            else {
+                this.finishClaudeMessage(providerId, "expired", "MESSAGE_EXPIRED");
+            }
+        }, Math.max(1, deadline - this.now()));
+        timer.unref();
+        this.pendingByProviderId.set(providerId, {
+            gatewayMessageId,
+            listener: listenerGeneration.listener,
+            listenerGeneration: listenerGeneration.generation,
+            targetId,
+            writeEvidence: "none",
+            timer,
+        });
+        this.providerIdByGatewayId.set(gatewayMessageId, providerId);
+        return true;
+    }
+    abandonClaudeTracking(gatewayMessageId, providerId) {
+        if (providerId !== undefined) {
+            const pending = this.pendingByProviderId.get(providerId);
+            if (pending?.gatewayMessageId === gatewayMessageId) {
+                clearTimeout(pending.timer);
+                this.pendingByProviderId.delete(providerId);
+                pending.listener.untrack(providerId);
+            }
+        }
+        this.providerIdByGatewayId.delete(gatewayMessageId);
+        this.pendingTargetByGatewayId.delete(gatewayMessageId);
+    }
+    onReceipt(listenerGeneration, event) {
+        const pending = this.pendingByProviderId.get(event.messageId);
+        if (pending === undefined ||
+            pending.listenerGeneration !== listenerGeneration.generation ||
+            pending.listener !== listenerGeneration.listener) {
+            return;
+        }
+        if (event.status === "held") {
+            pending.writeEvidence = "transport_written";
+            this.emitDelivery({ messageId: pending.gatewayMessageId, state: "held" });
+            return;
+        }
+        // `released` is Claude's native approval-gate terminal: the frame reached
+        // the recipient queue. It does not claim a model read or task completion.
+        const state = event.status === "released"
+            ? "released"
+            : event.status === "denied"
+                ? "denied"
+                : event.status === "expired"
+                    ? "expired"
+                    : event.status === "unconfirmed"
+                        ? "unconfirmed"
+                        : "ambiguous";
+        this.finishClaudeMessage(event.messageId, state, event.status === "unconfirmed"
+            ? "CLAUDE_RECEIPT_UNCONFIRMED"
+            : undefined);
+    }
+    recordClaudeWriteEvidence(providerId, evidence) {
+        const pending = this.pendingByProviderId.get(providerId);
+        if (pending === undefined)
+            return false;
+        const previous = pending.writeEvidence;
+        if (pending.writeEvidence !== "transport_written" ||
+            evidence === "transport_written") {
+            pending.writeEvidence = evidence;
+        }
+        return pending.writeEvidence !== previous;
+    }
+    finishClaudeMessage(providerId, state, safeErrorCode) {
+        const pending = this.pendingByProviderId.get(providerId);
+        if (pending === undefined)
+            return;
+        clearTimeout(pending.timer);
+        this.pendingByProviderId.delete(providerId);
+        this.providerIdByGatewayId.delete(pending.gatewayMessageId);
+        this.pendingTargetByGatewayId.delete(pending.gatewayMessageId);
+        this.emitDelivery({
+            messageId: pending.gatewayMessageId,
+            state,
+            ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
+        });
+    }
+    emitDelivery(event) {
+        const callbacks = this.callbacks;
+        if (callbacks === undefined || this.closed)
+            return;
+        invokeCallback(() => callbacks.onDelivery(event));
+    }
+    async refreshClaudeDiscovery() {
+        if (this.discoveryInFlight !== undefined) {
+            return await this.discoveryInFlight;
+        }
+        const operation = this.refreshClaudeDiscoveryOnce();
+        this.discoveryInFlight = operation;
+        try {
+            return await operation;
+        }
+        finally {
+            if (this.discoveryInFlight === operation) {
+                this.discoveryInFlight = undefined;
+            }
+        }
+    }
+    async refreshClaudeDiscoveryOnce() {
+        const dispatchEpochAtStart = new Map();
+        for (const routeHandle of this.selected.keys()) {
+            dispatchEpochAtStart.set(routeHandle, this.selectedDispatchEpoch.get(routeHandle) ?? 0);
+        }
+        const pendingAtStart = new Set(this.pendingTargetByGatewayId.values());
+        const discovery = await this.peer.discover();
+        this.discovered.clear();
+        const rows = [];
+        for (const peer of discovery.peers) {
+            if (peer.kind !== "interactive" ||
+                !NATIVE_CLAUDE_NAME.test(peer.alias) ||
+                peer.alias.startsWith("codex-")) {
+                continue;
+            }
+            const alias = `${peer.alias}@${this.identity.hostId}`;
+            if (!PUBLIC_ALIAS.test(alias))
+                continue;
+            const row = {
+                alias,
+                routeHandle: peer.targetId,
+                kind: "interactive",
+                state: claudeRouteState(peer),
+                compatibility: "compatible",
+            };
+            this.discovered.set(peer.targetId, row);
+            rows.push(row);
+        }
+        for (const [routeHandle, route] of this.nativeInbound) {
+            const current = this.discovered.get(routeHandle);
+            if (current !== undefined) {
+                // The stable session UUID owns native reply authority. A rename only
+                // updates its current public coordinate.
+                this.nativeInbound.set(routeHandle, {
+                    alias: current.alias,
+                    listenerGeneration: route.listenerGeneration,
+                });
+            }
+            else if (!discovery.truncated) {
+                this.nativeInbound.delete(routeHandle);
+            }
+        }
+        for (const [routeHandle, selectedAlias] of this.selected) {
+            const row = this.discovered.get(routeHandle);
+            if (row === undefined) {
+                this.emitClaudeRouteObservation(routeHandle, "busy", "CLAUDE_PEER_NOT_OBSERVED", true);
+            }
+            else {
+                if (row.alias !== selectedAlias) {
+                    // A Claude rename changes only the live name index. The native
+                    // session UUID remains the selected logical route.
+                    this.selected.set(routeHandle, row.alias);
+                }
+                if (row.state === "idle" &&
+                    (pendingAtStart.has(routeHandle) ||
+                        this.hasPendingClaudeReceipt(routeHandle) ||
+                        dispatchEpochAtStart.get(routeHandle) !==
+                            (this.selectedDispatchEpoch.get(routeHandle) ?? 0))) {
+                    // Never publish an idle sample from a discovery that overlapped a
+                    // dispatch or its receipt lifetime. The dirty epoch remains set for
+                    // a wholly post-terminal discovery.
+                    continue;
+                }
+                this.emitClaudeRouteObservation(routeHandle, row.state, undefined, true);
+            }
+        }
+        return { peers: rows, complete: !discovery.truncated };
+    }
+    emitClaudeRouteObservation(routeHandle, state, safeErrorCode, authoritative = false) {
+        if (this.nativeCodexSuccessionFreeze !== undefined)
+            return;
+        if (authoritative &&
+            state === "idle" &&
+            this.hasPendingClaudeReceipt(routeHandle)) {
+            // A registry peer can still report idle after our write but before it
+            // consumes the inbox frame. Preserve the dirty dispatch epoch so only a
+            // fresh discovery after exact terminal receipt can unlock this route.
+            return;
+        }
+        const signature = `${state}:${safeErrorCode ?? ""}`;
+        const mustPublish = authoritative && this.selectedObservationDirty.delete(routeHandle);
+        if (!mustPublish && this.selectedObservations.get(routeHandle) === signature) {
+            return;
+        }
+        this.selectedObservations.set(routeHandle, signature);
+        const callbacks = this.callbacks;
+        if (callbacks === undefined || this.closed)
+            return;
+        invokeCallback(() => callbacks.onRouteState({
+            endpoint: callbackEndpoint(this.identity, routeHandle),
+            state,
+            ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
+        }));
+    }
+    hasPendingClaudeReceipt(routeHandle) {
+        for (const targetId of this.pendingTargetByGatewayId.values()) {
+            if (targetId === routeHandle)
+                return true;
+        }
+        return false;
+    }
+    scheduleClaudeMonitor() {
+        if (this.closed ||
+            this.nativeCodexSuccessionFreeze !== undefined ||
+            this.selected.size === 0 ||
+            this.monitorTimer !== undefined) {
+            return;
+        }
+        this.monitorTimer = setTimeout(() => {
+            this.monitorTimer = undefined;
+            void this.refreshClaudeDiscovery()
+                .catch(() => {
+                if (this.nativeCodexSuccessionFreeze !== undefined)
+                    return;
+                for (const routeHandle of this.selected.keys()) {
+                    this.emitClaudeRouteObservation(routeHandle, "busy", "CLAUDE_DISCOVERY_UNAVAILABLE");
+                }
+            })
+                .finally(() => this.scheduleClaudeMonitor());
+        }, this.discoveryPollMs);
+        this.monitorTimer.unref();
+    }
+}
+export function createLocalClaudeGatewayProvider(options) {
+    return new LocalClaudeGatewayProvider(options);
+}
+function validateCodexFactory(factory) {
+    const schema = factory.schemaCompatibility;
+    const write = factory.writeCompatibility;
+    const certified = CODEX_APP_SERVER_WRITABLE_VERSIONS.includes(factory.appServerVersion);
+    const observedCandidate = factory.compatibilityPolicy === "observed" &&
+        schema.observedSchemaCandidate === true &&
+        CODEX_APP_SERVER_WRITABLE_VERSIONS.some((version) => sharesCompatibilityMajor(version, factory.appServerVersion));
+    if (factory.hostId !== LOCAL_HOST ||
+        factory.protocol !== "codex-app-server" ||
+        factory.protocolVersion !== factory.appServerVersion ||
+        (!certified && !observedCandidate) ||
+        schema.appServerVersion !== factory.appServerVersion ||
+        schema.endpointGeneration !== factory.endpointGeneration ||
+        schema.protocol !== "app-server-v2-stable" ||
+        schema.steering?.method !== "turn/steer" ||
+        schema.steering.requestSchema !== "expected-turn-id-text-v1" ||
+        schema.steering.deliveryBoundary !== "next-tool-call-boundary" ||
+        (write !== null &&
+            (write.appServerVersion !== schema.appServerVersion ||
+                write.endpointGeneration !== schema.endpointGeneration ||
+                write.protocol !== schema.protocol ||
+                write.observedSchemaCandidate !== schema.observedSchemaCandidate ||
+                write.steering?.method !== schema.steering.method ||
+                write.steering.requestSchema !== schema.steering.requestSchema ||
+                write.steering.deliveryBoundary !==
+                    schema.steering.deliveryBoundary)) ||
+        factory.writableReady !== (write !== null)) {
+        throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The local Codex provider requires exact schema and write attestations.");
+    }
+}
+function codexRouteState(observation) {
+    if (observation.connection !== "ready")
+        return "stale";
+    if (observation.routeStatus === "idle")
+        return "idle";
+    if (observation.routeStatus === "waiting_approval") {
+        return "awaiting_approval";
+    }
+    if (observation.routeStatus === "starting" ||
+        observation.routeStatus === "active" ||
+        observation.routeStatus === "interrupting") {
+        return "busy";
+    }
+    // Unknown, not-loaded, uncertain, system-error, and explicit stale states
+    // are never cosmetic busy. They cannot authorize another write.
+    return "stale";
+}
+function codexRouteSafeCode(observation) {
+    if (codexRouteState(observation) === "stale") {
+        return "CODEX_ROUTE_STALE";
+    }
+    if (!observation.writableReady) {
+        return "CODEX_WRITES_DISABLED";
+    }
+    return undefined;
+}
+export class LocalCodexGatewayProvider {
+    identity;
+    protocol;
+    protocolVersion;
+    factory;
+    maxCallbacks;
+    maxRoutes;
+    maxReplyBytes;
+    cleanupPollMs;
+    cleanupTimeoutMs;
+    recoveryInitialMs;
+    recoveryMaxMs;
+    now;
+    routes = new Map();
+    routeCreations = new Map();
+    routeReleases = new Map();
+    routeRecoveryAttempts = new Map();
+    routeRecoveryTimers = new Map();
+    routeRecoveries = new Map();
+    routesRequiringRecovery = new Set();
+    expectsReply = new Map();
+    compatibilityCertifyingRoutes = new Set();
+    compatibilityTurns = new Map();
+    callbackQueue = [];
+    callbackScheduled = false;
+    callbacks;
+    compatibilityAttested;
+    initialized = false;
+    closing = false;
+    closed = false;
+    constructor(options) {
+        validateCodexFactory(options.factory);
+        this.factory = options.factory;
+        this.identity = {
+            provider: "codex",
+            hostId: exactLocalHost(options.factory.hostId),
+            endpointGeneration: options.factory.endpointGeneration,
+        };
+        this.protocol = options.factory.protocol;
+        this.protocolVersion = options.factory.protocolVersion;
+        this.compatibilityAttested = CODEX_APP_SERVER_WRITABLE_VERSIONS.includes(options.factory.appServerVersion);
+        this.maxCallbacks = positiveBounded(options.maxCallbackEvents, MAX_CODEX_CALLBACKS, 4_096);
+        this.maxRoutes = positiveBounded(options.maxRoutes, MAX_CODEX_ROUTES, 256);
+        this.maxReplyBytes = positiveBounded(options.maxReplyBytes, MAX_TRANSIENT_REPLY_BYTES, 1024 * 1024);
+        this.cleanupPollMs = positiveBounded(options.cleanupPollMs, DEFAULT_CODEX_CLEANUP_POLL_MS, 1_000);
+        this.cleanupTimeoutMs = positiveBounded(options.cleanupTimeoutMs, DEFAULT_CODEX_CLEANUP_TIMEOUT_MS, 60_000);
+        if (this.cleanupPollMs >= this.cleanupTimeoutMs) {
+            throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "The cleanup polling interval must be shorter than its deadline.");
+        }
+        this.recoveryInitialMs = positiveBounded(options.recoveryInitialMs, DEFAULT_CODEX_RECOVERY_INITIAL_MS, 60_000);
+        this.recoveryMaxMs = positiveBounded(options.recoveryMaxMs, DEFAULT_CODEX_RECOVERY_MAX_MS, 5 * 60_000);
+        if (this.recoveryInitialMs > this.recoveryMaxMs) {
+            throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "The Codex recovery initial delay cannot exceed its capped delay.");
+        }
+        this.now = options.now ?? (() => new Date());
+    }
+    compatibilitySurface() {
+        return { surface: "codex", version: this.factory.appServerVersion };
+    }
+    acceptCompatibilityAttestation(attestation) {
+        if (attestation.surface !== "codex" ||
+            attestation.version !== this.factory.appServerVersion ||
+            attestation.tier === "incompatible") {
+            throw new BridgeError("CODEX_COMPATIBILITY_ATTESTATION_MISMATCH", "The Codex compatibility attestation does not match this endpoint.");
+        }
+        this.compatibilityAttested = true;
+    }
+    async runCompatibilityProbes() {
+        const [installation, control, initialize, threadList] = compatibilityProbeNames.codex;
+        let transport;
+        let connector;
+        let stage = "transport";
+        try {
+            transport = await this.factory.connectTransport();
+            stage = "initialize";
+            connector = await CodexAppServerConnector.connect({
+                compatibility: this.factory.schemaCompatibility,
+                writesEnabled: false,
+                route: {
+                    endpointGeneration: this.identity.endpointGeneration,
+                    threadId: COMPATIBILITY_PROBE_THREAD_ID,
+                },
+                transport,
+                maxReplyBytes: this.maxReplyBytes,
+                now: this.now,
+                onEvent: () => undefined,
+                onTurnResult: () => undefined,
+            });
+            stage = "thread_list";
+            await connector.observeLoadedThread(connector.guard());
+            this.compatibilityAttested = true;
+            return [
+                passedProbe(installation),
+                passedProbe(control),
+                passedProbe(initialize),
+                passedProbe(threadList),
+            ];
+        }
+        catch (error) {
+            if (stage === "transport") {
+                const controlFailure = error instanceof LocalCodexTransportError &&
+                    [
+                        "LOCAL_APP_SERVER_NOT_RUNNING",
+                        "LOCAL_APP_SERVER_ENDPOINT_UNSAFE",
+                        "TRANSPORT_CONNECT_FAILED",
+                    ].includes(error.code);
+                return [
+                    controlFailure
+                        ? passedProbe(installation)
+                        : failedProbe(installation, "CODEX_INSTALLATION_INVALID"),
+                    failedProbe(control, controlFailure
+                        ? "CODEX_CONTROL_SOCKET_UNAVAILABLE"
+                        : "CODEX_COMPAT_PROBE_BLOCKED"),
+                    failedProbe(initialize, "CODEX_COMPAT_PROBE_BLOCKED"),
+                    failedProbe(threadList, "CODEX_COMPAT_PROBE_BLOCKED"),
+                ];
+            }
+            return [
+                passedProbe(installation),
+                passedProbe(control),
+                stage === "initialize"
+                    ? failedProbe(initialize, "CODEX_INITIALIZE_SCHEMA_REJECTED")
+                    : passedProbe(initialize),
+                failedProbe(threadList, "CODEX_THREAD_LIST_SCHEMA_REJECTED"),
+            ];
+        }
+        finally {
+            if (connector !== undefined) {
+                await connector.close().catch(() => undefined);
+            }
+            else if (transport !== undefined) {
+                await transport.close().catch(() => undefined);
+            }
+        }
+    }
+    async runCompatibilityCertification(input) {
+        void input.controllerStateRoot;
+        const certifiedAt = this.now().toISOString();
+        const depth = input.withTurn ? "turn" : "thread_ops";
+        const routeHandle = input.routeHandle;
+        if (routeHandle === undefined || this.compatibilityCertifyingRoutes.has(routeHandle)) {
+            return {
+                depth,
+                outcome: "fail",
+                certifiedAt,
+                safeErrorCode: "CODEX_CERTIFICATION_ROUTE_REQUIRED",
+            };
+        }
+        this.assertReady();
+        const route = this.routes.get(routeHandle);
+        if (route === undefined || !this.observeRouteSuccessionBarrier(routeHandle).clean) {
+            return {
+                depth,
+                outcome: "fail",
+                certifiedAt,
+                safeErrorCode: "CODEX_CERTIFICATION_ROUTE_BUSY",
+            };
+        }
+        this.compatibilityCertifyingRoutes.add(routeHandle);
+        try {
+            const loaded = await route.connector.observeLoadedThread(route.connector.guard());
+            if (!loaded.selectedThreadLoaded) {
+                return {
+                    depth,
+                    outcome: "fail",
+                    certifiedAt: this.now().toISOString(),
+                    safeErrorCode: "CODEX_CERTIFICATION_THREAD_UNAVAILABLE",
+                };
+            }
+            await route.connector.certifyThreadOperations(route.connector.guard());
+            if (!input.withTurn) {
+                return {
+                    depth,
+                    outcome: "pass",
+                    certifiedAt: this.now().toISOString(),
+                };
+            }
+            const messageId = `compat_${randomBytes(12).toString("hex")}`;
+            const result = new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    this.compatibilityTurns.delete(messageId);
+                    resolve({
+                        messageId,
+                        outcome: "expired",
+                        replyCode: "REPLY_UNAVAILABLE",
+                        text: null,
+                    });
+                }, COMPATIBILITY_TURN_TIMEOUT_MS);
+                timer.unref();
+                this.compatibilityTurns.set(messageId, { resolve, timer });
+            });
+            try {
+                const disposition = await route.connector.submitMessage(route.connector.guard(), {
+                    deadlineAt: new Date(this.now().getTime() + COMPATIBILITY_TURN_TIMEOUT_MS).toISOString(),
+                    messageId,
+                    text: "reply OK",
+                });
+                if (disposition.disposition !== "started") {
+                    throw new BridgeError("CODEX_CERTIFICATION_TURN_NOT_STARTED", "The bounded certification turn did not start on the exact idle route.");
+                }
+                const settled = await result;
+                if (settled.outcome !== "completed" ||
+                    settled.text?.trim() !== "OK") {
+                    return {
+                        depth,
+                        outcome: "fail",
+                        certifiedAt: this.now().toISOString(),
+                        safeErrorCode: "CODEX_CERTIFICATION_TURN_FAILED",
+                    };
+                }
+                return {
+                    depth,
+                    outcome: "pass",
+                    certifiedAt: this.now().toISOString(),
+                };
+            }
+            finally {
+                const pending = this.compatibilityTurns.get(messageId);
+                if (pending !== undefined) {
+                    clearTimeout(pending.timer);
+                    this.compatibilityTurns.delete(messageId);
+                }
+            }
+        }
+        catch {
+            return {
+                depth,
+                outcome: "fail",
+                certifiedAt: this.now().toISOString(),
+                safeErrorCode: "CODEX_CERTIFICATION_FAILED",
+            };
+        }
+        finally {
+            this.compatibilityCertifyingRoutes.delete(routeHandle);
+        }
+    }
+    async initialize(callbacks) {
+        if (this.closed || this.initialized) {
+            throw new BridgeError("CODEX_PROVIDER_INITIALIZATION_REJECTED", "The local Codex provider cannot be initialized in this state.");
+        }
+        this.callbacks = callbacks;
+        this.initialized = true;
+        return this.factory.writeCompatibility === null
+            ? {
+                health: "degraded",
+                compatibility: "compatible",
+                safeErrorCode: "CODEX_MONITOR_ONLY",
+            }
+            : { health: "healthy", compatibility: "compatible" };
+    }
+    async selectRoute(input) {
+        this.assertReady();
+        if (!PUBLIC_ALIAS.test(input.alias) ||
+            !input.alias.endsWith(`@${this.identity.hostId}`)) {
+            throw new BridgeError("CODEX_ALIAS_MISMATCH", "The Codex alias is outside the exact local provider boundary.");
+        }
+        if (!OPAQUE_ROUTE.test(input.routeHandle)) {
+            throw new BridgeError("CODEX_ROUTE_INVALID", "The Codex task identifier is outside the exact provider boundary.");
+        }
+        this.cancelRouteRecovery(input.routeHandle);
+        const route = await this.ensureRoute(input.routeHandle);
+        const observation = route.connector.observation();
+        const state = codexRouteState(observation);
+        if (state === "stale") {
+            await this.releaseRoute(input.routeHandle);
+            throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task connection closed during route selection.");
+        }
+        this.queueRouteObservation(route, observation);
+        return {
+            routeHandle: input.routeHandle,
+            state,
+        };
+    }
+    observeRouteSuccessionBarrier(routeHandle) {
+        this.assertReady();
+        const route = this.routes.get(routeHandle);
+        const observation = route?.connector.observation();
+        const routeCreationInFlight = this.routeCreations.has(routeHandle);
+        const routeReleaseInFlight = this.routeReleases.has(routeHandle);
+        const pendingReplyCorrelations = this.expectsReply.size;
+        const pendingCallbacks = Math.max(this.callbackQueue.length, this.callbackScheduled ? 1 : 0);
+        const routePresent = route !== undefined;
+        const connection = observation?.connection ?? "absent";
+        const routeStatus = observation?.routeStatus ?? "absent";
+        const queueDepth = observation?.queueDepth ?? 0;
+        const hasActiveTurn = observation?.hasActiveTurn ?? false;
+        const requestInFlight = observation?.requestInFlight ?? false;
+        return {
+            routePresent,
+            connection,
+            routeStatus,
+            queueDepth,
+            hasActiveTurn,
+            requestInFlight,
+            routeCreationInFlight,
+            routeReleaseInFlight,
+            pendingReplyCorrelations,
+            pendingCallbacks,
+            clean: routePresent &&
+                connection === "ready" &&
+                routeStatus === "idle" &&
+                queueDepth === 0 &&
+                !hasActiveTurn &&
+                !requestInFlight &&
+                !routeCreationInFlight &&
+                !routeReleaseInFlight &&
+                pendingReplyCorrelations === 0 &&
+                pendingCallbacks === 0,
+        };
+    }
+    async dispatch(input) {
+        if (!this.initialized ||
+            this.closing ||
+            this.closed ||
+            !this.compatibilityAttested ||
+            input.authorization !== "selected_route" ||
+            !sameEndpoint(input.binding, this.identity)) {
+            return { state: "failed", safeErrorCode: "CODEX_ROUTE_UNAVAILABLE" };
+        }
+        const route = this.routes.get(input.binding.routeHandle);
+        if (route === undefined ||
+            this.routeReleases.has(input.binding.routeHandle)) {
+            return { state: "failed", safeErrorCode: "CODEX_ROUTE_UNAVAILABLE" };
+        }
+        if (this.compatibilityCertifyingRoutes.has(input.binding.routeHandle)) {
+            return { state: "deferred", safeErrorCode: "CODEX_ROUTE_HELD" };
+        }
+        if (!this.factory.writableReady ||
+            this.factory.writeCompatibility === null) {
+            return { state: "failed", safeErrorCode: "CODEX_WRITES_DISABLED" };
+        }
+        const guard = route.connector.guard();
+        if (!guard.writableReady) {
+            return { state: "failed", safeErrorCode: "CODEX_WRITES_DISABLED" };
+        }
+        if (strictDeadline(input.deadlineAt, this.now().getTime()) === undefined) {
+            return { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" };
+        }
+        if (this.expectsReply.has(input.messageId)) {
+            return { state: "failed", safeErrorCode: "CODEX_MESSAGE_DUPLICATE" };
+        }
+        this.expectsReply.set(input.messageId, input.expectsReply);
+        try {
+            const disposition = await route.connector.submitMessage(guard, {
+                deadlineAt: input.deadlineAt,
+                messageId: input.messageId,
+                ...(input.steer === true ? { steer: true } : {}),
+                text: input.text,
+            });
+            if (disposition.disposition === "deferred") {
+                this.expectsReply.delete(input.messageId);
+                return { state: "deferred", safeErrorCode: "CODEX_ROUTE_HELD" };
+            }
+            if (disposition.disposition === "steered") {
+                this.expectsReply.delete(input.messageId);
+                return { state: "delivered" };
+            }
+            return { state: "accepted" };
+        }
+        catch (error) {
+            if (!this.expectsReply.has(input.messageId)) {
+                // The connector synchronously handed off an exact terminal result.
+                return { state: "pending" };
+            }
+            this.expectsReply.delete(input.messageId);
+            if (error instanceof CodexConnectorError && error.ambiguous) {
+                return {
+                    state: "ambiguous",
+                    safeErrorCode: "CODEX_DISPATCH_OUTCOME_AMBIGUOUS",
+                };
+            }
+            if (error instanceof CodexConnectorError &&
+                [
+                    "ROUTE_NOT_READY",
+                    "ROUTE_BUSY",
+                ].includes(error.code)) {
+                return { state: "deferred", safeErrorCode: "CODEX_ROUTE_HELD" };
+            }
+            return { state: "failed", safeErrorCode: "CODEX_DISPATCH_REJECTED" };
+        }
+    }
+    async releaseRoute(routeHandle) {
+        this.cancelRouteRecovery(routeHandle);
+        const recovery = this.routeRecoveries.get(routeHandle);
+        if (recovery !== undefined)
+            await recovery;
+        await this.releaseRouteInternal(routeHandle);
+    }
+    async releaseRouteInternal(routeHandle) {
+        const pending = this.routeReleases.get(routeHandle);
+        if (pending !== undefined)
+            return await pending;
+        const route = this.routes.get(routeHandle);
+        if (route === undefined)
+            return;
+        const release = this.closeRoute(route).then(() => {
+            if (this.routes.get(routeHandle) === route) {
+                this.routes.delete(routeHandle);
+            }
+        });
+        this.routeReleases.set(routeHandle, release);
+        try {
+            await release;
+        }
+        finally {
+            this.routeReleases.delete(routeHandle);
+        }
+    }
+    async close() {
+        if (this.closed || this.closing)
+            return;
+        this.closing = true;
+        for (const timer of this.routeRecoveryTimers.values())
+            clearTimeout(timer);
+        this.routeRecoveryTimers.clear();
+        this.routesRequiringRecovery.clear();
+        const entries = [...this.routes.entries()];
+        const routeResults = await Promise.allSettled(entries.map(async ([routeHandle]) => this.releaseRoute(routeHandle)));
+        await Promise.allSettled([
+            ...this.routeRecoveries.values(),
+            ...this.routeCreations.values(),
+        ]);
+        this.drainCallbackQueue();
+        if (routeResults.some((result) => result.status === "rejected")) {
+            this.closing = false;
+            throw new BridgeError("CODEX_PROVIDER_CLEANUP_FAILED", "An exact owned Codex turn did not confirm termination.");
+        }
+        try {
+            await this.factory.close();
+        }
+        catch {
+            this.closing = false;
+            throw new BridgeError("CODEX_PROVIDER_CLEANUP_FAILED", "An exact owned Codex provider process did not confirm cleanup.");
+        }
+        this.closed = true;
+        this.closing = false;
+        this.callbackQueue.length = 0;
+        for (const [messageId, pending] of this.compatibilityTurns) {
+            clearTimeout(pending.timer);
+            pending.resolve({
+                messageId,
+                outcome: "abandoned",
+                replyCode: "REPLY_UNAVAILABLE",
+                text: null,
+            });
+        }
+        this.compatibilityTurns.clear();
+        this.compatibilityCertifyingRoutes.clear();
+        this.expectsReply.clear();
+        this.callbacks = undefined;
+    }
+    assertReady() {
+        if (!this.initialized ||
+            this.closing ||
+            this.closed ||
+            !this.compatibilityAttested) {
+            throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider is unavailable.", true);
+        }
+    }
+    async ensureRoute(threadId) {
+        this.assertReady();
+        const pendingRelease = this.routeReleases.get(threadId);
+        if (pendingRelease !== undefined) {
+            await pendingRelease;
+            return await this.ensureRoute(threadId);
+        }
+        const existing = this.routes.get(threadId);
+        if (existing !== undefined) {
+            if (existing.connector.observation().connection === "ready") {
+                return existing;
+            }
+            // A cached connector cannot recover after its transport closes or the
+            // protocol faults. Fully release that exact connector before constructing
+            // a fresh one. The identity-checked release lets automatic recovery and
+            // an explicit selector join the same cleanup safely.
+            await this.releaseRouteInternal(threadId);
+            return await this.ensureRoute(threadId);
+        }
+        const pending = this.routeCreations.get(threadId);
+        if (pending !== undefined)
+            return await pending;
+        if (this.routes.size + this.routeCreations.size >= this.maxRoutes) {
+            throw new BridgeError("CODEX_ROUTE_CAPACITY", "The bounded local Codex route table is full.", true);
+        }
+        const creation = this.createRoute(threadId);
+        this.routeCreations.set(threadId, creation);
+        try {
+            const route = await creation;
+            if (this.closing || this.closed) {
+                await this.closeRoute(route);
+                throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider closed during route creation.");
+            }
+            this.routes.set(threadId, route);
+            return route;
+        }
+        finally {
+            this.routeCreations.delete(threadId);
+        }
+    }
+    async createRoute(threadId) {
+        let transport;
+        let connector;
+        const generation = Symbol(threadId);
+        try {
+            transport = await this.factory.connectTransport();
+            const writesEnabled = this.factory.writableReady &&
+                this.factory.writeCompatibility !== null;
+            connector = await CodexAppServerConnector.connect({
+                compatibility: this.factory.writeCompatibility ??
+                    this.factory.schemaCompatibility,
+                writesEnabled,
+                route: {
+                    endpointGeneration: this.identity.endpointGeneration,
+                    threadId,
+                },
+                transport,
+                maxReplyBytes: this.maxReplyBytes,
+                now: this.now,
+                onEvent: (event) => this.onConnectorEvent(threadId, generation, event),
+                onTurnResult: (result) => this.onTurnResult(result),
+            });
+            const loaded = await connector.observeLoadedThread(connector.guard());
+            if (!loaded.selectedThreadLoaded) {
+                throw new BridgeError("CODEX_THREAD_NOT_OBSERVED", "The exact opted-in Codex task is not loaded on this endpoint.");
+            }
+            await connector.resumeThread(connector.guard());
+            const route = {
+                connector,
+                generation,
+                threadId,
+                transport,
+            };
+            this.queueRouteObservation(route, connector.observation());
+            return route;
+        }
+        catch (error) {
+            if (connector !== undefined) {
+                await connector.close().catch(() => undefined);
+            }
+            else if (transport !== undefined) {
+                await transport.close().catch(() => undefined);
+            }
+            if (error instanceof BridgeError)
+                throw error;
+            if (error instanceof CodexConnectorError) {
+                throw new BridgeError(error.ambiguous
+                    ? "CODEX_ROUTE_SETUP_AMBIGUOUS"
+                    : "CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task could not be safely observed and resumed.");
+            }
+            throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task could not be safely observed and resumed.");
+        }
+    }
+    onConnectorEvent(threadId, generation, event) {
+        const route = this.routes.get(threadId);
+        if (route === undefined || route.generation !== generation)
+            return;
+        this.queueRouteObservation(route, event);
+        if (event.kind === "protocol_fault" ||
+            (event.kind === "connection_closed" &&
+                event.details?.errorCode !== undefined) ||
+            (event.kind === "route_status_changed" &&
+                codexRouteState(event) === "stale")) {
+            this.routesRequiringRecovery.add(threadId);
+            this.scheduleRouteRecovery(threadId);
+        }
+    }
+    scheduleRouteRecovery(threadId) {
+        if (this.closed ||
+            this.closing ||
+            !this.routesRequiringRecovery.has(threadId) ||
+            this.routeRecoveryTimers.has(threadId) ||
+            this.routeRecoveries.has(threadId)) {
+            return;
+        }
+        const attempt = this.routeRecoveryAttempts.get(threadId) ?? 0;
+        const delay = Math.min(this.recoveryMaxMs, this.recoveryInitialMs * 2 ** Math.min(attempt, 16));
+        const timer = setTimeout(() => {
+            if (this.routeRecoveryTimers.get(threadId) !== timer)
+                return;
+            this.routeRecoveryTimers.delete(threadId);
+            const recovery = this.recoverRoute(threadId);
+            this.routeRecoveries.set(threadId, recovery);
+            void recovery.finally(() => {
+                if (this.routeRecoveries.get(threadId) === recovery) {
+                    this.routeRecoveries.delete(threadId);
+                }
+                this.scheduleRouteRecovery(threadId);
+            });
+        }, delay);
+        timer.unref();
+        this.routeRecoveryTimers.set(threadId, timer);
+    }
+    async recoverRoute(threadId) {
+        if (this.closed ||
+            this.closing ||
+            !this.routesRequiringRecovery.has(threadId)) {
+            return;
+        }
+        try {
+            const current = this.routes.get(threadId);
+            if (current !== undefined &&
+                codexRouteState(current.connector.observation()) === "stale") {
+                await this.releaseRouteInternal(threadId);
+            }
+            if (!this.routesRequiringRecovery.has(threadId))
+                return;
+            const replacement = await this.ensureRoute(threadId);
+            if (!this.routesRequiringRecovery.has(threadId)) {
+                // An explicit selector can join this exact creation after cancelling
+                // automatic recovery. In that case the replacement is now operator-
+                // owned and must remain live. Explicit release waits for this recovery
+                // promise before closing any late-created replacement.
+                return;
+            }
+            this.routesRequiringRecovery.delete(threadId);
+            this.routeRecoveryAttempts.delete(threadId);
+            this.queueRouteObservation(replacement, replacement.connector.observation());
+        }
+        catch {
+            this.routeRecoveryAttempts.set(threadId, (this.routeRecoveryAttempts.get(threadId) ?? 0) + 1);
+        }
+    }
+    cancelRouteRecovery(threadId) {
+        this.routesRequiringRecovery.delete(threadId);
+        this.routeRecoveryAttempts.delete(threadId);
+        const timer = this.routeRecoveryTimers.get(threadId);
+        if (timer !== undefined)
+            clearTimeout(timer);
+        this.routeRecoveryTimers.delete(threadId);
+    }
+    onTurnResult(result) {
+        const certification = this.compatibilityTurns.get(result.messageId);
+        if (certification !== undefined) {
+            clearTimeout(certification.timer);
+            this.compatibilityTurns.delete(result.messageId);
+            certification.resolve(result);
+            return;
+        }
+        const wantsReply = this.expectsReply.get(result.messageId) === true;
+        this.expectsReply.delete(result.messageId);
+        let replyText;
+        if (wantsReply && result.text !== null) {
+            const bytes = Buffer.from(result.text, "utf8");
+            if (bytes.length <= this.maxReplyBytes) {
+                replyText = Buffer.from(bytes).toString("utf8");
+            }
+        }
+        const state = result.outcome === "completed"
+            ? "completed"
+            : result.outcome === "interrupted"
+                ? "cancelled"
+                : result.outcome === "expired"
+                    ? "expired"
+                    : result.outcome === "failed"
+                        ? "failed"
+                        : "ambiguous";
+        const safeErrorCode = result.outcome === "completed"
+            ? result.replyCode === "REPLY_TOO_LARGE"
+                ? "CODEX_REPLY_TOO_LARGE"
+                : undefined
+            : result.outcome === "expired"
+                ? "MESSAGE_EXPIRED"
+                : result.outcome === "interrupted"
+                    ? "CODEX_TURN_INTERRUPTED"
+                    : result.outcome === "failed"
+                        ? "CODEX_TURN_FAILED"
+                        : "CODEX_DELIVERY_AMBIGUOUS";
+        this.enqueueCodexCallback({
+            type: "delivery",
+            value: {
+                messageId: result.messageId,
+                state,
+                ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
+                ...(replyText === undefined ? {} : { replyText }),
+            },
+        });
+    }
+    queueRouteObservation(route, observation) {
+        this.enqueueCodexCallback({
+            type: "route",
+            generation: route.generation,
+            routeHandle: route.threadId,
+            state: codexRouteState(observation),
+            ...(codexRouteSafeCode(observation) === undefined
+                ? {}
+                : { safeErrorCode: codexRouteSafeCode(observation) }),
+        });
+    }
+    enqueueCodexCallback(event) {
+        if (this.closed)
+            return;
+        if (this.callbackQueue.length >= this.maxCallbacks) {
+            const routeIndex = this.callbackQueue.findIndex((candidate) => candidate.type === "route");
+            if (routeIndex >= 0) {
+                this.callbackQueue.splice(routeIndex, 1);
+            }
+            else {
+                // The callback consumer is synchronous and itself queues safely. Drain
+                // one exact terminal handoff before accepting another; never drop one.
+                this.drainOneCallback();
+            }
+        }
+        this.callbackQueue.push(event);
+        if (this.callbackScheduled)
+            return;
+        this.callbackScheduled = true;
+        queueMicrotask(() => {
+            this.callbackScheduled = false;
+            this.drainCallbackQueue();
+        });
+    }
+    drainOneCallback() {
+        const event = this.callbackQueue.shift();
+        const callbacks = this.callbacks;
+        if (event === undefined || callbacks === undefined)
+            return;
+        if (event.type === "delivery") {
+            invokeCallback(() => callbacks.onDelivery(event.value));
+        }
+        else {
+            if (this.routes.get(event.routeHandle)?.generation !== event.generation) {
+                return;
+            }
+            invokeCallback(() => callbacks.onRouteState({
+                endpoint: callbackEndpoint(this.identity, event.routeHandle),
+                state: event.state,
+                ...(event.safeErrorCode === undefined
+                    ? {}
+                    : { safeErrorCode: event.safeErrorCode }),
+            }));
+        }
+    }
+    drainCallbackQueue() {
+        while (this.callbackQueue.length > 0)
+            this.drainOneCallback();
+    }
+    async closeRoute(route) {
+        let observation = route.connector.observation();
+        if (observation.connection === "ready") {
+            try {
+                route.connector.cancelQueuedMessages(route.connector.guard());
+            }
+            catch {
+                throw new BridgeError("CODEX_PROVIDER_CLEANUP_AMBIGUOUS", "The exact Codex queue could not be safely cancelled.");
+            }
+            let guard = route.connector.guard();
+            let externalTurnObserved = false;
+            if (guard.activeTurnId !== null &&
+                (guard.status === "active" || guard.status === "waiting_approval")) {
+                try {
+                    await route.connector.interruptOwnedTurn(guard);
+                }
+                catch (error) {
+                    if (error instanceof CodexConnectorError &&
+                        error.code === "TURN_NOT_OWNED") {
+                        // An approval request or turn notification can expose another
+                        // Desktop client's turn ID. The connector verifies ownership
+                        // before issuing RPC, so release must detach without waiting for
+                        // or attempting to control that external work.
+                        externalTurnObserved = true;
+                    }
+                    else {
+                        throw new BridgeError("CODEX_PROVIDER_CLEANUP_AMBIGUOUS", "The exact bridge-owned Codex turn did not confirm interruption.");
+                    }
+                }
+            }
+            if (!externalTurnObserved) {
+                guard = await this.waitForOwnedTurnToSettle(route.connector);
+                observation = route.connector.observation();
+                if (guard.activeTurnId !== null ||
+                    observation.hasActiveTurn ||
+                    observation.queueDepth !== 0) {
+                    throw new BridgeError("CODEX_PROVIDER_CLEANUP_AMBIGUOUS", "The exact bridge-owned Codex work did not reach a terminal state.");
+                }
+                if (observation.routeStatus !== "active" &&
+                    observation.routeStatus !== "waiting_approval" &&
+                    observation.routeStatus !== "starting" &&
+                    observation.routeStatus !== "interrupting") {
+                    await route.connector
+                        .unsubscribeThread(route.connector.guard())
+                        .catch(() => undefined);
+                }
+            }
+        }
+        await route.connector.close();
+        if (!route.transport.cleanupConfirmed) {
+            await route.transport.close();
+        }
+        if (!route.transport.cleanupConfirmed) {
+            throw new BridgeError("CODEX_PROVIDER_CLEANUP_FAILED", "The exact owned Codex proxy did not confirm termination.");
+        }
+    }
+    async waitForOwnedTurnToSettle(connector) {
+        const deadline = Date.now() + this.cleanupTimeoutMs;
+        while (true) {
+            const guard = connector.guard();
+            if (guard.activeTurnId === null)
+                return guard;
+            if (connector.observation().connection !== "ready" ||
+                Date.now() >= deadline) {
+                throw new BridgeError("CODEX_PROVIDER_CLEANUP_TIMEOUT", "The exact bridge-owned Codex turn did not confirm termination before the cleanup deadline.");
+            }
+            await new Promise((resolve) => {
+                setTimeout(resolve, this.cleanupPollMs);
+            });
+        }
+    }
+}
+export function createLocalCodexGatewayProvider(options) {
+    return new LocalCodexGatewayProvider(options);
+}
+//# sourceMappingURL=providers.js.map