approval-md 0.1.0 → 0.2.0

package/dist/src/codex/doctor.js

@@ -0,0 +1,41 @@
+import { resolve } from "node:path";
+import { checkCodexInstance, readCodexInstance } from "./manifest.js";
+import { diagnoseCodexInstance } from "./trust.js";
+export function strictDoctor(path, options = {}) {
+    const actualPath = resolve(path);
+    const read = readCodexInstance(actualPath);
+    if (!read.ok) {
+        return {
+            ok: false,
+            ready: false,
+            code: "manifest-invalid",
+            message: read.errors.map((error) => `${error.path || "/"}: ${error.message}`).join("; "),
+        };
+    }
+    if (read.manifest.paths.manifest !== actualPath) {
+        return {
+            ok: false,
+            ready: false,
+            code: "manifest-path-drift",
+            message: `manifest was read from ${actualPath}, but pins ${read.manifest.paths.manifest}`,
+        };
+    }
+    const checked = checkCodexInstance(read.manifest);
+    if (!checked.ok) {
+        return {
+            ok: false,
+            ready: false,
+            code: "manifest-invalid",
+            message: checked.errors.map((error) => `${error.path || "/"}: ${error.message}`).join("; "),
+        };
+    }
+    const report = diagnoseCodexInstance(checked.manifest, options);
+    return {
+        ok: false,
+        ready: false,
+        code: "codex-not-ready",
+        message: "strict Codex enforcement is not ready; inspect findings",
+        report,
+    };
+}
+//# sourceMappingURL=doctor.js.map

package/dist/src/codex/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/codex/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAwC,MAAM,YAAY,CAAC;AAMzF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAO,GAAiB,EAAE;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SACzF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0BAA0B,UAAU,cAAc,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE;SAC1F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC5F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,yDAAyD;QAClE,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/src/codex/manifest.d.ts

@@ -0,0 +1,49 @@
+import { type ValidationError } from "../core/validate.js";
+export declare const CODEX_INSTANCE_SCHEMA_VERSION: "approval.codex.instance.v1";
+export declare const SUPPORTED_CODEX_VERSION: "0.152.1";
+export declare const SUPPORTED_CODEX_PLATFORM: "darwin";
+export interface CodexInstancePaths {
+    install_root: string;
+    package_root: string;
+    workspace: string;
+    primary: string;
+    policy: string;
+    log: string;
+    manifest: string;
+    codex_executable: string;
+    node_executable: string;
+    mcp_executable: string;
+    broker_executable: string;
+    runner_executable: string;
+}
+export interface CodexInstanceManifest {
+    schema_version: typeof CODEX_INSTANCE_SCHEMA_VERSION;
+    instance_id: string;
+    platform: typeof SUPPORTED_CODEX_PLATFORM;
+    codex_version: typeof SUPPORTED_CODEX_VERSION;
+    node_version: string;
+    package_version: string;
+    paths: CodexInstancePaths;
+    principals: {
+        codex: "_approval_codex";
+        broker: "_approval_broker";
+        runner: "_approval_runner";
+    };
+    invocation: {
+        command: string;
+        args: [string, string, string, string];
+    };
+    components: {
+        broker: "required-not-shipped";
+        runner: "required-not-shipped";
+    };
+}
+export type ManifestCheck = {
+    ok: true;
+    manifest: CodexInstanceManifest;
+} | {
+    ok: false;
+    errors: ValidationError[];
+};
+export declare function checkCodexInstance(value: unknown): ManifestCheck;
+export declare function readCodexInstance(path: string): ManifestCheck;

package/dist/src/codex/manifest.js

@@ -0,0 +1,103 @@
+import { readFileSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { validate } from "../core/validate.js";
+export const CODEX_INSTANCE_SCHEMA_VERSION = "approval.codex.instance.v1";
+export const SUPPORTED_CODEX_VERSION = "0.152.1";
+export const SUPPORTED_CODEX_PLATFORM = "darwin";
+function within(parent, child) {
+    const rel = relative(parent, child);
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+function normalizedAbsolute(value) {
+    return isAbsolute(value) && resolve(value) === value && !value.includes("\u0000");
+}
+function semanticErrors(manifest) {
+    const errors = [];
+    const add = (path, message) => {
+        errors.push({ path, keyword: "codexInstance", message });
+    };
+    for (const [name, value] of Object.entries(manifest.paths)) {
+        if (!normalizedAbsolute(value))
+            add(`/paths/${name}`, "must be a normalized absolute path");
+    }
+    const { paths } = manifest;
+    const roots = [
+        ["workspace", paths.workspace],
+        ["primary", paths.primary],
+        ["install_root", paths.install_root],
+    ];
+    for (let left = 0; left < roots.length; left += 1) {
+        for (let right = left + 1; right < roots.length; right += 1) {
+            const a = roots[left];
+            const b = roots[right];
+            if (within(a[1], b[1]) || within(b[1], a[1])) {
+                add("/paths", `${a[0]} and ${b[0]} must be disjoint and may not contain one another`);
+            }
+        }
+    }
+    if (!within(paths.primary, paths.policy) || paths.policy === paths.primary) {
+        add("/paths/policy", "must be a file below primary");
+    }
+    if (!within(paths.primary, paths.log) || paths.log === paths.primary) {
+        add("/paths/log", "must be a file below primary");
+    }
+    for (const name of [
+        "package_root",
+        "manifest",
+        "codex_executable",
+        "node_executable",
+        "mcp_executable",
+        "broker_executable",
+        "runner_executable",
+    ]) {
+        const value = paths[name];
+        if (!within(paths.install_root, value) || value === paths.install_root) {
+            add(`/paths/${name}`, "must be below install_root");
+        }
+    }
+    const nodeMajor = Number.parseInt(manifest.node_version.split(".")[0] ?? "", 10);
+    if (!Number.isSafeInteger(nodeMajor) || nodeMajor < 20)
+        add("/node_version", "Node 20 or newer is required");
+    const executablePaths = new Set([
+        paths.codex_executable,
+        paths.node_executable,
+        paths.mcp_executable,
+        paths.broker_executable,
+        paths.runner_executable,
+    ]);
+    if (executablePaths.size !== 5)
+        add("/paths", "Codex, Node, MCP, broker and runner executables must be distinct");
+    const expectedArgs = ["codex", "serve", "--manifest", paths.manifest];
+    if (manifest.invocation.command !== paths.mcp_executable ||
+        manifest.invocation.args.length !== expectedArgs.length ||
+        manifest.invocation.args.some((value, index) => value !== expectedArgs[index])) {
+        add("/invocation", "must exactly invoke the pinned MCP executable as codex serve --manifest <manifest>");
+    }
+    return errors;
+}
+export function checkCodexInstance(value) {
+    const checked = validate("codex-instance", value);
+    if (!checked.ok)
+        return checked;
+    const manifest = value;
+    const errors = semanticErrors(manifest);
+    return errors.length === 0 ? { ok: true, manifest } : { ok: false, errors };
+}
+export function readCodexInstance(path) {
+    let value;
+    try {
+        value = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            errors: [{
+                    path: "",
+                    keyword: "manifestRead",
+                    message: cause instanceof Error ? cause.message : String(cause),
+                }],
+        };
+    }
+    return checkCodexInstance(value);
+}
+//# sourceMappingURL=manifest.js.map

package/dist/src/codex/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/codex/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,QAAQ,EAAwB,MAAM,qBAAqB,CAAC;AAErE,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAAqC,CAAC;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAkB,CAAC;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAiB,CAAC;AAyC1D,SAAS,MAAM,CAAC,MAAc,EAAE,KAAa;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,QAA+B;IACrD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAQ,EAAE;QAClD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG;QACZ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;QAC9B,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;KAC5B,CAAC;IACX,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAClD,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAA2B,CAAC;YAChD,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAA2B,CAAC;YACjD,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3E,GAAG,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACrE,GAAG,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI;QACjB,cAAc;QACd,UAAU;QACV,kBAAkB;QAClB,iBAAiB;QACjB,gBAAgB;QAChB,mBAAmB;QACnB,mBAAmB;KACX,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACvE,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,EAAE;QAAE,GAAG,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAC7G,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,eAAe;QACrB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,iBAAiB;KACxB,CAAC,CAAC;IACH,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,GAAG,CAAC,QAAQ,EAAE,kEAAkE,CAAC,CAAC;IAClH,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,IACE,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,cAAc;QACpD,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QACvD,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,EAC9E,CAAC;QACD,GAAG,CAAC,aAAa,EAAE,oFAAoF,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,KAA8B,CAAC;IAChD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC;oBACP,IAAI,EAAE,EAAE;oBACR,OAAO,EAAE,cAAc;oBACvB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAChE,CAAC;SACH,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/src/codex/templates.d.ts

@@ -0,0 +1,41 @@
+import { type CodexInstanceManifest } from "./manifest.js";
+export declare const CODEX_BUNDLE_VERSION = 1;
+export declare const CODEX_BUNDLE_FILES: readonly ["codex-instance.json", "requirements.toml", "managed_config.toml", "approval-codex-mcp", "approval-codex-start", "com.approval.codex-broker.plist", "com.approval.codex-runner.plist", "INSTALL.md"];
+export interface PrepareInput {
+    instanceId: string;
+    workspace: string;
+    primary: string;
+    installRoot: string;
+    output: string;
+    codexExecutable: string;
+    nodeExecutable: string;
+}
+export type PrepareResult = {
+    ok: true;
+    output: string;
+    manifest: CodexInstanceManifest;
+    files: string[];
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export interface BundleIndex {
+    version: 1;
+    files: Record<string, string>;
+}
+export declare function manifestFor(input: PrepareInput): CodexInstanceManifest;
+export declare function requirementsToml(manifest: CodexInstanceManifest): string;
+export declare function managedConfigToml(manifest: CodexInstanceManifest): string;
+export declare function renderBundle(manifest: CodexInstanceManifest): Record<string, string>;
+export declare function prepareBundle(input: PrepareInput): PrepareResult;
+export type BundleCheck = {
+    ok: true;
+    manifest: CodexInstanceManifest;
+    files: string[];
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function checkBundle(directory: string): BundleCheck;

package/dist/src/codex/templates.js

@@ -0,0 +1,319 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, lstatSync, readFileSync, realpathSync, readdirSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CODEX_INSTANCE_SCHEMA_VERSION, SUPPORTED_CODEX_PLATFORM, SUPPORTED_CODEX_VERSION, checkCodexInstance, } from "./manifest.js";
+export const CODEX_BUNDLE_VERSION = 1;
+export const CODEX_BUNDLE_FILES = [
+    "codex-instance.json",
+    "requirements.toml",
+    "managed_config.toml",
+    "approval-codex-mcp",
+    "approval-codex-start",
+    "com.approval.codex-broker.plist",
+    "com.approval.codex-runner.plist",
+    "INSTALL.md",
+];
+function quote(value) {
+    return JSON.stringify(value);
+}
+function xml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function packageVersion() {
+    const packageRoot = fileURLToPath(new URL("../../../", import.meta.url));
+    const value = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
+    if (typeof value.version !== "string")
+        throw new Error("installed package.json has no version");
+    return value.version;
+}
+export function manifestFor(input) {
+    const installRoot = resolve(input.installRoot);
+    const manifestPath = join(installRoot, "instances", `${input.instanceId}.json`);
+    const mcpExecutable = join(installRoot, "bin", "approval-codex-mcp");
+    return {
+        schema_version: CODEX_INSTANCE_SCHEMA_VERSION,
+        instance_id: input.instanceId,
+        platform: SUPPORTED_CODEX_PLATFORM,
+        codex_version: SUPPORTED_CODEX_VERSION,
+        node_version: process.versions.node,
+        package_version: packageVersion(),
+        paths: {
+            install_root: installRoot,
+            package_root: join(installRoot, "package"),
+            workspace: resolve(input.workspace),
+            primary: resolve(input.primary),
+            policy: join(resolve(input.primary), "APPROVAL.md"),
+            log: join(resolve(input.primary), ".approval", "log", "events.jsonl"),
+            manifest: manifestPath,
+            codex_executable: resolve(input.codexExecutable),
+            node_executable: resolve(input.nodeExecutable),
+            mcp_executable: mcpExecutable,
+            broker_executable: join(installRoot, "bin", "approval-codex-broker"),
+            runner_executable: join(installRoot, "bin", "approval-codex-runner"),
+        },
+        principals: {
+            codex: "_approval_codex",
+            broker: "_approval_broker",
+            runner: "_approval_runner",
+        },
+        invocation: {
+            command: mcpExecutable,
+            args: ["codex", "serve", "--manifest", manifestPath],
+        },
+        components: {
+            broker: "required-not-shipped",
+            runner: "required-not-shipped",
+        },
+    };
+}
+export function requirementsToml(manifest) {
+    const rules = manifest.invocation.args
+        .map((value) => `  { match = "exact", value = ${quote(value)} },`)
+        .join("\n");
+    return `# INERT REVIEW ARTIFACT. Installing this file is a human/MDM action.
+allowed_approval_policies = ["never"]
+allowed_web_search_modes = ["disabled"]
+default_permissions = "approval-codex-readonly"
+allow_managed_hooks_only = true
+allow_remote_control = false
+
+[allowed_permission_profiles]
+approval-codex-readonly = true
+
+[permissions.approval-codex-readonly.filesystem]
+":root" = "deny"
+":minimal" = "read"
+
+[permissions.approval-codex-readonly.filesystem.":workspace_roots"]
+"." = "read"
+
+[permissions.approval-codex-readonly.network]
+enabled = false
+
+[features]
+apps = false
+browser_use = false
+browser_use_external = false
+browser_use_full_cdp_access = false
+computer_use = false
+in_app_browser = false
+plugins = false
+web_search = false
+
+[mcp_servers.approval-codex.identity]
+command = { executable = ${quote(manifest.invocation.command)}, args = [
+${rules}
+] }
+`;
+}
+export function managedConfigToml(manifest) {
+    const args = manifest.invocation.args.map(quote).join(", ");
+    return `# INERT REVIEW ARTIFACT. This enables only the pinned strict MCP shim.
+[mcp_servers.approval-codex]
+command = ${quote(manifest.invocation.command)}
+args = [${args}]
+required = true
+`;
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\"'\"'")}'`;
+}
+function launcher(manifest, mode) {
+    const cli = join(manifest.paths.package_root, "cli.js");
+    const prefix = `exec /usr/bin/env -i PATH=/usr/bin:/bin HOME=/var/empty TMPDIR=/tmp ${shellQuote(manifest.paths.node_executable)} ${shellQuote(cli)}`;
+    const command = mode === "serve"
+        ? `if [ "$#" -ne 4 ] || [ "$1" != 'codex' ] || [ "$2" != 'serve' ] || [ "$3" != '--manifest' ] || [ "$4" != ${shellQuote(manifest.paths.manifest)} ]; then exit 2; fi
+${prefix} codex serve --manifest ${shellQuote(manifest.paths.manifest)}`
+        : `if [ "$#" -ne 0 ]; then exit 2; fi\n${prefix} codex start --manifest ${shellQuote(manifest.paths.manifest)}`;
+    return `#!/bin/sh
+# INERT until installed root-owned with the complete APRV-325 broker/runner.
+cd ${shellQuote(manifest.paths.package_root)} || exit 1
+${command}
+`;
+}
+function plist(manifest, component) {
+    const executable = component === "broker" ? manifest.paths.broker_executable : manifest.paths.runner_executable;
+    const principal = component === "broker" ? manifest.principals.broker : manifest.principals.runner;
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.approval.codex-${component}</string>
+  <key>ProgramArguments</key><array>
+    <string>${xml(executable)}</string>
+    <string>--manifest</string>
+    <string>${xml(manifest.paths.manifest)}</string>
+  </array>
+  <key>UserName</key><string>${principal}</string>
+  <key>RunAtLoad</key><false/>
+</dict></plist>
+`;
+}
+function installGuide(manifest) {
+    return `# Constrained Codex instance ${manifest.instance_id}
+
+This bundle is inert. It does not create users, install files, load launchd
+services, edit /etc/codex, authenticate Codex, start an executor, or change
+approval.md policy.
+
+The broker and runner are deliberately marked required-not-shipped. Do not
+install or start this bundle until APRV-325.2 and APRV-325.3 replace those
+placeholders and strict doctor reports ready.
+
+Target install root: ${manifest.paths.install_root}
+Canonical workspace: ${manifest.paths.workspace}
+Primary gate checkout: ${manifest.paths.primary}
+
+Review bundle-sha256.json, then run:
+  approval codex setup --check <this-directory>
+  approval codex doctor --manifest ${manifest.paths.manifest}
+
+A passing setup check proves only that this review bundle is internally
+consistent. It does not prove host custody or enforcement.
+`;
+}
+export function renderBundle(manifest) {
+    return {
+        "codex-instance.json": `${JSON.stringify(manifest, null, 2)}\n`,
+        "requirements.toml": requirementsToml(manifest),
+        "managed_config.toml": managedConfigToml(manifest),
+        "approval-codex-mcp": launcher(manifest, "serve"),
+        "approval-codex-start": launcher(manifest, "start"),
+        "com.approval.codex-broker.plist": plist(manifest, "broker"),
+        "com.approval.codex-runner.plist": plist(manifest, "runner"),
+        "INSTALL.md": installGuide(manifest),
+    };
+}
+export function prepareBundle(input) {
+    let manifest;
+    try {
+        manifest = manifestFor(input);
+    }
+    catch (cause) {
+        return { ok: false, code: "package-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    const checked = checkCodexInstance(manifest);
+    if (!checked.ok) {
+        return {
+            ok: false,
+            code: "manifest-invalid",
+            message: checked.errors.map((error) => `${error.path || "/"}: ${error.message}`).join("; "),
+        };
+    }
+    let output;
+    try {
+        const requestedOutput = resolve(input.output);
+        output = join(realpathSync(dirname(requestedOutput)), basename(requestedOutput));
+    }
+    catch (cause) {
+        return { ok: false, code: "prepare-failed", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    const roots = [manifest.paths.workspace, manifest.paths.primary, manifest.paths.install_root];
+    if (roots.some((root) => output === root || output.startsWith(`${root}/`) || root.startsWith(`${output}/`))) {
+        return { ok: false, code: "output-overlap", message: "preparation output must be disjoint from workspace, primary and install roots" };
+    }
+    try {
+        mkdirSync(output);
+        const rendered = renderBundle(manifest);
+        for (const [name, content] of Object.entries(rendered)) {
+            writeFileSync(join(output, name), content, {
+                encoding: "utf8",
+                mode: name.startsWith("approval-codex-") ? 0o755 : 0o644,
+                flag: "wx",
+            });
+        }
+        const index = { version: CODEX_BUNDLE_VERSION, files: {} };
+        for (const name of CODEX_BUNDLE_FILES) {
+            index.files[name] = sha256(readFileSync(join(output, name)));
+        }
+        writeFileSync(join(output, "bundle-sha256.json"), `${JSON.stringify(index, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o644,
+            flag: "wx",
+        });
+        return { ok: true, output, manifest, files: [...CODEX_BUNDLE_FILES, "bundle-sha256.json"] };
+    }
+    catch (cause) {
+        return { ok: false, code: "prepare-failed", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+}
+export function checkBundle(directory) {
+    const root = resolve(directory);
+    try {
+        if (!lstatSync(root).isDirectory() || realpathSync(root) !== root) {
+            return { ok: false, code: "bundle-root-unsafe", message: "bundle root must be a canonical directory, not a symlink" };
+        }
+        if (!lstatSync(join(root, "bundle-sha256.json")).isFile()) {
+            return { ok: false, code: "bundle-index-unreadable", message: "bundle-sha256.json must be a regular file" };
+        }
+    }
+    catch (cause) {
+        return { ok: false, code: "bundle-index-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    let index;
+    try {
+        index = JSON.parse(readFileSync(join(root, "bundle-sha256.json"), "utf8"));
+    }
+    catch (cause) {
+        return { ok: false, code: "bundle-index-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    if (index.version !== CODEX_BUNDLE_VERSION ||
+        typeof index.files !== "object" ||
+        index.files === null ||
+        Array.isArray(index.files)) {
+        return { ok: false, code: "bundle-index-invalid", message: "bundle-sha256.json has an unsupported shape or version" };
+    }
+    const expected = [...CODEX_BUNDLE_FILES].sort();
+    const actual = Object.keys(index.files).sort();
+    if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+        return { ok: false, code: "bundle-file-set", message: "bundle index must name the exact required file set" };
+    }
+    try {
+        const disk = readdirSync(root).sort();
+        const allowed = [...expected, "bundle-sha256.json"].sort();
+        if (JSON.stringify(disk) !== JSON.stringify(allowed)) {
+            return { ok: false, code: "bundle-file-set", message: "bundle directory must contain only the indexed files and bundle-sha256.json" };
+        }
+        for (const name of expected) {
+            if (!lstatSync(join(root, name)).isFile()) {
+                return { ok: false, code: "bundle-file-type", message: `${name} must be a regular file, not a symlink or directory` };
+            }
+            if (index.files[name] !== sha256(readFileSync(join(root, name)))) {
+                return { ok: false, code: "bundle-hash-mismatch", message: `${name} does not match bundle-sha256.json` };
+            }
+        }
+    }
+    catch (cause) {
+        return { ok: false, code: "bundle-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    let manifestValue;
+    try {
+        manifestValue = JSON.parse(readFileSync(join(root, "codex-instance.json"), "utf8"));
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            code: "manifest-invalid",
+            message: cause instanceof Error ? cause.message : String(cause),
+        };
+    }
+    const checked = checkCodexInstance(manifestValue);
+    if (!checked.ok) {
+        return { ok: false, code: "manifest-invalid", message: checked.errors.map((error) => error.message).join("; ") };
+    }
+    const expectedRendered = renderBundle(checked.manifest);
+    for (const [name, content] of Object.entries(expectedRendered)) {
+        if (readFileSync(join(root, name), "utf8") !== content) {
+            return { ok: false, code: "bundle-template-drift", message: `${name} does not match the manifest-derived template` };
+        }
+    }
+    return { ok: true, manifest: checked.manifest, files: [...expected, "bundle-sha256.json"] };
+}
+//# sourceMappingURL=templates.js.map

package/dist/src/codex/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/codex/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,iCAAiC;IACjC,iCAAiC;IACjC,YAAY;CACJ,CAAC;AAqBX,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAE/E,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,OAAO,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACrE,OAAO;QACL,cAAc,EAAE,6BAA6B;QAC7C,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,QAAQ,EAAE,wBAAwB;QAClC,aAAa,EAAE,uBAAuB;QACtC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QACnC,eAAe,EAAE,cAAc,EAAE;QACjC,KAAK,EAAE;YACL,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAC1C,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;YACnD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,CAAC;YACrE,QAAQ,EAAE,YAAY;YACtB,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YAChD,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;YAC9C,cAAc,EAAE,aAAa;YAC7B,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,uBAAuB,CAAC;YACpE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,uBAAuB,CAAC;SACrE;QACD,UAAU,EAAE;YACV,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,kBAAkB;SAC3B;QACD,UAAU,EAAE;YACV,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC;SACrD;QACD,UAAU,EAAE;YACV,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,sBAAsB;SAC/B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA+B;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;SACjE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BA+BkB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;EAC3D,KAAK;;CAEN,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA+B;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO;;YAEG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;UACpC,IAAI;;CAEb,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,QAA+B,EAAE,IAAuB;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,uEAAuE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACtJ,MAAM,OAAO,GACX,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,4GAA4G,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;EACrJ,MAAM,2BAA2B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAClE,CAAC,CAAC,uCAAuC,MAAM,2BAA2B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpH,OAAO;;KAEJ,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;EAC1C,OAAO;CACR,CAAC;AACF,CAAC;AAED,SAAS,KAAK,CAAC,QAA+B,EAAE,SAA8B;IAC5E,MAAM,UAAU,GACd,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC/F,MAAM,SAAS,GACb,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;IACnF,OAAO;;;+CAGsC,SAAS;;cAE1C,GAAG,CAAC,UAAU,CAAC;;cAEf,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;;+BAEX,SAAS;;;CAGvC,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,QAA+B;IACnD,OAAO,gCAAgC,QAAQ,CAAC,WAAW;;;;;;;;;;uBAUtC,QAAQ,CAAC,KAAK,CAAC,YAAY;uBAC3B,QAAQ,CAAC,KAAK,CAAC,SAAS;yBACtB,QAAQ,CAAC,KAAK,CAAC,OAAO;;;;qCAIV,QAAQ,CAAC,KAAK,CAAC,QAAQ;;;;CAI3D,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA+B;IAC1D,OAAO;QACL,qBAAqB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC/D,mBAAmB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QAC/C,qBAAqB,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAClD,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QACjD,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnD,iCAAiC,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5D,iCAAiC,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5D,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,IAAI,QAA+B,CAAC;IACpC,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACpH,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC5F,CAAC;IACJ,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+EAA+E,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE;gBACzC,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;gBACxD,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAChH,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;QACxH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;QAC9G,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAgB,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,IACE,KAAK,CAAC,OAAO,KAAK,oBAAoB;QACtC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,KAAK,CAAC,KAAK,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACxH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,6EAA6E,EAAE,CAAC;QACxI,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,IAAI,qDAAqD,EAAE,CAAC;YACxH,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,GAAG,IAAI,oCAAoC,EAAE,CAAC;YAC3G,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,aAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,IAAI,+CAA+C,EAAE,CAAC;QACvH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,oBAAoB,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/src/codex/trust.d.ts

@@ -0,0 +1,19 @@
+import type { CodexInstanceManifest } from "./manifest.js";
+export interface DoctorFinding {
+    code: string;
+    path?: string;
+    message: string;
+}
+export interface DoctorReport {
+    ok: false;
+    ready: false;
+    findings: DoctorFinding[];
+}
+export interface TrustOptions {
+    platform?: NodeJS.Platform;
+    resolveUid?: (name: string) => number | null;
+    groupsFor?: (name: string) => number[] | null;
+}
+export declare function parseCodexVersionOutput(stdout: string, stderr: string): string | null;
+export declare function parseNodeVersionOutput(stdout: string, stderr: string): string | null;
+export declare function diagnoseCodexInstance(manifest: CodexInstanceManifest, options?: TrustOptions): DoctorReport;