agentic-workflow-manager 9.11.12 → 9.12.1

package/dist/src/core/model-policy/machine-key.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readMachineKey = readMachineKey;
+exports.ensureMachineKey = ensureMachineKey;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const KEY_NAME = 'routing-machine.key';
+function keyPath(root) {
+    if (typeof root !== 'string' || !path_1.default.isAbsolute(root) || path_1.default.normalize(root) !== root || root.includes('\0'))
+        throw new Error('routing machine root must be an absolute normalized path');
+    for (let dir = root;; dir = path_1.default.dirname(dir)) {
+        const stat = fs_1.default.lstatSync(dir);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('routing machine root has unsafe or symlinked ancestor');
+        if (dir === path_1.default.dirname(dir))
+            break;
+    }
+    return path_1.default.join(root, KEY_NAME);
+}
+/** Read-only status path; never initializes machine state during diagnostics. */
+function readMachineKey(root) {
+    const file = keyPath(root);
+    try {
+        const stat = fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new Error('routing machine key is unsafe or symlinked');
+        if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)
+            throw new Error('routing machine key permissions are unsafe');
+        const bytes = native_bridge_1.secureFs.readRegularFile(file, 32).bytes;
+        if (bytes.length !== 32)
+            throw new Error('routing machine key length is invalid');
+        return Buffer.from(bytes);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+/** Only explicit setup may call this producer. No secret bytes are reported. */
+function ensureMachineKey(root) {
+    keyPath(root);
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const existing = readMachineKey(root);
+        if (existing)
+            return existing;
+        const bytes = (0, crypto_1.randomBytes)(32);
+        native_bridge_1.secureFs.writeProjectTransaction(root, KEY_NAME, bytes, { mode: 'create', createParents: false });
+        return bytes;
+    });
+}

package/dist/src/core/model-policy/native-claude-agent-definition.js

@@ -0,0 +1,82 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNativeClaudeAgentDeclaration = isNativeClaudeAgentDeclaration;
+exports.readClaudeAgentDeclaredModel = readClaudeAgentDeclaredModel;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const observedDeclarations = new WeakMap();
+function isNativeClaudeAgentDeclaration(value) {
+    return !!value && typeof value === 'object' && observedDeclarations.get(value) === JSON.stringify(value);
+}
+function safeDirectory(dir) {
+    for (let current = dir;; current = path_1.default.dirname(current)) {
+        const stat = fs_1.default.lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('Claude agent definition has an unsafe ancestor');
+        if (current === path_1.default.dirname(current))
+            break;
+    }
+}
+/** An explicit custom-agent model is necessary, but the effective model must
+ * still be independently observed in the native child transcript. Built-in
+ * agents, aliases and an inherited/default model cannot enroll a selection. */
+function readClaudeAgentDeclaredModel(input) {
+    if (!input || typeof input !== 'object' || !path_1.default.isAbsolute(input.cwd) || !path_1.default.isAbsolute(input.configDir)
+        || path_1.default.normalize(input.cwd) !== input.cwd || path_1.default.normalize(input.configDir) !== input.configDir
+        || input.cwd.includes('\0') || input.configDir.includes('\0')
+        || typeof input.agentType !== 'string' || !/^awm-[A-Za-z0-9][A-Za-z0-9_-]{0,123}$/.test(input.agentType))
+        throw new Error('Claude agent definition identity is invalid');
+    const dirs = [path_1.default.join(input.configDir, 'agents'), path_1.default.join(input.cwd, '.claude', 'agents')];
+    const declared = [];
+    for (const dir of dirs) {
+        try {
+            safeDirectory(dir);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        const names = fs_1.default.readdirSync(dir).filter(name => name.endsWith('.md'));
+        if (names.length > 256)
+            throw new Error('Claude agent definitions exceed limit');
+        for (const name of names) {
+            const file = path_1.default.join(dir, name);
+            const stat = fs_1.default.lstatSync(file);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error('Claude agent definition is unsafe');
+            const bytes = native_bridge_1.secureFs.readRegularFile(file, 1024 * 1024).bytes;
+            const content = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(content);
+            if (!match)
+                continue;
+            let frontmatter;
+            try {
+                frontmatter = js_yaml_1.default.load(match[1]);
+            }
+            catch {
+                throw new Error('Claude agent frontmatter is invalid');
+            }
+            if (!frontmatter || typeof frontmatter !== 'object' || Array.isArray(frontmatter))
+                continue;
+            const row = frontmatter;
+            if (row.name !== input.agentType)
+                continue;
+            if (typeof row.description !== 'string' || !row.description.trim())
+                throw new Error('Claude agent description is missing');
+            if (typeof row.model !== 'string' || !/^claude-[a-z0-9][a-z0-9.-]{1,126}$/.test(row.model))
+                throw new Error('Claude agent requires an explicit full model ID; aliases and inherit are unverified');
+            declared.push(row.model);
+        }
+    }
+    if (declared.length !== 1)
+        throw new Error(declared.length ? 'Claude agent definition is ambiguous' : 'Claude agent has no explicit custom definition');
+    const result = { agentType: input.agentType, modelId: declared[0] };
+    observedDeclarations.set(result, JSON.stringify(result));
+    return result;
+}

package/dist/src/core/model-policy/native-claude-config.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readClaudeModelConfigDigest = readClaudeModelConfigDigest;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const json_1 = require("../plan/json");
+const MODEL_KEYS = ['model', 'effortLevel', 'availableModels', 'enforceAvailableModels', 'modelOverrides'];
+const ENV_KEYS = ['ANTHROPIC_MODEL', 'ANTHROPIC_DEFAULT_OPUS_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL', 'ANTHROPIC_DEFAULT_HAIKU_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL_FORCE'];
+function safeDirectory(dir) {
+    for (let current = dir;; current = path_1.default.dirname(current)) {
+        const stat = fs_1.default.lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('Claude settings have an unsafe or symlinked ancestor');
+        if (current === path_1.default.dirname(current))
+            break;
+    }
+}
+function settings(file) {
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    safeDirectory(path_1.default.dirname(file));
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('Claude settings file is unsafe or symlinked');
+    const bytes = native_bridge_1.secureFs.readRegularFile(file, 1024 * 1024).bytes;
+    const value = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Claude settings must be an object');
+    return value;
+}
+function agentDefinitions(dir) {
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(dir);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    safeDirectory(path_1.default.dirname(dir));
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('Claude agents directory is unsafe or symlinked');
+    const names = fs_1.default.readdirSync(dir).filter(name => name.endsWith('.md')).sort();
+    if (names.length > 256)
+        throw new Error('Claude agent definitions exceed limit');
+    return names.map(name => {
+        const file = path_1.default.join(dir, name);
+        const entry = fs_1.default.lstatSync(file);
+        if (!entry.isFile() || entry.isSymbolicLink())
+            throw new Error('Claude agent definition is unsafe or symlinked');
+        const bytes = native_bridge_1.secureFs.readRegularFile(file, 1024 * 1024).bytes;
+        return [name, (0, crypto_1.createHash)('sha256').update(bytes).digest('hex')];
+    });
+}
+/** Fingerprints only locally visible model controls. Managed/server-side policy
+ * is not represented here; a native child observation remains mandatory. */
+function readClaudeModelConfigDigest(input) {
+    if (!input || typeof input !== 'object' || !path_1.default.isAbsolute(input.cwd) || !path_1.default.isAbsolute(input.configDir)
+        || path_1.default.normalize(input.cwd) !== input.cwd || path_1.default.normalize(input.configDir) !== input.configDir
+        || input.cwd.includes('\0') || input.configDir.includes('\0') || !Buffer.isBuffer(input.key) || input.key.length !== 32
+        || !input.environment || typeof input.environment !== 'object' || Array.isArray(input.environment))
+        throw new Error('Claude model config input is invalid');
+    safeDirectory(input.cwd);
+    safeDirectory(input.configDir);
+    const files = [path_1.default.join(input.configDir, 'settings.json'), path_1.default.join(input.cwd, '.claude', 'settings.json'), path_1.default.join(input.cwd, '.claude', 'settings.local.json')];
+    const projection = files.map(file => {
+        const value = settings(file);
+        if (!value)
+            return null;
+        const model = {};
+        for (const key of MODEL_KEYS)
+            if (Object.prototype.hasOwnProperty.call(value, key))
+                model[key] = value[key];
+        if (value.env && typeof value.env === 'object' && !Array.isArray(value.env)) {
+            const env = {};
+            for (const key of ENV_KEYS)
+                if (Object.prototype.hasOwnProperty.call(value.env, key))
+                    env[key] = value.env[key];
+            if (Object.keys(env).length)
+                model.env = env;
+        }
+        return model;
+    });
+    const environment = {};
+    for (const key of ENV_KEYS) {
+        const value = input.environment[key];
+        if (value !== undefined) {
+            if (typeof value !== 'string' || value.length > 4096)
+                throw new Error('Claude model environment is invalid');
+            environment[key] = value;
+        }
+    }
+    const agents = [agentDefinitions(path_1.default.join(input.configDir, 'agents')), agentDefinitions(path_1.default.join(input.cwd, '.claude', 'agents'))];
+    return (0, crypto_1.createHmac)('sha256', input.key).update(JSON.stringify({ projection, agents, environment })).digest('hex');
+}

package/dist/src/core/model-policy/native-claude-machine.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryClaudeAuthStatus = queryClaudeAuthStatus;
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+/** `claude auth status` is documented as a JSON, no-inference command. The
+ * account shape varies by auth method; incomplete identity stays unverified. */
+function queryClaudeAuthStatus(input) {
+    if (!input || typeof input !== 'object' || typeof input.command !== 'string' || input.command.length === 0 || input.command.length > 4096
+        || !Array.isArray(input.args) || input.args.length > 16 || input.args.some(value => typeof value !== 'string' || value.length > 65536)
+        || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 30000
+        || !Buffer.isBuffer(input.key) || input.key.length !== 32)
+        throw new Error('Claude auth query is invalid');
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(input.command, input.args, { stdio: ['ignore', 'pipe', 'pipe'], shell: false });
+        let settled = false;
+        let buffer = '';
+        const finish = (error, facts) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error) {
+                child.kill();
+                reject(error);
+            }
+            else
+                resolve(facts);
+        };
+        const timer = setTimeout(() => finish(new Error('Claude auth status timed out')), input.timeoutMs);
+        child.on('error', () => finish(new Error('Claude CLI could not be started')));
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => { buffer += chunk; if (buffer.length > 64 * 1024)
+            finish(new Error('Claude auth status exceeds 64 KiB')); });
+        child.on('exit', code => {
+            if (code !== 0)
+                return finish(new Error('Claude auth status failed or is logged out'));
+            try {
+                const parsed = JSON.parse(buffer);
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                    throw new Error('shape');
+                const value = parsed;
+                if (value.loggedIn !== true)
+                    throw new Error('login');
+                const fields = ['authMethod', 'apiProvider', 'email', 'orgId'];
+                const identified = fields.every(field => typeof value[field] === 'string' && value[field].length > 0 && value[field].length <= 320);
+                const subscriptionType = value.subscriptionType;
+                if (subscriptionType !== null && subscriptionType !== undefined && (typeof subscriptionType !== 'string' || subscriptionType.length > 128))
+                    throw new Error('subscription');
+                const accountScopeDigest = identified ? (0, crypto_1.createHmac)('sha256', input.key).update(JSON.stringify(fields.map(field => value[field]).concat([subscriptionType ?? null]))).digest('hex') : null;
+                finish(undefined, { provenance: 'claude-auth-status', accountState: accountScopeDigest ? 'identified' : 'unverified', accountScopeDigest, inferenceDispatched: false });
+            }
+            catch {
+                finish(new Error('Claude auth status response is invalid'));
+            }
+        });
+    });
+}

package/dist/src/core/model-policy/native-claude-transcript.js

@@ -0,0 +1,80 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNativeClaudeTranscriptObservation = isNativeClaudeTranscriptObservation;
+exports.readClaudeSubagentTranscript = readClaudeSubagentTranscript;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const MAX_BYTES = 16 * 1024 * 1024;
+const ASSISTANT_LINE = /"type"\s*:\s*"assistant"/;
+const observedTranscripts = new WeakMap();
+function isNativeClaudeTranscriptObservation(value) {
+    return !!value && typeof value === 'object' && observedTranscripts.get(value) === JSON.stringify(value);
+}
+/** Private JSONL format: any format change or mixed-model trace fails closed.
+ * Usage is deliberately unknown because repeated assistant chunks can duplicate
+ * the provider usage object. No prompt or transcript text is returned. */
+function readClaudeSubagentTranscript(input) {
+    if (!input || typeof input !== 'object' || typeof input.configDir !== 'string' || typeof input.file !== 'string'
+        || !path_1.default.isAbsolute(input.configDir) || !path_1.default.isAbsolute(input.file) || path_1.default.normalize(input.configDir) !== input.configDir
+        || path_1.default.normalize(input.file) !== input.file || input.configDir.includes('\0') || input.file.includes('\0')
+        || typeof input.agentId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(input.agentId))
+        throw new Error('Claude transcript identity or paths are invalid');
+    const relative = path_1.default.relative(input.configDir, input.file);
+    const segments = relative.split(path_1.default.sep);
+    if (segments.length < 5 || segments[0] !== 'projects' || segments[segments.length - 2] !== 'subagents'
+        || segments[segments.length - 1] !== `agent-${input.agentId}.jsonl`
+        || segments.some(segment => segment === '..' || segment === ''))
+        throw new Error('Claude transcript is outside the native subagents tree');
+    for (let dir = path_1.default.dirname(input.file);; dir = path_1.default.dirname(dir)) {
+        const stat = fs_1.default.lstatSync(dir);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('Claude transcript has an unsafe or symlinked ancestor');
+        if (dir === input.configDir)
+            break;
+        if (dir === path_1.default.dirname(dir))
+            throw new Error('Claude config root is invalid');
+    }
+    const stat = fs_1.default.lstatSync(input.file);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('Claude transcript is unsafe or symlinked');
+    const bytes = native_bridge_1.secureFs.readRegularFile(input.file, MAX_BYTES).bytes;
+    const lines = new TextDecoder('utf-8', { fatal: true }).decode(bytes).split('\n');
+    let actualModel;
+    let observedAt;
+    let count = 0;
+    for (const line of lines) {
+        if (!ASSISTANT_LINE.test(line))
+            continue;
+        if (line.length > 256 * 1024 || ++count > 10000)
+            throw new Error('Claude transcript assistant metadata exceeds limit');
+        const event = JSON.parse(line);
+        if (!event || typeof event !== 'object' || Array.isArray(event))
+            throw new Error('Claude transcript assistant event is invalid');
+        const item = event;
+        if (item.type !== 'assistant' || !item.message || typeof item.message !== 'object' || Array.isArray(item.message))
+            throw new Error('Claude transcript assistant event is invalid');
+        const model = item.message.model;
+        if (typeof model !== 'string' || model.length === 0 || model.length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(model))
+            throw new Error('Claude transcript model is invalid');
+        if (actualModel !== undefined && actualModel !== model)
+            throw new Error('Claude transcript contains mixed or multiple models');
+        if (typeof item.timestamp !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(item.timestamp)
+            || !Number.isFinite(Date.parse(item.timestamp)))
+            throw new Error('Claude transcript timestamp is invalid');
+        actualModel = model;
+        const time = new Date(item.timestamp).toISOString();
+        if (!observedAt || time > observedAt)
+            observedAt = time;
+    }
+    if (!actualModel || !observedAt)
+        throw new Error('Claude transcript has no assistant model evidence');
+    const result = { provenance: 'claude-subagent-transcript', agentId: input.agentId, actualModel, observedAt,
+        evidenceDigest: (0, crypto_1.createHash)('sha256').update(bytes).digest('hex'), tokenUsage: 'unknown' };
+    observedTranscripts.set(result, JSON.stringify(result));
+    return result;
+}

package/dist/src/core/model-policy/native-claude.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNativeClaudeSubagentLifecycle = isNativeClaudeSubagentLifecycle;
+exports.normalizeClaudeSubagentLifecycle = normalizeClaudeSubagentLifecycle;
+const observedLifecycles = new WeakMap();
+function isNativeClaudeSubagentLifecycle(value) {
+    return !!value && typeof value === 'object' && observedLifecycles.get(value) === JSON.stringify(value);
+}
+function record(value, name) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${name} must be an object`);
+    return value;
+}
+function boundedText(value, name, max = 128) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > max || /[\u0000-\u001f\u007f-\u009f]/.test(value))
+        throw new Error(`${name} is invalid`);
+    return value;
+}
+/** A matching native hook pair proves lifecycle, not the effective model.
+ * Call only on payloads captured by the installed Claude Code hooks. */
+function normalizeClaudeSubagentLifecycle(startValue, stopValue) {
+    const start = record(startValue, 'Claude SubagentStart hook');
+    const stop = record(stopValue, 'Claude SubagentStop hook');
+    if (start.hook_event_name !== 'SubagentStart' || stop.hook_event_name !== 'SubagentStop')
+        throw new Error('Claude subagent hook event kind is invalid');
+    const sessionId = boundedText(start.session_id, 'Claude session id');
+    const agentId = boundedText(start.agent_id, 'Claude agent id');
+    const agentType = boundedText(start.agent_type, 'Claude agent type');
+    const stopSessionId = boundedText(stop.session_id, 'Claude stop session id');
+    const stopAgentId = boundedText(stop.agent_id, 'Claude stop agent id');
+    const stopAgentType = boundedText(stop.agent_type, 'Claude stop agent type');
+    boundedText(stop.agent_transcript_path, 'Claude agent transcript path', 4096);
+    if (typeof stop.stop_hook_active !== 'boolean')
+        throw new Error('Claude stop hook active flag is invalid');
+    if (sessionId !== stopSessionId || agentId !== stopAgentId || agentType !== stopAgentType)
+        throw new Error('Claude subagent lifecycle identity mismatch');
+    const lifecycle = { provenance: 'claude-code-subagent-hooks', sessionId, agentId, agentType,
+        nativeDispatchVerified: true, acceptedSelectionVerified: false, actualModelVerified: false, tokenUsage: 'unknown' };
+    observedLifecycles.set(lifecycle, JSON.stringify(lifecycle));
+    return lifecycle;
+}

package/dist/src/core/model-policy/native-codex-machine.js

@@ -0,0 +1,116 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryCodexMachineFacts = queryCodexMachineFacts;
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function canonical(value, depth = 0) {
+    if (depth > 32)
+        throw new Error('Codex configuration nesting exceeds limit');
+    if (value === null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(item => canonical(item, depth + 1)).join(',')}]`;
+    const item = record(value, 'Codex configuration value');
+    return `{${Object.keys(item).sort().map(key => `${JSON.stringify(key)}:${canonical(item[key], depth + 1)}`).join(',')}}`;
+}
+function digest(key, value) { return (0, crypto_1.createHmac)('sha256', key).update(value, 'utf8').digest('hex'); }
+/** Explicit no-inference query. HMAC prevents offline guessing of email and
+ * configuration values; the caller owns one stable per-machine key. */
+function queryCodexMachineFacts(input) {
+    if (!input || typeof input !== 'object' || typeof input.command !== 'string' || input.command.length === 0 || input.command.length > 4096
+        || !Array.isArray(input.args) || input.args.length > 16 || input.args.some(arg => typeof arg !== 'string' || arg.length > 65536)
+        || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 30000
+        || typeof input.cwd !== 'string' || !path_1.default.isAbsolute(input.cwd) || !Buffer.isBuffer(input.key) || input.key.length !== 32)
+        throw new Error('Codex machine query is invalid');
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(input.command, input.args, { stdio: ['pipe', 'pipe', 'pipe'], shell: false, cwd: input.cwd });
+        let settled = false;
+        let buffer = '';
+        let expectedId = 1;
+        let configDigest;
+        const finish = (error, result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.kill();
+            if (error)
+                reject(error);
+            else
+                resolve(result);
+        };
+        const send = (request) => { if (!settled)
+            child.stdin.write(`${JSON.stringify(request)}\n`); };
+        const timer = setTimeout(() => finish(new Error('Codex machine query timed out')), input.timeoutMs);
+        child.on('error', () => finish(new Error('Codex app-server could not be started')));
+        child.stdin.on('error', () => finish(new Error('Codex app-server input failed')));
+        child.on('exit', () => finish(new Error('Codex app-server exited before machine response')));
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            if (settled)
+                return;
+            buffer += chunk;
+            if (buffer.length > 2 * 1024 * 1024)
+                return finish(new Error('Codex machine response exceeds 2 MiB'));
+            for (;;) {
+                const end = buffer.indexOf('\n');
+                if (end < 0 || settled)
+                    break;
+                const line = buffer.slice(0, end).trim();
+                buffer = buffer.slice(end + 1);
+                if (!line)
+                    continue;
+                let message;
+                try {
+                    message = record(JSON.parse(line), 'Codex protocol response');
+                }
+                catch {
+                    return finish(new Error('Codex protocol returned invalid JSON'));
+                }
+                if (message.id === undefined)
+                    continue;
+                if (message.id !== expectedId)
+                    return finish(new Error('Codex protocol response id mismatch'));
+                if (message.error !== undefined)
+                    return finish(new Error('Codex app-server rejected machine query'));
+                try {
+                    const result = record(message.result, 'Codex machine result');
+                    if (expectedId === 1) {
+                        expectedId = 2;
+                        send({ method: 'initialized' });
+                        send({ id: expectedId, method: 'config/read', params: { cwd: input.cwd, includeLayers: false } });
+                    }
+                    else if (expectedId === 2) {
+                        configDigest = digest(input.key, canonical(record(result.config, 'Codex effective config')));
+                        expectedId = 3;
+                        send({ id: expectedId, method: 'account/read', params: { refreshToken: false } });
+                    }
+                    else {
+                        if (typeof result.requiresOpenaiAuth !== 'boolean')
+                            throw new Error('Codex account response is invalid');
+                        const account = result.account === null ? null : record(result.account, 'Codex account');
+                        let accountScopeDigest = null;
+                        if (account?.type === 'chatgpt' && typeof account.email === 'string' && account.email.length > 0 && account.email.length <= 320 && typeof account.planType === 'string') {
+                            accountScopeDigest = digest(input.key, `chatgpt\0${account.email}\0${account.planType}`);
+                        }
+                        finish(undefined, { provenance: 'codex-app-server-config-account', configDigest: configDigest,
+                            accountState: accountScopeDigest ? 'identified' : 'unverified', accountScopeDigest, inferenceDispatched: false });
+                    }
+                }
+                catch {
+                    finish(new Error('Codex machine response is invalid'));
+                }
+            }
+        });
+        send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'awm', title: 'AWM machine discovery', version: '1.0.0' } } });
+    });
+}

package/dist/src/core/model-policy/native-codex-rollout.js

@@ -0,0 +1,111 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeCodexRolloutSelection = normalizeCodexRolloutSelection;
+exports.readCodexRolloutSelection = readCodexRolloutSelection;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+function record(value, name) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${name} must be an object`);
+    return value;
+}
+function boundedText(value, name) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(value))
+        throw new Error(`${name} is invalid`);
+    return value;
+}
+/** Normalize only the two metadata records from a locally verified Codex
+ * rollout. The private format is version-sensitive; unknown shapes remain
+ * UNTESTED rather than being promoted from thread configuration. */
+function normalizeCodexRolloutSelection(events, expected) {
+    if (!expected || typeof expected !== 'object')
+        throw new Error('Codex rollout identity is required');
+    const parentThreadId = boundedText(expected.parentThreadId, 'Codex parent thread id');
+    const childThreadId = boundedText(expected.childThreadId, 'Codex child thread id');
+    const turnId = boundedText(expected.turnId, 'Codex turn id');
+    if (!Array.isArray(events) || events.length === 0 || events.length > 10000)
+        throw new Error('Codex rollout events are invalid');
+    let cliVersion;
+    let selection;
+    let observedAt;
+    for (const raw of events) {
+        const event = record(raw, 'Codex rollout event');
+        if (event.type === 'session_meta') {
+            if (cliVersion !== undefined)
+                throw new Error('Codex rollout has duplicate session metadata');
+            const payload = record(event.payload, 'Codex session metadata');
+            if (boundedText(payload.id, 'Codex metadata child id') !== childThreadId)
+                throw new Error('Codex rollout child id mismatch');
+            const source = record(payload.source, 'Codex session source');
+            const subagent = record(source.subagent, 'Codex subagent source');
+            const spawn = record(subagent.thread_spawn, 'Codex thread spawn source');
+            if (boundedText(spawn.parent_thread_id, 'Codex metadata parent id') !== parentThreadId)
+                throw new Error('Codex rollout parent id mismatch');
+            cliVersion = boundedText(payload.cli_version, 'Codex rollout CLI version');
+            if (!/^\d+\.\d+\.\d+$/.test(cliVersion))
+                throw new Error('Codex rollout CLI version is invalid');
+        }
+        if (event.type === 'turn_context') {
+            const payload = record(event.payload, 'Codex turn context');
+            if (boundedText(payload.turn_id, 'Codex turn context id') !== turnId)
+                continue;
+            if (selection !== undefined)
+                throw new Error('Codex rollout has duplicate turn context');
+            if (typeof event.timestamp !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(event.timestamp)
+                || !Number.isFinite(Date.parse(event.timestamp)))
+                throw new Error('Codex turn timestamp is invalid');
+            observedAt = new Date(event.timestamp).toISOString();
+            selection = { selector: { kind: 'model', id: boundedText(payload.model, 'Codex turn model') },
+                effort: { kind: 'explicit', value: boundedText(payload.effort, 'Codex turn effort') } };
+        }
+    }
+    if (cliVersion === undefined)
+        throw new Error('Codex rollout session metadata is missing');
+    if (selection === undefined || observedAt === undefined)
+        throw new Error('Codex rollout turn context is missing');
+    return { provenance: 'codex-rollout-turn-context', cliVersion, observedAt, configuredSelection: selection, actualModelVerified: false };
+}
+const MAX_ROLLOUT_BYTES = 16 * 1024 * 1024;
+const METADATA_LINE = /"type"\s*:\s*"(?:session_meta|turn_context)"/;
+/** Read only the validated local Codex sessions tree; return no transcript or
+ * account data. A private-format change fails closed as UNTESTED to callers. */
+function readCodexRolloutSelection(input) {
+    if (!input || typeof input !== 'object' || typeof input.codexHome !== 'string' || typeof input.file !== 'string'
+        || !path_1.default.isAbsolute(input.codexHome) || !path_1.default.isAbsolute(input.file)
+        || path_1.default.normalize(input.codexHome) !== input.codexHome || path_1.default.normalize(input.file) !== input.file
+        || input.codexHome.includes('\0') || input.file.includes('\0'))
+        throw new Error('Codex rollout paths are invalid');
+    const sessions = path_1.default.join(input.codexHome, 'sessions');
+    const relative = path_1.default.relative(sessions, input.file);
+    if (!relative || relative === '..' || relative.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(relative))
+        throw new Error('Codex rollout is outside sessions');
+    for (let candidate = path_1.default.dirname(input.file);; candidate = path_1.default.dirname(candidate)) {
+        const stat = fs_1.default.lstatSync(candidate);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('Codex rollout has an unsafe or symlinked ancestor');
+        if (candidate === input.codexHome)
+            break;
+        if (candidate === path_1.default.dirname(candidate))
+            throw new Error('Codex rollout root is invalid');
+    }
+    const stat = fs_1.default.lstatSync(input.file);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('Codex rollout is unsafe or symlinked');
+    const bytes = native_bridge_1.secureFs.readRegularFile(input.file, MAX_ROLLOUT_BYTES).bytes;
+    const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    const events = [];
+    for (const line of text.split('\n')) {
+        if (!METADATA_LINE.test(line))
+            continue;
+        if (line.length > 256 * 1024)
+            throw new Error('Codex rollout metadata line exceeds 256 KiB');
+        events.push(JSON.parse(line));
+        if (events.length > 10000)
+            throw new Error('Codex rollout has too many metadata events');
+    }
+    return normalizeCodexRolloutSelection(events, input.expected);
+}