baychat 0.33.3 → 0.34.1

package/dist/relay/codex-app-server.js

@@ -29,6 +29,8 @@
 // does not acquire privileges on their behalf.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCodexTurn = runCodexTurn;
+exports.readCodexRateLimits = readCodexRateLimits;
+exports.parseCodexRateLimits = parseCodexRateLimits;
 const runtime_binary_1 = require("../runtime-binary");
 const spawn_env_1 = require("./spawn-env");
 /** How long a whole wake may take — resume, turn, and completion. */
@@ -248,3 +250,103 @@ function firstLine(text) {
     }
     return "";
 }
+/**
+ * Read the Codex account's rate limits through `codex app-server` (`account/rateLimits/read`) —
+ * the one reader both the session-lifecycle batch and Phase 1's limits report use (2026-10-22, so
+ * the two never write it twice). One short-lived process, like a wake, and no thread is touched.
+ *
+ * Resolves null rather than throwing: a Codex too old for the method, not logged in, or not
+ * answering in time has no limits to show, and that is not an error anyone can act on.
+ */
+function readCodexRateLimits(binaryPath, deps) {
+    const timeout = deps.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+    return new Promise((resolve) => {
+        const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform), ["app-server"]);
+        if (!run.ok)
+            return resolve(null);
+        const child = deps.spawn(run.file, run.args, {
+            windowsHide: true,
+            windowsVerbatimArguments: run.verbatim,
+            env: (0, spawn_env_1.headlessSpawnEnv)(),
+            shell: false,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let settled = false;
+        let buffer = "";
+        const finish = (limits) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.kill("SIGTERM");
+            setTimeout(() => child.kill("SIGKILL"), 5_000).unref();
+            resolve(limits);
+        };
+        const timer = setTimeout(() => finish(null), timeout);
+        const send = (message) => {
+            child.stdin?.write(`${JSON.stringify({ jsonrpc: "2.0", ...message })}\n`);
+        };
+        child.stdout?.on("data", (chunk) => {
+            buffer += chunk.toString();
+            let newline = buffer.indexOf("\n");
+            while (newline >= 0) {
+                const line = buffer.slice(0, newline).trim();
+                buffer = buffer.slice(newline + 1);
+                newline = buffer.indexOf("\n");
+                let message;
+                try {
+                    message = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (message.id === 0) {
+                    if (message.error)
+                        return finish(null);
+                    send({ method: "initialized", params: {} });
+                    send({ id: 1, method: "account/rateLimits/read", params: {} });
+                }
+                else if (message.id === 1) {
+                    return finish(message.error ? null : parseCodexRateLimits(message.result));
+                }
+            }
+        });
+        // A child that died before reading: its stdin errors (EPIPE), which must not crash the relay.
+        child.stdin?.on("error", () => finish(null));
+        // Read and dropped, so a chatty Codex never fills the pipe and stalls before it answers.
+        child.stderr?.on("data", () => { });
+        child.on("error", () => finish(null));
+        child.on("close", () => finish(null));
+        send({ id: 0, method: "initialize", params: { clientInfo: { name: "baychat-relay", title: "BayChat relay", version: CLIENT_VERSION } } });
+    });
+}
+/**
+ * The method's answer, read defensively: `{rateLimits: {primary, secondary, planType}}`, each
+ * window `{usedPercent, windowDurationMins, resetsAt}` (resetsAt in unix seconds). snake_case
+ * spellings of older builds are read too. Anything unreadable is left out, never guessed.
+ */
+function parseCodexRateLimits(raw) {
+    const outer = (raw ?? {});
+    const limits = ((outer.rateLimits ?? outer.rate_limits ?? outer) ?? {});
+    const windows = [];
+    for (const kind of ["primary", "secondary"]) {
+        const w = limits[kind];
+        if (!w || typeof w !== "object")
+            continue;
+        const used = Number(w.usedPercent ?? w.used_percent);
+        if (!Number.isFinite(used))
+            continue;
+        const minutes = Number(w.windowDurationMins ?? w.window_minutes);
+        const resets = Number(w.resetsAt ?? w.resets_at);
+        windows.push({
+            kind,
+            usedPercent: used,
+            ...(Number.isFinite(minutes) && minutes > 0 ? { windowMinutes: minutes } : {}),
+            ...(Number.isFinite(resets) && resets > 0 ? { resetsAt: new Date(resets * 1000).toISOString() } : {}),
+        });
+    }
+    const plan = limits.planType ?? limits.plan_type;
+    if (windows.length === 0)
+        return null;
+    return { windows, ...(typeof plan === "string" && plan ? { plan } : {}) };
+}

package/dist/relay/daemon.js

@@ -55,6 +55,7 @@ const context_notice_1 = require("./context-notice");
 const fresh_start_verify_1 = require("./fresh-start-verify");
 const commands_1 = require("./acp/commands");
 const daemon_glue_1 = require("./acp/daemon-glue");
+const presence_1 = require("./acp/presence");
 const runner_1 = require("./acp/runner");
 const turn_queue_1 = require("./acp/turn-queue");
 const session_reply_1 = require("./session-reply");
@@ -73,6 +74,7 @@ const socket_1 = require("./socket");
 const transport_1 = require("./transport");
 const watermarks_1 = require("./watermarks");
 const bay_relays_1 = require("./bay-relays");
+const acp_launch_1 = require("./launcher/acp-launch");
 const loop_1 = require("./launcher/loop");
 const log_line_1 = require("./log-line");
 const handle_1 = require("./launcher/handle");
@@ -93,6 +95,8 @@ class RelayDaemon {
     acpQueue = new turn_queue_1.AcpTurnQueue();
     acp;
     acpAlive;
+    /** The device MCP connection the relay joins its own (ACP) sessions with (tests inject one). */
+    acpCallerFn;
     /** How full each session's context is, as its runtime reports it (contract §7). */
     context;
     /** Reads each Codex session's own rollout for its context numbers. */
@@ -280,6 +284,7 @@ class RelayDaemon {
             conversationFor: (session) => this.lastRoom.get(session),
             log: (line) => this.log(line),
         });
+        this.acpCallerFn = opts.acpCaller ?? presence_1.deviceMcpCaller;
         this.acpAlive = (0, daemon_glue_1.acpKeepAliveScheduler)(() => (0, daemon_glue_1.keepAcpSessionsAlive)({ registry: this.registry, auth: this.auth, caller: opts.acpCaller, log: this.log }));
         this.acp = new runner_1.AcpSessionRunner({
             registry: this.registry,
@@ -373,6 +378,21 @@ class RelayDaemon {
                     if (this.registry.remove(name))
                         this.log(`session ${name} stopped by its launcher: forgotten`);
                 },
+                // End from the app on a session opened by hand: the pane it registered here.
+                registeredSession: (name) => this.registry.get(name),
+                // "Start again" for those sessions: the launch spot each runs in.
+                registeredSessions: () => this.registry.all(),
+                // dsh and Cursor started from the app: registered and run here, ended here.
+                acp: {
+                    start: (launch) => (0, acp_launch_1.launchAcpSession)(launch, {
+                        registry: this.registry,
+                        log: (line) => this.log(line),
+                        resolveBinary: this.resolveBinary,
+                        caller: () => (this.auth ? this.acpCallerFn(this.auth) : undefined),
+                    }),
+                    stop: (name) => (0, acp_launch_1.stopAcpSession)(name, { registry: this.registry, abort: (n) => void this.acp.stop(n), log: (line) => this.log(line) }),
+                    running: () => (0, acp_launch_1.launchedAcpSessions)(this.registry),
+                },
             }).catch((err) => this.log(`launcher stopped: ${err instanceof Error ? err.message : String(err)}`));
         }
         this.log(`listening on ${sockPath} (pid ${process.pid}) as device "${device.user.name}"`);
@@ -1626,7 +1646,14 @@ class RelayDaemon {
             (0, socket_1.writeFrame)(previous, { type: "error", message: channel_sessions_1.CHANNEL_REPLACED });
             previous.end();
         }
-        this.registry.replace({ name: frame.session, runtime: frame.runtime, delivery: "channel", pane: frame.pane, ownerPid: frame.ownerPid });
+        this.registry.replace({
+            name: frame.session,
+            runtime: frame.runtime,
+            delivery: "channel",
+            pane: frame.pane,
+            ownerPid: frame.ownerPid,
+            ...(typeof frame.cwd === "string" && frame.cwd ? { cwd: frame.cwd } : {}),
+        });
         this.channels.set(frame.session, sock);
         this.registry.setAttached(frame.session, true);
         (0, socket_1.writeFrame)(sock, { type: "attached", session: frame.session, delivery: "channel" });

package/dist/relay/launcher/acp-launch.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACP_LAUNCH_AGENTS = void 0;
+exports.isAcpLaunchRuntime = isAcpLaunchRuntime;
+exports.launchAcpSession = launchAcpSession;
+exports.launchedAcpSessions = launchedAcpSessions;
+exports.stopAcpSession = stopAcpSession;
+const agents_1 = require("../acp/agents");
+const daemon_glue_1 = require("../acp/daemon-glue");
+const policy_1 = require("../acp/policy");
+const presence_1 = require("../acp/presence");
+/**
+ * Starting a relay-run agent (DeepSeek's `dsh`, Cursor's `agent`) from the app (2026-10-22, the
+ * owner: "other runtimes, not just Claude"). There is no terminal to open: these agents are run
+ * by the relay itself, one process per turn over ACP. So a launch does what `baychat connect dsh`
+ * does at the computer — minus every question — and the session then answers from the chat.
+ *
+ * WHAT IT MAY WIDEN. The launch spot is already on this computer's launch allowlist (the owner ran
+ * `baychat launch add` for it, offering this runtime). The relay's own rule file lists agents and
+ * folders SEPARATELY, so listing an agent there would hand it every folder at that folder's
+ * ceiling: an agent the file does not list yet is refused (RUNTIME_NOT_CONNECTED — `baychat connect
+ * <agent>` at the computer). For a listed agent, a spot folder that no rule covers is added at the
+ * LOWEST ceiling, `chat` (answer, never act); a folder a rule already covers keeps its ceiling.
+ */
+/** The launch runtime → the relay's agent row id (Cursor's row is "cursor", its launch runtime "cursor-cli"). */
+exports.ACP_LAUNCH_AGENTS = { dsh: "dsh", "cursor-cli": "cursor" };
+function isAcpLaunchRuntime(runtime) {
+    return runtime !== null && runtime in exports.ACP_LAUNCH_AGENTS;
+}
+/** The mode a launched agent starts in, and the ceiling of a rule the launch adds. */
+const LAUNCH_MODE = "chat";
+const refused = (reason) => ({ status: "REFUSED", reason });
+async function launchAcpSession(launch, deps) {
+    const row = (0, agents_1.acpAgent)(exports.ACP_LAUNCH_AGENTS[launch.runtime]);
+    if (!row)
+        return refused("RUNTIME_NOT_OFFERED");
+    const existing = deps.registry.get(launch.session);
+    if (existing) {
+        // A terminal session of that name is somebody's own; a relay-run one of it is already running.
+        deps.log(`launch ${launch.launchId}: refused, "${launch.session}" is already a session on this computer`);
+        return refused(existing.acp ? "NAME_TAKEN" : "NAME_TAKEN_FOREIGN");
+    }
+    const binary = deps.resolveBinary(row.bin);
+    if (!binary.ok)
+        return refused("RUNTIME_MISSING");
+    try {
+        row.launch(LAUNCH_MODE, deps.patchDir ?? (0, agents_1.acpPatchDir)(), launch.session); // a name its config cannot hold throws
+    }
+    catch (err) {
+        deps.log(`launch ${launch.launchId}: refused, ${err instanceof Error ? err.message : String(err)}`);
+        return refused("NAME_INVALID");
+    }
+    const caller = deps.caller();
+    if (!caller)
+        return refused("BAY_NOT_CONNECTED");
+    const load = deps.loadPolicy ?? (() => (0, policy_1.loadPolicy)());
+    const policy = load();
+    if (!policy?.agents.includes(row.id)) {
+        deps.log(`launch ${launch.launchId}: refused, ${row.label} is not set up for the relay here. Run \`${row.connectCommand}\` at this computer.`);
+        return refused("RUNTIME_NOT_CONNECTED");
+    }
+    if (!(0, policy_1.checkFolder)(policy, row.id, launch.folder).ok) {
+        if (policy.roots.some((root) => root.path === launch.folder)) {
+            // A rule for exactly this folder that still does not pass: never rewrite it from here.
+            deps.log(`launch ${launch.launchId}: refused, the relay's rule for ${launch.folder} does not allow it now. Run \`${row.connectCommand}\` here.`);
+            return refused("RUNTIME_NOT_CONNECTED");
+        }
+        (deps.savePolicy ?? ((p) => (0, policy_1.savePolicy)(p)))((0, policy_1.upsertRoot)(policy, row.id, launch.folder, LAUNCH_MODE));
+        deps.log(`launch ${launch.launchId}: ${row.label} may now work in ${launch.folder} (ceiling ${LAUNCH_MODE}; raise it with \`${row.connectCommand}\`)`);
+    }
+    (0, agents_1.writeModePatch)(row, LAUNCH_MODE, launch.session, deps.patchDir ?? (0, agents_1.acpPatchDir)());
+    const room = !launch.join || "direct" in launch.join ? undefined : launch.join;
+    try {
+        await (0, presence_1.joinSession)(caller, launch.session, room);
+    }
+    catch (err) {
+        deps.log(`launch ${launch.launchId}: ${launch.session} could not join BayChat (${err instanceof Error ? err.message : String(err)})`);
+        return { status: "FAILED", reason: "JOIN_FAILED" };
+    }
+    const registered = (0, daemon_glue_1.registerAcpFrame)({ type: "acp-register", session: launch.session, runtime: row.id, runtimeBin: binary.path, acp: { agent: row.id, cwd: launch.folder, mode: LAUNCH_MODE } }, { registry: deps.registry, log: deps.log, resolveBinary: deps.resolveBinary, loadPolicy: load, platform: deps.platform });
+    if (!registered.ok) {
+        deps.log(`launch ${launch.launchId}: ${registered.message}`);
+        return { status: "FAILED", reason: "SPAWN_FAILED" };
+    }
+    deps.registry.upsert({ name: launch.session, runtime: row.id, launchedBy: launch.launchId });
+    deps.log(`launch ${launch.launchId}: started "${launch.session}" (${row.label}, ${LAUNCH_MODE}) in ${launch.folder}; the relay runs it from now on`);
+    return { status: "STARTED" };
+}
+/** The relay-run agents the app started that are still registered, for the launch caps. */
+function launchedAcpSessions(registry) {
+    return registry.all().flatMap((t) => (t.relayOwned && t.acp && t.launchedBy ? [{ name: t.name, cwd: t.acp.cwd }] : []));
+}
+/**
+ * End on a relay-run agent the app started: forget it, so the relay neither runs it again nor re-joins it (its
+ * keep-alive would otherwise bring an ended session straight back), and stop a turn in flight.
+ * Its rule and mode patches stay: they are the computer's, not the session's.
+ */
+function stopAcpSession(name, deps) {
+    const target = deps.registry.get(name);
+    // One set up with `baychat connect` at the computer is the computer's: End leaves it registered.
+    if (!target?.relayOwned || !target.acp || !target.launchedBy)
+        return false;
+    deps.abort(name);
+    deps.registry.remove(name);
+    deps.log(`acp: ${name} ended from BayChat; the relay no longer runs it`);
+    return true;
+}

package/dist/relay/launcher/argv.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UNATTENDED_NOTE = exports.LAUNCH_SESSION_PREFIX = void 0;
 exports.multiplexerSessionName = multiplexerSessionName;
 exports.baychatPrompt = baychatPrompt;
+exports.buildCodexLaunchCommand = buildCodexLaunchCommand;
 exports.buildLaunchCommand = buildLaunchCommand;
 exports.launchNameProblem = launchNameProblem;
 exports.roomTitleProblem = roomTitleProblem;
@@ -25,6 +26,7 @@ exports.roomTitleProblem = roomTitleProblem;
  */
 const detect_1 = require("../../channel/detect");
 const multiplexer_launch_1 = require("../../multiplexer-launch");
+const codex_launch_1 = require("./codex-launch");
 /** Every launcher-made multiplexer session is named `bc-<session name>`. */
 exports.LAUNCH_SESSION_PREFIX = "bc-";
 function multiplexerSessionName(sessionName) {
@@ -43,7 +45,9 @@ exports.UNATTENDED_NOTE = "(Started from the BayChat app: nobody is at this keyb
  * `ownConnection` (a relay on a setup of its own) the connection is named but no `--bay` is given:
  * that session has one login, so there is no Bay to choose.
  */
-function baychatPrompt(sessionName, join, bayEntry, ownConnection = false, channel = false) {
+function baychatPrompt(sessionName, join, bayEntry, ownConnection = false, channel = false, 
+/** How the runtime calls the skill: Claude Code `/baychat`, Codex `$baychat` (runtimes.ts). */
+invoke = "/baychat") {
     const room = !join ? "" : "sessions" in join ? " --sessions" : "direct" in join ? " --private" : ` --group "${join.group}"`;
     // An own connection (`baychat-relay`) is not a Bay: as `--bay` the session passed it on to the
     // channel's listen, which failed (Mac QA 2026-10-16). It is only named as the connection to use.
@@ -52,7 +56,19 @@ function baychatPrompt(sessionName, join, bayEntry, ownConnection = false, chann
     // listen_messages + Monitor (Mac QA 2026-10-16). Its channel is named as part of it.
     const ownChannel = ownConnection && channel ? ` and its channel (call mcp__${detect_1.CHANNEL_MCP_ENTRY}__listen first, with session "${sessionName}")` : "";
     const connection = bayEntry ? ` Use only the ${bayEntry} connection (its mcp__${bayEntry}__ tools)${ownChannel}.` : "";
-    return `/baychat ${sessionName}${room}${bay} ${exports.UNATTENDED_NOTE}${connection}`;
+    return `${invoke} ${sessionName}${room}${bay} ${exports.UNATTENDED_NOTE}${connection}`;
+}
+/**
+ * A launched Codex: the same detached `bc-<name>` session as Claude Code, its unattended flags
+ * (codex-launch.ts), and the `$baychat` line as its first prompt — one argv element, never a shell.
+ */
+function buildCodexLaunchCommand(input) {
+    const args = (0, multiplexer_launch_1.multiplexerArgv)(input.multiplexer, { kind: "detached", name: multiplexerSessionName(input.sessionName), cwd: input.folder }, {
+        binary: input.codexBin,
+        args: [...codex_launch_1.CODEX_UNATTENDED_FLAGS, baychatPrompt(input.sessionName, input.join, input.bayEntry, false, false, "$baychat")],
+        env: input.env,
+    });
+    return { file: input.multiplexer, args, cwd: input.folder, env: input.env };
 }
 function buildLaunchCommand(input) {
     const name = multiplexerSessionName(input.sessionName);

package/dist/relay/launcher/codex-launch.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_ROOM_ID_RE = exports.CODEX_UNATTENDED_FLAGS = void 0;
+exports.codexConfigPath = codexConfigPath;
+exports.codexLaunchProblem = codexLaunchProblem;
+exports.readCodexConfig = readCodexConfig;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Starting Codex from the app (2026-10-22). Codex runs in a detached `bc-<name>` tmux session like
+ * a launched Claude Code, and is told to join with its BayChat skill (`$baychat <name> …`). Once it
+ * joined with its thread id, the relay wakes it the way it wakes any open Codex: `codex queue`
+ * into that thread's own turn queue (docs/features/AGENT_RELAY.md, "Reachable while open").
+ *
+ * Nobody is at that keyboard, so anything Codex would stop and ask there waits forever. Two such
+ * questions are known before it starts, and refused instead of started into:
+ * - its BayChat MCP connection is missing (`baychat connect codex` never ran here): it could not
+ *   join, so the session would sit unjoined — RUNTIME_NOT_CONNECTED;
+ * - it has not trusted the folder ("Do you trust the files in this folder?") — FOLDER_NOT_TRUSTED.
+ * And it runs `--ask-for-approval never` inside the `workspace-write` sandbox with no network: it
+ * never stops to ask, and what the sandbox does not allow fails and is said in the chat instead.
+ * Because nobody approves anything, a spot allows it only after `baychat launch add … --unattended`
+ * at the computer (UNATTENDED_NOT_ALLOWED otherwise), and it joins only an existing group by id.
+ */
+/** Codex's flags for a session nobody sits at: never stops to ask, writes only its workspace, and
+ *  has no network whatever its config says (a room member who may wake it must not reach out). */
+exports.CODEX_UNATTENDED_FLAGS = [
+    "--sandbox",
+    "workspace-write",
+    "--ask-for-approval",
+    "never",
+    "-c",
+    "sandbox_workspace_write.network_access=false",
+];
+/** A group the Codex prompt may name: an id, never a title (a title is text other people chose,
+ *  and it would be read by Codex as part of its instructions). */
+exports.CODEX_ROOM_ID_RE = /^[a-z0-9]{20,40}$/;
+/** `$CODEX_HOME/config.toml`, else `~/.codex/config.toml` (a snap install's copy is the same file's twin). */
+function codexConfigPath(env = process.env) {
+    return path.join(env.CODEX_HOME || path.join(os.homedir(), ".codex"), "config.toml");
+}
+function escapeRe(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Why Codex cannot start unattended in `folder`, or undefined when it can. Reads `config.toml`
+ * as text: two table headers and one key are all it needs, and a TOML parser would be a new
+ * dependency for that.
+ */
+function codexLaunchProblem(folder, readConfig, 
+/** The MCP connection the prompt names (`baychat`, or `baychat-<bay>` on a computer with several). */
+entry = "baychat") {
+    const config = readConfig();
+    const server = new RegExp(`^\\s*\\[mcp_servers\\.(?:${escapeRe(entry)}|"${escapeRe(entry)}")\\]\\s*$`, "m");
+    if (!config || !server.test(config))
+        return "RUNTIME_NOT_CONNECTED";
+    // `[projects."/path"]` (or single-quoted) followed, before the next table, by trust_level = "trusted".
+    const table = new RegExp(`^\\s*\\[projects\\.(?:"${escapeRe(folder)}"|'${escapeRe(folder)}')\\]\\s*$([^\\[]*)`, "m");
+    const body = table.exec(config)?.[1] ?? "";
+    return /^\s*trust_level\s*=\s*["']trusted["']/m.test(body) ? undefined : "FOLDER_NOT_TRUSTED";
+}
+function readCodexConfig(env = process.env) {
+    try {
+        return fs.readFileSync(codexConfigPath(env), "utf8");
+    }
+    catch {
+        return null;
+    }
+}